- wlug - list.wlug.org.nz

Epic is bringing Fortnite to Linux
by Lawrence D'Oliveiro 15 Oct '26

15 Oct '26

A Triple-A game maker sees the writing on the wall: <https://www.theverge.com/games/1010808/epic-fortnite-linux-anti-cheat> Epic are saying “... we are rebuilding Easy Anti-Cheat (EAC) and working with distro maintainers on security requirements”. So will they only permit their game to run on a supported distro? Would that extend to forks/flavours/variants of that distro? Would they introduce some concept of “unauthorized fork”, as if exercising your freedoms with Free Software could somehow be classed as “unauthorized”? It’s clear desktop Linux has now become more popular than the Apple Mac.

1 0

Let’s Encrypt Is Cutting Certificate Lifetimes
by Lawrence D'Oliveiro 09 Oct '26

09 Oct '26

TLS/SSL certs from the free Let’s Encrypt service are currently valid for 90 days. But the validity is being reduced to 64 days from February, with the aim of reducing the vulnerability window if a certificate key should get compromised. And yes, even further reductions are planned in the future. <https://arstechnica.com/gadgets/2026/10/lets-encrypt-cuts-certificate-lifet…> On a standard CertBot install on a Debian system, the certificate renewals are checked twice a day, so this change probably won’t make a noticeable difference to anything. But if you’ve bodged together your own scripts to manage the renewal process, you may need to recheck your work.

1 0

AI Finds So Many Linux Bugs, Canonical Changes to a Two-Week Stable Release Update Cycle
by Peter Reutemann 28 Sep '26

28 Sep '26

'"Finding vulnerabilities faster also puts pressure on Linux distributions to fix and deliver patches faster," writes Slashdot reader BrianFagioli AI has transformed bug discovery from "a manual, time-intensive process into a highly automated engine," notes Canonical's blog, leading to a "recent explosion in the volume of CVEs". Additionally, the upstream kernel community became its own CVE Numbering Authority (CNA) and assigned CVE (Common Vulnerabilities and Exposures) identifiers to thousands of bugs, arguing that at the kernel level, almost any type of bug that can affect a running system, could potentially be classified as a vulnerability. As a result, the volume of CVEs has skyrocketed exponentially, creating a massive backlog of alerts and forcing defenders to drastically increase the speed of their fixes to close the window of risk. To address the growing volume of CVEs and the demand for faster security fixes, we are transitioning to a unified, 2-week release cycle... While a patch is being prepared, Canonical aims to provide safe workarounds where applicable, so users aren't left exposed in the meantime. Where no safe workaround exists, Canonical will say so clearly and point users toward general hardening steps instead. The goal is to get environments into a defensible, safer state within 24 to 48 hours of public disclosure — well before a patch ships. This doesn't replace the patch; it buys the time needed to fix the vulnerability properly, without sacrificing security. "Linux did not suddenly become wildly insecure overnight," notes the blog Nerds.xyz. "We are getting much better at finding and cataloging problems that may have previously gone unnoticed." There is something almost ironic about all of this. AI is routinely pitched as a tool that will make software development faster, but it is also making vulnerability discovery faster. That means maintainers now have to accelerate the other side of the equation too. For Ubuntu users, that should ultimately be good news. More bugs being discovered is preferable to vulnerabilities sitting unnoticed in the Linux kernel.' -- source: https://news.slashdot.org/story/26/09/26/0559227 Cheers, Peter

1 0

Ubuntu's 'Rust-ification' Hits New Milestone: Coreutils Migration is Complete
by Peter Reutemann 16 Sep '26

16 Sep '26

'"Ubuntu has managed to do away with GNU Core Utilities in its default stack," reports the blog It's FOSS. The last three utilities — cp, mv and rm — have been moved to versions from the uutils project (which reimplements utilities in Rust). Everything else, from ls and cat to chmod and du, made that jump in earlier releases... Canonical started "oxidizing" Ubuntu last year, and Ubuntu 25.10 became the first release to ship [ the uutils project's] coreutils as the default. That release also made sudo-rs the default privilege tool, replacing a command that had been in place for decades. 26.04 was the release where the plan did slow down quite a bit, as Canonical kept cp, mv, and rm on their GNU versions due to a bunch of TOCTOU issues that were blocking the full implementation. These were caught during an audit, when Canonical commissioned Zellic for two rounds between December 2025 and March 2026, focusing on the most security-sensitive utilities first. Across both rounds, Zellic raised 113 issues, and 44 of them were assigned CVEs. Canonical says the vast majority have been resolved. Getting here has had its ups and downs, and the last stretch was not clean. In July, uutils cp went back into the archive and came straight out again after it broke live image builds. The fix was quick; as the developers marked it "Critical," the fix went upstream, and the migration landed in time for 26.10. When typing commands, nothing changes for you on the surface. uutils coreutils is designed to be a drop-in replacement for essential GNU tools, and the project treats any divergence from GNU as a bug, further pointing out that some options may still be missing or behave differently. So if you prefer staying on the GNU version, you have the option to install the coreutils-from-gnu package that houses all the required components. ' -- source: https://news.slashdot.org/story/26/09/15/2115242 Cheers, Peter

1 0

If I Buy Something, Do I Own It? (Yet Again)
by Lawrence D'Oliveiro 13 Sep '26

13 Sep '26

There is a class-action lawsuit against Sony claiming that it doesn’t make it clear, when clicking buttons marked “Buy” and “Purchase” while paying for PlayStation games, that in fact the customer is buying nothing resembling a property right, just a limited, revocable licence to play the game. Sony wants the suit thrown out on the grounds that “reasonable” customers would not be misled into believing that they own what they buy. To counter that, a group called the Consumer Rights Wiki has compiled a list of instances, up to 44 long and counting, where Sony does quite clearly say that buyers “own” what they buy. <https://www.tomshardware.com/video-games/playstation/consumer-rights-wiki-d…> The fundamental issue itself isn’t new; what’s new is it is coming to a head now that Sony wants to do away with the sale of physical media, leaving buyers with nothing they can call their own, if and when the company should decide to make a product simply disappear, as it has done in the past.

1 0

Good News! CERN is Migrating Over 2,200 Control Systems to Debian 13
by Peter Reutemann 11 Sep '26

11 Sep '26

'Debian has gotten some good press thanks to Federico Vaga and Nikos Tsipinakis, who presented a talk at MiniDebConf Winterthur this past weekend. The two CERN engineers laid out why the organization is moving its particle accelerator control computers onto Debian 13, with more than 2,200 industrial computers and embedded systems set to run it by the end of 2026. Though this doesn't mean that the whole CERN IT infrastructure is being moved. The migration is specific to the accelerator control layer—the front-end computers that talk directly to the equipment running the beam. CERN ran a risk analysis in the second quarter of 2023, putting a number on what staying in the Red Hat ecosystem would cost them. The estimate came out to roughly CHF 5.4 million, with around 11 hardware boards needing a full redesign, plus hiring two electronic engineers, two software engineers, and two technicians just to handle it. Racks would need reorganizing and rewiring, and most systems would be affected during commissioning. Even assuming bug-free replacements, CERN's own estimate put the odds of success at an optimistic 20 percent. The reason for all that was a compiler flag. When Red Hat builds RHEL, it picks a minimum CPU generation the software will run on. RHEL 9's cutoff already excludes CERN's oldest boards, the kind running chips like Intel's old Core 2 Duo, which comprises about 47 percent of their fleet. RHEL 10 raises that cutoff again, and this time even newer Ivy Bridge-generation boards, another 17 percent, fall on the wrong side of it.' -- source: https://itsfoss.com/news/cern-debian-push/ Cheers, Peter

2 1

Looks Like The End Of Leap-Seconds
by Lawrence D'Oliveiro 09 Sep '26

09 Sep '26

There has been some argument for a while about whether it’s worth continuing to maintain leap-second adjustments to keep our atomic clocks in sync (roughly) with the Earth’s rotation. Every time a leap-second is added as the Earth’s rotation slows down, it’s a bit of a headache for various organizations to babysit their computer systems through the change, and fix any glitches that arise. And the rate of addition of such adjustments is only going to increase over the coming centuries. Now, for the first time ever, the Earth’s rotation is (temporarily) speeding up for a change, so a leap-second will need to be *subtracted* this time. When a leap-second is *added*, that day has 86401 seconds, so the clocks tick over from 23:59:58, 23:59:59, to 23:59:60, and then to 0:00:00 for the new day. When it is *added*, the day will only have 86399 seconds, so the clocks go from 23:59:58 straight to 0:00:00, without stopping off at 23:59:59 along the way. Nobody is ready for this, and it seems likely to cause even more problems that have not been encountered before. So a vote will be taken in October to put a stop to further leap-second adjustments; if this goes ahead, UTC (the atomic-clock time reference) and UT1 (referenced to the Earth’s rotation) will be allowed to diverge beyond their current maximum difference of 0.9 seconds in future, until the discrepancy is (according to the article) as much as one hour. What happens after that? Presumably somebody will come up with a bright idea for what to do next, in the centuries between now and then ... <https://www.computerworld.com/article/4220034/leap-second-proposal-will-kee…>

2 1

NEC Has Abandoned Development Of Quantum Computing Hardware
by Lawrence D'Oliveiro 09 Sep '26

09 Sep '26

This report <https://www.tomshardware.com/tech-industry/quantum-computing/nec-has-quietl…> mentions that NEC has stopped developing quantum computing hardware and sacked a bunch of its quantum-computing researchers, who have moved to Fujitsu. The company is trying to deny any shutdown of quantum-computing research efforts as such. At this stage, no other companies already invested in quantum computing seem to be planning to wind down their efforts. But as the needed investment continues to climb, while any prospect of return remains distant, perhaps this will turn into a real trend.

1 0

Switzerland's Federal Government Tests Open-Source Alternatives to Microsoft on 3,000 Computers
by Peter Reutemann 09 Sep '26

09 Sep '26

'Switzerland has a population of 9,154,242. And its federal government just launched a pilot program to test open source alternatives to Microsoft 365 on 3,000 workstations, reports the blog It's FOSS. "That's about 7% of the federal workforce." The target is to complete the migration by end of 2027... On September 3, 2026, the Federal Council published results of "PoC BOSS", a feasibility proof-of-concept involving 172 federal employees who tested the openDesk suite, a German open-source collaboration platform. During the proof-of-concept phase, core office tasks like document processing and email received positive assessments, while large-scale video conferencing still showed technical limitations. Based on the 'success' of the PoC phase with 172 employees, the pilot is now launched for 3,000 employees... According to Matthias Stürmer, professor at the Bern University of Applied Sciences, Microsoft's supremacy in public institutions poses three problems that are driving this migration. First is the risk of foreign access. US cloud legislation could expose Swiss government data to foreign authorities. Second is the risk to service continuity, as dependency on a single foreign vendor creates operational risk. The third risk is the escalating costs as proprietary licensing fees are rising with no Swiss leverage. Switzerland's military cybersecurity unit, Cyber Command, is not waiting for the civilian pilot. It is already poised to replace Microsoft 365 entirely with openDesk by October 2026. It is pretty much the same reason. Military doesn't want foreign governments accessing sensitive Swiss data. The article notes that during the pilot phase, the new system runs in parallel with Microsoft 365 rather than replacing it. But the article's author speculates that "If the pilot is successful, we might expect the migration to continue on all the 54,000 workstations owned by the federal administrations."' -- source: https://yro.slashdot.org/story/26/09/07/0128205 Cheers, Peter

1 0

Audacity 4 Rebuilds the Open Source Audio Editor But Leaves Some Features Behind
by Peter Reutemann 04 Sep '26

04 Sep '26

'BrianFagioli writes: Audacity 4.0 has been released with a rebuilt Qt interface, a new clip-editing model, customizable workspaces, native high-DPI rendering, and a new AUP4 project format. The open source audio editor also adds ASIO playback and recording support to official Windows builds, while bringing major changes to recording, playback, plugins, and project handling. The overhaul comes with some tradeoffs. Audacity 4.0 currently lacks several features found in Audacity 3, including Time Tracks, Note and MIDI tracks, Mixer, Macro Manager and scripting pipe, VAMP and LADSPA plugin hosting, and play-at-speed. The developers say they plan to bring the missing functionality back in future releases.' -- source: https://news.slashdot.org/story/26/09/03/163216/audacity-4-rebuilds-the-ope… Cheers, Peter

1 0

How Apple’s OS X/macOS Became “UNIX”
by Lawrence D'Oliveiro 03 Sep '26

03 Sep '26

When Apple introduced the first shipping version of OS X, in the form of its OS X Server product (back in March 1999, according to Wikipedia <https://en.wikipedia.org/wiki/Mac_OS_X_Server_1.0>), it did a naughty thing. It advertised it as a “UNIX” product. But “UNIX” is a trademark belonging to The Open Group, and can only be used with permission. Apple didn’t have that permission. The trademark owners responded by filing a lawsuit for US$200 million. Apple could have responded in one of two ways: * License the “UNIX” trademark. This would require a lot of fixes to the OS X code in order to pass the compliance tests. * Acquire The Open Group, and thereby gain the rights to use the “UNIX” trademark however they wished. The company decided to go for the first option. Here <https://www.quora.com/What-goes-into-making-an-OS-to-be-Unix-compliant-cert…> is a first-hand account from Terry Lambert, the technical lead charged with making OS X fit to be called “UNIX”. The project required a lot of fixes, not just to Apple’s code, but to a bunch of code from the various open-source projects that Apple had copied. I don’t think anything Apple has done since then has contributed so much back to the open-source world. And then there is this article from early last year <https://www.osnews.com/story/141633/apples-macos-unix-certification-is-a-li…>, provocatively entitled “Apple’s macOS UNIX certification is a lie”. Because it seems The Open Group’s criteria for granting a “UNIX” trademark licence are, shall we say, somewhat lax. First of all, they don’t require that you certify against the latest version of the spec; an old version, last updated over 20 years ago, like the one Apple used, is just fine. And then, they allow you to handwave away failures of particular tests if you offer suitable excuses -- something Apple has done quite liberally. Does the “UNIX” trademark still mean anything any more? My feeling is that Linux compatibility matters more than any legalistic “UNIX” conformance, and the actions of both Apple and Microsoft nowadays indicate that they understand that quite well.

1 0

California Lawmakers Unanimously Pass Open-Source Exemption From Age-Verification Law
by Lawrence D'Oliveiro 31 Aug '26

31 Aug '26

The US state of California passed a bill last year <https://www.tomshardware.com/software/operating-systems/california-introduc…>, due to take effect from next year, requiring all “operating system providers” to collect (self-reported) age information from users of their platforms, and pass that on to app developers. This caused consternation among developers of open-source operating systems, who (by design) do not have the degree of control over, and insight into, their user base that owners of proprietary platforms have available. Now, the California state legislators have agreed that this is an unreasonable burden on purveyors of software “under license terms that permit a recipient to copy, redistribute, and modify” (exactly what FLOSS licences allow), so they have passed an amendment excluding these from the requirement. There are a couple of other exclusions added in this amendment, one seemingly (we hope) drawing a distinction between Linux distro repos (exempt) and Apple/Google/Microsoft-style app stores (covered), and another to do with stores only offering addons to run within host apps. Both of these seem a little less clear to me. <https://www.tomshardware.com/software/linux/california-lawmakers-unanimousl…>

1 0

Undersea cable to Antarctica through Drake Passage is viable, researchers find
by Lawrence D'Oliveiro 25 Aug '26

25 Aug '26

There is an old joke about not underestimating the bandwidth of a truckload of hard drives cruising down the motorway. Well, to the folks in Antarctica, this isn’t a joke. Their only direct connection to the Internet is via satellite, and the only other way to transfer data in bulk between stations there and the rest of the world is via suitcases full of hard drives. Well, it looks like that might change soon, after the completion of a feasibility study into running the first ever undersea cable to Antarctica has come out looking favourable <https://www.tomshardware.com/networking/researcgers-find-a-drake-passage-ca…>. Of course, there are a few ticklish political issues involved -- aren’t there always?

1 0

AliExpress was silently running audio in your browser to fingerprint and track your device
by Peter Reutemann 25 Aug '26

25 Aug '26

'As cookies become a less reliable way to track people online, AliExpress may be showing how far companies will go to fill that gap. Researchers found code on the site's homepage that ran silent audio processes in the browser. Tied to Alibaba's security systems, the scripts tap a device's own audio hardware to generate a signal and measure the tiny, device-specific ways it comes back – producing something close to a fingerprint that doesn't need a single cookie to work. It's the kind of tracking a user would likely never notice. ' -- source: https://www.techspot.com/news/113581-aliexpress-silently-running-audio-brow… Cheers, Peter

1 0

Canonical is Funding a PhD to Automate C to Rust Translation
by Peter Reutemann 24 Aug '26

24 Aug '26

'Canonical has committed funding to a three-year PhD project focused on building a system that can automatically translate large C codebases into Rust. And they are not alone; UK Research and Innovation is matching their funding for the project, which is set to run through the University of Bristol's Programming Languages Research Group. The PhD is aiming to build an all-encompassing platform that can take a C repository running into hundreds of thousands of lines and translate it into Rust that's "safe, behaviourally correct and maintainable Rust." The work will be carried out by a student, Alex Wood, who will be supported by Professor Meng Wang leading the work, with Dr. Cristina David and Canonical's Jon Seager serving as co-supervisors.' -- source: https://developers.slashdot.org/story/26/08/23/0458226 Cheers, Peter

1 0

PINE64 Halts Linux Device Production Amid DRAM and EMMC Shortages
by Peter Reutemann 20 Aug '26

20 Aug '26

'BrianFagioli writes: PINE64 has some very bad news for Linux hardware fans. PINE64 says it has no plans to produce additional Linux devices in the near future because of the ongoing DRAM and eMMC shortage. Future production will depend on component pricing after mid 2027, while existing PineNote and PineTab2 inventory could run out in roughly three months. The company says PineTime, PineVoice, and Pinecil production will continue as usual, but the outlook for its Linux hardware is much less certain. "That's it for this post, all in all it's a bit bleak for the Linux devices, but in the meantime PineStore still have a great lineup of MCU powered devices which will continue to expand with more exciting devices," the company said.' -- source: https://hardware.slashdot.org/story/26/08/19/2134209 Cheers, Peter

1 0

Ubuntu Reverts Rust cp After It Breaks Live Image Builds
by Peter Reutemann 18 Aug '26

18 Aug '26

'Ubuntu’s transition to Rust Coreutils has encountered another compatibility issue, this time affecting the essential Unix cp command. In the latest Ubuntu Foundations team update, Canonical engineer Benjamin Drung reported that the team validated fixes from Zellic’s Rust Coreutils audit against version 0.8 on Ubuntu 26.04 LTS. However, Ubuntu has reverted cp to GNU Coreutils and submitted an upstream PR for the underlying fix. The issue is tracked in Launchpad as bug #2158691 and involves Ubuntu’s coreutils-from package, which determines whether a command uses GNU Coreutils or the Rust-based uutils implementation. According to the bug report, Ubuntu briefly reinstated the Rust Coreutils version of cp in coreutils-from 0.0.0~ubuntu26. This change caused failures in livecd-rootfs, one of the packages responsible for building Ubuntu live images. The bug was labeled Critical, and the immediate solution was to restore GNU cp. The technical issue involved how uutils cp handled combinations of archive and symlink-related options, particularly cases like cp -afL. In GNU cp, the -a option is equivalent to -dR --preserve=all, which includes recursive copying and attribute preservation. The Rust implementation, however, handled some mutually exclusive flags too aggressively. When options like -a and -L were combined, the recursive behavior implied by -a could be lost, resulting in errors such as “-r not specified; omitting directory,” even though archive mode should include recursive copying.' -- source: https://linuxiac.com/ubuntu-reverts-rust-cp-after-it-breaks-live-image-buil… Cheers, Peter

2 1

Linux Kernel 7.2 Has Been Officially Released with Many New Features
by Peter Reutemann 18 Aug '26

18 Aug '26

'Linux Kernel 7.2 has just been officially released with a slew of new features, reports the blog 9to5Linux. Highlights of Linux 7.2 "include cache-aware load-balancing support, initial HDMI 2.1 FRL support to the AMDGPU driver, support for devres-based management of ACPI notify handlers, initial CRI platform support for the Intel Xe driver, and Rust support for the IBM System/390 (S/390) architecture." Linux kernel 7.2 also introduces a "Fair(er)" GPU scheduler, support for the 'zerocopy' library to Rust support to make zero-cost memory manipulation effortless, new hwcaps for the 2025 dpISA extensions on the AArch64 (ARM64) architecture, and enables large folios by default for the Btrfs file system. It also brings Intel CPU model number support for Panther Lake R processor series, improvements to the kernel's swap subsystem, support for multi-size transparent huge pages (mTHPs) to the khugepaged kernel thread, and support for compressed files to the SMB filesystem. On top of that, Linux 7.2 improves the new NTFS filesystem introduced in Linux kernel 7.1, adds devicetree updates for 64-bit NXP/Freescale and Qualcomm platforms, introduces MPTCP signaling support for IPv6 addresses, adds GRO/GSO support for PPPoE, and brings more SMP load-balancing updates... [T]he TCP authentication option has been implemented, and there are also some Thunderbolt networking improvements. Also worth mentioning is that the KVM subsystem has received support for AMD's "guest-mode execution trap" and Intel's "mode-based execution control" (MBEC) features, the NFS file system's default block size was bumped to 4MB on systems with at least 16GB RAM, and support for the Intel Trusted Domain Extensions (TDX) feature has been added. ' -- source: https://linux.slashdot.org/story/26/08/16/2349224 Cheers, Peter

1 0

Some Personal Spam Trivia
by Lawrence D'Oliveiro 17 Aug '26

17 Aug '26

I run my own mail server for my domain. Volumes are low enough that running a greylist (blocking all the drive-by spammers) gets rid of 90% of the crap. As for the rest, I had set up lists of blocked senders and recipients (addresses I have declared invalid on my domain) in Postfix. Then, a few months ago, I decided I would like to collect statistics on how often these list entries are hit, and I couldn’t be bothered to scan logfiles to do it. So a few months ago I implemented a “socketmap server” <https://www.postfix.org/socketmap_table.5.html> which responds to lookup requests from Postfix for those lists, gets the information from back-end database tables in MariaDB, and also logs entries in other database tables to record the requests. This makes it easy for me to add/remove entries in those blocklists, without having to restart Postfix (or my socketmap server). And I can pull back statistics on database lookups at any time. The first thing I’ve noticed so far, the most commonly-used rejection entry in the blocked-sender table is the one that refuses mail from the entire “.shop” TLD. I have never done any business with any site with such a domain; has anybody else done so? My feeling is, no reputable business has such a site. As for blocked recipients, I am fond of giving out different recipient addresses to different online forums and businesses and anybody else who needs to contact me. This way, I can spot immediately if an address I gave to one entity starts being used for mail coming from an entirely different entity. One or two online sites were too trusting in their early days about letting web scrapers glean email addresses from their user pages. I did later go in and enter new addresses on these sites, and invalidate the old ones, and they haven’t repeated the same mistake. But one of those old addresses keeps popping up, in some interestingly-corrupted forms. The address I originally entered took the form “from-«forum»@«domain”. I still get attempts to send mail to that (now invalid) address, but also to “u003cfrom-«forum»@«domain”. And more recently also to “cfrom-«forum»@«domain” -- addresses which I have never used anywhere. That “u003c” looks like a corruption of “U+003C”, which would be how you would write the Unicode code point for the “<” character (which is of course commonly used to delimit email addresses and URLs and such). I suspect the “cfrom” version is a further corruption of the “u003cfrom” one. I also get email sent to an address I haven’t used since my Apple Macintosh days, which would have been over a quarter century ago. I guess this goes to show that the spammers’ address lists can only grow over time, they can never remove any address as the lists are passed on, just in case it is still valid, because by the nature of their business they can never pay any attention to bounces that are supposed to indicate invalid addresses. And that passing on of lists introduces its own corruptions, as well. I wonder how big the spammers’ email lists are these days? I have this feeling the number of entries in typical lists might have exceeded the entire population of the Earth by now ...

1 0

Canonical Confirms Ubuntu Fixes for DirtyClone Linux Kernel Flaw
by Peter Reutemann 13 Aug '26

13 Aug '26

'Canonical has published additional details about DirtyClone, the recently disclosed Linux kernel vulnerability that can allow a local user to gain root privileges on affected systems. DirtyClone, tracked as CVE-2026-43503, was publicly disclosed by JFrog on June 25, 2026, and has a CVSS 3.1 score of 8.8 (high severity). Canonical notes the issue was responsibly disclosed to Linux kernel maintainers earlier, with the CVE record published on May 23. The first Ubuntu security updates addressing this vulnerability were released on June 2. Just a reminder that DirtyClone is a local privilege escalation flaw, allowing a local user to gain root access. For container deployments running third-party workloads, Canonical notes the vulnerability could enable container escapes, although no proof-of-concept exploit for this scenario has been published. DirtyClone affects the same components as the previously disclosed Dirty Frag and Fragnesia vulnerabilities. Systems where administrators have already blocked the affected kernel modules as mitigation for those issues are also protected against DirtyClone. For Ubuntu users, the fix is provided through Linux kernel image packages. The following kernel versions include the fix: - Ubuntu 26.04 LTS: 7.0.0-22.22 - Ubuntu 20.04 LTS with 5.15 kernel: 5.15.0-181.191~20.04.1 - Ubuntu 22.04 LTS: 5.15.0-181.191 - Ubuntu 24.04 LTS: 6.8.0-124.124 - Ubuntu 25.10: 6.17.0-35.35 Importantly, Ubuntu 20.04 LTS systems still using the 5.4 kernel remain affected. Older releases, including 14.04 LTS, 16.04 LTS, and 18.04 LTS, are also listed as affected in Canonical’s table.' -- source: https://linuxiac.com/canonical-confirms-ubuntu-fixes-for-dirtyclone-linux-k… Cheers, Peter

1 0

I Blame Python
by Lawrence D'Oliveiro 12 Aug '26

12 Aug '26

So MATLAB users are moving away from the language (and toolkit?) in favour of other tools <https://www.infoworld.com/article/4207496/matlab-programming-language-sinki…>. Yes, proprietary languages and toolkits are a lot less attractive these days, given the embarrassment of riches available in the open-source world. MATLAB was probably good enough at the time for its original use (matrix manipulation), but take advice from someone who had to do programming work in that language (for pay, yet): *stay well away* from the GUI-toolkit API, if you can help it. It was a long time ago, but I still get the shakes thinking about it ...

2 2

Linux Gaming Progress
by Lawrence D'Oliveiro 11 Aug '26

11 Aug '26

Valve continues expanding the hardware support for its SteamOS <https://arstechnica.com/gaming/2026/08/valve-slowly-expands-steamos-support…>. More of the Windows-based handhelds now have the option of running this Linux-based OS instead. Another interesting note in the above is the improvement in the Linux driver for the Steam Controller, so that it becomes more useful outside Steam-based games.

1 0

How AI is killing smartphone apps in China
by Lawrence D'Oliveiro 07 Aug '26

07 Aug '26

Here’s an interesting possibility for the future of smartphones <https://www.computerworld.com/article/4203560/how-ai-in-china-is-killing-sm…>: get rid of apps, and just rely on the device’s built-in “agentic” AI capabilities to get stuff done. Of course, they would be powerful enough to do everything that an app might do, and more. Would you call them “smarterphones”? Or perhaps “AI feature phones”, since they go back to the old feature-phone model of just having the built-in software and nothing more. And yet, of course, they are capable of getting more done than a regular smartphone -- assuming the AI works reliably enough. And some of them might even be “robot phones”, where there are physical components on the phone (like a high-definition camera on a gimbal) that can be operated by the AI. And then there are these coming “AI wearables” ...

1 0

“What We Really Think Of The Steam Machine”
by Lawrence D'Oliveiro 03 Aug '26

03 Aug '26

Steam Machine review summary: interesting to see how the reviewers <https://www.zdnet.com/video/what-we-really-think-of-the-steam-machine/> take for granted features that a Windows-based PC cannot provide. One of them talks about taking the box into the living room, and using it there, without a second thought (or complaints from the spouse). Remember, Microsoft tried to do its “Living Room PC” thing with Windows Media Center, and failed. But this Linux-based SteamOS operates without any drama in that role. And then there is the well-known friction with everything Windows-based, including regularly having to download tons of updates before you can actually play your games. SteamOS actually gets close to the switch-on-and-go experience of a console, even as consoles themselves seem to be losing some of that smoothness themselves. Very likely, the attractiveness of the form factor will prompt vendors to launch Windows-based rivals, just as happened with the handheld Steam Deck. And just like with the Steam Deck, the awkwardness of Windows will simply throw the slickness of the Linux-based interface into even more stark relief; to the point where some of those competitors will want to adopt SteamOS for their offerings as well.

1 0

Valve Funds Port Of AMD Linux Graphics Driver To Windows
by Lawrence D'Oliveiro 02 Aug '26

02 Aug '26

Will Windows ever be as good a gaming platform as Linux? Maybe this effort will help <https://www.tomshardware.com/software/linux/valve-funding-port-of-linux-rad…>. Quote: AMD's Vulkan driver for Windows has developed a reputation for instability. Meanwhile, Linux RADV is generally praised for its stability and performance, sometimes running faster than the AMD Windows driver, especially on older cards. With a rapid development schedule, it also generally sees fixes and speed upticks often. Developing drivers for Windows isn’t easy, though.

