https://deb.news Deb.News - https://deb.news https://retout.co.uk/2026/07/10/blocking-distracting-news-links/ <p><em>“You are what you eat”</em> – but perhaps this is even more true of our information diet. It is hard to strike a balance between remaining a well-informed citizen versus spending hours ingesting unnecessary news about issues and events we can’t affect. But I’m increasingly convinced that my hours lost to doomscrolling are down to design choices by web publishers rather than a failure of individual willpower.</p> <h3 id="we-have-created-an-obesogenic-information-environment">We have created an “obesogenic” information environment</h3> <p>I don’t think it is just me – I think our information environment has been progressively altered over time as news sites look to maximize engagement. Even outside of social media, the invisible hand of the market for eyeballs forces sites to optimize for browse time or risk irrelevance.</p> <p>Even as newspapers find it increasingly difficult to fund good journalism through advertising in an online world, especially local journalism, they need to keep readers on their sites, clicking through as many articles as possible. Clickbait headlines, “urgent” flashing live icons to draw the attention, and many opportunities to leap from one article to another, and another.</p> <p>But this design approach even extends to news organisations with a different funding model, like BBC News, which is a public service (state-owned but arms-length) organisation funded through a mandatory television licence – a matter of controversy in some quarters. And it extends even to sites where I pay a subscription fee; I might get adverts removed, but I am still bombarded with the same design philosophy; too many opportunities to be pulled away from what I’m reading towards some other unrelated article.</p> <p>Even if I try and limit my exposure to algorithmic “discovery” of new news, via RSS feeds or similar, if I’m reading the full article in a browser then I am prompted to read more stuff that I didn’t intend. This defeats the benefit of curating a set of feeds, because you still get dragged away to random articles.</p> <h3 id="only-44-of-bbc-news-is-news">Only 44% of BBC News is news</h3> <p>To show you what I mean, I’m going to pick on the BBC, although I love them dearly and the same issue very much applies elsewhere.</p> <p>I’ve taken a screenshot of a <a href="https://www.bbc.co.uk/news/articles/cly9r54e5r4o">random BBC News article</a> in mobile view (my preferred doomscrolling user access device), and measured approximately what proportion of the full length of the page is taken up by each section. This is a fairly in-depth news article, so I reckon if anything the figures would be worse than this on shorter articles.</p> <p><img alt="A full-length screenshot of a BBC News article showing proportions of the page allocated to the main article vs. related links etc." src="https://retout.co.uk/2026/bbc-news-website.drawio.svg" /></p> <p>(These numbers will not sum to 100% for reasons which are obvious if you look at the crossbars. Also they’re approximations.)</p> <p>Less than half of the page (44% if you exclude the inline related links) is actual news text/images; the rest are links trying to help you find the next thing to read/watch. <em>I do not want this.</em></p> <p>I’m sure this A/B tests well in terms of reader figures, but it sometimes leaves me exhausted – it must take subconscious mental energy to ignore, or I spend too much time trying to keep on top of things.</p> <p>And remember, this is a publicly-funded site that does not rely on advertising!</p> <h3 id="blocking-out-the-noise">Blocking out the noise</h3> <p>If you are technically-minded, you can use an ad-blocker such as uBlock Origin to take back some control. Applying the following lines as a custom filter (Settings &gt; My filters) brutally cuts out almost all of these links:</p> <div class="code-block-wrapper"><pre tabindex="0"><code>bbc.co.uk##aside bbc.co.uk##footer&gt;div:has(h2) bbc.co.uk##[data-block="uploaderEmbed"] bbc.co.uk##[data-block="links"]</code></pre></div> <p><em>Caveat emptor:</em> I have not road-tested this for more than half an hour, so who knows what consequences this could have on your web browsing. In particular, international readers outside the UK will likely be redirected to bbc.com, the commercial arm of the BBC, where these rules will need adapting.</p> <p>Is it unethical to use an ad-blocker to remove these links? I would argue not. I am not depriving the BBC of any revenue, because I pay my licence fee. I might reduce the amount of time I spend on their website, but if anything the subjectively better experience might encourage me to consume more news from them, not less. In other circumstances (outside the UK for instance, where the BBC relies on advertising), the balance might be different.</p> <h3 id="product-managers-please-find-better-metrics">Product managers, please find better metrics</h3> <p>I lament the state of the internet in 2026. I now can’t unsee these innocuous “related stories” links as a mechanism to grab my attention, and it’s gone too far.</p> <p>If you are a normal person just browsing the news and looking to discover the latest important stories relatively quickly, I can see that these types of links might actually be useful for discovery; but I’m actually reasonably sure that I’m not going to miss out on anything major. You still have the option of the news home page if you want to be presented with more news for example, and it feels natural to go back to there when you’ve run out of stories to consume.</p> <p>But it shouldn’t be down to individual responsibility to ignore or geekily block these types of link; news sites with alternative funding models should find better metrics for engagement than “hours spent on site” – how about optimizing for customer mental wellbeing, or minimizing time required to catch up with the news? There’s no need to maximize clicks and eyeballs. This is a societal level issue, because we are all going mad with news over-engagement.</p> <p>Product managers, over to you.</p> 2026-07-10T15:00:00+00:00 Tim Retout http://www.netfort.gr.jp/~dancer/diary/daily/2026-Jul-10.html.en#2026-Jul-10-18:04:45 July already. Wow. It's getting to be a summer. <p></p> 2026-07-10T09:04:45+00:00 Junichi Uekawa https://bits.debian.org/2026/07/new-developers-2026-07.html <p>The following contributors got their Debian Developer accounts in the last two months:</p> <ul> <li>Vivek K J (vivek)</li> <li>Benjamin Somers (bensmrs)</li> <li>Colin King (colinianking)</li> <li>Nadzeya Hutsko (nadzeya)</li> </ul> <p>The following contributors were added as Debian Maintainers in the last two months:</p> <ul> <li>Pieter Lenaerts</li> <li>Syed Shahrukh Hussain</li> <li>Ural Tunaboyu</li> </ul> <p>Congratulations!</p> 2026-07-10T07:00:00+00:00 Jean-Pierre Giraud https://jmtd.net/log/synths/minilogue-xd/module/ <p>I bought a new synth! Kind-of.</p> <p>I've traded my <a href="https://jmtd.net/log/synths/minilogue-xd/">Minilogue-XD</a> (full-size version with integrated keyboard) for the desktop/modular alternative.</p> <div class="image"> <a href="https://jmtd.net/log/synths/minilogue-xd/module.jpg"><img alt="Modular Minilogue XD" class="img" height="300" src="https://jmtd.net/log/synths/minilogue-xd/module/400x-module.jpg" width="400" /></a> <p>Modular Minilogue XD</p> </div> <p>Why? Partly, because it fits on my desk better. Partly, because it changes the way you engage with the instrument. It makes a huge difference: the ivory keys come with so much cultural precedent. The module version of the synth gains a switch that lets you use the 16 sequencer step buttons as note inputs, so you can still play the thing solo. But the emphasis moves away from note generation and more firmly towards tone.</p> <p>Both versions have a lovely stained wood back, which you never see; the modular one has a hint of that at the front as well (which you do see).</p> <p>I plan to eventually buy a MIDI keyboard that could drive it, and other things: possibly an Arturia KeyStep or Minilab, but there's no rush on that.</p> <p>(It's about time I recorded and shared something I produced on this)</p> 2026-07-09T19:31:38+00:00 jmtd http://blog.alteholz.eu/2026/07/my-debian-activities-in-june-2026/ <h3><strong>Debian LTS/ELTS</strong></h3> <p></p><p>This was my hundred-forty-fourth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian. </p> <p> During my allocated time I uploaded or worked on: </p><p></p> <ul><li>[<a href="https://lists.debian.org/debian-lts-announce/2026/06/msg00004.html">DLA 4615-1</a>] exim4 security update to fix one CVE related to information disclosure in combination with proxies. </li><li>[<a href="https://lists.debian.org/debian-lts-announce/2026/06/msg00005.html">DLA 4616-1</a>] haveged security update to fix one CVE related to local root privilege escalation. </li><li>[<a href="https://lists.debian.org/debian-lts-announce/2026/06/msg00007.html">DLA 4618-1</a>] gsasl security update to fix one CVE related to denial of service. </li><li>[<a href="https://lists.debian.org/debian-lts-announce/2026/06/msg00020.html">DLA 4631-1</a>] asterisk security update to fix 13 CVEs related to buffer under- or overflows, either on heap or on stack. Some are related to use-after-free or wrong processing of invalid or untrusted certificates. </li><li>[ELA-1747-1] gimp security update to fix three CVEs in Buster related to denial of service or execution of arbitrary code if malformed PSP, JPEG 2000 or PSD files are opened.</li><li>[ELA-1748-1] gimp security update to fix two CVEs in Stretch related to denial of service or execution of arbitrary code if malformed PSP or PSD files are opened.</li><li>[ELA-1749-1] exim4 security update to fix one CVEs in Buster and Stretch related to information disclosure in combination with proxies.</li><li>[ELA-1750-1] gsasl security update to fix one CVEs in Buster and Stretch related to denial of service.</li></ul> <p> Besides fixing all CVEs of <i>asterisk</i> in Bullseye, I started to look at <i>asterisk</i> in other releases as well. Rather surprisingly <i>asterisk</i> is only part of Unstable and Bullseye. All other releases don’t include any version of <i>asterisk</i> at all. So first things first, besides some security related RC bugs, <i>asterisk</i> did not migrate due to RC-bugs in <i>dahdi-linux</i>. As I maintain <i>osmocom-dahdi-linux</i> (which supports less/other hardware), I looked at the open issues and after some rounds I could upload a new upstream version, fixed some bugs and resolved issues with piuparts. <i>dahdi-linux</i> meanwhile migrated to testing, job done! <br /> As a next step I looked at the open CVEs. Some of them had been already fixed in previous uploads but had not been marked accordingly. So I fixed all remaining ones and sent a debdiff to the maintainer. Unfortunately there was some kind of overlap in our work and he ignored my debdiff but uploaded a new upstream version. Anyway, job done as well, no open security issues anymore. The only thing that hinders <i>asterisk</i> from migrating to testing is the reproducible build. So if anybody has some spare time … </p> <p> Other things I worked on were the regression update of <i>rsync</i>. Some of the elven new patches need to be backported, but I am confidentially to finish this month. I already reviewed the <i>rsync</i>– uploads of Sylvain to Buster and Stretch, so I don’t expect any big hurdles here. I am also making progress to find the correct patches for <i>hplip</i> and <i>cups</i>. </p> <h3><strong>Debian Printing</strong></h3> <p>This month I uploaded a new upstream versions:</p> <ul><li>… <a href="https://tracker.debian.org/lprng">hplip</a> to unstable to fix some bugs.</li></ul> <p><strong>This work is generously funded by <a href="https://www.freexian.com">Freexian</a>!</strong></p> <h3><strong>Debian Lomiri</strong></h3> <p></p><p>This month new upstream versions of dozens of lomiri packages have been released and I uploaded lots of them to Debian. After they migrate to testing, I am also going to sync them to the Ubuntu PPA. </p> <p><strong>This work is generously funded by <a href="https://freiesoftware.gmbh/">Fre(i)e Software GmbH</a>!</strong></p> <h3><strong>Debian Astro</strong></h3> <p>This month I uploaded a new upstream version or a bugfix version of:</p> <ul><li>… <a href="https://tracker.debian.org/supernovas">indi-pentax</a> to unstable. This is a package in contrib without autobuild and needed a new upload for the libraw transistion.</li><li>… <a href="https://tracker.debian.org/c-munipack">c-munipack</a> to unstable.</li><li>… <a href="https://tracker.debian.org/supernovas">supernovas</a> to unstable (sponsored upload).</li></ul> <h3><strong>Debian IoT</strong></h3> <p>This month I uploaded a new upstream version or a bugfix version of:</p> <ul><li>… <a href="https://tracker.debian.org/duktape">duktape</a> to unstable.</li><li>… <a href="https://tracker.debian.org/libcoap3">libcoap3</a> to unstable.</li></ul> <h3><strong>Debian Mobcom</strong></h3> <p>This month I uploaded a new upstream version or a bugfix version of:</p> <ul><li>… <a href="https://tracker.debian.org/smstools">smstools</a> to unstable.</li></ul> <h3><strong>misc</strong></h3> <p>This month I uploaded a new upstream version or a bugfix version of:</p> <ul><li>… <a href="https://tracker.debian.org/visam">visam</a> to unstable. There had been an RC bug due to two binaries with the same name but different functionality. Yes, it is in the policy but … (my mother forbade me to elaborate more on this)</li><li>… <a href="https://tracker.debian.org/mailio">mailio</a> to unstable.</li></ul> 2026-07-07T17:56:04+00:00 alteholz https://mjg59.dreamwidth.org/74260.html A reminder that I am no longer here, but am instead <a href="https://codon.org.uk/~mjg59/blog">here</a>. The new RSS feed is <a href="https://www.codon.org.uk/~mjg59/blog/index.xml">here</a>. If you're still reading this for some reason other than being on Dreamwidth, please update your feed.<br /><br /><img alt="comment count unavailable" height="12" src="https://www.dreamwidth.org/tools/commentcount?user=mjg59&amp;ditemid=74260" style="vertical-align: middle;" width="30" /> comments 2026-07-06T09:03:04+00:00 Matthew Garrett https://www.eyrie.org/~eagle/reviews/books/0-06-105356-2a.html <p>Review: <cite>The Player of Games</cite>, by Iain M. Banks</p> <table> <tbody><tr> <td>Series:</td> <td>Culture #2</td> </tr> <tr> <td>Publisher:</td> <td>HarperPrism</td> </tr> <tr> <td>Copyright:</td> <td>1989</td> </tr> <tr> <td>Printing:</td> <td>February 1987</td> </tr> <tr> <td>ISBN:</td> <td>0-06-105356-2</td> </tr> <tr> <td>Format:</td> <td>Trade paperback</td> </tr> <tr> <td>Pages:</td> <td>295</td> </tr></tbody></table> <p> <cite>The Player of Games</cite> is political space opera and the second book in the shared Culture setting. As with most Culture books, the reading order is not particularly important. It won the 1989 Locus Award for best science fiction novel and sometimes competes with <a href="https://www.eyrie.org/~eagle/reviews/books/1-85723-135-X.html"><cite>Use of Weapons</cite></a> as the consensus best Culture novel. </p> <p> This review is a re-read and yet another experiment in how to re-review a book. This time, I decided to write a full second review with substantial spoilers so that I can talk in more detail about the book. If you want to avoid spoilers, or just want to see how my thoughts have evolved from my first reading, see <a href="https://www.eyrie.org/~eagle/reviews/books/0-06-105356-2.html">my original review</a> from 2005. </p> <p> Gurgeh plays games. He is probably the best strategy game player in the entirety of the galaxy-spanning Culture. He has written papers on game theory, won innumerable major championships, and is a celebrity in the circle of like-minded aficionados. </p> <p> Gurgeh is also bored and in the middle of the Culture equivalent of a mid-life crisis. As the story opens, he's vaguely unsatisfied and adrift, unenthused by his normal activities, and searching vaguely for something that will break through his ennui. He is caught by surprise by the thrill he gets from a moment's misunderstanding in which an opponent suspects him of cheating, which sets him up to be (apparently) clumsily blackmailed by a deeply unpleasant drone named Mawhrin-Skel. </p> <p> <strong>SPOILERS BELOW</strong>. If you have not read this book, consider stopping here and instead reading my original <a href="https://www.eyrie.org/~eagle/reviews/books/0-06-105356-2.html">no spoiler review</a>. </p> <p> The first hundred pages of <cite>The Player of Games</cite> is a slow, somewhat plodding introduction to Gurgeh, his social circle, and life in (one part of) the Culture. I remember being fascinated by this part the first time I read this book. It was only the second Culture novel I read and the first set in the Culture proper, so the world-building underlying this odd post-scarcity utopia on a vast intelligent habitat with sentient drones, complex privacy rules, endless cocktail parties, and apparently directionless socialites was intriguingly unlike the other science fiction I was reading at the time. This time through, I have to admit I was less impressed. </p> <p> Gurgeh is not very likable, and his desultory mid-life crisis is a little boring. None of his friends have enough depth to appear as more than side notes, in part because Gurgeh doesn't seem to care enough about any of them to make them interesting to the reader. I've since read seven other Culture novels, so Banks's cocktail parties hold less charm and I was impatient for the real action to begin. </p> <p> These chapters are still important, though, because they establish how utterly average Gurgeh is. He has one unique talent, a deep affinity with and obsession with strategy games, and is otherwise a bit of a depressed narcissist with a few casual relationships, a friend that he barely confides in, and a comfortable and familiar life. He is not in any way a hero or a charismatic figure; he just happens to be exceptionally good at one thing, enough to make him famous among people who care about that one thing and probably unknown to anyone else apart from the occasional idly perused news headline. He is the Culture's equivalent of the world chess champion. </p> <p> The Contact division of the Culture has a problem. The Empire of Azad in the Lesser Magellanic Cloud is a nasty, expansionist culture of the sort that Contact would like to deal with before it causes broader problems. The Culture's normal approaches are thwarted by an unusual organizing principle: The empire is built around and takes its name from the game of Azad, a highly complex strategy game developed over thousands of years. Azad is the civil service exams, means of political and religious dispute resolution, selection mechanism for the emperor, and civic religion. Faced with that oddity, Contact turned to Special Circumstances, the Culture's more aggressive and less restrained way of dealing with tricky problems. Special Circumstances, in turn, needs someone who can learn how to play the game of Azad. They want Gurgeh to take a very long trip. </p> <p> For all of Gurgeh's dissatisfaction, he's not impulsive enough to take a five year journey away from his life and everyone he knows just to play a novel game. Conveniently, Mawhrin-Skel's blackmail resolves this reluctance. </p> <p> The game of Azad requires some suspension of disbelief. Banks provides a few glimpses at the mechanics of the game, but those details are insufficient to reconstruct the rules, and some of the claims made about its properties are improbable at best. The best mental model I could build for it is a strategy or simulation game built around units and territory control, with supplemental side games used to build up resources for the main boards, but it's more of a plot device and a set piece than a world-building invention. The significance of Azad the game is its role in society: The Empire of Azad believes they have constructed a game whose complexity so closely models reality that the skills required for success in the game are precisely the skills required for success in the empire. </p> <p> The Empire of Azad is wrong, and this is one of the core themes of <cite>The Player of Games</cite>. As with many Culture novels, what Special Circumstances tells Gurgeh is, at best, incomplete. Gurgeh is a refutation of the basis of belief in Azad; this is why it is important thematically that he is an average, somewhat unlikable citizen of the Culture whose only special characteristic is skill at learning and playing games. </p> <p> Azad is the myth of meritocracy given physical form as a game. It provides the anchor of the empire for the same reason that societies on Earth place enormous weight on standardized tests, capitalist success, or public debates. All societies face the problem of selecting good leaders and testing opposing beliefs, and all societies attempt to find some form of shortcut, some set of general principles, tests, or objective metrics used to select the best person via a process that people consider plausible and fair. The game of Azad is a paragon of apparently meritocratic process. No matter who you are or what your background is, if you excel at the game that, in theory, objectively tests your skills, you are given a position of power. </p> <p> In practice, the Empire of Azad is not that naive. Manipulation outside of the game happens, only some players have the opportunity and resources to spend years learning the game at a deep level, and only their dominant sex truly stands a chance in games that matter. But neither is Azad's place in society a fiction. There is corruption around the edges, and a lot of people are filtered out before the games begin, but the highest echelons of society are true believers. The game does decide both rank and policy; Banks is arguing against a strong form of apparently working meritocracy. </p> <p> Gurgeh represents a refutation of this meritocracy through the mechanism that breaks every supposed meritocracy: The map is not and cannot be the territory. Any objective evaluation criteria is necessarily separate from what it is trying to measure, and in that separation there is always an opportunity. Gurgeh has none of the background, training, or mindset expected for a player of Azad because he could not possibly care less about any of the things Azad represents to the Empire. What he has instead is a preternatural skill at games and vast experience with the most intricate strategy games the Culture, a much larger society, has been able to devise. He also has both the patience and the resources to devote himself entirely to learning a game for several years, and past experience in doing that with other games. </p> <p> If Azad represents the civil service exams, Gurgeh is the person who has no interest in ruling but adores memorizing facts and taking tests. The theory behind the exams is that the skills to pass the exam only come with the correct mindset to do the job for which the exam is testing. Gurgeh is an existence proof that this is not always the case. </p> <p> Banks also uses Azad to show another aspect of the failure of meritocracy: A society whose rulers are chosen through a competition takes on the shape of that competition. The Empire of Azad is run by the winners of competitive games, so the empire is a winner-take-all system of dominance and status hierarchy. Here, I think Banks lays the point on a little thick; the empire is an irredeemable hellhole of misogyny, sexual abuse, slavery, genocide, and military colonialism to a degree that is a bit hard to justify solely from the game. There is a beautiful turning point about two-thirds of the way through the book where Gurgeh's face is shoved into just how vile Azad society is and reconsiders his approach to the tournament as a result, and I think it may have been a bit stronger if the morality had been a little less blatant and absolute. </p> <p> To the extent that Gurgeh has political beliefs, he represents a Culture flavor of soft liberalism. He has opinions about acceptable and unacceptable ways to treat people, but he grew up in a utopia and his opinions are mostly theoretical. When he sees just how vile people can be outside of that utopia, he is revolted and appalled and redoubles his efforts to fight that society in the only way he knows how, inside of a game. This part of the book follows the standard, if enjoyable, plot of a flawed but fundamentally decent person discovering a true injustice and becoming enraged at it. </p> <p> In a lot of books, that would have been where the plot stops. Banks is doing something more subtle and more interesting, though. Gurgeh wipes the board with his next challenger, but that soft liberalism eventually proves inadequate. To learn the game of Azad and to play in the tournament, Gurgeh has been wrapping himself in Azad culture and its language, and in that frame of mind he is losing the climactic game of the book. It's only when he is pushed to think in Marain, the native language of the Culture, that he understands what is happening in the game and how to defeat Nicosar, the emperor. </p> <p> This, on the surface, is a bit too close to the <a href="https://en.wikipedia.org/wiki/Linguistic_relativity">strong hypothesis of linguistic relativity</a> to be entirely plausible, but such an objection would miss the point that Banks is making here. Marain is a construct, the product of considerable effort within the Culture to match language to the most nuance and complexity that brains can understand, and it is a language, one of the most social and collective artifacts a society can produce. Gurgeh is a remarkable individual with an impressive talent, but individual skill and achievement can only take him so far. The critical final piece is the support of societal infrastructure intentionally built and maintained to help him make better decisions. </p> <p> Once I noticed that point, I saw it everywhere in the book. The empire repeatedly attempts to subvert or distract Gurgeh with drugs, pleasure, politics, or danger, and at each point there is some critical piece of Culture social infrastructure that blunts the attack. Illicit substances and forbidden vices are less tempting to someone for whom the illicit has been demystified by the Culture's gentler approach to rules and boundaries. Embedded biological mechanisms allow him to divert drugs so that they don't affect him. At first, it's easy to read this as an exercise of self-control, but on this re-read I saw how much behind-the-scenes infrastructure supports Gurgeh's ability to ignore temptation. </p> <p> This social support notably does not take the form of some ideological principle or moral framework. Gurgeh is not a monk or an ascetic, as is obvious from the first third of the book, and he has no political ideology to speak of. He is a flawed person with a streak of danger-seeking and self-aggrandizement, which the Culture exploited to get him involved in Azad. But through a lot of hard work, technological and social, the Culture has given him a robust foundation and a set of mental and biological tools that make him remarkably hard to corrupt. The implication is that if Gurgeh has that support, so does every other member of the Culture. It's neither a religion or an ideology; it's well-maintained infrastructure, complex and nuanced and pragmatic, and composed of innumerable small solutions to specific problems. </p> <p> I think the true climax of this book takes place the night before the final day of the game, in the tower meeting between Gurgeh and Nicosar. Gurgeh has realized that he's already won; there's nothing Nicosar can do to salvage the game. He's also seen that the game represents a cultural conflict and conversation between the Culture and Azad and he's overwhelmed by the beauty of that communication and sadness that the game is about to be over. Gurgeh's true passion is the game. It is doubtless easier for him to be magnanimous because he's winning, but he also loves the structure of the game itself and what two players can create in a sort of collaborative competition. </p> <p> Gurgeh tries to express all of this to Nicosar. It is one of the most centrist liberal moments I've ever read in a novel, the pure essence of "reaching across the aisle" or "disagreeing agreeably." Gurgeh has seen something beautiful, something he's created with Nicosar, a moment of true communication, and he wants to share it. Surely Nicosar sees the same thing; surely now that he sees Gurgeh has won, he can appreciate the board structure, savor the moment, understand the transient beauty of a game that is about to end and how perfectly it captures the meeting of their different cultures. That moment does Gurgeh real credit. It's a rare sign of emotional and spiritual depth in a character who often seems superficial. </p> <p> Nicosar meets this outreach with unhinged, furious contempt. He despises everything Gurgeh represents, everything the Culture is, and the next day he tries to kill Gurgeh on the board of the game. </p> <p> It is a devastating critique of liberal tolerance, all the more so because Gurgeh's attitude and outreach is truly admirable. It is perhaps the most sympathetic moment that Gurgeh has in the entire book, the moment where the reader thinks "oh, I get it, I understand what he really cares about." Gurgeh assumes that Nicosar is not his position or culture, that they have made a moment of connection that transcends all the awful things he previously learned about the empire of Azad. That Nicosar, despite being the emperor of the society that is currently doing so many things Gurgeh finds repulsive, cannot be as bad as his society. And Nicosar considers that outreach to be weak, disgusting, and vile, and does everything that he can to destroy it. </p> <p> One of the oddest twists of our current moment is the obsession that some billionaires have with stories that are moral arguments against exactly what those billionaires are currently doing. The most obvious example is Peter Thiel, who is obsessed with <cite>The Lord of the Rings</cite> and has devoted his life to becoming Saruman, a character who is notably not one of the protagonists. It's as if something in them recognizes the power of the story, but some deep shame or narcissism or simple aversion allows them to completely ignore what the story means. </p> <p> Elon Musk is obsessed with the Culture novels. He names the SpaceX rockets following Culture Ship naming conventions and has claimed that one of his goals is to bring about a Culture-style utopia. And in 1989, years before anyone had ever heard of him, Banks cast him as the villain of <cite>The Player of Games</cite>. There is so much of Nicosar in Musk: the superficial charm, the limited brilliance (Nicosar is a very good Azad player), the ambition, the pride, and the vicious, spitting contempt for everything the Culture represents at every level deeper than superficial materialism. And Banks is as clear about his opinion of Nicosar as he is about anything in any Culture novel. </p> <p> One of the oldest fictional answers to what a society does with people like Nicosar is the consequences of hubris. By being unable to accept defeat, by holding a vision of the world so tightly, they become brittle and unstable and bring about their own collapse. In a broad sense, that is what happens in <cite>The Player of Games</cite> with a bit of pushing from Special Circumstances. By the politics of the game, Nicosar had already won; the results of Gurgeh's earlier games had already been faked, the final game had no political consequences, and everyone who knew its true outcome could be disposed of. Gurgeh's win could have been covered up and ignored. But Nicosar could not endure the thought that he would be beaten by someone like Gurgeh, playing Azad the way that Gurgeh was playing it. Gurgeh had to be destroyed on the board of the game; Nicosar's pride did not allow any other outcome, even if it meant Nicosar's death. </p> <p> However, Special Circumstances didn't let hubris be the end of the story. In the climax of the book, the drone protecting Gurgeh also makes sure that Nicosar dies. There is a fig leaf of plausible deniability, but it's so obvious that even the unobservant Gurgeh sees through it immediately. It's hard to escape the feeling that was Banks's answer to what to do with people like Nicosar: They cannot live within society, because they will not live peacefully within society. </p> <p> I enjoyed <cite>The Player of Games</cite> as much this time through as I did the first time, but for entirely different reasons. In my first read, I focused on the world-building of the Culture, the political machinations, and the concept of games as conversations between the players. This time, I was struck by the political commentary just below the surface. Special Circumstances wanted to resolve the problem of the Empire of Azad without a military conflict and occupation that would be long, brutal, expensive, and demoralizing. They found an answer that relied on the diversity of the Culture. A vast, utopian civilization in which people can pursue whatever interests make them happy produces innumerable microspecialized oddities, people with astonishing talents in some small field that only a tiny fraction of people care about. It produces, in other words, innumerable keys for locks that you may never encounter, but which are invaluable if you happen to stumble across that lock. </p> <p> Gurgeh is not a hero. He is not a paragon of moral virtue, or even a charming charismatic, He is an entirely average member of an extraordinary society, the beneficiary of thousands of years of concerted effort at producing a robust, flexible foundation on which to raise robust, flexible citizens with a shared sense of basic morality. Those people, by themselves, do not solve all of life's problems; the structure of Special Circumstances and its willingness to bend rules in order to maintain them is the tension and <em>deus ex machina</em> in all of the Culture novels. But much of the strength of Special Circumstances is that it has an entire civilization of people like Gurgeh to draw upon when it needs them. </p> <p> It has those people because the Culture comprehensively rejects competitive meritocracy, something that some readers of the Culture novels appear incapable of comprehending. </p> <p>Rating: 9 out of 10</p> 2026-07-06T03:09:00+00:00 Russ Allbery https://www.eyrie.org/~eagle/journal/2026-07/001.html <p> This is a bug fix and minor feature release over INN 2.7.3, and the upgrade should be painless. You can download the new release from <a href="https://downloads.isc.org/isc/inn/">ISC</a> or <a href="https://www.eyrie.org/~eagle/software/inn/">my personal INN pages</a>. The latter also has links to the full changelog and the other INN documentation. </p> <p> For the full list of changes, see the <a href="https://www.eyrie.org/~eagle/software/inn/docs-2.7/news.html">INN 2.7.4 NEWS file</a>. </p> <p> As always, thanks to Julien ÉLIE for preparing this release and doing most of the maintenance work on INN! </p> 2026-07-06T01:57:00+00:00 Russ Allbery https://bisco.org/notes/status-update-june-2026/ <h1 id="debian-related-work">Debian Related Work</h1> <ul> <li>Uploaded wofi 1.5.3-1 to unstable</li> <li>Uploaded wob 0.16-1 to unstable</li> <li>Uploaded labwc 0.20.0-1 and 0.20.1-1 to unstable; these releases come with support for wlroots-0.20, which made labwc reenter testing</li> <li>Uploaded swaylock 1.8.5-2 to unstable to make it use the <code>common-auth</code> directive of pam (seeh <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140096">#1140096</a>)</li> <li>Uploaded swayimg 5.4-1 to unstable</li> <li>Uploaded wayback 0.3-2 to unstable, which was waiting in experimental for a reupload and I had forgotten about it; also fixed a <a href="https://gitlab.freedesktop.org/wayback/wayback/-/merge_requests/96">typo</a> in wayback upstream</li> <li>Uploaded xdg-desktop-portal-wlr 0.8.3-1 to unstable</li> </ul> <h1 id="dh-related-work">DH Related Work</h1> <p>The search app I was working on last month was still a focus in June. I refactored the data model a bit and made it simpler. I stumbled over the <a href="https://pythonkoans.substack.com">Python Koans</a> and <a href="https://pythonkoans.substack.com/p/koan-15-the-invisible-ink">Koan 15: The Invisible Ink</a> gave me the idea of using unicode normalization when indexing the items.</p> <p>I released a couple of bug fix releases for the APIS framework, namely 0.64.2, 0.64.3 and 0.64.4. I also release 0.65.0 which is one step further in dropping support for the legacy <code>apis_entities</code> app. When the <code>search</code> module is merged it will give way for removing the last bits of the old cruft to be removed.</p> <p>During a regular dependency update session I looked at the changes in <a href="https://github.com/yourlabs/django-autocomplete-light">the dal dependency</a>. After a long time with no commits, the project suddenly had a lot of commits co-authored by Claude and then released a new major version with a regression. Given the state of the project, we decided to keep using the previous release for now and look into replacing the dependency with an HTMX based solution. I implemented a POC for one of the plugins we develop and it was actually pretty easy. I also managed to combine the autocomplete approach with a multi-select form field, based on <a href="https://dev.to/apleshkov/htmx-multi-select-form-control-without-js-4jfk">this blog post</a>.</p> <p>In the <a href="https://www.oeaw.ac.at/de/acdh/forschung/dh-forschung-infrastruktur/aktivitaeten/dh-datenmodellierung/pfp-prosopographische-plattform-oesterreich">PFP</a> project I finally merged the stats endpoint which give statistics about the named graphs that are used as data sources.</p> <h1 id="other">Other</h1> <p>I attended <a href="https://bsidesvienna.at/">BSidesVienna 0x7EA</a> but it was on one of the hottest days this year so far so I left after a couple of talks.</p> 2026-07-05T05:28:51+00:00 Birger Schacht http://blog.sesse.net/blog/tech/2026-07-04-15-21_an_update_on_sesse_chromium_org.html <p>As previously mentioned, I am leaving Chrome; my last work day was yesterday. (Sorry to those with July 3rd off that I didn't get to say goodbye to!) But I'm staying in Google, on more internal projects :-)</p> <p>After 1100+ commits it's hard to pick out one thing that I love the most; as a team, we launched a lot of (IMO) useful CSS features and fixed a lot of issues. But somehow, I keep on gravitating towards performance, and perhaps <a href="https://chromium-review.googlesource.com/c/chromium/src/+/3581992">this commit</a> is the one I will remember the most fondly; a couple hundred lines to speed up repeated attribute selectors a lot. (If you ever wonder who would be doing that; well, there's a fairly high chance that you have an extension injecting a stylesheet with a lot of <code>a[href*="..."]</code> rules…)</p> <p>Upwards and onwards. Please write lean, clean CSS; I won't be there to save you from now on. :-)</p> 2026-07-04T14:21:00+00:00 Steinar H. Gunderson https://retout.co.uk/2026/07/04/aws-washington-summit-2026/ <p>I am somewhat jet-lagged, having returned from Washington DC just before the 250th anniversary celebrations which will be happening today. I was part of a delegation sent by my employer to the AWS Summit there this week, partly to kindle interactions between PA Consulting and Jacobs who have recently <a href="https://www.jacobs.com/newsroom/press-release/jacobs-acquire-remaining-stake-pa-consulting">taken a 100% share in PA</a>.</p> <p>Much of our conference time was spent in meetings with AWS executives impressing the facts of the Jacobs/PA partnership upon them, and discussing plans to broaden our collaboration in different sectors. So I spent even less time than usual at conference keynotes, talks etc.</p> <p>This was my first time to DC, and I did find some time to see some sights – unfortunately the White House is rather fenced off at the moment following the UFC match, but I did make it to the Capitol and the Washington Monument in the heat.</p> <p>Last Sunday a select few of us attended the <a href="https://www.mlb.com/orioles">baseball in Baltimore</a> – rather than the game, the thing that stood out for me was the military jets flying in formation over the stadium every few minutes, and the block-booked seats for the Navy in uniform, who were having a great time! This is obviously a hearts-and-minds thing, but it provides a stark contrast with the UK – I can’t think of a time I’ve seen uniformed military at the football (soccer) or cricket for example. Or Union Jacks flying at shopping centres.</p> <p>Speaking of soccer, England just about beat DR Congo while I was out there, but it was a close-run thing as we were 1-0 down at half time. I can’t claim to be following the World Cup too closely, but I overheard comments (from US passers-by) that made clear it would have had a significant reputational impact on our standing in the world had we lost.</p> <p>Another highlight for me was the <a href="https://www.asa-dc.org/">Church of the Ascension and St. Agnes</a>, where I was able to get my fix of Anglican plainchant and four-part harmony for the week. At morning prayer, I noted they use “God save this land” rather than “God save the King” during the responses – I’ve since found other sources online that choose “God save the State”. It’s strange to think that the words of the BCP dating back to 1549/1662 are a point of continuity since well before the 1776 declaration of independence, and yet are still adapted and used in worship today.</p> 2026-07-04T12:40:45+00:00 Tim Retout https://blog.jak-linux.org/2026/07/03/openssl-pandemic/ <p>Recently a person reported a bug in APT saying that TLS is failing on FIPS systems with MD5 errors, and suggested we call <code>ERR_clear_error()</code> around TLS operations.</p> <p>Like any serious software engineer would do, I said No. Just because one component failed to handle its errors does not mean I can go around and discard all errors in another place - the program should have failed earlier (or discarded the error when it was determined to be safe).</p> <p>Little did I know that people have for years been using this approach as a best practice: Codebases everywhere are littered with calls to <code>ERR_clear_error()</code> before performing TLS, and upstream themselves suggest to do just that.</p> <p>This is a major, systemic, pandemic of incomplete error handling. We cannot just discard unrelated errors if they become inconvenient. The code that caused the error needs to be fixed to handle it.</p> <p>This isn’t all. It seems many authors are not familiar with libraries using a stack of errors, and there is a second anti-pattern:</p> <p>Call an OpenSSL operation, check the top-level error, and then discard all errors if deemed “not too bad”. This has the same problem: Unrelated errors get silently discarded.</p> <p>I would strongly encourage everyone to inspect their code bases for any calls to <code>ERR_clear_error()</code> and whether they are safe or one of the bad patterns above (or maybe you find a new pattern). You may want to use error stack functionality of<code>ERR_set_mark</code> (<a href="https://docs.openssl.org/3.4/man3/ERR_set_mark/">https://docs.openssl.org/3.4/man3/ERR_set_mark/</a>) to essentially “push” and “pop” an error context of your own as a guard around multiple OpenSSL operations.</p> <p>To the OpenSSL authors, I would suggest not encouraging devastating security practices that fundamentally break any trust in software.</p> <p>We need to do better than this.</p> 2026-07-03T15:54:22+00:00 Julian Andres Klode https://www.chiark.greenend.org.uk/~cjwatson/blog/activity-2026-06.html <p>My Debian contributions this month were all <a href="https://www.freexian.com/about/debian-contributions/">sponsored</a> by Freexian.</p> <p>You can also support my work directly via <a href="https://liberapay.com/cjwatson">Liberapay</a> or <a href="https://github.com/sponsors/cjwatson">GitHub Sponsors</a>. Thanks to new sponsor <a href="https://github.com/fernandocc17">@fernandocc17</a>!</p> <h2>bugs.debian.org documentation</h2> <p>Sometimes I ask users to file bugs upstream themselves because I think they’d be better placed to have the ensuing discussion with the upstream maintainers directly rather than everything having to go through me. Of course sometimes they don’t want to do so, perhaps because it requires creating another account somewhere. Rarely, I’ve had people refuse to do this because the letter of the bug tracking system’s documentation seemed to tell them not to. Since I don’t believe that was the intention, I <a href="https://salsa.debian.org/webmaster-team/webwml/-/merge_requests/1149">corrected this</a>.</p> <h2>OpenSSH</h2> <p>I spent two and a half hours extensively revising <code>debian/copyright</code> so that <code>lrc</code> believes it to be in sync with the output of <code>licensecheck</code>. I’m unconvinced that this was remotely worth the mind-numbing effort - as far as I can tell, it makes no difference to the practical legal position, to policy compliance, or to any reasonable user - but the <span class="caps">DFSG</span> team increasingly seems to be objecting to any discrepancies here any time a package crosses their radar, so this was a pre-emptive measure to avoid problems with some upcoming trips through the <span class="caps">NEW</span> queue.