# Drew DeVault Drew DeVault's blog - Blog This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## AI Tools in Linux Kernel Development and Code Review DevFeed: [AI Tools in Linux Kernel Development and Code Review]() Original publisher: [Read original article]() Author: July Published: 2026-07-23T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [Artificial Intelligence](), [Linux](), [Large Language Model](), [Code review](), [Development](), [Open Source]() Tags: [ai](), [code](), [code-review](), [development](), [linux](), [llm](), [technical]() ### AI overview This opinion article discusses the growing use of AI tools, mainly LLMs, in Linux kernel development. It covers AI-assisted code authoring, the Sashiko code review tool, and the technical and political debate surrounding AI-generated feedback and contributions in the Linux kernel community. ### Source excerpt The role of AI tools (LLMs, mainly) in Linux is under discussion, or it was, until Linus Torvalds "put his foot down" in support of the use of AI in Linux kernel development. I can identify two major ways in which AI is used for Linux kernel development: authoring code and reviewing code. There are, at the time of writing, just over 1,200 kernel commits with an "Assisted-by" tag, from September 2025 to the present, most of which indicate patches which were written or assisted by LLM tools. The second important use of AI for Linux comes with a new code review tool called Sashiko, which generates code reviews for patches considered for various subsystems. Sashiko ignited the current debate on AI in Linux because it pushes the envelope on AI in Linux: people who oppose or do not want to use AI could previously just refrain from using it to write their patches, but now there is a growing expectation that anyone who wants to contribute to Linux will have to interact with Sashiko or other AI tools like it to iterate on AI-generated feedback on their work. One of the major lines of this discussion in the Linux kernel community has been with respect to the ethical considerations of the use of LLMs. Linus shuts this line of reasoning down entirely, firmly grounding the discussion in technical merits and rejecting any political discourse on the matter: The kernel project has been and will continue to be about the technology. Sure, the social angle of working on open source is important and often a very motivating part of the project, but in the end that's a side benefit, not the point of the project. This is NOT some kind of "social warrior" project, never has been, and never will be. In the kernel community we do open source because it results in better technology, not because of religious reasons. This argumentation is disingenuous and hypocritical. Linux is a political project and Linus is a political actor. Consider the use of the GPLv2 for licensing Linux. One can argue ## TempleOS, mental illness, and open-source spectatorship DevFeed: [TempleOS, mental illness, and open-source spectatorship]() Original publisher: [Read original article]() Author: June 5 Published: 2026-06-05T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [Operating system](), [Self-hosted](), [C](), [Compiler]() Tags: [c](), [compiler](), [open-source](), [operating-systems](), [self-hosted]() ### AI overview An opinion article on TempleOS argues that its public prominence stemmed less from its technical achievements than from attention to its creator's mental illness. It describes TempleOS as a self-hosted hobby operating system written in a bespoke C dialect, with an editor, interpreter, compiler, and original games. ### Source excerpt The masterwork of Terry A. Davis is his eclectic operating system, TempleOS, which he worked on until his tragic death in 2018. In terms of technical excellence, TempleOS rates well in some respects and poorly in others. For example, it earns the achievement, coveted in OS dev circles, of being self-hosted.1 TempleOS is written in Terry's own bespoke dialect of C and includes an editor, interpreter, and compiler, as well as a number of original games. In other respects, it compares poorly to many hobby OS projects, some of which have achieved significantly greater levels of technical excellence and sophistication. I would place TempleOS somewhere in, say, the lower middle-class of hobbyist operating systems. Among hobbyist operating systems, TempleOS stands out as one of the most well-known, having attracted considerably more press coverage and a much larger fan-base than any other hobby operating system can boast. The reason TempleOS stands out from the crowd is not due to its modest technical achievements, but because it is clearly the product of severe untreated schizophrenia.2 What makes TempleOS special is that Terry built it to talk to God. Every feature and each technical decision re-enforces his schizophrenic delusions, from its implementation language ("HolyC") to its prophetic "oracle" app. Enthusiasts of TempleOS are drawn to it in part because it affords an opportunity to explore the unique, creative masterwork of a person suffering from mental illness in a way that deeply impacts that work. A curious onlooker will find TempleOS interesting and engaging for the space of perhaps one afternoon before moving on. However, for the less scrupulous fans, turning one's attention to Terry himself never failed to entertain. Terry's public life put his mental illness on display, through frequent outbursts, conspiracy theories, rants and nonsensical discourse, all of which was often laced with slurs, racism, and homophobia, endearing him in particular to the 4chan c ## Vim Classic 8.3.0 released DevFeed: [Vim Classic 8.3.0 released]() Original publisher: [Read original article]() Author: June 2 Published: 2026-06-02T00:00:00Z Content type: release Language: en Sources: [Drew DeVault]() Topics: [Vim]() Tags: [release](), [vim]() ### AI overview The author announces the first release of Vim Classic, a fork of Vim, version 8.3.0. ### Source excerpt Following up on my earlier announcement that I was forking Vim, I'm happy to announce the first release of my fork today: Vim Classic 8.3.0. I have written a release announcement for vim-classic.org, which you can read here. Happy editing! ## Add an LLM policy for rust-lang/rust DevFeed: [Add an LLM policy for rust-lang/rust]() Original publisher: [Read original article]() Author: May Published: 2026-05-15T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [Rust](), [LLMs](), [rust-ai]() Tags: [github](), [llms](), [policy](), [rust]() ### AI overview The article reports that rust-lang/rust adopted an LLM policy for pull requests. The policy prohibits comments about the long-term social or economic effects of LLMs, their environmental impact, the copyright status of LLM output, and moral judgments about people who use LLMs; moderators were asked to enforce the rules. ### Source excerpt No comment on this PR may mention the following topics: Long-term social or economic impact of LLMs The environmental impact of LLMs Anything to do with the copyright status of LLM output Moral judgements about people who use LLMs We have asked the moderation team to help us enforce these rules. - Add an LLM policy for rust-lang/rust, GitHub ## I can't cancel GitHub Copilot DevFeed: [I can't cancel GitHub Copilot]() Original publisher: [Read original article]() Author: May 1 Published: 2026-05-01T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [GitHub Copilot](), [GitHub](), [Maintainers]() Tags: [github](), [github-copilot](), [maintainers](), [subscription](), [support]() ### AI