Agreguesi i feed

Together with Modal, I’m happy to announce that the Sovereign Tech Agency is investing nearly €510k into Flatpak development. The focus is on closing gaps in Flatpak’s sandboxing story: new portals for audio, networking, VPNs, and spell checking, plus infrastructure work on entitlements and intents.

I’ll be leading the technical side alongside Adrian, with organizational support from Kateryna and Cade. We’ve brought on a great team and the project will ramp up over the coming months through the end of 2027.

Read the full announcement on the Modal blog.

In Some Changes to GNOME Security Tracking, I reported:

I will discontinue tracking newly-reported security issues on November 1, 2026. During November, I will focus only on tracking issues reported prior to November 1. By December 1, all disclosure deadlines for that set of issues will have been reached, and I will be done.

This is because I was planning to leave my job at Red Hat on December 31 due to some internal Red Hat policy changes. But this timeline has now unexpectedly moved forward two months, to October 30. Accordingly, I will now discontinue tracking newly-reported security issues on October 1, 2026. During October, I will focus only on tracking issues reported prior to October 1. By November 1, all disclosure deadlines for that set of issues will have been reached, and I will be done.

If your agentic workload involves the agent being able to run arbitrary code (like bash or equivalent), then you should not use a “LLM as part of your app” framework like LangChain, BeeAI, OGX etc. Instead, run OpenCode, goose, or another general coding agent inside a sandbox such as OpenShell.

Sandboxing limits what the agent can access directly. For privileged effects, it is best augmented with a pattern like safe outputs: the agent emits a structured, unprivileged request that separately trusted code validates and applies.

A compact decision tree Can it run bash or arbitrary code? ├─ Yes → Run a generic agent in a sandbox └─ No → Are you *really* sure *all* of your tool calls (MCP or builtin) don't accidentally expose "execute arbitrary code"? ├─ Yes → OK, maybe LangChain or equivalent makes sense └─ No → Goto start

I also think the builtin sandboxing in most agent tools (like Claude Code and Gemini CLI) is a bad idea, and it’s better to just ensure the entire thing is sandboxed.

Related to all of this, a key thing anyone making an “agent” needs to ask is “how is this different from just writing an agent skill”. From my previous post you’ll know that I think GitHub Agentic Workflows is a good reference baseline for applying agentic AI (background/task oriented) safely and effectively. And there an “agent” is almost exactly just an agent skill, but with a bit of YAML defining its integration with the outer system.

Why should it be harder than that? I just don’t see it making sense for custom agents written in frameworks like LangChain to proliferate in most use cases. Sure you can use LLMs to generate it, but it’s even more secure and understandable to not have that code at all.

Even for the use case of an interactive chat bot, do you really need a custom app versus just MCP tools for an already generic frontend? I doubt it.

I don’t think it makes sense for most organizations to have proliferation of custom bespoke agents like these LangChain-style frameworks encourage. Skills and sandboxed generic agents are just easier to understand and work with.

Hello! I'm Angelo Verlain, a Software Engineering student, and I've been working for the last 3 months easing the debugging process of GJS apps by adding Debug Adapter Protocol (DAP) support to GJS as part of Google Summer of Code (GSoC 2026).

A debugger is software for executing a computer program in an environment that allows for programming-level inspection and control. A debugger is often used to debug, but can be used for other goals including testing. Common features of a debugger include stepping through code line-by-line, breaking into the program's flow of control, managing breakpoints, and reporting and modifying memory. ¹

What is GJS?

GJS or GNOME JavaScript is a JavaScript interpreter that allows developers to write code that can leverage GLib/GObject and various other libraries that work with GObject Introspection like GTK, Libsoup, etc...

In practice, GJS allows you to write GNOME/GTK Applications and GNOME Components in JavaScript. The GNOME Shell & Extensions, GNOME Weather, GNOME Audio Player, GNOME Maps, Workbench are all examples of projects powered by GJS.

What is DAP?

