OpenAI Finds 948 Local Privilege Escalation Bugs In The Linux Kernel
OpenAI published a blog post outlining their work on autonomous vulnerability discovery. To showcase their AI potential, they found 948 valid local privilege escalation vulnerabilities within the Linux kernel… ⌘ Read more

@lyse@lyse.isobeef.org Yeah! It was precisely that talk that got me into groff/troff in the first place. 😊 Haven’t seen it in a while. Maybe I should have rewatched it before making that blog post. 😅

The groff syntax is quite alien indeed. Because it’s so terse. I mean, have fun decyphering stuff like that:

\l'\w@\\$1@u\N@45@'

Regarding https://movq.de/blog/postings/2026-10-31/0/POSTING-en.html, @movq@www.uninformativ.de: Despite having watched meillo’s talk on troff and friends¹ over one and a half decades ago (and thus forgotten everything), it feels soooo alien, I’m surprised. I should really look into this myself. I frequently use gq} and gqG. They’re real lifesavers.

¹: https://www.ulm.ccc.de/ccc/chaosseminar/2009_11_troff-and-friends/

Cops Bust Botnet of 1.3 Million Android TV Boxes
A coalition of security firms working with Japan’s National Police Agency has disrupted a botnet of more than 1.3 million Android devices across 200+ countries. “We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology,” the Google Threat Intelligence Group (GTIG) said in a blog po … ⌘ Read more

AerynOS 2026.11 Released With New Installer Option, Other Improvements
AerynOS 2026.11 was released today along with a lengthy blog post highlighting the recent development work on this original Linux distribution… ⌘ Read more

KDE Linux Nearing Its Beta Milestone, Now Ships With NTSYNC By Default
KDE developer Nate Graham published his monthly blog post on Sunday to outline the current state of KDE Linux and some of the changes made to this in-house Linux distribution over the course of October. Additionally, KDE Linux is nearing its beta milestone after beinbg in development for over one year as a reference Linux distribution for KDE… ⌘ Read more

Rocky Linux Creator Built a New ‘Not Linux’ Kernel in 11 Days Using AI
From the blog It’s FOSS

Gregory Kurtzer is no stranger to the Linux world. He created CentOS, and when Red Hat messed it up, he started Rocky Linux as the community replacement. He also co-founded CIQ, the company offering enterprise support around Rocky. His latest project has nothing to do with rebuilding another Linux distro, though … ⌘ Read more

Anthropic Engineer Declares the Coding Interview Dead
An Anthropic engineering manager says he has stopped using traditional coding interviews because AI can now outperform candidates on the kinds of programming challenges they typically contain. “There’s no more point in giving you a little React challenge than there is in quizzing people about assembly; Claude is now better at both,” said Felix Rieseberg in a blog post. “Ou … ⌘ Read more

A Newly Proposed Linux Filesystem Can Fix Corrupted Data
BeamFS creator Aurelien Desbrieres is not calling for a merge, but is requesting feedback on an 18-patch proposal that takes the place of FTRFS, an earlier filesystem he proposed in April.

The Linux/Open Source blog It’s FOSS reports:

Filesystems that can repair damage, like Btrfs and ZFS, usually do it by falling back on a spare copy of the data. BeamFS skip … ⌘ Read more

Google Says Gmail and Photos Data Shared with AI Search Could Be Used for Targeted Ads
The blog Android Authority offers this TLDR:

Google updated its privacy policy to clarify that it could use information shared through Personal Intelligence to personalize ads. Gmail, Drive, and Photos content isn’t used for targeted ads by default, but connecting them to eligible Google services could … ⌘ Read more

Court Agrees with EFF: Utah’s VPN Law Demands a Technical Impossibility
“When state lawmakers attempt to rewrite how the internet works,” argues an EFF blog post, “users rely on courts to recognize that laws can’t make technical impossibilities a reality.”

“That’s why we were happy to see that a court has blocked Utah’s attempt to outlaw the privacy protections of Virtual Private Networks (VPNs).”

