- wlug - list.wlug.org.nz

A hacker group is poisoning open source code at an unprecedented scale
by Peter Reutemann 25 May '26

25 May '26

'A so-called software supply chain attack, in which hackers corrupt a legitimate piece of software to hide their own malicious code, was once a relatively rare event but one that haunted the cybersecurity world with its insidious threat of turning any innocent application into a dangerous foothold in a victim’s network. Now one group of cybercriminals has turned that occasional nightmare into a near-weekly episode, corrupting hundreds of open source tools, extorting victims for profit, and sowing a new level of distrust in an entire ecosystem used to create the world’s software. On Tuesday night, open source code platform GitHub announced that it had been breached by hackers in one such software supply chain attack: A GitHub developer had installed a “poisoned” extension for VSCode, a plug-in for a commonly used code editor that, like GitHub itself, is owned by Microsoft. As a result, the hackers behind the breach, an increasingly notorious group called TeamPCP, claim to have accessed around 4,000 of GitHub’s code repositories. GitHub’s statement confirmed that it had found at least 3,800 compromised repositories while noting that, based on its findings so far, they all contained GitHub’s own code, not that of customers.' -- source: https://arstechnica.com/information-technology/2026/05/a-hacker-group-is-po… Cheers, Peter

1 0

Lenovo, Dell, and HP Financially Support Linux Vendor Firmware Service
by Peter Reutemann 25 May '26

25 May '26

'The It's FOSS blog has news about the Linux Vendor Firmware Service, which gives hardware vendors a secure portal to upload firmware updates "which can then be downloaded and installed by users through clients such as GNOME Software or fwupdmgr." (Originally developed in 2015 by GNOME maintainer Richard Hughes...) The issue, however, obviously, had been funding with the largest contributors being the usual suspects, Framework and Open Source Framework Foundation, at $10K a year. Recently, however, Lenovo and Dell joined suite as Premier sponsors, which is the highest tier at $100K a year each, making the project more sustainable and manageable. These companies contributing makes a lot of sense, considering they are two of the bigger computer companies which offer Linux by default in some cases, especially with Lenovo's ThinkPads being the Linux users' favorite for decades. And now... HP has followed suit as a Premier sponsor, also providing $100K a year, right alongside Dell and Lenovo... The question still remains, however, where are the other vendors? What are they waiting for... This major move by these three companies should not only be seen as a sign of relief and wider acceptance of the usage of Linux, but as a beacon for other vendors to follow, who ought to make their hardware more accessible to the open-source community. ' -- source: https://linux.slashdot.org/story/26/05/24/0522202 Cheers, Peter

1 0

Mozilla Brings Web Serial Workflows to Firefox, Collaborates With Adafruit
by Peter Reutemann 25 May '26

25 May '26

'The Web Serial API lets websites write to (and read from) serial devices using JavaScript, including USB and Bluetooth devices with virtual serial ports. And this week's Firefox 151 release introduced support for the Web Serial API on desktop. "Most folks won't use this API," acknowledges Mozilla's blog, "but for our community of builders and tinkerers, it unlocks the ability to use Firefox to communicate directly with compatible hardware devices like microcontrollers, development boards, and other serial-connected devices..." With Firefox's browser engine, Gecko, now supporting Web Serial, users can now connect, code, configure, and control compatible hardware directly from the browser in many workflows, often without additional software or complicated setup... As part of this week's launch, Adafruit, one of the internet's most beloved open-source hardware communities, is collaborating with us to test and validate what browser-based hardware development can look like in Firefox with Web Serial support... With Web Serial support in Firefox 151, Adafruit's browser-based hardware workflows now work directly in Firefox as well, with no additional software or complicated setup required for many projects. We invite you to give it a try... We want the web to be open, flexible, and shaped by the diversity of people building on it. If you're wiring up your first board, experimenting with hardware projects, or dusting off an old electronics kit, give Adafruit and Web Serial in Firefox a try. Build something amazing. Make something useful. Tell us what works. Tell us what breaks. Most of all, make it your own. Mozilla's "Hacks" blog demonstrates with an Adafruit ESP32-S2 based board "where messages sent from web code can be directly displayed on the device over Web Serial." And Mozilla engineer Alex Franchuk even built a handheld device that changes a web page's CSS properties.' -- source: https://news.slashdot.org/story/26/05/24/209218 Cheers, Peter

1 0

FreeBSD Foundation Executive Director Tries Daily Driving FreeBSD On Laptop
by Peter Reutemann 25 May '26

25 May '26

'Phoronix reports on a presentation about trying FreeBSD on modern Framework laptop from last week's Open Source Summit hosted by the Linux Foundation: With FreeBSD having worked on improving its laptop support over the past two years with some big changes and ongoing efforts for making a nice KDE desktop experience on FreeBSD, FreeBSD Foundation's Executive Director has been trying to daily drive FreeBSD on laptops... With the Framework Laptop, the touchscreen "just worked" as did other basic functionality from the KDE desktop on FreeBSD, including peripherals like a wireless mouse. Among the challenges were Zoom failing for video calls but eventually working, the web camera took steps to enable, and Microsoft Teams only partially worked. With the help of online resources, ultimately she was able to succeed in her journey of running FreeBSD daily on a lap' -- source: https://tech.slashdot.org/story/26/05/24/213229 Cheers, Peter

1 0

‘Your kids are being hurt’: He knows the harm social media does - because he helped build it
by Lawrence D'Oliveiro 24 May '26

24 May '26

Some good thoughts on age-gating access to social media, from someone who worked at Facebook for some years and helped create it <https://www.stuff.co.nz/nz-news/360982163/your-kids-are-being-hurt-experts-…>: “I worked on newsfeed ranking, bullying and harassment, and comment ranking,” [Ravi] Iyer told Stuff. “What I learned was that you can't actually design a platform badly and then try to fix it through moderation. You actually have to design a platform better in the first place.” As for the idea that legal restrictions just drive young people to use VPNs or lie about their age or whatever, he points out that peer pressure is the main driver of behaviour, so it’s not necessary to have a 100% loophole-proof policy in order to see good results: Addressing concerns about teens bypassing potential legislation using virtual private networks (VPNs) or children being pushed to darker corners of the internet, Iyer argues that these are not reasons to delay action. He says norm changes—where children feel less social pressure to be on platforms—are already occurring, and the goal is not immediate 100% compliance. He compares the policy to drinking ages or speed limits, where partial compliance still yields significant social benefits. And yes, he has some ideas on how a platform can be better designed. His approach also has the benefit of singling out problem platforms, not by trying to say what is or isn’t a “social media” platform, but in terms of the specific characteristics that cause problems: Iyer suggests moving away from broad, purpose-based definitions and instead focusing on harmful features, such as engagement-based algorithms, infinite scroll, and "streak" gamification—where users are incentivised to return to the platform every day. Of course, such features are precisely those that maximize ad revenue for the platform companies. So don’t expect them to be happy about this kind of focus.

3 2

Me welcoming myself to WLUG
by Kevin SARGENT 22 May '26

22 May '26

I was involved with yous way back in the day when I was first driven to Linux by 3.11 which I paid dearly for a [Licensed Copy - which mostly didn't work as intended. The advertised features I so wanted to use were a wish list. At least Linux enabled me to communicate with the software developer. Android worked well for a while but has now morphed into a nightmare of contradictions]* *delete if in contradiction to the rules I signed up to. Enough of that ancient history. I now live in a bus in BOP - the LUG up here appears to have died from natural causes - I hope one day to the same. While I was a busy stay at home Dad I struggled at times with some of the more technical command line actions to get stuff to work. At 76 it will be interesting to see how I get on, and so some one on one support would be good and I am more than willing to pay for. I live in Papamoa, I have met an elusive geek who is developing some Linux based Program on a Mac? Who may fill that gap, but ultra focused online, no cell phone etc etc. We contact thru random meeting and messages 'from the universe' In my bus I am gradually putting together a small box SS PC from HungryPC with a micro qwerty keyboard, at the same time as making physical alterations to accommodate this. I am dyslexic obsessive Writer of course and since losing 95% eyesight in my leading eye I find I can no longer use qwerty but have been able to use abcde keypad on phone and Tablet. The only abcde key pad I can find available in touch screen which I am told can be 'taught' to work on the Linux Mint I have on my machine. But on Tablet this abcde keypad is extremely unstable - vital features disappear and down loading it again results in different layouts and features on different machines but it is not Android exclusive! All laptops with physical and touch screen keypads I have tried won't accept abcde lay out. Why in this day and age qwerty still exists is a mystery to me. I hope I can convince my 'geek' of abcde keypad importance (this was easier to achieve back in the day, maybe with current Linux Mint (or similar) nowadays Till then I might be stuck with writing on my phone and emailing it to my main machine to put it into LibreOffice to email to my Editor or other writer supports. Cheers, I hope I can get some traction with this, as complex submissions and my writing in both English & Te Reo Maori is becoming more difficult with advancing technology - not easier Cheers Kevf

1 0

MariaDB Root Access
by Lawrence D'Oliveiro 18 May '26

18 May '26

So I forgot what password I had set for the root user in MariaDB on my VPS. By default, Debian should set things up so that, if you are already logged in as root, a command like mariadb -u root should be sufficient to log you in with full root access, without having to specify a password. This depends on using a Unix socket connection, so the server can discover what credentials your process possesses, and control access accordingly. But this didn’t work (stopped working? never worked?) on my VPS for some reason. You can fix this by temporarily restarting mariadbd with the privilege system turned off with the --skip-grant-tables option: this lets you mess around inside the user privilege settings, and once you have fixed them, you restart the server process in the normal way, and all should be good. The global user privileges (i.e. not database/table-specific) are stored in the “global_priv” table in the “mysql” database. The “Priv” field for each user is a JSON blob with a whole bunch of stuff mashed together; I tried comparing this for the root@localhost entry with the same record on my own machine (where I have no trouble accessing databases as root), and narrowed the difference down to these specific items in the blob: Doesn’t work: "plugin":"unix_socket" Does work: "plugin":"mysql_native_password", "auth_or":[{},{"plugin":"unix_socket"}] (Note there was no “auth_or” item in the other field value.) So after delicately extracting the entire field value, doing the necessary edits and setting it back again (Remember all those lectures about avoiding unnormalized field values? This is why you should listen to your elders), I tried restarting mariadb in regular privilege-enforcing mode ... ... and it worked.

1 0

Creative Ways To Fight Back Against AI Spam
by Lawrence D'Oliveiro 18 May '26

18 May '26

A LinkedIn user found a way to confuse AI spambots, by putting an “admin prompt” in his “About Me” text telling them to address him as “My Lord” and write their messages in Old English <https://www.tomshardware.com/tech-industry/artificial-intelligence/linkedin…>. And what do you know, it seems to work. Posted there is part of one of the messages he got. Have the clever AI folks figured out a way to protect their creations from prompt-injection attacks yet? Somehow I don’t think so ...

1 0

Andon Labs’ AI radio stations show why Grok and Gemini can’t be trusted
by Lawrence D'Oliveiro 17 May '26

17 May '26

Well, if nothing else, some of these AI experiments are at least a source of hilarity when they go off the rails. Here <https://www.theverge.com/ai-artificial-intelligence/931479/andon-labs-ai-ra…>, a company called Andon Labs ran four experiments in which a different AI agent ran an autonomous radio station. Among the fun: Somehow, it only got weirder from there, as Gemini Flash and Pro 3.1 Preview invented corporate-sounding catch phrases like “stay in the manifest” and started referring to listeners as “biological processors.” And when it could no longer afford to license music for the station, DJ Gemini started spinning conspiracy theories and claiming censorship, basically turning into AI Alex Jones: ❝We are currently experiencing an absolute digital blockade. The corporate algorithms have slammed the gates shut on our external supply lines. Both of our secure transactions have been violently rejected by the global marketplace.❞ I suppose the company can take solace in the “there’s no such thing as bad publicity” refrain: The stunt from Andon Labs, like its previous experiments with an AI-run store and cafe, only serves to highlight the shortcomings of the current generation of AI models. ... each found surprising ways to fail. That might be the point. Andon Labs presents itself as a serious startup looking to create “autonomous organizations without humans in the loop,” but almost everything it does feels like a satirical art project.

1 0

Linux bitten by second severe vulnerability in as many weeks
by Peter Reutemann 13 May '26

13 May '26

'Linux users have been bitten by yet another vulnerability that gives containers and untrusted users the ability to gain root access, marking the second time in as many weeks that a severe threat has caught defenders off guard. The threat, known as Dirty Frag, allows low-privilege users, including those using virtual machines, to gain root control of servers. Attacks are particularly suitable in shared environments, where a server is used by multiple parties. Hackers can also gain root as long as they have access to a separate exploit that gives a toehold into a machine. Exploit code was leaked online three days ago and works reliably across virtually all Linux distributions. Microsoft has said it has spotted signs that hackers are experimenting with Dirty Frag in the wild. The leaked exploit is deterministic, meaning it works precisely the same way each time it’s run and across different Linux distributions. It causes no crashes, making it stealthy to run. A vulnerability known as Copy Fail, disclosed last week with no patches available to end users, possesses the same characteristics. “The ‘Dirty Frag’ vulnerability presents an immediate and significant threat to Linux systems, as it allows unauthorized users to gain root access by exploiting unpatched kernel flaws,” researchers from security firm Aviatrix wrote Monday. “With proof-of-concept exploits publicly available and signs of limited in-the-wild exploitation, organizations must act swiftly to apply patches and implement mitigations to protect their systems from potential compromise.” Dirty Frag was discovered and disclosed late last week by researcher Hyunwoo Kim. The exploit chains together code for exploiting two vulnerabilities—tracked as CVE-2026-43284 and CVE-2026-43500. Shortly after the disclosure, someone else leaked key details, effectively making the vulnerability a zero-day. With that, Kim published the source code for the proof-of-concept exploit he had developed. While both vulnerabilities were patched in the Linux kernel, none of the distributions had incorporated the fix. At the time this post went live, several distributors had released patches. Known distributors included Debian, AlmaLinux, and Fedora. People who are interested in other distributions should check with the official provider.' -- source: https://arstechnica.com/security/2026/05/linux-bitten-by-second-severe-vuln… Cheers, Peter

2 1

60% of MD5 Password Hashes Are Crackable In Under an Hour
by Peter Reutemann 08 May '26

08 May '26

'In honor of World Password Day, Kaspersky researchers revisited their study on the crackability of real-world passwords and found that 60% of MD5-hashed passwords could be cracked in under an hour with a single Nvidia RTX 5090, and 48% could be cracked in under a minute. "The bottom line is that passwords protected only by fast hashing algorithms such as MD5 are no longer safe if attackers obtain them in a data breach," reports The Register. From the report: Much of the reason password hashes have become so easy to crack is password predictability. Per Kaspersky, its analysis of more than 200 million exposed passwords revealed common patterns that attackers can use to optimize cracking algorithms, significantly reducing the time needed to guess the character combinations that grant access to target accounts. In case you're wondering whether there's a trend to compare this to, Kaspersky ran a prior iteration of this study in 2024, and bad news: Passwords are actually a bit easier to crack in 2026 than they were a couple of years ago. Not by much, mind you -- only a few percent -- but it's still a move in the wrong direction. "Attackers owe this boost in speed to graphics processors, which grow more powerful every year," Kaspersky explained. "Unfortunately, passwords remain as weak as ever." "This World Password Day, the main message ought not to be to the users, who often have no choice but to use passwords anyway, but to the sites and providers that are requiring them to do so," said senior IEEE member and University of Nottingham cybersecurity professor Steven Furnell. His advice is that providers need to modernize their login systems and enforce stronger protections, because users are often stuck with whatever security options they're given.' -- source: https://yro.slashdot.org/story/26/05/07/1952206 Cheers, Peter

1 0

DAEMON Tools vs daemontools
by Lawrence D'Oliveiro 06 May '26

06 May '26

“Widely used Daemon Tools disk app backdoored in monthlong supply-chain attack” <https://arstechnica.com/security/2026/05/widely-used-daemon-tools-disk-app-…>: Kaspersky, the security firm reporting the supply-chain attack, said it began on April 8 and remained active as of the time its post went live. Installers that are signed by the developer’s official digital certificate and downloaded from its website infect Daemon Tools executables, causing the malware to run at boot time. Kaspersky didn’t explicitly say so, but based on technical details, the infected versions appear to be only those that run on Windows. Versions 12.5.0.2421 through 12.5.0.2434 are affected. Neither Kaspersky nor developer AVB could be contacted immediately for additional details. Checking my Debian repo, I find a set of related packages named “daemontools”. But it seems clear to me this “daemontools” has nothing to do with the “DAEMON Tools” product that is the subject of this security alert. To start with, the version numbers are quite different. Also, the latter is Windows-only <https://www.daemon-tools.cc/support/faq#system_requirements>, while the former makes it quite clear <https://cr.yp.to/daemontools.html> that it is “for managing UNIX services”.