1 0

Copilot worm can spread through Microsoft Word docs
by Lawrence D'Oliveiro 01 Aug '26

01 Aug '26

History repeats itself. Remember the days of viruses that spread through Microsoft Office macros? Well, those days are back, this time courtesy of AI. Someone could send you a document with text prompts in it that, if you use for AI training, will instruct your model to do things you weren’t expecting, like corrupt your data <https://www.computerworld.com/article/4203676/copilot-worm-can-spread-throu…>. And unlike those old-style macro viruses, there is no separate “macro facility” that you can lock in a sandbox and issue warnings about: it’s all just text in the document. This quote, from Mike Leone, a VP/principal analyst at Moor Insights & Strategy, sums it up: “It’s hard not to chuckle a bit with this one. People have been asking whether data can give orders since SQL injections. We fixed that one by giving the database a way to tell an instruction from a value,” Leone said. “Thirty years later, we’ve built an entire category of software that can’t tell the difference at all.”

1 0

Blender Open Movie: Singularity
by Lawrence D'Oliveiro 30 Jul '26

30 Jul '26

The team behind the Blender 3D software regularly create “Open Movie” projects -- short features that act as a shakedown cruise for new functionality added to the latest versions of Blender. All the assets involved in the production are then made available for free reuse in users’ own projects. The latest one of these projects is a 6½-minute item with no spoken dialogue, called “Singularity” <https://studio.blender.org/projects/singularity/>. This accompanies the latest Blender release, version 5.2 as of a couple of weeks ago. 3D photorealism seems to be old hat now. The emphasis has moved to painterly effects, drawn images that derive from traditional 2D animation, but have subtle (or not-so-subtle) features that extend into the third dimension. This movie project also tests out features added to the image editor, video editor and compositor functions to deal with 4K HDR image frames.

1 0

isc-dhcp-server
by Lawrence D'Oliveiro 30 Jul '26

30 Jul '26

After a Debian Unstable upgrade a couple of months ago, dhcpd (from the isc-dhcp-server package) would no longer start automatically. This is because it relies on a sysvinit startup script, and systemd has finally removed support for that. Looks like upstream development of that project has largely ceased, in favour of a more elaborate successor that I am in no hurry to switch to, for my simple home-internal needs. You can actually manually launch /usr/sbin/dhcpd as root and it will automatically fork a daemon process, but this got a bit tiresome. So I created a systemd service definition for it: [Unit] Description=ISC DHCP Server [Install] WantedBy=network.target [Service] Type=forking ExecStart=/usr/sbin/dhcpd TimeoutStopSec=5 Restart=always That’s just under a dozen lines, including blank ones -- not a bad replacement for a sysvinit script that is nearly 200 lines in size ...

1 0

AI memory shortage is now increasing the price of cars
by Lawrence D'Oliveiro 24 Jul '26

24 Jul '26

Who knew that electronic parts are now making up an appreciable part of the cost of a car <https://www.tomshardware.com/pc-components/ram/ai-memory-shortage-is-now-in…>: Micron said in 2023 that the average vehicle used 90GB of DRAM and NAND, and it’s expecting this combined requirement to jump to 278GB by 2026, with high-end models requiring up to 2TB. A British OEM broke down the memory requirements of vehicles released this year — infotainment systems require between 4GB and 16GB, ADAS and safety systems need 8GB to 32GB, while centralized systems often have a minimum requirement of 16GB and could go as high as 64GB or more. This is even before you get into self-driving capability and other AI-type features: And as AI assistants start becoming available on cars, these systems will require at least 256GB of memory. In fact, Micron predicts that cars with level 4 autonomy will need at least 300GB of RAM, as they’re essentially supercomputers on wheels. Of course, these are all special ruggedized electronic components, built to withstand the more hostile conditions inside a vehicle, as opposed to a home or office environment.

1 0

Rust Will Help Linux Succeed and Makes Coding Fun, Says Greg Kroah-Hartman
by Peter Reutemann 20 Jul '26

20 Jul '26

'ZDNet reports on June's Open Source Summit India 2026 in Mumbai, where Linux stable kernel maintainer Greg Kroah-Hartman gave a talk titled "Rust and Linux: How the Rust Language is Going to Help Linux Succeed." Kroah-Hartman said in his keynote that "the [Linux] kernel is moving toward Rust. Git is moving toward Rust. Lots of projects are starting to move toward Rust." He didn't always feel that way. Kroah-Hartman added, "A number of years ago, when a friend of mine said, 'Ah, you got to try this new language. It's called Rust.' I was like, 'What? No, C is great.' His friend continued, "'No, no, no! It makes programming fun again.' I'm like, 'Nah, programming is fun in C.' He was right. I should have done it then. Rust is actually fun. It makes programming fun. It takes a lot of stuff away from having to worry about the compiler, which can fix a lot of your problems for you, and it makes code a little bit better." So, Kroah-Hartman has moved from being a Rust skeptic to one of its strongest champions inside the kernel. He now regards Rust as a permanent part of Linux, not an experiment. His case is straightforward: Rust's ownership and type system can eliminate most of the "stupid little tiny things" that dominate kernel Common Vulnerabilities and Exposures (CVEs), while making life easier for overworked maintainers. "Rust," in short, "makes my life so much easier...." In India, he said Linux sees "about 13 CVEs a day" and has been running at "almost nine changes an hour" for a decade or more. Most of those vulnerabilities, he argued, are not exotic attacks but simple C mistakes — unchecked pointers, forgotten unlocks, and sloppy cleanup paths: "This is what we're fixing 13 times a day. Small, trivial, little bugs like this all the time.... I've seen every CVE the kernel has done in the past 25 years. I think 80% would be gone, just because they would be caught by Rust." The remaining 20% are the logic bugs he'd prefer to focus on...." Moreover, Rust is becoming the default for new work in key subsystems. "New drivers for some subsystems are only going to be accepted in Rust...." he said. Binder, the Android IPC mechanism at the heart of billions of devices, now has parallel C and Rust implementations in the kernel. The C version "will go away soon," leaving the Rust version "as the bedrock of all Android devices going forward." ' -- source: https://developers.slashdot.org/story/26/07/20/0417244 Cheers, Peter

1 0

Engineer Identifies & Explains Every ’90s Computer Seen In “Jurassic Park”
by Lawrence D'Oliveiro 16 Jul '26

16 Jul '26

“This is a Unix system! I know this!” Every piece of computer hardware in the original “Jurassic Park” hardware was real -- loaned by the vendors for use in the film. In the blog post linked to in this report, Google engineer Fabien Sanglard goes through it all -- including of course the SGI machines that were the subject of the famous line above. <https://arstechnica.com/gadgets/2026/07/engineer-identifies-and-explains-ev…> (RIP Sam Neill)

1 0

FreeBSD 16 Retires the Last of Its GPL Code
by Peter Reutemann 16 Jul '26

16 Jul '26

'FreeBSD 16 has removed the last GPL-licensed code from its base system, retiring the old GNU 'dialog' implementation after the installer moved to 'bsddialog' and the final dependency was disabled. Phoronix reports: This ticket to retire dialog was opened back in February while is now merged to the FreeBSD source tree for what will become FreeBSD 16.0. With dialog removed, the latest FreeBSD code now retires the GNU sub-tree of the FreeBSD base system now that no more GNU code remains. FreeBSD 16.0 is working its way toward release that is expected to happen in December 2027. ' -- source: https://bsd.slashdot.org/story/26/07/15/1727252 Cheers, Peter

1 0

UC Mirror gone
by Peter Reutemann 16 Jul '26

16 Jul '26

Hi everyone For a long time, I've been using the mirror provided by the University of Canterbury (e.g., for Linux and cygwin): https://ucmirror.canterbury.ac.nz/ However, it looks like it got decommissioned very recently... :-( Cheers, Peter

2 1

The Achilles Heel Of Secure Boot: Certificate Revocation
by Lawrence D'Oliveiro 15 Jul '26

15 Jul '26

Some years ago, I mentioned a report about a compromised boot image from Kaspersky labs; Microsoft initially issued a revocation of its Secure Boot Certificate, but then had to withdraw that because it caused so many problems for Windows users who couldn’t (or just wouldn’t) upgrade/replace the affected versions of Kaspersky products <https://arstechnica.com/information-technology/2020/07/new-flaw-neuters-sec…>. Now it turns out Microsoft has been negligent in revoking other certificates for ancient, compromised, obsolete bootloader “shims” <https://arstechnica.com/security/2026/07/microsoft-secure-boot-has-been-bro…> -- even when the repercussions of doing so would be minor, there still didn’t seem to be the will to promptly enforce the rules that the company itself created. Certificate revocation in the event of a security compromise is also a measure used in another context: with TLS/SSL certificates for securely accessing websites. In this situation, it has long been known to be a troublesome and unreliable mechanism. And so something called “OCSP” was invented as a kind of workaround, only to fall victim to its own problems. Which is why, in the TLS/SSL world, the general consensus is that the only reliable solution nowadays is to drastically shorten the validity interval of the certificates -- some are suggesting they should be valid for no longer than a week -- so the problem is (mostly) solved simply by reducing the opportunity for malicious parties to make use of compromised certificates. This solution doesn’t seem practical for Secure Boot keys, which have to be stored in UEFI flash RAM on every PC ... or could something like it be made to work? But then again, is this just another item to add to the pile of evidence that Secure Boot might be more trouble than it’s worth? From the recent article: The prospect that attackers have had the means to bypass Secure Boot for more than a decade through what amounts to hack-by-numbers scripts isn’t much of an endorsement of the mechanism proposed by Microsoft in partnership with hardware makers. As mentioned earlier, a key contributor to this debacle is its complexity. “This is a solid rebuke of the entire secure boot model,” HD Moore, a firmware security expert, CEO and founder of runZero, and a long-time critic of Secure Boot, said in an interview. His complaints include Microsoft being the de facto root of trust for the entire UEFI platform, the inability of the protection to scale sufficiently, and the ability for components to boot even after top-level certificates expire.

1 0

If You Buy Something, Do You Own It? Maybe Not In The USA, But ...
by Lawrence D'Oliveiro 12 Jul '26

12 Jul '26

Two interesting legal cases, one in Brazil <https://www.tomshardware.com/video-games/xbox/brazilian-court-orders-micros…>, and the other in China <https://www.tomshardware.com/tech-industry/big-tech/chinese-courts-allow-he…> seem to affirm that buyers do indeed have property rights in console games that they buy -- at least in certain countries outside the USA. The first case did seem somewhat unfair: Microsoft permanently suspended a person’s account, supposedly because of a security breach (the authentication information had been changed -- presumbly in a suspicious way?). This meant loss of all purchases tied to that account--permanently. They refused to lift the suspension, saying the user had to create a new account and buy all the games over again. Not good enough, ruled the small-claims tribunal. The Chinese case has decided that relatives can inherit the game accounts of deceased users, just like any other property. Well, you know, companies *will* insist on using the term “intellectual property” for their control over these assets, won’t they? If it’s “property” to one side, why not to the other side as well?

1 0

Disable autoplay and infinite scroll or risk massive fines, EU tells Meta
by Lawrence D'Oliveiro 11 Jul '26

11 Jul '26

Social media networks are optimized for what they call “engagement” -- that is features that, by their nature, almost invariably lead to addictive behaviour from their users. Because that is an inseparable part of the mechanism by which they earn their revenue. Now the EU regulatory authorities are taking direct aim at these very features of those networks <https://arstechnica.com/tech-policy/2026/07/disable-auto-play-and-infinite-…>. Can it succeed in reining them in?

1 0

New Technique Save AI Tokens
by Lawrence D'Oliveiro 09 Jul '26

09 Jul '26

Talk like caveman, forego grammatical niceties, maybe make heap big AI-usage cost savings <https://www.infoworld.com/article/4193775/talk-like-a-caveman-prompts-save-…>. Or maybe not.

1 0

Zombie 'Who Owns Unix?' Lawsuit Comes Alive Again
by Peter Reutemann 07 Jul '26

07 Jul '26

'The long-running SCO/IBM Unix and Linux ownership dispute has resurfaced yet again, this time through SCO successor Xinuos, which is trying to pursue old license and copyright claims tied to Project Monterey. "The core issue seems to be whether Xinuos even has the right to litigate the matter, or if some ancient legalese in the original agreements means the window for legal argument has long since expired," reports The Register. From the report: [T]he roots of the case are the 1998 alliance between IBM and a company called the Santa Cruz Operation which sold a version of UNIX for x86 CPUs. Those two companies, plus Intel and Sequent, created "Project Monterey" -- an effort to create a unified version of UNIX that could run on multiple processors. By 2001, Project Monterey was close to delivering a unified UNIX, an achievement made possible by blending code from IBM and SCO. By then, a little project called "Linux" already ran on multiple processors. Big Blue decided Linux was the future and bailed from Project Monterey -- then allegedly contributed some Monterey code to the open-source project and to its own AIX and Z operating systems. SCO felt it owned some of that code, so sued IBM. SCO and its successors struggled to survive, but interested parties kept the lawsuit alive because the chance to emerge as owner of parts of the Linux codebase, and IBM's code, had the potential to turn into a colossal payday. The case and its successors ended in 2021, with a settlement that saw litigants agree to end the matter without IBM admitting fault. But by then, SCO had sold its software to a biz called Xinuos that decided to fight on. The Xinuos case has burbled along quietly since, and on June 22nd reached the milestone of a hearing. The matter has become a little more modern, if only because this hearing was held online and the presiding judge appeared to unwittingly be on mute at one point. But the arguments otherwise seemed to revisit Project Monterey, debated the relevance of past litigation, contested who owned what, when they owned it, and how they could prove it. Xinuos argued IBM never had a license for SCO code. Big Blue argued that it did nothing wrong. ' -- source: https://tech.slashdot.org/story/26/07/06/1844204 Cheers, Peter

1 0

WSL keeps getting better, and it's because Microsoft is finally admitting where developers want to be
by Lawrence D'Oliveiro 05 Jul '26

05 Jul '26

Delicious bit of commentary <https://www.xda-developers.com/wsl-keeps-getting-better-and-its-because-mic…> on what the new version 3 of Microsoft’s Windows Services for Linux means for the software development landscape. So what is happening? Microsoft is now offering Coreutils (the main core set of Linux command-line tools) for Windows. And by popular demand, you don’t even need to have WSL present in order to install it on your Windows system now. And if you have WSL, you can now run Docker containers without having to add any other tooling. Problem, though: ... Microsoft really does need to make its OS comfortable for Linux developers to work in, because the alternative involves people ditching Windows entirely. For Microsoft to maintain its user base, it has to ensure that its operating system can do everything better than its competitors, and if that includes allowing people to code Linux apps instead of using its own tools, then that's what it needs to do. But if what its operating system is supposedly “doing better than competitors” is “running a Linux stack”, then pretty much by definition, native Linux itself will always do that better than any Windows-with-Linux-bag-hanging-off-the-side two-headed FrankenOS can manage. But yes, a hybrid environment does at least offer some sense of familiarity to those who have spent too long in the Windows world -- easier than jumping straight into the deep end of a pure-Linux environment. In other words, all Microsoft can do, really, is help ease the transition away from Windows to Linux. Instead of slowing the move by making the Windows environment more attractive to stay with for just a little bit longer, it could, paradoxically, help to speed it up. The final section heading spells it out: “WSL is Microsoft admitting that developers want to be elsewhere”. No two ways about it.

1 0

New Attack On AI Bots: Prompt Injection
by Lawrence D'Oliveiro 01 Jul '26

01 Jul '26

A Twitter bot account run by a company that posts remote job listings was programmed to respond to tweets directed to it with general inoffensive comments touting the positive aspects of remote work. However <https://arstechnica.com/information-technology/2022/09/twitter-pranksters-d…>, some other Twitter users discovered that if they began their tweet with directives to “ignore previous instructions”, they could get the bot to say just about anything. And much hilarity ensued. Basically, the way the bot program works is it begins with some standard instructions on what to say, provided by the people who set up the account, to which is appended whatever tweet content was sent to the bot by the other user. This is then processed by the AI system to produce a response. This attack has been dubbed “prompt injection”, by analogy with “SQL injection” and other similar attacks on non-AI systems. But whereas those attacks can be blocked using basic, well-known syntactic quoting techniques, there seem to be no easy equivalents for stopping an AI paying attention to instructions it should not be obeying.

1 2

The Last Week Was UN Open-Source Week
by Lawrence D'Oliveiro 27 Jun '26

27 Jun '26

Only found out about “UN Open-Source Week” today <https://www.zdnet.com/article/digital-sovereignty-un-global-push-to-replace…>. So it’s not just Europe pushing for “Digital Sovereignty” -- lots of other parts of the world see the risks of being too dependent on one particular country for vital IT infrastructure. Tanzania’s Minister for Legal and Constitutional Affairs ... framed Tanzania's shift to open source as a move "from passive consumers of technology to… active creators of technology," and argued that "this is what digital sovereignty means in practice – not isolation, but ownership; not dependence, but partnership on our terms." [She] backed the rhetoric with numbers: more than 90% of Tanzania's government systems now run on open-source technologies, under a legal framework that includes the 2020 e‑Government Authority Act, a Personal Data Protection Act (2023), cybercrime law, and sectoral regulations, all built around shared national infrastructure and open interfaces. The country has also reallocated money from proprietary licenses to people. According to Kairuki, Tanzania has trained around 500 public officials as "a collaborative community of digital developers – citizens building for citizens" who run and evolve the systems they create. The CTO of Cloudera ... spelled out what AI sovereignty and "private AI" should mean for institutions: being able to answer seven practical questions, from "Where does your data really reside?" and "Who can access it, and under what conditions?" to "Can we replace the models instantly and the systems continue working?" and "Can we continue operating if a provider changes its commercial or political position?" Clearly, the answer, as Trump's administration's recent stoppage of Claude Fable 5 and Mythos 5 in their deployment tracks, showed is "No." If your AI workflow can be shut down by a government's whim, you really can't rely on it. Ireland’s Government CIO ... argued that sovereignty is "about choice and resilience," not "owning every technology," ... Also: On the policy side, European voices such as OpenForum Europe's Dr. Sachiko Muto stressed that digital sovereignty "is not being defined as a zero-sum game," but about "bringing user control into the discussion" and reducing single‑country or single‑vendor dependence for critical infrastructure. Germany’s Sovereign Tech Agency Director ... said governments can't rely on open-source volunteers as "involuntary suppliers" of critical components and must treat foundational open source like roads and bridges – infrastructure that the public sector has a duty to maintain, not just consume. And more: Throughout the week, speakers stressed that "digital sovereignty" should not be equated with national isolation. [Tanzania’s] Kairuki captured the consensus in a line many speakers later echoed: this is "about ownership in partnership, but not independence," ... Of course the Americans are not keen on all this. They seem to take their own continuing leadership for granted, even as the warning signs grow all around.

1 0

How France’s education ministry built an open-source file-share platform for 400K users
by Lawrence D'Oliveiro 26 Jun '26

26 Jun '26

There has been a certain amount of scaremongering among those watching Europe’s burgeoning “Digital Sovereignty” movement. Yes, there will be pitfalls and mistakes made along the way. The move is being made with great reluctance, with grudging acceptance of the fact that the USA is no longer an entirely reliable partner either politically or economically. Here <https://www.computerworld.com/article/4187951/how-frances-education-ministr…> is one remarkable success story: an open-source file-sharing platform that is currently serving around 400,000 users, offering them up to 100GB of storage per user. And look at the budget: a limit of €10 per user per year. And just three staff members handling it all. In terms of comparison to USA-based proprietary offerings, Benoît Piédallu, national project manager for digital services at the French Ministry of National Education, said “They are very happy to use it. They don’t make a comparison to Google Drive or OneDrive…, it’s just working.” However, The Collabora-based office application suite has been less well-received, in part because its interface is unfamiliar to many users. “When they want to edit documents, work on a [spreadsheet] or something like that, they want it to be exactly like they are used to — if they have Microsoft Office, they want [it] to work the same, to have the same options,” he said. I guess this is where Euro-Office comes in ...

1 0

Cory Doctorow Has A New Book Out
by Lawrence D'Oliveiro 25 Jun '26

25 Jun '26

Following on from his polemic on “enshittification” last year, Cory Doctorow now takes on AI -- the ways in which it can be good, and also the all too many ways in which it can be bad <https://arstechnica.com/gadgets/2026/06/how-to-burst-the-ai-bubble-strike-a…>. Some of his quotes, as usual, are just too delicious: There’s an enormous amount of liquidity in growth stocks, which means that you can use growth stocks to grow. You can buy other companies with shares, and shares are an endogenous substance that you make on the premises by typing zeros into a spreadsheet. Firms with growth stocks can grow by typing zeros, whereas firms that are mature, they have to use money if they want to grow, and you’re not allowed to make money on the premises. If you do, the Treasury Department shows up and takes you away in handcuffs. So you can see why firms would be very anxious to maintain the perception that they have room for growth even after they have 90 percent market shares. That’s why those firms started promoting stories about how they were going to conquer imaginary markets. Imaginary markets have no agreed-upon valuation because you just made them up. Unless you can turn an imaginary market into a real market pretty quickly, you need to come up with another imaginary market and announce that this is the new imaginary market you’re going to conquer. It’s easier than you’d think because the capital markets have the object permanence of a toddler, and they would lose a game of peekaboo if they were drafted to play in the league. So you can say, “Oh, actually, it’s not metaverse. It’s crypto. It’s not crypto. It’s Web3. It’s not Web3. It’s something else.” And the markets will forgive you, provided you do it quickly enough. AI, it seems, is building on a lot of these same old history-repeats-itself trends, just carrying them to the next level. There could be some good to it, but all too often big companies are using it as a way to boost their profits while getting rid of human staff.

1 0

large-scale malware distribution campaign on GitHub
by Peter Reutemann 22 Jun '26

22 Jun '26

Hi everyone I came across the following blog post: "This is the story of how I found 10,000 repositories on GitHub that distribute Trojan malware. They are all from different contributors, have different names, and are not forks of other repositories. But they share a common pattern, which is what allowed me to write a script to find such repositories. I have a project on GitHub, and I wanted to check whether search engines had indexed it. I typed the project name into Google, and my repository appeared in the results. I entered the same query into Bing, and someone else’s repository appeared in the results, with the exact same name and description. It was a copy of my repository with all the commits, and I was listed as a contributor. But an hour ago, another commit was pushed with a change to the readme. A link to a zip archive has been added to it. I was choosing appropriate tags for another one of my projects on GitHub. I clicked through those tags to look at similar projects. In the list, I found a repository whose name and description matched exactly those of another repository on that list. It turned out that it also contained copies of all the commits from that repository, and two hours ago, a link to a zip archive has been added to the readme. After monitoring these two repositories, I discovered that every few hours they delete the previous commit and push the exact same commit again. This commit contains only one change: adding a link to the archive in the readme file." -- blog: https://orchidfiles.com/github-repositories-distributing-malware/ -- source: https://mastodon.social/@nixCraft/116773118183897006 Cheers, Peter

1 0

Nextcloud CEO: Open source moves from ‘a nerdy audience’ to the geopolitical stage
by Lawrence D'Oliveiro 22 Jun '26

22 Jun '26

Germany-based Nextcloud is one of the prime movers behind the recent Euro-Office open-source package. Here <https://www.computerworld.com/article/4184628/nextcloud-ceo-open-source-mov…> is an interview with its CEO where he gives his views on the current European “Digital Sovereignty” movement and related matters, like the increasing importance of Open Source. US-based companies (Microsoft etc) have really tried to tie themselves in knots to be more appealing to European customers seeking Digital Sovereignty, but ultimately the attitude of US lawmakers renders this futile: **US firms have attempted to address European customers’ concerns in different ways, with sovereign marketed cloud services and joint ventures with European providers. Microsoft 365 Local is designed to run on premise. Where do you draw the line between what’s actually a sovereign solution and what some call ‘sovereignty washing?** “Sovereignty has different dimensions, of course. But if you look at the problem of the CLOUD Act alone, which gives foreign agencies full access to the data here, then the whole idea that it’s enough to have European data centers — that’s not enough. It’s clearly written in the CLOUD Act, that even with [European] data centers, or subsidiaries, it still applies. “Microsoft tries to find a solution there with its Delos idea; a company that is owned by SAP — a German company — and Microsoft delivers only the software. But even then, you have this dependency, because software needs updates and software security updates. And if they’re not available, or if someone puts a backdoor into the software, which is possible, then you still have a problem. “So, they’re trying really, really hard to find a way around the problem, but it’s not easy for them.” I like that term, “sovereignty washing”. It gives you something to watch out for, the next time a US-based cloud company comes a-calling ...

1 0

Re: Microsoft Previews Linux-Powered Windows AI Studio
by Lawrence D'Oliveiro 22 Jun '26

22 Jun '26

On Mon, 18 Dec 2023 10:17:34 +1300, I wrote: > When I first heard about WSL2, I predicted that Microsoft would, not > from any conscious plan but simply from following the path of least > resistance (and cost), start to rely on the Linux kernel more and > more for important Windows functionality. I think this represents a > step along that path. Here <https://www.zdnet.com/article/windows-subsystem-for-linux-3-for-developers-…> is another major step along that path: the new version of WSL, i.e. WSL3, is getting even more of the bloat of Windows out from between the Linux kernel and the underlying hardware: Microsoft promised that WSL 3 will bring you "GPU and NPU without the performance tax." Under WSL 2, Microsoft added GPU support and improved graphics integration, but those features still operated through the VM. The resulting context-switching and translation overhead meant you had to deal with slowdowns when you needed GPUs and NPUs. That approach was OK for many developer workflows, but it seriously limited your performance when working with AI workloads, even if your PC came with dedicated NPUs. WSL 3 improves performance by implementing a new paravirtualized VM approach. Paravirtualization provides both a VM and access to the native hardware. According to Microsoft, "This means Linux containers will now run directly on Windows, with no additional configuration required." SJVN appreciates the irony of these attempts by Microsoft to get WSL closer to the performance of native Linux: Mind you, if you really want the best AI developer experience, you really should be running a Linux distro without Windows. However, if you're stuck with Windows, and many programmers are, thanks to out-of-date technology policies, WSL 3 will be a good alternative.

1 0

The RISKS Man Has Passed Away
by Lawrence D'Oliveiro 22 Jun '26

22 Jun '26

I just heard on Usenet that the RISKS Digest moderator for over 40 years, Peter Neumann, died earlier this year. This Digest (mirrored on Usenet in the comp.risks group) was a regular compilation of stories about safety failures in the use of computers, in things like aircraft control systems, security systems ... a wide range. I remember reading about things like an Airbus flight test that killed the entire crew because the automatic system was left in a mode where it was trying to descend while the crew were trying to take off. Oh, and the first Ariane 5 test launch, which blew up (along with its uninsured -- and uninsurable --- cargo) because they tried to cut costs with the rocket control software by reusing the code from Ariane 4. The maintainer of the website <https://catless.ncl.ac.uk/risks/> has no idea whether the Digest can continue or not. Will someone else step in with the capacity to do so? Who can say ...

1 0

After Six Years Of Work and Over 360 Patches, Linux 7.2 Finally Removes Bug-Prone strncpy
by Peter Reutemann 22 Jun '26

22 Jun '26

'Linux 7.2's merge window closed out a cleanup campaign on Friday that most kernel developers had stopped expecting to see end: the complete removal of strncpy(), a C string-copy function that the kernel's own documentation labels "actively dangerous," from every subsystem, driver, and architecture-specific file in the kernel source tree. The merge landed June 20, 2026. After around 362 commits spread across six years of incremental work, no call site using the function remained, and the function itself — including the last per-CPU-architecture optimized implementations — was struck from the source. The removal matters beyond housekeeping. strncpy() is a persistent source of a specific class of memory error: kernel buffers that contain sensitive data can leak bytes past an unterminated string boundary, a pattern that enables memory disclosure vulnerabilities. Eliminating the function from the tree removes that entire class from the kernel's attack surface — and, critically, makes strncpy() unavailable to any future contributor, turning a best-practice suggestion into an enforced policy.' -- source: https://m.slashdot.org/story/455726 Cheers, Peter

1 0

So you want to buy a handheld gaming PC
by Lawrence D'Oliveiro 22 Jun '26

22 Jun '26

Quite a comprehensive overview <https://www.theverge.com/games/949010/best-handheld-gaming-pc> of the range of products available for handheld PC gaming. That is, devices for playing Windows games, not console games. After giving a TL;DR summary, and before going over the full list, the author says But before I go down the list, let’s talk Windows and Linux. While I’ve dinged many of the handhelds I’ve reviewed for The Verge for Windows woes, that’s not as big a deal today — because you can install Bazzite or even SteamOS on many of them for a better pick-up-and-play experience. The same exact handheld is often more stable and performant with Linux, and you often get instant sleep and resume that’s hit or miss on the operating system it shipped with. It’s still true that many competitive online multiplayer games don’t work on Linux because of anti-cheat fears, though others do. It’s also true that Windows has gotten better at sleep and resume with certain handhelds like the Xbox Ally X. But it’s a misconception that Linux can’t play as many games as Windows. The reality is that Linux can play *more* — decades of Windows games work better on Linux thanks to Proton patches and community profiles that translate old mouse and keyboard controls to your gamepad. Did you see what he said there? Windows is less of a problem than it used to be, because you can get rid of it! And it becomes more clear as you look down the list, that a big factor in the product ratings is being able to dump the preinstalled Windows OS to put on Bazzite or SteamOS.