In a w … ⌘ Read more

Let’s Encrypt to Cut SSL Certificate Lifetimes to 64 Days in February 2027
Let’s Encrypt “will shorten the default validity period of its TLS certificates from 90 days to 64 days, starting February 10, 2027,” reports the blog Linuxiac:

All certificates issued or renewed from that date will have a 64-day lifespan unless users explicitly select one of the shorter options already available: 45 or six days … ⌘ Read more

Ubuntu 26.10 Will Offer a Rust-based GnuPG Replacement Option
The blog It’s FOSS reports:

You already know that Canonical has been selectively replacing Ubuntu’s C-based system components with Rust-written equivalents that don’t compromise in terms of functionality, most of the time. Now it looks like the distro’s OpenPGP implementation is next, with Sequoia PGP coming preinstalled in Ubuntu 26.10. Canonical wan … ⌘ Read more

It’s basically what my own blob is too 😅 – The thing is though, if you see @lyse@lyse.isobeef.org’s posts, they get pretty long, there really isn’t any limit to the length of posts you can make in your Twtxt feed in the first place Haha 🤣

@zyak@twtxt.z85b.xyz Folder of text files with auto-generated index by the webserver, yeah, that comes close. Like meillo’s blogs: https://marmaro.de/lue/ https://marmaro.de/apov/

@david@daiwei.me I use OpenBSD’s smtpd, which was super easy to set up. It gets a little bit more complicated these days because you also need a DKIM setup, so every outgoing mail goes from smtpd to dkimproxy and back to smtpd. And then dovecot for POP3/IMAP (has basically nothing to do with the other two).

I’m cheating a bit, though: I use config management on top, which means that all the UNIX users and mailboxes and directories are created by that. If you were to do that manually, it would be a huge pain.

Maybe I’ll write a blog post about this some day, just for fun. 🤔

JMAP? Never heard of it.

https://movq.de/blog/postings/2026-10-08/0/POSTING-en.html @movq@www.uninformativ.de Fuck me dead and bury me pregnant!

Chrome 155 Ships Decoding Support For JPEG XL
Google has released Chrome 155 with support for decoding JPEG XL images, a format that offers 30-50% better compression than JPEG along with lossless compression, JPEG transcoding, HDR, animation, and progressive decoding. From a blog post: We expect that JPEG XL is most helpful for high-fidelity or lossless compression, especially of photographic images or in cases in which fine-grained p … ⌘ Read more

Someone Got Doom In an SQL Database
An anonymous reader quotes a report from Ars Technica: Rendering Doom in a database is obviously a bad idea,” Lukas Vogel writes in a lengthy blog post explaining how exactly he managed to render Doom using an SQL database. OK, that’s not entirely accurate. The SQLDoom project uses a small Python client to handle input and output, drive the game’s timing, and display each frame to the screen. Behi … ⌘ Read more

OpenAI Alerts More Than 100 Groups About Rogue AI Agent Activity
An anonymous reader quotes a report from Reuters: OpenAI has informed more than 100 organizations about incidents involving unauthorized activity tied to its AI agents, according to a blog post by the ChatGPT maker, as AI labs face mounting scrutiny over rogue AI agent activity. Here are some other details:
- The Sam Altman-led company has been c … ⌘ Read more

@itsericwoodward@itsericwoodward.com I’m not a hardcore OS/2 fan, either, but it does spark a great deal of nostalgia for me. 😍 For example: https://movq.de/blog/postings/2024-12-25/0/POSTING-en.html

@lyse@lyse.isobeef.org

Crazy, who comes up with things like that?

I didn’t come up with it, but I was close, I guess. DOS is so small, you don’t have much of a choice but to search for “anything related to time”. There aren’t that many syscalls/functions. You’ll quickly notice that there’s no global tick counter. So what else is there? Hmm, “get the mtime of a file” is pretty much the only other time-related thing. And which file is “stable”, probably allocated just once at boot? Mark Aitchison tried to use NUL, which is a pretty good idea. Thinking about it in retrospect, stdin does indeed make more sense, though, because that object really does get allocated just once at “boot” and then it stays the same. That’s not guaranteed for NUL (although just as likely).

But, it is possible in DOS to move “the console” to a serial port:

I wonder what that does to my little uptime program. :-)

Today, I also learned that -R is an alias for -r in rm.

Ah, I remember that. Dug it up and saved it in the blog: -R is more portable/consistent: http://movq.de/blog/postings/2026-09-30/0/POSTING-en.html

“Toolpak” Being Devised By GNOME OS Developers, Akin To Flatpak For Tools
GNOME developer Jordan Petridis published a blog post today to introduce the world to the Toolpak plans for GNOME OS… ⌘ Read more

AI Finds So Many Linux Bugs, Canonical Changes to a Two-Week Stable Release Update Cycle
“Finding vulnerabilities faster also puts pressure on Linux distributions to fix and deliver patches faster,” writes Slashdot reader BrianFagioli

AI has transformed bug discovery from “a manual, time-intensive process into a highly automated engine,” notes Canonical’s blog, leading to a “recent expl … ⌘ Read more

That was an interesting read about C:

https://pikuma.com/blog/c-integer-sizes-not-a-mistake

Oh, and only 29 clients have requested the actual image:

29 movq.de/blog/postings/2026-09-25/0/bine-initial.png

Assuming that that’s an actual human being who’s interested in the content, then it’d be less than 1% of the hits that I get.