The Debug Adapter Protocol is a a specification that describes how messages are passed between a debugger client (for example, your IDE) and server (such as the Node.js or any other language runtime). It specifies and communicates pausing & continuing execution, setting breakpoints, stepping through the code, viewing stack traces, and more. It works by defining a standard way for your development tool (e.g. GNOME Builder, VS Code, Zed, etc...) to connect to a debugger.

Today, you can already debug applications and libraries written for/with Android, Node.js, Deno, C, C++, Rust, Python and more. This project aims to make GJS applications debuggable in your favourite editor or debugger by implementing a DAP adapter for GJS.

Adding DAP to GJS

GJS already supports debugging programs by use of the --debugger flag, which spins up a GDB-style CLI interface where you invoke it by running gjs --debugger [file-name].js and writing commands like breakpoint [line], step, frame to set breakpoints, step through the code and print the stack frame respectively.

It works well, but it's different from the GUI debugging that’s more popular these days.

Here's an example of GJS debugging the following code saved as test2.js

function print(i) { console.log(i); } for (let i = 0; i < 10; i++) { print(i); }

If GJS had support for DAP, you wouldn’t be limited to just using the text mode debugger, but could debug applications using your favourite editor (Zed, VS Code, etc…)

The workflow would be easier too: Press F5 to debug (standard hotkey), specify the path to your entrypoint, and then run the program. To set a breakpoint, simply type the debugger keyword or click in the gutter/margin of your editor (even after your program has started execution!).

When the program reaches that breakpoint, you will have a nice stack trace showing where the program stopped, and give you options to inspect the current variables in the different scopes, continue execution, or step next, in our out of frames.

Here's an example of debugging the same script using VS Code's Node.js adapter (the experience we want):

Note that you can more clearly see the variables, call stack and breakpoints in the debugger.

Scope

My work is focused on launching & debugging GJS apps.

The scope is also limited to launching & debugging GJS applications or running scripts in the GJS interpreter and debugging them. Attaching to already running applications is not in scope.

Concretely this also means that debugging components like the GNOME Shell is not in scope.

Furthermore, I have only written an extension for Zed since it’s the editor I use, but other editor extensions like VS Code, Builder, and Emacs could be implemented as a follow-up task and will be relatively easy since GJS itself implements the DAP specification and we just need to bridge the two. If you want support for a specific editor or debugger, please let me know :).

Progress

I've made significant progress on the project.

The project period is coming to a close and I’ve made significant progress. Currently, the following is implement:

• A work-in-progress GJS DAP Extension is implemented, which allows you to debug GJS applications inside the Zed Editor. It's not yet published to the Zed Extension Store though
• You are able to launch a GJS program or run a file and break on entry
• Automatically pausing on debugger statements
• Ability to add breakpoints by clicking in the gutter/margin of the code editor (even while the app is running!)
• When execution pauses, you are able to resume execution to the next statement, or step in/out of functions/methods/scopes.
• When execution pauses, you can see all the stack frames
• When execution is paused, you can also inspect the different scopes and the variables defined in all of the scopes

My next steps will focus on the following:

• Implement a VS Code Extension so you can also debug GJS applications in VS Code in addition to Zed
• Allow configuring breaking on Caught and Uncaught exceptions

Figure: Debugging a program with a visual debugger (Zed), showing breakpoints (red circle in the gutter), current line highlighted and variables

I’m looking forward to sharing my progress when we get to the end of the program! Expect another blog post in the next couple of weeks.

Amazon has raised the prices of its hardware devices by as much as 60%, blaming "significant increases in memory and storage component costs." TechCrunch reports: The price explosion impacted Fire TVs, Echos, Kindles, and Eeros. One egregious example that's been cited is that of the Echo Dot, one of Amazon's cheapest smart speakers, the price of which jumped 60% overnight, from $49.99 to $79.99. Price-tracking sites like CamelCamelCamel show the stark uptick, which has previously hovered much lower. [...] The company also said that it would continue to offer occasional promotions to customers over the course of the next year. Amazon said in a statement: "The consumer electronics industry is facing significant increases in memory and storage component costs. After absorbing these increases for as long as we could, we recently adjusted pricing across our product lines."