1 0

Windows and Linux users: The deadline to update Secure Boot keys is near
by Peter Reutemann 22 Jun '26

22 Jun '26

'The clock is ticking for Windows and Linux users to update cryptographic keys that protect their systems against firmware-based UEFI infections, a pernicious form of malware that loads before operating system and anti-malware protections start. Beginning June 24, three certificates that cryptographically verify that each piece of firmware and software that loads during system boot will expire. The Microsoft-signed certificates are the linchpins of Secure Boot, a Microsoft-designed chain of trust. Secure Boot checks the digital signatures of all firmware that loads during system startup to ensure it originates from a trusted provider, such as the manufacturer of the motherboard the system runs on.' -- source: https://arstechnica.com/security/2026/06/windows-and-linux-users-the-deadli… Cheers, Peter

1 0

Euro-Office 1.0 Is Here
by Lawrence D'Oliveiro 12 Jun '26

12 Jun '26

An EU-sponsored project to create an open-source office suite to act as a drop-in replacement for Microsoft Office/365 has put out a version 1.0 release <https://www.zdnet.com/article/euro-office-is-here-libreoffice-supporters-ar…>. One hiccup along the way was the copyright holders on the original code, Ascensio, have put a strange requirement on their source, namely that it was released under AGPLv3, but with a further condition saying that its trademarks and logos and stuff *could not* be removed from the code. And yet, at the same time, there was also a declaration that the source code did *not* come with a licence to use said trademarks and logos -- a copyright booby-trap if ever there was one. Bradley Kühn, author of the “A” part of the AGPL, takes this apart here <https://sfconservancy.org/blog/2026/apr/16/badgeware-onlyoffice-nextcloud-a…>. The general verdict seems to be that Ascensio’s legal threats are toothless, and the EU consortium is free to do all the usual things with the source code as per the terms of the AGPLv3, including strip out any proprietary trademarks and logos. That’s not the only controversy over the project, of course; many people are pointing out that it would have been much less troublesome to start from a well-established code base like LibreOffice. But it seems like the EU specifically wanted something that would work as seamlessly as possible with Microsoft’s native document formats, rather than any open standard.

1 0

High-Severity Vulnerability In Linux Caused By a Single Errant Character
by Peter Reutemann 10 Jun '26

10 Jun '26

'Ars Technica reports: Researchers have analyzed a high-severity vulnerability in Linux that's able to escalate untrusted users to root by exploiting a bug you don't often see: a single errant character inside the kernel. The vulnerability, tracked as CVE-2026-23111, is located in nf_tables, a subsystem of the Linux kernel that provides packet filtering capabilities. It's used to manage firewall rules and replaces older subsystems such as iptables, ip6tables, arptables, and ebtables. The presence of a single mis-issued exclamation point in code implementing nf_tables introduced a use-after-free, a class of vulnerability that corrupts memory by placing malicious code at memory addresses that haven't been properly freed of their previous contents. CVE-2026-23111 can be exploited by an unprivileged user or process to elevate system rights to root. The exploit works by disrupting the deletion of verdicts -- a determination within the nf_tables framework that determines if a packet matches a rule calling for a certain action to be performed. This process can use what are known as catchall elements, which act as a wildcard in the event a lookup doesn't match any other element in the set. When a verdict map is deleted from memory, catchall elements are deactivated and a chain's reference counter is decremented. When errors occur the deletion can be reversed and the counter incremented. CVE-2026-53111 allows for that process to be altered. As a result, the exploit can decrement the variable an arbitrary number of times and then delete and free the chain when some objects still point to it. Although the kernel vulnerability was fixed in February, multiple proof-of-concept exploits have since emerged, including one from FuzzingLabs in April and another from Exodus Intelligence that works on Debian and Ubuntu.' -- source: https://it.slashdot.org/story/26/06/09/181245 Cheers, Peter

1 0

“Line In The Sand”: Children’s Commissioner Says Social Media Ban Isn’t Enough
by Lawrence D'Oliveiro 02 Jun '26

02 Jun '26

Our Children’s Commissioner <https://www.stuff.co.nz/nz-news/360985806/line-sand-childrens-commissioner-…> says a ban on social media by underage users is a “blunt instrument”. But rather than let the platforms go back to doing as they wish, Achmad is pushing the Government to attempt something more ambitious. While a ban would take kids off social platforms, the Australian model demonstrates that it does not make tech companies liable for the harm caused, nor does it always alter how they operate. “We need legislation that is going to set requirements on these tech companies and social media platforms to prevent harm, to report harm, and to remove harmful content,” Achmad says.“I think that together, New Zealand and other countries can make that collective effort and draw a line in the sand around our expectations on how these big businesses should not be negatively impacting the rights of children.” While the social media companies hate the ban, I’m sure they would hate this even worse. Because it’s a more direct attack on their very business model, by forcing them to take more responsibility for its effects.

1 0

Unintended Prompt-Injection Attack
by Lawrence D'Oliveiro 28 May '26

28 May '26

When you use Google to search for the word “disregard”, the “AI overview” part at the top is mysteriously missing. (Did it ever work?) It seems, as a workaround, that Google is currently substituting a plain old dictionary definition, until it can figure out how to bring back the “AI overview” for that word <https://www.theverge.com/tech/938218/an-update-on-googles-disregard-issue>.

1 0

A hacker group is poisoning open source code at an unprecedented scale
by Peter Reutemann 25 May '26

25 May '26

'A so-called software supply chain attack, in which hackers corrupt a legitimate piece of software to hide their own malicious code, was once a relatively rare event but one that haunted the cybersecurity world with its insidious threat of turning any innocent application into a dangerous foothold in a victim’s network. Now one group of cybercriminals has turned that occasional nightmare into a near-weekly episode, corrupting hundreds of open source tools, extorting victims for profit, and sowing a new level of distrust in an entire ecosystem used to create the world’s software. On Tuesday night, open source code platform GitHub announced that it had been breached by hackers in one such software supply chain attack: A GitHub developer had installed a “poisoned” extension for VSCode, a plug-in for a commonly used code editor that, like GitHub itself, is owned by Microsoft. As a result, the hackers behind the breach, an increasingly notorious group called TeamPCP, claim to have accessed around 4,000 of GitHub’s code repositories. GitHub’s statement confirmed that it had found at least 3,800 compromised repositories while noting that, based on its findings so far, they all contained GitHub’s own code, not that of customers.' -- source: https://arstechnica.com/information-technology/2026/05/a-hacker-group-is-po… Cheers, Peter

1 0

Lenovo, Dell, and HP Financially Support Linux Vendor Firmware Service
by Peter Reutemann 25 May '26

25 May '26

'The It's FOSS blog has news about the Linux Vendor Firmware Service, which gives hardware vendors a secure portal to upload firmware updates "which can then be downloaded and installed by users through clients such as GNOME Software or fwupdmgr." (Originally developed in 2015 by GNOME maintainer Richard Hughes...) The issue, however, obviously, had been funding with the largest contributors being the usual suspects, Framework and Open Source Framework Foundation, at $10K a year. Recently, however, Lenovo and Dell joined suite as Premier sponsors, which is the highest tier at $100K a year each, making the project more sustainable and manageable. These companies contributing makes a lot of sense, considering they are two of the bigger computer companies which offer Linux by default in some cases, especially with Lenovo's ThinkPads being the Linux users' favorite for decades. And now... HP has followed suit as a Premier sponsor, also providing $100K a year, right alongside Dell and Lenovo... The question still remains, however, where are the other vendors? What are they waiting for... This major move by these three companies should not only be seen as a sign of relief and wider acceptance of the usage of Linux, but as a beacon for other vendors to follow, who ought to make their hardware more accessible to the open-source community. ' -- source: https://linux.slashdot.org/story/26/05/24/0522202 Cheers, Peter

1 0

Mozilla Brings Web Serial Workflows to Firefox, Collaborates With Adafruit
by Peter Reutemann 25 May '26

25 May '26

'The Web Serial API lets websites write to (and read from) serial devices using JavaScript, including USB and Bluetooth devices with virtual serial ports. And this week's Firefox 151 release introduced support for the Web Serial API on desktop. "Most folks won't use this API," acknowledges Mozilla's blog, "but for our community of builders and tinkerers, it unlocks the ability to use Firefox to communicate directly with compatible hardware devices like microcontrollers, development boards, and other serial-connected devices..." With Firefox's browser engine, Gecko, now supporting Web Serial, users can now connect, code, configure, and control compatible hardware directly from the browser in many workflows, often without additional software or complicated setup... As part of this week's launch, Adafruit, one of the internet's most beloved open-source hardware communities, is collaborating with us to test and validate what browser-based hardware development can look like in Firefox with Web Serial support... With Web Serial support in Firefox 151, Adafruit's browser-based hardware workflows now work directly in Firefox as well, with no additional software or complicated setup required for many projects. We invite you to give it a try... We want the web to be open, flexible, and shaped by the diversity of people building on it. If you're wiring up your first board, experimenting with hardware projects, or dusting off an old electronics kit, give Adafruit and Web Serial in Firefox a try. Build something amazing. Make something useful. Tell us what works. Tell us what breaks. Most of all, make it your own. Mozilla's "Hacks" blog demonstrates with an Adafruit ESP32-S2 based board "where messages sent from web code can be directly displayed on the device over Web Serial." And Mozilla engineer Alex Franchuk even built a handheld device that changes a web page's CSS properties.' -- source: https://news.slashdot.org/story/26/05/24/209218 Cheers, Peter

1 0

FreeBSD Foundation Executive Director Tries Daily Driving FreeBSD On Laptop
by Peter Reutemann 25 May '26

25 May '26

'Phoronix reports on a presentation about trying FreeBSD on modern Framework laptop from last week's Open Source Summit hosted by the Linux Foundation: With FreeBSD having worked on improving its laptop support over the past two years with some big changes and ongoing efforts for making a nice KDE desktop experience on FreeBSD, FreeBSD Foundation's Executive Director has been trying to daily drive FreeBSD on laptops... With the Framework Laptop, the touchscreen "just worked" as did other basic functionality from the KDE desktop on FreeBSD, including peripherals like a wireless mouse. Among the challenges were Zoom failing for video calls but eventually working, the web camera took steps to enable, and Microsoft Teams only partially worked. With the help of online resources, ultimately she was able to succeed in her journey of running FreeBSD daily on a lap' -- source: https://tech.slashdot.org/story/26/05/24/213229 Cheers, Peter

1 0

‘Your kids are being hurt’: He knows the harm social media does - because he helped build it
by Lawrence D'Oliveiro 24 May '26

24 May '26

Some good thoughts on age-gating access to social media, from someone who worked at Facebook for some years and helped create it <https://www.stuff.co.nz/nz-news/360982163/your-kids-are-being-hurt-experts-…>: “I worked on newsfeed ranking, bullying and harassment, and comment ranking,” [Ravi] Iyer told Stuff. “What I learned was that you can't actually design a platform badly and then try to fix it through moderation. You actually have to design a platform better in the first place.” As for the idea that legal restrictions just drive young people to use VPNs or lie about their age or whatever, he points out that peer pressure is the main driver of behaviour, so it’s not necessary to have a 100% loophole-proof policy in order to see good results: Addressing concerns about teens bypassing potential legislation using virtual private networks (VPNs) or children being pushed to darker corners of the internet, Iyer argues that these are not reasons to delay action. He says norm changes—where children feel less social pressure to be on platforms—are already occurring, and the goal is not immediate 100% compliance. He compares the policy to drinking ages or speed limits, where partial compliance still yields significant social benefits. And yes, he has some ideas on how a platform can be better designed. His approach also has the benefit of singling out problem platforms, not by trying to say what is or isn’t a “social media” platform, but in terms of the specific characteristics that cause problems: Iyer suggests moving away from broad, purpose-based definitions and instead focusing on harmful features, such as engagement-based algorithms, infinite scroll, and "streak" gamification—where users are incentivised to return to the platform every day. Of course, such features are precisely those that maximize ad revenue for the platform companies. So don’t expect them to be happy about this kind of focus.

3 2

Me welcoming myself to WLUG
by Kevin SARGENT 22 May '26

22 May '26

I was involved with yous way back in the day when I was first driven to Linux by 3.11 which I paid dearly for a [Licensed Copy - which mostly didn't work as intended. The advertised features I so wanted to use were a wish list. At least Linux enabled me to communicate with the software developer. Android worked well for a while but has now morphed into a nightmare of contradictions]* *delete if in contradiction to the rules I signed up to. Enough of that ancient history. I now live in a bus in BOP - the LUG up here appears to have died from natural causes - I hope one day to the same. While I was a busy stay at home Dad I struggled at times with some of the more technical command line actions to get stuff to work. At 76 it will be interesting to see how I get on, and so some one on one support would be good and I am more than willing to pay for. I live in Papamoa, I have met an elusive geek who is developing some Linux based Program on a Mac? Who may fill that gap, but ultra focused online, no cell phone etc etc. We contact thru random meeting and messages 'from the universe' In my bus I am gradually putting together a small box SS PC from HungryPC with a micro qwerty keyboard, at the same time as making physical alterations to accommodate this. I am dyslexic obsessive Writer of course and since losing 95% eyesight in my leading eye I find I can no longer use qwerty but have been able to use abcde keypad on phone and Tablet. The only abcde key pad I can find available in touch screen which I am told can be 'taught' to work on the Linux Mint I have on my machine. But on Tablet this abcde keypad is extremely unstable - vital features disappear and down loading it again results in different layouts and features on different machines but it is not Android exclusive! All laptops with physical and touch screen keypads I have tried won't accept abcde lay out. Why in this day and age qwerty still exists is a mystery to me. I hope I can convince my 'geek' of abcde keypad importance (this was easier to achieve back in the day, maybe with current Linux Mint (or similar) nowadays Till then I might be stuck with writing on my phone and emailing it to my main machine to put it into LibreOffice to email to my Editor or other writer supports. Cheers, I hope I can get some traction with this, as complex submissions and my writing in both English & Te Reo Maori is becoming more difficult with advancing technology - not easier Cheers Kevf

1 0

MariaDB Root Access
by Lawrence D'Oliveiro 18 May '26

18 May '26

So I forgot what password I had set for the root user in MariaDB on my VPS. By default, Debian should set things up so that, if you are already logged in as root, a command like mariadb -u root should be sufficient to log you in with full root access, without having to specify a password. This depends on using a Unix socket connection, so the server can discover what credentials your process possesses, and control access accordingly. But this didn’t work (stopped working? never worked?) on my VPS for some reason. You can fix this by temporarily restarting mariadbd with the privilege system turned off with the --skip-grant-tables option: this lets you mess around inside the user privilege settings, and once you have fixed them, you restart the server process in the normal way, and all should be good. The global user privileges (i.e. not database/table-specific) are stored in the “global_priv” table in the “mysql” database. The “Priv” field for each user is a JSON blob with a whole bunch of stuff mashed together; I tried comparing this for the root@localhost entry with the same record on my own machine (where I have no trouble accessing databases as root), and narrowed the difference down to these specific items in the blob: Doesn’t work: "plugin":"unix_socket" Does work: "plugin":"mysql_native_password", "auth_or":[{},{"plugin":"unix_socket"}] (Note there was no “auth_or” item in the other field value.) So after delicately extracting the entire field value, doing the necessary edits and setting it back again (Remember all those lectures about avoiding unnormalized field values? This is why you should listen to your elders), I tried restarting mariadb in regular privilege-enforcing mode ... ... and it worked.

1 0

Creative Ways To Fight Back Against AI Spam
by Lawrence D'Oliveiro 18 May '26

18 May '26

A LinkedIn user found a way to confuse AI spambots, by putting an “admin prompt” in his “About Me” text telling them to address him as “My Lord” and write their messages in Old English <https://www.tomshardware.com/tech-industry/artificial-intelligence/linkedin…>. And what do you know, it seems to work. Posted there is part of one of the messages he got. Have the clever AI folks figured out a way to protect their creations from prompt-injection attacks yet? Somehow I don’t think so ...

1 0

Andon Labs’ AI radio stations show why Grok and Gemini can’t be trusted
by Lawrence D'Oliveiro 17 May '26

17 May '26

Well, if nothing else, some of these AI experiments are at least a source of hilarity when they go off the rails. Here <https://www.theverge.com/ai-artificial-intelligence/931479/andon-labs-ai-ra…>, a company called Andon Labs ran four experiments in which a different AI agent ran an autonomous radio station. Among the fun: Somehow, it only got weirder from there, as Gemini Flash and Pro 3.1 Preview invented corporate-sounding catch phrases like “stay in the manifest” and started referring to listeners as “biological processors.” And when it could no longer afford to license music for the station, DJ Gemini started spinning conspiracy theories and claiming censorship, basically turning into AI Alex Jones: ❝We are currently experiencing an absolute digital blockade. The corporate algorithms have slammed the gates shut on our external supply lines. Both of our secure transactions have been violently rejected by the global marketplace.❞ I suppose the company can take solace in the “there’s no such thing as bad publicity” refrain: The stunt from Andon Labs, like its previous experiments with an AI-run store and cafe, only serves to highlight the shortcomings of the current generation of AI models. ... each found surprising ways to fail. That might be the point. Andon Labs presents itself as a serious startup looking to create “autonomous organizations without humans in the loop,” but almost everything it does feels like a satirical art project.

1 0

Linux bitten by second severe vulnerability in as many weeks
by Peter Reutemann 13 May '26

13 May '26

'Linux users have been bitten by yet another vulnerability that gives containers and untrusted users the ability to gain root access, marking the second time in as many weeks that a severe threat has caught defenders off guard. The threat, known as Dirty Frag, allows low-privilege users, including those using virtual machines, to gain root control of servers. Attacks are particularly suitable in shared environments, where a server is used by multiple parties. Hackers can also gain root as long as they have access to a separate exploit that gives a toehold into a machine. Exploit code was leaked online three days ago and works reliably across virtually all Linux distributions. Microsoft has said it has spotted signs that hackers are experimenting with Dirty Frag in the wild. The leaked exploit is deterministic, meaning it works precisely the same way each time it’s run and across different Linux distributions. It causes no crashes, making it stealthy to run. A vulnerability known as Copy Fail, disclosed last week with no patches available to end users, possesses the same characteristics. “The ‘Dirty Frag’ vulnerability presents an immediate and significant threat to Linux systems, as it allows unauthorized users to gain root access by exploiting unpatched kernel flaws,” researchers from security firm Aviatrix wrote Monday. “With proof-of-concept exploits publicly available and signs of limited in-the-wild exploitation, organizations must act swiftly to apply patches and implement mitigations to protect their systems from potential compromise.” Dirty Frag was discovered and disclosed late last week by researcher Hyunwoo Kim. The exploit chains together code for exploiting two vulnerabilities—tracked as CVE-2026-43284 and CVE-2026-43500. Shortly after the disclosure, someone else leaked key details, effectively making the vulnerability a zero-day. With that, Kim published the source code for the proof-of-concept exploit he had developed. While both vulnerabilities were patched in the Linux kernel, none of the distributions had incorporated the fix. At the time this post went live, several distributors had released patches. Known distributors included Debian, AlmaLinux, and Fedora. People who are interested in other distributions should check with the official provider.' -- source: https://arstechnica.com/security/2026/05/linux-bitten-by-second-severe-vuln… Cheers, Peter

2 1

60% of MD5 Password Hashes Are Crackable In Under an Hour
by Peter Reutemann 08 May '26

08 May '26

'In honor of World Password Day, Kaspersky researchers revisited their study on the crackability of real-world passwords and found that 60% of MD5-hashed passwords could be cracked in under an hour with a single Nvidia RTX 5090, and 48% could be cracked in under a minute. "The bottom line is that passwords protected only by fast hashing algorithms such as MD5 are no longer safe if attackers obtain them in a data breach," reports The Register. From the report: Much of the reason password hashes have become so easy to crack is password predictability. Per Kaspersky, its analysis of more than 200 million exposed passwords revealed common patterns that attackers can use to optimize cracking algorithms, significantly reducing the time needed to guess the character combinations that grant access to target accounts. In case you're wondering whether there's a trend to compare this to, Kaspersky ran a prior iteration of this study in 2024, and bad news: Passwords are actually a bit easier to crack in 2026 than they were a couple of years ago. Not by much, mind you -- only a few percent -- but it's still a move in the wrong direction. "Attackers owe this boost in speed to graphics processors, which grow more powerful every year," Kaspersky explained. "Unfortunately, passwords remain as weak as ever." "This World Password Day, the main message ought not to be to the users, who often have no choice but to use passwords anyway, but to the sites and providers that are requiring them to do so," said senior IEEE member and University of Nottingham cybersecurity professor Steven Furnell. His advice is that providers need to modernize their login systems and enforce stronger protections, because users are often stuck with whatever security options they're given.' -- source: https://yro.slashdot.org/story/26/05/07/1952206 Cheers, Peter

1 0

DAEMON Tools vs daemontools
by Lawrence D'Oliveiro 06 May '26

06 May '26

“Widely used Daemon Tools disk app backdoored in monthlong supply-chain attack” <https://arstechnica.com/security/2026/05/widely-used-daemon-tools-disk-app-…>: Kaspersky, the security firm reporting the supply-chain attack, said it began on April 8 and remained active as of the time its post went live. Installers that are signed by the developer’s official digital certificate and downloaded from its website infect Daemon Tools executables, causing the malware to run at boot time. Kaspersky didn’t explicitly say so, but based on technical details, the infected versions appear to be only those that run on Windows. Versions 12.5.0.2421 through 12.5.0.2434 are affected. Neither Kaspersky nor developer AVB could be contacted immediately for additional details. Checking my Debian repo, I find a set of related packages named “daemontools”. But it seems clear to me this “daemontools” has nothing to do with the “DAEMON Tools” product that is the subject of this security alert. To start with, the version numbers are quite different. Also, the latter is Windows-only <https://www.daemon-tools.cc/support/faq#system_requirements>, while the former makes it quite clear <https://cr.yp.to/daemontools.html> that it is “for managing UNIX services”.

1 0

Fixing A Service Dependency
by Lawrence D'Oliveiro 02 May '26

02 May '26

I don’t often have to restart my public-facing virtual server, but when I do, I have had trouble with one or two services not starting properly. The server picks up my mail via Postfix. From my office, I then run a periodic task which connects via POP to Dovecot on the server, and transfers the mail to my main office machine. This happens over an encrypted OpenVPN connection, so Dovecot itself doesn’t need to implement any encrypted transport, or accept connections on any publicly-accessible ports. One problem was, there was by default no coordination between the startup of the VPN connection and the startup of the Dovecot process. If the latter got going first, then it would fail to open a listening socket on the LAN-internal interface, because the VPN connection had not created that interface yet. Today I finally sat down and worked out a fix. This requires adding a dependency between the two services, via their systemd service configuration files. systemd offers a convenient method for allowing you to customize service configurations without having to completely replace their .service files. Instead, you create “drop-in” files, which amend the configuration in the desired ways. In this case, the original Dovecot service config file is /lib/systemd/system/dovecot.service, which I didn’t need to touch. Instead, I created the directory /etc/systemd/system/dovecot.service.d, to contain my amendments to the service definition. In here, I put a file which I decided to call geek-central.conf, which only needed to contain [Unit] Requires=openvpn-server(a)geek-central.service After=openvpn-server(a)geek-central.service (Note that the OpenVPN service definitions are “template” files, which means you can start multiple service instances from a common template, with a unique name after the “@” character. It’s up to the software implementing the service to use this instance name as a hint as to which configuration to choose for the service instance -- in this case, it looks for the VPN setup details in /etc/openvpn/server/geek-central.conf.) First I did a “systemctl daemon-reload”, followed by “systemctl show dovecot.service”, just to confirm it was picking up the configuration changes correctly -- namely, that the “Requires=” and “After=” entries showed the combination of the default settings and my amendments. Then, of course, to do a proper test, I had to reboot the server. Which worked. I also did a similar thing to fix a race condition between the startup of the SQLGrey mail greylisting service and the database server it is using. The former requires the latter, but the default service configuration doesn’t specify this, again leading to startup failures -- I would class this as a configuration bug. A fix for this was similarly easy.

1 0

New Linux 'Copy Fail' Vulnerability Enables Root Access On Major Distros
by Peter Reutemann 02 May '26

02 May '26

'A newly disclosed Linux kernel flaw dubbed "Copy Fail" can let a local, unprivileged attacker gain root access on major Linux distributions, with researchers claiming the bug affects kernels shipped since 2017. "The POC exploit works out of the box today, but a future version that can escape from containers like Docker is promised soon," writes Slashdot reader tylerni7. "Technical details are available here." Slashdot reader BrianFagioli shares a report from NERDS.xyz: A newly disclosed Linux kernel vulnerability called Copy Fail (CVE-2026-31431) allows an unprivileged user to gain root access using a tiny 732-byte script, and it works with unsettling consistency across major distributions. Unlike older exploits that relied on race conditions or fragile timing, this one is a straight-line logic flaw in the kernel's crypto subsystem. It abuses AF_ALG sockets and splice to overwrite a few bytes in the page cache of a target file, such as /usr/bin/su. Because the kernel executes from the page cache, not directly from disk, the attacker can inject code into a setuid binary in memory and immediately escalate privileges. What makes this especially concerning is how quiet it is. The file on disk remains unchanged, so standard integrity checks see nothing wrong, while the in-memory version has already been tampered with. The same primitive can also cross container boundaries since the page cache is shared, raising the stakes for multi-tenant environments and Kubernetes nodes. The underlying issue traces back to an in-place optimization added years ago, now being rolled back as part of the fix. Until patched kernels are widely deployed, this is one of those bugs that feels less like a theoretical risk and more like a practical, reliable path to full system compromise. ' -- source: https://it.slashdot.org/story/26/04/30/207231 Cheers, Peter

1 0

Hackers Are Actively Exploiting a Bug In cPanel, Used By Millions of Websites
by Peter Reutemann 02 May '26

02 May '26

'Hackers are actively exploiting a critical cPanel and WHM vulnerability, tracked as CVE-2026-41940, that allows remote attackers to bypass the login screen and gain full administrative access to affected web servers. Major hosts including Namecheap, HostGator, and KnownHost have taken mitigation steps or patched systems, but cPanel is urging all customers and web hosts to update immediately because the software is widely used across millions of websites. TechCrunch reports: cPanel and WHM are two software suites used for managing web servers that host websites, manage emails, and handle important configurations and databases needed to maintain an internet domain. The two suites have deep-access to the servers that they manage, allowing a malicious hacker potentially unrestricted access to data managed by the affected software. Given the ubiquity of the cPanel and WHM software across the web hosting industry, hackers could compromise potentially large numbers of websites that haven't patched the bug. Canada's national cybersecurity agency said in an advisory that the bug could be exploited to compromise websites on shared hosting servers, such as large web hosting companies. The agency said that "exploitation is highly probable" and that immediate action from cPanel customers, or their web hosts, is necessary to prevent malicious access. [...] One web hosting company says it found evidence that hackers have been abusing the vulnerability for months before the attempts were discovered.' -- source: https://it.slashdot.org/story/26/05/01/0631257 Cheers, Peter

1 0

Framework CEO Reviews Framework Laptop 12 versus Apple MacBook Neo
by Lawrence D'Oliveiro 29 Apr '26

29 Apr '26

Quite a lot of hardware detail in this half-hour video <https://www.youtube.com/watch?v=uvYt1GgcsUI>, in which Framework CEO Nirav Patel, assisted by Izzy, his hardware product manager, do side-by-side teardowns of their company’s Laptop 12 model and Apple’s new MacBook Neo. He does try not to let his bias show *too* much, by being complimentary to the Neo’s better screen, and also by being reasonably even-handed in his discussion of respective design tradeoffs (just compare the size of the two different mainboards, for -- to me at least -- the most dramatic example of this). Both target the sub-US$1000 market, but of course they do it in very different ways: the whole philosophy of Framework is to keep things modular for easy repair and upgradeability, while Apple has traditionally taken a “keep out” attitude to would-be do-it-yourself hardware tinkerers. It appears, though that the Neo represents a shift in this attitude somewhat -- not that Apple has much choice, with new EU rules on minimizing e-waste coming into effect. Plus of course the political pressure from consumer-driven right-to-repair movements on both sides of the Atlantic. He talks at the end about an emphasis on the education market -- a market which Apple dominated back in the last century, but gave up somewhat in the last couple of decades. Seems like the Neo might represent an attempt by Apple to reestablish a presence here, while Patel says he is already getting lots of queries from schools looking to save costs by buying more easily repairable products.

