https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=14c897740388216acd59477a382de327d5e27ba4

Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.

As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates. There are no reports of certificate transparency logs, which track the issuance of all browser-trusted certificates, showing the compromised keys being used maliciously. The threat remains far from over, however, because it will be hard and time-consuming to update other key parts of the Internet, such as Linux distributions and embedded and Internet of Things devices.

One word: bonkers

The eight intermediate certificates belong to India-based certificate authority eMudhra Limited. An informal advisory published to emudhra.we-have-a-problem.com over on Tuesday posted the message “We have a problem here – Wayne.” The words were digitally signed using the private key of one of the eMudhra certificates. With proof that the reporting party had control of the key, defenders scrambled because the same key could be used to sign unauthorized certificates that would be trusted by millions of servers worldwide.

“This will be a massive cleanup job, bigger than Heartbleed,” Filippo Valsorda, a cryptography engineer and a cryptography maintainer for the open source Go programming language, told Ars. “There will be a very, very long tail, IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools that shipped their own copy of the roots (which is common in some ecosystems, like Python). Also, Linux distributions are still rolling out updates, some of them are not ready yet, and then system administrators will need to apply them to a lot of machines.”

Heartbleed is the name of a critical vulnerability in the OpenSSL cryptography library. In 2014, it came under mass exploitation. Exploits let many unaffiliated hackers decrypt TLS-protected exchanges between parties. They also recovered private TLS certificate keys, session cookies, and passwords. The attacks compromised thousands of servers, some belonging to large companies and government agencies around the world.

Recovery required a long series of steps that took years. Steps included patching OpenSSL on all affected devices, reissuing millions of TLS keys, revoking old certificates, rotating passwords and session tokens and updating embedded devices and other forgotten systems—something that was extremely time- and resource-intensive, especially at Internet scale.

“Every time you need a lot of different people in different contexts to do something, it will take a long time,” Valsorda explained. “This time it’s worse because there’s more contexts, more people, and more heterogeneity.”

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

“That is extremely in the ‘this should not be possible’ category,” Valdorda said. “Maybe some horribly dangerous key generation interface has a ‘size’ parameter and they set it to 1 by mistake???”

Ben Cartwright-Cox, director of BGP.tools, said: “My guess is that it’s example code that accidentally leaked to production, but hard to know. But it’s bonkers that no one noticed.”

At this early stage, the most immediate threat appears to be for those using VPNs, especially in countries with governments likely to maliciously intercept traffic. There are likely many other cases for concern. End users largely have no recourse other than to hold off using many non-browser forms of TLS communication until they receive assurances updates are in place.

As noted, most browsers have already blocked the intermediate certificates. The exception appears to be Edge, which at the time this article went live was still connecting to 12 vulnerable hosts. In response to questions asking why and if the company has plans to do so, a Microsoft representative the company will be in touch if it has anything to “share.” Meanwhile, Signal, WhatsApp, Wireguard, and other apps that don’t rely on TLS for confidentiality aren’t affected. This page and the emudhra.we-have-a-problem.com site show apps known to be patched so far.

The incident is the latest to expose a fatal flaw in the TLS regimen. It’s only as strong as its weakest link, which in this case was eMudhra. Fortunately, transparency logs account for much of that failure, but this measure requires parties to actively monitor massive feeds and works only after unauthorized certificates have been issued. eMudhra representatives weren’t immediately available to answer questions.

One caveat: exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers. People with control of a local network—at a coffee shop, university, or other organization—face much less of a challenge.

The team behind the Debian-based SparkyLinux distribution has introduced a new project called SparkyOS, with its first release, version 2026.10, now available. Unlike the familiar SparkyLinux, the new system is based on Arch Linux and is designed to run entirely from a USB drive.

The idea is that, instead of installing Linux on internal storage, users can carry a fully functional operating system on a USB drive and boot it on any compatible machine. More importantly, SparkyOS isn’t a traditional live environment where changes disappear after rebooting.

Instead, it works like a regular Linux installation, allowing users to install applications, update packages and the kernel, and save files and settings directly to the USB drive. Everything remains available the next time the system starts, even on a different computer.

Under the hood, the first SparkyOS release uses an Arch Linux rolling-release base, paired with the lightweight Xfce desktop environment and Linux kernel 7.2.11. It also includes access to the AUR, with Yay provided for managing additional packages.

