|
1825 Monetary Lane Suite #104 Carrollton, TX
Do a presentation at NTLUG.
What is the Linux Installation Project?
Real companies using Linux!
Not just for business anymore.
Providing ready to run platforms on Linux
|
Show Descriptions... (Show All)
(Two Column)
- Debian libhttp-daemon-perl Critical Shell Command Execution DLA-4639-1
A flaw was discovered in libhttp-daemon-perl, a simple http server class for Perl, which may result in the execution of arbitrary shell commands or file overwrite when processing specially crafted input. For Debian 11 bullseye, this problem has been fixed in version 6.12-1+deb11u2.
- Debian gst-plugins-good1.0 Critical Denial of Service Code Exec DSA-6359-1
Multiple security vulnerabilities were discovered in plugins for the GStreamer media framework and its codecs and demuxers, which may result in denial of service or potentially the execution of arbitrary code if a malformed media file is opened. For the stable distribution (trixie), these problems have been fixed in
- Debian libhttp-daemon-perl Important Exec Command Flaw DSA-6358-1
A flaw was discovered in libhttp-daemon-perl, a simple http server class for Perl, which may result in the execution of arbitrary shell commands or file overwrite when processing specially crafted input. For the stable distribution (trixie), this problem has been fixed in version 6.16-1+deb13u1.
- Debian Pillow Important DoS Code Exec Vulnern DSA-6357-1
Multiple security vulnerabilities have been discovered in Pillow, a Python imaging library, which could result in denial of service or the execution of arbitrary code if malformed files are processed. For the stable distribution (trixie), these problems have been fixed in version 11.1.0-5+deb13u3.
- Debian Imagemagick Important Denial Of Service Issues DSA-6356-1
Multiple security vulnerabilities were discovered in imagemagick, a software suite used for editing and manipulating digital images, which could lead to denial of service, information disclosure or potentially arbitrary code execution if malformed images are processed. For the stable distribution (trixie), these problems have been fixed in
- Systemd v261 released
Systemd v261 has been released with a long list of changes, including a newcloud "Instance Metadata Service" (IMDS) subsystem, "boot secret"functionality for use on systems that lack a physical TPM, as well assupport for the kernel's Live Update Orchestration (LUO) / KexecHandover (KHO) systems when they are present and enabled. See therelease notes for the full list of changes.
- [$] AURpocalypse now: a look at the recent AUR attacks
The Arch User Repository (AUR) hasbeen subjected to a sustained attack recently. The attacker, or attackers, havespun up a series of new accounts then used them to adopt orphanedpackages and push malicious updates that would install malware on users' systems.It is unclear how many users were compromised in the attack, but the maintainerswere playing Whac-A-Mole for several days to respond to each newly compromisedpackage. The project has turnedoff the AUR's new-user registration, for now, but it is unclear what its long-term response will be or if the AUR can be secured without major changes toits existing collaboration model.
- Security updates for Friday
Security updates have been issued by AlmaLinux (dracut), Debian (chromium, firefox-esr, and thunderbird), Fedora (chromium, firefox, nss, ocserv, ongres-scram, ongres-stringprep, perl-Archive-Tar, perl-GD, perl-HTTP-Daemon, perl-Net-Statsd, restic, singularity-ce, util-linux, and vorbis-tools), Mageia (gstreamer1.0-*, libupnp, luajit, opensc, and ruby-rack), SUSE (curl, dnsmasq, ffmpeg-4, frr, google-osconfig-agent, java-1_8_0-ibm, kernel, krb5, kubernetes-old, ldns, liburiparser1, openvswitch, rootlesskit, strongswan, traefik, and trivy), and Ubuntu (ldns, libheif, libnet-cidr-lite-perl, lxd, tomcat11, and vim).
- Eight new stable kernels for Friday
Greg Kroah-Hartman has announced the release of the 7.1.1, 7.0.13, 6.18.36, 6.12.94, 6.6.143, 6.1.176, 5.15.210, and 5.10.259 stable kernels. As usual, eachcontains important fixes. Users are advised to upgrade.
- The Software Freedom Conservancy's LLM-backed generative AI recommendations
The Software FreedomConservancy (SFC) has announcedthe release of its recommendationsfor using LLM-backed generative AI systems for FOSScontributions. The recommendations were created by the SFC andvolunteers from the free-software community.
The recommendations reflect the extremely difficult dilemmas thatthese systems pose for FOSS contributors. SFC and its volunteersunderstand that FOSS developers are approaching LLM-gen-AI from avariety of perspectives. The recommendations offer practicalassistance to minimize the damage caused by using proprietary systems,whether FOSS contributors reject LLM-gen-AI or choose (voluntarily orby employer mandate) to use them.
These recommendations are best practices (but not definitions orrequirements) that SFC and its volunteers formulated after carefulstudy of the growing LLM-gen-AI use among FOSS contributors. SFC willfollow these recommendations with a series of supporting materials,including documents, online tutorials, public Q&As, podcasts,and other community engagement. We will routinely refine ourrecommendations and continue to support FOSS contributors as theynavigate this difficult landscape.
- [$] The first half of the 7.2 merge window
The 7.2 merge window started with the 7.1kernel release on June 14. As of this writing, just over 7,000non-merge changesets have been pulled into the mainline for the next kernelrelease. Many of the core subsystems have been pulled at this point,meaning that most of the changes that can be expected in 7.2 have now comeinto focus.
- Mastodon 4.6 released
Version4.6 of the Mastodon fediverse platform has been released.
The headliner of this release is Collections, a way to create and share curated collections of profiles. Part of Mastodon's work ethos is our commitment to trust and safety, so we've put a lot of thought and care into the design of this feature to avoid some of the pitfalls and abuse people have experienced with similar features on other platforms, while focusing on its primary goal: Helping new users discover more of the Fediverse.
Other new features include support for subscribing to posts via email, theability to generate a "year in review" post, accessibility improvements,and more.
- [$] Single-hop block replication with RMR and BRMR
How can cloud providers efficiently supply durable virtual block devices? RemoteDirect Memory Access (RDMA) provides a way for servers in a cluster to sharechunks of memory, but there still needs to be a protocol that operates on top ofRDMA to provide the guarantees expected of a block device. The kernel's RDMA transportlibrary (RTRS) provides a way to send messages via RDMA. Ipresented about twonew components built on top of RTRS at the 2026LinuxStorage, Filesystem, Memory Management and BPF Summit: Reliable Multicastover RTRS (RMR) and Block device over RMR (BRMR). These modules, which Iam working on with Jia Li, could be a way for cloud providers toexpose durable block devices with as little overhead as possible. To accomplishthat, however, we need some discussion and feedback from the community beforesending the modules upstream.
- Security updates for Thursday
Security updates have been issued by AlmaLinux (dracut, podman, postfix, rsync, xorg-x11-server, and xorg-x11-server-Xwayland), Debian (atril, firefox-esr, and nginx), Mageia (libcap, perl, and python-pillow), Oracle (firefox, gstreamer-plugins-base and gstreamer-plugins-good, httpd:2.4, kernel, libpng12, libpng15, libxml2, libxslt, opencryptoki, openssl, postfix, rsync, webkit2gtk3, xorg-x11-server, and xorg-x11-server-Xwayland), Slackware (bind, libidn, mozilla, and openssl), SUSE (alloy, docker, elemental-system-agent, glibc, grafana, helm, LibVNCServer, openssh8.4, perl-GD, perl-HTTP-Daemon, python-WebOb-doc, python311-google-adk, rustup, traefik2, wireshark, and xwayland), and Ubuntu (dolibarr, golang-go.crypto, graphite2, gst-plugins-bad1.0, kitty, libconfig-inifiles-perl, libnginx-mod-js, and webpy).
- [$] LWN.net Weekly Edition for June 18, 2026
Inside this week's LWN.net Weekly Edition:
Front: State of Fedora; mTHP creation; overlayfs; buffer-heads cleanup; 7.1 statistics. Briefs: curl summer of bliss; 7.1 kernel; AUR compromise; Fedora election; FairScan 2.0; Firefox 152.0; Homebrew 6.0.0; KDE Plasma 6.7; LWN topic list; Quotes; ... Announcements: Newsletters, conferences, security updates, patches, and more.
- Fedora F44 election results
The resultsare in for Fedora's F44 election cycle for seats on the FedoraCouncil, Fedora EngineeringSteering Committee, FedoraMindshare Committee, and EPELSteering Committee.
Miro Hrončok and Aleksandra Fedorova have wonseats on the council. Neal Gompa, Fabio Valentini, Michel Lind,Maxwell G, and Simon de Vlieger have been elected to FESCo. SamyakJain, Akashdeep Dhar, Luis Bazan, and Mat Holmes have all been electedto the Mindshare Committee. The four candidates for the EPELcommittee, Carl George, Diego Hererra, Jonathan Wright, and TroyDawson were all automatically elected as there were an equal number ofcandidates and seats open. Congratulations to all the winners.
- Everything security at PyCon US 2026
The Python Software Foundation blog has a postwith a summary of the security-related content at PyCon US 2026 with links toslides from important sessions. The recordings will be published tothe PyCon US channel onYouTube, and the post will be updated with links to those videos asthey are made available.
- [$] Some buffer-heads cleanup work
Jan Kara has been workingon cleaning up how bufferheads are used by some kernel filesystems. In a shortfilesystem-track session at the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit, he gave an update onthat work and where it is headed. Topics included generic infrastructureto track buffer heads for metadata, a buffer-head cleanup for the Amigafilesystem, and some planned locking fixes.
- FairScan 2.0 released
Version2.0 of the FairScan document-scanning app for Android has beenreleased. The headline feature for this release is the addition ofoptical-character-recognition (OCR) support using Tesseract to produce PDFswith searchable text from scans. FairScan developer Pierre-YvesNicolas has written a detailedblog about adding the feature and explaining why it had not been addedpreviously.
