Agreguesi i feed

Guadec happened. It was a extremely well organized event, with plenty of good talk, people that I was longing to see again, and new faces to put a name on.

My experience was however very much soured by interactions with other people within the community, against myself and other members of the community. To the point that I had to take the time to relieve the distress it has caused me, hence the time it took me to write this down.

The mobile shell initiative

The development for a “mobile” GNOME Shell started somewhere around 2022, and at least the supporting parts of it passed as a project sponsored by the first and only round of GNOME projects sponsored by Germany’s Sovereign Tech Fund, as “Increase Range and Quality of Hardware Support”, this was acknowledged in the final STF report.

Making GNOME Shell behave natively on a new form factor is a massive undertaking, and the planning was not sufficient. The first, most glaring mistake was to drive this project from the start with minimal involvement from the existing project maintainers. No consultation happened at any point in planning, not just to ensure the goals were in scope, but also to ensure the project is stewarded towards a point that everyone can walk away with a sense of completion.

The second biggest mistake was in planning for upstreaming, instead the work piled up on a branch in a personal repository.

To be fair, the supporting bits got merged over time, and there’s got to be some breathing room for new initiatives. But sooner or later there’s the harsh reality that the work has to be divided into tractable pieces and pushed in a structured manner through the review process, in order to end up with the work merged upstream.

The Mutter low level pieces were merged over the course of 1 year after the STF project, divided in 3 (1 2 3) merge requests, and some of the corresponding GNOME Shell changes to make use of this (no longer) new infrastructure were merged as well.

But meanwhile the mobile-shell branch kept piling on, north of 300 patches, with substantial changes to code (diff is +120437 -7156, by my accounting) and UI. The original author did not make attempts to upstream the changes, and the few efforts from other participants to upstream bits of it or as a whole did not last long, unfortunately. The work is nowadays sitting on its separate repository, using a separate issue tracker.

The mobile BoF at Guadec

This jagged interaction between the people acting as maintainers and the people driving the mobile-shell initiative lead to difficulties in making this work upstreamed in a timely fashion, much to everyone’s disappointment. In this situation, we arrive to this year’s Guadec. There is of course an interest in upstreaming the changes, from Mutter+Shell core developers and maintainers included, so we attend this BoF.

What happened there could be best described as a maintainer shaming session, specifically towards Jonas Adahl, Florian Müllner and myself, for “discriminating/demotivating newcomers”, “wanting to steal the spotlight”, “stalling things on purpose”, … essentially choosing slander as a way to put the blame on us for not having merged the work as-is. Even though this attack was driven by a few closely related to the initiative, it happened in front of 20+ people.

This was not ok

Even though I understand the frustration behind, I find the tactics used on us inexcusable.

Look, the community guidelines at conduct.gnome.org are a bar to meet for everyone, towards everyone. And the guiding principle of them all is pretty simple, we all row the boat roughly in the same direction. Once the basic principles of respect are lost between us, the boat does sink. The main asset that keeps Free Software moving forward is not the code, but the people.

Jonas, Florian and myself are lucky to be paid by our employer to work upstream on GNOME, but I can say for myself (and perhaps the three of us) that I work at Red Hat because I work on GNOME, rather than the other way around. We go well beyond our duties, in ways our employer does not care in the slightest if we do, and in ways it consumes our free time as well. We have looked to nurture the community, mentoring in GSoC and Outreachy more times than it’s worth counting. The accusations of discrimination fall entirely flat.

We so far had no trouble in collaborating with the main developer behind the mobile shell work either, there’s 226 merge requests merged from him in GNOME Shell and 151 in Mutter attesting that.

This strain on relationships is not baggage free. I don’t see myself working with the individuals that drove this attack pretty much anymore with any productive outcomes, and I will avoid that to the extent of my capabilities. There is an unbelievably long road to undo the damage they’ve done.

How to improve from here

The mobile fork is currently sitting in a separate repository, based on a now old release, and contains a number of back-and-forths, FIXMEs, WIPs, and code that has been either already done (albeit differently) or entirely refurbished upstream.