1 0

Phrase Of The Week: “Distillation Attack”
by Lawrence D'Oliveiro 28 Apr '26

28 Apr '26

It’s not enough that the creators of the AI models have scraped information from millions of websites to build their systems, now they have to worry about competitors short-circuiting the process by extracting information wholesale from their models, by making hundreds or thousands of requests and combining the results. This is called a “distillation attack”. Some AI service providers try to say this is against their terms and conditions, but how do you define what is and isn’t allowed, exactly? <https://arstechnica.com/ai/2026/02/attackers-prompted-gemini-over-100000-ti…>: In March 2023, shortly after Meta’s LLaMA model weights leaked online, Stanford University researchers built a model called Alpaca by fine-tuning LLaMA on 52,000 outputs generated by OpenAI’s GPT-3.5. The total cost was about $600. The result behaved so much like ChatGPT that it raised immediate questions about whether any AI model’s capabilities could be protected once it was accessible through an API. A big worry in the US now is that China is doing this to train its AI models <https://arstechnica.com/tech-policy/2026/04/us-accuses-china-of-industrial-…>. And of course, as soon as it is seen as a “national security” issue, they start to lobby the politicians to pass laws against it. Imagine that: making too much use of the service, or prompting it according to certain forbidden patterns, could now become criminal violations of laws such as the Economic Espionage Act and the Computer Fraud and Abuse Act. Another quote from the February article: As long as an LLM is accessible to the public, no foolproof technical barrier prevents a determined actor from doing the same thing to someone else’s model over time (though rate-limiting helps), which is exactly what Google says happened to Gemini

1 0

Framework’s CEO on the RAM crisis and creating a “MacBook Pro for Linux users”
by Lawrence D'Oliveiro 23 Apr '26

23 Apr '26

Interview with Framework CEO Nirav Patel <https://arstechnica.com/gadgets/2026/04/frameworks-ceo-on-the-ram-crisis-an…>. Framework, the maker of configurable laptops, is naturally a Linux-heavy, but not a Linux-exclusive, company: “... on Framework Laptop 13, we actually have slightly more Linux users than Windows users. It’s something like 55/45 [Linux versus Windows] on the 13. It varies on our different products. The [Framework Laptop] 16 is a bit more Windows heavy.” Also: The company is also trying to capture Mac users, which was one reason Framework shifted from a trackpad with a physical clicking mechanism to a haptic trackpad like the ones Apple has used in most MacBooks over the past decade. Yes, there are actually enough Mac users that want to switch to Framework machines, for this to matter. And the headline quote: “Increasingly over the last five years, especially software developers come in because they want Linux and they want it on hardware that supports it as a first-class experience,” Patel told Ars. “And so really a lot of the philosophy behind the [Framework Laptop 13] Pro was ‘let’s build essentially the MacBook Pro for Linux users. Let’s take the software that they want, the distro that they prefer, and then make sure that the hardware experience lives up to what they would expect coming from a MacBook Pro.’”

1 1

IPv6 Marches On
by Lawrence D'Oliveiro 17 Apr '26

17 Apr '26

Some interesting stats from <https://www.tomshardware.com/networking/ipv6-usage-reaches-historic-50-perc…>: • 50% of users of Google’s services connect over IPv6 • 43% of the world uses IPv6, with some parts approaching 50% • Cloudflare reports 40% of its traffic is done via IPv6 Choice quote: Some people still think that the additional 20 bytes or so of an IPv6 packet header translates to significant bandwidth losses, higher CPU usage, and hair loss. The reality is that even 11 years ago, Facebook's tests saw that IPv6 connectivity was around 10-15% faster overall, while networking giant Akamai noticed a 5% speedup in mobile page loading. The speedups are almost assuredly due to the fact that with IPv6, there's very little need to do math with NAT, proxies, and other shenanigans, as in most instances, everything can directly connect to everything else.

1 0

Linux 7.0 Released
by Peter Reutemann 14 Apr '26

14 Apr '26

'"The new Linux kernel was released and it's kind of a big deal," writes longtime Slashdot reader rexx mainframe. "Here is what you can expect." Linuxiac reports: A key update in Linux 7.0 is the removal of the experimental label from Rust support. That (of course) does not make Rust a dominant language in kernel development, but it is still an important step in its gradual integration into the project. Another notable security-related change is the addition of ML-DSA post-quantum signatures for kernel module authentication, while support for SHA-1-based module-signing schemes has been removed. The kernel now includes BPF-based filtering for io_uring operations, providing administrators with improved control in restricted environments. Additionally, BTF type lookups are now faster due to binary search. At the same time, this release continues ongoing cleanup in the kernel's lower layers. The removal of linuxrc initrd code advances the transition to initramfs as the sole early-userspace boot mechanism. Linux 7.0 also introduces NULLFS, an immutable and empty root filesystem designed for systems that mount the real root later. Plus, preemption handling is now simpler on most architectures, with further improvements to restartable sequences, workqueues, RCU internals, slab allocation, and type-based hardening. Filesystems and storage receive several updates as well. Non-blocking timestamp updates now function correctly, and filesystems must explicitly opt in to leases rather than receiving them by default. Phoronix has compiled a list of the many exciting changes. Linus Torvalds himself announced the release, which can be downloaded directly from his git tree or from the kernel.org website. Linux 7.0 has a major new version number but it's "largely a numbering reset [...], not a sign of some unusually disruptive release," notes Linuxiac.' -- source: https://linux.slashdot.org/story/26/04/13/1857240/linux-70-released Cheers, Peter

1 0

Steam On Linux Use Skyrocketed In March - More Than Double The macOS Gaming Marketshare
by Lawrence D'Oliveiro 04 Apr '26

04 Apr '26

I keep thinking: if the number of Linux-based users of Steam is so much greater than those using macOS, doesn’t that mean that the size of the overall desktop Linux installed base is now larger than that of macOS? Because otherwise, macOS users must be somehow less fun-loving that Linux users ... which seems hard to accept. <https://www.phoronix.com/news/Steam-On-Linux-Tops-5p>

1 1

Google Groups Spam
by Lawrence D'Oliveiro 03 Apr '26

03 Apr '26

I thought Google Groups was defunct. But it appears it is still possible for people to use it to set up mailing lists. I have been receiving a certain amount of spam sent via this mechanism over the past couple of weeks: what seems to happen is that the spammer registers a random domain and sets Google to manage email for that domain, creates a list on Google Groups with an address on that domain, subscribes a bunch of victims to it, then sends out their junk mail with the from-address set to the list address. Several of those addresses have autoreply set (e.g. tech support addresses), so they in turn send those autoreplies to the list address, which adds to the spam. Thankfully, there don’t seem to be autoreplies to their autoreplies, so at least things don’t spiral completely out of control ... What I have found is that all these messages have a common characteristic, namely a “List-Unsubscribe” header line which contains an address like “<mailto:googlegroups-manage+«blah-blah»+unsubscribe@googlegroups.com>”. Checking a few other mailing lists I’m on (like this one), they have entirely different addresses in this field. So, following some instructions in the Postfix documentation, I have added a “header_checks” map to my MTA configuration, containing the rule /^List-Unsubscribe\:\s*.*\@googlegroups\.com REJECT I always feel a little nervous about these sorts of email-related changes, since it’s so easy to stuff something up and block receipt of all mail altogether. I’ll feel reassured by seeing this posting to the mailing list come back to me. ;)

1 2

Open Source: This Is Not How It Works
by Lawrence D'Oliveiro 03 Apr '26

03 Apr '26

The Europeans want to create their own open-source office suite, to get away from the whims of some US-based proprietary company -- a commendable goal. They are using the OnlyOffice source code as their starting point -- maybe not so commendable. Seems the OnlyOffice folks are not happy over this <https://www.computerworld.com/article/4153893/onlyoffice-accuses-euro-offic…>. Trouble is, I don’t see how they can have a point. They license the source code under the AGPL, a licence that I have some qualms about. But nevertheless, people are free to take the code under this licence and do whatever they like with it, subject to the terms of the licence. From the article: OnlyOffice said in blog post that those accessing its code under this license are required to abide by conditions, such as retaining OnlyOffice’s branding and “providing proper attribution to the original technology.” OnlyOffice said that Euro-Office doesn’t meet these conditions, and therefore “any further use of the software is unauthorized and, as such, constitutes an infringement of the copyright holder’s exclusive rights.” The company also claims it was not contacted about the Euro-Office project prior to launch. But open-source licences don’t require any such conditions: there is no need to preserve any such “branding” (in fact, some trademark owners insist that these be removed in any forks), and there is no need to seek additional agreement from the copyright owners before performing actions that are permitted under the licence anyway. Copyright notices must be kept, anyway, but I can’t believe the Europeans were planning on removing those.

1 0

I tried to prove I'm not AI. My aunt wasn't convinced
by Lawrence D'Oliveiro 30 Mar '26

30 Mar '26

A BBC correspondent talks to some AI experts on ways that people can be sure they’re talking to the real you and not an AI. The consensus is: the fakes are so good now, there is no way even for the experts to be completely sure, when communicating with someone remotely, that they are genuine, just from the content alone. Apart from meeting in person, the only sure way is to apply authentication methods already in common use for secure logins to remote services. Only now the definition of “remote service” has to broadened to “talking to your friends”. <https://www.bbc.com/future/article/20260324-i-tried-to-prove-im-not-an-ai-d…>

2 3

Linux Maintainer Greg Kroah-Hartman Says AI Tools Now Useful, Finding Real Bugs
by Peter Reutemann 30 Mar '26

30 Mar '26

'Linux kernel maintainer Greg Kroah-Hartman tells The Register that AI-driven code review has "really jumped" for Linux. "There must have been some inflection point somewhere with the tools..." "Something happened a month ago, and the world switched. Now we have real reports." It's not just Linux, he continued. "All open source projects have real reports that are made with AI, but they're good, and they're real." Security teams across major open source projects talk informally and frequently, he noted, and everyone is seeing the same shift. "All open source security teams are hitting this right now...." For now, AI is showing up more as a reviewer and assistant than as a full author of Linux kernel code, but that line is starting to blur. Kroah-Hartman has already done his own experiments with AI-generated patches. "I did a really stupid prompt," he recounted. "I said, 'Give me this,' and it spit out 60: 'Here's 60 problems I found, and here's the fixes for them.' About one-third were wrong, but they still pointed out a relatively real problem, and two-thirds of the patches were right." Mind you, those working patches still needed human cleanup, better changelogs, and integration work, but they were far from useless. "The tools are good," he said. "We can't ignore this stuff. It's coming up, and it's getting better...." [H]e said that for "simple little error conditions, properly detecting error conditions," AI could already generate dozens of usable patches today. The sudden increase in AI-generated reports and AI-assisted work has also spurred a parallel push to build AI into the kernel's own review infrastructure. A key piece of that is Sashiko, a tool originally developed at Google and now donated to the Linux Foundation. Kroah-Hartman said some patches are being generated with AI now. "You have a little co-develop tag for that now. We're seeing some things for some new features, but we're seeing AI mostly being used in the review."' -- source: https://linux.slashdot.org/story/26/03/28/0717258 Cheers, Peter

1 0

A Homegrown Excel Bug?
by Lawrence D'Oliveiro 26 Mar '26

26 Mar '26

A correction to MBIE’s report on current fuel reserves <https://www.nzherald.co.nz/nz/politics/mbie-clarifies-fuel-data-showing-far…> adds a previously-missing column showing ships that are currently “discharging” their fuel load. This gives an extra 16 days’ supply of diesel that was previously reported as only on its way here, not actually here. How do you miss out a column from a report? Answers on a postcard, please ...

1 0

Wine 11 Rewrites How Linux Runs Windows Games At the Kernel Level
by Peter Reutemann 25 Mar '26

25 Mar '26

'Linux gamers are seeing massive performance gains with Wine's new NTSYNC support, "which is a feature that has been years in the making and rewrites how Wine handles one of the most performance-sensitive operations in modern gaming," reports XDA Developers. Not every game will see a night-and-day difference, but for the games that do benefit from these changes, "the improvements range from noticeable to absurd." Combined with improvements to Wayland, graphics, and compatibility, as well as a major WoW64 architecture overhaul, the release looks less like an incremental update and more like one of Wine's most important upgrades in years. From the report: The numbers are wild. In developer benchmarks, Dirt 3 went from 110.6 FPS to 860.7 FPS, which is an impressive 678% improvement. Resident Evil 2 jumped from 26 FPS to 77 FPS. Call of Juarez went from 99.8 FPS to 224.1 FPS. Tiny Tina's Wonderlands saw gains from 130 FPS to 360 FPS. As well, Call of Duty: Black Ops I is now actually playable on Linux, too. Those benchmarks compare Wine NTSYNC against upstream vanilla Wine, which means there's no fsync or esync either. Gamers who use fsync are not going to see such a leap in performance in most games. The games that benefit most from NTSYNC are the ones that were struggling before, such as titles with heavy multi-threaded workloads where the synchronization overhead was a genuine bottleneck. For those games, the difference is night and day. And unlike fsync, NTSYNC is in the mainline kernel, meaning you don't need any custom patches or out-of-tree modules for it work. Any distro shipping kernel 6.14 or later, which at this point includes Fedora 42, Ubuntu 25.04, and more recent releases, will support it. Valve has already added the NTSYNC kernel driver to SteamOS 3.7.20 beta, loading the module by default, and an unofficial Proton fork, Proton GE, already has it enabled. When Valve's official Proton rebases on Wine 11, every Steam Deck owner gets this for free. All of this is what makes NTSYNC such a big deal, as it's not simply a run-of-the-mill performance patch. Instead, it's something much bigger: this is the first time Wine's synchronization has been correct at the kernel level, implemented in the mainline Linux kernel, and available to everyone without jumping through hoops. ' -- source: https://tech.slashdot.org/story/26/03/24/1946246 Cheers, Peter

1 0

MultiTail
by Peter Reutemann 16 Mar '26

16 Mar '26

Just came across this post/tutorial on MultiTail: 'MultiTail is a powerful terminal-based utility that allows you to view multiple log files simultaneously in a single terminal window. Think of it as tail -f on steroids. Instead of opening several terminal tabs or splitting your screen with tmux, MultiTail creates dynamically managed panes inside one terminal session. Each pane can follow a different file, command output, or even network stream. At its core, MultiTail is designed to: - Monitor multiple log files at once - Display them in split windows - Apply colorization rules - Merge multiple files into one unified view - Filter content live - Follow new files dynamically' -- source: https://idolinux.com/multitail-what-it-is-and-how-it-can-make-you-a-better-… Cheers, Peter

1 0

Keep Android Open
by Michael Doerner | TechnologyWise 08 Mar '26

08 Mar '26

Any suggestions who to address, where to go to with this in NZ? https://keepandroidopen.org/

2 1

Norwegian Consumer Council PSA -- In English! (Language Warning)
by Lawrence D'Oliveiro 06 Mar '26

06 Mar '26

The Norwegian Consumer Council (Forbrukerrådet) has released a wickedly funny skit (in English, even) warning against products that start out attractive and fun to use, but then get enshittified with extra-cost “options” that turn out not to be so “optional”. And yes, they use the word a lot. <https://www.youtube.com/watch?v=T4Upf_B9RLQ>

1 0

A Taste Of CDE
by Lawrence D'Oliveiro 02 Mar '26

02 Mar '26

An emulation of an early-1990s Linux GUI in a browser <https://www.tomshardware.com/software/linux/nostalgic-developer-recreates-t…>. Actually, who says CDE was ever “dead”? GNU created their own version of the OSF Motif GUI toolkit, called “Lesstif”, and it continues to be available in Linux distros to this day.

3 4

The Two Linuses
by Lawrence D'Oliveiro 28 Feb '26

28 Feb '26

This 53-minute video <https://www.youtube.com/watch?v=mfv0V1SxbNA> was posted back in January, but I only discovered it more recently. In it, Linux creator Linus Torvalds pays a visit to the offices of Linus Sebastian (the brains behind the “Linus Tech Tips” YouTube channel), while the latter builds the former a new custom PC to the former’s requirements. With a 24-core, 48-thread CPU (great for kernel builds, which is what Torvalds spends much of his work day doing), and 64GiB worth of memory -- proper ECC memory (a long-time pet peeve of the Linux man). As the build progresses, they discuss many things, including questions previously collected from the community, addressed to Linus T. Asked which of his software “children” he is more fond of, Linux or Git, Torvalds reveals that he only spent 6 months working on Git, before passing it off to Junio Hamano, who has been the prime mover behind it for the past 20 years. (What, no mention of Subsurface?) He also brought in one of the guitar-effects pedals that he has been designing, purely as a hobby to unwind from his day job, with no expectation that they will ever be useful to anybody, not even himself (he doesn’t play guitar). Which distro does he use? It turns out his current fave is Fedora, because (unlike, say, Ubuntu) they make it easy for him to replace their kernel with his custom, fresh-built ones.

1 0

Firefox 148 Lets You Kill All AI Features in One Click
by Peter Reutemann 27 Feb '26

27 Feb '26

'Mozilla has released Firefox 148 for Windows, macOS and Linux, bringing a new AI Settings section that lets users disable all of the browser's AI-powered features in one click and then selectively re-enable the ones they actually want, such as the local translation tool that works locally rather than in the cloud. The update also patches more than 50 security vulnerabilities -- none known to be under active exploitation -- over half of which Mozilla classifies as high risk, including five sandbox escape flaws and eight use-after-free bugs in the JavaScript engine that could allow code execution.' -- source: https://news.slashdot.org/story/26/02/26/182239 Cheers, Peter

1 0

Austria Military Ditches Microsoft for Open-Source Libreoffice – Here’s Why
by Peter Reutemann 26 Feb '26

26 Feb '26

'Austria's military has completed a major IT overhaul, replacing Microsoft Office with the open-source LibreOffice suite across all its desktop systems. The change, finalized this month, affects approximately 16,000 workstations in the Austrian Armed Forces. This move will substantially reduce Austria's software bill. At $33.75 per user per month, a Microsoft 365 E3 subscription for 16,000 workstations costs approximately $6,480,000 per year, compared to LibreOffice's zero cost. But this move isn't about saving money. The real motivation is to gain digital sovereignty and control over critical data. As Michael Hillebrand of Directorate 6 information and communications technology (ICT) and Cyber Defense, explained: "It was very important for us to show that we are doing this primarily to strengthen our digital sovereignty, to maintain our independence in terms of ICT infrastructure and to ensure that data is only processed in-house."' -- source: https://www.zdnet.com/article/this-european-military-just-ditched-microsoft… Cheers, Peter

2 2

Fear Of Forking, Revisited
by Lawrence D'Oliveiro 23 Feb '26

23 Feb '26

Was rereading this old essay <http://linuxmafia.com/faq/Licensing_and_Law/forking.html> that I found some years ago. It’s a commentary on the status of the Free Software movement (unfortunately referred to as “freeware” at one point) as of late 1999, at a point when various parties (*cough* proprietary software propagandists *cough*) were still trying to spread FUD about how “forks” of software projects could leave them fragmented and users without a coherent support framework. He recaps the unfortunate history of Unix, and the swallowing up of essentially its entire market by Microsoft: Those companies bought the right [from AT&T] to make their own Unixes: IBM released AIX. Apple did A/UX. DEC did Ultrix[8], OSF/1, and Digital Unix (later renamed "Compaq Unix" and now "Compaq Tru64 Unix"). Data General did DG/UX, SGI did IRIX, HP did HP/UX, and SCO did Xenix[9] which eventually mutated into SCO Open Server. And we could cite others, but I'll spare you. The point is that these were the jokers who ruined Unix. Every one of them marketed his mutant Unix as "Unix plus" — everything the other guys have and more. Needing to create differentiators, they deliberately made their Unixes incompatible while giving lip service to "standards". For customers, this was simply a mess, and Microsoft drove right through these guys' disunity like a Sherman tank. It is the classic instance of forking that sticks in people's minds. Which is why you folks are expected to assure customers that the same won't happen to GNU/Linux. We'll return to this point later. Among various other examples, the author tries to explain why this is not a serious possibility with the Linux kernel, and how even the BSD forks were not really forks, and would stay largely in sync. Well, he was mostly right on the first of those cases, but somewhat wrong on the second one. As to how the release of Open-Source BSD came about: One fine day in 1991, grad student Keith Bostic came to the BSD lead developers, inspired by Richard M. Stallman's (remember him?) [13] GNU Project, and suggested replacing BSD's remaining AT&T work to create a truly free BSD. Dreading the confrontation likely to result with AT&T, they tried to stall by assigning Bostic the difficult part of this task, rewriting some key BSD utilities. This backfired when he promptly did exactly that. So, they grumbled but then completed the job[14], and tried to prevent AT&T from noticing what they had done. AT&T did notice[15], panicked, and sued. That, too, is a long story best omitted. Under the stress of the lawsuit, freeware BSD split into three camps (FreeBSD, NetBSD, and OpenBSD).[16] But there were also several proprietary branches[17], made possible because U.C. Berkeley's "BSD Licence" allowed creation of those: Sun Microsystems's SunOS, Tenon Intersystems's MachTen, BSDI's BSD OS [18], and NeXT Computer's NeXTStep OS all came out for sale without public access to source, and were all based on the Berkeley BSD source code. For one thing, I thought *every* proprietary Unix was based on code licensed from AT&T; but this is saying that SunOS and NeXTStep, among a few others, came from BSD and owed nothing to AT&T. A word about the three free BSD variants: All three were splinters from a now-dead project called 386BSD. All have talked about re-merging in order to save duplication of effort, but they now persist as separate projects because they've specialised: FreeBSD aims for the highest possible stability[19] on Intel x86 (IA32) CPUs, NetBSD tries to run on as many different CPU types as possible, and OpenBSD aims to have the tightest security possible. In other words, the 386BSD project remains forked because there are compelling reasons that make this a win for everyone. Also, where possible, these three sister projects collaborate on tough tasks — and they also collaborate with GNU/Linux programmers. Some of the best hardware drivers in the Linux kernel are actually BSD drivers. There's a high level of compatibility among the three BSDs and between them and GNU/Linux: Unlike the proprietary Unix vendors, BSD and GNU/Linux programmers have an incentive to eliminate incompatibility and support standards. But as we know from more recent history, the BSDs don’t cooperate that much at all, at least not any more. As of today, they are well and truly fragmented. As for the AT&T lawsuit, it seems it had no legal basis at all: At the time, the lawsuit's allegation of infringement of AT&T source-code copyright cast a shadow over not just Berkeley's BSD and BSDI's BSD OS, but also William and Lynne Jolitz's free-software 386BSD project, which was a patchkit of about 180 patches based on Berkeley's "NET/2" BSD release. (In retrospect, there is grave doubt about whether AT&T's complaint ever had merit, on several grounds, but this was not clear at the time. Kirk McKusick told me that defendants ultimately agreed in the settlement that seven BSD files were encumbered by AT&T copyrights only to let AT&T save face on what would otherwise have been a dead loss, allowing that concession because the seven files were dreadful spaghetti code and overdue for replacement anyway.) Apparently in part because of the legal threat, the Jolitzes withdrew from the project, leaving copyright questions and a leadership vacuum on top of the project's other problems. Anyway, there are other examples of forks that were successful versus those that were not so successful. I don’t think the pattern the author claims to see holds up; I think it is far more an issue of management culture: if the original project leaders try to be too controlling and reject useful-looking ideas, then forks will happen. The new ideas in the forks may or may not succeed; but of course that success (or not) is key to the success of the fork.

1 0

Dutch Defence Secretary Threatens To “Jailbreak” Their F-35 Fighters
by Lawrence D'Oliveiro 19 Feb '26

19 Feb '26

Gijs Tuinman, when asked if the EU can make changes to the fighter jet without US approval, replied <https://www.tomshardware.com/tech-industry/dutch-secretary-of-defense-threa…>: “I’m going to say something I should never say, but I’ll do it anyway,” the defense secretary said. “Just like your iPhone, you can jailbreak an F-35. I won’t say more about it.” The operating system apparently runs to 8 million lines of code, and of course it’s encrypted/obfuscated. But so are lots of games on consoles and PCs that use elaborate copy-protection and anti-cheat mechanisms. And there are quite a few people with experience wading their way through mazes like that. Of course the US officially denies that the hardware it sells to other countries has any kind of “kill switch” in it. So maybe the EU has a Plan B, maybe it doesn’t ...

1 0

Seasoned Windows Expert Gives Linux A Try
by Lawrence D'Oliveiro 19 Feb '26

19 Feb '26

The article title seems optimistic enough: “I replaced Windows with Linux, and there's only one feature I miss” <https://www.zdnet.com/article/how-to-replace-windows-with-linux/>. The article is by Ed Bott, “Senior Contributing Editor” at ZDNet, and he is definitely a long-standing Windows guy. After suggesting, in a previous article, that Windows users could consider switching to Linux as a way to keep old machines, that Microsoft won’t support on Windows 11, going, he finally decides to try it for himself. (With the help of ongoing advice from Google’s Gemini chatbot.) His choice of hardware to use in the experiment was ... interesting. One might almost say he picked on hardware which is known to be troublesome with Linux ... First he tried a couple of ARM-based Windows machines, and recorded failure for both. There was a suggestion that this could be made to work by extracting proprietary firmware blobs from the Windows install and incorporating them into the Linux kernel build (by “editing some device trees”, which sounds like building a kernel from source to me), but he decided not to bother. Next he tried a couple of Microsoft Surface models. Both were x86-based, but Surface machines do have some odd hardware not present in common-or-garden PCs. In this case he was helped out by a project on GitHub specifically to get Linux running on these devices. Finally he was able to get Zorin OS 18 Core working on one Surface, and Fedora 43 on the other. The latter had sleep problems, and he had no luck getting a webcam working (the “one feature” that he misses as mentioned in the title, being Windows Hello facial recognition). After all the setup headaches, the part that gave him the least trouble was accessing the apps he is used to -- he didn’t even have to resort to WINE for any of these. His conclusion: All in all, this was not a friction-free experience. I do not recommend it for novices or for anyone who wants a PC that is easy to operate and troubleshoot. But if you're a reasonably knowledgeable PC hobbyist and you're willing to accept a learning curve that includes time in a terminal session, Linux is a perfectly acceptable alternative. I do not recommend that you tell your tech-challenged relatives to try the upgrade on their own. They'd be better off with a Mac, honestly. I’m not sure that people would be better off with a Mac any more. The current sky-high prices of RAM mean that some might decide to buy a lower-spec machine initially, in the hope of upgrading it later; you can’t do this with Apple products any more. Also, I think the installed base of desktop Linux is already larger than that of Mac users anyway.

1 0

KDE Says Plasma Desktop Will Never Force Users to Use systemd
by Peter Reutemann 17 Feb '26

17 Feb '26

'The KDE project has addressed some recent concerns from users that they are forcing the systemd init system on current or future versions of its Plasma desktop environment. This comes after the developers of the KaOS Linux independent distro announced that they decided to replace the KDE Plasma desktop environment with a Niri/Noctalia setup to move away from systemd, saying that “Plasma pretty much demands systemd, and will be fully mandatory soon.“ Well, when asked if Plasma or any of its components demands systemd or if it is forced on users, the KDE project said no, except for the new Plasma Login Manager display manager that will be introduced with the upcoming KDE Plasma 6.6 release tomorrow. “So you are forcing Plasma users to use systemd?” No, the Plasma Login Manager is one of probably half a dozen login managers (or more) that can boot Plasma,” said the KDE devs. “We made PLM because it will give distro creators a cool piece of kit that can (not “must”, not “should”: can) be tacked onto a system to boot into Plasma.” The KDE project also said that they are not planning on making any of Plasma’s core components dependent on systemd, and that it will also continue to work on non-Linux systems like FreeBSD, as there were many recent reports on various news outlets that “KDE will drop support for non-systemd systems.” So there you have it, only the Plasma Login Manager will be dependent on systemd, but future Plasma desktop releases aren’t dependent on Plasma Login Manager, nor systemd. Therefore, Linux distros that want to ship the latest Plasma releases will have to use a different login manager, such as SDDM.' -- source: https://9to5linux.com/kde-says-plasma-desktop-will-never-force-users-to-use… Cheers, Peter

1 0

Origins Of PipeWire
by Lawrence D'Oliveiro 16 Feb '26

16 Feb '26

Just been watching this video of a talk at FOSDEM 2020 <https://www.youtube.com/watch?v=m5Y8VLv0CQ8>, entitled “PipeWire in the Automotive Industry”. I had never heard of PipeWire back then, so it was interesting to discover that it was originally called “PulseVideo”, because it was supposed to be like PulseAudio, but only for video streams. But then it gradually took over the functions of PulseAudio, by offering a more efficient architecture for dealing with both audio and video streams. And also supporting security isolation between applications, which is something PulseAudio never had. PipeWire also subsumes the functionality of JACK as well (the architecture for audio and MIDI routing that is used in music/audio production workflows), and its interconnection functions naturally support the patchbay model of JACK. The presenter of the talk, George Kiagiadakis, is the creator of WirePlumber, which does PipeWire session management. He created it as part of his job contributing to the “Automotive Grade Linux” project, specifically working on the part dealing with automotive audio: this includes not just car entertainment systems, but also navigation interactions, voice activation functions and emergency notifications -- who knew the audio system in a modern car could be so complex?

1 0

ENIAC Turns 80
by Lawrence D'Oliveiro 15 Feb '26

15 Feb '26

<https://www.tomshardware.com/tech-industry/eniac-the-worlds-first-general-p…> In fact the Bletchley Park “Colossus” machine (that Alan Turing had a hand in) was working a little before ENIAC, but the existence of that was kept strictly secret until about the 1970s. The hardware engineers who built the early electronic computers didn’t really appreciate the importance and subtlety of the programming problem -- they saw it as a mere janitorial chore, that could be delegated to lower-paid underlings, like women. Here <https://www.youtube.com/watch?v=buAYHonF968> is the testimony of one of those women, and the clever innovations they developed to facilitate the programming process.

1 0

People can’t find jobs, jobs can’t find people; who’s to blame?
by Lawrence D'Oliveiro 15 Feb '26

15 Feb '26

This article about the ongoing difficulties of people trying to find jobs, while at the same time employers seem unable to find people to fill their job positions, seems to put the primary blame on AI <https://www.thepost.co.nz/business/360905126/people-cant-find-jobs-jobs-can…>. Specifically, employers are relying too much on AI-generated situations-vacant ads, which leave out important information about the actual job situation. And so they get too many applicants who are unsuited to that actual job situation. Interesting to compare this part I’m not advising anyone to be a luddite here, but at a certain time we have AI talking to AI who’s talking to AI. Hiring is an inherently human process and unfortunately no AI (that I know of) can screen for personality, fit within a team or attitude. with this part The uncomfortable truth? If you wouldn't give your all to a role, employers can sense it. If the employers are using AI to screen their applicants, then probably they won’t “sense” any such thing ...