That looks nice, so why didn't FairScan have it before? That'sbecause FairScan wasn't ready for it: I wouldn't be comfortable ifFairScan was giving you wrong text half of the time. To get goodresults from an OCR engine, you need to provide it a readableimage. If it's hard to read for a human, it's certainly also hard toread for an OCR engine.
Over the past year, I worked on different parts of FairScan'sautomatic processing to transform photos of documents into PDFs thatare easy for humans to read:
document detection perspective correction shadow reduction brightness and contrast enhancement
All this work on image processing helped FairScan produce cleanPDFs and can now also contribute to making text recognition effective.
FairScan is available via GooglePlay or F-Droid.
- Olimex LCD7-PANEL-LIME2 combines 7-inch touchscreen, A20 Linux SBC, and panel-mount frame
The LCD7-PANEL-LIME2 is a ready-to-mount Linux touch panel computer from Olimex, based on the company’s A20-OLinuXino-LIME2 open hardware SBC. The unit combines a 7-inch capacitive touchscreen, a plastic panel-mount frame, mounting brackets, ribbon cable, and an assembled A20-based Linux board into a single package. The computer board is the A20-OLinuXino-LIME2-e16Gs16M, an open-source ARM Linux SBC […]
- ESP32 Bit Pirate update adds WiFi Hotspot mode, Pirate Assistant, and Web Flasher
The ESP32 Bus Pirate project has been renamed ESP32 Bit Pirate as part of its continued development as an ESP32-S3-based multi-protocol firmware platform. The open-source project, developed by Geo-tp, turns supported ESP32-S3 boards into debugging and experimentation tools for wired protocols, radio interfaces, scripting, and browser-based interaction. The project remains inspired by the original Bus […]
- How NVIDIA Vera CPU Performance Compares To The Ampere Altra Max
Last month on Phoronix was an exclusive first look at the NVIDIA Vera CPU performance compared to prior-generation NVIDIA Grace as well as the current AMD EPYC and Intel Xeon competition. Following that was looking at how the ARM Linux server performance has evolved over the past eight years of AArch64 Linux servers. A Phoronix Premium supporter recently requested wanting to see how Vera compares to Ampere Altra. While Ampere Altra has been in the marketplace now for more than five years, they are some of the most readily available ARM Linux server options for DIY/enthusiast builds given the scarcity of AmpereOne and lack of other readily available socketed ARM CPU options. This article shows how the performance compares between Ampere Altra Max and NVIDIA Vera.
- The Growth of Vulnerability Management: The Rise of Agentic AI Pentesting
Cybersecurity shifts fast. Manual penetration tests remain valuable, especially for nuanced attack paths and business-logic issues, but they are expensive, point-in-time, and difficult to run continuously. By the time a report is delivered, the environment may have already changed. Automated scanners improved coverage and frequency, but most still rely on known signatures, templated checks, and shallow validation. They can find obvious issues, but they rarely match the adaptive reasoning, chaining, and persistence of a skilled attacker.Platforms like XBOW help security teams move toward continuous validation by running AI-driven tests that mimic large-scale human attackers. This shift moves the focus from periodic assessment and reactive patching toward ongoing exposure management and earlier prevention.
- The Secret Revolution in Battery Technology: 3-D Printing
"There's a revolution in battery technology hiding in plain sight," reports The Wall Street Journal. "The 3-D printing of batteries has the potential to put energy storage inside any device. "This will enable lightweight and long-lasting consumer gadgets, long-range military drones and even nanoscale robots."Almost all the innovations we regularly hear about — from cheaper, tougher electric-vehicle batteries to "Holy Grail" solid-state batteries — are about changing the chemistry of batteries. The promise of battery-tech 3-D printing (aka additive manufacturing) is simple: What if batteries could fill any available space, even structural elements of our gadgets, rather than always taking a rigid shape like a pouch or cylinder? The new approach has obvious appeal. The entire airframe of a drone could be filled with energy storage for increased range. Smartglasses could have sleek battery-packed frames, so they look like everyday eyewear rather than "Revenge of the Nerds" props. One of the biggest advantages of 3-D printing is that it works with any battery, regardless of its cell chemistry. It could advance today's lithium-ion as well as emerging sodium-ion and solid-state tech... Some [startups] are trying to use 3-D printing to create efficiencies in existing battery manufacturing systems. A brave handful of startups are pursuing radical new designs and approaches. They're starting with defense applications, where cost and scale are less of an issue... At Silicon Valley-based Sakuu... [r]ather than trying to 3-D-print whole batteries, the company is working on replacing one of battery manufacturing's biggest pain points, says Arwed Niestroj, Sakuu's chief operating officer, who is also a nuclear physicist and former head of Mercedes-Benz Research & Development North America. Existing battery assembly lines include football-field-long ovens for drying layers of material that have been dissolved in solvents. This requires a huge amount of energy and is a significant contributor to manufacturing costs, a big reason EV batteries aren't cheaper. Sakuu's process, under development for years, uses additive manufacturing to lay down key battery components without solvents, eliminating the need for ovens, says Niestroj. Sakuu is currently working to commercialize this tech with a major battery manufacturer...
Read more of this story at Slashdot.
- Is Tesla Planning To Sell Modular AI Data Center Hardware?
Electrek reports:Tesla wants to sell modular AI data center hardware, according to a new trademark application for a product called "Megapod." The filing describes a complete, self-contained computing system for AI workloads... Tesla filed the "Megapod" trademark (serial number 99893717) with the U.S. Patent and Trademark Office this month, through its longtime IP counsel. It's an intent-to-use application, meaning Tesla is claiming the name for a product it hasn't launched yet. The goods-and-services description is unusually specific for a trademark. Megapod covers "modular data center hardware systems for artificial intelligence computing, comprised of computer servers, computer hardware for artificial intelligence data processing, networking equipment, power distribution units, and cooling systems." It also covers "self-contained modular computing hardware systems for artificial intelligence workloads," integrated platforms sold as a single unit — an enclosure bundling compute, power distribution, and cooling — and downloadable software to monitor, manage, and optimize those systems. In plain terms: Tesla wants to sell a turnkey AI data center building block. Not a battery, not a chip on its own, but the full rack-and-room of servers, networking, power, and cooling that AI training and inference run on. Tesla's offering would have to compete with Nvidia's liquid-cooled, rack-scale systems that simulates a giant GPU, the article points out. But "The bigger issue is that Tesla has no merchant compute-hardware business to build on."Tesla's own AI training cluster, Cortex at Gigafactory Texas, runs on roughly 67,000 Nvidia H100-equivalent GPUs. In other words, Tesla is one of Nvidia's customers, not a competitor selling alternative hardware... Where Tesla does have a real AI-data-center business is power, not compute. Its Megapack and new Megablock energy storage products are selling into AI data centers as grid buffers — Musk's own xAI has bought roughly $1 billion of Megapacks to keep its training runs powered. That energy-storage strength is the one credible thread here. A Megapod that bundles Tesla's power electronics, thermal management, and the enclosure — the "shell" around the chips rather than the chips themselves — would at least sit adjacent to a business Tesla actually runs.
Read more of this story at Slashdot.
- UK Official Promises Statements 'Around VPNs' and Further Teen Restrictions on Chatbots and Social Media
PC Gamer reports:The UK government is considering an Australia-style ban on social media for under-16s, with Prime Minister Keir Starmer saying that the ban could take effect as soon as spring next year. As for the much nearer future, Science and Technology Secretary Liz Kendall told BBC Breakfast earlier this week, "We will make further statements in July about VPNs and further restrictions." To be clear, no specific restrictions have yet been announced and Kendall sounded somewhat cautious about an outright ban during a parliament debate that took place the same day. "I have commissioned further research about their usage. There are really important issues to balance here," she says. "Many people want to use VPNs for privacy — that is important — but we know that some children use them to get around restrictions. I will come back to that in July in our response to the consultation." So, we'll have to wait until next month for anything definite, but it's hard not to feel like a full ban on VPNs is already on the table. If that does come to pass, more than the contents of my Bluesky inbox will be at stake. Utah in the US has already tried to implement a full VPN ban (though this was postponed until September after Aylo, the parent company of Pornhub, challenged the law in court)... [T]he UK could just be the next domino after Utah, potentially setting off a chain reaction that affects users around the world. The article also argues that age checks can also be a privacy nightmare "with the security breach that exposed the personal info of 70,000 Discord users last year being one case in point." Here's the complete statement from UK Technology Secretary Kendall. "I'll come back in July with a further statement around VPNs but also additional measures that we want to look at, further restrictions on AI chatbots that parents have found very worrying, more about overnight curfews or breaks in doomscrolling for 16- and 17-year-olds."
Read more of this story at Slashdot.
- Cops Keep Getting Arrested for Using Flock's Cameras to Stalk People
404 Media remembers how a Florida police office looked up his ex-girlfriend's license plate in the Flock automated license plate reader system at least 69 times in 2024 — even searching for her mom's license plate at least 24 times. The police office was charged with stalking and hacking-related offenses, serving one day in prison with five years of probation — but his case "was not a one-off." [Alternate link via Bruce Schneier] Local news reports from around the country repeatedly detail police abusing the Flock surveillance system in order to stalk their partners or ex-partners. The contours of each story are much the same, with the police officer in question using their access to the system to repeatedly track a specific person over the course of weeks or months. The cases highlight the fact that Flock can be used to track the whereabouts of individual people, that police do not get a warrant in order to use the system, and that, if they have access to the system, they have the technical ability to look up any license plate they want for any reason they want. An April study by the civil rights group Institute for Justice found that at least 18 police officers have been caught around the country using Flock to stalk a romantic interest in the last few years; another database, called the ALPR Abuse Library, has documented 20 specific cases of "stalking/targeting" around the country. The known cases of police stalking are almost certainly a vast underreporting of the overall abuse, because they largely include only cases in which the behavior was so egregious that it led to police officers being fired, arrested, or both. Flock told 404 Media that it is "aware of 15 incidents of abuse, each surfaced because of the transparency and accountability features deliberately built into our platform.... There are also 140,000 monthly active users of Flock, so the relatively rare instances of abuse, while obviously wrong and awful, are exactly that — rare," a Flock spokesperson told 404 Media. [One in 10,000.] "Humans are fallible; unlike most tools society provide law enforcement, Flock ensures that in the instances when our technology is misused, the evidence used to hold responsible parties accountable, is right there in our system. We also encourage all our customers to have a usage policy, regular training, and to implement our Audit Assistance tool, which proactively flags unintended use...." But it is also the case that Flock has strenuously fought against lawsuits and potential regulations that are seeking to require police to get a warrant to use the system. And many cases of abuse have not been detected by police departments themselves but by those private citizens, journalists, and stalking victims who have found patterns of abuse in public records files they have obtained from their local police departments. In most cases of Flock-related stalking reviewed by 404 Media, the abuse occurred over the course of months or years, and the victims were subjected to dozens or hundreds of lookups. Other abuse cases have been discovered using the website HaveIBeenFlocked.com, a website that compiles Flock searches released via public records requests and turns them into a searchable database. Flock has repeatedly tried to get that website taken down, as we have previously reported.