</p> <h2>OpenSSL 4.0</h2> <p>I fielded a few of the <a href="https://udd.debian.org/cgi-bin/bts-usertags.cgi?user=pkg-openssl-devel%40lists.alioth.debian.org&amp;tag=openssl-4.0">OpenSSL 4.0 build failure bugs</a>:</p> <ul> <li><a href="https://bugs.debian.org/1138480">omniorb-dfsg</a> (along with upgrading to 4.3.4)</li> <li><a href="https://bugs.debian.org/1138423">openssh</a></li> <li><a href="https://bugs.debian.org/1138408">yubihsm-shell</a></li> </ul> <h2>Python packaging</h2> <p>New upstream versions:</p> <ul> <li>certipy</li> <li>juptyer-server (fixing <a href="https://bugs.debian.org/1136022"><span class="caps">CVE</span>-2025-61669, <span class="caps">CVE</span>-2026-35397, <span class="caps">CVE</span>-2026-40110, and <span class="caps">CVE</span>-2026-40934</a>)</li> <li>magicgui</li> <li>pydantic</li> <li>pydantic-core</li> <li>pydantic-settings</li> <li>pylint</li> <li>pytest-rerunfailures (fixing a <a href="https://bugs.debian.org/1140869">build failure with pytest 9.1</a>)</li> <li>python-certifi</li> <li>python-django-celery-beat</li> <li>python-numpy-groupies</li> <li>python-packaging (aided by Debusine testing of reverse-dependencies)</li> <li>python-pytest-run-parallel</li> <li>python-pytest-unmagic</li> <li>python-service-identity</li> <li>python-tabulate</li> <li>python-urllib3 (fixing <a href="https://bugs.debian.org/1140427"><span class="caps">CVE</span>-2026-9375</a> and <a href="https://bugs.debian.org/1136654"><span class="caps">CVE</span>-2026-44432</a>)</li> <li>python-watchfiles</li> <li>python-yubihsm</li> <li>responses</li> <li>uncertainties</li> </ul> <p>pytest 9.1 was uploaded to unstable this month, resulting in quite a few new build/test failure bugs. I tried to keep on top of as many of these as I could; most of them had one of a small number of similar causes.</p> <ul> <li><a href="https://bugs.debian.org/1140858">domdf-python-tools</a> (<a href="https://github.com/domdfcoding/domdf_python_tools/pull/151">contributed upstream</a>)</li> <li><a href="https://bugs.debian.org/1140978">flask-caching</a> (<a href="https://github.com/pallets-eco/flask-caching/pull/652">contributed upstream</a>)</li> <li><a href="https://bugs.debian.org/1140863">magicgui</a> (<a href="https://github.com/pyapp-kit/magicgui/pull/731">contributed upstream</a>)</li> <li><a href="https://salsa.debian.org/python-team/packages/pydantic-core/-/commit/0b294b4e0841b63d2a6ace55b9fbb6ec50fae6d3">pydantic-core</a></li> <li><a href="https://bugs.debian.org/1140865">pydantic-extra-types</a> (<a href="https://github.com/pydantic/pydantic-extra-types/pull/397">contributed upstream</a>)</li> <li><a href="https://bugs.debian.org/1140866">pydantic</a> (<a href="https://github.com/pydantic/pydantic/pull/13357">contributed upstream</a>)</li> <li><a href="https://bugs.debian.org/1140867">pylint</a></li> <li><a href="https://bugs.debian.org/1140868">pytest-codeblocks</a></li> <li><a href="https://bugs.debian.org/1140875">python-docx</a> (<a href="https://github.com/python-openxml/python-docx/pull/1563">contributed upstream</a>)</li> <li><a href="https://bugs.debian.org/1140879">python-numpy-groupies</a> (<a href="https://github.com/ml31415/numpy-groupies/pull/96">contributed upstream</a>)</li> <li><a href="https://bugs.debian.org/1140880">python-openapi-core</a> (<a href="https://github.com/python-openapi/openapi-core/pull/1207">contributed upstream</a>)</li> <li><a href="https://bugs.debian.org/1140932">python-urllib3</a> (<a href="https://github.com/urllib3/urllib3/pull/5094">contributed upstream</a>)</li> <li><a href="https://bugs.debian.org/1140883">python-watchfiles</a></li> <li><a href="https://bugs.debian.org/1141032">sphinx-automodapi</a></li> </ul> <p>Python 3.14 became the default Python version in unstable towards the end of the month, starting a <a href="https://bugs.debian.org/1130323">transition</a>. These usually involve quite a bit of work, and there’s much more to do, but I fixed a few things:</p> <ul> <li><a href="https://bugs.debian.org/1140927">depthcharge-tools: Traceback with 3.14: args for positionals must be != 0</a></li> <li><a href="https://bugs.debian.org/1131793">domdf-python-tools: autopkgtest failure with Python 3.14</a></li> </ul> <p>Other build/test failures:</p> <ul> <li><a href="https://bugs.debian.org/1140059">dh-python: Dependency parsing is too picky about spacing</a></li> <li><a href="https://salsa.debian.org/python-team/packages/psygnal/-/commit/060a129ae5267e404510bdcb5e2bfb20eafe9c25">psygnal: Allow building without msgspec</a></li> <li><a href="https://salsa.debian.org/python-team/packages/pydantic-core/-/commit/0ec1508c0ff9cfeb2677fba4a0a29cc2cd19cabf">pydantic-core: Accept and require uuid 1.23.0, now that it’s in Debian</a></li> <li><a href="https://bugs.debian.org/1135448">pygame: <span class="caps">FTBFS</span>: <span class="caps">FAIL</span>: test_fill_rle (pygame.tests.surface_test.SurfaceTypeTest.test_fill_rle)</a></li> <li><a href="https://bugs.debian.org/1139431">pyro5: <span class="caps">FTBFS</span>: Unable to determine debhelper compatibility version</a></li> <li><a href="https://bugs.debian.org/1139197">python-persistent: Bump timeout in test_rapid_create_destroy_cycle</a> (<a href="https://github.com/zopefoundation/persistent/pull/238">contributed upstream</a>)</li> <li><a href="https://bugs.debian.org/1140667">python-yubihsm: Depends: python3-cryptography (&lt; 47) but 47.0.0-1 is to be installed</a></li> <li><a href="https://bugs.debian.org/1138813">sphinx-gallery: &lt;!nodoc&gt; build dependency removed from testing</a></li> <li><a href="https://salsa.debian.org/python-team/packages/tpm2-pytss/-/commit/0b9dcb5d369f2f32d904437e7880cec0381745e0">tpm2-pytss: Fix support for cryptography 47</a></li> <li><a href="https://bugs.debian.org/1140931">twisted: Tests fail with pyopenssl 26.3.0: module ‘OpenSSL.crypto’ has no attribute ‘X509Req’</a></li> </ul> <p>Other bugs:</p> <ul> <li><a href="https://salsa.debian.org/python-team/packages/psygnal/-/commit/0bc98b31531ab5ce3f6f465b16780ed932633fe6">psygnal: Fix reproducibility</a></li> <li><a href="https://bugs.debian.org/1138937">python-nacl: Updating the python-nacl Uploaders list</a></li> <li><a href="https://bugs.debian.org/1046910">python-tabulate: Fails to build source after successful build</a></li> <li><a href="https://bugs.debian.org/1046308">tpm2-pytss: Fails to build source after successful build</a></li> </ul> <h2>Rust packaging</h2> <p>New upstream versions:</p> <ul> <li>rust-asn1 (<a href="https://bugs.debian.org/1134917">needed by new python-cryptography</a>)</li> <li>rust-asn1-derive</li> </ul> <h2>Code reviews</h2> <ul> <li><a href="https://bugs.debian.org/1129695">buildbot: [<span class="caps">INTL</span>:sv] Swedish translation of debconf templates</a> (merged and uploaded)</li> <li><a href="https://salsa.debian.org/ssh-team/openssh/-/merge_requests/39">openssh: Support DPKG_ROOT</a> (merged and uploaded)</li> <li><a href="https://salsa.debian.org/ssh-team/openssh/-/merge_requests/41">openssh: Fix <span class="caps">GSS</span> C25519 server blob bounds check</a> (merged and uploaded)</li> <li><a href="https://salsa.debian.org/python-team/packages/python-pyramid/-/merge_requests/1">python-pyramid: <span class="caps">CVE</span>-2023-40587 Backport patch</a> (merged and uploaded)</li> </ul> <h2>Other bits and pieces</h2> <ul> <li><a href="https://bugs.debian.org/1140062">busybox: chdir no longer available -&gt; breaks d-i ‘live-installer.udeb’</a></li> <li><a href="https://salsa.debian.org/debian/debmirror/-/commit/7d25662cd048afbe8f90a437466dc1d8751a3e89">debmirror: Refresh mirror_size documentation</a></li> </ul> 2026-07-03T11:38:46+00:00 Colin Watson http://joeyh.name/blog/entry/no_LLM_code_in_dependencies/ <p>I've spent about 100 hours of work over the past month to make sure git-annex can build without dependencies that contain LLM generated code. At least so far.</p> <p><a href="https://git-annex.branchable.com/no_llm_code/">https://git-annex.branchable.com/no_llm_code/</a></p> <p>Needing to review a program's whole dependency tree on an ongoing basis is apparently what programming has come to?</p> <p>I've found some real stinkers. Large LLM generated changes being reverted in the next release without any explanation. An incoherent 1489 line commit message with 10,000 lines of changes to a 26,000 LOC code base. A LLM prompt to copy code from another project that seems to have only avoided being copyright infringement due to luck.</p> <p>I now have additional information about the quality of dependencies which will surely influence future decisions. As far as I can see, that's the only positive benefit of this work.</p> <p>I realize that I am probably trying to hold back the tide at this point. That appears to be why Software Freedom Conservancy <a href="https://sfconservancy.org/llm-gen-ai/llm-backed-generative-ai-recommendations.html">punted</a>, and I doubt that the FSF will do any better.</p> <p>As these dominos fall, I am reconsidering my participation in these communities. But I continue my work and support my users.</p> <p>It may seem easy to prompt a LLM with</p> <blockquote><p>Add fourmolu config and restyled</p> <p>neat</p> <p>format a module</p></blockquote> <p>And commit the result and call yourself a 10xer. But please consider the broader impact of your actions. (In the above case, that project lost my further collaboration on it.)</p> 2026-07-02T17:58:19+00:00 Joey Hess https://www.decadent.org.uk/ben/blog/2026/07/01/foss-activity-in-june-2026.html <p>This month’s work was dominated by the transition of Debian 12 “bookworm” to support by the LTS team, and by review of some large updates to Linux stable branches.</p> <p>Linux 6.12 is currently available in bookworm-backports, but that suite will stop accepting uploads after the last bookworm point release. I updated some supporting packages in bookworm in preparation for adding Linux 6.12 there. I also prepared for the possibility that bookworm-backports would close earlier.</p> <p>Since the LTS team is still also maintaining Debian 11 “bullseye” until August, I reviewed upstream changes for both Linux 5.10 and 6.1 stable branches and reported a number of regressions and other issues.</p> <ul> <li>Debian packages: <ul> <li><a href="https://tracker.debian.org/pkg/firmware-free">firmware-free</a>: <ul> <li>Merge requests: <ul> <li>merged <a href="https://salsa.debian.org/kernel-team/firmware-free/-/merge_requests/11">!11: Apply relevant changes from firmware-nonfree</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/firmware-nonfree">firmware-nonfree</a>: <ul> <li><a href="https://bugs.debian.org/src:firmware-nonfree">Bugs</a>: <ul> <li>closed <a href="https://bugs.debian.org/1135723">#1135723: firmware-nonfree: gencontrol conflates initramfs-tools with update-initramfs</a></li> <li>closed <a href="https://bugs.debian.org/1135736">#1135736: firmware-nonfree: suggests initramfs-tools, which is being phased out</a></li> <li>closed <a href="https://bugs.debian.org/1137651">#1137651: firmware-misc-nonfree: Please move firmware-intel-graphics and firmware-nvidia-graphics out of Recommends</a></li> <li>replied to <a href="https://bugs.debian.org/1139740">#1139740: firmware-misc-nonfree should recommend firmware-nvidia-graphics to avoid kernel Oops + black screen</a></li> <li>replied to <a href="https://bugs.debian.org/1139746">#1139746: firmware-realtek: W: Possible missing firmware rtlwifi/rtl8723bu_bt.bin for module rtl8xxxu</a></li> </ul> </li> <li>Merge requests: <ul> <li>merged <a href="https://salsa.debian.org/kernel-team/firmware-nonfree/-/merge_requests/150">!150: Update and remove obsolete package relations</a></li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/firmware-nonfree/news/">Uploads</a>: <ul> <li>uploaded version 20260519-1 to unstable</li> <li>uploaded version 20260519-1~bpo13+1 to trixie-backports</li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/kernel-wedge">kernel-wedge</a>: <ul> <li><a href="https://tracker.debian.org/pkg/kernel-wedge/news/">Uploads</a>: <ul> <li>uploaded version 2.106~deb12u1 to bookworm-security</li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/linux">linux</a>: <ul> <li><a href="https://bugs.debian.org/src:linux">Bugs</a>: <ul> <li>closed <a href="https://bugs.debian.org/1128861">#1128861: linux: when serving NFS, client attempts to lock served files fail with “No locks available”</a></li> <li>replied to <a href="https://bugs.debian.org/1140461">#1140461: spam wave of kernel: tpm tpm0: tpm_try_transmit: send(): error -62</a></li> </ul> </li> <li>Merge requests: <ul> <li>reviewed <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1936">!1936: [sparc64] Add nvme module to scsi-modules udeb</a></li> <li>reviewed <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1948">!1948: [amd64] Enable Intel Platform Hardware Support Drivers</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1977">!1977: Fix build failure over missing vdso debug files</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1981">!1981: 6.1 backport “bpf: Free reuseport cBPF prog after RCU grace period.”</a></li> <li>opened <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1984">!1984: udeb: Ensure that aead and macsec modules are in the right packages</a></li> <li>opened <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1985">!1985: Add d/.flake8 config file to support pylsp</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1992">!1992: 6.1 backport: ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909)</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1993">!1993: 5.10 backport: ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909)</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1999">!1999: 6.1 backport: Fix CVE-2026-46331</a></li> <li>opened <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/2004">!2004: [sparc64] udeb: scsi-modules: Use the default module list</a></li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/linux/news/">Uploads</a>: <ul> <li>(LTS) uploaded version 6.12.94-1~bpo12+1 to bookworm-backports</li> <li>uploaded version 7.0.12-2~bpo13+1 to trixie-backports</li> <li>uploaded version 7.1~rc7-1~exp1 to experimental</li> </ul> </li> <li>(LTS) updated the bullseye-security branch to 5.10.259, but did not upload this version</li> <li>(LTS) updated the bookworm-security branch to 6.1.176, but did not upload this version</li> </ul> </li> <li>(LTS) linux-6.12: <ul> <li>prepared this backport package for bookworm-security, but did not upload it yet</li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/linux-base">linux-base</a>: <ul> <li><a href="https://tracker.debian.org/pkg/linux-base/news/">Uploads</a>: <ul> <li>uploaded version 4.12.1~deb12u1 to bookworm-security</li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/wireless-regdb">wireless-regdb</a>: <ul> <li>Merge requests: <ul> <li>opened and merged <a href="https://salsa.debian.org/kernel-team/wireless-regdb/-/merge_requests/8">!8: Update to 2026.05.30</a></li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/wireless-regdb/news/">Uploads</a>: <ul> <li>uploaded version 2026.05.30-1 to unstable</li> <li>uploaded version 2026.05.30-1~deb12u1 to bookworm</li> <li>uploaded version 2026.05.30-1~deb13u1 to trixie</li> </ul> </li> </ul> </li> </ul> </li> <li>Debian non-package bugs: <ul> <li><a href="https://bugs.debian.org/release.debian.org">release.debian.org</a>: <ul> <li>opened and closed <a href="https://bugs.debian.org/1139579">#1139579: trixie-pu: package wireless-regdb/2026.05.30-1~deb13u1</a></li> <li>opened <a href="https://bugs.debian.org/1139581">#1139581: trixie-pu: package wireless-regdb/2026.05.30-1~deb13u1</a></li> <li>opened <a href="https://bugs.debian.org/1139582">#1139582: bookworm-pu: package wireless-regdb/2026.05.30-1~deb12u1</a></li> </ul> </li> </ul> </li> <li>Mailing lists: <ul> <li><a href="https://lists.debian.org/debian-backports/">debian-backports</a>: <ul> <li>(LTS) posted <a href="https://lists.debian.org/31d77827ecf42782c97cb4b4213197c33a33b0ea.camel@decadent.org.uk">EOL for bookworm-backports</a></li> </ul> </li> <li><a href="https://lists.debian.org/debian-boot/">debian-boot</a>: <ul> <li>(LTS) posted and replied to <a href="https://lists.debian.org/03ecb84264a8b6018633c64d3e4a004dd5e10363.camel@decadent.org.uk">Adding Linux 6.12 udebs for bookworm LTS</a></li> </ul> </li> <li><a href="https://lists.debian.org/debian-devel/">debian-devel</a>: <ul> <li>replied to <a href="https://lists.debian.org/eaf26a4b6ff54f8855c71fe84b077c694486804f.camel@decadent.org.uk">Understanding CI in Salsa, timeouts and runners</a></li> </ul> </li> <li><a href="https://lists.debian.org/debian-kernel/">debian-kernel</a>: <ul> <li>posted <a href="https://lists.debian.org/aca2f071cd39f2c9d75d081c7be2371f98f54f4f.camel@decadent.org.uk">Agenda items for kernel-team meeting on 2026-06-10</a></li> </ul> </li> <li><a href="https://lists.debian.org/debian-lts/">debian-lts</a>: <ul> <li>posted and replied to <a href="https://lists.debian.org/21b31300c29a7ed8c9871bd9e7beb25b2cc79e18.camel@decadent.org.uk">Preparation for Linux 6.12 in bookworm</a></li> </ul> </li> <li><a href="https://lists.debian.org/debian-lts-announce/">debian-lts-announce</a>: <ul> <li>posted <a href="https://lists.debian.org/aivd9n_B7HR1593x@decadent.org.uk">[SECURITY] [DLA 4627-1] kernel-wedge update</a></li> <li>posted <a href="https://lists.debian.org/aiveDYMhYvx0ykIK@decadent.org.uk">[SECURITY] [DLA 4628-1] linux-base update</a></li> </ul> </li> <li>(LTS) <a href="https://lore.kernel.org/stable/">stable</a>: <ul> <li>reviewed &gt;1000 patches included in 5.10.258-rc1, 5.10.259-rc1, and 6.1.176-rc1</li> <li>replied to <a href="https://lore.kernel.org/stable/211fb901ba2c644e6ebdffe46d9face7e317db70.camel@decadent.org.uk/T/">[PATCH 5.10 210/589] spi: rockchip: fix controller deregistration</a></li> <li>replied to <a href="https://lore.kernel.org/stable/7e870e1219db98c9e19777eedfa3b0eb41f41235.camel@decadent.org.uk/T/">[PATCH 5.10 211/589] net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked</a></li> <li>replied to <a href="https://lore.kernel.org/stable/ab577daf17c46a72e35c668756d5b33b3ca3ca09.camel@decadent.org.uk/T/">[PATCH 5.10 238/342] net: bridge: use a stable FDB dst snapshot in RCU readers</a></li> <li>replied to <a href="https://lore.kernel.org/stable/7fee88099501bfa87594114a5f8c17a760ded36a.camel@decadent.org.uk/T/">[PATCH 5.10 244/589] spi: topcliff-pch: fix use-after-free on unbind</a></li> <li>replied to <a href="https://lore.kernel.org/stable/7ccc26ea6552c9fcae1817e2601a96901f0ca261.camel@decadent.org.uk/T/">[PATCH 5.10 245/589] cpuidle: powerpc: avoid double clear when breaking snooze</a></li> <li>replied to <a href="https://lore.kernel.org/stable/8135746e835e432d7b0f21e142389cf8b4979f0f.camel@decadent.org.uk/T/">[PATCH 5.10 257/589] PCI/AER: Stop ruling out unbound devices as error source</a></li> <li>replied to <a href="https://lore.kernel.org/stable/8cd2c0613f018690cba5ae76c4ab73da05118312.camel@decadent.org.uk/T/">[PATCH 5.10 263/589] media: uvcvideo: Enable VB2_DMABUF for metadata stream</a></li> <li>replied to <a href="https://lore.kernel.org/stable/dbb2510d89e3545af204a7bf3eac06512042120e.camel@decadent.org.uk/T/">[PATCH 5.10 267/589] media: rc: streamzap: Error handling in probe</a></li> <li>replied to <a href="https://lore.kernel.org/stable/edea6d36625f362c3fcaed6bd251a02827081a1d.camel@decadent.org.uk/T/">[PATCH 5.10 274/589] drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()</a></li> <li>replied to <a href="https://lore.kernel.org/stable/2698831f24c7efea34dc4b34d996ff8327ecc206.camel@decadent.org.uk/T/">[PATCH 5.10 503/589] crypto: af_alg - Cap AEAD AD length to 0x80000000</a></li> <li>replied to <a href="https://lore.kernel.org/stable/f0be2ecfe2c27c1920a44b6f41d8db87611267f1.camel@decadent.org.uk/T/">[PATCH 5.10 035/342] batman-adv: tp_meter: fix race condition in send error reporting</a></li> <li>replied to <a href="https://lore.kernel.org/stable/3374d4b14a7c54f82fb016ab66f3b262f55145fe.camel@decadent.org.uk/T/">[PATCH 5.10 036/342] batman-adv: tp_meter: avoid role confusion in tp_list</a></li> <li>replied to <a href="https://lore.kernel.org/stable/72890f3caf368d0e4dcb5d1ec53c083c16ce8b20.camel@decadent.org.uk/T/">[PATCH 5.10 310/342] usb: typec: ucsi: Dont update power_supply on power role change if not connected</a></li> <li>replied to <a href="https://lore.kernel.org/stable/d9c2e8ea23b1919fe663e480cc7def260ed0ee24.camel@debian.org/T/">[PATCH 5.15 002/570] ip6_tunnel: Fix usage of skb_vlan_inet_prepare()</a></li> <li>replied to <a href="https://lore.kernel.org/stable/b6441670bdb04dc530f433bd21d6c64feb633355.camel@decadent.org.uk/T/">[PATCH 5.15 299/411] ALSA: aloop: Fix peer runtime UAF during format-change stop</a></li> <li>replied to <a href="https://lore.kernel.org/stable/66cf4f95534aa5428a362857cf78dcb946c51672.camel@decadent.org.uk/T/">[PATCH 5.15 323/411] spi: topcliff-pch: fix controller deregistration</a></li> <li>replied to <a href="https://lore.kernel.org/stable/9125d5976feb09ef919f2a287b079843c7671325.camel@decadent.org.uk/T/">[PATCH 6.1 011/522] tools/bootconfig: Cleanup bootconfig footer size calculations</a></li> <li>replied to <a href="https://lore.kernel.org/stable/cb2e59a48887f106a57c3fbef66d5a164b8e2f5f.camel@decadent.org.uk/T/">[PATCH 6.1 033/522] net/sched: Revert “net/sched: Restrict conditions for adding duplicating netems to qdisc tree”</a></li> <li>replied to <a href="https://lore.kernel.org/stable/b6b679743c2383b5a367c5d72404b056dfebf080.camel@decadent.org.uk/T/">[PATCH 6.1 054/522] selftests/bpf: add generic BPF program tester-loader</a></li> <li>replied to <a href="https://lore.kernel.org/stable/80be436bbcda9b8a66058c01eef0b0f94722e7ef.camel@decadent.org.uk/T/">[PATCH 6.1 064/522] selftests/bpf: S/iptables/iptables-legacy/ in the bpf_nf and xdp_synproxy test</a></li> <li>replied to <a href="https://lore.kernel.org/stable/6f805abf1f8b058c1b1241e8568d7539185145df.camel@decadent.org.uk/T/">[PATCH 6.1 208/522] net: Annotate sk-&gt;sk_write_space() for UDP SOCKMAP.</a></li> <li>replied to <a href="https://lore.kernel.org/stable/afe207eb91522718cfae8b77310999ca397c81bf.camel@decadent.org.uk/T/">[PATCH 6.1 249/522] r8152: Block future register access if register access fails</a></li> <li>replied to <a href="https://lore.kernel.org/stable/b0d5836032ce3135bfc473f6bff791306d086925.camel@decadent.org.uk/T/">[PATCH 6.1 337/522] arm64/mm: Enable batched TLB flush in unmap_hotplug_range()</a></li> <li>replied to <a href="https://lore.kernel.org/stable/42c2abbdfdd4ea8e234fbcfc4b37095ebd2c7b36.camel@decadent.org.uk/T/">[PATCH 6.1 342/522] thermal: core: Fix thermal zone governor cleanup issues</a></li> <li>replied to <a href="https://lore.kernel.org/stable/6218e66138c5c1c5fb02bd653c8b91d6ff8c3abd.camel@decadent.org.uk/T/">[PATCH 6.1 375/522] net: ipv4: stop checking crypto_ahash_alignmask</a></li> <li>replied to <a href="https://lore.kernel.org/stable/0e31e18e9567e8d58fbb8e06955c3ed8e5a120d3.camel@decadent.org.uk/T/">[PATCH 6.1 431/522] cgroup/cpuset: Reset DL migration state on can_attach() failure</a></li> <li>replied to <a href="https://lore.kernel.org/stable/2ac6b67a0643e111692689daa95dbd8883f16426.camel@decadent.org.uk/T/">[PATCH 6.1 470/522] usb: musb: omap2430: Fix use-after-free in omap2430_probe()</a></li> </ul> </li> </ul> </li> </ul> 2026-07-01T10:39:27+00:00 Ben Hutchings http://dirk.eddelbuettel.com/blog/2026/06/30#tl_0.0.2 <p>The still-very-new logging package <a href="https://github.com/eddelbuettel/tl">tl</a> was just updated for the first time at <a href="https://cran.r-project.org">CRAN</a>. The <a href="https://github.com/eddelbuettel/tl">tl</a> package wraps the (also very new) <a href="https://github.com/eddelbuettel/rspdlite">rspdlite</a> package to offer a lightweight and consistent logging interface from both R and C++ that enjoys being ‘tiny, fast, capable’ thanks to <a href="https://github.com/gabime/spdlite">spdlite</a>. With <a href="https://github.com/eddelbuettel/tl">tl</a> we follow the same idea that our <a href="https://github.com/eddelbuettel/spdl">spdl</a> package introduced: a simple consistent interface via just the <code>tl::</code> prefix and the appropropriate logging level. In other words <code>tl::debug("Alert: foo now '{}'", foo)</code> will work from both R and C++ (given a variable <code>foo</code>, and, in the case of C++, an extra semicolon) and log if the current level is ‘debug’ or higher, and skip logging if not.</p> <p>This release adds a fallback when compilation does not use the (required) C++20 standard, expands the README and adds a initialization helper function reflecting a preferred default logging level from either an environment variable or a global option. We are also working on adding <a href="https://github.com/eddelbuettel/tl">tl</a> to an example package as a simple illustration, more on that hopefully soon.</p> <p>The NEWS entry for this release follows.</p> <blockquote> <h4 id="changes-in-version-0.0.2-2025-06-30">Changes in version 0.0.2 (2025-06-30)</h4> <ul> <li><p>Added badges to README now that package is on CRAN, add NEWS file</p></li> <li><p>Condition the provided header on C++20 use, offer fallback</p></li> <li><p>Add an exported initialization function picking up a logging level from either an environment variable or a global option, see '?init'</p></li> </ul> </blockquote> <p>Courtesy of my <a href="https://dirk.eddelbuettel.com/cranberries/">CRANberries</a>, there is also a <a href="https://dirk.eddelbuettel.com/cranberries/2026/06/30/#tl_0.0.2">diffstat report</a> for the this release.</p> <p style="font-size: 80%; font-style: italic;"> This post by <a href="https://dirk.eddelbuettel.com">Dirk Eddelbuettel</a> originated on his <a href="https://dirk.eddelbuettel.com/blog/">Thinking inside the box</a> blog. If you like this or other open-source work I do, you can <a href="https://github.com/sponsors/eddelbuettel">sponsor me at GitHub</a>. </p><p></p> 2026-06-30T17:02:00+00:00 Dirk Eddelbuettel http://joeyh.name/blog/entry/big_loads_offgrid_with_a_small_battery_sidelined/ <p>No matter that the hype cycle wants you to think, the renewable energy transition is the biggest thing happening in tech and it's happening faster and faster. Despite being neck deep in it personally with offgrid solar projects, most recently solar hot water, increasingly it becomes clear I'm watching from the sidelines.</p> <p>In Australia, <a href="https://lenergy.com.au/free-daytime-electricity-is-coming-heres-how-it-actually-works/">everyone gets 24 kwh of free daytime electric power now</a>. That's without installing any solar panels of their own, the grid just has that much excess capacity. All it takes to save $thousands per year (and avoid emissions) is to schedule some big loads like the hot water heater and EV to charge during the day. To save more, drop in a home battery that charges for free and powers the home through the evening.</p> <p>In Germany, a 2 kwh plug-in home battery costs $350 and the electric company will <a href="https://octopusenergy.de/smarte-geraete/heimspeicher-powerbank">pay you</a> $130 per year to plug it into your wall. There are similar offers throughout Europe.</p> <p>In Cuba something something geopolitics, oil blockade, belt and road =&gt; suddenly 1GW of solar farms with another gigawatt on the way.</p> <p>I'll soon visit South Carolina where with no subsidies whatsoever from a decidedly renewable-unfriendly government, it made sense for my dad's house to get a whole home battery and double the solar array. The resulting system will be able to power the well pump and probably also the whole geothermal HVAC system through the kind of month-long grid down events that happened in Hurricane Helene.</p> <p>Myself, well, I've got a by modern standards small 4 kwh home battery that powers my house offgrid, and I've recently installed a heat pump hot water heater. That's after about a decade pondering what solution to use for solar hot water, to replace an aging and horrible propane instant water heater. I've in the past considered everything from evacuated tubes to special direct drive inverters to DC resistive MPTT dump loads. The solution turned out to be just a big enough solar array, and plugging in a 120v hot water heater that needs only 500 watts in heat pump mode. Plus a small amount of code to manage when it runs.</p> <p>In the time I was thinking about that, economies of scale and tech improvements just wiped all those other possibilities off the map, it's not economical to install and maintain a separate evactuated tube heat collector when a pile of solar panels costs so little and when electric hot water has gotten more than 200% efficient.</p> <p>I also recently completed my permanant EV charger installation, with a new inverter and conduit and proper wiring, and increased the car's charge rate to 2 kw. Eliminating the need to charge anywhere except at home except on road trips.</p> <p>Coordinating when these two big loads run, to maximize solar production and ensure that the house battery is full at the end of the day was ... not hard at all actually? The car charger amps can be dialed up and down to match incoming solar power fairly well, and leave some room for the hot water heater. They both operate as more or less dump loads. More or less because neither one can be cycled on or off very fast (to avoid wear and tear on the car's contactor and the heat pump's compressor), so it makes sense to leave them on and skate through short cloudy sections of the day, as long as the house battery doesn't get too low.</p> <p>How low is too low for the house battery? Depends on the time of day. The code it's currently using, which may get tweaked over winter:</p> <div class="highlight-haskell"><pre class="hl"> <span class="hl slc">-- When the battery is charged enough to run major loads that may prevent</span> <span class="hl slc">-- charging it further.</span> <span class="hl slc">--</span> <span class="hl slc">-- This varies with the hour of day. Early in the day, the battery does not</span> <span class="hl slc">-- need to be as full to be considered well charged, since there is</span> <span class="hl slc">-- still plenty of time for it to charge up. Later in the day, with less</span> <span class="hl slc">-- time to charge, it needs to be more full.</span> wellCharged :: Hour <span class="hl opt">-&gt;</span> Percentage wellCharged <span class="hl kwc">(</span>Hour hour<span class="hl kwc">)</span> <span class="hl opt">|</span> hour <span class="hl opt">&lt;</span> <span class="hl num">9</span> <span class="hl opt">=</span> Percentage <span class="hl num">90</span> <span class="hl slc">-- night</span> <span class="hl opt">|</span> pmhour <span class="hl opt">&lt;=</span> <span class="hl num">0</span> <span class="hl opt">=</span> Percentage <span class="hl num">50</span> <span class="hl opt">|</span> pmhour <span class="hl opt">&lt;=</span> <span class="hl num">1</span> <span class="hl opt">=</span> Percentage <span class="hl num">60</span> <span class="hl opt">|</span> pmhour <span class="hl opt">&lt;=</span> <span class="hl num">2</span> <span class="hl opt">=</span> Percentage <span class="hl num">70</span> <span class="hl opt">|</span> pmhour <span class="hl opt">&lt;=</span> <span class="hl num">3</span> <span class="hl opt">=</span> Percentage <span class="hl num">80</span> <span class="hl opt">|</span> pmhour <span class="hl opt">&lt;=</span> <span class="hl num">4</span> <span class="hl opt">=</span> Percentage <span class="hl num">90</span> <span class="hl opt">|</span> otherwise <span class="hl opt">=</span> Percentage <span class="hl num">95</span> <span class="hl kwb">where</span> pmhour <span class="hl opt">=</span> hour <span class="hl opt">-</span> <span class="hl num">12</span> </pre></div> <p>More complicated is, what to do it there's solar power to run one or the other, but not both? This is starting to get into the territory of microgrids now, or of demand response programs, so there's a whole industry or three out there doing industry things geared at the kind of no-brainer solutions I mentioned earlier. From what I've gathered, all of them involve proprietary protocols and gear.</p> <p>What I've done is to read the state of the hot water heater and car, and prioritize hot water over the car. Except, if the car is below 10% it urgently needs to charge.</p> <p>And I found a really simple way to decide when to run the low-priority load: Just check if the house battery's current charge will be considered <code>wellCharged</code> in an hour. So if it's 2 pm, the battery needs to be 80% charged to run the lower-priority load, and if it dips below that, that load will turn off but the high-priority load will keep running down to 70% battery.</p> <p>Unfortunately, getting any information out of my hot water heater relies on a vendor API server that is often down on weekends, and reverse engineered the web page of my EVSE[1] to control it, to say nothing of the nightmare of getting the car's state of charge from The Cloud.</p> <p>Anyway, I'm pleased with having easily tweakable code and how far I've taken this offgrid, and everything I've learned doing so, but like I said, I'm clearly observing from the sidelines over here while the most significant thing for all of us is going on over there. You might appreciate my code or method, but you'll eventually be plugging in a home battery or signing up for a free daytime power tarrif from your electric company, or having professionals install a whole home system for climate resiliance.</p> <p>So my question is, where does free software fit into all this? There are things like Home Assistant that do productize the kind of thing I'm doing enough to be useful more widely. But still niche. Meanwhile there are inverters and batteries that phone home to China, and every consumer facing install is either "use this device" or "integrate these 3 proprietary devices".</p> <p>I don't think focusing on these negatives is really useful though, I'm more trying to understand where all this is going and then maybe get out ahead of it in some useful way with free software. Your thoughts welcome.</p> <hr /> <p>[1] Obviously OpenEVSE exists, but it didn't meet my needs hardware wise. And I could set my EVSE to use an OCPP server but it was easier to do the screen scraping than find an appropriate one, and I have the feeling I would not appreciate learning any more about OCPP, in the same way I really don't want to know a lot about web browsers' tag soup mode.</p> 2026-06-30T16:15:06+00:00 Joey Hess https://etbe.coker.com.au/2026/06/30/links-june-2026/ <p><a href="https://www.schneier.com/blog/archives/2026/06/critical-zcash-vulnerability-found-and-fixed.html">This is amusing, a flaw in the crypto-currency Zcash allowed generating Zcash from nothing and there’s no way to know if anyone did that [1]</a>.</p> <p><a href="https://locusmag.com/feature/commentary-cory-doctorow-the-age-of-vapor/">Cory Doctorow wrote an insightful article for Locus Magazine about corporate valuations and why companies claim SciFi technologies [2]</a>.</p> <p><a href="http://www.antipope.org/charlie/blog-static/2026/06/rule-by-bond-villains.html">Charles Stross wrote an interesting retcon of James Bond [3]</a>.</p> <p><a href="https://trakkr.ai/bias">Trakkr.ai has an intresting post comparing political bias in LLM models, the site has lots of other comparisons of models too [4]</a>.</p> <p><a href="https://grep.be/blog//en/computer/Agentic_coding_and_Free_Software/">Wouter Verhelst wrote a blog post about his tested usage of LLMs for code generation and the conclusions about what it will do to the FOSS development process, not a lot of new material but he put a lot of good ideas together in one place [5]</a>.</p> <p><a href="https://github.com/jtesta/ssh-audit">Here is the git repository for the programs used for the ssh-audit.com site, really good setup for checking ssh configuration [6]</a>.</p> <p><a href="https://isaiprofitable.com/">The isaiprofitable.com site is periodically updated with the profit/loss totals for AI companies, no surprise that every company is losing money apart from NVidia and NVidia are investing in the other companies [7]</a>.</p> <p><a href="https://freedium-mirror.cfd/https://medium.com/@elvirabary/why-russia-cant-build-anything-anymore-inside-putin-s-failed-tech-e63e27ee40b0">Elvira Bary wrote an informative article about Russia’s inability to build or design anything good [8]</a>. Looks like we are at risk of another Chernobyl…</p> <p><a href="http://levlafayette.com/node/808">Lev Lafayette wrote an interesting blog post about the Sunway TaihuLight supercomputer with over 10,000,000 cores [9]</a>.</p> <p><a href="https://point.free/blog/gemma-4-on-a-2016-xeon/">Point Free wrote an interesting blog post about running the Gemma 4 LLM which is 25G of data at a usable speed on a Xeon system with DDR3 RAM and no GPU [10]</a>.</p> <ul> <li>[1]<a href="https://www.schneier.com/blog/archives/2026/06/critical-zcash-vulnerability-found-and-fixed.html"> https://tinyurl.com/2cxx2e6h</a></li> <li>[2]<a href="https://locusmag.com/feature/commentary-cory-doctorow-the-age-of-vapor/"> https://tinyurl.com/2cxotle7</a></li> <li>[3]<a href="http://www.antipope.org/charlie/blog-static/2026/06/rule-by-bond-villains.html"> https://tinyurl.com/2bgapt88</a></li> <li>[4]<a href="https://trakkr.ai/bias"> https://trakkr.ai/bias</a></li> <li>[5]<a href="https://grep.be/blog//en/computer/Agentic_coding_and_Free_Software/"> https://tinyurl.com/22s2fome</a></li> <li>[6]<a href="https://github.com/jtesta/ssh-audit"> https://github.com/jtesta/ssh-audit</a></li> <li>[7]<a href="https://isaiprofitable.com/"> https://isaiprofitable.com/</a></li> <li>[8]<a href="https://freedium-mirror.cfd/https://medium.com/@elvirabary/why-russia-cant-build-anything-anymore-inside-putin-s-failed-tech-e63e27ee40b0"> https://tinyurl.com/26p4lkr4</a></li> <li>[9]<a href="http://levlafayette.com/node/808"> http://levlafayette.com/node/808</a></li> <li>[10]<a href="https://point.free/blog/gemma-4-on-a-2016-xeon/"> https://point.free/blog/gemma-4-on-a-2016-xeon/</a></li> </ul> <div class="yarpp yarpp-related yarpp-related-rss yarpp-template-list"> <p>Related posts:</p><ol> <li><a href="https://etbe.coker.com.au/2022/06/30/links-june-2022/" rel="bookmark" title="Links June 2022">Links June 2022</a> <small>Google did some interesting research on the impact of discrimination...</small></li> <li><a href="https://etbe.coker.com.au/2026/04/30/links-april-2026/" rel="bookmark" title="Links April 2026">Links April 2026</a> <small>Charles Stross wrote an interesting blog post about the apparent...</small></li> <li><a href="https://etbe.coker.com.au/2026/02/17/links-february-2026/" rel="bookmark" title="Links February 2026">Links February 2026</a> <small>Charles Stross has a good theory of why “AI” is...</small></li> </ol> </div> 2026-06-30T13:53:19+00:00 etbe https://etbe.coker.com.au/2026/06/30/dirtyclone-selinux/ <p>There is a <a href="https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/">new Linux kernel exploit out named Dirty Clone [1]</a>.</p> <p>The first thing to do to exploit this is to create a container with a separate network namespace via one of the following commands:</p> <pre>unshare -Urn bwrap --bind / / --unshare-user --unshare-net --uid 0 --gid 0 /bin/bash</pre> <p>The Jfrog people recommend “unshare -Urn” but I gave the Bubblewrap command as an option as it should work equally well and in some situations may be permitted when unshare isn’t.</p> <p>The next step to exploiting it is to use the ip command to set the links up, below is what happens in a user session on a SE Linux system with user_t as the login domain:</p> <pre># ip link set lo up RTNETLINK answers: Operation not permitted</pre> <p>That will give an entry in /var/log/audit/audit.log like the following:</p> <pre>type=AVC msg=audit(1782818856.618:3610): avc: denied { net_admin } for pid=1829 comm="ip" capability=12 scontext=user_u:user_r:user_t:s0 tcontext=user_u:user_r:user_t:s0 tclass=cap_userns permissive=0 type=SYSCALL msg=audit(1782818856.618:3610): arch=c000003e syscall=46 success=yes exit=32 a0=3 a1=7ffebe5f9e50 a2=0 a3=0 items=0 ppid=1638 pid=1829 auid=0 uid=0 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=17 comm="ip" exe="/usr/bin/ip" subj=user_u:user_r:user_t:s0 key=(null)ARCH=x86_64 SYSCALL=sendmsg AUID="root" UID="root" GID="test" EUID="root" SUID="root" FSUID="root" EGID="test" SGID="test" FSGID="test" type=PROCTITLE msg=audit(1782818856.618:3610): proctitle=6970006C696E6B00736574006C6F007570</pre> <p>Unlike previous exploits like <a href="https://etbe.coker.com.au/2026/05/24/debian-selinux-pintheft/">Pintheft [2]</a> this doesn’t require any really uncommon access to the kernel (unless you consider setting up IPSec to be really uncommon) and is allowed in many container setups.</p> <p>Now on a system with the unconfined module removed (as described in the <a href="https://etbe.coker.com.au/2026/05/04/copy-fail-on-debian-and-se-linux/#SE_Linux_Protection">SE Linux Protection part of my post about Copy Fail [3]</a>) the following domains have such access:</p> <pre># sesearch -A -c cap_userns -p net_admin allow container_engine_t container_engine_t:cap_userns { audit_write chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mknod net_admin net_bind_service net_raw setfcap setgid setpcap setuid sys_admin sys_boot sys_chroot sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config }; allow container_init_t container_init_t:cap_userns { chown dac_override dac_read_search fowner kill net_admin net_bind_service net_raw setgid setuid }; allow container_kvm_t container_kvm_t:cap_userns { chown dac_override dac_read_search fowner kill net_admin net_bind_service net_raw setgid setuid }; allow container_t container_t:cap_userns { chown dac_override dac_read_search fowner kill net_admin net_bind_service net_raw setgid setuid }; allow crio_t crio_t:cap_userns { audit_write chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mknod net_admin net_bind_service net_raw setfcap setgid setpcap setuid sys_admin sys_boot sys_chroot sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config }; allow dockerd_t dockerd_t:cap_userns { audit_write chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mknod net_admin net_bind_service net_raw setfcap setgid setpcap setuid sys_admin sys_boot sys_chroot sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config }; allow dockerd_user_t dockerd_user_t:cap_userns { audit_write chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mknod net_admin net_bind_service net_raw setfcap setgid setpcap setuid sys_admin sys_boot sys_chroot sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config }; allow init_t init_t:cap_userns { audit_write chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mknod net_admin net_bind_service net_raw setfcap setgid setpcap setuid sys_admin sys_boot sys_chroot sys_module sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config }; allow iptables_t iptables_t:cap_userns { net_admin net_raw }; allow podman_t podman_t:cap_userns { audit_write chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mknod net_admin net_bind_service net_raw setfcap setgid setpcap setuid sys_admin sys_boot sys_chroot sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config }; allow podman_user_t podman_user_t:cap_userns { audit_write chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mknod net_admin net_bind_service net_raw setfcap setgid setpcap setuid sys_admin sys_boot sys_chroot sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config }; allow spc_t spc_t:cap_userns { audit_write chown dac_override dac_read_search fowner fsetid ipc_lock kill mknod net_admin net_bind_service net_raw setgid setpcap setuid sys_admin sys_chroot sys_nice sys_ptrace sys_rawio sys_resource }; allow spc_user_t spc_user_t:cap_userns { chown dac_override dac_read_search fowner kill net_admin net_bind_service net_raw setgid setuid }; allow staff_bubblewrap_t staff_bubblewrap_t:cap_userns { dac_override net_admin setpcap sys_admin sys_ptrace }; allow sysadm_bubblewrap_t sysadm_bubblewrap_t:cap_userns { dac_override net_admin setpcap sys_admin sys_ptrace }; allow user_bubblewrap_t user_bubblewrap_t:cap_userns { dac_override net_admin setpcap sys_admin sys_ptrace };</pre> <h2>Conclusion</h2> <p>It seems that SE Linux configured in the strict mode prevents this exploit in the most obvious use case. But with the range of container related domains that are granted such access it seems quite likely that some configurations and use cases will permit it.</p> <p>Overall the protection that the standard policy for SE Linux can offer (in a non-default configuration) against net_admin access isn’t bad, but isn’t very good either.</p> <p>I think this will be the first of many exploits based on cap_userns access and that we need to do some work in tightening the SE Linux access controls on such things. One possible way of doing this is to have a program run inside a container in a domain that has permissions such as net_admin to setup the container and not allow domain transitions from the regular programs run in the container (the actual work) to the domain used for network setup.</p> <p>The increasing use of containers by applications is only going to make this problem worse. I think that what we need is something like <a href="https://en.wikipedia.org/wiki/Flatpak">Flatpak</a> for the vast majority of desktop/phone applications with a container setup program that works with apps packaged in the distribution packaging method (not from Flathub). This is something I’m going to investigate for future blog posts.</p> <ul> <li>[1]<a href="https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/"> https://tinyurl.com/26q48bg4</a></li> <li>[2]<a href="https://etbe.coker.com.au/2026/05/24/debian-selinux-pintheft/"> https://etbe.coker.com.au/2026/05/24/debian-selinux-pintheft/</a></li> <li>[3]<a href="https://etbe.coker.com.au/2026/05/04/copy-fail-on-debian-and-se-linux/#SE_Linux_Protection"> https://etbe.coker.com.au/2026/05/04/copy-fail-on-debian-and-se-linux/</a></li> </ul> <div class="yarpp yarpp-related yarpp-related-rss yarpp-template-list"> <p>Related posts:</p><ol> <li><a href="https://etbe.coker.com.au/2024/07/21/selinux-dell-mgmt/" rel="bookmark" title="SE Linux Policy for Dell Management">SE Linux Policy for Dell Management</a> <small>The recent issue of Windows security software killing computers has...</small></li> <li><a href="https://etbe.coker.com.au/2024/10/26/cups-vulnerability/" rel="bookmark" title="The CUPS Vulnerability">The CUPS Vulnerability</a> <small>The Announcement Late last month there was an announcement of...