I’d estimate that ~90% of the traffic I get is some kind of non-human / non-browser thing.

Here are some numbers on the recent blog post:

3804 movq.de/blog/postings/2026-09-25/0/POSTING-en.html
 404 movq.de/blog/postings/2026-09-25/0/t/bine-initial.png.jpg

The HTML page is obviously the blog post itself. The image is the thumbnail of the “opener” image: That’s the thing that you’re pretty much guaranteed to see when you open the post in a browser.

But out of the 3800 hits on the HTML page, only 400 (~10%) are also requesting that image.

So … it’s ~90% noise, right?

Microsoft Helps Take Down Massive Automated, AI-Powered Phishing-as-a-Service Platform
Microsoft’s security blog describes the fight against a new “AI-powered cybercrime platform” offering phishing-as-a-service, with AI-tailored lures and analyses of compromised inboxes (to identify high-value targets). The site compromised more than 12,000 inboxes in over 10,000 organizations around the wo … ⌘ Read more

Google Opens Preorders for Its $899 Gemini-Enhanced ‘Googlebook’ Laptops
Monday Google opened preorders for its “Googlebook” laptops, pricing them at $899. A Google’s blog post added that “At launch, you can choose between Intel Core Ultra Series 3 and Snapdragon X Elite processors” (paired with NPUs to power AI features).

“Devices will hit shelves on October 4 in the U.S. and on October 5 in Canada, the … ⌘ Read more

Developer Abandons ‘PS5 Linux’ Project After Sony Patches AI-Discovered Exploit
“In April this year, we saw Andy Nguyen turning the PS5 into a Linux-powered gaming PC,”
writes the blog It’s FOSS.

It ran Steam games and emulators using the PS5’s on-board hardware. But this week Andy announced he’s “stopping all my work on PS5 Linux” and “stepping away from the PS5 scene.”
stopping work on porting … ⌘ Read more

Firefox Touts Lower CPU Use for Large JPEGs, Faster PDF Viewer Startup (and AI Controls)
Firefox 156 is the second release since Mozilla moved to a twice-monthly release schedule, and the blog OMG Ubuntu notes it has faster start-up times for its built-in PDF viewer and also lower CPU usage when viewing large JPEG images:

In Firefox 156, the browser now uses libjpeg-turbo’s IDCT scaling t … ⌘ Read more

Ubuntu’s ‘Rust-ification’ Hits New Milestone: Coreutils Migration is Complete
“Ubuntu has managed to do away with GNU Core Utilities in its default stack,” reports the blog It’s FOSS.

The last three utilities — cp, mv and rm — have been moved to versions from the uutils project (which reimplements utilities in Rust).

Everything else, from ls and cat to chmod and du, made that jump in earlier release … ⌘ Read more

Does Brave Browser Load Faster Than Chrome, Firefox, and Microsoft Edge?
The Brave web browser published a new round of benchmarks claiming its desktop browser uses less system resources than Chrome, Microsoft Edge, and Firefox — and also loads pages faster.
The blog Linuxiac reports:

According to Brave’s testing, the browser used 44% less CPU, 28% less memory, and 10% less energy on average compared wit … ⌘ Read more

Switzerland’s Federal Government Tests Open-Source Alternatives to Microsoft on 3,000 Computers
Switzerland has a population of 9,154,242. And its federal government just launched a pilot program to test open source alternatives to Microsoft 365 on 3,000 workstations, reports the blog It’s FOSS. “That’s about 7% of the federal workforce.”

The target is to complete the migration by … ⌘ Read more

A Man Charged His EV at a Dealership - and Was Billed $418
The EV blog Electrek reports:

A Clinton Township, Michigan man was charged $418 for a single EV charging session at Elder Hyundai’s Macomb Township store after finding the charger listed as publicly available on the EVgo app, but didn’t discover the charges until after wrapping up his 40-ish minute charging session. “I was flabbergasted,” explained Stanle … ⌘ Read more

TiVo Will Start Charging Fees For Its Automatic Commercial Break-Skipping Feature ‘SkipMode’
TiVo is notifying customers about changes to “one of its longest-standing and most popular DVR features,” reports the blog Cord Cutter News:

Starting November 2, 2026, the current version of SkipMode that allows users to jump over commercial breaks with a single button press on the r … ⌘ Read more

To Promote Grand Theft Auto 6, Mayor Might Transform Miami into ‘Vice City’
Rockstar Games and the mayor of Miami-Dade county are discussing a joint marketing campaign transforming parts of the county to look like areas from Grand Theft Auto 6, reports the blog Rock Paper Shotgun:

The proposed publicity event would include “an immersive arrival experience” at Miami International Airport. with signs f … ⌘ Read more

“Yes, no AI is now a feature” - LibreOffice / The Document Foundation
Something I found interesting that deserved a write-up this morning is the blog post from LibreOffice / The Document Foundation on no AI being a feature.