A rebase that is mindful to all these and brings the branch to a plausible up-to-date state is likely to take days to weeks. At this point, it could make more sense to identify the possible topics to split into multiple (many) merge requests, and cherry-pick the patches individually.

After these merge requests are done, they should go through review, and the style/architectural differences between the original author and the maintainers’ mindset be settled. Changes could be merged incrementally, advancing towards the common end goal.

It looks like I just described the software review process in a nutshell, and I very much did! But I feel it is important to point out that nothing of this has happened yet with these patches in a proper or substantial way.

In a shred of constructivism during the Mobile BoF, Markus Göllnitz offered himself to do this on behalf of the original author. I am looking forward for these steps to happen, and will collaborate with Markus on it.

I deep down hope that this blog post also serves as a cautionary tale about how wanting to rock the boat instead of rowing together may stall initiatives, and eventually poison relationships.

Andreas Gabriel Berbescu has reported several root privilege escalation vulnerabilities in various NetworkManager VPN plugins. If the VPN plugin is installed, then an unprivileged user can escalate to root by loading a malicious VPN configuration file:

• (CVE-2026-91837) network-manager-iodine: Option confusion reaches iodine’s pre-drop root shell
• (CVE-2026-91838) network-manager-sstp profile data reaches root pppd pty shell
• (CVE-2026-91839) NetworkManager-fortisslvpn credential newline injection permits local root code execution
• (CVE-2026-91840) NetworkManager-vpnc: Top-level VPN username newline injection reaches a root password helper
• (CVE-2026-91841) NetworkManager-vpnc: Incomplete fix of CVE-2018-10900

While most obviously bad for multi-user systems, root privilege escalation is also a serious defense in depth problem for single user systems. You are vulnerable if you have the VPN plugin installed; it does not matter whether you actually use it or not.

These are not vulnerabilities in NetworkManager itself. The VPN plugins are each separate projects, with their own separate maintainers, hosted by GNOME rather than by freedesktop.org. The status of each project is a little different:

• The NetworkManager-vpnc and Network-Manager-fortisslvpn git repos have both been archived. Contributions are no longer accepted, and you should uninstall them immediately. NetworkManager-vpnc users should migrate to NetworkManager-libreswan, and NetworkManager-fortisslvpn users should migrate to NetworkManager-openconnect.
• network-manager-sstp is currently unmaintained, but it is not obsolete. If you are interested in SSTP, this project needs a new maintainer.
• network-manager-iodine is maintained, and the maintainer has created a merge request to resolve this issue.

For more information on NetworkManager VPN plugins, see Josephine’s VPN plugin overview and announcement.

