- wlug - list.wlug.org.nz

Linux Kernel Rust Code Sees Its First CVE Vulnerability
by Peter Reutemann 18 Dec '25

18 Dec '25

'Longtime Linux developer Greg Kroah-Hartman announced that the Linux kernel has received its first CVE tied to Rust code. Phoronix reports: This first CVE (CVE-2025-68260) for Rust code in the Linux kernel pertains to the Android Binder rewrite in Rust. There is a race condition that can occur due to some noted unsafe Rust code. That code can lead to memory corruption of the previous/next pointers and in turn cause a crash. This CVE for the possible system crash is for Linux 6.18 and newer since the introduction of the Rust Binder driver. At least though it's just a possible system crash and not any more serious system compromise with remote code execution or other more severe issues. ' -- source: https://it.slashdot.org/story/25/12/17/2034233 Cheers, Peter

1 0

Blocking ads with OpenWRT router
by Peter Reutemann 16 Dec '25

16 Dec '25

Hi everyone Found out on the weekend that I can install AdBlock straight on my router that is running OpenWRT: https://openwrt.org/docs/guide-user/services/ad-blocking?s%5B%5D=adblock Gets rid of (a large portion of) ads on mobile devices, like Android phones, when they are connected via WiFi. Cheers, Peter

1 0

New Rule Forbids GNOME Shell Extensions Made Using AI-Generated Code
by Peter Reutemann 15 Dec '25

15 Dec '25

'Phoronix reports: Due to the growing number of GNOME Shell extensions looking to appear on extensions.gnome.org that were generated using AI, it's now prohibited. The new rule in their guidelines note that AI-generated code will be explicitly rejected: "Extensions must not be AI-generated While it is not prohibited to use AI as a learning aid or a development tool (i.e. code completions), extension developers should be able to justify and explain the code they submit, within reason. Submissions with large amounts of unnecessary code, inconsistent code style, imaginary API usage, comments serving as LLM prompts, or other indications of AI-generated output will be rejected." In a blog post, GNOME developer Javad Rahmatzadeh explains that "Some devs are using AI without understanding the code..."' -- source: https://tech.slashdot.org/story/25/12/14/0453227 Cheers, Peter

1 0

New FreeBSD 15 Retires 32-Bit Ports and Modernizes Builds
by Peter Reutemann 08 Dec '25