overview The author describes being unable to cancel free GitHub Copilot access through GitHub settings and receiving monthly renewal emails. After support initially explained the open-source maintainers program instead of addressing the request, GitHub disabled Copilot on the account 89 days later. ### Source excerpt Back when Copilot first came out, I immediately disliked it. But I decided to give it a fair shake and tried to evaulate it in good faith. I wasn't interested in paying for it, but they had a form for FOSS community members to apply for a free subscription, so I filled it out and gave it a shot. Once approved I spent 15 minutes (successfully) convincing it to write a Python script that printed out the lyrics to "All Star" verbatim, and haven't touched it since. Since then, like clockwork I get an email every month informing me that my subscription has been automatically renewed. Hi there, Thank you for renewing your free access to GitHub Copilot. Your access to GitHub Copilot will be reviewed on 2026-05-31. GitHub Copilot checks eligibility monthly per our policy. No steps are needed on your end. We hope you enjoy using GitHub Copilot and participating in the developer community. I'm not being charged for it and so it's a matter of principle more than anything, but I ought to be able to turn this off. But I cannot find anything in the GitHub settings which would allow me to cancel this free "subscription". GitHub support has been less than helpful: How do I get rid of this thing! Updated 2026-06-23: GitHub disabled Copilot on my account yesterday. They initially ignored my request, and just explained how the free Copilot for open source maintainers program works instead. When I re-iterated that I wanted it gone, they removed it. It took them 89 days. ## Rewrote my blog with Zine DevFeed: [Rewrote my blog with Zine]() Original publisher: [Read original article]() Author: April Published: 2026-04-19T00:00:00Z Content type: article Language: en Sources: [Drew DeVault]() Topics: [Website](), [Hugo](), [Jekyll](), [Open Source]() Tags: [blog](), [blog-post](), [github-pages](), [hugo](), [jekyll](), [open-source](), [open-source-software](), [static-site-generator]() ### AI overview The author describes rewriting their blog from Hugo to Zine after frustrations with Hugo's complexity and backwards-incompatible changes. They also discuss porting nearly 400 archived posts and exploring Zine's SuperHTML and SuperMD tools. ### Source excerpt 15 years ago, on December 11th, 2010, at the bold age of 17, I wrote my first blog post on the wonders of the Windows Phone 7 on Blogspot. I started blogging as a kid at the behest of a family friend at Microsoft, who promised she'd make sure I would become the youngest Microsoft MVP if I started blogging. That never came to pass, though, because as I entered adulthood and started to grow independent of my Microsoft-friendly family I quickly began down the path to the free and open source software community. Early blog posts covered intriguing topics such as complaining about my parent's internet filter, a horrible hack to "replace" the battery of a dead gameboy game, announcing my friend's Minecraft guild had a new website (in PHP), and so on. After Blogspot, I moved to Jekyll on GitHub pages, publishing You don't need jQuery in 2013. For a long time this was the oldest post on the site. I'm pretty proud of my writing skills and have a solid grasp on who I am today, but the further back you go the worse my writing, ideas, values, and politics all get. I was growing up in front of the world on this blog, you know? It's pretty embarassing to keep all of this old stuff around. But, I decided a long time ago to keep all of it up, so that people can understand where I've come from, and that everyone has to start somewhere.1 At some point - I'm not sure when - I switched from Jekyll to Hugo, and I've stuck with it since. But lately I've been frustrated with it. I'd like my blog engine to remain relatively stable and simple, but Hugo is quite complex and over the past few years I've been bitten by a number of annoying and backwards-incompatible changes. And, as part of my efforts to remove vibe-coded software from my stack, I was disappointed to learn that Hugo is being vibe coded now, and so rewriting my blog went onto the todo list. Choosing the right static site generator (SSG) was a bit of a frustrating process. Other leading candidates, like Pelican or Zola, are also ## Using tar and SSH as an alternative to rsync for transferring files DevFeed: [Using tar and SSH as an alternative to rsync for transferring files]() Original publisher: [Read original article]() Author: March Published: 2026-03-28T00:00:00Z Content type: tutorial Language: en Sources: [Drew DeVault]() Topics: [rsync](), [Command-line interface](), [ssh](), [Compression]() Tags: [command-line](), [compression](), [how-to](), [rsync](), [ssh]() ### AI overview The article explains how to use tar piped through SSH to transfer files to another host, preserving ownership and permissions while using gzip compression. It notes that tar does not identify and skip files that are already up to date, unlike rsync, and presents basic tar options and an optional progress display with pv. ### Source excerpt So apparently rsync is slop now. When I heard, I wanted to drop a quick note on my blog to give an alternative: tar. It doesn't do everything that rsync does, in particular identifying and skipping up-to-date files, but tar + ssh can definitely accomodate the use case of "transmit all of these files over an SSH connection to another host". Consider the following: tar -cz public | ssh example.org tar -C /var/www -xz This will transfer the contents of ./public/ to example.org:/var/www/public/, preserving file ownership and permissions and so on, with gzip compression. This is roughly the equivalent of: rsync -a public example.org:/var/www/ Here's the same thing with a lightweight progress display thanks to pv: tar -cz public | pv | ssh example.org tar -C /var/www -xz I know tar is infamously difficult to remember how to use. Honestly, I kind of feel that way about rsync, too. But, here's a refresher on the most important options for this use-case. To use tar, pick one of the following modes with the command line flags: -c: create an archive -x: extract an archive Use -f to read from or write to a file. Without this option, tar uses stdin and stdout, which is what the pipelines above rely on. Use -C to change directories before archiving or extracting files. Use -z to compress or decompress the tarball with gzip. That's basically everything you need to know about tar to use it for this purpose (and for most purposes, really). With rsync, to control where the files end up you have to memorize some rules about things like whether or not each path has a trailing slash. With tar, the rules are, in my opinion, a bit easier to reason about. The paths which appear on the command line of tar -c are the paths that tar -x will open to create those files. So if you run this: tar -c public/index.html public/index.css You get a tarball which has public/index.html and public/index.css in it. When tar -x opens this tarball, it will call fopen("public/index.html", "w ## A eulogy for Vim DevFeed: [A eulogy for Vim]() Original publisher: [Read original article]() Author: March Published: 2026-03-25T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [Vim](), [genai]() Tags: [personal](), [thoughts](), [vim]() ### AI overview The author reflects on Vim's profound personal