Alvaro Lopez Ortega / 2026-11-07 Briefing

Created Sat, 07 Nov 2026 15:49:54 +0000 Modified Sat, 07 Nov 2026 15:50:39 +0000
3224 Words

Asahi Linux is moving repos to GPLv2-or-later, citing MIT-license abuse, and reports M3 support GA, DCP/Thunderbolt gains, and M5 Exclaves hurdles. Poettering et al. unveiled Amutable Foundations: immutable, bit-identical Fedora-based OS images plus fleet control. Security researchers warn Rails, Spring, and Jetty trust client-supplied Forwarded headers by default, allowing IP/host spoofing.

🐧 Linux & Open Source

Asahi Linux 7.3 Progress Report

Asahi Linux is moving its repositories to GPLv2-or-later, citing bad-faith attempts to exploit its MIT licensing, while its Linux 7.3 report details continued upstreaming of the macaudio and AVD drivers, initial Devicetrees for M4 Pro/Max and M5, and a shift toward upstream-first development. M3 support is now generally available without the EXPERT flag, DCP enablement improves performance, battery life, sleep, and notch-area use, Thunderbolt support is under kernel review, and SPTM-enabled macOS virtualization in m1n1 aids reverse engineering, though M5 introduces Exclaves-related challenges. Gaming is becoming more viable on M1/M2 via EX and Wine but remains patchy for recent titles, while M3 GPU acceleration is still missing and driver work has only reached rendering a triangle.

Automake 1.20 Brings New Features, Desires To Re-Establish GNU As Leading Build System

GNU Automake 1.20 has been released with new features including a --enable-jobserver option, a delete-on-error option, a print-distfiles target, and various bug fixes. The release also switches Automake from GPLv2-or-later to GPLv3-or-later, aligning it with Autoconf and FSF recommendations. The maintainer expressed a desire to re-establish the GNU build system as the leading choice for new software projects, though CMake and Meson adoption poses a challenge.

HyprBSD Provides Wayland-Based Desktop Built Atop FreeBSD, Complete With Steam Gaming

HyprBSD is a new FreeBSD-based desktop distribution offering a Wayland desktop built on the Hyprland compositor, with a graphical installer and support for AMD, Intel, and NVIDIA graphics. Based on FreeBSD 15.1-RELEASE, it uses FreeBSD’s Linux compatibility layer to run Steam and a range of games, including some BattlEye-protected titles, and is currently in release-candidate form.

Kmorph Aims To Provide Rebootless Linux Kernel Crash Recovery

Kmorph is a new open-source project aiming to provide rebootless Linux kernel crash recovery using out-of-tree Multikernel technology. It can recover important services such as Nginx in as little as about two seconds by switching to a standby fallback kernel. The project does not currently work on the mainline Linux kernel, and wider adoption depends on Multikernel being upstreamed.

KDE Plasma 6.9 Will Stop Leaking Memory When Right Clicking Files/Folders On Desktop

KDE developers are working toward Plasma 6.9, which will fix a small memory leak that occurs each time users right-click files or folders on the desktop. The update also includes configurable on-screen display pop-up positions, KDE-style systemd password prompts, Glide browser integration, and better desktop widget sizing. Plasma 6.8.3 will include a KWin crash fix for DisplayLink-connected screens.

Vulkan 1.4.368 Released With New Extensions From Valve & NVIDIA

Vulkan 1.4.368 is a small weekly spec update that resolves six internally raised issues and adds two new extensions. Valve’s VK_EXT_vertex_address_binding_unrestricted addresses vertex attribute updates and address validation, while NVIDIA’s VK_NV_internal_handle lets applications obtain opaque driver handles for certain Vulkan objects and pass them to external NVIDIA-focused APIs.

Microsoft’s Azure Linux 3.0.2022 Ships With More Than 470 Security Fixes

Microsoft released Azure Linux 3.0.2022, its in-house Linux distribution, with more than 470 security fixes for various CVEs across open-source projects and Azure components. The update also includes new Dockerfiles, an OpenVMM patch for confidential support, and several bug fixes.