Read more of this story at Slashdot.

The SEC is investigating the near-collapse of AI-focused hedge fund Situational Awareness, sending subpoenas to major Wall Street banks for details about the fund's trades, borrowing, and communications with lenders. The fund, founded by former OpenAI researcher Leopold Aschenbrenner, managed over $30 billion and borrowed tens of billions more before leveraged bets unraveled, forcing it to sell most of its stock portfolio to Citadel at a discount. The New York Times reports: The subpoenas asked for details on the timing of Situational Awareness's trades and for its communications with lenders about the money it was borrowing, also known as "leverage," two of those people said. The subpoenas additionally warned the banks to preserve any information regarding the San Francisco hedge fund. The S.E.C. oversees financial markets with an eye toward protecting small investors, and has brought civil cases regularly against investment firms that produced large losses. Any investigation into Situational Awareness would be at its earliest stages, and it's no guarantee that it would lead to fines or other punishment. The hedge fund has not been accused of wrongdoing. [...] Situational Awareness had a fast rise and an even quicker retreat. Founded just two years ago by Leopold Aschenbrenner, a former researcher at OpenAI, it rode the A.I. boom to soaring investment returns. To achieve those results, however, the fund relied on heavy borrowing, as well as complicated and expensive financial instruments that magnify gains -- and losses. The latter piled up quickly last month when the stock prices of publicly traded, high-flying A.I. companies dipped. At the same time, shares in more traditional technology companies -- which the hedge fund had been betting against -- rose, compounding the problem. Situational Awareness was forced into a fire sale. It wound up selling most of its stock portfolio to a rival, Citadel, at a discount.

Read more of this story at Slashdot.

The Trump administration is proposing to make permanent a $103,265 fee on certain new H-1B visas, dramatically increasing costs for employers that rely on highly skilled foreign workers in tech, education, and research. "A federal judge in June ruled that the fee was illegal and blocked the Trump administration from collecting it," reports Reuters. "A Boston-based appeals court is reviewing that decision while a different court considers whether a judge properly rejected a challenge to the fee by a major business group." From the report: Trump's temporary fee increase expires in September, one year after it was issued. The proposed rule by the U.S. Department of Homeland Security, posted in the Federal Register on Monday, would make a fee of $103,265 permanent. It could be finalized by the end of the year. The H-1B program allows U.S. employers to hire foreign workers with training in specialty fields and offers 65,000 visas annually, with another 20,000 for workers with advanced degrees, approved for three to six years. Those visas typically came with fees between $2,000 and $5,000 before Trump's order. The fee would not apply to visas granted to foreign citizens already in the United States on student visas, who make up a large share of new H-1B recipients, or to renewals of current visas.

Read more of this story at Slashdot.

Raspberry Pi has published an official guide for building a cyberdeck, leaning into a viral trend of homemade portable computers built from repurposed cases, purses, and other oddball hardware. The guide uses a Raspberry Pi 5, keyboard, battery, and Pelican-style case. The Verge reports: Raspberry Pi's head of social, Ashley Whittaker, acknowledged the cyberdeck trend today, saying "we haven't been able to get away from cyberdecks this year." Raspberry Pi has also increased its prices multiple times this year due to rising costs for RAM and other components, which could be another reason to support this growing market of active and would-be hobbyists. The 16GB version of the Raspberry Pi 5 included in the company's official cyberdeck guide got a $100 price hike in April, nearly as much as the board's original $120 price.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Ars Technica: Taiwan has indicted nine people -- reportedly including an Nvidia senior manager and two Supermicro employees based in the country -- who allegedly helped forge documents to cover up illegal exports of high-end AI servers to China in violation of US export controls. On Monday, Reuters reported that prosecutors in Keelung did not release any names but confirmed that the suspects were "charged with breach of trust and document forgery." One suspect linked to a related case remains at large, accused of the "siphoning of funds from a distributor company involved" in helping China get access to restricted Nvidia chips. Since 2022, the US has required a license to export semiconductors to China, with the intent of protecting national security by staying ahead of China in the AI race. But after the US arrested Supermicro co-founder Wally Liaw in March for allegedly funneling $2.5 billion in restricted AI servers to China since 2024, Taiwan launched a separate probe to learn more about the scheme. Taiwan's investigation found that co-conspirators attempted to falsify documents to make it appear that 130 B300 servers were installed and in use at a Taiwan facility. But 74 of those servers "were ultimately exported and delivered to Chinese customers," Reuters reported, while the rest, 56, were intended to go to China but were blocked once Taiwanese customs officials "detected irregularities." According to Taiwan officials, Nvidia's manager and Supermicro employees "colluded with one another at various levels for enormous profit, illegally exporting high-end servers, increasing corporate compliance costs, and severely damaging our nation's international image." Supermicro said in a statement to PCMag: "Supermicro is committed to protecting our advanced technologies and intellectual property. We are working closely with Taiwanese authorities on recent events, which underscore the importance of continued collaboration across industry and government to strengthen safeguards, enhance supply chain visibility, and facilitate the enforcement of export control laws."