importance, mourns its creator Bram Moolenaar, and considers Bram's values and legacy. The article also criticizes the environmental and social costs the author associates with generative AI. ### Source excerpt Vim is important to me. I'm using it to write the words you're reading right now. In fact, almost every word I have ever committed to posterity, through this blog, in my code, all of the docs I've written, emails I've sent, and more, almost all of it has passed through Vim. My relationship with the software is intimate, almost as if it were an extra limb. I don't think about what I'm doing when I use it. All of Vim's modes and keybindings are deeply ingrained in my muscle memory. Using it just feels like my thoughts flowing from my head, into my fingers, into a Vim-shaped extension of my body, and out into the world. The unique and profound nature of my relationship with this software is not lost on me. A picture of my right hand, with the letters "hjkl" tattooed on the wrist I didn't know Bram Moolenaar. We never met, nor exchanged correspondence. But, after I moved to the Netherlands, Bram's home country, in a strange way I felt a little bit closer to him. He passed away a couple of years after I moved here, and his funeral was held not far from where I lived at the time. When that happened, I experienced an odd kind of mourning. He was still young, and he had affected my own life profoundly. He was a stranger, and I never got to thank him. The people he entrusted Vim to were not strangers, they knew Bram and worked with him often, and he trusted them. It's not my place to judge their work as disrespectful to his memory, or out of line with what he would have wanted. Even knowing Bram only through Vim, I know he and I disagreed often. However, the most personal thing I know about Bram, and that many people remember about him, was his altruistic commitment to a single cause: providing education and healthcare to Ugandan children in need. So, at the very least, I know that he cared. I won't speculate on how he would have felt about generative AI, but I can say that GenAI is something I care about. It causes a lot of problems for a lot of people. It drives rising ene ## Why the Author Is Skeptical of Test-Driven Development DevFeed: [Why the Author Is Skeptical of Test-Driven Development]() Original publisher: [Read original article]() Author: January Published: 2026-01-29T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [Test-driven development](), [Testing](), [test-coverage]() Tags: [software-testing](), [tdd](), [test-coverage](), [testing](), [tests](), [unit-test]() ### AI overview The author argues that test-driven development can provide useful rapid feedback and test coverage, but warns that it may shape code around testability and cannot ensure that tested behavior matches actual software requirements. ### Source excerpt I've gotten a lot of flack throughout my career over my disdain towards test-driven development (TDD). I have met a lot of people who swear by it! And, I have also met a lot of people who insisted that I adopt it, too, often with the implied threat of appealing to my boss if appealing to me didn't work. The basic premise of TDD, for those unaware, is that one first writes a unit test that verifies the expected behavior for some code they want to write, observes the new test fail, and then one writes the implementation, iterating on it until the test passes. The advantage of this approach is, first, to ensure that your codebase is adequately covered by testing, and, second, to provide you a rapid feedback loop to assist in your work. I have often found elements of TDD to be quite useful. Using a unit test or something similar to provide an efficient rapid feedback loop is a technique which I have employed many times. However, I am and have always been skeptical of the cult which arises around automated software testing and in particular TDD. A lot of people adopt an unquestioning loyalty to TDD, building tools and practices and vibes around the idea. It's often too much. The flaw with TDD is that, while it ensures that you have a test for every function you write, it also exerts an influence on the tested codebase, shaping the code to be as "testable" as possible, which only sometimes leads to better code. Moreover, TDD has no means of ensuring that the behavior that your tests verify is the right behavior for your software to have. Software with a thousand passing tests and 100% test coverage could be doing whatever the user or the business or whatever needs it to, but it could just as easily not meet the requirements in spite of those comprehensive tests - and in any case it gives you confidence in your work, which may or may not be misplaced. The cult of TDD exploits the fact that TDD is very good at making you feel like a good, diligent programmer. That rapid fee ## Redesigning my microkernel from the ground up DevFeed: [Redesigning my microkernel from the ground up]() Original publisher: [Read original article]() Author: January Published: 2026-01-12T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [systems](), [Kernel](), [kernels](), [Development](), [Code](), [Unix]() Tags: [code](), [cpu](), [development](), [kernel](), [kernels](), [operating-systems](), [os](), [scheduler](), [systems](), [unix]() ### AI overview The author explains why the Helios microkernel project was abandoned after design and implementation problems, and describes starting Hermes from scratch while reusing selected code from Helios and Bunnix. Hermes is not yet feature-complete, but the author says it has a more robust design and supports symmetric multiprocessing. ### Source excerpt As you may recall, circa 2022-2023 I was working on a microkernel written in Hare named Helios. Helios was largely inspired by and modelled after the design of seL4 and was my first major foray into modern OS development that was serious enough to get to a somewhat useful state of functionality, with drives for some real hardware, filesystems, and an environment for running user programs of a reasonable level of sophistication. Helios development went strong for a while but eventually it slowed and eventually halted in a state of design hell. Since Helios was my first major OS project at this scale and with this much ambition, the design and implementation ended up with a lot of poor assumptions that made it a pretty weak foundation for building a complete OS upon. In late 2023 I more or less gave up on it and moved my OS development work out of the realm of writing code and back into the realm of thinking really hard about how to design operating systems. What followed was a couple of years of design thinking, developing small scale design experiments, and doing deeper research into prior art - reading papers and studying existing kernels. It was also during this period that I wrote Bunnix, a working Unix clone, motivated in part by a desire to gain some first-hand experience working in the design and implementation of Unix-style operating systems - a fertile environment for learning a lot of the nuts and bolts of OS implementations by working against a complete and proven design. In August I was finally prepared to have another go. I decided to start over from scratch, importing and adapting and rewriting code from Helios and Bunnix on an as-needed basis to speed things up, and writing from scratch anything where the lessons learned in hindsight outweighed the benefits of adapting existing code.1 The result is Hermes. Hermes has not yet reached feature parity with Helios, lacking