In 2026, censorship moved from a technical arms race to an openly political fight. At #40c3 I'll give a talk on what that shift means for people who need to communicate anyway.

Number of days since the last time being guilt tripped by an LLM: 0

Started work on making python-varlink compatible with the new UAPI varlink specification. Part one was easy and only adds the new Error definitions.

https://uapi-group.org/specifications/specs/varlink
https://github.com/varlink/python/pull/95

Getting a depressing amount of LLM slop PRs to my projects this week 😞

The #UAPI group will be hosting the Image-Based Linux and Boot Integrity devroom at #fosdem2027 and the CFP is now open: https://uapi-group.org/conferences/conferences/2027-01-30__fosdem-devroom/

Pro tip for _not_ getting your talk proposal immediately rejected: do not mention kubernetes in the abstract
Pro tip for getting your talk proposal immediately accepted: casually mention #varlink in the abstract

For now, I will no longer be uploading to the #Debian NEW queue.

And yes, I will now go outside and do something nice instead of trying to argue on mailing lists about #LLM use in #FOSS. Maybe do the same. The weather is great outside. :)

https://lists.debian.org/debian-devel/2026/10/msg00263.html

more or less confirms that the PHP exploit on Wednesday was overblown, and contrary to claims it would be exploited in 15 mins, we haven’t even seen one confirmed exploit yet. even proof of concept exploits are incredibly hard to write and deploy.

AI companies were lying. again

https://blog.luitjes.it/posts/i-want-my-wednesday-back/

Accepted developer rooms

We are pleased to announce the developer rooms that will be organised at FOSDEM 2026.
Developer rooms are assigned to self-organising groups to work together on open source projects, to discuss topics relevant to a broader subset of the community, etc. The individual developer room organisers will issue their calls for participation in the next few days. The list below will be updated accordingly.

/dev/random
AI Plumbers/Local-Fir...
---
https://fosdem.org/2027/news/accepted-developer-rooms/

Now the option to sign certificates with #eMudhra CA is built into #mitmproxy directly: https://github.com/mitmproxy/mitmproxy/pull/8500

Ah yes, I know my Eurojackpot coupon for this week.

#CA

Anthropic found the origin of the NIST elliptic curve seeds: they were generated with drand48()!

No one was seriously worried, but this should put some FUD to rest, completing the NIST ECC rehabilitation arc… just in time to be retired in favor of PQ.

Also, we raised $36 Ki for ISRG. Yay!

https://words.filippo.io/seeds-solved/

The recording of my #AllSystemsGo 2026 talk is up: “Immutable, Fully-Confined Debian Server Images, Even on a Raspberry Pi 3”.

A minimal Debian server built with mkosi and apparmor.d: UKI, A/B updates, dm-verity, a whole-system #AppArmor policy and an immutable /etc from signed confext images. Same image on x86-64 and a Pi 3, with different attacker models.

Video: https://www.youtube.com/watch?v=5Kft4nlDKR8
Slides: https://cfp.all-systems-go.io/all-systems-go-2026/talk/KJNYQ8/

#Debian #mkosi #systemd #Linux #Security

New blog post! Yet another attempt to implement secure hibernation on Linux when lockdown is enabled: https://codon.org.uk/~mjg59/blog/p/linux-lockdown-and-hibernation-again/

Publishing “Cryptographic Right Answers” for developers is a tradition by now.

Colin Percival started in 2009, Thomas Ptacek followed up in 2015, and then Latacora carried on in 2018 and 2024.

I put together an updated list. I'm very pleased (and mildly surprised) that at this point we have good post-quantum answers for everything.

Now we "just" need to get everything rolled out, and make Merkle Tree Certificates happen.

Let's get to work. See you in 2029.

https://words.filippo.io/right-answers/

Going from 20 degrees in Prague to 2 (feels like -1) in Oslo is brutal.

The Linux community got an TPM2 NV index range assigned from TCG. A new UAPI spec now maintains a registry for sub range assignments to projects: https://uapi-group.org/specifications/specs/linux_tpm_nvindex_registry/
#tpm #linux #security #measuredboot #systemd #uapi

🎉 Great news! Microsoft is fined €8,5 million by the Norwegian Data Protection Authority for sharing personal data to potentially thousands of companies!

⚠️ In 2020, we exposed how the dating app Grindr was sharing personal data with Xandr (later aquired by Microsoft), which in turn reserved the right to share this information with 4000+ companies (see illustration). https://www.forbrukerradet.no/side/microsoft-company-fined-85-million-euros-following-complaint-by-the-norwegian-consumer-council-and-noyb/
1/

New Blog: Programming Isn't Special

Artists understand that AI is bad for art. Why don’t programmers understand that we are artists?

https://blog.glyph.im/2026/10/programming-isnt-special.html

We gave a talk summarizing the #Landlock changes over the last two years, and what's coming next: Observability, process-wide control, networking and more...
https://lsseu2026.sched.com/event/2QmU9
Don't miss the lltop demo recording!