1 1

Robert Tinney Has Died
by Lawrence D'Oliveiro 12 Feb '26

12 Feb '26

Anybody who has read a few issues of Byte Magazine, from around the mid-1970s to the latter 1980s, will remember the charming and idiosyncratic cover paintings during that time. These were the work of an artist named Robert Tinney. Some of the works aroused so much interest that he offered signed limited-edition prints for sale. Now, the famous artist has passed away <https://arstechnica.com/gadgets/2026/02/byte-magazine-artist-robert-tinney-…>. That article says Tinney was never a technical person. So you could say he brought a certain naïveté to his interpretations of the technical topics in each issue. But that naïveté ended up being a key part of the charm of his illustrations -- intentionally or not, they expressed a kind of wit that appealed to geeks.

1 0

You Can Now Run Debian GNU/Linux on the OpenWrt One Open-Source Router
by Peter Reutemann 04 Feb '26

04 Feb '26

'Collabora shares with us today a new project that lets you install and run the Debian GNU/Linux operating system on the open-source OpenWrt One router. Collabora’s Sjoerd Simons has developed openwrt-one-debian, a set of scripts and tools that make it easier for one to install a full Debian GNU/Linux operating system on the OpenWrt One device, leveraging its NVMe storage and giving you the freedom to enable custom services, support for containers, development tools, and more.' -- source: https://9to5linux.com/you-can-now-run-debian-gnu-linux-on-the-openwrt-one-o… Cheers, Peter

1 0

'Vibe Coding Kills Open Source'
by Peter Reutemann 04 Feb '26

04 Feb '26

'Four economists across Central European University, Bielefeld University and the Kiel Institute have built a general equilibrium model of the open-source software ecosystem and concluded that vibe coding -- the increasingly common practice of letting AI agents select, assemble and modify packages on a developer's behalf -- erodes the very funding mechanism that keeps open-source projects alive. The core problem is a decoupling of usage from engagement. Tailwind CSS's npm downloads have climbed steadily, but its creator says documentation traffic is down about 40% since early 2023 and revenue has dropped close to 80%. Stack Overflow activity fell roughly 25% within six months of ChatGPT's launch. Open-source maintainers monetize through documentation visits, bug reports, and community interaction. AI agents skip all of that. The model finds that feedback loops once responsible for open source's explosive growth now run in reverse. Fewer maintainers can justify sharing code, variety shrinks, and average quality falls -- even as total usage rises. One proposed fix is a "Spotify for open source" model where AI platforms redistribute subscription revenue to maintainers based on package usage. Vibe-coded users need to contribute at least 84% of what direct users generate, or roughly 84% of all revenue must come from sources independent of how users access the software.' -- source: https://news.slashdot.org/story/26/02/03/1754205 Cheers, Peter

1 0

Notepad++ Compromised By State Actor
by Peter Reutemann 03 Feb '26

03 Feb '26

'Luthair writes: Notepad++ claims to have been targeted by a state actor, given their previous stance on Uyghurs one can speculate about a candidate. Notepad++, in a blog post: According to the analysis provided by the security experts, the attack involved infrastructure-level compromise that allowed malicious actors to intercept and redirect update traffic destined for notepad-plus-plus.org. The exact technical mechanism remains under investigation, though the compromise occurred at the hosting provider level rather than through vulnerabilities in Notepad++ code itself. Traffic from certain targeted users was selectively redirected to attacker-controlled served malicious update manifests.' -- source: https://it.slashdot.org/story/26/02/02/1646253 Cheers, Peter

1 0

Firefox is adding a switch to turn AI features off
by Peter Reutemann 03 Feb '26

03 Feb '26

'Unlike many of the companies stuffing AI into their browsers, Mozilla will soon give you a way to turn all of these features off. An update coming on February 24th will add a new “AI control” option to Firefox’s settings menu, allowing you to disable or enable the browser’s individual AI features, including access to a built-in AI chatbot, translations, AI tab group suggestions, and more.' -- source: https://www.theverge.com/news/872489/mozilla-firefox-ai-features-off-button Cheers, Peter

1 0

When 20-Year-Old Bill Gates Fought the World's First Software Pirates
by Peter Reutemann 02 Feb '26

02 Feb '26

'Just months after his 20th birthday, Bill Gates had already angered the programmer community," remembers this 50th-anniversary commemoration of Gates' Open Letter to Hobbyists. "As the first home computers began appearing in the 1970s, the world faced a question: Would its software be free?" Gates railed in 1976 that "Most of you steal your software." Gates had coded the BASIC interpreter for Altair's first home computer with Paul Allen and Monte Davidoff — only to see it pirated by Steve Wozniak's friends at the Homebrew Computing Club. Expecting royalties, a none-too-happy Gates issued his letter in the club's newsletter (as well as Altair's own publication), complaining "I would appreciate letters from any one who wants to pay up." But freedom-loving coders had other ideas. When Steve Wozniak and Steve Jobs released their Apple 1 home computer that summer, they stressed that "our philosophy is to provide software for our machines free or at minimal cost..." And early open-source hackers began writing their own free Tiny Basic interpreters to create a free alternative to the Gates/Micro-Soft code. This led to the first occurrence of the phrase "Copyleft" in October of 1976. Open Source definition author Bruce Perens shares his thoughts today. "When I left Pixar in 2000, I stopped in Steve Job's office — which for some reason was right across the hall from mine... " Perens remembered. "I asked Steve: 'You still don't believe in this Linux stuff, do you...?'" And Perens remembers how that movement finally won over Steve Jobs and carried the day. "Three years later, Steve stood onstage in front of a slide that said 'Open Source: We Think It's Great!' as he introduced the Safari browser, which at that time was based on the browser engine developed by the KDE Open Source project!"' -- source: https://news.slashdot.org/story/26/02/01/1915221 Cheers, Peter

1 0

Floppy Disk TV Remote
by Lawrence D'Oliveiro 20 Jan '26

20 Jan '26

Hardware hacker wants to make an alternative remote control for his smart TV that would be more intuitive for his toddler child to use than a conventional interactive remote interface. So what does he do? Build it out of an ancient, 1990s-technology floppy drive. Basic idea is that each floppy disk represents a different stream; user inserts disk into drive, TV starts playing that stream. Initially he thought of faking it, with simulated floppy “disks” with RFID chips on them that the “drive” would detect. Then he figured that the actual tactile experience of putting a real working disk into a real working drive would be far more effective. So he stores a config file on each disk that contains information about the stream to be played (plus associated display artwork), that software can read from the drive. Since there is only a small amount of data to be read off each disk, the drive can work quite nicely off battery power. So it becomes a real remote control as in one that is remote, not connected to the TV by any wire. Albeit one that is not very easy to pick up, but never mind ... <https://www.tomshardware.com/maker-stem/microcontrollers-projects/floppy-di… labeled-floppies-to-watch-his-favorite-shows>

2 1

“7 deprecated Linux commands you need to stop using - and what to use instead”
by Lawrence D'Oliveiro 15 Jan '26

15 Jan '26

Jack Wallen’s list <https://www.zdnet.com/article/linux-commands-deprecated-why-do-not-use/> of commands you shouldn’t be using any more, and what to use instead, is a mixed bag. ifconfig/iwconfig vs ip/iw -- the latter newer ones (part of the Linux “iproute2” suite) offer greater access to all the features of the Linux network stack than the former, older ones, and so are preferable in lots of ways. It is already possible to find setups which don’t have the old commands installed by default; I’m not sure if any distros have actually dropped the option for installing them altogether, but no doubt that will happen at some point. scp -- wrong. rsync, scp and sftp are all different ways of transferring files securely over SSH. scp did use to use its own protocol at one point, but it has been upgraded to use the same underlying protocol as sftp, so it’s perfectly fine to continue using the same command, if that’s what you’re used to. There is no sign that the scp command itself is going to be deprecated at any point, though no doubt the option to fall back to the old protocol for compatibility’s sake is likely to be removed eventually. egrep/fgrep -- it has been true for decades (possibly has always been true for the GNU utilities?) that egrep and fgrep are just synonyms for “grep -E” and “grep -F” respectively. And it is true that the alternative names are finally being deprecated after all these years, so it behooves you to learn to use the “grep” command for all forms. netstat vs ss -- yes, another case of the newer iproute2-based command taking over from the older, traditional command, and offering more features besides. Same remarks as above apply. route vs ip route -- iproute2 again. arp vs ip neighbour/neighbor -- more iproute2.

1 0

RISC-V PC Motherboard
by Lawrence D'Oliveiro 14 Jan '26

14 Jan '26

Here’s a mini-ITX motherboard with most of the usual trimmings (no integrated graphics or audio, though), but with a RISC-V CPU. So you’ll be using that single PCIe-x16 slot for a graphics card. Known to run Ubuntu. It’s available for pre-order <https://www.tomshardware.com/pc-components/cpus/milk-v-titan-mini-ix-board-…>. At this stage, it seems more targeted towards developers and early adopters, not (yet) the mass market.

2 1

How Long Does It Take to Fix Linux Kernel Bugs?
by Peter Reutemann 13 Jan '26

13 Jan '26

'A report from It's FOSS: Jenny Guanni Qu, a researcher at [VC fund] Pebblebed, analyzed 125,183 bugs from 20 years of Linux kernel development history (on Git). The findings show that the average bug takes 2.1 years to find. [Though the median is 0.7 years, with the average possibly skewed by "outliers" discovered after years of hiding.] The longest-lived bug, a buffer overflow in networking code, went unnoticed for 20.7 years! [But 86.5% of bugs are found within five years.] The research was carried out by relying on the Fixes: tag that is used in kernel development. Basically, when a commit fixes a bug, it includes a tag pointing to the commit that introduced the bug. Jenny wrote a tool that extracted these tags from the kernel's git history going back to 2005. The tool finds all fixing commits, extracts the referenced commit hash, pulls dates from both commits, and calculates the time frame. As for the dataset, it includes over 125k records from Linux 6.19-rc3, covering bugs from April 2005 to January 2026. Out of these, 119,449 were unique fixing commits from 9,159 different authors, and only 158 bugs had CVE IDs assigned. It took six hours to assemble the dataset, according to the blog post, which concludes that the percentage of bugs found within one year has improved dramatically, from 0% in 2010 to 69% by 2022. The blog post says this can likely be attributed to: - The Syzkaller fuzzer (released in 2015) - Dynamic memory error detectors like KASAN, KMSAN, KCSAN sanitizers - Better static analysis - More contributors reviewing code But "We're simultaneously catching new bugs faster AND slowly working through ~5,400 ancient bugs that have been hiding for over 5 years." They've also developed an AI model called VulnBERT that predicts whether a commit introduces a vulnerability, claiming that of all actual bug-introducing commits, it catches 92.2%. "The goal isn't to replace human reviewers but to point them at the 10% of commits most likely to be problematic, so they can focus attention where it matters..."' -- source: https://it.slashdot.org/story/26/01/12/0443201 Cheers, Peter

1 0

DMCA Takedown On Free Software
by Lawrence D'Oliveiro 07 Jan '26

07 Jan '26

Just read this report <https://www.tomshardware.com/software/chinese-semiconductor-outfit-has-linu…> about a DMCA takedown on a GitHub repository belonging to Rockchip. The copyright takedown was requested by the FFmpeg project. Their code is open source, of course. As is the code in the Rockchip repository. But the company took their code, removed the original attribution and licensing (LGPL), and put the result under an Apache licence, which is not compatible with the LGPL. Given that LGPL is a copyleft licence, and Apache is not, this could lead others to believe they could in turn take the Rockchip version of the code and develop it further and incorporate it into proprietary products without making any source available -- which is something copyleft is designed to prevent. Of course this action did not come out of the blue. The FFmpeg project had raised the issue with Rockchip back in 2024, but in the absence of any progress since that time, they felt that action had to be taken.

1 0

RIP Stewart Cheifet
by Lawrence D'Oliveiro 06 Jan '26

06 Jan '26

Those who spent their formative years back in the 20th century may or may not remember Stewart Cheifet, long-time presenter and executive producer of a US TV program called “The Computer Chronicles”, which was mainly produced through the 1980s and 1990s. I don’t recall that ever being shown here in NZ, but I later came to discover him through compilations of the shows on YouTube. And it turns it he has been instrumental in ensuring that records of all 400-odd episodes, as far as possible, have been preserved at the Internet Archive, as a valuable snapshot of the computing scene back in that era. Also of note, his co-presenter for the first several years was Gary Kildall, of CP/M fame, until the death of the latter. Now we hear Cheifet himself has passed away at the age of 87 <https://arstechnica.com/gadgets/2026/01/stewart-cheifet-pbs-host-who-chroni…>. (Oh, and if you’re wondering, he always pronounced it like “shuffay”).

1 0

pv - monitor the progress of data through a pipe
by Peter Reutemann 06 Jan '26

06 Jan '26

Hi everyone It's not Easter, but I love finding nifty little tools... :-) While looking up stackexchange for importing gzip-compressed MySQL dumps, I came across "pv", a tool for monitoring progress through pipes. Allows you to monitor how long, e.g., the import of a database dump will take. Example import command: pv mydump.sql.gz | gunzip | mysql -u root -p <database name> You will then see something like this: 1.73GiB 0:05:26 [6.54MiB/s] [=> ] 5% ETA 1:31:51 Here is the man page for pv: https://www.man7.org/linux/man-pages/man1/pv.1.html -- source: https://serverfault.com/a/445130 Cheers, Peter

1 0

2025 might have been the year for Linux gaming, but there's still a way to go until I switch from Windows
by Lawrence D'Oliveiro 30 Dec '25

30 Dec '25

Here is an article full of praise for the success Linux has been enjoying in handheld PC gaming, being able to run most Windows games better than Windows itself can manage <https://www.pcgamer.com/software/linux/2025-might-have-been-the-year-for-li…>. The writer mentions the one big obstacle to Linux enjoying greater success in this area: kernel-level anti-cheat mechanisms. The vast majority of these are Windows-specific, and many vendors are not only reluctant to support Linux as an alternative platform, they are downright hostile to it. Ultimately, though, I am going to put my bet on free-market Capitalism winning out. The customer is king. It is the game vendors who have to entice the buyers to part with their money in return for something worthwhile, the customers have no obligation to simply hand it over. If the only ace the Windows products have up their sleeve is obnoxious anti-cheat mechanisms, that may not be enough to keep customers flocking to them in droves. In other words, if the Linux-based handhelds continue to offer a superior user experience to the Windows-based ones, then those last remaining holdout vendors will be forced, purely by market forces, to go where the money is: they will ultimately be dragged, kicking and screaming, into supporting Linux gaming in some form.

1 0

Unix V4 Recovered
by Lawrence D'Oliveiro 25 Dec '25

25 Dec '25

A tape containing the only known copy of Bell Labs Unix version 4, dating from 1973, has been found at the University of Utah <https://www.tomshardware.com/software/linux/unix-v4-recovered-from-randomly…>. This was the first version of Unix in which the kernel and core utilities were (re)written in C. This particular tape had been sent to Martin Newell, he of the famous teapot. And yes, the recovered code is now available for you to try running for yourself.

1 0

The Linux Kernel Is Just A Program
by Lawrence D'Oliveiro 24 Dec '25

24 Dec '25

Came across this nifty little article <https://serversfor.dev/linux-inside-out/the-linux-kernel-is-just-a-program/> (found on Bluesky <https://bsky.app/profile/steveklabnik.com/post/3mapj6kf76k2d>) showing that you can run the Linux kernel directly from within a VM in qemu, without installing a distro or anything. It will boot, and then die because it wants to mount a root filesystem and start an init process; so then it’s easy enough to set that up with a few more commands, try booting it again, and there you go -- you have a running VM.

1 0

Linux Kernel Rust Code Sees Its First CVE Vulnerability
by Peter Reutemann 18 Dec '25

18 Dec '25

'Longtime Linux developer Greg Kroah-Hartman announced that the Linux kernel has received its first CVE tied to Rust code. Phoronix reports: This first CVE (CVE-2025-68260) for Rust code in the Linux kernel pertains to the Android Binder rewrite in Rust. There is a race condition that can occur due to some noted unsafe Rust code. That code can lead to memory corruption of the previous/next pointers and in turn cause a crash. This CVE for the possible system crash is for Linux 6.18 and newer since the introduction of the Rust Binder driver. At least though it's just a possible system crash and not any more serious system compromise with remote code execution or other more severe issues. ' -- source: https://it.slashdot.org/story/25/12/17/2034233 Cheers, Peter

1 0

Blocking ads with OpenWRT router
by Peter Reutemann 16 Dec '25

16 Dec '25

Hi everyone Found out on the weekend that I can install AdBlock straight on my router that is running OpenWRT: https://openwrt.org/docs/guide-user/services/ad-blocking?s%5B%5D=adblock Gets rid of (a large portion of) ads on mobile devices, like Android phones, when they are connected via WiFi. Cheers, Peter

1 0

New Rule Forbids GNOME Shell Extensions Made Using AI-Generated Code
by Peter Reutemann 15 Dec '25

15 Dec '25

'Phoronix reports: Due to the growing number of GNOME Shell extensions looking to appear on extensions.gnome.org that were generated using AI, it's now prohibited. The new rule in their guidelines note that AI-generated code will be explicitly rejected: "Extensions must not be AI-generated While it is not prohibited to use AI as a learning aid or a development tool (i.e. code completions), extension developers should be able to justify and explain the code they submit, within reason. Submissions with large amounts of unnecessary code, inconsistent code style, imaginary API usage, comments serving as LLM prompts, or other indications of AI-generated output will be rejected." In a blog post, GNOME developer Javad Rahmatzadeh explains that "Some devs are using AI without understanding the code..."' -- source: https://tech.slashdot.org/story/25/12/14/0453227 Cheers, Peter

1 0

New FreeBSD 15 Retires 32-Bit Ports and Modernizes Builds
by Peter Reutemann 08 Dec '25

08 Dec '25

'FreeBSD 15.0-RELEASE arrived this week, notes this report from The Register, which calls it the latest release "of the Unix world's leading alternative to Linux." As well as numerous bug fixes and upgrades to many of its components, the major changes in this version are reductions in the number of platforms the OS supports, and in how it's built and how its component software is packaged. FreeBSD 15 has significantly reduced support for 32-bit platforms. Compared to FreeBSD 14 in 2023, there are no longer builds for x86-32, POWER, or ARM-v6. As the release notes put it: "The venerable 32-bit hardware platforms i386, armv6, and 32-bit powerpc have been retired. 32-bit application support lives on via the 32-bit compatibility mode in their respective 64-bit platforms. The armv7 platform remains as the last supported 32-bit platform. We thank them for their service." Now FreeBSD supports five CPU architectures — two Tier-1 platforms, x86-64 and AArch64, and three Tier-2 platforms, armv7 and up, powerpc64le, and riscv64. Arguably, it's time. AMD's first 64-bit chips started shipping 22 years ago. Intel launched the original x86 chip, the 8086 in 1978. These days, 64-bit is nearly as old as the entire Intel 80x86 platform was when the 64-bit versions first appeared. In comparison, a few months ago, Debian 13 also dropped its x86-32 edition — six years after Canonical launched its first x86-64-only distro, Ubuntu 19.10. Another significant change is that this is the first version built under the new pkgbase system, although it's still experimental and optional for now. If you opt for a pkgbase installation, then the core OS itself is installed from multiple separate software packages, meaning that the whole system can be updated using the package manager. Over in the Linux world, this is the norm, but Linux is a very different beast... The plan is that by FreeBSD 16, scheduled for December 2027, the restructure will be complete, the old distribution sets will be removed, and the current freebsd-update command and its associated infrastructure can be turned off. Another significant change is reproducible builds, a milestone the project reached in late October. This change is part of a multi-project initiative toward ensuring deterministic compilation: to be able to demonstrate that a certain set of source files and compilation directives is guaranteed to produce identical binaries, as a countermeasure against compromised code. A handy side-effect is that building the whole OS, including installation media images, no longer needs root access. There are of course other new features. Lots of drivers and subsystems have been updated, and this release has better power management, including suspend and resume. There's improved wireless networking, with support for more Wi-Fi chipsets and faster wireless standards, plus updated graphics drivers... The release announcement calls out the inclusion of OpenZFS 2.4.0-rc4, OpenSSL 3.5.4, and OpenSSH 10.0 p2, and notes the inclusion of some new quantum-resistant encryption systems... In general, we found FreeBSD 15 easier and less complicated to work with than either of the previous major releases. It should be easier on servers too. The new OCI container support in FreeBSD 14.2, which we wrote about a year ago, is more mature now. FreeBSD has its own version of Podman, and you can run Linux containers on FreeBSD. This means you can use Docker commands and tools, which are familiar to many more developers than FreeBSD's native Jail system. "FreeBSD has its own place in servers and the public cloud, but it's getting easier to run it as a desktop OS as well," the article concludes. "It can run all the main Linux desktops, including GNOME on Wayland." "There's no systemd here, and never will be — and no Flatpak or Snap either, for that matter.' -- source: https://tech.slashdot.org/story/25/12/07/0627214 Cheers, Peter

1 0

How Home Assistant Leads a 'Local-First Rebellion'
by Peter Reutemann 08 Dec '25

08 Dec '25

'It runs locally, a free/open source home automation platform connecting all your devices together, regardless of brand. And GitHub's senior developer calls it "one of the most active, culturally important, and technically demanding open source ecosystems on the planet," with tens of thousands of contributors and millions of installations. That's confirmed by this year's "Octoverse" developer survey... Home Assistant was one of the fastest-growing open source projects by contributors, ranking alongside AI infrastructure giants like vLLM, Ollama, and Transformers. It also appeared in the top projects attracting first-time contributors, sitting beside massive developer platforms such as VS Code... Home Assistant is now running in more than 2 million households, orchestrating everything from thermostats and door locks to motion sensors and lighting. All on users' own hardware, not the cloud. The contributor base behind that growth is just as remarkable: 21,000 contributors in a single year... At its core, Home Assistant's problem is combinatorial explosion. The platform supports "hundreds, thousands of devices... over 3,000 brands," as [maintainer Franck Nijhof] notes. Each one behaves differently, and the only way to normalize them is to build a general-purpose abstraction layer that can survive vendor churn, bad APIs, and inconsistent firmware. Instead of treating devices as isolated objects behind cloud accounts, everything is represented locally as entities with states and events. A garage door is not just a vendor-specific API; it's a structured device that exposes capabilities to the automation engine. A thermostat is not a cloud endpoint; it's a sensor/actuator pair with metadata that can be reasoned about. That consistency is why people can build wildly advanced automations. Frenck describes one particularly inventive example: "Some people install weight sensors into their couches so they actually know if you're sitting down or standing up again. You're watching a movie, you stand up, and it will pause and then turn on the lights a bit brighter so you can actually see when you get your drink. You get back, sit down, the lights dim, and the movie continues." A system that can orchestrate these interactions is fundamentally a distributed event-driven runtime for physical spaces. Home Assistant may look like a dashboard, but under the hood it behaves more like a real-time OS for the home... The local-first architecture means Home Assistant can run on hardware as small as a Raspberry Pi but must handle workloads that commercial systems offload to the cloud: device discovery, event dispatch, state persistence, automation scheduling, voice pipeline inference (if local), real-time sensor reading, integration updates, and security constraints. This architecture forces optimizations few consumer systems attempt. "If any of this were offloaded to a vendor cloud, the system would be easier to build," the article points out. "But Home Assistant's philosophy reverses the paradigm: the home is the data center..." As Nijhof says of other vendor solutions, "It's crazy that we need the internet nowadays to change your thermostat."' -- source: https://news.slashdot.org/story/25/12/07/1955259 Cheers, Peter

1 0

Proposed Patches Make Upstream Linux Kernel Usable For The OpenWrt One Router
by Peter Reutemann 27 Nov '25

27 Nov '25

'Announced nearly one year ago was the OpenWrt One as a router/AP that is "hacker-friendly" and open-source. The OpenWrt One is powered by a Filogic 820 SoC and features WiFi 6. This official OpenWrt device is manufactured by Banana Pi. While there is downstream open-source code available for customizing the OpenWrt One to your heart's content, the upstream Linux kernel support to date hasn't been full-featured. Sjoerd Simons of Collabora today posted a set of 15 patches for making the OpenWrt One AP functional with the upstream Linux kernel. As Sjoerd puts it, to make the OpenWrt One "actually useful as an access point" with the mainline Linux kernel. The patches get PCI Express working as tested with NVMe storage, the wired network interfaces enabled, the WiFi/wireless networking brought up, status LEDs enabled, SPI NOR, and related bits. The patches bring the necessary Device Tree support and extensions to existing drivers to make everything work without any new drivers being required. There are various kernel quirks required too at this point for making the device happy with the mainline Linux kernel. All in just over 500 lines of code for making the OpenWrt One useful with these patches that will be hopefully mainlined to the Linux kernel.' -- source: https://www.phoronix.com/news/OpenWrt-One-Useful-Linux Has anyone experience with this router? Cheers, Peter

1 0

Arduino's New Terms of Service Worries Hobbyists Ahead of Qualcomm Acquisition
by Peter Reutemann 25 Nov '25

25 Nov '25

'Ars Technica: Some members of the maker community are distraught about Arduino's new terms of service (ToS), saying that the added rules put the company's open source DNA at risk. Arduino updated its ToS and privacy policy this month, which is about a month after Qualcomm announced that it's acquiring the open source hardware and software company. Among the most controversial changes is this addition: "User shall not: translate, decompile or reverse-engineer the Platform, or engage in any other activity designed to identify the algorithms and logic of the Platform's operation, unless expressly allowed by Arduino or by applicable license agreements ..." In response to concerns from some members of the maker community, including from open source hardware distributor and manufacturer Adafruit, Arduino posted a blog on Friday. Regarding the new reverse-engineering rule, Arduino's blog said: "Any hardware, software or services (e.g. Arduino IDE, hardware schematics, tooling and libraries) released with Open Source licenses remain available as before. Restrictions on reverse-engineering apply specifically to our Software-as-a-Service cloud applications. Anything that was open, stays open." But Adafruit founder and engineer Limor Fried and Adafruit managing editor Phillip Torrone are not convinced. They told Ars Technica that Arduino's blog leaves many questions unanswered and said that they've sent these questions to Arduino without response. "Why is reverse-engineering prohibited at all for a company built on openly hackable systems?" Fried and Torrone asked in a shared statement. There are also concerns about the ToS' broad new AI-monitoring powers, which offer little clarity on what data is collected, who can access it, or how long it's retained. On top of that, the update introduces an unusual patent clause that bars users from using the platform to identify potential infringement by Arduino or its partners, along with sweeping, perpetual rights over user-generated content. This could allow Arduino, and potentially Qualcomm, to republish, modify, monetize, or redistribute user uploads indefinitely.' -- source: https://hardware.slashdot.org/story/25/11/24/2144256 Cheers, Peter

1 0

The DoorDash Problem: Amazon Sues Perplexity
by Lawrence D'Oliveiro 22 Nov '25

22 Nov '25

A lot of companies are making a comfortable living by selling goods or services online: Amazon, DoorDash, Uber etc. A key part of the business model is that the visitors to their site are actual humans, who can be shown ads, or otherwise persuaded to upsell to some enticing extra product (“Would you like chips with that?”) and thereby disgorge a little bit of extra revenue. This is part of what’s called “building a relationship with the customer”. Which is a nice way of saying “owning the customer”. But what if the visitors to your site are AI bots, looking for deals on behalf of a human that ends up one step removed from contact with you? Then all those ads and extra persuasive messages fall on the worst kind of deaf ears -- no ears at all. The human says to the AI agent “get me a ride to the airport”, the agent goes away to the Uber and Lyft sites (or whatever else turns up), and picks the cheapest option at that moment. The human doesn’t know which company is providing the ride that turns up on their doorstep, and they won’t care. The providers of these products have become mere commodity suppliers. This thought does scare some of these online retailers. And now Amazon, just about the biggest such e-tailer out there, is suing Perplexity, a provider of just such an AI agent service. Amazon says that this is about maintaining a “positive customer experience”; but surely the form of the “customer experience” is something for the customer to choose. Amazon also says that access by AI bots is against the terms of service for its site, and that is clearly the core of its legal claim. But will such a claim hold up in court? How far can companies go in dictating exactly what form users’ accesses to their site can take? <https://www.theverge.com/podcast/823909/the-doordash-problem-ai-agents-web-…>

1 0

The EU made Apple adopt new Wi-Fi standards, and now Android can support AirDrop
by Lawrence D'Oliveiro 21 Nov '25

21 Nov '25

People in the US like to make fun of the seemingly endless bureaucratic hurdles that the EU Governments keep putting in the way of US companies looking to make a quick buck. You know, having to worry about boring things like “privacy” and “interoperability” and “security”, that kind of thing. Oh, and maintaining free-market competition -- imagine lecturing the USA about how to achieve that! But every now and then, this endless stream of new regulations hits the jackpot. Like how Google is suddenly able to offer full two-way compatibility with Apple’s formerly-proprietary “AirDrop” feature for exchanging files between mobile devices -- the file exchange is done directly, peer-to-peer, without going through any central servers. It’s all down to the fact that the EU forced Apple to move away from the completely proprietary low-level radio protocol it was originally using for AirDrop, towards something that was more amenable to exactly the sort of reverse-engineering of the higher-level protocol that Google did. Of course Apple did also contribute work towards the new standard, just as it did with USB Type-C; it’s better to be seen to be cooperating with inevitability, rather than futilely trying to fight it tooth and nail. <https://arstechnica.com/gadgets/2025/11/the-eu-made-apple-adopt-new-wi-fi-s…>

1 0

HP And Dell Disable HEVC (H.265) Support Built Into Their Laptops’ CPUs
by Lawrence D'Oliveiro 21 Nov '25

21 Nov '25

Some owners of HP and Dell laptops are finding that their machines can no longer playback HEVC/H.265-encoded video content, even though this capability is supposed to be built into their hardware <https://arstechnica.com/gadgets/2025/11/hp-and-dell-disable-hevc-support-bu…>. Why is this happening? The obvious answer: patent issues. The royalty rates these companies have to pay to offer this functionality is going up quite substantially from next year, and they have to cut costs. So the users will have to pay extra money to get this capability back. Synology also used to offer the capability to transcode videos to H.265 on some of its products, but discontinued that as of last year. This is why AV1 was created by Google and other companies: to offer a patent-free alternative to H.265. But in spite of all the patent issues that were clear from the beginning, lots of companies went ahead with H.265-based products regardless. Maybe now we will see the popularity of AV1 increase?

