|
1825 Monetary Lane Suite #104 Carrollton, TX
Do a presentation at NTLUG.
What is the Linux Installation Project?
Real companies using Linux!
Not just for business anymore.
Providing ready to run platforms on Linux
|
Show Descriptions... (Show All/All+Images)
(Single Column)
- Debian libgcrypt Denial of Service Security Advisory DSA-6294-1
It was discovered that an incorrect implementation of ECDH encryption (with NIST, Brainpool, X448, or X25519 curves) within Libgcrypt could result in denial of service. For the oldstable distribution (bookworm), this problem has been fixed in version 1.10.1-3+deb12u1.
- Debian krb5 Important NegoEx Denial of Service Vuln DSA-6293-1
Cem Onat Karagun discovered two vulnerabilities in the NegoEx parsing in krb5, the MIT implementation of Kerberos. An unauthenticated remote attacker can take advantage of these flaws to cause a denial of service. For the oldstable distribution (bookworm), this problem has been fixed in version 1.20.1-2+deb12u5.
- [$] Reviewing kernel patches with LLMs
In a plenary session atthe2026 Linux Storage,Filesystem, Memory Management, and BPF Summit, the state of patchreview using large language models (LLMs) was discussed. It is a topic that has been swirling around in thekernel community for much of the year. The plenary, which was led by RomanGushchin, Chris Mason, Josef Bacik, and Sasha Levin, resulted in a quite bitof discussion, so much that a second filesystem-track-only (though otherssurely sat in) slot was used to continue it later in the day.
- Comprehensive Response to Bambu's AGPLv3 Violations (Software Freedom Conservancy)
The Software Freedom Conservancy (SFC)published a newsitem on May 18 about its response to violations of the AGPLv3 by BambuLab in its 3D printers. The company has not provided the source code toits modifications to a 3D "slicer" program that was released under theAGPLv3 and it has also threatened Paweł Jarczak who created a fork of adifferent slicer (Orca Slicer) released under AGPLv3 in order to interoperate with hisBambu printer. Based on that, the SFC has created the baltobuproject aimed at reverse-engineering and reimplementing the Bambu codewhile also hosting the Orca Slicer fork.Bambu has behaved badly for years and made multiple, provably false public statements regarding the AGPLv3 and its requirements. The recent aggressive behavior toward Paweł Jarczak was a last straw for us: we have decided to launch a multi-pronged effort that will assist consumers and users in the short-term, and also work toward a long-term strategy to improve the software right to repair for all 3D printer consumers.
- [$] Tier-aware memory-controller limits
Joshua Hahn began his session in the memory-management track of the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit by saying that the memorycontroller for control groups is intended to provide resource allocation,accounting, and protection from interference by other tasks. Butit was not really designed for tiered-memory systems; he is looking for away to improve that situation.
- Security updates for Monday
Security updates have been issued by Debian (atril, evince, gnutls28, haproxy, haveged, jq, kernel, krb5, libgcrypt20, nodejs, and thunderbird), Fedora (aw-server-rust, awatcher, bind, bind-dyndb-ldap, chromium, composer, docker-buildkit, docker-buildx, dotnet10.0, dotnet8.0, dotnet9.0, evince, firefox, httpd, kernel, nodejs-aw-webui, nss, perl-Apache-Session-Browseable, pie, python-pulp-glue, python-requests, and python3.15), Slackware (kernel), SUSE (apptainer, chromium, cockpit, dnsmasq, google-guest-agent, hauler, iproute2, jfrog-cli, kernel, libecpg6, libsolv, libzypp, zypper, mcphost, oci-cli, perl-YAML-Syck, python-lxml, python-urllib3, python311-impacket, rqlite, rsync, util-linux, and xz), and Ubuntu (evince, linux-azure, linux-azure-5.4, linux-azure-fips, linux-azure-4.15, linux-azure-fips, linux-fips, linux-gcp-5.15, linux-lowlatency-hwe-5.15, linux-oracle-6.17, node-path-to-regexp, and rclone).
- [$] Dirk and Linus discuss AI and kernel development
Linus Torvalds does not enjoy giving talks, but he does consent tothe occasional on-stage conversation with Dirk Hohndel at LinuxFoundation events. The pair held the 30th of their fire-less firesidechats during a keynote session on May 20, at the 2026 OpenSource Summit North America. Topics included 3D printing, guitarpedals, the recent 7.1-rc4 release of the kernel, and Torvalds'scomplicated relationship with AI tooling.
- Kernel prepatch 7.1-rc5
The 7.1-rc5 kernel prepatch is out fortesting. Quoth Linus:
I'm not entirely happy about it - most of this is totally trivial stuff to random drivers, which obviously makes it all less scary, but at the same time I'm really not convinced the churn is worth it at rc5 time. These things are "fixes", sure, but at the same time a lot of them are simply so irrelevant that I think they'd be better off in a linux-next tree and get merged during the merge window.
So I think I'll start being a bit more hardnosed about this kind of unnecessary churn this late in the game. We are supposed to look for *regressions*. Non-critical fixes to long-standing issues are simply not appropriate for this late in the release cycle. End result: this is too big, and this is the heads-up that I'll be pushing back on pointless pull requests with fixes that just aren't that important. And yes, several of these series were triggered by AI code review.
- [$] Custom page-cache policies with BPF
The kernel's page cache is charged with maintaining pages (or, morecorrectly, folios) containing copies ofdata from files in the filesystem; its performance has a big effect on theperformance of the system as a whole. One of the key decisions the kernelmust make is when to evict folios from the page cache. At the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit, Tal Zussman ran amemory-management-track session on how the page cache could be bettercustomized for specific workloads. It will not be much of a spoiler to saythat it involves BPF.
- [$] Toward better handling of major page faults
A major page fault occurs when a process attempts to access a page that isnot currently present in RAM; satisfying such faults usually involves I/O, and can thus take some time. When many threadssharing an address space are generating page faults, the result can besignificant lock contention while that I/Otakes place. During the memory-management track at the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit, Barry Song led a sessionto try, yet again, to find an enduring solution to this problem.
- Security updates for Friday
Security updates have been issued by AlmaLinux (firefox), Debian (chromium, nss, openvpn, and thunderbird), Fedora (cockpit, kernel, and linux-firmware), Oracle (gdk-pixbuf2, kernel, and libsndfile), SUSE (container-suseconnect, cpp-httplib, dnsmasq, firefox, glibc, GraphicsMagick, java-1_8_0-openj9, kernel, mozjs115, php8, python-urllib3, rekor, rootlesskit, rsync, tiff, ucode-intel, util-linux, and xz), and Ubuntu (bind9, bubblewrap, libarchive, linux-intel-iot-realtime, postgresql-14, postgresql-16, postgresql-17, postgresql-18, and xdg-desktop-portal).
- Vulnerabilities in various GTK-based PDF readers
Michael Catanzaro has disclosed acommand-injection vulnerability affecting a number of GTK-based PDFreaders; exploits included:
They contain a script for building malicious polyglot PDFs that are simultaneously both valid PDF files and also valid ELF binaries. When the user opens the PDF in the PDF viewer and clicks on a malicious link embedded in the PDF, the PDF abuses the command injection vulnerability to load itself as a GTK module using the `--gtk-module` command line flag. It can then execute arbitrary code via its library constructor. That flag was removed in GTK 4, which is why the vulnerability is much less serious for Papers than it is for Evince, Atril, and Xreader.
- OpenBSD 7.9 released
The OpenBSD 7.9 release isout, right on schedule. There is the usual long list of new features,including improved architecture support, CPU scheduling on heterogeneoussystems, the ability to hibernate a suspended system after a configurabledelay, socket splicing, a__pledge_open()system call giving special access to the C library, and much more. See theannouncement and the fullchangelog for details.
- [$] Support for private memory nodes
Gregory Price started his session in the memory-management track of the2026 Linux Storage,Filesystem, Memory Management, and BPF Summit by saying that, incurrent kernels, if a NUMA node has memory, the assumption is that anybody canmake use of it. He is trying to implement the opposite policy — to makesome memory off-limits for all processes except those designed specificallyto use it. The session was used to present his goals and to discuss howthey might be implemented.
- Security updates for Thursday
Security updates have been issued by AlmaLinux (kernel, kernel-rt, and libsndfile), Debian (bind9, evince, firefox-esr, openjpeg2, pdns, and rsync), Fedora (erlang-cowlib, evince, expat, firefox, kernel, mingw-expat, mysql8.0, mysql8.4, nss, opencryptoki, pgadmin4, proftpd, python-django5, python-django6, python-dotenv, rsync, rust-nu, rustup, and strongswan), Oracle (nginx, nginx:1.24, ruby, ruby:3.3, and squid), Slackware (bind and rsync), SUSE (buildah, distribution, distribution-registry, docker, firefox-esr, helm, libpainter0, libsdb2_4_2, postgresql-jdbc, runc, and vim), and Ubuntu (gnutls28, gst-plugins-good1.0, jq, linux-nvidia, linux-nvidia-lowlatency, openvpn, rsync, and unbound).
- Jetway BFNZASL2 supports pfSense and OpenWrt in a fanless form factor
The Jetway BFNZASL2 is a fanless embedded networking system built around Intel processors including the Intel Atom x7835RE (Amston Lake), Intel Processor N97, and Intel Atom x7425E. The platform features four 2.5GbE interfaces with optional Wi-Fi 6 and 5G connectivity for networking and edge applications. The primary configuration uses the Intel Atom x7835RE processor with […]
- Intel Introducing USB4STREAM Protocol For Linux - Opening Up Some Nifty Uses For USB4
An exciting Intel innovation expected to be added for the upcoming Linux 7.2 kernel is introducing the new USB4STREAM protocol for USB4/Thunderbolt as a "super simple" way to "basically just transfer raw packets from one host to another". This can be useful for quickly backing up a system from one host to another, sharing of web cameras or other peripherals across systems, or other environments where not having networking or wanting to avoid the traditional Linux networking stack...
- ESP32-S31 development boards bring Wi-Fi 6, audio, camera, and HMI features
Earlier announced in March with the unveiling of the ESP32-S31 SoC, Espressif has now launched the ESP32-S31-Korvo-1 multimedia development board, while documentation additionally references the ESP32-S31-Function-CoreBoard-1 connectivity-oriented board. Both platforms are built around the ESP32-S31-WROOM-3 module and target multimedia, audio, display, and connected IoT applications. The ESP32-S31 is Espressif’s latest dual-core RISC-V SoC featuring Wi-Fi […]
- 9to5Linux Weekly Roundup: May 24th, 2026
The 293rd installment of the 9to5Linux Weekly Roundup is here for the week ending May 24th, 2026, keeping you updated on the most important developments in the Linux world.