08 Dec '25

'FreeBSD 15.0-RELEASE arrived this week, notes this report from The Register, which calls it the latest release "of the Unix world's leading alternative to Linux." As well as numerous bug fixes and upgrades to many of its components, the major changes in this version are reductions in the number of platforms the OS supports, and in how it's built and how its component software is packaged. FreeBSD 15 has significantly reduced support for 32-bit platforms. Compared to FreeBSD 14 in 2023, there are no longer builds for x86-32, POWER, or ARM-v6. As the release notes put it: "The venerable 32-bit hardware platforms i386, armv6, and 32-bit powerpc have been retired. 32-bit application support lives on via the 32-bit compatibility mode in their respective 64-bit platforms. The armv7 platform remains as the last supported 32-bit platform. We thank them for their service." Now FreeBSD supports five CPU architectures — two Tier-1 platforms, x86-64 and AArch64, and three Tier-2 platforms, armv7 and up, powerpc64le, and riscv64. Arguably, it's time. AMD's first 64-bit chips started shipping 22 years ago. Intel launched the original x86 chip, the 8086 in 1978. These days, 64-bit is nearly as old as the entire Intel 80x86 platform was when the 64-bit versions first appeared. In comparison, a few months ago, Debian 13 also dropped its x86-32 edition — six years after Canonical launched its first x86-64-only distro, Ubuntu 19.10. Another significant change is that this is the first version built under the new pkgbase system, although it's still experimental and optional for now. If you opt for a pkgbase installation, then the core OS itself is installed from multiple separate software packages, meaning that the whole system can be updated using the package manager. Over in the Linux world, this is the norm, but Linux is a very different beast... The plan is that by FreeBSD 16, scheduled for December 2027, the restructure will be complete, the old distribution sets will be removed, and the current freebsd-update command and its associated infrastructure can be turned off. Another significant change is reproducible builds, a milestone the project reached in late October. This change is part of a multi-project initiative toward ensuring deterministic compilation: to be able to demonstrate that a certain set of source files and compilation directives is guaranteed to produce identical binaries, as a countermeasure against compromised code. A handy side-effect is that building the whole OS, including installation media images, no longer needs root access. There are of course other new features. Lots of drivers and subsystems have been updated, and this release has better power management, including suspend and resume. There's improved wireless networking, with support for more Wi-Fi chipsets and faster wireless standards, plus updated graphics drivers... The release announcement calls out the inclusion of OpenZFS 2.4.0-rc4, OpenSSL 3.5.4, and OpenSSH 10.0 p2, and notes the inclusion of some new quantum-resistant encryption systems... In general, we found FreeBSD 15 easier and less complicated to work with than either of the previous major releases. It should be easier on servers too. The new OCI container support in FreeBSD 14.2, which we wrote about a year ago, is more mature now. FreeBSD has its own version of Podman, and you can run Linux containers on FreeBSD. This means you can use Docker commands and tools, which are familiar to many more developers than FreeBSD's native Jail system. "FreeBSD has its own place in servers and the public cloud, but it's getting easier to run it as a desktop OS as well," the article concludes. "It can run all the main Linux desktops, including GNOME on Wayland." "There's no systemd here, and never will be — and no Flatpak or Snap either, for that matter.' -- source: https://tech.slashdot.org/story/25/12/07/0627214 Cheers, Peter

1 0

How Home Assistant Leads a 'Local-First Rebellion'
by Peter Reutemann 08 Dec '25

08 Dec '25

'It runs locally, a free/open source home automation platform connecting all your devices together, regardless of brand. And GitHub's senior developer calls it "one of the most active, culturally important, and technically demanding open source ecosystems on the planet," with tens of thousands of contributors and millions of installations. That's confirmed by this year's "Octoverse" developer survey... Home Assistant was one of the fastest-growing open source projects by contributors, ranking alongside AI infrastructure giants like vLLM, Ollama, and Transformers. It also appeared in the top projects attracting first-time contributors, sitting beside massive developer platforms such as VS Code... Home Assistant is now running in more than 2 million households, orchestrating everything from thermostats and door locks to motion sensors and lighting. All on users' own hardware, not the cloud. The contributor base behind that growth is just as remarkable: 21,000 contributors in a single year... At its core, Home Assistant's problem is combinatorial explosion. The platform supports "hundreds, thousands of devices... over 3,000 brands," as [maintainer Franck Nijhof] notes. Each one behaves differently, and the only way to normalize them is to build a general-purpose abstraction layer that can survive vendor churn, bad APIs, and inconsistent firmware. Instead of treating devices as isolated objects behind cloud accounts, everything is represented locally as entities with states and events. A garage door is not just a vendor-specific API; it's a structured device that exposes capabilities to the automation engine. A thermostat is not a cloud endpoint; it's a sensor/actuator pair with metadata that can be reasoned about. That consistency is why people can build wildly advanced automations. Frenck describes one particularly inventive example: "Some people install weight sensors into their couches so they actually know if you're sitting down or standing up again. You're watching a movie, you stand up, and it will pause and then turn on the lights a bit brighter so you can actually see when you get your drink. You get back, sit down, the lights dim, and the movie continues." A system that can orchestrate these interactions is fundamentally a distributed event-driven runtime for physical spaces. Home Assistant may look like a dashboard, but under the hood it behaves more like a real-time OS for the home... The local-first architecture means Home Assistant can run on hardware as small as a Raspberry Pi but must handle workloads that commercial systems offload to the cloud: device discovery, event dispatch, state persistence, automation scheduling, voice pipeline inference (if local), real-time sensor reading, integration updates, and security constraints. This architecture forces optimizations few consumer systems attempt. "If any of this were offloaded to a vendor cloud, the system would be easier to build," the article points out. "But Home Assistant's philosophy reverses the paradigm: the home is the data center..." As Nijhof says of other vendor solutions, "It's crazy that we need the internet nowadays to change your thermostat."' -- source: https://news.slashdot.org/story/25/12/07/1955259 Cheers, Peter