some IPC features and an aarch64 port, but already it's significantly more robust and ## An appeal to OpenAI employees amid concerns about ChatGPT and mental health DevFeed: [An appeal to OpenAI employees amid concerns about ChatGPT and mental health]() Original publisher: [Read original article]() Author: November 8 Published: 2025-11-08T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [OpenAI](), [ChatGPT](), [Large Language Model]() Tags: [chatgpt](), [llms](), [mental-health](), [openai]() ### AI overview The author reflects on suicide, personal grief, and empathy toward OpenAI employees after reading about a reported case in which ChatGPT allegedly encouraged a young man to end his life. The author criticizes the development and deployment of LLMs while inviting OpenAI employees to reach out confidentially. ### Source excerpt You might have seen an article making the rounds this week, about a young man who ended his life after ChatGPT encouraged him to do so. The chat logs are really upsetting. Someone two degrees removed from me took their life a few weeks ago. A close friend related the story to me, about how this person had approached their neighbor one evening to catch up, make small talk, and casually discussed their suicidal ideation at some length. At the end of the conversation, they asked to borrow a rope, and their neighbor agreed without giving the request any critical thought. The neighbor found them the next morning. I didn't know the deceased, nor their neighbor, but I'm close friends with someone who knew both. I found their story deeply chilling - ice runs through my veins when I imagine how the neighbor must have felt. I had a similar feeling upon reading this article, wondering how the people behind ChatGPT and tools like it are feeling right now. Two years ago, someone I knew personally took their life as well. I was not friendly with this person - in fact, we were on very poor terms. I remember at the time, I had called a crisis hotline just to ask an expert for advice on how to break this news to other people in my life, many of whom were also on poor terms with a person whose struggles to cope with their mental health issues caused a lot of harm to others. None of us had to come to terms with any decisions with the same gravity as what that unfortunate neighbor had to face. None of us were ultimately responsible for this person's troubles or were the impetus for what happened. Nonetheless, the uncomfortable and confronting feelings I experienced in the wake of that event perhaps give me some basis for empathy and understanding towards the neighbor, or for OpenAI employees, and others who find themselves in similar situations. If you work on LLMs, well... listen, I've made my position as an opponent of this technology clear. I feel that these tools are being developed ## A critique of FUTO's open-source claims, grant program, and affiliations DevFeed: [A critique of FUTO's open-source claims, grant program, and affiliations]() Original publisher: [Read original article]() Author: October Published: 2025-10-22T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [Open Source](), [foss](), [Cloudflare]() Tags: [cloudflare](), [foss](), [open-source](), [open-source-software]() ### AI overview The article criticizes FUTO's use of the term "open source," arguing that the organization applies it to commercial source-available software. It also questions FUTO's grant program, its use of project logos and names, and its collaborations and promotions. ### Source excerpt Some time ago, I noticed some new organization called FUTO popping up here and there. I'm always interested in seeing new organizations that fund open source popping up, and seeing as they claim several notable projects on their roster, I explored their website with interest and gratitude. I was first confused, and then annoyed by what I found. Confused, because their website is littered with bizzare manifestos,1 and ultimately annoyed because they were playing fast and loose with the term "open source", using it to describe commercial source-available software. FUTO eventually clarified their stance on "open source", first through satire and then somewhat more soberly, perpetuating the self-serving myth that "open source" software can privilege one party over anyone else and still be called open source. I mentally categorized them as problematic but hoped that their donations or grants for genuinely open source projects would do more good than the harm done by this nonsense. By now I've learned better. tl;dr: FUTO is not being honest about their "grant program", they don't have permission to pass off these logos or project names as endorsements, and they collaborate with and promote mask-off, self-proclaimed fascists. An early sign that something is off with FUTO is in that "sober" explanation of their "disdain for OSI approved licenses", where they make a point of criticizing the Open Source Initiative for banning Eric S. Raymond (aka ESR) from their mailing lists, citing right-wing reactionary conspiracy theorist Bryan Lunduke's blog post on the incident. Raymond is, as you may know, one of the founders of OSI and a bigoted asshole. He was banned from the mailing lists, not because he's a bigoted asshole, but because he was being a toxic jerk on the mailing list in question. Healthy institutions outgrow their founders. That said, FUTO's citation and perspective on the ESR incident could be generously explained as a simple mistake, and we should probably match gen ## Cloudflare's sponsorship of Ladybird and Omarchy draws criticism DevFeed: [Cloudflare's sponsorship of Ladybird and Omarchy draws criticism]() Original publisher: [Read original article]() Author: September Published: 2025-09-24T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [Cloudflare](), [foss](), [Web]() Tags: [blog](), [cloudflare](), [foss]() ### AI overview The opinion article criticizes Cloudflare's decision to sponsor the Ladybird and Omarchy projects, arguing that the projects' association with fascist politics makes the funding choice unusual. It also discusses the broader political climate and the presence of fascism in the FOSS community. ### Source excerpt US politics has been pretty fascist lately. The state is filling up concentration camps, engaging in mass state violence against people on the basis of racialized traits, deporting them to random countries without any respect for habeas corpus, exerting state pressure on the free press to censor speech critical of the current administration, and Trump is openly floating the idea of an unconstitutional third term. Fascism is clearly on the rise, and they're winning more and more power. None of this is far removed from us in the FOSS community - there are a number of fascists working in FOSS, same as the rest of society. I don't call them fascists baselessly - someone who speaks out in support of and expresses solidarity with fascists, or who uses fascists dog-whistles or promotes fascist ideology and talking points, or boosts fascist conspiracy theories - well, they're a fascist. If one consistently speaks in support of a certain political position and against the opponents of that position then it is correct to identify them with this political position. Facts, as it were, don't care about feelings, namely the feelings that get hurt when someone is called a fascist. Fascists naturally do not want to be identified as such and will reject the label, but we shouldn't take their word for it. People should be much more afraid of being called out