- Argon Industria PoE+ HATs add 25W Ethernet power and optional NVMe to Raspberry Pi 5
Argon40 has introduced two Industria PoE+ HATs for the Raspberry Pi 5, providing power and data through a single Ethernet cable using the IEEE 802.3af/at PoE+ standard. Both boards deliver up to 25W output, supplying 5V/5A for full operation. The standard Argon Industria PoE+ HAT focuses on single-cable power and network connectivity, while the Argon […]
- SpaceX Launches 29 Starlink Satellites on Memorial Day
"The expansion of SpaceX's Starlink network of internet relay satellites continued Monday with a Memorial Day launch from Cape Canaveral Space Force Station," reports Spaceflight Now.The mission added another 29 Starlink satellites to more than 10,000 already in low Earth orbit:This was SpaceX's 60th orbital flight of the year, consisting of 59 Falcon 9 rockets and one Falcon Heavy rocket... Nearly 8.5 minutes after liftoff, [Falcon 9 first stage] B1078 landed on the drone ship, 'A Shortfall of Gravitas,' positioned in the Atlantic Ocean off the coast of South Carolina. This was the 151st landing for this vessel and the 614th booster landing to date for SpaceX. Meanwhile, the second stage shut down eight minutes and 39 seconds into flight and entered a coast phase, before short second burn at T+52 minutes. The stack of Starlink satellites deployed 61 minutes and 26 seconds after launch. On X.com SpaceX shared footage of the booster rocket landing, and a longer video showing Starship's 12th test flight Friday.
 
Read more of this story at Slashdot.
- Will Big Tech Layoffs Bring a Culture Shift to Anxiety and Job Insecurity?
Tech industry layoffs may be worse at large tech companies than the rest of the IT industry. The New York Times argues those layoffs have now shifted the culture at Big Tech companies, after interviewing more than two dozen of their workers. "Cooperation and collegiality are on the wane; chumminess between employees and managers has cooled as mutual suspicion pervades their relationships; and a throbbing economic anxiety infects almost every conversation. "Perhaps no site on the internet reflects this transformation more vividly than Blind, where users can post in private channels restricted to employees of a single company, or public channels visible to anyone..."Since 2022, large tech companies have collectively laid off more than 150,000 workers, unraveling what many tech workers once perceived as a guarantee of affluence and employability. The threat of being replaced by artificial intelligence has loomed over those who remain. This year alone, Amazon has indicated that it is laying off more than 15,000 workers, Block 4,000, Meta 8,000 and Oracle an estimated 30,000... By most measures, the sentiments that Blind tracks have taken a turn for the worse. During the nearly four years before tech companies began major layoffs in the fall of 2022, Meta and Microsoft employees posted about career success — topics like how to maximize their salary or win promotions — more than four times as often as they posted about job insecurity, according to Blind. Since then, the ratios have lurched in the opposite direction: Meta and Microsoft employees have posted about job insecurity roughly 1.5 times as often as they post about success... The shift has had practical effects. A Meta employee said in an interview that some workers on her team now used less vacation time and that, in a break with custom, people frequently checked on their projects while on vacation. They increasingly worry about getting a poor performance review or losing their job if they aren't constantly available. The employee, who declined to be identified for fear of retribution, said she and many of her colleagues frequently checked Blind because it could be comforting to see how many other Meta workers shared their anxieties. Employees at several companies said in interviews that their morale was further undermined by the feeling that the layoffs were abrupt and arbitrary, and executed with little empathy. Several tech workers said it was the scarcity of information about possible layoffs that raised their cortisol levels and made it difficult to focus on their jobs. They often fill the vacuum by turning to Blind, which, in addition to posts by workers, features a "tech layoff tracker" that lists both layoff rumors and those it has confirmed. "I was on Blind five days a week," said Faith Wilkins El, a software engineer who was laid off from Oracle in late March, after more than four years at the company. Wilkins El, who is part of the Oracle Workers Collective, a group seeking better severance agreements with the company, said navigating Blind was sometimes stressful because it was hard to know what was true or false. (Blind says it has a security team to weed out bad actors, like those who may try to register under fake email addresses.) Still, she found it more helpful than not because the layoffs came as less of a shock after she spent time on the site. "I was trying to get prepared mentally," she said. Blind is capitalizing on the increased interest with new products. It plans to unveil a service called Blind AI, which will allow employers to simulate their workers' reactions to certain changes, like a stricter in-office mandate. And it is close to releasing a feature to alert users that layoffs are imminent.
Read more of this story at Slashdot.
- It's Like the Olympics - But Steroids Are Allowed
"Think Olympics on steroids. Literally," quips the BBC, describing Sunday's controversial Enhanced Games event in Las Vegas featuring dozens of athletes "using performance-enhancing drugs to try and break world records in track, weightlifting and swimming. Some $25m (£18.6m) in prize money is up for grabs — with cash prizes for winners... The drugs they use must be legal, and approved by the Federal Drug Administration. But substances like testosterone and human growth hormone — banned by the World Anti-Doping Agency — are not only celebrated here, they're encouraged and for sale... Health experts warn that anabolic steroids and growth hormones can cause strokes and cardiovascular damage, among other risks. Event organisers claim Enhanced will push the limits of human performance while critics, especially in the Olympic movement, dismiss it as an affront to the spirit and founding principles of competitive sport... Earlier this month, the Enhanced Group — the company behind the competition — began trading on the New York Stock Exchange. And the competition is seemingly being treated as an opportunity for Enhanced to sell performance-enhancing medicine and supplements online. "The project was founded by entrepreneurs Aron D'Souza and Maximilian Martin in 2023," the artidcle points out, "and has attracted backing from prominent investors including billionaire Peter Thiel and Donald Trump Jr." And NPR adds that "Most of the participating athletes trained for the competition in Abu Dhabi, as part of Enhanced's own study."Enhanced did not break down what specific athletes used which drugs, but they announced on Wednesday in the lead-up to the event that 91% of the athletes competing used testosterone or testosterone esters, 79% used human growth hormone, and 62% used stimulants, such as adderall... The games have been largely panned by outside medical experts and sports governing bodies. Multiple recent studies assess the harm surrounding the Enhanced Games. Travis Tygart, the CEO of the U.S. Anti-Doping Agency, called the games a "dangerous clown show that puts profit over principle" in a statement. The International Olympic Committee said the games are a "betrayal of everything that we stand for." The World Anti-Doping Agency (WADA) last year urged U.S. authorities to stop the games. The International Federation of Sports Medicine said in 2024 that they see the medical oversight as "insufficient" to support theathletes.
Read more of this story at Slashdot.
- California Executive Order Directs Businesses and State Agencies to Prepare for AI-Driven Workforce Disruption
Thursday California's governor issued an executive order "directing state agencies to prepare workers and businesses for AI-driven workforce disruption," reports San Francisco's KQED. In a statement the governor said "This moment demands that we reimagine the entire system — how we work, how we govern, how we prepare people for the future."The order mandates agencies to explore a range of policy options, including severance standards, expanded unemployment insurance, job retraining programs aimed specifically at white-collar workers, worker ownership models and a concept the governor called "universal basic capital," giving all residents a stake in assets such as corporate stocks, bonds or wealth funds... Tom Kemp, executive director of the California Privacy Protection Agency, applauded the fact that the order named data privacy as a consumer protection concern and highlighted the CPPA's automated decision-making technology regulations, which he called "the nation's most comprehensive." Others are more skeptical. "Catastrophic job loss from AI is not inevitable, it's a political choice," Lorena Gonzalez, president of the California Federation of Labor Unions, AFL-CIO, wrote in a statement. However, Gonzalez noted one area of genuine agreement: the order's emphasis on collective bargaining as a tool for protecting workers from AI displacement... According to Stanford HAI's 2026 AI Index, software developers ages 22 to 25 are among those most likely to see their skills made redundant earliest. This year, U.S. employment fell nearly 20% from 2024, even as headcount for older developers continued to grow. Following the job cuts announced at Meta, a union of Alphabet workers in the U.S. and Canada released a statement that suggests Silicon Valley's own labor force may seek to organize... "It's undeniable that our whole industry is being transformed by the corporate push to adopt new AI tools," [Alphabet Workers Union-CWA Local 9009 said in a statement]. "It's hard not to feel anxiety and fear when we can see more and more tech companies cutting huge portions of their workforce both in anticipation of replacing them with AI, and to fund their multi-billion-dollar bets on AI as the future of the industry..." In February, AFL-CIO President Liz Shuler and Gonzalez delivered what amounted to an ultimatum to Newsom: regulate AI or lose labor's support for any future presidential run. Shuler called a potential AI-driven economic collapse a coming "crisis." In August 2025, Newsom announced a partnership with Google, Microsoft, IBM and Adobe to expand AI education in California schools and community colleges, a workforce preparation push that now looks like a precursor to Thursday's more sweeping order. The article notes that after signing the bill the governor shared this comment on X.com. "California will pursue new policies that make sure working Californians — not just Big Tech — benefit from the wealth and breakthroughs coming out of this space." Newsom telegraphed Thursday's order earlier this week, when he appeared at the Center for American Progress IDEAS Conference in Washington. "Businesses are going to make a fortune, and that's why you cannot continue to have a payroll tax system that taxes jobs and then subsidizes automation."
Read more of this story at Slashdot.
- AI 'Crashes the Party' at This Year's Cannes Film Festival - Including Multi-Year Meta Partnership
AI "crashed the party" at this year's Cannes Film Festival, writes The Hollywood Reporter. The festival exposed "the fault lines reshaping cinema," their article argues, including how "AI is here — and the industry has stopped pretending otherwise."A humanoid robot spotted marching up and down the Croisette seemed to sum up the worst AI fears of the film industry — the machines have arrived and they are taking your place. But inside the Palais and the market tents, the conversation over artificial intelligence had moved beyond fear into something more like uneasy acceptance. Fighting AI "is a battle we will lose," said Demi Moore, a Cannes jury member this year, at the festival's opening press conference, suggesting the film industry needs to "find ways in which we can work with it." That's not the official Cannes line. The festival has banned films using generative artificial intelligence from its competition lineup. But at the Cannes film market, and in discussions at industry events over the past two weeks, the tone has shifted. AI-friendly tech giant Meta signed on as an official partner to the festival in a multiyear deal. Its AI tools were used to help produce an [out of competition] festival entry: Steven Soderbergh's documentary John Lennon: The Last Interview. [Meta's press release announcing the partnership touts "our creator partnerships," their Meta AI assistant, and "our latest AI and wearable technologies" including Ray-Ban Meta AI features for smartglasses like "AI-powered translations that break down language barriers in real-time".] At the Marché du Film [film market], there was an "AI for Talent Summit" that took the AI revolution as given, focusing instead on ethical AI use, data sovereignty and on the ways the technology can be used to enhance, rather than replace, creativity. For the indie film industry, it felt like a turning point.
