- wlug - list.wlug.org.nz

You Can Now Run Debian GNU/Linux on the OpenWrt One Open-Source Router
by Peter Reutemann 04 Feb '26

04 Feb '26

'Collabora shares with us today a new project that lets you install and run the Debian GNU/Linux operating system on the open-source OpenWrt One router. Collabora’s Sjoerd Simons has developed openwrt-one-debian, a set of scripts and tools that make it easier for one to install a full Debian GNU/Linux operating system on the OpenWrt One device, leveraging its NVMe storage and giving you the freedom to enable custom services, support for containers, development tools, and more.' -- source: https://9to5linux.com/you-can-now-run-debian-gnu-linux-on-the-openwrt-one-o… Cheers, Peter

1 0

'Vibe Coding Kills Open Source'
by Peter Reutemann 04 Feb '26

04 Feb '26

'Four economists across Central European University, Bielefeld University and the Kiel Institute have built a general equilibrium model of the open-source software ecosystem and concluded that vibe coding -- the increasingly common practice of letting AI agents select, assemble and modify packages on a developer's behalf -- erodes the very funding mechanism that keeps open-source projects alive. The core problem is a decoupling of usage from engagement. Tailwind CSS's npm downloads have climbed steadily, but its creator says documentation traffic is down about 40% since early 2023 and revenue has dropped close to 80%. Stack Overflow activity fell roughly 25% within six months of ChatGPT's launch. Open-source maintainers monetize through documentation visits, bug reports, and community interaction. AI agents skip all of that. The model finds that feedback loops once responsible for open source's explosive growth now run in reverse. Fewer maintainers can justify sharing code, variety shrinks, and average quality falls -- even as total usage rises. One proposed fix is a "Spotify for open source" model where AI platforms redistribute subscription revenue to maintainers based on package usage. Vibe-coded users need to contribute at least 84% of what direct users generate, or roughly 84% of all revenue must come from sources independent of how users access the software.' -- source: https://news.slashdot.org/story/26/02/03/1754205 Cheers, Peter

1 0

Notepad++ Compromised By State Actor
by Peter Reutemann 03 Feb '26

03 Feb '26

'Luthair writes: Notepad++ claims to have been targeted by a state actor, given their previous stance on Uyghurs one can speculate about a candidate. Notepad++, in a blog post: According to the analysis provided by the security experts, the attack involved infrastructure-level compromise that allowed malicious actors to intercept and redirect update traffic destined for notepad-plus-plus.org. The exact technical mechanism remains under investigation, though the compromise occurred at the hosting provider level rather than through vulnerabilities in Notepad++ code itself. Traffic from certain targeted users was selectively redirected to attacker-controlled served malicious update manifests.' -- source: https://it.slashdot.org/story/26/02/02/1646253 Cheers, Peter

1 0

Firefox is adding a switch to turn AI features off
by Peter Reutemann 03 Feb '26

03 Feb '26

'Unlike many of the companies stuffing AI into their browsers, Mozilla will soon give you a way to turn all of these features off. An update coming on February 24th will add a new “AI control” option to Firefox’s settings menu, allowing you to disable or enable the browser’s individual AI features, including access to a built-in AI chatbot, translations, AI tab group suggestions, and more.' -- source: https://www.theverge.com/news/872489/mozilla-firefox-ai-features-off-button Cheers, Peter

1 0

When 20-Year-Old Bill Gates Fought the World's First Software Pirates
by Peter Reutemann 02 Feb '26

02 Feb '26

'Just months after his 20th birthday, Bill Gates had already angered the programmer community," remembers this 50th-anniversary commemoration of Gates' Open Letter to Hobbyists. "As the first home computers began appearing in the 1970s, the world faced a question: Would its software be free?" Gates railed in 1976 that "Most of you steal your software." Gates had coded the BASIC interpreter for Altair's first home computer with Paul Allen and Monte Davidoff — only to see it pirated by Steve Wozniak's friends at the Homebrew Computing Club. Expecting royalties, a none-too-happy Gates issued his letter in the club's newsletter (as well as Altair's own publication), complaining "I would appreciate letters from any one who wants to pay up." But freedom-loving coders had other ideas. When Steve Wozniak and Steve Jobs released their Apple 1 home computer that summer, they stressed that "our philosophy is to provide software for our machines free or at minimal cost..." And early open-source hackers began writing their own free Tiny Basic interpreters to create a free alternative to the Gates/Micro-Soft code. This led to the first occurrence of the phrase "Copyleft" in October of 1976. Open Source definition author Bruce Perens shares his thoughts today. "When I left Pixar in 2000, I stopped in Steve Job's office — which for some reason was right across the hall from mine... " Perens remembered. "I asked Steve: 'You still don't believe in this Linux stuff, do you...?'" And Perens remembers how that movement finally won over Steve Jobs and carried the day. "Three years later, Steve stood onstage in front of a slide that said 'Open Source: We Think It's Great!' as he introduced the Safari browser, which at that time was based on the browser engine developed by the KDE Open Source project!"' -- source: https://news.slashdot.org/story/26/02/01/1915221 Cheers, Peter

1 0

Floppy Disk TV Remote
by Lawrence D'Oliveiro 20 Jan '26

20 Jan '26

Hardware hacker wants to make an alternative remote control for his smart TV that would be more intuitive for his toddler child to use than a conventional interactive remote interface. So what does he do? Build it out of an ancient, 1990s-technology floppy drive. Basic idea is that each floppy disk represents a different stream; user inserts disk into drive, TV starts playing that stream. Initially he thought of faking it, with simulated floppy “disks” with RFID chips on them that the “drive” would detect. Then he figured that the actual tactile experience of putting a real working disk into a real working drive would be far more effective. So he stores a config file on each disk that contains information about the stream to be played (plus associated display artwork), that software can read from the drive. Since there is only a small amount of data to be read off each disk, the drive can work quite nicely off battery power. So it becomes a real remote control as in one that is remote, not connected to the TV by any wire. Albeit one that is not very easy to pick up, but never mind ... <https://www.tomshardware.com/maker-stem/microcontrollers-projects/floppy-di… labeled-floppies-to-watch-his-favorite-shows>

