Linux 7.3 KSMBD adds Apple Time Machine interoperability

KSMBD can now serve Apple Time Machine backups over SMB, using reverse-engineered AAPL SMB2 extensions for Finder metadata, streams, COPYCHUNK, sparse files, change notification, and RPC compatibility. The same Linux 7.3 work adds SMB2 command sequence windows, SMB3 request replay, per-share encryption, and SMB Direct RDMA encryption.

The Apple extensions are opt-in because their protocol behavior is undocumented; the implementation therefore expands practical interoperability without pretending the compatibility contract is stable. The Phoronix forum had one comment, but its endpoint was inaccessible during review.

• Kernel pull with the implementation
• Article comments

AMD proposes an LLVM flag to promote executable text to huge pages

An opt-in -fenable-readonly-thp Clang feature would align ELF segments at 2 MiB boundaries, then call madvise(MADV_COLLAPSE) so Linux can map large executable .text regions with instruction THP. The proposal targets iTLB pressure in large interpreters, servers, and compiler-like binaries without BOLT’s profiling pass; it trades some padding and startup work for simpler deployment. Linux 6.1+ supports tmpfs-backed binaries, while Linux 7.2+ adds disk-backed files with CONFIG_READ_ONLY_THP_FOR_FS.

The LLVM discussion includes a useful design objection: Google already uses a separate startup library and questions putting this in Clang rather than libc. Phoronix’s two-comment forum thread was inaccessible here.

• LLVM RFC and implementation details
• Phoronix comments

AI review loops don’t always stabilise

Naively alternating AI code review and AI-applied fixes can increase defects instead of converging: model opinions vary between runs, reviews expand scope, and false positives or hallucinations introduce new bugs.

The author’s small experiment asked an agent to write a non-trivial CIDR radix-trie library, then alternated delegated reviews and fixes for three rounds. Defect count increased each round. The linked write-up shows why the missing acceptance criteria—what “perfect” means, and which tests define it—dominated the outcome; later reviewers also received less change history to test whether they audited the artifact rather than the narrative. The Lobsters page exposed no usable comment text during review.

• Experiment write-up
• Lobsters discussion

mold: A massively parallel linker

The mold linker applies data parallelism across the entire ELF linking pipeline instead of leaving most cores idle, reporting 2.4–16.1× lower link times than lld and up to 112× over GNU ld on large real-world programs.

The paper identifies entangled symbol resolution and archive processing as barriers in existing linkers. mold eagerly parses every input and archive member in parallel, then resolves symbols in a separate parallel pass using concurrent data structures and atomic compare-and-swap. Its ablation study attributes the gains to parallelizing the whole pipeline rather than one magic optimization. The Lobsters submission had no comments during review.

• Lobsters discussion

Linux 7.3 FUSE gets buffer pools and zero-copy I/O

The in-development Linux 7.3 kernel lets FUSE io_uring servers use shared buffer pools and zero-copy access, reducing per-request memory overhead and userspace copying for privileged deployments.

The patch series decouples request entries from fixed maximum-size payload buffers, allowing the kernel to assign space from a contiguous pool. Its zero-copy path can access client pages or page-cache folios directly, but requires CAP_SYS_ADMIN and buffer pools. Benchmarks report substantial gains; large-folio preparation is not yet merged. The Phoronix forum had one comment, but its endpoint returned 403 during review.

• Source comments
• FUSE io_uring patch series

MNT Station: modular open hardware desktop and server

MNT Research’s new Station turns the Reform mainboard into a fanless, 20 W desktop, homelab server, router, or edge device while keeping the hardware designs open. The 200-pin processor-module connector allows CPU/RAM upgrades across boards such as the RK3588, LS1028A, Raspberry Pi CM4, and future SoMs; the board exposes PCIe, serial consoles, and an optional LiFePO4 battery/USV with Linux monitoring.

The campaign’s case starts at $299, with the mainboard and processor sold separately; orders currently target January 2027. Lobsters discussion questioned the price against Framework’s enclosure, but highlighted the unusual CPU-swappability, ARM support, and printable/open case design.

• Campaign and specifications
• Lobsters discussion

Rust’s never type finally stabilizes on nightly

After a decade of instability, five failed attempts, and more than two years of focused work, Rust’s ! never type is now stable on nightly (pending the next nightly release). The one-minute announcement understates the hard part: making a bottom type interact with inference, fallback, unimplemented!, unit types, and existing crates without silently breaking old code.