Read more of this story at Slashdot.
- FreeBSD Foundation Executive Director Tries Daily Driving FreeBSD On Laptop
Phoronix reports on a presentation about trying FreeBSD on modern Framework laptop from last week's Open Source Summit hosted by the Linux Foundation:With FreeBSD having worked on improving its laptop support over the past two years with some big changes and ongoing efforts for making a nice KDE desktop experience on FreeBSD, FreeBSD Foundation's Executive Director has been trying to daily drive FreeBSD on laptops... With the Framework Laptop, the touchscreen "just worked" as did other basic functionality from the KDE desktop on FreeBSD, including peripherals like a wireless mouse. Among the challenges were Zoom failing for video calls but eventually working, the web camera took steps to enable, and Microsoft Teams only partially worked. With the help of online resources, ultimately she was able to succeed in her journey of running FreeBSD daily on a laptop.
Read more of this story at Slashdot.
- Canonical Is Shutting Down Ubuntu Pastebin
"Canonical says Ubuntu Pastebin will be decommissioned at the end of May 2026," writes Slashdot reader BrianFagioli, "as part of an infrastructure modernization effort."The announcement only appeared this week, giving the Linux community barely any warning before a service that has been tied to Ubuntu support culture for years suddenly disappears. Ubuntu Pastebin has long been used for sharing logs, crash reports, config files, and terminal output across IRC, Ask Ubuntu, forums, bug reports, Reddit, and countless troubleshooting guides scattered around the internet. The bigger concern is link rot. Once the shutdown happens, years of old support discussions could lose critical debugging information overnight. Community members have already pointed out that some Ubuntu packages and scripts still reference paste.ubuntu.com directly. While it is understandable that aging services eventually get retired, the extremely short transition period is rubbing many Linux users the wrong way, especially in a community where old documentation and archived troubleshooting threads still regularly help people solve problems a decade later.
Read more of this story at Slashdot.
- Mozilla Brings Web Serial Workflows to Firefox, Collaborates With Adafruit
The Web Serial API lets websites write to (and read from) serial devices using JavaScript, including USB and Bluetooth devices with virtual serial ports. And this week's Firefox 151 release introduced support for the Web Serial API on desktop. "Most folks won't use this API," acknowledges Mozilla's blog, "but for our community of builders and tinkerers, it unlocks the ability to use Firefox to communicate directly with compatible hardware devices like microcontrollers, development boards, and other serial-connected devices..."With Firefox's browser engine, Gecko, now supporting Web Serial, users can now connect, code, configure, and control compatible hardware directly from the browser in many workflows, often without additional software or complicated setup... As part of this week's launch, Adafruit, one of the internet's most beloved open-source hardware communities, is collaborating with us to test and validate what browser-based hardware development can look like in Firefox with Web Serial support... With Web Serial support in Firefox 151, Adafruit's browser-based hardware workflows now work directly in Firefox as well, with no additional software or complicated setup required for many projects. We invite you to give it a try... We want the web to be open, flexible, and shaped by the diversity of people building on it. If you're wiring up your first board, experimenting with hardware projects, or dusting off an old electronics kit, give Adafruit and Web Serial in Firefox a try. Build something amazing. Make something useful. Tell us what works. Tell us what breaks. Most of all, make it your own. Mozilla's "Hacks" blog demonstrates with an Adafruit ESP32-S2 based board "where messages sent from web code can be directly displayed on the device over Web Serial." And Mozilla engineer Alex Franchuk even built a handheld device that changes a web page's CSS properties.
Read more of this story at Slashdot.
- Disney's 'Star Wars: The Mandalorian and Grogu' Opens to 'Mixed' Box Office Results
It's "the first time in seven years that a new Star Wars film has launched on the big screen," writes CNBC. And Variety notes it's expected to earn $102 million through Monday:[B]ox office analysts are mixed on the results. On one hand, it's significant for any film to debut above $100 million in post-pandemic times. On the other, "Star Wars" is one of Hollywood's preeminent film properties, so there's an expectation of a certain level of box office. And this start is the worst for "Star Wars" since Disney bought the franchise in 2012. CNBC cites reports 41% of tickets were sold for more expensive large-format screenings like IMAX and DolbyCinema. So how's the movie? Rotten Tomatoes shows an 89% positive rating from moviegoers on its "popcornmeter" and a 62% average score from professional movie critics. And Ars Technica writes that "The plot is predictable, the fight scenes are meh, but you can't beat the charm of that little green Grogu." So while there's "a paint-by-numbers plot," they add that "the little green puppet pretty much carries the entire film."The new film is ... fine. It's an average Star Wars outing, and it will give families a solid Memorial Day Weekend entertainment option. It's just not the spectacular home run that might have helped launch the flagging franchise into an exciting new era, and diehard Star Wars fans hoping for more are probably going to be disappointed. Of course, not everyone agrees. "How many nails can we realistically drive into Star Wars's coffin before it's time to give up hope of resuscitation?" writes Clarisse Loughrey for The Independent, calling it "the dullest and most inconsequential 'Star Wars' ever made." (She argues that the movie "stitches together what is clearly three episodes of the previously planned fourth season of The Mandalorian and calls it a day. There's not a whiff of effort here.") And a reviewer at RogerEbert.com gave it one-and-a-half stars, complaining that "There's no reason for anything in this movie except the wish to make even more money...."I'm on record as despising the word "content," which was pushed by early tech moguls to devalue art as interchangeable goo in a virtual pipeline, but this washed-out, video-game-looking movie, with its murky night scenes and lack of visual depth, deserves the word. You've seen everything in it before, from the equipment, spacecraft, armor, and tactical maneuvers to the species and various types of terrain (earthlike, but cartoony)... Even Grogu taxes our patience. Some of his cute bits could've ended with him facing the camera and doing jazz hands.
Read more of this story at Slashdot.
- Apple Preparing New 'Gen AI' Website Ahead of WWDC — and New AI Features?
Apple just registered a new subdomain record: genai.apple.com. The domain was spotted by a MacRumors contributing researcher, and though it doesn't yet lead to a live web page, they believe it's tied to Apple's annual developers conference WWDC which starts June 8, "where the company has promised to announce 'AI advancements' across its software platforms." The blog 9to5Mac speculates that "All signs point to WWDC 2026 being Apple's major AI renaissance, where the company will live up to the promises it made back at WWDC 2024, as well as a few additional new announcements."[I]it goes without saying that this is probably related to Apple's upcoming generative AI announcements at WWDC... Siri should finally be able to understand more personal context, have on screen awareness, and be able to take action in apps for you. This'll finally be made possible thanks to Apple's new partnership with Google, where Apple will be using Gemini-diffused models hosted on Private Cloud Compute to power Siri... Apple will also reportedly be introducing a new Siri app. This'll allow you to access your previous Siri conversations, as well as have text-based conversations with Siri. Other Apple Intelligence upgrades coming at WWDC 2026 include the ability to generate wallet passes from physical tickets, new editing features in the Photos app, and additional functionality for Visual Intelligence...
Read more of this story at Slashdot.
- Wind and Solar Generated More Power Than Gas Globally in April
Last month saw a world first, reports Electrek. Wind and solar generated more power globally than gas:According to new analysis from independent energy think tank Ember, wind and solar produced 22% of the world's electricity in April 2026, compared to 20% from gas. Together, the two renewable sources generated a record 531 terawatt-hours (TWh) of electricity during the month, 54 TWh more than gas plants generated globally, at 477 TWh... Five years ago, in April 2021, gas generation was almost identical to today's level at 476 TWh. But back then, wind and solar combined generated just 245 TWh — less than half of what they produced this April... Wind and solar generation increased across nearly every major market reporting April data... April tends to be the strongest month for this kind of milestone because spring weather in the Northern Hemisphere usually brings a combination of strong wind generation, rising solar output, and lower electricity demand between heating and cooling seasons. Still, the broader trend is clear. Ember's recent Global Electricity Review found that wind and solar met all global electricity demand growth in 2025. "Governments around the world are also ramping up renewable energy targets to reduce dependence on volatile fossil fuel imports..."
Read more of this story at Slashdot.
- Scammers Are Abusing an Internal Microsoft Account to Send Spam Links
"For months, scammers have been taking advantage of a loophole that allows them to send spammy emails from an internal Microsoft email address typically used for sending legitimate account alerts," TechCrunch reports:[The scammers] have been able to set up new Microsoft accounts as if they are new customers and use that access to send out emails purportedly from the tech giant, potentially tricking people into thinking these emails are genuine... Last week, I received several, similarly structured emails containing subject lines and web links to scammy sites from Microsoft across different email accounts. These crudely made emails were sent from msonlineservicesteam@microsoftonline.com, an email account that Microsoft uses to send important notifications to users, such as two-factor authentication codes and other critical alerts about their online account. Some of these emails' subject lines resembled official emails that would alert users to fraudulent transactions, while other emails claimed to have a private message waiting for the recipient at a web address mentioned in the email body. In a social post on Tuesday, anti-spam nonprofit The Spamhaus Project said it had also seen Microsoft's account notification email address being abused to send spam and that the activity dated back "several months." A PR representative told TechCrunch that Microsoft was "actively investigating" and "taking action against these phishing reports to help keep customers protected," with measures that include "removing accounts that violate our Terms of Use" and "further strengthening our detection and blocking mechanisms." TechCrunch suggests the issue may not be limited to Microsoft. "Other users commenting on social media say that other companies' email addresses are also being used to send out spam."
Read more of this story at Slashdot.