Running a law firm on Free software

The article provides a 2026 update on running the small English law firm decoded.legal using Free software on both client and server sides. The author says his setup is largely unchanged, detailing continued use of Debian/GNOME on a ThinkPad, Thunderbird and mutt for email, LibreOffice plus pandoc/typst for documents, reveal.js for presentations, and Firefox. He also notes hardware problems with the laptop’s USB-C/Thunderbolt ports and some minor software annoyances.

Windows takes a break at UK motorway services

The article reports that Windows suffered an outage at UK motorway services, disrupting operations. It notes that neither bad drivers nor faulty operating-system software is ideal.

🌐 Web & Dev Tools

Amutable Foundations Technical Overview

Lennart Poettering, Michael Vogt, and Joaquim Rocha published a technical overview of Amutable Foundations, comprising Amutable OS (AOS) and the Amutable Control Plane (ACP). AOS is an image-based Linux OS built from Fedora packages into immutable, bit-identical disk images assembled at build time rather than installed on deployed systems, eliminating drift and improving reproducibility, integrity, and testability; it enforces strict security defaults such as no shell, SSH, or language interpreters by default and activates only signed images, while systems merge typically fewer than five coarse images and split large or specific components into system extensions. ACP tracks, controls, updates, and verifies fleets of AOS installations.

Just how far can the FOR UPDATE SKIP LOCKED Postgres queue go?

The article benchmarks a Postgres-backed job queue using FOR UPDATE SKIP LOCKED on a 1-CPU instance. With 64 workers each using its own connection, throughput peaked around 375 jobs/s and CPU saturated before the default 100-connection limit. Using a shared pool of 20 connections let 128 workers reach about 650 jobs/s.

Meridian — an experimental web browser built on Servo and GPUI

Meridian is an experimental macOS web browser built in Rust on GPUI and Servo, useful for sites that rely less on JavaScript and complex layout features. It is highly configurable across fonts, keybinds, colors, and tabs, and can be tried via nix. The project is developed on Tangled and welcomes contributions, with open issues available for prospective contributors.

Two Dimensional Version Control

The author experimented with two-dimensional version control while following a 14-chapter roguelike tutorial, aiming to track both their own coding changes and the changes readers should make per chapter. Using the Jujutsu version control system instead of manual Git branches, they could edit earlier chapters and automatically propagate changes forward or backward across chapter histories. The process involved resolving occasional merge conflicts and cleaning up inconsistencies, but Jujutsu made commits feel editable rather than fixed.

Need for Speed Underground 2 online in the browser

The text explains how to manage game saves and cloud sync, edit settings and mods, and configure touch, keyboard, and controller controls. It lists key bindings for driving actions, camera, chat, and menus. It also covers touch-control display, thumb steering, and fullscreen/menu options.

Bong: DuckDuckGo bang alternative, open-source and self-hosted

Bong is an open-source, self-hosted alternative to DuckDuckGo bangs that offers 61 shortcuts for quickly searching or navigating to sites and services. The listed shortcuts cover destinations including Google, GitHub, YouTube, Naver, ChatGPT, Claude, Reddit, and various documentation and shopping sites.

Implementing GPT-2 in CSS

The author implemented GPT-2 inference entirely in CSS, avoiding JavaScript/WASM and using CSS math plus variable font files for matrix multiplication. The 124M-parameter model runs at roughly 15 seconds per token, with the stylesheets generated ahead of time in Python. The project required hundreds of experiments to reproduce transformer operations like LayerNorm, softmax, and attention in CSS.

🤖 AI & Models

How are you dealing with all the negative side effects of AI on the web?

The author argues that AI hype has degraded the web by pushing low-quality search results to the top, making LLM summaries seem acceptable mainly because they surface good links now buried lower. They also cite aggressive search-engine rate limiting and login/Anubis barriers on GitHub as frustrating ordinary browsing and reducing productivity.

Nasscom’s Nambiar warns AI may hurt new Indian engineering grads’ jobs, urges CS curriculum overhaul

Nasscom President Rajesh Nambiar warned that AI-driven automation of entry-level coding and software testing could make it harder for recent Indian engineering graduates to find tech jobs. He urged an immediate overhaul of computer science curricula to equip graduates with new skills.