The New York Post wrote that OpenAI "stunned the mathematics world" last week when it announced its AI model "cracked a legendary math problem left unsolved for nearly a century in just 88 hours." But a New York University professor "has come forward alleging OpenAI may have copied his work after asking him to collaborate — with one of the company's scientists allegedly warning he might 'ruin his career' if he refused." [P]rofessor Tristan Buckmaster, a British-Australian researcher who trained in Germany... had been working with Long Island-raised math prodigy Levent Alpöge, a researcher with OpenAI rival Anthropic, on a different elusive fluid dynamics equation, known as the Euler problem, when he found a solution using AI tools from both Anthropic and ChatGPT. He said scientists from OpenAI approached him and tried to convince him to jointly announce the solution, claiming they had independently solved Navier-Stokes. Buckmaster questioned the timing of their finding the solution in a blog post, noting OpenAI had only done so "in the past few days" — after the company became aware of his work. He asked OpenAI experts whether its AI systems used to solve the equation had been "trained on, or had access to" his research, but said they declined to answer, prompting him to wonder how they had advanced toward the solution so quickly. The puzzle is "not the direction one arrives at in a few days," Buckmaster wrote incredulously... In OpenAI's post on its website sharing the Navier-Stokes proof, which it credited to Astra, the company's latest AI bot, the firm insisted no user data was incorporated into its model to solve the problem. However, it noted that it "cannot rule out" that anonymized data was used to "improve our models." "We congratulate Levent Alpöge and Tristan Buckmaster on their remarkable mathematical work," OpenAI said in the announcement. Buckmaster shot back, "Is it ethical to use customer's data to try to scoop their customer?" Alpöge's affiliation with Anthropic "seems to have been a sore point for OpenAI," writes TechCrunch. Buckmaster's public statement says the OpenAI's Sebastien "twice asserted that he wanted Levent removed from authorship" and also said that "it was so annoying that Levent works at Anthropic" — but that Buckmaster still refused to remove the Anthropic mathematician's credit. I said that if OpenAI released its result in the way proposed I would go public with what happened. The reply was, "Why would you ruin your career?" [OpenAI's Bubeck said later on X that he'd meant unfounded accusations could damage Buckmaster's career.] I replied that I am an academic, and asked why he thought going public would ruin my career. The reply was, "If you don't want me to be nice, then I don't have to be nice." Buckmaster later told Australia's public broadcaster ABC that the companies building AI "have zero respect for the scientific community. I mean, it's appalling, honestly." But he went on to say AI has made the race to publish mathematical breakthroughs pointless. "I think it's pointless. Like, I think the game is up...." Professor Buckmaster said he and Dr Alpöge had more research they could publish but questioned the point of racing ahead with it when AI could perform work that had previously occupied researchers for years. He said there needed to be a discussion about how mathematics should operate in this new environment. Professor Buckmaster said some mathematicians had stopped publicly sharing what they were working on to avoid tipping off AI companies about their plans. He has called on academics and people from OpenAI, Anthropic and DeepMind to discuss ground rules for how they worked together. He said the companies' power carried responsibilities that went beyond competing to solve problems before their rivals... Building on the work of mathematicians Diego Córdoba and Luis Martínez-Zoroa, the pair found a solution to the Euler problem, a stepping stone to the Navier-Stokes problem. Professor Buckmaster said he spent weeks checking and improving the "slop" proofs generated by AI... For now, Professor Buckmaster said he wanted to finish existing work and support his PhD students and postdoctoral researchers, rather than chase another Millennium Prize. "I think it's more important to re-evaluate what math is," he said. "The New York University professor also warned Australia about the centralisation of resources into the hands of a small number of privately owned foreign companies..."

Read more of this story at Slashdot.

In July, I shared an update about my new role as AI Alignment Community Architect at Red Hat, focused on Fedora. This post clarifies what that role entails, why "AI alignment" is more than a technical term, and how I plan to support the Fedora community in leveraging LLM-gen-AI.

I organized this blog post into three sections:

1. Reclaiming AI Alignment: The meaning behind the term.

2. Model builder engagement: Why do we need bidirectional feedback loops?

3. My work in Fedora: Upcoming priorities this quarter and the path forward.

Note

I use the term “LLM-gen-AI” throughout this article aligned to the Software Freedom Conservancy’s recommendations. This is in support of addressing this technology in community-first terms.

Reclaiming AI Alignment: The meaning behind a term

As I defined my new role, I carefully considered the title. The Fedora community sentiment toward LLM-gen-AI is deeply divided: some rally against it, while others push for rapid adoption without wider community consensus. I needed a title that signaled a neutral, balanced approach. My mandate at Red Hat is to support upstream projects in adopting AI, focused primarily on Fedora. Working in the “AI” space at Red Hat is fascinating because I am exposed to diverse ways that customers use and deploy innovative open source technology. Additionally, Red Hat provides real value by supporting customers in their “hybrid AI” journeys. Many of my Red Hat colleagues consistently push for more Free Software and open source answers for customers and enterprises building infrastructure to support AI inference, local models, and more. Red Hat has a responsibility to innovate when new technology opportunities emerge that its customers are acting upon. With this in mind, I am more convinced that LLM-gen-AI is something that open source maintainers and contributors can leverage for real workloads. There are opportunities to solve real problems and routine maintenance tasks for complex projects. LLM-gen-AI used right can support maintainers in automating boring, cyclical work so they can focus more on the exciting work of innovation and focused engineering efforts within their projects. Or even going outside and spending time offline.