Lobsters commenters point to the Rust team’s compatibility constraints and the long-tail crater work needed to make the change viable. The post is a useful marker for a language feature that has been blocked by edge cases rather than by its core semantics.

• Announcement
• Lobsters discussion

OpenAI Jalapeño: Better Than Nvidia Blackwell

OpenAI’s first disclosed inference ASIC, built with Broadcom, is a serious hardware/software co-design effort—but the headline performance advantage is still a vendor-involved benchmark claim, not an independent production result.

SemiAnalysis reports a generalized LLM-inference chip designed from scratch in roughly 16 months, using HBM4 and targeting throughput per megawatt across several open models. Its charts put Jalapeño ahead of Nvidia Blackwell on the tested configurations, without speculative decoding; the report says adding speculative decoding could improve Jalapeño further. OpenAI even demonstrated Doom running on the chip via Codex-generated porting work.

The Hacker News discussion challenged the comparison’s missing ISA details, the choice to omit speculative decoding on Jalapeño while including it for competitors, and the gap between lab benchmarks and months of real production traffic. Other comments debated whether custom silicon is a durable moat or mainly leverage against Nvidia, and whether weights can ever be baked into hardware quickly enough for rapidly changing frontier models.

• Hacker News discussion

Microsoft Moves AI Governance from Policy to Runtime Enforcement

Microsoft’s architecture treats AI governance as an operational loop: policies define requirements, runtime controls enforce them, observability records behavior, evaluations test quality and safety, and audit turns telemetry into evidence.

The model spans nine domains—policy, data, model, observability, evaluations, security, identity/access, audit/compliance, and agent governance—and explicitly covers users, agents, models, tools, APIs, MCP servers, and enterprise systems. Foundry’s AI Gateway supplies authentication, quotas, token limits, and policy enforcement; Microsoft’s MCP guidance adds centralized authentication, rate limiting, IP restrictions, and audit logging without changing each MCP server or agent.

The useful shift is from “we have a policy” to “production can prove the policy was applied.” The caveat is that this is Microsoft’s platform architecture, mapping broader NIST risk-management concepts onto Foundry, Purview, Entra, Defender, and Azure API Management. InfoQ provides no source comment section for representative reactions.

• InfoQ article

Actually Queryable Executables

A follow-up to SELF turns the SQLite-backed executable from a file-format experiment into a stateful single-file application: code, routes, visitor logs, and mutable application state all live in one database.

The proof-of-concept self-httpd runs through the same binfmt_misc interpreter described in the earlier article, then uses SQLite WAL transactions to record requests and application data in the executable itself. The result eliminates the usual split between the binary, /var, /tmp, and application storage—at the cost of an unusual runtime and a much larger trust boundary around the interpreter and database.

The small Hacker News thread suggested backing a mount namespace and virtual filesystems with the same database, and reacted positively to the SQL-injection-to-arbitrary-code-execution novelty of the design. It is still a proof of concept, not a general deployment model.

• Hacker News discussion
• Earlier SELF design

A 64-bit tagged word makes a Rust interpreter smaller and faster

Plush’s dynamic-language Value enum occupied 128 bits even though each payload needed at most 64. Replacing it with a low-bit-tagged u64 uses alignment bits for type information, keeps common integer operations as direct machine arithmetic, and leaves uncommon values to boxing. Across the author’s benchmarks, every workload got faster; memory fell by as much as 37% on an allocation-heavy neural-network benchmark.

The main win was not fewer bit operations but fewer spills and memory accesses: values now fit in one register, improving cache behavior and letting LLVM generate a much shorter interpreter fast path. The trade-off is a 62-bit fixnum range and occasional heap boxing for large integers or unusual floating-point values.

• Lobsters discussion

A Unicode-version mismatch makes Python’s str.lower() security-sensitive

Python’s IDNA 2003/StringPrep implementation must use Unicode 3.2 tables, but a seemingly ordinary str.lower() call follows the interpreter’s newer Unicode data. That implementation/specification mismatch can make two components derive different hostnames from the same input, creating a parser differential around IDN validation.

HN commenters connected the bug to SSRF filters, WAFs, certificate or privileged-host checks, and password-reset flows, while stressing that the exploit is situational and requires IDN input. The practical lesson is to keep protocol-mandated canonicalization separate from general-purpose Unicode helpers.

