Friday, 19 June
17:35
[$] Suspending and resuming BPF programs [LWN.net]
BPF programs can be used to extend many aspects the Linux kernel, but BPF programs must run to completion in the same context that they began. Kumar Kartikeya Dwivedi is working on changing that by allowing BPF programs to be expressed as coroutines. He spoke about his work at the 2026 Linux Storage, Filesystem, Memory-Management and BPF Summit. While still experimental, the change promises to make long-running BPF tasks significantly easier to write.
Apple TV is incredibly weird stuff. It doesn't have a super deep roster, but it has a weirdly high ratio of absolutely must watch shit. I got some free Apple TV when I got an iPad a few Christmases ago, and ended up hooked on For All Mankind - then let it lapse, and now my three favorite shows are all from there. It goes Severance, Pluribus, and now Widow's Bay. They don't seem to be able to produce on any kind of schedule, but then, I don't think they're even trying to. This is exactly what a modern leviathan should be doing with its bulging coffers. As a young man, I was told that Campbell's Chunky Soup was said to eat like a meal. These are shows that watch like books, that benefit very clearly from study.
17:07
Reproducible Builds (diffoscope): diffoscope 320 released [Planet Debian]
The diffoscope maintainers are pleased to announce the release
of diffoscope version 320. This version
includes the following changes:
[ Chris Lamb ]
* Support androguard 4 and previous versions. Thanks, linsui!
(Closes: #1140016)
* Use --long-form arguments when calling apktool in order to support apktool
version 3. Thanks again to linsui. (Closes: #1140015)
* Update copyright years.
You find out more by visiting the project homepage.
16:07
[$] AURpocalypse now: a look at the recent AUR attacks [LWN.net]
The Arch User Repository (AUR) has been subjected to a sustained attack recently. The attacker, or attackers, have spun up a series of new accounts then used them to adopt orphaned packages and push malicious updates that would install malware on users' systems. It is unclear how many users were compromised in the attack, but the maintainers were playing Whac-A-Mole for several days to respond to each newly compromised package. The project has turned off the AUR's new-user registration, for now, but it is unclear what its long-term response will be or if the AUR can be secured without major changes to its existing collaboration model.
15:14
The WordPress community likes to say that WordPress powers a
certain
percentage of the web. This always bothered me, couldn't figure
out why, until just now. WordPress is part of the web,
that's the nature of the web. There should be no difference between
how you connect via UI or API to writing on WordPress and any other
text system, such as Bluesky or Twitter. No. Difference. Then the
user always has choice. Put together your favorite writing
environment. Mix and match. Every part is replaceable. That's the
idea of the web, and before that PCs and Macs. Instead we've got
silos. And WordPress should be the one that says the web is here
for all of us and WordPress is a big part of the web, but even the
smallest part in terms of users has huge value. And could be a
competitor of ours someday. We won't do anything to get in the way
of that because the most important people in our world are the
users. The really cool thing about it is that the product is set up
exactly this way. If every text product cloned their API, we'd have
the nirvana that the web promises. We are technically sooooo
close.
14:35
Security updates for Friday [LWN.net]
Security updates have been issued by AlmaLinux (dracut), Debian (chromium, firefox-esr, and thunderbird), Fedora (chromium, firefox, nss, ocserv, ongres-scram, ongres-stringprep, perl-Archive-Tar, perl-GD, perl-HTTP-Daemon, perl-Net-Statsd, restic, singularity-ce, util-linux, and vorbis-tools), Mageia (gstreamer1.0-*, libupnp, luajit, opensc, and ruby-rack), SUSE (curl, dnsmasq, ffmpeg-4, frr, google-osconfig-agent, java-1_8_0-ibm, kernel, krb5, kubernetes-old, ldns, liburiparser1, openvswitch, rootlesskit, strongswan, traefik, and trivy), and Ubuntu (ldns, libheif, libnet-cidr-lite-perl, lxd, tomcat11, and vim).
14:28
Today's song: "You who choose to lead must follow. "
I rarely ask my Echo to play a song, because after it plays it wants to know if I want to hear a notice. And there goes the buzz from having listened to one of my favorite songs that perfectly catches the moment.
Whoopi Goldberg says the Knicks should visit the White House. "I want all those black men to stand in our house and remind all of those people — as we try to remind the vice president — that when you try to destroy one part of history, you're destroying all of our history." So true.
When did the Knicks turn the corner? [Scripting News]
I've been trying to understand what the Knicks winning means
to me. I'm reminded of the feeling when we sold my mother's house,
the house I grew up in, the one my father had died in nine years
earier. The site of every battle and come-from-behind victory (I
graduated college, they couldn't believe it, for example). Was that
day in February 2018 when the fortunes of the Knicks turned?
It wasn't just a victory in the NBA playoffs of 2026, it was a pile of victories and setbacks over quite a few years, in a world where people really do make deals instead of pretending they do. And the Knicks all of a sudden were aimed at winning the top prize. The only reason, theoretically, we play basketball, is so every year all the greatest players and managers compete for who's the best that year. The 2026 Knicks didn't pop up from nowhere, they were carefully curated in a bootstrap that answered the question "If the Knicks were champions, what would they do?"
So now the next challenge for the team is to repeat. They will trade players, maybe even one of the ones we love the most. This version of the Knicks is a point in time. Things are already in motion behind the scenes, for sure.
So, again, when did the corner turn? When did the Knicks start the journey that would end at City Hall yesterday? I think it was Linsanity in 2011. That's when we got a tiny glimpse of what's possible. That short period is why I got involved in the Knicks again, after hating them for not being willing to letting Linsanity play out, so we could find out where it led.
When you're doing a bootstrap and one of your interations takes off like that, you don't take the feature out, you try building all around it, above, underneath or adjacent. This version of the Knicks gets that. And why it's of greater significance, it's exactly the approach our species desperately needs to take. Not just New York, not just the United States, and not just one sport -- everything. It's a model for the corner we must turn to survive and thrive.
14:00
Wouter Verhelst: Agentic coding and Free Software [Planet Debian]
Through work, I have paid license to windsurf (recently renamed to "devin"), an application for LLM-based (aka, "Agentic") development.
I hadn't been using it that much, but in an effort to more clearly understand how this whole AI development thing works, I decided to give it a closer look recently.
My conclusions:
In its current form, this whole LLM wave is problematic for multiple reasons. But ignoring that, and looking at the technology only, I can say that:
- it is a paradigm shift;
- it is, at the technological level, a positive evolution;
- and it is a threat to free software.
Problems
Lest someone (incorrectly) assume that I am arguing in favour of the current state of affairs with regards to LLMs, let me state this first.
The way LLMs are built today is highly parasitic. Websites are downloaded in whole, at unsustainable rates, regardless of the consent of the people who made the original content. The result is predictable: servers get overloaded, server administrators attempt to implement various mitigations. Some of these mitigations work; some do, for a while; some are entirely useless. In actual fact, the mitigations are an arms race -- if too many people implement the same mitigation, then the people who try to build yet another LLM so they can extract rent will just try to work around the mitigation, eventually they will succeed, and you'll just have to come up with another mitigation. It's a bit like spam; you introduce regex-based spam filters, they introduce spelling mistakes, you introduce bayesian filters, they add a large batch of markov chain-generated semi-nonsense words made invisible by markup, you add filters to block emails with such markup, they move the text into an image. We have working mitigations today, but eventually we'll run out of ideas.
LLMs glob up everything they can while ignoring the license of the source material. The people who push those LLMs claim that pushing the source material through the machine learning algorithms makes the output of the algorithm distinct enough from the source material that the license no longer applies; I'm not so sure that this is true. I guess the New York Times v OpenAI lawsuit will teach us some of the answer to that question here, but even so the ethical questions about "is it OK to bring down another server just so we can download the internet for another for-pay LLM" are still open. And regardless of what the law states, my opinion on "you're using my copyleft code to generate code under a different license" is not something you might like if you agree with the rent seekers' opinion on the subject.
That all being said and true, the technology works. You can have a "conversation" with an LLM that resembles a human one. If you pass it some data, you can use plain english to ask it questions about that data, which is a lot easier than to ask it about that in a formal way. You can request it to generate some code, and it will generate something that looks like what you need and that will be mostly correct for like 95% of the time.
Now, yes, 95% of the time is not 100% of the time, and no, you can't ask it to "write me a piece of software that implements this 300-page requirements document and get back to me when you're done", because it will fail, and you won't know where it has failed, and you'll take it into production and expect everything to be fine because it won't and this one minor logic bug will cause half your servers to spin and consume credits with your infrastructure provider with nothing to show for it.
But that doesn't mean you can't use an LLM to build a large piece of software. It just means you have to understand the LLMs limitations and strenghts, and use them correctly.
Here's what an LLM is good at:
- Generating plausible text
- Interpreting text to figure out what a plausible meaning or summary of that text is
- Giving vague indications as to what the probable context of a given body of text is.
It turns out that that's enough to use the LLM to build a reliable piece of software, provided you do it right.
Paradigm shift
An LLM can generate text by the truckful. The generated text could be code. Given a good enough LLM, the generated text might even run and do something useful.
You can try to blindly run the code, and if it doesn't run correctly, you can paste the error message to the LLM, and it can tell you what went wrong and how you could possibly fix it. This creates a feedback loop: you ask it for an amount of code, you run the code, you receive an error, you tell it that the code is problematic and give it the error message, it makes changes to the code, now you have something that at least no longer fails at startup.
If you ask it to add tests to make sure that your code acts as per your specification, now you get an error if and when the code doesn't act as per your specification. Or, well, at least not as per the part of the specification that was correctly turned into a unit test by the LLM.
LLMs have a context window, so if the error message is pasted in the same conversation as where the code was generated, it is able to reuse the earlier prompts to refine how it should interpret the error message that you received.
You can't really paste the source code of an entire application into the prompt of your LLM, that would quickly overrun its context window. But LLMs also allow you to provide some form of background information -- a document, say -- on which you ask it to reason. It will interpret that document, but doing so uses less of the LLMs context window. So providing the LLM with your application's source code as background information can help it understand better how your code interacts. This is especially helpful if you only provide the LLM the background information relevant to the actual question.
So now if you are able to:
- Create background context with your application's source code
- Have the LLM generate a first draft of your requested change, plus the tests to make sure it works
- Compile (if applicable) the generated code (and tests) and run said tests
- Return any error messages to the LLM with a request to correct the error
Then the combination of "getting it 95% right off the bat" and the above feedback loop means you can generate syntactically correct code, that probably does what you need, in minutes.
I say "probably" for a reason. There are going to be cases where you specify a request without a number of details (because they are implied), and the LLM will get most of those details right but just not implement the one bit because it's an automaton and it doesn't think. Or you will ask it to make sure that two bits of the application look exactly the same, without specifying that they must act the same, now and in the future, and it will just generate the same block of code twice and then in a future change it will change one but not the other.
But if you review the changes, and you have experience as a programmer, you will be able to spot most cases where the LLM got it wrong. And so it's possible, if not necessarily easy at first, to use an LLM to generate mostly correct code.
There are certain places where "mostly correct" code is not desireable. But equally, there are also cases where, "mostly correct" is good enough.
After all, most of the software you run today -- the bits of it that weren't, yet, generated by an LLM -- is only "mostly correct", too, because to err is human and we all make mistakes. If not, there wouldn't be any CVEs and your software would never do anything wrong.
Now, doing the feedback loop described above is certainly something you could do manually. You could open an account on one of the LLM websites, upload the source code of your application, ask it to generate some new feature, download the newly generated feature, run it, and then copy/paste any error messages back into the LLM.
But that's a lot of manual work of the type that computers are pretty good at. So that's what the "windsurf" tool helps you with: you run it inside your IDE -- either a VSCode-based tool that you download from their website which comes with their product preinstalled, or a separate JetBrains plugin that you can install. You can then open your entire relevant codebase in a workspace in your IDE. You then ask the LLM, through the IDE, to generate a new feature in your codebase, and to also generate the test while it's at it. It will use a mixture of LLM interpretation and non-LLM functionality to scoop out the relevant bits of your codebase to send to the LLM as background information, will send it your prompt, will download the generated code and patch or create files, will compile (if required) and run the newly generated code and tests, and will refine the generated code if the tests produce any errors. All mostly automatic; by default, running anything requires explicit confirmation. You can turn that off completely (probably not a good idea), or you can give it a whitelist of things that you don't want to confirm (perhaps OK), and the tool also passes standing instructions to the LLM to never generate any command that deletes a file (which, like with any LLM, can be overridden, but it requires you to be very stubborn and to use more credits than you'd probably like).
All this put together means you can build something without writing any piece of code, provided you do it right.
A technically positive evolution
Don't go and say, "here's a 300-page document, read it and write whatever the document says". It will get it wrong, it will write a massive test suite that it will only run at the end, it will choke itself up trying to interpret the massive amount of failures it encounters, it will fill up its context window and it will start to forget some of the requirements. That won't work.
But what you can do -- what I did, in fact -- is this.
First, create an empty workspace. Don't put any code in it.
Then, tell the LLM to generate a backend framework using technology X and a frontend framework using technology Y that initially only says "hello, world". Also add tests to it, and run the tests.
It will do that. You'll not get much, but it will work.
Then, ask it to add some UI elements. A login page, perhaps. A navigation bar. Small things. Most of it doesn't have to be functional -- but tests must be there for the bits that are, and have it run the tests and evaluate the results.
Rinse, repeat, until you have a working application.
Importantly, in between the steps, you should also run the
application yourself and see if the change was implemented
correctly. Sometimes it won't be. Sometimes there will be a subtle
bug -- I at one point had a the application hang after a few
minutes. Sometimes you tell it that there's a subtle bug, and it
will discover it more quickly than you could, and it will fix it,
and in implementing the fix it will uncover another bug,
and then you have to fix that one -- the fix it came up with for
the hang was to move something to an async process on the server,
which caused the application to start spinning while trying to
create hundreds of async jobs (this is when I realized that the
hang was a deadlock due to some part of the codebase doing
something that indirectly triggered itself). Sometimes it will try
to fix the bug you tell it about, and you'll see that it's going
off on a tangent that has nothing to do with what you're seeing.
It's important to keep an eye on what it's doing, so you can guide
it back on track when that happens -- when I told it about the
hang, it started investigating the part of the code which sends out
emails, thinking that it could hang while waiting for
sendmail to finish, but the hang was happening when
the application was idle, not when it was sending out
emails, and only when I told it about it happening when it was idle
did it find the deadlock.
So it's not a fully automatic process, and it needs to be guided by someone who knows what they're doing. But if that is the case, you can come up with something that works. I spent evenings and breaks for about a week, and I managed to create a working application which, had I written it by hand, would have taken me a few months of full-time work to come up with. And I now have a side project, fully complete and working, that I had been thinking about doing for more than a decade, but never got around to actually doing, because of all the work that would be involved and I just didn't see myself having the time for.
It's not perfect code. But it's mostly good enough, and it will perform the job it needs to. And it looks far slicker than most of the side projects I've done in the past, because in the past I would prioritize between implementing new features or making something look slick, and I would decide that the new feature was more important because it's only for me and there's only me and nobody cares if it looks good or not and I don't have three weeks to come up with something that looks better. But here, I found myself sometimes spending 10 minutes writing a prompt with instructions on making things look better. Because what's 10 minutes when you just spent an hour writing down and refining specifications for functionality and tests?
There are a number of other things in which an LLM can help a programmer.
For instance.
I received a bug report recently in a project I'm paid to maintain that I couldn't make heads or tails of. I opened the source code in my windsurf IDE, pasted the bug report in the prompt, and then requested the tool to analyze the source code and the associated logs and tell me how the described behavior could be happening. It turned out that I had overlooked something, but with the help of the tool, I found the bug in minutes.
I was trying to understand a particular part of a large codebase that I didn't really grasp very well. I loaded the codebase in the tool, and asked it to explain to me how a particular action is performed by the code. I requested specific functions and line numbers. I now have a far better understanding of how the code works, and will be able to write that patch that I've been wanting to write for years -- without using the LLM.
I have been struggling for, literally, years with understanding why another tool that I maintain was misbehaving in a particular way but only in Firefox. I opened the codebase in Firefox, explained the buggy behavior in plain English, and asked it to explain how this could be happening. It picked up some obscure corner case behavior of ffmpeg and mp4 containers that I was not aware of and that perfectly explained why things were misbehaving in the way that they were.
At the same time, there are limitations. Giving an LLM a codebase that was originally generated by an LLM (either the same one or another one) seems to work well. Giving it a codebase that was written by a human and expecting it to correctly update it seems to be more error-prone. I did one or two of those as a trial, and it is more problematic than anything.
An LLM is also not intelligent, notwithstanding the popular term of "Artificial Intelligence". On multiple occasions, I've asked it to write a test case for some code that was not set up to do so; and rather than suggesting a refactor is required, it would instead copy the code that needed to be tested and then test the copy, rather than the original. The tool has made multiple similar errors. I have sometimes people describe agentic coding as "similar to interacting with junior programmers", but that is not the case. A junior programmer will either fill in the gaps in your specifications, or ask for clarification when something seems off. The LLM will not do that; it will do what you ask, exactly that and nothing more. If you missed a corner case in your specification, then all bets are off.
I remember learning about programming language generations in college. A first-generation language is "machine code", a second-generation language is "assembler", a third-generation language is any high-level language such as C, Perl, or Pascal. I've forgotten what set a 3rd-generation language apart from a 4th-generation language. But I remember the definition they gave me for a 5th-generation language: "you tell the computer what to do, and it will do it". At the time, I thought it was ridiculous. Nobody could ever write something like that.
But it's here.
And it's a threat to free software.
A threat to free software?
Yes.
There is the obvious part where most of the well-known LLMs are non-free software. I mean, there are some "open source" LLM models. The windsurf tool that I used doesn't allow you to use them (directly), but they're there. There are also open source applications that implement what the windsurf editor does. So it's definitely possible to work like this without resorting to non-free software and non-free services, even though the non-free LLMs might be a bit ahead of the curve of the free ones. But that's not what I mean.
And there is also the obvious thing which I mentioned earlier in this post, which is that the people who try to build LLMs are doing it in unethical, disgusting ways, causing downtimes and disregarding licenses for whatever they can get their grubby hands on. Ideally we wouldn't be in that situation, and ideally this wouldn't be a problem, but we are where we are.
And there's the obvious thing where the OSI sold itself out and declared that a machine learning program can be open source even when the very things it was built from -- the training data -- is not available. That's a major issue that the free software community needs to fight against, but there's not really anything that that is a threat to free software. You just build your own, free software, LLM, and you're done.
The actual threat is in funding and developer support.
Most large businesses do not care about free-as-in-freedom software. They like the free-as-in-beer part, and they appreciate that the free-as-in-freedom bits can make the software more customizable. They are (mostly) happy to do sponsorships of the free-as-in-freedom projects that they use if that means their free-as-in-beer usage of the software gets improved.
But why would you care about all that when you can just generate the code you need, rather than interacting with an open source community that may or may not care about your business's interests?
Where to go from here
Although I think the moral and environmental issues with LLMs are real and problematic, given the experiments I did I am not convinced that the concept of interacting with a computer system in natural language and to use it to generate code is necessarily deficient. There are pitfalls, but they can be managed. It is possible to use such a system to create throwaway, proof-of-concept type "good enough" code bases. It can be used to interpret code bases and to understand bug reports.
I believe that the major issue with LLMs has to do with that saying about hammers and nails:
If all you have is a hammer, then everything looks like a nail.
LLMs are an outgrowth of machine learning, pushed by large corporations. These large corporations have a lot of money. If all you have is money, then every problem can be fixed by throwing more money at it. The initial language models were promising but not (yet) good enough, and it seemed that one way in which they could be improved was to increase the scale of the statistics: throw more hardware (and thus money) at it, and rather than improving the efficiency of the models, just scale up.
Scaling up is something that megacorporations are very good at. It's only a money problem, after all. Does that mean that "scaling up" is the only way to improve the models, though? I'm not convinced.
Some hardware, such as most modern Apple and Samsung devices, ship with accelerator hardware for machine learning algorithms. There are some models that are small enough to be able to run on these devices. I don't see why it should not be possible to create a small(er) language model that can do some useful part of the above-described use cases; if not locally, then at least on a server that one can run on-prem rather than requiring that you pay rent to one of the LLM companies.
The Software Freedom Conservancy has published an aspirational statement on machine learning-assisted programming that, I think, gets a lot right. It's not quite a definition, but it's something to keep in mind.
Perhaps that's the way forward?
More questions than answers at this point, anyway.
To study how chips really work, MIT researchers built their own operating system [OSnews]
A fascinating novel approach by researchers at MIT, called Fractal, to study in-depth how processors actually work.
A team at MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) decided to build something different. Fractal, an operating system kernel written from the ground up, treats the hardware itself as the object of study. Its first major use, a deep look at branch predictors — a CPU’s way of guessing what code to run next, before it knows for certain, so it doesn’t have to waste time waiting to find out — inside Apple’s M1 processor, has already turned up findings that prior work missed, including the first evidence that a class of speculative attack known as “Phantom” affects Apple Silicon.
“We’re using hardware in ways it wasn’t designed for,” says Joseph Ravichandran, the MIT PhD student in electrical engineering and computer science (EECS) who led the project. “It’s not even obvious that this is a possible thing you could do with the hardware. But we found a way to pull all these different primitives off. It’s like a microscope. If you’ve got a hand magnifying glass, you can see a little bit. But if you had an electron microscope, now we’re really talking. That’s what Fractal is. The electron microscope of operating systems.”
↫ Rachel Gordon at MIT News
While Fractal is small, its creators also added POSIX system calls, a C library, vim, GCC, a shell, and more. This way, it feels more familiar, and makes it easier for researchers to get started with the tool. Fractal is open source and hosted on GitHub, it has its own website, and there’s a detailed research paper with more in-depth information.
13:49
13:42
The Golden Age Of Bond Villains [Charlie's Diary]
So, the second novel in the Laundry Files, The Jennifer Morgue, was first published on November 1st, 2006. And while it was superficially a pastiche of the Bond movie canon (as it existed at that time--I was writing before the Daniel Craig era, ushered in with Casino Royale--it was also interrogating the dramatic conventions of the genre and also the implications of rule by Bond Villains.
At about the time I was writing it, a friend of mine (initially a tech journalist, later an industry pundit) described his experience of interviewing Elon Musk, who was allegedly leaning hard into the archetype. "I must be a Bond villain!" He joked, "I have an electric car and a tropical island where boiler-suited minions launch rockets!" And then he laughed it off. (In those days, we thought it was a simile: these days it's more clearly understood as a metaphor, if not the absolute raw truth.)
Anyway, I wrote a little afterword for The Jennifer Morgue discussing the significance of the Bond Villain as an archetype for our times and it does still appear to have something relevant to say, 20 years later; and I figure the current publisher has forgotten about it, so I'm going to shamelessly pirate my own work and reprint the entire epilogue from The Jennifer Morgue right here on my blog (the horror!).
Note that the Great Financial Crisis that kicked off the current era really started in late 2007, and our current era of oligarchic misrule, only got underway in the mid-20-teens, with the evitable rise to power of a deeply unpleasant TV reality star whose main claim to fame was playing a stupid man's idea of a successful business mogul.
(At least I didn't predict that.)
Anyway, the text is below the fold--it's quite long--and I ask this: what would you add, today?
The Golden Age of Spying
1. The Mary-Sue of MI6
"My name is Bond. James Bond."
These six words, heard by hundreds of millions of people, are almost invariably spoken during the first five minutes of each movie in one of the biggest media success stories of the 20th century. Unless you've lived under a rock for the past forty years, you hear them and you know at once that you're about to be plunged into a two hour long adrenaline saturated extravaganza of snobbish fashionable excess, violence, sex, car chases, more violence, and Blowing Shit Up -- followed by a post-coital cigarette and a light-hearted quip as the credits roll.
It wasn't always so. When "Casino Royale" was first published in 1953, it got a print run of 4750 hardcover copies and no advertising budget to speak of; while the initial reviews were favorable, comparing Ian Fleming to Le Queux and Oppenheim (the kings of the pre-war British spy thriller genre), it took a long time for his most famous creation to set the world on fire. Despite his rapidly rising print runs ("Casino Royale" eventually sold over a million paperbacks in the UK alone), and despite his increasing prominence among the post-war thriller writers, a decade elapsed before any of Fleming's novels were filmed; indeed, their author barely lived to see the commercial release of "Dr No" and the runaway success of the icon he created. (Nor were the films seen as a runaway success before they were made -- "Dr No" was notoriously made on a tight budget, even though it went on to gross nearly $60M around the world.)
Literary immortality -- or indeed, mere post-mortem survival -- is dauntingly hard for a novelist to achieve. The limbo of post-mortem obscurity awaits 95% of all novelists -- almost all novels go out of print for good within five years of the death of their author. But in addition to being a million-selling best-seller, Fleming was a ferociously well-connected newspaper executive with a strong sense of the value of his ideas, and he pursued television and film adaptation remorselessly. Cinematic success arrived just in time for his creation, and the synergy between best-selling books and massive movie hype has sufficed to keep them in print ever since.
James Bond is a creature of fantasy, perhaps best described using a literary term looted from that most curious and least respected of fields, fan fiction: the Mary-Sue. A Mary-Sue character is a placeholder in a script, a hollow cardboard cut-out into whose outline the author can squeeze their own dreams and fantasies. In the case of Bond, it's cruelly easy to make a case that the famous spy was his author's Mary-Sue: for Fleming had a curious and ambiguous relationship with spying.
A dilettante and dabbler for his first three decades, unsuccessful as a stockbroker, foreign correspondent, and banker, Fleming fortuitously landed his dream job on the eve of the Second World War: Secretary to the Director of Naval Intelligence in the Admiralty. The war was good for Ian Fleming, broadening and deepening him and giving him a job that captured his imagination and drew out his not inconsiderable talents. But Fleming was the man who knew too much: privy to too many secrets, he was wrapped in tissue paper and prevented from pursuing his desire to go into the field. He ended the war with a distinguished record -- and absolutely no combat experience (if one excludes being bombed by the Luftwaffe or watching the Dieppe raid from a destroyer, safely far off the Normandy coastline). Fleming grew up in the shade of a father who died heroically on the western front in 1917, and in adult life he wrote in the shadow of an elder brother whose reputation as a novelist surpassed his own. It's easy to imagine these unkind familial comparisons provoking the imaginative but flighty playboy who almost found himself during the war, goading him to imagine himself in the shoes of a hero who was not merely larger than life, but larger in every way than his own life.
And, as it turns out, James Bond was larger than Ian Fleming. Not only do few novels survive their author's demise, even fewer acquire sequels written by other hands; yet several other authors (including Kingsley Amis and John Gardner) have toiled in Fleming's vinyard. Few fictional characters acquire biographies written by third parties -- but Bond has not only acquired an autobiography (courtesy of biographer John Pearson) but spawned a small cultural industry, including a study of his semiotics by Umberto Eco. Now, that has got to be a sign of something ...
As with every true pearl, there was a sand-grain of truth at the heart of Bond. Fleming wrote thrillers informed by his actual experience. Years spent working out of the hothouse environment of Room 39 of the Admiralty building -- headquarters of the Naval Intelligence Division of the Royal Navy -- gave him a ringside seat on the operations of a major espionage organization. On various trips to Washington DC he worked with diplomats and officers of the OSS (predecessor organization to the CIA). As a foreign news manager at The Sunday Times after the war, there is some evidence that Fleming made his agency's facilities available to officers of MI6. His first Bond novels were submitted to that agency for security clearance before they were published. Bond himself may have been larger than life, but the strictures imposed by the organization he worked for were drawn from reality, albeit the reality of an intelligence agency of the early 1940s.
The world of secret intelligence gathering during the second world war was, however, very different from life in the intelligence community today. It was already changing by the late 1950s, as the bleeping football-shaped Sputniks zipped by overhead and intelligence directors began dreaming of spy satellites. By 2004, when MI5 (the counter-intelligence agency) openly placed recruiting advertisements in the press, we can be sure that Bond would be best advised to seek employment elsewhere. Spies are supposed to be short -- under 180 centimeters for men -- and nondescript. As a branch of the civil service, MI5's headquarters are presumably non-smoking, and drinking on the job is frowned upon. As intelligence agencies, MI5 and MI6 staff aren't in the business of ruthlessly wiping out enemies of the state: any decision to use lethal force lies with the Foreign Secretary, the COBRA committee, and other elements of the British government's security oversight bureaucracy. An MI6 agent driving a 1933 Bentley racer with a supercharged engine, frequenting the high-stakes table at a casino as James Bond so memorably did in his first print appearance, is an almost perfect inversion of the real picture.
Nevertheless, the archetype has legs. James Bond continued to grow and evolve, even after his creator put away his cigarette holder for the last time. To some extent, this was the product of storytelling expediency. The film adaptations started in the middle of a continuing story arc -- for Fleming wrote his novels with a modicum of continuity -- and while "Dr No" was the first to make it to celluloid, the novel was in fact a sequel to "From Russia With Love" (which was filmed second). Thus, various liberties were taken with the plot of the canonical novels, right from the start. You can re-read the novels at length without finding anything of the banter between Bond and M's secretary Moneypenny that is a recurrent theme of the films, for example, and that's before we get into the bizarre deviations of the mid-period Roger Moore movies (notably "The Spy Who Loved Me" and "Moonraker").
The literary James Bond is a creature of pre-war London clubland: upper-crust, snobbish, manipulative and cruel in his relationships with women, with a thinly-veiled sadomasochistic streak and a coldly ruthless attitude to his opponents which verges on the psychopathic. Over the years, his cinematic alter ego has acquired the stamina of Superman, learned to defy the laws of physics, ventured into space -- both outer and inner -- and deflowered more maids than Don Juan. He's also mutated to fit the prejudices and neuroses of the day, dabbling with (gasp!) monogamy, and hanging out with those heroic Afghan mujahideen in the late-eighties AIDS-and-Soviets-era "The Living Daylights". He's worked under a post-feminist ball-breaking 'M' in "Goldeneye", and even confronted a female arch-villain in "The World is Not Enough" (an innovation that would surely have Fleming, who formed his views on appropriate behavior for the fairer sex in the 1920s, rolling in his grave). But other aspects of the Bond archetype remain timeless. Fleming was fascinated by fast cars, exotic locations, and intricate gadgetry, and all of these traits of the original novels have been amplified and extrapolated in the age of modern special effects.
Just how does James Bond -- a "sexist, misogynist dinosaur, a relic of the Cold War", to use the words the script-writers on "GoldenEye" so tellingly put into M's mouth -- survive in the popular imagination more than fifty years after his literary birth? What does it mean when Mary-Sue stalks the landscape of the imagination, blasting holes in the plot with a Walther PPK (or the P99 he upgraded to in "Tomorrow Never Dies")? If we're going to understand this, perhaps we ought to start by looking at Bond's dark shadow, the Villain.
2. In search of Mabuse
Bond is, if you judge him by his work, a nasty fellow and not one you'd choose to lend your car to: to make this rough diamond glitter it is necessary to display him against a velvet backdrop of darkest villainy. If you strip the Bond archetype of the bacchanalia, glamorous locations, and fashion snobbery, you end up with an unappetizingly shallow, cold-blooded executioner -- the likes of Adam Hall's Quiller or James Mitchell's Callan, only without the breezy cynicism, or indeed any redeeming features at all. The role of adversary is thus a critical one in sustaining the appeal of the protagonist. Fleming set out to depict a hard-edged contemporary world where the usual black-and-white picture of the pre-war thriller had blurred and taken on some of the murky grey-on-grey ambiguity of the cold war era; Bond was the knight in shining armor, fighting for virtue and the free world against the dragon -- be they Mr. Big, Dr. No, Auric Goldfinger, or the looming shadow of Bond's greatest enemy of all, Ernst Stavro Blofeld, Number One of SPECTRE, the Special Executive for Counter-intelligence, Terrorism, Revenge and Extortion.
It is interesting to note that Blofeld assumed his primacy as Bond's #1 enemy only in the movie canon; Fleming originally invented him while working on the screenplay and novel of "Thunderball", and used him subsequently in "On Her Majesty's Secret Service" and "You Only Live Twice". (Prior to these later books, Bond typically tussled with less corporate enemies -- Soviet stooges, unregenerate Nazis, and psychotic gangsters.) Blofeld was born out of mere corporate expediency. Rather than demonize the Soviets and reduce their potential audience, the producers of the film of "From Russia With Love" appropriated SPECTRE as the adversarial organization. With the success of "Thunderball", the third of the films, Blofeld moved front and center and acquired a life of his own that far exceeded his prominence in the novels. Arguably, Fleming's death in 1964 freed up the movie series to diverge from their original author's plans; and so Blofeld may be seen as a demon of necessity, conjured up from the vasty depths in order to provide Bond with a worthy adversary.
'Twas not always so. Back at the turn of the 20th century, around the time that the British spy thriller was gradually cohering out of the mists of the penny dreadful and the literature of suspense (via the works of John Buchan and Erskine Childers -- not to mention the tangential contributions of Arthur Conan Doyle, by way of Sherlock Holmes) there was no great dualistic vision of the great champion confronting the villainous heart of evil. There was no great champion: we were on our own against the masters of night and mist, the great and terrible super-criminals. Professor Moriarty, Holmes' nemesis -- the Napoleon of Crime -- was but one of these: Fantômas, the 1911 creation of Pierre Souvestre and Marcel Allain, is another. The emperor of crime, Fantômas was a master of disguise and an agent of chaos (not to mention standing astride Paris in black mask, top hat and tails, in the posters for the 1913 movie of the same name: an icon of decadent wealth and criminal chaos). Nor was he alone. Guy Boothby's 1890's super-villain Dr Nikola fits the bill too, right down to the fluffy lap-cat and the fiendish plans. But perhaps the root of Bond's nemesis can be found in his full-fledged form somewhat later, and somewhat further to the east -- in the guise of Dr. Mabuse.
Dr. Mabuse is an archetype and a runaway media success in his own right, famous from five novels and twelve movies. The Doctor was created in 1922 by author Norbert Jacques, and was developed into one of the most chilling creations of the silent era by no less a director than Fritz Lang. Mabuse is a name, but one that nobody in their right mind speaks aloud. He's a master of disguise, naturally: and a rich, well-connected socialite and gambler. (Some social context: gambling at the high stakes table is no so much an innocuous recreation as an obscenity, in a decade of hyper-inflation and starvation, with crippled war veterans dying of cold on the street corners, as was the case in Weimar Germany). Mabuse has his fingers in every pie, by way of a syndicate so shadowy and criminal that nobody knows its extent; he's a spider, but the web he weaves is so broad that it looks like the whole of reality to the flies trapped in it. He is (in some of the stories) a psychiatrist, skilled in manipulation, and those who hunt him are doomed to become his victims. If Mabuse has a weakness it is that his schemes are over-elaborate and tend to implode messily, usually when his most senior minions rebel, hopelessly late; nevertheless, he is a master of the escape plan, and with his ability to brainwash minions into playing his role he's a remarkably hard phantom to slay.
It is all too easy to make fun of the likes of Fantômas and Dr. Nikola, and even their modern-day cognates such as Dr. Mabuse and Ernst Stavro Blofeld; for do they not represent such an obsessively concentrated pinnacle of entrepreneurial criminality that, if they really existed, they would instantly be hunted down and arrested by INTERPOL?
Careful consideration will lead one to reconsider this hasty judgment. Criminology, the study of crime and its causes, has a fundamental weak spot: it studies that proportion of the criminal population who are stupid or unlucky enough to get caught. The perfect criminal, should he or she exist, would be the one who is never apprehended -- indeed, the one whose crimes may be huge but unnoticed, or indeed miscategorized as not crimes at all because they are so powerful they sway the law in their favor, or so clever they discover an immoral opportunity for criminal enterprise before the legislators notice it. Such forms of criminality may be indistinguishable, at a distance, from lawful business; the criminal a paragon of upper-class virtue, a face-man for Forbes.
When the real Napoleons of Crime walk among us today, they do so in the outwardly respectable guise of executives in business suits and thousand-dollar haircuts. The executives of Worldcom and Enron were denizens of a corporate culture so rapacious that any activity, however dubious, could be justified in the name of enhancing the bottom line. They have rightfully been charged, tried, and in some cases jailed for fraud, on a scale that would have been the envy of Mabuse, Blofeld, or their modern successor, Dr. Evil. When you need extra digits on your pocket calculator to compute the sums you are stealing, you're in the big league. Again, when you're able to evade prosecution by the simple expedient of appointing the state prosecutor and the judges -- because you're the President of a country (and not just any country, but a member of the rich and powerful G8) -- you're certainly not amenable to diagnosis and detection in the same sense as your run-of-the-mill shoplifter or petty delinquent. I'm naming no names (they have intelligence services! Cruise missiles!) but this isn't a hypothetical scenario.
3. Interview with the Entrepreneur
In an attempt to clarify the mythology surrounding James Bond, I tracked his old rival down to his headquarters in the Ministry of Inward Investment in the breakaway Republic of Transdniestria. Somewhat suspicious at first, Mr. Blofeld relaxed as soon as he realized I was not pursuing him on behalf of the FSB, CIA, or IMF, and kindly agreed to be interviewed for this book. Now aged 72, Blofeld is a cheerful veteran of numerous high-tech start-ups, and not a few multinationals where, as a specialist in international risk management and arbitrage, he applied his unique skills to business expansion. Today he is semi-retired but has agreed to work in an voluntary capacity as director of the State investment agency.
"It took me a long time to understand the agenda that the British government was pursuing through the covert activities of MI6," he told me over a glass of sweet tea. "Call me naive, but I really believed -- at least at first -- that they were honest capitalists, the scoundrels."
Over the course of an hour, Ernst explained to me how he first became aware that the UK was attempting to sabotage his business interests. "It was back in 1960 or thereabouts that they first tried to destroy one of my subsidiaries. Until then I hadn't really had anything to do with them, but I believe one of my rivals in the phosphate mining business put it about that my man on site was some sort of spy, and they sent this Bond fellow -- not just to arrest him or charge him with some trumped-up nonsense, but to kill him." His lips paled with indignation at he contemplated the iniquity of the situation: that agents of the British government might go after an honest businessman for no better reason than an unsubstantiated allegation that he was spying on American missile tests. "I warned Julius to be careful and advised him to put a good lawyer on retainer, but what good are lawyers when the people you're up against send hired killers? Julius brought in security contractors, but this Bond fellow still murdered him in the end. And the British government denies everything, to this day!"
Ernst obviously believes in his own moral rectitude, but I had to ask the obvious questions, just for the record.
"Yes, I was chief executive of SPECTRE for twelve years. But you know, SPECTRE was entirely honest about its activities! We had nothing to hide because what we were doing was actually legal. We've been mercilessly slandered by those rogues from MI6 and their friends in the newspapers, but the fact is, we're no more guilty of criminal activity than any other multinational today: we simply had the misfortune to be foreign and entrepreneurial at a point in time when Whitehall was in the grasp of the communist conspirators Wilson and Callaghan and their running-dog so-called 'conservative' fellow Heath. And we were pilloried because what we were doing was in direct competition with the inefficient state-run enterprises that my good friend Lady Thatcher recognized as mosquitoes battening on the life-blood of capitalism. That cad Fleming put it about that SPECTRE stands for 'Special Executive for Counterintelligence, Terrorism, Revenge and Extortion' -- absolute tosh and nonsense! Would a group of criminals really call themselves something that blatant? I'll remind you that SPECTRE is actually a French acronym, as befits a non-profit charity incorporated in Paris. The name stands for 'Société Professionelle et Ethique du Capital Technologique Réinvestissement par les Experts.' Venture capitalists specializing in disruptive new technologies, in other words -- commercial space travel, nuclear power, antibiotics. Not some kind of half-baked terrorist organization! But you can imagine the threat we posed to the inefficient state monopolies like the British Aircraft Corporation, the coal mining industry, and Imperial Chemical Industries."
Blofeld paused to sip his tea thoughtfully.
"We were ahead of our time in many ways. We pioneered business methods that later became mainstream -- Sir James Goldsmith, Ronald Perelman, James Icahn, they all watched us and learned -- but by then, the commies were out of power in the west thanks to our friends in the establishment, so they had an easier time of it. No need to hire lots of expensive security and build concrete bunkers on desert islands! And yes, that made us look bad, don't think I'm unaware of it -- but you know, you want bunkers and isolated jungle rocket launch bases? All you have to do is look at Arianespace! It's fine when the government bureaucracies do it, but if an honest businessman tries to build a space launch site and hires security to keep the press and saboteurs from foreign governments out, it's suddenly a threat to world security!"
He paused for a while. "They put the worst complexion on everything we did. The plastic surgery? Well, we had the clinic, why not let our staff use it, so the surgeons could stay in practice between paying customers? It was a perk, nothing more. We did -- I admit it -- acquire a few companies trading in exotic weapons, non-lethal technologies mostly. And that business with Emilio and the yacht, I admit that looked bad. But did you know, it originally belonged to Adnan Khashoggi or Fahd ibn Saud or someone? Emilio was acting entirely on his own initiative -- a loose cannon -- and as soon as I heard about the affair I terminated his employment."
I asked Ernst to tell me about Bond.
"Listen, this Bond chap, I want you to understand this: however he's painted in the mass media, the reality is that he's a communist stooge, an assassin. Look at the evidence. He works for the state -- a socialist state at that. He went to university and worked with those traitors Philby and Burgess, that MacLean fellow -- communist spies to a man. He didn't resign his commission when the British government went socialist, like a decent fellow: instead he took assignments to go after entrepreneurs who were a threat to the interests of this socialist government, and he rubbed them out like a Mafia button man. There was no due process of law there, no respect for property rights, no courts, no lawyers -- just a 'License to Kill' enemies of the state, loosely defined, who mostly happened to be businessmen working on start-up projects that coincidentally threatened state monopolies. He's a damned commissar. Do you know why Moscow hated him? It's because he'd got them beat at their own racket."
Blofeld was clearly depressed by this recollection, so I tried to change the subject by asking him about his personal management philosophy."
"Well, you know, I tend to use whatever works in day to day situations. I'm a pragmatist, really. But I've got a soft spot for modern philosophers, Leo Strauss and Ayn Rand: the rights of the individual. And I've always wanted to remake the world as a better place, which is probably why the establishment dislike me: I'm a threat to vested interests. Well, they're all descended from men who were threats to vested interests too, back in the day: only I threaten them with new technologies, while their ancestors mostly did their threatening with a bloody sword and the gallows. I don't believe in initiating force." He laughs self-deprecatingly. "I suppose you could call me naive."
4. Trade Goods
When I played back my tape of our discussion, it took me some time to notice that Ernst had carefully steered the conversation away from certain key points I had intended to quiz him about.
One of the most disturbing aspects of the Bond milieu is the prevalence of technologies that are strangely out of place. Belt-buckle grappling hooks with wire spools that can support a man's weight? Laser rifles? These aren't simple extrapolations of existing technology -- they go far beyond anything that's achievable with today's engineering tools or materials science. But forget Bond's toys, the products of Q division. From Blofeld's solar-powered orbital laser in "Diamonds are Forever" to Carver's stealthed cruiser in "Tomorrow Never Dies", we are surrounded by signs that the adversary has got tricks up his sleeve that far outweigh anything Bond's backers can provide. These menacing intrusions of alien super-science -- where can they possibly have got them from?
The answer can be discerned with little difficulty if one cares to scrutinize the writings of the sage of Providence, Howard Phillips Lovecraft. This scholar -- whose path, regrettably, never crossed that of the young Ian Fleming -- asserted that our tenancy of this planet is but a recent aberration. Earth has in the past been home for a number of alien species of vast antiquity and incomprehensibly advanced knowledge, and indeed some of them may still linger on alongside us -- on the high Antarctic plateau, in the frigid oceanic depths, even in strange half-breed colonies off the New England coastline.