1 0

The Origin Of The Smiley
by Lawrence D'Oliveiro 21 Nov '25

21 Nov '25

Here’s a report <https://arstechnica.com/gadgets/2025/11/in-1982-a-physics-joke-gone-wrong-s…> on the precise origins of the use of the character sequences “:-)” and “:-(”, not quite to denote happiness/unhappiness as they are commonly used today, but to distinguish jokes from serious postings. The discussion happened back in September 1982, on a bulletin-board system running on a DECsystem-20 at Carnegie-Mellon University. It came about as a result of a joke posting being taken way too seriously (of course ...). To add to the interest, there is more than personal testimony to back up the record: original backup tapes of bboard postings from that time were dug up, and the actual transcript of those discussions was extracted, and are now available online <https://www.cs.cmu.edu/~sef/Orig-Smiley.htm>.

1 0

Taming The Data Destroyer
by Lawrence D'Oliveiro 17 Nov '25

17 Nov '25

I use the “dd” command fairly frequently, to put new versions of SystemRescue on the USB stick I dedicate to that purpose, for example. The command has been nicknamed the “data destroyer”, because while doing sector-level copies as root, it can be all too easy to write to the wrong device, and destroy an important filesystem. The “lsblk” command can be handy for confirming which block device you should be writing to, before pressing Enter on that fateful command. There’s lots of information it can display, to help you identify the right device. For example, a command like lsblk -o NAME,SIZE,SERIAL,WWN,VENDOR,MODEL shows a little tree display of devices and partitions in the first column, followed by a lot of info you can use to identify what is currently plugged in. I tried a couple of USB sticks, and they showed amazingly long strings for their serial numbers. My SystemRescue stick shows the vendor as “TOSHIBA” and the model as “TransMemory”. Interestingly, both Western Digital and Seagate drives show the vendor as “ATA”, though the model name begins with “WDC” for the one and “ST” for the other. The SSD boot drives in both my main workstation and laptop display blank for the vendor, but again the model field shows some vendor-specific information.

1 0

Glitch Tokens
by Lawrence D'Oliveiro 16 Nov '25

16 Nov '25

Added something more to my modest store of AI knowledge with this little item about “glitch tokens” -- inputs that make AI language models respond in bizarre and inexplicable ways <https://www.youtube.com/watch?v=WO2X3oZEJOA>. Some people assumed this behaviour was just a random consequence of the whole neural-network concept. Others probed a bit deeper, and discovered some actually explicable, if surprising, causes of particular glitches. What else is lurking in there ... ?

1 0

Why Windows sucks and how to fix it, according to a former Microsoft engineer
by Lawrence D'Oliveiro 14 Nov '25

14 Nov '25

Former Microsoft engineer (and retrocomputing enthusiast) Dave Plummer has done a video on what he thinks is wrong with Microsoft Windows <https://www.zdnet.com/article/why-windows-sucks-and-how-to-fix-it-according…>. According to him, Windows should have a “Pro” mode, which turns off a lot of the handholding. Secondly, users need to be given more control over the telemetry data that Microsoft collects about their activities. And thirdly, Microsoft should restore the option to run a Windows installation without having to register a Microsoft account. Generally, Microsoft should avoid “dark patterns” -- trying to inveigle its users into accessing the company’s online services, whether they wanted to or not. And turn down the volume a bit on all this “agentic OS” malarkey. All I have to say is: “HAHAHAHAHAHAHAHAHA!!!”. Plummer may be an engineer, but he’s not a businessman. Perhaps he hasn’t noticed that Windows isn’t bringing in as much profit for the company as it used to. So all these changes are attempts to boost revenue -- necessary, in the company’s eyes. Because how else do you keep such an expensive-to-develop, expensive-to-maintain OS afloat? Does Microsoft think it can get away with such behaviour, in spite of the chorus of complaints? Of course it does. And the article admits as such: So does Windows really suck? Yeah, it does, at least in certain ways. Of course, I'm still using it after all these years. Maybe it's become like an old, worn shoe that still feels comfortable despite all the problems. Phrases like “boiling the frog” come to mind ...

2 2

New Project Brings Strong Linux Compatibility To More Classic Windows Games
by Peter Reutemann 14 Nov '25

14 Nov '25

'Ars Technica reports: For years now, Valve has been slowly improving the capabilities of the Proton compatibility layer that lets thousands of Windows games work seamlessly on the Linux-based SteamOS. But Valve's Windows-to-Linux compatibility layer generally only extends back to games written for Direct3D 8, the proprietary Windows graphics API Microsoft released in late 2000. Now, a new open source project is seeking to extend Linux interoperability further back into PC gaming history. The d7vk project describes itself as "a Vulkan-based translation layer for Direct3D 7 [D3D7], which allows running 3D applications on Linux using Wine." The new project isn't the first attempt to get Direct3D 7 games running on Linux. Wine's own built-in WineD3D compatibility layer has supported D3D7 in some form or another for at least two decades now. But the new d7vk project instead branches off the existing dxvk compatibility layer, which is already used by Valve's Proton for SteamOS and which reportedly offers better performance than WineD3D on many games. D7vk project author WinterSnowfall writes that while they don't expect this new project to be upstreamed into the main dxvk in the future, the new version should have "the same level of per application/targeted configuration profiles and fixes that you're used to seeing in dxvk proper." And though d7vk might not perform universally better than the existing alternatives, WinterSnowfall writes that "having more options on the table is a good thing in my book at least." The report notes that the PC Gaming Wiki lists more than 400 games built on the aging D3D7 APIs, spanning mostly early-2000s releases but with a trickle of new titles still appearing through 2022. Notable classics include Escape from Monkey Island and Hitman: Codename 47.' -- source: https://linux.slashdot.org/story/25/11/10/2216209 Cheers, Peter

2 1

Business Laptops -- Linux At Both High And Low Ends
by Lawrence D'Oliveiro 13 Nov '25

13 Nov '25

Interesting to read this buyer’s guide to business laptops <https://www.computerworld.com/article/1553700/buyers-guide-to-business-lapt…>. Chromebooks have long been popular for school use, but are also finding a place in certain business needs as well. But look at the highest end -- the “mobile workstations”, the most expensive machines: When it comes to mobile workstations, all the careful calculations for size, weight, and battery life are replaced with a singular focus on performance, particularly for graphics. This laptop class insists on all-out performance for anything from Computer Aided Design and Manufacturing (CAD/CAM) to graphics design to AI model training. Not your noddy Word/Excel jockeys, then. Furthermore: MacOS and Windows 11 dominate here, but there’s another alternative: some models, like Lenovo’s ThinkPad P16 Gen 2, offer Fedora or Ubuntu Linux as an option. Also note that of all the laptop categories, this one has most resisted the move to Windows 11, largely because some specialty software and drivers don’t support the new OS. The Eurocom Panther 5, for instance, is configurable with Windows 10, Windows Server 2016, or even older versions of Windows. Windows 10, or even older?? Really?? I wonder how the purveyors of that “specialty software” (no doubt proprietary) can offer quality support for their product on an obsolete, buggy OS whose owner washed their hands of it years ago. The Linux option, though: if they’re smart and paying attention to users making choices like the one offered by Lenovo, they’ll move their software to running under that, and put an end to those long-standing Windows-endemic software headaches.

1 0

The Linux Kernel Looks To "Bite The Bullet" In Enabling Microsoft C Extensions
by Peter Reutemann 13 Nov '25

13 Nov '25

'Two patches queued into the Linux kernel's build system development tree, kbuild-next, would enable the -fms-extensions compiler argument everywhere for allowing GCC and LLVM/Clang to use the Microsoft C Extensions when compiling the Linux kernel. Being in kbuild-next these patches will likely be submitted for the Linux 6.19 kernel merge window next month but remains to be seen if there will be any last minute objections to this change. The -fms-extensions compiler option honored by the GNU Compiler Collection and LLVM/Clang allow enabling some non-standard C/C++ constructs used within Microsoft header files and honored by the the Microsoft Visual C/C++ compiler. For Linux kernel development purposes, enabling the Microsoft C Extensions would allow including a tagged struct or union anonymously in another struct/union. Going back many years there have been patches floated to unconditionally enable -fms-extensions for the Linux kernel but they haven't made it past the Linux kernel mailing list. But now with these two patches being in kbuild-next mean that it will likely be submitted for the Linux 6.19 kernel merge window barring any objections from prominent Linux kernel developers or Linus Torvalds himself.' -- article: https://www.phoronix.com/news/Linux-6.19-Patch-Would-MS-Ext -- source: https://mastodon.social/@nixCraft/115523510778052589 Cheers, Peter

1 0

Bumble Berry Pi
by Peter Reutemann 12 Nov '25

12 Nov '25

'Are you looking for a cheap and easy to build Raspberry Pi handheld? Check out the Bumble Berry Pi project which focuses on affordability and simplicity, letting you quickly create a portable cyberdeck perfect for terminal work, scripting, coding, or gaming on the go. Ha! You can have 37 Watt-hour battery that that lasts all day long with with Raspberry Pi 3b+.' -- github: https://github.com/samcervantes/bumble-berry-pi -- source: https://mastodon.social/@nixCraft/115524921845809880 This looks seriously cool! :-) Cheers, Peter

1 0

Firefox 145 Drops Support For 32-bit Linux
by Peter Reutemann 12 Nov '25

12 Nov '25

'Mozilla has released Firefox 145.0, and the standout change in this version is the official end of support for 32-bit Linux systems. Users on 32-bit distributions will no longer receive updates and are being encouraged to switch to the 64-bit build to continue getting security patches and new features. While most major Linux distributions have already moved past 32-bit support, this shift will still impact older hardware users and lightweight community projects that have held on to 32-bit for the sake of performance or preservation. The rest of the update introduces features such as built-in PDF comments, improved fingerprinting resistance for private browsing, tab group previews, password management in the sidebar, and minor UI refinements. Firefox also now compresses local translation models with Zstandard to reduce storage needs. But the end of 32-bit Linux support is the change that will leave the biggest mark, signaling another step toward a web ecosystem firmly centered on 64-bit computing.' -- source: https://news.slashdot.org/story/25/11/11/1757229 Cheers, Peter

1 0

FFmpeg To Google: Fund Us or Stop Sending Bugs
by Peter Reutemann 12 Nov '25

12 Nov '25

'FFmpeg, the open source multimedia framework that powers video processing in Google Chrome, Firefox, YouTube and other major platforms, has called on Google to either fund the project or stop burdening its volunteer maintainers with security vulnerabilities found by the company's AI tools. The maintainers patched a bug that Google's AI agent discovered in code for decoding a 1995 video game but described the finding as "CVE slop." The confrontation centered on a Google Project Zero policy announced in July that publicly discloses reported vulnerabilities within a week and starts a ninety-day countdown to full disclosure regardless of patch availability. FFmpeg, written primarily in assembly language, handles format conversion and streaming for VLC, Kodi and Plex but operates without adequate funding from the corporations that depend on it. Nick Wellnhofer resigned as maintainer of libxml2, a library used in all major web browsers, because of the unsustainable workload of addressing security reports without compensation and said he would stop maintaining the project in December.' -- source: https://news.slashdot.org/story/25/11/11/1947215 Cheers, Peter

1 0

Is AI Becoming A Linux-Only Thing?
by Lawrence D'Oliveiro 11 Nov '25

11 Nov '25

I wondered why it was necessary to give Windows users “an environment that can easily deploy AI apps made specifically for Linux on Windows machines without dealing with a complicated setup process”, according to <https://www.tomshardware.com/tech-industry/artificial-intelligence/asrocks-…>. Are there that many Linux-specific AI apps? It appears there are: Making matters worse, most "cutting-edge" AI applications are typically optimized for Linux, making it even harder for Windows users to get these apps up and running in Windows (if at all). You’d think most AI apps would concentrate on the Windows market, or at least support Windows and Linux equally. But perhaps not: The original version of AI Quickset was only capable of configuring AI applications that were designed with either Windows or Linux in mind. AI Quickset WSL expands upon this and again allows users the freedom to run Linux-based AI apps on Windows, which is a huge deal if you dabble in AI models that are mostly [relegated] to the Linux space.

1 1

Rust Is Coming To Debian's APT Package Manager
by Peter Reutemann 10 Nov '25

10 Nov '25

'A maintainer of Debian's Advanced Package Tool (APT) "has announced plans to introduce hard Rust dependencies into APT starting May 2026," reports the blog It's FOSS. The integration targets critical areas like parsing .deb, .ar, and tar files plus HTTP signature verification using Sequoia. [APT maintainer Julian Andres Klode] said these components "would strongly benefit from memory safe languages and a stronger approach to unit testing." He also gave a firm message to maintainers of Debian ports: "If you maintain a port without a working Rust toolchain, please ensure it has one within the next 6 months, or sunset the port." The reasoning is straightforward. Debian wants to move forward with modern tools rather than being held back by legacy architecture... Debian ports running on CPU architectures without Rust compiler support have six months to add proper toolchains. If they can't meet this deadline, those ports will need to be discontinued. As a result, some obscure or legacy platforms may lose official support. For most users on mainstream architectures like x86_64 and ARM, nothing changes. Your APT will simply become more secure and reliable under the hood. It's FOSS argues that "If done right, this could significantly strengthen APT's security and code quality." And the blog Linuxiac also supports the move. "By embedding Rust into APT, the distro joins a growing number of major open-source projects, such as the Linux kernel, Firefox, and systemd, that are gradually adopting Rust. And if I had to guess, I'd say this is just one of the first steps toward even deeper Rust integration in this legendary distribution, which is a good thing."' -- source: https://linux.slashdot.org/story/25/11/09/0232234 Cheers, Peter

1 0

Lost Unix v4 Possibly Recovered on a Forgotten Bell Labs Tape From 1973
by Peter Reutemann 10 Nov '25

10 Nov '25

'"A tape-based piece of unique Unix history may have been lying quietly in storage at the University of Utah for 50+ years," reports The Register. And the software librarian at Silicon Valley's Computer History Museum, Al Kossow of Bitsavers, believes the tape "has a pretty good chance of being recoverable." Long-time Slashdot reader bobdevine says the tape will be analyzed at the Computer History Museum. More from The Register: The news was posted to Mastodon by Professor Robert Ricci of the University of Utah's Kahlert School of Computing [along with a picture. "While cleaning a storage room, our staff found this tape containing #UNIX v4 from Bell Labs, circa 1973..." Ricci posted on Mastodon. "We have arranged to deliver it to the Computer History Museum."] The nine-track tape reel bears a handwritten label reading: UNIX Original From Bell Labs V4 (See Manual for format)... If it's what it says on the label, this is a notable discovery because little of UNIX V4 remains. That's unfortunate as this specific version is especially interesting: it's the first version of UNIX in which the kernel and some of the core utilities were rewritten in the new C programming language. Until now, the only surviving parts known were the source code to a slightly older version of the kernel and a few man pages — plus the Programmer's Manual [PDF], from November 1973. The Unix Heritage Society hosts those surviving parts — and apparently some other items of interest, according to a comment posted on Mastodon. "While going through the tapes from Dennis Ritchie earlier this year, I found some UNIX V4 distribution documents," posted Mastodon user "Broken Pipe," linking to tuhs.org/Archive/Applications/Dennis_Tapes/Gao_Analysis/v4_dist/. There's a file called license ("The program and information transmitted herewith is and shall remain the property of Bell Lab%oratories...") and coldboot ("Mount good tape on drive 0..."), plus a six-page "Setup" document that ends with these words... We expect to have a UNIX seminar early in 1974. Good luck. Ken Thompson Dennis Ritchie Bell Telephone Labs Murray Hill, NJ 07974' -- source: https://tech.slashdot.org/story/25/11/09/0528258 Cheers, Peter

1 0

Microsoft 365 Billing Screwup Refund Is Another Screwup
by Lawrence D'Oliveiro 09 Nov '25

09 Nov '25

About a year ago, Microsoft announced price increases for its “365” (not “Office”) product, while adding the Copilot feature. What it failed to mention was that users had the option of continuing on the old plan at the old price, without the Copilot feature -- which a lot of users didn’t want anyway. Some users went to cancel their plan, and at that point they would have been presented with the option to continue on the old plan. The rest would have felt they had no option but to pay the higher price. This is all deceptive behaviour which is against the law in both Australia and NZ, and presumably other civilized countries as well. Microsoft has decided to revert the price increase and offer a refund to users in both countries. Unfortunately, users in NZ don’t seem able to claim this -- the whole mechanism seems set up solely to cater to customers in Australia. Also it seems to only be available for certain plans and not others, and customers may still end up paying more anyway. Meanwhile, Australia’s anticompetition watchdog, the ACCC, is pressing ahead with its lawsuit against Microsoft. The company has also received a warning from NZ’s Commerce Commission. <https://www.nzherald.co.nz/business/microsoft-365-refund-fails-to-head-off-…>

1 1

IBM To Cut Thousands Of Jobs As Red Hat Growth Slows
by Lawrence D'Oliveiro 06 Nov '25

06 Nov '25

There are still some who have difficulty appreciating that the Linux world is much bigger than Red Hat. Here <https://www.computerworld.com/article/4084865/ibm-to-cut-thousands-of-jobs-…> is another reminder. Red Hat may well be the most profitable part of IBM left (which is why its troubles are having such an outsize impact on the company as a whole), but in the whole Open Source scheme of things, it is but one of many players.

1 0

GIMP Officially Launches Its New Snap Package for Linux Users
by Peter Reutemann 06 Nov '25

06 Nov '25

'The GIMP team has officially announced that the popular open-source image editor is now available as a Snap package, expanding its presence across Linux distributions that bet on this package format, especially the Ubuntu family and those based on it. Until now, the GIMP Snap package was maintained by the community-driven Snapcrafters project. Following a careful handover process that took several months, GIMP has taken over official ownership. The highlight of this first official Snap release is the new gimp-plugins plug interface. Previously, the Snap version came bundled with a few third-party plugins, but the GIMP team decided to follow its “vanilla package” policy—meaning no extra code outside of GIMP, GEGL, or BABL. Instead, developers implemented the gimp-plugins interface, which works similarly to GIMP’s Flatpak extension point or Microsoft’s MSIX modification packages. It allows plugin developers to ship their extensions separately, without breaking Snap’s strict confinement model. Currently, two plugins—GMIC and OpenVINO—can be installed through their respective Snap repositories. GIMP has also published a how-to guide on its developer website for anyone who wants to create or package Snap plugins. The first officially supported Snap release is GIMP 3.0.6, co-produced with the Snapcrafters team. It’s now available on the latest/stable channel, while users who prefer to test new features can grab the development version from the preview/stable channel. Just like with GIMP’s Flatpak and Microsoft Store (MSIX) packages, future Snap releases will be deployed automatically on release day. Users can install the official Snap right now from gimp.org/downloads.' -- source: https://linuxiac.com/gimp-officially-launches-its-new-snap-package-for-linu… Cheers, Peter

1 0

Bug in Rust-Based UUtils Broke Ubuntu 25.10 Automatic Update Checks
by Peter Reutemann 03 Nov '25

03 Nov '25

'"Ubuntu's decision to switch to Rust-based coreutils in 25.10 hasn't been the smoothest ride," writes the blog OMG Ubuntu, "as the latest — albeit now resolved — bug underscores." [Coreutils] are used by a number of processes, apps and scripts, including Ubuntu's own unattended-upgrades process, which automatically checks for new software updates. Alas, the Rust-based version of date had a bug which meant Ubuntu 25.10 desktops, servers, cloud and container images were not able to automatically check for updates when configured. Unattended-upgrades hooks into the date utility to check the timestamp of a reference file of when an update check was last run and, past a certain date, checks again. But date was incorrectly showing the current date, always. A fix has been issued so only Ubuntu 25.10 installs withrust-coreutils 0.2.2-0ubuntu2 (or earlier) are affected.' -- source: https://news.slashdot.org/story/25/11/03/0049215 Cheers, Peter

1 0

Industrial and medical devices struggle to upgrade to Windows 11
by Lawrence D'Oliveiro 01 Nov '25

01 Nov '25

The healthcare sector is hitting some hiccups trying to upgrade its equipment to Windows 11 <https://www.computerworld.com/article/4082710/industrial-and-medical-device…>. But then, this has happened with every major upgrade of Windows before this; why are the same mistakes still being made? Surely when you buy an expensive piece of equipment with an expected useful lifetime measurable in decades and a computer at its heart, common sense dictates that you will nail down a support contract that will cover hardware *and* software maintenance over that lifetime, will you not? We have had about half a century of experience of gear like this, since long before Microsoft came along. I wonder what lessons have been learned ...

1 0

LMDE 7 Officially Released with Debian 13 Base
by Peter Reutemann 31 Oct '25

31 Oct '25

'Over two years after the previous 6 “Faye” release, the Linux Mint team has officially unveiled LMDE 7 “Gigi”, a major new LTS release of the Debian-based Mint variant, bringing all the new features, improvements, and polished visuals from the Ubuntu-based 22.2 “Zara” edition, released in early September, over to the LMDE version. The release’s highlight is, of course, that LMDE 7 “Gigi” marks a major turning point: it is now entirely rebased on Debian 13 “Trixie”, which becomes the new upstream base for all packages. Under the hood, it’s powered by the Linux kernel 6.12 LTS, delivering broader hardware support and stability improvements for modern systems. On the desktop side, as I already said, LMDE 7 essentially incorporates all the enhancements introduced in Linux Mint 22.2 “Zara”. Among these is the introduction of Fingwit, a dedicated fingerprint authentication utility that enables biometric login and sudo operations on supported systems.' -- source: https://linuxiac.com/lmde-7-officially-released-with-debian-13-base/ Cheers, Peter

1 0

International Criminal Court To Ditch Microsoft Office For European Open Source Alternative
by Peter Reutemann 31 Oct '25

31 Oct '25

'The International Criminal Court will switch its internal work environment away from Microsoft Office to Open Desk, a European open source alternative, the institution confirmed to Euractiv. The switch comes amid rising concerns about public bodies being reliant on US tech companies to run their services, which have stepped up sharply since the start of US President Donald Trump's second administration. For the ICC, such concerns are not abstract: Trump has repeatedly lashed out at the court and slapped sanctions on its chief prosecutor, Karim Khan. Earlier this year, the AP also reported that Microsoft had cancelled Khan's email account, a claim the company denies. "We value our relationship with the ICC as a customer and are convinced that nothing impedes our ability to continue providing services to the ICC in the future," a Microsoft spokesperson told Euractiv.' -- source: https://news.slashdot.org/story/25/10/30/1847204 Cheers, Peter

1 0

Say it with me: Windows is the problem with Windows handhelds
by Lawrence D'Oliveiro 30 Oct '25

30 Oct '25

Sean Hollister says <https://www.theverge.com/games/807711/xbox-ally-sleep-fail-bazzite-fix-perf…>: It’s been nearly two weeks since Microsoft, a multi-trillion dollar company, shipped a $600 handheld “Xbox” that can’t be relied on to sleep, wake, or hold a charge while asleep in my tests. Neither Microsoft nor Asus would admit there’s a problem with the white Xbox Ally or offer a timeline to fix it after repeated requests by The Verge. But if you want your white Asus handheld to start working reliably, you could do what I did: I installed the latest build of Bazzite, a SteamOS-like, Linux-based operating system that works properly with gamepad controls, and sleeps like a dream. ... Did I mention Bazzite runs most of my Windows games *substantially faster* than Windows? Rub it in even more, why don’t you: It’s not just games that feel faster: Steam is a far more responsive interface without the bloat of Windows lurking under the hood. It feels like an entirely different handheld. With Bazzite, I can use it like I use a Nintendo Switch, simply pressing the power button whenever I want to pause a game, then picking up exactly where I left off hours or days later. Microsoft’s response: Microsoft declined our request for an interview about the future of the Xbox Ally or a timeline on fixes, but VP of Windows product management Anshul Rawat provided this statement to The Verge: ... We’ve identified a small set of issues and initial fixes will be rolling out soon. Optimizing Windows, the most flexible OS in the world, for a range of devices and screen sizes across PCs and the cloud is an ongoing journey. Really?? Windows is “the most flexible OS in the world”, getting its lunch eaten by Linux not just in mobile, but in practically every computing sphere?