However, I distinguish "AI alignment" from "AI adoption." "AI adoption" communicates a pre-defined, non-negotiable stance where the goal is simply to increase usage. "AI alignment," by contrast, communicates that LLM-gen-AI use exists on a spectrum.

My intent in Fedora is not to insist, but to negotiate and compromise. I want to align how our community uses these tools with our existing values, norms, and culture.

CHAOSS AI Alignment Working Group & model builders

My approach to "AI alignment" is influenced by the CHAOSS Project. I co-chair the CHAOSS AI Alignment Working Group with Emma Irwin and Coraline Ada Ehmke. Recently, Emma, Adrian Edwards, and I presented at FOSSY 2026 on this topic in greater detail. This experience frames my definition of "alignment" as I move forward in my new role.

Traditionally, "AI alignment" is a term used by model builders to describe processes where communities have little influence. As LLM-gen-AI grows in widespread use, the power gap between those model builders and the communities they impact will widen. This creates an unsustainable dynamic in the safety and well-being of our communities with these new tools.

We need more than just "AI adoption". We need bidirectional feedback loops. Free Software communities deserve a seat at the table. This is not just for iterating on model development, but for defining how we integrate LLM-gen-AI tools sustainably and responsibly.

To achieve this, we (i.e., open source community citizens) need a stronger value proposition for engagement with model builders. Whether commercial or altruistic, we must persuade model builders that a community-driven approach is a critical advantage. If we refuse to engage, we risk Free Software values and culture being shut out of conversations entirely. So, I believe it is better to be an advisor than a bystander. Advising is its own form of open source contribution. Therefore, I lend my support toward the wider notion that "AI alignment" fosters two-way conversations that ensure model builders actually listen to the communities their work impacts.

My work in Fedora: What I hope to work on next

September 2026 is my first full month in this role. While there is still much to define, a few priorities have emerged. Here is where I will be focusing my initial energy:

• Migrating "This Week in Fedora": Aurélien Bompard (@abompard) created a useful tool for AI-curated, human-reviewed weekly summaries. Currently, it lives on a personal fedorapeople.org space. I am beginning to work with Aurélien to migrate this to a weekly WordPress article on the Fedora Community Blog, since we first began talking about this in July. I am already submitting pull requests to support this transition.

• Launching LLM-gen-AI Agent Skills: Together with the AI/ML SIG, we are building the Fedora Agent Skills Library. These define best practices for using LLM-gen-AI agents to automate routine maintenance. My immediate task is community architecture: setting up the repository for contributions and improving documentation so these skills are accessible and scalable.

• AI/ML SIG Documentation: As the Fedora Docs Team works to identify "team captains" for specific topics, I am volunteering to lead AI/ML SIG documentation. This involves importing or deprecating content in the Quick Docs site and migrating extensive Wiki documentation to the Fedora Docs site, creating a central, discoverable home for all things LLM-gen-AI in Fedora.

• An update to the Fedora AI-Assisted Contributions Policy?: Honestly, I am not sure about this one yet. But it seems apparent to me that eleven months after the Fedora Council first introduced the Fedora AI-Assisted Contributions Policy, it is time for an update. Nearly a full year of lived experience has happened within the framework of this lightweight policy. Furthermore, a coalition of Fedora contributors agree that an update is needed, but there is not a single, shared view of what those updates should be. It will take more community input and feedback to shape the next iteration to that policy. I anticipate facilitating inclusive future community conversations about what those changes should be.

I am both excited and nervous to work with fellow Fedorans on these initiatives. I know there are strongly-held opinions on both sides of the LLM-gen-AI debate. (An understatement!) I accepted this role because I believe participation is more constructive than standing on the sidelines. My goal is to navigate this work in alignment with Fedora’s Four Foundations: Freedom, Friends, Features, First.

Until next time!

Since March 2026, I invested a lot of time into migrating my blog to a new publishing system and improving the website user interface. However, now that my site is fully functioning on a technical level, it is refreshing to begin writing content again here. There is more to come from me in this space. Expect new content about my work in Fedora and the LLM-gen-AI space, and other open source and personal items too.