- Lenovo, Dell, and HP Financially Support Linux Vendor Firmware Service
The It's FOSS blog has news about the Linux Vendor Firmware Service, which gives hardware vendors a secure portal to upload firmware updates "which can then be downloaded and installed by users through clients such as GNOME Software or fwupdmgr." (Originally developed in 2015 by GNOME maintainer Richard Hughes...)The issue, however, obviously, had been funding with the largest contributors being the usual suspects, Framework and Open Source Framework Foundation, at $10K a year. Recently, however, Lenovo and Dell joined suite as Premier sponsors, which is the highest tier at $100K a year each, making the project more sustainable and manageable. These companies contributing makes a lot of sense, considering they are two of the bigger computer companies which offer Linux by default in some cases, especially with Lenovo's ThinkPads being the Linux users' favorite for decades. And now... HP has followed suit as a Premier sponsor, also providing $100K a year, right alongside Dell and Lenovo... The question still remains, however, where are the other vendors? What are they waiting for... This major move by these three companies should not only be seen as a sign of relief and wider acceptance of the usage of Linux, but as a beacon for other vendors to follow, who ought to make their hardware more accessible to the open-source community.
Read more of this story at Slashdot.
- More Videogames Developers Consider Unionization - Some Spurred By Changes to Remote Work Policies
Developers for several top videogames have joined unions under the Communication Workers of America — including Call of Duty, Fallout, Overwatch, Diablo and World of Warcraft. Last month workers on the online game Magic: The Gathering Arena team announced their own CWA union. The gaming news site Aftermath shares some interesting details:Owner Hasbro and Wizards of the Coast could have voluntarily agreed to the union, but instead the issue is going to an official vote with the National Labor Relations Board in June... [O]ne Arena developer shared on Bluesky that one of the reasons they were inspired to organize was because Wizards changed its remote work policy, requiring them to move across the country or to a more expensive state to remain employed. (Changes to remote work have been one of the big drivers of unionization and union action among video game developers.) If the union is successful, the company wouldn't be able to unilaterally change working conditions like remote work; it would have to negotiate with the union over the decision. There's no guarantee unionized employees would get what they want, but they'd have more of a say, and the opportunity to directly influence their work situation, than they would without a union.
Read more of this story at Slashdot.
- 'Underminr' CDN Vulnerability Hides Malicious Traffic Behind Trusted Domains
Slashdot reader wiredmikey writes: Threat actors are exploiting a vulnerability in shared content delivery network (CDN) infrastructure to hide connections to malicious domains. Researchers say the vulnerability could impact roughly 88 million domains and can bypass DNS filtering and protective DNS controls, potentially enabling stealthy command-and-control communications and other evasive attacks. Dubbed "Underminr," the exploit "presents the SNI and HTTP Host of a domain," writes SecurityWeek, "while forcing a request to the IP address of another tenant on the same shared edge."The mismatch, ADAMnetworks reports, has been exploited in attacks targeting large-scale hosting providers, including those that have implemented mitigations against domain fronting... Threat actors' increased reliance on AI is expected to lead to a surge in attacks. "Once Underminr becomes parametric information for AI-generated malware, we could expect to see it in every attack that needs to evade protective DNS as part of the attack chain," ADAMnetworks CEO David Redekop says.
Read more of this story at Slashdot.
- From DHCP to SZTP – The Trust Revolution
By Juha Holkkola, FusionLayer Group The Dawn of Effortless Connectivity In the transformative years of the late 1990s, a quiet revolution took place, fundamentally altering how we connect to networks. The introduction of DHCP answered a crucial question, Where are you on the network?!, by automating IP address assignment. This innovation eradicated the manual configuration [0]
The post From DHCP to SZTP – The Trust Revolution appeared first on Linux.com.
- Using OpenTelemetry and the OTel Collector for Logs, Metrics, and Traces
OpenTelemetry (fondly known as OTel) is an open-source project that provides a unified set of APIs, libraries, agents, and instrumentation to capture and export logs, metrics, and traces from applications. The project’s goal is to standardize observability across various services and applications, enabling better monitoring and troubleshooting. Read More at Causely
The post Using OpenTelemetry and the OTel Collector for Logs, Metrics, and Traces appeared first on Linux.com.
- Meta9s CacheLib Sees New Release After Two Year Hiatus For Helping With High DRAM Prices
Back in 2021 Facebook open-sourced CacheLib as a new caching engine. Back in 2021 it was done to help scale services with non-volatile memory caching to offset increasing DRAM costs at the time. Now in 2026, DRAM memory prices are astronomical compared to 2021 pricing given the AI surge. And, surprisingly, Meta is out with a new CacheLib release after being absent the past two years...
- Intel Introducing USB4STREAM Protocol For Linux - Opening Up Some Nifty Uses For USB4
An exciting Intel innovation expected to be added for the upcoming Linux 7.2 kernel is introducing the new USB4STREAM protocol for USB4/Thunderbolt as a "super simple" way to "basically just transfer raw packets from one host to another". This can be useful for quickly backing up a system from one host to another, sharing of web cameras or other peripherals across systems, or other environments where not having networking or wanting to avoid the traditional Linux networking stack...
- Linux To Drop ARCnet Support For Old ISA & PCMCIA Hardware
With Linux 7.1 ISDN, ham radio, and other old network code was removed in lightening the kernel source tree by around 138 thousand lines of code. Some additional Linux networking code cleaning is expected for Linux 7.2 with the ISA and PCMCIA hardware around ARCnet set to be removed...
- Linux To Remove ISA Speech Synthesizer Driver That Likely Hasn9t Been Used In Decades
Following the process of phasing out Intel 486 CPU support and other old hardware drivers that were dropped in the Linux 7.1 kernel cycle for reducing the kernel maintenance burden, the upcoming Linux 7.2 cycle is continuing the trend of phasing out some of the old hardware support that is very obsolete, likely having no users on the latest upstream kernels, and no one formally maintaining the obsolete drivers...
- Boot-Time Wizard Aims To Help Reduce Linux Boot Times
While in the past decade or so Linux desktop/laptop users likely have little to complain about boot times and there hasn't been much emphasis around trying to make boot times even faster on the Linux desktop especially in an era where many systems are always-on and suspend/resume working more reliably these days, boot times are still an important factor in the embedded Linux world. Boot-Time Wizard is one of the new efforts aiming to help embedded Linux makers cut-down on their boot times...
- AV2 Codec Looks Like It Will Be Officially Released Next Week
For years already AV2 has been in development as the successor to AV1 for this wonderful open-source, royalty-free video codec. While there was talk about releasing AV2 by the end of 2025, that didn't happen but now latest indicators are pointing toward its formal debut next week...
- DreamWorks9 Open-Source MoonRay Renderer Now Part Of The Academy Software Foundation
Back in 2022 it was announced DreamWorks Animation was open-sourcing their MoonRay renderer that has been used in production feature films. It ended up being published as open-source in March 2023 as OpenMoonRay and since then has continued advancing with new feature releases and improvements. Now it's being contributed to the Academy Software Foundation as the newest project...
- FreeBSD 15.1-RC1 Released: Fixes With Now Seeing More AI-Discovered Security Issues
In addition to the recent influx of Linux security vulnerabilities affecting Linux, FreeBSD has also begun receiving security reports via AI/LLM-driven discovery tools. FreeBSD 15.1-RC1 is out today ahead of the planned official release in June and it brings a handful of security fixes out of this new AI-driven security research space...
- OpenCL 3.1.1 Released To Address A Possible Performance Regression
Released earlier this month was the OpenCL 3.1 specification with a focus on enhancing AI and HPC workloads for this long-time Khronos specification. Out today is OpenCL 3.1.1 as a point release with an emphasis on addressing a possible performance regression of OpenCL 3.1...
- Linux Provides Better Performance With The AMD Ryzen 9 9950X3D2 Over Windows 11
Last month with the new AMD Zen 5 "Dual Edition" 3D V-Cache CPU, the AMD Ryzen 9 9950X3D2 Dual Edition showed great performance on Linux across a range of workloads. Curious if the operating system was playing into the greater benefit of Ryzen 9 9950X3D2 versus just the workloads tested, this article is looking at both the AMD Ryzen 9 9950X3D and Ryzen 9 9950X3D2 on Microsoft Windows 11 and Ubuntu 26.04 LTS Linux across a range of native benchmarks.
- The Nokia N8 has a brand new, modern, actively maintained, and regularly updated Symbian ROM
I have a Nokia N8, and its one of my favourite retro (?) devices I own. It was one of Nokias last efforts to make Symbian happen in the post-iPhone era, and while the hardware was quite nice, Symbian just wasnt made for multitouch devices. It didnt move the needle much for an already dying Nokia, and things just got worse from there. A bright spot with the Nokia N9, some decent Windows Phone devices, and then the end. We all know the story. The Nokia N8, though, seems to have been given a new lease on life recently. This smartphone, released in 2010, can be turned into a usable, capable device again, thanks to a brand new, modern custom Symbian ROM called Reborn. It takes the latest stock Symbian version for the N8, removes any and all applications/links/etc. that dont work anymore, and then proceeds to make a ton of things work again. Modern TLS for HTTPS support, updated certificates, modern email support, a brand new application store, a new update application with a steady stream of OTA updates to fix issues, a bunch of security fixes, a whole slew of quality-of-life touches, and so, so much more. This is absolutely amazing work. Clearly a labour of love, theres already been tons of updates over the past year since the ROMs initial release, and I obviously cant not install this on my own N8, assuming it still works. A video by Janus Cycle covering the project is also available, for the more visually-oriented among us.
- Microsoft continues beating the agentic! Windows drum
Were a mere €124 away from the first incentive during our fundraiser: making me use stock Windows 11 for a month. Since the writing appears to be on the wall, and the donation pulling us across the line can come in any moment, I figured Id better take a peek at how things stand with Windows. I came across a story about Yusuf Mehdi, an executive vice president and consumer chief marketing officer, who apparently became the face of Microsofts AI! push. After 35 years, hes leaving the company, but not after pledging to continue pushing AI! deeper into Windows 11. Despite this intense backlash, Mehdi is doubling down on the AI vision during his final months at the company. In his LinkedIn announcement, he stated: “I will work through the next fiscal year to help reimagine Windows for the agentic era, grow Microsoft 365 services, and bring our One Copilot vision to life.” Microsoft has recently scaled back on some intrusive Copilot features in Notepad, Snipping Tool, and Photos, but the executive leadership team still views AI agents as the inevitable future of the Windows desktop experience. ↫ Abhijith M B at Windows Latest The numbers for Microsoft and every other software company who dove head-first into AI! are clear: its one of the biggest bottomless pits of all time, and theyre all throwing money down the pit hoping itll eventually fill up and overflow. Meanwhile, 100 metres down in the pit, a dude in a leather jacket is holding out a bucket and collecting some of the money before it disappears into the void below. For Microsoft, AI! represents a $235 billion loss (so far!), so the company had to do something anything to stop the bleeding. They tried shoving Copilot buttons in every nook and cranny of its products, but users rightfully and understandably revolted. Theyre toning it down in Windows, and recently, theyve also had to tone it down in Office as users were horrified to discover a floating Copilot button in Word, Excel, and so on. People really do not want this shit, which puts these companies in a hugely precarious position: just how badly can they abuse the geese? Well see just how much Microsoft will actually roll back its force-feeding practices, and Im not excited to be partaking in the Windows 11 experiment soon.