Getting started doesn’t require partitioning a hard drive or a conventional installation process. SparkyOS is distributed as a preconfigured IMG image that users write directly to a USB drive. Once prepared, the drive can boot the operating system on compatible hardware.

The distribution targets 64-bit computers with UEFI firmware and requires a USB drive with at least 16 GB of storage. A faster USB drive provides a better experience, especially when installing applications or performing system updates.

One interesting detail is that SparkyOS isn’t necessarily tied to Arch Linux. The developers describe it as a portable operating system that can be built using different Linux distributions as its foundation. Arch is simply the base chosen for this initial release, leaving room for other variants in the future.

For those interested in trying it, the default username and password are both sparky, while administrative operations are handled through sudo.

For more details, see the announcement.

SparkyOS 2026.10 is available now from the project’s official website, where users can also find the download image and instructions for preparing a bootable USB drive.

Well, well, well...

The Linux Foundation published a new study today around the impact of generative AI on open-source software development. One key takeaway is that ~25% of new open-source software pull requests amount to AI slop.

The new Linux Foundation research study found that GenAI has the potential of cutting open-source coding time in half for increased productivity. They also found 59% of project maintainers found growing GenAI-based contributions. The 50% productivity boost was found to be across all types of open-source software development tasks. 71% of OSS maintainers agreed that GenAI reduces barriers to entry.

Very concerning though, their research found that 25% of incoming pull requests are estimated to be low-quality AI slop across open-source projects. Presumably that number will, sadly, continue to rise as more newcomers and users embrace AI/LLMs for working on patches on their behalf.

Those curious can find the Linux Foundation Research report in full via LinuxFoundation.org.

I haven't distro hopped much in the past few years, so I am near clueless. I know that Linux Mint has a graphical updater and I vaguely remember openSUSE having it, though I'm not so sure on that one, because as I mentioned, it's been a while. Especially curious if any Arch-based distros have it.

2024 Kia EV6, stock head unit.

Edit with some quick notes because I didn't realize this blew up:

This is NOT yet usable as a replacement to stock. Working:

• Boots! (32 bit only because stock is 32bit, so no AAOS)
• Display
• Touch
• WiFi
• Maybe BT
• Maybe Modem (not gonna test that)
• GPS (uses translation daemon)
• Climate/controls/sensors/some energy stats - as much as MICOM provides anyway (uses translation daemon)
• GPU
• VPU (really need to test more)

Not working yet:

• Audio/amp control
• Power sequencing like when to turn off display, wake/sleep etc
• Any kind of head unit experience (this will come later, I'll try AGL first, and if I can get 64 bit then I'll try AAOS)

Use NEMESIS to get root on Android: https://github.com/xwtk/hmg_nemesis

Blog post that has a small section on this: https://w-floyd.com/2026/10/notes-on-llms-part-01/#2024-kia-ev6-head-unit I'll post more there as I find the time. I am using LLMs for a lot of the heavy lifting as I try things out (never to write my blog). I link to my GitHub repos there, where this work is being actively pushed.

I only bought this car a week ago.

Don't be an idiot and actually reflash your unit if you try this - I am using kexec to boot from an image from the USB, so this is completely nondestructive (NEMESIS is what actually is installed to the system).

Some more photos!

What are we supposed to do with it?

The GNU Linux-libre project announced today the release and general availability of the GNU Linux-libre 7.3 kernel for those who seek 100% freedom for their GNU/Linux computers and software freedom lovers.

Based on the recently released Linux 7.3 kernel series, the GNU Linux-libre 7.3 kernel is here to clean up blob names in new drivers for the Tyr Mali GPU, Morse Micro mm81x wifi, NXP wifi, and Realtek PHY, as well as new blob names in preexisting drivers, including nova-core, amdgpu, adreno, tegra, iris video decoder, rtw89, and mt76 wifi.

The GNU Linux-libre 7.3 kernel also cleans up remoteproc documentation, Qualcomm Q6V5 PAS, qla2xxx scsi, aw88399 sound codecs, and assorted Qualcomm devicetree files. As usual, check out the release announcement for more details about the changes included in this new GNU Linux-libre kernel release.