Meta rolls out Muse Wonder-trained models with Active Memory and Focus for Muse/Meta AI users

Meta is rolling out specialized versions of its existing models, trained using its frontier Muse Wonder model, to all Muse and Meta AI users while reserving Wonder itself for subscribers’ harder tasks. The new models include Active Memory and Active Focus; Meta says Active Memory improves use of critical context to 90% of tasks from 76% previously, while Active Focus helps agents keep working when problems arise.

I don’t care if web content is AI-generated

The author argues that common objections to AI-generated web content—inaccuracy, inauthenticity, and hidden authorship—also apply to much human-generated content, including misinformation and “human slop.” While he understands unease about AI-written stories presented as factual, he questions why AI authorship matters for fiction, since fiction is inherently inauthentic regardless of who writes it.

Inter-AI Morality: How AI Systems Treat One Another [pdf]

The PDF “Inter-AI Morality: How AI Systems Treat One Another” examines the moral dimensions of interactions among artificial intelligence systems. It focuses on how AI systems treat one another.

The Components of Agent Memory

The article explores how AI agents can manage memory by analogy to human memory, separating fast encoding of experiences from offline consolidation. It describes “dreaming” or sleep-time compute, in which agents use idle time to reflect on logs, fix mistakes, and produce memory notes or representations. It also examines tagging salient events and frames memory as a prediction about what future sessions will need, while evaluating each component’s role in memory organization.

Brave Sells Its Search Index to AI, and Your Website Is Probably in It

The New York Times sued Brave on Nov. 2, alleging it copied more than 30 billion webpages without identifying its crawler or letting site owners block it, then sold that content to AI companies. Brave sells access to its search index through its Search API, which it says is used by AI firms including Cohere, Mistral, Perplexity, and You.com; Brave has not yet responded to the claims. Because Brave’s crawler does not advertise a distinct user agent and instead follows Googlebot’s rules, websites cannot block Brave without also blocking Google, the article says.

Fireworks says you’re wasting money on AI unless you’re using all the models

Fireworks argues that organizations waste money on AI if they rely on a single model instead of using multiple models. It advocates managed inference that automatically routes each query to the most suitable model for the job.

🔐 Security & Privacy

Forwarded Without Question: How Web Frameworks Overtrust the Forwarded Header

Web frameworks including Rails, Spring, and Jetty read the Forwarded header by default, while most reverse proxies and CDNs do not modify it, allowing untrusted client-supplied values to pass through and be trusted by applications. This can enable client IP and hostname spoofing, so proxies and applications should agree on trusted headers and proxies should drop untrusted forwarding headers.

Censys: 800+ exposed ARTEX, Chinese AI-powered open-source pentest tied to cyberattacks since July

Censys identified more than 800 publicly exposed deployments of Artex, a Chinese-made open-source AI penetration-testing tool, many accessible without a password. Artex has been linked to several cyberattacks since its July release, including campaigns attributed to Chinese-speaking hackers. The exposure raises concerns that misconfigured instances could be found and misused by outsiders.

Every Mac comes with an (undocumented) family member classifier

A security analysis reports that every Mac since macOS 13 runs undocumented daemons that build an on-device Personal Knowledge Graph from Contacts, Calendar, Photos, Messages, Mail, location, Screen Time, and behavioral signals, mapping who users know, how people are related, and how and when they communicate and move. The graph is reportedly a queryable store used by LLMs, and the researchers released an open-source dashboard called iKnow so users can inspect their own graph. The post says documentation is scarce and highlights privacy implications.

NHS breach helpline left staff carrying a ‘significant emotional burden’

A review found that NHS staff at Royal Cornwall Hospitals NHS Trust were given a day’s notice before staffing a helpline after a data breach affecting 8,003 people, where they faced distressed and angry callers and had to make safeguarding decisions without training or an established process. Staff reported little preparation or support, with some learning their own data had been exposed while working the helpline, placing a significant emotional burden on them. The helpline was planned to run for two weeks in December 2025 but lasted 11 weeks until February 2026 due to call volume.

