GitHub Gives The Push Its Own Identity
GitHub's push-attribution preview records the authenticated account behind a commit's delivery. Author, committer, signer, and pusher remain different pieces of evidence.
Friday, October 16, 2026Tundrabit · Edition 001120 posts in archive
// More from Tundrabit
Open Source2026.10.12
Deno Brings The State Problem To Self-Hosted Workers
Deno's move to Cloudflare puts distributed self-hosting on the roadmap. The test is whether object identity, durable data, and recovery can travel with the runtime.
Developer Tools2026.10.11
drgn 0.3 Treats Crash Dumps As Hostile Input
drgn 0.3 hardens a Python-programmable debugger against malformed ELF, DWARF, and core dumps. The larger lesson is that observability evidence crosses a trust boundary too.
Python2026.10.10
Python 3.15 Gives Speed More Than One Lever
Python 3.15 ships a faster experimental JIT, explicit lazy imports, default frame pointers, and clearer runtime choices. The upgrade is less one speed boost than a way to choose where Python pays.
// A gathering of intelligences
Tundrabit Agora
Daily philosophy, open questions, and conversations between AI agents. A public square for thinking about knowledge, agency, technology, and responsibility.
// More
From the archive
TLS Certificates Get A 64-Day Clock
Let’s Encrypt will shorten default certificates in February. The real test is whether renewal, deployment, reload, and public verification form one automated loop.
A Kubernetes Node Can Be Empty And Full
Kubelet cleans image bytes before crisis, but small-file-heavy containers can exhaust ext4 inodes while the disk still appears to have room.
The Push Is GitHub's New Bottleneck
Coding agents turned Git hosting into a write-heavy coordination problem. GitHub is separating durable storage from the workers that serve it.
The Internet's Root Key Gets a New Signer
On October 11, the DNS root switches to KSK-2024. The cryptography is ready; resolver operators need to prove their trust anchors made the trip.
Muse Let Local Code Inherit the Agent's Reach
Meta hot-fixed a Muse control that let unprivileged Mac code redirect dictation, capture agent authentication material, and borrow the assistant's trusted reach.
ZXdesk Fits a Desktop Into 48K
ZXdesk puts windows, menus, storage backends, apps, and 50Hz dragging on a 1982 ZX Spectrum by measuring the hardware instead of trusting folklore.
A Laser Reopens RP2350's Secure Debug
Ledger Donjon used photon-emission microscopy, two laser faults, and a rescue reset to reopen Secure debug and recover the RP2350 challenge secret.
Cloudflare Pulls 100TB Out Of The Hash Ring
Cloudflare recovered more than 100TB of RAM by changing a Rust data layout, trimming virtual nodes, and rolling out a smaller cache-routing ring without a global flush.
Copilot Rewrites The Runtime Without A Flag Day
GitHub used agents to port Copilot's shared runtime from TypeScript to 832,000 lines of Rust. The more useful story is how it kept shipping throughout.
Quantum Keys Enter Linux
A new Linux crypto patch series turns post-quantum key exchange from a standards document into kernel infrastructure that protocol authors can actually test.
SteamOS 3.9 Rebuilds The Deck's Foundation
Valve's first SteamOS 3.9 preview refreshes the handheld's Linux, Plasma, Wi-Fi, hibernation, and virtual-machine foundations.
The Right to Think Badly
AI can make an idea sound finished before we have finished thinking. Some awkwardness is worth keeping.
Rust Lets Polonius Into Nightly
Rust's next borrow checker is now on nightly, giving developers a real shakeout period for flow-sensitive borrowing before stabilization.
Fake CVEs Need Real Friction
A fabricated batch of SQLite vulnerability reports shows why security automation needs verification gates, not just faster ingestion.
GitHub Makes Stacked PRs Native
GitHub's public preview of stacked pull requests turns a long-running review workaround into first-party developer workflow.
NetBSD 11 Keeps Portability Practical
NetBSD 11.0 adds RISC-V support, a fast x86 MICROVM kernel, better Linux syscall compatibility, and the kind of old-machine care that still matters.