The GNU Linux-libre kernel targets software freedom lovers and Linux purists who want to build a 100% free GNU/Linux computer without any proprietary drivers or code. You can download the compressed tarballs of the GNU Linux-libre 7.2 kernel right now from the official website.

Ready-to-use binary packages for Debian-based (DEB) and Red Hat-based (RPM) distributions are also available for download from the Freesh project and RPM Freedom websites. The GNU Linux-libre kernel can be installed on virtually any GNU/Linux distribution alongside or as a replacement for the standard kernel.

GNU Linux-libre is a modified version of the standard Linux kernel that removes all proprietary software, binary blobs, and non-free firmware. Managed by the Free Software Foundation Latin America (FSFLA) and was officialized as a GNU package in 2012.

There is yet-another-Linux-file-system attempt... An initial request for comments (RFC) patch series was sent out this morning for BeamFS. The proposed BeamFS is a Reed-Solomon protected file-system.

BeamFS was born out of the stalled FTRFS proposal earlier this year as a fault-tolerant file-system. FTRFS was short for the Fault-Tolerant Radiation-Robust Filesystem.

BeamFS is described in today's RFC patch series as:

"beamfs is a block-device filesystem that corrects corrupted bytes in place, on a single device, with no second copy to repair from. Every data block is a capsule of sixteen interleaved RS(255,239) codewords, built on lib/reed_solomon; every read decodes it, and a read the decoder cannot vouch for fails with -EIO instead of returning wrong bytes. Directory blocks, inodes, the allocation bitmap and the superblock carry Reed-Solomon parity as well, and indirect blocks have a parity region of their own. In the default layout 288 bytes of every 4096 (7%) are overhead.

beamfs descends from FTRFS, posted here as an RFC in April. The limits of FTRFS were in its design (threat model, where correction sits, scale, kernel integration), so beamfs is a new filesystem with its own on-disk format, and this is a new thread."

BeamFS goes on to being described for systems where their data is on one storage device and in a radiation prone environment. FTRFS development began with satellite on-board computers in mind as well as systems running in radiotherapy rooms. BeamFS incorporates the feedback of the original FTRFS proposal to hopefully be more acceptable to the upstream Linux kernel and a better design.

Earlier this year due to FTRFS and other new file-system proposals, Linux kernel developers did enact new guidance on allowing new file-systems into the Linux kernel, so we'll see ultimately what comes of BeamFS for a Linux file-system for radiation-prone environments.

In a comment over at !selfhosted@lemmy.world someone wrote:

Containers are not a security barrier. They cannot be, they never will be.

I'm no expert but my mental model of containers was different in that I thought containerized processes live in somehow separate environments, at least filesystem- and network-wise.

I run self-hosted services in containers on my server to isolate them from each other, and now and then binaries I don't fully trust (things like suspected slop code or not well known python libraries) in containers on my laptop.

Does someone with more technical knowledge about how containers work feel like explaining whether that is a bad idea and if so why? That would be highly appreciated.

Edit: missing words and punctuation.

Edit 2: I would like to thank everyone who took the time to reply. My key take aways are that I will move my self-hosted services into VMs for proper isolation, but that it's probably fine to use a container when I want to make sure an LLM doesn't accidentally rm -rf my laptop system when it gets stuck.

Stemming from a bug report one month ago with GNOME 51 over high GPU usage while the monitor is sleeping, a set of 17 patches were merged today for addressing this issue.

The bug report noted clients still rendering while the monitor is sleeping and thus high GPU usage.The issue was tracked down to un-throttled repainting of the CRTC back-end stage views even when in power savings mode

The now merged code addresses this issue by handling forward progress without repainting while in the power savings state. Jonas Ådahl of Red Hat who authored the fix explained of the changes:

- It actively decides to not draw when power saving by having the renderer inhibit painting if power saving and a stage view targets a CRTC. This solves the originally reported bug; vkgears, glxgears, es2gears all report ~60 fps while power saving, without having the frame clock having to deal with knowing about power saving.

- It handles migrating presentation feedback of frames that gets discarded. This means vkgears properly receives .discarded events while power saving.

The code is merged to Mutter and should be part of the GNOME 51.2 release.

PRAGUE — At Open Source Summit Europe, Dr. Laura Dornheim, Munich’s chief digital officer, said in her keynote speech that Munich abandoned its LiMux Linux desktop deployment for Windows over a decade ago because of politics, but now it’s returning to open-source software.