Read more of this story at Slashdot.

China has delayed its ambitious Chang'e 7 lunar mission until at least 2027 after scrubbing an August 24 launch. Poor weather conditions were likely a factor, with China's Manned Space Agency (CMSA) saying the decision reflects the need for "absolute safety." Scientific American reports: China and the U.S. are in a race to send humans back to the moon, a feat that that U.S. accomplished in the 1960s and that has never been achieved by any other country. Chang'e 7 is to play to a crucial part in China's ambitions: the probe is designed to search for frozen water in the Shackleton Crater, a pit that spans some 21 kilometers (13 miles) and sits beside the lunar south pole. No spacecraft has ever landed in that region, which scientists consider to be among the likeliest places to find water on the moon. Locating water that can be used by humans is vital to establishing any long-term lunar presence. NASA and China are eyeing the region to establish a crewed base -- and because this real estate is so precious, it matters who gets their first. Ars Technica notes in its reporting that the delayed launch was "most likely" due to Typhoon Narra, "which has 45 mph winds (equivalent to a moderate Tropical Storm) and continues to meander around in the waterway separating Hainan Island, where the spaceport is located, and mainland China." As for why the next launch window won't open until next February or March? "It likely is a combination of factors, including sunlight conditions in polar landing zones as well as the mission plan that requires a 90-day lunar orbit reconnaissance before landing," reports Ars. There's also a possibility, albeit an unlikely one, that "some technical issue was discovered at the last minute with either the complex Chang'e 7 payload, or the rocket."

Read more of this story at Slashdot.

The FDA has cleared the first Alzheimer's blood test for symptomatic patients as young as 40. The test measures amyloid and tau biomarkers from a single blood draw and identified positive biomarkers with 97.6% accuracy in a validation study. New Atlas reports: PrecivityAD2 is a single blood test that quickly assesses the proteins amyloid and tau, using mass spectrometry to measure plasma AB42/40 and p-tau217/np-tau217. The results are then scored, qualifying as negative, likely positive, or positive for AD. "Just over a year ago, there were no FDA-cleared blood tests for Alzheimer's, and now we have three," Isobel Coleman, chief executive officer of the Alzheimer's Drug Discovery Foundation (ADDF), said in a statement. "This is a proof point that sustained, early investment in translational science plays a catalytic role in moving promising ideas from the lab to patients." In a recent clinical validation study, 1,142 symptomatic adults were tested using PrecivityAD2. The process accurately identified 97.6% of positive biomarkers. What's more, the results remained consistent even in patients with comorbidities like chronic kidney disease and diabetes, which can distort plasma amyloid samples. It's worth noting that the test isn't intended for general health screenings, but for patients who already show some cognitive decline. "As PrecivityAD2 and tools like it move further into clinical practice, they will enable earlier detection, sharpen clinical trials, and build the foundation for precision medicine and combination therapies," Coleman added.

Read more of this story at Slashdot.