- On C extensions, portability, and alternative compilers
Anyone whos written C knows that full ISO C standard-adhering code is an impractical rarity. Most real world C code out there relies on non-standard behaviors and language extensions to varying extents, and a lot of this isnt for extra features, but just to work around bugs and gaps in different compilers and libraries. A lot of codebases will try somewhat to support various environments, mostly through the use of preprocessor checks and guards, but these attempts are finicky at best and straight up broken at worst. I have ran into many of these situations while working on my C compiler, so heres a small list of some of them. ↫ lemon/Sofia Sometimes I wonder how computers even get anything done at all.
- Flatpak will depend on systemd
If you visit the Flatpak website today, it lists, as the very first advantage of the project: Build for every distro: create one app and distribute it to the entire Linux desktop market.! If you then move on to the list of supported distributions, youll see the usual suspects, but also distributions like Void Linux, Guix, and Alpine. These last three all have one thing in common: they use an init system other than systemd, because Flatpak doesnt care what init system you use. It seems that for the next major version of Flatpak, however, thats going to change: systemd will probably become a dependency for Flatpak. Speaking at the Linux App Summit, Arian Vovk and Sebastian Wick held a great talk about the future of Flatpak. The current version of Flatpak will continue to see a ton of improvements, but at the same time, the limits of what can be done with its decades-old design have become harder and harder to work around. As such, theyre also planning for and working on what they call Flatpak Next, or perhaps Flatpak 2.0, which is effectively a rewrite of Flatpak based on what theyve learned over the years, making use of modern technologies and ideas that have gained ground since the initial design of Flatpak 1.x. Its important to note that everything discussed during the talk is planning, and not a single line of code has been written yet. This means that all of these plans are subject to change, and as the work progresses over the coming years, the end result may turn out very different from whats been detailed in the talk. In addition, and I cant stress this enough: if anything in this discussion gives you even the smallest of inklings to go and harass, attack, insult, or otherwise bother anyone involved in Flatpak, systemd, or related technologies, please be so kind as to book an appointment for a yoga class or whatever. It seems like you need it. Right at the onset of the talk, Vovk and Wick explain that they want to move the permission management from Flatpak into the service layer, through a new service called systemd-appd. Systemd-appd gives applications an identifier and stores their permissions, and then this data can be queried by the rest of the system. In turn, this enables a slew of other features, not least of which is subsandboxing. At the moment, the plan is to introduce this feature in the current version of Flatpak, thereby introducing a dependency on systemd into Flatpak. From what I understand from Vovk, they were intending to be super considerate! of distributions and people not using systemd, which I take to mean wed eventually end up in a situation very similar to systemd-logind, which was extracted from systemd into a separate daemon, elogind, so that distributions using other init systems could still make use of desktop environments depending on systemd-logind. I imagine Flatpak developers wanted to make as many affordances as realistically possible for something similar to happen to systemd-appd, thus ensuring Flatpak would remain available on distributions not using systemd. Obviously, people who are using distributions like Void or Alpine were concerned about the future of Flatpak on their systems. If Flatpak gains a hard dependency on systemd, Flatpak would no longer work on distributions without systemd, so the talk raised questions sadly, it seems the questions were directed at someone not technically involved with Flatpak development, and his replies were not particularly helpful and often just downright insulting and inflammatory. Even though hes not involved in Flatpak development, enough people assumed that he was, and a toxic brew stirred. Users with genuine, friendly questions about the future of Flatpak on their systems were met with derision and insults, and it spiraled out of control from there, drawing in the rabid anti-systemd Red Hat conspiracy lunatics (and worse). Things got progressively worse for everyone involved, particularly for Flatpaks developers. And so we ended up at the situation where everyones mad and Flatpaks developers are not feeling inclined to spend time on that shit anymore! when it comes to accommodating and making affordances for distributions and people not using systemd. The end result will most likely be that any future Flatpak dependency on systemd will be stricter, and making any independent elogind-like daemon will be much harder than it was going to be. Nobody wins, everybody loses, all because some people thought it necessary and productive to be insulting and inflammatory. As things currently stands, its very likely that over the coming years, Flatpak will gain a dependency on systemd, possibly without any affordances for an independent daemon to replicate systemd-appd functionality on distributions that do not use systemd. In other words, Flatpak would no longer be able to boast that it enables Build for every distro: create one app and distribute it to the entire Linux desktop market.!, as it would no longer be distribution-agnostic. And thats a shame, because Flatpak fills a real need for users, regardless of whatever init system they use. Which is apparently something some people base their entire identity on, because theyre weirdos.
- Long-term support! does not mean what you think it does
You may think you know what long-term support! means when picking a Linux distribution and version, but judging by the multitude of utterly wrong takes and deeply confused users I come across online, Im starting to get the feeling that in fact, no, you dont know what it means. KDEs Nate Graham is seeing the same confusion, and has published a blog post going over what LTS really means in the Linux world. People seem to think that an LTS release means its going to be more stable, have fewer bugs, and receive support for a certain set period of time. The reality is that only that last one really applies, sort-of. LTS generally means youre going to be using a Linux distribution version where youll get security fixes and possibly maintenance updates for a set number of years, but you wont be getting updates with new features or other updates that arent security fixes. The purpose of an LTS release is to more or less freeze itself and its packages in time, so that users know exactly what theyre getting. However, part of being frozen in time means any bugs, crashes, and hardware support are also frozen in time. The end result is that LTS releases will often have wildly outdated package versions, and those outdated package versions will most likely contain a ton of bugs and issues that have long been fixed in subsequent releases subsequent releases youre not getting, because youre on an LTS release. LTS releases are fairly stable and reliable as long as you use the most popular software from their included software repositories. So in the circumstances when this stops being the case, I think sometimes people can feel betrayed. They think, “I thought this was supposed to be stable! Why didn’t anyone fix this bug yet? Where’s my long-term support?” But Debian, Ubuntu, and Kubuntu never promised any level of stability, reliability, or absence of bugs. They promised that the version-locked software in their repos would receive security fixes for a certain number of years. Ubuntu and Kubuntu also offered a certain amount of non-guaranteed best-effort hardware compatibility improvements and non-security bug fixes. ↫ Nate Graham This causes major problems for upstream developers. People who use an LTS release will be using versions of packages that are out of date and full of bugs that have already been fixed in later versions, but they dont know that, so they end up reporting these old bugs that have been fixed ages ago as if theyre new. If youre an LTS user and you experience a persistent bug and subsequent crash in Kwin, youre most likely going to complain at the Kwin developers, even if the Kwin developers have already fixed this bug 18 months ago. Every week theres at least a few developers in my Fedi timeline rolling their eyes at Debian users reporting bugs fixed ages ago and getting mad when told they should complain at Debian developers for not backporting the fix. So many LTS users seem to think that LTS equals increased stability, fewer bugs, and fewer crashes, but thats just not what LTS is for or what it claims to offer. Sticking to specific (major) versions of packages means not youre not only missing out on new features and changes which might be desirable for you but also on bug fixes. With LTS, as they say, the bugs are also stable.
- Gnutella: a protocol outliving the world that created it
Now thats a name I havent heard in a long time. Gnutella is a file sharing protocol that many have forgotten and it has the story of a decentralized technology adopted by millions of casual users who did not care to learn what a peer-to-peer system was. Users showed up because the protocol solved real problems at scale and the solution just so happened to be decentralized. No one ever pretended to use Gnutella in hopes their GnutellaCoinTM would go up in value later. They just downloaded MP3s. The network exploded in popularity, then plateaued for almost a decade, then settled into a permanent long tail state of continued but diminished use. Welcome to my overly enthusiastic love letter to Gnutella. ↫ Rick Carlino I genuinely didnt know or I had forgotten, more likely that Gnutella formed the backbone of LimeWire, another name I havent heard in a long time. Im quite sure I used LimeWire over 25 years ago, but details are fuzzy and I might be confusing it with other filesharing networks of a similar vintage. I was an avid CD buyer and MiniDisc user (I used MD well into the smartphone age), so I didnt have much need for downloading MP3s. Gnutella is also apparently still active, and there are still clients you can download and use. Of course, its a mere shadow of its former self, but this, too, was news to me. Im kind of inclined to see if its still hosting MP3s.
- Migrating from Ubuntu 16.04 to FreeBSD
Bruno Crocis blog had been running on Ubuntu 16.04 for a long time, well past the Linux distributions expiration date. As such, it was time to upgrade, but instead of opting for something standard like another Ubuntu release, he opted for FreeBSD instead. This blog has been running on a Digital Ocean VPS for over ten years. A machine hosted in New York City, running Ubuntu 16.04 LTS. An LTS that hasn’t been in support for at least 5 years. It was about time to change it. After some considerations, I migrated to a Hetzner virtual machine that is way better than my old Ubuntu one, less than half the price of what I used to pay, and just across the country from me. Not only that, but I took the challenge to move my stack to FreeBSD. It’s a long text, but stay for a cool introduction of FreeBSD Jails with Bastille and some interesting site load benchmarks. ↫ Bruno Croci I absolutely adore the recent surge in people (re)discovering the BSDs as a valid alternative to Linux in both the server and desktop space. In this particular case, it was FreeBSDs Jails and ZFS support that won Corci over, and its easy to see why. While there are countless alternatives to Jails in the Linux world, ZFS is harder to come by as it cant be part of the kernel due to licensing issues. With how powerful and capable ZFS is, it makes sense to want to use it on your server, and in that case, FreeBSD is probably a better choice than most Linux distributions. There are countless reasons to choose one of the BSDs over a Linux distribution, and Im glad were seeing an uptick.