It’s not returning to the Linux desktop, however — not yet, anyway. Instead, it’s switching its infrastructure programs from proprietary software to open-source software. For example, it’s replacing VMware with Proxmox, moving from Jira and Confluence to OpenProject and XWiki, and adopting PostgreSQL as an alternative to Oracle databases.

The two infrastructure and collaboration migrations alone are expected to save roughly €1.5 million or more annually.

Taken together, these projects illustrate the difference between Munich’s first Linux campaign and its current approach. Rather than making desktop Linux its center pole, the city is replacing individual layers of proprietary infrastructure where it can make a practical case.

So, this comeback is not a wholesale resurrection of LiMux, the Debian/Kubuntu Linux desktop project that made Munich the Linux desktop standard-bearer between 2003 and 2013. Besides, Dornheim added, dealing with the elephant in the room, “So [if LiMux] was a success, why is it not alive anymore? Not because of technical issues.” So, what changed?

Dornheim explained it was all politics. “Open source in the public sector doesn’t fail because of technical issues. It mostly fails because it’s not aligned with the political agenda.” She continued that Munich had switched away from Linux because a new government got Microsoft to agree to make Munich the headquarters for Microsoft Germany.

The lesson from LiMux is that technical capability isn’t enough, she continued. Open-source projects also need durable political support.

From Linux pioneer back to Windows

Munich’s original move began as Windows NT 4.0 neared the end of support. Yes, that was over 20 years ago. In May 2003, its council voted to migrate to a tailor-made Linux distribution, LiMux.

The rollout began in earnest in 2006. By December 2013, Munich had completed the migration with more than 14,800 desktops running LiMux. A European Commission Open Source Observatory case study reported savings of about €11 million because the city dumped Windows.

LiMux became the leading example that a large city could operate Linux desktops and open-source office software. It also exposed the difficulty of changing a sprawling government IT environment, particularly when Microsoft Office documents, legacy workflows, PDF use, and user expectations remained tied to proprietary systems.

The political climate changed after Munich’s 2014 municipal election. By November 2017, the council had voted to reverse course and return its computers to Windows, with a target of 2020. The office-suite transition took longer. Indeed, the migration from LibreOffice to Microsoft Office wasn’t completed until 2023.

So, despite what you may have heard, this was not a case of “Linux failed.” It didn’t. It was politics, pure and simple.

Where Munich goes from here

Today, Germany’s third-largest city is targeting proprietary platforms where open-source alternatives can deliver financial savings, greater control, and software that other municipalities can reuse. Digital sovereignty matters, but that’s not the primary driver in Munich.

That said, Dornheim noted that a cloud transition to Azure without sufficient assurance from Microsoft of General Data Protection Regulation (GDPR) compliance would require the city to scrutinize who could use each tool. This management overheard didn’t help make a case for staying with Microsoft. It’s also a clear example of how digital sovereignty has become both an important technical and political issue.

Dornheim added that her answer to getting politicians to support open-source software in the long run is to connect open source with priorities they understand. These include budgets, public services, and the ability to make software available across the administration.

She added that Munich’s current IT strategy is to ensure open-source software functions well without losing the political support needed to sustain it. It certainly helps that, thanks to the shift to open-source software, “We are saving roughly a million euros a year. So that’s again a great win, not just for us, for our belief in public and public code, but also for the politicians in Munich.

The open-source return started with infrastructure

The new Munich IT plan also embraced the “public money, public code” principle: software developed with public funding should, where appropriate, be available for others to inspect, use, and improve. The commitment applied to newly acquired or developed software even as the earlier Windows migration continued.

Dornheim, who became Munich’s CDO in September 2022, has not treated that policy as a mandate for a third administration-wide operating-system upheaval. Supporting institutions have also changed. Munich established an Open Source Program Office in 2024. This added a dedicated structure for coordinating its open-source work. Its public software portal presents the city’s approach in three categories: Use existing open-source software, improve it, and publish software that the city develops itself.

That’s a broader commitment than just replacing Windows with a Linux distro. Munich is now an open-source software development participant, not simply a customer choosing between licenses.

Software that other cities can use

There are several examples of Munich sharing its software. One such is DAVe, Munich’s application for documenting and analyzing traffic data. In use since 2021, the software has also been adopted by Wolfsburg, Germany.