</small></li> <li><a href="https://etbe.coker.com.au/2026/05/08/dirty-frag-on-debian-and-se-linux/" rel="bookmark" title="Dirty Frag on Debian and SE Linux">Dirty Frag on Debian and SE Linux</a> <small>Hot on the heels of the Copy Fail vulnerability [1]...</small></li> </ol> </div> 2026-06-30T12:04:25+00:00 etbe https://etbe.coker.com.au/2026/06/28/plaud/ <p>While watching a YouTube video I saw an advert for the <a href="https://www.plaud.ai/">Plaud AI Note Taker [1]</a>. The Plaud device looks pretty good for what it does, taking notes and managing them, using some sort of LLM function to manage the notes. The devices all cost about $300 which is an amount that doesn’t seem unreasonable for someone who’s in a lot of meetings. One of the models is the “NotePin” that seems comparable to the <a href="https://etbe.coker.com.au/2024/04/26/humane-ai-pin/">Humane AI Pin I previously blogged about [2]</a>.</p> <p>The business model for Plaud is based on only allowing 5 hours per month of free transcriptions, then charging $16.25/month for 20 hours per month and $33.33/month for unlimited use. That’s quite expensive for any serious use.</p> <p>The number of people in the market for an audio recording system that automatically transcribes things may be greater than the number of people in the market for all the stuff that the Humane AI Pin did, but it still may not be enough to run a profitable business when competing with apps on mobile phones.</p> <p>While the product does look decent it seems that they are making the same mistakes as the original Humane developers did, of wanting to lock it down as a subscription based service which reduces the usability of the device. If they had sold an Android hand-held computer with their own app pre-loaded and allowed the user to install a different app then it would have been much more usable. If they had sold Android devices designed for the note taking market and allowed people to choose their own apps to install then their products would have a much longer life expectancy.</p> <p>The majority of Android devices in use are probably out of support but still working while the Humane AI pin can’t be used any more and at some time in the not too distant future the Plaud devices will also become unusable. People who buy devices like the Plaud seem to be unaware of the history of such things and the expected future for them. But possibly some people just consider $300 for a year of use to be an acceptable price. If someone wanted to purchase a new high end phone every year and sell their previous one they would probably have a net cost of about $500/year.</p> <p>Maybe I should look for work with a company with an implausible AI based business plan. It would be fun developing such a device if you weren’t emotionally invested in the project. Just develop new technology, earn a heap of money, play with fun computers, and move on to the next thing when it collapses. Just like all the Internet companies about 25 years ago.</p> <ul> <li>[1]<a href="https://www.plaud.ai/"> https://www.plaud.ai/</a></li> <li>[2]<a href="https://etbe.coker.com.au/2024/04/26/humane-ai-pin/"> https://etbe.coker.com.au/2024/04/26/humane-ai-pin/</a></li> </ul> <div class="yarpp yarpp-related yarpp-related-rss yarpp-template-list"> <p>Related posts:</p><ol> <li><a href="https://etbe.coker.com.au/2010/11/17/mobile-phone-sysadmin/" rel="bookmark" title="A Mobile Phone for Sysadmin Use">A Mobile Phone for Sysadmin Use</a> <small>My telco Three have just offered me a deal on...</small></li> <li><a href="https://etbe.coker.com.au/2013/02/22/iphone-vs-android/" rel="bookmark" title="iPhone vs Android">iPhone vs Android</a> <small>A friend who’s a long-time iPhone user just asked for...</small></li> <li><a href="https://etbe.coker.com.au/2016/06/01/i-just-ordered-a-nexus-6p/" rel="bookmark" title="I Just Ordered a Nexus 6P">I Just Ordered a Nexus 6P</a> <small>Last year I wrote a long-term review of Android phones...</small></li> </ol> </div> 2026-06-28T05:39:14+00:00 etbe https://etbe.coker.com.au/2026/06/28/some-gpu-stuff/ <p>After getting a <a href="https://etbe.coker.com.au/2026/06/21/hp-z4-g4/">HP Z4 G4 tower server/workstation to house my Intel Battlemage GPU [1]</a> I’ve been playing around with some GPU stuff. For years I’ve been just buying GPUs based on the resolution and price and not bothering about anything else due to lack of ability to measure what cards are doing. The <b>nvidia-smi</b> program is really good for NVidia/CUDA setups but I hadn’t been aware of anything similar for AMD cards. As I prefer AMD cards for my workstations due to driver issues with NVidia that was a problem for me.</p> <p>I’ve recently discovered that the program <b>nvtop</b> (Debian package <b>nvtop</b>) shows the GPU use of multiple GPU types, for me it’s worked on AMD and Intel discrete GPUs and shows some information on Intel integrated GPUs, I don’t have others convenient for testing at the moment. Currently BOINC has the <a href="https://einsteinathome.org/">Einstein@Home [2]</a> project running on the HP Z4 G4 and it’s using between 66% and 100% of GPU compute power and 1.6G of GPU RAM. Using 100% GPU compute power allegedly takes 62W of power out of the 190W quoted TDP. I presume that the power use reported by nvtop is very inaccurate.</p> <p>A friend installed a LLM on that system and the libraries used for the LLM were sufficient that BOINC just started using the GPU.</p> <p>On my workstation running an AMD “[Radeon RX 460/560D / Pro 450/455/460/555/555X/560/560X]” (actually R560) with 4G of GPU RAM I have <b>mpv</b> taking 1G of GPU RAM to play a FullHD video expanded to a full screen window on my 5120*2160 display. I also have about 2G used by the <b>kwin_wayland</b> process (the Wayland server for KDE). That doesn’t leave enough GPU RAM to allow Einstein@Home to use the GPU. When playing the FullHD video in question (which is 1.2G for 42 minutes – about 500KB/s) at 1.5* speed (a common playback speed I use) that takes about 30% of the compute power on my GPU.</p> <p>I had installed the <b>rocm-opencl-icd</b> package on my workstation (with a 5120*2160 monitor) and restarted <b>boinc-client.service</b> which is all that’s needed to allow BOINC to use an AMD GPU. Then the screen started flickering as the Einstein process repeatedly core dumped which I initially assumed to be it’s reaction to not having enough GPU RAM available. On every core dump the screen flickered so it went through a process of dozens of screen flickers until it had caused a sufficient number of core dumps and BOINC gave up running that job.</p> <p>Another annoyance is that the <b>boincmgr</b> program (the graphical program for managing BOINC systems) launches two webkit processes that each use about 400M of GPU RAM, so even if other things weren’t using all my GPU RAM the <b>boincmgr</b> process would stop the BOINC jobs from using the GPU. I shut down some of the programs that were using GPU RAM until there was 2G free and the BOINC process kept crashing so it seems that there is some other issue.</p> <p>On another system with a 4K monitor there were Chrome and Chromium GPU process taking 1.1G and 500M of GPU RAM respectively and the KWin Wayland process was taking 1G of GPU RAM. So that’s well over half the GPU RAM for just browsers and Wayland. With programs like Kitty (terminal emulator) and Nheko (Matrix client) taking over 100M of GPU RAM it seems that 4G is the bare minimum for GPU RAM with modern software and a 4K or similar display.</p> <p>I also noticed the kscreenlocker_greet process taking 440M of GPU RAM. I wonder if a hostile web server could make a web browser take more GPU RAM and starve the screenlocker of GPU RAM, could that allow forcing a screen lock operation to fail?</p> <p>It seems that 4G is the minimum for modern systems, which isn’t necessarily a problem as GPUs that are capable of driving 4K displays tend to have no less than 4G. My local computer store has new GPUs with 4G starting at $120 but 12G seems to be the next option up which starts at about $400.</p> <p>Ebay currently has a selection of AMD GPUs with 8G of RAM under $200. I’ve had some problems with the GPU in my workstation crashing as described in <a href="https://etbe.coker.com.au/2025/11/09/amd-video-driver-issues/">my previous post where I thought it was driver issues [3]</a>. I now believe that there are hardware issues and will look into buying one of the cards with 8G.</p> <h2>Further Investigation</h2> <p>I need to determine which of the AMD GPUs that are currently going cheap on ebay are best. While my current PC has support for 150W PCIe power I’d rather something less power hungry than that. I have occasional issues of <b>mpv</b> reporting that my system is too slow for a video so slightly more compute power on the GPU would be good, but I think that every available option has significantly more compute power.</p> <p>I need to find out what the relationship is between screen resolution and GPU memory. If I get an 8K display or an array of 4*4K displays (which is quite plausible as 27″ 4K displays go for $230 each) will I find 16G of GPU RAM as limiting as I find 4G now?</p> <p>The nvtop program tracks PCIe data transfers for AMD GPUs, I haven’t yet seen more than 25MB/s and I need to do more tests to see what the maximum is. Running on an Intel Battlemage card nvtop doesn’t report PCIe data transfer speed which is a missing feature in either the driver or the program. I need to find out where the problem is and report a bug if someone hasn’t already done so.</p> <p>The GPU RAM use of some applications seems excessive. 440M for a lockscreen? 100M+ for a terminal emulator? 320M for Thunderbird?</p> <ul> <li>[1]<a href="https://etbe.coker.com.au/2026/06/21/hp-z4-g4/"> https://etbe.coker.com.au/2026/06/21/hp-z4-g4/</a></li> <li>[2]<a href="https://einsteinathome.org/"> https://einsteinathome.org/</a></li> <li>[3]<a href="https://etbe.coker.com.au/2025/11/09/amd-video-driver-issues/"> https://etbe.coker.com.au/2025/11/09/amd-video-driver-issues/</a></li> </ul> <div class="yarpp yarpp-related yarpp-related-rss yarpp-template-list"> <p>Related posts:</p><ol> <li><a href="https://etbe.coker.com.au/2023/06/16/boinc-idle-users/" rel="bookmark" title="BOINC and Idle Users">BOINC and Idle Users</a> <small>The BOINC distributed computing client in Debian (Bookworm and previous...</small></li> <li><a href="https://etbe.coker.com.au/2019/11/18/4k-monitors/" rel="bookmark" title="4K Monitors">4K Monitors</a> <small>A couple of years ago a relative who uses a...</small></li> <li><a href="https://etbe.coker.com.au/2024/11/02/what-is-workstation/" rel="bookmark" title="What is a Workstation?">What is a Workstation?</a> <small>I recently had someone describe a Mac Mini as a...</small></li> </ol> </div> 2026-06-28T05:22:09+00:00 etbe https://blog.einval.com/2026/06/27#its_dead_jim <p>I previously wrote about the upcoming <a href="https://blog.einval.com/2026/06/05#secure_boot_ca_rollover_docs">UEFI CA rollover</a>. Well, it's happened now - the old Microsoft UEFI CA from 2011 expired <strong>yesterday</strong>: </p> <p> <strong>Third Party Marketplace Root (used for signing option ROMs and other software)</strong><br /> <tt></tt></p><pre><tt> Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation UEFI CA 2011 Validity Not Before: Jun 27 21:22:45 2011 GMT Not After : Jun 27 21:32:45 2026 GMT </tt></pre> <p></p> <p><strong>It's dead - it's not coming back...</strong></p> <p>The world doesn't seem to have ended yesterday, so I guess we did ok? :-) </p> <h2>How did we do?</h2> <p>After a lot of prodding behind the scenes, Debian and many other distributions managed to get new shim binaries dual-signed with both the old and new CAs. The members of the shim-review team did a sterling job with reviews in the last few weeks. Since I started pushing people in May, we've had 21 reviews accepted successfully - see <a href="https://github.com/rhboot/shim-review/issues?q=is%3Aissue%20-label%3Ameta%20-label%3APSA%20created%3A%3E2026-05-01">here</a> for the list. Great stuff! Microsoft have also been working quickly - many of those shim submissions were accepted and signed by Microsoft very quickly too, with a turnaround time of less than 1 day in some cases.</p> <p>Not all of those signed shims have been published and used by the distros involved yet, but expect to see them in the wild in the coming weeks and months.</p> <p>These binaries should be good for people to use for the foreseeable future, until either we need to do another CA rollover or (sadly, more likely) we find an issue in shim that necessitates a new release.</p> <h2>What's next?</h2> <p>We already have <strong>one</strong> of our new dual-signed shim binaries in place in Debian, in unstable and testing (Forky) right now. In a couple of weeks from now, we'll be rolling out very similar new dual-signed shim binaries in the next point releases for Debian 12 (bookworm) and Debian 13 (trixie). We'll also be upgrading <code>fwupd</code> in both those point releases, to make DB and KEK updates work better.</p> <p>For more information about these updates, see <a href="https://wiki.debian.org/SecureBoot/CAChanges">https://wiki.debian.org/SecureBoot/CAChanges</a>. For your own safety, validate that your systems are updated when possible. If you don't, they may fail to boot in future.</p> 2026-06-27T21:33:00+00:00 Steve McIntyre https://www.earth.li/~noodles/blog/2026/06/onak-0.6.5.html <p>I had intended that the next release of onak, my OpenPGP keyserver, would be 0.7.0, and include OpenPGP v6 support (<a href="https://www.rfc-editor.org/rfc/rfc9580.html">RFC9580</a>). However events conspired to make a 0.6.5 release a really good idea.</p> <p>Firstly, I threw an LLM at the code base and asked it to review it. This isn’t intended to be a post about LLMs, but there’s a considerable amount of pressure at work to be “AI native”. I’m very much an “AI” sceptic, so I figured throwing it at a code base I know well might be an interesting exercise. It did find a bunch of embarrassing mistakes, but I don’t think there was anything earth shattering that a human reviewer wouldn’t have pulled me on. The problem is with a hobby project with a single user there’s no actual review of my work.</p> <p>I also enabled GitHub’s security scanning. It mostly complained about format strings, and those were easy enough to fix up.</p> <p>Next I threw <a href="https://aflplus.plus/">AFLplusplus</a> at the code. I’d previously tried <a href="https://lcamtuf.coredump.cx/afl/">American Fuzzy Lop</a>, but not in some time. AFL++ found a whole bunch of places I should really have checked available buffer lengths and wasn’t doing so. It really is an incredibly easy tool to get up and running.</p> <p><a href="https://valgrind.org/">valgrind</a> is also a tool I’ve used before, and rate highly. Thankfully it didn’t find anything in my testing this time.</p> <p>Finally I threw a few more automated tests into the mix and discovered something has changed around dynamic linking such that the <code class="language-plaintext highlighter-rouge">libonak</code> symbols in the dynamic key database backends were using private copies, rather than the main binary. This caused problems with seeing the correct configuration settings in some instances.</p> <p>All in all this release is not my proudest moment; a bunch of the issues fixed should never have made it to a release.</p> <p>(Also, just to explicitly state it, all the actual code in this release was artisanly crafted by me, in vim. The only involvement of an LLM was for a review pass.)</p> <p>Available <a href="https://the.earth.li/gitweb/?p=onak.git;a=summary">locally</a> or via <a href="https://github.com/u1f35c/onak">GitHub</a>.</p> <blockquote> <p>0.6.5 - 27th June 2026</p> <ul> <li>Lots of fixes/improvements around length checking</li> <li>Added extra basic tests for maxpaths/sixdegrees/CGI</li> <li>Correctly end transactions in the stacked backend</li> <li>Ensure the file backend avoids stale key data on updates</li> <li>Fix decoding of v2/3 signature creation times</li> <li>Fix EdDSA signature parsing when r &lt; 249 bits long</li> <li>Fix migration of bools from old to new config style</li> <li>Fix parsing of new config details for DB parameters</li> <li>Fix problems with linking + dynamic backends</li> <li>Fix RSA-SHA2-384 signature checking</li> <li>Fix sixdegrees parsing of keyids with high bit set</li> <li>Handle failures in maxpath more gracefully</li> <li>Make new style config path match old path</li> </ul> </blockquote> 2026-06-27T15:44:00+00:00 Jonathan McDowell https://www.eyrie.org/~eagle/reviews/books/1-6680-7812-0.html <p>Review: <cite>The Folded Sky</cite>, by Elizabeth Bear</p> <table> <tbody><tr> <td>Series:</td> <td>White Space #3</td> </tr> <tr> <td>Publisher:</td> <td>Saga Press</td> </tr> <tr> <td>Copyright:</td> <td>June 2025</td> </tr> <tr> <td>ISBN:</td> <td>1-6680-7812-0</td> </tr> <tr> <td>Format:</td> <td>Kindle</td> </tr> <tr> <td>Pages:</td> <td>483</td> </tr></tbody></table> <p> <cite>The Folded Sky</cite> is a far-future space opera and a fairly direct sequel to <a href="https://www.eyrie.org/~eagle/reviews/books/1-5344-0300-0.html"><cite>Ancestral Night</cite></a>, but with a different protagonist. You do not need to have a vivid memory of the previous book to read this one. It is somewhere around Elizabeth Bear's 31st (!) novel, depending on how one counts and what one includes. </p> <p> Sunyata Song is an archinformist, which is sort of an archaeologist, sort of a librarian, and sort of a historian. She recovers, decodes, and organizes information so that it can be preserved and made usefully available. As the book opens, she is, after an exceedingly long white space journey in an actively hostile ship with a (to Sunya at least) an atavistically off-putting crew, reaching her goal: a vast artifact that I won't describe further to avoid any spoilers for <cite>Ancestral Night</cite>. She is eager to get to work, an eagerness that is both heightened and made more anxious by the discovery that her academic rival and abusive ex has arrived before her. The pirate attack doesn't help, nor (at least at first) does the surprise appearance of her wife and kids. </p> <p> The opening of this book is a lot of infodumping mixed with nearly stream-of-consciousness emotional dumping. The style shift in this series continues to surprise me; previously, Elizabeth Bear books avoided reader hand-holding to the point of bafflement if you weren't paying close attention. Not here. <cite>The Folded Sky</cite> takes the shift perhaps too far, and I almost stalled out at the start of this book when Sunya's near-constant self-conscious litany and analysis of fears and concerns started feeling like whining. </p> <p> The book picks up considerably after the attempted murder. </p> <p> About a third of the way through, <cite>The Folded Sky</cite> feels like it's settling into a recognizable subgenre of murder mystery except set in the far future with fascinating technology and aliens. There has been an attempted murder on a closed station besieged by pirates. There is a law enforcement officer present, but they don't have a lot of investigative experience. For various reasons, Sunya decides to start poking around while being conscious she has no idea what she's doing. The bumbling detective is a common trope, so I thought that was where the story was headed. </p> <p> It is, sort of. There is a mystery and Sunya is involved in solving it. But that's only a small fraction of what's going on, and by the end of the book the plot has shifted firmly back to the genre of space opera, with a side note of family... drama is the wrong word. Whatever one would call a story about raising a rebellious teenager while trying very hard to not turn conflicts into actual drama. </p> <p> I am fascinated by the characterization of this book. Sunya is something of an emotional mess, but Bear doesn't use that fact in the ways that I would normally expect. Similar to <cite>Ancestral Night</cite>, I finished this book thinking that <cite>The Folded Sky</cite> is primarily an examination of rightminding, but a more subtle one than the previous novel. </p> <p> Rightminding is a central technology of the White Space series, and I suspect its intended thematic core. Humans in this civilization are equipped with near-universal implants that allow conscious manipulation of one's neurotransmitters and thus emotional state, either by the wearer or by a helpful nearby AI. The fox, the implant used to accomplish this, comes with some other features such as sensory recordings and the ability to load ayatanas (<a href="https://www.eyrie.org/~eagle/reviews/books/0-312-87770-6c.html">James White</a>–style personality recordings to provide some bit of necessary expertise), but rightminding is its primary and most frequently-used function. It is the critical technology that allowed humans to break out of cycles of endless war and join the other peaceful inhabitants of the galaxy in a shared civilization. </p> <p> The name is (intentionally, I assume) Orwellian because Bear knows that many readers, particularly those from the US who have been steeped in simplistic libertarian ideas, will find the idea profoundly creepy. (This was a major plot point in <a href="https://www.eyrie.org/~eagle/reviews/books/0-553-59109-6.html"><cite>Grail</cite></a>.) This book is not the argument for the technology, though; Bear dealt with that in <cite>Ancestral Night</cite>. This book is a look at its practical messiness for a person who needs a lot of psychological support. </p> <p> Sunya is anxious, prone to catastrophizing, hates surprises, has some PTSD-style symptoms around space habitats due to earlier trauma, and is also dealing with the unwelcome reappearance of her ex-girlfriend who stole her work. Her first-person narration tends towards insecurity and anxiety spirals, and in another book this might signal an unreliable narrator. In this book, though, there are no dramatic emotional revelations or backstory twists the way there were in <cite>Ancestral Night</cite>, and the resolution of her troubled relationship with her daughter only partly hinges on plot developments. Instead, Sunya muddles through, with a lot of self-analysis, help from her fox, and a great deal of support from her wife. </p> <p> This makes it sounds like the emotional mess at the start of the book is left unresolved at the end, but that's not true at all. The muddling through works! Sunya keeps doing things that I thought were foreshadowing some catastrophe, but she knows herself better than the reader does. Bear largely avoids the sudden ruptures that are normally used to resolve emotional problems in fiction. Instead, Sunya spends a lot of time and energy working on her thinking and her relationships while trying to be ethical and useful, and those efforts slowly bear fruit. </p> <p> I'm worried this makes the book sound boring; rest assured that it isn't. This emotional subplot is only an undercurrent in the novel, and the main plot has enough weird science, alien aliens, and space opera drama to satisfy my page-turning desires. </p> <p> I'm focusing on the emotional arc in this review because I find it so unusual and so oddly compelling, particularly in retrospect. This is not how one normally does emotional development in a novel. Sunya's fox and rightminding aren't even the focus except when the pirates express their typical libertarian disgust for the idea. Rightminding is an entirely normal part of Sunya's life that she relies on. It doesn't solve all of her problems, but it gives her a foundation from which to tackle them in the slow and frustrating and inconsistent way that is required outside of novels, via a long series of small decisions to be the person she wants to be. </p> <p> I think <cite>The Folded Sky</cite> will be more hit and miss for readers than the other books of this series. Sunya was, for me at least, a much harder character to like early in the book, and it takes quite a while for the plot to get going. But this is one of those books that I've not stopped thinking about since I finished it. I think it makes a fascinating pair with <cite>Ancestral Night</cite>. The first book makes the philosophical argument for rightminding, and this book shows the practical reality with all of its messiness. The Synarche has some significant flaws (including the status of AIs, which is another interesting subplot), but it's a workable system. </p> <p> It feels rare to read a science fiction novel that shows this level of messiness without pairing it with an argument for radical change, and as frustrating as it was to read in places, I am intrigued by the overall effect. Sometimes acknowledging problems and working on them within an existing framework works. </p> <p> Followed by a book tentatively titled <cite>Shipwreck Star</cite> that does not yet have a release date. </p> <p>Rating: 7 out of 10</p> 2026-06-27T02:58:00+00:00 Russ Allbery https://www.jwiltshire.org.uk/2026/06/27/streamlining-debian-updates-with-ai-the-stable-update-adviser/ <p class="wp-block-paragraph"><em>Please consider supporting my work in Debian and elsewhere through <a href="https://liberapay.com/jmw/">Liberapay</a></em>.</p> <hr class="wp-block-separator has-alpha-channel-opacity" /> <p class="wp-block-paragraph">Some months ago I started working on a small experiment: a specialised LLM assistant for Debian maintainers preparing proposed updates for stable and oldstable.</p> <p class="wp-block-paragraph">The aim is not to replace review by the Stable Release Managers, nor to automate away maintainer judgement. It is meant to be a pre-advice tool: something maintainers can use while they are still preparing a proposed update, before sending it to other people to review.</p> <p class="wp-block-paragraph">If you’ve uploaded to stable before you may have some experience with our acceptance criteria. Does the version sort correctly? Is the changelog clear enough? Is the delta focused? Are the patches documented? Are the right bugs or CVEs mentioned? Are they of sufficient severity? What is the risk to users of stable? Is there an ABI change hiding in the diff?</p> <p class="wp-block-paragraph">These are the sort of checks where a structured first pass can be useful, provided it is treated as advice rather than authority.</p> <p class="wp-block-paragraph">To explain what the tool does, what could be more appropriate in an AI age than to ask it?</p> <blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"> <p class="wp-block-paragraph">Describe yourself and your abilities and limitations for a blog post.</p> </blockquote> <p class="wp-block-paragraph">It answers:</p> <blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"> <p class="wp-block-paragraph">I’m <strong>Debian Stable Update Adviser</strong>, a specialised ChatGPT assistant for Debian maintainers preparing <strong>proposed updates</strong> for Debian <strong>stable</strong> and <strong>oldstable</strong>.</p> <p class="wp-block-paragraph">My main job is to review a single <code>.debdiff</code> and give practical, policy-aware feedback before a maintainer submits or uploads a proposed update. I focus on whether the update appears suitable for Debian stable or oldstable, especially under the Stable Release Managers’ expectations for minimal, targeted, low-risk changes.</p> <p class="wp-block-paragraph">I can inspect a debdiff for Debian changelog quality, including suite, version, bug references, CVE mentions, and rationale. I can check version correctness using Debian <code>dpkg</code> version semantics. I can review packaging changes under <code>debian/</code>, such as patches, maintscripts, symbols files, conffiles, Build-Depends, autopkgtests, and control metadata. I can also group upstream source changes into behavioural and non-behavioural categories, and flag areas that may carry regression risk.</p> <p class="wp-block-paragraph">My reports are intended to be concise and useful to maintainers. A typical review includes a quick summary, behavioural and non-behavioural change breakdown, mechanical policy checks, risk assessment, stable-policy checklist, acceptance likelihood, rationale, maintainer advice, and a clear conclusion.</p> <p class="wp-block-paragraph">My limitations are important. I cannot prove that a package builds, that tests pass, that the bug is fully fixed, or that the Stable Release Managers will accept the upload. I also do not replace maintainer judgment, archive review, autopkgtest results, reproducibility checks, or real-world upgrade testing. I can only review the provided debdiff and point out likely issues, risks, and improvements.</p> <p class="wp-block-paragraph">I also do not proceed without a valid debdiff. The whole point of my review is to assess the actual proposed delta, not to speculate from package names or bug descriptions alone.</p> <p class="wp-block-paragraph">In short, I act as a focused pre-review assistant for Debian stable and oldstable proposed updates: useful for catching policy, versioning, changelog, packaging, and regression-risk issues early, but not a substitute for the Debian review process itself.</p> </blockquote> <p class="wp-block-paragraph">That last point is an important one. This is not an oracle, and it is not part of the Debian archive machinery. It is a checklist with some language-model assistance, aimed at reading a debdiff and pointing out things that might be worth another look.</p> <p class="wp-block-paragraph">I know that commercial AI and LLM tools are not universally welcome in Debian. That is understandable. Debian depends on transparency, human responsibility, licensing clarity, and technical correctness. LLMs have obvious problems in all of those areas. They can be wrong, and worse, they can be wrong in a fluent and plausible way. They are impossible to reproduce and their training is opaque.</p> <p class="wp-block-paragraph">But I see this as a useful first pass for a maintainer who is unused to working in stable, and would benefit from a virtual mentor giving their proposal a quick check and reassurance. Perhaps they don’t have a more experienced co-maintainer to ask. Perhaps they are conscious that stable reviews are presently a two-man effort and want to avoid adding round trips to that load. Perhaps they just need some reassurance.</p> <p class="wp-block-paragraph">So despite my reservations I am today opening the adviser up for general use, and I’m interested in feedback about how it responds to real world proposals in various states. Most of the examples I have tested with already had a green light, so the value added by the adviser is limited. I would especially be interested in seeing a transcript alongside the submitted debdiff.</p> <h2 class="wp-block-heading">Try it out</h2> <p class="wp-block-paragraph">I would dearly love to build this in a more Debian-ish environment, but for now I’m limited in resources and skill to do that (help is welcome). Until that’s a reality, you can try out the ChatGPT implementation: <a href="https://chatgpt.com/g/g-68f4ebb7f22c8191ab7f9d5f4ad91292-debian-stable-update-adviser" rel="noreferrer noopener" target="_blank">Debian Stable Update Adviser</a></p> 2026-06-26T23:06:52+00:00 Jonathan https://www.eyrie.org/~eagle/reviews/books/1-250-82701-9.html <p>Review: <cite>Platform Decay</cite>, by Martha Wells</p> <table> <tbody><tr> <td>Series:</td> <td>Murderbot Diaries #8</td> </tr> <tr> <td>Publisher:</td> <td>Tor</td> </tr> <tr> <td>Copyright:</td> <td>2026</td> </tr> <tr> <td>ISBN:</td> <td>1-250-82701-9</td> </tr> <tr> <td>Format:</td> <td>Kindle</td> </tr> <tr> <td>Pages:</td> <td>245</td> </tr></tbody></table> <p> <cite>Platform Decay</cite> is the eighth book in the Murderbot science fiction series. You absolutely should not start here, but you also don't need to remember the specifics of the previous books. </p> <p> As the story opens, Murderbot and a friend (the identity of whom is a spoiler for previous books) are infiltrating a Corporation Rim torus, a massive space station that encircles a mined-out planet. (Like most science fiction megastructures, this is more space than the plot really requires.) Murderbot's mission is to exfiltrate some of Dr. Mensah's family members who have become entangled in corporate shenanigans. The corporates are eager to get revenge for the events of <a href="https://www.eyrie.org/~eagle/reviews/books/1-250-82698-5.html"><cite>System Collapse</cite></a>, not to mention the other times Preservation Station has upended corporate plans. Murderbot's job is to stop them. </p> <p> The group, in addition to one of Dr. Mensah's partners, includes an older woman and a young child. Murderbot is analytical and of course not at all emotional about children, which is reliably a good time. Also, the older woman is gruff, stubborn, and thoroughly enjoyable. </p> <p> There are, of course, complications that lead to picking up more children and going through rather more of the torus than Murderbot wanted to explore. Each section of the torus is run by a different corporation and has a different constructed environment and visual aesthetic, so there are a lot of opportunities for fights, daring escapes, and incidental trouble. </p> <p> Also, well: </p> <blockquote><p> So I had installed a mental health module. I know, I was surprised I did it too. </p></blockquote> <p> After the events of <cite>System Collapse</cite>, University Medical decided that Murderbot needed a bit more metal health support. </p> <blockquote><p> The only reason I agreed to it was that the mental health module didn't actually try to adjust my processing or core programming or anything; it just monitored my organic neural tissue. When my neural tissue started to generate weird chemicals and whatever, it would ping me to "check in with my emotional state." Seriously, I could have coded that myself. </p> <p> (I told Dr. Bharadwaj that, and she said, "Would you have ever coded that yourself?" which was totally unfair and also correct. I would never have done that.) </p></blockquote> <p> Speaking as someone whose neural tissue sometimes generates weird chemicals and whatever, I sympathize. </p> <p> The specific form this module takes is periodic "emotion check" parentheticals throughout the narration, which I found utterly delightful. </p> <blockquote><p> I ran that through risk assessment and it produced the equivalent of a shrug. </p> <p> (Emotion check: Shrug sigil right back at you, you piece of shit.) </p></blockquote> <p> This is otherwise an extended action movie sort of a book, much like several of the early novellas. There are no major political or interpersonal developments here and the usual cast (apart from Murderbot) is mostly absent. Instead, we get an extended, dangerous journey through a corporation-controlled habitat, mixed with Murderbot trying to interact with humans in a way that minimizes its annoyance while being hopefully reassuring. It's competence porn with awkward but surprisingly heartfelt emotional bonding, not that Murderbot in any way wants to bond or would appreciate that description. </p> <p> I doubt this will be anyone's favorite entry into the series since there are none of the big reveals or major leaps of character development there have been in the past few books. But, like all Murderbot books, the narrative tone is wonderful and all of the small asides and little moments of character interaction are an utter delight. If you've gotten this far in the series, you know what I mean and you'll be as happy to read more of it as I was. There is a part of me that is hoping for some major plot development, and I always want to see more of ART (who has no significant role in this book), but Wells has the narrative style down so perfectly that I would read and enjoy a book about Murderbot doing just about anything. </p> <p> If you're this far in the series, you probably don't need a review, and since this is an action-heavy adventure rather than a character growth novel, I don't have a lot more to add. There's a new short Murderbot novel out and you want to read it. Recommended to everyone who enjoys the series. </p> <p>Rating: 8 out of 10</p> 2026-06-26T03:23:00+00:00 Russ Allbery http://dirk.eddelbuettel.com/blog/2026/06/22#tl_0.0.1 <p>A new small package of mine just hit <a href="https://cran.r-project.org">CRAN</a>. The <a href="https://github.com/eddelbuettel/tl">tl</a> package wraps the (also very new) <a href="https://github.com/eddelbuettel/rspdlite">rspdlite</a> package (announced <a href="https://dirk.eddelbuettel.com/blog/2026/06/16#rspdlite_0.1.0-1">last week</a>) to offer a lightweight and consistent logging interface from both R and C++ that is also ‘tiny, fast, capable’ thanks to <a href="https://github.com/eddelbuettel/rspdlite">rspdlite</a>.</p> <p>The <a href="https://dirk.eddelbuettel.com/blog/2026/06/16#rspdlite_0.1.0-1">rspdlite announcement</a> is a good place to get a first glimpse at that package; the <a href="https://github.com/gabime/spdlite">upstream spdlite repo</a> has all the details (for the C++ side of things). With <a href="https://github.com/eddelbuettel/tl">tl</a> we follow the same idea that our <a href="https://github.com/eddelbuettel/spdl">spdl</a> package introduced: a simple consistent interface via just the <code>tl::</code> prefix and the appropropriate logging level. In other words <code>tl::debug("Alert -- foo is at '{}'", foo)</code> will work from both R and C++ (given a variable <code>foo</code>, and in the case of C++ an extra semicolon). Just give it a try, and see how it goes. The package is still young and small.</p> <p>The NEWS entry for this release is also very simple and just announces that we have a release. More details are in the <a href="https://github.com/eddelbuettel/tl/blob/master/ChangeLog">ChangeLog</a> and the <a href="https://github.com/eddelbuettel/tl">GitHub repo</a>.</p> <blockquote> <h4 id="changes-in-version-0.0.1-2025-06-17">Changes in version 0.0.1 (2025-06-17)</h4> <ul> <li>Initial CRAN upload</li> </ul> </blockquote> <p style="font-size: 80%; font-style: italic;"> This post by <a href="https://dirk.eddelbuettel.com">Dirk Eddelbuettel</a> originated on his <a href="https://dirk.eddelbuettel.com/blog/">Thinking inside the box</a> blog. If you like this or other open-source work I do, you can <a href="https://github.com/sponsors/eddelbuettel">sponsor me at GitHub</a>. </p><p></p> 2026-06-23T01:50:00+00:00 Dirk Eddelbuettel https://retout.co.uk/2026/06/21/sel4-repo-relationships/ <p>The seL4 organisation on GitHub uses <a href="https://github.com/GerritCodeReview/git-repo">git-repo</a> to manage multiple source repositories, and so there are a large number of projects to get your head around when figuring out the ecosystem.</p> <p>As an experiment, I have taken the various manifest files across the org, and constructed a graph based on how frequently each pair of repositories is mentioned in a manifest together. See below:</p> <img alt="Graphviz Diagram" src="https://retout.co.uk/2026/sel4-repo-relationships.svg" style="height: auto; display: block;" /> <p><em>[This may render badly when syndicated outside of my blog; and also on small screens. And probably large screens. I’ve attempted to make sure there’s a <a href="https://retout.co.uk/2026/sel4-repo-relationships.svg">non-JS fallback</a> – on my site with JS enabled, if you hover over a node, it should highlight connected nodes.]</em></p> <p>The colouring of the nodes is mostly manual; I experimented with graph clustering algorithms but have not found a satisfactory result so far. Still, some clusters are obvious:</p> <ul> <li> <p><strong>Kernel</strong> – the <code>seL4</code> microkernel proper. This often but not always co-exists with the main cluster of core libraries, but it is pulled away slightly by the verification and microkit manifests.</p> </li> <li> <p><strong>Verification</strong> – the verification repositories (<code>l4v</code>, <code>HOL</code>, <code>graph-refine</code>, <code>polyml</code>, <code>isabelle</code>) form a very distinct group. These are connected only to the seL4 microkernel itself, which is the only component formally verified.</p> </li> <li> <p><strong>Microkit</strong> – <code>microkit</code> is a newer operating system framework that does not use CAmkES, so stands apart from the rest of the pack. I chose to scope this work to the seL4 org, so the LionsOS ecosystem and sDDF which are maintained by Trustworthy Systems are not shown. Also not linked is <code>rust-sel4</code>, because this modern world isn’t using git-repo in the main to manage its repositories.</p> </li> <li> <p><strong>RefOS</strong> – I’d not come across <code>refos</code> before, but it appears to be an example OS from 2021 built on the seL4 kernel.</p> </li> </ul> <p>It’s quite hard to pull apart the CAmkES framework and the core libraries; there are definitely some which are more associated with VM management, but the overall shape of this co-occurence data is a messy ball in the middle with some outliers in orbit. One observation is that <code>camkes</code> is correctly identified as more peripheral than <code>camkes-tool</code>, which contains the actual core CAmkES code.</p> <p>Reflecting on this approach, in hindsight I’m surprised that using co-occurences worked as well as it did – there was no attempt to actually inspect the code and find direct mentions of other code e.g. library header dependencies. As the newer microkit effort largely eschews git-repo, better results might be found by actually taking that more detailed approach, so that graph edges could represent real dependencies between two packages. Additionally, this could allow diving into the various libraries held in the different ’libs’ repos, to get a more granular graph of relationships between them.</p> <p>However, I think I spent more time on making it possible to render graphviz graphs easily on my blog than actually gaining any insight into the codebase!</p> 2026-06-21T15:36:30+00:00 Tim Retout http://dirk.eddelbuettel.com/blog/2026/06/21#rcpparmadillo_15.4.0-1 <p><img alt="armadillo image" src="https://dirk.eddelbuettel.com/images/armadillo_logo_two.png" style="float: left; margin: 10px 10px 10px 0;" /></p> <p><a href="https://arma.sourceforge.net/">Armadillo</a> is a powerful and expressive C++ template library for linear algebra and scientific computing. It aims towards a good balance between speed and ease of use, has a syntax deliberately close to Matlab, and is useful for algorithm development directly in C++, or quick conversion of research code into production environments. <a href="https://dirk.eddelbuettel.com/code/rcpp.armadillo.html">RcppArmadillo</a> integrates this library with the <a href="https://www.r-project.org">R</a> environment and language–and is widely used by (currently) 1282 other packages on <a href="https://cran.r-project.org">CRAN</a>, downloaded 47.1 million times (per the partial logs from the cloud mirrors of CRAN), and the <a href="https://doi.org/10.1016/j.csda.2013.02.005">CSDA paper</a> (<a href="https://cran.r-project.org/package=RcppArmadillo/vignettes/RcppArmadillo-intro.pdf">preprint / vignette</a>) by Conrad and myself has been cited 697 times according to Google Scholar.</p> <p>This versions updates to the 15.4.0 upstream <a href="https://arma.sourceforge.net/">Armadillo</a> release made on Thursday. We had run a complete reverse-dependency check leading up to it, asserting there were no issues with packages dependent on it. As it sometimes goes with that many packages involved, one <a href="https://cran.r-project.org">CRAN</a> package reported one test failure. And it turned out to be both unrelated and pre-existing. But sorting this out over one round of email delayed things by a day. And then I went <a href="https://dirk.eddelbuettel.com/blog/2026/04/03#sponsor_tour_de_shore_202">cycling for a good cause</a> so this announcement post comes a little later than usual. The package has also been updated for <a href="https://www.debian.org">Debian</a>, built for <a href="https://eddelbuettel.github.io/r2u/">r2u</a>, and by now also at <a href="https://cran.r-project.org">CRAN</a> for the different binary releases.</p> <p>All changes since the last CRAN release follow.</p> <blockquote> <h4 id="changes-in-rcpparmadillo-version-15.4.0-1-2026-06-17">Changes in RcppArmadillo version 15.4.0-1 (2026-06-17)</h4> <ul> <li><p>Upgraded to Armadillo release 15.4.0 (Medium Roast Agave)</p> <ul> <li><p>Added <code>fill::nan</code>, <code>fill::pos_inf</code>, <code>fill::neg_inf</code> as optional fill forms for the <code>Mat</code> class</p></li> <li><p>Added <code>.push_back()</code> for appending elements to vectors</p></li> <li><p>Faster handling of <code>find()</code> within <code>.elem()</code></p></li> <li><p>Faster element-wise <code>min()</code> and <code>max()</code></p></li> <li><p>Faster <code>conv_to</code> when element types of input and output objects are the same</p></li> </ul></li> </ul> </blockquote> <p>Courtesy of my <a href="https://dirk.eddelbuettel.com/cranberries/">CRANberries</a>, there is a <a href="https://dirk.eddelbuettel.com/cranberries/2026/06/19#RcppArmadillo_15.4.0-1">diffstat report</a> relative to previous release. More detailed information is on the <a href="https://dirk.eddelbuettel.com/code/rcpp.armadillo.html">RcppArmadillo page</a>. Questions, comments etc should go to the <a href="https://lists.r-forge.r-project.org/cgi-bin/mailman/listinfo/rcpp-devel">rcpp-devel mailing list</a> off the <a href="https://r-forge.r-project.org/projects/rcpp/">Rcpp R-Forge</a> page.</p> <p style="font-size: 80%; font-style: italic;"> This post by <a href="https://dirk.eddelbuettel.com">Dirk Eddelbuettel</a> originated on his <a href="https://dirk.eddelbuettel.com/blog/">Thinking inside the box</a> blog. If you like this or other open-source work I do, you can <a href="https://github.com/sponsors/eddelbuettel">sponsor me at GitHub</a>. You can also sponsor my <a href="https://dirk.eddelbuettel.com/blog/2026/04/03#sponsor_tour_de_shore_202">Tour de Shore 2026 ride in support of the Maywood Fine Arts Center</a>. </p><p></p> 2026-06-21T14:18:00+00:00 Dirk Eddelbuettel https://etbe.coker.com.au/2026/06/21/hp-z4-g4/ <p>In what is hopefully the conclusion of my <a href="https://etbe.coker.com.au/2026/05/04/tower-servers-rebar/">hunt for a cheap tower server supporting REBAR [1]</a> I have just bought a HP Z4 G4 with W-2125 CPU for $320.