1 0

Proposed Patches Make Upstream Linux Kernel Usable For The OpenWrt One Router
by Peter Reutemann 27 Nov '25

27 Nov '25

'Announced nearly one year ago was the OpenWrt One as a router/AP that is "hacker-friendly" and open-source. The OpenWrt One is powered by a Filogic 820 SoC and features WiFi 6. This official OpenWrt device is manufactured by Banana Pi. While there is downstream open-source code available for customizing the OpenWrt One to your heart's content, the upstream Linux kernel support to date hasn't been full-featured. Sjoerd Simons of Collabora today posted a set of 15 patches for making the OpenWrt One AP functional with the upstream Linux kernel. As Sjoerd puts it, to make the OpenWrt One "actually useful as an access point" with the mainline Linux kernel. The patches get PCI Express working as tested with NVMe storage, the wired network interfaces enabled, the WiFi/wireless networking brought up, status LEDs enabled, SPI NOR, and related bits. The patches bring the necessary Device Tree support and extensions to existing drivers to make everything work without any new drivers being required. There are various kernel quirks required too at this point for making the device happy with the mainline Linux kernel. All in just over 500 lines of code for making the OpenWrt One useful with these patches that will be hopefully mainlined to the Linux kernel.' -- source: https://www.phoronix.com/news/OpenWrt-One-Useful-Linux Has anyone experience with this router? Cheers, Peter

1 0

Arduino's New Terms of Service Worries Hobbyists Ahead of Qualcomm Acquisition
by Peter Reutemann 25 Nov '25

25 Nov '25

'Ars Technica: Some members of the maker community are distraught about Arduino's new terms of service (ToS), saying that the added rules put the company's open source DNA at risk. Arduino updated its ToS and privacy policy this month, which is about a month after Qualcomm announced that it's acquiring the open source hardware and software company. Among the most controversial changes is this addition: "User shall not: translate, decompile or reverse-engineer the Platform, or engage in any other activity designed to identify the algorithms and logic of the Platform's operation, unless expressly allowed by Arduino or by applicable license agreements ..." In response to concerns from some members of the maker community, including from open source hardware distributor and manufacturer Adafruit, Arduino posted a blog on Friday. Regarding the new reverse-engineering rule, Arduino's blog said: "Any hardware, software or services (e.g. Arduino IDE, hardware schematics, tooling and libraries) released with Open Source licenses remain available as before. Restrictions on reverse-engineering apply specifically to our Software-as-a-Service cloud applications. Anything that was open, stays open." But Adafruit founder and engineer Limor Fried and Adafruit managing editor Phillip Torrone are not convinced. They told Ars Technica that Arduino's blog leaves many questions unanswered and said that they've sent these questions to Arduino without response. "Why is reverse-engineering prohibited at all for a company built on openly hackable systems?" Fried and Torrone asked in a shared statement. There are also concerns about the ToS' broad new AI-monitoring powers, which offer little clarity on what data is collected, who can access it, or how long it's retained. On top of that, the update introduces an unusual patent clause that bars users from using the platform to identify potential infringement by Arduino or its partners, along with sweeping, perpetual rights over user-generated content. This could allow Arduino, and potentially Qualcomm, to republish, modify, monetize, or redistribute user uploads indefinitely.' -- source: https://hardware.slashdot.org/story/25/11/24/2144256 Cheers, Peter