Two humanoid robots competing at the World Humanoid Robot Games in Beijing on Saturday ran the 100-meter dash faster than Usain Bolt's 9.58-second world-record time. "[T]he Tiangong Ultra humanoid robot completed the 100-meter dash in 9.39 seconds during a preliminary heat," reports Engadget. "Developed by Beijing Humanoid Robot Innovation Center, the record-holding robot overtook Honor's Lightning robot, which completed the sprint in 9.47 seconds. From the report: Despite the impressive finish times, don't expect these humanoid robots to be used for any commercial purposes yet. After their sprints, they slammed directly into pads and some even required human assistance to be stretchered off the course. However, it's still a major improvement from last year's inaugural World Humanoid Robot Games, where the Tiangong Ultra won the 100-meter dash in 21.5 seconds. Beijing has also hosted a humanoid robot half-marathon, where Honor's Lightning won in 50 minutes and 26 seconds, which also beat the pace of another human world record. "The World Humanoid Robot Games in Beijing kicked off August 22 and will run until the 26, hosting thousands of robot participants competing in more than just track and field events, including soccer, table tennis and boxing," adds Engadget.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Gizmodo: Dr. Dre, the pioneering rapper and seven-time Grammy-winning producer behind hit songs like Tupac's "California Love" and Eminem's "The Real Slim Shady," is very much pro using artificial intelligence tools to make music. In an interview with the New York Times, Dr. Dre and Interscope Records co-founder Jimmy Iovine spoke about artificial intelligence's recent foray into music production, with the producer characterizing those who oppose AI song generation tools as "afraid of learning new things." "I don't see it as a threat. I think the only people that see it as a threat are the people who have trouble creating," Dr. Dre said. "I had a discussion with a few people a few days ago. They were against AI, and I'm like, 'OK, you sound like the person that would have been against the drum machine when it came out.' Or synthesizers, right?" [...] Iovine, the music executive and Dr. Dre's partner in Beats by Dre, for his part, says he doesn't "see the downside at all." "There will be some crappy music. There's crappy music now," Iovine told the NYT. "In the studio, when gifted people have AI, they're going to make better records." Dr. Dre said he uses AI in producing "as a tool to see what it would do with what I just did." The award-winning producer also said he is definitely not alone among his peers in his stance on AI either: many producers use AI but fear to admit it. Iovine calls them "closet AI producers," and says Timbaland, the four-time Grammy-winning singer-producer behind a long list of hits like "Promiscuous" with Nelly Furtado, is also one.

Read more of this story at Slashdot.

Version:next-20260824 (linux-next) Released:2026-08-24

A Linux TCP query can touch congestion-control memory after a concurrent BPF update has freed it. Two new use-after-free reports show how an ordinary read path inherited a lifetime assumption that no longer holds when BPF makes congestion-control objects dynamically replaceable.

A Linux BPF patch posted on August 21, 2026, expands validation for program replacement across cgroup and Linux Security Module hooks. Version 3 addresses cases where two programs share a broad type but expect different runtime contexts or return rules.

Code merged for the Linux 7.3 development cycle changes the measured boot evidence produced by the Integrity Measurement Architecture, or IMA. The kernel now records the raw policy rules that decide what the system measures, closing a gap that could leave remote verifiers without a complete picture of how the evidence was created.