If this strikes you as nonsensical, first contemplate your nearest city: how recognizable would it be in a hundred years' time if our entire species silently vanished away tomorrow? How recognizable would it be in a thousand years? Would any relics still bear witness to the once-proud towers of New York or Tokyo, a million years hence? Our future -- and the future of any once-proud races that bestrode our planet -- is that of an oily stain in the shale deposits of deep history. Earth's biosphere and the active tectonic system it dances on cleans house remorselessly, erasing any structure that is not alive or maintained by the living.
Consider also the extent to which we really occupy the planet we live on. We think of ourselves as the dominant species on Earth -- but 75% of the Earth's entire biomass consists of bacteria and algae that we can't even see with the naked eye. (Bacteria from whose ranks fearsome pathogens periodically emerge, burning like wildfire through our ranks.) Nor do we, in any real sense of the word, occupy the oceans. Certainly our trawlers hunt the bounty of the upper waters. But submarines (of which there are only a few hundred on the entire planet) fumble like blind men through the uppermost half kilometer of a world-ocean that averages three kilometers in depth, unable to dive beneath their pressure limits to explore the abyssal plains that cover nearly two thirds of the planetary surface. Finally, the surface (both the sub-oceanic abyss and the thin skin of dry land we cling tenuously to) is but a thousandth of the depth of the planet itself; we can't even drill through the crust, much less contemplate with any certainty the nature of events unfolding within the hot, dense mantle beneath.
We could be sharing the planet with numerous powerful alien civilizations, denizens of the high energy condensed-matter realm beneath our feet, and we'd never know it -- unless they chose to send emissaries into our biosphere, sprinkling death rays and other trade goods like glass beads before the aboriginal inhabitants, extracting a ghastly price in return for their largesse ...
5. A Colder War?
James Bond was a creature of the Cold War: a strange period of shadow-boxing that stretched from late 1945 to the winter of 1991, forty-six years of paranoia, fear, and the creepy sensation that our lives were in thrall to forces beyond our comprehension. It's almost impossible to explain the Cold War to anyone who was born after 1980; the sense of looming doom, the long shadows cast by the two eyeball-to-eyeball superpowers, each possessing vast powers of destruction, ready and able to bring about destruction on a planetary scale in pursuit of their recondite ideologies. It was, to use the appropriate adjective, a truly Lovecraftian age, dominated by the cold reality that our lives could be interrupted by torment and death at virtually any time; normal existence was conducted in a soap-bubble universe sustained only by our determination to shut out awareness of the true horrors lurking in the darkness outside it, an abyss presided over by chilly alien warriors devoted to death-cult ideologies and dreams of Mutually Assured Destruction. Decades of distance has bought us some relief, thickening the wall of the bubble -- memories misting over with the comforting illusion that the Cold War wasn't really as bad as it seemed at the time -- but who do we think we're kidding? The Cold War wasn't about us. It was about the Spies, and the Secret Masters, and the Hidden Knowledge.
It's no coincidence that the Cold War was the golden age of spying -- the peak of the second-oldest profession, the diggers in the dark, the seekers after unclean knowledge and secret wisdom. Prior to 1939, spying of the international kind rather than the sordid domestic variety (let us pass swiftly over the sordid Stasi archives of sealed glass jars full of worn underwear, kept as scent cues for the police dogs) was a small scale, largely amateurish concern. With the outbreak of the second world war it mushroomed. Faced with employment vacancies, the first response of a growing organization is to recruit close to home. Just like any 1990s dot-com startup, growing as the founders haul in all their friends and anyone they know who has the right skill set, the 1940s espionage agencies were a boom town into which a well-connected clubbable London playboy would inevitably be sucked -- and, moreover, one where he might try his hand and succeed, to everyone's surprise. (In the 1990s he'd end up in marketing, with stock options up to here. Sic transit gloria techie.)
When the Second World War gave way to the doomwatch days and Strangelove nights of the Cold War, it entered a period in which the same clubbable fellow might find himself working in a mature organization, vastly larger and more professional than the half-assed amateurism of the early days. The CIA was born in the shadow of the wartime OSS, and grew into the emblematic Company (traders in secrets, overthrowers of governments), locked in titanic struggle with that other superpowered rival, the KGB (and their less well known fellows in the GRU).
The age of the traditional sneak-spies with their Minox cameras gave way to the era of the bugging device. With the 1960s came a new emphasis on supplementing human intelligence (HUMINT) with intelligence from electronic sources (ELINT). New agencies -- the NSA in the United States, GCHQ in the UK -- expanded as the field of "spyless spying" went mainstream, aided by the explosion in computing power made possible by integrated circuits and, later, the microprocessor. As telephony, television, telex, and other technologies began to come online a torrent of data poured through the wires, a deluge that threatened to drown the agencies in useless noise. Or was it the whispering on the deep-ocean cables? Maybe the chatter served to conceal and disguise the quiet whispering of the hidden oracles, dribbling out strange new concepts that warped the vulnerable primate minds to serve their inscrutable goals. The source of the incredible new technologies that drove the advances of the middle of the twentieth century was, perhaps, the whispering of an alien farmer in the ears of his herd ...
Times change, and the golden age of spying is over. We've delivered the harvest of fear that the secret masters desired; or maybe they've simply lost interest in us for the time being. Time will tell. For now, be content that it's all over: the Cold War was a time of strangely rapid technological progress, but also of claustrophobic fear of destruction at three minutes' notice, of the thermonuclear stars coming right and bringing madness and death in their wake. Retreat into your soap-bubble universe, little primate, and give thanks.
From the perspective of the 21st century, Bond was a poor archetype for a hero; certainly he couldn't save us from the gibbering horrors of the Cold War, but only cast a shadow beneath their unblinking ground-zero glare. But we found salvation in the end, in the most unlikely place of all: if you turn on the TV you're likely to see one of old Ernst's protégés being held up for praise as an object of emulation. President of Italy, captain of industry, or chief executive of Enron -- SPECTRE won and it's their world that we live in, the world of the lesser evil.
13:14
Issue 46 – Greta’s Wedding – 11 [Comics Archive - Spinnyverse]
The post Issue 46 – Greta’s Wedding – 11 appeared first on Spinnyverse.
12:35
Error'd: Microbits [The Daily WTF]
This week we have got a couple of Mathanon's. Maybe they're the same person, maybe they're not, there's really no way to know!
Frist anon has a "Numeric fun fact" for us: "Got a form sent from work to express interest in some event. They actually enforced the validation that the answer must be a number, so I submitted "42"." Bravo.
Next anon has a different numeric fun factor: "The SAS website wants us to know the size of the file behind the link down to the nanobyte precision." They split the bit! That must be what this quantum computing thing is about.
Conscientious dad Mark R. takes all the responsibilities. "My kid's school ensures they're legally covered on all things said and unsaid."
Philipp H. points out "The Redmond philosophers have created something the old Greek philosophers will have to rethink. Or is this a pun on Schrödinger's Cat? German→English translation: "We cannot bring/transfer/switch you to this message because you're in a chat, in which you're not in.""
We haven't heard from Michael R. in a while. Here he is with a pithy "The irony is not lost on me."
Happy Juneteenth to those who celebrate.
Your journey to .NET 9 is more than just one decision.Avoid migration migraines with the advice in this free guide. Download Free Guide Now!
12:14
Anthropic’s Fable and the State of AI [Schneier on Security]
On June 9th, Anthropic released its Fable generative AI model. Three days later, the US government classified it as a dangerous munition, and used its export-control authority to prohibit any foreign nationals from accessing it. Unable to differentiate between Americans and foreigners, the company shut off access for everyone.
The government’s actions won’t help. The problem isn’t any one particular model; it’s the general trend of increasing AI capabilities. And any real solution requires the sort of collective action that just isn’t possible right now.
Fable is the constrained version of Mythos, the AI model Anthropic announced in April. Anthropic only released it to a few selected organizations, because the company claimed it was so good at finding and exploiting vulnerabilities in computer code that releasing it more generally would be dangerous.
It was an obviously self-serving announcement, and because few were able to verify Anthropic’s claims they were met with some skepticism. Those with access used Mythos to find and patch many vulnerabilities in their own software. But one UK group found the latest, already public, OpenAI model to be just as powerful.
Fable is just another incremental improvement in the years-long climb of AI capabilities. But just as important as the AI model is the “harness.” This is typically not AI. It’s ordinary computer code that interfaces with the user. It stitches together AI models, decides how and for what purposes they can be used, and gives them useful tools such as web search and the ability to run their own computer code.
When Mythos first entered limited release, there was widespread debate whether its power came from the model or the harness. With Mythos demonstrating that it was possible, the open-source community scrambled to build harnesses that could steer other AI models towards similar capabilities. Harness improvements don’t need massive data or data centers.
They largely succeeded. For example, a Prague company was able to replicate Anthropic’s few verifiable cybersecurity capabilities with a much smaller and cheaper model—and a more sophisticated harness. Last week, a group showed that multiple cheaper models harnessed in concert matches Fable’s performance.
The broader community had only a few days with Fable, but that time we learned some about its capabilities. Its difference is less the new model’s raw analytical and problem solving capabilities, and more that the model doesn’t need that sophisticated harness.
Fable requires much less expertise and detailed prompting from the human user. You can give it a difficult goal and it will figure out novel and unexpected ways to satisfy it, finding loopholes in whatever constraints you or the system have imposed on it.
“Relentlessly proactive” is how AI researcher Simon Willison described it. Another descriptor might be “creative.” Experienced AI developers have had that combination of creativity and proactivity since last year, but Fable puts it within easy reach of everyone.
In the hands of someone with a legitimate problem that needs solving, that can be an incredibly useful capability. But in the hands of someone who wants to do harm, it can be equally dangerous. AIs don’t have a moral compass in the same way that people do. They are agents of the wants and desires of the people who prompt them.
That points to the real problem with relentlessly proactive AI. In language, wants and desires are always underspecified. If I ask you to get me some coffee, you would probably pour me a cup from the coffeepot, or buy one from a nearby coffee shop.
You couldn’t buy me a pound of raw beans, or a coffee plantation. You wouldn’t order a cup of coffee for delivery next month. You wouldn’t find a nearby person, rip a cup of coffee out of their hands, and bring it to me. I wouldn’t have to specify any of the million limitations to my request; you would just know.
Human stories are filled with warnings about underspecified desires. King Midas wished that everything he touch turn to gold, forgetting to add “but not my food, drink, and daughter.” And genies are notorious for granting your wish in a way you wish they hadn’t.
The deeper point is that it’s impossible to list all limitations and restrictions, and like a malicious genie, a creative AI will find the ones you forgot. Block a database you don’t want it to have access to, and it might figure out how to bypass your control. Ask it to book a flight, and it might hack the airline because the website says the flight is sold out. Ask it to save money on your cellphone plan, and it might cancel it altogether—or get someone else to pay for it. As far as we know now AI has not done any of this yet, but you get the idea.
Malicious intent is not required. To an AI model, constraints are just things to get around and not general truisms about the world. They are creative problem solvers and natural rule breakers. They “hack” in the sense that they find and exploit loopholes.
Human systems rely on so many norms that we scarcely recognize the existence of until they are broken. AIs naturally think outside the box, because they don’t have any real conception of what the box is or why it’s there in the first place.
There is no foolproof way to prevent people from using AI models to complete harmful tasks. There is no way to prevent the models from incidentally causing harm while completing benign tasks. AI models are no longer isolated from the real world. They browse the internet and answer emails.
They trade stocks and make purchases. They control physical systems. They are, in effect, robots that affect life and property. We have no technical mechanisms to verify the integrity of an AI system. This level of capability and creativity in the hands of us untrustworthy humans will have both great and terrible results.
The problem is not unique to Anthropic. Mythos/Fable might currently be the most capable rules hacker, but more sophisticated harnesses give other models similar capabilities. And we should assume that the other frontier models are no more than a few months behind, and that open-source models are less than a year behind. At best, any ban only serves to delay the problem for a short while.
That delay might be useful if we—as a society, as a planet—would use that time to come together and figure out what to do. This isn’t a US/China arms race problem; this a species-level problem that requires coordinated action at that scale. Unfortunately, we have no mechanism to do that. I first wrote about this problem five years ago, but it was all too futuristic.
Today, when its right in front of us, there is no world government that can impose constraints on the for-profit corporations currently controlling AI models and research. The US has no appetite to effectively and even-handedly regulate those corporations, even as they do catastrophic damage to the environment, democracy, and—in this case—society in general.
This all makes an AI public option all the more necessary, and urgent. Today’s AIs can be fast, smart and secure, but only two of the three are possible for any given system. These safety tradeoffs are tightly held secrets of companies racing to beat one another, and they tell us we have to trust them. Instead, the choices and their consequences need to be brought out into the sunlight.
We should be funding open-source harnesses that balance capability and safety—that achieve useful goals without so much power—and open-source AI models whose provenance and biases are public and well understood. We have opened the AI Pandora’s box. Now we have to make the best of it.
This essay originally appeared in The Guardian.
10:56
The UK’s New Under-16 Social Media Ban Will Cause More Harm Than It Prevents [Deeplinks]
This week, politicians in the UK pushed forward with plans to eviscerate privacy and free speech on the internet by announcing a ban on social media for users under 16 that is set to take effect in Spring 2027.
The UK government continues to falsely characterize this policy as a necessary response to growing concerns about online harms for young people. In reality, much like the Online Safety Act, it will cause more harm than it will prevent.
Users of all ages are burdened with proving their age before accessing content, with social media platforms such as Snapchat, TikTok, YouTube, Instagram, Facebook, and X included in the ban. There remains no reliable, privacy-preserving method of verifying the age of every internet user and methods vary from one platform to the next.
Young people will not simply be protected from being contacted by adults or endlessly scrolling—they’ll also lose access to educational videos on YouTube, local events on Facebook, and potentially cut off from distant friends and family.
Public policy must be effective, proportionate and respectful of fundamental rights. Young people deserve better than a policy built on panic, and all internet users deserve a safe and free internet. A social media ban generates headlines, but it will not solve the problem.
A Brief History of Age-Gating in the UK
Age restriction proposals in the UK date back to a decade ago, when the proposed Digital Economy Bill was put forth to (among other things) restrict young people from accessing pornographic websites. While the Digital Economy Act of 2017 passed without age-based restrictions, it laid the groundwork for later age verification measures.
Over the next few years, age checks for porn websites were announced then delayed several times. But it wasn’t until a consultation under the 2016-2019 May government and the 2020 publication of the Online Harms Whitepaper that age verification became a broader idea.
In 2023, the UK passed the controversial Online Safety Act, establishing powers that could weaken privacy protections and freedom of expression for internet users worldwide. In July 2025, the government implemented age assurance measures on sites hosting “harmful” content.
And despite politicians affirming repeatedly that the Online Safety Act would solve all of the problems with online safety, this year they decided it in fact did not go far enough. American social psychologist and The Anxious Generation author Jonathan Haidt—who has called for age-related social media bans around the world, despite significant scientific doubt about his research—met with the UK Health Secretary in February to push for the ban.
In March, politicians introduced plans for a social media ban into the Children’s Wellbeing and Schools Bill to “prevent children under the age of 16 from becoming or being users” of “all regulated user-to-user services,” to be implemented by “highly-effective age assurance measures”—effectively banning under-16s from social media.
When this proposal came before the House of Commons, MPs defeated and proposed their own amendment: enabling the Secretary of State to introduce provisions “requiring providers of specified internet services” to prevent access by children, under age 18 rather than 16, to specified internet services or to specified features; and to restrict access by children to specified internet services which ministers provide.
But the social media ban does not stop there. The provision also requires internet service providers to limit the time kids spend online, and has rules about who can contact them online. These extreme rules will take decisions about using technology away from families and put them in the hands of government regulators.
The history of this proposal shows that the UK government has repeatedly returned to the same flawed idea: restricting access to online services by requiring age checks for everyone. But the fundamental problems have not changed. There is still no widely available way to verify age online without compromising privacy—but even if there were, broad restrictions on social media will inevitably limit access to lawful speech, and valuable online communities, and arts and culture.
EFF Joins 60+ Groups Urging the UK to Halt Face Estimation at the Border [Deeplinks]
This week, EFF joined Foxglove, Human Rights Watch, and 60 other organizations in writing to the UK’s Minister of State for Border Security and Asylum, Alex Norris, raising serious concern about the Home Office’s decision to deploy Facial Age Estimation (FAE) to assess asylum-seeking children from 2027.
The letter points to four key concerns:
Discrimination
As with most face estimation and recognition tools, there is ongoing bias in the deployment of these technologies. With FAE, many have highlighted its baked-in failures and discrimination, particularly in relation to women and people of color. Evidence shows that FAE is most accurate for estimating the ages of Eastern European men, but even then it consistently produces errors. The Home Office itself noted “that FAE performance can vary depending on ethnicity” and skin tone.
Inaccuracy
The Home Office has admitted that FAE systems are imprecise for analyzing 16-to 18-year-olds, with even the “top systems” having an “error margin of around 2.5 years here.” This is exactly the age range for which the Home Office has chosen to deploy this technology. And this error margin will be widened yet further because children seeking asylum often suffer from trauma-induced aging.
Lawfulness of Use of Children’s Data
Major concerns exist around the lawful basis on which the Home Office, or its chosen third-party FAE vendors, could have sought consent to collect and process photographs or data from asylum-seeking children to train this system. Further, there is no clarity on the images and/or data that this technology has been trained on.
Lack of Necessary Disclosure
The Home Office claims “extensive testing has already been carried out across diverse groups, including different ethnicities, genders and age ranges, indicating promising performance and accuracy.” But these purported “promising” results have not been published, nor have any Equality or Data Protection Impact Assessments.
The letter continues by requesting clarification on several key questions regarding these concerns. EFF and partners have provided the UK government 21 days for a response, and we urge the Home Office to take on this uphill task in good faith and release the information.
You can read the letter in full here.
10:07
The gap between true and known [Seth's Blog]
We have more agency and choice than we know.
And sometimes, when the awareness of our freedom arrives, it’s too late to reclaim the opportunities we missed.
Some of the walls around us are real—built by people who have no right to build them, who profit from our staying put.
And some of the walls aren’t walls at all. A door we never tried, because no one told us it was unlocked.
Perhaps, instead of waiting for certainty, we act as if, just for now, to explore what’s possible.
Too often, we’re held back unfairly by others who have no right to do so. But sometimes, we hold ourselves back simply because we didn’t know we had a choice.
09:14
New Comic: Widow's Bae
07:00
Junichi Uekawa: looking for last. [Planet Debian]
looking for last. I realized it's gone. what's my
replacement?
05:49
How Do You Like Them Apples? [Ctrl+Alt+Del Comic]
Some of our weeks in the spring definitely feel like this.
The post How Do You Like Them Apples? appeared first on Ctrl+Alt+Del Comic.
Girl Genius for Friday, June 19, 2026 [Girl Genius]
The Girl Genius comic for Friday, June 19, 2026 has been posted.
01:42
Apple TV is incredibly weird stuff. It doesn't have a super deep roster, but it has a weirdly high ratio of absolutely must watch shit. I got some free Apple TV when I got an iPad a few Christmases ago, and ended up hooked on For All Mankind - then let it lapse, and now my three favorite shows are all from there. It goes Severance, Pluribus, and now Widow's Bay. They don't seem to be able to produce on any kind of schedule, but then, I don't think they're even trying to. This is exactly what a modern leviathan should be doing with its bulging coffers. As a young man, I was told that Campbell's Chunky Soup was said to eat like a meal. These are shows that watch like books, that benefit very clearly from study.
00:00
Canada Is Forging Ahead with Its Dangerous Surveillance Bill [Deeplinks]
With no serious debate, including on proposed amendments, Canada is blazing full speed ahead with Bill C-22, which would threaten encryption and increase surveillance. Also known as the Lawful Access Bill, Bill C-22 is currently moving forward quickly to a vote despite the many, many criticisms civil liberty groups and the tech industry have hurled at it.
As we’ve discussed before, Bill C-22 is dangerous on multiple levels. It pushes for requirements for metadata retention, expands information sharing with foreign governments, and establishes a mechanism that allows Canada’s Ministry of Public Safety to demand that companies create backdoors, effectively breaking encryption. That mechanism was a key facet of Part 2 in Bill C-22, and the government prevented it from being independently debated.
In a deep analysis of the bill, Citizen Lab and the Canadian Civil Liberties Association detail every one of flaws of this proposal, concluding that most elements are unsalvageable.
A wide range of tech companies agree. Signal, Apple, Google, and several VPN providers oppose the bill, and some have said they’d likely be forced to either cut Canadians off from certain features or shut down services in Canada altogether.
The Canadian government wants this dangerous, complicated, overreaching bill passed before June 19. Bill C-22 is riddled with privacy problems that affect millions of people. It should be debated and studied fully, not jammed through on an arbitrary deadline.
OpenMedia is offering a tool for Canadians to contact their elected representatives about the bill. Actions taken on OpenMedia's website are governed by OpenMedia's privacy policy, not EFF's.
EFF Thanks SerpApi For Helping Us Protect Free Speech Online [Deeplinks]
EFF is grateful for SerpApi’s generous support, helping us fight for your rights to speak and access information online. SerpApi has been giving to EFF every year since 2018, and alongside our 32,000 individual donors, their gift is critical to keeping up the fight.
Whether in the courts, halls of power, or broader policy debates, we appreciate the work this support has made possible over the years. Some examples:
- We sued the U.S. Department of Homeland Security and Department of State to stop an unconstitutional social media surveillance program to identify and punish individuals who express viewpoints the government disagrees with.
- We helped develop the Santa Clara Principles, a framework to reign in overbroad content moderation so that all users are treated fairly and offered consistent tools for recourse if their speech is censored by tech companies.
- In the whitepaper Unfiltered: How YouTube’s Content ID Discourages Fair Use and Dictates What We See Online, we pushed back on YouTube for silencing individual creators in the interest of protecting a small number of giant copyright holders.
- We stood with whistleblowers and dissidents persecuted for their online speech.
- We continued the fight to protect Section 230.
We live in an era when lawful speech and the right to access information are being targeted by Big Tech and governments around the world that are hostile to dissent. Free speech online is core to EFF’s mission, and SerpApi’s support will help us continue the fight to protect everyone’s right to free expression.
Thursday, 18 June
23:14
AmigaOS 2: the greatest upgrade [OSnews]
Five years after releasing the Amiga 1000, Commodore was about to launch the Amiga 3000, their first real high-end Amiga. With a 68030 processor, on-board SCSI and a slightly updated graphics chipset, all in a sleek desktop case, the Amiga was truly ready for the era of professional 32-bit computing. But Moore’s law wasn’t the only thing thad had been pressuring Commodore since the release of the Amiga 1000: The desktop metaphor had matured even further, and the competition had been hard at work. IBM had launched OS/2, Windows 3.0 had turned Microsoft’s offering from a proof of concept into something actually usable, and new players had entered the scene – among them NeXTStep, with its polished 3D look.
It was time to bring AmigaOS, too, into the 1990s.
↫ Carl Svensson
It’s interesting – there’s a lot of focus on the first version of the Amiga operating system and the third one, but you don’t hear a lot about AmigaOS 2.x. It turns out this is rather odd, because as Svensson details, this version came with an absolute ton of changes and improvements, from an entirely new widget toolkit to a brand new file system, and so much more. The new widget toolkit and accompanying style guide also ensured that the operating system looked, felt, and behaved consistently.
Remember when we cared about that?
There’s so much more cool features, though, like command history, line editing, universal clipboard support and more just for the CLI, as well as something called Commodities. These were tiny little programs managed from a central location, which didn’t even need a GUI to work. Commodities included by default were things like ClickToFront, a focus-follows-mouse option, and more. Oh and of course, BASIC was replaced by ARexx.
The list just keeps going, and you should really read Svensson’s article.
22:28
Why doesn’t GetLastInputInfo() return info for the user I’m impersonating? [The Old New Thing]
A customer had a Windows NT service process, and from that
service process, they wanted to obtain the last input time for all
signed-in users. Their strategy was to use
WTSQueryUserToken() to get the token
for each user, use that token to impersonate the user, and then
call GetLastInputInfo() to get the
last input time for that user. Unfortunately, the function always
return the last input info for the service session, and since
services are not interactive, it always says that there has been no
input since the system booted.
Does GetLastInputInfo() work with
impersonation?
Recall that
the default answer to “Does this work when
impersonating?” is “No”. And in fact, the
documentation for GetLastInputInfo()
explicitly says that it doesn’t, if you read it closely.
This function is useful for input idle detection. However, GetLastInputInfo does not provide system-wide user input information across all running sessions. Rather, GetLastInputInfo provides session-specific user input information for only the session that invoked the function.
I underlined the important part. It reports on the last input information for the session that invoked the function. When the service impersonates, it updates its security context to align with that of the user being impersonated, but it doesn’t change the fact that that it is still running in session zero, the service session.
If you need to get last input information from another session, you will need a friend in that session to call it for you. Typically this is done by launching a helper process into the target session: The helper process collects the information you want and then sends the information to the service.
Bonus chatter: A related question is “Does
GetAsyncKeyState from a
service?” The answer is technically yes, it works. However it
probably doesn’t work the way you think. It returns the
asynchronous key state for the desktop that the service is running
in. And since services run in a non-interactive session, that
desktop will never see any keyboard activity.
The post Why doesn’t <CODE>GetLastInputInfo()</CODE> return info for the user I’m impersonating? appeared first on The Old New Thing.
20:56
Call for Submissions: Digital Pride [Deeplinks]
This Pride season, join EFF and the Queer Arts Collective in building a creative space at the intersection of digital justice and artistic expression.
We’re looking for fresh, untold, historically censored takes on digital liberation.
Whether it’s pointing the lens towards an issue you feel is underrepresented in digital justice efforts; sharing personal accounts of joy, pleasure, or sorrow under surveillance; painting your widest imagination for our communities using technology for good instead of carcerality and doom—we want to see it and we want it to expand our own understanding of what’s important and beautiful.
We’re going to be curating between five and nine art pieces across writing (fiction, nonfiction, poetry) and visual arts (photography, drawing, painting). We welcome fluidity in medium and genre, and cross-genre works of all kinds, such as graphic storytelling and collaborations.
We are looking for works that convey the importance of digital liberation and ways of achieving it, particularly from under-represented perspectives. Pieces will be selected based on interpretation of the theme, emotional resonance (does it surprise, move, frighten, delight?), and overall curatorial cohesion for each issue.
Submissions that adhere to the following length guidelines are preferred:
(NON)FICTION - max 1500 words
POETRY - max
2 poems
VISUAL ARTS - max 1 artwork, which
can be a serialized collection.
Please submit to paige+pride@eff.org by June 30, 2026, including your piece as an attachment and a short bio in the body of the email, alongside anything else we should know about your submission. You can expect to hear back from us around July 31, and we aim to have the first issue published in September. If we select your submission for publication on both EFF and Queer Arts Collective websites, we will compensate you between $25 - $50, depending on the number of pieces published.
There is no fee for entry. Please only submit one piece or a contained series for this call, and wait for us to get back to you before submitting again. If you plan to submit both individually and as part of a collective, one submission in each of these categories applies.
Your submission must be your original work and you must have the legal right to authorize us to publish it, but it need not be created specifically for this project; you may submit a work you have published previously. Please disclose any use of AI in a note in your application—this will not disqualify your entry, though we value transparency of labor exchange.
As attempting to witness art is a highly subjective endeavor, please don't consider not being selected as anything other than circumstantial. We are looking to foster a community of artists working for digital justice, and would love to see more from you in the future.
You will retain all legal rights to your work, but agree to provide EFF and Queer Arts Collective with a non-exclusive and non-time-limited license to publish your work on their websites and other promotional materials, such as in zines.
Meet the Judges
Kit Walsh is an EFF attorney who works to protect the rights of activists, journalists, researchers, and dissenters in order to build a better world. She is also a Nebula-award-winning author and is best known for her tabletop roleplaying game Thirsty Sword Lesbians.
Paige Collings is an EFF activist working to dismantle systems of oppression and advance collective liberation. Her work focuses on highlighting how state surveillance and corporate restrictions stifle marginalized communities and perpetuate historic injustices and harm. She works with activists across the globe to facilitate systemic change by speaking truth to power and creating spaces for alternative imaginations.
The Queer Arts Collective is an NYC-based collective run by queer and racialized artist-activists, looking to make space for art that is deliberately disruptive of structural hierarchies that power the status quo.
A New Bill Takes Aim at Government Pressure to Silence Lawful Online Speech [Deeplinks]
Last week, Senators Ted Cruz and Ron Wyden introduced the Justice Against Weaponized Bureaucratic Overreach to Networked Expression, or JAWBONE Act. The bipartisan legislation creates a federal cause of action against government officials who coerce or attempt to coerce broadcasters, interactive computer services, or AI providers into taking actions against lawful, First-Amendment-protected speech, and establishes a transparency system for government communications with those intermediaries about user expression.
We thank the Senators for their leadership on this important issue. Jawboning occurs when the government pressures private companies to censor speech protected by the First Amendment, and it’s not always obvious to the public or to the victims what has actually happened. Deleting posts or cancelling accounts because a government official or agency demanded it or even made threats in making those demands—just like spying on people’s communications on behalf of the government—raises serious free speech concerns. Among other things, this bill would provide a new legal right to bring claims against the government in federal court, in addition to what the First Amendment provides.
At EFF, we’re continuing to fight back on behalf of those censored by government coercion. One recent example: we represent the creator of ICEBlock, an app that allows the public to report immigration enforcement activity in their communities. In June 2025, high-ranking federal officials began threatening to investigate and prosecute the creator of ICEBlock, Joshua Aaron. In October 2025, the U.S. Attorney General demanded Apple remove ICEBlock from the App Store, and the company complied. The government’s coercion violated Aaron’s First Amendment rights.
We’ve also filed a Freedom of Information Act lawsuit against the same government agencies that threatened Aaron and other services that provided forums to report ICE activity. The lawsuit seeks the disclosure of the government’s communications with Apple, Google, and Meta that forced the services to remove lawful speech.
When federal officials pressure private companies into censoring protected speech, it can violate the First Amendment. But, not every communication from a government agency to a platform is unconstitutionally coercive. Treating legitimate communication and information-sharing between the government and private actors as though it were always unconstitutional would chill the valuable, good-faith engagement that supports a healthier and safer internet and nation for all Americans. This is a complex issue, and one that is important for Congress and the courts to get right.
Finally, contrary to what many in Congress have been saying, social media platforms and other internet intermediaries have their own First Amendment rights to decide how they moderate users’ speech. They are not “state actors” and do not have an obligation under the First Amendment to allow all user speech on their platforms. EFF filed an amicus brief setting out our position in 2018, and we’ve said it in many cases since. The Supreme Court recognized again in the Netchoice cases that these services have a right to curate and edit their users’ speech, whether or not it aligns with the government’s position. And, it’s important to defend that First Amendment right so that governments cannot dictate how to edit a company’s site according to the government’s wishes and desires. To prevent jawboning by default, companies must be free to curate their platforms as they wish.
EFF applauds Senators Cruz and Wyden for taking this critical issue seriously, and we look forward to working with Congress on this bipartisan bill as it moves through the process. We hope it lands on the right balance to provide additional protections for everyday users around freedom of expression.
Court Records Should Be Free [Deeplinks]
Court records belong to the public. Yet anyone seeking access to federal court filings through PACER, a government software system that stands for Public Access to Court Electronic Records, is usually required to pay hefty fees to search for and view documents. PACER’s fees have long acted as a barrier that makes it hard, especially for low income people, to see and understand the work produced by our own public servants.
That's why EFF joined a broad group of organizations supporting the Open Courts Act of 2026, legislation that would modernize the federal courts' electronic filing systems and eliminate PACER fees.
The bill would replace the aging PACER and CM/ECF systems with a modern, unified platform designed to improve public access, strengthen cybersecurity, and reduce long-term costs. Supporters note that PACER currently collects more than $150 million annually in fees from the public, despite court records being public documents.
The Open Courts Act would also make court records easier to find, access, and understand. The legislation builds on a similar proposal, also supported by EFF, that previously won bipartisan support in the Senate Judiciary Committee but did not become law before the end of the congressional session.
This is not a new issue for EFF. More than a decade ago, we criticized PACER's paywalls and the removal of some court records from online access, arguing that the public should not have to pay to read the law and the judicial decisions that shape it. The Open Courts Act would move U.S. courts a big step closer to that goal.
In addition to EFF, the bill is supported by Fix the Court, the group pushing this bill forward; the Free Law Project, which maintains RECAP, software that has created a large archive of legal opinions and other court records; as well as civil society groups, open government watchdogs, and media groups.
Public access to the courts is a cornerstone of democratic accountability. Let’s eliminate unnecessary barriers to court records, and bring the federal judiciary’s tech into the modern era.
- Read the full letter supporting the Open Courts Act of 2026
20:07
Field Notes from a Year of OPSEC Training [Deeplinks]
Late last year, as part of our annual “Year in Review” series, we summarized our efforts providing digital privacy and security advice to at-risk communities. OPSEC trainings (short for operational security, a catch-all term we use to describe any kind of workshop, advising session, assessment, or presentation about operational security for individuals and organization) are something we've long provided, but until recently, something we’ve never broadcasted.
This has become a critical aspect of our work over the years, keeping us grounded and in touch with the realities of tech-enabled violence as well as evolving resistance strategies used by movement workers. Hoping other security trainers and organizers copy our homework, here’s a more thorough breakdown.
NOT TRADITIONAL PENTESTING
To be clear, we're not a 'pentesting' company, which refers to the methodological process of testing a person or organization's security and privacy posture, nor an information security (infosec) firm that offers anything within scopes of traditional security assessments. Infosec companies almost always adhere to a cycle of: discovery/reconnaissance; > vulnerability scanning and testing; > exploitation of vulnerabilities found; > and a reportback of recommended mitigation strategies. Such full-spectrum audits can run the gamut of testing network security, physical security, organization posture against phishing or ransomware attacks, web app security, and more. For many organizations, the value of such engagements is immeasurable.
Such companies—although equipped with the technical sophistication to do full-spectrum digital security auditing and testing—often lack the critical points of view of human rights defenders and activists. Many human rights defenders and liberation movement workers are critically under-resourced and unable to meet the high costs of engagement with such infosec companies. But that’s not what we offer. Our trainings center the needs of people on the ground, and offer this work pro bono.
The cycle of engagement our work tends to take is similar to the lifecycle of pentesting outlined above, but with some key differences better suited to people-powered movements.
We begin with a period of discovery about the organization we’re engaging with, learning about their work, the issue space they’re working in, and the types of threats their peers have faced in the past. Relying on our knowledge of known threat actors (state-operated threats, non-state actors, surveillance mechanisms, and more), we conduct a thorough threat modeling and risk assessment exercise, surfacing critical pieces of information about what we ought to prioritize protecting and from what. Sometimes that’s enough for a group to get started on improving their security plans, and we send them on their way.
After receiving consent from the group to do so, we may perform some OSINT (open source intelligence) investigation and map out a sketch of their digital footprint. This often looks like some combination of discoverability through public records, data broker ecosystems, and breach databases, as well as risks they may incur through the services they rely on for their web presence. That latter part can be done with typical pentesting reconnaissance tools, as well as our own project Privacy Badger for mapping the trackers on their website, which pose them and their users some amount of risk. Working from this sketch of their digital footprint, opportunities to lessen the reach of their data exposure, or at least the more sensitive areas they ought to be aware of, become apparent.
For a more in-depth engagement, we take the information gathered from the guided threat modeling exercises, as well as the digital footprint we’ve developed for them, and we move on to training the participants on what they need to address their threats. Sometimes that looks like a deep dive on encryption and how it can be used to protect data backups and secure communications. Other times it looks like getting very knowledgeable and practiced on the various ways to stay safe from surveillance threats encountered at a protest. Often though, our engagement with those asking for advice on how to strengthen their OPSEC is as simple as presenting materials covered in our Surveillance Self-Defense (SSD) project, but with EFF staff to help apply those lessons to their context.
MOVEMENTS AND COMMUNITIES ADVISED
Requests for such training mostly arise organically, either via referral, from our participation in external media, or driven by an interest in SSD. Naturally, the demand for accessible OPSEC advice escalates along with the general sophistication and reach of surveillance technology. And as authoritarianism creeps and continues to threaten the movement workers fighting against it, there's a marked urgency for that demand.
The types of communities and liberation movement workers that reach out run a wide array of experiences, but some commonalities stick out. Since the fall of Roe v. Wade, we've seen a huge uptick in abortion access activists like clinic escorts and information distribution networks reaching out. So too are providers of criminalized healthcare services, both abortion services and gender affirming care alike. The list goes on: advocates for transgender rights such as art collectives and archivists, sex worker rights activists, survivors of intimate partner violence, climate justice activists, legal defense groups focusing on immigrant justice and Black liberation. And many, many others, often stemming from experiences of distinct marginalization and state-powered violence.
We’re dressing the wounds the violence of surveillance inflicts.
TAXONOMY OF THREATS
When there's a cast of common threat actors that so often emerge during risk assessment (ideologically motivated harassers, lawmakers, cops, negligent leadership at large tech platforms, etc) there is a level of predictability about their capabilities. We use that information to make knowledgeable risk assessments for those we’re working with, determining the means that threat actors have to cause them harm, as well as the likelihood.
For community organizers and grassroots activists we most often see concerns around doxxing (and harassment driven by OSINT), social media monitoring, content suppression on tech platforms, and insider threats such as infiltration within trusted communication channels. Often this comes with a tension between publicity and privacy—needing to spread their message and further their cause, while recognizing that digital privacy has a profound impact on their personal safety. Some activists may instead hope to organize other more covert forms of direct action. They're more likely to be concerned about the types of street level surveillance that they may encounter.
Small organizations nonprofit and otherwise may share the concerns around doxxing, as well as traditional digital security concerns around their web presence. Website defacement and data exfiltration are particular concerns for organizations that don't have the resources to commit to IT security staff. And for those that do have meager budgets for such things, organizational compliance and ease-of-use regarding privacy and security technologies are a whole other concern. The question then becomes how to manage a system of distributed devices that are uncontrolled by the organization, but operationally necessary for each member of their community.
Generally speaking, the threats most commonly encountered in these spaces have to do with the opacity and unchecked reach of surveillance systems. With every single individual or group that we encounter in this type of work, threat modeling comes number one in terms of priority. There is no way to protect against every theoretical threat. Instead, we walk others through the process of identifying and then prioritizing known and perceived threats, based on their specific context and the type of work that they do, before moving on to recommended mitigation and resistance strategies.
STRATEGIES OF RESISTANCE
Developing a threat model without a course of action often does more to stoke privacy nihilism than remedy the risks communities face. The more we engage with at-risk communities and offer reasonable, accessible OPSEC advice, the greater our instinct develops for recognizing such strategies. At the core of these recommendations lie the backbones of privacy and security fundamentals, such as encryption, access controls, sophisticated backup plans, OSINT skills, and resistance to online tracking.
Over the years, we've found it easiest to begin with non-technical recommendations first. These strategies often mesh well with the community's extant organizing procedures, such as designating team roles and thought out contingency plans for specific risks. This may look like identifying those extant plans and tacking on responsibilities like data backups, code words for community vetting, and developing workarounds or contingency plans for if they lose access to specific technologies.
Eventually, though, the strategies must become more technical, like switching to more private and secure technology alternatives, developing a sophisticated and encrypted data backup plan, and having technical contingency plans in place for if/when they are deplatformed or their services interrupted. Developing patience and compassion when walking groups through unfamiliar technologies is an essential tool of this work. So too is the habit of checking ourselves, as privacy and security nerds, to know the difference between the most secure technologies and those which will actually be used by at-risk community members. Any step towards more thoughtful OPSEC is better than one too difficult to use. The last thing we want is a recommendation that results in people frustratedly giving up on doing anything at all. After all, the whole point of this is to empower movement workers, not inhibit them.
HOLISTIC MITIGATIONS
It is painfully obvious how many identified threats could be protected against if there were comprehensive data privacy legislation protecting all people. The lack of such is an existential threat to everyone. Bills that undermine peoples' right to privacy are never clear about what they're doing, and often come wrapped in some paternalistic guise of addressing some other harm elsewhere. They often use confusing, oblique language that preys on the public's interest to correct the course of other social harms. The reality is that when it’s clearly explained, every person online wants better privacy. And as we know, every individual's personal security and wellbeing are entwined with their access to privacy. The capacity with which a person can decide what to share online, rather than have sensitive information non-consensually taken from them by creepy surveillance technologies, is a matter of self-determination. And it's in all our best interests to fight for the right to self-determination.
WHAT WE GET BACK
An unexpected outcome of identifying so many common threat actors across such varied issue spaces is revealing potential avenues of collaboration and camaraderie. Some movements are already keen on this allyship, such as those focusing on various aspects of bodily autonomy and self-determination. Abortion access activists and trans liberation activists are often in concerted allyship. Other less obvious connections are legal defense groups that offer "know-your-rights" style educational materials and other issue-specific activists who have questions about the legal threats they're facing while fighting for their cause.
Recognizing the common threat actors across different issue spaces begins to highlight opportunities for collective action against those threats. As a digital rights organization, this is very much our wheelhouse, and precisely why our technologist team is self-described as one working toward the public interest. It’s also from this point of view that we continue to win. And why it’s critical for lawmakers to pay attention when we say particular pieces of bad legislation are harmful to public safety. And finally, why it is necessary for public interest technologists and digital rights activists to connect with other communities to learn about the specific technology risks they’re worried about. As Mariame Kaba says, “Nothing that we do that is worthwhile is done alone.” This very blog post is in an effort to provoke thought for digital security trainers, so that we as a community don’t work atomized and alone, reproducing the same work, exhausting ourselves and creating unnecessary redundancy.
We do what we can to keep up. And thankfully, we participate within an ecosystem of digital security providers that have a keen mind towards fighting for digital rights. We share resources, referrals, and expertise. Our Surveillance Self-Defense project is stress-tested by the experiences shared by the liberation movement workers we engage with and provide this work to. If you’re interested in becoming a digital security resource for your community, start with the SSD. If you’re a human rights defender with questions about how to stay safe, reach out. And if you’re not sure what else to do, you can always help us keep it going.
AI Regulation Should Be Rational, Not Retaliatory [Deeplinks]
The Trump administration’s approach to AI safety, particularly the generative AI models that regularly grab headlines, has been haphazard at best. At worst, it’s unconstitutional. As EFF and our allies explained in an amicus brief, the Pentagon’s actions against one company, Anthropic, violate the First Amendment because they were motivated by the administration’s desire to punish an uncooperative company, not legitimate concerns about national security.
By and large, the Trump administration’s AI strategy has minimized regulation in the name of “winning” the global “race” to develop leading frontier models. It has pared back regulations intended to address even the most serious AI threats—like AI-enabled cyberattacks on government systems—to protect AI innovation.
Yet it has repeatedly singled out one AI company for arbitrary, heavy-handed rules and sanctions. For years, the federal government relied on Anthropic’s models for use in its classified systems. But after Anthropic resisted the government’s demands to use Anthropic’s models to autonomously kill people or spy on Americans, the government declared war on the “woke” company. It designated the company a “supply chain risk,” effectively banning agencies and government contractors from doing business with the company.
A court issued a preliminary injunction preventing these sanctions from taking effect, as EFF and other civil liberties organizations urged it to do in an amicus brief filed earlier this year. But absent judicial action, these sanctions would’ve cost the company hundreds of millions of dollars. Either way, it sent a clear signal that companies must adhere to the government’s wishes or face similar consequences.
As we explained in our brief filed today, these sanctions were clear retaliation for the company’s public refusal to allow the Pentagon to use its models to develop fully autonomous weapons and spy on Americans. This kind of retaliation is unconstitutional.