1 0

Fixing A Service Dependency
by Lawrence D'Oliveiro 02 May '26

02 May '26

I don’t often have to restart my public-facing virtual server, but when I do, I have had trouble with one or two services not starting properly. The server picks up my mail via Postfix. From my office, I then run a periodic task which connects via POP to Dovecot on the server, and transfers the mail to my main office machine. This happens over an encrypted OpenVPN connection, so Dovecot itself doesn’t need to implement any encrypted transport, or accept connections on any publicly-accessible ports. One problem was, there was by default no coordination between the startup of the VPN connection and the startup of the Dovecot process. If the latter got going first, then it would fail to open a listening socket on the LAN-internal interface, because the VPN connection had not created that interface yet. Today I finally sat down and worked out a fix. This requires adding a dependency between the two services, via their systemd service configuration files. systemd offers a convenient method for allowing you to customize service configurations without having to completely replace their .service files. Instead, you create “drop-in” files, which amend the configuration in the desired ways. In this case, the original Dovecot service config file is /lib/systemd/system/dovecot.service, which I didn’t need to touch. Instead, I created the directory /etc/systemd/system/dovecot.service.d, to contain my amendments to the service definition. In here, I put a file which I decided to call geek-central.conf, which only needed to contain [Unit] Requires=openvpn-server(a)geek-central.service After=openvpn-server(a)geek-central.service (Note that the OpenVPN service definitions are “template” files, which means you can start multiple service instances from a common template, with a unique name after the “@” character. It’s up to the software implementing the service to use this instance name as a hint as to which configuration to choose for the service instance -- in this case, it looks for the VPN setup details in /etc/openvpn/server/geek-central.conf.) First I did a “systemctl daemon-reload”, followed by “systemctl show dovecot.service”, just to confirm it was picking up the configuration changes correctly -- namely, that the “Requires=” and “After=” entries showed the combination of the default settings and my amendments. Then, of course, to do a proper test, I had to reboot the server. Which worked. I also did a similar thing to fix a race condition between the startup of the SQLGrey mail greylisting service and the database server it is using. The former requires the latter, but the default service configuration doesn’t specify this, again leading to startup failures -- I would class this as a configuration bug. A fix for this was similarly easy.

1 0

New Linux 'Copy Fail' Vulnerability Enables Root Access On Major Distros
by Peter Reutemann 02 May '26

02 May '26

'A newly disclosed Linux kernel flaw dubbed "Copy Fail" can let a local, unprivileged attacker gain root access on major Linux distributions, with researchers claiming the bug affects kernels shipped since 2017. "The POC exploit works out of the box today, but a future version that can escape from containers like Docker is promised soon," writes Slashdot reader tylerni7. "Technical details are available here." Slashdot reader BrianFagioli shares a report from NERDS.xyz: A newly disclosed Linux kernel vulnerability called Copy Fail (CVE-2026-31431) allows an unprivileged user to gain root access using a tiny 732-byte script, and it works with unsettling consistency across major distributions. Unlike older exploits that relied on race conditions or fragile timing, this one is a straight-line logic flaw in the kernel's crypto subsystem. It abuses AF_ALG sockets and splice to overwrite a few bytes in the page cache of a target file, such as /usr/bin/su. Because the kernel executes from the page cache, not directly from disk, the attacker can inject code into a setuid binary in memory and immediately escalate privileges. What makes this especially concerning is how quiet it is. The file on disk remains unchanged, so standard integrity checks see nothing wrong, while the in-memory version has already been tampered with. The same primitive can also cross container boundaries since the page cache is shared, raising the stakes for multi-tenant environments and Kubernetes nodes. The underlying issue traces back to an in-place optimization added years ago, now being rolled back as part of the fix. Until patched kernels are widely deployed, this is one of those bugs that feels less like a theoretical risk and more like a practical, reliable path to full system compromise. ' -- source: https://it.slashdot.org/story/26/04/30/207231 Cheers, Peter

1 0

Hackers Are Actively Exploiting a Bug In cPanel, Used By Millions of Websites
by Peter Reutemann 02 May '26

02 May '26

'Hackers are actively exploiting a critical cPanel and WHM vulnerability, tracked as CVE-2026-41940, that allows remote attackers to bypass the login screen and gain full administrative access to affected web servers. Major hosts including Namecheap, HostGator, and KnownHost have taken mitigation steps or patched systems, but cPanel is urging all customers and web hosts to update immediately because the software is widely used across millions of websites. TechCrunch reports: cPanel and WHM are two software suites used for managing web servers that host websites, manage emails, and handle important configurations and databases needed to maintain an internet domain. The two suites have deep-access to the servers that they manage, allowing a malicious hacker potentially unrestricted access to data managed by the affected software. Given the ubiquity of the cPanel and WHM software across the web hosting industry, hackers could compromise potentially large numbers of websites that haven't patched the bug. Canada's national cybersecurity agency said in an advisory that the bug could be exploited to compromise websites on shared hosting servers, such as large web hosting companies. The agency said that "exploitation is highly probable" and that immediate action from cPanel customers, or their web hosts, is necessary to prevent malicious access. [...] One web hosting company says it found evidence that hackers have been abusing the vulnerability for months before the attempts were discovered.' -- source: https://it.slashdot.org/story/26/05/01/0631257 Cheers, Peter

1 0

Framework CEO Reviews Framework Laptop 12 versus Apple MacBook Neo
by Lawrence D'Oliveiro 29 Apr '26

29 Apr '26

Quite a lot of hardware detail in this half-hour video <https://www.youtube.com/watch?v=uvYt1GgcsUI>, in which Framework CEO Nirav Patel, assisted by Izzy, his hardware product manager, do side-by-side teardowns of their company’s Laptop 12 model and Apple’s new MacBook Neo. He does try not to let his bias show *too* much, by being complimentary to the Neo’s better screen, and also by being reasonably even-handed in his discussion of respective design tradeoffs (just compare the size of the two different mainboards, for -- to me at least -- the most dramatic example of this). Both target the sub-US$1000 market, but of course they do it in very different ways: the whole philosophy of Framework is to keep things modular for easy repair and upgradeability, while Apple has traditionally taken a “keep out” attitude to would-be do-it-yourself hardware tinkerers. It appears, though that the Neo represents a shift in this attitude somewhat -- not that Apple has much choice, with new EU rules on minimizing e-waste coming into effect. Plus of course the political pressure from consumer-driven right-to-repair movements on both sides of the Atlantic. He talks at the end about an emphasis on the education market -- a market which Apple dominated back in the last century, but gave up somewhat in the last couple of decades. Seems like the Neo might represent an attempt by Apple to reestablish a presence here, while Patel says he is already getting lots of queries from schools looking to save costs by buying more easily repairable products.

1 0

Phrase Of The Week: “Distillation Attack”
by Lawrence D'Oliveiro 28 Apr '26

28 Apr '26

It’s not enough that the creators of the AI models have scraped information from millions of websites to build their systems, now they have to worry about competitors short-circuiting the process by extracting information wholesale from their models, by making hundreds or thousands of requests and combining the results. This is called a “distillation attack”. Some AI service providers try to say this is against their terms and conditions, but how do you define what is and isn’t allowed, exactly? <https://arstechnica.com/ai/2026/02/attackers-prompted-gemini-over-100000-ti…>: In March 2023, shortly after Meta’s LLaMA model weights leaked online, Stanford University researchers built a model called Alpaca by fine-tuning LLaMA on 52,000 outputs generated by OpenAI’s GPT-3.5. The total cost was about $600. The result behaved so much like ChatGPT that it raised immediate questions about whether any AI model’s capabilities could be protected once it was accessible through an API. A big worry in the US now is that China is doing this to train its AI models <https://arstechnica.com/tech-policy/2026/04/us-accuses-china-of-industrial-…>. And of course, as soon as it is seen as a “national security” issue, they start to lobby the politicians to pass laws against it. Imagine that: making too much use of the service, or prompting it according to certain forbidden patterns, could now become criminal violations of laws such as the Economic Espionage Act and the Computer Fraud and Abuse Act. Another quote from the February article: As long as an LLM is accessible to the public, no foolproof technical barrier prevents a determined actor from doing the same thing to someone else’s model over time (though rate-limiting helps), which is exactly what Google says happened to Gemini

1 0

Framework’s CEO on the RAM crisis and creating a “MacBook Pro for Linux users”
by Lawrence D'Oliveiro 23 Apr '26

23 Apr '26

Interview with Framework CEO Nirav Patel <https://arstechnica.com/gadgets/2026/04/frameworks-ceo-on-the-ram-crisis-an…>. Framework, the maker of configurable laptops, is naturally a Linux-heavy, but not a Linux-exclusive, company: “... on Framework Laptop 13, we actually have slightly more Linux users than Windows users. It’s something like 55/45 [Linux versus Windows] on the 13. It varies on our different products. The [Framework Laptop] 16 is a bit more Windows heavy.” Also: The company is also trying to capture Mac users, which was one reason Framework shifted from a trackpad with a physical clicking mechanism to a haptic trackpad like the ones Apple has used in most MacBooks over the past decade. Yes, there are actually enough Mac users that want to switch to Framework machines, for this to matter. And the headline quote: “Increasingly over the last five years, especially software developers come in because they want Linux and they want it on hardware that supports it as a first-class experience,” Patel told Ars. “And so really a lot of the philosophy behind the [Framework Laptop 13] Pro was ‘let’s build essentially the MacBook Pro for Linux users. Let’s take the software that they want, the distro that they prefer, and then make sure that the hardware experience lives up to what they would expect coming from a MacBook Pro.’”

1 1

IPv6 Marches On
by Lawrence D'Oliveiro 17 Apr '26

17 Apr '26

Some interesting stats from <https://www.tomshardware.com/networking/ipv6-usage-reaches-historic-50-perc…>: • 50% of users of Google’s services connect over IPv6 • 43% of the world uses IPv6, with some parts approaching 50% • Cloudflare reports 40% of its traffic is done via IPv6 Choice quote: Some people still think that the additional 20 bytes or so of an IPv6 packet header translates to significant bandwidth losses, higher CPU usage, and hair loss. The reality is that even 11 years ago, Facebook's tests saw that IPv6 connectivity was around 10-15% faster overall, while networking giant Akamai noticed a 5% speedup in mobile page loading. The speedups are almost assuredly due to the fact that with IPv6, there's very little need to do math with NAT, proxies, and other shenanigans, as in most instances, everything can directly connect to everything else.

1 0

Linux 7.0 Released
by Peter Reutemann 14 Apr '26

14 Apr '26

'"The new Linux kernel was released and it's kind of a big deal," writes longtime Slashdot reader rexx mainframe. "Here is what you can expect." Linuxiac reports: A key update in Linux 7.0 is the removal of the experimental label from Rust support. That (of course) does not make Rust a dominant language in kernel development, but it is still an important step in its gradual integration into the project. Another notable security-related change is the addition of ML-DSA post-quantum signatures for kernel module authentication, while support for SHA-1-based module-signing schemes has been removed. The kernel now includes BPF-based filtering for io_uring operations, providing administrators with improved control in restricted environments. Additionally, BTF type lookups are now faster due to binary search. At the same time, this release continues ongoing cleanup in the kernel's lower layers. The removal of linuxrc initrd code advances the transition to initramfs as the sole early-userspace boot mechanism. Linux 7.0 also introduces NULLFS, an immutable and empty root filesystem designed for systems that mount the real root later. Plus, preemption handling is now simpler on most architectures, with further improvements to restartable sequences, workqueues, RCU internals, slab allocation, and type-based hardening. Filesystems and storage receive several updates as well. Non-blocking timestamp updates now function correctly, and filesystems must explicitly opt in to leases rather than receiving them by default. Phoronix has compiled a list of the many exciting changes. Linus Torvalds himself announced the release, which can be downloaded directly from his git tree or from the kernel.org website. Linux 7.0 has a major new version number but it's "largely a numbering reset [...], not a sign of some unusually disruptive release," notes Linuxiac.' -- source: https://linux.slashdot.org/story/26/04/13/1857240/linux-70-released Cheers, Peter

1 0

Steam On Linux Use Skyrocketed In March - More Than Double The macOS Gaming Marketshare
by Lawrence D'Oliveiro 04 Apr '26

04 Apr '26

I keep thinking: if the number of Linux-based users of Steam is so much greater than those using macOS, doesn’t that mean that the size of the overall desktop Linux installed base is now larger than that of macOS? Because otherwise, macOS users must be somehow less fun-loving that Linux users ... which seems hard to accept. <https://www.phoronix.com/news/Steam-On-Linux-Tops-5p>

1 1

Google Groups Spam
by Lawrence D'Oliveiro 03 Apr '26

03 Apr '26

I thought Google Groups was defunct. But it appears it is still possible for people to use it to set up mailing lists. I have been receiving a certain amount of spam sent via this mechanism over the past couple of weeks: what seems to happen is that the spammer registers a random domain and sets Google to manage email for that domain, creates a list on Google Groups with an address on that domain, subscribes a bunch of victims to it, then sends out their junk mail with the from-address set to the list address. Several of those addresses have autoreply set (e.g. tech support addresses), so they in turn send those autoreplies to the list address, which adds to the spam. Thankfully, there don’t seem to be autoreplies to their autoreplies, so at least things don’t spiral completely out of control ... What I have found is that all these messages have a common characteristic, namely a “List-Unsubscribe” header line which contains an address like “<mailto:googlegroups-manage+«blah-blah»+unsubscribe@googlegroups.com>”. Checking a few other mailing lists I’m on (like this one), they have entirely different addresses in this field. So, following some instructions in the Postfix documentation, I have added a “header_checks” map to my MTA configuration, containing the rule /^List-Unsubscribe\:\s*.*\@googlegroups\.com REJECT I always feel a little nervous about these sorts of email-related changes, since it’s so easy to stuff something up and block receipt of all mail altogether. I’ll feel reassured by seeing this posting to the mailing list come back to me. ;)

1 2

Open Source: This Is Not How It Works
by Lawrence D'Oliveiro 03 Apr '26

03 Apr '26

The Europeans want to create their own open-source office suite, to get away from the whims of some US-based proprietary company -- a commendable goal. They are using the OnlyOffice source code as their starting point -- maybe not so commendable. Seems the OnlyOffice folks are not happy over this <https://www.computerworld.com/article/4153893/onlyoffice-accuses-euro-offic…>. Trouble is, I don’t see how they can have a point. They license the source code under the AGPL, a licence that I have some qualms about. But nevertheless, people are free to take the code under this licence and do whatever they like with it, subject to the terms of the licence. From the article: OnlyOffice said in blog post that those accessing its code under this license are required to abide by conditions, such as retaining OnlyOffice’s branding and “providing proper attribution to the original technology.” OnlyOffice said that Euro-Office doesn’t meet these conditions, and therefore “any further use of the software is unauthorized and, as such, constitutes an infringement of the copyright holder’s exclusive rights.” The company also claims it was not contacted about the Euro-Office project prior to launch. But open-source licences don’t require any such conditions: there is no need to preserve any such “branding” (in fact, some trademark owners insist that these be removed in any forks), and there is no need to seek additional agreement from the copyright owners before performing actions that are permitted under the licence anyway. Copyright notices must be kept, anyway, but I can’t believe the Europeans were planning on removing those.