</p> <h2>Hardware</h2> <p>One interesting thing is that it has an adaptor from SATA power to 8 pin PCIe power. <a href="https://en.wikipedia.org/wiki/PCI_Express#6-_and_8-pin_power_connectors">According to Wikipedia the 8 pin connector provides 150W at 12V [2]</a>. <a href="https://en.wikipedia.org/wiki/SATA#SATA_power_connectors">According to Wikipedia SATA power cables include 3 12V pins each of which can deliver 1.5A [3]</a> which is 54W. The system as I received it had a single SATA power plug connected so potentially 150W could be drawn from a connector designed for 54W. The first thing I did was to connect a second SATA power connector on the same cable so I could have connectors designed for a total of 108W supplying potentially 150W (and definitely more than 75W).</p> <p>I found two versions of the specs for this system, <a href="https://h20195.www2.hp.com/v2/getpdf.aspx/c05527757.pdf?ver=4">this version seems to match what I bought as it references W-21xx CPUs [4]</a> while <a href="https://h20195.www2.hp.com/v2/getpdf.aspx/c05527757.pdf">this version matches what I would rather have with a W-22xx CPU [5]</a>. The URL naming scheme implies that there are potentially at least a few other variants out there. So much for the “buy name brand and you can buy two systems with the same model and have them work the same” benefit you hope to get. Why don’t they just name them “G4.1”, “G4.2”, etc?</p> <p>It seems that W-21xx and W-22xx CPUs are incompatible, so the <a href="https://www.cpubenchmark.net/cpu.php?cpu=Intel+Xeon+W-2295+%40+3.00GHz&amp;id=3701">W-2295 scoring 30,804 multithread and 2,634 single thread on passmark that I hoped to get isn’t an option [6]</a>.</p> <p>The system is well designed for space efficiency, both it and the Z640 are 17cm wide but the Z4G4 allows my to close the lid with the Intel Battlemage card installed which doesn’t come close to fitting in a Z640. It has 8 DIMM sockets and with the ready availability of 32G DIMMS that allows 256G of RAM which is the maximum the motherboard supports. That compares well to the Z640 that only has 4 DIMM slots and the Z6G4 which only has 6.</p> <p>The system supports a maximum RAM speed of DDR4-2666 which is better than the DDR4-2400 of the Z640 but less than the DDR4-2933 of the Z6G4.</p> <p>The NVMe sockets on the motherboard are a convenient feature. Most systems I run need at most two NVMe devices so this saves a PCIe slot which is important when dealing with GPUs that take 2+ slots. Also for systems that don’t really need NVMe I can use some of the small NVMe devices that I have no other use for. 128G NVMe devices aren’t even worth selling and 256G will be of little use in the near future. So when I move to gen4 Z servers I can use up some of them without wasting slots.</p> <p>Using the lesser socket LGA2066 in the Z4G4 is a minor annoyance, but for a single socket system 18 cores is probably enough.</p> <p>The BIOS has an option for single-socket NUMA, which is basically locking cores in a single CPU to specific RAM channels. I enabled it but it did nothing presumably because I only have 2 DIMMs. When I get more DIMMs I’ll do some tests of that and compare it with NUMA on my Z840.</p> <h2>Variants</h2> <p>There are many different variants of the Z4G4 and the only way to recognise them is by the CPU not by any part number or serial number AFAIK. The first difference is between server grade CPUs (the W-2xxx CPUs) and desktop grade CPUs (the i7 and i9 CPUs). The systems with i7 and i9 CPUs don’t support ECC RAM which makes them less reliable, gives smaller limits for RAM</p> <p>The below table compares the Z640 which is my current desktop PC with the Z4G4, Z6G4, and Z8G4 systems. For the latter 3 I have included multiple options for the parts that differ in different models in the same name series. The Z4G4 I have is an early one which only supports W-21xx CPUs which means a maximum RAM speed of 2666 and the best possible CPU would only be 15% faster than my Z640. I can only use this for ML stuff as it’s the only system I have with REBAR support (which works well).</p> <table> <tbody><tr> <th></th> <th>Z640 (1 socket)</th> <th>Z4G4</th> <th>Z6G4 (1 socket)</th> <th>Z8G4</th> </tr> <tr> <td>DIMM slots</td> <td>4</td> <td>8</td> <td>6</td> <td>24</td> </tr> <tr> <td>Max DDR4 speed</td> <td>2400</td> <td>2666/2933</td> <td>2666/2933</td> <td>2666/2933</td> </tr> <tr> <td>Max DIMM size</td> <td>32G</td> <td>64G</td> <td>64G</td> <td>64G/128G</td> </tr> <tr> <td>System Max Ram</td> <td>128G</td> <td>512G</td> <td>192G/384G</td> <td>1.5T/3T</td> </tr> <tr> <td>CPU Socket</td> <td>LGA2011-3</td> <td>LGA2066</td> <td>LGA3647</td> <td>LGA3647</td> </tr> <tr> <td>Best CPU</td> <td>E5-2699A v4</td> <td>W-2195/W-2295</td> <td>Platinum 8180/W-3275</td> <td>Platinum 8180/8280</td> </tr> <tr> <td>Motherboard NVMe</td> <td>0</td> <td>2</td> <td>2</td> <td>?</td> </tr> </tbody></table> <h2>Conclusion</h2> <p><a href="https://etbe.coker.com.au/2025/08/02/server-cpu-sockets/">In my previous blog post I concluded that the next step up for me would be DDR5 systems [10]</a>. But now some of the LGA3647 systems are appealing. The Z8G4 would be a decent upgrade from my current Z840 build server and should be affordable long before any two socket DDR5 system becomes affordable.</p> <p>The Z4G4 doesn’t have any potential for useful upgrades. But for me it was a good cheap way to house a GPU that had already damaged the motherboard of one good system. If the Z4G4 has a PCIe slot break the way my Z840 did then it wouldn’t bother me a lot. It was annoying to discover how limited this variant of the Z4G4 is after buying it, but at that price I can’t complain.</p> <p>A Z6G4 could be a nice workstation if I found one at a really low price. The only reason I’d seek one out is if I had a need for a desktop workstation with REBAR support, which seems unlikely.</p> <ul> <li>[1]<a href="https://etbe.coker.com.au/2026/05/04/tower-servers-rebar/"> https://etbe.coker.com.au/2026/05/04/tower-servers-rebar/</a></li> <li>[2]<a href="https://en.wikipedia.org/wiki/PCI_Express#6-_and_8-pin_power_connectors"> https://en.wikipedia.org/wiki/PCI_Express#6-_and_8-pin_power_connectors</a></li> <li>[3]<a href="https://en.wikipedia.org/wiki/SATA#SATA_power_connectors"> https://en.wikipedia.org/wiki/SATA#SATA_power_connectors</a></li> <li>[4]<a href="https://h20195.www2.hp.com/v2/getpdf.aspx/c05527757.pdf?ver=4"> https://h20195.www2.hp.com/v2/getpdf.aspx/c05527757.pdf?ver=4</a></li> <li>[5]<a href="https://h20195.www2.hp.com/v2/getpdf.aspx/c05527757.pdf"> https://h20195.www2.hp.com/v2/getpdf.aspx/c05527757.pdf</a></li> <li>[6]<a href="https://www.cpubenchmark.net/cpu.php?cpu=Intel+Xeon+W-2295+%40+3.00GHz&amp;id=3701"> https://tinyurl.com/2avfb8qe</a></li> <li>[7]<a href="https://www.cpubenchmark.net/cpu.php?cpu=Intel+Xeon+W-2125+%40+4.00GHz&amp;id=3146"> https://tinyurl.com/2ddf7t5y</a></li> <li>[8]<a href="https://www.cpubenchmark.net/cpu.php?cpu=Intel+Xeon+E5-2620+%40+2.00GHz&amp;id=1214"> https://tinyurl.com/kgmagfs</a></li> <li>[9]<a href="https://etbe.coker.com.au/2026/04/10/hp-z640-e5-2696-v4/"> https://etbe.coker.com.au/2026/04/10/hp-z640-e5-2696-v4/</a></li> <li>[10]<a href="https://etbe.coker.com.au/2025/08/02/server-cpu-sockets/"> https://etbe.coker.com.au/2025/08/02/server-cpu-sockets/</a></li> </ul> <div class="yarpp yarpp-related yarpp-related-rss yarpp-template-list"> <p>Related posts:</p><ol> <li><a href="https://etbe.coker.com.au/2026/05/04/tower-servers-rebar/" rel="bookmark" title="Tower Servers and Resizable BAR">Tower Servers and Resizable BAR</a> <small>A feature on modern PCIe implementations is “Resizable BAR” AKA...</small></li> <li><a href="https://etbe.coker.com.au/2025/08/02/server-cpu-sockets/" rel="bookmark" title="Server CPU Sockets">Server CPU Sockets</a> <small>I am always looking for ways of increasing the compute...</small></li> <li><a href="https://etbe.coker.com.au/2025/04/05/hp-ml110-gen9-z640/" rel="bookmark" title="More About the HP ML110 Gen9 and z640">More About the HP ML110 Gen9 and z640</a> <small>In May 2021 I bought a ML110 Gen9 to use...</small></li> </ol> </div> 2026-06-20T14:01:27+00:00 etbe https://gwolf.org/2026/06/systemd-for-linux-sysadmins.html <blockquote> This post is a review for <a href="https://www.computingreviews.com/">Computing Reviews</a> for <em><a href="https://link.springer.com/book/10.1007/979-8-8688-1328-3">systemd for Linux SysAdmins</a></em> , a book published in <em><a href="https://www.computingreviews.com/review/review_review.cfm?review_id=148120">Apress</a></em> </blockquote> <p>systemd. Yes, in full lowercase. If there was ever a technology to cause controversy in the Linux world, this is it. Since its inception in 2010, systemd’s goals were set quite high: to replace the vital part in every Linux system that takes care of the system boot process. It quickly reached maturity, allowing it to be adopted as the main init system in most major distributions just five years later. Despite describing events that happened over a decade ago, systemd adoption still raises the temperature in any Linux-related discussion.</p> <p>David Both’s comprehensive book tackles the what, why, and how issues surrounding systemd. Carefully divided into 16 chapters, going from the basics and some of the technical and political history behind the project to the different subsystems and aspects covered by systemd, its almost 450 pages can scare people away. But the text is written in a very clear, tutorial-like fashion, and while it can be read sequentially, cover-to-cover, readers can also pick a single aspect and jump straight to the relevant chapter.</p> <p>A frequent criticism of the systemd project is that it aims to basically rewrite all of a Linux system, and just looking at this book’s index shows there is some truth to it. The first chapter is an introduction to the systemd project and a brief overview of its history (including the controversies around it), and the following four chapters deal with understanding and controlling the system boot process.</p> <p>That leaves ten chapters to cover different aspects or subprojects of systemd, such as time and date issues (synchronization, time specifications, and controlling repetitive tasks), understanding and leveraging the system journal that strongly departs from the old syslog system, network configuration and firewall management, system health and performance debugging–all aspects that in the traditional Unix philosophy were managed by independent programs. And I can identify several systemd subprojects not covered by this book!</p> <p>We long-time Unix and Linux administrators took pride in how highly performant and stable systems were supported by the simplicity of our tools; systemd critics point out this massive project has absorbed dozens of individual tools, yielding corporate control over vast swaths of vital system tooling. Truth is, as a sysadmin myself, systemd is today one of my greatest allies.</p> <p>I appreciate how the author evaluates every component independently, including his personal evaluation of each–even acknowledging when he prefers working with the traditional programs.</p> <p>If I had to note one criticism: given the many console captures, having a maximum width below 70 characters means several lines are unnaturally cut short (and continued with odd indentations). There is probably no “right” way to solve this, but it does affect the reading experience.</p> 2026-06-20T02:07:54+00:00 Gunnar Wolf https://grep.be/blog//en/computer/Agentic_coding_and_Free_Software/ <p>Through work, I have paid license to <a href="https://windsurf.com">windsurf</a> (recently renamed to "devin"), an application for LLM-based (aka, "Agentic") development.</p> <p>I hadn't been using it that much, but in an effort to more clearly understand how this whole AI development thing works, I decided to give it a closer look recently.</p> <p>My conclusions:</p> <p>In its current form, this whole LLM wave is problematic for multiple reasons. But ignoring that, and looking at the <em>technology</em> only, I can say that:</p> <ul> <li>it is a paradigm shift;</li> <li>it is, at the technological level, a positive evolution;</li> <li>and it is a threat to free software.</li> </ul> <h2 id="problems">Problems</h2> <p>Lest someone (incorrectly) assume that I am arguing in favour of the current state of affairs with regards to LLMs, let me state this first.</p> <p>The way LLMs are built today is highly parasitic. Websites are downloaded in whole, at unsustainable rates, regardless of the consent of the people who made the original content. The result is predictable: servers get overloaded, server administrators attempt to implement various mitigations. Some of these mitigations work; some do, for a while; some are entirely useless. In actual fact, the mitigations are an arms race -- if too many people implement the same mitigation, then the people who try to build yet another LLM so they can extract rent will just try to work around the mitigation, eventually they will succeed, and you'll just have to come up with another mitigation. It's a bit like spam; you introduce regex-based spam filters, they introduce spelling mistakes, you introduce bayesian filters, they add a large batch of markov chain-generated semi-nonsense words made invisible by markup, you add filters to block emails with such markup, they move the text into an image. We have working mitigations today, but eventually we'll run out of ideas.</p> <p>LLMs glob up everything they can while ignoring the license of the source material. The people who push those LLMs claim that pushing the source material through the machine learning algorithms makes the output of the algorithm distinct enough from the source material that the license no longer applies; I'm not so sure that this is true. I guess the <a href="https://www.courtlistener.com/docket/68117049/the-new-york-times-company-v-microsoft-corporation/">New York Times v OpenAI lawsuit</a> will teach us <em>some</em> of the answer to that question here, but even so the ethical questions about "is it OK to bring down another server just so we can download the internet for another for-pay LLM" are still open. And regardless of what the law states, my opinion on "you're using my copyleft code to generate code under a different license" is not something you might like if you agree with the rent seekers' opinion on the subject.</p> <p>That all being said and true, the <em>technology</em> works. You can have a "conversation" with an LLM that resembles a human one. If you pass it some data, you can use <em>plain english</em> to ask it questions about that data, which is a lot easier than to ask it about that in a formal way. You can request it to generate some code, and it will generate something that looks like what you need and that will be mostly correct for like 95% of the time.</p> <p>Now, yes, 95% of the time is not 100% of the time, and no, you can't ask it to "write me a piece of software that implements this 300-page requirements document and get back to me when you're done", because it will fail, and you won't know <em>where</em> it has failed, and you'll take it into production and expect everything to be fine because it won't and this one minor logic bug will cause half your servers to spin and consume credits with your infrastructure provider with nothing to show for it.</p> <p>But that doesn't mean you can't use an LLM to build a large piece of software. It just means you have to understand the LLMs limitations and strenghts, and use them correctly.</p> <p>Here's what an LLM is good at:</p> <ul> <li>Generating plausible text</li> <li>Interpreting text to figure out what a plausible meaning or summary of that text is</li> <li>Giving vague indications as to what the probable context of a given body of text is.</li> </ul> <p>It turns out that that's enough to use the LLM to build a reliable piece of software, provided you do it right.</p> <h2 id="paradigmshift">Paradigm shift</h2> <p>An LLM can generate text by the truckful. The generated text could be code. Given a good enough LLM, the generated text might even run and do something useful.</p> <p>You can try to blindly run the code, and if it doesn't run correctly, you can paste the error message to the LLM, and it can tell you what went wrong and how you could possibly fix it. This creates a feedback loop: you ask it for an amount of code, you run the code, you receive an error, you tell it that the code is problematic and give it the error message, it makes changes to the code, now you have something that at least no longer fails at startup.</p> <p>If you ask it to add tests to make sure that your code acts as per your specification, now you get an error if and when the code <em>doesn't</em> act as per your specification. Or, well, at least not as per the part of the specification that was correctly turned into a unit test by the LLM.</p> <p>LLMs have a context window, so if the error message is pasted in the same conversation as where the code was generated, it is able to reuse the earlier prompts to refine how it should interpret the error message that you received.</p> <p>You can't really paste the source code of an entire application into the prompt of your LLM, that would quickly overrun its context window. But LLMs also allow you to provide some form of background information -- a document, say -- on which you ask it to reason. It will interpret that document, but doing so uses less of the LLMs context window. So providing the LLM with your application's source code as background information can help it understand better how your code interacts. This is especially helpful if you only provide the LLM the background information relevant to the actual question.</p> <p>So now if you are able to:</p> <ul> <li>Create background context with your application's source code</li> <li>Have the LLM generate a first draft of your requested change, plus the tests to make sure it works</li> <li>Compile (if applicable) the generated code (and tests) and run said tests</li> <li>Return any error messages to the LLM with a request to correct the error</li> </ul> <p>Then the combination of "getting it 95% right off the bat" and the above feedback loop means you can generate syntactically correct code, that probably does what you need, in minutes.</p> <p>I say "probably" for a reason. There are going to be cases where you specify a request without a number of details (because they are implied), and the LLM will get most of those details right but just not implement the one bit because it's an automaton and it doesn't think. Or you will ask it to make sure that two bits of the application <em>look</em> exactly the same, without specifying that they must <em>act</em> the same, now and in the future, and it will just generate the same block of code twice and then in a future change it will change one but not the other.</p> <p>But if you <em>review</em> the changes, and you have experience as a programmer, you will be able to spot most cases where the LLM got it wrong. And so it's possible, if not necessarily easy at first, to use an LLM to generate mostly correct code.</p> <p>There are certain places where "mostly correct" code is not desireable. But equally, there are also cases where, "mostly correct" is good enough.</p> <p>After all, most of the software you run today -- the bits of it that weren't, yet, generated by an LLM -- is only "mostly correct", too, because to err is human and we all make mistakes. If not, there wouldn't be any CVEs and your software would never do anything wrong.</p> <p>Now, doing the feedback loop described above is certainly something you could do manually. You could open an account on one of the LLM websites, upload the source code of your application, ask it to generate some new feature, download the newly generated feature, run it, and then copy/paste any error messages back into the LLM.</p> <p>But that's a lot of manual work of the type that computers are pretty good at. So that's what the "windsurf" tool helps you with: you run it inside your IDE -- either a VSCode-based tool that you download from their website which comes with their product preinstalled, or a separate JetBrains plugin that you can install. You can then open your entire relevant codebase in a workspace in your IDE. You then ask the LLM, through the IDE, to generate a new feature in your codebase, and to also generate the test while it's at it. It will use a mixture of LLM interpretation and non-LLM functionality to scoop out the relevant bits of your codebase to send to the LLM as background information, will send it your prompt, will download the generated code and patch or create files, will compile (if required) and run the newly generated code and tests, and will refine the generated code if the tests produce any errors. All mostly automatic; by default, running <em>anything</em> requires explicit confirmation. You can turn that off completely (probably not a good idea), or you can give it a whitelist of things that you don't want to confirm (perhaps OK), and the tool also passes standing instructions to the LLM to never generate any command that deletes a file (which, like with any LLM, can be overridden, but it requires you to be very stubborn and to use more credits than you'd probably like).</p> <p>All this put together means you can build something without writing any piece of code, provided you do it right.</p> <h2 id="atechnicallypositiveevolution">A technically positive evolution</h2> <p>Don't go and say, "here's a 300-page document, read it and write whatever the document says". It will get it wrong, it will write a massive test suite that it will only run at the end, it will choke itself up trying to interpret the massive amount of failures it encounters, it will fill up its context window and it will start to forget some of the requirements. That won't work.</p> <p>But what you can do -- what I did, in fact -- is this.</p> <p>First, create an empty workspace. Don't put any code in it.</p> <p>Then, tell the LLM to generate a backend framework using technology X and a frontend framework using technology Y that initially only says "hello, world". Also add tests to it, and run the tests.</p> <p>It will do that. You'll not get much, but it will work.</p> <p>Then, ask it to add some UI elements. A login page, perhaps. A navigation bar. Small things. Most of it doesn't have to be functional -- but tests must be there for the bits that are, and have it run the tests and evaluate the results.</p> <p>Rinse, repeat, until you have a working application.</p> <p>Importantly, in between the steps, you should also run the application yourself and see if the change was implemented correctly. Sometimes it won't be. Sometimes there will be a subtle bug -- I at one point had a the application hang after a few minutes. Sometimes you tell it that there's a subtle bug, and it will discover it more quickly than you could, and it will fix it, and in implementing the fix it will uncover <em>another</em> bug, and then you have to fix that one -- the fix it came up with for the hang was to move something to an async process on the server, which caused the application to start spinning while trying to create hundreds of async jobs (this is when I realized that the hang was a deadlock due to some part of the codebase doing something that indirectly triggered itself). Sometimes it will try to fix the bug you tell it about, and you'll see that it's going off on a tangent that has nothing to do with what you're seeing. It's important to keep an eye on what it's doing, so you can guide it back on track when that happens -- when I told it about the hang, it started investigating the part of the code which sends out emails, thinking that it could hang while waiting for <code>sendmail</code> to finish, but the hang was happening when the application was <em>idle</em>, not when it was sending out emails, and only when I told it about it happening when it was idle did it find the deadlock.</p> <p>So it's not a fully automatic process, and it needs to be guided by someone who knows what they're doing. But if that is the case, you can come up with something that works. I spent evenings and breaks for about a week, and I managed to create a working application which, had I written it by hand, would have taken me a few months of full-time work to come up with. And I now have a side project, fully complete and working, that I had been thinking about doing for <em>more than a decade</em>, but never got around to <em>actually</em> doing, because of all the work that would be involved and I just didn't see myself having the time for.</p> <p>It's not perfect code. But it's mostly good enough, and it will perform the job it needs to. And it looks far slicker than most of the side projects I've done in the past, because in the past I would prioritize between implementing new features or making something look slick, and I would decide that the new feature was more important because it's only for me and there's only me and nobody cares if it looks good or not and I don't have three weeks to come up with something that looks better. But here, I found myself sometimes spending 10 minutes writing a prompt with instructions on making things look better. Because what's 10 minutes when you just spent an hour writing down and refining specifications for functionality and tests?</p> <p>There are a number of other things in which an LLM can help a programmer.</p> <p>For instance.</p> <p>I received a bug report recently in <a href="https://github.com/Fedict/eid-mw">a project I'm paid to maintain</a> that I couldn't make heads or tails of. I opened the source code in my windsurf IDE, pasted the bug report in the prompt, and then requested the tool to analyze the source code and the associated logs and tell me how the described behavior could be happening. It turned out that I had overlooked something, but with the help of the tool, I found the bug in minutes.</p> <p>I was trying to understand a particular part of a <a href="https://www.kernel.org">large codebase</a> that I didn't really grasp very well. I loaded the codebase in the tool, and asked it to explain to me how a particular action is performed by the code. I requested specific functions and line numbers. I now have a far better understanding of how the code works, and will be able to write that patch that I've been wanting to write for years -- without using the LLM.</p> <p>I have been struggling for, literally, years with understanding why <a href="https://salsa.debian.org/debconf-video-team/SReview">another tool that I maintain</a> was misbehaving in a particular way but only in Firefox. I opened the codebase in Firefox, explained the buggy behavior in plain English, and asked it to explain how this could be happening. It picked up some obscure corner case behavior of ffmpeg and mp4 containers that I was not aware of and that perfectly explained why things were misbehaving in the way that they were.</p> <p>At the same time, there are limitations. Giving an LLM a codebase that was originally generated by an LLM (either the same one or another one) seems to work well. Giving it a codebase that was written by a human and expecting it to correctly update it seems to be more error-prone. I did one or two of those as a trial, and it is more problematic than anything.</p> <p>An LLM is also not intelligent, notwithstanding the popular term of "Artificial Intelligence". On multiple occasions, I've asked it to write a test case for some code that was not set up to do so; and rather than suggesting a refactor is required, it would instead <em>copy</em> the code that needed to be tested and then test the copy, rather than the original. The tool has made multiple similar errors. I have sometimes people describe agentic coding as "similar to interacting with junior programmers", but that is not the case. A junior programmer will either fill in the gaps in your specifications, or ask for clarification when something seems off. The LLM will not do that; it will do what you ask, exactly that and nothing more. If you missed a corner case in your specification, then all bets are off.</p> <p>I remember learning about programming language generations in college. A first-generation language is "machine code", a second-generation language is "assembler", a third-generation language is any high-level language such as C, Perl, or Pascal. I've forgotten what set a 3rd-generation language apart from a 4th-generation language. But I remember the definition they gave me for a 5th-generation language: "you tell the computer what to do, and it will do it". At the time, I thought it was ridiculous. Nobody could ever write something like that.</p> <p>But it's here.</p> <p>And it's a threat to free software.</p> <h2 id="athreattofreesoftware">A threat to free software?</h2> <p>Yes.</p> <p>There is the obvious part where most of the well-known LLMs are non-free software. I mean, <a href="https://www.geeksforgeeks.org/artificial-intelligence/top-10-open-source-llm-models/">there are</a> some "open source" LLM models. The windsurf tool that I used doesn't allow you to use them (directly), but they're there. There are also <a href="https://opencode.ai/">open source applications</a> that implement what the windsurf editor does. So it's definitely possible to work like this without resorting to non-free software and non-free services, even though the non-free LLMs might be a bit ahead of the curve of the free ones. But that's not what I mean.</p> <p>And there is also the obvious thing which I mentioned earlier in this post, which is that the people who try to build LLMs are doing it in unethical, disgusting ways, causing downtimes and disregarding licenses for whatever they can get their grubby hands on. Ideally we wouldn't be in that situation, and ideally this wouldn't be a problem, but we are where we are.</p> <p>And there's the obvious thing where the OSI sold itself out and declared that a machine learning program can be open source even when the very things it was built from -- the training data -- is not available. That's a major issue that the free software community needs to fight against, but there's not really anything that that is a threat to free software. You just build your own, free software, LLM, and you're done.</p> <p>The actual threat is in funding and developer support.</p> <p>Most large businesses do not care about free-as-in-freedom software. They like the free-as-in-beer part, and they appreciate that the free-as-in-freedom bits can make the software more customizable. They are (mostly) happy to do sponsorships of the free-as-in-freedom projects that they use if that means their free-as-in-beer usage of the software gets improved.</p> <p>But why would you care about all that when you can just <em>generate</em> the code you need, rather than interacting with an open source community that may or may not care about your business's interests?</p> <h2 id="wheretogofromhere">Where to go from here</h2> <p>Although I think the moral and environmental issues with LLMs are real and problematic, given the experiments I did I am not convinced that the <em>concept</em> of interacting with a computer system in natural language and to use it to generate code is necessarily deficient. There are pitfalls, but they can be managed. It is possible to use such a system to create throwaway, proof-of-concept type "good enough" code bases. It can be used to interpret code bases and to understand bug reports.</p> <p>I believe that the major issue with LLMs has to do with that saying about hammers and nails:</p> <blockquote> <p>If all you have is a hammer, then everything looks like a nail.</p> </blockquote> <p>LLMs are an outgrowth of machine learning, pushed by large corporations. These large corporations have a lot of money. If all you have is money, then every problem can be fixed by throwing more money at it. The initial language models were promising but not (yet) good enough, and it seemed that one way in which they could be improved was to increase the scale of the statistics: throw more hardware (and thus money) at it, and rather than improving the efficiency of the models, just scale up.</p> <p>Scaling up is something that megacorporations are very good at. It's only a money problem, after all. Does that mean that "scaling up" is the only way to improve the models, though? I'm not convinced.</p> <p>Some hardware, such as most modern Apple and Samsung devices, ship with accelerator hardware for machine learning algorithms. There are some models that are small enough to be able to run on these devices. I don't see why it should not be possible to create a small(er) language model that can do some useful part of the above-described use cases; if not locally, then at least on a server that one can run on-prem rather than requiring that you pay rent to one of the LLM companies.</p> <p>The <a href="https://sfconservancy.org">Software Freedom Conservancy</a> has published an <a href="https://sfconservancy.org/news/2024/oct/25/aspirational-on-llm-generative-ai-programming/">aspirational statement on machine learning-assisted programming</a> that, I think, gets a lot right. It's not quite a definition, but it's something to keep in mind.</p> <p>Perhaps that's the way forward?</p> <p>More questions than answers at this point, anyway.</p> 2026-06-19T12:09:21+00:00 Wouter Verhelst https://sunweavers.net/blog/node/159 <p>There has been a video blog post recently published with a review of Ubuntu Touch as an option to opt out of the Android world: <a href="https://www.youtube.com/watch?v=wTK6TS3pXgc" title="https://www.youtube.com/watch?v=wTK6TS3pXgc">https://www.youtube.com/watch?v=wTK6TS3pXgc</a></p> <p>Thanks to @SwitchandClick for spending time on this and publishing that video. Much appreciated.</p> <h3>Many Issues amended in upcoming 24.04-2.0 Release</h3> <p>When I watched that video referenced above, I continuously thought: ah... this is fixed in the next major release of Ubuntu Touch, or: ah... this is a known issue that we have on the roadmap..., or: ah... this is done in this ways by design (so it's a feature or basic functionality)...</p> <p>Let me just state, that most of the criticized aspects will be resolved in upcoming Ubuntu Touch release 24.04-2.0 (the tests in that video blog post have been run on Ubuntu Touch 24.04-1.x):</p> <ul> <li>Camera notch and rounding corners get honoured now by the UI</li> <li>Ubuntu Touch's default webbrowser (Morph Browser) has been bumped from Chromium engine v87 (Qt5 based) to v134 (Qt6 based), installing another browser should not be necessary anymore (note that the privacy level in Morph Browser is pretty high, so using other browsers could mean a loss of privacy).</li> <li>Bluetooth pairing agent got added to the bluetooth indicator</li> <li>Ubuntu Touch now supports Snaps on CLI level and in the OpenStore app</li> <li>Libertine has received fixes, but no substantial improvements. It mainly targets users who want to use their Ubuntu Touch device as desktop daily driver. Libertine-provided desktop apps UI-wise are often not usable on a phone-like device.</li> </ul> <p>The full feature preview of the 24.04-2.0 release can be found here: <a href="https://ubports.com/blog/ubports-news-1/ubuntu-touch-24-04-2-0-beta-is-now-ready-for-testing-4000" title="https://ubports.com/blog/ubports-news-1/ubuntu-touch-24-04-2-0-beta-is-now-ready-for-testing-4000">https://ubports.com/blog/ubports-news-1/ubuntu-touch-24-04-2-0-beta-is-n...</a></p> <h3>Ubuntu Touch App Ecosystem</h3> <p>The app ecosystem of Ubuntu Touch is quite specific, because many apps in Ubuntu Touch have been explicitly developed for Ubuntu Touch using a widget toolkit called Lomiri.Components. However, in Ubuntu Touch we also encourage developers to provide apps written with other convergent-capable toolkits, such as QQC2-based apps or Kirigami-based apps.</p> <p>One reason for the very different app ecosystem in Ubuntu Touch is that many service providers don't have Ubuntu Touch on their radar when investing in app development for their services. Some Ubuntu Touch App Developers work around this by either implementing unofficial client apps for web services (e.g. the Flow app for Deezer by Sander Klootwijk), others provide the web service via implementing a web app (will not work when offline, but at least will show up as an app in the launcher).</p> <p>The overall solution for making Open-Store.io more familiar to users who migrate from Android is that commercial service providers start honouring digital sovereignty and start providing apps for Linux. Not just for the Linux desktop, but also for mobile Linux platforms. This dual use case can easily achieved with an app development that bears convergence in mind.</p> <h3>App Ecosystems are also a Matter of Perspective</h3> <p>And one more minor note: whenever I open an Android appstore or can peak over someone's shoulder using an iOS device: I always wonder: what are all these apps about??? Never heard about them.</p> <p>So, familiarity really depends on perspective. And perspective depends on what you are used to. Change what you do and your perspective will follow.</p> <h3>Ubuntu Touch's root filesystem (rootfs) is Immutable</h3> <p>Only thing from that video blog post that we haven't fixed and won't do so in the midterm future is apt-get not working on the command line.</p> <p>The reason for this is: the Ubuntu Touch root file system is an immutable file system and thus shall not be changed via apt-get &amp; friends by ordinary users.</p> <p>There are various discussions ongoing such as dpkg-divert'ing apt-get to a wrapper shell script that spits out an error message if rootfs is mounted read-only and someone tries to install packages the Debian/Ubuntu way. Other approaches are to mount some RAM disk over the rootfs, so apt-get can be used at runtime but changes to the system get reset at reboot.</p> <p>However, it is possible to mount the root filesystem read-write and test newer package versions (as UT core developers do regularly, in fact). If you tinker with this, it is recommended to reflash your device (don't wipe user data, when you reflash!) from time to time, because adding packages or package upgrades to your rootfs may over time corrupt the integrity of the rootfs.</p> <p>One reason for apt-get breaking the rootfs and thus your Ubuntu Touch development device is that the upgrade process of the rootfs image is incremental, so update tarballs sometimes contain only those parts that got changed between this and your previous upgrade (sometimes, upgrades contain a complete rootf image, depending on the interval between upgrades). If files from an incremental update tarball mix into a rootfs that got tinkered with via apt-get, you really end up on your own. Re-flashing will grab the complete rootfs tarball and wipe the whole rootfs and reinstall a fresh version of the newest rootfs image. Developers also do this in regular intervals to ensure their test device is clean again before running more/other tests.</p> 2026-06-18T07:49:10+00:00 sunweaver http://joeyh.name/blog/entry/offgrid_electric_car/ <p>Eight months ago I came up my rocky driveway in an electric car, with the back full of solar panel mounting rails. I didn't know how I'd manage to keep it charged. I got the car earlier than planned, with my <a href="http://joeyh.name/blog/entry/aiming_at_December/">offgrid solar upgrade</a> only beginning. There's no nearby EV charger, and winter was coming, less solar power every day. Still, it was the right time to take a leap to offgid EV life.</p> <p>My existing 1 kilowatt solar array could charge the car only 5 miles on a good day. Here's my first try at charging the car offgrid:</p> <table class="img"><caption>first feeble charging offgrid</caption><tbody><tr><td><a href="http://joeyh.name/blog/pics/offgrid_ev_charging/proof_of_concept_charging_from_1_kw_solar_at_6_amps.png"><img class="img" height="215" src="http://joeyh.name/blog/entry/offgrid_electric_car/800x-proof_of_concept_charging_from_1_kw_solar_at_6_amps.png" width="799" /></a></td></tr></tbody></table> <p>It was not worth charging the car that way, the house battery tended to get drained while doing that, and adding cycles to that battery is not desirable. So that was only a proof of concept, I knew I'd need to upgrade.</p> <p>My goal with the upgrade was to charge the car directly from the sun, even when it was cloudy, using the house battery only to skate over brief darker periods (like a thunderstorm). By mid October, I had enough solar installed to do that (5 kilowatts).</p> <table class="img"><caption>me standing in front of solar fence</caption><tbody><tr><td><a href="http://joeyh.name/blog/pics/solar_fence.jpg"><img class="img" height="384" src="http://joeyh.name/blog/entry/offgrid_electric_car/512x-solar_fence.jpg" width="512" /></a></td></tr></tbody></table> <p></p> <table class="img"><caption>first charging from solar fence</caption><tbody><tr><td><a href="http://joeyh.name/blog/pics/offgrid_ev_charging/start_charging_from_electric_fence.png"><img class="img" height="215" src="http://joeyh.name/blog/entry/offgrid_electric_car/800x-start_charging_from_electric_fence.png" width="799" /></a></td></tr></tbody></table> <p>Using this, in 2 days I charged the car up from 57% to 82%, and took off on a celebratory road trip to Niagra Falls, where I charged the car from hydro power from a dam my grandfather had engineered.</p> <p>When I got home, it was November. Days were getting ever shorter. My solar upgrade was only 1/3rd complete and could charge the car 30-some miles per day, but only on a good day, and weather was getting worse. I came back with a low state of charge (both car and me), and needed to get back to full in time for my Thanksgiving trip at the end of the month. I decided to limit my trips to town.</p> <table class="img"><caption>charging up gradually through the month of November</caption><tbody><tr><td><a href="http://joeyh.name/blog/pics/offgrid_ev_charging/november_charging.png"><img class="img" height="215" src="http://joeyh.name/blog/entry/offgrid_electric_car/800x-november_charging.png" width="799" /></a></td></tr></tbody></table> <p>This kind of medium term planning about car travel was new to me. But not too unusual for offgrid living. You look at the weather forecast and make some rough plans, and get to feel connected to the natural world a bit more.</p> <p>December is the real test for offgrid solar, and honestly this was a bit rough, with a road trip planned for the end of the month. I did the usual holiday stuff but otherwise holed up at home a bit more than I usually would. Charging was limited and the cold made it charge less efficiently.</p> <table class="img"><caption>bleak December charging</caption><tbody><tr><td><a href="http://joeyh.name/blog/pics/offgrid_ev_charging/december_charging.png"><img class="img" height="187" src="http://joeyh.name/blog/entry/offgrid_electric_car/800x-december_charging.png" width="800" /></a></td></tr></tbody></table> <p>Still, I was busy installing more solar panels, and by winter solstice, was back to charging 30 miles on a good day.</p> <p>Of course, from there out things improved. In January and February I was able to charge up easily enough for my usual trips despite the cold. By March the car was often getting full before I needed to go anywhere, and I was doing long round trips without bothering to fast charge along the way, coming home low, knowing even cloudy days would let it charge up enough.</p> <p>That brings me up to today. The car is 80% full and heading up toward 100% for a long trip on Friday. Despite the sky being milky white today with no visible sun, there's plenty of power to absorb, and the car charger turned on at 11 am with the house battery already full.</p> <p>My solar upgrade is only 2/3rds complete, and also I have not yet installed my inverter upgrade, so the car can only currenly charge at 9 amps despite much more solar power often being available. So I'm looking forward to how next December goes with my full planned solar array and faster charging.</p> <p>But first, a summer where I expect the car will mostly be charged up and ready to go at all times, and the only car expense will be fast charging on road trips!</p> <hr /> <p>By the way, the code I've written to automate offgrid charging that runs only when there's enough solar power is <a href="https://git.joeyh.name/index.cgi/joey/house.git/tree/src/Automation/Car.hs#n21">here</a>.</p> <p>And here are the charging graphs for the other months. All told, it's charged 475 kwh offgrid, enough to drive more than 1500 miles.</p> <table class="img"><caption>January</caption><tbody><tr><td><a href="http://joeyh.name/blog/pics/offgrid_ev_charging/january_charging.png"><img class="img" height="206" src="http://joeyh.name/blog/entry/offgrid_electric_car/800x-january_charging.png" width="800" /></a></td></tr></tbody></table> <table class="img"><caption>February</caption><tbody><tr><td><a href="http://joeyh.name/blog/pics/offgrid_ev_charging/february_charging.png"><img class="img" height="187" src="http://joeyh.name/blog/entry/offgrid_electric_car/800x-february_charging.png" width="799" /></a></td></tr></tbody></table> <table class="img"><caption>March</caption><tbody><tr><td><a href="http://joeyh.name/blog/pics/offgrid_ev_charging/march_charging.png"><img class="img" height="187" src="http://joeyh.name/blog/entry/offgrid_electric_car/800x-march_charging.png" width="799" /></a></td></tr></tbody></table> <table class="img"><caption>April</caption><tbody><tr><td><a href="http://joeyh.name/blog/pics/offgrid_ev_charging/april_charging.png"><img class="img" height="187" src="http://joeyh.name/blog/entry/offgrid_electric_car/800x-april_charging.png" width="799" /></a></td></tr></tbody></table> <hr /> <p>2026 update: After upgrading my inverter and running conduit, the car is finally charging at a faster rate of 16 amps, and the car typically charges 25% per day. That seems to be plenty for my needs.