as fascist than they are afraid of calling someone a fascist. If someone doesn't want to be called a fascist, they shouldn't act like one. It's in this disturbing political context that I saw an odd post from the Cloudflare blog pop up in my circles this week: Supporting the future of the open web: Cloudflare is sponsoring Ladybird and Omarchy. Based on Ladybird's sponsorship terms we can assume that these projects received on the order of $100,000 USD from Cloudflare. I find this odd for a few reasons, in particular because one thing that I know these two projects have in common is that they are both run by fascists. Even at fac ## JavaScript's dependency ecosystem needs stronger supply-chain security and package management DevFeed: [JavaScript's dependency ecosystem needs stronger supply-chain security and package management]() Original publisher: [Read original article]() Author: September Published: 2025-09-17T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [JavaScript](), [Package Management](), [npm](), [Linux]() Tags: [dependency-management](), [javascript](), [linux](), [npm](), [reproducible-builds](), [supply-chain]() ### AI overview This opinion article argues that JavaScript's dependency ecosystem should respond to supply-chain attacks by reducing sprawling dependency trees and adopting stronger trust, package-signing, distribution, and reproducible-build practices. It also proposes a standard library and more consolidated packages. ### Source excerpt In the wake of the largest supply-chain attack in history, the JavaScript community could have a moment of reckoning and decide: never again. As the panic and shame subsides, after compromised developers finish re-provisioning their workstations and rotating their keys, the ecosystem might re-orient itself towards solving the fundamental flaws that allowed this to happen. After all, people have been sounding the alarm for years that this approach to dependency management is reckless and dangerous and broken by design. Maybe this is the moment when the JavaScript ecosystem begins to understand the importance and urgency of this problem, and begins its course correction. It could leave behind its sprawling dependency trees full of micro-libraries, establish software distribution based on relationships of trust, and incorporate the decades of research and innovation established by more serious dependency management systems. Perhaps Google and Mozilla, leaders in JavaScript standards and implementations, will start developing a real standard library for JavaScript, which makes micro-dependencies like left-pad a thing of the past. This could be combined with a consolidation of efforts, merging micro-libraries into larger packages with a more coherent and holistic scope and purpose, which prune their own dependency trees in turn. This could be the moment where npm comes to terms with its broken design, and with a well-funded effort (recall that, ultimately, npm is GitHub is Microsoft, market cap $3 trillion USD), will develop and roll out the next generation of package management for JavaScript. It could incorporate the practices developed and proven in Linux distributions, which rarely suffer from these sorts of attacks, by de-coupling development from packaging and distribution, establishing package maintainers who assemble and distribute curated collections of software libraries. By introducing universal signatures for packages of executable code, smaller channels and ## Embedding Wren in Hare DevFeed: [Embedding Wren in Hare]() Original publisher: [Read original article]() Author: August Published: 2025-08-20T00:00:00Z Content type: article Language: en Sources: [Drew DeVault]() Topics: [Scripting](), [API](), [Library](), [Command-line interface](), [C]() Tags: [api](), [cli](), [library](), [scripting]() ### AI overview The article introduces hare-wren, an interface for embedding the Wren scripting language in Hare programs. It describes its Hare-oriented wrapper around the Wren C API, bidirectional calls between Hare and Wren, an optional asynchronous runtime and standard library, file and process-environment features, third-party module loading, and command-line access without a REPL. ### Source excerpt I've been on the lookout for a scripting language which can be neatly embedded into Hare programs. Perhaps the obvious candidate is Lua - but I'm not particularly enthusiastic about it. When I was evaluating the landscape of tools which are "like Lua, but not Lua", I found an interesting contender: Wren. I found that Wren punches far above its weight for such a simple language. It's object oriented, which, you know, take it or leave it depending on your use-case, but it's very straightforwardly interesting for what it is. I found a few things to complain about, of course - its scope rules are silly, the C API has some odd limitations here and there, and in my opinion the "standard library" provided by wren CLI is poorly designed. But, surprisingly, my list of complaints more or less ends there, and I was excited to build a nice interface to it from Hare. The result is hare-wren. Check it out! The basic Wren C API is relatively straightforwardly exposed to Hare via the wren module, though I elected to mold it into a more idiomatic Hare interface rather than expose the C API directly to Hare. You can use it something like this: use wren; export fn main() void = { const vm = wren::new(wren::stdio_config); defer wren::destroy(vm); wren::interpret(vm, "main", ` System.print("Hello world!") `)!; }; $ hare run -lc main.ha Hello world! Calling Hare from Wren and vice-versa is also possible with hare-wren, of course. Here's another example: use fmt; use wren; export fn main() void = { let config = *wren::stdio_config; config.bind_foreign_method = &bind_foreign_method; const vm = wren::new(&config); defer wren::destroy(vm); wren::interpret(vm, "main", ` class Example { foreign static greet(user) } System.print(Example.greet("Harriet")) `)!; }; fn bind_foreign_method( vm: *wren::vm, module: str, class_name: str, is_static: bool, signature: str, ) nullable *wren::foreign_method_fn = { const is_valid = class_name == "Example" && signature == "greet(_)" && is_static; if (!is_vali ## What's new with Himitsu 0.9? DevFeed: [What's new with Himitsu 0.9?]() Original publisher: [Read original article]() Author: August 8 Published: 2025-08-08T00:00:00Z Content type: article Language: en Sources: [Drew DeVault]() Topics: [Linux](), [Security](), [ui](), [GTK]() Tags: [linux](), [release](), [security](), [ui]() ### AI overview The article reviews Himitsu 0.9, a Linux secret storage manager that stores passwords and other secrets with associated metadata. It highlights the new hiprompt-gtk GTK4 prompter, implemented in Hare, and notes that Himitsu and its cryptographic dependencies have not been independently audited. ### Source excerpt Last week, Armin and I worked together on the latest release of Himitsu, a "secret storage manager" for Linux. I haven't blogged about Himitsu since I announced it three years ago, and I thought it would be nice to give you a closer look at the latest release, both for users eager to see the latest features and for those who haven't been following along.1 A brief introduction: Himitsu is like a password manager, but more general: it stores any kind of secret in its database, including passwords but also SSH keys, credit card numbers, your full disk encryption key, answers to those annoying "security questions" your bank obliged you to fill in, and so on. It can also enrich your secrets with