Dornheim said such collaboration should become routine rather than depend on another city discovering a suitable project. “I think these matches shouldn’t just happen sort of by accident, but there needs to be a structure across the whole public sector. It’s on my wish list.”

Munich’s work also includes MUCGPT, a municipal AI application that enables employees to access large language model (LLM) capabilities. This helps with writing and proofreading emails.

The city is also investing in the open-source ecosystem. Its Open Source Sabbatical program supports developers working on open-source projects. The broader purpose is to support improvements and funding components used in open-source municipal services.

Put it all together, and Munich’s open-source approach is no longer simply about the Linux desktop. Instead, it’s all about Munich reducing its dependence on proprietary software, controlling costs, and turning publicly funded software into a reusable public asset. So far, the city’s doing well.

Hey everyone!

I'm Soumalya, a developer interested in Linux and systems programming. I've been working on Wallr, a wallpaper engine for Wayland written in Rust, and wanted to share it here to get feedback from other people in the open-source community.

I started building it partly to learn more about Rust, GPU rendering, and how Wayland works under the hood. It's grown quite a bit since then.

Wallr supports static images, GIFs, and video wallpapers. It also has 11 transition effects, per-monitor wallpaper settings, directory watching, and optional integrations with Matugen, Wallust, and Pywal.

Under the hood, it uses wgpu for rendering, with a background daemon that communicates with the CLI over a Unix socket. Video playback uses FFmpeg, with hardware decoding where supported. I've also included a benchmark script to compare Wallr with awww, although I'd like to test it across more hardware and compositors before drawing broad conclusions about performance.

It currently targets Hyprland, Sway, niri, and compatible KDE Plasma 6 setups. GNOME/Mutter isn't supported at the moment.

For transparency, I used AI assistance during development to make my workflow easier. I'm continuing to work on the project, test it, and improve the implementation.

Source code and installation instructions: https://github.com/programmersd21/wallr

I'd appreciate feedback on the code, architecture, compatibility, or anything that could be improved. If you use another Wayland wallpaper tool, I'd also be interested in hearing what you like about it and what you think could be done differently.

Thanks for reading!

TLDR: Which distro is better for gaming and video editing (NVIDIA GPU), CachyOS or Ubuntu?

Hi! It's been probably a month since I started using Linux (escaping from Windows), and I choose LMDE since the distro that I felt aligned more with what I want from a distro on in general is Debian, but since it was my first time using Linux on my main device (just tried Debian on a laptop to run a Homelab) I got recommended Mint to make it easier for me to adapt. The thing is that since I started using LMDE I've discovered that it doesn't cover perfectly my needs. Two things that I didn't want to lose when switching to Linux were gaming and the ability to run video/audio/photo editing programs flawlessly, mainly DaVinci Resolve and AffinityPhoto. It's been practically impossible to achieve that, since DaVinci doesn't work, can't even get to install AffinityPhoto and some videogames need more recent (NVIDIA) drivers than what Debian and of course LMDE can offer. So, seeing that I want to keep LMDE (and maybe in the future upgrade from LMDE to Debian) but at the same time I'm not willing to give up on those 2 things, I believe the dual-boot option is the one that suits me the most. Now, what I'm here for. I've been doing some research and the ones that caught my atention the most were CachyOS and Ubuntu:

• CachyOS: PROS: · High gaming performance and (looks like) compatibility. · Looks like DaVinci works perfectly for a lot of people (although some other people claim having issues). CONS: · Sounds too complex as a distro for someone who has close to zero programming knowledge and just started using Linux. · The rolling release aspect feels a little scary too.

• Ubuntu: PROS: · May not be THE gaming distro but it seems to be working for a lot of people without having extensive programming or Linux knowledge. · Generally may be more compatible and stable than CachyOS in general · Seems it will be easier for me to adapt to since it's Debian-based. CONS: · Doesn't seem as good as CachyOS on a performance standpoint, affecting both video editing and gaming capabilities.

Now, my questions would be: Am I mistaken in any of the info I have revolving these two distros? Could I be missing any other options? Which do you think is the distro that could suit me the most? Any recommendation when doing the Dual-boot? I have never done it and it scares me a little tbh.