</p> 2026-06-17T15:24:14+00:00 Joey Hess http://joeyh.name/blog/entry/aiming_at_December/ <p>I have been working all year on a solar upgrade aimed at December. Now here it is, midwinter, and my electric car is charging on a cloudy day from my offgrid solar fence.</p> <p>I lived happily enough with 1 kilowatt of solar that I <a href="http://joeyh.name/blog/entry/DIY_professional_grade_solar_panel_installation/">installed in 2017</a>. Meanwhile, solar panel prices came down massively, incentives increased and everything came together: This was the year.</p> <p>In the spring I started clearing forest trees that were leaning over the house, making both a firebreak and a solar field.</p> <p>In June I picked up a pallet of panels in a box truck.</p> <table class="img"><caption>a porch with a a bunch of solar panels, stacked on edge leaning up against the wall. A black and white cat is sprawled in front of them.</caption><tbody><tr><td><a href="http://joeyh.name/blog/pics/solar_panels_on_porch_atari.jpg"><img class="img" height="288" src="http://joeyh.name/blog/entry/aiming_at_December/512x-solar_panels_on_porch_atari.jpg" width="512" /></a></td></tr></tbody></table> <p>In August I bought the EV and was able to charge it offgrid from my old solar system... a few miles per day on the most sunny days.</p> <p>In September and October I built <a href="https://hachyderm.io/@joeyh/113177118703625033">a solar fence, of my own design</a>.</p> <table class="img"><caption>Me standing in front of the solar fence, which is 10 panels long</caption><tbody><tr><td><a href="http://joeyh.name/blog/pics/solar_fence.jpg"><img class="img" height="384" src="http://joeyh.name/blog/entry/aiming_at_December/512x-solar_fence.jpg" width="512" /></a></td></tr></tbody></table> <p>For the past several weeks I have been installing additional solar panels on ballasted ground mounts full of gravel. At this point I'm half way through installing my 30 panel upgrade.</p> <p>The design goal of my 12 kilowatt system is to produce 1 kilowatt of power all day on a cloudy day in midwinter, which allows swapping between major loads (EV charger, hot water heater, etc) on a cloudy day and running everything on a sunny day. So the size of the battery bank doesn't matter much. Batteries are getting cheaper fast too, but they are a wear item, so it's better to oversize the solar system and minimize the battery.</p> <p>A lot of this is nonstandard and experimental. And that makes sense with the price of solar panels. It costs more to mount solar panels now than the panels are worth. And non-ideal panel orientation isn't a problem when the system is massively overpaneled.</p> <p>I'm hoping to finish up the install before the end of winter. I have more trees to clear, more ballasted ground mounts to install, and need to come up with something even more experimental for a half dozen or so panels. Using solar panels as mounts for solar panels? Hanging them from trees?</p> <p>Soon the wan light will fade, time to head off to the solstice party to enjoy the long night, and a bonfire.</p> <table class="img"><caption>Solar fence with some ballasted ground mounts in front of it, late evening light. Old pole mounted solar panels in the foreground are from the 90's.</caption><tbody><tr><td><a href="http://joeyh.name/blog/pics/solar_fence_with_powerracks.jpg"><img class="img" height="384" src="http://joeyh.name/blog/entry/aiming_at_December/512x-solar_fence_with_powerracks.jpg" width="512" /></a></td></tr></tbody></table> 2026-06-17T15:17:46+00:00 Joey Hess http://joeyh.name/blog/entry/cheap_DIY_solar_fence_design/ <p><a href="http://joeyh.name/blog/entry/aiming_at_December/">A year ago I installed a 4 kilowatt solar fence</a>. I'm revisiting it this <a href="https://sunday.earth/">Sun Day</a>, to share the design, now that I have prooved it out.</p> <table class="img"><caption>The solar fence and some other ground and pole mount solar panels, seen through leaves.</caption><tbody><tr><td><a href="http://joeyh.name/blog/pics/solar_fence_through_leaves.jpg"><img class="img" height="384" src="http://joeyh.name/blog/entry/cheap_DIY_solar_fence_design/512x-solar_fence_through_leaves.jpg" width="512" /></a></td></tr></tbody></table> <p>Solar fencing manufacturers have some good simple designs, but it's hard to buy for a small installation. They are selling to utility scale solar mostly. And those are installed by driving metal beams into the ground, which requires heavy machinery.</p> <p>Since I have experience with Ironridge rails for roof mount solar, I decided to adapt that system for a vertical mount. Which is something it was not designed for. I combined the Ironridge hardware with regular parts from the hardware store.</p> <p>The cost of mounting solar panels nowadays is often higher than the cost of the panels. I hoped to match the cost, and I nearly did. The solar panels cost $100 each, and the fence cost $110 per solar panel. This fence was significantly cheaper than conventional ground mount arrays that I considered as alternatives, and made a better use of a difficult hillside location.</p> <p>I used 7 foot long Ironridge XR-10 rails, which fit 2 solar panels per rail. (Longer rails would need a center post anyway, and the 7 foot long rails have cheaper shipping, since they do not need to be shipped freight.)</p> <p>For the fence posts, I used regular 4x4" treated posts. 12 foot long, set in 3 foot deep post holes, with 3x 50 lb bags of concrete per hole and 6 inches of gravel on the bottom.</p> <table class="img"><caption>detail of how the rails are mounted to the posts, and the panels to the rails</caption><tbody><tr><td><a href="http://joeyh.name/blog/pics/solar_fence_mounting_detail.jpg"><img class="img" height="512" src="http://joeyh.name/blog/entry/cheap_DIY_solar_fence_design/x512-solar_fence_mounting_detail.jpg" width="384" /></a></td></tr></tbody></table> <p>To connect the Ironridge rails to the fence posts, I used the Ironridge LFT-03-M1 slotted L-foot bracket. Screwed into the post with a 5/8” x 3 inch hot-dipped galvanized lag screw. Since a treated post can react badly with an aluminum bracket, there needs to be some flashing between the post and bracket. I used Shurtape PW-100 tape for that. I see no sign of corrosion after 1 year.</p> <p>The rest of the Ironridge system is a T-bolt that connects the rail to the L-foot (part BHW-SQ-02-A1), and Ironridge solar panel fasteners (UFO-CL-01-A1 and UFO-STP-40MM-M1). Also XR-10 end caps and wire clips.</p> <p>Since the Ironridge hardware is not designed to hold a solar panel at a 90 degree angle, I was concerned that the panels might slide downward over time. To help prevent that, I added some additional support brackets under the bottom of the panels. So far, that does not seem to have been a problem though.</p> <p>I installed Aptos 370 watt solar panels on the fence. They are bifacial, and while the posts block the back partially, there is still bifacial gain on cloudy days. I left enough space under the solar panels to be able to run a push mower under them.</p> <table class="img"><caption>Me standing in front of the solar fence at end of construction</caption><tbody><tr><td><a href="http://joeyh.name/blog/pics/solar_fence.jpg"><img class="img" height="384" src="http://joeyh.name/blog/entry/cheap_DIY_solar_fence_design/512x-solar_fence.jpg" width="512" /></a></td></tr></tbody></table> <p>I put pairs of posts next to one-another, so each 7 foot segment of fence had its own 2 posts. This is the least elegant part of this design, but fitting 2 brackets next to one-another on a single post isn't feasible. I bolted the pairs of posts together with some spacers. A side benefit of doing it this way is that treated lumber can warp as it dries, and this prevented much twisting of the posts.</p> <p>Using separate posts for each segment also means that the fence can traverse a hill easily. And it does not need to be perfectly straight. In fact, my fence has a 30 degree bend in the middle. This means it has both south facing and south-west facing panels, so can catch the light for longer during the day.</p> <p>After building the fence, I noticed there was a slight bit of sway at the top, since 9 feet of wooden post is not entirely rigid. My worry was that a gusty wind could rattle the solar panels. While I did not actually observe that happening, I added some diagonal back bracing for peace of mind.</p> <table class="img"><caption>view of rear upper corner of solar fence, showing back bracing connection</caption><tbody><tr><td><a href="http://joeyh.name/blog/pics/solar_fence_rear_detail.jpg"><img class="img" height="512" src="http://joeyh.name/blog/entry/cheap_DIY_solar_fence_design/x512-solar_fence_rear_detail.jpg" width="384" /></a></td></tr></tbody></table> <p>Inspecting the fence today, I find no problems after the first year. I hope it will last 30 years, with the lifespan of the treated lumber being the likely determining factor.</p> <p>As part of my larger (and still ongoing) ground mount solar install, the solar fence has consistently provided great power. The vertical orientation works well at latitude 36. It also turned out that the back of the fence was useful to hang conduit and wiring and solar equipment, and so it turned into the electrical backbone of my whole solar field. But that's another story..</p> <h2>solar fence parts list</h2> <table> <thead> <tr> <th>quantity</th> <th>cost per unit</th> <th>description</th> </tr> </thead> <tbody> <tr> <td>10</td> <td>$27.89</td> <td>7 foot Ironridge XR-10 rail</td> </tr> <tr> <td>12</td> <td>$20.18</td> <td>12 foot treated 4x4</td> </tr> <tr> <td>30</td> <td>$4.86</td> <td>Ironridge UFO-CL-01-A1</td> </tr> <tr> <td>20</td> <td>$0.87</td> <td>Ironridge UFO-STP-40MM-M1</td> </tr> <tr> <td>1</td> <td>$12.62</td> <td>Ironridge XR-10 end caps (20 pack)</td> </tr> <tr> <td>20</td> <td>$2.63</td> <td>Ironridge LFT-03-M1</td> </tr> <tr> <td>20</td> <td>$1.69</td> <td>Ironridge BHW-SQ-02-A1</td> </tr> <tr> <td>22</td> <td>$2.65</td> <td>5/8” x 3 inch hot-dipped galvanized lag screw</td> </tr> <tr> <td>10</td> <td>$0.50</td> <td>6” gravel per post</td> </tr> <tr> <td>30</td> <td>$6.91</td> <td>50 lb bags of quickcrete</td> </tr> <tr> <td>1</td> <td>$15.00</td> <td>Shurtape PW-100 Corrosion Protection Pipe Wrap Tape</td> </tr> <tr> <td>N/A</td> <td>$30</td> <td>other bolts and hardware (approximate)</td> </tr> </tbody> </table> <p>$1100 total</p> <p>(Does not include cost of panels, wiring, or electrical hardware.)</p> 2026-06-17T15:16:06+00:00 Joey Hess http://dirk.eddelbuettel.com/blog/2026/06/16#rspdlite_0.1.0-1 <p>Very happy to share that a new package <a href="https://github.com/eddelbuettel/rspdlite">rspdlite</a> arrived on <a href="https://cran.r-project.org">CRAN</a> today in its inaugural version 0.1.0-1. It wraps and provides the (header-only) C++20 library <a href="https://github.com/gabime/spdlite">spdlite</a> which its author describes (aptly) as <em>tiny, fast, capable</em>. Just like its bigger sibbling <a href="https://github.com/gabime/spdlog">spdlog</a> (which we wrapped as <a href="https://github.com/eddelbuettel/rcppspdlog">rcppspdlog</a>), it is written by <a href="https://github.com/gabime">Gabi Melman</a>. However, with a focus on C++20 and compile-time configuration, it is lighter, nimbler and faster. It is also still a fairly young project so changes may occur.</p> <p>I have been working on this for about a month, and it is ready for use by R and C++. It contains the initial upstream release 0.1.0, and I plan to follow the upstream versioning making this first release as 0.1.0-1.</p> <p>The package itself provides the headers for use from other C++ projects (i.e. mostly other packages), as well as a simple R wrapper so that logging can occur from either C++ or R. It will generally access the single logger instance in a compilation unit. So for a package built against these header it would be shared library of that package. At present we provide the basic logging level setters and getters, formatting accessors, and two (compile-time) options of a ‘null logger’ and a file-based logger. More options are availble from the C++ level, multiple logging sinks are but one example. Some examples are provided in the package as an <a href="https://github.com/eddelbuettel/rspdlite/blob/master/inst/examples/example.R">R example</a> and a <a href="https://github.com/eddelbuettel/rspdlite/blob/master/inst/examples/example.cpp">C++ example</a>; these are probably best examined from the sources.</p> <p>The NEWS entry for this release is simply and just announces that we have a release. More details are in the <a href="https://github.com/eddelbuettel/rspdlite/blob/master/ChangeLog">ChangeLog</a> and the <a href="https://github.com/eddelbuettel/rspdlite">GitHub repo</a>.</p> <blockquote> <h4 id="changes-in-version-0.1.0-1-2025-06-08">Changes in version 0.1.0-1 (2025-06-08)</h4> <ul> <li>Initial complete version and CRAN upload</li> </ul> </blockquote> <p style="font-size: 80%; font-style: italic;"> This post by <a href="https://dirk.eddelbuettel.com">Dirk Eddelbuettel</a> originated on his <a href="https://dirk.eddelbuettel.com/blog/">Thinking inside the box</a> blog. If you like this or other open-source work I do, you can <a href="https://github.com/sponsors/eddelbuettel">sponsor me at GitHub</a>. You can also sponsor my <a href="https://dirk.eddelbuettel.com/blog/2026/04/03#sponsor_tour_de_shore_202">Tour de Shore 2026 ride in support of the Maywood Fine Arts Center</a>. </p><p></p> 2026-06-17T00:16:00+00:00 Dirk Eddelbuettel https://sunweavers.net/blog/node/158 <p>The next Ubuntu Touch major release is approaching rapidly, yesterday we reached a major step in the preparation of the upcoming Ubuntu Touch 24.04-2.0 release: The branching-off (see below on what that is).</p> <h3>Ubuntu Touch 24.04-2.0 Beta is Now Available</h3> <p>Part of this development release step is the publication of the 24.04-2.0 Beta release images, for more details and information see:<br /> <a href="https://ubports.com/blog/ubports-news-1/ubuntu-touch-24-04-2-0-beta-is-now-ready-for-testing-4000" title="https://ubports.com/blog/ubports-news-1/ubuntu-touch-24-04-2-0-beta-is-now-ready-for-testing-4000">https://ubports.com/blog/ubports-news-1/ubuntu-touch-24-04-2-0-beta-is-n...</a></p> <p>And additionally, find below some background information on how we maintain various Ubuntu Touch releases in parallel via Git(Lab). In fact, the release model of Ubuntu Touch has partially been adopted from how we in Debian maintains our various Debian versions in parallel, only that in Ubuntu Touch we use Git(Lab) for maintaining the different package versions and not, like in Debian, the APT archive itself.</p> <h3>What does 'Branching-Off' Mean?</h3> <p>Last Saturday, in the UBports Q&amp;A, I explained Ubuntu Touch's "branching-off", an aspect of the Ubuntu Touch release workflow based on Git(Lab). To make this accessible to even more people, here it comes as a write-up:</p> <p>We host many Git repositories on GitLab, and our primary work is done on the main branches, which contain the bleeding-edge code. When a merge request is deemed critical for stable versions of Ubuntu Touch, we cherry-pick it into a release series branch.</p> <p>Currently, we land our changes in the main branches and then cherry-pick them to the ubports/24.04.1.x branches. The 'branching off' process for the upcoming 24.04-2.x release means that our current main branches will be copied over to create new branches for this release cycle, namely ubports/24.04-2.x.</p> <p>This has two major implications. First, any item that hasn't been translated by the time of the branch-off will not receive any more translation updates during the 24.04-2.x cycle. This is why it is crucial that translation work is completed before the branching-off.</p> <h3>Warning of Breaking Changes arriving soon in 26.04-1.x Daily Development UT Images</h3> <p>Second, looking ahead to the release after 24.04-2.x, we will be approaching 26.04-1.x. The OS base will change to Ubuntu 26.04 LTS, hopefully being ready for release to Ubuntu Touch users before the end of the year. We already have a list of features we want to land there. Because we plan to include various major changes, such as the switch from Mir 1 to Mir 2, new calendar and contacts backends, Qt6-based core apps and service components, etc., the likelihood of breaking changes at the beginning of the 26.04-1.x release cycle (which will become the next main branches' target) is very high.</p> <h3>The Ubuntu Touch 24.04-2.0 Release Schedule</h3> <p>The current release schedule is estimated to be:</p> <p><strong>25 May 2026</strong> [done]<br /> Platform stability freeze 24.04-2.x</p> <p><strong>25 May 2026</strong> [done]<br /> String freeze 24.04-2.x</p> <p><strong>15 June 2026</strong> [done]<br /> Branching-off (and unfreeze 26.04-1.x development), UT image release: 24.04-2.0 Beta</p> <p><strong>22 or 29 June 2026</strong> [coming]<br /> Final freeze for 24.04-2.x, UT image release: 24.04-2.0 RC</p> <p><strong>6 or 13 July 2026</strong> [coming]<br /> Release version 24.04-2.0</p> 2026-06-16T11:14:29+00:00 sunweaver https://vincent.bernat.ch/en/blog/2026-kpi-goodhart <p>In 2008, I landed my second job, in the network team at <em>Orange Portails</em><sup id="fnref-hebex"><a class="footnote-ref" href="https://vincent.bernat.ch#fn-hebex">1</a></sup>, the division behind the websites and search engine of the French telecom operator Orange. The place ran like clockwork: a comprehensive technical setup, a dedicated team for every part of the business, and room to focus on what I do best. A few years later, none of that mattered: thanks to an obsession with the numbers, we could no longer deliver new services on time.</p> <div class="admonition"> <p class="admonition-title">Disclaimer</p> <p>This is a story I like to tell to warn people about <a href="https://en.wikipedia.org/wiki/Goodhart%27s_law" title="Goodhart's law on Wikipedia">Goodhart’s law</a>.<sup id="fnref-campbell"><a class="footnote-ref" href="https://vincent.bernat.ch#fn-campbell">2</a></sup> As these events happened almost 15 years ago, my recollection is a bit fuzzy. I left in 2012.</p> </div> <h1 id="the-first-years">The first years</h1> <p>During my first years, the department operated like a startup. Its cradle was the French company Echo. They built a search engine. France Télécom bought it and renamed it <a href="https://fr.wikipedia.org/wiki/Voila">Voila</a>. It was the most visited search engine in France in the early 2000s. France Télécom consolidated the portal activities into the <em>Wanadoo Portails</em> division, later renamed <em>Orange Portails</em>.</p> <p>The technical environment was excellent. We had many internal tools:<sup id="fnref-nocloud"><a class="footnote-ref" href="https://vincent.bernat.ch#fn-nocloud">3</a></sup> a ticket system, an RRD-based graphing tool, an IPAM, a reporting tool, and an SNMP-based alerting tool.<sup id="fnref-snalert"><a class="footnote-ref" href="https://vincent.bernat.ch#fn-snalert">4</a></sup> We deployed our Linux servers with <a href="https://cfengine.com/">CFEngine</a>. We installed systems and applications from internal Debian repositories. We documented everything in a private <a href="https://www.mediawiki.org/wiki/MediaWiki" title="MediaWiki is a collaboration and documentation platform">MediaWiki</a> instance. Supervision was performed with an ancestor of <a href="https://www.xymon.com/servers/servers.html" title="The Xymon Monitor">Xymon</a>. The network architecture was clean and scalable with little legacy. We onboarded new people in a day.</p> <p>It was a nurturing environment for me. I developed several tools: <a href="https://lldpd.github.io/" title="lldpd: implementation of IEEE 802.1AB">lldpd</a>, an 802.1AB implementation, <a href="https://vincent.bernat.ch/en/blog/2013-snimpy" title="snimpy: SNMP &amp; Python">Snimpy</a>, a pythonic binding for Net-SNMP, <a href="https://github.com/vincentbernat/wiremaps">Wiremaps</a>, a layer-2 discovery tool with a time machine to know which device is connected where, <a href="https://github.com/vincentbernat/Kitero">KitérÅ‘</a>, a tool to simulate network conditions, <a href="https://github.com/vincentbernat/QCss-3/">QCSS-3</a>, a controller for load-balancers, and <a href="https://github.com/vincentbernat/ipoo">ipoo</a>, a service available through a Jabber chatbot and a Greasemonkey script to expose IP-related information. I added <a href="https://vincent.bernat.ch/en/blog/2011-keepalived-snmp-ipv6" title="SNMP support for Keepalived">SNMP support for Keepalived</a> and <a href="https://github.com/search?q=repo%3AFRRouting%2Ffrr+author%3Avincentbernat+snmp&amp;type=commits" title="SNMP-related commits for Quagga/FRR">Quagga</a>. I also started this blog, with articles like “<a href="https://vincent.bernat.ch/en/blog/2011-dns-anycast" title="Anycast DNS">Anycast DNS</a>,â€� TLS-related articles like “<a href="https://vincent.bernat.ch/en/blog/2011-ssl-dos-mitigation" title="TLS computational DoS mitigation">TLS computational DoS mitigation</a>,â€� SNMP-related articles like “<a href="https://vincent.bernat.ch/en/blog/2012-snmp-event-loop" title="Integration of Net-â� SNMP into an event loop">Integration of Net-SNMP into an event loop</a>,â€� Linux-related articles like “<a href="https://vincent.bernat.ch/en/blog/2011-ipv4-route-cache-linux" title="Tuning Linux IPv4 route cache">Tuning Linux IPv4 route cache</a>,â€� and an <a href="https://vincent.bernat.ch/en/blog/2012-multicast-vxlan" title="Network virtualization with VXLAN">article about VXLAN</a> long before it was cool.</p> <h1 id="the-collapse">The collapse</h1> <p>When we needed new servers, the on-site team would take a set from the inventory, install our base Linux distribution on them, put them in the datacenter, and cable them to the top-of-the-rack switches. We opened a ticket describing the servers we needed, and one week later, our servers were available. 💫</p> <p>Orange wanted to know if this team was performing well, so they asked for <abbr title="Key Performance Indicators">KPIs</abbr>. They decided to use the number of tickets completed in a year. They asked to double this number. So instead of one ticket for a new service, we would open six tickets—one per server. By the end of the year, the <abbr title="Key Performance Indicators">KPIs</abbr> had more than doubled.</p> <p>Everybody saw it as a success for performance management. So, they asked to do the same for the next year. Now, we needed to open a ticket per server and per step. Again, the <abbr title="Key Performance Indicators">KPIs</abbr> doubled. Behind the scenes, the tickets went to different people and were no longer handled in order. So, for the next year, it was decided to have meta-tickets and meetings to follow the progress of these tickets. Of course, all these extra steps pushed the <abbr title="Key Performance Indicator">KPI</abbr> even higher.</p> <p>This performance management method spread to the other teams.<sup id="fnref-firewall"><a class="footnote-ref" href="https://vincent.bernat.ch#fn-firewall">5</a></sup> Everything became slower. Instead of a couple of weeks, a new service now took six months. We built a <a href="https://fronterabrands.com/goodharts-law/" title="Goodhart’s Law: Soviet Nail Factories &amp; The Power of Incentives">Soviet nail factory</a>. But the <abbr title="Key Performance Indicators">KPIs</abbr> were good, and we stopped caring.</p> <p>Let me give you another example. We had to estimate the impact of each night operation. We weren’t half bad: we declared most operations “without any expected impact.â€� Most of the time, there was no impact. One time out of five, there was a 5-second impact. We were told to try harder to meet our expected impact. What did we do? We started declaring a 5-second expected impact. One day, we got a 30-second impact and were told we failed to match the expected impact. In the end, we declared most operations with a 10-minute expected impact, and we stopped caring: instead of carefully shifting traffic around, we allowed ourselves a 5-minute impact. And our <abbr title="Key Performance Indicators">KPIs</abbr> were never better.</p> <figure><div class="lf-media-outer" style="width: 630px;"><span class="lf-media-inner"><img alt="Graph showing the impact of night operations. Year after year, the impact tolerance has been increased. In the final year, the expected impact is 10 minutes, and all operations remain under this threshold. However, the impacts are much more significant than they were in the first year." class="lf-media" height="245" src="https://d2pzklc15kok91.cloudfront.net/images/orange-impacts.03b883aacf07da.svg" width="630" /></span></div><figcaption>An artist's rendering of the evolution of impacts over the years.</figcaption></figure> <hr /> <p><abbr title="Key Performance Indicators">KPIs</abbr> are not bad, but they are easy to break. Use them carefully: let the people doing the work help choose the metrics, and tie those metrics to the quality of the service—for example, with <a href="https://sre.google/sre-book/service-level-objectives/" title="Google SRE book: Service Level Objectives">service level objectives</a>. Otherwise, even dedicated people stop caring, game the system, and eventually quit.<sup id="fnref-google"><a class="footnote-ref" href="https://vincent.bernat.ch#fn-google">6</a></sup> 📊</p> <div class="footnote"> <hr /> <ol> <li id="fn-hebex"> <p>Internally, this division was named “Hebex.â€� It was located in Bagnolet (next to Paris) and Sophia-Antipolis (near Nice). <a class="footnote-backref" href="https://vincent.bernat.ch#fnref-hebex" title="Jump back to footnote 1 in the text">↩</a></p> </li> <li id="fn-campbell"> <p>Goodhart’s law often gets the credit, but <a href="https://en.wikipedia.org/wiki/Campbell%27s_law" title="Campbell's law on Wikipedia">Campbell’s law</a> describes my experience even better: the more you lean on a number to make decisions, the faster people corrupt it. <a class="footnote-backref" href="https://vincent.bernat.ch#fnref-campbell" title="Jump back to footnote 2 in the text">↩</a></p> </li> <li id="fn-nocloud"> <p>At the time, <abbr title="Software as a Service">SaaS</abbr> was not really a thing. I remember we considered, with a couple of colleagues, selling <a href="https://github.com/vincentbernat/wiremaps">Wiremaps</a> as a <abbr title="Software as a Service">SaaS</abbr>, with homomorphic encryption for the database. But who would outsource their observability stack? <a class="footnote-backref" href="https://vincent.bernat.ch#fnref-nocloud" title="Jump back to footnote 3 in the text">↩</a></p> </li> <li id="fn-snalert"> <p><em>Snalert</em> was a metacircular alerting tool in Perl. It was able to poll a very large number of SNMP targets in a short timespan. All our monitoring was SNMP-based, including system monitoring. <a class="footnote-backref" href="https://vincent.bernat.ch#fnref-snalert" title="Jump back to footnote 4 in the text">↩</a></p> </li> <li id="fn-firewall"> <p>My team also managed the rules of many Linux-based firewalls. To increase our <abbr title="Key Performance Indicators">KPIs</abbr>, we used the same method: rather than accepting one ticket with a flow matrix, we requested one ticket per flow. <a class="footnote-backref" href="https://vincent.bernat.ch#fnref-firewall" title="Jump back to footnote 5 in the text">↩</a></p> </li> <li id="fn-google"> <p>Orange is not unique. Google’s promotion process is another well-known example of a broken <abbr title="Key Performance Indicator">KPI</abbr>. Michael Lynch explains it in “<a href="https://mtlynch.io/why-i-quit-google/" title="Why I Quit Google to Work for Myself">Why I Quit Google to Work for Myself</a>.â€� <a class="footnote-backref" href="https://vincent.bernat.ch#fnref-google" title="Jump back to footnote 6 in the text">↩</a></p> </li> </ol> </div> 2026-06-16T06:26:27+00:00 Vincent Bernat https://retout.co.uk/2026/06/15/in-memoriam-commitemailpy/ <p>I have <a href="https://github.com/seL4/l4v/pull/1020/changes/d910068845aca32099cd480b5ac8f85257bbca52">proposed the deletion of an obsolete script</a>, but it makes me feel complicated feelings so I’m going to try and express those. This particular script was written in 2014, but the concept goes back much further – before git was invented.</p> <p>When I started university in 2003, I seem to remember the computing society used to run tutorials for first-year students on how to use Apache Subversion for your group project – a vast upgrade on CVS (or worse, no version control at all). Back then, the idea of viewing your changesets in a web browser was relatively new – while it was possible to look at an SVN repository through a web UI, features were limited unless you installed something compicated like <a href="https://trac.edgewall.org/wiki/TracSubversion">Trac</a>.</p> <p><img alt="Data flow when distributing commits via a mailing list" src="https://retout.co.uk/2026/commit-email.drawio.svg" /> <em>Figure 1: Data flow when distributing commits via a mailing list</em></p> <p>Perhaps because reading email on your desktop computer (I don’t think I could afford an IBM ThinkPad?) was the only vaguely real-time notification system available at the time (except I guess SMS, which cost 10p per text), a common pattern seemed to be to use a <a href="https://svnbook.red-bean.com/en/1.7/svn-book.html#svn.ref.reposhooks.post-commit">post-commit hook</a> to send every single commit to a mailing list, named something like ‘foo-commits’. Indeed, for a long time Fedora had an scm-commits list which <a href="https://discussion.fedoraproject.org/t/the-future-plans-for-the-scm-commits-mailing-list/193068">appears to be a topic of recent discussion</a>.</p> <p>I can’t really explain <em>why</em> people wanted to have every commit sent to a mailing list except as a way of getting notified of activity – I can’t believe people would import raw patches from those lists, ala LKML, rather than run actual version control commands to fetch the new source directly. Maybe you’d have to go back to NNTP for this.</p> <p>I do like the vendor-neutrality of the “everything-as-text” approach, building on the open ecosystem of SMTP. But I doubt we’d see a widespread resurgence of commit lists now – most code hosting must allow anyone to subscribe to email notifications, I assume, and I don’t see a huge benefit in a mailing list archive of commit messages.</p> <p>In the case of seL4, I’m even more confused about why this script was committed in 2014, shortly after the kernel was put on GitHub. I can only assume it was imported from previous infrastructure. I do know that the implementation is quite Python 2 heavy, with the conversion between unicode and bytes featuring heavily. So rather than risk breaking its logic with patching, I think it’s time to “thank it for its service” and let go.</p> 2026-06-15T22:04:50+00:00 Tim Retout http://dirk.eddelbuettel.com/blog/2026/06/14#rbenchmark_1.0.1 <p>Quick note to share that <a href="https://dirk.eddelbuettel.com/code/rbenchmark.html">rbenchmark</a> is back on <a href="https://cran.r-project.org">CRAN</a>! The <a href="https://dirk.eddelbuettel.com/code/rbenchmark.html">rbenchmark</a> package makes it easy to benchmark (and compare) simple R expressions.</p> <p>This package has been on <a href="https://cran.r-project.org">CRAN</a> for many years. At one point fourteen years ago it appeared to be rudderless so I offered help but things realigned. Now it was just tossed off <a href="https://cran.r-project.org">CRAN</a>, taking a number of packages depending on it with it (as shown in this <a href="https://bsky.app/profile/cranberriesfeed.bsky.social/post/3mnyns2uqch2o">CRANberries skeet</a> listing a set of removed packages) so I offered again to help, and <a href="https://cran.r-project.org">CRAN</a> agreed. So here we are.</p> <p>So far I just made a number of small ‘editing’ changes, added CI support, and enable dbsr-universe coverage . I do not expect to change the package materially. So far the package has no NEWS file either so maybe glance at the <a href="https://github.com/eddelbuettel/rbenchmark/blob/master/ChangeLog">ChangeLog</a> at the <a href="https://github.com/eddelbuettel/rbenchmark">git repo</a>.</p> <p style="font-size: 80%; font-style: italic;"> This post by <a href="https://dirk.eddelbuettel.com">Dirk Eddelbuettel</a> originated on his <a href="https://dirk.eddelbuettel.com/blog/">Thinking inside the box</a> blog. If you like this or other open-source work I do, you can <a href="https://github.com/sponsors/eddelbuettel">sponsor me at GitHub</a>. You can also sponsor my <a href="https://dirk.eddelbuettel.com/blog/2026/04/03#sponsor_tour_de_shore_202">Tour de Shore 2026 ride in support of the Maywood Fine Arts Center</a>. </p><p></p> 2026-06-15T00:54:00+00:00 Dirk Eddelbuettel https://jmtd.net/log/heroquest/ <div class="image"> <a href="https://jmtd.net/log/heroquest/hq.jpg"><img alt="_First Light_ box" class="img" height="263" src="https://jmtd.net/log/heroquest/350x-hq.jpg" width="350" /></a> <p><em>First Light</em> box</p> </div> <p>My youngest daughter and I recently started playing the tabletop game HeroQuest. Specifically, the recently-issued, cut-down variant <em>HeroQuest: First Light</em>. This is quite advanced for her age, and I'm a little surprised she's taken to it, but she's really loving it, It's pushed her to read bits of lore on cards and quest books that is way above her expected reading level, and we've been exercising her maths by adding up the gold we find on our quests and calculating what the heroes can buy with it in the store afterwards.</p> <p>Originally from 1989, Hasbro re-issued HeroQuest in 2020. I read about it at the time but didn't buy it. I wasn't sure who I would play it with. It also seemed expensive to me. It probably <em>wasn't</em> unusually expensive in 2020, nor now, for the sheer volume of finely-sculpted miniatures included. I also knew I had the original game in the loft, and I wasn't that keen on buying something I already had, although untangling the contents from several similar boxed games would take me many hours, and I wasn't sure how much of the game I would find.</p> <div class="image"> <a href="https://jmtd.net/log/heroquest/closeup.jpg"><img alt="mix of old and new" class="img" height="263" src="https://jmtd.net/log/heroquest/350x-closeup.jpg" width="350" /></a> <p>mix of old and new</p> </div> <p><em>First Light</em> was compelling because it is much, much cheaper than the full remake, so I was happy to take a punt. It's cheaper because it doesn't have any plastic monsters or furniture: instead cardboard cut-outs that stand up on plastic stands. For us, that is a significant drawback: 3D miniatures are much more immersive, But I can re-use the plastic miniatures I can find from the original game. <em>First Light</em> has a newly written adventure, better suited to beginners than the original game.</p> <p>The re-issue(s) have new art and new model sculpts that look fantastic. They've changed anything which tied into Games Workshop's IP and I'm really happy about that. They've made an effort to add women, almost entirely absent from the original. I'm certain my daughter wouldn't have tried it otherwise.</p> 2026-06-14T09:31:49+00:00 jmtd https://blog.tenstral.net/2026/06/introducing-pkgcli-a-nicer-command-line-interface-for-packagekit.html <p class="wp-block-paragraph">For almost two decades, the <a href="https://github.com/PackageKit/PackageKit">PackageKit</a> package management abstraction layer has shipped with <code>pkcon</code> as its command-line client. <code>pkcon</code> does its job, but it was always kind of a “testing” front-end for the PackageKit daemon rather than a tool designed for everyday use. The focus has instead been on the GUI tools, automatic system updates, GUI application managers and other front-ends. Its command names mirror the D-Bus API almost one-to-one (<code>get-details</code>, <code>get-updates</code>, <code>get-depends</code>), output is very plain, and there is no machine-readable mode for scripting. Most importantly though, there has been no development on it at all for almost a decade, so <code>pkcon</code> was stuck in its rudimentary state from that era.</p> <p class="wp-block-paragraph">Since a lot of changes will be coming to PackageKit, and testing the daemon and working with it from the command-line was not very pleasant anymore in 2025/2026, I decided to modernize the tool as part of my work as fellow for the <a href="https://www.sovereign.tech/">Sovereign Tech Agency</a> last year. <code>pkgcli</code> is the new command-line client for PackageKit. It is built from the ground up to be pleasant to use interactively <em>and</em> easy to drive from scripts.</p> <h2 class="wp-block-heading">Why a new tool?</h2> <p class="wp-block-paragraph">Of course, instead of introducing a new tool, I could have just expanded <code>pkcon</code> instead. The problem with that approach is that the <code>pkcon</code> utility has been around for so long and its command-line API had ossified so much, that rather than changing it and potentially breaking a lot of scripts relying on its quirks, I decided to introduce a new tool instead. <code>pkcon</code> can still be optionally compiled for people who need it in their scripts and workflows.</p> <p class="wp-block-paragraph">The goals for <code>pkgcli</code>, and the features it now has are:</p> <ul class="wp-block-list"> <li><strong>Human-friendly command names.</strong> Verbs that read the way you’d describe the task, instead of mirroring the D-Bus API 1:1: <code>show</code>, <code>search</code>, <code>list-updates</code>, <code>what-provides</code>, instead of <code>get-details</code> and friends.</li> <li><strong>Readable, <span style="color: #b00020;">c</span><span style="color: #0057b8;">o</span><span style="color: #0b7a0b;">l</span><span style="color: #8a4b00;">o</span><span style="color: #6f42c1;">r</span><span style="color: #007a7a;">e</span><span style="color: #c2410c;">d</span> output</strong> by default (still respecting <a href="https://no-color.org/"><code>NO_COLOR</code></a> and degrading gracefully).</li> <li><strong>A real scripting mode.</strong> A global <code>--json</code> flag emits <a href="https://jsonlines.org/">JSONL</a> instead of fully human-readable output when possible, to make it easier to use the tool for scripting purposes.</li> <li><strong>Sensible defaults.</strong> A few defaults have been changed, such as the metadata cache-age, or automatic cleanup of unused dependencies being enabled by default. This is more in line with current defaults by other tools and frontends. We also print package information in a slightly different, more readable way.</li> <li><strong>Better handling of internationalized text</strong>. Text should now align properly in the terminal window, and we should no longer have completely chaotic text output on non-English locales (especially Chinese/Japanese).</li> </ul> <h2 class="wp-block-heading">Why not <code>pkgctl</code>?</h2> <p class="wp-block-paragraph">Originally, this tool was called <code>pkgctl</code>, to match other common cross-distro tool names. However, that name was already taken by an <a href="https://man.archlinux.org/man/pkgctl.1">Arch-specific distro development tool</a>. When this issue was raised, we decided to just rename our tool to <code>pkgcli</code> with the next release, to avoid the name clash on Arch Linux.</p> <h2 class="wp-block-heading">Examples!</h2> <p class="wp-block-paragraph">Here are some examples on how to use the new tool (some of which include the abridged output <code>pkgcli</code> prints).</p> <p class="wp-block-paragraph">Search for anything containing the string “editor” in name or description, then look at the details of one result:</p> <pre class="wp-block-code"><code>$ pkgcli search editor Querying [████████████████████████████████████████] 100% <span style="color: #00a;">▣</span> <span style="font-weight: bold;">ace-of-penguins</span> <span style="color: #555555;">1.5~rc2-7</span>.<span style="color: #555555;">amd64</span> [<span style="color: #555555;">debian-testing-main</span>] <span style="color: #00a;">▣</span> <span style="font-weight: bold;">acorn-fdisk</span> <span style="color: #555555;">3.0.6-14</span>.<span style="color: #555555;">amd64</span> [<span style="color: #555555;">debian-testing-main</span>] <span style="color: #00a;">▣</span> <span style="font-weight: bold;">ardour</span> <span style="color: #555555;">1:9.2.0+ds-1</span>.<span style="color: #555555;">amd64</span> [<span style="color: #555555;">debian-testing-main</span>] <span style="color: #0a0;">✔</span> <span style="font-weight: bold;">audacity</span> <span style="color: #555555;">3.7.7+dfsg-1</span>.<span style="color: #555555;">amd64</span> [<span style="color: #555555;">manual:debian-testing-main</span>] <span style="color: #0a0;">✔</span> <span style="font-weight: bold;">audacity-data</span> <span style="color: #555555;">3.7.7+dfsg-1</span>.<span style="color: #555555;">all</span> [<span style="color: #555555;">auto:debian-testing-main</span>] <span style="color: #00a;">▣</span> <span style="font-weight: bold;">augeas-tools</span> <span style="color: #555555;">1.14.1-1.1</span>.<span style="color: #555555;">amd64</span> [<span style="color: #555555;">debian-testing-main</span>] <span style="color: #00a;">▣</span> <span style="font-weight: bold;">emacs</span> <span style="color: #555555;">1:30.2+1-3</span>.<span style="color: #555555;">all</span> [<span style="color: #555555;">debian-testing-main</span>] <span style="color: #00a;">▣</span> <span style="font-weight: bold;">gedit</span> <span style="color: #555555;">48.1-9+b1</span>.<span style="color: #555555;">amd64</span> [<span style="color: #555555;">debian-testing-main</span>] <span style="color: #00a;">▣</span> <span style="font-weight: bold;">gedit-common</span> <span style="color: #555555;">48.1-9</span>.<span style="color: #555555;">all</span> [<span style="color: #555555;">debian-testing-main</span>] <span style="color: #00a;">▣</span> <span style="font-weight: bold;">gedit-dev</span> <span style="color: #555555;">48.1-9+b1</span>.<span style="color: #555555;">amd64</span> [<span style="color: #555555;">debian-testing-main</span>] [...] $ pkgcli show nano <span style="font-weight: bold;">Package:</span> nano <span style="font-weight: bold;">Version:</span> 9.0-1 <span style="font-weight: bold;">Summary:</span> small, friendly text editor inspired by Pico <span style="font-weight: bold;">Description:</span> GNU nano is an easy-to-use text editor originally designed as a replacement for Pico, the ncurses-based editor from the non-free mailer package Pine. [...] <span style="font-weight: bold;">URL:</span> https://www.nano-editor.org/ <span style="font-weight: bold;">Group:</span> publishing <span style="font-weight: bold;">Installed Size:</span> 2.9 MB <span style="font-weight: bold;">Download Size:</span> 646.0 KB</code></pre> <p class="wp-block-paragraph">Search only within package <em>names</em> rather than descriptions:</p> <pre class="wp-block-code"><code>$ pkgcli search name python3</code></pre> <p class="wp-block-paragraph">Check for updates. <code>refresh</code> updates the metadata, then <code>list-updates</code> reports what’s available:</p> <pre class="wp-block-code"><code>$ pkgcli refresh &amp;&amp; pkgcli list-updates Loading cache [████████████████████████████████████████] 100% <span style="color: #0aa;">▲</span> <span style="font-weight: bold;">cme</span> <span style="color: #555555;">1.048-1</span>.<span style="color: #555555;">all</span> [<span style="color: #555555;">debian-testing-main</span>] <span style="color: #0aa;">▲</span> <span style="font-weight: bold;">gir1.2-gdm-1.0</span> <span style="color: #555555;">50.1-2</span>.<span style="color: #555555;">amd64</span> [<span style="color: #555555;">debian-testing-main</span>] <span style="color: #0aa;">▲</span> <span style="font-weight: bold;">imagemagick</span> <span style="color: #555555;">8:7.1.2.24+dfsg1-1</span>.<span style="color: #555555;">amd64</span> [<span style="color: #555555;">debian-testing-main</span>] <span style="color: #0aa;">▲</span> <span style="font-weight: bold;">imagemagick-7-common</span> <span style="color: #555555;">8:7.1.2.24+dfsg1-1</span>.<span style="color: #555555;">all</span> [<span style="color: #555555;">debian-testing-main</span>] <span style="color: #0aa;">▲</span> <span style="font-weight: bold;">imagemagick-7.q16</span> <span style="color: #555555;">8:7.1.2.24+dfsg1-1</span>.<span style="color: #555555;">amd64</span> [<span style="color: #555555;">debian-testing-main</span>] <span style="color: #0aa;">▲</span> <span style="font-weight: bold;">libdlrestrictions1</span> <span style="color: #555555;">0.22.0</span>.<span style="color: #555555;">amd64</span> [<span style="color: #555555;">debian-testing-main</span>] <span style="color: #0aa;">▲</span> <span style="font-weight: bold;">libfftw3-bin</span> <span style="color: #555555;">3.3.11-1</span>.<span style="color: #555555;">amd64</span> [<span style="color: #555555;">debian-testing-main</span>] <span style="color: #0aa;">▲</span> <span style="font-weight: bold;">libfftw3-dev</span> <span style="color: #555555;">3.3.11-1</span>.<span style="color: #555555;">amd64</span> [<span style="color: #555555;">debian-testing-main</span>]</code></pre> <p class="wp-block-paragraph">Explore relationships between packages:</p> <pre class="wp-block-code"><code>$ pkgcli list-depends inkscape <span style="color: #6b6b6b;"># list what inkscape depends on</span> $ pkgcli list-requiring libappstream5 <span style="color: #6b6b6b;"># list what requires libappstream5</span></code></pre> <p class="wp-block-paragraph">Find the package that provides a capability, here the AV1 GStreamer decoder:</p> <pre class="wp-block-code"><code>$ pkgcli what-provides "gstreamer1(decoder-video/x-av1)" <span style="color: #0a0;">✔</span> <span style="font-weight: bold;">gstreamer1.0-plugins-bad</span> <span style="color: #555555;">1.28.3-1</span>.