1 0

The DoorDash Problem: Amazon Sues Perplexity
by Lawrence D'Oliveiro 22 Nov '25

22 Nov '25

A lot of companies are making a comfortable living by selling goods or services online: Amazon, DoorDash, Uber etc. A key part of the business model is that the visitors to their site are actual humans, who can be shown ads, or otherwise persuaded to upsell to some enticing extra product (“Would you like chips with that?”) and thereby disgorge a little bit of extra revenue. This is part of what’s called “building a relationship with the customer”. Which is a nice way of saying “owning the customer”. But what if the visitors to your site are AI bots, looking for deals on behalf of a human that ends up one step removed from contact with you? Then all those ads and extra persuasive messages fall on the worst kind of deaf ears -- no ears at all. The human says to the AI agent “get me a ride to the airport”, the agent goes away to the Uber and Lyft sites (or whatever else turns up), and picks the cheapest option at that moment. The human doesn’t know which company is providing the ride that turns up on their doorstep, and they won’t care. The providers of these products have become mere commodity suppliers. This thought does scare some of these online retailers. And now Amazon, just about the biggest such e-tailer out there, is suing Perplexity, a provider of just such an AI agent service. Amazon says that this is about maintaining a “positive customer experience”; but surely the form of the “customer experience” is something for the customer to choose. Amazon also says that access by AI bots is against the terms of service for its site, and that is clearly the core of its legal claim. But will such a claim hold up in court? How far can companies go in dictating exactly what form users’ accesses to their site can take? <https://www.theverge.com/podcast/823909/the-doordash-problem-ai-agents-web-…>

1 0

The EU made Apple adopt new Wi-Fi standards, and now Android can support AirDrop
by Lawrence D'Oliveiro 21 Nov '25

21 Nov '25

People in the US like to make fun of the seemingly endless bureaucratic hurdles that the EU Governments keep putting in the way of US companies looking to make a quick buck. You know, having to worry about boring things like “privacy” and “interoperability” and “security”, that kind of thing. Oh, and maintaining free-market competition -- imagine lecturing the USA about how to achieve that! But every now and then, this endless stream of new regulations hits the jackpot. Like how Google is suddenly able to offer full two-way compatibility with Apple’s formerly-proprietary “AirDrop” feature for exchanging files between mobile devices -- the file exchange is done directly, peer-to-peer, without going through any central servers. It’s all down to the fact that the EU forced Apple to move away from the completely proprietary low-level radio protocol it was originally using for AirDrop, towards something that was more amenable to exactly the sort of reverse-engineering of the higher-level protocol that Google did. Of course Apple did also contribute work towards the new standard, just as it did with USB Type-C; it’s better to be seen to be cooperating with inevitability, rather than futilely trying to fight it tooth and nail. <https://arstechnica.com/gadgets/2025/11/the-eu-made-apple-adopt-new-wi-fi-s…>

1 0

HP And Dell Disable HEVC (H.265) Support Built Into Their Laptops’ CPUs
by Lawrence D'Oliveiro 21 Nov '25

21 Nov '25

Some owners of HP and Dell laptops are finding that their machines can no longer playback HEVC/H.265-encoded video content, even though this capability is supposed to be built into their hardware <https://arstechnica.com/gadgets/2025/11/hp-and-dell-disable-hevc-support-bu…>. Why is this happening? The obvious answer: patent issues. The royalty rates these companies have to pay to offer this functionality is going up quite substantially from next year, and they have to cut costs. So the users will have to pay extra money to get this capability back. Synology also used to offer the capability to transcode videos to H.265 on some of its products, but discontinued that as of last year. This is why AV1 was created by Google and other companies: to offer a patent-free alternative to H.265. But in spite of all the patent issues that were clear from the beginning, lots of companies went ahead with H.265-based products regardless. Maybe now we will see the popularity of AV1 increase?

1 0