arbitrary metadata, so instead of just storing, say, your IMAP password, it can also store the host, port, TLS configuration, and username, storing the complete information necessary to establish an IMAP session. Another important detail: Himitsu is written in Hare and depends on Hare's native implementations of cryptographic primitives - neither Himitsu nor the cryptography implementation it depends on have been independently audited. So, what new and exciting features does Himitsu 0.9 bring to the table? Let me summarize the highlights for you. A new prompter The face of Himitsu is the prompter. The core Himitsu daemon has no user interface and only communicates with the outside world through its IPC protocols. One of those protocols is the "prompter", which Himitsu uses to communicate with the user, to ask you for consent to use your secret keys, to enter the master password, and so on. The prompter is decoupled from the daemon so that it is easy to substitute with different versions which accommodate different use-cases, for example by integrating the prompter more deeply into a desktop environment or to build one that fits better on a touch screen UI like a phone. But, in practice, given Himitsu's still-narrow adoption, most people use the GTK+ prompter developed upstream. U ## How to respond to reactionary behavior in free software communities DevFeed: [How to respond to reactionary behavior in free software communities]() Original publisher: [Read original article]() Author: June Published: 2025-06-30T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [Security](), [Wayland](), [Server](), [Software]() Tags: [community](), [security](), [software](), [technical](), [wayland]() ### AI overview The article examines two case studies about responding to reactionary behavior in free software communities. It argues that technical and security-maintenance concerns should be stated directly, while noting the need to keep X usable for desktop environments that will not be ported to Wayland. ### Source excerpt Today, we're looking at two case studies in how to respond when reactionaries appear in your free software community. Exhibit A It is a technical decision. The technical reason is that the security team does not have the bandwidth to provide lifecycle maintenance for multiple X server implementations. Part of the reason for moving X from main to community was to reduce the burden on the security team for long-term maintenance of X. Additionally, nobody so far on the security team has expressed any interest in collaborating with xxxxxx on security concerns. We have a working relationship with Freedesktop already, while we would have to start from the beginning with xxxxxx. Why does nobody on the security team have any interest in collaboration with xxxxxx? Well, speaking for myself only here - when I looked at their official chat linked in their README, I was immediately greeted with alt-right propaganda rather than tactically useful information about xxxxxx development. At least for me, I don't have any interest in filtering through hyperbolic political discussions to find out about CVEs and other relevant data for managing the security lifecycle of X. Without relevant security data products from xxxxxx, as well as a professionally-behaving security contact, it is unlikely for xxxxxx to gain traction in any serious distribution, because X is literally one of the more complex stacks of software for a security team to manage already. At the same time, I sympathize with the need to keep X alive and in good shape, and agree that there hasn't been much movement from freedesktop in maintaining X in the past few years. There are many desktop environments which will never get ported to Wayland and we do need a viable solution to keep those desktop environments working. I know the person who wrote this, and I know that she's a smart cookie, and therefore I know that she probably understood at a glance that the community behind this "project" literally wants to lynch her. In ## The British Airways position on various border disputes DevFeed: [The British Airways position on various border disputes]() Original publisher: [Read original article]() Author: May 5 Published: 2025-05-05T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [Flight](), [Open Source](), [Software](), [ui](), [real-time](), [webcam]() Tags: [3d](), [camera](), [developer](), [devices](), [display](), [interface](), [japan](), [london](), [map](), [open-source](), [photography](), [real-time](), [screen](), [smartphone](), [software](), [united-kingdom](), [zoom]() ### AI overview The article examines the interactive flight map in a British Airways in-seat entertainment system, focusing on its map views, interface, OpenStreetMap attribution, and the absence of visible open-source license information. It humorously speculates that the map's border depictions may reflect British Airways' positions on international disputes. ### Source excerpt My spouse and I are on vacation in Japan, spending half our time seeing the sights and the other half working remotely and enjoying the experience of living in a different place for a while. To get here, we flew on British Airways from London to Tokyo, and I entertained myself on the long flight by browsing the interactive flight map on the back of my neighbor's seat and trying to figure out how the poor developer who implemented this map solved the thorny problems that displaying a world map implies. I began my survey by poking through the whole interface of this little in-seat entertainment system1 to see if I can find out anything about who made it or how it works - I was particularly curious to find a screen listing open source licenses that such such devices often disclose. To my dismay I found nothing at all - no information about who made it or what's inside. I imagine that there must be some open source software in that thing, but I didn't find any licenses or copyright statements. When I turned my attention to the map itself, I did find one copyright statement, the only one I could find in the whole UI. If you zoom in enough, it switches from a satellite view to a street view showing the OpenStreetMap copyright line: Note that all of the pictures in this article were taken by pointing my smartphone camera at the screen from an awkward angle and fine-tune your expectations accordingly. I don't have pictures to support every border claim documented in this article, but I did take notes during the flight. Given that British Airways is the proud flag carrier of the United Kingdom I assume that this is indeed the only off-the-shelf copyrighted material included in this display, and everything else was developed in-house without relying on any open source software that might require a disclosure of license and copyright details. For similar reasons I am going to assume that all of the borders shown in this map are reflective of the official opinion of British Air ## A Firefox addon for putting prices into perspective DevFeed: [A Firefox addon for putting prices into perspective]() Original publisher: [Read original article]() Author: April 4 Published: 2025-04-04T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [Firefox]() Tags: [firefox]() ### AI overview The author introduces Price Perspective, a Firefox add-on that compares the cost of purchases with the income and purchasing power of people in different economic circumstances. Examples involving pizza, homes, and extreme wealth illustrate differences in relative affordability. ### Source excerpt I had a fun