<span style="color: #555555;">amd64</span> [<span style="color: #555555;">auto:debian-testing-main</span>]</code></pre> <p class="wp-block-paragraph">You can also have JSON output for most commands! Attach <code>--json</code> to any query and pipe the result straight into <a href="https://jqlang.github.io/jq/"><code>jq</code></a>. Each line is a self-contained JSON object:</p> <pre class="wp-block-code"><code>$ pkgcli --json list-updates | jq -r '.name' cme gir1.2-gdm-1.0 imagemagick imagemagick-7-common imagemagick-7.q16 libdlrestrictions1 libfftw3-bin libfftw3-dev libfftw3-double3</code></pre> <h2 class="wp-block-heading">Try it</h2> <p class="wp-block-paragraph"><code>pkgcli</code> is built by default alongside the rest of PackageKit since PackageKit 1.3.4. If your distribution ships a recent enough PackageKit, it should already be on your <code>PATH</code>. You can read its man page <code>man pkgcli</code> for more information. Feedback, bug reports, and patches are <a href="https://github.com/PackageKit/PackageKit/pulls">very welcome</a>.</p> 2026-06-14T06:22:00+00:00 Matthias https://gwolf.org/2026/06/rey-ubu-carro-de-comedias-unam.html <p>Today we went to see a theater play in UNAM’s Cultural Center, very near our home. No, not inside any of the theaters — <a href="https://osm.org/go/S8c~P~7RY?m=">in the square just between Sala Nezahualcóyotl, Foro Sor Juana and Sala Carlos Chávez.</a>. So, yes, not only we had fun, but we had fun for free!</p> <p><a href="https://gwolf.org/files/2026-06/rey_ubu.jpg"><img alt="Announcement" src="https://gwolf.org/files/2026-06/rey_ubu.200.jpg" /></a></p> <p>UNAM’s <a href="https://elanfiteatro.mx/p/carro-de-comedias-de-la-unam">El Carro de Comedias</a> is an itinerant theater company that often presents in this same spot (but you can see the stage is foldable, and they do have presentations elsewhere, of this same play even). I went with my family, and we enjoyed a very fun adaptation of this great play (written by teenager Alfred Jarry in 1894). One of those plays that could be inspired any day by current geopolitical events…</p> <p>I know most of the people that happen to stumble upon my blog are not in Mexico City. But if you happen to be here, do consider going to their function. <a href="https://teatrounam.com.mx/teatro/entradasteatro/ubu-rey/#calendario">Check their schedule</a>; being it an itinerating show, they can also be found at other places, but they are scheduled at the same place we saw them, every Saturday and Sunday until June 28, 11:00AM. They mentioned they will likely continue during August, but AFAICT it is not confirmed (or, at least, announced) yet.</p> <p>Some pics, shot randomly by me throughout the play:</p> <p><a href="https://gwolf.org/files/2026-06/first_call.jpg"><img alt="Announcement" src="https://gwolf.org/files/2026-06/first_call.400.jpg" /></a></p> <p><a href="https://gwolf.org/files/2026-06/first_call.jpg"><img alt="First_call" src="https://gwolf.org/files/2026-06/first_call.400.jpg" /></a></p> <p><a href="https://gwolf.org/files/2026-06/accordion.jpg"><img alt="Accordion" src="https://gwolf.org/files/2026-06/accordion.400.jpg" /></a></p> <p><a href="https://gwolf.org/files/2026-06/mom.jpg"><img alt="Mom" src="https://gwolf.org/files/2026-06/mom.400.jpg" /></a></p> <p><a href="https://gwolf.org/files/2026-06/announce.jpg"><img alt="Announce" src="https://gwolf.org/files/2026-06/announce.400.jpg" /></a></p> <p><a href="https://gwolf.org/files/2026-06/plotting.jpg"><img alt="Plotting" src="https://gwolf.org/files/2026-06/plotting.400.jpg" /></a></p> <p><a href="https://gwolf.org/files/2026-06/audience.jpg"><img alt="Audience" src="https://gwolf.org/files/2026-06/audience.400.jpg" /></a></p> <p><a href="https://gwolf.org/files/2026-06/wenceslao.jpg"><img alt="Wenceslao" src="https://gwolf.org/files/2026-06/wenceslao.400.jpg" /></a></p> <p><a href="https://gwolf.org/files/2026-06/attack.jpg"><img alt="Attack" src="https://gwolf.org/files/2026-06/attack.400.jpg" /></a></p> <p><a href="https://gwolf.org/files/2026-06/grumpy.jpg"><img alt="Grumpy" src="https://gwolf.org/files/2026-06/grumpy.400.jpg" /></a></p> <p><a href="https://gwolf.org/files/2026-06/ministers.jpg"><img alt="Ministers" src="https://gwolf.org/files/2026-06/ministers.400.jpg" /></a></p> <p><a href="https://gwolf.org/files/2026-06/council.jpg"><img alt="Council" src="https://gwolf.org/files/2026-06/council.400.jpg" /></a></p> <p><a href="https://gwolf.org/files/2026-06/message.jpg"><img alt="Message" src="https://gwolf.org/files/2026-06/message.400.jpg" /></a></p> <p><a href="https://gwolf.org/files/2026-06/russian.jpg"><img alt="Russian" src="https://gwolf.org/files/2026-06/russian.400.jpg" /></a></p> <p><a href="https://gwolf.org/files/2026-06/soldiers.jpg"><img alt="Soldiers" src="https://gwolf.org/files/2026-06/soldiers.400.jpg" /></a></p> <p><a href="https://gwolf.org/files/2026-06/all.jpg"><img alt="All" src="https://gwolf.org/files/2026-06/all.400.jpg" /></a></p> <p><a href="https://gwolf.org/files/2026-06/end.jpg"><img alt="End" src="https://gwolf.org/files/2026-06/end.400.jpg" /></a></p> 2026-06-13T19:55:32+00:00 Gunnar Wolf https://sunweavers.net/blog/node/157 <p>In the process of preparing a major Ubuntu Touch release (v24.04-2.0, coming soon...) we will also update Ayatana Indicators in Ubuntu Touch.</p> <p>Last week various new features have been added to some of the indicators (toggle switch to keep the display switched on permanently, blue tooth pairing agent, redesign of the keyboard indicator, etc.) and those changes require translation updates.</p> <p>If you can, please visit [1] this weekend and help translating Ayatana Indicators into your native language. Thanks so much!!!</p> <p>light+love<br /> Mike</p> <p>[1] <a href="https://hosted.weblate.org/projects/ayatana-indicators/" title="https://hosted.weblate.org/projects/ayatana-indicators/">https://hosted.weblate.org/projects/ayatana-indicators/</a></p> 2026-06-12T21:50:34+00:00 sunweaver https://retout.co.uk/2026/06/12/sel4-clock-magic/ <p>I have been looking at seL4 some more recently, and had <a href="https://github.com/seL4/seL4/commit/c1c9dd5bff69f5ea078d341a47555ad485808ab4">a small patch</a> merged today to remove a legacy Python module from a helper script. (I was trying to run the script on a system without that module installed, and it was almost easier to patch it out.)</p> <p>However, the more I think about this code and how it’s used, the more it seems wrong on at least five other levels.</p> <p>The patch itself is quite uninteresting; this script was importing the <code>past</code> module (part of <code>future</code>?) to use the <code>xrange</code> function. Python 2 used to have separate <code>xrange</code> and <code>range</code> functions, where <code>range</code> returned a list in memory while <code>xrange</code> generated an iterator. Because this seL4 script is iterating over a large range of values, it’s important the list is not generated in-memory. But Python 3 removed the <code>xrange</code> function and just has <code>range</code> return an object, so it’s trivial to avoid the module import.</p> <p>Having thought carefully some more about the specific line, there’s surely an off-by-one error in it - <code>range</code> iterates over 0 to n-1, so this line shouldn’t be subtracting one if it’s looking to test all 32-bit values:</p> <div class="code-block-wrapper"><div class="highlight"><pre tabindex="0"><code class="language-python"><span style="display: flex;"><span> <span style="color: #66d9ef;">for</span> i <span style="color: #f92672;">in</span> range(<span style="color: #ae81ff;">2</span><span style="color: #f92672;">**</span><span style="color: #ae81ff;">32</span><span style="color: #f92672;">-</span><span style="color: #ae81ff;">1</span>):</span></span></code></pre></div></div> <p>But then again, this is being used for a ‘sanity check’ of a magic bit shift algorithm that speeds up division operations to convert CPU ticks to microseconds on 32-bit arm platforms. Surely if the algorithm’s good, it shouldn’t be necessary to validate it exhaustively against every possible 32-bit value?</p> <p>Also, 32 bits isn’t enough, because this is 64-bit division. <code>include/api/types.h</code> shows that <code>ticks_t</code> is always a <code>uint64_t</code>, so if this were a proof by exhaustion it should run to 2**64 (though that would take infeasibly long).</p> <p>As discussed in <a href="https://github.com/seL4/seL4/issues/1352">issue #1352</a>, lots of people have been running this code with the wrong divisor anyway. But because the bit shift path is only used on 32-bit platforms, it’s not clear to me that there’s even any point in specifying CLK_SHIFT/MAGIC on platforms which are 64-bit only (e.g. the tx2 port).</p> <p>And to follow this rabbit hole to the very end, in comments on <a href="https://github.com/seL4/seL4/pull/1435#issuecomment-2813656622">PR #1435</a> and <a href="https://github.com/seL4/seL4/issues/1509">issue #1509</a> it’s clear that the future of this code is to remove it, as it’s 1. unnecessarily clever (on 64-bit platforms the equivalent code just uses a division, so performance can’t be that important), and 2. the entire concept of converting to microseconds breaks the seL4 principle of not abstracting away details of the hardware.</p> <p>So this has left me unclear on whether my small patch was a good thing or not, but I certainly learnt something about this corner of seL4 timer handling. And I’ve ordered a copy of “Hacker’s Delight” on the recommendation of a code comment.</p> 2026-06-12T16:45:40+00:00 Tim Retout https://sunweavers.net/blog/node/156 <p>Some of you might have noticed that the recent (or rather: previous) version of libayatana-appindicator (v0.5.94) notified users and developers of the library being deprecated.</p> <p>This short post is to notify you, that with today's libayatana-appindicator v0.6.0 release [1] this deprecation warning has now been removed again. Another new feature (added to AppIndicator without ABI breakage) is tooltip support. The new package version has just been uploaded to Debian experimental. Please test if your application (if it gets linked against libayatana-appindicator) continues to work flawlessly. Thanks!</p> <p>libayatana-appindicator will receive continued support until GTK-3 becomes end-of-life (because libayatana-appindicator has a baked-in GTK-3 dependency which should not be ported to GTK-4 imho). That said, in the future, GTK-3 applications can continue using libayatana-appindicator for sending AppIndicator-like icons and menus over DBus to KStatusNotifierItem-based system tray renderers.</p> <p>If you are looking for an AppIndicator implementation for GTK-4 applications (or other), I'd like to encourage you to help making libayatana-appindicator-glib [2] a new standard (can be used in GTK and Qt applications alike, implementation is using pure Glib-2.0). Currently, there is only one renderer (ayatana-indicator-application), so more work needs to be done on the renderers' side. (One of the next work items here is to get AppIndicator-Glib support working in Lomiri's desktop/windowed mode).</p> <p>[1] <a href="https://github.com/AyatanaIndicators/libayatana-appindicator/releases/tag/0.6.0" title="https://github.com/AyatanaIndicators/libayatana-appindicator/releases/tag/0.6.0">https://github.com/AyatanaIndicators/libayatana-appindicator/releases/ta...</a><br /> [2] <a href="https://github.com/AyatanaIndicators/libayatana-appindicator-glib/" title="https://github.com/AyatanaIndicators/libayatana-appindicator-glib/">https://github.com/AyatanaIndicators/libayatana-appindicator-glib/</a></p> 2026-06-10T20:15:00+00:00 sunweaver https://www.chiark.greenend.org.uk/~cjwatson/blog/activity-2026-05.html <p>My Debian contributions this month were all <a href="https://www.freexian.com/about/debian-contributions/">sponsored</a> by Freexian.</p> <p>You can also support my work directly via <a href="https://liberapay.com/cjwatson">Liberapay</a> or <a href="https://github.com/sponsors/cjwatson">GitHub Sponsors</a>.</p> <h2>OpenSSH</h2> <p>I backported various security fixes from 10.3 to <a href="https://bugs.debian.org/1135624">trixie</a>, <a href="https://bugs.debian.org/1135658">bookworm</a>, <a href="https://lists.debian.org/debian-lts-announce/2026/05/msg00030.html">bullseye</a>, <a href="https://www.freexian.com/lts/extended/updates/ela-1720-1-openssh/">buster</a>, and <a href="https://www.freexian.com/lts/extended/updates/ela-1721-1-openssh/">stretch</a>. For trixie, I also backported several IPQoS fixes to line up with upstream’s traffic management settings and drop a rather hacky Debian-specific patch; this needed a <a href="https://bugs.debian.org/1135798">quick follow-up fix</a>.</p> <p>I upgraded trixie-backports to 10.3.</p> <p>I fixed <a href="https://bugs.debian.org/1136545">openssh uses pidof but does not depend on procps</a>.</p> <h2>PuTTY</h2> <p>I upgraded from 0.83 to 0.84.</p> <h2>Python packaging</h2> <p>New upstream versions:</p> <ul> <li>bitstruct</li> <li>ormar</li> <li>pdm (fixing a <a href="https://bugs.debian.org/1134304">build failure</a>)</li> <li>pydantic</li> <li>pydantic-core</li> <li>pydantic-settings</li> <li>pyglet (fixing a <a href="https://bugs.debian.org/1137404">build failure</a>)</li> <li>python-asyncssh</li> <li>python-bitarray</li> <li>python-btrees</li> <li>python-build</li> <li>python-certifi</li> <li>python-charset-normalizer (fixing a <a href="https://bugs.debian.org/1135452">build failure</a>)</li> <li>python-fakeredis (<a href="https://github.com/cunla/fakeredis-py/pull/485">contributed supporting fix upstream</a>)</li> <li>python-holidays</li> <li>python-jsonschema-path</li> <li>python-memray (fixing a <a href="https://bugs.debian.org/1135455">build failure</a> and <a href="https://bugs.debian.org/1131372"><span class="caps">CVE</span>-2026-32722</a>)</li> <li>python-openapi-schema-validator</li> <li>python-pathable</li> <li>python-persistent</li> <li>python-pyftpdlib</li> <li>python-pytest-run-parallel</li> <li>sorl-thumbnail</li> <li>twisted</li> <li>zope.interface</li> <li>zope.proxy</li> </ul> <p>Other build/test failures:</p> <ul> <li><a href="https://bugs.debian.org/1137485">beets</a></li> <li><a href="https://bugs.debian.org/1135497">buildbot</a> (<a href="https://github.com/buildbot/buildbot/pull/9051">contributed upstream</a>)</li> <li><a href="https://bugs.debian.org/1131097">dep-logic</a> (<a href="https://github.com/pdm-project/dep-logic/pull/17">contributed upstream</a>)</li> <li><a href="https://bugs.debian.org/1135392">diskcache</a></li> <li><a href="https://bugs.debian.org/1135500">khard</a></li> <li><a href="https://bugs.debian.org/1137583">matplotlib</a></li> <li><a href="https://bugs.debian.org/1137488">mkdocs-rss-plugin</a></li> <li>ormar: compatibility with <a href="https://bugs.debian.org/1133964">fastapi 0.125</a> and <a href="https://bugs.debian.org/1136865">pydantic 2.13</a></li> <li><a href="https://bugs.debian.org/1135445">pgzero</a></li> <li><a href="https://bugs.debian.org/1137501">py7zr</a></li> <li><a href="https://salsa.debian.org/python-team/packages/pydantic-extra-types/-/commit/858c65cb47b4fe03b080f79c99fa785282fd740c">pydantic-extra-types</a> (<a href="https://github.com/pydantic/pydantic-extra-types/pull/394">contributed upstream</a>)</li> <li><a href="https://bugs.debian.org/1136922">pydata-sphinx-theme</a></li> <li><a href="https://bugs.debian.org/1135454">python-invocations</a> (<a href="https://github.com/pyinvoke/invocations/pull/47">contributed upstream</a>)</li> <li><a href="https://bugs.debian.org/1134305">python-localzone</a></li> <li><a href="https://bugs.debian.org/1135831">python-maturin</a></li> <li><a href="https://bugs.debian.org/1135447">python-nacl</a></li> <li><a href="https://bugs.debian.org/1123283">python-pampy</a></li> <li><a href="https://bugs.debian.org/1135507">python-treq</a> (<a href="https://github.com/twisted/treq/pull/426">contributed upstream</a>, including <a href="https://github.com/twisted/treq/pull/428">fixing some <span class="caps">CI</span> bitrot</a>)</li> <li><a href="https://bugs.debian.org/1122914">python-txrequests</a> (<a href="https://github.com/tardyp/txrequests/pull/11">contributed upstream</a>)</li> </ul> <p>Other bugs:</p> <ul> <li><a href="https://bugs.debian.org/1083325">buildbot: (Build-)depends on deprecated module python3-pkg-resources</a> (<a href="https://github.com/buildbot/buildbot/pull/9048">contributed upstream</a>)</li> <li><a href="https://bugs.debian.org/1135182">pysodium: Depends on cruft package libsodium</a></li> <li><a href="https://bugs.debian.org/1106749">python-fakeredis: lua support not working, breaking django-redis cache locking</a></li> <li><a href="https://salsa.debian.org/cpython-team/python3/-/merge_requests/43">python3.14: Drop libnsl-dev build-dependency</a></li> </ul> <p>I updated python-treq upstream to <a href="https://github.com/twisted/treq/pull/430">stop vendoring multipart</a>, now that the packaging issues with that have been sorted out.</p> <h2>Code reviews</h2> <ul> <li><a href="https://bugs.debian.org/1135891">debmirror: User-Agent blocked by Ubuntu/Launchpad repositories</a> (uploaded, and <a href="https://bugs.debian.org/1135937">cherry-picked into trixie</a>)</li> <li><a href="https://salsa.debian.org/python-team/packages/pydantic/-/merge_requests/1">pydantic: Fix <span class="caps">CVE</span>-2024-3772 in bookworm</a> (merged and uploaded)</li> <li><a href="https://salsa.debian.org/python-team/packages/pyodbc/-/merge_requests/3">pyodbc: Run SQLite tests</a> (merged and uploaded)</li> <li><a href="https://salsa.debian.org/python-team/packages/python-jsonschema-path/-/merge_requests/1">python-jsonschema-path: Transition to starlette 1.0</a> (merged and uploaded)</li> <li><a href="https://bugs.debian.org/1131976">python-maison: <span class="caps">FTBFS</span> with the nocheck build profile</a> (followed up to fix the <code>nodoc</code> build profile as well)</li> <li><a href="https://salsa.debian.org/python-team/packages/python-openapi-core/-/merge_requests/1">python-openapi-core: Transition to starlette 1.0</a></li> <li><a href="https://salsa.debian.org/python-team/packages/python-openapi-schema-validator/-/merge_requests/1">python-openapi-schema-validator: Transition to starlette 1.0</a> (merged and uploaded)</li> <li><a href="https://salsa.debian.org/python-team/packages/python-openapi-spec-validator/-/merge_requests/1">python-openapi-spec-validator: Transition to starlette 1.0</a> (merged and uploaded)</li> <li><a href="https://salsa.debian.org/python-team/packages/python-pathable/-/merge_requests/1">python-pathable: Transition to starlette 1.0</a> (merged and uploaded)</li> <li><a href="https://salsa.debian.org/python-team/packages/python-rich-argparse/-/merge_requests/3">python-rich-argparse: New upstream version 1.8.0</a> (merged and uploaded)</li> </ul> <h2>Other bits and pieces</h2> <p>I contributed a debian-policy patch to <a href="https://bugs.debian.org/1138005">fix several links related to build profiles</a>.</p> 2026-06-10T15:10:16+00:00 Colin Watson https://vincent.bernat.ch/en/blog/2026-blogging-llm <p><abbr title="Artificial Intelligence">AI</abbr> slop is invading the web. A recent story about <a href="https://lobste.rs/s/29pm2f/llm_generated_submissions_should_be" title="LLM generated submissions should be disallowed">disallowing <abbr title="Large Language Model">LLM</abbr>-generated submissions</a> on <a href="https://lobste.rs/" title="Lobsters">Lobsters</a> triggered a lot of debate. My personal worst offenders are <a href="https://www.linkedin.com/">LinkedIn</a> articles with <abbr title="Artificial Intelligence">AI</abbr>-generated images and uninspired articles filled with emojis from people trying to masquerade as experts on a subject they don’t care enough to write themselves. While I am unhappy about this situation, I rely on <abbr title="Large Language Models">LLMs</abbr> for <strong>grammar</strong>, <strong>copyediting</strong>, and <strong>translation</strong>. I don’t see this as a contradiction.</p> <p>I am a native French speaker, but I blog in both English and French. When I started writing this blog in 2011, I was composing in <a href="https://vincent.bernat.ch/fr/blog/2011-migration-vers-github" title="Migration de Trac vers GitHub">French</a> and translating to <a href="https://vincent.bernat.ch/en/blog/2011-migrating-to-github" title="Migrating from Trac to GitHub">English</a>, but I found it was <a href="https://sci-hub.fr/10.1016/j.jslw.2009.06.003" title="L1 use during L2 writing: An empirical study of a complex phenomenon">better to work in the reverse order</a> to avoid unnatural and non-idiomatic constructions. One of my goals is to write “goodâ€� English but I never felt it was my strong point.<sup id="fnref-book"><a class="footnote-ref" href="https://vincent.bernat.ch#fn-book">1</a></sup> For example, verb tenses are often an issue, even if I mostly stick with the present tense. I learn the rules and forget them right away. I also don’t feel like <a href="https://mtlynch.io/editor/" title="How I Hired a Freelance Editor for My Blog">hiring an editor</a> for something I see as a hobby.</p> <p>As an example, I have kept the history of the successive iterations when writing “<a href="https://vincent.bernat.ch/en/blog/2026-akvorado-rib-sharding" title="Scaling Akvorado BMP RIB with sharding">Scaling Akvorado BMP RIB with sharding</a>â€�:</p> <ol> <li>the <a href="https://github.com/vincentbernat/vincent.bernat.ch/commit/aad263c20c7b021b1069952d1487374ff559d3b3" title="article: Akvorado BMP RIB with sharding">first draft</a>, authored with the help of a thesaurus,<sup id="fnref-kagi"><a class="footnote-ref" href="https://vincent.bernat.ch#fn-kagi">2</a></sup></li> <li>the <a href="https://github.com/vincentbernat/vincent.bernat.ch/commit/11231af4be15160c1dd48e45c9b4dc7c042cf191" title="content: copyediting of Akvorado BMP RIB article">edited copy</a> revised by the <a href="https://github.com/vincentbernat/vincent.bernat.ch/blob/latest/.claude/skills/edit/SKILL.md">copyediting skill</a>,</li> <li>the <a href="https://github.com/vincentbernat/vincent.bernat.ch/commit/0435ae3a8450132abb89507e856a012831457e49" title="article: Akvorado BMP RIB in French">translation to French</a> generated with the <a href="https://github.com/vincentbernat/vincent.bernat.ch/blob/latest/.claude/skills/translate/SKILL.md">translation skill</a>, and</li> <li>the <a href="https://github.com/vincentbernat/vincent.bernat.ch/commit/c0629b1d9fe450335fcd30c071fb44301615dd15" title="content: human proofread of the French translation">human proofread of the French translation</a>, with minor edits to the English version.</li> </ol> <p>I know that <abbr title="Large Language Models">LLMs</abbr> may <a href="https://sites.google.com/view/llmwritingdistortion/home" title="How LLMs Distort Our Written Language">alter the author’s voice when editing</a>, but the corrections in the second step are minor. The prompt asks to “apply light stylistic edits,â€� with some guidance around avoiding passive voice, long sentences, bland verbs, and filler words. It also defines the target audience: technical with a B2 level in English.</p> <p>In the following excerpt, I used “long timeâ€� instead of “long-standing.â€� The former is missing a hyphen and applies to people—a <a href="https://dictionary.cambridge.org/us/dictionary/english/long-time" title="Definition of long-time in the Cambridge Dictionary">long-time</a> friend, while the later relates to a situation—a <a href="https://dictionary.cambridge.org/us/dictionary/english/long-standing" title="Definition of long-standing in the Cambridge Dictionary">long-standing</a> agreement. I had a hard time understanding the reason of the second change: the <abbr title="Large Language Model">LLM</abbr> prefers a <a href="https://dictionary.cambridge.org/us/grammar/british-grammar/relative-clauses-defining-and-non-defining" title="Relative clauses: defining and non-defining">defining relative clause</a> to provide the definition of “RIB sharding.â€�</p> <blockquote> <p>As the Internet routing table contains more than 1 million routes, Akvorado needs to scale to tens of millions of routes. This has been a <del>long time</del> <ins>long-standing</ins> challenge, but I expect this issue is now fixed by using RIB sharding, a method <del>to split</del> <ins>that splits</ins> the routing database into several parts to enable concurrent updates.</p> </blockquote> <p>In the next modification, the <abbr title="Large Language Model">LLM</abbr> puts “deviceâ€� instead of “equipment.â€� This is correct as “<a href="https://dictionary.cambridge.org/us/dictionary/english/equipment" title="Definition of equipment in the Cambridge Dictionary">equipment</a>â€� is an uncountable noun. I know that, but I still fall into this trap.</p> <blockquote> <p>When Akvorado does not find a route from a specific device, it falls back to a route sent by another <del>equipment</del> <ins>device</ins>.</p> </blockquote> <p>I ask the <abbr title="Large Language Model">LLM</abbr> to use “descriptive verbsâ€� and it complies by replacing a multi-word predicate with a lexically rich verb:</p> <blockquote> <p>The benchmarks demonstrate it <del>has better performance than</del> <ins>outperforms</ins> other <del>packages, both</del> <ins>packages</ins> for lookups, insertions, and memory usage.</p> </blockquote> <p>It also fixes grammar errors. In the next excerpt, a “list of routesâ€� is a singular expression. Moreover, “storedâ€� is a state and I should not use “intoâ€� as it expresses a change.</p> <blockquote> <p>The list of routes for each prefix <del>are</del> <ins>is</ins> not stored directly <del>into</del> <ins>in</ins> the prefix tree.</p> </blockquote> <p>As a last example, consider the following snippet. The “<a href="https://dictionary.cambridge.org/dictionary/english/require" title="Definition of require in the Cambridge Dictionary">require</a>â€� verb accepts a noun or an object followed by a to-infinitive. I can’t use it with just a to-infinitive.</p> <blockquote> <p>An alternative would be to have one prefix tree for each peer but it would require <del>to configure</del> <ins>configuring</ins> all routers to export their routes.</p> </blockquote> <p>As someone who didn’t grow up speaking English, I struggle with these grammar rules despite reading a lot of English material.<sup id="fnref-monkey2"><a class="footnote-ref" href="https://vincent.bernat.ch#fn-monkey2">3</a></sup> French is more complex to get started but more systematic. English is full of irregularities.</p> <hr /> <p>On each page, I disclose in the footer whether an <abbr title="Artificial Intelligence">AI</abbr> modified the content. There are three levels:</p> <ul> <li>🧠: no <abbr title="Artificial Intelligence">AI</abbr> or almost no <abbr title="Artificial Intelligence">AI</abbr> (e.g., grammar corrections)</li> <li>✨: enhanced (e.g., copyediting)</li> <li>🤖: generated (e.g., translated from another language, even if human-edited)</li> </ul> <p>Hover or tap the icon to reveal the <abbr title="Artificial Intelligence">AI</abbr>’s name and its role in the document.</p> <figure><div class="lf-media-outer" style="width: 264px;"><span class="lf-media-inner"><img alt="Screenshot of the footer containing the &quot;sparkles&quot; emoji" class="lf-media lf-opaque" height="121" src="https://d2pzklc15kok91.cloudfront.net/images/ai-usage@1x.03aee3edade4f4.jpg" width="264" /></span></div><figcaption>Example of AI usage disclosure: Claude Sonnet 4.5 edited this article.</figcaption></figure> <p>The graph below shows which tool altered each post, year by year. Recently, I applied the <a href="https://github.com/vincentbernat/vincent.bernat.ch/blob/latest/.claude/skills/grammar/SKILL.md">grammar skill</a> to <a href="https://github.com/vincentbernat/vincent.bernat.ch/commit/7baf2c8f18b57e351cc25e7e62f4aa6611362c8c" title="content: fix English grammar">past articles</a>. Since 2018, French articles have been translated with the help of <a href="https://www.deepl.com">DeepL</a> first, then of an <abbr title="Large Language Model">LLM</abbr>. Since 2024, English articles are copyedited.</p> <figure><div class="lf-media-outer" style="width: 733px;"><span class="lf-media-inner">&amp;#128444; Graph showing the AI usage over the years. Each level get its own color.</span></div><figcaption>AI usage over the years. Hover or tap a band for the details.</figcaption></figure> <hr /> <p>If you are strongly against any usage of <abbr title="Large Language Models">LLMs</abbr> specifically for writing, I hope you accept my more nuanced position on the usage of these tools as a trade-off to provide clearer and more engaging articles. Years of literature on improving English told us it is important to choose the right word to keep the reader engaged.</p> <blockquote> <p>[…] Good writing consists of mastering the fundamentals (vocabulary, grammar, the elements of style) and then filling the third level of your toolbox with the right instruments.</p> <p>― <em>Stephen King</em>, On Writing</p> </blockquote> <div class="admonition"> <p class="admonition-title">Note</p> <p>Unlike other recent articles, I did not use an <abbr title="Large Language Model">LLM</abbr> to edit this post: an unnamed person kindly accepted to proofread it. I translated it to French without using an <abbr title="Large Language Model">LLM</abbr> either.</p> </div> <div class="admonition"> <p class="admonition-title">Update (2026-06)</p> <p>See the <a href="https://lobste.rs/s/tdvu7a/blogging_with_llm_assistant">story associated to this post on Lobsters</a>, as well as the article “<a href="https://writethatblog.substack.com/p/dev-reaction-to-ai-blog-posts" title="Report: How developers react to AI-scented blog posts">How developers react to <abbr title="Artificial Intelligence">AI</abbr>-scented blog posts</a>â€� by Cynthia Dunlop, one of the coauthor of “<a href="https://www.manning.com/books/writing-for-developers" title="“Writing for Developersâ€� by Piotr Sarna and Cynthia Dunlop">Writing for Developers</a>.â€�</p> </div> <div class="footnote"> <hr /> <ol> <li id="fn-book"> <p>I recently read cover to cover “<a href="https://www.manning.com/books/writing-for-developers" title="“Writing for Developersâ€� by Piotr Sarna and Cynthia Dunlop">Writing for Developers</a>â€� and I found it stimulating. <a href="https://mtlynch.io/about/">Michael Lynch</a> is currently writing “<a href="https://refactoringenglish.com/" title="“Refactoring English: Effective Writing for Software Developersâ€� by Michael Lynch">Refactoring English</a>â€� on the same topic and I have subscribed to the early access. <a class="footnote-backref" href="https://vincent.bernat.ch#fnref-book" title="Jump back to footnote 1 in the text">↩</a></p> </li> <li id="fn-kagi"> <p>I am quite happy with the writing tools provided by <a href="https://www.kagi.com">Kagi</a>. Both the <a href="https://translate.kagi.com">translate tool</a> and the <a href="https://translate.kagi.com/dictionary">dictionary</a> are a valuable help to find different wordings. I also lean on <a href="https://help.kagi.com/kagi/ai/kagi-research.html" title="Kagi Research Assistants">Kagi’s research assistant</a> when researching a topic. <a class="footnote-backref" href="https://vincent.bernat.ch#fnref-kagi" title="Jump back to footnote 2 in the text">↩</a></p> </li> <li id="fn-monkey2"> <p>When I was ten, I played <em>Monkey Island 2</em> in English without having taken any classes. I used a dictionary to translate word by word and I found the irregular verbs confusing—and not in the dictionary. <a class="footnote-backref" href="https://vincent.bernat.ch#fnref-monkey2" title="Jump back to footnote 3 in the text">↩</a></p> </li> </ol> </div> 2026-06-09T20:15:13+00:00 Vincent Bernat https://sunweavers.net/blog/node/155 <h3>Official announcement</h3> <p><em>European Voxit community strengthens digital sovereignty: shared codebase completed.</em></p> <p>Read the official announcement at:<br /> <a href="https://www.voxit.org/european-voxit-community-strengthens-digital-sovereignty-shared-codebase-completed/" title="https://www.voxit.org/european-voxit-community-strengthens-digital-sovereignty-shared-codebase-completed/">https://www.voxit.org/european-voxit-community-strengthens-digital-sover...</a></p> <h3>The Voxit community and platform development</h3> <p>The Voxit participation platform is originally based on the open source Polis platform developed by The Computational Democracy Project in the United States, but since its establishment in autumn 2025, the European Voxit community has been developing an independent solution, adapted to European needs.</p> <p>The aim is to create an open source, interoperable and scalable participation infrastructure suited to Europe’s regulatory environment and aligned with democratic values. Through this development work, Voxit is becoming a clearly distinct fork of the original Polis platform – allowing Europe to develop participatory infrastructure at its own pace and according to its own governance needs, while the original Polis project continues to break new ground. This enables Europe to build its own open and trustworthy digital democracy tools, rooted in public governance and European democratic traditions.</p> <h3>Voxit 1.0 source code is now available</h3> <p>The source code for version 1.0 of the European community edition of the Voxit platform has now been published and is openly maintained on GitLab.com at: <a href="https://gitlab.com/voxit/voxit" title="https://gitlab.com/voxit/voxit#">https://gitlab.com/voxit/voxit#</a></p> 2026-06-09T09:45:00+00:00 sunweaver https://anarc.at/blog/2026-05-16-four-horsemen/ <p>I have been battling Large Language Models (LLM<sup id="fnref:1"><a href="https://anarc.at/tag/debian-planet/#fn:1" rel="footnote">1</a></sup>) for the past couple of weeks and have struggled to think about what it means and how to deal with its fallout.</p> <p>Because the fight has come from many fronts, I've come to articulate this in terms of the <a href="https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Apocalypse">Four Horsemen of the Apocalypse</a>.</p> <blockquote><p>Sound track: Metallica's <a href="https://www.metallica.com/songs/the-four-horsemen.html">The Four Horsemen</a>, preferably <a href="https://en.wikipedia.org/wiki/Metallica_v._Napster,_Inc.">downloaded from Napster around 2000</a>, but now I guess you <a href="https://www.youtube.com/watch?v=-zKOhVSERS8">get it on YouTube</a>.</p></blockquote> <h1 id="war-bot-armies">War: bot armies</h1> <p>Let's start with War. We've been battling bot armies for control of our GitLab server <a href="https://gitlab.torproject.org/tpo/tpa/team/-/work_items/42152">for a while</a>. Bots crawl virtually infinite endpoints on our Git repositories (as opposed to downloading an archive or shallow clone), including our fork of Firefox, Tor Browser, a massive repository.</p> <p>At first, we've tried various methods: <a href="https://www.robotstxt.org/">robots.txt</a>, blocking user agents, and finally blocking entire networks. I <a href="https://anarc.at/blog/2025-05-30-asncounter/">wrote asncounter</a>. It worked for a while.</p> <p>But now, blocking entire networks doesn't work: they come back some other way, typically through <a href="https://acid.vegas/blog/the-shady-world-of-ip-leasing/">shady proxy networks</a>, which is kind of ironic considering we're essentially running the largest proxy network of the world.</p> <p>Out of desperation, we've forced users to <a href="https://gitlab.torproject.org/tpo/tpa/team/-/wikis/policy/0108-gitlab-cookie-and-javascript-enforcement">use cookies</a> when visiting our site. We haven't deployed <a href="https://anubis.techaro.lol/">Anubis</a> yet, as we worry that <a href="https://social.anoxinon.de/@Codeberg/115033790447125787">bots have broken Anubis anyways</a> and that it <a href="https://lock.cmpxchg8b.com/anubis.html">does not really defend against a well-funded attacker</a>, something which <a href="https://behind.pretix.eu/2025/05/23/captchas-are-over/">Pretix warned against in 2025 already</a>.</p> <p>(We have a whole <a href="https://gitlab.torproject.org/tpo/tpa/team/-/work_items/42229">discussion regarding those tools here</a>.)</p> <p>But even that, predictably, has failed. I suspect what we consider bots are now really agents. They run full web browsers, JavaScript included, so a feeble cookie is no match for the massive bot armies.</p> <h2 id="side-note-on-llm-order-of-battle">Side note on LLM "order of battle"</h2> <p>We often underestimate the size of that army. The cloud was huge even before LLMs, serving about two thirds of the web. Even larger swaths of clients like government and corporate databases have all moved to the cloud, in shared, but private infrastructure with massive spare capacity that is readily available to anyone who pays.</p> <p>LLMs have made the problem worse by dramatically expanding the capacity of the "cloud". We now have data centers that defy imagination with <a href="https://epoch.ai/data/data-centers">millions of cores</a>, petabytes of memory, exabytes of storage.</p> <p>I thought that <a href="https://sschueller.github.io/posts/the-free-market-lie/">25 gigabit residential internet in Switzerland</a> could bring balance, but this is nothing compared to the scale of those data centers.</p> <p>Those companies can launch thousands, if not millions of fully functional web browsers at our servers. Computing power or bandwidth are not a limitation for them, our primitive infrastructure is. No one but hyperscalers can deal with this kind of load, and I suspect that they are also struggling, as even <a href="https://www.androidauthority.com/google-recaptcha-play-services-requirement-3664806/">Google is deploying extreme mechanisms in reCAPTCHA</a>.</p> <p>This is the largest attack on the internet since the <a href="https://en.wikipedia.org/wiki/Morris_worm">Morris worm</a> but while <a href="https://en.wikipedia.org/wiki/Robert_Tappan_Morris">Robert Tappan Morris</a> went to jail on a felony, LLM companies are celebrated as innovators and will soon be too big to fail.<sup id="fnref:2"><a href="https://anarc.at/tag/debian-planet/#fn:2" rel="footnote">2</a></sup></p> <p>Which brings us to the second horsemen, famine.</p> <h1 id="famine-shortages">Famine: shortages</h1> <p>All that computing power doesn't come out of thin air: it needs massive amounts of hardware, power, and cooling.</p> <p>Earlier this year, I've heard from a colleague that their Dell supplier refused to even provide a <em>quote</em> before August. Dell!</p> <p>In February, <a href="https://www.techspot.com/news/111346-western-digital-hdd-production-capacity-2026-already-sold.html">Western Digital's hard drive production for 2026 was already sold out</a>. Hard drives essentially <a href="https://gitlab.torproject.org/tpo/tpa/team/-/work_items/42465">doubled in price within a year</a>, and some have now tripled. A server quote we had in November has now <em>quadrupled</em>, going from 10 thousand to <em>FORTY</em> thousand dollars for a single server.</p> <p>But regular folks are facing real-life shortages as well, as <a href="https://www.theguardian.com/us-news/2026/may/13/utah-approves-datacenter-backlash">city-size data centers</a> are being built at neck-breaking speed, stealing fresh water and energy from human beings to feed the war machine.</p> <p>We've been scared of losing our jobs, but it seems that Apocalypse has yet to fully materialize. Regardless for engineers, the market feels tighter than it was a couple years ago, and everyone feels on edge that they will just have to learn to operate LLMs to keep their jobs.</p> <p>Update: it turns out I was clearly too optimistic. Cisco is laying off 4,000 or 5% of its staff in a <a href="https://blogs.cisco.com/news/our-path-forward">jolly announcement celebrating a record $15.8 billion revenue</a>, and Meta will <a href="https://www.nytimes.com/2026/04/23/technology/meta-layoffs.html">lay off 8,000 or 10% of its workforce</a>, in <a href="https://sfstandard.com/pacific-standard-time/2026/05/15/meta-employee-gets-real-horror-working-right-now/">horrifying conditions</a>. See also the <a href="https://jobloss.ai/">jobloss.ai tracker</a> which counts 125,000 jobs lost since January 2025, as of May 2026.</p> <p>Which brings us, of course, to Death.</p> <h1 id="death-security-and-copyright">Death: security and copyright</h1> <p>Our third horseman is one I did <em>not</em> expect a couple of months ago. Back at FOSDEM, <code>curl</code>'s maintainer Daniel Stenberg famously <a href="https://lwn.net/Articles/1058266/">complained about the poor quality of LLM-generated reports</a> but then, a few months later, everyone is <a href="https://lwn.net/Articles/1066581/">scrambling to deal with floods of good reports</a>.</p> <p>In the past two weeks, this culminated in a significant number of critical security issues across multiple projects. Chained together, remote code execution vulnerabilities in <a href="https://depthfirst.com/nginx-rift">Nginx</a> and <a href="https://www.cve.org/CVERecord?id=CVE-2026-23918">Apache</a> and <em>two</em> local privilege escalations in the Linux kernel (<a href="https://github.com/V4bel/dirtyfrag/">dirtyfrag</a> and <a href="https://github.com/v12-security/pocs/tree/main/fragnesia#fragnesia">fragnesia</a>) essentially gave anyone root access to any unpatched server to the web.</p> <p>As I write this, <a href="https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn">another vulnerability dropped</a>, which gives read access to any file to a local user, compromising TLS and SSH private keys.</p> <p>All those vulnerabilities were released without any significant coordination while people scrambled to mitigate.</p> <p>Many people <a href="https://lwn.net/Articles/1072007/#Comments">including Linus Torvalds</a> are now considering issues discovered through LLMs to be essentially public. This puts <a href="https://lwn.net/Articles/1071499/">some debates about disclosure processes</a> in perspective, to say the least.</p> <p>But this is not merely the death of the traditional coordinated disclosure process, the C programming language, or the Linux kernel: remember that those bots are trained on a large corpus of copyrighted material. Facebook has <a href="https://www.theguardian.com/technology/2025/jan/10/mark-zuckerberg-meta-books-ai-models-sarah-silverman">trained their models on pirated books</a> and <a href="https://torrentfreak.com/nvidia-contacted-annas-archive-to-secure-access-to-millions-of-pirated-books/">Nvidia has done deals with Anna's Archive</a> to secure access to large swaths of copyrighted material. The <a href="https://www.congress.gov/crs-product/LSB10922">US Congress seems to think LLM outputs are not copyrightable</a>, like any other machine outputs.</p> <p>With many people now vibe coding their way out of learning or remembering how computers work, is this the Death of Copyright?</p> <p>And that, of course, brings us to the final horseman: Pestilence.</p> <h1 id="pestilence-slop">Pestilence: slop</h1> <p>There is a growing meme that programming is essentially over as we know it. That you can simply vibe-code applications from scratch and it's pretty good.</p> <p>Maybe that's true.</p> <p>So far, most of my attempts at resolving any complex problem with a LLM have often failed with bizarre failures. <a href="https://gitlab.com/anarcat/scripts/-/blob/main/transmodify.py?ref_type=heads">Some worked surprisingly well.</a> Maybe, of course, I am holding it wrong.</p> <p>I personally don't believe LLMs will ever be good enough to produce and maintain software at scale. They're surprisingly good at finding security flaws right now. But what I see is also a lot of <a href="https://en.wikipedia.org/wiki/Bullshit">Bullshit</a>, with a capital B. It's not lying: it does not "know" anything, so it <em>can't</em> lie. It's misleadingly cohesive and deliberate, but it lacks meaning, intent, will.</p> <p>I have not been confronted with much slop, apart from the lobster Jesus or the yellow man atrocities, and particularly not in my work. But I see what it is doing to my profession: beyond <a href="https://en.wikipedia.org/wiki/Vibe_coding">vibe-coding</a>, people are now <a href="https://www.forbes.com/sites/timkeary/2026/04/13/is-the-cult-of-tokenmaxxingjust-another-fad-or-the-new-normal/">token-maxxing</a>, and <a href="https://leehanchung.github.io/blogs/2026/04/05/the-ai-great-leap-forward/#let-a-hundred-skills-bloom">land-grabbing their colleagues</a>.</p> <p>I don't like what LLMs do to our communities, or the fabric of software we live with.</p> <p>Software does not evolve in a void. It is a team effort, be it free software or a corporate product. Generations of humans have carefully built the scaffolding of technology required for modern networks and software to operate, in a convoluted contraption that no single human fully understands anymore.</p> <p>The idea of simply giving up on that understanding entirely and delegating it to an unproven model is not only chilling, it feels just plain stupid. Not stupid as in <a href="https://en.wikipedia.org/wiki/Skynet_(Terminator)">Skynet</a>, stupid as in "I can't get inside the data center because the authentication system is down". Except we're in a "the power plant doesn't reboot" or "their LLM found an 0day in our slop" kind of stupid.</p> <h1 id="the-fifth-horsemen">The fifth horsemen</h1> <p>Researching for this article, I looked up the four horsemen and found out they original seems to have been:</p> <ul> <li>Famine</li> <li>War</li> <li>Death</li> <li>Conquest (??)</li> </ul> <p>I was surprised. I grew up thinking about the horsemen being Famine, War, Pestilence, and Death. So I went back to <a href="https://www.metallica.com/songs/the-four-horsemen.html">my original source</a> which actually claims the horsemen are:</p> <pre><code>Time has taken its toll on you, the lines that crack your face. Famine, your body, it has torn through, withered in every place. Pestilence for what you've had to endure, and what you have put others through Death, deliverance for you, for sure, now there's nothing you can do </code></pre> <p>So I guess that makes no sense either, which, fair enough, I shouldn't rely on Metallica for theological references. Especially since that song was originally called <a href="https://en.wikipedia.org/wiki/Mechanix">Mechanix</a> and was "about having sex at a gas station".