🚀 Startups & Hardware

Tablet shipments drop 23% to 32M in Q3 2026, 3-year low; iPad down 27.5% to 11.58M

Global tablet shipments fell 23% year-over-year to 32 million units in Q3 2026, the lowest level in nearly three years, according to Omdia. Apple’s iPad shipments declined 27.5% year-over-year to about 11.58 million units.

Shenzhen clears illicit chip and iPhone markets ahead of APEC summit

Shenzhen is clearing out illicit markets for smuggled chips and stolen iPhones as it prepares to host the APEC summit. The city, home to major tech giants, is taking action ahead of the gathering of international leaders.

Axon invests $1.2B in Skydio at $5.2B valuation; drones used by police, military, allies

Axon has invested $1.2 billion in US drone manufacturer Skydio at a $5.2 billion pre-money valuation after the companies rejected an acquisition. The deal gives Axon a minority stake and strengthens an exclusive public safety partnership; Skydio’s autonomous drones are used by public safety agencies, the US military, and 32 allied nations.

Beijing AI video startup Sand.ai raises $200M Series A+, total $300M in 10 months

Beijing-based video-generation AI startup Sand.ai raised $200 million in a Series A+ round, reaching a valuation above $1 billion and bringing its total funding over the past 10 months to $300 million. The round was led by CoStone Capital and Wangsu Science & Technology, with participation from state-backed and existing investors. Sand.ai plans to use the capital for video foundation model R&D, inference infrastructure, product iteration, and global expansion.

CesiumAstro raises $730M at $4.5B+ valuation for 737-satellite LEO network

CesiumAstro raised $730 million in a Series D led by Janus Henderson at a valuation above $4.5 billion, bringing its total funding to $1.4 billion. The Austin-based satellite manufacturer plans to use the capital to build a 737-satellite low-Earth-orbit communications network at two altitudes for businesses and governments.

The $8 Linux Computer (2022)

The Ox64 is an $8 RISC-V computer capable of running Linux on three different cores, despite resembling a microcontroller. At the time of writing, Ethernet, Wi-Fi, and SD-card support were nonfunctional, and setup required nontrivial UART programming, an RP2040 serial bridge, and modifications to the flashing tool.

I Toured Unitree’s Factory. I’m More Bullish on the West

A tour of Unitree’s Hangzhou factory found that its robot production remains largely manual, with little machinery relative to output and labor at only 8% of unit cost, limiting the savings automation can deliver. Most of Unitree’s humanoid revenue still comes from research and education rather than factories, and the company expects robots’ “ChatGPT moment” to be years away. The author argues this gap leaves room for Western companies to lead in the automated systems that will build future robots.

🔬 Science & Society

A barbarian tribe’s mythic origin story is true, ancient DNA reveals

Ancient DNA from Lombard burials supports the tribe’s traditional origin story, indicating that the Lombards had Scandinavian-related ancestry before migrating south into Europe. The genetic evidence suggests their myth of a northern homeland was grounded in real population history, though the migrating group was genetically diverse.

Did prediction markets do any predicting this midterms?

Prediction markets performed no better than polls or Nate Silver’s FLIPR model in the midterms, especially in close or flipped races, according to the article. It suggests treating prediction markets as entertainment rather than a superior forecasting tool and taxing their ads.

Lighting the Skies

The article argues that radar, though less dramatic than the atomic bomb, likely had a greater impact on World War II’s outcome, while nuclear weapons’ significance is often overstated because they arrived late in the war. It then examines searchlights as another battlefield-changing technology, tracing their use from the 1870 siege of Paris to modern car lots and their roots in early electric arc lighting.

Organic farm in Switzerland is growing blueberries beneath 5,220 solar panels

Swiss blueberry farmer Olivier Pichonnat installed Switzerland’s largest agrivoltaic project—5,220 solar panels about 10.5 feet above 4,500 bushes on 4.4 acres—after repeated crop losses from frost, rain, hail, drought, and heat. The project was delayed by restrictive Swiss planning rules, but initial results suggest the panels extended growing conditions, protected bush health, and may have improved the harvest after only one summer.