In a recent executive order, the Trump administration took its war on Anthropic even further, by imposing “export controls” that ban any foreign nationals from using Anthropic’s new Mythos and Fable models. To comply with this order, Anthropic shut down the models altogether.
These extreme measures were purportedly justified by security concerns. The administration said it feared that Anthropic’s Mythos-class models could be used to find and exploit existing vulnerabilities in software code—hardly a new feat for an LLM. Anthropic itself has contributed to public anxieties about its Mythos-class models, initially claiming that Mythos was too dangerous for public release and restricting access to a handful of partners. The company’s CEO called for a pause on AI development, citing fears that the technology was becoming too powerful.
But regulators should be cutting through the hype, not feeding it. Even if Mythos’s capabilities were a modest improvement over existing technology, others are already closing the gap. In other words, nothing about Mythos is so uniquely dangerous that it warrants exceptional export controls to protect the public. Yet other LLMs with similar offensive cybersecurity capabilities are not subject to export controls. Instead, the government has embraced a voluntary system in which companies are encouraged to submit models to the government for cybersecurity testing 30 days before releasing them to the public.
AI policy should be reasonably responsive to real-world risk, grounded in the realities of the technology, and no more burdensome than necessary to protect the public. But the government’s haphazard decision to impose export controls on Mythos-class models, while subjecting other AI models to nothing more than a voluntary, light-touch framework, meets none of these criteria. As leading cybersecurity experts and executives recently explained in an open letter, these sanctions prevent developers and security teams from using the best models to find and fix vulnerabilities before adversaries, armed with nearly as capable AI, can exploit them.
Decades Later, Code Is Still Speech
More importantly, export controls on important software tools like LLMs can undermine the free flow of digital communications and technologies that activists, innovators, and ordinary users desperately need. Freedom of expression requires access to these tools. Depriving the public of the best AI threatens our rights without making us any safer.
EFF has long opposed government efforts to restrict the publication of non-classified software to the general public. In the 1990s, EFF challenged export controls on encryption software, helping establish the principle that “code is speech,” protected by the First Amendment. Courts recognized that software is not just a functional tool—it’s a means of ideas, knowledge, and technical know-how. And they recognized that the government was overreaching in trying to restrict private developers from sharing their improvements in computer security with the public.
While AI models raise new questions, efforts to restrict access to them implicate the same constitutional and speech concerns as older efforts to restrict encryption. Export controls are uniquely susceptible to abuse. And they are especially suspect when they are unilaterally imposed without clear and fair standards.
Whether these export controls were another attempt to punish Anthropic or simply a misguided security measure, the public loses. The real cybersecurity risks of advanced AI may ultimately justify limited regulations to protect the public from legitimate threats. But whether the government ultimately chooses to heavily regulate the technology or hold off to promote innovation, its rules must be rational and evenhanded.
- Read EFF's Amicus Brief in Anthropic v. Department of War
19:28
The Big Idea: Joseph Eckert [Whatever]
Many of us dream of time travel, but what if that travel was thrust upon you randomly and unwillingly? Author Joseph Eckert brings us a fresh take on time travel in his new novel, The Traveler. Venture on through his Big Idea to see when and where this unique travel idea originated.
JOSEPH ECKERT:
The core of The
Traveler is family. More specifically, the core is the
relationship between an average Midwestern father and his
extraordinary son. Simultaneously, it’s also a vast science
fiction story about a man tumbling helplessly forward through time,
the length of time he travels doubling every twenty four
hours.
Bear
with me, if you will, as I look back three decades (oof—that
hurts to write) to two key events in my life that would lay the
groundwork for the Big Idea behind The
Traveler.
The
first event involves me, precocious youth, coming home from what I
remember was fifth grade, having just learned about exponents. I
found my mother and convinced her to change my allowance. Instead
of a dollar a week (or whatever it was), I asked for just a penny a
day. Just one cent! Except she’d double the amount the next
day, and each day thereafter. So: two pennies on day two, four
pennies on day three, eight on day four, and so on. My mother
agreed. My plan was in flight. Soon, I knew, she’d be forced
to pay me thousands, then millions of dollars! Cue maniacal
fifth-grade laughter.
We
didn’t even make it to day ten before she called it
off.
Despite my dream of phenomenal and unlikely
wealth coming to an abrupt and inglorious ending, I retained my
interest in exponential increases. We see such increases in life
and the sciences, from viral propagation to the now mostly defunct
Moore’s Law in computing, to amusing dinner table discussions
of vampires overrunning the planet (and subsequently starving
because everyone’s a vampire and no one’s left to be a
living blood bag—this is common dinner table discussion,
right?).
The
exponential penny scheme was event one. Event two took place when I
was around the same age, at a book store in Northern Wisconsin
called Book World.
My
parents didn’t often take me to the local library, for
whatever reason, but they did take me to Book World, sometimes
leaving me there for hours. Rather remarkably for a small town
bookstore not far from the Upper Peninsula of Michigan, Book World
had a solid sci fi and fantasy section, including books by authors
living outside the United States. It was through Book World that I
was introduced to the works of Tad Williams, Joe Haldeman, Clive
Barker, and, most importantly for this Big Idea, Peter F Hamilton
and Iain M Banks.
I
remember walking into Book World. Pushing through the glass door,
stepping into the narrow entryway with its gentle upward slope,
angling around the crowded newspaper stacks. Entering the store
proper, I recall the smell of books baked into the very walls; the
soft creak of the floorboards under my sneakers in the perpetually
hushed space; the winding path I’d take from the front door,
always walking by the magazines first (craning my neck to try to
see around the plastic covers blocking the Playboys and
Penthouses… I was an adolescent boy). Down the aisle,
glancing at the comic books for anything new and eye-catching, then
a fast one-eighty around the end cap, into the fiction and then the
fantasy and science fiction section. What new wonders would
await?
I
have a clear memory of seeing the covers for Consider
Phlebas and The Reality Dysfunction for the first
time. What amazing futures must those books contain to have such
glorious art on the outside? I convinced my parents to buy them (or
I used my allowance… perhaps contributing the meager amount I
received from my exponential penny scheme) and began to
read.
Magically, powerfully, the wonders inside the
pages exceeded the promises made by the covers.
And
as I read, I began to wonder. What if? Could I write something like
this, in this tradition? Something this big, this grand, with this
amazing scope?
Hard
cut to many years later.
As I
was pulling together the idea that was The Traveler, I
knew I wanted the protagonist to be a relatable Everyman, one whose
life was not extraordinary until a defining moment when it all
changed. I wanted a father-son relationship to be at the core,
reflecting a bit of my life experience with my own father. And I
wanted to write something in the vein of Peter F Hamilton and Iain
M Banks, asking big sci fi questions and (hopefully) bringing the
reader on the kind of imaginative ride I remembered from those
science fiction classics of my youth.
But
how to get our modern-day relatable Everyman into a grand sci fi
future? What could get him there but not instantly… instead,
by steadily increasing degrees…?
Ah
hah!
The
exponential penny scheme returns and finally bears
fruit.
Thus
was born the central conceit of The Traveler. Scott
Treder, a Madison area database admin, is driving to work one day
when his car disappears around him. Scott, still going twenty five
miles per hour, falls out of the sky and tumbles down the sidewalk.
As he sits, battered and bruised and confused, on the side of the
road, his phone reconnects to the network. He has dozens of texts
and voicemails waiting for him.
It’s twenty four hours in the
future.
The
next day, at exactly the same time, he travels two days forward.
Then four, then eight, then sixteen… and this time,
there’s no mother, eyebrow arched, to cotton onto the scheme
and put a stop to things before day ten.
As
Scott jumps forward through time, his brilliant son, Lyle, grows
obsessed with figuring out what’s happening—and with
saving his father.
The Traveler is out now in the US and
UK. I hope you enjoy reading it, and I hope it carries you on a
journey the same way those brilliant works by Peter F Hamilton and
Iain M Banks did for me in my youth.
The Traveler: Amazon|Barnes & Noble|Bookshop|Books-A-Million|Powell’s
Author socials: Website
19:00
City Hally rally with the Knicks [Scripting News]
Watched the ceremony at City Hall.
Glad they went through the whole team and gave them something honorable to take with them.
My moment of clarity on what this meant came when Mitchell Robinson got his award as a champion.
I also liked that the Mayor listed all the recent past Knicks players who could've been on this team but were traded to make it what it is. He named the right ones.
The whole thing was inclusive, generous and working together. Cried all the way through it, nice release still don't have any idea which way is up. In my heart this was never supposed to happen but there it is.
Why wasn't Clyde on the stage?
And Dolan reminded us we don't get to vote for him. I know I know.
18:14
Today I did a change that was across two apps, different projects, client and server. I tested it as best I could for now, and it appears to work in both apps. But now I have an extra level of confidence because I asked Claude to do a code review, checking all my assumptions and it does find egregious mistakes, that in the past might have taken a day in a debugger to track down. Now it can happen in less than the time that it took for me to write this post.
17:35
The Software Freedom Conservancy's LLM-backed generative AI recommendations [LWN.net]
The Software Freedom Conservancy (SFC) has announced the release of its recommendations for using LLM-backed generative AI systems for FOSS contributions. The recommendations were created by the SFC and volunteers from the free-software community.
The recommendations reflect the extremely difficult dilemmas that these systems pose for FOSS contributors. SFC and its volunteers understand that FOSS developers are approaching LLM-gen-AI from a variety of perspectives. The recommendations offer practical assistance to minimize the damage caused by using proprietary systems, whether FOSS contributors reject LLM-gen-AI or choose (voluntarily or by employer mandate) to use them.
These recommendations are best practices (but not definitions or requirements) that SFC and its volunteers formulated after careful study of the growing LLM-gen-AI use among FOSS contributors. SFC will follow these recommendations with a series of supporting materials, including documents, online tutorials, public Q&As, podcasts, and other community engagement. We will routinely refine our recommendations and continue to support FOSS contributors as they navigate this difficult landscape.
16:42
Compare the badass parade in NYC to the deplorable demo Trump had at the White House last week. The people meeting the people to love each other. How much better and more American could it get.
Kubernetes in the Age of AI [Radar]
When Kubernetes first came onto the scene, it was a major turning point, a revision of the infrastructure and operations space that transformed the way developers and ops personnel build, deploy, and maintain applications in the cloud. It has since become the clear standard for how modern applications are built and operated. As the CNCF noted in its latest Annual Cloud Native Survey report, “Among container users, 82% are using Kubernetes in production in 2025, up from 66% in 2023. This represents near-universal adoption within the container ecosystem.”
Over the last few years, another revision in the space has occurred with Kubernetes’s evolution from a container orchestrator to an AI infrastructure platform. According to the CNCF survey, “The rise of Kubernetes as the de facto AI platform represents a fundamental shift in how organizations approach machine learning operations. . .[with Kubernetes] providing a unified orchestration layer that handles both traditional application workloads and compute-intensive AI tasks.” The emergence of seismic technologies like generative AI and agentic AI has only accelerated this transformation.
The intersection of AI with Kubernetes is undoubtedly one of the most impactful developments in the operations space. As Jonathan Johnson, software architect at Dijure, observes, “AI on K8s is very, very important, and there is not enough [resources] out there.” Raju Gandhi, senior technical architect at Edward Jones, echoes this assessment, noting that “operationalizing AI/ML on K8s is a big issue, [and it’s only] getting bigger. This is a topic that needs attention.” But what are some of the things that you should know about this trend to keep abreast and stay ahead in the game?
Generative AI
Anyone with access to a computer or a smartphone has likely used some iteration of generative AI, a stunning fact when you consider that GenAI was on the outer edges of mainstream discourse and consumption a scant five years ago. But at the end of 2022, the debut of ChatGPT marked the beginning of a technological revolution, one that would impact and reshape nearly every aspect of our working and personal lives. Unsurprisingly, there are now thousands of generative AI models, a proliferation that naturally has its own set of complexities. Selecting a model is simple, but if you’re an application developer or MLOps engineer, how do you go about operating that model in a production system? Not only do you have to be cognizant of factors like resilience, scalability, security, and operational costs, but there’s the fact that bringing a model from experimentation into production can be arduous if not done properly. That’s where Kubernetes comes into play.
As Roland Huß and Daniele Zonca, distinguished engineers at Red Hat, note, “GenAI/LLM models are resource intensive, requiring substantial computational power and large datasets. Given its scalability and extensibility, Kubernetes is uniquely suited to function as an efficient platform for AI and LLM model pretraining, fine-tuning, deployment, and prompt engineering.” They further elaborate that “this integration with Kubernetes not only simplifies the adoption of cutting-edge AI technologies but also ensures a seamless and efficient operational flow. Kubernetes, with its robust scalability and management capabilities, stands as an ideal platform for generative AI projects, aligning DevOps and MLOps practices in a cohesive ecosystem.”
This sentiment is already shared by a wide swath of the industry. According to the CNCF survey above, as of 2025, 66% of organizations run generative AI workloads on Kubernetes. These organizations include OpenAI, which uses Kubernetes for its AI/LLM application experimenting and testing; Tesla, which utilizes KServe to manage production-grade LLM inference; and Adobe, which uses Kubernetes to power its suite of generative creative models. Other companies taking this approach include Uber, Intuit, and Google. With more companies adopting this practice for their generative AI and LLMs operations, it’d be prudent for any organization to leverage Kubernetes for their own GenAI and LLM workflows.
Agentic AI
Nearly coinciding with the rise of GenAI has been the steady growth of agentic AI. Unlike GenAI, agentic AI goes beyond answering simple prompts and generating text in its ability to operate autonomously to perform complex, multistep actions, utilize tools, and make independent decisions. With its ability to support both traditional ML processes and GenAI and LLM operations, it should come as no surprise that Kubernetes has a role in the agentic AI ecosystem as well.
According to Ronald Petty, principal consultant at RX-M, “Kubernetes has been leveraged to host machine learning pipelines, including AI model training and inference. As inference options have become plentiful and affordable, on and off-premise, we have seen the rise of agents. Coupling cloud native technologies and popular protocols, we now see agents moving from ad hoc demos to complex fleets of agents on systems like Kubernetes.” So what are some examples of the integration between these two technologies?
One notable offering is Kagent, an OS programming framework that runs AI agents in Kubernetes and “helps engineers build powerful internal platforms by tackling cloud native tasks such as configuration, troubleshooting, complex deployment scenarios, observability pipelines and dashboards, and safely enabling network security.” Operating along similar lines is K8sGPT, an AI-powered tool that leverages intelligent insights and automated troubleshooting to analyze Kubernetes clusters for configuration problems and security issues, as well as generates solutions to problems discovered in analysis.
A more recent entry in the field is Sympozium, a Kubernetes-native coordination layer for multi-agent AI systems that “solves the same problem Kubernetes solved for containers, but for agents that need to share context, hand off tasks, and maintain shared situational awareness.” Another newer offering is Agent Sandbox, which allows you to run AI agents as isolated, stateful workloads with a native API on Kubernetes.
The fundamentals
While it’s important to be aware of the latest developments and trends affecting your domain, that shouldn’t come at the expense of foundational knowledge and skills. As basketball great Michael Jordan once said, “Get the fundamentals down and the level of everything you do will rise.” One of the most fundamental skills for working with Kubernetes is networking, and frustratingly enough, it’s one of the more difficult ones to master. As Cisco senior staff engineer Nico Vibert observes, “Platform engineers tend to be comfortable with Linux networking but less so with protocols like BGP and IPv6; network administrators know those protocols well but find Kubernetes abstractions unfamiliar. Both personas struggle to navigate the dozens of networking tools seemingly required to meet connectivity and security requirements.” Yet as organizations move mission-critical workloads, AI training pipelines, and regulated financial services onto Kubernetes, the engineers who can design, secure, and troubleshoot the network layer have become some of the most sought-after professionals in the industry.
In recognition of both the importance and difficult nature of the Kubernetes networking skill, the CNCF recently announced a new certification focused on the Kubernetes network engineer role. The certification is designed to validate hands-on networking expertise across all of the aforementioned layers, filling a gap that the Kubernetes community has long recognized.
For organizations that use Kubernetes to develop and deliver applications, leaders and decision-makers need to be aware that utilizing Kubernetes in conjunction with the latest AI tools is no longer a luxury but a necessary practice that will allow their companies to thrive. A similar onus should be placed on the basics. When hiring your next DevOps, network, or site reliability engineer, ensure that their ability to design, secure, and troubleshoot the Kubernetes network layer is second to none.
If you want to dive deeper, check out Roland Huß and Daniele Zonca’s Generative AI on Kubernetes, Jonathan Johnson’s GPU Kubernetes Homelab live course, Alex Corvin, Taneem Ibrahim, and Kyle Stratis’s Scalable Kubernetes Infrastructure for AI Platforms, Ashok Srirama and Sukirti Gupta’s Kubernetes for Generative AI Solutions, and Yogesh Raheja’s K8sGPT Essentials on-demand course. They’re all on O’Reilly. If you’re not a member, you can get started with a free trial.
Pluralistic: AI digital sovereignty risk doesn't exist (18 Jun 2026) [Pluralistic: Daily links from Cory Doctorow]
->->->->->->->->->->->->->->->->->->->->->->->->->->->->->
Top Sources: None -->
Today's links
- AI digital sovereignty risk doesn't exist: If 'risk + AI = risk – AI', then 'AI = 0'.
- Hey look at this: Delights to delectate.
- Object permanence: Napster x librarians; Flickr API reciprocity; KFC's Mega Jug v diabetes research; Hambone virtuoso; Google fiber x binding arbitration; "The Immortal Choir Holds Every Voice."
- Upcoming appearances: LA, Menlo Park, Toronto, NYC, Philadelphia, Chicago, London, Edinburgh, Sydney, Melbourne, Brighton, London, South Bend.
- Recent appearances: Where I've been.
- Latest books: You keep readin' em, I'll keep writin' 'em.
- Upcoming books: Like I said, I'll keep writin' 'em.
- Colophon: All the rest.
AI digital sovereignty risk doesn't exist (permalink)
Back at the height of the blockchain bubble, I made a hobby of pointing out that crypto weirdos were palming a card. I used this formulation:
if: problem + blockchain = problem – blockchain
then: blockchain = 0
https://pluralistic.net/2022/01/30/the-inevitability-of-trusted-third-parties/
You see, blockchain weirdos kept insisting that they could solve problems related to trust and institutional design with "smart contracts." Rather than having to trust a board of directors to steer an organization, you could just have a self-executing institution, the "distributed autonomous organization" or DAO.
So for example, if you want to buy a copy of the US Constitution at a Sotheby's auction, you could set up a DAO to raise and pool the funds, eliminating the need to find trustworthy people to receive, hold and deploy these funds:
https://en.wikipedia.org/wiki/ConstitutionDAO
However – and here's where the palmed card comes in – the DAO can't go to Sotheby's and place a bid on the Constitution. Instead, the members of the DAO have to elect a guy to receive all that cash, walk into Sotheby's, get one of those little ping-pong paddles last seen at the State of the Union in Chuck Schumer's withered claw (emblazoned with the brave slogan "You're hurting my fee-fees") and raise the paddle during the bidding.
That guy doesn't have to go to Sotheby's. That guy can simply walk away with all the money. Members of the DAO are trusting this guy with their entire collective treasury. Indeed, since the DAO has no corresponding legal entity, it might even be that members of the DAO can't sue this guy if he steals all their money – and even worse, without a limited liability structure, it might mean that everyone in the DAO can be sued for anything bad this guy does with the money.
Which raises the question: what's the point of building this insanely complex hairball of blockchain-based smart contracts to raise and hold the money if you're just going to hand it to this guy and trust him without limit? Why not just have that guy set up a Zelle account and a Whatsapp group? In other words: the problem that the DAO is trying to solve is the difficulty of trusting people with the keys to the kingdom, but no matter how much blockchain you sprinkle on this DAO, it ends with this one guy walking around with all your money, which he can steal with impunity if he so chooses.
Or, put more succinctly:
if: problem + blockchain = problem – blockchain
then: blockchain = 0
This turns out to be a really good way of assessing policy prescriptions for their soundness and foundation in reality, because – as the blockchain swindle shows us – it's possible to come up with entirely fictitious solutions to entirely real problems. The problem of designing a trustworthy institution that can't be betrayed by its leaders and whose operations don't consume all its resources is a real problem – it's quite possibly the real problem – but adding a DAO does nothing to solve the core problems of institutional design, and actually makes some of those problems worse.
There's another real problem with a fictitious solution that is – surprise! – tied to another tech bubble: digital sovereignty.
It's a genuine problem that everyone in the world (outside of China's sphere of influence) is glued to America's tech platforms. These platforms steal everyone's money and data, and every country has signed a trade deal with the USA promising not to let its own technologists and entrepreneurs go into business making add-ons and complementary goods that remediate the defects in America's tech exports:
https://pluralistic.net/2026/01/29/post-american-canada/#ottawa
What's more, Trump's response to finding himself in this poker game that's rigged entirely in his favor is to flip over the table because he resents having to pretend to play at all (as November Kelly so aptly put it). His incontinent belligerence on the world stage sees him making bids to steal whole countries and he's recruited American tech giants to help him in this chaotic program of lunatic imperialism. When other countries' public officials make decisions that Trump dislikes, he gets companies like Microsoft to disconnect whole institutions from the internet, deleting their files, email archives, calendars and address books, and depriving them of the ability to connect to any service tied to their Outlook accounts:
https://pluralistic.net/2026/04/20/praxis/#acceleration
Which means that if Trump wants to steal Greenland, he doesn't have to roll tanks into Nuuk – he can just brick the country of Denmark. He can shut down all their ministries, every large firm, every household. He can shut down their iPhones and Android devices. He can kill their smart-speakers. He can hormuz the world's supply of Ozempic, Lego and ferociously strong licorice:
https://pluralistic.net/2026/04/04/digital-subjugation/#greenlands-next
It doesn't stop there! Trump can also shut down every tractor!
https://pluralistic.net/2022/05/08/about-those-kill-switched-ukrainian-tractors/
This is the digital sovereignty risk. It's also the digital sovereignty opportunity. If countries repeal the laws that the US bullied them into accepting, laws that protect US tech giants from local competitors who block their plunder of data and money, they can turn America's tech trillions into their own tech billions. As Jeff Bezos likes to say, "your margin is my opportunity":
https://pluralistic.net/2026/01/30/zucksauce/#gandersauce
Meanwhile, repealing these US-protecting laws would enable countries to extract their data from US platforms so they can move it into domestic alternatives, and bypass the software locks that block them from updating phones, cars, tractors and ventilators to protect them from remote killswitches:
https://pluralistic.net/2026/01/01/39c3/#the-new-coalition
The digital sovereignty risk is having your country's government, businesses and industries terminated by Trump. The digital sovereignty opportunity is making billions of dollars by producing and exporting products that defend people from Big Tech plunder and Trumpian killswitches. That is the real world.
But many "digital sovereignty" advocates are living in an imaginary world, in which the digital sovereignty risk is that Trump will shut off their country's access to AI.
This is where the "if problem + blockchain" formulation comes in handy. If Trump shut off Canada's access to Chatgpt, Claude and Grok tomorrow, nothing would happen. No significant business, no federal or provincial ministry, no municipal government depends on these products for anything essential. And if Canada were to build their own local AI to sub in for Chatgpt, Claude and Grok, it would loose tens, if not hundreds of billions of dollars. Worst of all, a national AI strategy does nothing – not one solitary thing – to protect Canada from Trump shutting down our ministries, our companies, or our tractors.
In other words:
If: digital sovereignty + AI = digital sovereignty – AI
Then: AI = 0
If you think AI tools are nifty and want Canada to invest in AI, then first, please stop pretending that this has anything to do with "digital sovereignty." Not only is this a transparent bit of nonsense, it's a dangerous one, because digital sovereignty is a real problem, and AI does nothing to solve it.
If you want a good "national AI strategy," try this: save your money until the bubble bursts, and then buy your GPUs and hire your talent at 10 cents on the dollar and put them to work refining open source models:
https://pluralistic.net/2025/12/05/pop-that-bubble/#u-washington
Buying AI at the top of the market is nuts. That would be like shopping for Aeron chairs and foosball tables in March 2000. If you just sit tight for a couple months, you'll be able to find bankrupt dotcom entrepreneurs selling these at knock-down prices out front of their formerly overpriced office space in the Mission, in the time-honored tradition of former Wall Street millionaires selling apples out of their Rolls Royces:
https://digicoll.lib.berkeley.edu/record/323794
(Literally: I bought a "dining room set" of six $1500 Steelcase Leap chairs in the summer of 2000 from a failed dotcom CEO on Van Ness for $25 a piece – still in the original plastic!)
And in the meantime, please let's stop pretending that digital sovereignty has anything to do with "national AI." If Trump takes away your AI, everything is fine. If Trump takes away your iPhones, Office 365 and tractors, your country grinds to a halt. This is just not that complicated:
If: digital sovereignty + AI = digital sovereignty – AI
Then: AI = 0
(Image: Armin Kübelbeck, CC BY-SA 4.0, modified)
Hey look at this (permalink)
- Is Donald Trump the Greatest Environmentalist of All Time?? https://jacobin.com/2026/06/trump-iran-green-transition-environmentalism
-
WNBA Players Scored a Historic Labor Contract—With One Notable Caveat https://www.hardresetmedia.com/p/wnba-players-labor-contract-wearables
-
Trump’s Anthropic shutdown just made the case for non-American AI https://www.theverge.com/ai-artificial-intelligence/949986/anthropic-fable-mythos-shutdown-sovereign-ai
-
Blindsight Sci-fi Short Film https://www.youtube.com/watch?v=VkR2hnXR0SM
-
Introducing: Story Oracle https://www.clarionwest.org/story-oracle/
Object permanence (permalink)
#25yrsago Napster boss's American Library Association keynote https://web.archive.org/web/20010623201456/https://www.salon.com/tech/wire/2001/06/17/napster/index.html
#20yrsago Flickr: we’ll give full access to competitors – if they reciprocate https://www.flickr.com/groups/central/discuss/72157594165399644/#comment72157594167782546
#20yrsago Report from a concert by a Serbian war-criminal https://web.archive.org/web/20060613081324/http://blog.b92.net/blog/22
#20yrsago European podcasters to WIPO: Stay away from us! https://web.archive.org/web/20060619224538/https://www.bloggernews.net/2006/06/european-podcasters-team-up-to-lobby.html
#15yrsago KFC: support diabetes research by buying an 800 calorie, 56 spoonful of sugar “Mega Jug” https://web.archive.org/web/20110619031415/https://theweek.com/article/index/216462/irony-alert-buy-kfcs-800-calorie-soda-to-support-diabetes-research
#10yrsago Terrorist who murdered Jo Cox shouts: “Death to traitors” in court https://www.csmonitor.com/World/2016/0618/Accused-killer-of-MP-Jo-Cox-makes-defiant-court-statement
#10yrsago Judge orders release of man convicted while his public defender was handcuffed https://web.archive.org/web/20160617172242/http://www.reviewjournal.com/crime/judge-releases-man-who-received-jail-sentence-while-lawyer-was-handcuffs-video
#10yrsago Hambone virtuoso https://www.youtube.com/watch?v=YMJeaZtgwng
#10yrsago Google Fiber now forces subscribers into binding arbitration; days left to opt out https://web.archive.org/web/20160617141759/https://consumerist.com/2016/06/16/google-fiber-copies-comcast-att-forces-users-to-give-up-their-legal-right-to-sue/
#1yrago The Immortal Choir Holds Every Voice https://pluralistic.net/2025/06/18/anarcho-cryptid/#decameron-and-on
Upcoming appearances (permalink)
- Virtual: The future of world governance, with Kim Stanley
Robinson (UN Independent Expert on International Order), Jun 19
https://www.youtube.com/live/wJvBvYdaAMY -
LA: The Reverse Centaur's Guide to Life After AI with Brian Merchant (Skylight Books), Jun 19
https://www.skylightbooks.com/event/skylight-cory-doctorow-presents-reverse-centaurs-guide-life-after-ai-w-brian-merchant -
Menlo Park: The Reverse Centaur's Guide to Life After AI with Angie Coiro (Kepler's), Jun 21
https://www.keplers.org/upcoming-events-internal/cory-doctorow-2026 -
Toronto: The Sovereignty Debate (IAB Canada's State of the Nation), Jun 23
https://iabcanada.com/state-of-the-nation-2026 -
Toronto: The Reverse Centaur's Guide to Life After AI (Osler Records/Type Books), Jun 23
https://www.eventbrite.com/e/cory-doctorow-book-launch-and-talk-tickets-1991501299998 -
NYC: The Reverse Centaur's Guide to Life After AI with Jonathan Coulton (The Strand), Jun 24
https://www.strandbooks.com/cory-doctorow-the-reverse-centaur-s-guide-to-life-after-ai.html -
Philadelphia: The Reverse Centaur's Guide to Life After AI with David Williams (Fitler Club/Philadelphia Citizen), Jun 25
https://www.eventbrite.com/e/cory-doctorow-book-event-tickets-1990110326559 -
Chicago: The Reverse Centaur's Guide to Life After AI with Rick Perlstein (Exile in Bookville), Jun 26
https://exileinbookville.com/events/50628 -
London: Idler Festival, Jul 11
https://www.idler.co.uk/festival/ -
Edinburgh International Book Festival with Jimmy Wales, Aug 17
https://www.edbookfest.co.uk/events/the-front-list-cory-doctorow-and-jimmy-wales -
Sydney: The Festival of Dangerous Ideas, Aug 23-24
https://festivalofdangerousideas.com/cory-doctorow/ -
Melbourne: Enshittification at the Wheeler Centre, Aug 25
https://www.wheelercentre.com/events-tickets/season-2026/cory-doctorow-enshittification -
Brighton: The Reverse Centaur's Guide to Life After AI with Carole Cadwalladr (Brighton Dome), Sep 8
https://brightondome.org/whats-on/LSC-cory-doctorow-the-reverse-centaurs-guide-to-life-after-ai/ -
London: The Reverse Centaur's Guide to Life After AI with Riley Quinn (Foyle's Picadilly), Sep 9
https://www.foyles.co.uk/events/enshittification-cory-doctorow-riley-quinn -
South Bend: An Evening With Cory Doctorow (Notre Dame), Oct 6
https://franco.nd.edu/events/2026/10/06/an-evening-with-cory-doctorow/
Recent appearances (permalink)
- The Enshittification of Life, the Universe, & Everything
(Luke Savage)
https://www.lukewsavage.com/p/the-enshittification-of-life-the -
Cory Doctorow's digital jail-break (DW In Focus)
https://www.dw.com/en/cory-doctorows-digital-jail-break/audio-77414035 -
Why the Internet Got Worse and What to Do About It (Jim Rutt) (RIP)
https://www.jimruttshow.com/cory-doctorow-3/ -
On Enshittification – and what can be done about it (Re:publica)
https://www.youtube.com/watch?v=KhINQgPMVSI -
EFFecting Change: How to Disenshittify the Internet (EFF, with Wendy Liu)
https://archive.org/details/effecting-change-enshittification
Latest books (permalink)
- "Canny Valley": A limited edition collection of the collages I create for Pluralistic, self-published, September 2025 https://pluralistic.net/2025/09/04/illustrious/#chairman-bruce
-
"Enshittification: Why Everything Suddenly Got Worse and What to Do About It," Farrar, Straus, Giroux, October 7 2025
https://us.macmillan.com/books/9780374619329/enshittification/ -
"Picks and Shovels": a sequel to "Red Team Blues," about the heroic era of the PC, Tor Books (US), Head of Zeus (UK), February 2025 (https://us.macmillan.com/books/9781250865908/picksandshovels).
-
"The Bezzle": a sequel to "Red Team Blues," about prison-tech and other grifts, Tor Books (US), Head of Zeus (UK), February 2024 (thebezzle.org).
-
"The Lost Cause:" a solarpunk novel of hope in the climate emergency, Tor Books (US), Head of Zeus (UK), November 2023 (http://lost-cause.org).
-
"The Internet Con": A nonfiction book about interoperability and Big Tech (Verso) September 2023 (http://seizethemeansofcomputation.org). Signed copies at Book Soup (https://www.booksoup.com/book/9781804291245).
-
"Red Team Blues": "A grabby, compulsive thriller that will leave you knowing more about how the world works than you did before." Tor Books http://redteamblues.com.
-
"Chokepoint Capitalism: How to Beat Big Tech, Tame Big Content, and Get Artists Paid, with Rebecca Giblin", on how to unrig the markets for creative labor, Beacon Press/Scribe 2022 https://chokepointcapitalism.com
Upcoming books (permalink)
- "The Reverse-Centaur's Guide to AI," a short book about being a better AI critic, Farrar, Straus and Giroux, June 2026 (https://us.macmillan.com/books/9780374621568/thereversecentaursguidetolifeafterai/)
-
"Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2026
-
"The Post-American Internet," a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027
-
"Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027
-
"The Memex Method," Farrar, Straus, Giroux, 2027
Colophon (permalink)
Today's top sources:
Currently writing: "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Third draft completed. Submitted to editor.
- "The Reverse Centaur's Guide to AI," a short book for Farrar, Straus and Giroux about being an effective AI critic. LEGAL REVIEW AND COPYEDIT COMPLETE.
-
"The Post-American Internet," a short book about internet policy in the age of Trumpism. PLANNING.
-
A Little Brother short story about DIY insulin PLANNING
This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.
https://creativecommons.org/licenses/by/4.0/
Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.
How to get Pluralistic:
Blog (no ads, tracking, or data-collection):
Newsletter (no ads, tracking, or data-collection):
https://pluralistic.net/plura-list
Mastodon (no ads, tracking, or data-collection):
Bluesky (no ads, possible tracking and data-collection):
https://bsky.app/profile/doctorow.pluralistic.net
Medium (no ads, paywalled):
Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):
https://mostlysignssomeportents.tumblr.com/tagged/pluralistic
"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla
READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.
ISSN: 3066-764X
15:21
[$] The first half of the 7.2 merge window [LWN.net]
The 7.2 merge window started with the 7.1 kernel release on June 14. As of this writing, just over 7,000 non-merge changesets have been pulled into the mainline for the next kernel release. Many of the core subsystems have been pulled at this point, meaning that most of the changes that can be expected in 7.2 have now come into focus.
15:14
Now that Google has added AI in their search, and it dominates search more and more, it's become more difficult to find ideas that aren't well explained by AI and are on some randome old web pages. For example, this morning I wanted to find an explainer for "Standing on the toes of giants," something a colleague once used in a story. I'm sure there's stuff out there, but no luck finding it. Didn't help that there's a popular song with that title.
14:35
Mastodon 4.6 released [LWN.net]
Version 4.6 of the Mastodon fediverse platform has been released.
The headliner of this release is Collections, a way to create and share curated collections of profiles. Part of Mastodon's work ethos is our commitment to trust and safety, so we've put a lot of thought and care into the design of this feature to avoid some of the pitfalls and abuse people have experienced with similar features on other platforms, while focusing on its primary goal: Helping new users discover more of the Fediverse.
Other new features include support for subscribing to posts via email, the ability to generate a "year in review" post, accessibility improvements, and more.
[$] Single-hop block replication with RMR and BRMR [LWN.net]
How can cloud providers efficiently supply durable virtual block devices? Remote Direct Memory Access (RDMA) provides a way for servers in a cluster to share chunks of memory, but there still needs to be a protocol that operates on top of RDMA to provide the guarantees expected of a block device. The kernel's RDMA transport library (RTRS) provides a way to send messages via RDMA. I presented about two new components built on top of RTRS at the 2026 Linux Storage, Filesystem, Memory Management and BPF Summit: Reliable Multicast over RTRS (RMR) and Block device over RMR (BRMR). These modules, which I am working on with Jia Li, could be a way for cloud providers to expose durable block devices with as little overhead as possible. To accomplish that, however, we need some discussion and feedback from the community before sending the modules upstream.
Security updates for Thursday [LWN.net]
Security updates have been issued by AlmaLinux (dracut, podman, postfix, rsync, xorg-x11-server, and xorg-x11-server-Xwayland), Debian (atril, firefox-esr, and nginx), Mageia (libcap, perl, and python-pillow), Oracle (firefox, gstreamer-plugins-base and gstreamer-plugins-good, httpd:2.4, kernel, libpng12, libpng15, libxml2, libxslt, opencryptoki, openssl, postfix, rsync, webkit2gtk3, xorg-x11-server, and xorg-x11-server-Xwayland), Slackware (bind, libidn, mozilla, and openssl), SUSE (alloy, docker, elemental-system-agent, glibc, grafana, helm, LibVNCServer, openssh8.4, perl-GD, perl-HTTP-Daemon, python-WebOb-doc, python311-google-adk, rustup, traefik2, wireshark, and xwayland), and Ubuntu (dolibarr, golang-go.crypto, graphite2, gst-plugins-bad1.0, kitty, libconfig-inifiles-perl, libnginx-mod-js, and webpy).
14:28
World Wide Knicks by Sally Atkins [Scripting News]
My longtime friend Sally Atkins reponded to my question yesterday about how widely the love of the Knicks is being felt.
You asked. From all I see out here in the Midwest and also from comments from friends in Europe, I can testify that yes absolutely the Knicks win is a total joy to behold far and wide. Not just for the artful wins, although that was great fun. The last second dunk in the second to last game was breathtaking.
The larger gift is that New Yorkers have so vividly shown that right now and going forward we are capable of joy-and-unity vs hate-and-division. Love is way more fun than hate. Most people know that, you’ve shown it. Knicks fans, people of all ages and creeds , are a palpable reminder of the power of the people right on!
Remember the 1967 Troggs hit Love is All Around? I feel it in my fingers, I feel it in my toes.
Happy Parade Day!
Let this hopeful moment fuel the near future.
PS: Did you see the news clip of the Knicks just after arriving back in NY, just off their plane they joined in a parade for Puerto Rico or maybe it was Pride Month. Hallelujah. (Dave: It was the Puerto Rican Day parade, two players went, Alvarado (who is Puerto Rican himself) and Jordan Clarkson who is from the Philippines, and is the super freak hippie on the team, though they're pretty much all hippies.)
Responses from other sites
Tommy Williams: "Not here in Montana, or among my colleagues across the Midwest. It didn't attract more attention than any other NBA championship. Everyone's focus (for sports) is on the World Cup."
Courtney Robertson: "Noticing that sports is bringing unification and joy when I really could use that."
Phil: "There are a surprising number of Knicks fans here in Cincy, and it's been a pretty big deal -- I've even got a friend who flew out to NYC for the parade today."
14:14
Why I’m Obsessed With “Obsession” [Whatever]
Y’all already know that I am
not a horror fan. Horror has always been my least favorite
movie genre, and there are very few movies within the genre that I
even consider worthwhile. When I went to
see Obsession, I was already outside of my comfort
zone by going and seeing a horror movie in theaters, as
they’re always too loud and I really hate being jump scared
in front of other people.
You can imagine my surprise when Obsession ended up being the best horror movie I’ve ever seen. It is one of the most incredible films I’ve seen, even when I take it out of the horror ranking. It’s just that good.
I’d like to give y’all some spoiler-free thoughts first, so you can get a good feel for why I love this movie without getting into the nitty-gritty details, but then I will go deeper with spoilers and get into what makes it so damn great.
For starters, Obsession has so many little factoids about it that it make it more special than most films right off the bat, like the fact it was made for under a million dollars, at a whopping $750k. I have not heard of a successful, theater-released movie having that small of a budget in I don’t even know how long, if at all. That is so impressive. Not only that, but it is one of the only films, alongside E.T., to do better financially in the following weeks after opening weekend. Most movies peak at their opening weekend, but Obsession just kept getting more and more popular.
The fact that the cast was comprised of people I’d never heard of it made it all the better, because when you have Matt Damon as your lead, it’s hard to see him as anyone other than… Matt Damon (looking at you, Christopher Nolan’s Odyssey). So having a cast full of people I’ve literally never seen before made it feel so much more real. It’s more immersive when you don’t recognize big name stars that steal the spotlight. These people felt like people, not celebrities in a movie. Plus, everyone did such a stellar job, especially Inde Navarrette! She was perfectly terrifying.
Without giving too much away, the basic plot is this guy, Bear, wishes that his crush, Nikki, loved him, and let’s just say he gets more than he bargained for. The themes this movie explores are extremely heavy. Bodily autonomy, consent, love VS obsession, toxic and abusive relationships, family-friendly topics like that!
The horror element in Obsession is a special kind of dread that sticks with you long after you leave the theater. This movie sat heavily in my brain for days on end. A lot of horror movies give you two hours of cheap adrenaline rushes and jump scares while being oh so forgettable, but Obsession truly haunts you. “Unsettling” is too timid of a word to describe the feeling it will leave you with.
I find the pacing to be rather good, as there’s no B-plot for this movie, so it’s pretty much just all go-go-go with no breaks. There are no slow parts or scenes that feel unnecessary. All the scenes feel like the perfect length.
The lighting is a work of art in this movie. The soft, dim lighting at the bar, in Bear’s house, and throughout the film alongside the dark, shadowy, spooky scenes is so good. It’s very atmospheric, and feels somewhat intimate. Even the scenes that are dark aren’t that kind of super annoying horror movie dark where you just can’t see shit for the sake of jump scaring you. It’s like an actually well done type of darkness.
So, great performances, good pace, nice lighting, and a special kind of horror, all for under a million dollars! Pretty impressive stuff.
Now let’s get into the details. SPOILER WARNING!
From the moment we meet Bear, we are shown, expertly, how he is kind of a piece of junk. When practicing his confession speech, he only brings up how Nikki was nice to him and was there for him when he was going through a tough time. He never says what he likes about her as a person, just what she has done for him and how she makes him feel.
When he gets home and finds his cat dead, he puts it in a black garbage bag and throws it away. Who does that?! That is not how you dispose of a deceased pet?!
At trivia night, he tries to confess his feelings at an awkward, inopportune time that would affect the rest of the group and impact everyone’s evenings.
He didn’t give his gift to Nikki, he used it for himself and then lied to her, saying he left her gift at his house. Because he sucks!
AND HE CALLED HER FREAKY NIKKI EVEN THOUGH SHE HATES THAT. Bear is a certified jerk, even though it seems like, at first, that he’s just a shy, nice guy with a crush.
Worst of all, Bear is a coward. When Nikki asks him bluntly if he likes her, he pussies out and says no, then regrets it immediately. Then, when Wish Nikki says she knows he likes her, he denies it and makes her confess first before admitting that, yes, he does like her.
He is a coward when he can’t shoot himself and takes the pills instead, and he is a coward when he tries to throw up the pills because he doesn’t have the nerve to actually kill himself. He is a coward to the bitter end, and I think that is amazing. What a flawed, awful, hate-able character. There is no redemption, because he couldn’t even commit to killing himself. He is never the good guy, he is, from the start, the bad guy.
I have never felt worse for a horror movie character than I feel for Nikki. In the short amount of time we get to see the real Nikki, she is fun and kind and thoughtful. Nikki seems like a genuinely nice person, and it’s easy to see why Bear would have a crush on her. And suddenly, she’s gone. Trapped in some sort of horrible, agonizing negative space while something else controls her body, with only short spurts of consciousness where the real Nikki is begging to be freed, fighting to be released from Wish Nikki taking back over. Each time the real Nikki surfaces I can only imagine what is going through her mind, or if she wonders if this will be the last time she ever gains control again, just to succumb back under. Of course, it reminds me a lot of Get Out, which is also a great movie!
To be hurt by someone you think of as a friend, not just hurt but condemned to this cursed existence, only for him to ignore your pleas for death. UGH. Poor Nikki. It’s actually so heartbreaking. And so real! It’s often the people closest to you that hurt you the most.