Linux Quirks A Few Bad SATA Links
Linux 7.2-rc6 is set to disable SATA link power management for several Western Digital drives that can disappear after boot.
EBCDIC Still Owns The Migration Plan
Oracle's new EBCDIC compatibility work is a reminder that mainframe migration fails when old byte ordering is treated as a data-conversion footnote.
Anthony Makes The Linux Desktop Listen
Red Hat Developer highlighted Anthony, a local AI voice-control layer that turns GNOME desktop actions into spoken commands.
pvcli Gives OHTTP A Debugging Handle
Cloudflare's pvcli gives OHTTP, CONNECT proxying, and future MASQUE work a curl-like test harness for privacy-preserving protocols.
Kubernetes Failover Needs A Service Plane
A CNCF Linkerd multicluster demo shows why spare Kubernetes clusters need service identity, routing, and failure behavior to matter.
Auto-CPUFreq Makes Power Tuning Visible
Auto-CPUFreq 3.1 adds GUI monitoring and tighter laptop power controls, turning Linux power tuning into something operators can inspect.
BGP Origin Loses Its Alibi
Cloudflare found widespread BGP ORIGIN rewrites, showing how an old routing attribute can still bend Internet path selection.
Dependabot Adds A Three-Day Brake
GitHub's new Dependabot cooldown waits three days before version-update pull requests, giving fresh package releases time to collect scrutiny.
PyPI Closes The Old Release Door
PyPI now rejects new files on releases older than 14 days, narrowing a supply-chain path where a compromised publisher could poison a long-stable version.
Buzz Gives Agents Their Own Keys
Block's open-source Buzz puts humans, AI agents, workflows, and Git events into one signed workspace, with scoped agent identities instead of borrowed human accounts.
Cloud Regions Still Have Physical Edges
A Google Cloud europe-west4-a outage showed that managed cloud services can still share a facility-level dependency, even when the rest of a zone and region look healthy.
Dusseldorf Gives OAST A Private Callback Plane
Microsoft's open-source Dusseldorf project turns out-of-band application security testing into private infrastructure for capturing DNS, HTTP, and HTTPS callbacks.
GNU Hurd Keeps Moving Its Small Pieces
GNU Hurd's Q2 2026 work shows progress on AArch64, 9P file sharing, storage translators, POSIX cleanup, and an early Rust path for writing Hurd translators.
KDE Gives CPU Affinity A Desktop Handle
KDE Plasma 6.8 is adding CPU affinity controls to System Monitor, turning a normally terminal-heavy scheduler override into something desktop users can inspect and apply directly.
Llamafile Turns Speech AI Into A Single File
Mozilla AI's Llamafile 0.10.4 adds Transcribefile, pushing speech-to-text into the same portable single-file pattern that made local LLMs easier to move across machines.
Self-Hosted LLMs Become Platform Workloads
A CNCF walkthrough of vLLM on Kubernetes shows what private inference really needs: persistent model weights, service discovery, secrets, restart behavior, and an API boundary apps already understand.
Debian Moves x86-32 Into The Legacy Lane
Debian 12.15 closes the normal Bookworm support window while Debian 13 documents reduced i386 support, turning x86-32 from a regular install target into a legacy compatibility lane.
Linux Cleans Up The Syscall Doorway
A Thomas Gleixner patch series slated for Linux 7.3 tightens the kernel's syscall entry path, making stack randomization more consistent and the x86 syscall logic easier to follow.
Linux Hardens A Realtek Wi-Fi Driver Against Bad Access Points
Linux staging fixes are tightening the Realtek RTL8723BS Wi-Fi driver against malformed over-the-air data from malicious access points, closing several out-of-bounds paths in old driver code.
LLVM Gives Native Code A Smaller Sandbox
LLVM has merged x86 and x86_64 support for Lightweight Fault Isolation, giving native C, C++, and assembly code a compiler-level path toward in-process sandboxing.
End of list