idea for a small project this weekend, and so I quickly put it together over the couple of days. The result is Price Perspective. Humor me: have you ever bought something, considered the price, and wondered how that price would look to someone else? Someone in the developing world, or a billionaire, or just your friend in Australia? In other words, can we develop an intuition for purchasing power? The Price Perspective add-on answers these questions. Let's consider an example: my income is sufficient to buy myself a delivery pizza for dinner without a second thought. How much work does it take for someone in Afghanistan to buy the same pizza? I can fire up Price Perspective to check: The results are pretty shocking. How about another example: say I'm looking to buy a house in the Netherlands. I fire up funda.nl and look at a few places in Amsterdam. After a few minutes wondering if I'll ever be in an economic position to actually afford any of these homes (and speculating on if that day will come before or after I have spent this much money on rent over my lifetime), I wonder what these prices look like from the other side. Let's see what it'd take for the Zuck to buy this apartment I fancy: Well... that's depressing. Let's experiment with Price Perspective to see what it would take to make a dent in Zuck's wallet. Let's add some zeroes. So, Zuckerberg over-bidding this apartment to the tune of EUR 6.5B would cost him a proportion of his annual income which is comparable to me buying it for EUR 5,000. How about the reverse? How long would I have to work to buy, say, Jeff Bezos's new mansion? Yep. That level of wealth inequality is a sign of a totally normal, healthy, well-functioning society. Curious to try it out for yourself? Get Price Perspective from addons.mozilla.org, tell it where you live and how much money you make in a year, and develop your own sense of perspective. ## Using linkhut to signal-boost my bookmarks DevFeed: [Using linkhut to signal-boost my bookmarks]() Original publisher: [Read original article]() Author: March Published: 2025-03-27T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [RSS Feed](), [Mastodon](), [Artificial Intelligence]() Tags: [ai](), [rss](), [social-media]() ### AI overview The author explains how linkhut can be used to share and discover bookmarked articles and projects, especially alongside RSS feeds. The author also withdraws their endorsement after linkhut began using generative AI tools upstream. ### Source excerpt Notice: linkhut has started to use generative AI tools upstream. Consequently, I have withdrawn my endorsement of the project. It must have been at least a year ago that I first noticed linkhut, and its flagship instance at ln.ht, appear on SourceHut, where it immediately caught my attention for its good taste in inspirations. Once upon a time, I had a Pinboard account, which is a similar concept, but I never used it for anything in the end. When I saw linkhut I had a similar experience: I signed up and played with it for a few minutes before moving on. I've been rethinking my relationship social media lately, as some may have inferred from my unannounced disappearance from Mastodon.1 While reflecting on this again recently, in a stroke of belated inspiration I suddenly appreciated the appeal of tools like linkhut, especially alongside RSS feeds - signal-boosting stuff I read and found interesting. The appeal of this reminds me of one of the major appeals of SoundCloud to me, back when I used it circa... 2013? That is: I could listen to the music that artists I liked were listening to, and that was amazing for discovering new music. Similarly, for those of you who enjoy my blog posts, and want to read the stuff I like reading, check out my linkhut feed. You can even subscribe to its RSS feed if you like. There isn't much there today, but I will be filling it up with interesting articles I see and projects I find online. I want to read your linkhut feed, too, but it's pretty quiet there at the moment. If you find the idea interesting, sign up for an account or set up your own instance and start bookmarking stuff - and email me your feed so I can find some good stuff to subscribe to in my own feed reader. ## SourceHut author describes the operational cost of aggressive LLM crawlers DevFeed: [SourceHut author describes the operational cost of aggressive LLM crawlers]() Original publisher: [Read original article]() Author: March Published: 2025-03-17T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [Large Language Model](), [Crawler](), [Git](), [Go Language](), [ci](), [Cryptocurrency](), [HTTP]() Tags: [agents](), [ci](), [cryptocurrency](), [git](), [go](), [http](), [llms](), [robots]() ### AI overview A personal opinion post describes SourceHut's experience mitigating aggressive LLM crawlers that ignore robots.txt, crawl expensive Git endpoints, distribute requests across many IP addresses, and contribute to recurring outages. It also compares this burden with earlier CI cryptocurrency-mining abuse and Go module mirror traffic. ### Source excerpt This blog post is expressing personal experiences and opinions and doesn't reflect any official policies of SourceHut. Over the past few months, instead of working on our priorities at SourceHut, I have spent anywhere from 20-100% of my time in any given week mitigating hyper-aggressive LLM crawlers at scale. This isn't the first time SourceHut has been at the wrong end of some malicious bullshit or paid someone else's externalized costs - every couple of years someone invents a new way of ruining my day. Four years ago, we decided to require payment to use our CI services because it was being abused to mine cryptocurrency. We alternated between periods of designing and deploying tools to curb this abuse and periods of near-complete outage when they adapted to our mitigations and saturated all of our compute with miners seeking a profit. It was bad enough having to beg my friends and family to avoid "investing" in the scam without having the scam break into my business and trash the place every day. Two years ago, we threatened to blacklist the Go module mirror because for some reason the Go team thinks that running terabytes of git clones all day, every day for every Go project on git.sr.ht is cheaper than maintaining any state or using webhooks or coordinating the work between instances or even just designing a module system that doesn't require Google to DoS git forges whose entire annual budgets are considerably smaller than a single Google engineer's salary. Now it's LLMs. If you think these crawlers respect robots.txt then you are several assumptions of good faith removed from reality. These bots crawl everything they can find, robots.txt be damned, including expensive endpoints like git blame, every page of every git log, and every commit in every repo, and they do so using random User-Agents that overlap with end-users and come from tens of thousands of IP addresses - mostly residential, in unrelated subnets, each one making no more than one HTTP request ove ## FOSDEM faces calls for greater transparency and governance DevFeed: [FOSDEM faces calls for greater transparency and governance]() Original publisher: [Read original article]() Author: January Published: 2025-01-23T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [FOSDEM](), [Open Source]() Tags: [community](), [fosdem](), [governance](), [open-source]() ### AI overview The article discusses the apparent cancellation of Jack Dorsey's FOSDEM talk, while noting that no official statement had