2 1

“7 deprecated Linux commands you need to stop using - and what to use instead”
by Lawrence D'Oliveiro 15 Jan '26

15 Jan '26

Jack Wallen’s list <https://www.zdnet.com/article/linux-commands-deprecated-why-do-not-use/> of commands you shouldn’t be using any more, and what to use instead, is a mixed bag. ifconfig/iwconfig vs ip/iw -- the latter newer ones (part of the Linux “iproute2” suite) offer greater access to all the features of the Linux network stack than the former, older ones, and so are preferable in lots of ways. It is already possible to find setups which don’t have the old commands installed by default; I’m not sure if any distros have actually dropped the option for installing them altogether, but no doubt that will happen at some point. scp -- wrong. rsync, scp and sftp are all different ways of transferring files securely over SSH. scp did use to use its own protocol at one point, but it has been upgraded to use the same underlying protocol as sftp, so it’s perfectly fine to continue using the same command, if that’s what you’re used to. There is no sign that the scp command itself is going to be deprecated at any point, though no doubt the option to fall back to the old protocol for compatibility’s sake is likely to be removed eventually. egrep/fgrep -- it has been true for decades (possibly has always been true for the GNU utilities?) that egrep and fgrep are just synonyms for “grep -E” and “grep -F” respectively. And it is true that the alternative names are finally being deprecated after all these years, so it behooves you to learn to use the “grep” command for all forms. netstat vs ss -- yes, another case of the newer iproute2-based command taking over from the older, traditional command, and offering more features besides. Same remarks as above apply. route vs ip route -- iproute2 again. arp vs ip neighbour/neighbor -- more iproute2.

1 0

RISC-V PC Motherboard
by Lawrence D'Oliveiro 14 Jan '26

14 Jan '26

Here’s a mini-ITX motherboard with most of the usual trimmings (no integrated graphics or audio, though), but with a RISC-V CPU. So you’ll be using that single PCIe-x16 slot for a graphics card. Known to run Ubuntu. It’s available for pre-order <https://www.tomshardware.com/pc-components/cpus/milk-v-titan-mini-ix-board-…>. At this stage, it seems more targeted towards developers and early adopters, not (yet) the mass market.

2 1

How Long Does It Take to Fix Linux Kernel Bugs?
by Peter Reutemann 13 Jan '26

13 Jan '26

'A report from It's FOSS: Jenny Guanni Qu, a researcher at [VC fund] Pebblebed, analyzed 125,183 bugs from 20 years of Linux kernel development history (on Git). The findings show that the average bug takes 2.1 years to find. [Though the median is 0.7 years, with the average possibly skewed by "outliers" discovered after years of hiding.] The longest-lived bug, a buffer overflow in networking code, went unnoticed for 20.7 years! [But 86.5% of bugs are found within five years.] The research was carried out by relying on the Fixes: tag that is used in kernel development. Basically, when a commit fixes a bug, it includes a tag pointing to the commit that introduced the bug. Jenny wrote a tool that extracted these tags from the kernel's git history going back to 2005. The tool finds all fixing commits, extracts the referenced commit hash, pulls dates from both commits, and calculates the time frame. As for the dataset, it includes over 125k records from Linux 6.19-rc3, covering bugs from April 2005 to January 2026. Out of these, 119,449 were unique fixing commits from 9,159 different authors, and only 158 bugs had CVE IDs assigned. It took six hours to assemble the dataset, according to the blog post, which concludes that the percentage of bugs found within one year has improved dramatically, from 0% in 2010 to 69% by 2022. The blog post says this can likely be attributed to: - The Syzkaller fuzzer (released in 2015) - Dynamic memory error detectors like KASAN, KMSAN, KCSAN sanitizers - Better static analysis - More contributors reviewing code But "We're simultaneously catching new bugs faster AND slowly working through ~5,400 ancient bugs that have been hiding for over 5 years." They've also developed an AI model called VulnBERT that predicts whether a commit introduces a vulnerability, claiming that of all actual bug-introducing commits, it catches 92.2%. "The goal isn't to replace human reviewers but to point them at the 10% of commits most likely to be problematic, so they can focus attention where it matters..."' -- source: https://it.slashdot.org/story/26/01/12/0443201 Cheers, Peter

1 0

DMCA Takedown On Free Software
by Lawrence D'Oliveiro 07 Jan '26

07 Jan '26

Just read this report <https://www.tomshardware.com/software/chinese-semiconductor-outfit-has-linu…> about a DMCA takedown on a GitHub repository belonging to Rockchip. The copyright takedown was requested by the FFmpeg project. Their code is open source, of course. As is the code in the Rockchip repository. But the company took their code, removed the original attribution and licensing (LGPL), and put the result under an Apache licence, which is not compatible with the LGPL. Given that LGPL is a copyleft licence, and Apache is not, this could lead others to believe they could in turn take the Rockchip version of the code and develop it further and incorporate it into proprietary products without making any source available -- which is something copyleft is designed to prevent. Of course this action did not come out of the blue. The FFmpeg project had raised the issue with Rockchip back in 2024, but in the absence of any progress since that time, they felt that action had to be taken.

1 0