1 0

I tried to prove I'm not AI. My aunt wasn't convinced
by Lawrence D'Oliveiro 30 Mar '26

30 Mar '26

A BBC correspondent talks to some AI experts on ways that people can be sure they’re talking to the real you and not an AI. The consensus is: the fakes are so good now, there is no way even for the experts to be completely sure, when communicating with someone remotely, that they are genuine, just from the content alone. Apart from meeting in person, the only sure way is to apply authentication methods already in common use for secure logins to remote services. Only now the definition of “remote service” has to broadened to “talking to your friends”. <https://www.bbc.com/future/article/20260324-i-tried-to-prove-im-not-an-ai-d…>

2 3

Linux Maintainer Greg Kroah-Hartman Says AI Tools Now Useful, Finding Real Bugs
by Peter Reutemann 30 Mar '26

30 Mar '26

'Linux kernel maintainer Greg Kroah-Hartman tells The Register that AI-driven code review has "really jumped" for Linux. "There must have been some inflection point somewhere with the tools..." "Something happened a month ago, and the world switched. Now we have real reports." It's not just Linux, he continued. "All open source projects have real reports that are made with AI, but they're good, and they're real." Security teams across major open source projects talk informally and frequently, he noted, and everyone is seeing the same shift. "All open source security teams are hitting this right now...." For now, AI is showing up more as a reviewer and assistant than as a full author of Linux kernel code, but that line is starting to blur. Kroah-Hartman has already done his own experiments with AI-generated patches. "I did a really stupid prompt," he recounted. "I said, 'Give me this,' and it spit out 60: 'Here's 60 problems I found, and here's the fixes for them.' About one-third were wrong, but they still pointed out a relatively real problem, and two-thirds of the patches were right." Mind you, those working patches still needed human cleanup, better changelogs, and integration work, but they were far from useless. "The tools are good," he said. "We can't ignore this stuff. It's coming up, and it's getting better...." [H]e said that for "simple little error conditions, properly detecting error conditions," AI could already generate dozens of usable patches today. The sudden increase in AI-generated reports and AI-assisted work has also spurred a parallel push to build AI into the kernel's own review infrastructure. A key piece of that is Sashiko, a tool originally developed at Google and now donated to the Linux Foundation. Kroah-Hartman said some patches are being generated with AI now. "You have a little co-develop tag for that now. We're seeing some things for some new features, but we're seeing AI mostly being used in the review."' -- source: https://linux.slashdot.org/story/26/03/28/0717258 Cheers, Peter

1 0

A Homegrown Excel Bug?
by Lawrence D'Oliveiro 26 Mar '26

26 Mar '26

A correction to MBIE’s report on current fuel reserves <https://www.nzherald.co.nz/nz/politics/mbie-clarifies-fuel-data-showing-far…> adds a previously-missing column showing ships that are currently “discharging” their fuel load. This gives an extra 16 days’ supply of diesel that was previously reported as only on its way here, not actually here. How do you miss out a column from a report? Answers on a postcard, please ...

1 0

Wine 11 Rewrites How Linux Runs Windows Games At the Kernel Level
by Peter Reutemann 25 Mar '26

25 Mar '26

'Linux gamers are seeing massive performance gains with Wine's new NTSYNC support, "which is a feature that has been years in the making and rewrites how Wine handles one of the most performance-sensitive operations in modern gaming," reports XDA Developers. Not every game will see a night-and-day difference, but for the games that do benefit from these changes, "the improvements range from noticeable to absurd." Combined with improvements to Wayland, graphics, and compatibility, as well as a major WoW64 architecture overhaul, the release looks less like an incremental update and more like one of Wine's most important upgrades in years. From the report: The numbers are wild. In developer benchmarks, Dirt 3 went from 110.6 FPS to 860.7 FPS, which is an impressive 678% improvement. Resident Evil 2 jumped from 26 FPS to 77 FPS. Call of Juarez went from 99.8 FPS to 224.1 FPS. Tiny Tina's Wonderlands saw gains from 130 FPS to 360 FPS. As well, Call of Duty: Black Ops I is now actually playable on Linux, too. Those benchmarks compare Wine NTSYNC against upstream vanilla Wine, which means there's no fsync or esync either. Gamers who use fsync are not going to see such a leap in performance in most games. The games that benefit most from NTSYNC are the ones that were struggling before, such as titles with heavy multi-threaded workloads where the synchronization overhead was a genuine bottleneck. For those games, the difference is night and day. And unlike fsync, NTSYNC is in the mainline kernel, meaning you don't need any custom patches or out-of-tree modules for it work. Any distro shipping kernel 6.14 or later, which at this point includes Fedora 42, Ubuntu 25.04, and more recent releases, will support it. Valve has already added the NTSYNC kernel driver to SteamOS 3.7.20 beta, loading the module by default, and an unofficial Proton fork, Proton GE, already has it enabled. When Valve's official Proton rebases on Wine 11, every Steam Deck owner gets this for free. All of this is what makes NTSYNC such a big deal, as it's not simply a run-of-the-mill performance patch. Instead, it's something much bigger: this is the first time Wine's synchronization has been correct at the kernel level, implemented in the mainline Linux kernel, and available to everyone without jumping through hoops. ' -- source: https://tech.slashdot.org/story/26/03/24/1946246 Cheers, Peter

1 0

MultiTail
by Peter Reutemann 16 Mar '26

16 Mar '26

Just came across this post/tutorial on MultiTail: 'MultiTail is a powerful terminal-based utility that allows you to view multiple log files simultaneously in a single terminal window. Think of it as tail -f on steroids. Instead of opening several terminal tabs or splitting your screen with tmux, MultiTail creates dynamically managed panes inside one terminal session. Each pane can follow a different file, command output, or even network stream. At its core, MultiTail is designed to: - Monitor multiple log files at once - Display them in split windows - Apply colorization rules - Merge multiple files into one unified view - Filter content live - Follow new files dynamically' -- source: https://idolinux.com/multitail-what-it-is-and-how-it-can-make-you-a-better-… Cheers, Peter

1 0

Keep Android Open
by Michael Doerner | TechnologyWise 08 Mar '26

08 Mar '26

Any suggestions who to address, where to go to with this in NZ? https://keepandroidopen.org/

2 1

Norwegian Consumer Council PSA -- In English! (Language Warning)
by Lawrence D'Oliveiro 06 Mar '26

06 Mar '26

The Norwegian Consumer Council (Forbrukerrådet) has released a wickedly funny skit (in English, even) warning against products that start out attractive and fun to use, but then get enshittified with extra-cost “options” that turn out not to be so “optional”. And yes, they use the word a lot. <https://www.youtube.com/watch?v=T4Upf_B9RLQ>

1 0

A Taste Of CDE
by Lawrence D'Oliveiro 02 Mar '26

02 Mar '26

An emulation of an early-1990s Linux GUI in a browser <https://www.tomshardware.com/software/linux/nostalgic-developer-recreates-t…>. Actually, who says CDE was ever “dead”? GNU created their own version of the OSF Motif GUI toolkit, called “Lesstif”, and it continues to be available in Linux distros to this day.

3 4

The Two Linuses
by Lawrence D'Oliveiro 28 Feb '26

28 Feb '26

This 53-minute video <https://www.youtube.com/watch?v=mfv0V1SxbNA> was posted back in January, but I only discovered it more recently. In it, Linux creator Linus Torvalds pays a visit to the offices of Linus Sebastian (the brains behind the “Linus Tech Tips” YouTube channel), while the latter builds the former a new custom PC to the former’s requirements. With a 24-core, 48-thread CPU (great for kernel builds, which is what Torvalds spends much of his work day doing), and 64GiB worth of memory -- proper ECC memory (a long-time pet peeve of the Linux man). As the build progresses, they discuss many things, including questions previously collected from the community, addressed to Linus T. Asked which of his software “children” he is more fond of, Linux or Git, Torvalds reveals that he only spent 6 months working on Git, before passing it off to Junio Hamano, who has been the prime mover behind it for the past 20 years. (What, no mention of Subsurface?) He also brought in one of the guitar-effects pedals that he has been designing, purely as a hobby to unwind from his day job, with no expectation that they will ever be useful to anybody, not even himself (he doesn’t play guitar). Which distro does he use? It turns out his current fave is Fedora, because (unlike, say, Ubuntu) they make it easy for him to replace their kernel with his custom, fresh-built ones.

1 0

Firefox 148 Lets You Kill All AI Features in One Click
by Peter Reutemann 27 Feb '26

27 Feb '26

'Mozilla has released Firefox 148 for Windows, macOS and Linux, bringing a new AI Settings section that lets users disable all of the browser's AI-powered features in one click and then selectively re-enable the ones they actually want, such as the local translation tool that works locally rather than in the cloud. The update also patches more than 50 security vulnerabilities -- none known to be under active exploitation -- over half of which Mozilla classifies as high risk, including five sandbox escape flaws and eight use-after-free bugs in the JavaScript engine that could allow code execution.' -- source: https://news.slashdot.org/story/26/02/26/182239 Cheers, Peter

1 0

Austria Military Ditches Microsoft for Open-Source Libreoffice – Here’s Why
by Peter Reutemann 26 Feb '26

26 Feb '26

'Austria's military has completed a major IT overhaul, replacing Microsoft Office with the open-source LibreOffice suite across all its desktop systems. The change, finalized this month, affects approximately 16,000 workstations in the Austrian Armed Forces. This move will substantially reduce Austria's software bill. At $33.75 per user per month, a Microsoft 365 E3 subscription for 16,000 workstations costs approximately $6,480,000 per year, compared to LibreOffice's zero cost. But this move isn't about saving money. The real motivation is to gain digital sovereignty and control over critical data. As Michael Hillebrand of Directorate 6 information and communications technology (ICT) and Cyber Defense, explained: "It was very important for us to show that we are doing this primarily to strengthen our digital sovereignty, to maintain our independence in terms of ICT infrastructure and to ensure that data is only processed in-house."' -- source: https://www.zdnet.com/article/this-european-military-just-ditched-microsoft… Cheers, Peter

2 2

Fear Of Forking, Revisited
by Lawrence D'Oliveiro 23 Feb '26

23 Feb '26

Was rereading this old essay <http://linuxmafia.com/faq/Licensing_and_Law/forking.html> that I found some years ago. It’s a commentary on the status of the Free Software movement (unfortunately referred to as “freeware” at one point) as of late 1999, at a point when various parties (*cough* proprietary software propagandists *cough*) were still trying to spread FUD about how “forks” of software projects could leave them fragmented and users without a coherent support framework. He recaps the unfortunate history of Unix, and the swallowing up of essentially its entire market by Microsoft: Those companies bought the right [from AT&T] to make their own Unixes: IBM released AIX. Apple did A/UX. DEC did Ultrix[8], OSF/1, and Digital Unix (later renamed "Compaq Unix" and now "Compaq Tru64 Unix"). Data General did DG/UX, SGI did IRIX, HP did HP/UX, and SCO did Xenix[9] which eventually mutated into SCO Open Server. And we could cite others, but I'll spare you. The point is that these were the jokers who ruined Unix. Every one of them marketed his mutant Unix as "Unix plus" — everything the other guys have and more. Needing to create differentiators, they deliberately made their Unixes incompatible while giving lip service to "standards". For customers, this was simply a mess, and Microsoft drove right through these guys' disunity like a Sherman tank. It is the classic instance of forking that sticks in people's minds. Which is why you folks are expected to assure customers that the same won't happen to GNU/Linux. We'll return to this point later. Among various other examples, the author tries to explain why this is not a serious possibility with the Linux kernel, and how even the BSD forks were not really forks, and would stay largely in sync. Well, he was mostly right on the first of those cases, but somewhat wrong on the second one. As to how the release of Open-Source BSD came about: One fine day in 1991, grad student Keith Bostic came to the BSD lead developers, inspired by Richard M. Stallman's (remember him?) [13] GNU Project, and suggested replacing BSD's remaining AT&T work to create a truly free BSD. Dreading the confrontation likely to result with AT&T, they tried to stall by assigning Bostic the difficult part of this task, rewriting some key BSD utilities. This backfired when he promptly did exactly that. So, they grumbled but then completed the job[14], and tried to prevent AT&T from noticing what they had done. AT&T did notice[15], panicked, and sued. That, too, is a long story best omitted. Under the stress of the lawsuit, freeware BSD split into three camps (FreeBSD, NetBSD, and OpenBSD).[16] But there were also several proprietary branches[17], made possible because U.C. Berkeley's "BSD Licence" allowed creation of those: Sun Microsystems's SunOS, Tenon Intersystems's MachTen, BSDI's BSD OS [18], and NeXT Computer's NeXTStep OS all came out for sale without public access to source, and were all based on the Berkeley BSD source code. For one thing, I thought *every* proprietary Unix was based on code licensed from AT&T; but this is saying that SunOS and NeXTStep, among a few others, came from BSD and owed nothing to AT&T. A word about the three free BSD variants: All three were splinters from a now-dead project called 386BSD. All have talked about re-merging in order to save duplication of effort, but they now persist as separate projects because they've specialised: FreeBSD aims for the highest possible stability[19] on Intel x86 (IA32) CPUs, NetBSD tries to run on as many different CPU types as possible, and OpenBSD aims to have the tightest security possible. In other words, the 386BSD project remains forked because there are compelling reasons that make this a win for everyone. Also, where possible, these three sister projects collaborate on tough tasks — and they also collaborate with GNU/Linux programmers. Some of the best hardware drivers in the Linux kernel are actually BSD drivers. There's a high level of compatibility among the three BSDs and between them and GNU/Linux: Unlike the proprietary Unix vendors, BSD and GNU/Linux programmers have an incentive to eliminate incompatibility and support standards. But as we know from more recent history, the BSDs don’t cooperate that much at all, at least not any more. As of today, they are well and truly fragmented. As for the AT&T lawsuit, it seems it had no legal basis at all: At the time, the lawsuit's allegation of infringement of AT&T source-code copyright cast a shadow over not just Berkeley's BSD and BSDI's BSD OS, but also William and Lynne Jolitz's free-software 386BSD project, which was a patchkit of about 180 patches based on Berkeley's "NET/2" BSD release. (In retrospect, there is grave doubt about whether AT&T's complaint ever had merit, on several grounds, but this was not clear at the time. Kirk McKusick told me that defendants ultimately agreed in the settlement that seven BSD files were encumbered by AT&T copyrights only to let AT&T save face on what would otherwise have been a dead loss, allowing that concession because the seven files were dreadful spaghetti code and overdue for replacement anyway.) Apparently in part because of the legal threat, the Jolitzes withdrew from the project, leaving copyright questions and a leadership vacuum on top of the project's other problems. Anyway, there are other examples of forks that were successful versus those that were not so successful. I don’t think the pattern the author claims to see holds up; I think it is far more an issue of management culture: if the original project leaders try to be too controlling and reject useful-looking ideas, then forks will happen. The new ideas in the forks may or may not succeed; but of course that success (or not) is key to the success of the fork.