Read more of this story at Slashdot.
- After Six Years Of Work and Over 360 Patches, Linux 7.2 Finally Removes Bug-Prone strncpy
Tech Times reports:Linux 7.2's merge window closed out a cleanup campaign on Friday that most kernel developers had stopped expecting to see end: the complete removal of strncpy(), a C string-copy function that the kernel's own documentation labels "actively dangerous," from every subsystem, driver, and architecture-specific file in the kernel source tree. The merge landed June 20, 2026. After around 362 commits spread across six years of incremental work, no call site using the function remained, and the function itself — including the last per-CPU-architecture optimized implementations — was struck from the source. The removal matters beyond housekeeping. strncpy() is a persistent source of a specific class of memory error: kernel buffers that contain sensitive data can leak bytes past an unterminated string boundary, a pattern that enables memory disclosure vulnerabilities. Eliminating the function from the tree removes that entire class from the kernel's attack surface — and, critically, makes strncpy() unavailable to any future contributor, turning a best-practice suggestion into an enforced policy. Phoronix notes it's replaced by five different functions:In place of strncpy, Linux kernel code should use strscpy() for NUL terminated destinations, strscpy_pad() for NUl-terminated destinations with zero-padding, strtomem_pad() for non-NUL-terminated fixed-width fields, memcpy_and_pad() for bounded copies with explicit padding, or memcpy() for known-length memory copies. "The reason five functions were needed," explains Tech Times, "is that different parts of the kernel were using strncpy() for five semantically distinct memory operations — each with a different intent, different termination requirement, and different padding behavior. "The original function obscured all of those differences under a single ambiguous name. The 362-commit campaign to replace it was, in effect, a codebase-wide audit that forced every call site to declare its actual intent in code That is an engineering outcome with lasting value: the kernel's string-handling semantics are now explicit where they were previously implicit, and future maintainers can read a function name and understand what a copy operation actually does.
Read more of this story at Slashdot.
- US Bill Would Mandate AI Chip Location Tracking to Thwart China and Other Adversaries
NBC News reports:A group of companies that specialize in tracking international shipments of sensitive technologies is backing a Capitol Hill bill that would require America's most powerful AI chips to incorporate stronger security mechanisms aimed at preventing the chips from reaching China and other adversaries. The letter, signed by six companies, says the Chip Security Act (CSA) would increase American chip companies' competitiveness and close key loopholes in the U.S. export control regime. The move clashes with claims from semiconductor lobbying groups that the requirements would constrain America's booming chip industry. Sent to congressional leadership Thursday morning and seen by NBC News, the dispatch instead argues that more robust security verification would assure chip customers and manufacturers that they are abiding by sensitive restrictions on chip sales. The companies argue that the boosted confidence will "lead to increased sales, faster export approvals, larger transactions, greater access to new markets, and more expansive chip deals." Despite U.S. export control laws banning sales of advanced AI chips to certain countries, including China, loopholes in current requirements have allowed billions of dollars' worth of America's best AI chips to be sold to entities in third-party countries that can then forward them to China. In just one case in March, the Justice Department charged three people with conspiring to forward $2.5 billion of AI chips to China. The CSA aims to address those loopholes, mandating that chip exporters better track where advanced chips are sent, via either bespoke location-verification hardware or software that can run on existing hardware. That, bill proponents claim, would ensure that sensitive chips could be sold to countries like Malaysia or Indonesia without fear of further transfer to China... Experts say that because chips perform the advanced computations required for frontier AI systems, cutting off access to the chips is crucial to prevent geopolitical rivals from using AI systems for military or economic purposes.
Read more of this story at Slashdot.
- The Rust Ecosystem Gets an AI Security Engineer in Residence
While the Rust Foundation has a Security Initiative to protect its ecosystem, "the threats have expanded," they announced this week, "and so has the kind of help maintainers need."Much of this comes back to a single shift: Automated tooling (much of it now built on large language models) has gotten good enough to surface real vulnerabilities in open source code quickly and at scale. That is useful, and several large Rust projects have already received and fixed credible issues found this way. The same tooling has also made it trivial to generate vulnerability reports that look plausible and are worthless. Maintainers across the ecosystem are losing real hours sorting these from the reports that matter, and the noise tends to bury the signal. So, with funding from the Alpha-Omega Project, the Rust Foundation is bringing on a full-time AI Security Engineer in Residence dedicated to the Rust ecosystem. This position is being funded with part of the $12.5M in open source security funding that the Linux Foundation announced in March.The role exists to take pressure off maintainers. The person in this position will use a mix of human-led and AI-assisted methods to proactively review Rust itself and the crates the ecosystem leans on most and help us separate real, exploitable issues from false positives and low-signal noise before anything reaches a maintainer... This role will run full-time for six months to start, with room to extend depending on what we learn and the funding available. Methods, playbooks, and prompts will be documented so the work doesn't end with the contract. We are grateful that Rust is not embarking on this work in isolation. Several other ecosystems have received parallel Alpha-Omega grants for the same kind of work (e.g., the PHP Foundation and the Drupal Association) and we plan to share tooling, triage practices, and what we learn rather than duplicating work A statement from Rust's new AI Security Engineer in Residence acknowledges that "One of our next challenges is the wave of bugs discovered by the next generation of AI-powered developer tools."
Read more of this story at Slashdot.
- Canonical's Upcoming AI Tool: Talk to Ubuntu Instead of Typing
This week the Ubuntu desktop's director of engineering announced they're bringing speech-to-text dictation to Ubuntu Desktop, aiming for an experience "that feels like a natural part of the desktop while respecting user privacy and running entirely on local hardware." "Speech recognition has become a common feature on modern platforms, and we think it should be a first-class experience on Ubuntu Desktop as well." More details from the blog It's FOSS:For Ubuntu 26.10, the initial version of Myna is expected to be a desktop dictation tool built around GNOME on Wayland with a push-to-talk mechanism gatekeeping when your microphone accepts input. Using it means holding a hotkey, speaking, and letting go. A small activity indicator shows while it is listening, and the transcribed text lands wherever the cursor was sitting when dictation started. Recognition itself happens inside a sandboxed component called the Canonical Inference Snap, while a Speech Orchestrator manages the session and an Audio Adapter handles whatever the microphone picks up, denoising and chunking it before it ever reaches the model... Speech recognition will happen locally, and an internet connection is not needed once the appropriate model is installed... The audio data won't be sticking around either, being stored in a small in-memory buffer that gets discarded the moment the session ends. Features like dictation into password fields, wake words, continuous listening, voice assistants, voice commands, translation, speaker identification, and automatic language detection are all off the table... You should also know that Canonical is looking for feedback before the specs for Myna are finalized, especially from people who already rely on dictation or assistive tools on Linux.
Read more of this story at Slashdot.
- New Super PAC Aims to Rally Tech Workers to Help Limit AI: 'the Guardrails Alliance'
"A grassroots movement is forming among everyday tech workers who are demanding their companies develop and deploy AI responsibly," reports TechCrunch. Hoping to leverage that discontent is a new super PAC called the Guardrails Alliance. The New York Times reports that it launched Thursday with backers that included tech employees and labor unions:Guardrails positions itself as a populist political movement that runs on small donations from people in the trenches of the AI boom. The PAC has about $5 million at its disposal today and planGuardrails will buy ads to support Alex Bores, a New York congressional candidate who became Leading the Future's first target and is running in the primaries next week. s to raise $15 million this cycle — small potatoes compared to deep-pocketed adversaries like Leading the Future, which has more than $100 million from tech leaders like OpenAI president Greg Brockman... "This is not about matching [Leading the Future] dollar for dollar," [said the super PAC's co-founder, political operative Shaunna Thomas]. "What this vehicle is meant to do is be a political home for people who are concerned about the way the anti-regulation AI tech sector is trying to manipulate elections." Meanwhile a former Netflix and Warner Bros. executive has launched the Alliance for Responsible Innovation in the Arts & Media, reports Variety, calling it an AI-focused content coalition that says it's dedicated to supporting "responsible and sustainable AI innovation and the importance of human creativity."The initial members of the coalition, announced Monday, include Disney, the New York Times, Adobe, Condé Nast, the Financial Times, ITV, Advance, BBC, Cambridge University Press & Assessment, U.K. publisher Reach and Wiley. Many of the coalition's members have either struck deals with AI companies or are developing their own AI tools... The group plans to argue for legal and policy guardrails around AI's usage, with its funding directed towards analyses, tools and services focused on advancing those initiatives... One of the group's launch advisers is Damian Collins, OBE, who previously served as the U.K. Parliamentary Under-Secretary of State in the Department for Science, Innovation and Technology under prime ministers Boris Johnson and Liz Truss. "Using AI to break the law can never be an acceptable excuse," he said in a statement. "Laws around personal safety, intellectual property and financial crime still apply in the age of AI. This is why ARIAM has been created and why I'm proud to working with this necessary initiative."
Read more of this story at Slashdot.