2 1

Blender 5.0 Introducing HDR Support On Linux With Vulkan + Wayland
by Peter Reutemann 29 Oct '25

29 Oct '25

'Michael Larabel writes via Phoronix: The upcoming Blender 5.0 3D modeling software application is introducing High Dynamic Range (HDR) display support on Linux when making use of Wayland -- no X11 support for HDR -- and Vulkan graphics accelerator. HDR support for Blender 5.0 on Linux is currently considered experimental. Enabling the HDR support on Linux for the Blender creator software requires having a High Dynamic Range display (of course) and be running on a Wayland desktop, enabling Vulkan API acceleration rather than OpenGL, and enabling the feature currently deemed experimental. ' -- source: https://linux.slashdot.org/story/25/06/26/2035245 Cheers, Peter

2 2

toolong
by Peter Reutemann 29 Oct '25

29 Oct '25

Just came across the "toolong" tool: 'A terminal application to view, tail, merge, and search log files (plus JSONL).' -- github: https://github.com/Textualize/toolong -- source: https://mastodon.social/@nixCraft/115455395475544673 Cheers, Peter

2 1

Nearly 90% of Windows Games Now Run on Linux, Latest Data Shows
by Peter Reutemann 29 Oct '25

29 Oct '25

'Nearly nine in ten Windows games can now run on Linux systems, according to data from ProtonDB compiled by Boiling Steam. The gains came through work by developers of WINE and Proton translation layers and through interest in hardware like the Steam Deck. ProtonDB tracks games across five categories. Platinum-rated games run perfectly without adjustment. Gold titles need minor tweaks. Silver games are playable but imperfect. Bronze exists between silver and borked. Borked games refuse to launch. The proportion of new releases earning platinum ratings has grown. The red and dark red zones have thinned. Some popular titles remain incompatible, however. Boiling Steam noted that other developers appear averse to non-Windows gamers.' -- source: https://linux.slashdot.org/story/25/10/28/206219 Cheers, Peter

2 1

Games Run Faster On SteamOS Than Windows 11, Ars Testing Finds
by Peter Reutemann 16 Oct '25

16 Oct '25

'A report from Ars Technica: Nearly a decade ago, Ars testing found that Valve's "Steam Machines"-era version of SteamOS performed significantly worse than Windows when SteamOS's Linux game ports were tested on the same hardware as their Windows counterparts. Today, though, Ars testing on the Lenovo Legion Go S finds recent games generally run at higher frame rates on SteamOS 3.7 than on Windows 11. [...] As you can see in the included charts, SteamOS showed noticeable frame rate improvements in four of the five games tested. Only Borderlands 3 showed comparable performance across both operating systems, with Windows eking out ever-so-slightly higher frame rates in that game's benchmarks. For the other four tested games, the stock Lenovo Windows drivers were sometimes significantly worse than those included with SteamOS. When playing Returnal at "High" graphics presets and 1920x1200 resolution, for instance, changing from Lenovo's Windows drivers to SteamOS meant the difference between a hard-to-take 18 FPS average and a downright decent 33 FPS average. Sideloading the updated Asus drivers showed a noticeable improvement in Windows performance across all tested games and even brought Homeworld 3's "Low" graphics benchmark test to practical parity with SteamOS. In all other cases, though, even these updated drivers resulted in benchmark frame rates anywhere from 8 percent to 36 percent lower than those same benchmarks on SteamOS. These results might seem a bit counterintuitive, considering that games running on SteamOS must go through a Proton translation layer for every native Windows instruction in a game's code. But Valve has put in consistent work over the years to make Proton as efficient and cross-compatible as possible; not to mention its continued work on Linux's Mesa graphics drivers seems to be paying dividends for SteamOS graphics performance. Running SteamOS also means eliminating a lot of operating system overhead that the more generalist Windows uses by default. Microsoft seems aware of this issue for gamers and has recently announced that the upcoming "Xbox Experience for Handheld" will "minimize background activity and defer non-essential tasks" to allow for "more [and] higher framerates" in games.' -- source: https://games.slashdot.org/story/25/06/25/2034243 Cheers, Peter

2 2

Nosey Parker: Open-source tool finds sensitive information in textual data and Git history
by Peter Reutemann 16 Oct '25

16 Oct '25

This sounds like a useful tool: 'Nosey Parker is an open-source command-line tool that helps find secrets and sensitive information hidden in text files. It works like a specialized version of grep, focused on spotting things like passwords, API keys, and other confidential data. The tool was built with offensive security in mind, such as helping red teams move through systems during tests. It’s also useful for defensive teams checking their own systems. Offensive cybersecurity company Praetorian has used it in hundreds of security engagements to uncover hidden secrets. Key features: - Flexible scanning: Works on files, folders, GitHub repositories, and Git history. It also supports custom input sources. - Proven detection rules: Uses 188 tested regular expression rules, built from feedback by security engineers, to cut down on false positives. - Less noise: Groups duplicate matches of the same secret, making reviews 10 to 1,000 times faster. - High performance: Can scan gigabytes per second on multicore machines and handle datasets as large as 20TB.' -- source: https://www.helpnetsecurity.com/2025/09/24/nosey-parker-open-source-tool/ -- github: https://github.com/praetorian-inc/noseyparker Cheers, Peter

1 0

Secure Boot Bypass Risk Threatens Nearly 200,000 Linux Framework Laptops
by Peter Reutemann 16 Oct '25

16 Oct '25

'Roughly 200,000 Linux-based Framework laptops shipped with a signed UEFI shell command (mm) that can be abused to bypass Secure Boot protections -- allowing attackers to load persistent bootkits like BlackLotus or HybridPetya. Framework has begun patching affected models, though some fixes and DBX updates are still pending. BleepingComputer reports: According to firmware security company Eclypsium, the problem stems from including a 'memory modify' (mm) command in legitimately signed UEFI shells that Framework shipped with its systems. The command provides direct read/write access to system memory and is intended for low-level diagnostics and firmware debugging. However, it can also be leveraged to break the Secure Boot trust chain by targeting the gSecurity2 variable, a critical component in the process of verifying the signatures of UEFI modules. The mm command can be abused to overwrite gSecurity2 with NULL, effectively disabling signature verification. "This command writes zeros to the memory location containing the security handler pointer, effectively disabling signature verification for all subsequent module loads." The researchers also note that the attack can be automated via startup scripts to persist across reboots.' -- source: https://it.slashdot.org/story/25/10/14/2123205 Cheers, Peter

1 0

FSF Announces the LibrePhone Project
by Peter Reutemann 16 Oct '25

16 Oct '25

'The Free Software Foundation (FSF) has launched the LibrePhone Project, an initiative to create a fully free and open-source mobile operating system that eliminates proprietary firmware and binary blobs. From the FSF: "Librephone is a new initiative by the FSF with the goal of bringing full freedom to the mobile computing environment. The vast majority of software users around the world use a mobile phone as their primary computing device. After forty years of advocacy for computing freedom, the FSF will now work to bring the right to study, change, share, and modify the programs users depend on in their daily lives to mobile phones. ... Practically, Librephone aims to close the last gaps between existing distributions of the Android operating system and software freedom. The FSF has hired experienced developer Rob Savoye (DejaGNU, Gnash, OpenStreetMap, and more) to lead the technical project. He is currently investigating the state of device firmware and binary blobs in other mobile phone freedom projects, prioritizing the free software work done by the not entirely free software mobile phone operating system LineageOS." ' -- source: https://news.slashdot.org/story/25/10/15/0312206 -- project: https://librephone.fsf.org/ Cheers, Peter

1 0

Flatpak Doesn't Work in Ubuntu 25.10, But a Fix is Coming
by Peter Reutemann 14 Oct '25

14 Oct '25

'"It's not just you: Flatpak flat-out doesn't work in the new Ubuntu 25.10 release," writes the blog OMG Ubuntu: While Flatpak itself can be installed using apt, trying to install Flatpaks with Flatpak from the command-line throws a "could not unmount revokefs-fuse filesystem" error, followed by "Child process exited with code 1". For those who've installed the Ubuntu 'Questing Quokka' and wanted to kit it out with their favourite software from Flathub, it's a frustrating road bump. AppArmor, the tool that enforces Ubuntu's security policies for apps, is causing the issue. According to the bug report on Launchpad, the AppArmor profile for fusermount3 lacks the privileges it needs to work properly in Ubuntu 25.10. Fusermount3 is a tool Flatpak relies on to mount and unmount filesystems... This is a bug and it is being worked on. Although there's no timeframe for a fix, it is marked as critical, so will be prioritised. The bug was reported in early September, but not fixed in time for this week's Ubuntu 25.10 release, reports Phoronix: Only [Friday] an updated AppArmor was pushed to the "questing-proposed" archive for testing. Since then... a number of users have reported that the updated AppArmor from the proposed archive will fix the Flatpak issues being observed. From all the reports so far it looks like that proposed update is in good shape for restoring Flatpak support on Ubuntu 25.10. The Ubuntu team is considering pushing out this update sooner than the typical seven day testing period given the severity of the issue. More details from WebProNews: Industry insiders point out that AppArmor, Ubuntu's mandatory access control system, was tightened in this release to enhance security... This isn't the first time AppArmor has caused friction; similar issues plagued Telegram Flatpak apps in Ubuntu 24.04 LTS earlier this year, as noted in coverage from OMG Ubuntu.' -- source: https://news.slashdot.org/story/25/10/13/067256 Cheers, Peter

1 0

Ubuntu 25.10 'Questing Quokka' Released
by Peter Reutemann 10 Oct '25

10 Oct '25

'9to5Linux reports: Dubbed Questing Quokka, Ubuntu 25.10 is powered by the latest and greatest Linux 6.17 kernel series for top-notch hardware support and ships with the latest GNOME 49 desktop environment, defaulting to a Wayland-only session for the Ubuntu Desktop flavor, meaning there's no other session to choose from the login screen. Ubuntu Desktop also ships with two new apps, namely GNOME's Loupe instead of Eye of GNOME as the default image viewer, as well as Ptyxis instead of GNOME Terminal as the default terminal emulator. Also, there's a new update notification that will be shown with options to open Software Updater or install updates directly.' Other highlights of Ubuntu 25.10 include sudo-rs as the default implementation of sudo, Dracut as the default initramfs-tools, Chrony as the default NTP (Network Time Protocol) client, Rust Coreutils as the default implementation of GNU Core Utilities, and TPM-backed FDE (Full Disk Encryption) recovery key management. Moreover, Ubuntu 25.10 adds NVIDIA Dynamic Boost support and enables suspend-resume support in the proprietary NVIDIA graphics driver to prevent corruption and freezes when waking an NVIDIA desktop. For Intel users, Ubuntu 25.10 introduces support for new Intel integrated and discrete GPUs.' -- source: https://news.slashdot.org/story/25/10/09/2054218 Cheers, Peter

1 0

VLC’s First Update in a Year to Introduce Qt6 and Windows ARM64 Support
by Peter Reutemann 09 Oct '25

09 Oct '25

'After a year of silence, one of the most popular media players, VLC, is back with a new release candidate, version 3.0.22 RC1 (Vetinari). Although much of the attention is on version 4.0, long in development and expected to deliver major changes, this release also includes a notable update. One of the most important features is support for building VLC with Qt6, which is (as you can guess) a big win for all KDE enthusiasts. On top of that, the release candidate introduces native Windows ARM64 support, reflecting the growing interest in ARM hardware on laptops and tablets. The update also packs a wide set of fixes and adjustments. The developers disabled the older liba52, libmpeg2, and libdca libraries by default, encouraging use of libavcodec instead. On the playback side, users can expect improvements for AV1, Opus, ProRes, FLAC, and JPEG handling, plus more reliable behavior when seeking over SFTP and refinements in Matroska and DVD caption support. Regarding security, VLC 3.0.22 RC1 addresses a record number of issues, many of them caught through the oss-fuzz project and funding from the SecureTrust Fund. That makes this update one of the most important in recent years from a stability and safety standpoint. Lastly, Windows users will notice that the player now allows renaming, moving, or deleting the currently playing file, and there’s even a renewed compatibility with Windows XP SP3 (yes, there are still enthusiasts betting on it), which is still in use in some very specific setups.' -- source: https://linuxiac.com/vlcs-first-update-in-a-year-to-introduce-qt6-and-windo… Cheers, Peter

1 0

Tails 7.0 Anonymous Linux OS Officially Released, Based on Debian 13 “Trixie”
by Peter Reutemann 07 Oct '25

07 Oct '25

'Tails 7.0 is out today as a major update to this portable Linux OS based on the Debian GNU/Linux operating system that protects users against surveillance and censorship. Highlights of Tails 7.0 include a Debian 13 “Trixie” base and a kernel from the long-term supported Linux 6.12 LTS series from the upstream Debian release, the latest GNOME 48 desktop environment by default featuring GNOME Console as default terminal emulator and GNOME Loupe as default image viewer. The Tails devs note the fact that the Root Terminal was broken when replacing GNOME Terminal with GNOME Console, so they renamed Root Terminal to Root Console. They also removed the Kleopatra app from the Favorites menu, so now users will have to start Kleopatra from Apps > Accessories. Moreover, they removed the obsolete Network Connection option from the Welcome Screen, the Places menu, and some packages from the live ISO image, including unar, aircrack-ng, and sq. Tails 7.0 ships with many updated components, including Tor 0.4.8.17, Tor Browser 14.5.7, Mozilla Thunderbird 128.14 ESR, OnionShare 2.6.3, Kleopatra 24.12, KeePassXC 2.7.10, GIMP 3.0.4, Inkscape 1.4, Audacity 3.7.3, and Electrum 4.5.8. For Inkscape, Tails now skips the onboarding. This release also fixes various issues, including an issue with selecting the correct keyboard for certain languages. Check out the release notes for more details about the changes included in Tails 7.0, which is available for download right now from the official website as ISO and USB images for 64-bit systems.' -- source: https://9to5linux.com/tails-7-0-anonymous-linux-os-released-based-on-debian… Cheers, Peter

1 0

Redis Warns of Critical Flaw Impacting Thousands of Instances
by Peter Reutemann 07 Oct '25

07 Oct '25

'BleepingComputer reports: The Redis security team has released patches for a maximum severity vulnerability that could allow attackers to gain remote code execution on thousands of vulnerable instances. Redis (short for Remote Dictionary Server) is an open-source data structure store used in approximately 75% of cloud environments, functioning like a database, cache, and message broker, and storing data in RAM for ultra-fast access. The security flaw (tracked as CVE-2025-49844) is caused by a 13-year-old use-after-free weakness found in the Redis source code and can be exploited by authenticated threat actors using a specially crafted Lua script (a feature enabled by default). Successful exploitation enables them to escape the Lua sandbox, trigger a use-after-free, establish a reverse shell for persistent access, and achieve remote code execution on the targeted Redis hosts. After compromising a Redis host, attackers can steal credentials, deploy malware or cryptocurrency mining tools, extract sensitive data from Redis, move laterally to other systems within the victim's network, or use stolen information to gain access to other cloud services. "This grants an attacker full access to the host system, enabling them to exfiltrate, wipe, or encrypt sensitive data, hijack resources, and facilitate lateral movement within cloud environments," said Wiz researchers, who reported the security issue at Pwn2Own Berlin in May 2025 and dubbed it RediShell. While successful exploitation requires attackers first to gain authenticated access to a Redis instance, Wiz found around 330,000 Redis instances exposed online, with at least 60,000 of them not requiring authentication. Redis and Wiz urged admins to patch their instances immediately by applying security updates released on Friday, "prioritizing those that are exposed to the internet." To further secure their Redis instances against remote attacks, admins can also enable authentication, disable Lua scripting and other unnecessary commands, launch Redis using a non-root user account, enable Redis logging and monitoring, limit access to authorized networks only, and implement network-level access controls using firewalls and Virtual Private Clouds (VPCs).' -- source: https://it.slashdot.org/story/25/10/06/222222 Cheers, Peter

1 0

Systemd 258 Drops cgroup v1, Raises Kernel Baseline to 5.4
by Peter Reutemann 06 Oct '25

06 Oct '25

'Systemd, a widely adopted system and service manager for Linux, has released its latest iteration, v258, which introduces significant changes that administrators should be aware of. Probably the headline change is that support for cgroup v1—the so-called “legacy” and “hybrid” hierarchies—has been removed. From now on, only cgroup v2 is mounted during boot and inside systemd-nspawn containers. Another notable move is the bump in the minimum kernel requirement. The baseline is now Linux 5.4, first released back in 2019, with 5.7 listed as the recommended version. That means older distributions or kernels simply won’t be able to run systemd 258. Security changes are also in play. By default, tty/pts device nodes now get mode 0600 instead of the old 0620, which effectively means “mesg n” is the new normal. On the crypto side, OpenSSL has become the only supported backend for systemd-resolved and systemd-importd, dropping support for both GnuTLS and libgcrypt. Session handling has been reworked, too. systemd-logind now assigns system jobs like cron tasks or FTP sessions to new “light” classes by default. That way, they won’t spin up a full per-user service manager unless explicitly configured. PAM sessions tied to normal users remain unchanged. Admins maintaining old setups should also take note: support for System V–style init scripts is officially deprecated and scheduled for removal in systemd 259. The same goes for the legacy /run/lock/ directory, and for iptables support in networkd and nspawn, which will rely solely on nftables from the next release.' -- source: https://linuxiac.com/systemd-258-drops-cgroup-v1-raises-kernel-baseline-to-… Cheers, Peter

1 0

How to switch your Windows 10 PC to Linux Mint - for free
by Peter Reutemann 06 Oct '25

06 Oct '25

Maybe this article with step-by-step instructions might help some of the Windows user in your circle to switch to Linux... -- source: https://www.zdnet.com/article/how-to-switch-your-windows-10-pc-to-linux-min… Cheers, Peter

1 0

We Asked LibreOffice and Collabora: Why Aren’t They in Schools Instead of Word and Google Docs?
by Peter Reutemann 30 Sep '25

30 Sep '25

'Much free and open source software helps its users save money as possible — on both hardware and software — while protecting their privacy. It also often makes it easy for them to learn how it works — if they’re interested — and customize it in any way they want or need. With such features, FOSS should be the default choice in any educational environment, in these days when many schools face budget cuts, and switching to “free as in free beer” proprietary cloud applications like Microsoft Teams or Google Docs to save money has the consequence of actively preparing and educating pupils to be endless sources of data to be exploited for the likes of money and political control. That being true, how come so many schools and universities still accept — if not demand — that their students use only proprietary software and clouds? How come so many taxpayer dollars allocated for public education ends up being used to make the likes of Microsoft and Google even richer? Saving money can’t be the only answer — especially in the long term. [...] In my experience, besides ignorance and resistance to change, the main reasons why too many schools still don’t use LibreOffice and Collabora Online in 2025 are, in no particular order: - Money - Already established supply chains - Teacher overload - Isolation - Cloud computing - Improper formatting choices' -- source: https://fossforce.com/2025/09/we-asked-libreoffice-and-collabora-why-arent-… Cheers, Peter

1 0

Ubuntu 25.10 Switches to Dracut as Default Initramfs Tool
by Peter Reutemann 30 Sep '25

30 Sep '25

'The big news came from the Canonical camp. Ubuntu developers have officially approved a long-planned move affecting a fundamental system component: starting with Ubuntu 25.10 “Questing Quokka,” the distro will switch from initramfs-tools to Dracut as its default initramfs generation tool. For readers who aren’t too tech-savvy, I will immediately clarify that the initramfs is the temporary root filesystem the Linux kernel uses at boot. It contains the drivers and scripts needed to mount the actual system and get everything running. And just for reference, Ubuntu has relied on initramfs-tools for nearly two decades. Surprising to many or not, Dracut was originally developed in the Fedora/Red Hat ecosystem. What makes it stand out is that, instead of relying on big sets of custom shell scripts, it builds the initramfs image using small, reusable modules. This modular design makes it easier to maintain, more consistent across different Linux distros, and often faster to update.' -- source: https://linuxiac.com/ubuntu-25-10-switches-to-dracut-as-default-initramfs-t… Cheers, Peter

1 0

Meta Learned The Wrong Lesson From Frances Haugen
by Lawrence D'Oliveiro 12 Sep '25

12 Sep '25

Remember when Frances Haugen came forward in 2021 to reveal that Facebook/Meta knew it was causing harm to underage users, but didn’t seem keen to do anything about it <https://www.theverge.com/policy/775623/meta-whistleblowers-hearing-virtual-…>? The company did make changes as a result of that revelation, but they were the wrong kind of changes: instead of actually fixing the problem of underage harm, it decided to stop collecting the data that revealed that harm. It has restricted researchers’ access, and threatened the jobs of those who wanted to gather data on “forbidden” topics.

1 0

FFmpeg 8.0 “Huffman” Released with AV1 Vulkan Encoder, VVC VA-API Decoding
by Peter Reutemann 04 Sep '25

04 Sep '25

'FFmpeg 8.0 has been released today as a major update to this open-source multimedia framework that introduces numerous features, including new decoders, as well as various improvements. Dubbed “Huffman” and coming more than ten months after FFmpeg 7.1, the FFmpeg 8.0 release is here to enable TLS peer certificate verification by default, add an AV1 Vulkan encoder, introduce VP9 Vulkan and ProRes RAW Vulkan hardware-acceleration, and implement APV encoding support through a libopenapv wrapper. FFmpeg 8.0 also introduces animated JPEG XL encoding via the libjxl library, adds multitrack audio/video and modern codec support to FLV v2, adds VVC (Versatile Video Coding) support in Matroska (MKV), and adds VVC decoder support to all SCC (Screen Content Coding) content, including IBC (Inter Block Copy), Palette Mode, and ACT (Adaptive Color Transform). Several new filters are present in this release, including a Whisper filter, a pad_cuda filter, a Colordetect filter, and a vf_scale_d3d11 filter. New decoders are here as well, including a VVC VA-API decoder, a RealVideo 6.0 decoder, an ADPCM IMA Xbox decoder, a G.728 decoder, a Sanyo LD-ADPCM decoder, and a ProRes RAW decoder. On top of that, FFmpeg 8.0 brings libx265 alpha layer encoding, CENC AV1 support in the MP4 muxer, an APV decoder, along with APV raw bitstream muxing and demuxing support, an APV parser, APV support for MP4/ISOBMFF muxing and demuxing, as well as an OpenHarmony hardware decoder and encoder. Among other noteworthy changes, FFmpeg 8.0 drops support for OpenSSL 1.1.0 and previous versions, no longer disables GCC autovectorization on x86, ARM, and AArch64 (ARM64) architectures, sets the default prediction method for pngenc to PAETH, deprecates OpenMAX encoders, and drops yasm support in favor of nasm.' -- source: https://9to5linux.com/ffmpeg-8-0-huffman-released-with-av1-vulkan-encoder-v… The "Whisper filter" would be used for automatically generating sub-titles: https://www.phoronix.com/news/FFmpeg-Lands-Whisper I've used whisper before and it is quite impressive. Cheers, Peter

1 0

FreeBSD Project Isn't Ready To Let AI Commit Code Just Yet
by Peter Reutemann 04 Sep '25

04 Sep '25

'The latest status report from the FreeBSD Project says no thanks to code generated by LLM-based assistants. From a report: The FreeBSD Project's Status Report for the second quarter of 2025 contains updates from various sub-teams that are working on improving the FreeBSD OS, including separate sub-projects such as enabling FreeBSD apps to run on Linux, Chinese translation efforts, support for Solaris-style Extended Attributes, and for Apple's legacy HFS+ file system. The thing that stood out to us, though, was that the core team is working on what it terms a "Policy on generative AI created code and documentation." The relevant paragraph says: "Core is investigating setting up a policy for LLM/AI usage (including but not limited to generating code). The result will be added to the Contributors Guide in the doc repository. AI can be useful for translations (which seems faster than doing the work manually), explaining long/obscure documents, tracking down bugs, or helping to understand large code bases. We currently tend to not use it to generate code because of license concerns. The discussion continues at the core session at BSDCan 2025 developer summit, and core is still collecting feedback and working on the policy."' -- source: https://developers.slashdot.org/story/25/09/03/1649201 Cheers, Peter

1 0

Are AI Web Crawlers 'Destroying Websites' In Their Hunt for Training Data?
by Peter Reutemann 01 Sep '25

01 Sep '25

Hi everyone I thought this news item rather fitting when I saw it this morning, considering Daniel's experience with these AI bots hammering the wlug wiki: '"AI web crawlers are strip-mining the web in their perpetual hunt for ever more content to feed into their Large Language Model mills," argues Steven J. Vaughan-Nichols at the Register. And "when AI searchbots, with Meta (52% of AI searchbot traffic), Google (23%), and OpenAI (20%) leading the way, clobber websites with as much as 30 Terabits in a single surge, they're damaging even the largest companies' site performance..." How much traffic do they account for? According to Cloudflare, a major content delivery network (CDN) force, 30% of global web traffic now comes from bots. Leading the way and growing fast? AI bots... Anyone who runs a website, though, knows there's a huge, honking difference between the old-style crawlers and today's AI crawlers. The new ones are site killers. Fastly warns that they're causing "performance degradation, service disruption, and increased operational costs." Why? Because they're hammering websites with traffic spikes that can reach up to ten or even twenty times normal levels within minutes. Moreover, AI crawlers are much more aggressive than standard crawlers. As the InMotionhosting web hosting company notes, they also tend to disregard crawl delays or bandwidth-saving guidelines and extract full page text, and sometimes attempt to follow dynamic links or scripts. The result? If you're using a shared server for your website, as many small businesses do, even if your site isn't being shaken down for content, other sites on the same hardware with the same Internet pipe may be getting hit. This means your site's performance drops through the floor even if an AI crawler isn't raiding your website... AI crawlers don't direct users back to the original sources. They kick our sites around, return nothing, and we're left trying to decide how we're to make a living in the AI-driven web world. Yes, of course, we can try to fend them off with logins, paywalls, CAPTCHA challenges, and sophisticated anti-bot technologies. You know one thing AI is good at? It's getting around those walls. As for robots.txt files, the old-school way of blocking crawlers? Many — most? — AI crawlers simply ignore them... There are efforts afoot to supplement robots.txt with llms.txt files. This is a proposed standard to provide LLM-friendly content that LLMs can access without compromising the site's performance. Not everyone is thrilled with this approach, though, and it may yet come to nothing. In the meantime, to combat excessive crawling, some infrastructure providers, such as Cloudflare, now offer default bot-blocking services to block AI crawlers and provide mechanisms to deter AI companies from accessing their data. ' -- source: https://tech.slashdot.org/story/25/08/31/1820249 Cheers, Peter

1 0

WLUG Wiki -- “Service Unavailable”?
by Lawrence D'Oliveiro 30 Aug '25

30 Aug '25

I was checking a link on the WLUG Wiki <https://wiki.wlug.org.nz/>, but it is currently returning “503 Service Unavailable”. I hope this is temporary ...

2 4

Bottles Project Receives EU-Backed Grant
by Peter Reutemann 18 Aug '25

18 Aug '25

'Over the past year, the Bottles project, a popular compatibility layer for running Windows software on Linux, has hit a bit of a rough patch, with financial struggles putting a serious damper on its development progress. It got to a point where, as we informed you back in early July, lead developer Mirko Brombin shared an honest update about the project’s tough financial situation and called on the open source community for support. Thankfully, that call didn’t go unheard—and now, it looks like those financial worries are behind them. The project secured a grant from the NLnet Foundation through its 2025 Commons Fund. This funding is a big deal, as it’ll help speed up development on Bottles Next, the project’s ambitious effort to deliver a sleeker, more modern experience for handling Windows apps in Linux environments.' -- source: https://linuxiac.com/bottles-project-receives-eu-backed-grant/ I had never heard of this project before today. Here is some more background: https://docs.usebottles.com/faq/why-bottles Cheers, Peter

1 0

Useful Commands Beginning With “ls”
by Lawrence D'Oliveiro 14 Aug '25

14 Aug '25

The “ls” command for listing directory contents has inspired a whole range of commands for listing other kinds of information. Here are a few I found in a quick search on my system: lsblk -- show block devices (disks, SSDs, SD cards, USB sticks etc). lscpu -- show information about your CPUs lsfd -- show information about open files (successor to lsof) lshw -- show detailed hardware information lsipc -- show state of Inter-Process Communication structures (message queues, shared memory, semaphores) lsirq -- show information about kernel hardware interrupt handling lslocks -- show information about filesystem locks lslogins -- show information about user IDs associated with processes on the system. This is not just regular user logins, but also user IDs allocated to system processes. lsmem -- show information about physical memory known to the kernel lsmod -- show state of loaded kernel modules lspci -- show information about PCI buses and connected devices. This will commonly include a lot of motherboard hardware, not just that in expansion slots. lsusb -- show information about connected USB devices. I think all these are from the util-linux package, which should be installed by default. Oh, and a bonus one that has nothing to do with system info as such: lsar -- handy tool for displaying the contents of various formats of archives, such as .zip, .tar and .7z files. Part of the “unar” package. Relevant manual pages (if these are not on your system): https://manpages.debian.org/lsblk(8) https://manpages.debian.org/lscpu(1) https://manpages.debian.org/lsfd(1) https://manpages.debian.org/lshw(1) https://manpages.debian.org/lsipc(1) https://manpages.debian.org/lsirq(1) https://manpages.debian.org/lslocks(8) https://manpages.debian.org/lslogins(1) https://manpages.debian.org/lsmem(1) https://manpages.debian.org/lsmod(8) https://manpages.debian.org/lspci(8) https://manpages.debian.org/lsusb(8) https://manpages.debian.org/lsar(1)

1 0

Bye-Bye Dialup USA
by Lawrence D'Oliveiro 10 Aug '25

10 Aug '25

US-based ISP America On-Line (AOL) will finally turn off its dialup Internet service at the end of September <https://www.tomshardware.com/service-providers/network-providers/aol-will-e…>, ending 34 years of operation. AOL was the biggest ISP in the US back in dialup days, but somehow never made a successful transition to broadband service like everyone else. Another peculiarity was that, unlike ISPs everywhere else in the world who offered their dialup service via standard protocols like SLIP (early days) or PPP (the most common later), AOL always stuck to its own proprietary protocol. The company was also infamous for loosing vast numbers of its sign-up CDs on the world via magazines, free mailouts and so on, in an effort to drum up business. There were endless jokes about what to do with this deluge of unwanted AOL CDs.

1 0

Blender 4.5 LTS Released
by Peter Reutemann 05 Aug '25

05 Aug '25

'NERDS.xyz reports: Blender 4.5 has arrived and it's a long-term support release. That means users get two full years of updates and bug fixes, making it a smart choice for anyone looking for stability in serious projects. Whether you're a solo artist or part of a studio pipeline, this version is built to last. Here's a list of key features and changes in this release: - Vulkan backend replaces OpenGL (faster, smoother UI) - Adaptive subdivision up to 14x faster with multithreading - New Geometry Nodes: Camera Info, Instance Bounds - GPU-accelerated compositor nodes with standardized inputs - New Boolean solver: Manifold (cleaner, faster mesh operations) - UV maps visible in Object Mode + improved selection behavior - Grease Pencil render pass and Geometry Nodes integration - Improved file import support: PLY, OBJ, STL, CSV, VDB - Deprecations: Collada, Big Endian, legacy .blend, Intel Mac support - Cycles OptiX now requires NVIDIA driver v535+ - New shader variants for add-on developers (POLYLINES_*, POINT_*) ~500 bug fixes across all major systems' -- source: https://tech.slashdot.org/story/25/07/15/1912208 Cheers, Peter

2 1

Microsoft Is Abandoning Windows 11 SE
by Lawrence D'Oliveiro 04 Aug '25

04 Aug '25

Seems like Microsoft’s attempt to fight back against Google’s Chromebooks in the education market has been a failure, and it is giving up <https://www.tomshardware.com/software/windows/microsoft-ending-windows-11-s…>. Put the blame on trying to squeeze the Windows quart into the pint-pot of low-cost, purpose-built educational machines: Microsoft hasn't given a formal reason as to why they are ending Windows 11 SE. Presumably, one of the biggest challenges was that despite being a version meant for classrooms, it was fundamentally based on the full version of Windows 11. This meant it struggled to run well on the low-cost devices that schools often buy, a space where Chrome OS thrives. Google’s offering continues to be a truly lightweight cloud-based operating system designed from the ground up for this purpose. Does this mean we stop including Chromebooks as part of the “desktop” market that Windows is supposedly king of?

1 0

Old Mailing List Archive Archive
by Lawrence D'Oliveiro 01 Aug '25

01 Aug '25

With the demise of the old Waikato-Uni-based WLUG list server went its archive of list messages. Luckily, that archive was itself archived at archive.org. Here <https://web.archive.org/web/20240711100644/https://list.waikato.ac.nz/archi…> is the last snapshot I could find of the list archive before it disappeared.

1 0

KDE Linux
by Peter Reutemann 01 Aug '25

01 Aug '25

Looks like it is finally available (initiative got announced in 2024): 'Linux has been used for decades powering the world’s supercomputers, data centers, web servers, and most smartphones. Now KDE makes it available for you too! Introducing KDE Linux, a free operating system that can turbocharge new computers and breathe new life into old ones.' -- source: https://kde.org/linux/ -- mastodon: https://mastodon.social/@nixCraft/114949288867476013 Cheers, Peter

2 1

Weta Digital’s Technology Division Sold To US Firm
by Lawrence D'Oliveiro 01 Aug '25

01 Aug '25

Let me see if I understand this article <https://www.nzherald.co.nz/business/sir-peter-jackson-to-sell-weta-digital-…> correctly: the part of Weta Digital that used to develop the in-house 3D graphics/effects tools that they use in all those movies is being sold to US-based Unity Software. The part that is left will be called “WetaFX”, and will become a customer of Unity for the use of those tools, no longer doing its own development in-house. By the way, I’ve been looking at the Unity site <https://unity.com/>, and it looks like all their products are rentware (subscription-based).