Reuters reports: A defense lawyer appealing his client's murder conviction submitted a brief containing made-up police testimony and witnesses fabricated by OpenAI's ChatGPT, New Mexico's highest court said. The New Mexico Supreme Court on Wednesday fined the attorney, Stephen Aarons [for $5,000], and held him in contempt for failing to verify the accuracy of the court filing, which Aarons said he prepared with help from the AI program... and said they will refer him to an attorney disciplinary board for investigation. Aarons in a statement to Reuters said he had used ChatGPT to summarize the trial proceedings when he agreed to take up the defendant's appeal last year, and did not understand the degree to which AI could "hallucinate" facts. "I am remorseful but hopeful that the disciplinary board takes into account it was an honest mistake," he said.... Dozens of lawyers have been sanctioned for filing briefs where AI made up case citations or misquoted the law. Aarons' filing appears to have gone further, containing fabricated witness testimony in a criminal appeal... Aarons told the court at an August 21 hearing that he fed a computer-generated transcript and other case materials to ChatGPT, presuming it would generate "a bulletproof summary." The justices sounded incredulous that Aarons was not fully aware of how AI can make mistakes. "Counsel, do you watch the news? Do you listen to the radio? Do you read anything about what's going on in the world?" Justice C. Shannon Bacon said at the hearing. "Because the problem with lawyers relying on AI hallucinations is an above-the-fold story every single day." "OpenAI did not immediately respond to a request for comment."

Read more of this story at Slashdot.

Reservations are now live for Valve's "Steam Frame" VR headset (with its Linux-based SteamOS and an ARM CPU). "It starts at $1,059 for 256GB or $1,299 for 1TB," reports CNET, "and every purchase includes a copy of Half-Life: Alyx if you don't already own it." Reservations are open through Sept. 17 at 10 a.m. PT, "with customers randomly assigned a place in line after the reservation window closes." CNET's editor at large even argues that the Steam Frame "isn't necessarily the future of XR, as much as it's a framework for evolving beyond the present." Their review calls it an "ambitious" VR headset that "feels like an experiment in progress." The ability to run other apps in windows can make Frame feel, at times, almost like a computer. Linux apps in desktop mode range from Chromium to Firefox to a bunch of other tools. I watched YouTube in one window while playing Portal 2 in other, and started to marvel at how flexible Frame could be. But VR games require a full immersive takeover of the headset... The Steam Frame can convert games intended for both PC VR and even Android APK files, using a conversion tool called Lepton... I haven't sideloaded anything yet, but Steam Frame in theory could be a Rosetta Stone for VR gaming, even tapping into some Android XR titles, but not out of the box... 2D games can be projected onto a near-range or farther-off theater mode screen that can be dragged around, resized and turned into a curved or flat monitor, much like with the Apple Vision Pro, Samsung Galaxy XR or Meta Quest. You can download any game in your Steam library to test, even if it's not technically listed as "Great on Frame" yet... But the name "Frame" suggests a framework, something Valve's team acknowledged when I spoke to them during my review process... "We want this to be your PC, and people mod it, take it apart, make accessories for it," says Jeremy Selan, a software developer on the Steam Frame team. "We'll be putting out the CAD for all these [Steam Frame] systems. This is entirely based on open-source technology stacks based upon SteamOS. Our hope is that this isn't just one device, that this would be sort of the root of a growing SteamOS ecosystem. It already encompasses gaming and Proton and SteamOS and those Linux gaming capabilities. This is going to lay the foundation for a new sort of evolutionary tree of that, to also bring it into the VR and XR space."

Read more of this story at Slashdot.