My main priority is having a stable (and compatible in the first place, of course) experience (maybe Ubuntu?), but I don't mind having to put more work into it to achieve a better experience (maybe CachyOS?).

I would love to hear from you and, of course, if I'm missing any relevant information I'll be more than happy to share it too.

Thank you very much! :D

CachyOS has taken the Linux world by storm lately. It’s currently one of the most popular Linux distros, and for good reason — it’s fast, polished, and, most importantly, reliable. I’ve used it myself, and I can see why so many people, especially Linux gamers, are fans of it. That said, if I were building a Linux gaming system, I’d choose Bazzite over CachyOS, and it boils down to one key reason.

CachyOS is a solid gaming distro

Giving credit where it’s due

CachyOS is an Arch-made-easy distro, giving you all the benefits of Arch without the technical hassle. You get a proper graphical installer to streamline the setup process, while the CachyOS Hello app offers one-click access to routine maintenance tasks like updating mirrors, installing gaming packages, adjusting system settings, and more.

That said, the real reason behind CachyOS’s astronomical rise to fame is its performance. The distro ships with its own custom Linux kernel, aptly named the CachyOS kernel, which is optimized for modern x86-64 processors. The official repositories also contain packages compiled for these architectures to take advantage of the CPU-specific optimizations.

All these optimizations help CachyOS squeeze more performance out of your hardware, making it a great choice for gamers. With the same hardware, you may see higher frame rates, better 1 percent lows, and more responsive gameplay compared with other Linux distros. Granted, the gains aren't anything extraordinary — CachyOS won't magically make a game that was otherwise unplayable run smoothly on your hardware — but the extra performance is certainly nice to have.

But it’s still an Arch-based distro

Performance matters, but so does reliability

CachyOS is based on Arch Linux, and there's a reason Arch isn't generally recommended for Linux newcomers. You see, Arch is a rolling-release distro, which means package updates become available as soon as they're released. This is usually good news for gamers because they get quick access to the latest features and performance improvements. However, it also introduces additional maintenance overhead.

You're expected to update your system regularly, ideally weekly or at least every couple of weeks. If you put off updates for too long, you might run into problems when you finally update, including keyring errors, outdated mirror lists, and other technical conflicts.

There's also the fact that constantly dealing with cutting-edge software can affect system stability. While most updates go smoothly, a buggy update can occasionally break something when you least expect it. It might be a driver, your desktop environment, or even a package dependency that causes your games to stop launching. When that happens, it's on you to figure out what went wrong and fix it.

Granted, CachyOS does provide a safety net for buggy updates and system breakages. It uses the Btrfs file system alongside Snapper to take snapshots before every system update. This way, if an update introduces bugs or breaks your system, you can roll back to a previous working snapshot. It's certainly a useful feature, and one that makes many rolling-release distros more viable for daily use.

Reliability by recovery vs. reliability by design

It's worth pointing out that snapshots are a recovery tool, not a way to prevent breakage in the first place. You still have to deal with a broken system and know how to boot into the appropriate snapshot. There's also a limit to what snapshots cover. By default, Snapper only takes snapshots of the preconfigured subvolumes, which typically include the root file system — not the home directory where your games live.

Now, yes, you can technically configure snapshots for your home directory, but doing so requires a lot of care and attention. Depending on your setup, rolling back personal files could also revert game saves, settings, and other documents alongside the changes you're trying to undo, which is a disaster in its own right.

For someone who's comfortable with Linux, all of this is manageable. However, for someone who has just switched from Windows to Linux to play games, it's a lot of unnecessary technical hassle.

Bazzite is far more reliable and beginner-friendly

It’s a distro designed to be fool-proof

Bazzite is another popular distro for Linux gaming. However, unlike CachyOS, it uses Fedora's Atomic Desktops as its base, offering a balance of stability and up-to-date software. These desktops use an image-based approach to system updates. Instead of updating individual system packages, Bazzite downloads an updated system image, prepares it as a separate deployment, and activates it after a reboot.

This sort of atomic update ensures that system updates are applied as a whole. If something goes wrong during an update, you can boot back into the previous deployment. This reduces the risk of partial updates and dependency conflicts, significantly lowering the chances of system breakage caused by failed updates.