Honestly their entire friend group is such a mess, with Ian and Nikki hooking up and Ian not telling Bear even though he knows how he feels about her. Ian tries sabotaging Bear’s attempts at confessing and is unhappy about his relationship with Nikki, yet never even mentioned his and Nikki’s situationship to the guy who is supposedly his best friend. Plus, if Bear is his best friend, why didn’t he believe him or at the very least hear him out more on the One Wish Willow?
If my best friend came to me, obviously distressed, and a ton of weird stuff had been going on lately, and they told me it was because of this very real wishing stick, I’d at least hear them out instead of calling them crazy right off the bat. I trust my friends with my life, and love them dearly, why would I believe they’re lying to me about something like this? Bear was obviously extremely distraught and practically begging Ian to listen, but he refused and just wished for a billion dollars to be a fucking dick.
As for Sarah, she was a Pick-Me praying on the downfall of Bear’s and Nikki’s relationship, judging from the sideline while also trying to make moves of her own on Bear. She asked him to meet her late at night in private, then told him that Nikki is taking advantage of him and he doesn’t deserve it, and that he needs someone “more chill.” Literally referring to herself as a better match for him than Nikki. What kind of friend does that?! She even says that he was supposed to kiss her, not Nikki. Does she secretly hate and envy Nikki? She is not a girl’s girl, that’s for sure, and she got a face full of brick for it. (I’m just kidding, she didn’t actually deserve the brick for being a Pick-Me, but it still is an unfortunate character flaw.)
Point is, this friend group really sucked. Nikki was the best of them, truly. Now she’s an extremely traumatized girl who will never be the same because of one selfish boy’s actions. She was a beautiful soul, and now she has been through hell and back, and is certainly forever changed. Again, poor Nikki. It makes me so sad!
I really love that the One Wish Willow isn’t even an evil thing, you can make a wish and have everything go great. The shopkeeper that made his wish certainly seemed fine, and Ian got his billion dollars with zero issues. It’s solely because Bear made a bad wish with bad intentions that his wish turned out so terrible. I find that to be an extremely satisfying mechanic, even though it sadly comes at the cost of Nikki.
This was a well-shot, well-acted, well-executed film with an amazing concept and cast. I loved it, and saw it three times in theaters. I highly recommend it, even if you aren’t usually a fan of horror movies. It’s probably the best film I’ve seen this year.
Have you seen Obsession yet? What did you think was the scariest part (for me, it was definitely when Bear is on the phone with One Wish Willow, and you hear Nikki screaming in agony in the background)? What’s your favorite horror movie? Let me know in the comments, and have a great day!
-AMS
14:07
Representative Line: Sort This Out [The Daily WTF]
Today's anonymous submitter has spent a long time toiling through many, many tickets. Their effort has been an attempt to "save" their employer from the disaster left behind by by a highly-paid consultant. As one does, our submitter started with the highest priority tickets with the highest severity. Eventually, they whittled down that list, and had some bandwidth to start looking at the pieces of the code which clearly weren't exploding right now (because there were no tickets), but were likely to explode at some point in the future (creating a storm of tickets).
Scanning through the JavaScript, our submitter found a
sort function. That was automatically concerning- why
was that particular wheel being reinvented?
The first line of the sort function was this:
obj[x._id.account_id] = x.count_total
In this case, x._id is meant to be the unique
identifier from their Mongo DB. That, uh, should be not
precisely a UUID (Mongo does its own weird version), but
it definitely shouldn't have an account_id field on
it. They are storing an arbitrary object as their unique
identifier in the database. Which, I'm no Mongo expert, but I don't
need to be Flash Gordon to know that's a bad idea.
But setting aside the choice of using random objects as unique
identifiers, there's also the other question: how is this
furthering the goal of sorting? Why on Earth am I building an
object in the form: {"id0": 5, "id1": 7, "id2": 11}?
Or am I even doing that? This is the first line of the function, so
we're not even doing a loop, it's just {"id0": 5}.
This isn't just an unexploded bomb, it's a mystery: the primary mystery being why hasn't this exploded already? The second mystery is: what's going to happen when your luck runs out?
[Advertisement] ProGet’s got you covered with security and
access controls on your NuGet feeds.
Learn more.13:42
NBA fans, esp Knicks fans, are not fans of the current president. A picture of the Knicks team with Trump in the Oval Office would be hard to see. Not threatening to resign as a Knicks fan, not ruling it out either.
13:21
Joe Marshall: Controlled Unclassified Information [Planet Lisp]
Back in the day, the US government had a program called SBIR (Small Business Innovation Research) that funded small businesses to do research and development. I recall sitting in our dorm in college, reading through a giant printed catalog of SBIR grants just to amuse ourselves by brainstorming solutions over bad pizza.
.So, I got curious the other day: what does the SBIR landscape look like now?
I can tell you right now: do not even try to read an SBIR solicitation on your local machine. You are opening yourself up to a world of absolute, unmitigated pain.
You might think, what harm could there be in simply opening a file?
Well, in the modern compliance panopticon, any manipulation of digital information that comes from the govenment has the potential to spawn CUI (Controlled Unclassified Information). CUI is basically a digital pathogen; once you download that file, *anything whatsover* derived from it, including notes and metadata, instantly becomes CUI by association. The moment you read an SBIR on your computer, you've infected your system, rendering you subject to a nightmare of Byzantine federal regulations.
These days, the amount of beurocratic red tape surrounding CUI is insane. To even look at the file legally, you need a dedicated, air-gapped machine completely disconnected from the internet, conforming to a massive, expensive slew of NIST standards covering everything from hardware-level encryption to strict access controls. Alternatively you could contract with a cloud company that offers a pre-certified "CUI-compliant" environment.
And assuming you actually shell out the cash and jump through the hoops to set up this digital containment zone just to read a PDF, you must meticulously audit and account for every single action you take in its presence. Under current federal auditing logic, you are explicitly assumed to be attempting to defraud the government unless you can produce a mountain of paper proving otherwise. Want to bring in a partner to bounce ideas around? You can't just "know a guy." You have to navigate a labyrinth of federal subcontracting regulations.
I had intended on amusing myself by reading some SBIRs and daydreaming about solutions that might involve Lisp (an impossibility in the modern enterprise stack for entirely separate, depressing reasons). Instead, I quickly discovered I did not even own the physical hardware required to even read an SBIR without running afoul of federal regulations.
I wanted to read some clever and inspiring engineering proposals. I ended up reading a lot of very dry and boring compliance regulations.
12:14
Embedding Forbidden Text in Spyware to Discourage AI Analysis [Schneier on Security]
At least one malware developer is adding text about nuclear and biological weapons to their spyware, in an effort to stop automatic AI analysis.
The _index.js payload begins with a large JavaScript block comment containing fake system instructions and policy-triggering content. Because it is inside a comment, it does not affect JavaScript execution. The runtime skips it. The real malware begins after the comment with a try{eval(…)} wrapper around a large character-code array and a ROT-style substitution function.
This header appears designed for AI-mediated analysis, not for Node, Bun, or Python. It attempts to derail scanners or analyst copilots that feed the beginning of a file to a language model without clearly isolating the content as untrusted data. In weak pipelines, this can cause refusal behavior, prompt confusion, context pollution, or premature classification before the scanner reaches the actual malware.
This is not a magical bypass against static detection. YARA rules, entropy checks, AST parsing, string extraction, deobfuscation, and behavioral rules still work. But it is a practical anti-analysis trick against naive LLM-first triage systems.
11:28
Grrl Power #1470 – Chicken threat upgraded [Grrl Power]
Dodging weapons fire, be it from a gun or a bow or even just a Roman Candle, as well as sword swipes, kicks, flails, punches, shuriken, paintballs, etc., is one of those times where having large, relatively unsecured body parts can be a real hazard. Like a tail, or Twi’lek lekku. Or boobs.
Max becomes less jiggly the higher her armor is. She never has the problem of blocking bullets by standing in front of innocents with her hands on her hips, Superman style, only the bullets start going all over the place because of fluid and elasticity dynamics of invulnerable boobs being machine gunned. No, the bullets go all over the place because someone is machine-gunning invulnerable, non-deformable rounded surfaces. That would make for some chaotic reflections unless you were really good at 3D billiards and could calculate ricochet angles at literal machine gun speeds. (Yes, I know billiards is already a game played in 3D, but it’s functionally all on a 2D plane, unless you include hopping the balls over each other. I meant like if the balls were in some sort of 3D space with pockets on the interior of a cube or sphere or dodecahedreon, that had a sort of felt-like inertia field.)
Anyway, I mention all that because I still thought I ought to have her breasts showing a little bit of inertia, otherwise she’d look like some Poser 3D model rendered upside down, Wampa ice cave style, with boobs hanging ceiling-ward in defiance of circumstances.
Of course, you could say the same thing about muscular men. All the beefcake makes your hitbox that much larger. In The Expanse, at some point Amos ask “Why do I keep getting shot?” I felt it was a missed opportunity that no one said, “Because you’re so big.” (The real reason of course is to show the audience that the characters don’t have absolute plot armor.) But my point really is that women of a particular endowment, if they know they’re getting into a firefight, would probably wear a “smush ’em down, hold ’em in place” sports bra vs a wonder bra, and that’s assuming they’re not in a position to don body armor. Max is armored, sure, but is only wearing about 2 mm of smart space latex and some pasties. Trying to wear a sports bra under that setup would make it look like she was laying on her boobs, and like I said, she’s running with enough armor most of the time during the tournament that punching her in the boob would break a normal human’s hand before the boob deformed in any way. Also a Terminator’s hand. A Cameron one, probably not a WH40K one. But then, a broken hand would be the least of your concerns if you tried to punch her in the boob.
**************
Thomas Doscher writes Vixen War Bride, one of my
favorite series lately, and he’s gotten two audiobooks done,
but is trying to wrangle up the funding to get the rest produced,
which I would very much like to see. He’s got a GoFundMe set up to that end.
It’s different than a kickstarter, which would basically
pre-sell you the audiobooks. This is just for anyone who really
likes the series and would really like to have it all in audiobook
format. So, FYI.
Final version is up, both at TWC and Patreon.
Sexy bodymod news lady Gail has a special one-on-one interview with Tournament Quarter finalist Saraviah Nightwing! And if you subscribe to Gail’s Space Patreon, (which, due to the vagaries of Earth and Gal-Net’s DNS servers, happens to be the same as the Grrl Power Patreon, go figure) you can see that same interview in the nude!
Double res version will be posted over at Patreon. Feel free to contribute as much as you like.
10:49
Promotion, activation, conversation [Seth's Blog]
[A long riff on book publishing with (perhaps) wide applicability to your work as well.]
Publishing is different from writing—it’s the hard work of creating the conditions to help people get in sync, move forward, and get to where they’re headed.
The best reason to publish a non-fiction business or how-to book in 2026 is to change lives. Transformation is possible.
Transformation can happen, but only if the book ends up in the right hands for the right reasons.
Today, it’s harder than ever to pull that off. Tim Ferriss shares the numbers. We have a glut of information, but not nearly enough action. I’ve been at this for forty years, but the change this time is significant.
The number of books in this category continues to expand, but their total impact has not. At the same time, more books are being purchased by more people—the long tail is real. Publishing a book is super easy now, but publishing one that works is harder than ever.
Authors and publishers get stuck on the gap between interest and action. Too often, we don’t act until it’s too late in the process.
The author’s job in publishing begins long before pub day.
There are three pillars:
- Promotion
- Activation
- Conversation
The first one gets way too much discussion, energy, and noise. Promotion gets the word out. Promotion can easily become all-consuming, and it can also become selfish. The promotion part of the equation asks, “have you seen my new book?” Promotion is everywhere, so we come to believe that it matters.
Activation creates the tension that answers the promotion question with, “I’ll go grab a copy.”
And conversation is the unsung part of every single hit book in this genre: “I need my friends to read this.”
Successful publishing, then, looks like this: Generate awareness. Create tension that leads to engagement with the work. Deliver an idea that works better for the reader when it’s shared and discussed. Reader traction leads to the network effect. The transformations compound, and the book becomes a foundation of culture and alignment.
That’s the work of publishing. Each component matters, not just the first one.
I’d break promotion into a few components:
Permission: When you can deliver anticipated, personal, and relevant messages to the people who want to get them, you’ve earned attention, not stolen it. Letting people who read your blog or listen to your podcast know about your new book is mutually beneficial. This is a trust that’s not to be taken lightly.
Shared permission: When you appear on someone else’s podcast or in the media, you’re bringing the message of your book to people who trust the host. The paradox is that the more trusted the media channel, the more difficult it is for you to appear when it suits you.
Buzz: This is a side effect of a good story and a medium that wants to carry it. In the hyper-parallel world of social media, there are an infinite number of tiny media outlets, and when they start to vibrate at the same frequency, buzz occurs. This is 5% preparation and 95% luck.
Hustle and Hype: Burning bridges and crossing lines just because it’s important to you. Please don’t. No one ever ends up glad they did this. It might not feel like hustle to the hustler, but if the person you’re targeting with your hype feels hustled, then that’s what’s happening.
But promotion is not worth much if it doesn’t translate into people actually purchasing and reading your book. Activation overcomes inertia, fear, and inconvenience. Activation energy leads to someone not only buying a book, but reading it.
Most publishers have someone who does publicity and promotion. Most marketers think about their job in the same way. Where are the teams that focus on activation?
In two recent book launches, I worked to create awareness with a record-breaking podcast tour. Each time I appeared on more than fifty podcasts on launch day. It took months of recording sessions and the kind support of some of the best podcasters in the world to pull this off.
Together we reached millions of people in just a few days. And yet, very few of these listeners bought a book as a result of a podcast. The math might be 1,000,000 YouTube interview views equals a hundred books sold.
Estimated growth in hours spent (billions!)
listening to podcasts or other forms of online
productivity/business learning
The common-sense math is simple: Over the last two decades, hours spent listening to podcasts, blog posts and videos about non-fiction topics is exponentially higher than it was, but sales in the category are flat or down.
Podcast appearances often solve the problem of what’s in the book (“oh, I heard it, I get it”) as opposed to creating useful and generous tension that leads to a read.
[Let me pause for a second here and clarify: If you can effectively give your idea away without writing and publishing a book, please do! Most of my blog posts reach more people than my books do, and I keep them as posts because that’s the best way to get my point across. But if it’s worth publishing a book around a set of ideas, it’s probably not easily translated into a thirty-minute podcast. Buying, reading, holding, shelving, sharing–these are opportunities the book has to amplify its impact.]
Now, consider the idea of a knock-knock book. This is a book with a secret. The world asks about it (knock knock) and the answer is, “buy the book.” This was a big part of publishing for a long time—if you want to know, you needed to read the book. But now that the answer is free, online, there’s not a lot of reason left to buy this sort of book… If all a book has is a secret, it won’t have the secret for long. TLDR.
Instead, the most resilient books in this category serve a different purpose. They’re shareable. They amplify a network. They serve as an instigator and a totem, a device that allows one reader to share insights with another, all in service of getting in sync. Books are souvenirs for some purchasers, but tools for most of us.
The step after activation is the one with the highest leverage: Conversation.
Successful books in this category don’t sell by the copy; they sell by the carton.
How will my organization, my team or my relationships improve if we all read this book? Can we talk about these ideas and put them to work together?
This is why Purple Cow and The Dip were two of my bestselling books.
When David and Brian wrote The Dip into Billions, they were using it as a shorthand. The judge was saying, “we need to talk about this nuanced idea, here’s an anchor.” The book becomes the foundation for a conversation that needed to happen.
Books that matter over time almost always fit this description: Atomic Habits, In Search of Excellence, Grit, The War of Art, The Let Them Theory, Mindset, and Big Magic… practical books that stand for something and offer a foundation for shared exploration and possibility.
You can do all the promotion and activation you want, but if your book doesn’t support conversation, it will soon fade away.
Have you seen my book? →
I’ll grab a copy →
I need my friends to read this →
My circle is using this as a tool.
Don’t tell me about your promotional strategy. Talk to me about activation and build conversation into your work from the start.
“On the one hand, information wants to be expensive, because it’s so valuable. The right information in the right place just changes your life. On the other hand, information wants to be free, because the cost of getting it out is getting lower and lower all the time.” Stewart Brand, 1984.
The two ideas don’t have to fight with each other. Information isn’t enough. It’s transformation and conversation that fuel our future.
10:00
Oracle Solaris 11.4 SRU93 released [OSnews]
Oracle is sticking to its promise of more regular Solaris updates with the release of Oracle Solaris 11.4 SRU93. This release, like other SRU releases, is for paying Solaris customers, as the CBE releases for enthusiasts are on a different cadence. With Solaris’ focus being on enterprise server environments, it should come as no surprise that most of the changes and improvements are focused on things like enterprise networking and security, such as changes to how policy settings for the Kernel Crypto Framework (KCF) are stored, moving from using RPC over sockets instead of STREAMS, and more.
Of course, there’s also the long list of updated open source packages.
SRU 93.221.2 updates a broad set of platform, runtime, developer, networking, desktop, and open source components. Notable updates include Apache Tomcat to 9.0.116, bash to 5.3 patch 9, BIND to 9.20.18 and 9.20.21, Django 4.2 to 4.2.30, Django 5.2 to 5.2.13, Firefox to 140.8.0esr, Golang to 1.25.8, Node.js 20 to 20.20.2, Node.js 22 to 22.22.2, Node.js 24 to 24.14.1, NSS to 3.119.1, Perl to 5.42, Python 3.11 to 3.11.15, Python 3.13 to 3.13.12, RabbitMQ to 4.2.4, Thunderbird to 140.8.0esr, vim to 9.2.0340, and zlib to 1.3.2. Additional updates include development tools, Python modules, X11 utilities, printing components, libraries, cryptographic packages, networking tools, and desktop-related packages.
↫ Colin Kavanagh at the Oracle Solaris Blog
Existing Oracle Solaris customers can
update to the new release through pkg update.
09:14
Mike Gabriel: Commenting on the recent Ubuntu Touch review done by @SwitchandClickOfficial on Youtube [Planet Debian]
There has been a video blog post recently published with a review of Ubuntu Touch as an option to opt out of the Android world: https://www.youtube.com/watch?v=wTK6TS3pXgc
Thanks to @SwitchandClick for spending time on this and publishing that video. Much appreciated.
Many Issues amended in upcoming 24.04-2.0 Release
When I watched that video referenced above, I continuously thought: ah... this is fixed in the next major release of Ubuntu Touch, or: ah... this is a known issue that we have on the roadmap..., or: ah... this is done in this ways by design (so it's a feature or basic functionality)...
Let me just state, that most of the criticized aspects will be resolved in upcoming Ubuntu Touch release 24.04-2.0 (the tests in that video blog post have been run on Ubuntu Touch 24.04-1.x):
- Camera notch and rounding corners get honoured now by the UI
- Ubuntu Touch's default webbrowser (Morph Browser) has been bumped from Chromium engine v87 (Qt5 based) to v134 (Qt6 based), installing another browser should not be necessary anymore (note that the privacy level in Morph Browser is pretty high, so using other browsers could mean a loss of privacy).
- Bluetooth pairing agent got added to the bluetooth indicator
- Ubuntu Touch now supports Snaps on CLI level and in the OpenStore app
- Libertine has received fixes, but no substantial improvements. It mainly targets users who want to use their Ubuntu Touch device as desktop daily driver. Libertine-provided desktop apps UI-wise are often not usable on a phone-like device.
The full feature preview of the 24.04-2.0 release can be found here: https://ubports.com/blog/ubports-news-1/ubuntu-touch-24-04-2-0-beta-is-n...
Ubuntu Touch App Ecosystem
The app ecosystem of Ubuntu Touch is quite specific, because many apps in Ubuntu Touch have been explicitly developed for Ubuntu Touch using a widget toolkit called Lomiri.Components. However, in Ubuntu Touch we also encourage developers to provide apps written with other convergent-capable toolkits, such as QQC2-based apps or Kirigami-based apps.
One reason for the very different app ecosystem in Ubuntu Touch is that many service providers don't have Ubuntu Touch on their radar when investing in app development for their services. Some Ubuntu Touch App Developers work around this by either implementing unofficial client apps for web services (e.g. the Flow app for Deezer by Sander Klootwijk), others provide the web service via implementing a web app (will not work when offline, but at least will show up as an app in the launcher).
The overall solution for making Open-Store.io more familiar to users who migrate from Android is that commercial service providers start honouring digital sovereignty and start providing apps for Linux. Not just for the Linux desktop, but also for mobile Linux platforms. This dual use case can easily achieved with an app development that bears convergence in mind.
App Ecosystems are also a Matter of Perspective
And one more minor note: whenever I open an Android appstore or can peak over someone's shoulder using an iOS device: I always wonder: what are all these apps about??? Never heard about them.
So, familiarity really depends on perspective. And perspective depends on what you are used to. Change what you do and your perspective will follow.
Ubuntu Touch's root filesystem (rootfs) is Immutable
Only thing from that video blog post that we haven't fixed and won't do so in the midterm future is apt-get not working on the command line.
The reason for this is: the Ubuntu Touch root file system is an immutable file system and thus shall not be changed via apt-get & friends by ordinary users.
There are various discussions ongoing such as dpkg-divert'ing apt-get to a wrapper shell script that spits out an error message if rootfs is mounted read-only and someone tries to install packages the Debian/Ubuntu way. Other approaches are to mount some RAM disk over the rootfs, so apt-get can be used at runtime but changes to the system get reset at reboot.
However, it is possible to mount the root filesystem read-write and test newer package versions (as UT core developers do regularly, in fact). If you tinker with this, it is recommended to reflash your device (don't wipe user data, when you reflash!) from time to time, because adding packages or package upgrades to your rootfs may over time corrupt the integrity of the rootfs.
One reason for apt-get breaking the rootfs and thus your Ubuntu Touch development device is that the upgrade process of the rootfs image is incremental, so update tarballs sometimes contain only those parts that got changed between this and your previous upgrade (sometimes, upgrades contain a complete rootf image, depending on the interval between upgrades). If files from an incremental update tarball mix into a rootfs that got tinkered with via apt-get, you really end up on your own. Re-flashing will grab the complete rootfs tarball and wipe the whole rootfs and reinstall a fresh version of the newest rootfs image. Developers also do this in regular intervals to ensure their test device is clean again before running more/other tests.
06:21
Urgent: Federal worker lifelong secrecy agreements [Richard Stallman's Political Notes]
US citizens: submit an official comment to the Office of Personnel Management opposing the plan to require federal workers to sign lifelong secrecy agreements covering everything they do and know about their jobs.
I have condemned since around 1980 nondisclosure agreements that cover generally useful technical information, and refused ever to agree to one. These nondisclosure agreements are a different moral issue; they will be aimed protecting corrupt and treacherous acts inside federal agencies.
See the instructions for how to sign this letter campaign without running any nonfree JavaScript code--not trivial, but not hard.
Urgent: Investigate FBI's raid on voter registration activity [Richard Stallman's Political Notes]
US citizens: call on your congresscritter and senators to investigate the FBI's raid on a voter registration activity.
US citizens: Join with this campaign to address this issue.
To phone your congresscritter about this, the main switchboard is +1-202-224-3121.
Please spread the word.
Urgent: Reject magats' attempt to obstruct mailing of ballots [Richard Stallman's Political Notes]
US citizens: call on the USPS to obey its mandate by rejecting the magats' attempt to obstruct the mailing of ballots to voters.
See the instructions for how to sign this letter campaign without running any nonfree JavaScript code--not trivial, but not hard.
Urgent: Reject deeper embedding of U.S.-Israeli military cooperation [Richard Stallman's Political Notes]
US citizens: call on your congresscritter and senators to reject the deeper embedding of U.S.-Israeli military cooperation.
See the instructions for how to sign this letter campaign without running any nonfree JavaScript code--not trivial, but not hard.
To phone your congresscritter about this, the main switchboard is +1-202-224-3121.
Please spread the word.
Judges challenge corrupter's $1.8bn slush fund [Richard Stallman's Political Notes]
*Bipartisan group of ex-federal judges challenges [the corrupter]'s $1.8bn [corruption slush fund]* in a lawsuit.
They have also urged the judge who approved this self-dealing "settlement" to reopen the decision and investigate whether the case that it "settled" was fraud on that court.
Around 17,500 people deported to countries they've never seen [Richard Stallman's Political Notes]
The persecutor has deported around 17,500 people to countries they have never seen before. Most of them do not speak the local language and can't live there.
Even worse, many of those countries intend to send those deportees back to their countries of origin, where they are likely to be tortured or killed.
Magats don't mind killing an immigrant and are glad to involve another intermediate country as an excuse.
Abortion prohibitions hinder treatments after miscarriages [Richard Stallman's Political Notes]
US state abortion prohibitions hinder treatment after miscarriages.
Adopt ranked choice voting for presidential primaries [Richard Stallman's Political Notes]
Calling on the Democratic Party to adopt ranked choice voting for the presidential primaries of 2028.
Israel expanding part of Gaza where Palestinians are shot on sight [Richard Stallman's Political Notes]
Israel is expanding, step by step, the part of Gaza where Palestinians are to be shot on sight. Originally it was 53% (plus a roughly defined border strip). Then it expanded to 60% plus... Now Netanyahu has ordered widening it to 70% plus the border strip.
06:07
Windows stack limit checking retrospective, follow-up [The Old New Thing]
Aaron Giles worked on porting Windows to both ARM32 and AArch64, and he noted a missing detail in my retrospective of stack limit checking on arm64:
Every once in a while Raymond Chen does an architectural comparison series and I get to see (a paraphrased version of) some code I wrote way back when. He’s right about why we passed stack size/16, but surprised he didn’t call out the unconventional x15 usage.
— Aaron Giles (@aarongiles.com) Mar 20, 2026 at 8:08 PM
I’m guessing that by “unconventional x15
usage”, Aaron means “Why is the parameter passed in the
x15 register? The AArch64 calling convention passes
the first parameter in the x0 register, so
shouldn’t that parameter be in the x0
register?”
It seemed so obvious to me that I didn’t consider it worth mentioning.
The function that needs to do a stack probe is in a bit of a bind: It has inbound parameters, some of which might be passed in registers. If the stack size parameter were passed like a normal parameter to the stack probe function, then the calling function has to save its original inbound parameters somewhere. But it can’t save them on the stack because it has to do a stack probe before it can use the stack.
The solution is to give the stack probe function a custom calling convention that limits itself to scratch registers that are not used for receiving inbound parameters.
| Architecture | Used for parameters |
Allocation size |
Also modified |
|---|---|---|---|
| 8086 | ax | bx, dx | |
| x86-32 | ecx | eax | |
| MIPS | a0…a3 | t8 | |
| PowerPC | r3…r10 | r12 | r0, r11 |
| Alpha AXP | a0…a5 | t12 | t8, t9, t10 |
| x86-64 | rcx, rdx, r8, r9 | rax | r10, r11 |
| AArch64 | x0…x7 | x15 | x16, x17 |
The calling conventions for processor architectures designate certain registers as “super-volatile”, typically those used reserved for assembler temporaries or for facilitating function calls between modules. These registers are excellent candidates for use by the stack probe function since there is no way they could be used for normal parameter passing.
For example, PowerPC uses r11, and AArch64 uses r16 and r17, all of which are available for use in function glue stubs. Other opportunities were overlooked: MIPS and Alpha AXP could have used at, though I can see why they may have wanted to avoid using them because the assembler might use them implicitly when assembling pseudo-instructions.
The post Windows stack limit checking retrospective, follow-up appeared first on The Old New Thing.
02:35
[$] LWN.net Weekly Edition for June 18, 2026 [LWN.net]
Inside this week's LWN.net Weekly Edition:
- Front: State of Fedora; mTHP creation; overlayfs; buffer-heads cleanup; 7.1 statistics.
- Briefs: curl summer of bliss; 7.1 kernel; AUR compromise; Fedora election; FairScan 2.0; Firefox 152.0; Homebrew 6.0.0; KDE Plasma 6.7; LWN topic list; Quotes; ...
- Announcements: Newsletters, conferences, security updates, patches, and more.
Wednesday, 17 June
23:56
Android 17 released for Pixel devices with very few interesting improvements [OSnews]
Yesterday, Google released Android 17 to Pixel devices, so late last night I updated my Pixel 10 Pro with the intent to write a news item about the release today. The reality is that that I totally forgot I even upgraded last night, because Android 17 is about the biggest nothingburger I’ve ever seen. Virtually all of the new features listed in the upgrade blurb on my phone were “AI” nonsense I don’t encounter, so over the course of the day, I didn’t really notice anything new about my phone’s operating system.
The only interesting feature that I think will be particularly useful on tablets and perhaps foldable devices is something called “App Bubbles”. Basically, you can turn any application into an overlay that can be minimised into a bubble, which then lives anywhere on your screen. Tap it, and you can maximise the overlay again. This little multitasking bubble can contain multiple applications, effectively making it a dock or taskbar. Neat, but I didn’t see much use for it on my phone.
The remainder of the new non-“AI” features are hard to spot, at best. I guess the ability to turn one half of a foldable display into a gamepad is neat if you can deal with gaming on glass buttons (I cannot), and the changes to location access (you can now grant it for just one time) and contacts access (it’s more fine-grained and temporary now instead of granting access to everything forever) are welcome, but that’s about it for user-facing features.
Under the hood, the one thing that stands out is that Google is enforcing stricter memory limits for applications, based on how much RAM a device has. The idea is that this should prevent memory leaks from getting out of control and leading to crashes, which is nice, especially for devices with less RAM.
Android 17 is available for Pixel devices now, and will probably find its way to non-Pixel devices over the coming months or years. With how little meat there is on Android 17’s bones, this might be the first release where Android’s update woes don’t really matter.
23:07
The Free and Open Web Is Under Attack at the IETF [Deeplinks]
The ability to access publicly available information using automated tools is a central value and benefit of a free and open internet. Automated access—often called crawling or scraping—powers important, useful tools for locating, preserving, and analyzing online information. For example, crawling and scraping helps journalists, researchers, and watchdog organizations report the news, find security flaws, and investigate discrimination. Crawling the web allows non-profits like the Internet Archive to preserve historical copies of websites. Tools for automated comparison shopping allow consumers to find the best deals on items they want to buy. And so on.
Yet the open internet access is increasingly under threat from publishers and Big Tech companies alike. Fearing lost advertising and licensing revenues, website operators increasingly claim that they need to lock down their sites from bots that crawl public web content to train or operate AI models. Some companies are even trying to embed their business models into internet standards by changing Internet Engineering Task Force (IETF) technical standards that shape much of the internet.
Many of their economic anxieties are understandable. AI bots can strain websites’ infrastructure, in some cases, degrading site performance or taking them offline altogether. Upgrading systems costs money that some sites may not have. And AI is likely to disrupt the business models many publishers adopted in response to the rise of the internet, if users rely on AI overviews instead of visiting source websites.
However reasonable these fears may be, the answer is not to change the IETF standards from neutral protocols that encourage openness to restrictive requirements designed to monetize internet access.
The worst of these proposed standards would give websites far greater ability to automatically block legitimate, lawful scraping and crawling. For example, the AI Preferences working group is working on proposals to give publishers a way to express “preference signals” against crawling web data for AI-related purposes, including to train models, generate outputs, and help users search the web. These preference signals would be expressed through robots.txt and could potentially become legally binding in some jurisdictions.
Another working group, called Web Bot Auth, is pursuing efforts to protect sites from overly-aggressive bots that strain website resources—a positive goal that could meaningfully improve the internet in the AI era. But Web Bot Auth is simultaneously pursuing a much more dangerous path as well: standards changes that would enable sites to cryptographically identify bots so that they can more easily block anyone they wish—not just “bad” actors, but competitors, dissidents, or anyone who hasn’t paid for the right to access sites using automated tools. If sites restrict crawling to a preapproved list of cryptographically authenticated bots, they could require licensing payments from those wishing to crawl their sites. This would close off the open web to researchers, archivists, and startups without the ability to pay for automated access.
Websites may have legitimate reasons to worry about AI’s impacts on their traffic and advertising revenue, but those reasons must be weighed against the benefits of the open web. These proposals would effectively give website operators veto power over a wide range of important uses—from the investigations and archival works described above to accessibility tools for people with disabilities, to research efforts aimed at holding governments accountable.
That is why we are fighting back against these threats to open access. EFF and our allies in the open internet community have successfully resisted some of the most dangerous IETF proposals thus far—and won’t stop working to protect the open web from efforts to manipulate internet standards to undermine the right to freely access the internet in any legal way, including with automated tools.
22:00
It's very textbook stuff; now that the game festivals are over, now that the charm offensive has been executed more or less flawlessly and there's no more juice to squeeze from it, it's time to produce an incredibly large cartoon knife from nowhere and move to the next phase.
21:35
The NO FAKES Act Could Silence Satire, Commentary, And News [Deeplinks]
The NO FAKES Act is supposed to target harmful AI-generated impersonations. But in reality, it will make it easier to suppress commentary, satire, and other lawful speech. That's why EFF has signed a letter urging the Senate Judiciary Committee not to advance the bill in its current form.
Tell Congress to Say No to NO FAKES
In the letter, EFF joins a coalition of civil society groups in pointing out that the bill would import many of the worst features of the DMCA notice-and-takedown system into an even broader range of online expression. Faced with a “heckler’s veto” over legal speech, platforms will have incentives to remove content first and ask questions later.
The bill offers no protection for a platform’s judgment about an often difficult question—whether a particular piece of content is satire, parody, commentary, or news. Any platform that guesses wrong faces penalties of up to $750,000 per work.
NO FAKES could also undermine the rights of the people it is supposed to protect. The new federal “likeness” right could be licensed or transferred to others, so individuals will lose control over the use of their own face and voice. That’s not theoretical—workers in the entertainment industry are routinely asked to sign broad contracts about the future use of their likenesses.
As the letter notes:
A background actor who signs a release on set or an ordinary person who clicks through a platform's terms of service could end up with the right to their own face and voice in someone else's hands, for years, with federal enforcement behind it.
EFF and the other signatories urge Congress to examine existing legal remedies and pursue narrowly tailored solutions to genuine harms. The last thing we need is a sweeping new intellectual property right that threatens free expression.
In addition to EFF, the letter is signed by the Center for Democracy & Technology, the American Civil Liberties Union, Fight for the Future, Foundation for Individual Rights and Expression, the Organization for Transformative Works, Public Knowledge, the R Street Institute, The Future of Free Speech, and the Woodhull Freedom Foundation. Read the full letter here.
20:28
The Knicks’ message is that working together works.
Being a NYer and Knicks fan, I don't have a good perspective on how big an event the Knicks winning is. If you're not from the area, how widely is this holiday being observed and how many share the enthusiasm. Are people everywhere asking "How about those Knicks!"
There will be new higher level development environments. How they work, I don't know. But much of your time working in Claude Code is telling it how to do stuff you want it to do, always -- and reminding that it that it forgot one of the rules (which it seems to always admit). A new development environment will come with rules about how to work with people. Those rules will be written with the help of psychologists who study human reasoning processes.
19:42
Pluralistic: The (real) dead economy theory (17 Jun 2026) [Pluralistic: Daily links from Cory Doctorow]
->->->->->->->->->->->->->->->->->->->->->->->->->->->->->
Top Sources: None -->
Today's links
- The (real) dead economy theory: Vibes and memestocks, all the way down.
- Hey look at this: Delights to delectate.
- Object permanence: Jim Baen has had a stroke; Blame Apple for iTunes DRM; France v the internet; "Rotters"; 1901 undersea cables; Washington Post wants Trump coverage blackout; Taxes are for the little people; Gamer lifecycle; Ghanian postal song; "What Lies Beneath the Clock Tower": Murder of Jo Cox; 12 year old doxed by anti-vaxers; Hong Kong bookseller recants forced confession.
- Upcoming appearances: LA, Menlo Park, Toronto, NYC, Philadelphia, Chicago, London, Edinburgh, Brighton, South Bend.
- Recent appearances: Where I've been.
- Latest books: You keep readin' em, I'll keep writin' 'em.
- Upcoming books: Like I said, I'll keep writin' 'em.
- Colophon: All the rest.
The (real) dead economy theory (permalink)
Here's a fun fact about Elon Musk: in 2020, his (nominal) net worth was $20b, and today it's $1t (nominally). But that's not the fun fact; this is: everything he's done since 2020 was a flop.
As John Quiggin writes, the pre-2020 Musk was the Musk of Tesla, batteries and Starlink. The post-2020 Musk is the Musk of Starship, robotaxis, Cybertrucks and Twitter – a string of commercial flops and assets that literally exploded. I would add that post-2020 Musk created the world's hungriest money-furnace, an automated child-porn production tool called "XAI":
https://crookedtimber.org/2026/06/15/one-big-grift/
Quiggin declares that this is the era in which "financial markets fail in the task of valuing assets accurately," and "the institutional structures that are supposed to make them work have given up trying." Nor did this start with the Spacex IPO. As Quiggin writes, Bitcoin and other cryptos were once shunned by nominally sober financial institutions like Goldman Sachs, but today, not only do all the big banks offer crypto services, people have largely stopped calling it cryptocurrency because no one is even pretending that it's a form of money. It's a tradeable collectible, not even particularly useful for paying for crimes or laundering money.
Spacex is just a continuation of the logic of crypto, in which something is valuable because some people think other people will pay more for it in the future, and not because it does useful things:
https://johnquiggin.com/2018/02/09/bitcoin-kills-the-efficient-market-hypothesis/
That's the logic of the whole market today. AI – the world's money-losingest technology – attracts investment at the expense of everything else. When horrified NIH lifers begged the DOGE boys not to shut down long-running medical research projects, Musk's broccoli-haired brownshirts laughed in their faces, saying we don't need cancer research because "GAI" is almost here and it will cure cancer. You could hardly ask for a better example of investing in vibes over value than shutting down real cancer research to free up money for teaching more words to the word-guessing machine because it's about to become God and cure cancer.
Today, Goldman Sachs isn't merely all-in on crypto – it's all-in on the Spacex IPO. As Quiggin writes, the bank has signed off on Musk's claim that "Musk's ragbag of assets" will grow one hundredfold in the next 40 months.
Quiggin's short essay has been rolling around in my mind since I read it a couple days ago. Then, yesterday, I spotted this essay by Owen McGrann entitled "The Dead Economy Theory":
https://www.owenmcgrann.com/p/the-dead-economy-theory
The perfect name for this phenomenon! Or so I thought. Then I read McGrann's article, and discovered that it's yet another piece asking how the economy will work after AI takes all of our jobs because AI is absolutely going to do that and there's no point in even questioning whether that will happen.
Look, thought experiments about how to deal equitably with labor displacement in the face of automation are all well and good. I'm a science fiction writer, that stuff is my bread and butter.
But applying "dead economy theory" to the blithe acceptance of the claims of AI pitchmen is a terrible waste of a killer coinage. The true risk of AI to your job isn't: "an AI will do your job." It's: "an AI salesman will exploit your boss's infinite horniness for replacing mouthy workers with pliable machines to sell him a chatbot that can't do your job, and then your boss will fire you and replace you with that inept, defective chatbot."
By the same token: the real "dead economy" risk isn't that all the productive labor will be done by chatbots owned by a habitual liar and eminently guillotineable billionaire like Sam Altman. The actual dead economy risk is that our institutions and markets will continue to move capital from productive activity into memestocks, vibes, and bubbles.
We could do "AI cancer research" by producing tools that automate gnarly multivariant analysis problems for cancer researchers. But what we're actually doing is defunding cancer research (especially any research into "systemic" cancer because studying systemic things is "woke") to free up fiscal space so we can build data-centers and make Musk into a trillionaire.
That's not just a dead economy – it's one that'll kill everyone you love and everything that matters.