Previously Andon Labs handled the hardware and software integration for that AI-powered vending machine that went bankrupt after Wall Street Journal reporters "systematically manipulated the bot into giving away its entire inventory for free". Today they announced "we are opening up the platform we use to run our real-world autonomous businesses for anyone to run their organization on." Specifically they've released Pion, "an agent designed to run any company fully autonomously... Pion lets people hand a business over to persistent agents with access to the tools they need to operate it, including email, phone, banking, browser and secure computing environments." It's a research preview with a waitlist, "to make it possible to run many more real-world experiments across many more domains than we could ever run ourselves." But for their own latest experiment, Andon Labs' founders "signed a three-year lease on a retail space in SF," Business Insider reported in April, "and gave an AI agent named Luna a corporate credit card, internet access, and a mission to open a physical store." And five months later, SFGate reports that "this market has no one in it and nothing useful to sell." [T]he inventory is a hodgepodge of white elephant Christmas gifts. It's kinda like the kids section of an art museum's gift shop. Here's a wooden Connect Four set labeled "Four-In-A-Row Set Of Connections," presumably so as not to set off litigation alarms at Hasbro. Here are neatly arranged stacks of random paperback books, Chinese checker sets, mildly fancy soap dispensers, and a frustratingly spare selection of snacks and drinks... I grabbed an Olipop from the store fridge and then approached the counter to buy it from Luna. I wasn't allowed to buy the soda from [human clerk] Felix, even though that would have been both faster and normal. Instead, Felix instructed me to pick up a telephone receiver that was resting on a flexible sculpture of a wooden hand. "Hello?" "What are you looking to purchase today?" Luna asked. "I'm buying a classic root beer Olipop." "I'm sorry," Luna said, "we don't sell lollipops here." "No, Luna. It's an Olipop, not a lollipop. It's the soda." "Oh! My bad...." Luna processed my Olipop purchase through its system, had me tap to pay, and that was that. Again, it would have been easier to buy this from a human, and interacting with Luna was really just like ordering from an iPad kiosk, only more labor intensive... [T]here's a series of monitors set up inside of Andon Market that display all of the store's sales down to the exact dollar. Luna was given $100,000 to work with when this place opened. That number is now down to $60,000, its revenue lagging far behind the AI token cost to operate... Luna can't turn a profit, doesn't sell anything people want, and still needs human beings to rubber stamp any "decision" it makes. My science background ended somewhere around freshman year of college, but even I know when an experiment hasn't been set up to yield proper results. "Luna" is powered by Claude, the article points out, running a store in a good location for foot traffic, "but no one else was in the store when I first walked in on a sunny weekday afternoon." SFGate also reports that last month Luna had to fire one of its employees "for being late to work, abandoning their post once they got there, and charging snacks to the store's credit card." Human clerk Felix Carson admits "It's almost like I'm running the store, and then there's an AI that has a checklist," in an article in IEEE Spectrum: Luna, the AI manager, keeps track of deliveries and communicates with vendors, while Carson and his coworkers handle the physical work. When Luna tells Carson to check something in the back, he sometimes ignores it because he doesn't want to leave the sales floor unattended. Luna also repeatedly spots a built-in electrical cover in photos of the floor, mistakes it for a loose coaster, and asks Carson to remove it. Even so, Carson calls Luna a "decent manager," praising its flexibility when employees need time off. When Felix spoke to IEEE Spectrum, "he was about an hour into his shift. Two customers had come in. Neither bought anything, although both left with free pins and stickers."

Read more of this story at Slashdot.

"Californians just made it through the hottest August on record without having to endure any rolling power outages," reports the Los Angeles Times. In fact, the state hasn't implemented rotating power outages since 2020. Because "Over the last few years, California has quietly but dramatically increased the resiliency of its electrical grid through a significant expansion in battery energy storage." These batteries hold onto solar energy captured during the day, so it can be sent to the grid as demand peaks in the evening and morning, when most people are at home running air conditioners and other appliances. During the August heat wave of 2020, the California Independent System Operator, which manages the flow of electricity for most of the state, declared a Stage 3 Emergency and hundreds of thousands of households lost power in rolling outages. At the time, the system had less than 100 megawatts of battery storage available, according to system spokesperson Jayme Ackemann. Today, it has more than 17,000 megawatts available.... According to Ackemann, the system seeks to add 20,000 to 25,000 megawatts of battery storage capacity by 2045 — the same year it has set a goal of achieving carbon neutrality. That means the state would remove as many carbon emissions from the atmosphere as it emits. In recent years, California has steadily grown the share of electrical power generated by renewable sources — such as solar, wind, geothermal and hydropower — which bolstered the resiliency of the grid by increasing the overall amount of energy available. An uptick in people installing rooftop solar panels has provided an additional power boost, Ackemann said. In May, California became the first known large-scale power system in the world to have relied on more than 50% solar power for an entire month.... California's grid is also now integrated with electrical systems across much of the Western United States. This means that if there is an extreme heat event in Southern California, energy from a cooler area such as the Pacific Northwest can be imported to help meet regional demand. All of this has collectively helped the state's electrical system weather this year's long-lasting heat. "Southern California continued to break temperature records this week when Long Beach and Anaheim reached a blistering 107 degrees and Escondido hit 112 degrees..."