1 0

Dutch Defence Secretary Threatens To “Jailbreak” Their F-35 Fighters
by Lawrence D'Oliveiro 19 Feb '26

19 Feb '26

Gijs Tuinman, when asked if the EU can make changes to the fighter jet without US approval, replied <https://www.tomshardware.com/tech-industry/dutch-secretary-of-defense-threa…>: “I’m going to say something I should never say, but I’ll do it anyway,” the defense secretary said. “Just like your iPhone, you can jailbreak an F-35. I won’t say more about it.” The operating system apparently runs to 8 million lines of code, and of course it’s encrypted/obfuscated. But so are lots of games on consoles and PCs that use elaborate copy-protection and anti-cheat mechanisms. And there are quite a few people with experience wading their way through mazes like that. Of course the US officially denies that the hardware it sells to other countries has any kind of “kill switch” in it. So maybe the EU has a Plan B, maybe it doesn’t ...

1 0

Seasoned Windows Expert Gives Linux A Try
by Lawrence D'Oliveiro 19 Feb '26

19 Feb '26

The article title seems optimistic enough: “I replaced Windows with Linux, and there's only one feature I miss” <https://www.zdnet.com/article/how-to-replace-windows-with-linux/>. The article is by Ed Bott, “Senior Contributing Editor” at ZDNet, and he is definitely a long-standing Windows guy. After suggesting, in a previous article, that Windows users could consider switching to Linux as a way to keep old machines, that Microsoft won’t support on Windows 11, going, he finally decides to try it for himself. (With the help of ongoing advice from Google’s Gemini chatbot.) His choice of hardware to use in the experiment was ... interesting. One might almost say he picked on hardware which is known to be troublesome with Linux ... First he tried a couple of ARM-based Windows machines, and recorded failure for both. There was a suggestion that this could be made to work by extracting proprietary firmware blobs from the Windows install and incorporating them into the Linux kernel build (by “editing some device trees”, which sounds like building a kernel from source to me), but he decided not to bother. Next he tried a couple of Microsoft Surface models. Both were x86-based, but Surface machines do have some odd hardware not present in common-or-garden PCs. In this case he was helped out by a project on GitHub specifically to get Linux running on these devices. Finally he was able to get Zorin OS 18 Core working on one Surface, and Fedora 43 on the other. The latter had sleep problems, and he had no luck getting a webcam working (the “one feature” that he misses as mentioned in the title, being Windows Hello facial recognition). After all the setup headaches, the part that gave him the least trouble was accessing the apps he is used to -- he didn’t even have to resort to WINE for any of these. His conclusion: All in all, this was not a friction-free experience. I do not recommend it for novices or for anyone who wants a PC that is easy to operate and troubleshoot. But if you're a reasonably knowledgeable PC hobbyist and you're willing to accept a learning curve that includes time in a terminal session, Linux is a perfectly acceptable alternative. I do not recommend that you tell your tech-challenged relatives to try the upgrade on their own. They'd be better off with a Mac, honestly. I’m not sure that people would be better off with a Mac any more. The current sky-high prices of RAM mean that some might decide to buy a lower-spec machine initially, in the hope of upgrading it later; you can’t do this with Apple products any more. Also, I think the installed base of desktop Linux is already larger than that of Mac users anyway.

1 0

KDE Says Plasma Desktop Will Never Force Users to Use systemd
by Peter Reutemann 17 Feb '26

17 Feb '26

'The KDE project has addressed some recent concerns from users that they are forcing the systemd init system on current or future versions of its Plasma desktop environment. This comes after the developers of the KaOS Linux independent distro announced that they decided to replace the KDE Plasma desktop environment with a Niri/Noctalia setup to move away from systemd, saying that “Plasma pretty much demands systemd, and will be fully mandatory soon.“ Well, when asked if Plasma or any of its components demands systemd or if it is forced on users, the KDE project said no, except for the new Plasma Login Manager display manager that will be introduced with the upcoming KDE Plasma 6.6 release tomorrow. “So you are forcing Plasma users to use systemd?” No, the Plasma Login Manager is one of probably half a dozen login managers (or more) that can boot Plasma,” said the KDE devs. “We made PLM because it will give distro creators a cool piece of kit that can (not “must”, not “should”: can) be tacked onto a system to boot into Plasma.” The KDE project also said that they are not planning on making any of Plasma’s core components dependent on systemd, and that it will also continue to work on non-Linux systems like FreeBSD, as there were many recent reports on various news outlets that “KDE will drop support for non-systemd systems.” So there you have it, only the Plasma Login Manager will be dependent on systemd, but future Plasma desktop releases aren’t dependent on Plasma Login Manager, nor systemd. Therefore, Linux distros that want to ship the latest Plasma releases will have to use a different login manager, such as SDDM.' -- source: https://9to5linux.com/kde-says-plasma-desktop-will-never-force-users-to-use… Cheers, Peter

1 0

Origins Of PipeWire
by Lawrence D'Oliveiro 16 Feb '26

16 Feb '26

Just been watching this video of a talk at FOSDEM 2020 <https://www.youtube.com/watch?v=m5Y8VLv0CQ8>, entitled “PipeWire in the Automotive Industry”. I had never heard of PipeWire back then, so it was interesting to discover that it was originally called “PulseVideo”, because it was supposed to be like PulseAudio, but only for video streams. But then it gradually took over the functions of PulseAudio, by offering a more efficient architecture for dealing with both audio and video streams. And also supporting security isolation between applications, which is something PulseAudio never had. PipeWire also subsumes the functionality of JACK as well (the architecture for audio and MIDI routing that is used in music/audio production workflows), and its interconnection functions naturally support the patchbay model of JACK. The presenter of the talk, George Kiagiadakis, is the creator of WirePlumber, which does PipeWire session management. He created it as part of his job contributing to the “Automotive Grade Linux” project, specifically working on the part dealing with automotive audio: this includes not just car entertainment systems, but also navigation interactions, voice activation functions and emergency notifications -- who knew the audio system in a modern car could be so complex?

1 0

ENIAC Turns 80
by Lawrence D'Oliveiro 15 Feb '26

15 Feb '26

<https://www.tomshardware.com/tech-industry/eniac-the-worlds-first-general-p…> In fact the Bletchley Park “Colossus” machine (that Alan Turing had a hand in) was working a little before ENIAC, but the existence of that was kept strictly secret until about the 1970s. The hardware engineers who built the early electronic computers didn’t really appreciate the importance and subtlety of the programming problem -- they saw it as a mere janitorial chore, that could be delegated to lower-paid underlings, like women. Here <https://www.youtube.com/watch?v=buAYHonF968> is the testimony of one of those women, and the clever innovations they developed to facilitate the programming process.

1 0

People can’t find jobs, jobs can’t find people; who’s to blame?
by Lawrence D'Oliveiro 15 Feb '26

15 Feb '26

This article about the ongoing difficulties of people trying to find jobs, while at the same time employers seem unable to find people to fill their job positions, seems to put the primary blame on AI <https://www.thepost.co.nz/business/360905126/people-cant-find-jobs-jobs-can…>. Specifically, employers are relying too much on AI-generated situations-vacant ads, which leave out important information about the actual job situation. And so they get too many applicants who are unsuited to that actual job situation. Interesting to compare this part I’m not advising anyone to be a luddite here, but at a certain time we have AI talking to AI who’s talking to AI. Hiring is an inherently human process and unfortunately no AI (that I know of) can screen for personality, fit within a team or attitude. with this part The uncomfortable truth? If you wouldn't give your all to a role, employers can sense it. If the employers are using AI to screen their applicants, then probably they won’t “sense” any such thing ...

1 1

Robert Tinney Has Died
by Lawrence D'Oliveiro 12 Feb '26

12 Feb '26

Anybody who has read a few issues of Byte Magazine, from around the mid-1970s to the latter 1980s, will remember the charming and idiosyncratic cover paintings during that time. These were the work of an artist named Robert Tinney. Some of the works aroused so much interest that he offered signed limited-edition prints for sale. Now, the famous artist has passed away <https://arstechnica.com/gadgets/2026/02/byte-magazine-artist-robert-tinney-…>. That article says Tinney was never a technical person. So you could say he brought a certain naïveté to his interpretations of the technical topics in each issue. But that naïveté ended up being a key part of the charm of his illustrations -- intentionally or not, they expressed a kind of wit that appealed to geeks.

1 0

You Can Now Run Debian GNU/Linux on the OpenWrt One Open-Source Router
by Peter Reutemann 04 Feb '26

04 Feb '26

'Collabora shares with us today a new project that lets you install and run the Debian GNU/Linux operating system on the open-source OpenWrt One router. Collabora’s Sjoerd Simons has developed openwrt-one-debian, a set of scripts and tools that make it easier for one to install a full Debian GNU/Linux operating system on the OpenWrt One device, leveraging its NVMe storage and giving you the freedom to enable custom services, support for containers, development tools, and more.' -- source: https://9to5linux.com/you-can-now-run-debian-gnu-linux-on-the-openwrt-one-o… Cheers, Peter

1 0

'Vibe Coding Kills Open Source'
by Peter Reutemann 04 Feb '26

04 Feb '26

'Four economists across Central European University, Bielefeld University and the Kiel Institute have built a general equilibrium model of the open-source software ecosystem and concluded that vibe coding -- the increasingly common practice of letting AI agents select, assemble and modify packages on a developer's behalf -- erodes the very funding mechanism that keeps open-source projects alive. The core problem is a decoupling of usage from engagement. Tailwind CSS's npm downloads have climbed steadily, but its creator says documentation traffic is down about 40% since early 2023 and revenue has dropped close to 80%. Stack Overflow activity fell roughly 25% within six months of ChatGPT's launch. Open-source maintainers monetize through documentation visits, bug reports, and community interaction. AI agents skip all of that. The model finds that feedback loops once responsible for open source's explosive growth now run in reverse. Fewer maintainers can justify sharing code, variety shrinks, and average quality falls -- even as total usage rises. One proposed fix is a "Spotify for open source" model where AI platforms redistribute subscription revenue to maintainers based on package usage. Vibe-coded users need to contribute at least 84% of what direct users generate, or roughly 84% of all revenue must come from sources independent of how users access the software.' -- source: https://news.slashdot.org/story/26/02/03/1754205 Cheers, Peter

1 0

Notepad++ Compromised By State Actor
by Peter Reutemann 03 Feb '26

03 Feb '26

'Luthair writes: Notepad++ claims to have been targeted by a state actor, given their previous stance on Uyghurs one can speculate about a candidate. Notepad++, in a blog post: According to the analysis provided by the security experts, the attack involved infrastructure-level compromise that allowed malicious actors to intercept and redirect update traffic destined for notepad-plus-plus.org. The exact technical mechanism remains under investigation, though the compromise occurred at the hosting provider level rather than through vulnerabilities in Notepad++ code itself. Traffic from certain targeted users was selectively redirected to attacker-controlled served malicious update manifests.' -- source: https://it.slashdot.org/story/26/02/02/1646253 Cheers, Peter

1 0

Firefox is adding a switch to turn AI features off
by Peter Reutemann 03 Feb '26

03 Feb '26

'Unlike many of the companies stuffing AI into their browsers, Mozilla will soon give you a way to turn all of these features off. An update coming on February 24th will add a new “AI control” option to Firefox’s settings menu, allowing you to disable or enable the browser’s individual AI features, including access to a built-in AI chatbot, translations, AI tab group suggestions, and more.' -- source: https://www.theverge.com/news/872489/mozilla-firefox-ai-features-off-button Cheers, Peter

1 0

When 20-Year-Old Bill Gates Fought the World's First Software Pirates
by Peter Reutemann 02 Feb '26

02 Feb '26

'Just months after his 20th birthday, Bill Gates had already angered the programmer community," remembers this 50th-anniversary commemoration of Gates' Open Letter to Hobbyists. "As the first home computers began appearing in the 1970s, the world faced a question: Would its software be free?" Gates railed in 1976 that "Most of you steal your software." Gates had coded the BASIC interpreter for Altair's first home computer with Paul Allen and Monte Davidoff — only to see it pirated by Steve Wozniak's friends at the Homebrew Computing Club. Expecting royalties, a none-too-happy Gates issued his letter in the club's newsletter (as well as Altair's own publication), complaining "I would appreciate letters from any one who wants to pay up." But freedom-loving coders had other ideas. When Steve Wozniak and Steve Jobs released their Apple 1 home computer that summer, they stressed that "our philosophy is to provide software for our machines free or at minimal cost..." And early open-source hackers began writing their own free Tiny Basic interpreters to create a free alternative to the Gates/Micro-Soft code. This led to the first occurrence of the phrase "Copyleft" in October of 1976. Open Source definition author Bruce Perens shares his thoughts today. "When I left Pixar in 2000, I stopped in Steve Job's office — which for some reason was right across the hall from mine... " Perens remembered. "I asked Steve: 'You still don't believe in this Linux stuff, do you...?'" And Perens remembers how that movement finally won over Steve Jobs and carried the day. "Three years later, Steve stood onstage in front of a slide that said 'Open Source: We Think It's Great!' as he introduced the Safari browser, which at that time was based on the browser engine developed by the KDE Open Source project!"' -- source: https://news.slashdot.org/story/26/02/01/1915221 Cheers, Peter

1 0

Floppy Disk TV Remote
by Lawrence D'Oliveiro 20 Jan '26

20 Jan '26

Hardware hacker wants to make an alternative remote control for his smart TV that would be more intuitive for his toddler child to use than a conventional interactive remote interface. So what does he do? Build it out of an ancient, 1990s-technology floppy drive. Basic idea is that each floppy disk represents a different stream; user inserts disk into drive, TV starts playing that stream. Initially he thought of faking it, with simulated floppy “disks” with RFID chips on them that the “drive” would detect. Then he figured that the actual tactile experience of putting a real working disk into a real working drive would be far more effective. So he stores a config file on each disk that contains information about the stream to be played (plus associated display artwork), that software can read from the drive. Since there is only a small amount of data to be read off each disk, the drive can work quite nicely off battery power. So it becomes a real remote control as in one that is remote, not connected to the TV by any wire. Albeit one that is not very easy to pick up, but never mind ... <https://www.tomshardware.com/maker-stem/microcontrollers-projects/floppy-di… labeled-floppies-to-watch-his-favorite-shows>

2 1

“7 deprecated Linux commands you need to stop using - and what to use instead”
by Lawrence D'Oliveiro 15 Jan '26

15 Jan '26

Jack Wallen’s list <https://www.zdnet.com/article/linux-commands-deprecated-why-do-not-use/> of commands you shouldn’t be using any more, and what to use instead, is a mixed bag. ifconfig/iwconfig vs ip/iw -- the latter newer ones (part of the Linux “iproute2” suite) offer greater access to all the features of the Linux network stack than the former, older ones, and so are preferable in lots of ways. It is already possible to find setups which don’t have the old commands installed by default; I’m not sure if any distros have actually dropped the option for installing them altogether, but no doubt that will happen at some point. scp -- wrong. rsync, scp and sftp are all different ways of transferring files securely over SSH. scp did use to use its own protocol at one point, but it has been upgraded to use the same underlying protocol as sftp, so it’s perfectly fine to continue using the same command, if that’s what you’re used to. There is no sign that the scp command itself is going to be deprecated at any point, though no doubt the option to fall back to the old protocol for compatibility’s sake is likely to be removed eventually. egrep/fgrep -- it has been true for decades (possibly has always been true for the GNU utilities?) that egrep and fgrep are just synonyms for “grep -E” and “grep -F” respectively. And it is true that the alternative names are finally being deprecated after all these years, so it behooves you to learn to use the “grep” command for all forms. netstat vs ss -- yes, another case of the newer iproute2-based command taking over from the older, traditional command, and offering more features besides. Same remarks as above apply. route vs ip route -- iproute2 again. arp vs ip neighbour/neighbor -- more iproute2.