- Facial Recognition on Public Buses? Kansas City Says Yes
An anonymous reader shared this report from the Associated Press:Officials in Kansas City, Missouri, are preparing to equip cameras on some public buses with facial recognition software capable of identifying passengers who appear on a list of banned riders or missing persons. Supporters and opponents alike view the effort as a major litmus test for tapping the AI-powered software on a U.S. public transportation system, positioning Kansas City as the latest epicenter of a fierce debate over whether the safety benefits of artificial intelligence are worth the privacy costs. "The idea of running face recognition on a camera that is pointed on live spaces in public is a line that until recently has never really been crossed in the last 25 years," said Jay Stanley, senior policy analyst for the Project on Speech, Privacy and Technology at the American Civil Liberties Union. The state of Missouri declined to help fund the project as expected due to concerns with the facial recognition component. Still, the city is pushing ahead with local and federal money, said Tyler Means, chief mobility and strategy officer at the Kansas City Transportation Authority. "Privacy is always a tricky thing," Means said. "We've always had cameras on our buses. It's just new technology. I think in time it'll smooth over and people will realize, 'Well, it didn't really feel any different'...." Images captured by cameras aboard the buses would immediately be checked against any active alerts, generated when a missing person, banned rider or someone on a law enforcement watch list designated by the transportation authority is identified... After the buses return to the depot, the transportation authority would archive the regular video footage on a local server for up to five years. The company partnering with Kansas City to run the cameras "started using live facial recognition years ago to alert nursing homes when residents left the building," according to the article, and then "brought the technology to correctional institutions and schools." But this is its first attempt at bringing its cameras onto public transportation. The article also includes this quote from Will Owen, communications director for the Surveillance Technology Oversight Project. "City residents should not be guinea pigs for transit systems to test Silicon Valley's latest unproven, biased surveillance tech."
Read more of this story at Slashdot.
- Polymarket Paid Dozens to Post Videos of Themselves 'Winning' With Fake Bets
In January a college student posted a video showing him winning $100,000 on Polymarket — one of 145 that appeared to show bets adding up to almost $410,000, reports the Wall Street Journal. "But none of those bets were real." Instead its creator was "one of dozens of mostly college-age creators Polymarket paid to film themselves making fake trades and sometimes scoring fake wins," the Journal reports, citing interviews with the creators an an analysis of more than 1,100 of their videos:Polymarket built near-perfect copies of its website, then instructed creators to make simulated trades on those dummy sites and hide that they were being paid by Polymarket. To get the videos to go viral, Polymarket has recruited a social-media army to copy and re-post creators' footage. Though the New York-based company has been banned from offering its primary crypto platform in the U.S. since 2022, the social-media creators are paid to specifically target U.S. users, who can still access the site with a virtual private network... Polymarket hired and worked closely with a marketing contractor to promote the site. In a message reviewed by the Journal, that contractor told its social-media army to repost content made by 10 Polymarket creators in particular... These creators didn't initially identify themselves as paid by Polymarket, although one offered a $20 bonus code in his social-media bio... The company instructed creators not to disclose they are paid, according to creators who have worked with the company. They said the pay often added up to $2,000 to $3,000 a month... A handful of videos the Journal reviewed also contained short glimpses of URLs indicating the sites were test environments for Polymarket engineers... Creators said they send the finished videos to Polymarket for review. If a video isn't engaging enough, or if it bears obvious signs of being faked, Polymarket will ask for the videos to be reshot, the creators said... Polymarket sends creators bullet-point guidance on what to say, according to creators who have worked with the company and a recruiting website... Polymarket's viral clipping campaign racked up more than 140 million views on TikTok, YouTube and Instagram, according to the analytics provider Tubular... Internal materials show that Polymarket and Virality promote videos showing how easy it is to conduct insider trades on the platform. Polymarket has paid clippers to promote at least 19 videos discussing opportunities to use inside information or other tactics to manipulate markets. America's advertising laws "require people who are paid to endorse a product to disclose their ties," the article notes, "although there is some gray area about what's permitted." (After the Journal's investigation, the creators started adding "@polymarket partner" to their bios, the article points out._ And when asked for a comment, Polymarket "said it plans to conduct a comprehensive audit of active promotional content."
Read more of this story at Slashdot.
- Gamers Sue PlayStation: It's Not Clear They're Selling Licenses Rather Than Ownership of Games
The gaming news site Aftermath reports:Four gamers are suing Sony Interactive Entertainment for allegedly breaking a California law that requires digital storefronts selling games to make it clear people are buying licenses, not actually owning the games. Sony Interactive Entertainment's PlayStation store uses language like "Buy Now" and "Confirm Purchase," lawyers wrote in a complaint filed on Thursday... "In reality, consumers who 'purchase' digital games through PlayStation do not obtain ownership of those products," lawyers wrote. "Instead, PlayStation grants only a limited, revocable license to access the software, subject to multiple restrictions contained in a separate Software Product License Agreement".... [T]he PlayStation store does have a disclosure. Above the "Confirm Purchase" button, there's a note: "By selecting [Confirm Purchase], you agree to complete the purchase in accordance with the PlayStation Terms of Service before using this content. You further acknowledge that your purchase of this digital product amounts to a license subject to the Software Product License Agreement." These four gamers aren't satisfied with that; they said in the complaint that it's too small, and that "a reasonable customer completing a purchase would not necessarily notice this disclosure." "It's a proposed class action complaint, meaning the group of four gamers is asking a judge to grant them class action status."
Read more of this story at Slashdot.
- How Millions of Digital Home Devices Are Secretly Powering Cyberattacks
The Wall Street Journal reports on internet-connected devices — and how every year millions of them "can contain a secret digital backdoor that opens up access to your home internet, so that anyone... can surf the web as if they were you." (And this is especially true for "knockoffs that you buy online"...) In a video report this week they tested two digital picture frames from Amazon and three streaming devices from Walmart "because we heard that they often ship with backdoor software used in cyberattacks. Security experts believe manufacturers are being paid to add this malware, but many people also get tricked into downloading the software onto their phones or computers... Within minutes of turning the devices on, there was a surge of internet traffic... Visits to gambling, porn, cryptocurrency and loads of other sketchy web sites started pouring in from users around the world." (And remote visitors also tried to access Outlook and Gmail accounts...) Residential proxy companies even rent out access to "tens of millions of home networks around the world," according to the report. "But the problem is actually worse than that. Hackers figured out a way to seize control of these backdoors, and they started taking over these residential networks. Last month authorities arrested a 23-year-old Ottawa man, saying he'd taken control of more than a million devices to launch some of the largest cyberattacks anyone had ever seen.." After a couple months the Journal's reporter collected logs of all the traffic, and sent it to an investigator at Comcast, who said both were conducting DDoS attacks. But estimate for the number of infected devices are as low as tens of millions or as high 500 million-plus. "We've seen nation state attacks launched through these kind of endpoints, which means your device sitting in your house is part of a nation state attack against another nation state... We've seen ad fraud, we've seen ticket scalping, we've seen financial fraud." But more importantly, "We have seen some of the largest computer attacks — meaning computers attacking other computers at human request — ever recorded in our digital history in the last several months." At cybersecurity conferences, some are warning "there are much larger ones on the horizon if we don't get a hold of this problem." The company making the picture frame "couldn't be reached for comment," while Amazon said it's been out of stock since last year. Both Amazon and Walmart said they take action when they confirm malware on a third-party product.
Read more of this story at Slashdot.
- OpenAI Announces Benchmarks for AI Life Sciences Research. Its Best Model Failed 63.9% of the Test
This week OpenAI announced a 750-task test to to measure "whether AI systems can support realistic life science research tasks, not just answer biology questions." But while OpenAI's top-performing GPT-Rosalind model led the rankings, Slashdot reader BrianFagioli notes that "it achieved a pass rate of just 36.1 percent, failing nearly two-thirds of benchmark tasks." Nerds.xyz points out that means "the best-performing model failed nearly two-thirds of the benchmark's tasks."The benchmark also revealed a familiar weakness. AI systems generally perform better when everything is presented as text. Once they are forced to work with supporting documents, figures, or complex datasets, performance drops noticeably. GPT-Rosalind's pass rate fell from 45.1 percent on text-only tasks to 28.1 percent on tasks involving artifacts or URLs. To be fair, the benchmark is not intended to suggest AI is useless in research. Quite the opposite. OpenAI found that models are becoming increasingly capable of scientific communication, evidence synthesis, and translating research findings into practical explanations. Those are valuable skills, particularly for researchers drowning in information. But LifeSciBench serves as a useful reminder that today's AI systems are still far from autonomous scientists. They can help. They can assist. They can sometimes provide surprisingly useful insights. What they cannot reliably do, however, is replace the expertise, judgment, and skepticism that real scientific research requires.
Read more of this story at Slashdot.
- Remembering When Alan Turing Developed a Portable Voice Encryption Device
Long-time Slashdot reader smooth wombat writes: Alan Turing, one of the more famous people who worked at Bletchley Park to decipher the German Enigma coding machine, was also working on a separate project. His private papers, known as the Bayley papers for his assistant Donald Bayley who held onto the papers until his death in 2020, reveal Turning had produced a working model of a portable voice encryption device. He even demonstrated it by using a Winston Churchill speech recording. "Weighing just 39 kg, including its power pack," Jack Copeland wrote in an article for IEEE Spectrum, "Delilah would be at home in a truck, a trench, or a large backpack." More from Popular Mechanics:Turingâ(TM)s work at Bletchley Park actually informed the Delilah experimentation he was doing at Hanslope Park, and not just because he used Red Forms, the Army-issue sheets Hanslope staffers were meant to use to alert Bletchley staffers to enemy signals, as his personal scrap paper for Delilah experiments. He drew inspiration from one of the German cipher machines they had decoded at Bletchley; not the famed Enigma machine, but rather the SZ42. While the former relied on Morse Code, the latter utilized a 5-bit telegraph code, which Copeland notes âoewas a forerunner of ASCII and Unicode and is still used by some ham radio operators.â The SZ42 produced an obscuring key of telegraph characters, with an identical key produced to both the sender and receiver. If it could be done for text, Turing reasoned it could be done for sound as well... [T]he reason Delilah fell to the wayside of history isnâ(TM)t because it was a failure, but rather because it simply wasnâ(TM)t needed anymore. By the time Turing had built and demonstrated his device, the war was over. What good was a portable voice encryptor if you had no major enemies trying to intercept your calls, the government reasoned. So funding for the project stopped, and Turingâ(TM)s two-year experiment ended with a whimper. Turingâ(TM)s time as an electrical engineer at Hanslope Park became a footnote in his story, if even that.