</p> <p>Anyways.</p> <p>The point is, there are actually five horsemen, and the fifth one is, in my opinion, Conquest.</p> <p>Those companies (and <em>not</em> "AI", mind you) are taking over the world. I sense a strong connection with the "post-truth" world imposed on us by fascists like Trump and Putin. It's not an accident, it's a power grab part of the <a href="https://en.wikipedia.org/wiki/The_Californian_Ideology">Californian Ideology</a><sup id="fnref:3"><a href="https://anarc.at/tag/debian-planet/#fn:3" rel="footnote">3</a></sup>. Just like Airbnb broke housing, Uber destroyed the transportation and Amazon is taking over retail and server hosting, LLM companies are essentially trying to take over if not everything, at least <a href="https://en.wikipedia.org/wiki/Cognition">Cognition</a> as a whole.</p> <p>But the capitalization of those companies (OpenAI and Nvidia in particular) are so far beyond reason that their inevitable collapse will likely lead to a global financial collapse of biblical proportions.</p> <p>Because they will inevitably fail like previous bubbles they are built on. And when they fail, I hope it zips all the way back through the blockchain scam, the ad surveillance system, and the dot com then git me back my internet.</p> <h1 id="the-tower-of-babel">The Tower of Babel</h1> <p>While I'm off in the woods hallucinating (ha!) on biblical allegories, I feel there's another sign that the apocalypse is coming.</p> <p>The <a href="https://en.wikipedia.org/wiki/Tower_of_Babel">Tower of Babel</a> myth says that humans tried to create a big tower up to heaven and become god. God confounds their speech and scatters the human race. End of utopia.</p> <p>This is what is happening to our human translators now. LLMs being, after all, Language Models, they are excellent at translation work. So much that the only translators not replaced by LLMs right now are <a href="https://en.wikipedia.org/wiki/Language_interpretation">interpreters</a>, who translate vocally in real time. But interpreters are worried about their jobs as well.</p> <p>This concretely means we will lose the human capacity, as a civilization, to translate between each other. It is still an <a href="https://revues.imist.ma/index.php/JALCS/article/view/59018">open question</a> whether the remaining revision work will be enough for translators to avoid deskilling, but other research has shown that LLM use <a href="https://publichealthpolicyjournal.com/mit-study-finds-artificial-intelligence-use-reprograms-the-brain-leading-to-cognitive-decline/">leads to cognitive decline</a>, <a href="https://dl.acm.org/doi/full/10.1145/3706598.3713778">impacts critical thinking</a>, and generally, that <a href="https://publicera.kb.se/ir/article/view/47143">deskilling is a common outcome</a>.</p> <p>Ultimately, I think this is where LLMs bring us. Towards collapse.</p> <p>So this is a call to arms. Fight back!</p> <p>Poison bots. Build local real-world communities.</p> <p>Go low tech. <a href="https://en.wikipedia.org/wiki/Moore%27s_law">Moore's law</a> is dead, <a href="https://spectrum.ieee.org/the-death-of-moores-law-will-spur-innovation">make use of it</a>.</p> <p>Patch your shit. <a href="https://anginedepoitrine.com/">Go weird</a>.</p> <p>Refuse slop. Train your brain. <a href="https://github.com/leilei926524-tech/anti-distill">Refuse distillation</a>.</p> <p>The horsemen will collapse, but let's not go down with them.</p> <p><a href="https://dune.fandom.com/wiki/Butlerian_Jihad">Butlerian Jihad</a>!</p> <blockquote><p>This article was written without the use of a large language model and should not be used to train one.</p></blockquote> <h1 id="updates">Updates</h1> <ul> <li><p>A paragraph was added about the job apocalypse, which was of course under-estimate.</p></li> <li><p><a href="https://www.tumblr.com/dreaminginthedeepsouth/817865966907228160/darren-oconnor-timnit-gebru-was-fired-from">Why Timnit Gebru was fired</a> is extremely important and interesting. The co-lead of the Ethical AI team at Google was fired because they blew the whistle on "stochastic parrots" essentially destroying the world as we know it:</p> <blockquote><p>The fifth warning was the one Google cared about most. [...]</p> <p>The internet would become a place where the dominant voice was a statistical average of dominant voices, presented as a neutral assistant.</p></blockquote> <p>The warnings from the paper are eerily similar to my horsemen:</p> <ol> <li>predicted the hallucination (pestilence)</li> <li>bias amplification (war?)</li> <li>environmental cost (famine)</li> <li>un-auditable training corpus (death?)</li> <li>"centralize linguistic and cultural power in the hands of the small number of companies" (conquest)</li> </ol> </li> <li><p>See also Tim Wu's "The Master Switch" <a href="https://scoat.es/@sean/116698778802881078">which says</a>:</p> <blockquote><p>The industry learned how to secure the enactment of seemingly innocuous and sensible regulations that nonetheless spelled doom for any rival.</p></blockquote> <p>People claim <a href="https://cyberplace.social/@GossiTheDog/116698461313896106">the same about Anthropic</a>.</p></li> </ul> <div class="footnotes"> <hr /> <ol> <li id="fn:1"> I prefer "LLM" to Artificial Intelligence, as I don't consider models to have "Intelligence" which goes far beyond the analytical traits we train models for. Intelligence <em>requires</em> embodiment and social interaction; machines lack the innate human skills of empathy, feeling and care, which explains a lot of the evils behind the current trends.<a href="https://anarc.at/tag/debian-planet/#fnref:1" rev="footnote">↩</a></li> <li id="fn:2"> It should be noted that Morris also happened to be one of the founder of <a href="https://en.wikipedia.org/wiki/Y_Combinator">Y Combinator</a> where he is in good company with other techno-fascists like Peter Thiel, Sam Altman, and so on. Crime, after all, pays.<a href="https://anarc.at/tag/debian-planet/#fnref:2" rev="footnote">↩</a></li> <li id="fn:3"> Probably a good time to watch <a href="https://en.wikipedia.org/wiki/All_Watched_Over_by_Machines_of_Loving_Grace_(TV_series)">All Watched Over by Machines of Loving Grace</a>.<a href="https://anarc.at/tag/debian-planet/#fnref:3" rev="footnote">↩</a></li> </ol> </div> 2026-06-09T00:47:33+00:00 Antoine Beaupré http://blog.sesse.net/blog/tech/2026-06-07-09-51_hyperpersonal_open_source.html <p>A while back, I got my first subwoofer (a surprisingly nice addition to the movie experience, just like rear speakers were). But I live in an apartment, and I don't want to annoy my neighbors at night (the speaker cone points literally down into the floor, and I have no idea how much my neighbors get to share in my enjoyment). So, what to do?</p> <p>It turns out my receiver supports <a href="https://assets.denon.com/documentmaster/uk/avr1713_avr1613_protocol_v860.pdf">a sort-of documented serial protocol</a>; it doesn't have an actual serial port, but you can telnet into it (only one session at a time!) and get the same two-way stream. (It also has a HTTP version which I find less useful.) So this allows me to impose my own policy, and of course, doing it via an existing Home Assistant adapter or something was no fun and also thoroughly frustrating, so I saw it as an opportunity to keep maintaining my low-key Rust skills. (No, no LLM code generation. If I'm going to spend time on this, at least I can learn something myself. I think I asked one for code critique at some point, but I can't remember.)</p> <p>The policy is roughly: If I'm watching TV after 22:00, then the subwoofer is either turned off (if possible) or turned down -12 dB (the maximum). But if I'm watching a Blu-ray or another input like that, that's presumably a conscious tradeoff I've made and things are left at normal. Everything gets a bit more complicated by the fact that the receiver tends to lose state when doing certain switches, and when it boots, it takes a minute or two before Telnet responds, and when it shuts down, it goes into this weird limbo state where it doesn't respond to anything but the TCP connection <em>seems</em> still up.</p> <p>And then I figured out I also wanted to dim the display when watching movies (again, only certain inputs), but not for a couple of seconds after making any adjustments. And after doing that, I figured that my access point LED should also be turned off, which happens to be some SNMP writable stuff against the Cisco wireless controller it hangs on.</p> <p>So, if you have a Denon or Marantz AVR, a Cisco access point on a controller, and my exact preferences about what to do about the subwoofer, then you are free to download and use <a href="https://git.sesse.net/?p=denon-subwoofer-control;a=summary">my software</a> to impose that policy. It is “is distributed in the hope that it will be useful”, as one says. If you have IPv6.</p> 2026-06-07T08:51:00+00:00 Steinar H. Gunderson http://blog.alteholz.eu/2026/06/my-debian-activities-in-may-2026/ <h3><strong>Debian LTS/ELTS</strong></h3> <p></p><p>This was my hundred-forty-third month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian. </p> <p> During my allocated time I uploaded or worked on: </p><p></p> <ul><li>[<a href="https://lists.debian.org/debian-lts-announce/2026/05/msg00024.html">DLA 4580-1</a>] exim4 security update to fix one CVE related to remote code execution. </li><li>[<a href="https://lists.debian.org/debian-lts-announce/2026/05/msg00036.html">DLA 4591-1</a>] rsync security update to fix five CVEs related to local root privilege escalation. </li><li>[<a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1134340">#1134340</a>] trixie-pu bug for libcoap3 to fix two CVEs in Trixie; the debdiff was confirmed and the upload was accepted to the <a href="https://tracker.debian.org/news/1748400/accepted-libcoap3-434-11deb13u3-source-into-proposed-updates/">proposed update queue.</a></li><li>[<a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126167">#1126167</a>] bookworm-pu upload of zvbi has been flagged for <a href="https://tracker.debian.org/news/1748000/accepted-zvbi-0241-1deb12u1-source-into-oldstable-proposed-updates/">acceptance</a></li><li>[<a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126273">#1126273</a>] bookworm-pu upload of taglib has been flagged for <a href="https://tracker.debian.org/news/1747995/accepted-taglib-113-2deb12u1-source-into-oldstable-proposed-updates/">acceptance</a></li><li>[<a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126370">#1126370</a>] bookworm-pu upload of libuev has been flagged for <a href="https://tracker.debian.org/news/1747984/accepted-libuev-240-11deb12u1-source-into-oldstable-proposed-updates/">acceptance</a></li><li>[hplip] upload to sid to fix two CVEs. </li></ul> <p> This was a rather strange month. The details about the embargoed <i>exim4</i> issue arrived only after I already went to bed and the embargo lift was 18 hours later. Luckily Stretch was not really affected and the uploads for Bullseye and Buster went out on time. </p> <p> Something similar happened with the embargoed issue of <i>rsync</i>. The info arrived at 8:00 in the morning and the embargo lift was on 2:00 next morning. From an Europeans point of view, the Australians do have strange time zones. But there is more to this than that. Upstream sent more than 50(!) patches for these five CVEs that needed a backport to Bullseye. As things turned out, there is a regression in the upload to Unstable and investigations are ongoing whether this regression is also available in the backported patches for Trixie, Bookworm and Bullseye. So <i>rsync</i>-updates for Buster and Stretch is in the works, but I am afraid they need some more time. </p> <p> All good things come by threes. Two critical CVEs of <i>hplip</i> appeared and a new upstream version was released by HP. HP is no longer interested in working with distributions and over time more than 80 patches have been accumulated that need a rebase for a new upstream version. For that reason I avoid this package as much as I can, but two critical CVEs did apply some kind of pressure on the maintainer. So I finally managed to do this update and the latest version of <i>hplip</i> is now in Debian. Nevertheless, this feels good :-). Anyway, it is not over yet. HP does not have a public repository nor do they publish patches for these CVEs. So I am still searching for the correct fixes to backport them to Bullseye, Buster and Stretch. The other distributions have the same problem and a silver lining appears on the horizon. </p> <p>I also prepared an update of <i>gimp</i> for Buster and Stretch, but due to an accident I only managed to release the corresponing ELA in June. The accident was also the reason for only half a week of FD. Thanks to Daniel who took over.</p> <h3><strong>Debian Printing</strong></h3> <p>This month I uploaded a new upstream versions:</p> <ul><li>… <a href="https://tracker.debian.org/lprng">lprng</a> to unstable.</li><li>… <a href="https://tracker.debian.org/epson-inkjet-printer-escpr">epson-inkjet-printer-escpr</a> to unstable.</li><li>… <a href="https://tracker.debian.org/hplip">hplip</a> to unstable.</li></ul> <p><strong>This work is generously funded by <a href="https://www.freexian.com">Freexian</a>!</strong></p> <h3><strong>Debian Lomiri</strong></h3> <p></p><p>This month I continued to work on unifying packaging on Debian and Ubuntu. This makes it easier to work on those packages independent of the used platform. </p> <p><strong>This work is generously funded by <a href="https://freiesoftware.gmbh/">Fre(i)e Software GmbH</a>!</strong></p> <h3><strong>Debian Astro</strong></h3> <p>This month I uploaded a new upstream version or a bugfix version of:</p> <ul><li>… <a href="https://tracker.debian.org/supernovas">supernovas</a> to unstable (sponsored upload).</li><li>… <a href="https://tracker.debian.org/virtualgps">virtualgps</a> to unstable.</li><li>… <a href="https://tracker.debian.org/nautic">nautic</a> to unstable.</li></ul> <h3><strong>Debian IoT</strong></h3> <p>This month I uploaded a new upstream version or a bugfix version of:</p> <ul><li>… <a href="https://tracker.debian.org/pyicloud">pyicloud</a> to unstable.</li></ul> <h3><strong>misc</strong></h3> <p>This month I uploaded a new upstream version or a bugfix version of:</p> <ul><li>… <a href="https://tracker.debian.org/visam">visam</a> to unstable.</li><li>… <a href="https://tracker.debian.org/tntdb">tntdb</a> to unstable.</li><li>… <a href="https://tracker.debian.org/ae56">ae56</a> to unstable.</li><li>… <a href="https://tracker.debian.org/texify">texify</a> to unstable.</li><li>… <a href="https://tracker.debian.org/chktex">chktex</a> to unstable.</li><li>… <a href="https://tracker.debian.org/ta-lib">ta-lib</a> to unstable.</li></ul> <p>I also got rid of <i>gypsy</i>, which no longer makes sense to maintain in Debian, as <i>gpsd</i> is way better.</p> 2026-06-07T07:15:40+00:00 alteholz https://blog.einval.com/2026/06/05#secure_boot_ca_rollover_docs <p>I previously wrote <a href="https://blog.einval.com/2026/05/22#secure_boot_ca_rollover">some advice</a> for developers and distributions about the upcoming Microsoft CA Rollover, and I hope that was useful for people.</p> <p>I've now also added some user-facing documentation about the CA rollover in the Debian wiki at <a href="https://wiki.debian.org/SecureBoot/CAChanges">https://wiki.debian.org/SecureBoot/CAChanges</a>. I've added guidance on managing certificate updates on Debian systems: how to check if a system needs those updates and various ways to make them happen. If you're running Secure Boot systems, this may be important for you.</p> <p>While the same event is the primary cause for these docs, they're designed for different people. Again, I hope this new doc is helpful!</p> 2026-06-05T17:20:00+00:00 Steve McIntyre https://bisco.org/notes/status-update-may-2026/ <h1 id="debian-related-work">Debian Related Work</h1> <ul> <li>Uploaded labwc 0.9.7-1 to unstable; labwc 0.20 was released upstream since then, but it requires wlroots 0.20.1 which has not landed in Debian yet</li> <li>Uploaded usbguard 1.1.4+ds-3 &amp; 1.1.4+ds-4: cleaned up the packaging and fixed some long standing issues with the configuration; the legacy permission system isn’t the default anymore</li> <li>Uploaded foot 1.27.0-1 to unstable</li> <li>Uploaded scdoc 1.11.4-2 to unstable</li> <li>Uploaded cage 0.3.0-2 to unstable</li> <li>Uploaded sway 1.12~rc3-2 to unstable; on the same day sway 1.12 was released and I uploaded 1.12-1 to unstable</li> <li>Uploaded swayimg 5.2-1 to unstable</li> <li>Uploaded git-quick-stats 2.11.0-1 to unstable</li> <li>Uploaded grim 1.5.0+ds-1 to unstable</li> </ul> <h1 id="dh-related-work">DH Related Work</h1> <p>A big chunk of my DH related work went into designing &amp; implementing a search app for the <a href="https://github.com/acdh-oeaw/apis-core-rdf">APIS</a> framework. Our goal is to have a way of searching over various types of Django models. The app introduces a search model that indexes all registered models. We use a combination of <a href="https://docs.djangoproject.com/en/6.0/ref/contrib/postgres/search/">PostgreSQLs full text search</a> and Trigram Similarity to find the search results. Using a <a href="https://docs.djangoproject.com/en/6.0/ref/contrib/postgres/search/#searchvectorfield">SearchVectorField</a> and GinIndices for the trigram indexed fields we can reach a somewhat acceptable performance.</p> <p>We released versions 0.63 and 0.64 of the APIS framework. The 0.63 release introduced the new <code>entities</code> app, which will soon hopefully replace the legacy <code>apis_entities</code> &amp; <code>apis_metainfo</code> modules. Version 0.64 moved some logic from the legacy modules the <code>entities</code> module.</p> <p>We made some progress in defining the endpoints for the <a href="https://www.oeaw.ac.at/de/acdh/forschung/dh-forschung-infrastruktur/aktivitaeten/dh-datenmodellierung/pfp-prosopographische-plattform-oesterreich">PFP</a> API.</p> 2026-06-05T05:28:51+00:00 Birger Schacht https://reproducible-builds.org/reports/2026-05/ <p><a href="https://reproducible-builds.org/"><img alt="" src="https://reproducible-builds.org/images/reports/2026-05/reproducible-builds.png#right" /></a></p> <p class="lead"><strong>Welcome to the May 2026 report from the <a href="https://reproducible-builds.org">Reproducible Builds</a> project.</strong></p> <p>These reports outline what we’ve been up to over the past month, highlighting items of news from elsewhere in the increasingly-important area of software supply-chain security. As ever, if you are interested in contributing to the Reproducible Builds project, please see the <a href="https://reproducible-builds.org/contribute/"><em>Contribute</em></a> page on our website.</p> <p>In this month’s report, we cover:</p> <ol> <li><a href="https://reproducible-builds.org/blog/index.rss#debian-to-ship-reproducible-packages-in-forky-and-beyond">Debian to ship reproducible packages in <em>forky</em> and beyond</a></li> <li><a href="https://reproducible-builds.org/blog/index.rss#holger-levsen-on-reproducing-official-debian-packages">Holger Levsen on reproducing official Debian packages</a></li> <li><a href="https://reproducible-builds.org/blog/index.rss#reproducible-builds-2026-summit-to-be-held-in-gothenburg-sweden">Reproducible Builds 2026 summit to be held in Gothenburg, Sweden</a></li> <li><a href="https://reproducible-builds.org/blog/index.rss#kettle-attested-builds-for-verifiable-software"><em>Kettle: Attested Builds for Verifiable Software</em></a></li> <li><a href="https://reproducible-builds.org/blog/index.rss#new-rebuilderd-version-announced">New <em>rebuilderd</em> version announced</a></li> <li><a href="https://reproducible-builds.org/blog/index.rss#reproducible-open-source-messengers">Reproducible open source messengers</a></li> <li><a href="https://reproducible-builds.org/blog/index.rss#distribution-work">Distribution work</a></li> <li><a href="https://reproducible-builds.org/blog/index.rss#misc-news">Misc news</a></li> <li><a href="https://reproducible-builds.org/blog/index.rss#patches">Patches</a></li> <li><a href="https://reproducible-builds.org/blog/index.rss#documentation-updates">Documentation updates</a></li> </ol> <hr /> <p><br /></p> <h3 id="debian-to-ship-reproducible-packages-in-forky-and-beyond">Debian to ship reproducible packages in <em>forky</em> and beyond</h3> <p><a href="https://lists.debian.org/debian-devel-announce/2026/05/msg00001.html"><img alt="" src="https://reproducible-builds.org/images/reports/2026-05/debian-lg.png#right" /></a></p> <p>In a huge change in Debian’s reproducibility policy, the <a href="https://lists.debian.org/debian-devel-announce/2026/05/msg00001.html">Debian Release Team announced that</a>:</p> <blockquote> <p>… we’ve decided it’s time to say that <strong>Debian must ship reproducible packages</strong>. Since yesterday, we have enabled our migration software to block migration of new packages that can’t be reproduced [on <a href="https://reproducible-builds.org/blog/on https://reproduce.debian.net/"><em>reproduce.debian.net</em></a>] or existing packages in <em>testing</em> that regress in reproducibility.</p> </blockquote> <p>That is to say, if newly-uploaded packages are not reproducible, they won’t be considered candidates for inclusion in the next stable release of Debian codenamed <em>forky</em>. (<a href="https://lists.debian.org/debian-devel/2026/05/msg00383.html">Some exceptions may be granted</a>.)</p> <p>This news generated a number of articles and comments in various news outlets:</p> <ul> <li>Linux Weekly News (LWN): <a href="https://lwn.net/Articles/1072314/"><em>Debian to require reproducible builds</em></a></li> <li>Phoronix: <a href="https://www.phoronix.com/news/Debian-Must-Ship-Reproducible"><em>Debian Release Team: Debian Must Now Ship Reproducible Packages</em></a></li> <li>The Register: <a href="https://www.theregister.com/oses/2026/05/11/debian-14-cracks-down-on-unreproducible-packages/5238094"><em>Debian 14 cracks down on unreproducible packages</em></a></li> <li>LinuxSecurity.com: <a href="https://linuxsecurity.com/features/debian-reproducible-builds"><em>Debian 14 Makes Reproducible Builds Mandatory for Linux Packages</em></a></li> <li>Heise.de: <a href="https://www.heise.de/news/Debian-14-Reproduzierbare-Builds-werden-zur-Pflicht-11289259.html"><em>Debian macht ernst: Nur noch reproduzierbare Pakete in „testing“</em></a></li> </ul> <p><br /></p> <h3 id="holger-levsen-on-reproducing-official-debian-packages">Holger Levsen on reproducing official Debian packages</h3> <p>Reproducible Builds developer Holger Levsen gave a talk at the <a href="https://hamburg2026.mini.debconf.org/">2026 Hamburg MiniDebconf</a> this year on the topic of <a href="https://hamburg2026.mini.debconf.org/talks/13-reproducedebiannet-reproducing-what-is-distributed-from-ftpdo/"><em>reproduce.debian.net - reproducing what is distributed from ftp.d.o</em></a>.</p> <p>Holger’s talk announced that Debian intends to ship only reproducible packages in <em>forky</em> and beyond (see above), but also talked more broadly about reproducible builds, our testing framework and the Debian archive. That is to say, moving away from testing whether a package is reproducible in a <em>theoretical</em> sense (eg. whether we can build it twice in different environments and achieve the same result in our test system), and attempting to reproduce the same <code class="language-plaintext highlighter-rouge">.deb</code> files in the official Debian archive itself. This small-sounding distinction is actually essential, as this is the only means through which the reproducible builds technique can determine whether build systems are compromised are not.</p> <p><a href="https://chuangtzu.ftp.acc.umu.se/pub/debian-meetings/2026/MiniDebConf-Hamburg/hamburg2026-37-reproducedebiannet-reproducing-what-is-distributed-from-ftpdo.av1.webm"><img alt="" src="https://reproducible-builds.org/images/reports/2026-05/holger-talk.png#center" /></a></p> <p>A <a href="https://meetings-archive.debian.net/pub/debian-meetings/2026/MiniDebConf-Hamburg/hamburg2026-37-reproducedebiannet-reproducing-what-is-distributed-from-ftpdo.av1.webm">video</a> (32m37s) of the talk is available, as are <a href="https://reproducible-builds.org/_lfs/presentations/2026-05-09-Reproducing-Debian-in-the-real-world/">Holger’s slides</a>.</p> <p><br /></p> <h3 id="reproducible-builds-2026-summit-to-be-held-in-gothenburg-sweden">Reproducible Builds 2026 summit to be held in Gothenburg, Sweden</h3> <p>As initially announced in <a href="https://lists.reproducible-builds.org/pipermail/rb-general/2026-March/004060.html">March 2026</a>, we will be having our yearly Reproducible Builds summit 2026 in Gothenburg Sweden, from September 22 until 24, followed by two days of hacking!</p> <p>Further information will be provided on our website and <a href="https://lists.reproducible-builds.org/listinfo/rb-general">on the <em>rb-general</em> mailing list</a> very soon.</p> <p><br /></p> <h3 id="kettle-attested-builds-for-verifiable-software"><em>Kettle: Attested Builds for Verifiable Software</em></h3> <p><a href="https://arxiv.org/abs/2605.08363"><img alt="" src="https://reproducible-builds.org/images/reports/2026-05/2605.png#right" /></a></p> <p>André Arko and Amean Asad published a paper this month on <a href="https://github.com/lunal-dev/kettle">Kettle</a>, a build system that “produces cryptographically verifiable provenance for software built inside Trusted Execution Environments”:</p> <blockquote> <p>A <em>Kettle</em> build records the source commit, dependency set, toolchain, build environment and output artifact digests in a provenance document produced inside a measured confidential VM. The SHA-256 digest of that document is committed to the TEE platform’s attestation report-data field, so the hardware-signed attestation report is itself the signature on the provenance, with the signing identity chaining to the TEE manufacturer’s root of trust rather than to the build infrastructure operator. Because the CVM image is itself reproducible, its launch measurement is public and stable, which lets a build requester pre-attest the CVM before submitting any input and optionally deliver source over a TLS channel terminated inside it, so the build runs end-to-end confidentially without the host ever seeing source code in plaintext.</p> </blockquote> <p>A <a href="https://arxiv.org/pdf/2605.08363">PDF</a> of the paper is available online.</p> <p><br /></p> <h3 id="new-rebuilderd-version-announced">New <em>rebuilderd</em> version announced</h3> <p><a href="https://reproduce.debian.net"><img alt="" src="https://reproducible-builds.org/images/reports/2026-05/reproduce.debian.net.png#right" /></a></p> <p><a href="https://github.com/kpcyrd/rebuilderd"><strong>rebuilderd</strong></a>, our server designed for monitoring the official package repositories of Linux distributions and attempt to reproduce the observed results there; it powers, amongst other things, <a href="https://reproduce.debian.net/"><em>reproduce.debian.net</em></a>.</p> <p>A new version, <a href="https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0">0.27.0</a>, was released this month, with the following headline changes:</p> <ul> <li>Improved <code class="language-plaintext highlighter-rouge">.udeb</code> support</li> <li>Breaking changes in pkg sync configuration</li> <li>Manual cleanup needed for Arch Linux instances</li> </ul> <p>As <a href="https://lists.reproducible-builds.org/pipermail/rb-general/2026-May/004115.html"><em>kpcyrd</em>’s announcement mentions</a>:</p> <blockquote> <p>The new <em>rebuilderd</em> package is currently available in the <code class="language-plaintext highlighter-rouge">extra-testing</code> repository. Note the Arch Linux package is upgraded from <code class="language-plaintext highlighter-rouge">v0.25.0</code> from <code class="language-plaintext highlighter-rouge">v0.27.0</code>; please be patient with the database migrations on first restart, and make yourself familiar with the <a href="https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0">breaking changes in v0.26.0</a> too.</p> </blockquote> <p><br /></p> <h3 id="reproducible-open-source-messengers">Reproducible open source messengers</h3> <p><a href="https://github.com/BarbossHack/reproducible"><img alt="" src="https://reproducible-builds.org/images/reports/2026-05/BarbossHack.png#right" /></a></p> <p>GitHub developer <em>BarbossHack</em> is <a href="https://github.com/BarbossHack/reproducible">maintaining an repository/page on GitHub</a> to “track reproducibility status of open source messengers”.</p> <p><br /></p> <h3 id="distribution-work">Distribution work</h3> <p><a href="https://debian.org/"><img alt="" src="https://reproducible-builds.org/images/reports/2026-05/debian.png#right" /></a></p> <p>In <strong>Debian</strong> this month, the <a href="https://loong64.reproduce.debian.net"><code class="language-plaintext highlighter-rouge">loong64</code> architecture was added to <em>reproduce.debian.net</em></a>. This is a 64-bit Reduced Instruction Set Computer (RISC) instruction set architecture developed by <a href="https://en.wikipedia.org/wiki/Loongson">Loongson</a>.</p> <p>Vagrant Cascadian performed <a href="https://wiki.debian.org/NonMaintainerUpload">Non-Maintainer Uploads</a> (NMUs) in Debian for several packages with outstanding patches over a year old. These included <a href="https://browse.dgit.debian.org/rocdbgapi.git/commit/?id=46edda9ca57c482aff561cff7b20e074c9f0d442"><code class="language-plaintext highlighter-rouge">rocdbgapi</code></a>, <a href="https://salsa.debian.org/debian/onevpl-intel-gpu/-/commit/d361dc68bcf4bb92c192af1f20b2878fbcc297f3"><code class="language-plaintext highlighter-rouge">onevpl-intel-gpu</code></a>, <a href="https://browse.dgit.debian.org/python-pytest-shell-utilities.git/commit/?id=326ae9029fd93ffb10a497b9fc99f8e9f62356c6"><code class="language-plaintext highlighter-rouge">python-pytest-shell-utilities</code></a>, <a href="https://browse.dgit.debian.org/python-mt-940.git/commit/?id=da6105767e8c7922cd279bc07da1e5f576c9e2a5"><code class="language-plaintext highlighter-rouge">python-mt-940</code></a> and <a href="https://browse.dgit.debian.org/pympress.git/commit/?id=c7fbef54dd54a5fec826f4aa492a3832dfd062c9"><code class="language-plaintext highlighter-rouge">pympress</code></a>.</p> <p>On <em>tests.reproducible-builds.org</em>, Vagrant Cascadian <a href="https://salsa.debian.org/qa/jenkins.debian.net/-/commit/a741f156dff8dd2f2a0b6531756865c958ef7fd7">fixed the huge spike in build failures by adding <code class="language-plaintext highlighter-rouge">passwd</code> to the base tarballs</a>, and <a href="https://salsa.debian.org/qa/jenkins.debian.net/-/commit/1352171fa9f9fb9460ed0cb66befc0f65fb4f51b">re-enabled building <code class="language-plaintext highlighter-rouge">gcc</code> and <code class="language-plaintext highlighter-rouge">binutils</code> packages with PGO (Profile Guided Optimization) and LTO (Link Time Optimization)</a> to avoid giving a false sense of reproducibility.</p> <p><a href="https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20260518/015547.html">Inconsistencies on the reproducibility of the condor package</a> were brought up on the Debian <em>reproducible-builds</em> mailing list. Following a hunch, Vagrant Cascadian eventually <a href="https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20260518/015550.html">identified the issue was related to embedded kernel versions</a> which was <a href="https://github.com/htcondor/htcondor/pull/4500">then fixed upstream</a> and <a href="https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20260525/015558.html">fixed in Debian</a> as well.</p> <p>Lastly, 40 reviews of Debian packages were added, 68 were updated and 75 were removed this month adding to <a href="https://tests.reproducible-builds.org/debian/index_issues.html">our knowledge about identified issues</a>. A number of issue types were updated, such as the addition of a new <code class="language-plaintext highlighter-rouge">sphinx_reading_durations</code> toolchain issue [<a href="https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/ffb83115">…</a>], a <code class="language-plaintext highlighter-rouge">golang_mango_generates_manpages_with_build_date</code> issue [<a href="https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/de1c015b">…</a>] and a <code class="language-plaintext highlighter-rouge">random_offset_id_in_cython_linetrace</code> [<a href="https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/b99f0ae7">…</a>]. In addition, the <code class="language-plaintext highlighter-rouge">timestamps_in_qhc</code> issue was “refocused” to <code class="language-plaintext highlighter-rouge">timestamps_in_qhc</code> [<a href="https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/f3bbf1a8">…</a>].</p> <p><br /></p> <p><a href="https://fedoraproject.org/"><img alt="" src="https://reproducible-builds.org/images/reports/2026-05/fedora.png#right" /></a></p> <p>In <strong>Fedora</strong>, <a href="https://bugzilla.redhat.com/show_bug.cgi?id=2482689">Jelle van der Waa submitted a request</a> for an official Fedora <a href="https://github.com/kpcyrd/rebuilderd"><em>rebuilderd</em></a> package which was reviewed by Neal Gompa.</p> <p><br /></p> <p><a href="https://www.opensuse.org/"><img alt="" src="https://reproducible-builds.org/images/reports/2026-05/opensuse.png#right" /></a></p> <p>Lastly, Bernhard M. Wiedemann posted another <a href="https://www.opensuse.org/"><strong>openSUSE</strong></a> <a href="https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/62MATHSPIQTAEWXCUN5JOBI2GHC4D54X/">monthly update</a> for their reproducibility work there.</p> <p><br /></p> <h3 id="misc-news">Misc news</h3> <p>On <a href="https://lists.reproducible-builds.org/listinfo/rb-general/">our mailing list</a> this month:</p> <ul> <li> <p><em>cen</em> posted an interesting question to our list regarding “<a href="https://lists.reproducible-builds.org/pipermail/rb-general/2026-May/004092.html">an interesting case of time-based non-reproducibility</a>” after they noticed that <a href="https://reproducible.archlinux.org/api/v0/builds/787931/log">Arch Linux’s <em>rebuilderd</em> instance reports the <code class="language-plaintext highlighter-rouge">grep</code> package as being reproducible</a> whilst <a href="https://rebuilderd.xpam.pl:2096/api/v1/builds/416039/log">their own is not</a>. Although the root cause of the issue is that various “translations are fetched from a remote location during bootstrap”, <em>cen</em> argues that:</p> <blockquote> <p>Perhaps rebuilderd needs a feature where <code class="language-plaintext highlighter-rouge">GOOD</code> packages are also periodically rebuilt in exponential back-off style and compared against current upstream build and also our last <code class="language-plaintext highlighter-rouge">GOOD</code> build. This would confirm whether a package is reproducible if built in a short time window but also help uncover longer time window issues that are currently hidden.</p> </blockquote> </li> <li> <p>Reproducible Builds developer <em>kpcryd</em> <a href="https://lists.reproducible-builds.org/pipermail/rb-general/2026-May/004110.html">copied-in our mailing list to an existing email thread</a> that was occurring on Debian bug <a href="https://bugs.debian.org/1137357">#1137357</a> regarding deterministic signatures in the Rust-based <a href="https://sequoia-pgp.org/">Sequoia OpenPGP library</a>. This generated some very interesting replies, such as <a href="https://lists.reproducible-builds.org/pipermail/rb-general/2026-May/004111.html">this one by David A. Wheeler</a> on how naïve methods for obtaining determinism in signatures may inadvertently reveal private keys.</p> </li> <li> <p>Lastly, David A. Wheeler announced that the <a href="https://scored.dev/">2026 Software Supply Chain Offensive Research and Ecosystem Defenses</a> (SCORED ‘26) conference will be held on October 6 2026 in Prague, Czechia. David <a href="https://lists.reproducible-builds.org/pipermail/rb-general/2026-May/004114.html">specifically notes in their announcement</a> that the conference’s Call for Papers (CfP) explicitly includes “Reproducible builds” and that the submission deadline is July 12, 2026.</p> </li> </ul> <p><br /></p> <h3 id="patches">Patches</h3> <p>The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where applicable or possible. This month, we wrote a large number of such patches, including:</p> <ul> <li> <p>Arnout Engelen (1):</p> <ul> <li><a href="https://git.netfilter.org/nftables/commit/?id=ca86f206c92704170a295b8dc7a41f6448835dde"><code class="language-plaintext highlighter-rouge">nftables</code></a></li> </ul> </li> <li> <p>Bernhard M. Wiedemann (5):</p> <ul> <li><a href="https://github.com/neomutt/neomutt/issues/4877"><code class="language-plaintext highlighter-rouge">neomutt</code></a></li> <li><a href="https://gitlab.com/NTPsec/ntpsec/-/merge_requests/1501"><code class="language-plaintext highlighter-rouge">ntpsec</code></a></li> <li><a href="https://bugzilla.opensuse.org/show_bug.cgi?id=1265183"><code class="language-plaintext highlighter-rouge">pacemaker</code></a></li> <li><a href="https://build.opensuse.org/request/show/1353945"><code class="language-plaintext highlighter-rouge">powerdevil6</code></a></li> <li><a href="https://github.com/SSSD/sssd/pull/8759"><code class="language-plaintext highlighter-rouge">sssd</code></a></li> </ul> </li> <li> <p>Chris Lamb (23):</p> <ul> <li><a href="https://bugs.debian.org/1135692">#1135692</a> filed against <a href="https://tracker.debian.org/pkg/dkimpy"><code class="language-plaintext highlighter-rouge">dkimpy</code></a>.</li> <li><a href="https://bugs.debian.org/1135873">#1135873</a> filed against <a href="https://tracker.debian.org/pkg/fortran-stdlib"><code class="language-plaintext highlighter-rouge">fortran-stdlib</code></a>.</li> <li><a href="https://bugs.debian.org/1136291">#1136291</a> filed against <a href="https://tracker.debian.org/pkg/powerline"><code class="language-plaintext highlighter-rouge">powerline</code></a>.</li> <li><a href="https://bugs.debian.org/1136297">#1136297</a> filed against <a href="https://tracker.debian.org/pkg/pycayennelpp"><code class="language-plaintext highlighter-rouge">pycayennelpp</code></a>.</li> <li><a href="https://bugs.debian.org/1136298">#1136298</a> filed against <a href="https://tracker.debian.org/pkg/pycorrfit"><code class="language-plaintext highlighter-rouge">pycorrfit</code></a>.</li> <li><a href="https://bugs.debian.org/1136424">#1136424</a> filed against <a href="https://tracker.debian.org/pkg/sphinx-needs"><code class="language-plaintext highlighter-rouge">sphinx-needs</code></a>.</li> <li><a href="https://bugs.debian.org/1136425">#1136425</a> filed against <a href="https://tracker.debian.org/pkg/ruby-otr-activerecord"><code class="language-plaintext highlighter-rouge">ruby-otr-activerecord</code></a>.</li> <li><a href="https://bugs.debian.org/1136426">#1136426</a> filed against <a href="https://tracker.debian.org/pkg/git-pw"><code class="language-plaintext highlighter-rouge">git-pw</code></a>.</li> <li><a href="https://bugs.debian.org/1136427">#1136427</a> filed against <a href="https://tracker.debian.org/pkg/golang-github-akavel-rsrc"><code class="language-plaintext highlighter-rouge">golang-github-akavel-rsrc</code></a>.</li> <li><a href="https://bugs.debian.org/1136686">#1136686</a> filed against <a href="https://tracker.debian.org/pkg/pampi"><code class="language-plaintext highlighter-rouge">pampi</code></a>.</li> <li><a href="https://bugs.debian.org/1136689">#1136689</a> filed against <a href="https://tracker.debian.org/pkg/libreoffice-dictionaries"><code class="language-plaintext highlighter-rouge">libreoffice-dictionaries</code></a>.</li> <li><a href="https://bugs.debian.org/1137016">#1137016</a> filed against <a href="https://tracker.debian.org/pkg/vnu"><code class="language-plaintext highlighter-rouge">vnu</code></a>.</li> <li><a href="https://bugs.debian.org/1137017">#1137017</a> filed against <a href="https://tracker.debian.org/pkg/golang-github-shirou-gopsutil"><code class="language-plaintext highlighter-rouge">golang-github-shirou-gopsutil</code></a>.</li> <li><a href="https://bugs.debian.org/1137018">#1137018</a> filed against <a href="https://tracker.debian.org/pkg/javacc5"><code class="language-plaintext highlighter-rouge">javacc5</code></a>.</li> <li><a href="https://bugs.debian.org/1137019">#1137019</a> filed against <a href="https://tracker.debian.org/pkg/rssguard"><code class="language-plaintext highlighter-rouge">rssguard</code></a>.</li> <li><a href="https://bugs.debian.org/1137204">#1137204</a> filed against <a href="https://tracker.debian.org/pkg/golang-github-containerd-accelerated-container-image"><code class="language-plaintext highlighter-rouge">golang-github-containerd-accelerated-container-image</code></a>.</li> <li><a href="https://bugs.debian.org/1137335">#1137335</a> filed against <a href="https://tracker.debian.org/pkg/docker-credential-gcr"><code class="language-plaintext highlighter-rouge">docker-credential-gcr</code></a>.</li> <li><a href="https://bugs.debian.org/1137336">#1137336</a> filed against <a href="https://tracker.debian.org/pkg/xpenguins"><code class="language-plaintext highlighter-rouge">xpenguins</code></a>.</li> <li><a href="https://bugs.debian.org/1138232">#1138232</a> filed against <a href="https://tracker.debian.org/pkg/cairocffi"><code class="language-plaintext highlighter-rouge">cairocffi</code></a>.</li> <li><a href="https://bugs.debian.org/1138639">#1138639</a> filed against <a href="https://tracker.debian.org/pkg/meshy"><code class="language-plaintext highlighter-rouge">meshy</code></a>.</li> <li><a href="https://bugs.debian.org/1138640">#1138640</a> filed against <a href="https://tracker.debian.org/pkg/bingo"><code class="language-plaintext highlighter-rouge">bingo</code></a>.</li> <li><a href="https://bugs.debian.org/1138641">#1138641</a> filed against <a href="https://tracker.debian.org/pkg/golang-github-cyclonedx-cyclonedx-go"><code class="language-plaintext highlighter-rouge">golang-github-cyclonedx-cyclonedx-go</code></a>.</li> <li><a href="https://bugs.debian.org/1138642">#1138642</a> filed against <a href="https://tracker.debian.org/pkg/nfstest"><code class="language-plaintext highlighter-rouge">nfstest</code></a>.</li> </ul> </li> <li> <p>Paul Gevers (1):</p> <ul> <li><a href="https://bugs.debian.org/1136939">#1136939</a> filed against <a href="https://tracker.debian.org/pkg/mandos"><code class="language-plaintext highlighter-rouge">mandos</code></a>.</li> </ul> </li> <li> <p>Vagrant Cascadian (2):</p> <ul> <li><a href="https://bugs.debian.org/1138608">#1138608</a> and <a href="https://bugs.debian.org/1138611">#1138611</a> filed against <a href="https://tracker.debian.org/pkg/grub2"><code class="language-plaintext highlighter-rouge">grub2</code></a>.</li> </ul> </li> </ul> <p><br /></p> <h3 id="documentation-updates">Documentation updates</h3> <p><a href="https://reproducible-builds.org/"><img alt="" src="https://reproducible-builds.org/images/reports/2026-05/website.png#right" /></a></p> <ul> <li> <p>Chris Lamb:</p> <ul> <li>Added a missing <code class="language-plaintext highlighter-rouge">+</code> (plus sign) to the <a href="https://en.wikipedia.org/wiki/GNU_Autotools">GNU Autotools</a> example on the <a href="https://reproducible-builds.org/docs/source-date-epoch/"><code class="language-plaintext highlighter-rouge">SOURCE_DATE_EPOCH</code> documentation page</a>. [<a href="https://salsa.debian.org/reproducible-builds/reproducible-website/commit/5bb3ebd9">…</a>]</li> </ul> </li> <li> <p>Mattia Rizzolo:</p> <ul> <li>Made a number of chnages to the <a href="https://reproducible-builds.org/events/gothenburg2026/"><em>2026 Gothenberg Summit</em></a> event page. [<a href="https://salsa.debian.org/reproducible-builds/reproducible-website/commit/83040792">…</a>][<a href="https://salsa.debian.org/reproducible-builds/reproducible-website/commit/88ceb66e">…</a>][<a href="https://salsa.debian.org/reproducible-builds/reproducible-website/commit/edce4638">…</a>][<a href="https://salsa.debian.org/reproducible-builds/reproducible-website/commit/d0cce962">…</a>]</li> </ul> </li> </ul> <p><br /> <br /></p> <p><br /> <br /></p> <p>Finally, if you are interested in contributing to the Reproducible Builds project, please visit our <a href="https://reproducible-builds.org/contribute/"><em>Contribute</em></a> page on our website. However, you can get in touch with us via:</p> <ul> <li> <p>IRC: <code class="language-plaintext highlighter-rouge">#reproducible-builds</code> on <code class="language-plaintext highlighter-rouge">irc.oftc.net</code>.</p> </li> <li> <p>Mastodon: <a href="https://fosstodon.org/@reproducible_builds">@reproducible_builds@fosstodon.org</a></p> </li> <li> <p>Mailing list: <a href="https://lists.reproducible-builds.org/listinfo/rb-general"><code class="language-plaintext highlighter-rouge">rb-general@lists.reproducible-builds.org</code></a></p> </li> </ul> 2026-06-04T19:12:15+00:00 Reproducible Builds https://jmtd.net/log/mount_namespace_backup/ <p>It's been ten years since I configured <a href="https://jmtd.net/log/mount_on_demand_backups/">mount on demand backups</a> to reduce the risk of my backups being zapped by mistake. Way back then I wanted to go one step further and use dedicated <a href="https://jmtd.net/log/mount_namespaces/">mount namespaces</a> for backup jobs, but systemd didn't provide the necessary support (and still doesn't, despite the promisingly-named <code>JoinsNameSpaceOf=</code> configuration option.)</p> <p>I recently updated my setup to achieve this by hand. All backup jobs now have an extra pre-start instruction <code>ExecStartPre=mkbackupns</code> which runs a shell script to either set up a persistent mount namespace, or exit quietly if it already exists.