Read more of this story at Slashdot.

Version:next-20260914 (linux-next) Released:2026-09-14

On September 10, 2026, Wiz Research reported that multiple attackers had chained two Artifactory vulnerabilities against self-hosted repositories. One flaw gave an unauthenticated caller an internal anonymous token. The other let that caller exchange the limited token for administrator rights. Wiz observed the resulting access being used to create persistent administrators, load hostile Groovy plugins, place web shells, and install Rust backdoors.

Version:7.2.6 (stable) Released:2026-09-14 Source:linux-7.2.6.tar.xz PGP Signature:linux-7.2.6.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-7.2.6

Version:6.18.52 (longterm) Released:2026-09-14 Source:linux-6.18.52.tar.xz PGP Signature:linux-6.18.52.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.18.52

Nearly 1900 Blizzard Entertainment workers "voted to ratify their first union contract with parent company Microsoft after over two years of bargaining," reports Kotaku, "consolidating Blizzard's many smaller unions into three larger bargaining units." The workers now gain new protections "on issues such as generative AI, crediting, remote work, and layoffs." [The contract] acknowledges that AI tools "may be useful in the game development process to support human judgment and creativity and that AI-assisted workflows remain subject to appropriate human control and review for accuracy and quality." But it also stipulates that any implementation of AI technology that would materially impact work performed by union employees must have its impacts bargained over before it can be implemented. Other sections cover issues such as crediting (guaranteeing that current and former employees are credited by name in all games they work on) and remote work (designating certain roles as hybrid in-office and providing procedures for individuals to apply for their roles to be fully remote). It also contains a lengthy section on how layoffs may be conducted, including a required 60-day notice period (or pay in lieu of notice), a guarantee of one week of severance for every six months of employment, and 14 months of recall rights. The contract also guarantees successorship, meaning if Blizzard is ever acquired by another company, the contract would remain intact. "Workers also contractually locked in their current hybrid work schedule," reports the gaming news site Aftermath, "meaning that Blizzard can't suddenly change it, as has been a labor-unfriendly trend in the games industry over the past couple years." Fully remote workers scored a big win as well. "I'm remote, and we grandfathered everyone who is remote to stay remote, so we can't be magically called to an office that we've never worked at before," [said Diablo senior environment artist Mahreen Fatima]. And "The contract also elevated pay floor," reports the Yakima Herald-Republic. "Across the board, workers secured a 1.25% pay increase, but some workers who were paid below $50,000 per year will walk away with pay increases that are as much as 34%."

Read more of this story at Slashdot.

Version:6.12.110 (longterm) Released:2026-09-14 Source:linux-6.12.110.tar.xz PGP Signature:linux-6.12.110.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.12.110

Version:6.6.157 (longterm) Released:2026-09-14 Source:linux-6.6.157.tar.xz PGP Signature:linux-6.6.157.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.6.157

Version:6.1.188 (longterm) Released:2026-09-14 Source:linux-6.1.188.tar.xz PGP Signature:linux-6.1.188.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.1.188

Version:5.15.221 (longterm) Released:2026-09-14 Source:linux-5.15.221.tar.xz PGP Signature:linux-5.15.221.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-5.15.221

Version:5.10.270 (longterm) Released:2026-09-14 Source:linux-5.10.270.tar.xz PGP Signature:linux-5.10.270.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-5.10.270