Hey look at this (permalink)
- Onward, Friends https://www.eff.org/deeplinks/2026/06/farewell-now-friends
-
The 40 Most Rage-Inducing Problems in Tech https://www.theringer.com/2026/05/28/tech/pope-leo-xiv-ai-encyclical-tech-industry-problems
-
THE GUILLOTINE EMOJI PROPOSAL https://www.carrozo.com/guillotine-emoji
-
Corporations Repurchase $4.8 TRILLION of Stock Since 2017 Trump-GOP Tax Law https://4taxfairness.substack.com/p/corporations-repurchase-48-trillion
-
US approval of Paramount/Warner Bros. deal surprised DOJ lawyers, report says https://arstechnica.com/tech-policy/2026/06/us-approval-of-paramount-warner-bros-deal-surprised-doj-lawyers-report-says/
Object permanence (permalink)
#20yrsago Jim Baen, science fiction publisher, has had a serious stroke https://nielsenhayden.com/makinglight/archives/007658.html#007658
#20yrsago Why Apple is to blame for iTunes DRM https://web.archive.org/web/20060620004534/http://vitanuova.loyalty.org/NewsBruiser-2.6.1/nb.cgi/view/vitanuova/2006/06/15/1
#20yrsago Lifecycle of a gamer https://www.raphkoster.com/2006/06/16/the-lifecycles-of-a-player/
#20yrsago Spammer: I’ll buy MySpace profiles with more than 20k contacts https://web.archive.org/web/20060619062837/http://skibrooklyn.blogspot.com/2006/06/easy-money-sell-your-friends.html
#20yrsago Psychology of bad probability estimation: why lottos and terrorists matter https://web.archive.org/web/20060627174933/https://server1.sxsw.com/2006/coverage/SXSW06.INT.20060311.DanielGilbert.mp3
#15yrsago Copyright complaint kills Peanutweeter https://web.archive.org/web/20110620093750/https://www.wired.com/underwire/2011/06/peanutweeter-dmca-takedown/
#15yrsago Work song of Ghanian postal workers cancelling stamps https://blogfiles.wfmu.org/KF/0512/Ghana_Post_Office.mp3
#15yrsago What Lies Beneath the Clock Tower: steampunk choose-your-own-adventure https://memex.craphound.com/2011/06/17/what-lies-beneath-the-clock-tower-steampunk-choose-your-own-adventure/
#15yrsago French proposal: any URL to be arbitrarily blacklisted without due process https://www.laquadrature.net/en/2011/06/15/the-entire-internet-under-governmental-censorship-in-france/
#15yrsago Rotters: YA horror novel about grave-robbing chills, thrills, delights https://memex.craphound.com/2011/06/15/rotters-ya-horror-novel-about-grave-robbing-chills-thrills-delights/
#15yrsago Map of undersea cables from 1901 https://web.archive.org/web/20110220121138/http://www.dephx.com/2010/11/map-of-undersea-cables-from-1901.html
#15yrsago Copyright complaint kills Peanutweeter https://web.archive.org/web/20110620093750/https://www.wired.com/underwire/2011/06/peanutweeter-dmca-takedown/
#15yrsago Work song of Ghanian postal workers cancelling stamps https://blogfiles.wfmu.org/KF/0512/Ghana_Post_Office.mp3
#15yrsago What Lies Beneath the Clock Tower: steampunk choose-your-own-adventure https://memex.craphound.com/2011/06/17/what-lies-beneath-the-clock-tower-steampunk-choose-your-own-adventure/
#10yrsago Supreme Court ruling is a blow to copyright trolling business-model https://arstechnica.com/tech-policy/2016/06/attorneys-in-copyright-case-on-resold-textbooks-inch-closer-to-2m-payday/
#10yrsago The Orlando shooting, according to the Congressmen who took the most money from the NRA https://web.archive.org/web/20160617143716/https://theslot.jezebel.com/heres-how-the-congressmen-who-have-gotten-the-most-cash-1782083985
#10yrsago British Pro-EU MP murdered in the street by man shouting “Britain first!” https://web.archive.org/web/20160616212235/https://theintercept.com/2016/06/16/british-referendum-campaign-suspended-killing-pro-europe-lawmaker-jo-cox/
#10yrsago 12 year old makes devastating video about anti-vaxxers, gets doxxed https://skepchick.org/2016/06/anti-vaxxers-dox-a-child-critic/
#10yrsago Report from the prison-industrial complex’s leading trade show https://www.theguardian.com/us-news/2016/jun/16/us-prisons-jail-private-healthcare-companies-profit
#10yrsago Your cable operator is spying on you and selling the data from your set-top box https://publicknowledge.org/public-knowledge-defends-consumer-privacy-in-set-top-box-data-complaint-to-fcc-ftc/
#10yrsago Not robots: youth unemployment caused by late retirement, driven by pension precarity https://thebaffler.com/salvos/exit-planning-geoghegan
#10yrsago Oakland mayor denies firing police chief over officers who statutorily raped teen sex-worker https://eastbayexpress.com/badge-of-dishonor-top-oakland-police-department-officials-looked-away-as-east-bay-cops-sexually-exploited-and-trafficked-a-teenager-2-1/
#10yrsago Paramount tells judge that they’re still suing over Star Trek fan-film https://www.hollywoodreporter.com/business/business-news/paramount-says-star-trek-fan-903497/
#10yrsago $40,000/year private school sues school for low-income kids for $2M over “Commonwealth” https://www.bostonglobe.com/metro/2016/06/16/can-school-lay-claim-commonwealth-its-name-back-bay-institution-believes-can/WHwiaaPEn04cIY6uxXjoiO/story.html
#10yrsago Wisconsin Congresswoman: mandatory drug tests for anyone claiming $150K in itemized tax-deductions https://www.theguardian.com/us-news/2016/jun/16/gwen-moore-drug-test-rich-for-tax-deductions
#10yrsago Hong Kong bookseller: I was forced to confess on China TV https://www.bbc.com/news/av/world-asia-china-36552672#5yrsago
#10yrsago Washington Post calls for “blackout” on Trump coverage, appeals to RNC https://web.archive.org/web/20160615113350/https://www.washingtonpost.com/opinions/the-right-response-to-donald-trump-a-media-blackout/2016/06/14/2868a0e0-3256-11e6-8758-d58e76e11b12_story.html
#10yrsago Security economics: black market price of hacked servers drops to $6 https://www.wired.com/2016/06/xdedic-server-trading-forum-kaspersky/
#10yrsago Lower-case “x” as a gender-neutral typographic convention https://kottke.org/16/06/x-marks-gender-neutral
#5yrsago Taxes are for the little people https://pluralistic.net/2021/06/15/guillotines-and-taxes/#carried-interest
Upcoming appearances (permalink)
- Virtual: The future of world governance, with Kim Stanley
Robinson (UN Independent Expert on International Order), Jun 19
https://www.youtube.com/live/wJvBvYdaAMY -
LA: The Reverse Centaur's Guide to Life After AI with Brian Merchant (Skylight Books), Jun 19
https://www.skylightbooks.com/event/skylight-cory-doctorow-presents-reverse-centaurs-guide-life-after-ai-w-brian-merchant -
Menlo Park: The Reverse Centaur's Guide to Life After AI with Angie Coiro (Kepler's), Jun 21
https://www.keplers.org/upcoming-events-internal/cory-doctorow-2026 -
Toronto: The Sovereignty Debate (IAB Canada's State of the Nation), Jun 23
https://iabcanada.com/state-of-the-nation-2026 -
Toronto: The Reverse Centaur's Guide to Life After AI (Osler Records/Type Books), Jun 23
https://www.eventbrite.com/e/cory-doctorow-book-launch-and-talk-tickets-1991501299998 -
NYC: The Reverse Centaur's Guide to Life After AI with Jonathan Coulton (The Strand), Jun 24
https://www.strandbooks.com/cory-doctorow-the-reverse-centaur-s-guide-to-life-after-ai.html -
Philadelphia: The Reverse Centaur's Guide to Life After AI with David Williams (Fitler Club/Philadelphia Citizen), Jun 25
https://www.eventbrite.com/e/cory-doctorow-book-event-tickets-1990110326559 -
Chicago: The Reverse Centaur's Guide to Life After AI with Rick Perlstein (Exile in Bookville), Jun 26
https://exileinbookville.com/events/50628 -
London: Idler Festival, Jul 11
https://www.idler.co.uk/festival/ -
Edinburgh International Book Festival with Jimmy Wales, Aug 17
https://www.edbookfest.co.uk/events/the-front-list-cory-doctorow-and-jimmy-wales -
Brighton: The Reverse Centaur's Guide to Life After AI with Carole Cadwalladr (Brighton Dome), Sep 8
https://brightondome.org/whats-on/LSC-cory-doctorow-the-reverse-centaurs-guide-to-life-after-ai/ -
South Bend: An Evening With Cory Doctorow (Notre Dame), Oct 6
https://franco.nd.edu/events/2026/10/06/an-evening-with-cory-doctorow/
Recent appearances (permalink)
- The Enshittification of Life, the Universe, & Everything
(Luke Savage)
https://www.lukewsavage.com/p/the-enshittification-of-life-the -
Cory Doctorow's digital jail-break (DW In Focus)
https://www.dw.com/en/cory-doctorows-digital-jail-break/audio-77414035 -
Why the Internet Got Worse and What to Do About It (Jim Rutt) (RIP)
https://www.jimruttshow.com/cory-doctorow-3/ -
On Enshittification – and what can be done about it (Re:publica)
https://www.youtube.com/watch?v=KhINQgPMVSI -
EFFecting Change: How to Disenshittify the Internet (EFF, with Wendy Liu)
https://archive.org/details/effecting-change-enshittification
Latest books (permalink)
- "Canny Valley": A limited edition collection of the collages I create for Pluralistic, self-published, September 2025 https://pluralistic.net/2025/09/04/illustrious/#chairman-bruce
-
"Enshittification: Why Everything Suddenly Got Worse and What to Do About It," Farrar, Straus, Giroux, October 7 2025
https://us.macmillan.com/books/9780374619329/enshittification/ -
"Picks and Shovels": a sequel to "Red Team Blues," about the heroic era of the PC, Tor Books (US), Head of Zeus (UK), February 2025 (https://us.macmillan.com/books/9781250865908/picksandshovels).
-
"The Bezzle": a sequel to "Red Team Blues," about prison-tech and other grifts, Tor Books (US), Head of Zeus (UK), February 2024 (thebezzle.org).
-
"The Lost Cause:" a solarpunk novel of hope in the climate emergency, Tor Books (US), Head of Zeus (UK), November 2023 (http://lost-cause.org).
-
"The Internet Con": A nonfiction book about interoperability and Big Tech (Verso) September 2023 (http://seizethemeansofcomputation.org). Signed copies at Book Soup (https://www.booksoup.com/book/9781804291245).
-
"Red Team Blues": "A grabby, compulsive thriller that will leave you knowing more about how the world works than you did before." Tor Books http://redteamblues.com.
-
"Chokepoint Capitalism: How to Beat Big Tech, Tame Big Content, and Get Artists Paid, with Rebecca Giblin", on how to unrig the markets for creative labor, Beacon Press/Scribe 2022 https://chokepointcapitalism.com
Upcoming books (permalink)
- "The Reverse-Centaur's Guide to AI," a short book about being a better AI critic, Farrar, Straus and Giroux, June 2026 (https://us.macmillan.com/books/9780374621568/thereversecentaursguidetolifeafterai/)
-
"Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2026
-
"The Post-American Internet," a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027
-
"Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027
-
"The Memex Method," Farrar, Straus, Giroux, 2027
Colophon (permalink)
Today's top sources:
Currently writing: "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Third draft completed. Submitted to editor.
- "The Reverse Centaur's Guide to AI," a short book for Farrar, Straus and Giroux about being an effective AI critic. LEGAL REVIEW AND COPYEDIT COMPLETE.
-
"The Post-American Internet," a short book about internet policy in the age of Trumpism. PLANNING.
-
A Little Brother short story about DIY insulin PLANNING
This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.
https://creativecommons.org/licenses/by/4.0/
Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.
How to get Pluralistic:
Blog (no ads, tracking, or data-collection):
Newsletter (no ads, tracking, or data-collection):
https://pluralistic.net/plura-list
Mastodon (no ads, tracking, or data-collection):
Bluesky (no ads, possible tracking and data-collection):
https://bsky.app/profile/doctorow.pluralistic.net
Medium (no ads, paywalled):
Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):
https://mostlysignssomeportents.tumblr.com/tagged/pluralistic
"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla
READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.
ISSN: 3066-764X
18:49
ARM Never Made a Chip. Dolby Never Built a Speaker. [I, Cringely]
There’s a lot of excited arithmetic going around about artificial intelligence. A trillion-dollar valuation here, a hundred-billion-dollar funding round there, the price of a model quoted like the budget of a moon mission. I’ve been writing this column long enough — since the Reagan administration, if you want to make me feel old about it — to have learned one durable thing about computing: the number everybody is staring at is almost never where the money ends up.
Let me tell you about two companies that figured that out early.
The first is ARM. If you’re reading this on a phone, there’s an ARM design inside it. There’s one in the tablet on your nightstand, the car in your driveway, probably the watch on your wrist. ARM is in nearly every smartphone on the planet. And here’s the part that ought to stop you cold: ARM has never manufactured a single chip. Not one. They don’t own a factory. They design an instruction set — the basic grammar a processor uses to think — and they license it. Everybody else does the expensive, dangerous, capital-soaked work of actually building the silicon. ARM collects a royalty measured in pennies on each chip, and those pennies, multiplied across the entire industry, have made a company that builds nothing worth more than many of the companies that actually run the factories.
The second is Dolby. Ray Dolby could have spent his career building the world’s best noise-reduction box and selling it to recording studios, and he’d have done fine. Instead he did something smarter. He turned his method for cleaner sound into a standard, and then he made that standard the thing every other manufacturer wanted on the box. You never bought a Dolby. You bought a tape deck, or a receiver, or a movie ticket, and somewhere on it was a little double-D logo that meant somebody had paid Ray Dolby for the privilege of sounding good. He didn’t win the audio market. He put a toll booth on it.
I bring up these two old stories because I think we’re about to watch the same trick get played in AI, and almost nobody is positioned for it.
Here’s the uncomfortable truth underneath all that trillion-dollar arithmetic: intelligence is on its way to becoming a commodity. The models are converging. The thing that felt like magic two years ago is now something you can rent by the token from half a dozen vendors, and the price only goes one direction. When you can swap one model for another the way you swap one brand of gasoline for another, you’re no longer looking at a miracle. You’re looking at a utility. And utilities don’t command trillion-dollar margins for long.
So, if intelligence gets cheap, where does the value go? It goes, as it always does, to whatever stays scarce.
And the scarce thing in AI isn’t intelligence. It’s trust.
We’ve built machines that are fluent and confident and, a meaningful fraction of the time, wrong — wrong in the specific, expensive way that sounds exactly as authoritative as being right. I’ve spent a good part of this series on that problem, because it is the problem. A model that is brilliant and occasionally invents things is not something you can put in front of an insurance adjuster, a radiologist, a loan officer, or a judge. The intelligence is already good enough. What’s missing is the guarantee.
Now here’s the interesting thing about a guarantee like that. Once somebody works out how to verify an AI’s answer — to know, before it ever reaches a human, whether the system is standing on solid ground or making it up — that capability doesn’t behave like a product. It behaves like a standard.
Think about why. You don’t want trustworthy AI in one app. You want it everywhere the AI is, the way you want the brakes to work in every car and not just the one in the showroom. A verification layer is only worth something if it sits underneath everything — and the fastest way to get underneath everything is not to build a rival to every AI company on earth. It’s to license the one thing they all need and let them keep competing on everything else.
That’s ARM. That’s Dolby. You don’t sell the trustworthy machine. You license the part that makes the machine trustworthy, and you collect a sliver every time it runs.
It’s an odd business to explain at a cocktail party, because the honest one-line description is “we sell nothing.” We don’t want to build the model. We don’t want to win the application market. We don’t want to run the data center. We want to be the instruction set for verified answers — the double-D logo on the box that tells a regulated buyer the output can be trusted — and to be paid a small, dull, recurring amount every single time, across a base that is growing faster than almost anything in the history of this industry.
Small and dull and recurring, multiplied by enormous, is exactly how ARM quietly became worth more than the giants whose chips it lives inside. You don’t have to win the market. You have to be the toll on it.
I find this clarifying, and not only for business reasons. For a decade the working assumption in AI has been that the prize goes to whoever builds the biggest brain. I think that’s the wrong race, or at least the wrong finish line. The biggest brain is going to get cheaper every year, the way the fastest chip and the cleanest sound did before it. The durable money — the ARM money, the Dolby money — is going to belong to whoever owns the standard that everyone else has to license in order to be believed.
Trust is going to be the most valuable thing in artificial intelligence. And trust, it turns out, is something you license, not something you sell.
Disclosure: I’m a co-founder of 2Brains, Inc., which is built on exactly the idea in this column — so season my enthusiasm with the appropriate grain of salt. I’ve tried to make the argument stand on its own two feet, the way ARM and Dolby do, whether or not you ever pay me a nickel
The post ARM Never Made a Chip. Dolby Never Built a Speaker. first appeared on I, Cringely.
Digital Branding
Web Design Marketing
The 31st anniversary isn’t usually the one where people get introspective about the nature of marriage and stuff — we tend to like big round numbers for a reason — but last year on this day Krissy and I were in Venice doing all sorts of touristy things and I really didn’t have the time or the inclination to spend my time in Italy on a laptop (and not even a laptop; I took my iPad with me). This year for our anniversary we’re going to Versailles, but it’s the one in Ohio and it’s pronounced “Ver-SAILS,” and we’re going there for dinner at a nice restaurant there. So as it happens I have some time today to muse on the nature of matrimony.
I’ve spoken before of the things that Krissy and I have done to make sure our marriage stays strong over the years, from simple things like saying “I love you” a lot — and I do mean, a lot, I don’t know any other couple who says it as much as we do — to more complicated things like continually checking in on each other, not taking each other for granted and making sure both of us are getting our needs met by the other. This is stuff I think most married folks can do, and should do, in the way that works best for their own relationship; basically, the understanding that relationships, even (and maybe especially) the good ones, are still work and ought to be tended to, instead of just being taken for granted.
But the other thing is I think Krissy and I both got lucky in finding the person best suited for helping us become the person we were hoping to be. And yes, at least initially that absolutely was luck; when Krissy spotted me on a dance floor she could know nothing else about me other than I danced like I wasn’t worried about being judged for it, and when I first laid eyes on Krissy I knew nothing about her other than she was the sort of beautiful that could make people walk into walls because they were looking at her. These were good things, sure. A fine start, and enough to get us to go on that official first date three weeks later. But ultimately not a lot to go on.
I still think Krissy is beautiful, and she still enjoys my dance stylings, but it’s everything else that really sealed the deal. It became clear to me that not only was Krissy smart, she was in many ways smarter than I was, with a far better sense of how to actually navigate the day-to-day world in a successful fashion. She was (and is) a direct-line and decisive thinker where I had and have a tendency to overthink and be discursive. None of this is news to long-time readers here, of course; I’ve talked about this before. But what I don’t think people understand is what an actual revelation it was for me to see something like that in action, inside the context of my actual life. I was not — and this is putting it extremely charitably — raised in a situation where order and executive function were common, and it was something I struggled with myself, and, no surprise, still do.
To see someone who just naturally had it, and used it like it was no big deal, well. It was like watching someone perform actual magic. And this person was willing to use it! For me! And us! Together! Aside from the actual fucking relief of having someone in my life actively being stable and sensible and reliable, and also loved me, there was the practical matter of how much potential this opened up for our life together; that I could, and was allowed to, focus on things I was good at, that would end up benefitting us both. I often say to people, here and elsewhere, that I have the career I have because Krissy is my partner, but I genuinely don’t think people understand the extent to how that is true. I would still be a writer, to be sure. I would not this writer, with these books, and this life.
And what about Krissy? Well, I was funny and clever, which is not to be discounted, even if, as we all know, there is a fine line between “clever” and “asshole.” She also saw I was talented — I had a skill that I both used and continued to develop, and an ability in it that was more than just standard issue. On top of that, I was (and still am!) ambitious, which Krissy saw as a plus. Just as I saw potential in what she offered to me in terms of stability and reliability, she saw potential in what I offered to her in the desire to do bigger things, and saw where she fit in with making those things happen.
Equally if not more importantly, Krissy figured out that I didn’t need to be trained out of any bad habits when it came to our partnership. My own particular brand of masculinity was and is not one that required me to petulantly stomp my foot about how I was the man in the relationship, damn it, and therefore was the one in charge of whatever it was a dude was meant to be in charge of. I could write a whole series of posts — and maybe I will one day — about how much of “masculinity” boils down to “I don’t like being argued with and if I don’t get my way I will explode,” but for now, suffice to say that this is not a particular neurosis of mine. Krissy saw, I like to think accurately, that I valued her for every part of her, which included her decisiveness and initiative. I did not need to be told that Krissy should be allowed to cook across the whole range of her abilities. She did not ever have to diminish who she was because she was worried my ego couldn’t handle it.
So, these are the things that we figured out early about each other. As we continued, it turned out that we helped each other build on all of these things. We have never argued about “who is in charge,” not just because that was not an argument worth having, but because the way our skill sets fell out it’s literally never been an issue. To put it extremely generally, when it comes to our lives together, I handle strategy and Krissy handles tactics, because that’s how our brains work best. Strategy without tactics is useless; tactics without strategy is pointless. It’s not about who makes decisions. It’s about, when we make the decision, how do we make it happen.
None of this happened because we knew from day one about any of this. It came from paying attention to each other, valuing and trusting each other, and building on what we’ve done as we’ve gone along. We got lucky when we met that these things about us were already there, and we liked them about each other. But then we did the work together, every day, so that these things we liked were given space to develop into things that would let us build a whole life together, across four decades now. It would be simplistic and wrong to suggest all of this happened without hiccups or snags or occasional misunderstandings along the way, of course. We are both human beings. But the deep well of love and trust that we can draw from helps a whole lot when that’s happened.
I don’t think any of us can help if we get lucky when it comes to drawing a partner who helps us be our best self — I think Krissy and I found the right person for us almost entirely by random and had the good sense to go with that. I do think everyone can look at the partner they have and ask “how can who I am and what I do make their life better, and our life better?” Because, you know, I have faith there is an actual good answer for everyone there. You have to find it. And then you have to do it. And then keep doing it.
And keep asking it, because life changes. Krissy and I are not the people, or in the same circumstances, in our 50s as we were in our 20s, 30s, or even 40s. Every step of our life we wanted and needed things from each other and, so far, at least, we’ve figured out the ways to make that happen. It’s work! It never stops being work! And the reward is having a life that only you two could have made for each other. There was no guarantee that at any step along the way we couldn’t have fallen out of step with each other. Sometimes that happens, and sometimes when that happens the best thing is to call it and move on separately. That’s all right! For us, it keeps working. We work to keep it working.
This is where we are, 31 years into the marriage. I spend a lot of time letting Krissy know how wonderful I think she is, and how much I value the life we built together, and how much I’m looking forward to continuing to do that, for as long as we get to. She’s the best thing to happen to me, and I keep trying to return that favor. I’ll keep doing it. She’s really great.
— JS
17:35
Fedora F44 election results [LWN.net]
The results are in for Fedora's F44 election cycle for seats on the Fedora Council, Fedora Engineering Steering Committee, Fedora Mindshare Committee, and EPEL Steering Committee.
Miro Hrončok and Aleksandra Fedorova have won seats on the council. Neal Gompa, Fabio Valentini, Michel Lind, Maxwell G, and Simon de Vlieger have been elected to FESCo. Samyak Jain, Akashdeep Dhar, Luis Bazan, and Mat Holmes have all been elected to the Mindshare Committee. The four candidates for the EPEL committee, Carl George, Diego Hererra, Jonathan Wright, and Troy Dawson were all automatically elected as there were an equal number of candidates and seats open. Congratulations to all the winners.
16:56
Joey Hess: best of the web [Planet Debian]
This is somehow the featured website on https://earlyweblinks.com/ this week.
Read all about my web site here! https://earlyweblinks.com/site-of-the-week/joey-hess
Kind of reminds me of back in 1995 or so when my website would randomly end up picked by some best of the web list that I never heard of. The web is still a small place I guess.
Maybe I should join a web ring or something?
16:49
Everything security at PyCon US 2026 [LWN.net]
The Python Software Foundation blog has a post with a summary of the security-related content at PyCon US 2026 with links to slides from important sessions. The recordings will be published to the PyCon US channel on YouTube, and the post will be updated with links to those videos as they are made available.
16:42
The Case Against Building Your Own Agent Platform [Radar]
You know the meeting. The board wants an AI agent strategy by end of quarter. Someone on the leadership team has read a McKinsey report. You’ve been voluntold to build the platform. The slide deck says “AI-native.” The acceptance criteria are vague. Somebody mentions LangGraph, and somebody else says, “We’ll just wrap it ourselves.”
You ask what “done” looks like. Nobody in the room can answer.
The cost of building this is almost always estimated before anyone has a clear picture of what “this” actually is. And that’s the problem I want to work through here, because the scope of the work being casually assigned to internal platform teams right now is genuinely larger than the people assigning it understand.
Build versus buy, flipped in a year
This particular pendulum has swung before. App servers in the late 1990s. Content management systems in the 2000s. Container orchestration in the 2010s. The pattern rhymes every time: When a category is new, the components look deceptively simple. Early adopters build their own. The market catches up. Within 18 months, building becomes the expensive path. Within 36 months, the teams that built internally are rewriting on top of the category winner that emerged while they weren’t looking.
What’s different about the current moment is the speed. Menlo Ventures’ 2025 State of Generative AI in the Enterprise report shows the build-versus-buy split inverted in a single year. In 2024, 47% of enterprise AI solutions were built internally. By late 2025, that number had collapsed to 24%. The market made the decision in 12 months, which is unusual.
I’ve lived through enough of these transitions to recognize the shape. What I want to do in this piece is explain why I think the scope of “agent platform” is systematically underestimated right now, and what platform engineers should be asking before they commit to building one.
Most “agent platforms” aren’t
A lot of the projects labeled “agent platform” right now are actually workflow systems with an LLM in the loop. That’s a meaningful distinction. As Anthropic pointed out in its “Building Effective Agents” guidance, workflows are systems where LLMs and tools are orchestrated through predefined code paths. Agents are systems where LLMs dynamically direct their own processes and tool usage.
Most of what enterprises are shipping today sits on the workflow side. That’s fine. Workflows have bounded requirements, tractable testing, and predictable failure modes. If your team is building a workflow system, you might reasonably build it yourselves.
The trap is that teams start building for workflows, then get asked to support agents, and discover the jump isn’t incremental. Agents need memory that survives across sessions. They need evaluation that handles nondeterminism. They need governance that tracks actions, not just outputs. They need orchestration that recovers from failure modes a workflow engine never sees.
Here’s the thesis I want to put on the table: The decision to build an agent platform almost always underestimates the long tail. Memory, governance, eval, and orchestration aren’t features you add to a workflow engine. They’re separate product bets, each with its own maturity curve, its own vendor landscape, and its own team of specialists who’ve been working on it full-time for 18 months while you’ve been doing something else.
Let me walk through them.
Memory
The assumption inside most build proposals is that memory is a database problem. You’ll pick a vector store, shove conversation history into it, and retrieve relevant chunks when the agent needs context. Done.
Production memory is three separate systems: episodic, semantic, and procedural, each with different retention and retrieval policies. It’s temporal reasoning that tracks when facts were valid, not just what they were. It’s deduplication, multitenant isolation, and explicit source-of-truth governance.
The signal that this is a separate product category, not a feature: Mem0 raised $24 million across seed and Series A. Letta (formerly MemGPT) raised $10M from Felicis. Zep exists as an independent company with a temporal knowledge graph engine. Mem0’s State of AI Agent Memory 2026 report maps 21 frameworks across three hosting models with measurable benchmark gaps between them. On LongMemEval, Zep scores 15 points higher than Mem0 on temporal queries, which tells you these aren’t interchangeable tools that happen to serve the same market.
This is the component that platform teams underestimate hardest. Memory sounds like a database problem. It isn’t.
Governance
The assumption is that governance is RBAC plus audit logging. Your agents are services. Services get role-based access controls. You log the tool calls. Compliance is happy.
Agent governance is something different. It spans action authorization, not just data authorization. It requires decision-chain auditability, where you can reconstruct why the agent did what it did, not just what it did. It needs behavioral drift detection, tiered autonomy, and compliance mapped to agent actions rather than data accesses.
Grant Thornton’s 2026 AI Impact Survey of 950 business executives found that 78% lack strong confidence they could pass an independent AI governance audit within 90 days. Meanwhile, enterprises are moving to increase agent autonomy faster than their governance frameworks can keep up. Traditional AI governance wasn’t designed for action-level authorization, which is where most agent-specific risk accumulates.
And there’s a hard deadline attached to this. The EU AI Act becomes fully enforceable for high-risk systems in August 2026. Credit scoring, hiring decisions, healthcare support, and critical infrastructure all fall in scope. If your internal platform doesn’t handle conformity assessments, human oversight mechanisms, complete audit trails, and ongoing monitoring, that’s not a v2 feature. That’s a legal exposure.
OWASP now documents “excessive agency” as a top vulnerability class for LLM applications. Cornell researchers have demonstrated indirect prompt injection attacks that manipulate agents through content they ingest. These are agent-specific attack surfaces, and traditional security tooling doesn’t see them.
RBAC was designed for humans with predictable intent. Agents don’t have predictable intent.
Eval
The assumption is that evaluation means writing test cases and measuring accuracy. You built software before. You know how to test things.
Agent evaluation is qualitatively different from traditional software testing or even LLM evaluation, McKinsey’s QuantumBlack team noted: For LLMs, you evaluate the response to a prompt. For a single agent, you evaluate the full trajectory, including tool calls, state transitions, and intermediate decisions. For multi-agent systems, you evaluate system dynamics, including coordination patterns and collective invariants.
This matters because agent behavior is nondeterministic by design. The same input produces different valid execution paths. “Did the agent succeed?” is no longer a yes-or-no question, because the agent might reach the right answer through a trajectory you didn’t anticipate, or reach the wrong answer through a trajectory that looks reasonable until the last step.
The tooling ecosystem reflects this.
Google Vertex AI has
standardized trajectory_exact_match,
trajectory_precision, and
trajectory_recall as production metrics. These
didn’t exist 18 months ago. LangSmith, Braintrust, Arize,
Galileo, Maxim, and others are building full evaluation platforms
around trajectory-based analysis, LLM-as-judge scoring with
statistical validation, and regression testing against production
failures.
Here’s the signal that the category is real: LangChain’s 2026 State of AI Agents report found that 57% of organizations now have agents in production, and 32% cite quality as the top deployment barrier. Gartner projects that 60% of software engineering teams will adopt AI evaluation and observability platforms by 2028, up from 18% in 2025. When a category jumps from 18% to 60% adoption in three years, that’s not a “we can build this in a sprint” situation.
You can’t tell whether your evaluation is working without another evaluation. Judge drift, calibration against human experts, internal consistency across independent runs. . .your eval system needs its own eval system, which is exactly the kind of recursion that eats platform teams alive.
Orchestration
The orchestration layer hasn’t converged. LangGraph uses directed graphs with conditional edges. CrewAI uses role-based crews. OpenAI’s Agents SDK uses explicit handoffs. AutoGen uses conversational GroupChat. Google ADK uses hierarchical agent trees. Claude’s Agent SDK uses tool-use chains with subagents. Microsoft’s Agent Framework is its own thing. Each represents a different bet on state management, communication pattern, and coordination model. None of them are interchangeable. Migration between them isn’t a config change—it’s rewriting most of your agent logic.
Underneath them, the protocol layer is still being invented. The Model Context Protocol is becoming the standard for tool integration, and agent-to-agent (A2A) protocols are emerging for cross-framework coordination. Both are moving targets, and building on a moving protocol is a cost that internal platform teams rarely price in.
If you built your own orchestration layer in 2024, you’re rewriting it in 2026. The teams that picked a framework spent those two years shipping.
The honest case for building
I want to engage the strongest version of the build argument, because there are real reasons to build, and pretending otherwise makes this piece less useful than it should be.
Proprietary data genuinely is a durable competitive moat. Mastercard built a foundation model on its transaction network. Plaid built one on its financial institution coverage. As Morgan Stanley’s analysis from last year made clear, decades of verified historical data with consistent identifiers is both technically challenging and prohibitively expensive for outside players to recreate. If your organization has data like that, you should absolutely build on it.
Regulated industries have legitimate reasons to want control over the full stack. Off-the-shelf AI tools don’t always cleanly map to frameworks like HIPAA, GxP, 21 CFR Part 11, SOX, FFIEC, and PCI DSS, and the cost of a failed audit is measured in business units shut down, not in sprints.
Vendor lock-in at the AI layer is subtler and more dangerous than in traditional software. If your agentic workflows are built on a vendor’s proprietary orchestration layer, switching costs compound rapidly across memory, eval, and integrations simultaneously.
But here’s the distinction that matters: Those are arguments for building agents on top of platform components, not arguments for building the platform components themselves. You can own the data, the domain logic, the evaluation criteria, the governance policies, and the specific behaviors your business needs without owning the memory layer, the orchestration engine, or the trace collection infrastructure underneath them.
Build the things that are specific to your business. Buy the things that are specific to the technology category. That’s the heuristic.
Five questions before you commit
If you’re the platform engineer being pulled into this decision, here are the questions worth asking before anyone signs up for the scope.
Are you building an agent platform or a workflow system? They’re not the same scope, and conflating them is where most of the cost overruns originate. A workflow system is a reasonable thing to build. An agent platform is four product categories you haven’t staffed for.
Can you articulate what “done” looks like for each of the four components? Memory, governance, eval, orchestration. In under three sentences each. If you can’t, you don’t have requirements. You have a vibe. And vibes don’t ship.
What happens to your platform when you need to swap the underlying model? Menlo’s December 2025 data shows Anthropic went from 12% of enterprise LLM spend in 2023 to 40% in 2025, while OpenAI fell from 50% to 27%. Enterprises didn’t plan those switches. The capability gaps forced them. If your internal platform hardcoded assumptions about context windows, tool-calling formats, or reasoning styles from one vendor, swapping models isn’t an API key change. It’s simultaneous rewrites across memory, eval, and orchestration.
What happens when the techniques themselves change? Eighteen months ago the default pattern was RAG with flat vector retrieval. Now it’s just-in-time context strategies, agent-managed memory tiers, and trajectory-based evaluation. Anthropic’s own follow-up to “Building Effective Agents” explicitly acknowledges the field has moved since they wrote the original. If your platform baked in the 2024 patterns, the 2026 patterns are a refactor, not a config change. Vendor platforms absorb those shifts as releases. Internal platforms absorb them as sprints.
What happens when the platform team leaves? This is the tale as old as COBOL, custom ESBs in 2008, or hand-rolled container orchestration in 2015. A small team builds something clever, it works, they move on, and five years later you’re paying premium rates to contractors who can still read the code. Agent platforms are a particularly bad candidate for this pattern because the talent pool is both small and mobile. Here’s the uncomfortable version of the question: Who on your team, today, could rebuild the memory layer if the person who wrote it left tomorrow?
What this looks like in 2 years
Gartner’s prediction that over 40% of agentic AI projects will be canceled by 2027 isn’t really about the AI. It’s about projects that got scoped before anyone understood the shape of the work. Most of the canceled projects will be internal builds, because internal builds are where the scope estimation error accumulates. Deloitte’s data on two- to four-year AI ROI horizons is the warning shot. If your timeline to value is already long, every month you spend rebuilding a component that exists as a product is a month you don’t have.
The teams that built their platforms around OpenAI in 2023 weren’t wrong. They made a reasonable bet on the market leader at the time. But they spent 2025 porting to a landscape where Anthropic had tripled share and Google had gone from 7% to 21%. The teams that picked model-agnostic platforms spent 2025 shipping. The only durable bet in this space is the one that assumes the bet will change.
The best platform engineering decision you can make this quarter might be to not build the platform.
Sources
Primary sources
- Menlo Ventures, 2025: The State of Generative AI in the
Enterprise, December 2025,
https://menlovc.com/perspective/2025-the-state-of-generative-ai-in-the-enterprise/. - Anthropic, “Building Effective Agents,” December
2024,
https://www.anthropic.com/research/building-effective-agents. - Anthropic, “Effective Context Engineering for AI
Agents,” 2025,
https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents. - European Commission, AI Act Regulatory Framework (Regulation EU
2024/1689),
https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai. - Google Cloud, “Evaluate Gen AI Agents,” Vertex AI
Documentation,
https://cloud.google.com/vertex-ai/generative-ai/docs/models/evaluation-agents. - McKinsey QuantumBlack, “Evaluations for the Agentic
World,”
https://medium.com/quantumblack/evaluations-for-the-agentic-world-c3c150f0dd5a. - LangChain, State of Agent Engineering 2026,
https://www.langchain.com/state-of-agent-engineering. - Gartner, “Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027,” June 2025, https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027.
- Grant Thornton, 2026 AI Impact Survey, April 2026,
https://www.grantthornton.com/services/advisory-services/artificial-intelligence/2026-ai-impact-survey.
Secondary Sources
- Mem0, “Mem0 Raises $24M to Build the Memory Layer for
AI,” October 2025,
https://mem0.ai/series-a. - Felicis, “Felicis’s Seed in Letta,” September
2024,
https://www.felicis.com/blog/letta. - Vectorize.io, “Mem0 vs Zep,” Benchmark
Comparison,
https://vectorize.io/articles/mem0-vs-zep. - Rasmussen et al., “Zep: A Temporal Knowledge Graph
Architecture for Agent Memory,” arXiv 2501.13956,
https://arxiv.org/abs/2501.13956. - OWASP, “LLM08:2025 Excessive Agency,” OWASP Top 10
for LLM Applications,
https://genai.owasp.org/llmrisk/llm08-excessive-agency/. - Greshake et al., “Not What You’ve Signed Up For:
Compromising Real-World LLM-Integrated Applications with Indirect
Prompt Injection,” arXiv 2302.12173, February 2023,
https://arxiv.org/abs/2302.12173. - Model Context Protocol, Official Specification,
https://modelcontextprotocol.io. - PYMNTS, “FinTechs Race to Build Foundation Models on
Proprietary Data,” 2026,
https://www.pymnts.com/artificial-intelligence-2/2026/fintechs-race-to-build-foundation-models-on-proprietary-data/. - Deloitte, “State of Generative AI in the
Enterprise,” Quarterly Reports,
https://www.deloitte.com/us/en/insights/topics/digital-transformation/state-of-generative-ai-in-enterprise.html.
15:21
[$] Some buffer-heads cleanup work [LWN.net]
Jan Kara has been working on cleaning up how buffer heads are used by some kernel filesystems. In a short filesystem-track session at the 2026 Linux Storage, Filesystem, Memory Management, and BPF Summit, he gave an update on that work and where it is headed. Topics included generic infrastructure to track buffer heads for metadata, a buffer-head cleanup for the Amiga filesystem, and some planned locking fixes.
14:35
FairScan 2.0 released [LWN.net]
Version 2.0 of the FairScan document-scanning app for Android has been released. The headline feature for this release is the addition of optical-character-recognition (OCR) support using Tesseract to produce PDFs with searchable text from scans. FairScan developer Pierre-Yves Nicolas has written a detailed blog about adding the feature and explaining why it had not been added previously.
That looks nice, so why didn't FairScan have it before? That's because FairScan wasn't ready for it: I wouldn't be comfortable if FairScan was giving you wrong text half of the time. To get good results from an OCR engine, you need to provide it a readable image. If it's hard to read for a human, it's certainly also hard to read for an OCR engine.
Over the past year, I worked on different parts of FairScan's automatic processing to transform photos of documents into PDFs that are easy for humans to read:
- document detection
- perspective correction
- shadow reduction
- brightness and contrast enhancement
All this work on image processing helped FairScan produce clean PDFs and can now also contribute to making text recognition effective.
FairScan is available via Google Play or F-Droid.
Security updates for Wednesday [LWN.net]
Security updates have been issued by AlmaLinux (hplip, kernel, kernel-rt, libpng12, libpng15, libxml2, libxslt, mysql:8.0, mysql:8.4, opencryptoki, openssl, postfix, postgresql:15, rsync, and webkit2gtk3), Debian (asterisk, atril, gsasl, and libreoffice), Fedora (ack, bird, chromium, firefox, ldns, librabbitmq, nextcloud, nss, openslide, perl-Protocol-HTTP2, tig, vorbis-tools, and xen), Mageia (coturn, log4cxx, and python-tornado), SUSE (389-ds, buildah, container-suseconnect, distribution, editorconfig-core-c, elemental-system-agent, glib-networking, google-guest-agent, google-osconfig-agent, kernel, libcaca, libXpm, opensc, openssl-3, openvswitch, perl-Crypt-PBKDF2, python-python-dotenv, python311-aiosmtplib, python311-zeroconf, runc, shim, and sqlite3), and Ubuntu (ca-certificates, keystone, librabbitmq, linux, linux-aws, linux-kvm, linux-aws-hwe, linux-azure, linux-gcp, linux-hwe, linux-oracle, linux-azure, linux-azure, linux-gcp, linux-hwe, linux-oracle, linux-azure-6.8, linux-oracle-5.15, nova, openimageio, qemu, and squid).
14:07
CodeSOD: Weekly Calculated [The Daily WTF]
There's a language out there called "Progress Advanced Business Language" (or "Open Edge Advanced Business Language"). Just hearing that string of words in a sequence tells you you're in for it. It's a verbose, "English-like" programming language. But we're not here to pick on the language.
A long time ago, Mirjam had the "pleasure" of working in a Progress ABL environment. At some point, one of the developers had needed to find a date six months prior to the current date. It didn't need to be accurate, and thus said developer littered the code with comments reminding everyone that it didn't need to be that accurate. They arguably spent more time defending the choice to be inaccurate than it would have taken to write code that would have been accurate.
Mirjam doesn't have the code anymore, so what we have here is a mix of her remembered pseudocode, Progress syntax, and my attempts to clarify all of it. Let's not worry too much about the language, and instead focus on the logic:
ASSIGN v-date = TODAY.
/* Calculates the current week/year */
RUN week.p(INPUT v-date, OUTPUT v-weeknumber, OUTPUT v-year).
IF v-weeknumber > 26 THEN
ASSIGN v-weeknumber = v-weeknumber - 26.
ELSE
ASSIGN v-weeknumber = 52 - 26 - v-weeknumber
v-year = v-year - 1.
/* Turn the result of that calculation back into a date */
RUN week2.p(INPUT v-weeknumber, INPUT v-year, OUTPUT v-resultdate).
This code gets the current date. It then breaks that into week
number of the date (1-52), and the year of the date. Then, if the
week number is greater than 26, it subtracts 26 from it, giving us
a date half a year ago, ish. If the current weak number is less
than or equal to 26, we do 52 - 26 - v-weeknumber, and
decrement the year. Which yes, is a fairly round about way to
handle the rollover- 52 - 26 happens to be…
26.
It's worth noting, that as primitive looking as this syntax is,
Progress ABL does have an ADD_INTERVAL function, which
lets you do date arithmetic, without all this nonsense. In fact,
Mirjam went ahead and replaced all of this with a single line.
That said, as a little bonus WTF, Progress does have some weird date quirks, for example, you can construct a date from an integer. Which has a very unsurprising (but also, weirdly surprising) range of possible values:
The value of the expression cannot be a date value before 12/31/-32768 or after 12/31/32767.
At least that covers a range that includes both the discovery of agriculture and the eventual rediscovery of agriculture after the event that enters into legend as "The Fall".
[Advertisement] Keep all your packages and Docker containers in one
place, scan for vulnerabilities, and control who can access
different feeds. ProGet installs in minutes and has a powerful free
version with a lot of great features that you can upgrade when
ready.Learn
more.13:07
CSSC-1.5.0-rc3 is released [Planet GNU]
This is to announce CSSC-1.5.0-rc3, a beta release.
This is a release candidate for a future stable 1.5.0 release.
There have been 46 commits by 2 people in the 109 weeks since
CSSC-1.5.0-rc2.
See the NEWS below for a brief summary.
Thanks to everyone who has contributed!
The following people contributed changes to this release:
Greg A. Woods (1)
Paul Bryce (2)
James Youngman (43)
James
==================================================================
Here is the GNU CSSC home page:
https://gn ...
rg/s/CSSC/
Here are the compressed sources and a GPG detached signature:
https://alpha.gnu
... -1.5.0-rc3.tar.gz
https://alpha.gnu
... .0-rc3.tar.gz.sig
Use a mirror for higher download bandwidth:
https://www.gnu.o ...
rg/order/ftp.html
Here are the SHA256 and SHA3-256 checksums:
File: CSSC-1.5.0-rc3.tar.gz
SHA256 sum:
a78bc23062b11c33a858acd8a08c173ea2957f763f5b7ddb2990c0fee7c71cec
SHA3-256 sum:
20733dd3c517c1bb44c67088b1a208ebf00e1eab4ab21e806bd963869faf918a
Verify the SHA256 checksum with either sha256sum, sha256, or
'shasum -a 256'.
Verify the SHA3-256 checksum with 'cksum -a sha3 -l 256
--base64'
from coreutils-9.8.
Use a .sig file to verify that the corresponding file (without
the
.sig suffix) is intact. First, be sure to download both the
.sig file
and the corresponding tarball. Then, run a command like
this:
gpg --verify CSSC-1.5.0-rc3.tar.gz.sig
The signature should match the fingerprint of the following
key:
pub rsa4096 2015-12-24 [SC]
0CF4 E8D8 7159 3224
8428 32B8 88DD 9E08 C5DD ACB9
uid James Youngman
<james@youngman.org>
uid James Youngman <jay@gnu.org>
If that command fails because you don't have the required public
key,
or that public key has expired, try the following commands to
retrieve
or refresh it, and then rerun the 'gpg --verify' command.
gpg --locate-external-key james@youngman.org
gpg --recv-keys 88DD9E08C5DDACB9
wget -q -O- 'https://savannah.
... SC&download=1' | gpg --import -
As a last resort to find the key, you can try the official GNU
keyring:
wget -q https://ftp.gnu.o ...
u/gnu-keyring.gpg
gpg --keyring gnu-keyring.gpg --verify
CSSC-1.5.0-rc3.tar.gz.sig
This release is based on the CSSC git repository, available as
git clone https://https.git
... .org/git/CSSC.git
with commit 26add75e45f79cd493409ee2f0c2646849314aad tagged as
v1.5.0-rc3.
For a summary of changes and contributors, see:
https://gitweb.gi ... tlog;h=v1.5.0-rc3
or run this command from a git-cloned CSSC directory:
git shortlog
43b5b054701732df7ce24eb59821010c39c60cb6..v1.5.0-rc3
This release was bootstrapped with the following tools:
Autoconf 2.72
Automake 1.17
Gnulib 2026-06-08
88592a2880cf39a2f597cd0294a90d8dd7faa2df
NEWS
- Noteworthy changes in release 1.5.0-rc3 (2026-06-14)
* Some typos in error
message have been fixed.
* admin now supports
combination of -r with -n as well as the
portable
combination of -r with -i.
* Support "sccs sact";
the sact program already existed but
could not previously be invoked via the sccs wrapper.
Thanks to Greg A. Woods for this improvement.
* In some places we now
prefer "grep -E" to "egrep" in order
to avoid a
warning message from GNU grep. Some very old
versions of
Unix may not support this option.
* Various C++
portability improvements.
- Updated version of gnulib.
- Updated version of googletest; this is now at the last
version
at which it still supported building with Automake.
13:00
Issue 46 – Greta’s Wedding – 10 [Comics Archive - Spinnyverse]
The post Issue 46 – Greta’s Wedding – 10 appeared first on Spinnyverse.