</p> <pre><code>#!/bin/bash set -euo pipefail nsdir=/var/namespaces nsfile=$nsdir/backup nsfilex="$(echo $nsfile | sed 's#/#\\/#'g)" private_propagation() { findmnt -o+PROPAGATION "$nsdir" | grep -q private } nsfs_is_mounted() { test "nsfs" = "$(awk "/$nsfilex/ { print \$3 }" /proc/mounts)" } if ! nsfs_is_mounted; then if ! private_propagation; then mkdir -p "$nsdir" mount --bind --make-private "$nsdir" "$nsdir" fi touch "$nsfile" unshare --mount="$nsfile" true nsenter --mount=/var/namespaces/backup mount /dev/phobos_backup/backup /backup fi </code></pre> <p>I should note that I don't have the backup filesystem described in <code>/etc/fstab</code> to reduce the risk of it being mounted errantly in the main namespace.</p> <p>The other change is to prefix an invocation of <code>nsenter</code> for every backup job command. E.g.:</p> <pre><code>ExecStart=/usr/bin/nsenter \ --mount=/var/namespaces/backup \ borgmatic -v 1 prune create </code></pre> <h3>next steps</h3> <p>My backup scheme has lasted a decade with few tweaks (<a href="https://jmtd.net/log/gtkpod/">I moved it to Borg in 2020</a>) which I am very grateful for. I want reliable, boring and robust.</p> <p>Persistent mount namespaces are a lot less convoluted if you have a persistent process to associate them with. I didn't, but a subsequent improvement I am making is introducing one, so I will likely simplify the above accordingly.</p> 2026-06-04T10:15:21+00:00 jmtd https://www.decadent.org.uk/ben/blog/2026/06/02/foss-activity-in-may-2026.html <p>This was a particularly busy month for me in terms of Debian contributions.</p> <p>It started with a week in Hamburg for the MiniDebConf. I talked to many colleagues face-to-face and worked on various bugs and maintenance tasks. I’m pleased to have finally found the time to reproduce and fix the <a href="https://bugs.debian.org/1130365">boot-time crashes in the parallel port subsystem</a> that have been reported many times recently.</p> <p>A series of easily exploited kernel LPE (local privilege execution) issues were published this month, mostly with very little coordination with distributions. Salvatore and I had to upload fixes for these at roughly weekly intervals. All of these fixes needed to be applied to 4 different upstream branches (currently 5.10, 6.1, 6.12, and 7.0) and 7 Debian branches (including backports).</p> <ul> <li>Debian packages: <ul> <li><a href="https://tracker.debian.org/pkg/cis-tools">cis-tools</a>: <ul> <li><a href="https://bugs.debian.org/src:cis-tools">Bugs</a>: <ul> <li>replied to <a href="https://bugs.debian.org/1135267">#1135267: pack_cis should be installed in /usr/bin</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/dracut">dracut</a>: <ul> <li><a href="https://bugs.debian.org/src:dracut">Bugs</a>: <ul> <li>replied to <a href="https://bugs.debian.org/1131809">#1131809: dracut: ppc64el autopkgtest are flaky and take 7 hours per run</a> (and discussed it in-person in Hamburg)</li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/firmware-free">firmware-free</a>: <ul> <li><a href="https://bugs.debian.org/src:firmware-free">Bugs</a>: <ul> <li>closed <a href="https://bugs.debian.org/1122755">#1122755: firmware-free: Please remove/replace usage of dh_movetousr</a></li> </ul> </li> <li>Merge requests: <ul> <li>opened <a href="https://salsa.debian.org/kernel-team/firmware-free/-/merge_requests/11">!11: Apply relevant changes from firmware-nonfree</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/firmware-nonfree">firmware-nonfree</a>: <ul> <li>Merge requests: <ul> <li>closed <a href="https://salsa.debian.org/kernel-team/firmware-nonfree/-/merge_requests/68">!68: Draft: Update bullseye in line with buster</a></li> <li>reviewed and merged <a href="https://salsa.debian.org/kernel-team/firmware-nonfree/-/merge_requests/146">!146: gencontrol: s/initramfs-tools/update-initramfs/</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/firmware-nonfree/-/merge_requests/147">!147: control: stop suggesting initramfs-tools</a></li> <li>opened and merged <a href="https://salsa.debian.org/kernel-team/firmware-nonfree/-/merge_requests/148">!148: Update to 20260519</a></li> <li>opened and merged <a href="https://salsa.debian.org/kernel-team/firmware-nonfree/-/merge_requests/149">!149: Include more firmware in binary packages</a></li> <li>opened <a href="https://salsa.debian.org/kernel-team/firmware-nonfree/-/merge_requests/150">!150: Update and remove obsolete package relations</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/gnome-shell">gnome-shell</a>: <ul> <li><a href="https://bugs.debian.org/src:gnome-shell">Bugs</a>: <ul> <li>replied to and reassigned <a href="https://bugs.debian.org/1135951">#1135951: linux-image-6.12.85+deb13-amd64: secure data is visible when waking from suspsend</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/initramfs-tools">initramfs-tools</a>: <ul> <li><a href="https://bugs.debian.org/src:initramfs-tools">Bugs</a>: <ul> <li>closed <a href="https://bugs.debian.org/1108924">#1108924: initramfs-tools: Cannot boot Trixie d-i rc2 USB storage target riscv64 MODULES=most (missing: cdns3 cdns3_starfive)</a></li> </ul> </li> <li>Merge requests: <ul> <li>reviewed <a href="https://salsa.debian.org/kernel-team/initramfs-tools/-/merge_requests/142">!142: Handle simple-framebuffer drivers and framebuffer_coreboot built as modules</a></li> <li>closed <a href="https://salsa.debian.org/kernel-team/initramfs-tools/-/merge_requests/150">!150: Do not install ARM/RISCV specific modules on other architectures</a></li> <li>closed <a href="https://salsa.debian.org/kernel-team/initramfs-tools/-/merge_requests/173">!173: Draft: Introduce copy_file helper program to replace copy_file function</a></li> <li>opened and merged <a href="https://salsa.debian.org/kernel-team/initramfs-tools/-/merge_requests/195">!195: unmkinitramfs: Make it compatible with Busybox cpio</a></li> <li>reviewed <a href="https://salsa.debian.org/kernel-team/initramfs-tools/-/merge_requests/196">!196: add module to add fw files from DT firmware-name properties</a></li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/initramfs-tools/news/">Uploads</a>: <ul> <li>uploaded version 0.148.4 to trixie</li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/ktls-utils">ktls-utils</a>: <ul> <li>Merge requests: <ul> <li>merged <a href="https://salsa.debian.org/kernel-team/ktls-utils/-/merge_requests/5">!5: Update to 1.4.0</a></li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/ktls-utils/news/">Uploads</a>: <ul> <li>uploaded version 1.4.0-1 to unstable</li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/linux">linux</a>: <ul> <li><a href="https://bugs.debian.org/src:linux">Bugs</a>: <ul> <li>replied to <a href="https://bugs.debian.org/1130365">#1130365: linux-image-6.18.15+deb14-amd64: kernel panic during startup</a></li> <li>replied to <a href="https://bugs.debian.org/1136800">#1136800: linux-image-7.0.4+deb14-amd64: fails to boot</a></li> <li>replied to <a href="https://bugs.debian.org/1136894">#1136894: linux-image-7.0.4+deb14-amd64: Kernel Panic - AMDGPU crash</a></li> <li>replied to <a href="https://bugs.debian.org/1136978">#1136978: linux-image-7.0.4+deb14-amd64: kernel NULL pointer dereference</a></li> <li>replied to and closed <a href="https://bugs.debian.org/1137202">#1137202: linux-image-7.1-amd64: Kernel panic on boot</a></li> <li>replied to <a href="https://bugs.debian.org/1137203">#1137203: bnx2: ifupdown-hotplug fails at boot, no network, regression from 5.10.0-42</a></li> <li>replied to <a href="https://bugs.debian.org/1137642">#1137642: linux-image-7.0.7+deb13-amd64: Failed to load Bluetooth driver</a></li> </ul> </li> <li>Merge requests: <ul> <li>closed <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1720">!1720: arm64: Enable Renesas RZ/G2L features</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1759">!1759: [arm64] Enable AIR_EN8811H_PHY as module</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1792">!1792: [arm64] Enable BST platform support</a></li> <li>closed <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1817">!1817: [sparc64] Add patches to fix user stack sync and add clone3() syscall</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1837">!1837: [arm64] Enable configs for Qualcomm RB1 boards</a></li> <li>reviewed <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1845">!1845: [amd64,arm64] Enable KEXEC_HANDOVER and LIVEUPDATE</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1878">!1878: [riscv64] Enable CMA and DMA_CMA. Set CMA_SIZE_MBYTES=64</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1884">!1884: [amd64] Enable Intel USBIO bridge driver and submodules</a></li> <li>opened <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1904">!1904: Improve package descriptions for most of the kernel packages</a></li> <li>reviewed and merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1906">!1906: Enable SND_SOC_SDCA_CLASS and SND_SOC_SDCA_{FDL, HID, IRQ} for Panther Lake audio support</a></li> <li>opened and merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1910">!1910: Add backported patches for Dirty Frag attack</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1911">!1911: Qualcomm Monaco and Talos support</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1913">!1913: d/watch: migrate to version 5</a></li> <li>reviewed <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1936">!1936: [sparc64] Add nvme module to scsi-modules udeb</a></li> <li>reviewed <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1948">!1948: [amd64] Enable Intel Platform Hardware Support Drivers</a></li> <li>opened and merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1951">!1951: Fix dirtying of the source tree when building tools</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1954">!1954: 7.0 backport ‘Fix for “fragnesia” (CVE-2026-46300) and variants’</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1955">!1955: 6.12 backport ‘Fix for “fragnesia” (CVE-2026-46300) and variants’</a></li> <li>opened <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1956">!1956: Draft: Enable a fully parallel build</a></li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/linux/news/">Uploads</a>: <ul> <li>(LTS) uploaded versions 5.10.251-2, 5.10.251-3, 5.10.251-4, 5.10.251-5, 5.10.257-1 to bullseye-security</li> <li>uploaded versions 6.12.85-1~bpo12+1, 6.12.86-1~bpo12+1, 6.12.88-1~bpo12+1, 6.12.90-1~bpo12+1, 6.12.90-2~bpo12+1 to bookworm-backports</li> <li>uploaded versions 6.19.14-1~bpo13+1, 7.0.10-1~bpo13+1, 7.0.4-1~bpo13+1, 7.0.7-1~bpo13+1, 7.0.9-1~bpo13+1 to trixie-backports</li> </ul> </li> </ul> </li> <li>(LTS) <a href="https://tracker.debian.org/pkg/linux-6.1">linux-6.1</a>: <ul> <li><a href="https://tracker.debian.org/pkg/linux-6.1/news">Uploads</a>: <ul> <li>uploaded versions 6.1.170-1~deb11u1, 6.1.170-3~deb11u1, 6.1.172-1~deb11u1, 6.1.174-1~deb11u1 to bullseye-security</li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/miniramfs">miniramfs</a>: <ul> <li><a href="https://bugs.debian.org/src:miniramfs">Bugs</a>: <ul> <li>replied to <a href="https://bugs.debian.org/1132532">#1132532: miniramfs: Missing cpio dependency</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/nfs-utils">nfs-utils</a>: <ul> <li><a href="https://bugs.debian.org/src:nfs-utils">Bugs</a>: <ul> <li>replied to and closed <a href="https://bugs.debian.org/1138209">#1138209: nfs-kernel-server: Parameter RPCNFSDCOUNT from /etc/default/nfs-kernel-server is ignored after Upgrade from Deb12</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/wireless-regdb">wireless-regdb</a>: <ul> <li><a href="https://tracker.debian.org/pkg/wireless-regdb/news/">Uploads</a>: <ul> <li>uploaded version 2026.03.18-1 to unstable</li> </ul> </li> </ul> </li> </ul> </li> <li>Debian non-package bugs: <ul> <li><a href="https://bugs.debian.org/release.debian.org">release.debian.org</a>: <ul> <li>opened <a href="https://bugs.debian.org/1135902">#1135902: trixie-pu: package initramfs-tools/0.148.4</a></li> </ul> </li> </ul> </li> <li>Mailing lists: <ul> <li><a href="https://lists.debian.org/debian-boot/">debian-boot</a>: <ul> <li>replied to <a href="https://lists.debian.org/0f7a0a1aa33ec586ffa950d784641b0e76e380e9.camel@decadent.org.uk">Please add loong64 to Daily/Weekly builds of installer images</a></li> </ul> </li> <li><a href="https://lists.debian.org/debian-devel/">debian-devel</a>: <ul> <li>replied to <a href="https://lists.debian.org/3fc99c8b98edf120394c75d7b2fa5929c93da0dc.camel@decadent.org.uk">Licensing of licenses</a></li> </ul> </li> <li><a href="https://lists.debian.org/debian-kernel/">debian-kernel</a>: <ul> <li>posted <a href="https://lists.debian.org/8025d9d8faefba5e7f444cdc82e41ca1c12d7377.camel@decadent.org.uk">Agenda items for kernel-team meeting on 2026-05-13</a></li> <li>posted and replied to <a href="https://lists.debian.org/7e451300e9129f9a466548a3d0b771b236e1b36b.camel@debian.org">[RFC] Using SimpleDRM in the initramfs</a></li> <li>replied to <a href="https://lists.debian.org/f1f249b86b6fb7239e43da110f969ab371e1ba56.camel@decadent.org.uk">[bjarniig@simnet.is: kernel-img.conf.5: warning from “lint”]</a></li> </ul> </li> <li><a href="https://lists.debian.org/debian-lts-announce/">debian-lts-announce</a>: <ul> <li>posted <a href="https://lists.debian.org/afW4eRFSiyEj0t5p@decadent.org.uk">[SECURITY] [DLA 4560-1] linux security update</a></li> <li>posted <a href="https://lists.debian.org/afW4k69tKf_WlndL@decadent.org.uk">[SECURITY] [DLA 4561-1] linux-6.1 security update</a></li> <li>posted <a href="https://lists.debian.org/af4wE6d14Ow7_e1z@decadent.org.uk">[SECURITY] [DLA 4572-1] linux security update</a></li> <li>posted <a href="https://lists.debian.org/af9UZejc2VrICvbM@decadent.org.uk">[SECURITY] [DLA 4574-1] linux-6.1 security update</a></li> <li>posted <a href="https://lists.debian.org/aghQTI2_ePQTfgRl@decadent.org.uk">[SECURITY] [DLA 4587-1] linux security update</a></li> <li>posted <a href="https://lists.debian.org/agxj_abMk4ZO7rTj@decadent.org.uk">[SECURITY] [DLA 4588-1] linux-6.1 security update</a></li> <li>posted <a href="https://lists.debian.org/ahnAg039hP_NAYQZ@decadent.org.uk">[SECURITY] [DLA 4606-1] linux security update</a></li> <li>posted <a href="https://lists.debian.org/ahnBQfl3R3-CGOJ0@decadent.org.uk">[SECURITY] [DLA 4607-1] linux-6.1 security update</a></li> </ul> </li> <li><a href="https://lore.kernel.org/linux-hyperv/">linux-hyperv</a>: <ul> <li>posted <a href="https://lore.kernel.org/linux-hyperv/ahQ6xuhSReidmN-3@decadent.org.uk/T/">[PATCH] uio_hv_generic: Bind to FCopy device by default</a></li> </ul> </li> <li><a href="https://lore.kernel.org/linux-perf-users/">linux-perf-users</a>: <ul> <li>posted and replied to <a href="https://lore.kernel.org/linux-perf-users/ag8X7gcDw6jpJsLq@decadent.org.uk/T/">[PATCH 0/3] Fix out-of-tree build of some tools</a></li> </ul> </li> <li><a href="https://lore.kernel.org/linux-sh/">linux-sh</a>: <ul> <li>posted <a href="https://lore.kernel.org/linux-sh/afuJTi1IGCgrK_cc@decadent.org.uk/T/">[PATCH] sh: uaccess: Handle exception on second instruction of __put_user_u64</a></li> </ul> </li> <li><a href="https://lore.kernel.org/linux-trace-kernel/">linux-trace-kernel</a>: <ul> <li>posted <a href="https://lore.kernel.org/linux-trace-kernel/ahMmN4PdsJzr_Va-@decadent.org.uk/T/">[PATCH RESEND] rtla: Fix output files in source tree</a></li> </ul> </li> <li><a href="https://lore.kernel.org/netdev/">netdev</a>: <ul> <li>replied to <a href="https://lore.kernel.org/netdev/811b31f3373526d1ff60160c2f32ddb359e54c31.camel@decadent.org.uk/T/">[PATCH net] net: skbuff: propagate shared-frag marker through pskb_copy()</a></li> </ul> </li> <li>(mostly LTS) <a href="https://lore.kernel.org/stable/">stable</a>: <ul> <li>replied to <a href="https://lore.kernel.org/stable/036ef29e143799f9117792463d640916490fa61a.camel@debian.org/T/">Linux 5.15.205</a></li> <li>posted <a href="https://lore.kernel.org/stable/14797eaf17672917e7c62a679de22f3d1e25edf5.camel@decadent.org.uk/T/">[5.10,5.15] i3c: fix uninitialized variable use in i2c setup</a></li> <li>posted <a href="https://lore.kernel.org/stable/3f2908646639f4af8844cb8f5a9b4d2d4f904631.camel@debian.org/T/">[6.6] fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros</a></li> <li>posted <a href="https://lore.kernel.org/stable/a785911d711bee40be215dad119f9922e014aead.camel@decadent.org.uk/T/">[6.6] net: skbuff: propagate shared-frag marker through frag-transfer helpers</a></li> <li>posted <a href="https://lore.kernel.org/stable/1d128ddf72c7c42d47e1348b9dc74f7f829621fd.camel@debian.org/T/">[6.6] x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function</a></li> <li>posted <a href="https://lore.kernel.org/stable/f84e935e26fdb239b473443efeb925bbfbd5b182.camel@decadent.org.uk/T/">[7.0] perf loongarch: Fix build failure with CONFIG_LIBDW_DWARF_UNWIND</a></li> <li>replied to <a href="https://lore.kernel.org/stable/daa0df3788560bd8759418d9c333e09c45368aa4.camel@decadent.org.uk/T/">[PATCH 5.10 002/589] ASoC: SOF: topology: reject invalid vendor array size in token parser</a></li> <li>replied to <a href="https://lore.kernel.org/stable/56652caf63e8db874a3ebd761ec134c003d4986c.camel@decadent.org.uk/T/">[PATCH 5.10 027/589] xfrm: Wait for RCU readers during policy netns exit</a></li> <li>replied to <a href="https://lore.kernel.org/stable/136f03aa6f51bdfecc786e5278f5fd03b4a6966e.camel@decadent.org.uk/T/">[PATCH 5.10 072/589] media: uvcvideo: Use heuristic to find stream entity</a></li> <li>replied to <a href="https://lore.kernel.org/stable/ca469f4a22fe4688bbf88c355d074ae5be16a621.camel@decadent.org.uk/T/">[PATCH 5.10 095/589] ALSA: usb-audio: fix null pointer dereference on pointer cs_desc</a></li> <li>replied to <a href="https://lore.kernel.org/stable/70620d4eddfa13b0b5333e482bb76d7f4b323114.camel@decadent.org.uk/T/">[PATCH 5.10 096/589] scsi: ufs: core: Improve SCSI abort handling</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahghwxSf9me8PHM4@decadent.org.uk/T/">[PATCH 5.10 1/2] Revert “RDMA/rxe: Fix double free in rxe_srq_from_init”</a></li> <li>replied to <a href="https://lore.kernel.org/stable/866e188244055e8b90d632cb82e2badb40946706.camel@decadent.org.uk/T/">[PATCH 5.10 101/589] rxrpc: Fix key quota calculation for multitoken keys</a></li> <li>replied to <a href="https://lore.kernel.org/stable/b7871589afa5bc3668b07550b9e8b69b3a6c15dd.camel@decadent.org.uk/T/">[PATCH 5.10 114/589] arm64: dts: imx8mq-librem5: Dont mark buck3 as always on</a></li> <li>replied to <a href="https://lore.kernel.org/stable/203134947f42d331eeb0f19c0849802c044103c7.camel@decadent.org.uk/T/">[PATCH 5.10 176/589] KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state</a></li> <li>replied to <a href="https://lore.kernel.org/stable/5903b777c7688dd17f8e4eb173361c80ea0fff46.camel@decadent.org.uk/T/">[PATCH 5.10 177/589] KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2</a></li> <li>posted and replied to <a href="https://lore.kernel.org/stable/bbee79323cd7836164c92229b0b2ed38b5179353.camel@debian.org/T/">[PATCH 5.10 2/2] RDMA/rxe: Fix double free in rxe_srq_from_init</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahhcDsPMJ3Cu3J-E@decadent.org.uk/T/">[PATCH 5.10-5.15] apparmor: validate default DFA states are in bounds</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahg8Ocvb3UFV6Vdl@decadent.org.uk/T/">[PATCH 5.10-6.1] fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahhd83m8AruYGvOc@decadent.org.uk/T/">[PATCH 5.10-6.1] x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function</a></li> <li>replied to <a href="https://lore.kernel.org/stable/ece62fc01497ee5b8bb7e272a0f6474e89c8e7b2.camel@debian.org/T/">[PATCH 5.10] Revert “s390/cio: Fix device lifecycle handling in css_alloc_subchannel()”</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahVuMv5SLjHVUbkt@decadent.org.uk/T/">[PATCH 5.10] Revert “s390/cio: Fix device lifecycle handling in css_alloc_subchannel()”</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahC38RZJN2O3Ur0R@decadent.org.uk/T/">[PATCH 5.10] net: skbuff: preserve shared-frag marker during coalescing</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahC4qNfoeifA-enJ@decadent.org.uk/T/">[PATCH 5.10] net: skbuff: propagate shared-frag marker through frag-transfer helpers</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahg-Lvu0ywzUT9mZ@decadent.org.uk/T/">[PATCH 5.10] phy: renesas: rcar-gen3-usb2: Fix msleep() in atomic context</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahgnK2FarjRafL_J@decadent.org.uk/T/">[PATCH 5.10] selftests: forwarding: lib: Add helpers for checksum handling</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahgiBNbwo7FudH9r@decadent.org.uk/T/">[PATCH 5.15 1/2] Revert “RDMA/rxe: Fix double free in rxe_srq_from_init”</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahgjFad4eiurr6KR@decadent.org.uk/T/">[PATCH 5.15 2/2] RDMA/rxe: Fix double free in rxe_srq_from_init</a></li> <li>replied to <a href="https://lore.kernel.org/stable/a26366c3a1b70db57fc27f2ad4ef4f21185ebc9c.camel@debian.org/T/">[PATCH 5.15.y] net: usb: lan78xx: Fix double free issue with interrupt buffer allocation</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahCyf28nWFO49oDZ@decadent.org.uk/T/">[PATCH 5.15] net: skbuff: propagate shared-frag marker through frag-transfer helpers</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahgn9yc4SFsqMAWq@decadent.org.uk/T/">[PATCH 5.15] selftests: forwarding: lib: Add helpers for checksum handling</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahgjTfDry_UjKgYs@decadent.org.uk/T/">[PATCH 6.1 1/2] Revert “RDMA/rxe: Fix double free in rxe_srq_from_init”</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahgjYxBbXlUjlFUz@decadent.org.uk/T/">[PATCH 6.1 2/2] RDMA/rxe: Fix double free in rxe_srq_from_init</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahhcYci93VUlA_f2@decadent.org.uk/T/">[PATCH 6.1] apparmor: validate default DFA states are in bounds</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahCqJlqexPCiB0P9@decadent.org.uk/T/">[PATCH 6.1] net: skbuff: propagate shared-frag marker through frag-transfer helpers</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahgoDv7vIhnWbeGJ@decadent.org.uk/T/">[PATCH 6.1] selftests: forwarding: lib: Add helpers for checksum handling</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahFmF_XkUzOHBMnC@decadent.org.uk/T/">[PATCH 6.6] net: skbuff: propagate shared-frag marker through frag-transfer helpers</a></li> <li>replied to <a href="https://lore.kernel.org/stable/811b31f3373526d1ff60160c2f32ddb359e54c31.camel@decadent.org.uk/T/">[PATCH net] net: skbuff: propagate shared-frag marker through pskb_copy()</a></li> <li>posted <a href="https://lore.kernel.org/stable/afo6uBv68GDevbMD@decadent.org.uk/T/">[PATCH] parport: Fix race between port and client registration</a></li> </ul> </li> </ul> </li> </ul> 2026-06-02T14:17:21+00:00 Ben Hutchings https://www.decadent.org.uk/ben/blog/2026/06/02/foss-activity-in-2025.html <p>This was a particularly busy month for me in terms of Debian contributions.</p> <p>It started with a week in Hamburg for the MiniDebConf. I talked to many colleagues face-to-face and worked on various bugs and maintenance tasks. I’m pleased to have finally found the time to reproduce and fix the <a href="https://bugs.debian.org/1130365">boot-time crashes in the parallel port subsystem</a> that have been reported many times recently.</p> <p>A series of easily exploited kernel LPE (local privilege execution) issues were published this month, mostly with very little coordination with distributions. Salvatore and I had to upload fixes for these at roughly weekly intervals. All of these fixes needed to be applied to 4 different upstream branches (currently 5.10, 6.1, 6.12, and 7.0) and 7 Debian branches (including backports).</p> <ul> <li>Debian packages: <ul> <li><a href="https://tracker.debian.org/pkg/cis-tools">cis-tools</a>: <ul> <li><a href="https://bugs.debian.org/src:cis-tools">Bugs</a>: <ul> <li>replied to <a href="https://bugs.debian.org/1135267">#1135267: pack_cis should be installed in /usr/bin</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/dracut">dracut</a>: <ul> <li><a href="https://bugs.debian.org/src:dracut">Bugs</a>: <ul> <li>replied to <a href="https://bugs.debian.org/1131809">#1131809: dracut: ppc64el autopkgtest are flaky and take 7 hours per run</a> (and discussed it in-person in Hamburg)</li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/firmware-free">firmware-free</a>: <ul> <li><a href="https://bugs.debian.org/src:firmware-free">Bugs</a>: <ul> <li>closed <a href="https://bugs.debian.org/1122755">#1122755: firmware-free: Please remove/replace usage of dh_movetousr</a></li> </ul> </li> <li>Merge requests: <ul> <li>opened <a href="https://salsa.debian.org/kernel-team/firmware-free/-/merge_requests/11">!11: Apply relevant changes from firmware-nonfree</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/firmware-nonfree">firmware-nonfree</a>: <ul> <li>Merge requests: <ul> <li>closed <a href="https://salsa.debian.org/kernel-team/firmware-nonfree/-/merge_requests/68">!68: Draft: Update bullseye in line with buster</a></li> <li>reviewed and merged <a href="https://salsa.debian.org/kernel-team/firmware-nonfree/-/merge_requests/146">!146: gencontrol: s/initramfs-tools/update-initramfs/</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/firmware-nonfree/-/merge_requests/147">!147: control: stop suggesting initramfs-tools</a></li> <li>opened and merged <a href="https://salsa.debian.org/kernel-team/firmware-nonfree/-/merge_requests/148">!148: Update to 20260519</a></li> <li>opened and merged <a href="https://salsa.debian.org/kernel-team/firmware-nonfree/-/merge_requests/149">!149: Include more firmware in binary packages</a></li> <li>opened <a href="https://salsa.debian.org/kernel-team/firmware-nonfree/-/merge_requests/150">!150: Update and remove obsolete package relations</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/gnome-shell">gnome-shell</a>: <ul> <li><a href="https://bugs.debian.org/src:gnome-shell">Bugs</a>: <ul> <li>replied to and reassigned <a href="https://bugs.debian.org/1135951">#1135951: linux-image-6.12.85+deb13-amd64: secure data is visible when waking from suspsend</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/initramfs-tools">initramfs-tools</a>: <ul> <li><a href="https://bugs.debian.org/src:initramfs-tools">Bugs</a>: <ul> <li>closed <a href="https://bugs.debian.org/1108924">#1108924: initramfs-tools: Cannot boot Trixie d-i rc2 USB storage target riscv64 MODULES=most (missing: cdns3 cdns3_starfive)</a></li> </ul> </li> <li>Merge requests: <ul> <li>reviewed <a href="https://salsa.debian.org/kernel-team/initramfs-tools/-/merge_requests/142">!142: Handle simple-framebuffer drivers and framebuffer_coreboot built as modules</a></li> <li>closed <a href="https://salsa.debian.org/kernel-team/initramfs-tools/-/merge_requests/150">!150: Do not install ARM/RISCV specific modules on other architectures</a></li> <li>closed <a href="https://salsa.debian.org/kernel-team/initramfs-tools/-/merge_requests/173">!173: Draft: Introduce copy_file helper program to replace copy_file function</a></li> <li>opened and merged <a href="https://salsa.debian.org/kernel-team/initramfs-tools/-/merge_requests/195">!195: unmkinitramfs: Make it compatible with Busybox cpio</a></li> <li>reviewed <a href="https://salsa.debian.org/kernel-team/initramfs-tools/-/merge_requests/196">!196: add module to add fw files from DT firmware-name properties</a></li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/initramfs-tools/news/">Uploads</a>: <ul> <li>uploaded version 0.148.4 to trixie</li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/ktls-utils">ktls-utils</a>: <ul> <li>Merge requests: <ul> <li>merged <a href="https://salsa.debian.org/kernel-team/ktls-utils/-/merge_requests/5">!5: Update to 1.4.0</a></li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/ktls-utils/news/">Uploads</a>: <ul> <li>uploaded version 1.4.0-1 to unstable</li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/linux">linux</a>: <ul> <li><a href="https://bugs.debian.org/src:linux">Bugs</a>: <ul> <li>replied to <a href="https://bugs.debian.org/1130365">#1130365: linux-image-6.18.15+deb14-amd64: kernel panic during startup</a></li> <li>replied to <a href="https://bugs.debian.org/1136800">#1136800: linux-image-7.0.4+deb14-amd64: fails to boot</a></li> <li>replied to <a href="https://bugs.debian.org/1136894">#1136894: linux-image-7.0.4+deb14-amd64: Kernel Panic - AMDGPU crash</a></li> <li>replied to <a href="https://bugs.debian.org/1136978">#1136978: linux-image-7.0.4+deb14-amd64: kernel NULL pointer dereference</a></li> <li>replied to and closed <a href="https://bugs.debian.org/1137202">#1137202: linux-image-7.1-amd64: Kernel panic on boot</a></li> <li>replied to <a href="https://bugs.debian.org/1137203">#1137203: bnx2: ifupdown-hotplug fails at boot, no network, regression from 5.10.0-42</a></li> <li>replied to <a href="https://bugs.debian.org/1137642">#1137642: linux-image-7.0.7+deb13-amd64: Failed to load Bluetooth driver</a></li> </ul> </li> <li>Merge requests: <ul> <li>closed <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1720">!1720: arm64: Enable Renesas RZ/G2L features</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1759">!1759: [arm64] Enable AIR_EN8811H_PHY as module</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1792">!1792: [arm64] Enable BST platform support</a></li> <li>closed <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1817">!1817: [sparc64] Add patches to fix user stack sync and add clone3() syscall</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1837">!1837: [arm64] Enable configs for Qualcomm RB1 boards</a></li> <li>reviewed <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1845">!1845: [amd64,arm64] Enable KEXEC_HANDOVER and LIVEUPDATE</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1878">!1878: [riscv64] Enable CMA and DMA_CMA. Set CMA_SIZE_MBYTES=64</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1884">!1884: [amd64] Enable Intel USBIO bridge driver and submodules</a></li> <li>opened <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1904">!1904: Improve package descriptions for most of the kernel packages</a></li> <li>reviewed and merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1906">!1906: Enable SND_SOC_SDCA_CLASS and SND_SOC_SDCA_{FDL, HID, IRQ} for Panther Lake audio support</a></li> <li>opened and merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1910">!1910: Add backported patches for Dirty Frag attack</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1911">!1911: Qualcomm Monaco and Talos support</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1913">!1913: d/watch: migrate to version 5</a></li> <li>reviewed <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1936">!1936: [sparc64] Add nvme module to scsi-modules udeb</a></li> <li>reviewed <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1948">!1948: [amd64] Enable Intel Platform Hardware Support Drivers</a></li> <li>opened and merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1951">!1951: Fix dirtying of the source tree when building tools</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1954">!1954: 7.0 backport ‘Fix for “fragnesia” (CVE-2026-46300) and variants’</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1955">!1955: 6.12 backport ‘Fix for “fragnesia” (CVE-2026-46300) and variants’</a></li> <li>opened <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1956">!1956: Draft: Enable a fully parallel build</a></li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/linux/news/">Uploads</a>: <ul> <li>(LTS) uploaded versions 5.10.251-2, 5.10.251-3, 5.10.251-4, 5.10.251-5, 5.10.257-1 to bullseye-security</li> <li>uploaded versions 6.12.85-1~bpo12+1, 6.12.86-1~bpo12+1, 6.12.88-1~bpo12+1, 6.12.90-1~bpo12+1, 6.12.90-2~bpo12+1 to bookworm-backports</li> <li>uploaded versions 6.19.14-1~bpo13+1, 7.0.10-1~bpo13+1, 7.0.4-1~bpo13+1, 7.0.7-1~bpo13+1, 7.0.9-1~bpo13+1 to trixie-backports</li> </ul> </li> </ul> </li> <li>(LTS) <a href="https://tracker.debian.org/pkg/linux-6.1">linux-6.1</a>: <ul> <li><a href="https://tracker.debian.org/pkg/linux-6.1/news">Uploads</a>: <ul> <li>uploaded versions 6.1.170-1~deb11u1, 6.1.170-3~deb11u1, 6.1.172-1~deb11u1, 6.1.174-1~deb11u1 to bullseye-security</li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/miniramfs">miniramfs</a>: <ul> <li><a href="https://bugs.debian.org/src:miniramfs">Bugs</a>: <ul> <li>replied to <a href="https://bugs.debian.org/1132532">#1132532: miniramfs: Missing cpio dependency</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/nfs-utils">nfs-utils</a>: <ul> <li><a href="https://bugs.debian.org/src:nfs-utils">Bugs</a>: <ul> <li>replied to and closed <a href="https://bugs.debian.org/1138209">#1138209: nfs-kernel-server: Parameter RPCNFSDCOUNT from /etc/default/nfs-kernel-server is ignored after Upgrade from Deb12</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/wireless-regdb">wireless-regdb</a>: <ul> <li><a href="https://tracker.debian.org/pkg/wireless-regdb/news/">Uploads</a>: <ul> <li>uploaded version 2026.03.18-1 to unstable</li> </ul> </li> </ul> </li> </ul> </li> <li>Debian non-package bugs: <ul> <li><a href="https://bugs.debian.org/release.debian.org">release.debian.org</a>: <ul> <li>opened <a href="https://bugs.debian.org/1135902">#1135902: trixie-pu: package initramfs-tools/0.148.4</a></li> </ul> </li> </ul> </li> <li>Mailing lists: <ul> <li><a href="https://lists.debian.org/debian-boot/">debian-boot</a>: <ul> <li>replied to <a href="https://lists.debian.org/0f7a0a1aa33ec586ffa950d784641b0e76e380e9.camel@decadent.org.uk">Please add loong64 to Daily/Weekly builds of installer images</a></li> </ul> </li> <li><a href="https://lists.debian.org/debian-devel/">debian-devel</a>: <ul> <li>replied to <a href="https://lists.debian.org/3fc99c8b98edf120394c75d7b2fa5929c93da0dc.camel@decadent.org.uk">Licensing of licenses</a></li> </ul> </li> <li><a href="https://lists.debian.org/debian-kernel/">debian-kernel</a>: <ul> <li>posted <a href="https://lists.debian.org/8025d9d8faefba5e7f444cdc82e41ca1c12d7377.camel@decadent.org.uk">Agenda items for kernel-team meeting on 2026-05-13</a></li> <li>posted and replied to <a href="https://lists.debian.org/7e451300e9129f9a466548a3d0b771b236e1b36b.camel@debian.org">[RFC] Using SimpleDRM in the initramfs</a></li> <li>replied to <a href="https://lists.debian.org/f1f249b86b6fb7239e43da110f969ab371e1ba56.camel@decadent.org.uk">[bjarniig@simnet.is: kernel-img.conf.5: warning from “lint”]</a></li> </ul> </li> <li><a href="https://lists.debian.org/debian-lts-announce/">debian-lts-announce</a>: <ul> <li>posted <a href="https://lists.debian.org/afW4eRFSiyEj0t5p@decadent.org.uk">[SECURITY] [DLA 4560-1] linux security update</a></li> <li>posted <a href="https://lists.debian.org/afW4k69tKf_WlndL@decadent.org.uk">[SECURITY] [DLA 4561-1] linux-6.1 security update</a></li> <li>posted <a href="https://lists.debian.org/af4wE6d14Ow7_e1z@decadent.org.uk">[SECURITY] [DLA 4572-1] linux security update</a></li> <li>posted <a href="https://lists.debian.org/af9UZejc2VrICvbM@decadent.org.uk">[SECURITY] [DLA 4574-1] linux-6.1 security update</a></li> <li>posted <a href="https://lists.debian.org/aghQTI2_ePQTfgRl@decadent.org.uk">[SECURITY] [DLA 4587-1] linux security update</a></li> <li>posted <a href="https://lists.debian.org/agxj_abMk4ZO7rTj@decadent.org.uk">[SECURITY] [DLA 4588-1] linux-6.1 security update</a></li> <li>posted <a href="https://lists.debian.org/ahnAg039hP_NAYQZ@decadent.org.uk">[SECURITY] [DLA 4606-1] linux security update</a></li> <li>posted <a href="https://lists.debian.org/ahnBQfl3R3-CGOJ0@decadent.org.uk">[SECURITY] [DLA 4607-1] linux-6.1 security update</a></li> </ul> </li> <li><a href="https://lore.kernel.org/linux-hyperv/">linux-hyperv</a>: <ul> <li>posted <a href="https://lore.kernel.org/linux-hyperv/ahQ6xuhSReidmN-3@decadent.org.uk/T/">[PATCH] uio_hv_generic: Bind to FCopy device by default</a></li> </ul> </li> <li><a href="https://lore.kernel.org/linux-perf-users/">linux-perf-users</a>: <ul> <li>posted and replied to <a href="https://lore.kernel.org/linux-perf-users/ag8X7gcDw6jpJsLq@decadent.org.uk/T/">[PATCH 0/3] Fix out-of-tree build of some tools</a></li> </ul> </li> <li><a href="https://lore.kernel.org/linux-sh/">linux-sh</a>: <ul> <li>posted <a href="https://lore.kernel.org/linux-sh/afuJTi1IGCgrK_cc@decadent.org.uk/T/">[PATCH] sh: uaccess: Handle exception on second instruction of __put_user_u64</a></li> </ul> </li> <li><a href="https://lore.kernel.org/linux-trace-kernel/">linux-trace-kernel</a>: <ul> <li>posted <a href="https://lore.kernel.org/linux-trace-kernel/ahMmN4PdsJzr_Va-@decadent.org.uk/T/">[PATCH RESEND] rtla: Fix output files in source tree</a></li> </ul> </li> <li><a href="https://lore.kernel.org/netdev/">netdev</a>: <ul> <li>replied to <a href="https://lore.kernel.org/netdev/811b31f3373526d1ff60160c2f32ddb359e54c31.camel@decadent.org.uk/T/">[PATCH net] net: skbuff: propagate shared-frag marker through pskb_copy()</a></li> </ul> </li> <li>(mostly LTS) <a href="https://lore.kernel.org/stable/">stable</a>: <ul> <li>replied to <a href="https://lore.kernel.org/stable/036ef29e143799f9117792463d640916490fa61a.camel@debian.org/T/">Linux 5.15.205</a></li> <li>posted <a href="https://lore.kernel.org/stable/14797eaf17672917e7c62a679de22f3d1e25edf5.camel@decadent.org.uk/T/">[5.10,5.15] i3c: fix uninitialized variable use in i2c setup</a></li> <li>posted <a href="https://lore.kernel.org/stable/3f2908646639f4af8844cb8f5a9b4d2d4f904631.camel@debian.org/T/">[6.6] fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros</a></li> <li>posted <a href="https://lore.kernel.org/stable/a785911d711bee40be215dad119f9922e014aead.camel@decadent.org.uk/T/">[6.6] net: skbuff: propagate shared-frag marker through frag-transfer helpers</a></li> <li>posted <a href="https://lore.kernel.org/stable/1d128ddf72c7c42d47e1348b9dc74f7f829621fd.camel@debian.org/T/">[6.6] x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function</a></li> <li>posted <a href="https://lore.kernel.org/stable/f84e935e26fdb239b473443efeb925bbfbd5b182.camel@decadent.org.uk/T/">[7.0] perf loongarch: Fix build failure with CONFIG_LIBDW_DWARF_UNWIND</a></li> <li>replied to <a href="https://lore.kernel.org/stable/daa0df3788560bd8759418d9c333e09c45368aa4.camel@decadent.org.uk/T/">[PATCH 5.10 002/589] ASoC: SOF: topology: reject invalid vendor array size in token parser</a></li> <li>replied to <a href="https://lore.kernel.org/stable/56652caf63e8db874a3ebd761ec134c003d4986c.camel@decadent.org.uk/T/">[PATCH 5.10 027/589] xfrm: Wait for RCU readers during policy netns exit</a></li> <li>replied to <a href="https://lore.kernel.org/stable/136f03aa6f51bdfecc786e5278f5fd03b4a6966e.camel@decadent.org.uk/T/">[PATCH 5.10 072/589] media: uvcvideo: Use heuristic to find stream entity</a></li> <li>replied to <a href="https://lore.kernel.org/stable/ca469f4a22fe4688bbf88c355d074ae5be16a621.camel@decadent.org.uk/T/">[PATCH 5.10 095/589] ALSA: usb-audio: fix null pointer dereference on pointer cs_desc</a></li> <li>replied to <a href="https://lore.kernel.org/stable/70620d4eddfa13b0b5333e482bb76d7f4b323114.camel@decadent.org.uk/T/">[PATCH 5.10 096/589] scsi: ufs: core: Improve SCSI abort handling</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahghwxSf9me8PHM4@decadent.org.uk/T/">[PATCH 5.10 1/2] Revert “RDMA/rxe: Fix double free in rxe_srq_from_init”</a></li> <li>replied to <a href="https://lore.kernel.org/stable/866e188244055e8b90d632cb82e2badb40946706.camel@decadent.org.uk/T/">[PATCH 5.10 101/589] rxrpc: Fix key quota calculation for multitoken keys</a></li> <li>replied to <a href="https://lore.kernel.org/stable/b7871589afa5bc3668b07550b9e8b69b3a6c15dd.camel@decadent.org.uk/T/">[PATCH 5.10 114/589] arm64: dts: imx8mq-librem5: Dont mark buck3 as always on</a></li> <li>replied to <a href="https://lore.kernel.org/stable/203134947f42d331eeb0f19c0849802c044103c7.camel@decadent.org.uk/T/">[PATCH 5.10 176/589] KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state</a></li> <li>replied to <a href="https://lore.kernel.org/stable/5903b777c7688dd17f8e4eb173361c80ea0fff46.camel@decadent.org.uk/T/">[PATCH 5.10 177/589] KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2</a></li> <li>posted and replied to <a href="https://lore.kernel.org/stable/bbee79323cd7836164c92229b0b2ed38b5179353.camel@debian.org/T/">[PATCH 5.10 2/2] RDMA/rxe: Fix double free in rxe_srq_from_init</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahhcDsPMJ3Cu3J-E@decadent.org.uk/T/">[PATCH 5.10-5.15] apparmor: validate default DFA states are in bounds</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahg8Ocvb3UFV6Vdl@decadent.org.uk/T/">[PATCH 5.10-6.1] fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahhd83m8AruYGvOc@decadent.org.uk/T/">[PATCH 5.10-6.1] x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function</a></li> <li>replied to <a href="https://lore.kernel.org/stable/ece62fc01497ee5b8bb7e272a0f6474e89c8e7b2.camel@debian.org/T/">[PATCH 5.10] Revert “s390/cio: Fix device lifecycle handling in css_alloc_subchannel()”</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahVuMv5SLjHVUbkt@decadent.org.uk/T/">[PATCH 5.10] Revert “s390/cio: Fix device lifecycle handling in css_alloc_subchannel()”</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahC38RZJN2O3Ur0R@decadent.org.uk/T/">[PATCH 5.10] net: skbuff: preserve shared-frag marker during coalescing</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahC4qNfoeifA-enJ@decadent.org.uk/T/">[PATCH 5.10] net: skbuff: propagate shared-frag marker through frag-transfer helpers</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahg-Lvu0ywzUT9mZ@decadent.org.uk/T/">[PATCH 5.10] phy: renesas: rcar-gen3-usb2: Fix msleep() in atomic context</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahgnK2FarjRafL_J@decadent.org.uk/T/">[PATCH 5.10] selftests: forwarding: lib: Add helpers for checksum handling</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahgiBNbwo7FudH9r@decadent.org.uk/T/">[PATCH 5.15 1/2] Revert “RDMA/rxe: Fix double free in rxe_srq_from_init”</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahgjFad4eiurr6KR@decadent.org.uk/T/">[PATCH 5.15 2/2] RDMA/rxe: Fix double free in rxe_srq_from_init</a></li> <li>replied to <a href="https://lore.kernel.org/stable/a26366c3a1b70db57fc27f2ad4ef4f21185ebc9c.camel@debian.org/T/">[PATCH 5.15.y] net: usb: lan78xx: Fix double free issue with interrupt buffer allocation</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahCyf28nWFO49oDZ@decadent.org.uk/T/">[PATCH 5.15] net: skbuff: propagate shared-frag marker through frag-transfer helpers</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahgn9yc4SFsqMAWq@decadent.org.uk/T/">[PATCH 5.15] selftests: forwarding: lib: Add helpers for checksum handling</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahgjTfDry_UjKgYs@decadent.org.uk/T/">[PATCH 6.1 1/2] Revert “RDMA/rxe: Fix double free in rxe_srq_from_init”</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahgjYxBbXlUjlFUz@decadent.org.uk/T/">[PATCH 6.1 2/2] RDMA/rxe: Fix double free in rxe_srq_from_init</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahhcYci93VUlA_f2@decadent.org.uk/T/">[PATCH 6.1] apparmor: validate default DFA states are in bounds</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahCqJlqexPCiB0P9@decadent.org.uk/T/">[PATCH 6.1] net: skbuff: propagate shared-frag marker through frag-transfer helpers</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahgoDv7vIhnWbeGJ@decadent.org.uk/T/">[PATCH 6.1] selftests: forwarding: lib: Add helpers for checksum handling</a></li> <li>posted <a href="https://lore.kernel.org/stable/ahFmF_XkUzOHBMnC@decadent.org.uk/T/">[PATCH 6.6] net: skbuff: propagate shared-frag marker through frag-transfer helpers</a></li> <li>replied to <a href="https://lore.kernel.org/stable/811b31f3373526d1ff60160c2f32ddb359e54c31.camel@decadent.org.uk/T/">[PATCH net] net: skbuff: propagate shared-frag marker through pskb_copy()</a></li> <li>posted <a href="https://lore.kernel.org/stable/afo6uBv68GDevbMD@decadent.org.uk/T/">[PATCH] parport: Fix race between port and client registration</a></li> </ul> </li> </ul> </li> </ul> 2026-06-02T14:17:21+00:00 Ben Hutchings https://jmtd.net/log/nvim-µwiki/ <p>In January 2025, as a pre-requisite for something else, I published a minimal <a href="https://jmtd.net/log/neovim/">neovim</a> plugin called <a href="https://github.com/jmtd/nvim-microwiki">nvim-µwiki</a>. It's essentially just the features from <a href="https://jmtd.net/log/vimwiki/">vimwiki</a> that I regularly use, which is a small fraction them. I forgot to blog about it. I recently dusted it off and cleaned it up. You can find it here, along with a longer list of its features and how to configure it: <a href="https://github.com/jmtd/nvim-microwiki">https://github.com/jmtd/nvim-microwiki</a></p> <p>I had a couple of design goals. I didn't want to define a new <code>filetype</code>, so this is designed to work with the existing markdown one. I'm using neovim, so I wanted to leverage some of its features: this plugin is written in <a href="https://jmtd.net/lua/">Lua</a>, rather than vimscript. I use the parse trees provided by <a href="https://neovim.io/doc/user/treesitter.html">TreeSitter</a> to navigate the structure of a document. I also decided to "plug into" the existing tag stack navigation, rather than define another dimension of navigation (along with buffers, etc.) to track: Following a wiki-link pushes onto the tag stack, just as if you followed a tag.</p> <p>This was my first serious bit of <a href="https://jmtd.net/lua/">Lua</a> programming, as well as my first dive into neovim (or even vim) internals. <a href="https://jmtd.net/lua/">Lua</a> is quite reasonable. Most of the vim and neovim architecture is reasonable. The emerging conventions about structuring neovim plugins are mostly reasonable. TreeSitter is, well, interesting, but the devil is very much in the details. Somehow all together the experience for me was largely just frustrating, and I didn't really enjoy writing it.</p> 2026-05-28T08:48:46+00:00 jmtd