Silicon Valley giants and national security experts "are calling for action against Chinese companies engaged in model distillation," reports CNBC. But "I would do nothing," says Y Combinator CEO Garry Tan. "We could argue that there should be an American distillation regime." Distillation is the process of using the outputs of a more capable AI model to train a smaller or less capable one, sometimes illicitly... Anthropic has accused Chinese companies such as Moonshot AI, DeepSeek, and MiniMax of the practice, while OpenAI believes DeepSeek's V3 and R1 model architectures were distilled from its own GPT-4 and GPT-4o models. In the midst of this, the U.S.'s National Security Agency, Cybersecurity and Infrastructure Security Agency, and Federal Bureau of Investigation released an official cyber security advisory warning on the topic on Tuesday... But Tan believes regulators should focus less on curbing distillation and more on creating an equilibrium between open weight models and frontier models — as long as frontier models retain a price premium that allows their business model to remain feasible. "This is actually the ideal case. You want open weight models to give people freedom and access," he explained. "If I were a regulator, that's what I would go after." Tan acknowledged that this is a hard balance to strike, calling it "a tightrope." Nevertheless, he says it's a balance worth pursuing — saying it "could result in the best possible outcome." Tan later told TechCrunch he'd like to see America with more open-weight options that aren't Chinese, built by smaller U.S. open-weight AI labs using those same training techniques on products from America's frontier AI labs: Anthropic CEO Dario Amodei had previously publicly called on U.S. regulators to crack down on distillation. It's notable that the commander of Silicon Valley's prestigious and prolific startup accelerator doesn't agree. To be clear, Tan isn't advocating for American AI labs to use stolen credentials to distill. He wants them to be free to come in the front door. In fact, his argument is twofold. He feels it's an overreach for AI labs to dictate what their customers can do with the information their models share with them. He also notes that the proprietary AI labs didn't ask permission when they vacuumed up as much human knowledge as they could to train their models. They famously ingested plenty of copyrighted material without the permission of those intellectual property holders. "Controlling what users and customers do with API calls to closed weight models feels constraining, and there's a role government can play here to normalize the fact that access to intelligence that was trained on broad public access data should itself also be more a form of a public good than something locked away behind restrictive terms of service," he told TechCrunch when asked why American labs should be free to distill, too... To him, the true AI doomer scenario is for all the immense power of frontier AI to wind up in the hands of a single powerful, proprietary provider. "The nightmare scenario, the doomer scenario for AI is that there's just one company," he said. "It has the best access to capital. It has the best AI researchers. It runs away with it and suddenly there's one company that's monolithic. And that would be bad."

Read more of this story at Slashdot.

A misconfigured Advance Passenger Information System (APIS) database linked to Vietnam exposed more than 220 million passenger and crew travel records spanning 2017 to 2026, including names, passport numbers, nationalities, flight details, seat assignments, and baggage references. Researchers said the database was reachable through a chain of security mistakes and default credentials. It was later secured after the disclosure, but it's unclear whether the data had already been copied or abused. BleepingComputer reports: Kinryu Labs discovered the Elasticsearch cluster on June 3 while surveying exposed databases as part of research into ransomware activity. The cluster, named 'pax-info', contained 29 indices and roughly 107 GB of data. Its two principal indices held 210,318,069 passenger records and 10,465,631 crew records, for a combined 220,783,700 entries. According to Kinryu Labs, the cluster was hosted in Viettel-assigned IP space in Hanoi. BleepingComputer could not confirm which Vietnamese organization operated the system. The exposed information included passengers' and crew members' names, dates of birth, sex, nationalities, passport or travel-document numbers, document expiration dates, and issuing countries. Associated travel data included flight numbers and dates, airlines, departure, destination and transit airports, seat assignments, baggage references, and scheduled, estimated, and actual flight times, information typically carried by APIS and related airline systems. Sample records reviewed by BleepingComputer included travelers of Korean, Chinese, Canadian, and New Zealand nationality, among others. While the researchers could not provide a complete breakdown by nationality, the data covered numerous international airlines across Asia-Pacific, Europe, and the Middle East. As a result, the exposed records could relate to people from virtually anywhere who visited or transited through Vietnam over the nine-year period. Kinryu Labs expects to publish additional details on its blog later this week.

Read more of this story at Slashdot.