1 0

RISC-V PC Motherboard
by Lawrence D'Oliveiro 14 Jan '26

14 Jan '26

Here’s a mini-ITX motherboard with most of the usual trimmings (no integrated graphics or audio, though), but with a RISC-V CPU. So you’ll be using that single PCIe-x16 slot for a graphics card. Known to run Ubuntu. It’s available for pre-order <https://www.tomshardware.com/pc-components/cpus/milk-v-titan-mini-ix-board-…>. At this stage, it seems more targeted towards developers and early adopters, not (yet) the mass market.

2 1

How Long Does It Take to Fix Linux Kernel Bugs?
by Peter Reutemann 13 Jan '26

13 Jan '26

'A report from It's FOSS: Jenny Guanni Qu, a researcher at [VC fund] Pebblebed, analyzed 125,183 bugs from 20 years of Linux kernel development history (on Git). The findings show that the average bug takes 2.1 years to find. [Though the median is 0.7 years, with the average possibly skewed by "outliers" discovered after years of hiding.] The longest-lived bug, a buffer overflow in networking code, went unnoticed for 20.7 years! [But 86.5% of bugs are found within five years.] The research was carried out by relying on the Fixes: tag that is used in kernel development. Basically, when a commit fixes a bug, it includes a tag pointing to the commit that introduced the bug. Jenny wrote a tool that extracted these tags from the kernel's git history going back to 2005. The tool finds all fixing commits, extracts the referenced commit hash, pulls dates from both commits, and calculates the time frame. As for the dataset, it includes over 125k records from Linux 6.19-rc3, covering bugs from April 2005 to January 2026. Out of these, 119,449 were unique fixing commits from 9,159 different authors, and only 158 bugs had CVE IDs assigned. It took six hours to assemble the dataset, according to the blog post, which concludes that the percentage of bugs found within one year has improved dramatically, from 0% in 2010 to 69% by 2022. The blog post says this can likely be attributed to: - The Syzkaller fuzzer (released in 2015) - Dynamic memory error detectors like KASAN, KMSAN, KCSAN sanitizers - Better static analysis - More contributors reviewing code But "We're simultaneously catching new bugs faster AND slowly working through ~5,400 ancient bugs that have been hiding for over 5 years." They've also developed an AI model called VulnBERT that predicts whether a commit introduces a vulnerability, claiming that of all actual bug-introducing commits, it catches 92.2%. "The goal isn't to replace human reviewers but to point them at the 10% of commits most likely to be problematic, so they can focus attention where it matters..."' -- source: https://it.slashdot.org/story/26/01/12/0443201 Cheers, Peter

1 0

DMCA Takedown On Free Software
by Lawrence D'Oliveiro 07 Jan '26

07 Jan '26

Just read this report <https://www.tomshardware.com/software/chinese-semiconductor-outfit-has-linu…> about a DMCA takedown on a GitHub repository belonging to Rockchip. The copyright takedown was requested by the FFmpeg project. Their code is open source, of course. As is the code in the Rockchip repository. But the company took their code, removed the original attribution and licensing (LGPL), and put the result under an Apache licence, which is not compatible with the LGPL. Given that LGPL is a copyleft licence, and Apache is not, this could lead others to believe they could in turn take the Rockchip version of the code and develop it further and incorporate it into proprietary products without making any source available -- which is something copyleft is designed to prevent. Of course this action did not come out of the blue. The FFmpeg project had raised the issue with Rockchip back in 2024, but in the absence of any progress since that time, they felt that action had to be taken.

1 0

RIP Stewart Cheifet
by Lawrence D'Oliveiro 06 Jan '26

06 Jan '26

Those who spent their formative years back in the 20th century may or may not remember Stewart Cheifet, long-time presenter and executive producer of a US TV program called “The Computer Chronicles”, which was mainly produced through the 1980s and 1990s. I don’t recall that ever being shown here in NZ, but I later came to discover him through compilations of the shows on YouTube. And it turns it he has been instrumental in ensuring that records of all 400-odd episodes, as far as possible, have been preserved at the Internet Archive, as a valuable snapshot of the computing scene back in that era. Also of note, his co-presenter for the first several years was Gary Kildall, of CP/M fame, until the death of the latter. Now we hear Cheifet himself has passed away at the age of 87 <https://arstechnica.com/gadgets/2026/01/stewart-cheifet-pbs-host-who-chroni…>. (Oh, and if you’re wondering, he always pronounced it like “shuffay”).

1 0

pv - monitor the progress of data through a pipe
by Peter Reutemann 06 Jan '26

06 Jan '26

Hi everyone It's not Easter, but I love finding nifty little tools... :-) While looking up stackexchange for importing gzip-compressed MySQL dumps, I came across "pv", a tool for monitoring progress through pipes. Allows you to monitor how long, e.g., the import of a database dump will take. Example import command: pv mydump.sql.gz | gunzip | mysql -u root -p <database name> You will then see something like this: 1.73GiB 0:05:26 [6.54MiB/s] [=> ] 5% ETA 1:31:51 Here is the man page for pv: https://www.man7.org/linux/man-pages/man1/pv.1.html -- source: https://serverfault.com/a/445130 Cheers, Peter

1 0

2025 might have been the year for Linux gaming, but there's still a way to go until I switch from Windows
by Lawrence D'Oliveiro 30 Dec '25

30 Dec '25

Here is an article full of praise for the success Linux has been enjoying in handheld PC gaming, being able to run most Windows games better than Windows itself can manage <https://www.pcgamer.com/software/linux/2025-might-have-been-the-year-for-li…>. The writer mentions the one big obstacle to Linux enjoying greater success in this area: kernel-level anti-cheat mechanisms. The vast majority of these are Windows-specific, and many vendors are not only reluctant to support Linux as an alternative platform, they are downright hostile to it. Ultimately, though, I am going to put my bet on free-market Capitalism winning out. The customer is king. It is the game vendors who have to entice the buyers to part with their money in return for something worthwhile, the customers have no obligation to simply hand it over. If the only ace the Windows products have up their sleeve is obnoxious anti-cheat mechanisms, that may not be enough to keep customers flocking to them in droves. In other words, if the Linux-based handhelds continue to offer a superior user experience to the Windows-based ones, then those last remaining holdout vendors will be forced, purely by market forces, to go where the money is: they will ultimately be dragged, kicking and screaming, into supporting Linux gaming in some form.

1 0

Unix V4 Recovered
by Lawrence D'Oliveiro 25 Dec '25

25 Dec '25

A tape containing the only known copy of Bell Labs Unix version 4, dating from 1973, has been found at the University of Utah <https://www.tomshardware.com/software/linux/unix-v4-recovered-from-randomly…>. This was the first version of Unix in which the kernel and core utilities were (re)written in C. This particular tape had been sent to Martin Newell, he of the famous teapot. And yes, the recovered code is now available for you to try running for yourself.

1 0

The Linux Kernel Is Just A Program
by Lawrence D'Oliveiro 24 Dec '25

24 Dec '25

Came across this nifty little article <https://serversfor.dev/linux-inside-out/the-linux-kernel-is-just-a-program/> (found on Bluesky <https://bsky.app/profile/steveklabnik.com/post/3mapj6kf76k2d>) showing that you can run the Linux kernel directly from within a VM in qemu, without installing a distro or anything. It will boot, and then die because it wants to mount a root filesystem and start an init process; so then it’s easy enough to set that up with a few more commands, try booting it again, and there you go -- you have a running VM.

1 0

Linux Kernel Rust Code Sees Its First CVE Vulnerability
by Peter Reutemann 18 Dec '25

18 Dec '25

'Longtime Linux developer Greg Kroah-Hartman announced that the Linux kernel has received its first CVE tied to Rust code. Phoronix reports: This first CVE (CVE-2025-68260) for Rust code in the Linux kernel pertains to the Android Binder rewrite in Rust. There is a race condition that can occur due to some noted unsafe Rust code. That code can lead to memory corruption of the previous/next pointers and in turn cause a crash. This CVE for the possible system crash is for Linux 6.18 and newer since the introduction of the Rust Binder driver. At least though it's just a possible system crash and not any more serious system compromise with remote code execution or other more severe issues. ' -- source: https://it.slashdot.org/story/25/12/17/2034233 Cheers, Peter

1 0

Blocking ads with OpenWRT router
by Peter Reutemann 16 Dec '25

16 Dec '25

Hi everyone Found out on the weekend that I can install AdBlock straight on my router that is running OpenWRT: https://openwrt.org/docs/guide-user/services/ad-blocking?s%5B%5D=adblock Gets rid of (a large portion of) ads on mobile devices, like Android phones, when they are connected via WiFi. Cheers, Peter

1 0

New Rule Forbids GNOME Shell Extensions Made Using AI-Generated Code
by Peter Reutemann 15 Dec '25

15 Dec '25

'Phoronix reports: Due to the growing number of GNOME Shell extensions looking to appear on extensions.gnome.org that were generated using AI, it's now prohibited. The new rule in their guidelines note that AI-generated code will be explicitly rejected: "Extensions must not be AI-generated While it is not prohibited to use AI as a learning aid or a development tool (i.e. code completions), extension developers should be able to justify and explain the code they submit, within reason. Submissions with large amounts of unnecessary code, inconsistent code style, imaginary API usage, comments serving as LLM prompts, or other indications of AI-generated output will be rejected." In a blog post, GNOME developer Javad Rahmatzadeh explains that "Some devs are using AI without understanding the code..."' -- source: https://tech.slashdot.org/story/25/12/14/0453227 Cheers, Peter

1 0

New FreeBSD 15 Retires 32-Bit Ports and Modernizes Builds
by Peter Reutemann 08 Dec '25

08 Dec '25

'FreeBSD 15.0-RELEASE arrived this week, notes this report from The Register, which calls it the latest release "of the Unix world's leading alternative to Linux." As well as numerous bug fixes and upgrades to many of its components, the major changes in this version are reductions in the number of platforms the OS supports, and in how it's built and how its component software is packaged. FreeBSD 15 has significantly reduced support for 32-bit platforms. Compared to FreeBSD 14 in 2023, there are no longer builds for x86-32, POWER, or ARM-v6. As the release notes put it: "The venerable 32-bit hardware platforms i386, armv6, and 32-bit powerpc have been retired. 32-bit application support lives on via the 32-bit compatibility mode in their respective 64-bit platforms. The armv7 platform remains as the last supported 32-bit platform. We thank them for their service." Now FreeBSD supports five CPU architectures — two Tier-1 platforms, x86-64 and AArch64, and three Tier-2 platforms, armv7 and up, powerpc64le, and riscv64. Arguably, it's time. AMD's first 64-bit chips started shipping 22 years ago. Intel launched the original x86 chip, the 8086 in 1978. These days, 64-bit is nearly as old as the entire Intel 80x86 platform was when the 64-bit versions first appeared. In comparison, a few months ago, Debian 13 also dropped its x86-32 edition — six years after Canonical launched its first x86-64-only distro, Ubuntu 19.10. Another significant change is that this is the first version built under the new pkgbase system, although it's still experimental and optional for now. If you opt for a pkgbase installation, then the core OS itself is installed from multiple separate software packages, meaning that the whole system can be updated using the package manager. Over in the Linux world, this is the norm, but Linux is a very different beast... The plan is that by FreeBSD 16, scheduled for December 2027, the restructure will be complete, the old distribution sets will be removed, and the current freebsd-update command and its associated infrastructure can be turned off. Another significant change is reproducible builds, a milestone the project reached in late October. This change is part of a multi-project initiative toward ensuring deterministic compilation: to be able to demonstrate that a certain set of source files and compilation directives is guaranteed to produce identical binaries, as a countermeasure against compromised code. A handy side-effect is that building the whole OS, including installation media images, no longer needs root access. There are of course other new features. Lots of drivers and subsystems have been updated, and this release has better power management, including suspend and resume. There's improved wireless networking, with support for more Wi-Fi chipsets and faster wireless standards, plus updated graphics drivers... The release announcement calls out the inclusion of OpenZFS 2.4.0-rc4, OpenSSL 3.5.4, and OpenSSH 10.0 p2, and notes the inclusion of some new quantum-resistant encryption systems... In general, we found FreeBSD 15 easier and less complicated to work with than either of the previous major releases. It should be easier on servers too. The new OCI container support in FreeBSD 14.2, which we wrote about a year ago, is more mature now. FreeBSD has its own version of Podman, and you can run Linux containers on FreeBSD. This means you can use Docker commands and tools, which are familiar to many more developers than FreeBSD's native Jail system. "FreeBSD has its own place in servers and the public cloud, but it's getting easier to run it as a desktop OS as well," the article concludes. "It can run all the main Linux desktops, including GNOME on Wayland." "There's no systemd here, and never will be — and no Flatpak or Snap either, for that matter.' -- source: https://tech.slashdot.org/story/25/12/07/0627214 Cheers, Peter

1 0

How Home Assistant Leads a 'Local-First Rebellion'
by Peter Reutemann 08 Dec '25

08 Dec '25

'It runs locally, a free/open source home automation platform connecting all your devices together, regardless of brand. And GitHub's senior developer calls it "one of the most active, culturally important, and technically demanding open source ecosystems on the planet," with tens of thousands of contributors and millions of installations. That's confirmed by this year's "Octoverse" developer survey... Home Assistant was one of the fastest-growing open source projects by contributors, ranking alongside AI infrastructure giants like vLLM, Ollama, and Transformers. It also appeared in the top projects attracting first-time contributors, sitting beside massive developer platforms such as VS Code... Home Assistant is now running in more than 2 million households, orchestrating everything from thermostats and door locks to motion sensors and lighting. All on users' own hardware, not the cloud. The contributor base behind that growth is just as remarkable: 21,000 contributors in a single year... At its core, Home Assistant's problem is combinatorial explosion. The platform supports "hundreds, thousands of devices... over 3,000 brands," as [maintainer Franck Nijhof] notes. Each one behaves differently, and the only way to normalize them is to build a general-purpose abstraction layer that can survive vendor churn, bad APIs, and inconsistent firmware. Instead of treating devices as isolated objects behind cloud accounts, everything is represented locally as entities with states and events. A garage door is not just a vendor-specific API; it's a structured device that exposes capabilities to the automation engine. A thermostat is not a cloud endpoint; it's a sensor/actuator pair with metadata that can be reasoned about. That consistency is why people can build wildly advanced automations. Frenck describes one particularly inventive example: "Some people install weight sensors into their couches so they actually know if you're sitting down or standing up again. You're watching a movie, you stand up, and it will pause and then turn on the lights a bit brighter so you can actually see when you get your drink. You get back, sit down, the lights dim, and the movie continues." A system that can orchestrate these interactions is fundamentally a distributed event-driven runtime for physical spaces. Home Assistant may look like a dashboard, but under the hood it behaves more like a real-time OS for the home... The local-first architecture means Home Assistant can run on hardware as small as a Raspberry Pi but must handle workloads that commercial systems offload to the cloud: device discovery, event dispatch, state persistence, automation scheduling, voice pipeline inference (if local), real-time sensor reading, integration updates, and security constraints. This architecture forces optimizations few consumer systems attempt. "If any of this were offloaded to a vendor cloud, the system would be easier to build," the article points out. "But Home Assistant's philosophy reverses the paradigm: the home is the data center..." As Nijhof says of other vendor solutions, "It's crazy that we need the internet nowadays to change your thermostat."' -- source: https://news.slashdot.org/story/25/12/07/1955259 Cheers, Peter

1 0

Proposed Patches Make Upstream Linux Kernel Usable For The OpenWrt One Router
by Peter Reutemann 27 Nov '25