Read more of this story at Slashdot.
- Security: Why Linux Is Better Than Windows Or Mac OS
Linux is a free and open source operating system that was released in 1991 developed and released by Linus Torvalds. Since its release it has reached a user base that is greatly widespread worldwide. Linux users swear by the reliability and freedom that this operating system offers, especially when compared to its counterparts, windows and [0]
- Essential Software That Are Not Available On Linux OS
An operating system is essentially the most important component in a computer. It manages the different hardware and software components of a computer in the most effective way. There are different types of operating system and everything comes with their own set of programs and software. You cannot expect a Linux program to have all [0]
- Things You Never Knew About Your Operating System
The advent of computers has brought about a revolution in our daily life. From computers that were so huge to fit in a room, we have come a very long way to desktops and even palmtops. These machines have become our virtual lockers, and a life without these network machines have become unimaginable. Sending mails, [0]
- How To Fully Optimize Your Operating System
Computers and systems are tricky and complicated. If you lack a thorough knowledge or even basic knowledge of computers, you will often find yourself in a bind. You must understand that something as complicated as a computer requires constant care and constant cleaning up of junk files. Unless you put in the time to configure [0]
- The Top Problems With Major Operating Systems
There is no such system which does not give you any problems. Even if the system and the operating system of your system is easy to understand, there will be some times when certain problems will arise. Most of these problems are easy to handle and easy to get rid of. But you must be [0]
- 8 Benefits Of Linux OS
Linux is a small and a fast-growing operating system. However, we can’t term it as software yet. As discussed in the article about what can a Linux OS do Linux is a kernel. Now, kernels are used for software and programs. These kernels are used by the computer and can be used with various third-party software [0]
- Things Linux OS Can Do That Other OS Cant
What Is Linux OS? Linux, similar to U-bix is an operating system which can be used for various computers, hand held devices, embedded devices, etc. The reason why Linux operated system is preferred by many, is because it is easy to use and re-use. Linux based operating system is technically not an Operating System. Operating [0]
- Packagekit Interview
Packagekit aims to make the management of applications in the Linux and GNU systems. The main objective to remove the pains it takes to create a system. Along with this in an interview, Richard Hughes, the developer of Packagekit said that he aims to make the Linux systems just as powerful as the Windows or [0]
- What’s New in Ubuntu?
What Is Ubuntu? Ubuntu is open source software. It is useful for Linux based computers. The software is marketed by the Canonical Ltd., Ubuntu community. Ubuntu was first released in late October in 2004. The Ubuntu program uses Java, Python, C, C++ and C# programming languages. What Is New? The version 17.04 is now available here [0]
- Ext3 Reiserfs Xfs In Windows With Regards To Colinux
The problem with Windows is that there are various limitations to the computer and there is only so much you can do with it. You can access the Ext3 Reiserfs Xfs by using the coLinux tool. Download the tool from the official site or from the sourceforge site. Edit the connection to “TAP Win32 Adapter [0]
- A tale of two path separators
In macOS, you can apparently create files and directories in the Finder with names that include slashes. If you then go into the terminal and take a look with ls, youll see that the slashes are actually colons. I don’t understand all the nuances, but I know this is a side-effect of the fact that macOS has not one but`two`path separators: the slash (/) and the colon (:). The two separators are used in different contexts, and the system will translate between them as needed. These two separators reflect the two parent systems of modern macOS:`classic Mac OS`and the`Unix-like NeXTSTEP. When they were joined together, Apple’s engineers had to build a file system that was compatible with both the classic Mac’s file system (the Mac OS Extended File System, aka HFS+), and with NeXTSTEP’s file system (the Unix file system, aka UFS). Among other differences, these systems had different path separators: HFS+ used a colon, while UFS used a slash. ↫ Alex Chan (article from 2021) I had no idea macOS worked this way, but it makes sense considering the platforms dual history. Whats interesting is that when Apple moved to APFS almost a decade ago, this duality in path separators remained, most likely for backwards compatibility reasons. In a sense, this is somewhat similar to Windows supporting both backward and forward slashes, with the former being a leftover from DOS, and the latter an addition (to Windows) from the UNIX world. None of that beats Windows when using the Japanese or Korean locale, though. Because Japanese and Korean Windows use different codepages than Windows in the Americas and Western Europe, these versions of Windows render the backslash as the yen sign (¥) and and won (₩) sign respectively. As such, something like the Program Files directory actually renders like C:¥Program Files¥ and C:₩Program Files₩. Similar issues occurred in other Windows locales as well, but the impact of this in Japan and South Korea were so widespread that people just expect it to be that way, even if its easily fixed today. I cant find if Windows 11 still uses ¥/₩ in Japan/South Korea, since the last references of it I can quickly uncover all point to Windows 10.
- Apple internals: Swift in the kernel
Apples Swift has become the de-facto language for Apples own developers for a while now, and it seems that with the new operating system releases from the company unveiled during WWDC, Switch is now also being used in the kernel. Naturally I dropped what I was doing and went grepping through the iOS 27 kernelcache. Alas, nothing came of it. All is not lost though: I found the Embedded Swift runtime in macOS 27, sitting in`com.apple.kec.pthread`of all places. Then I went poking around the root filesystem and it turns out Apple gave the whole effort a name: KernelKit. Lets dissect it. ↫ Josh Maine Its still quite limited at this time, which makes sense you dont want to be too crazy with the core of the operating system that runs on god knows how many PCs, smartphones, and other devices. Its also entirely contained within a few kexts as embedded runtimes, and the XNU kernel itself remains entirely C and C++.
- I stored a website in a favicon!
Every website has a favicon. Its that little icon in your browser tab. Usually you upload it once and then never think about it again. But. A favicon is just an image. An image is just pixels. And pixels are just bytes. So of course I wondered if I could store something inside one. ↫ Tim Wehrle I love it when people do something useless just for fun.
- What was nice about the UI of Windows 2000
I mean, this is preaching to the choir, but lets go anyway. I liked the UIs of the entire era from 3.0 to 2000, really. Im mostly using Windows 2000 as an example here because it runs so well in QEMU/KVM and that allows me to easily take screenshots. Some of the following will sound absolutely trivial, but I think its worth pointing out. ↫ movq.de blog Just a series of observations about how much better graphical user interfaces were back in the 90s and early 2000s. Weve lost so many affordances based on both common sense and scientific study, and what we ended up with is a confusing, inconsistent mess. It doesnt really matter where you look user interface design has deteriorated since the early 2000s, a decline that only accelerated thanks to the arrival of the iPhone, where consistency is a dirty word, and the web, where the advertising people took prominence over the design people. I just want my buttons to look like buttons man.
- To study how chips really work, MIT researchers built their own operating system
A fascinating novel approach by researchers at MIT, called Fractal, to study in-depth how processors actually work. A team at MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) decided to build something different. Fractal, an operating system kernel written from the ground up, treats the hardware itself as the object of study. Its first major use, a deep look at branch predictors — a CPU’s way of guessing what code to run next, before it knows for certain, so it doesn’t have to waste time waiting to find out — inside Apple’s M1 processor, has already turned up findings that prior work missed, including the first evidence that a class of speculative attack known as “Phantom” affects Apple Silicon. “We’re using hardware in ways it wasn’t designed for,” says Joseph Ravichandran, the MIT PhD student in electrical engineering and computer science (EECS) who led the project. “It’s not even obvious that this is a possible thing you could do with the hardware. But we found a way to pull all these different primitives off. It’s like a microscope. If you’ve got a hand magnifying glass, you can see a little bit. But if you had an electron microscope, now we’re really talking. That’s what Fractal is. The electron microscope of operating systems.” ↫ Rachel Gordon at MIT News While Fractal is small, its creators also added POSIX system calls, a C library, vim, GCC, a shell, and more. This way, it feels more familiar, and makes it easier for researchers to get started with the tool. Fractal is open source and hosted on GitHub, it has its own website, and theres a detailed research paper with more in-depth information.
- AmigaOS 2: the greatest upgrade
Five years after releasing the Amiga 1000, Commodore was about to launch the Amiga 3000, their first real high-end Amiga. With a 68030 processor, on-board SCSI and a slightly updated graphics chipset, all in a sleek desktop case, the Amiga was truly ready for the era of professional 32-bit computing. But Moores law wasnt the only thing thad had been pressuring Commodore since the release of the Amiga 1000: The desktop metaphor had matured even further, and the competition had been hard at work. IBM had launched OS/2, Windows 3.0 had turned Microsofts offering from a proof of concept into something actually usable, and new players had entered the scene among them NeXTStep, with its polished 3D look. It was time to bring AmigaOS, too, into the 1990s. ↫ Carl Svensson Its interesting theres a lot of focus on the first version of the Amiga operating system and the third one, but you dont hear a lot about AmigaOS 2.x. It turns out this is rather odd, because as Svensson details, this version came with an absolute ton of changes and improvements, from an entirely new widget toolkit to a brand new file system, and so much more. The new widget toolkit and accompanying style guide also ensured that the operating system looked, felt, and behaved consistently. Remember when we cared about that? Theres so much more cool features, though, like command history, line editing, universal clipboard support and more just for the CLI, as well as something called Commodities. These were tiny little programs managed from a central location, which didnt even need a GUI to work. Commodities included by default were things like ClickToFront, a focus-follows-mouse option, and more. Oh and of course, BASIC was replaced by ARexx. The list just keeps going, and you should really read Svenssons article.