- Secure boot and Microsoft CA rollover: a heads-up for distributions
Weve already talked about the secure boot certificates from Microsoft that are about to become invalid, but Debian EFI team member and longtime Debian contributor Steve McIntyre published a blog post with more information for users and distribution developers alike. Why are Microsofts secure boot certificates relevant for the Linux world? Well, Linux distributions use shim to provide secure boot functionality, and this shim is signed with Microsofts certificates, because they are included in just about every single computer or motherboard ever shipped. The expiration of these oldest certificates should most likely not be a problem, as existing signed binaries should keep working. This is because the UEFI specification does not look at the expiration dates; it only cares that the signature is valid. Unless you have buggy firmware, your machine will continue to boot Linux just fine. Microsoft is already handing out new certificates, but they started the rollout of these way too late, so thats why its an actual issue today. New machines and updated older machines will most likely have all of these new CAs installed. New machines are already shipping that only include the new CAs; they will not trust older software and this has already started causing problems for some users. If you already have an old shim signed by Microsoft for your distribution from before October 2025, then it will only be signed using the older CA that expires soon. On newer machines, your users will already not be able to boot your distro with Secure Boot enabled. If you want your users to be able to use Secure Boot in future, you will need to get a new shim build submitted, reviewed and signed using the new CA. However, that signed build will not work on older machines unless they have had the new CAs installed. This is also likely to cause problems for some users. You should encourage your users to update their systems NOW before things break for them. ↫ Steve McIntyre I think the Linux world will be able to handle this just fine, but the fact that Microsoft started this process of replacement so late is a real shame. Im by no means an expert in this field, but I wonder if there isnt some better solution than relying on Microsoft. I understand their certificates will effectively always be installed on every motherboard, but shouldnt we be able to move that responsibility to a more independent entity?
- Googles plan for ads in its new AI! chatbot search engine is to let AI! generate the ads
After Google killed its search engine a few days ago, one question remained: how exactly does advertising fit into all of this? Google is obviously not going to move to chatbot search without somehow adding ads to your conversation with the pachinko machine, so everybody was wondering how that was going to work, exactly. Well, we have the answer, and its an obvious one. When researching a topic, consumers want to know exactly how a product suits their unique situation. In fact, 75% of people report making faster, more confident decisions using AI Mode in Search. 1 That’s why we’re testing two new types of ads, built with Gemini, that offer relevant product details along with helpful guidance. To help people evaluate their choices, both of these new formats will feature an independent AI explainer as part of the ad. Our Gemini model evaluates and synthesizes information about a product or service, and displays that context alongside the advertiser’s creative. This coherent, independent response ensures transparency and builds trust. These formats will also continue to be clearly labeled as “Sponsored.” ↫ Googles Ads 8 Commerce Blog Of course theyre going to just generate the ads with AI!, too. Google will offer two types of AI!-generated ads in their new chatbot search tool, the first of which will simply be an AI!-generated answer to a users question. If you ask the Google chatbot how can I clean my bed sheets of unintended nightly slop discharge?!, Google will generate an ad based on the features of a slopcleaner washing machine detergent product and show that to you. The second type comes in when a user asks something like what is the best way to kill a search engine?! Googles chatbot will then show a number of ways to kill a search engine, and one of the items in that list might be an ad generated by Google, alongside the customary unrelated information, wrong information, and made-up nonsense. Google claims both of these types of ads will be labeled as such, but I doubt that small label will be noticed by many, and of course, theres no way to know any of the other answers the chatbot generates arent paid-for either. Here, too, though, we must ask the question what the end game is. This new chatbot search engine is clearly trying to keep you on Googles website, but in doing so, itll deprive large numbers of websites of the traffic they need to survive. If they cant survive, theyre die. If theyre dead, they cant produce the content Google AI! needs to slobber up to spit back out in Googles chatbot search. Chatbot search is also an agent of its own destruction, because you cant generate improved slop with nothing but slop. Because, and I cant repeat this often enough, nobody has ever used AI! to produce anything of value.
- Twelve ways to be wrong about AI!-assisted coding
Suppose your manager asks you next week to demonstrate that the AI coding tools your company signed up for are worth the subscription cost. Would you measure lines of code generated, or tickets closed? Or would you send out a survey asking whether developers feel more productive? Each of those approaches is flawed in a different way; the sections below explain why. ↫ Greg Wilson Every single study that claims to prove AI! has a positive effect on productivity falls into one or more of these categories. Again, nobody has ever used AI! to produce anything of value.
- AI! tools shit where they eat
The stories of AI! bots and crawlers absolutely ravaging websites and services keep on coming, and the amount of work people have to do just to survive these AI! bot and crawler assaults is insane. I run Weird Gloop, which hosts some of the biggest video game wikis ever, like Minecraft, OSRS and League. Over the last 3 years, we’ve had to spend more and more of our time fighting with this bot traffic that is spiky, disproportionately expensive, and getting harder to distinguish from humans. If we weren’t constantly mitigating the bots, they would use ~10x more of our compute resources than everything else put together even though that “everything else” includes tens of millions of (human) pageviews and tens of thousands of edits a day. Everyone who runs wikis is dealing with the exact same problem. The Wikimedia Foundation has a post about it impacting operations, every major wiki farm has had varying degrees of service outages, and some smaller independent wikis have been knocked completely offline. Overall, I’d guess that about 95% of all server issues in the wiki ecosystem this year have been caused by bad scrapers. ↫ cookmeplox at the Weird Gloop blog AI! tools are a quintessential example of shitting where you eat!. All of these tools just suck up huge amounts of content created by actual humans, only to regurgitate bits and pieces of that content upon request according statistical models. If in that process of sucking up everybodys content, these tools are placing such amounts of undue stress and cost on the people making and hosting that content that said people stop making and hosting such content, where are these AI! tools going to get their content from next? With every person that throws up their hands in the air in utter frustration as they see theyre hosting bills skyrocket and their sites become unusable, AI! tools are agents of their own destruction, since ingesting the slop they themselves create only makes these AI! tools worse. Nobody has ever used AI! to produce anything of value, after all.
- Setting up KDE and Wayland on FreeBSD 15.x
Since X11 has moved to legacy status, its only a matter of time before the BSDs are going to have to make the move to being Wayland-first as well. This applies particularly to FreeBSD, which has been focusing on improving its suitability for desktop and laptops lately. The good news is that Wayland has been available on FreeBSD for a while now, and setting it up with a KDE desktop is a breeze. Dolce Far Niente has a quick and easy guide, updated today, that walks you through the steps of setting up KDE with Wayland on a fresh FreeBSD 15.x installation. Im keeping this on my to-do list, but Im not committing yet because were getting quite close to the first incentive of the OSNews fundraiser, where I have to install, run, and use vanilla Windows 11 (including Office and Outlook) for a month. No point in setting up FreeBSD when were about to hit that incentive. Regardless, this is going to be the future of FreeBSD for desktop and laptop use, so you if youre already a FreeBSD user, you might as well try and see if Wayland works for you today.
- Firefox, Vivaldi unveil their UI overhauls
Two popular web browser are overhauling their user interface, and the first to actually ship its new version is Vivaldi. Version 8.0 of this Chromium-based browser completely overhauls its UI, but retains its extensive customisation options, including the option to go back to the old look and feel if the new one doesnt float your boat. I wonder if this update addresses some of my long-standing issues with Vivaldi where it just seemed impossible to integrate the browser properly with KDE or GNOME, since it opted for its own fonts and had a ton of very custom UI that made it stand out moreso than even other browser. Before publishing this post, I did a quick install and check, and no, it seems not much has changed in that department. Not everyone will care in fact, I think most people dont but I do, and I do whatever it takes to make my browser look properly native. Any Chromium-based browser is a hard sell in that area, and that applies doubly so for Vivaldi and its long list of custom UI elements. The other popular web browser overhauling its UI is Firefox, which is bringing its new UI to testing now, with an actual release later this year. You can clearly see that both Vivaldi and Firefox seem to be following a similar trend, even if Im not entirely sure if it has a name yet. The new Firefox design also overhauls the settings page, integrates Mozilla services like its VPN, and brings back the compact mode (which has been hidden behind an about:config flag for years now). My biggest worry is how this will affect Librewolf and the KDE and GNOME themes I use, but it seems were going to have more than enough time to figure that out.
- Get your passwords out of BitWarden while you still can
I was a long-time Bitwarden user, until a year or so ago when I started migrating my passwords first to Firefox/LibreWolf, and recently from there to a KeePass database I can transfer and use with whatever password manager application is compatible with KeePass file format. It seems I was accidentally on time, as its come out over the last few days that Bitwarden is probably going down the drain soon. In February, the company got a new CEO, and in March, it doubled its Premium price, announcing the hike deep in a feature announcement. The new CEO seems to be a bellwether for whats to come for Bitwarden. Hes a merger and acquisitions guy, with a history of gutting companies and selling them for parts, and changes to Bitwardens website also indicate where its headed. The phrase “Always free” disappeared from the`personal password manager page`in mid-April. It used to sit prominently under the plan selector. The free plan still exists — for now — but the commitment language is gone. And then there’s the values rewrite. Bitwarden used to define its culture with the acronym GRIT: Gratitude, Responsibility,`Inclusion, and`Transparency. After May 4th, that changed. GRIT now stands for Gratitude, Responsibility,`Innovation, and`Trust. Inclusion and Transparency are out. Innovation and Trust are in. ↫ Patrick Boyd The Always free! motto quietly reappeared on the site after its removal was uncovered and went viral on Fedi. The change in CEO, the changes in values, and the removal (and reappearance) of Bitwardens well-known and oft-repeated commitment to its free plan have all been quiet. No announcements, no blog posts, no posts on social media but they did change a four-year old blog post by Bitwardens former CEO to change that GRIT acronym. You dont need to be an honors student to figure out where this is going, and what the new CEOs plans are for Bitwarden. Do as I did, and get your passwords out of BitWarden. I strongly suggest using an open format that can be used by any compatible password manager, with KeePass formats being the obvious choice. This way your passwords are truly yours, and not dependent on someones continued commitment to free plans or proprietary services that can unexpectedly change hands. Bitwarden is licensed under the Apache 2.0 license, but with all of the above, one has to wonder how long thats going to remain a thing.