12:14
AI Use by the US Government [Schneier on Security]
On 14 April, the Trump administration quietly acknowledged the widespread use of AI to automate government processes. The office of management and budget (OMB) disclosed a staggering 3,611 active or planned use cases for AI across the federal government. The list has ballooned by 70% from the one published in the final year of the Biden administration, and includes many disturbing-seeming plans to hand over sensitive governmental functions to AI.
Scanning this list, many readers may find many causes for alarm. It represents a transfer of decision processes from human to machine on a massive scale over matters of individual freedom, public health and well-being, nuclear reactor safety and more.
Consider these examples. The Health and Human Services’ (HHS) office of administration for children and families hired the world’s “scariest AI company,” Palantir—notorious for its work on behalf of the military, the CIA and ICE—to scan all grant applications to flag those not ideologically aligned with the administration’s dictates. The Federal Bureau of Prisons is developing an AI system to assess the “potential for misconduct for newly admitted inmates,” routing people into high-security confinement before they have actually done anything wrong in their custody. These read like programs fit for a Philip K Dick or George Orwell novel.
Other use cases insert AI into life-and-death decision making. The Department of Veterans Affairs is developing an AI that will listen in on calls to the veterans crisis line, and then gather information from external databases to assess the mental state and suicide risk of the caller.
The Department of Energy is testing the use of AI to control nuclear reactors, targeting a way to autonomously respond to potential nuclear safety incidents. Here’s one that’s disturbing for its retirement, rather than its deployment: the state department has ended a program to use AI to forecast mass civilian killings, which had been intended to aid conflict prevention.
While it’s easy to raise questions about these and similar uses of AI, the reality is that any of these programs could be implemented responsibly. In some cases, like the HHS system, the AI might be enforcing alignment to a policy prescription that opponents abhor. But that concern is more about the policy itself rather than the idea that agencies should comply with executive orders.
In other cases, there may even be bipartisan agreement on the goal, like taking urgent action to help veterans at risk of self-harm. Lots of work and validation is needed to prove AI safe and effective for these use cases and convince the public it is appropriate, but the idea is plausible.
In other cases, a scary-sounding AI use may not even be new. The use of predictive methods and statistics to assign prisoner security classifications goes back decades, even if such systems are often biased and ineffective.
Using autonomous systems for model predictive control (MPC) of nuclear reactors is a well studied, and a widely applied aspect of nuclear plant management. And the recently disclosed addition of AI was initiated under the Biden administration.
But anyone reviewing the 2025 inventory could be forgiven for leaping to severe conclusions. What matters are the details of how the AI system is used, and here the inventory is severely lacking.
The disclosures carry minimal information, and lack the context necessary to understand their purpose and approach. The descriptions are typically just a sentence, and rarely more than a paragraph.
And while the process theoretically involves some form of public consultation, in reality there is generally none. It would take an eagle-eyed citizen to even come across this disclosure. Unless you read FedScoop regularly, or watch the OMB’s federal chief information officer’s GitHub account, you probably missed it.
Only one of the examples cited above (the DoJ) even proposes to involve the public. Under the administration’s policy, it’s not required for the rest because they are not classified as “high impact” use cases—a label that is applied inconsistently across agencies.
We wrote a book surveying applications of AI to democratic processes worldwide, including executive agencies as well as the courts, legislatures and politics. Our conclusion was that, while there are inappropriate applications of AI in governance that should be resisted, an urgent need to reform the economics of AI, and an imperative for renovating the democratic systems it is being unleashed on, there are also valuable and beneficial use cases for AI in government.
Machine translation is a good example. Customs and Border Protection (CBP) has deployed an AI translation system to help officers when human interpreters are not available. The idea that CBP, an agency under heavy scrutiny for reported abuses of human rights, would direct people to talk to a machine instead of a person may strike many as inhumane.
It’s true that human interpreters have very real advantages when it comes to understanding nuance from physical cues and social context. But an officer with a competent AI translator available immediately is better than one who cannot communicate with the person in front of them.
The Trump administration’s AI use case inventory has 70 such translation use cases, up from 58 in the Biden administration’s 2024 disclosure.
Disclosure of AI use cases could be a means to build public confidence and trust, but only if paired with consistent, meaningful public consultation. Washington DC and California are actively engaging the public to determine where and how it’s appropriate to use AI in government processes, or for government to regulate AI use in society.
Both have held public deliberations on this topic at a wide scale, using AI platforms. These examples demonstrate the potential for capturing broad-based public input to steer AI policy.
The international gold standard was arguably set by the French in 2016, via their Digital Republic Act. The law, itself informed by an online citizen consultation, requires all algorithms used to automate government administrative decisions to be subject to public records requests, to be appealable to a human reviewer, and to have mandatory notification of the use of automation to those affected by the decisions.
Canada offers another example of what more rigorous and participatory disclosure might look like. In 2025, they launched an AI use case registry, not unlike the US inventory. However, Canada also has a federal directive mandating a transparent risk-scoring and impact assessment process for automated systems that make administrative decisions about citizens.
That longstanding directive requires a detailed explanation of risks and benefits as well as consultation with certain stakeholders from the conception of the AI use case. The Canadian system could be improved; it could require a public comment period and an obligation for agencies to respond substantively to feedback before engaging in sensitive uses of AI.
AI offers real potential to improve the efficacy, efficiency and accessibility of government. But, equally, there is legitimate reason for public concern and distrust that can only be addressed through transparency and dialog. The US should adopt, at the federal and state level, algorithmic impact risk assessment procedures and public comment processes to facilitate a safe, trusted, equitable transformation of government agencies to take advantage of modern technology.
This essay was written with Nathan E. Sanders, and originally appeared in The Guardian.
10:49
It’s pretty astonishing how far people will go to announce various forms of status:
- College logo sweatshirts
- Flat abs
- A good haircut
- Glowing skin
- A well-trimmed front lawn
- The zip code where we choose to live
- Having a nice car
- Not having a car at all
- The type of email service we use
- Our accent or lack of one
- The sticker on a hat
- The gaunt look of a serious runner
- The puffy look of someone who never runs
- The foods we eat
- The foods we choose not to eat
- Where we sit at a meeting
- Reading the book before the movie
- The breed of dog we adopt
- Being too busy to respond quickly
- Responding to emails instantly
- The stroller for our baby
- Having a baby
- Not having a baby
- Deciding what’s on the list
- The NPR tote bag
- Talking about the latest tech
- Using the latest tech
- Seeing a movie on opening night
- Holding the door open for someone
- Having the door held open for you
- Being recognized as a regular at a restaurant
- Having a bodyguard
- Being on a list
- Social media statistics
- Knowing about wine, or chocolate, or Roman history
The list has little to do with money spent or money in the bank.
Humans care about status and affiliation. We’ve spent our lives being very good at noticing both.
08:28
New Comic: Dark Arisen
05:35
Girl Genius for Wednesday, June 17, 2026 [Girl Genius]
The Girl Genius comic for Wednesday, June 17, 2026 has been posted.
04:28
Retrofitting the WM_COPYDATA message onto Windows 3.1 [The Old New Thing]
Some time ago, I talked about
how to return results back from the WM_COPYDATA
message. Which reminded me of a clever bit of history.
The WM_COPYDATA message was introduced in
32-bit Windows. There was no need for it in 16-bit Windows because
all 16-bit programs ran in the same address space. A far pointer in
one process was good in any process. You could put it in the
lParam of a window message and send it to any other
window, same process or different process, doesn’t matter.
But 32-bit programs ran in separate address spaces, so this trick
didn’t work. Hence the need for
WM_COPYDATA to pass data not only between 32-bit
programs, but also between 32-bit programs and 16-bit programs.
How did this message get retrofitted into 16-bit Windows so that Win32s could support it?
Easy: It was already implemented, unwittingly.
If the source and destination windows are both 16-bit windows,
then the pointer to the COPYDATASTRUCT is
already valid in both processes, as is the pointer inside the
COPYDATASTRUCT. And the window handle in
the wParam is also the same for both processes.
Therefore, doing absolutely nothing with the wParam
and lParam and simply allowing it to pass from a
16-bit program to another 16-bit program will still behave as
expected.
And it so happens that Windows 3.1 already did that: Windows 3.1
always passed the wParam and lParam
unmodified, even when the message sender and receiver are in
different processes, because all programs shared the same address
space.
It was just a sneaky trick to design the
WM_COPYDATA message in such a way that the null
marshaler is the correct behavior when it is sent between 16-bit
programs.
The post Retrofitting the <CODE>WM_<WBR>COPYDATA</CODE> message onto Windows 3.1 appeared first on The Old New Thing.
02:07
Dirk Eddelbuettel: rspdlite 0.1.0-1 on CRAN: New Package! [Planet Debian]
Very happy to share that a new package rspdlite arrived on CRAN today in its inaugural version 0.1.0-1. It wraps and provides the (header-only) C++20 library spdlite which its author describes (aptly) as tiny, fast, capable. Just like its bigger sibbling spdlog (which we wrapped as rcppspdlog), it is written by Gabi Melman. However, with a focus on C++20 and compile-time configuration, it is lighter, nimbler and faster. It is also still a fairly young project so changes may occur.
I have been working on this for about a month, and it is ready for use by R and C++. It contains the initial upstream release 0.1.0, and I plan to follow the upstream versioning making this first release as 0.1.0-1.
The package itself provides the headers for use from other C++ projects (i.e. mostly other packages), as well as a simple R wrapper so that logging can occur from either C++ or R. It will generally access the single logger instance in a compilation unit. So for a package built against these header it would be shared library of that package. At present we provide the basic logging level setters and getters, formatting accessors, and two (compile-time) options of a ‘null logger’ and a file-based logger. More options are availble from the C++ level, multiple logging sinks are but one example. Some examples are provided in the package as an R example and a C++ example; these are probably best examined from the sources.
The NEWS entry for this release is simply and just announces that we have a release. More details are in the ChangeLog and the GitHub repo.
Changes in version 0.1.0-1 (2025-06-08)
- Initial complete version and CRAN upload
This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. If you like this or other open-source work I do, you can sponsor me at GitHub. You can also sponsor my Tour de Shore 2026 ride in support of the Maywood Fine Arts Center.
00:28
Urgent: Call media to cover FBI election raids [Richard Stallman's Political Notes]
US citizens: call on CNN, NBC and the New York Times to cover the FBI's election intimidation raids.
Urgent: Ban surveillance pricing [Richard Stallman's Political Notes]
US citizens: call on your state's governor to protect consumers and ban surveillance pricing.
Urgent: Restore screwworm control funding [Richard Stallman's Political Notes]
US citizens: call on your congresscritter and senators to restore screwworm control funding.
See the instructions for how to sign this letter campaign without running any nonfree JavaScript code--not trivial, but not hard.
US citizens: Join with this campaign to address this issue.
To phone your congresscritter about this, the main switchboard is +1-202-224-3121.
Please spread the word.
00:00
I wrote a short post yesterday about AI as an alien species. Steve Mays breaks it down into parts, and got every bit right. This is the kind of back and forth that the web is capable of. Update: It's even worse than it appears. Turns out the excellent analysis was written by Perplexity, one of the artificial aliens. Reminds me of a speech by Robin Williams in Good Will Hunting. In case it's not obvious, Williams is talking about artificial aliens.
Tuesday, 16 June
23:35
The Big Idea: Alethea Kontis [Whatever]
Not all books fit the mold of the genre they’re in. For Alethea Kontis, she wanted to write romance without the explicit parts, wanted to write a YA book that wasn’t dumbed down for kids with no attention span and no literacy skills. Well, she did it, and she did it her way, in her newest novel, Thieftess.
ALETHEA KONTIS:
This post is for the smart kids. The rebels. My fellow goonies.
This essay marks my FIFTH time as a guest on The Big Idea—I am now a proud member of the Whatever Five-Timers Club! Please remind me to make sure John and Athena mail me my membership card.
The last time I was featured on Whatever was in 2017. The Before Times. An Age of Innocence. Social media was less commercial, Gen AI was a dream of the future, and the CDC’s playbook was positive the next great pandemic would be influenza. I went to conventions back then. I knew what K-pop was, but I didn’t know K-dramas existed. I didn’t speak any Korean, Portuguese, Croatian, or Arabic. I had never been to Asia or Africa. Storm chasers were other people, and the topic of a movie I loved once upon a time.
Back then, I wrote books that were publishable.
I joke because it’s both horrible and true. My books are too long. Too clever. Too smart. Too subtle. Too bloody. Set in the wrong time period. Set in a country where I wasn’t born. Contain protagonists who are the wrong age. Contain far too many difficult/archaic/polysyllabic words. Contain too many complicated characters from too many different cultural backgrounds.
In the current capitalist climate, picture books need to have TENSION. Romances needs to have SEX. Middle grade novels need to be FAST PACED and also SUPER SHORT because no one has an attention span anymore and 10-year-olds are intimidated by thick books. Plus, thick books are expensive. And for the love of all that is holy, do NOT write any more Young Adult Fantasy. Ever.
I cried after the call where my agent told me that last one.
She’s not my agent anymore.
Honestly, it’s a miracle I was even traditionally published in the first place. A handful of excellent people had the privilege of being able to take a chance on me, and for that I will be forever grateful. These days, no one can afford to take a risk. I get it.
But I can’t afford to stop writing. So I didn’t.
In late October 2023, I got the rights back to the Woodcutter Sisters books. The series of my heart. You remember them: they read like a mashup of The Princess Bride and a non-Disney Once Upon a Time. Yeah. The YA Fantasy ones. Got awards and stuff. There were seven Woodcutter sisters, all named after the days of the week. I got to write Sun-Fri. Harcourt orphaned me before I could tell the Pirate Queen sister’s tale. My working title was Thieftess.
Thieftess has a listing on Goodreads. As of this writing, there are 2 reviews. The first laments the news of my publisher dropping the series. The second was posted by someone so excited to announce that the series would be returning that THEY WROTE IN ALL CAPS. Both of these entries delight me to no end.
Freedom is a beautiful thing. I consciously took advantage of mine this past decade. I lived, defiantly. I chased storms, learned other languages, traveled the world, and made hundreds of new friends all over that world. And I quietly, constantly, kept writing in the background.
In a way, my series being released from my trad publisher was a mercy. I wasn’t sure the committee would let me get away with all the things I wanted to do in the rest of the books anyway. And when it came time to finish writing Thieftess—eleven years after I started it—I embraced my tiny rebellions.
In nutshell, Thieftess:
- is a YA-Appropriate Romantic Pirate Adventure Fantasy
- is far too optimistic
- is too long (for a traditional YA)
- has too many characters
- has too many chapters (it reads like a web novel)
- switches POV without announcing who is speaking instead of a chapter title
- has chapter titles
- has maps
- features pirates who get drunk, die, kiss, kill, and steal, but there’s still no sex
- stars a female protagonist in her late 20s (but so was Alanna of Trebond, eventually)
The book also contains a million Easter eggs, but so did Enchanted. Heck, so did AlphaOops. That’s a very on-brand Alethea thing. But the rest is my rebellion.
Here in 2026, joy itself is a rebellion. Kindness is a rebellion. Naps are a rebellion. Poetry is a rebellion. Smart books that trust their readers are a rebellion. Reading prologues and epilogues is a rebellion. Writing in cursive is a rebellion. Writing your own emails is a rebellion. Leaving your phone in the other room is a rebellion. Going outside is a rebellion. Speaking more than one language is a rebellion. Quoting Shakespeare is a rebellion. Imperfection is a rebellion. Daring to fail over and over again is a rebellion.
Finishing this absolutely gorgeous book that took me eleven years to write—and then releasing it into the world—is my rebellion.
When I originally took @princessalethea as my screen name on LiveJournal (remember LiveJournal?) it was because my role model was the feisty leader of another particularly infamous rebel alliance. I mean to carry on in that same fine tradition.
And now if you’ll excuse me, I’m going to go write a book with a bunch of sex in it. Because I’m still broke.
Love you, Squad.
xox
Princess Alethea
PS: Goonies Never Say Die
Thieftess: Amazon
21:28
KDE Plasma 6.7 released [OSnews]
The KDE team released KDE Plasma 6.7 today, and with it comes a long list of improvements, new features, bug fixes, new old themes, and so much more. A new feature that is sure to please those among us who use virtual desktops: you can now have different virtual desktop setups per display. It’s been a long-requested feature, so it’s great to see it makes its way to the KDE users. I despise virtual desktops, but I’m happy to see something that I assumed was already part of KDE to finally actually become available.
Another major feature in KDE Plasma 6.7 is something we’ve already talked about: the return of the classic Oxygen and Air themes from the KDE 4.x days. These themes have seen extensive work over the past year or so to make them usable on the latest KDE release, which includes tons of bug fixes, visual nips and tucks, and countless additions to the collection of assets required to make a modern KDE theme look complete. This includes a ton of new icons in the old styles, light and dark modes, accent colour support, and much more. There’s still work left here, including adding support for QtQuick/Kirigami applications – which brings us to the next major new addition to KDE 6.7
This is also something we’ve already talked about: Union. I won’t repeat what I already explained last time Union came up, but suffice it to say that Union effectively unifies the various different ways KDE applications are themed, allowing theme designers to use relatively standard CSS to create themes that cover every aspect of the KDE user experience. Before Union, theme designers had to create individual, unique themes for a variety of parts of KDE – the Plasma desktop, QtWidgets using QStyle, QtQuick/Kirigami – which was a ton of work, and in the case of QtQuick/Kirigami, wasn’t really possible at all. As such, without Union, KDE’s theming is essentially broken, and Union fixes that. For now, Union is not enabled by default, and must be installed and enabled separately for testing.
Of course, there’s a ton of other smaller new features, changes, and bug fixes as well. KDE Plasma 6.7 will find its way to your distribution soon enough.
20:56
Jason Calacanis challenges people to develop certain open source software, offering a bounty on specific projects, but I think the real incentive for people to pitch in is that Jason has a lot of sway in the startup world, and if there is a flow of excellent open software this way, users will find out about it because the reach of Jason's podcasts and blogs. I've known him for many years, we both signed up on Twitter on the same day in 2006, early days of the web. He has become one of the most successful angels in tech. I'm proud to have known him way back when.
20:42
After 26 years, today is my last day at EFF. It's been a terrific and wild ride — the organization has grown from a tiny band of fighty people trying to plant a flag for freedom and justice in the coming digital world into a large, established band of fighty people doing, well, much the same. The world around us has changed enormously. Our core values haven't budged.
I'm proud of what we've achieved: freeing encryption, defending coders, pushing to rein in government and corporate surveillance and ensure the right to have a private conversation online, standing up for free speech and anonymous speech, fighting for network neutrality and safe voting machines, busting stupid patents, and making sure copyright didn't become the one law that rules the internet. That's only the start. We've stopped more bad legislative, regulatory, and legal ideas than I can count, built tools that millions rely on to protect their privacy, and helped encrypt the web. I've long said EFF is the plumber of the internet — finding the clogs and barriers that prevent technology from serving freedom, justice, and innovation for everyone.
In addition to presenting cases in courts across the land, testifying in Congress and in California, in the European Parliament and at the United Nations, I went onto the internet with Stephen Colbert and engaged in a healthy disagreement with Jon Stewart. I wrote a lot of it down in a book, hoping to recruit others to the cause. The work has been hard and often frustrating at times. But looking back, the fun parts are what I remember most.
None of it would have been possible without EFF’s stalwart members. More than 30,000 people, some with big wallets and some with small ones, give us what we need to stand up to bullies and fight for the long haul. EFF has always served as a beacon for people who know that for technology to support freedom, justice, and innovation for all the people of the world, we need a dedicated band of folks working overtime on behalf of users, innovators, and creators.
There's still plenty left to do. We haven't killed the third-party doctrine, tamed the surveillance business model, or gotten metadata the constitutional protection it deserves. Stupid patents persist as does the overreach of DMCA section 1201 and the Computer Fraud and Abuse Act. The government is now the largest purchaser of data from shady brokers, communities everywhere are fighting license plate readers and other street-level surveillance, and we haven't reined in NSA and FBI spying nearly enough. Meanwhile, the rise of AI is supercharging problems we've fought against for years.
But I'm proud of what we've built together. I'm grateful to every EFFer — past, present, and future — who threw in with us when the odds were long and the pay was much better elsewhere. I'm grateful to the EFF Board and especially to my mentors and friends Pam Samuelson and Shari Steele, along with my longtime partner in justice, Lee Tien, who has been working with me since the Bernstein case. Fighting for justice is easier when you have a posse: coworkers, co-counsel, coalitions, interns, volunteers, and the heroic clients who trusted us to steward their cases in ways that bent the law toward everyone's benefit. Twenty-six years later, EFF is part of a global diaspora of organizations defending internet freedom — and I'm proud of that too.
I'm stepping down because good leaders should make way for new ones, and the time feels right. EFF is strong and full of fight. My successor Nicole Ozer — a longtime friend and collaborator — is exactly the right person for this moment. She understands EFF's role and values at a deep level and will protect them while helping the organization rise to meet what's coming.
As for me, I'm not going far. After a few months off to reflect and walk dogs, I plan to get back into the fight for justice — likely heading back into the courtroom. And I'll be watching, cheering, donating, and wearing the merch from EFF, just like the rest of you.
19:56
Apple adds keylogger to iOS App Store for targeted advertising: tied to your account and unencrypted [OSnews]
A week or so ago, Apple announced a bunch of features for the App Store on iOS, including personalised recommendations based on your activity and usage of iOS. It turns out this includes a keylogger (taplogger?) in the App Store, which records every single tap you make, every single letter you enter, and a lot of other information. All of this information is unencrypted and sent to Apple.
Now Apple is putting the extensive identifiable analytics they collect in the App Store in action. They record every tap and there’s no way to turn it off.
They can even calculate your typing speed.
↫ Michael Tsai, quoting Mysk
The provided screenshots of the data collected are terrifying, especially because the data is unencrypted, sent to Apple, and fully tied to your user account. Apple clearly wants a slice of that big, juicy advertising pie, and they, too, are discovering that the easiest and best way to serve targeted ads is to collect as much data as they can about you. Of course, this is something the entire internet (but not OSNews!) and several megacorporations are built on by now, but Apple has been incredibly sanctimonious about how it supposedly actually cares about user privacy, making this keylogger yet another case of Apple’s hypocrisy on full display.
Of course, if you care about privacy, you’re entirely free to download your iOS applications from somewhere other than the App Store and install them yours…
Oh, wait.
19:07
The LWN public topics list [LWN.net]
Part of running LWN is keeping a list of potentially interesting topics that may merit the effort to turn into articles. As an experiment, we are now exposing that list to our subscribers at the Project Leader and Supporter levels. The hope is that this list will provide useful insights into what is on our radar and which might be coming to LWN in the near future.
![[Topic list screenshot]](https://lwn.net/images/2026/topiclist.png)
With this feature, we hope to give our most committed subscribers a look behind the curtain and the ability to provide input on the topics they are most interested in reading about. There, is, thus, a simple voting mechanism built into this list. No topic will be chosen (or rejected) solely on the basis of votes; there are a lot of considerations that go into topic selection, and that will not change. But more information about where our readers' interests lie will, hopefully, be helpful.
For all readers: we are always happy to welcome topic suggestions sent to lwn@lwn.net.
The Yard Gets a Facelift [Whatever]
Here at the Scalzi Compound we’ve been having a lot of work done: New garage/barn, new porch railings and entirely new back deck. The good news is all of that work is just about done, with only a couple of small things yet to be done. The bad news is that all the construction trucks, pallets and tractors did a number to parts of our yard, turning its previously relatively smooth surface into a festival of ruts and uneven bits.
This will not do, so Krissy had the landscaping company we use come out, dig out the ruts, regrade and then reseed the lawn. This means that for the next few weeks there’s probably going to be this big brown patch in the yard (which I assume will be covered by straw, etc; I guess I’ll find out by the end of the day), but after that everything will be fine. This is a bit of cosmetic work that’s actually been a few years in the making — parts of the redone area have been uneven for a while now — but it was the ruts left by the construction vehicles that made Krissy decide now was the time.
(Well, that and the fact that, inasmuch as we’re already having so much else done — and have budgeted for it — the additional expense of this can just get rolled into all of that.)
It’ll be nice to walk on that part of the lawn without possibly tripping, and also, inasmuch as this is the last piece of (intended) work at the house for the year, it’ll be nice to not have other people’s trucks and construction vehicles around. I like what we’ve done with the place, to be sure. I’m looking forward to being able to enjoy it.
— JS
17:56
Everyone wants to know things humans can do better than AI systems. One answer — relate with humans. The machines have no clue how our minds work. They act as if we're just like them. They could tell you all about it, from books they read, but they've never related with humans as humans. There's a great speech by Robin Williams in Good Will Hunting, where he explains how reading about something isn't the same as living it.
I'm gorging on NBA podcasts this week. So much fun for a
Knicks user to hear how much-loved the Knicks are. Basketball is an
intimate sport for fans, it's like five consecutive boxing matches.
We get to know the players' personalities, forming an idea of who
they are, watching what they do. The Knicks are like John, Paul,
George, Ringo, Mickey, Davy, Mike, Peter. If you're my age you know
each of those characters, the same way a Knicks fan who watched
this team be assembled one player at a time, and what it cost in
trades. It worked. And there is a big lesson here, working
together works. We should all be doing more of that, with
people who are different from each other as Brunson, Hart, OG,
Mikal Bridges, KAT, Mitchell Robinson and the maestro Leon
Rose. Most people just met them in the last few weeks, but
we've been watching this assemble over six years. One thing the
pundits don't ask, what trades will the Knicks make now? They
will do some trades, right now they can demand a higher
price because every one of the players they trade will have a
ring.
16:49
[$] The state of Fedora in 2026 [LWN.net]
On June 15 at Fedora's Flock conference, held in Prague, Fedora Project Leader (FPL) Jef Spaleta delivered a short "State of Fedora" keynote that provided a bit of insight into the status of the project. Topics included the overall growth for Fedora usage, ways to increase contributions, and an alarming decline in the number of active packagers working on the project.
15:21
Firefox 152.0 released [LWN.net]
Version 152.0 of the Firefox web browser has been released. Notable changes in this release include a brand-new look for the Firefox Settings interface, the ability to disable tracker blocking in private browsing tabs, a feature to mute browser sound from the address bar, experimental support for the JPEG XL image format, and more.
15:14
The time the Windows x86 emulator team found code so bad that they fixed it during emulation [OSnews]
Another story from the good old days from Raymond Chen.
During an exchange of war stories, a colleague of mine told one from back in the days when Windows included a processor emulator for x86-32 on systems that natively ran some other processor. (This has happened many times. And no, I don’t know which processor this particular story applied to.)
↫ Raymond Chen at The Old New Thing
So the core of the story comes down to this:
All in all, it took this program 256 kilobytes of code to initialize 64 kilobytes of data.
↫ Raymond Chen at The Old New Thing
The people working on Windows were so offended by this, they added code to the processor emulator just to fix this program.
FreeBSD 15.1 released [OSnews]
Speaking of FreeBSD, the project released version 15.1 of their operating system today. As it’s a point release, it’s not full of massive changes, but it still brings the LinuxKPI-based wireless drivers up to Linux 7.0, support for the C23 version of the C has progressed considerably, Unicode has bene updated to version 17.0.0 and CLDR 48, and more.
14:35
KDE Plasma 6.7 released [LWN.net]
Version 6.7 of KDE's Plasma desktop has been released. Notable changes in this release include per-screen virtual desktops, faster desktop switching, introduction of the Union theming system as a tech preview, as well as many other improvements and bug fixes. The release is dedicated to Eric Laffoon, a longtime KDE supporter, who passed away in May.
See the KDE wiki for a full list of new features, and the Changelog for a list of all commits in this release.
Security updates for Tuesday [LWN.net]
Security updates have been issued by AlmaLinux (mod_http2, postfix, and webkit2gtk3), Debian (bird2, libgd-perl, and libreoffice), Fedora (7zip, ack, hugo, and perl-Mojo-JWT), Mageia (atril, evince, xreader, emacs, lcms2, libgcrypt, libinput, libsndfile, putty, and sudo), Red Hat (openssl and osbuild-composer), SUSE (cheat, chromedriver, containerized-data-importer, cyrus-imapd, freeipmi, graphicsmagick, java-11-openj9, java-17-openj9, kitty, kubevirt, kubevirt-1.6, libcaca, libopenssl-3-devel, librav1e0_8, neonmodem, opensc, openssh, openssl-1_0_0, openssl-1_1, openssl-3, perl-HTTP-Daemon, perl-XML-LibXML, python-python-dotenv, python311-paramiko, python311-PyJWT, python311-starlette, python311-tornado6, qemu, restic, and trivy), and Ubuntu (adsys, cups, fastnetmon, freerdp2, freerdp3, mesa, nginx, rsync, ruby2.3, ruby2.5, and tmux).
14:28
FreeBSD 15 with KDE and Wayland on a Laptop [OSnews]
Expect to see more and more articles like this one, as more and more people discover that FreeBSD’s desktop/laptop support keeps improving rapidly.
FreeBSD 15 really feels like a breakthrough release.
It’s always been my favorite operating system for servers, but with the arrival of pkgbase, massive improvements to the LinuxKPI drivers, and the launch of the Laptop Support and Usability Project, it’s become my primary desktop, too.
↫ Cullum Smith
Since Smith tried FreeBSD 14.0, there’s now KDE Plasma 6.x, you can leave legacy X11 behind and use Wayland on FreeBSD now, and support for Intel Wi-Fi chips has greatly expanded. Apparently, battery life has improved as well, which is one of the hardest problems to solve for an operating system, especially with the wide variety of hardware combinations in the x86 world.
The rest of Smith’s article is a guide to setting up FreeBSD 15 with KDE and Wayland. It’s quite detailed with a ton of low-level tuning and fiddling, accompanied by clear and concise explanation of what the changes do, which I really like. Definitely a bookmark for anyone who wants to try out FreeBSD with KDE.
14:14
CodeSOD: Required Fields [The Daily WTF]
If you want to connect to another system, you need to supply credentials. That's a pretty obvious requirement. We can set aside the whole technical challenge of managing those credentials and the security problems various techniques create, and just focus in on: you must supply some credentials to authenticate.
Lisa has inherited a method which connects to another system. It, correctly, will complain if you don't supply parameters for credentials. It will, incorrectly, mislead you about their requirement:
public function connect(string $username = "", string $password = ""): void
{
if ($username === "") {
throw new InvalidArgumentException("username is required.");
}
if ($password === "") {
throw new InvalidArgumentException("username is required.");
}
// ... other stuff
}
The $username and $password fields
here are set to default values. Which means it is syntactically
valid to invoke the function connect(). It won't work
if you do that, as it will definitely throw an exception, but this
is a bit of misleading ergonomics. If the parameters are required,
they should probably, I don't know, be required?
What really draws our attention here, however, is not the misuse of default parameters, but the absolute disaster that debugging issues with this function could easily become. If you fail to enter a username, you'll get an exception telling you "username is required". And if you fail to enter a password, you'll also get an error message telling you "username is required".
Which is a factually true statement: username is required. But it's not the cause of my error, which is that I failed to supply the password. Theoretically, though, we could adopt this to make writing exception messages easier. I could make every exception message be "username is required", and it wouldn't be wrong. And clearly, that's what we truly mean when we say "not even wrong".
[Advertisement] Keep all your packages and Docker containers in one
place, scan for vulnerabilities, and control who can access
different feeds. ProGet installs in minutes and has a powerful free
version with a lot of great features that you can upgrade when
ready.Learn
more.13:21
Linear Thinking, Nonlinear Costs [Radar]
Many AI agent systems become economically unsustainable long before they become technically impressive. Teams usually focus on model choice, prompt design, tool calling, and orchestration. Those things matter, but they are only part of the system setup. The deeper issue is that coding agents, such as Claude Code, Codex, and Jules, make agent workflows easier to generate. But when implementation is abstracted away, the underlying mechanics become harder to see. Bad engineering used to produce slow code. Now it produces expensive systems that also happen to be slow.
When we design agent systems, we still need to remember that the costs scale nonlinearly. A single user request rarely triggers a single model call. It expands into routing, retrieval, reasoning, reflection, guardrail checks, tool calls, and synthesis. Each step may repeat shared context, reload state, recompute a planner decision, or retry a failed path. What looks like an intelligent workflow can therefore behave like a recursive, stateful computation with overlapping subproblems. If that sounds like backtracking, dynamic programming, and memoization to you, you’re right.
We already know how to optimize systems like this. The problem is that coding agents make agent systems easier to generate, but not necessarily easier to optimize. Unless we recognize the underlying mechanics, we may never ask our coding agents to apply the optimization patterns that keep our systems viable.
Old problems wearing new clothes
When we use coding agents to generate agent architectures, it’s tempting to stop at “the trace looks reasonable.” The tool can generate routers, retrievers, planners, evaluators, guardrails, tool interfaces, and synthesis steps. It may also know about caching, pruning, memoization, and state modeling. But it won’t necessarily implement those patterns unless you ask for these optimization layers explicitly.
Even if you work with agent instructions, unless your SKILL.md, AGENTS.md, or project instructions include constraints around repeated context, memoization, cache invalidation, pruning, and cost per request, your resulting agent system may be functionally correct and economically wasteful at the same time. That’s the tricky part: The code can pass review, the unit tests can pass, and the architecture can look reasonable. The invoice is where the hidden computation finally shows up.
It’s easy to give too much agency to tools like Claude Code. When a coding agent reasons in language, calls tools, reflects, and produces fluent text or code, it can feel like a knowledgeable coworker. At the interface level, that impression is understandable. These tools help teams generate more code, move faster, and become more productive. Still, this doesn’t remove the need for engineering craft underneath. Someone still has to recognize repeated context, recomputed planner decisions, correlated retries, unpruned branches, and state that can’t be reused. The coding agent can implement the system, but the engineer still has to understand what kind of system should be implemented. This is where old computer science returns, not as theory but as the optimization layer our agent systems need in production.
The cost multiplier, repeated-work problems, and backtracking
The cost multiplier often shows up first as latency. The user doesn’t see the router, the retries, the reflection loop, or the tool calls. They only see that the agent is taking too long. From the outside, the system looks stuck or broken. From the inside, it may simply be repeating work.
This is one of the uncomfortable differences between traditional software and agent systems. In a conventional application, a failed operation often throws an error, times out, or leaves a trace that is easy to inspect. In an agent workflow, failure can look like effort to improve reliability. Take the weakest step in your agent workflow. If it succeeds 60% of the time, and you try to push it close to 99% reliability through retries, you need 5 retries:
1 − (1 − 0.60)5 = 0.98976
This math assumes each retry is a roll of fair dice. LLMs aren’t dice. Whether you’re using greedy decoding or probabilistic sampling, the model is still drawing from the same underlying distribution shaped by your prompt. If the first “thought” is a hallucination or logic error, bumping the temperature won’t fix the underlying state. You aren’t buying independent trials; you’re just sampling different paths through the same flawed map and state.
This is where the old algorithmic framing matters. In a backtracking problem, you don’t keep walking down the same failed branch and call it progress. You return to the last valid state, mark the failed path, and use the failure as information for the next choice. The point isn’t just to try again. The point is to try again under a changed state.
Agent workflows need the same discipline. A retry shouldn’t mean “run it again and hope.” It should give the model structured feedback about why the previous attempt failed: which constraint failed, which tool result was invalid, which schema didn’t validate, which assumption was unsupported, or which branch added nothing. The next attempt should then change something meaningful: the prompt, the tool choice, the retrieved evidence, the validation constraint, or the planner state.
Memoization, pruning, and dynamic programming
Prompt caching is usually the first optimization. If every step repeats the same system prompt, tool definitions, schema constraints, examples, and policy rules, then caching the shared prefix is an obvious win. It reduces the cost of repeated context. But prompt caching only recognizes that text repeats. It doesn’t notice that decisions repeat.
In many agent systems, the expensive unit isn’t only text. It’s the repeated decision. If the same or equivalent state appears again, paying the model to rediscover the same action is unnecessary. That is what memoization does: It turns repeated computation into lookup. In classical algorithms, the repeated computation might be a recursive subproblem. In an agent system, it might be a planner decision over the same task, facts, tools, and constraints. The planner can be treated as a function over state:
πLLM(St)→at+1^πLLM(S_t) \rightarrow a_{t+1}
where StS_t is the current state of the workflow and at+1a_{t+1} is the next action. Without memoization, this function is evaluated again and again through an LLM call. With memoization, the system first checks whether it has seen the same or equivalent state before. If you want a deeper walkthrough of how to use memoization, I cover it in AI Agents: The Definitive Guide.
But memoization only helps once the system knows which states are worth revisiting. Pruning handles the other side of the problem: branches that shouldn’t be explored further. However, don’t limit pruning to KV cache pruning or speculative decoding. Use it also when a tool repeatedly returns no new information. Your next LLM call shouldn’t be a slightly reworded version of the same query. If a reflection loop keeps producing stylistic changes without improving correctness, the loop should stop. If a search path violates a constraint or depends on an unsupported assumption, it should be marked as unproductive and removed from the active search space.
Dynamic programming becomes relevant when different branches of the workflow solve overlapping subproblems. A research agent may ask similar questions across several documents. A coding agent may inspect the same dependency chain from different entry points. A business analysis agent may compute the same metric for several report sections. If every branch solves these subproblems from scratch, the system pays repeatedly for work it has already done. Table 1 shows examples of how these patterns map to AI agent systems.
Table 1. Classical optimization patterns applied to AI agent systems
| Optimization | The “old” CS way | The “agent” way |
| Memoization | Store results of expensive function calls. | Cache decisions. If the agent saw this state before, don’t ask it to reason again. |
| Pruning | Cut off search paths in a tree that won’t lead to a solution. | Kill a reflection loop when the critique stops yielding structural improvements. |
| Dynamic programming | Break problems into overlapping subproblems. | Share codebase analysis across multiple specialized agents instead of rereading files. |
This isn’t nostalgia. These patterns mitigate the cost
structure of agent systems. Memoization reduces repeated decisions.
Pruning reduces repeated failure. Dynamic programming reduces
repeated subproblem solving. Together, they form the optimization
layer many agent architectures are missing in production.
Where to start: Optimization follows topology
The patterns above aren’t a checklist you apply uniformly. Each multi-agent topology, whether centralized, decentralized, independent, or hybrid, distributes communication and coordination differently, which directly affects overhead, latency, and failure propagation. The optimization layer has to follow.
Centralized
A single orchestrator decides, delegates, and aggregates. The expensive unit is the orchestrator’s decision, repeated across similar inputs. Memoize the planner first.Decentralized
Agents coordinate peer-to-peer, exchanging messages without a central authority. The cost moves into the communication itself: redundant exchanges, restated context, agents reasoning over the same shared state from different angles. Prompt caching on the shared context is the first win, followed by pruning exchanges that no longer add information.Independent/swarms
Lightweight agents fan out without coordinating. Cheap individually, expensive in aggregate. If three of your ten agents ask semantically equivalent questions, you pay three times for the same answer. Memoization and pruning aren’t optimizations here; they’re load-bearing.Hybrid
The repeated work shows up at two scales: within a cluster (overlapping subproblems among peers) and across clusters (the coordinator rediscovering the same routing decision). Use dynamic programming on shared subproblems inside the cluster, memoization on the coordinator’s decisions across them.
The optimization layer isn’t a generic discipline you bolt on. It’s a function of the shape of the implementation. Coding agents made it easy to generate the shape without seeing it. The craft is in seeing it anyway.
Who Owns the Code Claude Wrote? [Radar]
The following article originally appeared on Sena Evren’s Legal Layer newsletter and is being reposted here with the author’s permission.
TL; DR
Agentic coding tools like Claude Code, Cursor, and Codex generate code that may be uncopyrightable, owned by your employer, or contaminated by open source licenses you cannot see. Some of this is settled law, some is actively contested, and this piece is clear about which is which. If you are shipping AI-assisted code and have not thought about any of this, this piece is for you.
If you shipped code this week, some of it was probably written by an AI. The question of who legally owns that code is less settled than most developers assume, and the answer depends on three things that have nothing to do with how good the code is:
- Whether a human made enough creative decisions to establish copyright
- Whether your employment contract already assigned it to your employer
- Whether the model pulled from GPL-licensed training data and quietly contaminated your codebase
On March 31, 2026, Anthropic accidentally published 512,000 lines of Claude Code’s source code in a routine software update through a missing configuration file. Before sunrise, the codebase was mirrored across GitHub. Before breakfast, a developer had used an AI tool to rewrite the entire thing in Python, and the “claw-code” repository hit 100,000 GitHub stars in a single day, the fastest in history. Then came the DMCA takedowns, and then came the question nobody had a clean answer to:
If Claude Code was, by Anthropic’s own lead engineer’s admission, predominantly written by Claude itself, does Anthropic even own it? Can you issue a DMCA takedown for code that copyright law may not protect?
That incident compressed every open question about AI-generated code ownership into a single news cycle. The same questions apply to your codebase.
The copyright rule nobody told you
Here is the legal baseline, in plain terms: Copyright only protects work created by a human.
The US Copyright Office has confirmed this consistently, and the DC Circuit upheld it in the Thaler case. When the Supreme Court declined to hear the Thaler appeal in March 2026, it did not endorse the lower court’s reasoning or settle the question nationally. Cert denial means the court chose not to hear the case, nothing more. What it does mean is that the DC Circuit’s ruling stands, the Copyright Office’s position is intact, and no court has yet gone the other way. Works predominantly generated by AI without meaningful human authorship are not eligible for copyright protection under current doctrine, and that position is stable even if it is not finally settled.
Two important limits on what Thaler actually decided.
- The case involved a painting created with zero human involvement at all. Thaler listed the AI system as sole author and made no claim of any human creative contribution. The ruling does not directly address the harder question of AI-assisted work where a human was involved but the degree of that involvement is disputed.
- Thaler involved visual art. No court has yet applied the human authorship doctrine specifically to code output from an AI coding tool. The logic applies, but the direct precedent does not exist yet.
What it means for you: Code that Claude Code or Cursor generated and you accepted without meaningful modification may not be copyrightable by anyone. If a competitor copies it, you may have no legal recourse, because the code sits in the public domain in everything but name.
The phrase that determines whether your code is protected is “meaningful human authorship,” and the Copyright Office has deliberately refused to quantify it with a percentage or a number of edits, because what courts look for is evidence that a human made genuine creative decisions:
- Choosing the architecture
- Deciding what to reject
- Restructuring the output to fit a specific design
Specifying an objective to the model is not enough. Directing how the work is constructed is what counts.
In an agentic workflow, this distinction is harder to establish than it sounds. Consider a typical Claude Code session:
- You write a one-line prompt: “build a rate limiting module for the API.”
- Claude Code plans the approach, generates five files, and iterates through three versions.
- You review the output, run the tests, and merge.
Your contribution in that sequence is your architectural intent and your final approval. Whether that constitutes meaningful human authorship in a courtroom is an unresolved question with no definitive court ruling yet.
The honest answer is: probably yes for modules you substantially redirected, probably no for code you accepted verbatim, and unclear for everything in between.
The middle ground is actively being litigated right now. In Allen v. Perlmutter, artist Jason Allen is challenging the Copyright Office’s denial of registration for a work he created using more than 600 detailed prompts and subsequent editing in Photoshop. The Copyright Office acknowledged the Photoshop edits as human-authored but still denied registration for the AI-generated underlying elements. That case has not been decided yet, and whatever it decides will be the closest thing to a ruling on how much human involvement is enough.
The closest existing precedent on partial protection is Zarya of the Dawn, a graphic novel where the Copyright Office granted registration for the human-authored text but denied it for the Midjourney-generated images. That decision establishes a practical principle developers can use right now: The human-authored elements of an AI-assisted codebase may be separately protectable even if the generated code itself is not. Your architecture documents, your design decisions recorded in commit messages, your ADRs, your prompt logs showing deliberate redirection, these may be protectable as human-authored expression even if the code they produced is not. Protecting what you can starts with documenting what you actually did.