- Oracle Solaris 11.4 SRU93 released
Oracle is sticking to its promise of more regular Solaris updates with the release of Oracle Solaris 11.4 SRU93. This release, like other SRU releases, is for paying Solaris customers, as the CBE releases for enthusiasts are on a different cadence. With Solaris focus being on enterprise server environments, it should come as no surprise that most of the changes and improvements are focused on things like enterprise networking and security, such as changes to how policy settings for the Kernel Crypto Framework (KCF) are stored, moving from using RPC over sockets instead of STREAMS, and more. Of course, theres also the long list of updated open source packages. SRU 93.221.2 updates a broad set of platform, runtime, developer, networking, desktop, and open source components. Notable updates include Apache Tomcat to 9.0.116, bash to 5.3 patch 9, BIND to 9.20.18 and 9.20.21, Django 4.2 to 4.2.30, Django 5.2 to 5.2.13, Firefox to 140.8.0esr, Golang to 1.25.8, Node.js 20 to 20.20.2, Node.js 22 to 22.22.2, Node.js 24 to 24.14.1, NSS to 3.119.1, Perl to 5.42, Python 3.11 to 3.11.15, Python 3.13 to 3.13.12, RabbitMQ to 4.2.4, Thunderbird to 140.8.0esr, vim to 9.2.0340, and zlib to 1.3.2. Additional updates include development tools, Python modules, X11 utilities, printing components, libraries, cryptographic packages, networking tools, and desktop-related packages. ↫ Colin Kavanagh at the Oracle Solaris Blog Existing Oracle Solaris customers can update to the new release through pkg update.
- Android 17 released for Pixel devices with very few interesting improvements
Yesterday, Google released Android 17 to Pixel devices, so late last night I updated my Pixel 10 Pro with the intent to write a news item about the release today. The reality is that that I totally forgot I even upgraded last night, because Android 17 is about the biggest nothingburger Ive ever seen. Virtually all of the new features listed in the upgrade blurb on my phone were AI! nonsense I dont encounter, so over the course of the day, I didnt really notice anything new about my phones operating system. The only interesting feature that I think will be particularly useful on tablets and perhaps foldable devices is something called App Bubbles!. Basically, you can turn any application into an overlay that can be minimised into a bubble, which then lives anywhere on your screen. Tap it, and you can maximise the overlay again. This little multitasking bubble can contain multiple applications, effectively making it a dock or taskbar. Neat, but I didnt see much use for it on my phone. The remainder of the new non- AI! features are hard to spot, at best. I guess the ability to turn one half of a foldable display into a gamepad is neat if you can deal with gaming on glass buttons (I cannot), and the changes to location access (you can now grant it for just one time) and contacts access (its more fine-grained and temporary now instead of granting access to everything forever) are welcome, but thats about it for user-facing features. Under the hood, the one thing that stands out is that Google is enforcing stricter memory limits for applications, based on how much RAM a device has. The idea is that this should prevent memory leaks from getting out of control and leading to crashes, which is nice, especially for devices with less RAM. Android 17 is available for Pixel devices now, and will probably find its way to non-Pixel devices over the coming months or years. With how little meat there is on Android 17s bones, this might be the first release where Androids update woes dont really matter.
- KDE Plasma 6.7 released
The KDE team released KDE Plasma 6.7 today, and with it comes a long list of improvements, new features, bug fixes, new old themes, and so much more. A new feature that is sure to please those among us who use virtual desktops: you can now have different virtual desktop setups per display. Its been a long-requested feature, so its great to see it makes its way to the KDE users. I despise virtual desktops, but Im happy to see something that I assumed was already part of KDE to finally actually become available. Another major feature in KDE Plasma 6.7 is something weve already talked about: the return of the classic Oxygen and Air themes from the KDE 4.x days. These themes have seen extensive work over the past year or so to make them usable on the latest KDE release, which includes tons of bug fixes, visual nips and tucks, and countless additions to the collection of assets required to make a modern KDE theme look complete. This includes a ton of new icons in the old styles, light and dark modes, accent colour support, and much more. Theres still work left here, including adding support for QtQuick/Kirigami applications which brings us to the next major new addition to KDE 6.7 This is also something weve already talked about: Union. I wont repeat what I already explained last time Union came up, but suffice it to say that Union effectively unifies the various different ways KDE applications are themed, allowing theme designers to use relatively standard CSS to create themes that cover every aspect of the KDE user experience. Before Union, theme designers had to create individual, unique themes for a variety of parts of KDE the Plasma desktop, QtWidgets using QStyle, QtQuick/Kirigami which was a ton of work, and in the case of QtQuick/Kirigami, wasnt really possible at all. As such, without Union, KDEs theming is essentially broken, and Union fixes that. For now, Union is not enabled by default, and must be installed and enabled separately for testing. Of course, theres a ton of other smaller new features, changes, and bug fixes as well. KDE Plasma 6.7 will find its way to your distribution soon enough.
- Apple adds keylogger to iOS App Store for targeted advertising: tied to your account and unencrypted
A week or so ago, Apple announced a bunch of features for the App Store on iOS, including personalised recommendations based on your activity and usage of iOS. It turns out this includes a keylogger (taplogger?) in the App Store, which records every single tap you make, every single letter you enter, and a lot of other information. All of this information is unencrypted and sent to Apple. Now Apple is putting the extensive identifiable analytics they collect in the App Store in action. They record every tap and there’s no way to turn it off. They can even calculate your typing speed. ↫ Michael Tsai, quoting Mysk The provided screenshots of the data collected are terrifying, especially because the data is unencrypted, sent to Apple, and fully tied to your user account. Apple clearly wants a slice of that big, juicy advertising pie, and they, too, are discovering that the easiest and best way to serve targeted ads is to collect as much data as they can about you. Of course, this is something the entire internet (but not OSNews!) and several megacorporations are built on by now, but Apple has been incredibly sanctimonious about how it supposedly actually cares about user privacy, making this keylogger yet another case of Apples hypocrisy on full display. Of course, if you care about privacy, youre entirely free to download your iOS applications from somewhere other than the App Store and install them yours0 Oh, wait.
- The time the Windows x86 emulator team found code so bad that they fixed it during emulation
Another story from the good old days from Raymond Chen. During an exchange of war stories, a colleague of mine told one from back in the days when Windows included a processor emulator for x86-32 on systems that natively ran some other processor. (This has happened many times. And no, I don’t know which processor this particular story applied to.) ↫ Raymond Chen at The Old New Thing So the core of the story comes down to this: All in all, it took this program 256 kilobytes of code to initialize 64 kilobytes of data. ↫ Raymond Chen at The Old New Thing The people working on Windows were so offended by this, they added code to the processor emulator just to fix this program.
- FreeBSD 15.1 released
Speaking of FreeBSD, the project released version 15.1 of their operating system today. As its a point release, its not full of massive changes, but it still brings the LinuxKPI-based wireless drivers up to Linux 7.0, support for the C23 version of the C has progressed considerably, Unicode has bene updated to version 17.0.0 and CLDR 48, and more.
- FreeBSD 15 with KDE and Wayland on a Laptop
Expect to see more and more articles like this one, as more and more people discover that FreeBSDs desktop/laptop support keeps improving rapidly. FreeBSD 15 really feels like a breakthrough release. It’s always been my favorite operating system for servers, but with the arrival of`pkgbase, massive improvements to theLinuxKPI`drivers, and the launch of the`Laptop Support and Usability Project, it’s become my primary desktop, too. ↫ Cullum Smith Since Smith tried FreeBSD 14.0, theres now KDE Plasma 6.x, you can leave legacy X11 behind and use Wayland on FreeBSD now, and support for Intel Wi-Fi chips has greatly expanded. Apparently, battery life has improved as well, which is one of the hardest problems to solve for an operating system, especially with the wide variety of hardware combinations in the x86 world. The rest of Smiths article is a guide to setting up FreeBSD 15 with KDE and Wayland. Its quite detailed with a ton of low-level tuning and fiddling, accompanied by clear and concise explanation of what the changes do, which I really like. Definitely a bookmark for anyone who wants to try out FreeBSD with KDE.
- Zinnia: a modular 64-bit UNIX-like kernel written in Rust
Its been a while since weve had a new operating system project written in Rust, so lets look at Zinnia. The kernel is written in (almost) 100% Rust and attempts to avoid unsafe code where possible. It implements a big range of POSIX APIs in system calls, but also exposes common extensions found in Linux and BSDs, like epoll and timerfd. This allows it to run a somewhat modern desktop using Wayland and X11 sessions. Most drivers are implemented as modules. These are Rust ELF dylibs which get loaded and linked during boot from an initrd, similar to Linux systems. Zinnia can boot from any UEFI based system thanks to the Limine bootloader. ↫ Zinnia OS website At least Weston and Xfce can run on Zinnia, even on real hardware, which is quite an achievement. The project was started in 2024 as a learning endeavour, but quickly grew out of control, as these projects are wont to do. The codes open source.
- Haiku enables AVX512 support
Were a little deep into June already, but its only now that Haiku published its monthly progress report for May. Theres a bunch of fixes for drag-and-drop behaviour in Tracker, AVX512 support can now be enabled thanks to changes to the kernel’s FPU handling, some low-level changes were made for the Rust and Zig compilers, and further improvements were made to the boot process on the Raspberry Pi 5 (although a lot more work is needed on that front). Theres still no sixth beta since a few more blockers remain, but dont let that stop you from installing Haiku its stable enough as it is, sixth beta or no.
- Tribblix Milestone 40 for x86 released
Tribblix, the Illumos distribution focused on giving you a classic UNIX-style experience, has been updated with the release of Milestone 40. This version has some major component updates. Perl in now 5.42 instead of 5.34, and the default Python is now 3.13. The GCC suite is now version 14.2.0, go is version 1.26, Xfce has been updated to version 4.18, node is v22, with v24 added and v20 removed. ↫ Tribblix M40 release notes Theres a more detailed changelog, as well as the downloads page to get started. If youre already running Tribblix, you can update in-place, of course.