27 Nov '25

'Announced nearly one year ago was the OpenWrt One as a router/AP that is "hacker-friendly" and open-source. The OpenWrt One is powered by a Filogic 820 SoC and features WiFi 6. This official OpenWrt device is manufactured by Banana Pi. While there is downstream open-source code available for customizing the OpenWrt One to your heart's content, the upstream Linux kernel support to date hasn't been full-featured. Sjoerd Simons of Collabora today posted a set of 15 patches for making the OpenWrt One AP functional with the upstream Linux kernel. As Sjoerd puts it, to make the OpenWrt One "actually useful as an access point" with the mainline Linux kernel. The patches get PCI Express working as tested with NVMe storage, the wired network interfaces enabled, the WiFi/wireless networking brought up, status LEDs enabled, SPI NOR, and related bits. The patches bring the necessary Device Tree support and extensions to existing drivers to make everything work without any new drivers being required. There are various kernel quirks required too at this point for making the device happy with the mainline Linux kernel. All in just over 500 lines of code for making the OpenWrt One useful with these patches that will be hopefully mainlined to the Linux kernel.' -- source: https://www.phoronix.com/news/OpenWrt-One-Useful-Linux Has anyone experience with this router? Cheers, Peter

1 0

Arduino's New Terms of Service Worries Hobbyists Ahead of Qualcomm Acquisition
by Peter Reutemann 25 Nov '25

25 Nov '25

'Ars Technica: Some members of the maker community are distraught about Arduino's new terms of service (ToS), saying that the added rules put the company's open source DNA at risk. Arduino updated its ToS and privacy policy this month, which is about a month after Qualcomm announced that it's acquiring the open source hardware and software company. Among the most controversial changes is this addition: "User shall not: translate, decompile or reverse-engineer the Platform, or engage in any other activity designed to identify the algorithms and logic of the Platform's operation, unless expressly allowed by Arduino or by applicable license agreements ..." In response to concerns from some members of the maker community, including from open source hardware distributor and manufacturer Adafruit, Arduino posted a blog on Friday. Regarding the new reverse-engineering rule, Arduino's blog said: "Any hardware, software or services (e.g. Arduino IDE, hardware schematics, tooling and libraries) released with Open Source licenses remain available as before. Restrictions on reverse-engineering apply specifically to our Software-as-a-Service cloud applications. Anything that was open, stays open." But Adafruit founder and engineer Limor Fried and Adafruit managing editor Phillip Torrone are not convinced. They told Ars Technica that Arduino's blog leaves many questions unanswered and said that they've sent these questions to Arduino without response. "Why is reverse-engineering prohibited at all for a company built on openly hackable systems?" Fried and Torrone asked in a shared statement. There are also concerns about the ToS' broad new AI-monitoring powers, which offer little clarity on what data is collected, who can access it, or how long it's retained. On top of that, the update introduces an unusual patent clause that bars users from using the platform to identify potential infringement by Arduino or its partners, along with sweeping, perpetual rights over user-generated content. This could allow Arduino, and potentially Qualcomm, to republish, modify, monetize, or redistribute user uploads indefinitely.' -- source: https://hardware.slashdot.org/story/25/11/24/2144256 Cheers, Peter

1 0

The DoorDash Problem: Amazon Sues Perplexity
by Lawrence D'Oliveiro 22 Nov '25

22 Nov '25

A lot of companies are making a comfortable living by selling goods or services online: Amazon, DoorDash, Uber etc. A key part of the business model is that the visitors to their site are actual humans, who can be shown ads, or otherwise persuaded to upsell to some enticing extra product (“Would you like chips with that?”) and thereby disgorge a little bit of extra revenue. This is part of what’s called “building a relationship with the customer”. Which is a nice way of saying “owning the customer”. But what if the visitors to your site are AI bots, looking for deals on behalf of a human that ends up one step removed from contact with you? Then all those ads and extra persuasive messages fall on the worst kind of deaf ears -- no ears at all. The human says to the AI agent “get me a ride to the airport”, the agent goes away to the Uber and Lyft sites (or whatever else turns up), and picks the cheapest option at that moment. The human doesn’t know which company is providing the ride that turns up on their doorstep, and they won’t care. The providers of these products have become mere commodity suppliers. This thought does scare some of these online retailers. And now Amazon, just about the biggest such e-tailer out there, is suing Perplexity, a provider of just such an AI agent service. Amazon says that this is about maintaining a “positive customer experience”; but surely the form of the “customer experience” is something for the customer to choose. Amazon also says that access by AI bots is against the terms of service for its site, and that is clearly the core of its legal claim. But will such a claim hold up in court? How far can companies go in dictating exactly what form users’ accesses to their site can take? <https://www.theverge.com/podcast/823909/the-doordash-problem-ai-agents-web-…>

1 0

The EU made Apple adopt new Wi-Fi standards, and now Android can support AirDrop
by Lawrence D'Oliveiro 21 Nov '25

21 Nov '25

People in the US like to make fun of the seemingly endless bureaucratic hurdles that the EU Governments keep putting in the way of US companies looking to make a quick buck. You know, having to worry about boring things like “privacy” and “interoperability” and “security”, that kind of thing. Oh, and maintaining free-market competition -- imagine lecturing the USA about how to achieve that! But every now and then, this endless stream of new regulations hits the jackpot. Like how Google is suddenly able to offer full two-way compatibility with Apple’s formerly-proprietary “AirDrop” feature for exchanging files between mobile devices -- the file exchange is done directly, peer-to-peer, without going through any central servers. It’s all down to the fact that the EU forced Apple to move away from the completely proprietary low-level radio protocol it was originally using for AirDrop, towards something that was more amenable to exactly the sort of reverse-engineering of the higher-level protocol that Google did. Of course Apple did also contribute work towards the new standard, just as it did with USB Type-C; it’s better to be seen to be cooperating with inevitability, rather than futilely trying to fight it tooth and nail. <https://arstechnica.com/gadgets/2025/11/the-eu-made-apple-adopt-new-wi-fi-s…>

1 0

HP And Dell Disable HEVC (H.265) Support Built Into Their Laptops’ CPUs
by Lawrence D'Oliveiro 21 Nov '25

21 Nov '25

Some owners of HP and Dell laptops are finding that their machines can no longer playback HEVC/H.265-encoded video content, even though this capability is supposed to be built into their hardware <https://arstechnica.com/gadgets/2025/11/hp-and-dell-disable-hevc-support-bu…>. Why is this happening? The obvious answer: patent issues. The royalty rates these companies have to pay to offer this functionality is going up quite substantially from next year, and they have to cut costs. So the users will have to pay extra money to get this capability back. Synology also used to offer the capability to transcode videos to H.265 on some of its products, but discontinued that as of last year. This is why AV1 was created by Google and other companies: to offer a patent-free alternative to H.265. But in spite of all the patent issues that were clear from the beginning, lots of companies went ahead with H.265-based products regardless. Maybe now we will see the popularity of AV1 increase?

1 0

The Origin Of The Smiley
by Lawrence D'Oliveiro 21 Nov '25

21 Nov '25

Here’s a report <https://arstechnica.com/gadgets/2025/11/in-1982-a-physics-joke-gone-wrong-s…> on the precise origins of the use of the character sequences “:-)” and “:-(”, not quite to denote happiness/unhappiness as they are commonly used today, but to distinguish jokes from serious postings. The discussion happened back in September 1982, on a bulletin-board system running on a DECsystem-20 at Carnegie-Mellon University. It came about as a result of a joke posting being taken way too seriously (of course ...). To add to the interest, there is more than personal testimony to back up the record: original backup tapes of bboard postings from that time were dug up, and the actual transcript of those discussions was extracted, and are now available online <https://www.cs.cmu.edu/~sef/Orig-Smiley.htm>.

1 0

Taming The Data Destroyer
by Lawrence D'Oliveiro 17 Nov '25

17 Nov '25

I use the “dd” command fairly frequently, to put new versions of SystemRescue on the USB stick I dedicate to that purpose, for example. The command has been nicknamed the “data destroyer”, because while doing sector-level copies as root, it can be all too easy to write to the wrong device, and destroy an important filesystem. The “lsblk” command can be handy for confirming which block device you should be writing to, before pressing Enter on that fateful command. There’s lots of information it can display, to help you identify the right device. For example, a command like lsblk -o NAME,SIZE,SERIAL,WWN,VENDOR,MODEL shows a little tree display of devices and partitions in the first column, followed by a lot of info you can use to identify what is currently plugged in. I tried a couple of USB sticks, and they showed amazingly long strings for their serial numbers. My SystemRescue stick shows the vendor as “TOSHIBA” and the model as “TransMemory”. Interestingly, both Western Digital and Seagate drives show the vendor as “ATA”, though the model name begins with “WDC” for the one and “ST” for the other. The SSD boot drives in both my main workstation and laptop display blank for the vendor, but again the model field shows some vendor-specific information.

1 0

Glitch Tokens
by Lawrence D'Oliveiro 16 Nov '25

16 Nov '25

Added something more to my modest store of AI knowledge with this little item about “glitch tokens” -- inputs that make AI language models respond in bizarre and inexplicable ways <https://www.youtube.com/watch?v=WO2X3oZEJOA>. Some people assumed this behaviour was just a random consequence of the whole neural-network concept. Others probed a bit deeper, and discovered some actually explicable, if surprising, causes of particular glitches. What else is lurking in there ... ?

1 0

Why Windows sucks and how to fix it, according to a former Microsoft engineer
by Lawrence D'Oliveiro 14 Nov '25

14 Nov '25

Former Microsoft engineer (and retrocomputing enthusiast) Dave Plummer has done a video on what he thinks is wrong with Microsoft Windows <https://www.zdnet.com/article/why-windows-sucks-and-how-to-fix-it-according…>. According to him, Windows should have a “Pro” mode, which turns off a lot of the handholding. Secondly, users need to be given more control over the telemetry data that Microsoft collects about their activities. And thirdly, Microsoft should restore the option to run a Windows installation without having to register a Microsoft account. Generally, Microsoft should avoid “dark patterns” -- trying to inveigle its users into accessing the company’s online services, whether they wanted to or not. And turn down the volume a bit on all this “agentic OS” malarkey. All I have to say is: “HAHAHAHAHAHAHAHAHA!!!”. Plummer may be an engineer, but he’s not a businessman. Perhaps he hasn’t noticed that Windows isn’t bringing in as much profit for the company as it used to. So all these changes are attempts to boost revenue -- necessary, in the company’s eyes. Because how else do you keep such an expensive-to-develop, expensive-to-maintain OS afloat? Does Microsoft think it can get away with such behaviour, in spite of the chorus of complaints? Of course it does. And the article admits as such: So does Windows really suck? Yeah, it does, at least in certain ways. Of course, I'm still using it after all these years. Maybe it's become like an old, worn shoe that still feels comfortable despite all the problems. Phrases like “boiling the frog” come to mind ...

2 2

New Project Brings Strong Linux Compatibility To More Classic Windows Games
by Peter Reutemann 14 Nov '25

14 Nov '25

'Ars Technica reports: For years now, Valve has been slowly improving the capabilities of the Proton compatibility layer that lets thousands of Windows games work seamlessly on the Linux-based SteamOS. But Valve's Windows-to-Linux compatibility layer generally only extends back to games written for Direct3D 8, the proprietary Windows graphics API Microsoft released in late 2000. Now, a new open source project is seeking to extend Linux interoperability further back into PC gaming history. The d7vk project describes itself as "a Vulkan-based translation layer for Direct3D 7 [D3D7], which allows running 3D applications on Linux using Wine." The new project isn't the first attempt to get Direct3D 7 games running on Linux. Wine's own built-in WineD3D compatibility layer has supported D3D7 in some form or another for at least two decades now. But the new d7vk project instead branches off the existing dxvk compatibility layer, which is already used by Valve's Proton for SteamOS and which reportedly offers better performance than WineD3D on many games. D7vk project author WinterSnowfall writes that while they don't expect this new project to be upstreamed into the main dxvk in the future, the new version should have "the same level of per application/targeted configuration profiles and fixes that you're used to seeing in dxvk proper." And though d7vk might not perform universally better than the existing alternatives, WinterSnowfall writes that "having more options on the table is a good thing in my book at least." The report notes that the PC Gaming Wiki lists more than 400 games built on the aging D3D7 APIs, spanning mostly early-2000s releases but with a trickle of new titles still appearing through 2022. Notable classics include Escape from Monkey Island and Hitman: Codename 47.' -- source: https://linux.slashdot.org/story/25/11/10/2216209 Cheers, Peter

2 1

Business Laptops -- Linux At Both High And Low Ends
by Lawrence D'Oliveiro 13 Nov '25

13 Nov '25

Interesting to read this buyer’s guide to business laptops <https://www.computerworld.com/article/1553700/buyers-guide-to-business-lapt…>. Chromebooks have long been popular for school use, but are also finding a place in certain business needs as well. But look at the highest end -- the “mobile workstations”, the most expensive machines: When it comes to mobile workstations, all the careful calculations for size, weight, and battery life are replaced with a singular focus on performance, particularly for graphics. This laptop class insists on all-out performance for anything from Computer Aided Design and Manufacturing (CAD/CAM) to graphics design to AI model training. Not your noddy Word/Excel jockeys, then. Furthermore: MacOS and Windows 11 dominate here, but there’s another alternative: some models, like Lenovo’s ThinkPad P16 Gen 2, offer Fedora or Ubuntu Linux as an option. Also note that of all the laptop categories, this one has most resisted the move to Windows 11, largely because some specialty software and drivers don’t support the new OS. The Eurocom Panther 5, for instance, is configurable with Windows 10, Windows Server 2016, or even older versions of Windows. Windows 10, or even older?? Really?? I wonder how the purveyors of that “specialty software” (no doubt proprietary) can offer quality support for their product on an obsolete, buggy OS whose owner washed their hands of it years ago. The Linux option, though: if they’re smart and paying attention to users making choices like the one offered by Lenovo, they’ll move their software to running under that, and put an end to those long-standing Windows-endemic software headaches.