• HN discussion

LatticeDB puts graph, vector, and full-text search in one embedded file

LatticeDB is a single-file, single-writer graph database written in Zig. Its Cypher-like query layer combines graph traversal, HNSW vector search, and BM25 full-text search, while a WAL-backed event log and graph changefeed keep local agent-memory and RAG workloads in one transactional substrate.

The project is explicit about its boundary: it targets one owning process on one machine, not multi-client or distributed deployment. HN commenters focused on subtree permissions and concurrent writers; the author acknowledged that cross-process file locking still needed work and described the single-writer model as deliberate.

• HN discussion

C2PA camera provenance breaks under real Android threat models

Android camera-app implementations of C2PA rely on Key Attestation and Play Integrity to stop an app from signing arbitrary files, but root exploits and low-cost fault injection can defeat those guarantees. The author demonstrates that even the strongest current mobile assurance story cannot establish that signed pixels came directly from a sensor.

The HN discussion pushed the threat model further: sensor-level signing still leaves optical attacks such as photographing a screen, and several commenters questioned whether a signature can ever prove the real-world authenticity people infer from it.

• HN discussion

AI-generated bug reports are becoming a denial-of-service problem for maintainers

QEMU maintainers received more than 125 low-effort bug reports in minutes from one user, mostly UBSan output and assertions without a concrete reproducer, fix, or urgent failure. The volume turns automated bug hunting into an operational burden: maintainers must triage noise before they can find actionable defects.

This is the less glamorous side of harness engineering. Better model output does not remove the need for deduplication, evidence, rate limits, and a clear contribution contract; otherwise the project becomes the model’s unpaid evaluation queue.

• Source comments

LLVM/Clang 23.1 adds Zen 6, Rigel, LFI, and partial C++26 support

LLVM 23.1 is the first stable LLVM 23 release. It adds AMD Zen 6 and NVIDIA Rigel targets, x86 Lightweight Fault Isolation support, a new AMD HIP offload driver, partial C++26 and C2Y functionality, AMDGPU GFX1310, SpacemiT X100 RISC-V targeting, and linker and diagnostic improvements.

The release also brings AVX-512 BMM support to the new Zen 6 target. Phoronix’s forum thread listed one comment, but the forum endpoint was unavailable during review.

• Source comments

Linux 7.0-mk2 makes multi-kernel Linux available for testing

The first public multikernel Linux release bundles a year of patches against Linux 7.0. It lets multiple independent kernel instances run on dedicated CPU cores while sharing the machine’s underlying hardware, exploring isolation and resource sharing below the usual virtual-machine boundary.

This is an experimental tree rather than an upstream Linux feature, but the release makes the architecture easier to reproduce and evaluate. Phoronix’s forum thread listed six comments; the forum endpoint was unavailable during review.

• Source comments

Nitter project receives cease-and-desist letters

Nitter’s maintainer says the project has received cease-and-desist letters and expects public instances to remain down while legal advice is sought. The immediate trigger visible in the issue was every instance returning the same rate-limit error.

The Hacker News discussion focused on why anonymous access still matters: people use Nitter to read posts without handing data to X, and organizations—including public services—still publish updates only there. One commenter noted that self-hosting may continue to work, but public instances are the part now threatened.

• Hacker News discussion

DuckDB 2.0 extends the embedded engine with a native networked mode

DuckDB’s planned 2.0 release keeps the single-binary model while adding a native client/server mode, remote CONNECT/ATTACH operations, and query pushdown across DuckDB, PostgreSQL, and MySQL endpoints. The preview also uses MVCC and multi-connection isolation for longer-lived, multi-tenant server deployments.

The extension story is changing just as substantially: a versioned C API with YAML-defined specification and stable ABI should stop extensions from being rebuilt for every DuckDB release, with Rust bindings planned. Teams can also pin and self-host extension repositories. General availability is targeted for the fall, so these details describe a preview rather than a finished release.

KDE is making Wayland remote desktop practical for headless use

Plasma 6.8 adds an unattended mode that logs the remote user into an isolated session, resizes its screens to the client, dynamically follows the client window, and restores the host session afterward. That makes a headless home machine usable without exposing the host desktop to people nearby.

KDE also rebuilt clipboard handling for bidirectional text and future file transfer, while frame-timing instrumentation, frame coalescing, adaptive in-flight buffering, and better backpressure reduce latency during network dropouts. RDP compatibility and emulated input support are being broadened as well.

The Phoronix forum reported seven comments, but its endpoint returned 403 during review, so no reactions are invented.

• Implementation details from David Edmundson
• Phoronix comments