What's more, Bazzite is an immutable distro, which means its core system is read-only. You can't freely modify the base system files as you would on a traditional Linux distro. This prevents applications and packages from casually modifying the underlying system, making Bazzite more resilient to accidental changes and the resulting breakages that can occur on other distros like CachyOS.

Bazzite's immutable nature also means you can't install apps and packages as freely as you can on other distros, since doing so involves modifying the core system. However, this generally isn't a problem for gaming since Steam and Lutris come preinstalled, and you can install your games through these launchers.

Furthermore, you can install system-level RPM packages using rpm-ostree, although this approach is generally discouraged. Instead, you're expected to use Flatpak for traditional desktop apps, Homebrew for command line apps, and Distrobox for software that needs a traditional package manager.

Overall, for someone who just wants to install Linux and play games without worrying too much about maintaining their OS, Bazzite is the more beginner-friendly choice.

Bazzite gives you the console experience

The way I see it, Bazzite offers more of a plug-and-play console gaming experience, which is perfect for casual gamers who aren't interested in worrying about the technicalities of Linux. In fact, you can install Bazzite's HTPC variant, which boots straight into Steam Gaming Mode, giving you a console-like experience based on Steam's Big Picture Mode. From there, you can simply install your Steam games and play them without ever having to worry about the Linux distro underneath.

In comparison, CachyOS is closer to traditional PC gaming. It gives you plenty of options but expects you to be tech-savvy enough to make the most of them and patient enough to troubleshoot problems if and when things go wrong. It certainly gives you more control over the OS, and if you enjoy that, CachyOS is going to be the better distro for you.

However, I just want a system that works. I have limited free time, and I'd rather spend it playing games than optimizing a system for gaming.

Yes, you read that correctly. Microsoft is bringing its Defender security software to Linux desktops. The company has announced that Microsoft Defender for Endpoint now officially supports Linux desktop environments, with the feature currently available in public preview.

And before anyone starts wondering whether Microsoft has suddenly decided that every Linux user needs antivirus software, there’s an important distinction. This isn’t the consumer version of Defender familiar to Windows users. Instead, it’s Microsoft’s enterprise security platform for organizations running Linux workstations.

According to Microsoft, the expansion is driven by the growing use of Linux desktops among developers. These machines often access source code repositories, cloud infrastructure, credentials, and other sensitive resources, making them attractive targets for attackers.

The idea is to give enterprise security teams the same visibility and protection across Linux desktops that they already have for Windows, macOS, and Linux servers.

As for the capabilities, Defender for Endpoint provides real-time antivirus protection, endpoint detection and response, threat investigation, vulnerability management, and centralized security monitoring through the Microsoft Defender portal.

Security administrators can use these tools to investigate suspicious activity, identify compromised machines, and respond to threats without managing Linux workstations through a separate security platform.

Interestingly, Microsoft isn’t introducing a completely new Linux security agent for this purpose. According to its documentation, the desktop version uses the same deployment packages, installation methods, and security capabilities already available for Linux servers.

The supported distributions are also the same. The list includes Ubuntu LTS, Debian, Fedora, Red Hat Enterprise Linux, openSUSE Leap, SUSE Linux Enterprise, Rocky Linux, AlmaLinux, and several others.

Desktop environment choice doesn’t matter. Whether a workstation runs GNOME, KDE Plasma, or another graphical environment, compatibility depends on the underlying distribution and kernel rather than the desktop itself.

There’s also an interesting detail regarding device identification. Defender attempts to determine whether a Linux installation is a server or workstation using operating system metadata and other system characteristics. When it cannot reliably identify a machine as a workstation, it classifies it as a server by default.

Of course, Defender’s presence on Linux isn’t entirely new. Microsoft introduced its antivirus solution for Linux servers back in 2020, subsequently expanding its enterprise threat detection and response capabilities. What’s changing now is the official inclusion of desktop workstations.

Finally, it’s also worth emphasizing that this remains a public preview, not a generally available release. Organizations interested in deploying it will need an appropriate Microsoft Defender for Endpoint subscription and must meet the existing Linux system requirements.

For more details, see Microsoft’s official announcement.

Do you feel safe with all the entRUSTing they're putting on non GNU software?

The title says that because, until now, the core utilities in Ubuntu were not fully Rust. cp, mv, and⁣ rm had stayed on the GNU versions over compatibility issues. They have since moved to the Rust-based uutils implementation, taking the distro even further in its oxidation process.