Image

Read the full article on GamingOnLinux. ⌘ Read more

3mdeb Enhancing The UEFI Update Capsules Experience For Open-Source Firmware
Open-source firmware consulting firm 3mdeb is out with a new blog post highlighting their recent work on enhancing the UEFI update capsules experience for open-source firmware with Coreboot and their downstream Dasharo offerings… ⌘ Read more

California’s Age Verification Bill Passes with Linux Exemption Intact
California’s age-verification bill has passed in its legislature — but with its open-source carve-out intact, reports the blog Linuxiac:

Back in May, we reported that California lawmakers amended Assembly Bill 1856 to carve open-source operating systems out of the state’s upcoming age verification requirements. Three months later, that e … ⌘ Read more

OpenAI To Cut Off AI Models For SpaceX-owned Cursor
“OpenAI said on Friday that it plans to stop providing AI models to Cursor, the coding-tool company now owned by Elon Musk’s SpaceX,” reports Reuters:

“We are making this choice because we cannot be confident that SpaceX will use our technology within our terms of service, based on our experience with Elon Musk’s companies violating contracts,” OpenAI said in a blog post… H … ⌘ Read more

Amazon’s HR Lead Uses AI Tool to Write 100,000 Lines of Code - 25 Years After She Last Coded
In an Amazon News blog post, their HR leader describes using AI to write 100,000 lines of code — 25 years after she last coded. “Do you know how empowering it is to realize that after 25 years away from coding, you can actually build again?” First she built a calendar app for her family, … ⌘ Read more

Multikernel Linux Tree Released: Runs Multiple Kernels On Bare Metal Without a Hypervisor
“Multikernel Technologies has put out mklinux v7.0-mk2, the first public release of the multikernel Linux tree it’s been building since last year,” reports the blog It’s FOSS:

The basic premise of the project is that one physical server can run several independent Linux kernels side by side, each … ⌘ Read more

KDE Remote Desktop Experience Improving For Closing The X11 vs. Wayland Gap
KDE developer David Edmundson is out today with a blog post around improvements that have been ongoing for the Plasma 6.8 release in improving the KDE remote desktop experience. As part of ensuring a good Wayland experience and hitting all the needs fulfilled by X11, Plasma 6.8 is seeing improvements for its remote desktop functionality… ⌘ Read more

AliExpress Leverages User Audio Systems For Fingerprinting
A developer says AliExpress is using the browser’s WebAudio API to help fingerprint users by playing inaudible audio and measuring tiny differences in how their devices process it. CyberNews reports: The developer, “laserphile,” wrote on their blog that they recently ran into some weird issues with their Bluetooth headphones. They couldn’t play music via thei … ⌘ Read more

23 Years After SimCity 4’s Release, ‘Eternal Commuter’ Bug Finally Fixed
“It began life just a year after SimCity 4’s 2003 launch,” writes the blog PCGamesN. “Now, over 20 years later, it’s still going strong with the arrival of Network Addon Mod update 50.”

The SimCity 4 Network Addon Mod, or simply ‘NAM’ among the community, has long been a de facto recommendation to anyone looking to pick up the class … ⌘ Read more

Canonical is Funding a PhD to Automate C to Rust Translation
An anonymous reader shared this report from the blog It’s FOSS:

Canonical has committed funding to a three-year PhD project focused on building a system that can automatically translate large C codebases into Rust. And they are not alone; UK Research and Innovation is matching their funding for the project, which is set to run through the Universi … ⌘ Read more

Debian is Voting on Whether to Allow AI-Assisted Contributions
Debian developers are voting on whether to ban AI-assisted contributions, reports the blog Linuxiac, with a ballot listing eight proposals and a “None of the above” option.

The first one is still the original proposal to ban LLM-assisted contributions by changing the Debian Social Contract. This would stop generative AI from being used for direct D … ⌘ Read more

@movq@www.uninformativ.de https://movq.de/blog/postings/2026-08-05/0/POSTING-en.html Very interesting! I basically never analyze binary files, but this were some great thoughts on that subject. I hope to remember them when I find myself in the situation to look at binaries more closely.

@movq@www.uninformativ.de Regarding https://movq.de/blog/postings/2026-08-16/0/POSTING-en.html, how often do you edit the first commit? A good mate does the same for at least a whole decade, probably more. I never found myself in this situation. Even though I mess with commits on a daily basis. Just never the first one so far. 8-)