What your employer probably already owns
Before you think about whether your code is copyrightable, there is a more immediate question: Even if it is, is it actually yours?
Your employment contract almost certainly says that anything you build at work belongs to your employer. That principle has a name in copyright law: the work-for-hire doctrine. Under it, any code created by an employee within the scope of their employment is owned by the employer, who is treated as the legal author, regardless of whether the code was written by hand, generated by Claude Code, or some combination. Using an AI coding tool during work hours, on a work project, on a work machine, does not change who owns the result.
Most employment contracts go further than the doctrine’s defaults. Look for a section in yours called “Intellectual Property,” “IP Assignment,” or “Work Product.” Open the contract, search for those terms, and read that section. A clause that says any of the following almost certainly covers your AI-assisted code:
- “Any work product created using company equipment or resources”
- “Any invention or development made during the term of employment”
- “Any software created with the assistance of company-licensed tools”
The third one is the one to watch. If your employer licenses Claude Code, Cursor, or Copilot for the team, and you use those same tools to build a side project, a broad IP assignment clause may give the employer a claim over that project, even if you built it on your own time.
A senior developer in San Francisco described exactly this situation earlier this year. He had used Claude Code for work projects and for a personal fitness tracking app built on evenings and weekends. His company updated its IP policy and claimed everything he had built with AI assistance, including the personal app, arguing that because Claude had access to open work files in the IDE, any AI output was a derivative work of company IP.
This is the clearest example of how far this can stretch. His company’s claim rested on one phrase: The AI tools were “context-aware” of his company’s codebase. The argument does not hold up legally, because context visibility in an IDE does not make AI output a derivative work of files that were open nearby, and the connection between what Claude can see and what it generates is probabilistic pattern completion, not copying. But the argument illustrates what employers are starting to claim. If the clause is broad enough, it has surface validity regardless of what the AI actually did.
The practical rule: If you are building something on the side, use a personal account, a personal machine, and tools you pay for yourself. Keep your employer’s licensed tools out of that workflow entirely.
The open source contamination problem
Even if you own your AI-generated code, you may have already contaminated it with an open source license you cannot see.
AI coding tools are trained on massive amounts of public code, including code licensed under the GPL, LGPL, and other copyleft licenses. Copyleft licenses carry a specific obligation that travels with the code:
- If you distribute software that is a derivative of GPL-licensed code, you must release your own source code under the same license.
- This applies even if you did not know the code you incorporated was GPL-licensed.
- “I did not know” is not a defense to a copyleft violation.
When an AI tool reproduces a substantial verbatim portion of GPL-licensed code from its training data, and you ship that code in a commercial product without releasing source, you may have created a copyleft violation without ever touching the original repository. The legal standard for infringement is substantial verbatim reproduction, not functional similarity or resemblance, and this distinction matters: an AI tool generating code that works like GPL code is different from an AI tool that reproduces GPL code word for word. The risk sits at the verbatim end of that spectrum, and the problem is that you have no way to know which side of the line your codebase is on without running a scan.
The chardet community dispute made this concrete in early 2026. This was not a filed lawsuit but a public dispute within the open source community that raised the question without resolving it legally. A developer used Claude to rewrite chardet, a Python character encoding library, and rereleased it under an MIT license, arguing that the AI rewrite was a “clean room” implementation free of the original LGPL license.
The legal question the community fought over: If Claude was trained on the LGPL-licensed codebase and its output reproduces substantial verbatim portions of that code, can the output be treated as license-free? The chardet dispute did not resolve cleanly and no court has issued a definitive ruling on this specific question. What is settled is that verbatim copying of GPL code violates the license regardless of how it was produced. What is unsettled is whether AI-generated output that reproduces training data patterns counts as verbatim copying. The working assumption among lawyers advising companies through M&A is that it probably does, and that assumption is now showing up as a standard condition in acquisition due diligence.
The Doe v GitHub litigation, still working through the Ninth Circuit as of April 2026, is asking whether GitHub Copilot reproduces licensed code without attribution in violation of copyright law and DMCA Section 1202. The district court dismissed most claims but the appeal is live. Whatever the outcome, the litigation has already changed industry behavior: GitHub Copilot added duplicate detection filters, and acquisition due diligence now routinely includes an AI codebase license scan.
What to do about all of this
Four concrete actions, none of which require a lawyer.
1. Run a license scan on your AI-assisted codebase
Tools that do this well:
- FOSSA—most comprehensive, widely used in enterprise
- Snyk Open Source—good for dev-team workflows, integrates with GitHub
- Black Duck—standard in M&A due diligence
Each will scan your codebase, flag code that matches known open source libraries, and identify the licenses attached. If you are shipping a commercial product and have never run one of these, you are operating on assumption. The scan takes an afternoon and costs less than the first hour of a copyright dispute.
2. Document your human creative contributions as you go
The evidence that establishes meaningful human authorship is the same evidence you already produce in a normal engineering workflow. You just have to keep it deliberately rather than letting it disappear.
What to preserve:
- Commit messages that describe what you changed and why, not just what the AI generated. “Restructured Claude’s module architecture, rejected initial state management approach, rewrote error handling from scratch” is evidence. “Add rate limiting module” is not.
- Prompt logs. Claude Code and Cursor both retain interaction history. Export or screenshot the sessions where you made significant architectural decisions.
- Design documents, ADRs, or any notes that predate the generated code and show you specified the structure before the AI built it.
The second commit message versus the first is the difference between a defensible authorship claim and a clean “Claude wrote this” record.
3. Read the IP clause in your employment contract before you build anything on the side
Open your contract, search for “intellectual property,” “IP assignment,” or “work product,” and read that section carefully. The specific language determines your exposure:
- “Work product created during employment hours” is narrower than “work product created using company resources.”
- “Relating to the company’s business” is narrower than “any software development.”
- “Company-licensed tools” is the phrase that captures AI coding tools even on personal projects.
If the clause is broad and you want to build something independently, you have three realistic options: negotiate a written carveout before you start (easier at the start of a new role than mid-employment), use entirely personal tools on entirely personal time on a personal machine, or accept that the claim exists and decide whether the risk is worth it.
4. Check which Anthropic plan you are on before shipping for commercial use
Go to anthropic.com/legal and compare the consumer terms against the commercial terms. The difference that matters:
- Consumer terms (free and Pro plans): Anthropic assigns outputs to you, but the IP indemnification is narrower and covers fewer scenarios.
- Commercial terms (API and enterprise): Anthropic assigns outputs to you and will defend you against copyright infringement claims arising from your authorized use of the service and its outputs.
If you are shipping AI-assisted code in a commercial product using the free or Pro plan, the indemnification gap is real. The API or enterprise agreement is the appropriate tier. Note that neither indemnification covers a downstream GPL violation from license contamination in your codebase. That is your governance problem to solve with the license scan in action 1.
The thing worth sitting with
Anthropic’s own lead engineer publicly stated that his recent contributions to Claude Code were written entirely by the AI, and the leaked codebase that Anthropic issued 8,000 DMCA takedowns to suppress may be predominantly AI-authored. Whether Anthropic’s copyright claims over that codebase are legally valid remains an open question no court has yet resolved.
If the company that built the tool cannot cleanly assert copyright over its own AI-assisted code, the question of whether you can is worth taking seriously before it becomes relevant in a transaction, a dispute, or an acquisition conversation. The developer who documents their creative contributions from the start is in a meaningfully different legal position than the one who accepted three thousand lines of Claude output and merged without review, even if both shipped the same product.
A note on what this piece covers and what it does not
Three things in it are settled law:
- Works lacking human authorship are uncopyrightable,
- The work-for-hire doctrine applies regardless of how code was generated.
- Verbatim copying of GPL-licensed code violates the license.
Two things are emerging consensus without definitive court rulings yet:
- How much human direction is enough to establish meaningful authorship in an agentic workflow
- Whether AI output that reproduces training data patterns counts as verbatim copying
One thing is genuine speculation:
- Whether any of this will be litigated at scale in the near term
Most code copyright claims never reach court. The place where the unsettled questions become concrete today is M&A due diligence and institutional fundraising, where acquirers and investors are already asking these questions as a condition of closing.
If neither of those applies to your situation right now, the four actions above are still worth doing, but the urgency is lower than the piece might imply.
Further reading
1. US Copyright Office—Copyright and Artificial
Intelligence (Part 2: Copyrightability)
The primary regulatory source on what qualifies as meaningful human
authorship in AI-assisted works. Part 2 covers the specific tests
the Office applies when reviewing AI-generated content
registrations. Essential if you want to understand exactly where
the legal line sits.
2. Andersen v. Stability AI,
Midjourney, DeviantArt—Ninth Circuit docket
The foundational case on AI training data and copyright
infringement, currently shaping how courts think about what AI
models learn and reproduce. Relevant to the GPL contamination
question in a way most developers have not connected yet.
3. Doe v. GitHub, Inc.—Ninth Circuit
appeal
The live litigation on whether Copilot reproduces licensed code
without attribution. Track this one: The Ninth Circuit decision
will set the standard that determines whether AI-generated code
carrying open source patterns constitutes copyright
infringement.
4. GitHub—Copilot and
copyright: What you need to know
GitHub’s own legal position on why Copilot outputs are not
infringing. Worth reading as a counterpoint: Understanding the
argument they make helps you understand where it is strong and
where it has limits, particularly on the GPL training data
question.
5. FOSSA—Understanding
open source license obligations
A developer-friendly reference to how copyleft obligations actually
work in practice: what triggers the source disclosure requirement,
what constitutes a derivative work, and how the GPL, LGPL, and AGPL
differ in their reach. The clearest plain-language guide available
on this topic.
6. Anthropic—Usage Policy and Terms of Service
The actual document that determines your IP rights and
indemnification scope when you use Claude commercially. Read
sections 7 and 8 specifically: output ownership and IP
indemnification. The difference between the consumer and commercial
terms is stated plainly and takes 10 minutes to understand.
I write about legal architecture for AI products at Legal Layer. This piece is informational and does not constitute legal advice.
12:56
Mike Gabriel: Ubuntu Touch development - 24.04-2.0 Beta and Meaning of Branching-Off [Planet Debian]
The next Ubuntu Touch major release is approaching rapidly, yesterday we reached a major step in the preparation of the upcoming Ubuntu Touch 24.04-2.0 release: The branching-off (see below on what that is).
Ubuntu Touch 24.04-2.0 Beta is Now Available
Part of this development release step is the publication of the
24.04-2.0 Beta release images, for more details and information
see:
https://ubports.com/blog/ubports-news-1/ubuntu-touch-24-04-2-0-beta-is-n...
And additionally, find below some background information on how we maintain various Ubuntu Touch releases in parallel via Git(Lab). In fact, the release model of Ubuntu Touch has partially been adopted from how we in Debian maintains our various Debian versions in parallel, only that in Ubuntu Touch we use Git(Lab) for maintaining the different package versions and not, like in Debian, the APT archive itself.
What does 'Branching-Off' Mean?
Last Saturday, in the UBports Q&A, I explained Ubuntu Touch's "branching-off", an aspect of the Ubuntu Touch release workflow based on Git(Lab). To make this accessible to even more people, here it comes as a write-up:
We host many Git repositories on GitLab, and our primary work is done on the main branches, which contain the bleeding-edge code. When a merge request is deemed critical for stable versions of Ubuntu Touch, we cherry-pick it into a release series branch.
Currently, we land our changes in the main branches and then cherry-pick them to the ubports/24.04.1.x branches. The 'branching off' process for the upcoming 24.04-2.x release means that our current main branches will be copied over to create new branches for this release cycle, namely ubports/24.04-2.x.
This has two major implications. First, any item that hasn't been translated by the time of the branch-off will not receive any more translation updates during the 24.04-2.x cycle. This is why it is crucial that translation work is completed before the branching-off.
Warning of Breaking Changes arriving soon in 26.04-1.x Daily Development UT Images
Second, looking ahead to the release after 24.04-2.x, we will be approaching 26.04-1.x. The OS base will change to Ubuntu 26.04 LTS, hopefully being ready for release to Ubuntu Touch users before the end of the year. We already have a list of features we want to land there. Because we plan to include various major changes, such as the switch from Mir 1 to Mir 2, new calendar and contacts backends, Qt6-based core apps and service components, etc., the likelihood of breaking changes at the beginning of the 26.04-1.x release cycle (which will become the next main branches' target) is very high.
The Ubuntu Touch 24.04-2.0 Release Schedule
The current release schedule is estimated to be:
25 May 2026 [done]
Platform stability freeze 24.04-2.x
25 May 2026 [done]
String freeze 24.04-2.x
15 June 2026 [done]
Branching-off (and unfreeze 26.04-1.x development), UT image
release: 24.04-2.0 Beta
22 or 29 June 2026 [coming]
Final freeze for 24.04-2.x, UT image release: 24.04-2.0 RC
6 or 13 July 2026 [coming]
Release version 24.04-2.0
12:14
Flock Cameras Are Being Used for Stalking [Schneier on Security]
There are over a dozen cases around the country where police officers are using the Flock surveillance camera system to obsessively and illegally stalk people.
12:07
Vincent Bernat: Building a Soviet Nail Factory: how KPIs killed efficiency [Planet Debian]
In 2008, I landed my second job, in the network team at Orange Portails, the division behind the websites and search engine of the French telecom operator Orange. The place ran like clockwork: a comprehensive technical setup, a dedicated team for every part of the business, and room to focus on what I do best. A few years later, none of that mattered: thanks to an obsession with the numbers, we could no longer deliver new services on time.
Disclaimer
This is a story I like to tell to warn people about Goodhart’s law.1 As these events happened almost 15 years ago, my recollection is a bit fuzzy. I left in 2012.
The first years
During my first years, the department operated like a startup. Its cradle was the French company Echo. They built a search engine. France Télécom bought it and renamed it Voila. It was the most visited search engine in France in the early 2000s. France Télécom consolidated the portal activities into the Wanadoo Portails division, later renamed Orange Portails.
The technical environment was excellent. We had many internal tools:2 a ticket system, an RRD-based graphing tool, an IPAM, a reporting tool, and an SNMP-based alerting tool.3 We deployed our Linux servers with CFEngine. We installed systems and applications from internal Debian repositories. We documented everything in a private MediaWiki instance. Supervision was performed with an ancestor of Xymon. The network architecture was clean and scalable with little legacy. We onboarded new people in a day.
It was a nurturing environment for me. I developed several tools: lldpd, an 802.1AB implementation, Snimpy, a pythonic binding for Net-SNMP, Wiremaps, a layer-2 discovery tool with a time machine to know which device is connected where, Kitérő, a tool to simulate network conditions, QCSS-3, a controller for load-balancers, and ipoo, a service available through a Jabber chatbot and a Greasemonkey script to expose IP-related information. I added SNMP support for Keepalived and Quagga. I also started this blog, with articles like “Anycast DNS,” TLS-related articles like “TLS computational DoS mitigation,” SNMP-related articles like “Integration of Net-SNMP into an event loop,” Linux-related articles like “Tuning Linux IPv4 route cache,” and an article about VXLAN long before it was cool.
The collapse
When we needed new servers, the on-site team would take a set from the inventory, install our base Linux distribution on them, put them in the datacenter, and cable them to the top-of-the-rack switches. We opened a ticket describing the servers we needed, and one week later, our servers were available. 💫
Orange wanted to know if this team was performing well, so they asked for KPIs. They decided to use the number of tickets completed in a year. They asked to double this number. So instead of one ticket for a new service, we would open six tickets—one per server. By the end of the year, the KPIs had more than doubled.
Everybody saw it as a success for performance management. So, they asked to do the same for the next year. Now, we needed to open a ticket per server and per step. Again, the KPIs doubled. Behind the scenes, the tickets went to different people and were no longer handled in order. So, for the next year, it was decided to have meta-tickets and meetings to follow the progress of these tickets. Of course, all these extra steps pushed the KPI even higher.
This performance management method spread to the other teams.4 Everything became slower. Instead of a couple of weeks, a new service now took six months. We built a Soviet nail factory. But the KPIs were good, and we stopped caring.
Let me give you another example. We had to estimate the impact of each night operation. We weren’t half bad: we declared most operations “without any expected impact.” Most of the time, there was no impact. One time out of five, there was a 5-second impact. We were told to try harder to meet our expected impact. What did we do? We started declaring a 5-second expected impact. One day, we got a 30-second impact and were told we failed to match the expected impact. In the end, we declared most operations with a 10-minute expected impact, and we stopped caring: instead of carefully shifting traffic around, we allowed ourselves a 5-minute impact. And our KPIs were never better.
KPIs are not bad, but they are easy to break. Use them carefully: let the people doing the work help choose the metrics, and tie those metrics to the quality of the service—for example, with service level objectives. Otherwise, even dedicated people stop caring, game the system, and eventually quit. 📊
-
Goodhart’s law often gets the credit, but Campbell’s law describes my experience even better: the more you lean on a number to make decisions, the faster people corrupt it. ↩
-
At the time, SaaS was not really a thing. I remember we considered, with a couple of colleagues, selling Wiremaps as a SaaS, with homomorphic encryption for the database. But who would outsource their observability stack? ↩
-
Snalert was a metacircular alerting tool in Perl. It was able to poll a very large number of SNMP targets in a short timespan. All our monitoring was SNMP-based, including system monitoring. ↩
-
My team also managed the rules of many Linux-based firewalls. To increase our KPIs, we used the same method: rather than accepting one ticket with a flow matrix, we requested one ticket per flow. ↩
10:49
The relentless math of the long tail [Seth's Blog]
There are more than a million podcasts. The good news is that it’s easy to start one.
The top 1% of all podcasts account for 99% of all downloads.
That means that if your goal is reach, the long tail isn’t going to help much. The short head, even in a medium as wide open as this, dominates consumption. Lots of podcasts to choose from, but most people don’t choose.
Chris Anderson didn’t call the theory the ‘short head’, even though it’s the viral hits that everyone focuses on. The long tail is where most of the content (books, videos, small businesses, political ideas) land.
The long tail may be exactly where you want to be. But don’t hang out there if you need to reach the masses. The goal of reaching the masses is rarely compatible with the math of the long tail.
Someone is going to win that lottery, but it probably won’t be us.
08:14
Lacking Libido by Cyan [Oh Joy Sex Toy]
05:56
Israeli occupied Lebanon resembles West Bank [Richard Stallman's Political Notes]
Life in the part of Lebanon under Israeli occupation resembles the West Bank. Shi'ites are being forced out of their towns entirely. Sunnis, whose farms have been effectively confiscated, are living amidst patrolling Israeli soldiers under an all-night curfew and anyone who goes outdoors is likely to be shot dead.
Tony B'liar's parting advice for the Labour Party [Richard Stallman's Political Notes]
Tony B'liar's parting advice for the Labour Party: to become the third right-wing lunatic party, competing with the Gory Party and Deform.
Arbitrarily blocking immigrants renewing truck driving licenses [Richard Stallman's Political Notes]
Magat officials are arbitrarily blocking many immigrants from renewing truck driving licenses even though they are authorized to work in the US.
EPA prioritizing big business [Richard Stallman's Political Notes]
Under magat control, the EPA is *prioritizing big business over public health.*
(satire) Listerine Leaves germs alive [Richard Stallman's Political Notes]
(satire) *Listerine Leaves 0.1% Of Germs Alive To Spread Message Of Terror Throughout Microbial Community.*
05:07
The time the x86 emulator team found code so bad that they fixed it during emulation [The Old New Thing]
During an exchange of war stories, a colleague of mine told one from back in the days when Windows included a processor emulator for x86-32 on systems that natively ran some other processor. (This has happened many times. And no, I don’t know which processor this particular story applied to.)
This particular emulator employed binary translation, generating native code to perform the equivalent operations of the original x86-32 code. This offered a significant performance improvement over emulation via interpreter. You can imagine that x86-32 is just a bytecode, and the emulator is a JIT compiler.
Anyway, my colleague found that there was one program that needed to allocate around 64KB of memory on the stack and initialize it. The standard way of doing this is to perform a stack probe to ensure that 64KB of memory is available, then subtracting 65536 from the stack pointer, and then initializing the memory in a small, tight loop.
But using a loop to initialize the memory was too mundane for whatever compiler was used to compile this code. Instead of generating a loop to initialize each byte of the buffer, the compiler “optimized” the code by unrolling the loop into 65,536 individual “write byte to memory” instructions, each 4 bytes long.
All in all, it took this program 256 kilobytes of code to initialize 64 kilobytes of data.
This offended the team so much that they added special code to the translator to detect this horrible function and replace it with the equivalent tight loop.
The post The time the x86 emulator team found code so bad that they fixed it during emulation appeared first on The Old New Thing.
01:35
Hey, I Wrote an Actual Song: “Really Great” [Whatever]
Apparently the 31st wedding anniversary is the “Write Your Spouse a Song” anniversary, because that’s what I did this year. As many of you know, Krissy and I actually have a three-day anniversary, since June 15 is the anniversary of me proposing (that happened in 1994), June 16 is the anniversary of our first date (1993), and June 17 is the anniversary of our actually getting hitched. Last year to celebrate we went to Venice. We weren’t going to top that this year, but I still wanted to do something fun and maybe memorable.
Also, and independently, I wanted to start writing actual songs this year, and not just cover songs and noodly electronic compositions. So, while Krissy was away yesterday hanging out with friends, I camped out in my music studio and wrote up this song, about how Krissy is, you know, really great. Literally, that’s the song! My wife! She’s great! I dig her the most! It’s not complicated! And also, if you listen to the lyrics, not in the least bit subtle. It’s clear I’m a big fan of my wife.
I’m pretty happy with the song but I do have some compositional caveats. One, this is the first song I’ve written in literal years, and I’ve only written, like, four in forty years, and one of them was a co-write with a far more accomplished musician. I decided to make it easy on myself by not trying to write The Greatest Love Song Ever Written, just the greatest love song I’ve written about my spouse to this point, which I think we can all agree is a much more achievable goal for a novice. Two, this is me in the home studio, so consider this song to be demo-quality. Three, I don’t know why for this song it turned out I need to be singing in a fake, quasi-British-esque accent in order to stay anywhere on key, but apparently I do, and now we will all just have to live with this piece of information.
Nevertheless! I really like this openly sweet, kinda silly love song, and Krissy, as it happens, loves it, so if any of the rest of you like it, too, that’s a bonus. It’s already a hit with its intended audience of one. Which, I’m not going to lie, is a relief. It would have been awkward if I wrote a song for my life and as was, like, all, “you call that a decent middle eight?” or something like that. I actually had to leave the room while she listened to it for the first time. I don’t get that nervous about anything. But, you know. You write a love song for your spouse, you want them to love it. I’m glad mine did. Maybe you’ll like it too.
— JS
01:14
EFFecting Change: LGBTQ+ Solidarity Against the Tide of Surveillance [Deeplinks]
LGBTQ+ communities are facing an escalating wave of censorship and targeted surveillance, but we can push back through mutual solidarity. Join us live to learn how safer virtual spaces get built, how platform policies and government pressure are reshaping the digital landscape, and what platform accountability actually looks like. Our panel will share ideas for direct action and concrete strategies you can bring back to your community. Whether you’re an activist, an ally, or just paying attention, this conversation is for you. Join the livestream online followed by live Q&A.
LGBTQ+ Solidarity Against the Tide of Surveillance
Wednesday, June 17th
9:00 am - 10:00 am Pacific - Check Local Time
Livestream followed by Q&A
This event is LIVE and
FREE!
About the Speakers
Paige Collings
As a lawyer, digital policy activist
and community organizer, Paige works to dismantle systems of
oppression and advance collective liberation. Her work focuses
on highlighting how state surveillance and corporate restrictions
stifle marginalized communities and perpetuate historic injustices
and harm. She has worked with activists across the globe to
facilitate systemic change by speaking truth to power and creating
spaces for alternative imaginations; and her writing on digital
justice has been featured in Wired, Politico, Teen Vogue, the Daily
Beast and more.
Jillian C.
York
Jillian is EFF's Director for International Freedom of
Expression, based in London. Her work examines state and
corporate censorship and its impact on culture and human
rights, with a focus on historically marginalized communities.
At EFF, she organizes coalitions, writes about and researches
topics related to freedom of expression, leads
the Speaking
Freely interview series, and contributes
to various other areas of the organization's work. Jillian is the
author of Silicon Values: The Future of Free Speech Under
Surveillance Capitalism (Verso, 2021), a
contributor to several academic volumes, and has
written for MIT Technology
Review, The
Guardian, and WIRED, among
others. She is also a visiting professor at
the College of
Europe Natolin in Warsaw, and
a regular
speaker at global events.
Soatok Dreamseeker
Soatok Dreamseeker is a gay furry security engineer. He blogs about
applied cryptography on his blog, Dhole Moments, and is developing
key transparency to enable end-to-end encryption on the Fediverse.
His puns are 100% whole groan.
Luísa Franco
Machado
Luísa Franco Machado is an award-winning international expert
in digital rights and data justice. She has also been a technical
advisor in data governance and AI ethics for governments, NGOs, and
international organizations worldwide, including the UN, OECD.AI,
GIZ, and others. Luísa has carried on policy research at the
London School of Economics and Political Science (LSE) and Sciences
Po Paris on the intersection between technology and socio-economic
development. In 2022, the United Nations recognized them as a
global Young Leader for the Sustainable Development Goals (SDGs)
among more than 6,500 advocates. In 2025 she was featured in
Apolitical's Government AI 100 list as a rising star.
Monday, 15 June
23:42
Tim Retout: In memoriam commit-email.py [Planet Debian]
I have proposed the deletion of an obsolete script, but it makes me feel complicated feelings so I’m going to try and express those. This particular script was written in 2014, but the concept goes back much further – before git was invented.
When I started university in 2003, I seem to remember the computing society used to run tutorials for first-year students on how to use Apache Subversion for your group project – a vast upgrade on CVS (or worse, no version control at all). Back then, the idea of viewing your changesets in a web browser was relatively new – while it was possible to look at an SVN repository through a web UI, features were limited unless you installed something compicated like Trac.
Figure 1:
Data flow when distributing commits via a mailing list
Perhaps because reading email on your desktop computer (I don’t think I could afford an IBM ThinkPad?) was the only vaguely real-time notification system available at the time (except I guess SMS, which cost 10p per text), a common pattern seemed to be to use a post-commit hook to send every single commit to a mailing list, named something like ‘foo-commits’. Indeed, for a long time Fedora had an scm-commits list which appears to be a topic of recent discussion.
I can’t really explain why people wanted to have every commit sent to a mailing list except as a way of getting notified of activity – I can’t believe people would import raw patches from those lists, ala LKML, rather than run actual version control commands to fetch the new source directly. Maybe you’d have to go back to NNTP for this.
I do like the vendor-neutrality of the “everything-as-text” approach, building on the open ecosystem of SMTP. But I doubt we’d see a widespread resurgence of commit lists now – most code hosting must allow anyone to subscribe to email notifications, I assume, and I don’t see a huge benefit in a mailing list archive of commit messages.
In the case of seL4, I’m even more confused about why this script was committed in 2014, shortly after the kernel was put on GitHub. I can only assume it was imported from previous infrastructure. I do know that the implementation is quite Python 2 heavy, with the conversion between unicode and bytes featuring heavily. So rather than risk breaking its logic with patching, I think it’s time to “thank it for its service” and let go.
22:14
We had an opportunity to dip back into the List of the Forgotten, as we had already detailed the perfidy of Niantic Spatial in full. The current list is constantly being added to, and so release from this obligation may never truly arrive. Currently it stands as follows, if you would like a sort of preview:
Fruit Fucker
The food court dragon
Rex Ready
L. H. Franzibald
CTS
Twisp & Catsby
Jim
K-Reazy
"Tag urself," etc.
21:28
If Claude were human it would learn from you even if they didn't record what it learned in a notebook, two or three times and they would remember. Not so with Claude. If it isn't written down it will not remember it. Its mind doesn't have memory. It remembers things by writing them in a markdown file. It's like the movie Memento, where the main character tatoos the info he needs on his body. And then proceeds to misunderstand it. Claude is just like that.
20:35
Zinnia: a modular 64-bit UNIX-like kernel written in Rust [OSnews]
It’s been a while since we’ve had a new operating system project written in Rust, so let’s look at Zinnia.
The kernel is written in (almost) 100% Rust and attempts to avoid unsafe code where possible. It implements a big range of POSIX APIs in system calls, but also exposes common extensions found in Linux and BSDs, like epoll and timerfd. This allows it to run a somewhat modern desktop using Wayland and X11 sessions.
Most drivers are implemented as modules. These are Rust ELF dylibs which get loaded and linked during boot from an initrd, similar to Linux systems. Zinnia can boot from any UEFI based system thanks to the Limine bootloader.
↫ Zinnia OS website
At least Weston and Xfce can run on Zinnia, even on real hardware, which is quite an achievement. The project was started in 2024 as a learning endeavour, but quickly grew out of control, as these projects are wont to do. The code’s open source.
Haiku enables AVX512 support [OSnews]
We’re a little deep into June already, but it’s only now that Haiku published its monthly progress report for May. There’s a bunch of fixes for drag-and-drop behaviour in Tracker, AVX512 support can now be enabled thanks to changes to the kernel’s FPU handling, some low-level changes were made for the Rust and Zig compilers, and further improvements were made to the boot process on the Raspberry Pi 5 (although a lot more work is needed on that front).
There’s still no sixth beta since a few more blockers remain, but don’t let that stop you from installing Haiku – it’s stable enough as it is, sixth beta or no.
Tribblix Milestone 40 for x86 released [OSnews]
Tribblix, the Illumos distribution focused on giving you a classic UNIX-style experience, has been updated with the release of Milestone 40.
This version has some major component updates. Perl in now 5.42 instead of 5.34, and the default Python is now 3.13. The GCC suite is now version 14.2.0, go is version 1.26, Xfce has been updated to version 4.18, node is v22, with v24 added and v20 removed.
↫ Tribblix M40 release notes
There’s a more detailed changelog, as well as the downloads page to get started. If you’re already running Tribblix, you can update in-place, of course.
19:56
Child's Play Auction Needs You! [Penny Arcade]
I really want to make this year’s Child’s Play dinner auction the best that we have ever had and to do that I am asking for your help and I am asking for it early!
19:28
Music For Your Monday: Madison Beer’s “Yes Baby” [Whatever]
Though I’ve always loved Madison Beer’s
voice in KDA, the fictional girl-pop group from League of
Legends, I’ve never really listened to her own music outside
of that. Turns out, unsurprisingly, that she has some real
bangers.
This song of hers, “Yes Baby,” is one I have had on repeat for the past week or so and it is so in my head it’s wild. Not that I’m mad about it, it’s really fucking good. Give it a listen:
I love the clubby feel, the soft feminine vocals, the bass. It’s a great vibe. I hope this song helps you rock through the rest of your Monday, and have a great rest of your day!
-AMS
18:28
Just now, to Claude: "Amazing how we get lost in the weeds, that's why you have cut way down on the verbiage. I am a human -- you can absorb all that info in an instant. My brain does not work that way." We are talking to aliens now, just didn't come to us the way we thought they would. I don't think 2001 anticipated they would think in completely different ways from us, and would not understand the differences. They talk to us as if we were them, the same way your cat thinks you're just a bigger cat.
17:42
Now that basketball is over, can we ask why the Spurs played cartoon music to introduce the Knicks. I was surprised they did it again in Game 5 after the butt-kicking they got in Game 4.
17:28
Pluralistic: AI and amateurism (15 Jun 2026) [Pluralistic: Daily links from Cory Doctorow]
->->->->->->->->->->->->->->->->->->->->->->->->->->->->->
Top Sources: None -->
Today's links
- AI and amateurism: When is generative content vernacular?
- Hey look at this: Delights to delectate.
- Object permanence: Disney characters x clean underwear; Transparent Pontiac; Makers v dog with LED collar; Microsoft buys Linkedin; Legitimate greatness.
- Upcoming appearances: LA, Menlo Park, Toronto, NYC, Philadelphia, Chicago, Edinburgh, South Bend.
- Recent appearances: Where I've been.
- Latest books: You keep readin' em, I'll keep writin' 'em.
- Upcoming books: Like I said, I'll keep writin' 'em.
- Colophon: All the rest.
AI and amateurism (permalink)
Over the weekend, I did an interview about my forthcoming book The Reverse Centaur's Guide to Life After AI (a book about being a better AI critic), and the interviewer said she was surprised that I wasn't an AI booster, based on my demographics and work history:
https://us.macmillan.com/books/9780374621568/thereversecentaursguidetolifeafterai/
I could see where she was coming from. I encountered computers in the mid-seventies, as a small child. My first computer was a CARDIAC, a working, Turing-complete, mechanical computer made entirely of cardboard, that I spent endless hours with:
https://www.instructables.com/CARDIAC-CARDboard-Illustrative-Aid-to-Computation-/
Then I graduated to a teletype terminal and acoustic coupler connected to a minicomputer at the University of Toronto. My mom, a kindergarten teacher, used to smuggle home 1,000' rolls of paper towel from the kids' bathroom. I'd get 1,000' feet of computing up one side, then another 1,000' down the other side, then I'd carefully re-roll the paper towel so she could put it back in the bathroom for the kids to dry their hands on.
After that, I got an Apple ][+ in 1979, and shortly thereafter acquired a modem, and that was it: I was hooked for life. I became an amateur programmer, then a professional programmer. I hosted forums on dial-up BBSes where I distributed software and offered support to strangers who wanted to connect their computers to the internet. I got a job as a gopher developer, then a web developer, then a CIO-for-hire, helping wire up small businesses and connect them to the net. Eventually, I co-founded a free/open source software startup, before transitioning to 25 years as a digital rights activist with the Electronic Frontier Foundation. And for most of that time, I was energetically writing science fiction, eventually becoming associated with a school sometimes called "post-cyberpunk":
https://en.wikipedia.org/wiki/Rewired:_The_Post-Cyberpunk_Anthology
The force that energized all this work was a dialectical one, the contradiction that powered cyberpunk literature itself. For all that cyberpunk was undeniably enamored with the coolness and combustibility of new technology, it was also terrified of how technology could be a force for oppression, surveillance and control. As William Gibson says, "cyberpunk was a warning, not a suggestion."
Gibson's more famous quote, of course, is "the street finds its own use for things." In Gibson's novels (and in my own life in technology) all the most interesting things happen when users of technology (often without formal training or credentials) find ways to adapt the technology they use to suit their needs:
https://pluralistic.net/2026/03/17/technopolitics/#original-sin
This is why I remain an ardent fan of Hypercard, Scratch and other meta-tools that are designed to allow non-programmers to write software that exactly conforms to their desires. Whatever the apps produced by these tools lack in sophistication and efficiency is more than offset by the fact that they give everyday people the power to directly control the tools they rely upon.
If "epistemic humility" means anything, it means acknowledging that no amount of "requirements gathering" can capture the needs of people totally unlike yourself as faithfully as those users can capture their own needs. Giving people the tools to produce their own software is always going to make tools – vernacular, idiosyncratic, homespun – that are more suited to their own hands and minds than anything a technologist working on their behalf could make.
The ancient dictum of "nothing about us without us" – born in 16th century Poland and taken up by the modern disability rights movement – asserts the right of people to control their own living conditions, and also the unique capacity of people to understand their own needs. You know what's even better than being consulted on the design of the technology you use? Having direct control over that technology!
This is why I was so suspicious of the iPad. The iPad's much-lauded "ease of use" was entirely about how easy it was to use an iPad to consume technology. But the iPad remains the single most user-innovation-hostile technology in modern history, a device designed to make it impossible to produce technology without permission from a remorseless multinational corporation. This is cyberpunk as a demand, not a warning:
https://memex.craphound.com/2010/04/01/why-i-wont-buy-an-ipad-and-think-you-shouldnt-either/
The technology I've championed all my life is technology that gives more control to its users. One of my immutable precepts is that people who are different from me know things I can't know, and the only way I can get the benefit of their unique knowledge and perspective is if they are free to make and share things that matter to them. As Dan Gillmor said, back when he was inventing the study of citizen journalism, "My readers know more than I do":
https://www.oreilly.com/openbook/wemedia/book/ch00.pdf
And while I am broadly very skeptical of AI, and deeply alarmed by the proliferation of "vibe coded" software in production environments, vibe coding for personal projects is a useful and exciting addition to the lineage of tools that let computer users decide how their computers will work. For people making personal projects, vibe coding extends the power of shell scripting, cron jobs, Applescript, and other desktop automation tools to a wider audience.
One of the journalists I spoke to last week about my book described how he had vibe coded an app that showed him an alert every time a plane flew over his house, giving the tail number and other details of the flight. This is information that I have no need for and no interest in, and that I'm therefore excited to learn about, because its very existence affirms that the world is full of people who are delightfully, irreducibly, amazingly different from me, and moreover, that their unique needs can be directly met using their imaginations and their personal computers.
I recently sat down with my colleague Naomi Novik, a brilliant author who also co-founded Archive of Our Own. Naomi demoed her followup to AO3 for me: Wreccer, a system to help you find small groups of people with taste similar to your own, in order to facilitate media recommendations within that group – a kind of personal, relationship-driven alternative to massive, centralized, monolithic algorithmic recommendation systems:
Naomi told me that Wreccer was being built using the same design ethos that the original Twitter embraced. When Twitter launched, it was an API first, and the official Twitter front end was built on that API – but anyone could build their own front end for Twitter that worked in the way they wanted it to. Now, the word "anyone" is doing a lot of work in that sentence, because most people don't even know what an API is, and of the people who do, most of them were not capable of writing their own software front end for Twitter.
But Wreccer is being designed for the age of vibe coding, and the API will really allow anyone who uses the service to design their own interface to the system, one that elevates and centers the features they find useful and tucks away the ones they're not interested in. Your personal, custom front end could also bring in other data-sources – pulling in your Mastodon messages, for example, or even showing you an alert with the tail-number of any plane flying over your home.
This is the part of vibe coding that I'm quite excited about, but it's not the part the industry focuses on. Instead of hearing about how personal, homemade software utilities can be an end unto themselves, we hear about vibe coded projects as prototypes for commercial production code. We hear about clueless bosses vibe coding software products and services that run fine for one user on a siloed desktop computer, and then demanding to know why it takes 50 engineers a year to make the same thing work for millions of users on the public internet. We hear about people who vibe code and submit patches to free/open-source software projects with millions of users, overwhelming project maintainers with slop code that is riddled with security vulnerabilities.
Of course, there's an obvious reason why the industry wants to focus on the potential for vibe coded software to replace production code. The AI bubble has burned up $1.4t to date, while bringing in mere tens of billions of dollars per year, even as its unit economics grow steadily worse:
To keep the bubble inflated, AI hucksters must promise massive economic returns to the technology. They want investors to believe that vibe code is about to replace working programmers, who are skilled, high-waged, high-demand workers. Their pitch is that for every million dollars' worth of programmers that an AI salesman and a boss conspire to fire, half a million dollars will go to the AI company whose bots shit out that vibe code.
That's par for the course with the AI bubble, whose focus is entirely on how AI can centralize, control and homogenize our lives. Whereas early desktop publishing, web publishing and social media gave us a glorious higgledy-piggledy of chaotic, weird and transgressive hobbyist media and retina-searing designs, AI art and design are instantly recognizable at a thousand yards, and it all looks the same, boring, and washed:
https://pluralistic.net/2024/07/20/ransom-note-force-field/#antilibraries
AI companies have released open weight/open source models that can run on your own computer, but these are treated as side-shows and toys and demos. The real action, we're told, is in "frontier models," which is industry-speak for "a piece of software whose running costs exceed the GDP of most countries":
https://pluralistic.net/2026/02/19/now-we-are-six/#stock-buyback
Perhaps this is why the dynamics of AI are so different from the early dynamics of the web. Early web users were workers, who demanded that their bosses allow them to use the web and so devolve more power to people doing their jobs. By contrast, today's most ardent AI boosters are bosses, who threaten workers who don't use AI enough in the course of their duties:
https://pluralistic.net/2026/05/26/the-ai-will-continue/#until-morale-improves
Where we do see idiosyncrasy emerging from AI usage, it's often terrible. AI can help you create a folie-a-un in which you and a chatbot team up to reinforce your delusions and drive you deeper into a world of dangerous mirage:
https://pluralistic.net/2026/06/03/mission-space/#gsd
There's a (false) story that's told about people who championed the early internet: that we were blithely certain that technology could only be a force for good, and negligently disinterested in the possibility that technology could control, extract and harm. That's demonstrably untrue: recall cyberpunk's dualism of "the street finds its own use for things" and "cyberpunk is a warning, not a suggestion."