1 0

The Linux Kernel Looks To "Bite The Bullet" In Enabling Microsoft C Extensions
by Peter Reutemann 13 Nov '25

13 Nov '25

'Two patches queued into the Linux kernel's build system development tree, kbuild-next, would enable the -fms-extensions compiler argument everywhere for allowing GCC and LLVM/Clang to use the Microsoft C Extensions when compiling the Linux kernel. Being in kbuild-next these patches will likely be submitted for the Linux 6.19 kernel merge window next month but remains to be seen if there will be any last minute objections to this change. The -fms-extensions compiler option honored by the GNU Compiler Collection and LLVM/Clang allow enabling some non-standard C/C++ constructs used within Microsoft header files and honored by the the Microsoft Visual C/C++ compiler. For Linux kernel development purposes, enabling the Microsoft C Extensions would allow including a tagged struct or union anonymously in another struct/union. Going back many years there have been patches floated to unconditionally enable -fms-extensions for the Linux kernel but they haven't made it past the Linux kernel mailing list. But now with these two patches being in kbuild-next mean that it will likely be submitted for the Linux 6.19 kernel merge window barring any objections from prominent Linux kernel developers or Linus Torvalds himself.' -- article: https://www.phoronix.com/news/Linux-6.19-Patch-Would-MS-Ext -- source: https://mastodon.social/@nixCraft/115523510778052589 Cheers, Peter

1 0

Bumble Berry Pi
by Peter Reutemann 12 Nov '25

12 Nov '25

'Are you looking for a cheap and easy to build Raspberry Pi handheld? Check out the Bumble Berry Pi project which focuses on affordability and simplicity, letting you quickly create a portable cyberdeck perfect for terminal work, scripting, coding, or gaming on the go. Ha! You can have 37 Watt-hour battery that that lasts all day long with with Raspberry Pi 3b+.' -- github: https://github.com/samcervantes/bumble-berry-pi -- source: https://mastodon.social/@nixCraft/115524921845809880 This looks seriously cool! :-) Cheers, Peter

1 0

Firefox 145 Drops Support For 32-bit Linux
by Peter Reutemann 12 Nov '25

12 Nov '25

'Mozilla has released Firefox 145.0, and the standout change in this version is the official end of support for 32-bit Linux systems. Users on 32-bit distributions will no longer receive updates and are being encouraged to switch to the 64-bit build to continue getting security patches and new features. While most major Linux distributions have already moved past 32-bit support, this shift will still impact older hardware users and lightweight community projects that have held on to 32-bit for the sake of performance or preservation. The rest of the update introduces features such as built-in PDF comments, improved fingerprinting resistance for private browsing, tab group previews, password management in the sidebar, and minor UI refinements. Firefox also now compresses local translation models with Zstandard to reduce storage needs. But the end of 32-bit Linux support is the change that will leave the biggest mark, signaling another step toward a web ecosystem firmly centered on 64-bit computing.' -- source: https://news.slashdot.org/story/25/11/11/1757229 Cheers, Peter

1 0

FFmpeg To Google: Fund Us or Stop Sending Bugs
by Peter Reutemann 12 Nov '25

12 Nov '25

'FFmpeg, the open source multimedia framework that powers video processing in Google Chrome, Firefox, YouTube and other major platforms, has called on Google to either fund the project or stop burdening its volunteer maintainers with security vulnerabilities found by the company's AI tools. The maintainers patched a bug that Google's AI agent discovered in code for decoding a 1995 video game but described the finding as "CVE slop." The confrontation centered on a Google Project Zero policy announced in July that publicly discloses reported vulnerabilities within a week and starts a ninety-day countdown to full disclosure regardless of patch availability. FFmpeg, written primarily in assembly language, handles format conversion and streaming for VLC, Kodi and Plex but operates without adequate funding from the corporations that depend on it. Nick Wellnhofer resigned as maintainer of libxml2, a library used in all major web browsers, because of the unsustainable workload of addressing security reports without compensation and said he would stop maintaining the project in December.' -- source: https://news.slashdot.org/story/25/11/11/1947215 Cheers, Peter

1 0

Is AI Becoming A Linux-Only Thing?
by Lawrence D'Oliveiro 11 Nov '25

11 Nov '25

I wondered why it was necessary to give Windows users “an environment that can easily deploy AI apps made specifically for Linux on Windows machines without dealing with a complicated setup process”, according to <https://www.tomshardware.com/tech-industry/artificial-intelligence/asrocks-…>. Are there that many Linux-specific AI apps? It appears there are: Making matters worse, most "cutting-edge" AI applications are typically optimized for Linux, making it even harder for Windows users to get these apps up and running in Windows (if at all). You’d think most AI apps would concentrate on the Windows market, or at least support Windows and Linux equally. But perhaps not: The original version of AI Quickset was only capable of configuring AI applications that were designed with either Windows or Linux in mind. AI Quickset WSL expands upon this and again allows users the freedom to run Linux-based AI apps on Windows, which is a huge deal if you dabble in AI models that are mostly [relegated] to the Linux space.

1 1

Rust Is Coming To Debian's APT Package Manager
by Peter Reutemann 10 Nov '25

10 Nov '25

'A maintainer of Debian's Advanced Package Tool (APT) "has announced plans to introduce hard Rust dependencies into APT starting May 2026," reports the blog It's FOSS. The integration targets critical areas like parsing .deb, .ar, and tar files plus HTTP signature verification using Sequoia. [APT maintainer Julian Andres Klode] said these components "would strongly benefit from memory safe languages and a stronger approach to unit testing." He also gave a firm message to maintainers of Debian ports: "If you maintain a port without a working Rust toolchain, please ensure it has one within the next 6 months, or sunset the port." The reasoning is straightforward. Debian wants to move forward with modern tools rather than being held back by legacy architecture... Debian ports running on CPU architectures without Rust compiler support have six months to add proper toolchains. If they can't meet this deadline, those ports will need to be discontinued. As a result, some obscure or legacy platforms may lose official support. For most users on mainstream architectures like x86_64 and ARM, nothing changes. Your APT will simply become more secure and reliable under the hood. It's FOSS argues that "If done right, this could significantly strengthen APT's security and code quality." And the blog Linuxiac also supports the move. "By embedding Rust into APT, the distro joins a growing number of major open-source projects, such as the Linux kernel, Firefox, and systemd, that are gradually adopting Rust. And if I had to guess, I'd say this is just one of the first steps toward even deeper Rust integration in this legendary distribution, which is a good thing."' -- source: https://linux.slashdot.org/story/25/11/09/0232234 Cheers, Peter

1 0

Lost Unix v4 Possibly Recovered on a Forgotten Bell Labs Tape From 1973
by Peter Reutemann 10 Nov '25

10 Nov '25

'"A tape-based piece of unique Unix history may have been lying quietly in storage at the University of Utah for 50+ years," reports The Register. And the software librarian at Silicon Valley's Computer History Museum, Al Kossow of Bitsavers, believes the tape "has a pretty good chance of being recoverable." Long-time Slashdot reader bobdevine says the tape will be analyzed at the Computer History Museum. More from The Register: The news was posted to Mastodon by Professor Robert Ricci of the University of Utah's Kahlert School of Computing [along with a picture. "While cleaning a storage room, our staff found this tape containing #UNIX v4 from Bell Labs, circa 1973..." Ricci posted on Mastodon. "We have arranged to deliver it to the Computer History Museum."] The nine-track tape reel bears a handwritten label reading: UNIX Original From Bell Labs V4 (See Manual for format)... If it's what it says on the label, this is a notable discovery because little of UNIX V4 remains. That's unfortunate as this specific version is especially interesting: it's the first version of UNIX in which the kernel and some of the core utilities were rewritten in the new C programming language. Until now, the only surviving parts known were the source code to a slightly older version of the kernel and a few man pages — plus the Programmer's Manual [PDF], from November 1973. The Unix Heritage Society hosts those surviving parts — and apparently some other items of interest, according to a comment posted on Mastodon. "While going through the tapes from Dennis Ritchie earlier this year, I found some UNIX V4 distribution documents," posted Mastodon user "Broken Pipe," linking to tuhs.org/Archive/Applications/Dennis_Tapes/Gao_Analysis/v4_dist/. There's a file called license ("The program and information transmitted herewith is and shall remain the property of Bell Lab%oratories...") and coldboot ("Mount good tape on drive 0..."), plus a six-page "Setup" document that ends with these words... We expect to have a UNIX seminar early in 1974. Good luck. Ken Thompson Dennis Ritchie Bell Telephone Labs Murray Hill, NJ 07974' -- source: https://tech.slashdot.org/story/25/11/09/0528258 Cheers, Peter

1 0

Microsoft 365 Billing Screwup Refund Is Another Screwup
by Lawrence D'Oliveiro 09 Nov '25

09 Nov '25

About a year ago, Microsoft announced price increases for its “365” (not “Office”) product, while adding the Copilot feature. What it failed to mention was that users had the option of continuing on the old plan at the old price, without the Copilot feature -- which a lot of users didn’t want anyway. Some users went to cancel their plan, and at that point they would have been presented with the option to continue on the old plan. The rest would have felt they had no option but to pay the higher price. This is all deceptive behaviour which is against the law in both Australia and NZ, and presumably other civilized countries as well. Microsoft has decided to revert the price increase and offer a refund to users in both countries. Unfortunately, users in NZ don’t seem able to claim this -- the whole mechanism seems set up solely to cater to customers in Australia. Also it seems to only be available for certain plans and not others, and customers may still end up paying more anyway. Meanwhile, Australia’s anticompetition watchdog, the ACCC, is pressing ahead with its lawsuit against Microsoft. The company has also received a warning from NZ’s Commerce Commission. <https://www.nzherald.co.nz/business/microsoft-365-refund-fails-to-head-off-…>

1 1

IBM To Cut Thousands Of Jobs As Red Hat Growth Slows
by Lawrence D'Oliveiro 06 Nov '25

06 Nov '25

There are still some who have difficulty appreciating that the Linux world is much bigger than Red Hat. Here <https://www.computerworld.com/article/4084865/ibm-to-cut-thousands-of-jobs-…> is another reminder. Red Hat may well be the most profitable part of IBM left (which is why its troubles are having such an outsize impact on the company as a whole), but in the whole Open Source scheme of things, it is but one of many players.

1 0

GIMP Officially Launches Its New Snap Package for Linux Users
by Peter Reutemann 06 Nov '25

06 Nov '25

'The GIMP team has officially announced that the popular open-source image editor is now available as a Snap package, expanding its presence across Linux distributions that bet on this package format, especially the Ubuntu family and those based on it. Until now, the GIMP Snap package was maintained by the community-driven Snapcrafters project. Following a careful handover process that took several months, GIMP has taken over official ownership. The highlight of this first official Snap release is the new gimp-plugins plug interface. Previously, the Snap version came bundled with a few third-party plugins, but the GIMP team decided to follow its “vanilla package” policy—meaning no extra code outside of GIMP, GEGL, or BABL. Instead, developers implemented the gimp-plugins interface, which works similarly to GIMP’s Flatpak extension point or Microsoft’s MSIX modification packages. It allows plugin developers to ship their extensions separately, without breaking Snap’s strict confinement model. Currently, two plugins—GMIC and OpenVINO—can be installed through their respective Snap repositories. GIMP has also published a how-to guide on its developer website for anyone who wants to create or package Snap plugins. The first officially supported Snap release is GIMP 3.0.6, co-produced with the Snapcrafters team. It’s now available on the latest/stable channel, while users who prefer to test new features can grab the development version from the preview/stable channel. Just like with GIMP’s Flatpak and Microsoft Store (MSIX) packages, future Snap releases will be deployed automatically on release day. Users can install the official Snap right now from gimp.org/downloads.' -- source: https://linuxiac.com/gimp-officially-launches-its-new-snap-package-for-linu… Cheers, Peter

1 0

Bug in Rust-Based UUtils Broke Ubuntu 25.10 Automatic Update Checks
by Peter Reutemann 03 Nov '25

03 Nov '25

'"Ubuntu's decision to switch to Rust-based coreutils in 25.10 hasn't been the smoothest ride," writes the blog OMG Ubuntu, "as the latest — albeit now resolved — bug underscores." [Coreutils] are used by a number of processes, apps and scripts, including Ubuntu's own unattended-upgrades process, which automatically checks for new software updates. Alas, the Rust-based version of date had a bug which meant Ubuntu 25.10 desktops, servers, cloud and container images were not able to automatically check for updates when configured. Unattended-upgrades hooks into the date utility to check the timestamp of a reference file of when an update check was last run and, past a certain date, checks again. But date was incorrectly showing the current date, always. A fix has been issued so only Ubuntu 25.10 installs withrust-coreutils 0.2.2-0ubuntu2 (or earlier) are affected.' -- source: https://news.slashdot.org/story/25/11/03/0049215 Cheers, Peter

1 0

Industrial and medical devices struggle to upgrade to Windows 11
by Lawrence D'Oliveiro 01 Nov '25

01 Nov '25

The healthcare sector is hitting some hiccups trying to upgrade its equipment to Windows 11 <https://www.computerworld.com/article/4082710/industrial-and-medical-device…>. But then, this has happened with every major upgrade of Windows before this; why are the same mistakes still being made? Surely when you buy an expensive piece of equipment with an expected useful lifetime measurable in decades and a computer at its heart, common sense dictates that you will nail down a support contract that will cover hardware *and* software maintenance over that lifetime, will you not? We have had about half a century of experience of gear like this, since long before Microsoft came along. I wonder what lessons have been learned ...

1 0

LMDE 7 Officially Released with Debian 13 Base
by Peter Reutemann 31 Oct '25

31 Oct '25

'Over two years after the previous 6 “Faye” release, the Linux Mint team has officially unveiled LMDE 7 “Gigi”, a major new LTS release of the Debian-based Mint variant, bringing all the new features, improvements, and polished visuals from the Ubuntu-based 22.2 “Zara” edition, released in early September, over to the LMDE version. The release’s highlight is, of course, that LMDE 7 “Gigi” marks a major turning point: it is now entirely rebased on Debian 13 “Trixie”, which becomes the new upstream base for all packages. Under the hood, it’s powered by the Linux kernel 6.12 LTS, delivering broader hardware support and stability improvements for modern systems. On the desktop side, as I already said, LMDE 7 essentially incorporates all the enhancements introduced in Linux Mint 22.2 “Zara”. Among these is the introduction of Fingwit, a dedicated fingerprint authentication utility that enables biometric login and sudo operations on supported systems.' -- source: https://linuxiac.com/lmde-7-officially-released-with-debian-13-base/ Cheers, Peter

1 0

International Criminal Court To Ditch Microsoft Office For European Open Source Alternative
by Peter Reutemann 31 Oct '25

31 Oct '25

'The International Criminal Court will switch its internal work environment away from Microsoft Office to Open Desk, a European open source alternative, the institution confirmed to Euractiv. The switch comes amid rising concerns about public bodies being reliant on US tech companies to run their services, which have stepped up sharply since the start of US President Donald Trump's second administration. For the ICC, such concerns are not abstract: Trump has repeatedly lashed out at the court and slapped sanctions on its chief prosecutor, Karim Khan. Earlier this year, the AP also reported that Microsoft had cancelled Khan's email account, a claim the company denies. "We value our relationship with the ICC as a customer and are convinced that nothing impedes our ability to continue providing services to the ICC in the future," a Microsoft spokesperson told Euractiv.' -- source: https://news.slashdot.org/story/25/10/30/1847204 Cheers, Peter

1 0

Say it with me: Windows is the problem with Windows handhelds
by Lawrence D'Oliveiro 30 Oct '25

30 Oct '25

Sean Hollister says <https://www.theverge.com/games/807711/xbox-ally-sleep-fail-bazzite-fix-perf…>: It’s been nearly two weeks since Microsoft, a multi-trillion dollar company, shipped a $600 handheld “Xbox” that can’t be relied on to sleep, wake, or hold a charge while asleep in my tests. Neither Microsoft nor Asus would admit there’s a problem with the white Xbox Ally or offer a timeline to fix it after repeated requests by The Verge. But if you want your white Asus handheld to start working reliably, you could do what I did: I installed the latest build of Bazzite, a SteamOS-like, Linux-based operating system that works properly with gamepad controls, and sleeps like a dream. ... Did I mention Bazzite runs most of my Windows games *substantially faster* than Windows? Rub it in even more, why don’t you: It’s not just games that feel faster: Steam is a far more responsive interface without the bloat of Windows lurking under the hood. It feels like an entirely different handheld. With Bazzite, I can use it like I use a Nintendo Switch, simply pressing the power button whenever I want to pause a game, then picking up exactly where I left off hours or days later. Microsoft’s response: Microsoft declined our request for an interview about the future of the Xbox Ally or a timeline on fixes, but VP of Windows product management Anshul Rawat provided this statement to The Verge: ... We’ve identified a small set of issues and initial fixes will be rolling out soon. Optimizing Windows, the most flexible OS in the world, for a range of devices and screen sizes across PCs and the cloud is an ongoing journey. Really?? Windows is “the most flexible OS in the world”, getting its lunch eaten by Linux not just in mobile, but in practically every computing sphere?