- Printing with CUPS on OpenBSD
Printing on Linux, macOS, and even on Windows seems to be pretty much a solved problem, but what about printing on OpenBSD? Anyway, to do so I would need to set up my HP OfficeJet printer, connected wirelessly to the network, on OpenBSD. I chose to do this using HPLIP and CUPS as they are both in ports, I am familiar with how they work, and my printer is old enough that its PPD (driver) file is included in the slightly older version of HPLIP that is ported to OpenBSD. However, after installing both packages, starting the relevant services via rcctl including Avahi, and launching CUPS and finding the printer, I could not get it to install properly. Either it would error out at the end saying the printer couldn’t be added and advise me to check the CUPS error log, or it would seemingly successfully add the printer but I couldn’t print anything and couldn’t adjust the printer settings. ↫ Morgan at his blog Only very tangentially related, but my personal crowning achievement in computing is somehow making it possible for my PA-RISC c8000 workstation running HP-UX 11i v1 to print to my modern all-in-one HP printer thing, some random HP consumer junker we bought on a whim because it was a returned item and cheap. It took some messing around, but ever since Ive been able to just print stuff right from any application on HP-UX over the network, wirelessly. Note that the c8000 and HP-UX 11i v1 are almost two decades out of date compared to the printer, but by trying out promising device files included in HP-UX I managed to get it all to work. I never need it, but I am fairly sure Im one of the very few people in the world who can reliably print from an HP-UX 11i v1 workstation to a modern throwaway HP junker over Wi-Fi. Put that on my tombstone.
- OSNews fundraiser progress
⁂ A progress bar to keep track of our fundraiser! ⁂ Donate through Ko-Fi Donate through SEPA transfer Why a fundraiser? Note that I have to update it manually, and that it includes both Ko-Fi donations, as well as direct bank transfers. Yes, if your country is part of SEPA (EU, more or less), you can now do a safe direct bank transfer using IBAN to a dedicated bank account. This avoids any third parties. Use your banks application or website (Name: Thom Holwerda IBAN: SE08 8000 0820 1684 4657 8414 BIC: SWEDSESS).
- EU OS: A Bold Step Toward Digital Sovereignty for Europe
Image 
A new initiative, called "EU OS," has been launched to develop a Linux-based operating system tailored specifically for the public sector organizations of the European Union (EU). This community-driven project aims to address the EU's unique needs and challenges, focusing on fostering digital sovereignty, reducing dependency on external vendors, and building a secure, self-sufficient digital ecosystem.
What Is EU OS?
EU OS is not an entirely novel operating system. Instead, it builds upon a Linux foundation derived from Fedora, with the KDE Plasma desktop environment. It draws inspiration from previous efforts such as France's GendBuntu and Munich's LiMux, which aimed to provide Linux-based systems for public sector use. The goal remains the same: to create a standardized Linux distribution that can be adapted to different regional, national, and sector-specific needs within the EU.
Rather than reinventing the wheel, EU OS focuses on standardization, offering a solid Linux foundation that can be customized according to the unique requirements of various organizations. This approach makes EU OS a practical choice for the public sector, ensuring broad compatibility and ease of implementation across diverse environments.
The Vision Behind EU OS
The guiding principle of EU OS is the concept of "public money – public code," ensuring that taxpayer money is used transparently and effectively. By adopting an open-source model, EU OS eliminates licensing fees, which not only lowers costs but also reduces the dependency on a select group of software vendors. This provides the EU’s public sector organizations with greater flexibility and control over their IT infrastructure, free from the constraints of vendor lock-in.
Additionally, EU OS offers flexibility in terms of software migration and hardware upgrades. Organizations can adapt to new technologies and manage their IT evolution at a manageable cost, both in terms of finances and time.
However, there are some concerns about the choice of Fedora as the base for EU OS. While Fedora is a solid and reliable distribution, it is backed by the United States-based Red Hat. Some argue that using European-backed projects such as openSUSE or KDE's upcoming distribution might have aligned better with the EU's goal of strengthening digital sovereignty.
Conclusion
EU OS marks a significant step towards Europe's digital independence by providing a robust, standardized Linux distribution for the public sector. By reducing reliance on proprietary software and vendors, it paves the way for a more flexible, cost-effective, and secure digital ecosystem. While the choice of Fedora as the base for the project has raised some questions, the overall vision of EU OS offers a promising future for Europe's public sector in the digital age.
Source: It's FOSS
European Union
- Linus Torvalds Acknowledges Missed Release of Linux 6.14 Due to Oversight
Linus Torvalds Acknowledges Missed Release of Linux 6.14 Due to Oversight
Linux kernel lead developer Linus Torvalds has admitted to forgetting to release version 6.14, attributing the oversight to his own lapse in memory. Torvalds is known for releasing new Linux kernel candidates and final versions on Sunday afternoons, typically accompanied by a post detailing the release. If he is unavailable due to travel or other commitments, he usually informs the community ahead of time, so users don’t worry if there’s a delay.
In his post on March 16, Torvalds gave no indication that the release might be delayed, instead stating, “I expect to release the final 6.14 next weekend unless something very surprising happens.” However, Sunday, March 23rd passed without any announcement.
On March 24th, Torvalds wrote in a follow-up message, “I’d love to have some good excuse for why I didn’t do the 6.14 release yesterday on my regular Sunday afternoon schedule,” adding, “But no. It’s just pure incompetence.” He further explained that while he had been clearing up unrelated tasks, he simply forgot to finalize the release. “D'oh,” he joked.
Despite this minor delay, Torvalds’ track record of successfully managing the Linux kernel’s development process over the years remains strong. A single day’s delay is not critical, especially since most Linux users don't urgently need the very latest version.
The new 6.14 release introduces several important features, including enhanced support for writing drivers in Rust—an ongoing topic of discussion among developers—support for Qualcomm’s Snapdragon 8 Elite mobile chip, a fix for the GhostWrite vulnerability in certain RISC-V processors from Alibaba’s T-Head Semiconductor, and a completed NTSYNC driver update that improves the WINE emulator’s ability to run Windows applications, particularly games, on Linux.
Although the 6.14 release went smoothly aside from the delay, Torvalds expressed that version 6.15 may present more challenges due to the volume of pending pull requests. “Judging by my pending pile of pull requests, 6.15 will be much busier,” he noted.
You can download the latest kernel here.
Linus Torvalds kernel
- AerynOS 2025.03 Alpha Released with GNOME 48, Mesa 25, and Linux Kernel 6.13.8
Image 
AerynOS 2025.03 has officially been released, introducing a variety of exciting features for Linux users. The release includes the highly anticipated GNOME 48 desktop environment, which comes with significant improvements like HDR support, dynamic triple buffering, and a Wayland color management protocol. Other updates include a battery charge limiting feature and a Wellbeing option aimed at improving user experience.
This release, while still in alpha, incorporates Linux kernel 6.13.8 and the updated Mesa 25.0.2 graphics stack, alongside tools like LLVM 19.1.7 and Vulkan SDK 1.4.309.0. Additionally, the Moss package manager now integrates os-info to generate more detailed OS metadata via a JSON file.
Future plans for AerynOS include automated package updates, easier rollback management, improved disk handling with Rust, and fractional scaling enabled by default. The installer has also been revamped to support full disk wipes and dynamic partitioning.
Although still considered an alpha release, AerynOS 2025.03 can be downloaded and tested right now from its official website.
Source: 9to5Linux
AerynOS
- Xojo 2025r1: Big Updates for Developers with Linux ARM Support, Web Drag and Drop, and Direct App Store Publishing
Image 
Xojo has just rolled out its latest release, Xojo 2025 Release 1, and it’s packed with features that developers have been eagerly waiting for. This major update introduces support for running Xojo on Linux ARM, including Raspberry Pi, brings drag-and-drop functionality to the Web framework, and simplifies app deployment with the ability to directly submit apps to the macOS and iOS App Stores.
Here’s a quick overview of what’s new in Xojo 2025r1:
1. Linux ARM IDE Support
Xojo 2025r1 now allows developers to run the Xojo IDE on Linux ARM devices, including popular platforms like Raspberry Pi. This opens up a whole new world of possibilities for developers who want to create apps for ARM-based devices without the usual complexity. Whether you’re building for a Raspberry Pi or other ARM devices, this update makes it easier than ever to get started.
2. Web Drag and Drop
One of the standout features in this release is the addition of drag-and-drop support for web applications. Now, developers can easily drag and drop visual controls in their web projects, making it simpler to create interactive, user-friendly web applications. Plus, the WebListBox has been enhanced with support for editable cells, checkboxes, and row reordering via dragging. No JavaScript required!
3. Direct App Store Publishing
Xojo has also streamlined the process of publishing apps. With this update, developers can now directly submit macOS and iOS apps to App Store Connect right from the Xojo IDE. This eliminates the need for multiple steps and makes it much easier to get apps into the App Store, saving valuable time during the development process.
4. New Desktop and Mobile Features
This release isn’t just about web and Linux updates. Xojo 2025r1 brings some great improvements for desktop and mobile apps as well. On the desktop side, all projects now include a default window menu for macOS apps. On the mobile side, Xojo has introduced new features for Android and iOS, including support for ColorGroup and Dark Mode on Android, and a new MobileColorPicker for iOS to simplify color selection.
5. Performance and IDE Enhancements
Xojo’s IDE has also been improved in several key areas. There’s now an option to hide toolbar captions, and the toolbar has been made smaller on Windows. The IDE on Windows and Linux now features modern Bootstrap icons, and the Documentation window toolbar is more compact. In the code editor, developers can now quickly navigate to variable declarations with a simple Cmd/Ctrl + Double-click. Plus, performance for complex container layouts in the Layout Editor has been enhanced.
What Does This Mean for Developers?
Xojo 2025r1 brings significant improvements across all the platforms that Xojo supports, from desktop and mobile to web and Linux. The added Linux ARM support opens up new opportunities for Raspberry Pi and ARM-based device development, while the drag-and-drop functionality for web projects will make it easier to create modern, interactive web apps. The ability to publish directly to the App Store is a game-changer for macOS and iOS developers, reducing the friction of app distribution.
How to Get Started
Xojo is free for learning and development, as well as for building apps for Linux and Raspberry Pi. If you’re ready to dive into cross-platform development, paid licenses start at $99 for a single-platform desktop license, and $399 for cross-platform desktop, mobile, or web development. For professional developers who need additional resources and support, Xojo Pro and Pro Plus licenses start at $799. You can also find special pricing for educators and students.
Download Xojo 2025r1 today at xojo.com.
Final Thoughts
With each new release, Xojo continues to make cross-platform development more accessible and efficient. The 2025r1 release is no exception, delivering key updates that simplify the development process and open up new possibilities for developers working on a variety of platforms. Whether you’re a Raspberry Pi enthusiast or a mobile app developer, Xojo 2025r1 has something for you.
Xojo ARM
- New 'Mirrored' Network Mode Introduced in Windows Subsystem for Linux
Microsoft's Windows Subsystem for Linux (WSL) continues to evolve with the release of WSL 2 version 0.0.2. This update introduces a set of opt-in preview features designed to enhance performance and compatibility.