- The Growth of Vulnerability Management: The Rise of Agentic AI Pentesting
by Malana VanTyler
Cybersecurity shifts fast. Manual penetration tests remain valuable, especially for nuanced attack paths and business-logic issues, but they are expensive, point-in-time, and difficult to run continuously. By the time a report is delivered, the environment may have already changed. Automated scanners improved coverage and frequency, but most still rely on known signatures, templated checks, and shallow validation. They can find obvious issues, but they rarely match the adaptive reasoning, chaining, and persistence of a skilled attacker.Platforms like XBOW help security teams move toward continuous validation by running AI-driven tests that mimic large-scale human attackers. This shift moves the focus from periodic assessment and reactive patching toward ongoing exposure management and earlier prevention.
From Automation to Agency
To appreciate the value of these modern platforms, it’s important to separate traditional automation from what is called “agentic” AI. Earlier AI pentesting tools mostly worked like advanced “if-then” systems, running preset scripts and looking for known patterns. While useful to automate some tasks pentesters perform, these tools lack the ability to pivot.
If a standard tool hits a non-standard login portal, it generally stops. An agent platform, however, can identify and adapt to the obstacle, reason through potential bypasses, and attempt alternative tactics.
This core differentiator is the “agent,” a specialized model capable of goal-oriented planning. These platforms employ real-time attack path analysis tools. They identify a low-severity vulnerability and assess whether it could be exploited to gain access
to a high-value asset. This approach imitates how an advanced attacker moves laterally within a system. The result is a clearer and more realistic view of the organization’s real risk compared to just listing bugs in a spreadsheet without context.
Comparing Methodologies: Strategy and Execution
When comparing platforms in this area, the industry is shifting focus from just ticking off features to demonstrating how effectively those features can be used. Modern platforms, including XBOW, focus on high-fidelity testing that avoids disrupting production environments while still proving that a vulnerability is reachable.
Three main architectural approaches have emerged as standouts:
Go to Full Article
- Linux Kernel 7.1 Officially Released with New NTFS Driver, Intel FRED, and Major Code Cleanup
by George Whittaker
The Linux kernel development team has officially released Linux Kernel 7.1, marking the first major update in the 7.x series. Announced by Linus Torvalds on June 14, 2026, the release introduces a mix of new features, hardware improvements, filesystem enhancements, and large-scale code cleanup efforts that continue modernizing the Linux platform.
While Linux 7.1 is not a long-term support (LTS) release, it delivers several significant changes that will eventually make their way into many Linux distributions over the coming months.
A Brand-New NTFS Driver Arrives
One of the most significant additions in Linux 7.1 is a completely rewritten in-kernel NTFS filesystem driver.
The new implementation has reportedly been under development for several years and replaces older code with a modern design built around Linux’s current storage infrastructure. The driver utilizes technologies such as iomap and folios, which improve efficiency and simplify future maintenance.
Benefits include:
Improved NTFS write performance Better handling of large files More modern filesystem architecture Easier future development and maintenance
For users who regularly exchange data between Linux and Windows systems, this is one of the most important improvements in the release.
Intel FRED Enabled by Default
Linux 7.1 also enables Intel Flexible Return and Event Delivery (FRED) by default on supported hardware.
FRED is a newer CPU mechanism designed to improve how processors handle interrupts and exceptions. By replacing older methods with a more streamlined approach, FRED aims to improve performance and reduce complexity in low-level CPU operations.
The feature primarily benefits newer Intel platforms, including upcoming processor generations.
Graphics Drivers Continue to Improve
Graphics support remains a major focus of kernel development, and Linux 7.1 delivers additional improvements for both Intel and AMD hardware.
Highlights include:
Performance enhancements for Intel Arc GPUs Continued work on Intel Battlemage graphics Updates for AMD Radeon hardware Expanded GPU reliability monitoring infrastructure through DRM-RAS support
These updates help improve gaming, desktop performance, and workstation workloads across modern Linux systems.
Steam Deck OLED Audio Fixes Land Upstream
Linux gamers receive a welcome improvement in this release as audio support fixes for the Steam Deck OLED have finally been merged into the mainline kernel.
Go to Full Article
- Canonical Launches ARM Laptop Certification Program to Boost Ubuntu’s Next Generation of Mobile Computing
by George Whittaker
Canonical is expanding its hardware certification efforts with a new focus on ARM-powered laptops, a move that reflects the growing momentum behind ARM architecture in the personal computing market. As ARM processors become increasingly common in laptops thanks to their impressive balance of performance, battery life, and efficiency, Canonical aims to ensure that Ubuntu users receive a seamless experience on this emerging class of hardware.
The initiative represents another step in Ubuntu’s long-standing effort to provide reliable Linux support across a wide range of devices while strengthening relationships with hardware manufacturers.
Why ARM Laptops Matter More Than Ever
For years, x86 processors from Intel and AMD dominated the laptop market. However, the landscape has changed significantly as ARM-based systems have become more powerful and capable.
Modern ARM laptops offer several advantages:
Longer battery life Lower power consumption Reduced heat output Always-on connectivity capabilities Competitive performance for everyday workloads
As manufacturers increasingly invest in ARM hardware, Linux distributions face growing pressure to ensure compatibility matches what users expect from traditional x86 systems. Canonical has already spent years supporting ARM across cloud, server, IoT, and embedded environments, making laptops a natural next step.
What the Certification Program Does
The new certification effort builds upon Canonical’s existing Ubuntu Certified Hardware program, which validates systems through extensive testing covering both hardware and operating system functionality. Certified devices undergo comprehensive verification to ensure Ubuntu operates correctly across critical components and daily workflows.
Testing typically includes:
Wireless networking Audio functionality Graphics performance Bluetooth support USB device compatibility Power management Suspend and resume behavior Firmware integration Security features such as TPM support
The goal is to eliminate the uncertainty that Linux users sometimes face when purchasing new hardware.
Creating a Better Ubuntu Experience on ARM
Historically, Linux support on ARM laptops has varied significantly between devices. Some systems work exceptionally well, while others require manual configuration, custom kernels, or vendor-specific patches.
Go to Full Article
- Btrfs Snapshot Deletion Gets Faster as Developers Tackle One of the Filesystem’s Biggest Pain Points
by George Whittaker
The Btrfs filesystem continues to receive significant performance tuning, and one of the latest areas of focus is snapshot deletion performance. While Btrfs snapshots have long been praised for their speed, flexibility, and efficient use of storage, deleting large numbers of snapshots has historically been one of the filesystem’s most resource-intensive operations.
Recent kernel development efforts are helping address that problem by improving metadata handling, reducing lock contention, and streamlining internal cleanup processes. The result is faster snapshot removal and less disruption on systems that rely heavily on snapshots for backups, rollbacks, and system recovery.
Why Snapshot Deletion Has Been Challenging
Btrfs is a copy-on-write (CoW) filesystem that stores data and metadata in a highly interconnected structure. This design enables many advanced features, including:
Instant snapshots Subvolumes Checksumming Compression Efficient data sharing between snapshots
However, the same architecture that makes snapshots so efficient to create can make them more complex to remove. When a snapshot is deleted, Btrfs must determine which blocks are still referenced by other snapshots and which can be safely reclaimed. On systems with many snapshots, this process can generate significant metadata activity.
Recent Performance Improvements
Developers have been working to reduce overhead associated with Btrfs metadata operations, which directly impacts snapshot cleanup performance.
Recent kernel updates include:
Reduced lock contention during extent tree operations More efficient extent buffer traversal Improved handling of internal filesystem structures Reduced contention during metadata searches General transaction and cleanup optimizations
These changes help the filesystem spend less time waiting on internal locks and more time performing actual cleanup work.
Less Impact During Cleanup Operations
One common complaint among Btrfs users has been elevated I/O activity during large snapshot deletion jobs.
On systems that maintain dozens, or even hundreds, of snapshots, cleanup operations could temporarily increase:
Disk activity CPU usage I/O wait times Metadata processing workloads
Recent improvements are designed to make these operations less disruptive by reducing bottlenecks inside the filesystem's metadata management code.
For users running backup servers, NAS appliances, or snapshot-heavy desktop systems, these optimizations can improve overall responsiveness while cleanup tasks run in the background.
Go to Full Article
- How Digital Software Is Powering Innovation in Modern Product Design
by Will Jones
By enabling digitized production design, this digital software is freeing up businesses and individuals across numerous industries to work smarter, not harder.
To design a new product or tool is often a lengthy, labor-intensive process. Even the most successful and streamlined physical design process is intensive and iterative by nature; it is the process of taking something that begins as little more than an idea and turning it into reality. Inherently, that is going to take a great deal of translation, as well as trial and error. When working with real-world, physical elements, this also makes for a costly endeavor, as each new trial effort may prove essential to the long-term success of the design, but still has adverse financial effects. Dassault Systèmes offers CAD software to help businesses stay on top of advancements in their industries.
Before digital design software became widely adopted, engineers and designers often relied heavily on hand-drawn technical sketches and manual drafting methods during product development. Revising a design could require redrawing entire sections of a project, making the process both time-consuming and resource-intensive. Modern digital design systems have significantly changed these workflows by allowing teams to make rapid adjustments, automate calculations, and store detailed design information within a single platform. This shift has contributed to the broader adoption of digital tools across industries seeking more streamlined development processes.
Fortunately, though, in this new world of ever-advancing technological tools, the design process doesn’t have to be fraught with issues and obstacles anymore, thanks to systems such as CAD software. This new software is now enabling businesses to design smarter, faster, and more accurately by digitizing product development processes and improving collaboration across engineering and manufacturing teams.
Digital Design as the Foundation of Innovation
Digital software allows engineers to create precise digital models that can then serve as the foundation for product development. Compare this to the physical alternative, which has long been a well-thought-out sketch of the product in question. Even the most comprehensive of sketches is only going to be dealing with two dimensions, and is likely to leave room for confusion or error based on the interpretation of the subjective rendering.
Go to Full Article
- GNOME Files Supercharges Search with Faster Results, Smarter Filters, and Better File Discovery
by George Whittaker
The GNOME project continues refining one of its most frequently used applications: GNOME Files (formerly known as Nautilus). Recent development efforts have focused heavily on improving the file manager’s search capabilities, making it easier to locate documents, media files, and folders across increasingly large storage volumes.