Gluons are the quantum 'Gorilla Glue' involved in binding quarks together, ScienceAlert reminds us. But for nearly 50 years, physicists have hunted for "glueballs", exotic particles predicted by this theory of the strong interaction — the only type of particle in nature composed entirely of force mediators: Now, a collaboration working at a collider in Beijing says it has the clearest evidence yet that a known particle called X(2370) is dominated by one of these elusive states... Physicists sifted through the wreckage of high-energy particle collisions to find strong evidence of this glueball, made predominantly of gluons — massless force carriers of the strong interaction between quarks... The new evidence for this exotic, unstable glueball's ephemeral existence comes from a recent preprint on arXiv, presented at the International Conference on High Energy Physics in Brazil... This collaboration uses the Beijing Electron Positron Collider II, a particle accelerator and collider that smashes electrons into their antimatter counterparts, called positrons, to probe perplexing particle physics. The resultant glueball is an "unprecedented form of matter," says Jin Shan, a particle physicist at Nanjing University and one of the research team's leaders. "It not only enables the theory describing strong interactions to pass its most rigorous test, but also vastly expands the boundaries of our understanding of the physical world," he told Fan Chen at South China Morning Post... Previously, in a study published in the journal Physical Review Letters in 2024, the researchers analyzed 10 billion meson decay events. They measured the X(2370) particle's mass and spin parity — a property that dictates its interactions and almost-instantaneous decay — for the first time, finding complete agreement between their experimental values and predictions. Now, they've identified its additional decay modes and determined its flavor-singlet nature, "the most important characteristic of a glueball...." The authors describe their work as the clearest experimental result to emerge from nearly 50 years of glueball searches, supporting the long-standing theoretical prediction that gluons can bind together into a new form of matter. The discovery ""highlights advances in technology and analytical techniques that have recently revealed another decades-in-the-making physics mystery," the article points out. "More experiments are needed to further confirm and constrain the prototypes of the highly esoteric glueball; in other words, more particle smashing."

Read more of this story at Slashdot.

The long legal battle over ownership of Linux "is closer than ever to ending," reports the Register, "after a panel of three judges ruled a claim against IBM and Red Hat isn't valid, and that time has expired for further action." In 2021, an heir to SCO settled with IBM for $14.25 million — a sum that reflects the fact SCO had for years failed to produce strong evidence to back its claims. Another of SCO's legal successors, Xinuos, filed a new claim that IBM should be on the hook because Big Blue knew it did not own the code it contributed to Linux but instead had a non-exclusive license to use it. Xinuos argued that when IBM contributed Project Monterey code to Linux [25 years ago], it breached that license. Xinuos eventually took that argument to the US District Court for the Southern District of New York — and failed to convince it that IBM and Red Hat had a case to answer. Xinuos appealed, and on August 10th the United States Court of Appeals for the Second Circuit decided [PDF] not to revisit the District Court's decision, agreeing that the original legalese governing Project Monterey means it's too late to re-litigate the matter. The Appeals Court also agreed that Xinuos tried to frame the case as a licensing issue but failed, instead arguing that the issue was really about ownership. That ain't all, folks, because Xinuos intends to file a petition to have the case re-heard by the full bench of the Court of Appeals. That hardly ever happens, unless the court finds significant errors or major legal issues that make a rehearing worthwhile. Law firm Kaplan says the Second Circuit has allowed reviews of less than 0.03 percent of the cases it has handled. So perhaps this matter is now close to a final resolution. Back in 2000 Slashdot interviewed one of the presidents of SCO.

Read more of this story at Slashdot.

A Pew Research senior data scientist analyzed 500,000 English-language webpages from the past five years with an AI detection tool to estimate how many were likely written or edited by AI: Of all the pages in this sample, 10% show significant signs of AI authorship... If we filter old webpages out of our samples and look at only the pages published after the release of ChatGPT, the trend is even more pronounced. In the July 2026 snapshot, signs of AI authorship can be found in over one-third of pages published after ChatGPT was released. This is in line with other studies that have shown that large shares of recently published pages on the internet were likely written or substantially edited by AI. AI-authored text is not evenly spread across the web. When ChatGPT was first released, the kinds of linguistic patterns that can signal AI authorship appeared at similar rates across the main top-level web domains (.com, .org, .edu and .gov). But in samples from 2026, around one-in-ten pages with a .com domain show signs of AI authorship — about double the share on .org domains (4.6%), and 10 times the rate on .edu or .gov domains (both around 1%). They even identified specific ways online text has changed, "comparing the internet of today to a snapshot from 2023." Em dashes appear twice as often Oxford commas increased 63%. Words used more frequently by AI (like "delve," "interplay" or "testament") have more than doubled in usage. "Negative parallelism" comparisons ("it's not just X, it's Y") have nearly tripled.

Read more of this story at Slashdot.