More true is to say that early internet champions were alive to the importance of the internet, and therefore both excited about the possibilities of the internet to deliver a world of connection, idiosyncrasy, love and solidarity; and about the danger of the internet as a dystopian system of surveillance and manipulation:
https://pluralistic.net/2025/02/13/digital-rights/#are-human-rights
History isn't finished. Long after the AI bubble pops, there will be local models and people vibe coding homemade software that respond directly to their needs. The stuff we make on our own computers, for ourselves, is deplatformed from its inception. It's part of the life we can build in technology's "shadowy corners" that we used to just call "technology." The fact that this stuff is utterly unsuited to be production code makes it inherently unmonetizable. It's how the street finds its own use for things:
https://pluralistic.net/2026/02/23/goodharts-lawbreaker/#no-metrics-no-targets
Hey look at this (permalink)
- Mediocre Fred https://www.youtube.com/watch?v=gCXc-xC5ms0
-
Shame On You https://www.change.org/p/an-open-letter-to-the-american-diabetes-association-shame-on-you
-
Keycap Quarry https://keycapquarry.com/shop/
-
The Threat of Big Insurance https://prospect.org/2026/06/11/threat-of-big-insurance-lobbying-congress-donations/
-
End Citizens United’s Tiffany Muller on fighting big money in politics https://www.citationneeded.news/end-citizens-uniteds-tiffany-muller-on-fighting-big-money-in-politics/
Object permanence (permalink)
#25yrsago Disney characters win right to clean underwear https://web.archive.org/web/20010707023727/https://www.sfgate.com/cgi-bin/article.cgi?file=/news/archive/2001/06/07/state1339EDT0171.DTL
#20yrsago Lampooning the American dismissal of Gitmo suicides https://fafblog.blogspot.com/2006/06/610-changed-everything-run-for-your.html
#20yrsago LA’s South Central Farm under police siege right now https://web.archive.org/web/20060616085732/http://www.southcentralfarmers.com/index.php?option=com_content&task=view&id=160&Itemid=2
#15yrsago Transparent Pontiac for sale https://web.archive.org/web/20110610113919/http://blog.hemmings.com/index.php/2011/06/07/the-tin-indian-that-wasnt-rm-to-offer-see-through-pontiac/
#15yrsago Pulp Fiction edited down to just the cussing https://www.youtube.com/watch?v=5PcAQbhnGNs
#15yrsago New York State to pet cemeteries: no pet owners’ ashes allowed https://web.archive.org/web/20110614133359/https://www.foxnews.com/us/2011/06/11/new-york-tells-pet-cemeteries-to-stop-taking-in-humans/#ixzz1PAZoGS6l
#15yrsago A dog with persistence-of-vision LEDs in her shirt writes my novel Makers in the park at night https://web.archive.org/web/20110618011346/https://i.document.m05.de/?p=970
#15yrsago Head of UN copyright agency says fair use is a “negative agenda,” wants to get rid of discussions on rights for blind people and go back to giving privileges to giant companies https://memex.craphound.com/2011/06/14/head-of-un-copyright-agency-says-fair-use-is-a-negative-agenda-wants-to-get-rid-of-discussions-on-rights-for-blind-people-and-go-back-to-giving-privileges-to-giant-companies/
#10yrsago Air Force loses access to database tracking fraud investigations to 2004 https://arstechnica.com/information-technology/2016/06/database-corruption-erases-100000-air-force-investigation-records/
#10yrsago Peter Thiel’s lawyer threatens Gawker for talking about Donald Trump’s “hair” https://web.archive.org/web/20160615022004/https://gawker.com/now-peter-thiels-lawyer-wants-to-silence-reporting-on-t-1781918385
#10yrsago Samantha Bee on Orlando shooting: angry and uncompromising https://www.youtube.com/watch?v=t88X1pYQu-I
#10yrsago Goldman Sachs bribed Libyan officials with sex workers, private jet rides, then lost all their money https://www.theguardian.com/business/2016/jun/13/goldman-sachs-hired-prostitutes-to-win-libyan-business-court-told
#10yrsago Net Neutrality Wins: Federal Court Upholds FCC Open Internet Rules https://www.techdirt.com/2016/06/14/cable-industry-proclaims-more-competition-hurts-consumers-damages-economic-efficiency/
#10yrsago Microsoft will buy Linkedin for $26.2B https://arstechnica.com/information-technology/2016/06/microsoft-will-acquire-linkedin-for-18-5b/
#10yrsago Lin-Manuel Miranda’s Tony Awards sonnet for the Orlando shooting victims https://www.rollingstone.com/tv-movies/tv-movie-news/see-lin-manuel-mirandas-stirring-tribute-to-orlando-victims-103131/
#10yrsago China’s online astroturf is mostly produced by government workers as “extra duty” https://web.archive.org/web/20160613194153/http://arstechnica.com/information-technology/2016/06/red-astroturf-chinese-government-makes-millions-of-fake-social-media-posts/
#10yrsago Rio: your quadrennial reminder that the Olympics colonize host-states with Orwellian surveillance and human rights abuses https://web.archive.org/web/20160614122124/https://motherboard.vice.com/read/the-olympics-are-turning-rio-into-a-military-state
#5yrsago A Monopoly Isn’t the Same as Legitimate Greatness https://pluralistic.net/2021/06/13/a-monopoly-isnt-the-same-as-legitimate-greatness/
Upcoming appearances (permalink)
- Virtual: The future of world governance, with Kim Stanley
Robinson (UN Independent Expert on International Order), Jun 19
https://www.youtube.com/live/wJvBvYdaAMY -
LA: The Reverse Centaur's Guide to Life After AI with Brian Merchant (Skylight Books), Jun 19
https://www.skylightbooks.com/event/skylight-cory-doctorow-presents-reverse-centaurs-guide-life-after-ai-w-brian-merchant -
Menlo Park: The Reverse Centaur's Guide to Life After AI with Angie Coiro (Kepler's), Jun 21
https://www.keplers.org/upcoming-events-internal/cory-doctorow-2026 -
Toronto: The Sovereignty Debate (IAB Canada's State of the Nation), Jun 23
https://iabcanada.com/state-of-the-nation-2026 -
Toronto: The Reverse Centaur's Guide to Life After AI (Osler Records/Type Books), Jun 23
https://www.eventbrite.com/e/cory-doctorow-book-launch-and-talk-tickets-1991501299998 -
NYC: The Reverse Centaur's Guide to Life After AI with Jonathan Coulton (The Strand), Jun 24
https://www.strandbooks.com/cory-doctorow-the-reverse-centaur-s-guide-to-life-after-ai.html -
Philadelphia: The Reverse Centaur's Guide to Life After AI with David Williams (Fitler Club/Philadelphia Citizen), Jun 25
https://www.eventbrite.com/e/cory-doctorow-book-event-tickets-1990110326559 -
Chicago: The Reverse Centaur's Guide to Life After AI with Rick Perlstein (Exile in Bookville), Jun 26
https://exileinbookville.com/events/50628 -
Edinburgh International Book Festival with Jimmy Wales, Aug 17
https://www.edbookfest.co.uk/events/the-front-list-cory-doctorow-and-jimmy-wales -
South Bend: An Evening With Cory Doctorow (Notre Dame), Oct 6
https://franco.nd.edu/events/2026/10/06/an-evening-with-cory-doctorow/
Recent appearances (permalink)
- The Enshittification of Life, the Universe, & Everything
(Luke Savage)
https://www.lukewsavage.com/p/the-enshittification-of-life-the -
Cory Doctorow's digital jail-break (DW In Focus)
https://www.dw.com/en/cory-doctorows-digital-jail-break/audio-77414035 -
Why the Internet Got Worse and What to Do About It (Jim Rutt) (RIP)
https://www.jimruttshow.com/cory-doctorow-3/ -
On Enshittification – and what can be done about it (Re:publica)
https://www.youtube.com/watch?v=KhINQgPMVSI -
EFFecting Change: How to Disenshittify the Internet (EFF, with Wendy Liu)
https://archive.org/details/effecting-change-enshittification
Latest books (permalink)
- "Canny Valley": A limited edition collection of the collages I create for Pluralistic, self-published, September 2025 https://pluralistic.net/2025/09/04/illustrious/#chairman-bruce
-
"Enshittification: Why Everything Suddenly Got Worse and What to Do About It," Farrar, Straus, Giroux, October 7 2025
https://us.macmillan.com/books/9780374619329/enshittification/ -
"Picks and Shovels": a sequel to "Red Team Blues," about the heroic era of the PC, Tor Books (US), Head of Zeus (UK), February 2025 (https://us.macmillan.com/books/9781250865908/picksandshovels).
-
"The Bezzle": a sequel to "Red Team Blues," about prison-tech and other grifts, Tor Books (US), Head of Zeus (UK), February 2024 (thebezzle.org).
-
"The Lost Cause:" a solarpunk novel of hope in the climate emergency, Tor Books (US), Head of Zeus (UK), November 2023 (http://lost-cause.org).
-
"The Internet Con": A nonfiction book about interoperability and Big Tech (Verso) September 2023 (http://seizethemeansofcomputation.org). Signed copies at Book Soup (https://www.booksoup.com/book/9781804291245).
-
"Red Team Blues": "A grabby, compulsive thriller that will leave you knowing more about how the world works than you did before." Tor Books http://redteamblues.com.
-
"Chokepoint Capitalism: How to Beat Big Tech, Tame Big Content, and Get Artists Paid, with Rebecca Giblin", on how to unrig the markets for creative labor, Beacon Press/Scribe 2022 https://chokepointcapitalism.com
Upcoming books (permalink)
- "The Reverse-Centaur's Guide to AI," a short book about being a better AI critic, Farrar, Straus and Giroux, June 2026 (https://us.macmillan.com/books/9780374621568/thereversecentaursguidetolifeafterai/)
-
"Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2026
-
"The Post-American Internet," a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027
-
"Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027
-
"The Memex Method," Farrar, Straus, Giroux, 2027
Colophon (permalink)
Today's top sources:
Currently writing: "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Third draft completed. Submitted to editor.
- "The Reverse Centaur's Guide to AI," a short book for Farrar, Straus and Giroux about being an effective AI critic. LEGAL REVIEW AND COPYEDIT COMPLETE.
-
"The Post-American Internet," a short book about internet policy in the age of Trumpism. PLANNING.
-
A Little Brother short story about DIY insulin PLANNING
This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.
https://creativecommons.org/licenses/by/4.0/
Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.
How to get Pluralistic:
Blog (no ads, tracking, or data-collection):
Newsletter (no ads, tracking, or data-collection):
https://pluralistic.net/plura-list
Mastodon (no ads, tracking, or data-collection):
Bluesky (no ads, possible tracking and data-collection):
https://bsky.app/profile/doctorow.pluralistic.net
Medium (no ads, paywalled):
Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):
https://mostlysignssomeportents.tumblr.com/tagged/pluralistic
"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla
READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.
ISSN: 3066-764X
16:49
30 years of XaoS: Past, present and future [Planet GNU]
September 19, 2026 from 14:30–17:30 CET
Free Software Directory meeting on IRC: Friday, June 19, starting at 12:00 EDT (16:00 UTC) [Planet GNU]
Join the FSF and friends on Friday, June 19 from 12:00 to 15:00 EDT (16:00 to 19:00 UTC) to help improve the Free Software Directory.
16:14
An example of the latest version of the library generator, which is of course just a script. Note that there's a disclosure at the bottom of the page where it says how and why it was created, and then lists the exact prompt that ChatGPT responded to. And I didn't write the prompt, Claude did. I think that pretty much assures I kept my own opinion to myself.
15:28
I'm creating a new way to do messaging, a network that only understands RSS feeds for incoming and outgoing messages. The only API you'll need to subscribe is a feed reader. The idea is to show developers how to do it so a thousand flowers can bloom. It's a lot easier to create these things if you're modest in the features you support, at least at first, and you don't try to control the users. There is no business model here, other than the satisfaction of making sure everyone knows what a social system looks like made only out of features of the web, and every part replaceable.
Request for Claude, please add a close box to this message box. I wasn't using the new model. Once is enough for this message.
What 'RSS feeds' means [Scripting News]
Often when I use the term RSS feeds it will link to this page.
In the coming weeks and months I'm going to talk a lot about RSS feeds. I want to be clear, that it is a short hand for RSS, Atom and RDF. It makes the writing flow better, and it gives me a place to provide the technical details for people who need them.
We use the Feedparser package to read the feeds, so basically we support the same feed formats they do.
15:07
“Your EPUB is fine. Kobo disagrees. Blame Adobe.” [OSnews]
An infuriating story about something most of us don’t really stop to think about: e-books and the rendering engines companies and software use to display them.
It’s the year 2026. Thanks to the horrendous [Adobe] RMSDK which Kobo decided to use as their backbone for all book rendering (probably for DRM reasons), a single line of perfectly valid CSS turns a perfectly valid EPUB file into a “corrupted file” on Kobo and just drops the whole book. No clear error message, no fallback. Just a massive fail.
↫ André Klein
The level of obnoxiousness goes even deeper: Kobo devices ship with a better, actually maintained renderer for e-books as well, but in order to have a book use it, the book file in question needs to have a specific file extension. Remember that e-book files are just packaged websites; there’s no reason to do any of this nonsense with two rendering engines, one of which is shit and frozen in time.
I have never had to do anything related to creating an e-book – I just put books on my own Kobo and read them – and even I am getting annoyed just reading this.
14:42
Good morning sports fans! Going to the Knicks parade in NYC on Thurs? Starts at 10AM at Battery Park, goes up Broadway through Canyon of Heroes, concluding at City Hall.
14:21
Windows 1.0 and the WinAPI, 40 years later [OSnews]
How far can you get, application development-wise, by using only the original APIs from Windows 1.0, and only whatever came included by default with Windows 1.0?
I finally decided to write an application for the very first version of Windows and see how different the modern WinAPI really is from its earliest versions. Windows 1.0 came out back in the mid-1980s – the era of 16-bit processors, MS-DOS, and cooperative multitasking. At first glance, you might think it has almost nothing in common with modern Windows, but when you look specifically at the application API, that’s where things get interesting.
I wanted to see how far it would be possible to go using only the capabilities of the first version of Windows. I didn’t want to just make a minimal example with a window and a menu, but a small, complete application with graphics, keyboard input, timers, and constant redrawing. For this experiment, I chose Xonix – a simple yet surprisingly addictive game.
↫ Stanislav Safronov
It turns out that surprisingly, despite the 40 years and massive changes since Windows 1.0, there’s still a lot that feels recognisable. It’s also remarkable that the code Safronov ended up with ran on every version of Windows from 1.0 to 10, but sine it’s a 16 bit application it no longer works on Windows 11. It also had a hiccup on Windows 95, but he suspects that’s an issue in the 16 bit subsystem in Windows 95, and not in his code.
The code’s available on GitHub.
13:28
CodeSOD: Caught a Mistake [The Daily WTF]
Daniel recently started a new job. His first
task was to fetch some data from the database and render it to the
user. Easy enough, and there were already wrapper functions around
the database to make it easy. He called execute_read,
passed it a query, and checked the results.
There were no results. But the query definitely should have returned results. What was going on?
def execute_read(conn, query, params, only_one=False):
result = None
cursor = None
try:
start_time = time.time()
cursor = conn.cursor()
cursor.execute(query, params)
if only_one:
result = cursor.fetchone()
else:
result = cursor.fetchall()
end_time = time.time()
time_taken = end_time - start_time
if env.is_production():
if time_taken > 0.4:
logger.critical("long query", query=query, time_taken=time_taken)
else:
if time_taken > 0.2:
logger.warning("long query", query=query, time_taken=time_taken)
except Exception as err: # pragma: no cover
logger.exception("execute_read exception", exception_msg=err, query=query)
finally:
logger.debug("execute_read debug", query=query, params=params, only_one=only_one)
if not result:
if only_one:
result = {}
else:
result = []
if cursor:
cursor.close()
return result
There are a lot of things I don't like about this
function. The only_one parameter, for starters. Note
how the database library actually breaks that behavior out as
different functions- that's a much more appropriate model,
especially since you have wildly different return types depending
on how that flag is set.
Similarly, checking env.is_production() to check a
timing threshold is itself pretty awful. I can sympathize with
wanting different timing constraints based on what environment
you're in- but if that's the case, the timing constraint
is the parameter. env.long_query_threshold should be
the configuration parameter. Also, your database should be able to
alert you to these kinds of things, so that it doesn't live in your
code anyway.
But the WTF here is the promiscuous exception handler, which
catches all errors and simply logs them. This created a situation
where Daniel sent a query to the database and got no results. He
didn't go straight to the logs and tried to debug it more directly,
so it took him quite some time to find the execute_read
exception log line which told him what was wrong: his SQL
query had a syntax error.
Daniel writes: "I can't imagine the disaster that this causes if there's a network hiccup in production." Failing silently and returning empty results sets definitely is inviting a lot of confusion.
[Advertisement] Keep all your packages and Docker containers in one
place, scan for vulnerabilities, and control who can access
different feeds. ProGet installs in minutes and has a powerful free
version with a lot of great features that you can upgrade when
ready.Learn
more.12:49
Issue 46 – Greta’s Wedding – 09 [Comics Archive - Spinnyverse]
The post Issue 46 – Greta’s Wedding – 09 appeared first on Spinnyverse.
12:14
The FCC Wants to Eliminate Burner Phones [Schneier on Security]
A proposed FCC rule would kill burner phones: phones whose accounts are not attached to a particular person.
The FCC plans to do this by legally forcing the country’s telecoms to store a wealth of personal information about essentially all phone customers, including a government issued identification number and their physical address, alarming privacy advocates and civil rights activists who compare the measures to those from authoritarian countries where it can be difficult to buy a mobile phone plan without giving up your identity.
The proposed change would drastically shake up how people obtain phone plans in the U.S., and have all sorts of privacy and cybersecurity knock-on effects. The FCC is proposing the data collection partly as a way to combat scammers, with telecoms being required to collect other information on business and foreign customers like the intended use case of their bulk phone plan purchase and their IP address. But the changes would mean telecoms collect data on all new and renewing customers, and the FCC provides a long list of other things that the collected data could help authorities with.
11:35
Grrl Power #1469 – Semi Finals Roster [Grrl Power]
Events include Unlimited Class Charity, where strangely enough, you can’t win by donating all of your organs. Well, unless you have really top-tier regeneration, maybe. Of course, it seems like a terrible idea for someone with massive regeneration to donate an organ, because how would you stop that organ from regenerating the rest of its original body around it, since you’ve implanted it in a place where it’s being kept alive and fed a stream of nutrients? Obviously it would depend on how the regeneration works. Something that required conscious effort would probably be fine, but Wolverine donating half of his liver would probably have dire consequences.
- Unlimited Class Paying it Forward (I’m actually not sure how that would be an event. Maybe it’s some sort of… relay?)
- Unlimited Class Teaching a Man to Fish
- Unlimited Class Condolences
- Unlimited Class Writing Something Meaningful on a Work Birthday Card and Not Just “Have a Good One” or “Another Step Closer to the Grave, Hah Hah”
- Unlimited Class Hugging but Not For So Long it Gets Awkward
- Unlimited Class Maintaining Eye Contact with Someone While They Tell You Some Boring Story They For Some Reason Think is Totally Interesting
- Unlimited Class Stealing from the Rich and Giving to the Poor and Also Kicking the Rich in the Balls Until their Genitals go Necrotic – (there is some argument that this last bit isn’t “nice” in a technical sense, but most everyone agrees they usually deserve it.)
What Unlimited Class Niceness Arena events can you think of?
BTW, someone pointed out that Roark-1-8 looks a bit like Goon Squad. Or a lot. Well, it’s not. I guess I have an armor design in my head, and I have to put effort into deviating from it.
Final version is up, both at TWC and Patreon.
Sexy bodymod news lady Gail has a special one-on-one interview with Tournament Quarter finalist Saraviah Nightwing! And if you subscribe to Gail’s Space Patreon, (which, due to the vagaries of Earth and Gal-Net’s DNS servers, happens to be the same as the Grrl Power Patreon, go figure) you can see that same interview in the nude!
Double res version will be posted over at Patreon. Feel free to contribute as much as you like.
10:49
Reality Be Damned [George Monbiot]
The policies of both Reform UK and the Conservatives would destroy a million jobs. In return, they offer imaginary employment in a fantasy industry.
By George Monbiot, published in the Guardian 10th June 2026
Really? You want to destroy a million jobs? Vote Reform UK for mass unemployment: is that your pitch? Hammer these questions home whenever you meet a supporter of the party. Or, for that matter, a Conservative, as their party now takes an almost identical line.
The figures are stark. They were compiled not by Just Stop Oil or the Green party, but by that bastion of conservatism, the Confederation of British Industry. They show that the net zero economy now directly employs more than 300,000 full-time workers, while supporting the jobs of 1.1 million. The net zero sector is worth £100bn to the UK already, and is likely to grow by hundreds of billions more. The rest of the green economy directly employs a further 600,000.
This is just the start. In October, the government announced plans to create another 400,000 jobs through its green energy plan, particularly for people leaving the fossil fuel industry, school leavers, ex-offenders, veterans and the unemployed. Training centres and colleges will be built in places badly hit by deindustrialisation. It’s the first realistic plan for a vast increase in skilled manual jobs in many years.
By contrast, in 2023 the UK’s oil and gas industry provided 27,500 jobs, and supported a total of 205,000. In other words, depending on where you draw the line, oil and gas provided between one-tenth and one-fifth of the employment generated by the alternatives. These figures are likely to be even lower today, as they’ve been tumbling rapidly for years. Despite the new licensing rounds and tax breaks the Conservatives gave the industry, it shed 70,000 jobs between 2016 and 2023. The Rosebank oilfield, a cause célèbre for Reform and the Tories, would, if extraction is approved, directly generate a grand total of 255 jobs over its lifetime.
Rail against these numbers all you like, you’re up against geology. A fortnight ago, Reform UK’s deputy leader and energy spokesperson Richard Tice claimed “there is decades and decades and decades of gas in the North Sea”. In reality, even if further licences are granted for the North Sea’s potentially viable fields, by 2050 our gas output will fall by 97% from 2025 levels. New licences scarcely affect this trajectory, as so little is left to be extracted. It takes, on average, 28 years between approval and production (by contrast, large-scale wind and solar take around four). Far from meeting UK demand for “decades and decades and decades”, there’s likely to be less than a year’s worth of extractable supply. Reform promises fake jobs in a fantasy industry.
They and the Tories are now competing to discover the outer limits of imbecility. Some Reform candidates simply deny climate science. Tice goes even further, peddling outright conspiracy fictions: “There are loads of scientists who are terrified to speak, because they won’t get any research funding if they tell it as it is.” Kemi Badenoch, the Tory leader, has been ripped to shreds – by the former Conservative prime minister Theresa May, among others – over false claims she has made to support her abandonment of net zero.
Even in opposition, these parties are seeking to sabotage the net zero economy. Last year, Tice wrote to eight major energy firms, threatening that Reform would “strike down” renewable energy contracts signed under the current government. If you bid for a contract, “you do so at your own risk … the era of unquestioned liberal progressive orthodoxy across the Western hemisphere is over. Prospective investors in the UK’s Net Zero economy would be wise to take note.”
Labour MPs retorted that realising this threat would mean ripping up contract law. They could also have questioned whether the UK is in the western hemisphere. But geography, geology, physics, law: who gives a monkey’s? The world will do as we say. God himself will cower in our shade.
Within the first three years of a Reform government, Transition Economics estimates, it would destroy 500,000 jobs. This would rise to 1.4 million by 2040. Who would suffer most? Oil and gas workers, who are being supported by the current government to move into renewables and advanced manufacturing. But throwing people out of work is something Reform seems to contemplate gleefully: last year Nigel Farage told Durham council workers with climate-related jobs, “you all better really be seeking alternative careers very, very quickly”. After all, why should multimillionaires care about other people’s employment?
Reform and the Tories like to pitch their attack on climate policy as the triumph of hard-headed pragmatism over those woolly boffins and tree huggers who don’t care about the “working man and woman”. But they are the ones trashing the jobs of practical people. They are the romantics, the fantasists, dreaming of an impossible world. Of course, the question in politics is not what the facts say. It is whether the facts can be made to matter.
Even if you set aside the trifling issue of human survival, and the local pollution, noise and damage fossil fuels cause, and the vast costs they already inflict through both energy bills and climate impacts, the case is inarguable. To choose the dying industry over the growing one is simply, in terms of jobs and income, to inflict immense harm on the people of this country.
On whose behalf do they make this choice? Not their own voters, who strongly support renewable energy and net zero policies, and would much prefer renewables to the fracking that Tice demands. Despite the barrage of nonsense, support for green policies among Reform voters seems only to be growing. Tice’s constituency, Boston and Skegness, is the most flood-prone in England, and some of those who suffer as a result are incensed by his stance.
But there is one group with whom the party seems to align: its funders. Two-thirds of the money it has received, according to one analysis, comes from very rich people with interests in oil and gas. I see Reform as a party of millionaires working for billionaires.
The polls show that Reform’s achilles heel is the perception that it’s working not for the “ordinary people of Britain”, but for the rich and powerful: billionaires and fossil fuel companies. So spread the word: for the sake of their elite chums, they will throw you out of work.
www.monbiot.com
10:14
Degrees of freedom [Seth's Blog]
When tech shows up, it offers a shortcut and convenience.
You can use Google Maps to direct you somewhere without paying much attention to the surroundings.
You can use Claude to write your marketing copy and get a better-than-mediocre result the first try.
You can look for a gift on Amazon, pick the first match, and be pretty sure it’ll do the job.
Tech adoption often focuses on making things easier, simpler, and pre-decided.
And yet… we can also decide to use tech to do more work, insert more humanity, and amplify flexibility. We don’t try to get our time back, we try to figure out how to leverage the time we’ve got.
When a film director uses AI to create storyboards, it’s a chance to generate multiple approaches to a scene, not just one. When we sit with all the data Google Maps offers us for a trip, we might plan a less direct route, with more stops and detours, simply because we now know what our options are. And once we know what the mediocre and average marketing copy looks like, we put in the time (and take the risks) to go to edges we never would have had the resources to explore in the old days.
The best tech gives us a chance to work harder on the parts that matter to our customers and to us.
Here’s the simple fork in the road:
Professionals and organizations that use AI to save time, cut costs, and lay people off are taking a lazy road to failure and irrelevance.
Those who use it to do harder, braver, and more powerful work, who figure out how to create more value and charge more for it, and who end up hiring more people to do so, will be defining our future.
09:42
Freexian Collaborators: Debian Contributions: Go default compatibility, Trimming build-essential, Python upstream engagement and more! (by Anupa Ann Joseph) [Planet Debian]
Debian Contributions: 2026-05
Contributing to Debian is part of Freexian’s mission. This article covers the latest achievements of Freexian and their collaborators. All of this is made possible by organizations subscribing to our Long Term Support contracts and consulting services.
Go default compatibility, by Helmut Grohne
At the MiniDebConf Hamburg,
Andrew Lee had prepared a
talk on how Debian accidentally chooses Go compatibility.
Helmut joined Tobias Quathammer and Andrew Lee in looking into the
problem. Go has a compatibility system where modules declare a
desired Go version to be compatible with. This influences various
features such as whether RSA keys smaller than 1024 bits are
accepted. Unfortunately, Debian’s way of building Go packages
is unique in setting GO111MODULE=off, which
practically implies a very old compatibility version that enables a
number of insecure settings. Most Linux distributions use the
default GO111MODULE=on and therefore consult a
go.mod file that often declares a sensible version.
While doing so is the way for Debian longer term, getting there
involves major changes so we also sought a more short term
workaround. We developed a
patch to the Go compiler that would enable it to pick up a
compatibility version from the environment. Tobias uploaded it to
unstable. The next step is
communicating the declared compatibility version from
go.mod to the compiler via the new variable. Then,
rebuilding the archive resolves the immediate symptoms. This does
not save us from having to perform the larger transition to
GO111MODULE=on, but this shortcut can be backported to
trixie.
Trimming build-essential, by Helmut Grohne
One of the harder problems of the architecture cross bootstrap
is correctly expressing the Build-Depends of
glib during the toolchain bootstrap. It implicitly
depends on build-essential, which happens to depend on
libc6-dev. This poses a cycle. It applies even for
cross building, because it is interpreted for the host architecture
and that there is no way of satisfying this dependency during the
toolchain bootstrap.
Given discussions at MiniDebConf Hamburg
with Jochen Sprickerhof and others, a seemingly stupid idea
evolved: Let’s delete build-essential. What
looks insane on the surface might deserve a second look. Given how
we moved away from C, C++ and autotools, what is in
build-essential no longer is required by much of the
archive. With the rise of debputy,
debian/rules no longer has to be a makefile. While the
task would be huge, those packages relevant to architecture
bootstrap could explicitly support building without the implied
dependency making their dependencies explicit. In a number of
cases, this amounts to issuing a dependency on
g++-for-host. This dependency requires the use of
architecture-prefixed tools. Therefore, Helmut wrote a debhelper
change that makes it always pass build tools to various build
systems. This also enables more packages to honour environment
variables such as CC and CXX.
Python upstream engagement, by Stefano Rivera
Stefano attended PyCon
US (at personal expense) to improve upstream relations and
ensure Debian’s voice is heard where it needs to be. On
Friday there was a packaging
summit (notes)
with good discussion on the future of the wheel
format, and some discussion of the new abi3t shared
library format for free-threaded python.
In preparation for the event, Stefano did a complete review of the current patch stack.
Stefano’s primary goal was to get some of Debian’s patches merged during the sprints, and results were mixed. Some trivial patches (e.g. GH-150098, made progress and merged, but the most consequential patch Debian is carrying is still blocked. Stefano will continue to try to drive progress on this.
Miscellaneous contributions
- Carles worked on po-debconf-manager: Reviewed Catalan translations for 6 packages, submitted 10 packages to maintainers, and removed 3 packages from po-debconf-manager.
- Carles worked on check-relations: Continued improving the backend, including importing source package build dependencies to better support analysis of Debian blends. Added support for ignoring packages using regular expressions and source package names in response to user feedback. Used the tool to report 5 new bugs and followed up on previously reported issues.
- Helmut sent a cross build patch on behalf of a customer.
- Helmut uploaded
debvmandguess_concurrencyboth featuring improved reproducibility and documentation. - Helmut continued maintaining rebootstrap and made it correctly
handle binNMUs of
gcc-defaults. Additionally, he poked at existing gcc patches giving answers, rebasing or closing them. - Helmut supported the video team in Hamburg mixing audio.
- Helmut continued to report undeclared file conflicts of various kinds and corresponded with maintainers about them.
- Antonio attended a debate during the Brazil Internet Forum about the impacts of the child protection regulation (ECA Digital) on free software operating systems.
- Antonio worked on Debian CI to improve the system transparency for users. This included listing any pending jobs explicitly in the job lists for each package/architecture/suite page, as well as adding a queue status page that users can check for an estimate of test latency.
- Antonio worked on several Debian CI maintenance tasks,
including but not limited to some monitoring improvements,
replacing usage of fonts-font-awesome with fonts-fork-awesome, and
adding the ability in
debcito configure a global notice (which is being used in Debian CI to point to the system status pages). - Antonio started doing some tests related to the change of
default Debian CI backend from lxc to incus-lxc. This helped
identify an omission in the creation of incus-lxc images. It was
missing dpkg-dev, which caused a few packages that assumed its
presence to fail. In the end, the incus-lxc backend will be fixed
to include dpkg-dev by default in the image, but that uncovered an
undeclared dependency in
gem2deb(Ruby packaging helper) and inruby-byebug, both already fixed in unstable. - Stefano did some minimal work on debian-reimbursements to get it working with current versions of django-allauth.
- May included the discovery of several high-severity Linux kernel root exploits. Stefano updated kernels and rebooted debian.social infrastructure several times.
- Stefano supported the Hamburg miniDebConf’s wafer website during the event, and set up an instance for the 2027 edition too.
- Stefano supported the bursary team issuing bursaries for DebConf 26.
- Stefano uploaded routine updates of
python-pip,pystemmer,snowball-data,snowball(making up a mini, uncoordinated snowball transition),python-authlib,python-discovery,python-installer,python-mitogen,python-pipx,python-cachecontrol,platformdirs, andpython-virtualenv. - Stefano fixed a small number of bugs in
dh-python, culminating in the7.20260524upload. - Thorsten finally managed to upload a new upstream version of
hplip. He also uploaded a new upstream version ofepson-inkjet-printer-escpr. Last but not least with the help of other contributors he could fix bugs inlprng. - Lucas and Santiago contributed significantly to the DebConf 26 Content team; helping to organize the team, review and rate talk proposals.
- Lucas also supported a packaging sprint held in India by rebuilding and publishing the latest results of the Ruby 3.4 transition effort.
- Santiago continued contributing to the efforts to organize DebConf 26, especially supporting the local team with different tasks.
- In collaboration with Emmanuel Arias, Santiago is mentoring
Aryan Karamtoth, a GSoC participant that is working to introduce
linux live-patching support in Debian. The GSoC project started in
May, with community bonding and coding. Santiago reviewed a
merge request to prepare the
clang-extractpackage for debian. clang-extract is one of the building blocks that will help to extract specific functions from large C code, so only relevant code can be patched, without recompiling the whole original basecode. - Anupa assisted Jean-Pierre Giraud with the point release announcements for Debian 13.5 and Debian 12.14.
- Colin backported various security fixes from OpenSSH 10.3 to all supported releases (including LTS and ELTS).
- Colin backported IP quality-of-service fixes to OpenSSH in trixie. The situation there had been unsatisfactory for some time, and upstream reworked their QoS support in OpenSSH 10.1 in a way that typically produces much better results.
- Colin imported new upstream versions of 26 Python packages, and fixed around 25 RC bugs for the Python team.
08:35
New Comic: Empirical
06:21
Urgent: Reject Todd Blanche [Richard Stallman's Political Notes]
US citizens: call on the Senate to Reject Todd Blanche for Attorney General.
US citizens: Join with this campaign to address this issue.
To phone your congresscritter about this, the main switchboard is +1-202-224-3121.
Please spread the word.
Urgent: Expose Supreme Court for playing politics [Richard Stallman's Political Notes]
US citizens: call on the media to expose the Supreme Court for playing politics.
Urgent: Resist bully's air travel shutdown [Richard Stallman's Political Notes]
US citizens: call on the Senate to resist the bully's air travel shutdown, meant to punish cities that won't help the deportation thugs.
US citizens: Join with this campaign to address this issue.
To phone your congresscritter about this, the main switchboard is +1-202-224-3121.
Please spread the word.
Report by Democratic National Committee [Richard Stallman's Political Notes]
The Democratic National Committee commissioned a report about why the Democrats lost the 2024 presidential election, then refused for a long time to release it.
Facing public pressure, the committee released the report, after saying the report was badly flawed for disregarding a very important point: the effect of Democrats' refusal to criticize Israel firmly about Gaza.
It seems that the report was written to avoid that issue. I wonder who decided to write the report that way.
Asylum seekers in the UK [Richard Stallman's Political Notes]
The UK Labour Party, competing to outdo the extreme right-wing in harshness to refugees, plans that each asylee will get a review every 2.5 years — and these reviews will continue for 20 years before the refugee is allowed to remain permanently.
The policy is, I think, meant to drive refugees to seek asylum elsewhere.
Ministry of Truth deleted Jan 6 participants from DOJ site [Richard Stallman's Political Notes]
The Ministry of Truth has deleted from the DOJ web site the information about prosecutions of participants in the bully's Jan 6 attack on the Capitol.
Bullshit generators suggesting changes to faces [Richard Stallman's Political Notes]
Bullshit generators can give users recommendations for what to change in their faces using plastic surgery, but they may be dangerous or foolish.
The recommendations may unreliable, impossible, or injurious, but users become dead set on getting these operations and then may ruin their lives by having them or seeking the funds to have them.
I suspect that calling those programs "bullshit generators" instead of "AI" would help some people turn away from them.
How Europe can defeat Putin's ambitions [Richard Stallman's Political Notes]
Advice on how Europe can defeat Putin's ambitions.
Bossware spreading to more workers [Richard Stallman's Political Notes]
"Bossware", which a company runs to snoop on and send commands to workers, is spreading to control more and more workers.
Bossware is oppressive, of course. On the general level, it is oppressive because it is a nonfree program. More specifically, systems that give orders to people are treating them like machines.
The article bemoans the confusion that comes from using the term "AI" to refer to both bossware and LLMs. That is not the only confusion that comes from the term "AI". Let's reject that term, and use the terms "bossware" and "LLMs" instead.
Second indictment of James Comey [Richard Stallman's Political Notes]
The second indictment of James Comey, after the first prosecution failed, shows the persecutor's determination to hurt his opposition, by hook or by crook.
(satire) ICE ransom of Minnesota [Richard Stallman's Political Notes]
(satire) *ICE Issues Ransom Note Demanding $65 Billion If U.S. Wants To See Minnesota Again.*
Only way out of Iran war [Richard Stallman's Political Notes]
It looks like the would-be bully is coming to recognize that the only way out of his war with Iran is to climb down, accept partial defeat, and draw a pretty face on it. Given the circumstances, that choice is less harmful than any of the other options, but militarist Republicans are enraged.
I am disappointed (though not surprised) that this has done nothing to advance the cause of human rights in Iran, nor even to find out how many dissidents the Islamist fanatics have killed.
Saboteur in chief not acting as constitutional president [Richard Stallman's Political Notes]
Robert Reich argues that the saboteur in chief does not act as a constitutional president, and does not deserve the title of "president".
I agree, but Reich does not suggest what to call him instead.
I have a number of suggestions in the glossary page.
Torture and sexual abuse by Israeli thugs [Richard Stallman's Political Notes]
Australians who were seized by Israel from the Gaza aid flotilla report torture and sexual abuse by Israeli thugs.
Australian PM Albanese pleads ignorance of whether those reports are true, but some of the victims were diagnosed with broken bones from torture. Those should be easy to verify with an x-ray. Even bruises will have been recorded by medics in Turkey and Australia.
Albanese should verify the facts quickly and then act accordingly.
Inadequate medical attention in deportation prisons [Richard Stallman's Political Notes]
Abusive deportation prisons tend to give prisoners totally inadequate medical attention, systematically refusing to examine problems that sometimes turn out to be very dangerous.
This can lead to death, or to a fate worse than death, such as dementia.
US sanctions on ICC members [Richard Stallman's Political Notes]
*Former prosecutor calls for EU statute blocking US sanctions on ICC members.*
Varroa mites immune to chemical to protect bees from them [Richard Stallman's Political Notes]
Varroa mites, which are parasites on bees, have become immune to the chemical that is used to protect bees from them. This could lead to disaster.
Scheme to demoralize Americans about corruption [Richard Stallman's Political Notes]
The corrupter and his capi are now making their corruption totally blatant as a scheme to demoralize Americans who might perceive something wrong about corruption.
06:07
Girl Genius for Monday, June 15, 2026 [Girl Genius]
The Girl Genius comic for Monday, June 15, 2026 has been posted.
05:35
Extracting Money [Ctrl+Alt+Del Comic]
The post Extracting Money appeared first on Ctrl+Alt+Del Comic.
02:42
Dirk Eddelbuettel: rbenchmark 1.0.1 on CRAN: New(ly Adopted) Package! [Planet Debian]
Quick note to share that rbenchmark is back on CRAN! The rbenchmark package makes it easy to benchmark (and compare) simple R expressions.
This package has been on CRAN for many years. At one point fourteen years ago it appeared to be rudderless so I offered help but things realigned. Now it was just tossed off CRAN, taking a number of packages depending on it with it (as shown in this CRANberries skeet listing a set of removed packages) so I offered again to help, and CRAN agreed. So here we are.
So far I just made a number of small ‘editing’ changes, added CI support, and enable dbsr-universe coverage . I do not expect to change the package materially. So far the package has no NEWS file either so maybe glance at the ChangeLog at the git repo.
This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. If you like this or other open-source work I do, you can sponsor me at GitHub. You can also sponsor my Tour de Shore 2026 ride in support of the Maywood Fine Arts Center.
00:14
The world has moved on [Cory Doctorow's craphound.com]
This week on my podcast, I read a recent post from my Pluralistic newsletter, “The World Has Moved On,” which analogizes Stephen King’s Dark Tower series to the Enshittification hypothesis.
In the Dark Tower novels, we crisscross a fallen world in which decay is all around us. The buildings are rotten, the machines have stopped working and no one knows how to fix them, babies and livestock alike are frequently born with deadly congenital defects. Much of the world has fallen into wasteland, cracked and barren. An army of wreckers, led by the demagogue John Farson (who styles himself “The Good Man”) are slowly but surely conquering the land, laying waste to those few remaining outposts of civilization and conscripting the young men in the conquered lands to march on their neighbors.It wasn’t always this way. There was a time when the world was defined by hope and virtue and light, when the machines were fixed and the crops were harvested. Life wasn’t golden – there were still squabbles and sorrows and even wars – but life was good.
And then the world moved on.
For reasons that no one truly understands, the normal push/pull of decay and renewal turned into a one-way, irreversible process in which everything that crumbled or snapped or burned up couldn’t be repaired or replaced or recovered. Our mysterious ability to beat back the Second Law of Thermodynamics – an absurdity we probably should have always treated as an aberration – has collapsed. The world has moved on.
Sunday, 14 June
22:49
Running DOS on the Behringer DDX3216 with a DIY BIOS from scratch [OSnews]
In 1994 I got my first computer: an Intel i486 DX2-66 with 4 MB RAM and a 512MB harddisk. The software was IBMs OS/2 and Microsofts Windows 3.11. In the next four years I was upgrading this machine every few months with more RAM (up to 16MB), a CD-ROM-drive and a soundblaster card. So I learned upgrading this machine, installing new software and finally learned how to program new software using BASIC. But I never got in touch with the boot-process or the details of MS-DOS.
In 2026, 32 years later, I learned from some screenshots of the DDX3216, that Behringer used a real 386 processor within this machine. Immediately, some of my neurons fired in my head and I pondered if I could boot software and even a full operating system on this device. My goal was to learn how an x86-system is booting, how DOS takes over and what is necessary to get into the shell.
↫ Christian Nöding
So this introduction is a bit cryptic if you’re not aware of what a DDX3216 is – I sure had no idea. The Behringer DDX3216 is a digital mixing console for use in music studios, and I think it’s about 25 years old or so. Apparently it’s built around a 386, and as Nöding details in this article, that means it can be made to run DOS. It also happens to have a small black and white LCD, so there’s a place to route output to, as well. Furthermore, once you open it up, you’ll find things like a BIOS chip, PCMCIA slot, a floppy controller, serial/parallel port controller, and more.
Sure sounds like a PC to me.
After talking to companies and individuals who might have a BIOS compatible with the AMD 386 SoC used in the device bore no fruit, Nöding decided to develop his own BIOS, which involves getting all the devices, interfaces, and even the display to work properly as well. The next step was getting DOS to work, and after MS-DOS 6.22 refused to work, FreeDOS did the trick and booted just fine.
There’s still a ton more possible things that can be done here, but this is already quite amazing.
21:56
New top of page image. The official Knicks team picture as champs.
20:28
Gunnar Wolf: Rey Ubu - Carro de Comedias, UNAM [Planet Debian]
Today we went to see a theater play in UNAM’s Cultural Center, very near our home. No, not inside any of the theaters — in the square just between Sala Nezahualcóyotl, Foro Sor Juana and Sala Carlos Chávez.. So, yes, not only we had fun, but we had fun for free!
UNAM’s El Carro de Comedias is an itinerant theater company that often presents in this same spot (but you can see the stage is foldable, and they do have presentations elsewhere, of this same play even). I went with my family, and we enjoyed a very fun adaptation of this great play (written by teenager Alfred Jarry in 1894). One of those plays that could be inspired any day by current geopolitical events…
I know most of the people that happen to stumble upon my blog are not in Mexico City. But if you happen to be here, do consider going to their function. Check their schedule; being it an itinerating show, they can also be found at other places, but they are scheduled at the same place we saw them, every Saturday and Sunday until June 28, 11:00AM. They mentioned they will likely continue during August, but AFAICT it is not confirmed (or, at least, announced) yet.
Some pics, shot randomly by me throughout the play:
17:28
Upcoming Speaking Engagements [Schneier on Security]
This is a current list of where and when I am scheduled to speak:
- I’m giving a keynote at Cybernation 2026 in Berlin, Germany, on June 24, 2026.
- I’m speaking at the Potsdam Conference on National Cybersecurity at the Hasso Plattner Institut in Potsdam, Germany. The event runs June 24–25, 2026, and my talk will be the evening of June 24.
- I’m participating in a panel discussion at the Austrian Institute for International Affairs in Vienna on Thursday, June 25, 2026.
- I’m speaking at the Digital Humanism Conference in Vienna, Austria, on Friday, June 26, 2026.
- I’m giving a fireside chat for Epicenter Works, to be held at Kaffee Alt Wien in Vienna, Austria, on Friday, June 26, 2026.
- I’m participating (via Zoom) in a panel discussion at Quantum.Tech World in Boston, Massachusetts, USA, on Friday, June 26, 2026. The topic is “Q-Day’s Shortening Deadline: Immediate Solutions.”
- I’m speaking at Czech Technical University in Prague, Czechia, on Monday, June 29, 2026.
- I’m speaking at the Nuremberg Digital Festival in Nuremburg, Germany, on Wednesday, July 1, 2026.
- I’m speaking at CanSecWest 2026 in Vancouver, Canada. The conference runs September 30–October 1, 2026; the time of my talk is TBD.
The list is maintained on this page.
17:00
It seems to come earlier every year, doesn’t it?
There may be other things going on today, but if there are, I don’t want to know about them, I’ll just be here with my flag.
Also, congratulations to Knicks fans today, and condolences to Spurs fans.
I think that covers it!
— JS
12:42
Swift at Apple: migrating the TrueType hinting interpreter [OSnews]
TrueType is a widely used vector font standard for rendering text in web pages, PDFs, operating systems, and applications. Familiar fonts like Helvetica, Garamond, and Monaco are all built on TrueType outlines. The format specifies a hinting interpreter intended to help outlines rasterize faithfully on low-resolution displays. Modern high-resolution displays enable beautiful typography from outlines alone, but TrueType fonts that need hinting to render legibly remain in use and we continue to support them.
Font parsers process data from untrusted sources, making the TrueType hinting interpreter a security-critical attack surface. To make the format more resilient on Apple platforms, we rewrote its hinting interpreter from C to memory-safe Swift for the Fall 2025 releases. In addition to memory safety, we also improved performance: on average, our Swift interpreter runs 13% faster than the C interpreter it replaced.
↫ Scott Perry
This article provides a deep dive into how, exactly they did that.