For many Linux users, file search has become one of the most important daily workflows. As personal data collections grow and SSDs make local storage faster than ever, GNOME developers are investing in tools that help users find information more quickly and efficiently. GNOME Files already relies on indexing technologies such as Tracker (now GNOME LocalSearch) to deliver fast results, and recent improvements are building on that foundation.
A Redesigned Search Experience
One of the most noticeable improvements is a redesigned search interface that makes searching feel more integrated into the overall file management experience.
Recent GNOME development previews introduced:
A cleaner search popover Inline result previews Improved keyboard navigation Faster access to search filters Better visibility of search options within the file manager interface
These refinements reduce the number of clicks required to narrow down results and help users locate files without leaving their current workflow.
Smarter Filtering Options
Search filters have become increasingly important as users store larger collections of documents, images, videos, and audio files.
GNOME Files has been expanding its filtering capabilities, allowing users to narrow searches more effectively based on:
File type Media category Search location Recent activity Indexed metadata
Earlier updates expanded support for additional audio and video file formats, making it easier to locate multimedia content directly from the search interface. This is particularly useful for users managing large media libraries.
Improved Search Performance
Fast search results are just as important as accurate ones.
GNOME Files continues leveraging the GNOME indexing framework to provide near-instant search results while minimizing system overhead. The file manager works closely with the LocalSearch indexing service to locate files quickly without repeatedly scanning entire drives.
This approach provides several benefits:
Faster file discovery Reduced CPU usage during searches Better scalability on large storage volumes More responsive user experience
For desktop users who frequently work with thousands of files, these performance gains can significantly improve productivity.
Go to Full Article
- NixOS 26.05 ‘Yarara’ Released with Systemd Initrd by Default and Major Infrastructure Updates
by George Whittaker
The NixOS project has officially released NixOS 26.05, codenamed “Yarara,” continuing the distribution’s unique approach to Linux system management through declarative configuration, atomic upgrades, and reproducible deployments. The release introduces several important platform-level changes, modernized infrastructure components, and continued refinement of the Nix ecosystem.
As one of the most distinctive Linux distributions available today, NixOS continues attracting developers, DevOps engineers, and advanced Linux users who value predictable system behavior and highly reproducible environments.
What Makes NixOS Different?
Unlike traditional Linux distributions that install packages directly into shared system locations, NixOS is built around the Nix package manager, which stores software in isolated, versioned paths and generates complete system configurations declaratively.
This architecture provides several advantages:
Atomic system upgrades Reliable rollback capabilities Reproducible environments Easier infrastructure automation Reduced dependency conflicts
These features have helped NixOS gain popularity among developers managing complex systems and cloud infrastructure.
Systemd-Based Initrd Becomes the Default
One of the most significant changes in NixOS 26.05 is the move to a systemd-based Stage 1 initrd by default. The older scripted implementation is now deprecated and scheduled for removal in NixOS 26.11.
The initrd (initial RAM disk) is responsible for preparing the system during early boot before the main operating system loads.
According to the release notes:
Systemd now handles Stage 1 initialization by default The previous scripted implementation remains temporarily available Users can still revert using boot.initrd.systemd.enable = false Long-term migration toward the systemd-based approach is encouraged
This change is expected to improve consistency and simplify maintenance across modern NixOS deployments.
Continuing the Twice-Yearly Release Cycle
NixOS continues its established release cadence of publishing stable versions twice per year—typically around May and November. The 26.05 “Yarara” release follows the previous 25.11 “Xantusia” release and continues the project's steady development rhythm.
The 26.05 development cycle involved extensive staging, package testing, and release management work coordinated through the NixOS community.
Large-Scale Package and Infrastructure Updates
Like previous NixOS releases, 26.05 includes a massive collection of package updates across the software ecosystem.
Go to Full Article
- GNOME 51 Development Officially Begins as ‘A Coruña’ Cycle Gets Underway
by George Whittaker
The GNOME Project has officially opened the development cycle for GNOME 51, the next major release of one of Linux’s most widely used desktop environments. Following the recent launch of GNOME 50 “Tokyo,” developers are already shifting focus toward the next chapter of the desktop’s evolution, which will carry the codename “A Coruña.”
While it’s still very early in the process, the release schedule is now taking shape, giving Linux users and developers an early look at what to expect over the coming months.
GNOME 51 “A Coruña” Is Now in Development
The new release is named A Coruña, after the Spanish city that will host GUADEC 2026, the annual GNOME Users and Developers European Conference. The event serves as one of the most important gatherings for GNOME contributors, where future desktop plans, technologies, and development priorities are discussed.
As soon as GNOME 50 was finalized, development work for GNOME 51 officially began, continuing GNOME’s well-established six-month release cadence.
Release Schedule Already Published
The GNOME team has outlined the preliminary roadmap for the GNOME 51 cycle.
Current milestone dates include:
GNOME 51 Alpha: June 27, 2026 GNOME 51 Beta: August 1, 2026 GNOME 51 Release Candidate (RC): August 29, 2026 GNOME 51 Final Release: September 16, 2026
These milestones provide time for:
Feature integration Public testing Bug fixing Performance optimization Final stabilization before release
As always, dates may shift slightly depending on development progress.
Still Too Early for Major Feature Announcements
Because the development cycle has only just started, GNOME developers have not yet revealed a finalized feature list. Most major design discussions and merge requests are still in their early stages.
However, several areas are already attracting attention.
Wayland Improvements Are Likely a Major Focus
One of the biggest transitions in recent GNOME history happened with GNOME 50, which completed the project’s move away from X11 by removing remaining X.Org support from the desktop environment.
Because GNOME is now fully committed to Wayland, many observers expect GNOME 51 to focus heavily on:
Go to Full Article
- Alpine Linux Experiments with Systemd Compatibility While Keeping Its Lightweight Identity
by George Whittaker
Alpine Linux, one of the most recognizable non-systemd Linux distributions, is reportedly experimenting with an optional systemd compatibility layer, a move that has sparked intense discussion across the Linux community.
For years, Alpine has stood apart from mainstream Linux distributions by avoiding both glibc and systemd, instead relying on:
musl libc BusyBox OpenRC as its init system
Now, growing software compatibility pressures, especially around desktop applications, containers, and enterprise tooling, appear to be pushing Alpine developers to explore new approaches.
Why Alpine Linux Avoided Systemd for So Long
Alpine Linux built its reputation around simplicity, security, and minimalism. Unlike many mainstream distributions, Alpine intentionally avoided systemd in favor of the lighter and more modular OpenRC init system.
This design philosophy made Alpine extremely popular for:
Containers and Docker images Embedded systems Lightweight virtual machines Security-focused deployments
Its tiny footprint and reduced dependency chain became major advantages in cloud and container environments.
The Compatibility Problem Is Growing
Despite Alpine’s popularity, avoiding systemd has increasingly created compatibility challenges.
Many modern Linux applications now assume the presence of:
libsystemd systemd APIs glibc-specific behaviors
This has become particularly problematic for:
Desktop software Proprietary enterprise applications Monitoring agents Certain gaming and multimedia tools AI and container orchestration software
Historically, Alpine users often relied on:
Compatibility layers like gcompat Flatpak containers Docker workarounds Manually patched packages
The growing complexity of those workarounds appears to be one reason compatibility discussions are intensifying.
What the Experimental Compatibility Layer Actually Means
Importantly, Alpine Linux is not replacing OpenRC with systemd.
Instead, the project appears to be exploring:
Optional compatibility packages libsystemd support Improved API compatibility for software expecting systemd components
Experimental efforts already exist in the broader ecosystem. For example, unofficial projects have packaged portions of systemd, particularly libsystemd, for Alpine systems specifically to satisfy software dependencies without running full systemd services.
Go to Full Article
- Debian Experiments with AI-Assisted Bug Triage as Open-Source Projects Face Growing Report Overload
by George Whittaker
The Debian project has begun exploring AI-assisted bug triage workflows, joining a broader movement across the open-source world to manage the rapidly increasing volume of software bug reports and vulnerability submissions.
While Debian developers are approaching the idea cautiously, the effort reflects a growing reality for large open-source projects: modern software ecosystems are producing more bugs, duplicate reports, and security findings than human maintainers can efficiently process alone.
The discussion arrives during a period of intense debate within Linux and open-source communities about how artificial intelligence should be integrated into software development and maintenance.
Why Debian Is Looking at AI-Assisted Triage
Debian is one of the largest and most complex Linux distributions in existence, maintaining tens of thousands of software packages across multiple architectures and release branches. Managing bug reports at that scale has always been challenging.
Now, AI-assisted vulnerability scanning and automated testing tools are dramatically increasing report volumes across open-source projects. Maintainers are increasingly facing:
Duplicate vulnerability reports Low-quality automated submissions Massive triage backlogs Security mailing list overload Increasing maintainer burnout
AI-assisted bug triage systems are being explored as a way to help organize, prioritize, and categorize incoming reports before human maintainers review them.
What AI-Assisted Bug Triage Actually Means
Importantly, Debian is not handing software maintenance over to AI systems.
Instead, AI-assisted triage generally focuses on repetitive administrative tasks such as:
Detecting duplicate bug reports Categorizing issues by severity Routing bugs to appropriate maintainers Summarizing lengthy reports Identifying missing reproduction details Prioritizing security-related submissions
The goal is to reduce the amount of manual sorting work maintainers must perform before actual debugging begins.
The Open-Source Community Is Divided
Debian’s experiments come during an ongoing debate about AI’s role in open-source development.
Some maintainers view AI-assisted tooling as necessary because software complexity has outpaced human review capacity. Others worry about:
Low-quality AI-generated reports Maintainer overload False positives Loss of contributor accountability “Drive-by” AI contributions with little human understanding
The Debian community itself has spent months discussing how AI-assisted contributions should be handled, but no final project-wide policy has yet been adopted.
Go to Full Article
|