Key additions include "Automatic memory reclaim" which dynamically optimizes WSL's memory footprint, and "Sparse VHD" to shrink the size of the virtual hard disk file. These improvements aim to streamline resource usage.
Additionally, a new "mirrored networking mode" brings expanded networking capabilities like IPv6 and multicast support. Microsoft claims this will improve VPN and LAN connectivity from both the Windows host and Linux guest.
Complementing this is a new "DNS Tunneling" feature that changes how DNS queries are resolved to avoid compatibility issues with certain network setups. According to Microsoft, this should reduce problems connecting to the internet or local network resources within WSL.
Advanced firewall configuration options are also now available through Hyper-V integration. The new "autoProxy" feature ensures WSL seamlessly utilizes the Windows system proxy configuration.
Microsoft states these features are currently rolling out to Windows Insiders running Windows 11 22H2 Build 22621.2359 or later. They remain opt-in previews to allow testing before final integration into WSL.
By expanding WSL 2 with compelling new capabilities in areas like resource efficiency, networking, and security, Microsoft aims to make Linux on Windows more performant and compatible. This evolutionary approach based on user feedback highlights Microsoft's commitment to WSL as a key part of the Windows ecosystem.
Windows
- Linux Threat Report: Earth Lusca Deploys Novel SprySOCKS Backdoor in Attacks on Government Entities
The threat actor Earth Lusca, linked to Chinese state-sponsored hacking groups, has been observed utilizing a new Linux backdoor dubbed SprySOCKS to target government organizations globally.
As initially reported in January 2022 by Trend Micro, Earth Lusca has been active since at least 2021 conducting cyber espionage campaigns against public and private sector targets in Asia, Australia, Europe, and North America. Their tactics include spear-phishing and watering hole attacks to gain initial access. Some of Earth Lusca's activities overlap with another Chinese threat cluster known as RedHotel.
In new research, Trend Micro reveals Earth Lusca remains highly active, even expanding operations in the first half of 2023. Primary victims are government departments focused on foreign affairs, technology, and telecommunications. Attacks concentrate in Southeast Asia, Central Asia, and the Balkans regions.
After breaching internet-facing systems by exploiting flaws in Fortinet, GitLab, Microsoft Exchange, Telerik UI, and Zimbra software, Earth Lusca uses web shells and Cobalt Strike to move laterally. Their goal is exfiltrating documents and credentials, while also installing additional backdoors like ShadowPad and Winnti for long-term spying.
The Command and Control server delivering Cobalt Strike was also found hosting SprySOCKS - an advanced backdoor not previously publicly reported. With roots in the Windows malware Trochilus, SprySOCKS contains reconnaissance, remote shell, proxy, and file operation capabilities. It communicates over TCP mimicking patterns used by a Windows trojan called RedLeaves, itself built on Trochilus.
At least two SprySOCKS versions have been identified, indicating ongoing development. This novel Linux backdoor deployed by Earth Lusca highlights the increasing sophistication of Chinese state-sponsored threats. Robust patching, access controls, monitoring for unusual activities, and other proactive defenses remain essential to counter this advanced malware.
The Trend Micro researchers emphasize that organizations must minimize attack surfaces, regularly update systems, and ensure robust security hygiene to interrupt the tactics, techniques, and procedures of relentless threat groups like Earth Lusca.
Security
- Linux Kernel Faces Reduction in Long-Term Support Due to Maintenance Challenges
The Linux kernel is undergoing major changes that will shape its future development and adoption, according to Jonathan Corbet, Linux kernel developer and executive editor of Linux Weekly News. Speaking at the Open Source Summit Europe, Corbet provided an update on the latest Linux kernel developments and a glimpse of what's to come.
A major change on the horizon is a reduction in long-term support (LTS) for kernel versions from six years to just two years. Corbet explained that maintaining old kernel branches indefinitely is unsustainable and most users have migrated to newer versions, so there's little point in continuing six years of support. While some may grumble about shortened support lifecycles, the reality is that constantly backporting fixes to ancient kernels strains maintainers.
This maintainer burnout poses a serious threat, as Corbet highlighted. Maintaining Linux is largely a volunteer effort, with only about 200 of the 2,000+ developers paid for their contributions. The endless demands on maintainers' time from fuzz testing, fixing minor bugs, and reviewing contributions takes a toll. Prominent maintainers have warned they need help to avoid collapse. Companies relying on Linux must realize giving back financially is in their interest to sustain this vital ecosystem.
The Linux kernel is also wading into waters new with the introduction of Rust code. While Rust solves many problems, it also introduces new complexities around language integration, evolving standards, and maintainer expertise. Corbet believes Rust will pass the point of no return when core features depend on it, which may occur soon with additions like Apple M1 GPU drivers. Despite skepticism in some corners, Rust's benefits likely outweigh any transition costs.
On the distro front, Red Hat's decision to restrict RHEL cloning sparked community backlash. While business considerations were at play, Corbet noted technical factors too. Using older kernels with backported fixes, as RHEL does, risks creating divergent, vendor-specific branches. The Android model of tracking mainline kernel dev more closely has shown security benefits. Ultimately, Linux works best when aligned with the broader community.
In closing, Corbet recalled the saying "Linux is free like a puppy is free." Using open source seems easy at first, but sustaining it long-term requires significant care and feeding. As Linux is incorporated into more critical systems, that maintenance becomes ever more crucial. The kernel changes ahead are aimed at keeping Linux healthy and vibrant for the next generation of users, businesses, and developers.
kernel
- Linux Celebrates 32 Years with the Release of 6.6-rc2 Version
Today marks the 32nd anniversary of Linus Torvalds introducing the inaugural Linux 0.01 kernel version, and celebrating this milestone, Torvalds has launched the Linux 6.6-rc2. Among the noteworthy updates are the inclusion of a feature catering to the ASUS ROG Flow X16 tablet's mode handling and the renaming of the new GenPD subsystem to pmdomain.
The Linux 6.6 edition is progressing well, brimming with exciting new features that promise to enhance user experience. Early benchmarks are indicating promising results, especially on high-core-count servers, pointing to a potentially robust and efficient update in the Linux series.
Here is what Linus Torvalds had to say in today's announcement:
Another week, another -rc.I think the most notable thing about 6.6-rc2 is simply that it'sexactly 32 years to the day since the 0.01 release. And that's a roundnumber if you are a computer person.Because other than the random date, I don't see anything that reallystands out here. We've got random fixes all over, and none of it looksparticularly strange. The genpd -> pmdomain rename shows up in thediffstat, but there's no actual code changes involved (make sure touse "git diff -M" to see them as zero-line renames).And other than that, things look very normal. Sure, the architecturefixes happen to be mostly parisc this week, which isn't exactly theusual pattern, but it's also not exactly a huge amount of changes.Most of the (small) changes here are in drivers, with some tracingfixes and just random things. The shortlog below is short enough toscroll through and get a taste of what's been going on. Linus Torvalds
- Introducing Bavarder: A User-Friendly Linux Desktop App for Quick ChatGPT Interaction
Want to interact with ChatGPT from your Linux desktop without using a web browser?
Bavarder, a new app, allows you to do just that.
Developed with Python and GTK4/libadwaita, Bavarder offers a simple concept: pose a question to ChatGPT, receive a response, and promptly copy the answer (or your inquiry) to the clipboard for pasting elsewhere.
With an incredibly user-friendly interface, you won't require AI expertise (or a novice blogger) to comprehend it. Type your question in the top box, click the blue send button, and wait for a generated response to appear at the bottom. You can edit or modify your message and repeat the process as needed.
During our evaluation, Bavarder employed BAI Chat, a GPT-3.5/ChatGPT API-based chatbot that's free and doesn't require signups or API keys. Future app versions will incorporate support for alternative backends, such as ChatGPT 4 and Hugging Chat, and allow users to input an API key to utilize ChatGPT3.
At present, there's no option to regenerate a response (though you can resend the same question for a potentially different answer). Due to the lack of a "conversation" view, tracking a dialogue or following up on answers can be challenging — but Bavarder excels for rapid-fire questions.
As with any AI, standard disclaimers apply. Responses might seem plausible but could contain inaccurate or false information. Additionally, it's relatively easy to lead these models into irrational loops, like convincing them that 2 + 2 equals 106 — so stay alert!
Overall, Bavarder is an attractive app with a well-defined purpose. If you enjoy ChatGPT and similar technologies, it's worth exploring.
ChatGPT AI
- LibreOffice 7.5.3 Released: Third Maintenance Update Brings 119 Bug Fixes to Popular Open-Source Office Suite
Today, The Document Foundation unveiled the release and widespread availability of LibreOffice 7.5.3, which serves as the third maintenance update to the current LibreOffice 7.5 open-source and complimentary office suite series.
Approximately five weeks after the launch of LibreOffice 7.5.2, LibreOffice 7.5.3 arrives with a new set of bug fixes for those who have successfully updated their GNU/Linux system to the LibreOffice 7.5 series.
LibreOffice 7.5.3 addresses a total of 119 bugs identified by users or uncovered by LibreOffice developers. For a more comprehensive understanding of these bug fixes, consult the RC1 and RC2 changelogs.
You can download LibreOffice 7.5.3 directly from the LibreOffice websiteor from SourceForge as binary installers for DEB or RPM-based GNU/Linux distributions. A source tarball is also accessible for individuals who prefer to compile the software from sources or for system integrators.
All users operating the LibreOffice 7.5 office suite series should promptly update their installations to the new point release, which will soon appear in the stable software repositories of your GNU/Linux distributions.
In early February 2023, LibreOffice 7.5 debuted as a substantial upgrade to the widely-used open-source office suite, introducing numerous features and improvements. These enhancements encompass major upgrades to dark mode support, new application and MIME-type icons, a refined Single Toolbar UI, enhanced PDF Export, and more.
Seven maintenance updates will support LibreOffice 7.5 until November 30th, 2023. The next point release, LibreOffice 7.5.4, is scheduled for early June and will include additional bug fixes.
The Document Foundation once again emphasizes that the LibreOffice office suite's "Community" edition is maintained by volunteers and members of the Open Source community. For enterprise implementations, they suggest using the LibreOffice Enterprise family of applications from ecosystem partners.
LibreOffice
- France Says "Au Revoir" to Microsoft
In a move that should surprise no one, France announced plans to reduce its reliance on US technology, and Microsoft Windows is the first to get the boot.
- System76 Retools Thelio Desktop
The new Thelio Mira has landed with improved performance, repairability, and front-facing ports alongside a high-quality tempered glass facade.
|