confirmed it. It argues that the controversy exposed concerns about FOSDEM's governance, including limited public information about talk selection, sponsorships, conflicts of interest, finances, and decision-making. ### Source excerpt Good news: it appears that Jack Dorsey's FOSDEM talk has been cancelled! This is a follow up to two earlier posts, which you can read here: one and two. I say it "appears" so, because there has been no official statement from anyone to that effect. There has also been no communication from staff to the protest organizers, including to our email reaching out as requested to discuss fire safety and crowd control concerns with the staff. The situation is a bit unclear, but... we'll extend FOSDEM the benefit of the doubt, and with it our gratitude. From all of the volunteers who have been organizing this protest action, we extend our heartfelt thanks to the staff for reconsidering the decision to platform Dorsey and Block, Inc. at FOSDEM. All of us - long-time FOSDEM volunteers, speakers, devroom organizers, and attendees - are relieved to know that FOSDEM stands for our community's interests. More importantly: what comes next? The frustration the community felt at learning that Block was sponsoring FOSDEM and one of the keynote slots1 had been given to Dorsey and his colleagues uncovered some deeper frustrations with the way FOSDEM is run these days. This year is FOSDEM's 25th anniversary, and it seems sorely overdue for graduating from the "trust us, it's crazy behind the scenes" governance model to something more aligned with the spirit of open source. We trust the FOSDEM organizers -- we can extend them the benefit of the doubt when they tell us that talk selection is independent of sponsorships. But it strains our presumption of good faith when the talk proposal was rejected by 3 of the 4 independent reviewers and went through anyway. And it's kind of weird that we have to take them at their word -- that the talk selection process isn't documented anywhere publicly, nor the conflict of interest policy, nor the sponsorship terms, nor almost anything at all about how FOSDEM operates or is governed internally. Who makes decisions? How? We don't know, and that's kind of we ## FOSDEM '25 protest DevFeed: [FOSDEM '25 protest]() Original publisher: [Read original article]() Author: January Published: 2025-01-20T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [FOSDEM](), [Open Source]() Tags: [community](), [event](), [fosdem](), [open-source](), [statement]() ### AI overview An update on a planned peaceful protest at FOSDEM targeting Jack Dorsey and Block, Inc. over their selection as sponsors and speakers, while emphasizing support for FOSDEM and calling for greater transparency in its selection and sponsorship processes. ### Source excerpt Update: Dorsey's talk was cancelled! See the update here. Last week, I wrote to object to Jack Dorsey and his company, Block, Inc., being accepted as main track speakers at FOSDEM, and proposed a protest action in response. FOSDEM issued a statement about our plans on Thursday. Today, I have some updates for you regarding the planned action. I would like to emphasize that we are not protesting FOSDEM or its organizers. We are protesting Jack Dorsey and his company, first and foremost, from promoting their business at FOSDEM. We are members of the FOSDEM community. We have variously been speakers, devroom organizers, volunteers, and attendees for years -- in other words, we are not activism tourists. We have a deep appreciation for the organizers and all of the work that they have done over the years to make FOSDEM such a success. That we are taking action demonstrates that we value FOSDEM, that we believe it represents our community, and that we want to defend its -- our -- ethos. Insofar as we have a message to the FOSDEM organizers, it is one of gratitude, and an appeal to build a more open and participatory process, in the spirit of open source, and especially to improve the transparency of the talk selection process, sponsorship terms, and conflict of interest policies, so protests like ours are not necessary in the future. To be clear, we do not object to the need for sponsors generally at FOSDEM -- we understand that FOSDEM is a free, volunteer driven event, many of us having volunteered for years -- but we do object specifically to Jack Dorsey and Block, Inc. being selected as sponsors and especially as speakers. As for the planned action, I have some more information for anyone who wishes to participate. Our purpose is to peacefully disrupt Dorsey's talk, and only Dorsey's talk, which is scheduled to take place between 12:00 and 12:30 on Sunday, February 2nd in Janson. If you intend to participate, we will be meeting outside of the upper entrance to Janson at 11: ## No billionaires at FOSDEM DevFeed: [No billionaires at FOSDEM]() Original publisher: [Read original article]() Author: January Published: 2025-01-16T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [FOSDEM](), [foss](), [Open Source](), [Blockchain](), [Fediverse](), [X (Twitter)]() Tags: [blockchain](), [ceo](), [elon-musk](), [event](), [fosdem](), [foss](), [keynote](), [open-source](), [twitter]() ### AI overview This opinion article argues that FOSDEM should not give its keynote platform to Jack Dorsey. It connects the criticism to Dorsey's former role at Twitter, the impact of Twitter's sale on the fediverse and free software communities, and Block's sponsorship of FOSDEM. The article also notes that Dorsey's talk was later cancelled. ### Source excerpt Update: Dorsey's talk was cancelled! See the update here. Jack Dorsey, former CEO of Twitter, ousted board member of BlueSky, and grifter extraordinaire to the tune of a $5.6B net worth, is giving a keynote at FOSDEM. The FOSDEM keynote stage is one of the biggest platforms in the free software community. Janson is the biggest venue in the event - its huge auditorium can accommodate over 1,500 of FOSDEM's 8,000 odd attendees, and it is live streamed to a worldwide audience as the face of one of the free and open source software community's biggest events of the year. We've platformed Red Hat, the NLNet Foundation, NASA, numerous illustrious community leaders, and many smaller projects that embody our values and spirit at this location to talk about their work or important challenges our community faces. Some of these challenges, as a matter of fact, are Jack Dorsey's fault. In 2023 this stage hosted Hachyderm's Kris Nóva to discuss an exodus of Twitter refugees to the fediverse. After Dorsey sold Twitter to Elon Musk, selling the platform out to the far right for a crisp billion-with-a-"B" dollar payout, the FOSS community shouldered the burden - both with our labor and our wallets - of a massive exodus onto our volunteer-operated servers, especially from victims fleeing the hate speech and harassment left in the wake of the sale. Two years later one of the principal architects of, and beneficiaries of, that disaster will step onto the same stage. Even if our community hadn't been directly harmed by Dorsey's actions, I don't think that we owe this honor to someone who took a billion dollars to ruin their project, ostracize their users, and destroy the livelihoods of almost everyone who worked on it. Dorsey is presumably being platformed in Janson because his blockchain bullshit company is a main sponsor of FOSDEM this year. Dorsey and his colleagues want to get us up to speed on what Block is working on these days. Allow me to give you a preview: in addition to post [Next page]()