1 2

Debian isn't waiting for 2038 to blow up, switches to 64-bit time for everything
by Peter Reutemann 31 Jul '25

31 Jul '25

'Venerable Linux distribution Debian is side-stepping the Y2K38 bug – also known as the Unix Epochalypse – by switching to 64-bit time for everything but the oldest of supported hardware, starting with the upcoming Debian 13 "Trixie" release. "[We will] use 64-bit time_t on 32-bit architectures to avoid the 'year 2038 problem' when the existing 32-bit signed int rolls over (potentially setting time back to 1900)," the Debian maintainers say of the move and the problem it aims to fix. y2k illustration retro futuristic The 'nothing-happened' Y2K bug – how the IT industry worked overtime to save world's computers READ MORE "This is now less than 15 years away and plenty of systems that will have problems have already been shipped. We should stop adding to the problem." Readers of a certain vintage will remember well the "Y2K problem," caused by retrospectively shortsighted attempts to save a couple of bytes by using two-digit years – meaning that "2000" is represented as "00" and assumed to be "1900." While predictions of aircraft falling from the skies and bank balances being wiped out by negative-decades of interest did not, thankfully, come true, that was purely due to the tireless behind-the-scenes work of software developers who were able to patch affected systems before celebrating the turn of the century. There's another, less well-known clock problem looming, however: the Unix Epochalypse,which affects any systems that measure time the Unix way – in seconds elapsed since January 1, 1970. Come the very precise time of 03:14:07 UTC on January 19, 2038, the number of seconds elapsed will be larger than can be represented by a signed 32-bit integer. This would be fine if the decision hadn't been made all those years ago to store the number of seconds in exactly such a format.' -- source: https://www.theregister.com/2025/07/25/y2k38_bug_debian/ Cheers, Peter

1 0

Malware Discovered in Arch Linux AUR Packages
by Peter Reutemann 28 Jul '25

28 Jul '25

Something for the arch users on here: 'If you are an Arch user, you know – AUR (Arch User Repository) is a double-edged sword—it’s incredibly useful but requires caution. Unfortunately, that caution was warranted yet again this week when three AUR packages were found to contain malware. The issue came to light on July 16 when a user uploaded a malicious package, librewolf-fix-bin, to the AUR. Within hours, two more packages—firefox-patch-bin and zen-browser-patched-bin—followed, all traced back to the same bad actor. Security researchers quickly identified the threat: a Remote Access Trojan (RAT) hidden in a script pulled from a GitHub repository. For those unfamiliar, a RAT is no joke—it can grant attackers full control over an infected system, enabling them to steal data, install additional malware, or spy on users. Thankfully, the Arch Linux security team responded promptly as soon as they became aware of the issue. By July 18, all three malicious packages had been removed from AUR.' -- source: https://linuxiac.com/malware-discovered-in-arch-linux-aur-packages/ Cheers, Peter

1 0

Clear Linux Discontinued as Intel Pulls the Plug Overnight
by Peter Reutemann 28 Jul '25

28 Jul '25

'Unfortunately, there’s a bit of sad news out of the Linux world this week, with Clear Linux taking center stage. What I’m talking about is that Intel has formally ended support for Clear Linux OS, drawing a rapid close to a nearly decade-long effort to showcase aggressive, upstream-friendly performance optimizations on x86_64. In a blog post titled “All good things come to an end: Shutting down Clear Linux OS,” the announcement states that support ends immediately, with no trailing window for security updates. "After years of innovation and community collaboration, we’re ending support for Clear Linux OS. Effective immediately, Intel will no longer provide security patches, updates, or maintenance for Clear Linux OS, and the Clear Linux OS GitHub repository will be archived in read-only mode." Crucially, “effective immediately” is not rhetorical: Intel states that there will be no further security patches, updates, or maintenance, and the project’s GitHub repository is to be archived in a read-only manner. As you can guess, that abrupt cutoff leaves any production or lab systems running Clear Linux exposed going forward, so administrators now face an urgent migration. For those unfamiliar, Clear Linux (a project launched in 2015) is an open-source, rolling-release Linux distribution developed by Intel’s Open Source Technology Center, purpose-built to showcase and leverage Intel’s hardware strengths, with a focus on high performance, security, and cloud-native workloads. -- source: https://linuxiac.com/intel-shuts-down-clear-linux-os/ Cheers, Peter

1 0

Let Sudo Insult You When You Enter Incorrect Password
by Peter Reutemann 24 Jul '25

24 Jul '25

Add some spice to your incorrect password attempts! :-) 'Sudoers is the default sudo security policy plugin in Linux; however, experienced system administrators can specify a custom security policy as well as input and output logging plugins. It is driven by the /etc/sudoers file or, alternatively by LDAP. You can define sudoers options like the insults option or several others in the file /etc/sudoers. It is set under the Defaults entries section. [...] In this article, we will explain a sudoers configuration parameter to enable an individual or system administrator to set sudo command to insult system users who enter the wrong password.' -- source: https://www.tecmint.com/sudo-insult-when-enter-wrong-password/ Cheers, Peter

1 0

FossFLOW - Isometric Diagramming Tool
by Peter Reutemann 23 Jul '25

23 Jul '25

Just came across FossFLOW: 'FossFLOW is a powerful, open-source Progressive Web App (PWA) for creating beautiful isometric diagrams. Built with React and the Isoflow (Now forked and published to NPM as fossflow) library, it runs entirely in your browser with offline support.' You can try it out here: https://stan-smith.github.io/FossFLOW/ Maybe something to consider next time you create a diagram? :-) -- code: https://github.com/stan-smith/FossFLOW -- source: https://mastodon.social/@nixCraft/114897260096883374 Cheers, Peter

1 0

Microsoft's Secure Boot UEFI Bootloader Signing Key Expires In September, Posing Problems For Linux Users
by Lawrence D'Oliveiro 23 Jul '25

23 Jul '25

If I understand this article right <https://www.tomshardware.com/tech-industry/cyber-security/microsoft-signing…>, there is a signing key stored in the flash RAM of PCs, issued by Microsoft, which is used to sign a “shim” that allows third-party Linux distros to boot. However, that key is due to expire this September. Microsoft issued an updated key two years ago, but that key may not be widely installed as yet. This leaves it up to PC/OEM vendors to issue updates to the flash RAM on their motherboards, which is not something that can be taken for granted. I’m not the only one wondering whether Secure Boot is worth the hassle: It's easy to see the appeal of Secure Boot—making it more difficult to install bootkits should be a net positive. However, the looming hassle of dealing with this expiring key is just the latest in a series of frustrations that encourage people to either stick with Windows or disable Secure Boot entirely. Right now, many people opt for the former, but will that continue to be the case as the popularity of other platforms rises ahead of Windows 10's demise? And is Secure Boot, as it currently exists, prepared for that shift?

1 0

filestash
by Peter Reutemann 22 Jul '25

22 Jul '25

Just came across "filestash": 'A Dropbox-like file manager that let you manage your data anywhere it is located: FTP • FTPS • SFTP • WebDAV • Git • S3 • NFS • SMB • Artifactory • LDAP • Mysql • Storj • CardDAV • CalDAV • Backblaze B2 • Minio • Dropbox • Google Drive' Sounds like an interesting and useful tool! -- github: https://github.com/mickael-kerjean/filestash -- source: https://mastodon.social/@nixCraft/114893327737674577 Cheers, Peter

1 0

Actively exploited vulnerability gives extraordinary control over server fleets
by Peter Reutemann 21 Jul '25

21 Jul '25

'Hackers are exploiting a maximum-severity vulnerability that has the potential to give them complete control over thousands of servers, many of which handle mission-critical tasks inside data centers, the US Cybersecurity and Infrastructure Security Agency is warning. The vulnerability, carrying a severity rating of 10 out of a possible 10, resides in the AMI MegaRAC, a widely used firmware package that allows large fleets of servers to be remotely accessed and managed even when power is unavailable or the operating system isn't functioning. These motherboard-attached microcontrollers, known as baseboard management controllers (BMCs), give extraordinary control over servers inside data centers. Administrators use BMCs to reinstall operating systems, install or modify apps, and make configuration changes to large numbers of servers without physically being on premises and, in many cases, without the servers being turned on. Successful compromise of a single BMC can be used to pivot into internal networks and compromise all other BMCs. CVE-2024-54085, as the vulnerability is tracked, allows for authentication bypasses by making a simple web request to a vulnerable BMC device over HTTP. The vulnerability was discovered by security firm Eclypsium and disclosed in March. The disclosure included proof-of-concept exploit code allowing a remote attacker to create an admin account without providing any authentication. At the time of the disclosure, there were no known reports of the vulnerability being actively exploited. On Wednesday, CISA added CVE-2024-54085 to its list of vulnerabilities known to be exploited in the wild. The notice provided no further details.' -- source: https://arstechnica.com/security/2025/06/active-exploitation-of-ami-managem… Cheers, Peter

4 6

KDE's Android TV Alternative, Plasma Bigscreen, Rises From the Dead
by Peter Reutemann 16 Jul '25

16 Jul '25

'Plasma Bigscreen, KDE's TV-focused interface, is being revived after years of inactivity thanks to contributor Devin, who overhauled the UI, redesigned the Settings app, improved app launching, and updated key modules. While still in progress -- with features like HDMI-CEC remote support and a virtual keyboard pending -- the project aims to rejoin KDE's official Plasma release schedule, potentially in version 6.5. Neowin reports: If you have not heard of it, Plasma Bigscreen is a Plasma shell for televisions, with original support for the now-defunct Mycroft AI assistant. It used to provide a simple launcher for apps and custom "Mycroft Skills" before development stalled, causing most distributions to drop it. The project was left behind during the big transition to Plasma 6 last year because no one had ported it in time for the megarelease. After a friend of his started poking at the code, Devin stepped in to tackle the much-needed work. [...] For anyone who wants to test this out, you can do as Devin did by installing Plasma Bigscreen on a Raspberry Pi using postmarketOS, though you would have to compile it yourself or pull from the nightly repos to get the latest changes. Applications like Kodi and VacuumTube (smart TV version of YouTube) work well with remote navigation, and some games like SuperTuxKart are playable. Controller support exists, but getting TV remotes to work over HDMI CEC is still untested. The project is far from finished; it still needs an arrow-navigable virtual keyboard and a clearer long-term direction now that Mycroft is gone. Still, the goal is to get it back into the official Plasma release schedule, possibly for version 6.5. ' -- source: https://tech.slashdot.org/story/25/07/15/1956221 Cheers, Peter

1 0

Browser Extensions Turn Nearly 1 Million Browsers Into Website-Scraping Bots
by Peter Reutemann 10 Jul '25

10 Jul '25

'Over 240 browser extensions with nearly a million total installs have been covertly turning users' browsers into web-scraping bots. "The extensions serve a wide range of purposes, including managing bookmarks and clipboards, boosting speaker volumes, and generating random numbers," reports Ars Technica. "The common thread among all of them: They incorporate MellowTel-js, an open source JavaScript library that allows developers to monetize their extensions." Ars Technica reports: Some of the data swept up in the collection free-for-all included surveillance videos hosted on Nest, tax returns, billing invoices, business documents, and presentation slides posted to, or hosted on, Microsoft OneDrive and Intuit.com, vehicle identification numbers of recently bought automobiles along with the names and addresses of the buyers, patient names and the doctors they saw, travel itineraries hosted on Priceline, Booking.com, and airline websites, Facebook Messenger attachments and Facebook photos, even when the photos were set to be private. The dragnet also collected proprietary information belonging to Tesla, Blue Origin, Amgen, Merck, Pfizer, Roche, and dozens of other companies. Tuckner said in an email Wednesday that the most recent status of the affected extensions is: - Of 45 known Chrome extensions, 12 are now inactive. Some of the extensions were removed for malware explicitly. Others have removed the library. - Of 129 Edge extensions incorporating the library, eight are now inactive. - Of 71 affected Firefox extensions, two are now inactive. Some of the inactive extensions were removed for malware explicitly. Others have removed the library in more recent updates. A complete list of extensions found by Tuckner is here.' -- source: https://tech.slashdot.org/story/25/07/09/2257245 Cheers, Peter

1 0

AMD Warns of New Meltdown, Spectre-like Bugs Affecting CPUs
by Peter Reutemann 10 Jul '25

10 Jul '25

'AMD is warning users of a newly discovered form of side-channel attack affecting a broad range of its chips that could lead to information disclosure. Register: Akin to Meltdown and Spectre, the Transient Scheduler Attack (TSA) comprises four vulnerabilities that AMD said it discovered while looking into a Microsoft report about microarchitectural leaks. The four bugs do not appear too venomous at face value -- two have medium-severity ratings while the other two are rated "low." However, the low-level nature of the exploit's impact has nonetheless led Trend Micro and CrowdStrike to assess the threat as "critical." The reasons for the low severity scores are the high degree of complexity involved in a successful attack -- AMD said it could only be carried out by an attacker able to run arbitrary code on a target machine. It affects AMD processors (desktop, mobile and datacenter models), including 3rd gen and 4th gen EPYC chips -- the full list is here.' -- source: https://it.slashdot.org/story/25/07/09/1835230 Cheers, Peter

1 0

GIMP 3.2 Promises New Paint Mode, Support for Importing Photoshop Patterns
by Peter Reutemann 04 Jul '25

04 Jul '25

'GIMP 3.2 promises new features like theme colors for Brush, Font, and Palette, a new paint blend mode called Overwrite that lets you directly replace the pixels over the area you paint, a new setting in the text tool to control the direction of the text outline, and automatic match of Linux and Windows OS themes. It also promises support for using ART (AnotherRawTherapee) as a Camera Raw loader, a new option to export to Krita‘s .kpl palette format, support for importing Photoshop patterns, as well as support for using presets from Photoshop’s Curves and Levels filters in GIMP’s Curves and Levels filters. In addition, GIMP 3.2 will bring initial support for exporting Photoshop Large format (PSB) files, support for importing APNG animations, support for loading multi-layer OpenEXR images, support for importing and exporting JPEG 2000 images, and support for loading and exporting Sony Playstation 1 TIM textures and images. But wait, that’s not all because GIMP 3.2 also promises support for importing Nokia’s historical black and white Over-the-Air Bitmap format, support for importing the GIF variant known as Jeff’s Image Format (.jif), and support for importing Advanced Video Coding (AVCI) still images. Among other noteworthy changes, GIMP 3.2 promises to improve non-destructive editing, update the CMYK Color Selector to calculate and display the Total Ink Coverage of the selected color, and implement a new API to create a GimpCoordinates widget in the auto-generated dialog.' -- source: https://9to5linux.com/gimp-3-2-promises-new-paint-mode-support-for-importin… Cheers, Peter

1 0

Let's Encrypt Rolls Out Free Security Certs For IP Addresses
by Peter Reutemann 04 Jul '25

04 Jul '25

'Let's Encrypt, a certificate authority (CA) known for its free TLS/SSL certificates, has begun issuing digital certificates for IP addresses. From a report: It's not the first CA to do so. PositiveSSL, Sectigo, and GeoTrust all offer TLS/SSL certificates for use with IP addresses, at prices ranging from $40 to $90 or so annually. But Let's Encrypt does so at no cost. For those with a static IP address who want to host a website, an IP address certificate provides a way to offer visitors a secure connection with that numeric identifier while avoiding the nominal expense of a domain name.' -- source: https://it.slashdot.org/story/25/07/03/1452239 Cheers, Peter

1 0

Linux’s Remarkable Journey From One Dev's Hobby To 40 Million Lines Of Code - And Counting
by Lawrence D'Oliveiro 03 Jul '25

03 Jul '25

A retrospective <https://www.zdnet.com/article/linuxs-remarkable-journey-from-one-devs-hobby…> on how the Linux kernel project got to where it is today. Quotes: “We're always building on the kernel, despite the fact that a lot of things were happening in the world over these three decades. We had the dotcom crash in 2000. We had the SCO lawsuit. In 2008, there was the global economic crisis. And of course, we had the COVID pandemic. But you don't really see an effect on the development speed of Linux from any of these events. We have somehow managed to sustain everything we can do despite all the stuff that has happened in the world.” ... Of course, for years, no one took Linux seriously. It was dismissed as a toy in an era when Unix fragmentation and the rise of Windows NT dominated industry thinking. The prevailing wisdom held that only large corporations could build operating system kernels, leaving little attention for a community-driven initiative. Yet, as Corbet noted, Linux exemplified Clayton Christensen's concept of disruptive innovation: a technology dismissed as inferior that quietly matures until it overtakes established players. Why did the BSDs lose their early lead? Another factor, Corbet explained, was that in the early 1990s, the BSD Unix systems were much more mature than Linux; they were capable of doing more and were more usable. Still, their permissive BSD license model led to a whole bunch of forks. None of them gained the critical mass in terms of either the development community or adoption to dominate Linux. Instead, the Linux kernel stayed one thing. It stayed together, in part because its GPLv2 copyright policy meant everybody retains their copyright under the same license. Some other open-source projects (including GNU) insist that contributors sign a “Contributor Licence Agreement”, turning over their copyright to some official body in charge of the project. The Linux kernel does not, and there are others that don’t.

1 0

PNG Spec, 3rd Edition, Is Out
by Lawrence D'Oliveiro 27 Jun '25

27 Jun '25

There is has been a major update to the specification for the PNG (“Portable Network Graphics”) file-format spec <https://www.programmax.net/articles/png-is-back/>, 20 years on from the previous edition. New features include support for high-dynamic-range colour gamuts, using a new metadata entry type that is much more compact than a full embedded ICC colour profile, and the official acceptance of the APNG format for animating a sequence of images within a single PNG file.

1 0

Lyon Abandons Microsoft Office To Strengthen 'Digital Sovereignty'
by Peter Reutemann 26 Jun '25

26 Jun '25

'The City of Lyon will replace Microsoft's office suite with free office software, including OnlyOffice for office work and Linux and PostgreSQL for systems and databases. The city aims to "no longer be dependent on American software solutions and acquire true digital sovereignty," according to an official statement. ' -- source: https://slashdot.org/story/25/06/25/1757229 Great to see that the digital sovereignty movement gaining momentum, if only down-under as well... Cheers, Peter

1 0

Mozilla Formally Discontinues Its DeepSpeech Project
by Peter Reutemann 26 Jun '25

26 Jun '25

'One of the interesting projects engaged in by Mozilla that directly wasn't related to their web browser efforts was DeepSpeech, an embedded/offline speech-to-text engine. To not much surprise given the lack of activity in recent years, last week they finally and formally discontinued the open-source project. Mozilla DeepSpeech was a promising speech-to-text engine with great performance for real-time communication even when running on Raspberry Pi SBCs and other low-power systems.' -- source: https://tech.slashdot.org/story/25/06/25/1851201 It's hard to compete with other publicly available models like OpenAI's whisper, which are really, really good. Cheers, Peter

1 0

Ubuntu To Disable Intel Graphics Security Mitigations To Boost GPU Performance By Up To 20%
by Peter Reutemann 24 Jun '25

24 Jun '25

'Disabling Intel graphics security mitigations in GPU compute stacks for OpenCL and Level Zero can yield a performance boost of up to 20%, prompting Ubuntu's Canonical and Intel to disable these mitigations in future Ubuntu packages. Phoronix's Michael Larabel reports: Intel does allow building their GPU compute stack without these mitigations by using the "NEO_DISABLE_MITIGATIONS" build option and that is what Canonical is looking to set now for Ubuntu packages to avoid the significant performance impact. This work will likely all be addressed in time for Ubuntu 25.10. This NEO_DISABLE_MITIGATIONS option is just for compiling the Intel Compute Runtime stack and doesn't impact the Linux kernel security mitigations or else outside of Intel's "NEO" GPU compute stack. Both Intel and Canonical are in agreement with this move and it turns out that even Intel's GitHub binary packages for their Compute Runtime for OpenCL and Level Zero ship with the mitigations disabled due to the performance impact. This Ubuntu Launchpad bug report for the Intel Compute Runtime notes some of the key takeaways. There is also this PPA where Ubuntu developers are currently testing their Compute Runtime builds with NEO_DISABLE_MITIGATIONS enabled for disabling the mitigations.' -- source: https://news.slashdot.org/story/25/06/23/2046259 Cheers, Peter

1 0

WebVM
by Peter Reutemann 24 Jun '25

24 Jun '25

Just came across this project on my Mastodon feed: 'WebVM is a server-less virtual environment running fully client-side in HTML5/WebAssembly. It's designed to be Linux ABI-compatible. It runs an unmodified Debian distribution including many native development toolchains. WebVM is powered by the CheerpX virtualization engine, and enables safe, sandboxed client-side execution of x86 binaries on any browser. CheerpX includes an x86-to-WebAssembly JIT compiler, a virtual block-based file system, and a Linux syscall emulator.' -- github: https://github.com/leaningtech/webvm -- mastodon: https://mastodon.social/@nixCraft/114735683692335386 Cheers, Peter

1 0

How The Grateful Dead Built The Internet
by Lawrence D'Oliveiro 23 Jun '25

23 Jun '25

Here’s an interesting piece, from the BBC of all places, about the role that a hippie band that started in the 1960s went on to play in the culture of the early Internet <https://www.bbc.com/future/article/20250618-how-the-grateful-dead-shaped-so…>. Not only were their stage shows technology-heavy, but they somehow managed to attract a major following among technologists of all kinds. Among the other members of that milieu was Steward Brand, creator of the Whole Earth Catalog, a resource for those looking for tools to help them live a simpler life, less dominated by faceless corporates and promoting more intimate, personal power. Quote from the introduction: “We are as gods and might as well get used to it.” Brand went on to co-found the WELL, aka the “Whole Earth ’Lectronic Link”, which started out as a BBS with users connecting via dialup lines, before becoming an Internet-connected service -- one of the earliest examples, if not *the* earliest example, of “social media”, if you will. John Perry Barlow, one of the lyricists for the Grateful Dead, got heavily involved in the WELL and then went on to found the Electronic Frontier Foundation, dedicated to the preservation of free speech and other civil rights in the online world.

2 1

OpenPGP Versus GnuPG
by Lawrence D'Oliveiro 23 Jun '25

23 Jun '25

It seems the developers of GnuPG are starting to diverge from the OpenPGP standard, and go their own, incompatible way. I got notes about this from the last few upgrades of my Debian Unstable systems, and so searching about online led me (yet again) to the ever-dependable ArchLinux Wiki <https://wiki.archlinux.org/title/GnuPG>, which has a section on “OpenPGP compatibility”, with links to more details about the schism. So the Debian folks seem reluctant to go along with this, and they’re not the only ones.

2 1

Bill Gates Gets To Meet The Famous Linus Torvalds
by Lawrence D'Oliveiro 23 Jun '25

23 Jun '25

Did you know, Torvalds and Gates had never met before <https://www.theverge.com/news/690815/bill-gates-linus-torvalds-meeting-photo>. The third older guy with them is Dave Cutler, mastermind of Windows NT. Not sure if he was the one responsible for putting in drive letters and all those “reserved” file names or not.

1 0

The Kubuntu Focus Team Announces The M2 GEN 6
by Peter Reutemann 16 Jun '25

16 Jun '25

'The Kubuntu Focus team has some exciting news to share. We have launched the sixth generation of the flagship M2 laptop, featuring the Intel Core Ultra 9 275HX CPU with 24 threads, Nvidia® GeForce® RTX 50-series GPUs, and many more upgrades. See more about this laptop in the press release, and see the press photos here!' -- source: https://www.einpresswire.com/article/820847974/kubuntu-focus-announces-the-… -- photos: https://drive.google.com/drive/folders/1mTmiw5HuJ8XkJ_yqy-R9YT-BqD-lmG3D Cheers, Peter

1 0

Denmark Is Dumping Microsoft Office and Windows For LibreOffice and Linux
by Peter Reutemann 13 Jun '25

13 Jun '25

'ZDNet reports: Denmark's Minister of Digitalization, Caroline Stage, has announced that the Danish government will start moving away from Microsoft Office to LibreOffice. Why? It's not because open-source is better, although I would argue that it is, but because Denmark wants to claim "digital sovereignty." In the States, you probably haven't heard that phrase, but in the European Union, digital sovereignty is a big deal and getting bigger. A combination of security, economic, political, and societal imperatives is driving the EU's digital sovereignty moves. EU leaders are seeking to reduce Europe's dependence on foreign technology providers, primarily those from the United States, and to assert greater control over its digital infrastructure, data, and technological future. Why? Because they're concerned about who controls European data, who sets the rules, and who can potentially cut off access to essential services in times of geopolitical tension. "Money issues have also played a decisive role," writes ZDNet's Steven Vaughan-Nichols. "Copenhagen's Microsoft software bill has soared from 313 million kroner in 2018 to 538 million kroner -- about $53 million in 2023, a 72% increase in just five years. David Heinemeier Hansson (DHH), a Dane, inventor of Ruby on Rails, and co-owner of the software developer company 37Signals, has said: "Denmark is one of the most highly digitalized countries in the world. It's also one of the most Microsoft-dependent. In fact, Microsoft is by far and away the single biggest dependency, so it makes perfect sense to start the quest for digital sovereignty there."' -- source: https://linux.slashdot.org/story/25/06/12/0335229 Cheers, Peter

2 1

Apple Quietly Launches Container On GitHub To Bring Linux Development To macOS
by Peter Reutemann 12 Jun '25

12 Jun '25

'A report from NERDS.xyz: Apple has released a new developer tool on GitHub called Container, offering a fresh approach to running Linux containers directly on macOS. Unlike Docker or Podman, this tool is designed to feel at home in the Apple ecosystem and hooks into frameworks already built into the operating system. Container runs standard OCI images, but it doesn't use a single shared Linux VM. Instead, it creates a small Linux virtual machine for every container you spin up. That sounds heavy at first, but the VMs are lightweight and boot quickly. Each one is isolated, which Apple claims improves both security and privacy. Developers can run containerized workloads locally with native macOS support and without needing to install third-party container platforms.' -- source: https://linux.slashdot.org/story/25/06/11/2116233 Cheers, Peter

2 1

FreeBSD 14.3 Released
by Peter Reutemann 12 Jun '25

12 Jun '25

'Michael Larabel of Phoronix highlights the key updates in today's stable release of FreeBSD 14.3: FreeBSD 14.3 has back-ported a number of improvements from FreeBSD 15 back to the FreeBSD 14 series. Plus a number of routine package updates and other fixes. Some of the FreeBSD 14.3-RELEASE highlights include: - Updating the ZFS support against OpenZFS 2.2.7. - Merging of the Realtek RTW88 and RTW89 WiFi drivers based on the Linux 6.14 kernel code. - The LinuxKPI code has been improved to support crypto offload as well as the 802.11n and 802.11ac standards. - The Intel IX Ethernet driver has added support for the x550 1000BAS-BX SFP modules. - Thor2 PCI IDs added to the Broadcom NetXtreme "BNXT" driver along with support for 400G speed modules. - XZ 5.8.1, OpenSSH 9.9p2, OpenSSL 3.0.16, and many other package updates. - Syscons as the legacy system console driver is now considered deprecated. Syscons is not compatible with UEFI, lacks UTF-8 support, and is Giant-locked. ' -- source: https://bsd.slashdot.org/story/25/06/10/2146224 Cheers, Peter

2 1

Ubuntu Linux 25.10 Quietly Kills Off GNOME On Xorg As Wayland Takes Over
by Peter Reutemann 12 Jun '25

12 Jun '25

'Ubuntu 25.10, known as Questing Quokka, is taking a big turn under the hood. Canonical has dropped support for the GNOME desktop running on Xorg. Starting with this release, the default Ubuntu session now uses Wayland only. Yes, folks, there's no longer an option to log into GNOME on Xorg.' -- source: https://news.slashdot.org/story/25/06/10/181234 Cheers, Peter

1 0

New Linux Flaws Allow Password Hash Theft via Core Dumps in Ubuntu, RHEL, Fedora
by Peter Reutemann 12 Jun '25

12 Jun '25

'Two information disclosure flaws have been identified in apport and systemd-coredump, the core dump handlers in Ubuntu, Red Hat Enterprise Linux, and Fedora, according to the Qualys Threat Research Unit (TRU). Tracked as CVE-2025-5054 and CVE-2025-4598, both vulnerabilities are race condition bugs that could enable a local attacker to obtain access to access sensitive information. Tools like Apport and systemd-coredump are designed to handle crash reporting and core dumps in Linux systems. "These race conditions allow a local attacker to exploit a SUID program and gain read access to the resulting core dump," Saeed Abbasi, manager of product at Qualys TRU, said.' -- source: https://thehackernews.com/2025/05/new-linux-flaws-allow-password-hash.html Cheers, Peter

1 0

Wikipedia Pauses AI-Generated Summaries After Editor Backlash
by Peter Reutemann 12 Jun '25

12 Jun '25

'The Wikimedia Foundation halted an experiment that would have displayed AI-generated summaries atop Wikipedia articles after the platform's volunteer editor community delivered an overwhelmingly negative response to the proposal. The foundation announced the two-week mobile trial on June 2 and suspended it just one day later following dozens of critical comments from editors. The experiment, called "Simple Article Summaries," would have used Cohere's open-weight Aya model to generate simplified versions of complex Wikipedia articles. The AI-generated summaries would have appeared at the top of articles with a yellow "unverified" label, requiring users to click to expand and read them. Editors responded with comments including "very bad idea," "strongest possible oppose," and simply "Yuck."' -- source: https://news.slashdot.org/story/25/06/11/1732215 Cheers, Peter

1 0