2 1

Blender 5.0 Introducing HDR Support On Linux With Vulkan + Wayland
by Peter Reutemann 29 Oct '25

29 Oct '25

'Michael Larabel writes via Phoronix: The upcoming Blender 5.0 3D modeling software application is introducing High Dynamic Range (HDR) display support on Linux when making use of Wayland -- no X11 support for HDR -- and Vulkan graphics accelerator. HDR support for Blender 5.0 on Linux is currently considered experimental. Enabling the HDR support on Linux for the Blender creator software requires having a High Dynamic Range display (of course) and be running on a Wayland desktop, enabling Vulkan API acceleration rather than OpenGL, and enabling the feature currently deemed experimental. ' -- source: https://linux.slashdot.org/story/25/06/26/2035245 Cheers, Peter

2 2

toolong
by Peter Reutemann 29 Oct '25

29 Oct '25

Just came across the "toolong" tool: 'A terminal application to view, tail, merge, and search log files (plus JSONL).' -- github: https://github.com/Textualize/toolong -- source: https://mastodon.social/@nixCraft/115455395475544673 Cheers, Peter

2 1

Nearly 90% of Windows Games Now Run on Linux, Latest Data Shows
by Peter Reutemann 29 Oct '25

29 Oct '25

'Nearly nine in ten Windows games can now run on Linux systems, according to data from ProtonDB compiled by Boiling Steam. The gains came through work by developers of WINE and Proton translation layers and through interest in hardware like the Steam Deck. ProtonDB tracks games across five categories. Platinum-rated games run perfectly without adjustment. Gold titles need minor tweaks. Silver games are playable but imperfect. Bronze exists between silver and borked. Borked games refuse to launch. The proportion of new releases earning platinum ratings has grown. The red and dark red zones have thinned. Some popular titles remain incompatible, however. Boiling Steam noted that other developers appear averse to non-Windows gamers.' -- source: https://linux.slashdot.org/story/25/10/28/206219 Cheers, Peter

2 1

Games Run Faster On SteamOS Than Windows 11, Ars Testing Finds
by Peter Reutemann 16 Oct '25

16 Oct '25

'A report from Ars Technica: Nearly a decade ago, Ars testing found that Valve's "Steam Machines"-era version of SteamOS performed significantly worse than Windows when SteamOS's Linux game ports were tested on the same hardware as their Windows counterparts. Today, though, Ars testing on the Lenovo Legion Go S finds recent games generally run at higher frame rates on SteamOS 3.7 than on Windows 11. [...] As you can see in the included charts, SteamOS showed noticeable frame rate improvements in four of the five games tested. Only Borderlands 3 showed comparable performance across both operating systems, with Windows eking out ever-so-slightly higher frame rates in that game's benchmarks. For the other four tested games, the stock Lenovo Windows drivers were sometimes significantly worse than those included with SteamOS. When playing Returnal at "High" graphics presets and 1920x1200 resolution, for instance, changing from Lenovo's Windows drivers to SteamOS meant the difference between a hard-to-take 18 FPS average and a downright decent 33 FPS average. Sideloading the updated Asus drivers showed a noticeable improvement in Windows performance across all tested games and even brought Homeworld 3's "Low" graphics benchmark test to practical parity with SteamOS. In all other cases, though, even these updated drivers resulted in benchmark frame rates anywhere from 8 percent to 36 percent lower than those same benchmarks on SteamOS. These results might seem a bit counterintuitive, considering that games running on SteamOS must go through a Proton translation layer for every native Windows instruction in a game's code. But Valve has put in consistent work over the years to make Proton as efficient and cross-compatible as possible; not to mention its continued work on Linux's Mesa graphics drivers seems to be paying dividends for SteamOS graphics performance. Running SteamOS also means eliminating a lot of operating system overhead that the more generalist Windows uses by default. Microsoft seems aware of this issue for gamers and has recently announced that the upcoming "Xbox Experience for Handheld" will "minimize background activity and defer non-essential tasks" to allow for "more [and] higher framerates" in games.' -- source: https://games.slashdot.org/story/25/06/25/2034243 Cheers, Peter

2 2

Nosey Parker: Open-source tool finds sensitive information in textual data and Git history
by Peter Reutemann 16 Oct '25

16 Oct '25

This sounds like a useful tool: 'Nosey Parker is an open-source command-line tool that helps find secrets and sensitive information hidden in text files. It works like a specialized version of grep, focused on spotting things like passwords, API keys, and other confidential data. The tool was built with offensive security in mind, such as helping red teams move through systems during tests. It’s also useful for defensive teams checking their own systems. Offensive cybersecurity company Praetorian has used it in hundreds of security engagements to uncover hidden secrets. Key features: - Flexible scanning: Works on files, folders, GitHub repositories, and Git history. It also supports custom input sources. - Proven detection rules: Uses 188 tested regular expression rules, built from feedback by security engineers, to cut down on false positives. - Less noise: Groups duplicate matches of the same secret, making reviews 10 to 1,000 times faster. - High performance: Can scan gigabytes per second on multicore machines and handle datasets as large as 20TB.' -- source: https://www.helpnetsecurity.com/2025/09/24/nosey-parker-open-source-tool/ -- github: https://github.com/praetorian-inc/noseyparker Cheers, Peter

1 0

Secure Boot Bypass Risk Threatens Nearly 200,000 Linux Framework Laptops
by Peter Reutemann 16 Oct '25

16 Oct '25

'Roughly 200,000 Linux-based Framework laptops shipped with a signed UEFI shell command (mm) that can be abused to bypass Secure Boot protections -- allowing attackers to load persistent bootkits like BlackLotus or HybridPetya. Framework has begun patching affected models, though some fixes and DBX updates are still pending. BleepingComputer reports: According to firmware security company Eclypsium, the problem stems from including a 'memory modify' (mm) command in legitimately signed UEFI shells that Framework shipped with its systems. The command provides direct read/write access to system memory and is intended for low-level diagnostics and firmware debugging. However, it can also be leveraged to break the Secure Boot trust chain by targeting the gSecurity2 variable, a critical component in the process of verifying the signatures of UEFI modules. The mm command can be abused to overwrite gSecurity2 with NULL, effectively disabling signature verification. "This command writes zeros to the memory location containing the security handler pointer, effectively disabling signature verification for all subsequent module loads." The researchers also note that the attack can be automated via startup scripts to persist across reboots.' -- source: https://it.slashdot.org/story/25/10/14/2123205 Cheers, Peter

1 0

FSF Announces the LibrePhone Project
by Peter Reutemann 16 Oct '25

16 Oct '25

'The Free Software Foundation (FSF) has launched the LibrePhone Project, an initiative to create a fully free and open-source mobile operating system that eliminates proprietary firmware and binary blobs. From the FSF: "Librephone is a new initiative by the FSF with the goal of bringing full freedom to the mobile computing environment. The vast majority of software users around the world use a mobile phone as their primary computing device. After forty years of advocacy for computing freedom, the FSF will now work to bring the right to study, change, share, and modify the programs users depend on in their daily lives to mobile phones. ... Practically, Librephone aims to close the last gaps between existing distributions of the Android operating system and software freedom. The FSF has hired experienced developer Rob Savoye (DejaGNU, Gnash, OpenStreetMap, and more) to lead the technical project. He is currently investigating the state of device firmware and binary blobs in other mobile phone freedom projects, prioritizing the free software work done by the not entirely free software mobile phone operating system LineageOS." ' -- source: https://news.slashdot.org/story/25/10/15/0312206 -- project: https://librephone.fsf.org/ Cheers, Peter

1 0

Flatpak Doesn't Work in Ubuntu 25.10, But a Fix is Coming
by Peter Reutemann 14 Oct '25

14 Oct '25

'"It's not just you: Flatpak flat-out doesn't work in the new Ubuntu 25.10 release," writes the blog OMG Ubuntu: While Flatpak itself can be installed using apt, trying to install Flatpaks with Flatpak from the command-line throws a "could not unmount revokefs-fuse filesystem" error, followed by "Child process exited with code 1". For those who've installed the Ubuntu 'Questing Quokka' and wanted to kit it out with their favourite software from Flathub, it's a frustrating road bump. AppArmor, the tool that enforces Ubuntu's security policies for apps, is causing the issue. According to the bug report on Launchpad, the AppArmor profile for fusermount3 lacks the privileges it needs to work properly in Ubuntu 25.10. Fusermount3 is a tool Flatpak relies on to mount and unmount filesystems... This is a bug and it is being worked on. Although there's no timeframe for a fix, it is marked as critical, so will be prioritised. The bug was reported in early September, but not fixed in time for this week's Ubuntu 25.10 release, reports Phoronix: Only [Friday] an updated AppArmor was pushed to the "questing-proposed" archive for testing. Since then... a number of users have reported that the updated AppArmor from the proposed archive will fix the Flatpak issues being observed. From all the reports so far it looks like that proposed update is in good shape for restoring Flatpak support on Ubuntu 25.10. The Ubuntu team is considering pushing out this update sooner than the typical seven day testing period given the severity of the issue. More details from WebProNews: Industry insiders point out that AppArmor, Ubuntu's mandatory access control system, was tightened in this release to enhance security... This isn't the first time AppArmor has caused friction; similar issues plagued Telegram Flatpak apps in Ubuntu 24.04 LTS earlier this year, as noted in coverage from OMG Ubuntu.' -- source: https://news.slashdot.org/story/25/10/13/067256 Cheers, Peter

1 0

Ubuntu 25.10 'Questing Quokka' Released
by Peter Reutemann 10 Oct '25

10 Oct '25

'9to5Linux reports: Dubbed Questing Quokka, Ubuntu 25.10 is powered by the latest and greatest Linux 6.17 kernel series for top-notch hardware support and ships with the latest GNOME 49 desktop environment, defaulting to a Wayland-only session for the Ubuntu Desktop flavor, meaning there's no other session to choose from the login screen. Ubuntu Desktop also ships with two new apps, namely GNOME's Loupe instead of Eye of GNOME as the default image viewer, as well as Ptyxis instead of GNOME Terminal as the default terminal emulator. Also, there's a new update notification that will be shown with options to open Software Updater or install updates directly.' Other highlights of Ubuntu 25.10 include sudo-rs as the default implementation of sudo, Dracut as the default initramfs-tools, Chrony as the default NTP (Network Time Protocol) client, Rust Coreutils as the default implementation of GNU Core Utilities, and TPM-backed FDE (Full Disk Encryption) recovery key management. Moreover, Ubuntu 25.10 adds NVIDIA Dynamic Boost support and enables suspend-resume support in the proprietary NVIDIA graphics driver to prevent corruption and freezes when waking an NVIDIA desktop. For Intel users, Ubuntu 25.10 introduces support for new Intel integrated and discrete GPUs.' -- source: https://news.slashdot.org/story/25/10/09/2054218 Cheers, Peter

1 0

VLC’s First Update in a Year to Introduce Qt6 and Windows ARM64 Support
by Peter Reutemann 09 Oct '25

09 Oct '25

'After a year of silence, one of the most popular media players, VLC, is back with a new release candidate, version 3.0.22 RC1 (Vetinari). Although much of the attention is on version 4.0, long in development and expected to deliver major changes, this release also includes a notable update. One of the most important features is support for building VLC with Qt6, which is (as you can guess) a big win for all KDE enthusiasts. On top of that, the release candidate introduces native Windows ARM64 support, reflecting the growing interest in ARM hardware on laptops and tablets. The update also packs a wide set of fixes and adjustments. The developers disabled the older liba52, libmpeg2, and libdca libraries by default, encouraging use of libavcodec instead. On the playback side, users can expect improvements for AV1, Opus, ProRes, FLAC, and JPEG handling, plus more reliable behavior when seeking over SFTP and refinements in Matroska and DVD caption support. Regarding security, VLC 3.0.22 RC1 addresses a record number of issues, many of them caught through the oss-fuzz project and funding from the SecureTrust Fund. That makes this update one of the most important in recent years from a stability and safety standpoint. Lastly, Windows users will notice that the player now allows renaming, moving, or deleting the currently playing file, and there’s even a renewed compatibility with Windows XP SP3 (yes, there are still enthusiasts betting on it), which is still in use in some very specific setups.' -- source: https://linuxiac.com/vlcs-first-update-in-a-year-to-introduce-qt6-and-windo… Cheers, Peter

1 0

Tails 7.0 Anonymous Linux OS Officially Released, Based on Debian 13 “Trixie”
by Peter Reutemann 07 Oct '25

07 Oct '25

'Tails 7.0 is out today as a major update to this portable Linux OS based on the Debian GNU/Linux operating system that protects users against surveillance and censorship. Highlights of Tails 7.0 include a Debian 13 “Trixie” base and a kernel from the long-term supported Linux 6.12 LTS series from the upstream Debian release, the latest GNOME 48 desktop environment by default featuring GNOME Console as default terminal emulator and GNOME Loupe as default image viewer. The Tails devs note the fact that the Root Terminal was broken when replacing GNOME Terminal with GNOME Console, so they renamed Root Terminal to Root Console. They also removed the Kleopatra app from the Favorites menu, so now users will have to start Kleopatra from Apps > Accessories. Moreover, they removed the obsolete Network Connection option from the Welcome Screen, the Places menu, and some packages from the live ISO image, including unar, aircrack-ng, and sq. Tails 7.0 ships with many updated components, including Tor 0.4.8.17, Tor Browser 14.5.7, Mozilla Thunderbird 128.14 ESR, OnionShare 2.6.3, Kleopatra 24.12, KeePassXC 2.7.10, GIMP 3.0.4, Inkscape 1.4, Audacity 3.7.3, and Electrum 4.5.8. For Inkscape, Tails now skips the onboarding. This release also fixes various issues, including an issue with selecting the correct keyboard for certain languages. Check out the release notes for more details about the changes included in Tails 7.0, which is available for download right now from the official website as ISO and USB images for 64-bit systems.' -- source: https://9to5linux.com/tails-7-0-anonymous-linux-os-released-based-on-debian… Cheers, Peter

1 0

Redis Warns of Critical Flaw Impacting Thousands of Instances
by Peter Reutemann 07 Oct '25

07 Oct '25

'BleepingComputer reports: The Redis security team has released patches for a maximum severity vulnerability that could allow attackers to gain remote code execution on thousands of vulnerable instances. Redis (short for Remote Dictionary Server) is an open-source data structure store used in approximately 75% of cloud environments, functioning like a database, cache, and message broker, and storing data in RAM for ultra-fast access. The security flaw (tracked as CVE-2025-49844) is caused by a 13-year-old use-after-free weakness found in the Redis source code and can be exploited by authenticated threat actors using a specially crafted Lua script (a feature enabled by default). Successful exploitation enables them to escape the Lua sandbox, trigger a use-after-free, establish a reverse shell for persistent access, and achieve remote code execution on the targeted Redis hosts. After compromising a Redis host, attackers can steal credentials, deploy malware or cryptocurrency mining tools, extract sensitive data from Redis, move laterally to other systems within the victim's network, or use stolen information to gain access to other cloud services. "This grants an attacker full access to the host system, enabling them to exfiltrate, wipe, or encrypt sensitive data, hijack resources, and facilitate lateral movement within cloud environments," said Wiz researchers, who reported the security issue at Pwn2Own Berlin in May 2025 and dubbed it RediShell. While successful exploitation requires attackers first to gain authenticated access to a Redis instance, Wiz found around 330,000 Redis instances exposed online, with at least 60,000 of them not requiring authentication. Redis and Wiz urged admins to patch their instances immediately by applying security updates released on Friday, "prioritizing those that are exposed to the internet." To further secure their Redis instances against remote attacks, admins can also enable authentication, disable Lua scripting and other unnecessary commands, launch Redis using a non-root user account, enable Redis logging and monitoring, limit access to authorized networks only, and implement network-level access controls using firewalls and Virtual Private Clouds (VPCs).' -- source: https://it.slashdot.org/story/25/10/06/222222 Cheers, Peter

1 0