Ubuntu 26.10, codenamed "Stonking Stingray", is an interim release, which means it brings newer software than the earlier LTS while only getting nine months of support, ending in July 2027.

Although our features roundup covered a lot of ground, there were some changes that it missed.

Ubuntu 26.10: What's New?

Well, we start with the kernel powering this interim release, Linux 7.3, which offers support for recent Snapdragon X2 Elite laptops along with several older Snapdragon X Elite and X Plus machines from Lenovo, HP, and Acer.

Gamers will be glad to know that the first chunk of Valve engineer Natalie Vock’s VRAM overcommit work has also landed in this kernel. Games on graphics cards with too little video memory should run better, as some of the data can now be offloaded to regular system RAM.

You already know that this Linux release is shaping up to be one of the most performance-focused releases in years.

Ubuntu is also moving to the NVIDIA 615 driver series, which replaces 595 and 610 and ships open kernel modules only, supporting Turing and newer GPUs.

The rustification we talked about earlier also extends to OpenPGP, where Sequoia PGP, a Rust-based implementation built by former GnuPG developers, has landed in the main archive. Its sq and sqv tools now sit alongside GnuPG's gpg and gpgv.

For the desktop environment, Ubuntu 26.10 has GNOME 51, with its range of upgrades such as a fingerprint manager in the Users panel, DNS search domains in the Network settings, and a count badge in Files when you drag multiple items.

There's also the Ubuntu Tiling Assistant that shows a Windows-11-like interface for the built-in snappable window layouts.

If you were hoping for a redesigned installer and first-boot onboarding flow, those are planned to come for the next long-term support release, Ubuntu 28.04 LTS.

Other Changes & Improvements

These are some of the other notable changes in this release:

OpenSSL 4 brings Encrypted Client Hello (ECH) and better QUIC support.
TPM-backed full-disk encryption now works without a hardware root of trust if a PIN or passphrase is set.
The RISC-V platform gets official RVA23 support for the SpacemiT K3 boards and SiFive's BigSky platform.
Twelve new wallpapers that were picked across the Mascot, Photography, and Digital/Abstract categories.
The toolchain upgrades consist of GCC 15.2.0, LLVM 22.1.8, Python 3.14.7, Rust 1.97.1, Go 1.27, and OpenJDK 25.0.4.

Download Ubuntu 26.10

ISOs for this interim release are available for AMD64, ARM64, RISC-V, and others from the official website; go for the "Desktop" ISOs if you are a regular user. Specific flavors like Server, Netboot, and WSL can be fetched from the releases portal.

There appears to be a few bad actors in the Lemmy community spreading ragebait for personal gain

In fact, the same mechanisms added at the beginning to catch bad human written code are the exact same that catch bad AI code

1. No, the Linux kernel DOES NOT use AI to automatically approve code for inclusion. As far as I can tell, there are no plans to do so
2. The Kernel actually has a huge number of maintainers. As part of the process, all patches are reviewed by a human who provide feedback as part of the process, and patches get bounced back and forth multiple time.
3. Patches don't just magically go straight to master. The maintainers generally have their own branches where it goes to, then it goes to staging trees like Linux-Next. It goes through many eyes, and many tests by the end. The idea that AI code is overrunning the kernel is rediculous
4. Maintainers also check that the code meets coding guidelines and is written properly, and solves the problem they are trying to solve. Yes, they also ensure the code isn't slop
5. LLM's though might be used to identify obvious problems with the code (which they are VERY good at), or even identify code that doesn't follow coding guidelines.
6. The only thing that matters is the human who submitted the code, as they should be checking the code submitted anyway (including LLM generated code)

Writing bad code isn't something new, and isn't unique to LLM's. Coders (and it seems some "journalists") have been writing slop since computers were invented.

The process hasn't gotten less stringent (probably even MORE stringent as there is an additional set of robotic eyes that can also check), and the same mechanisms that were put in place to catch badly written code 10 years ago, are still there now.. With no changes.

Timestamps:

00:00 Intro

00:49 Sponsor: Hostinger

02:02 GNOME OS released in Preview

06:03 Epic Games Store has a Linux client, EAC will support Linux too

10:01 Torvalds builds branch for kernel using Al

13:42 Kernel devs ponder removing mandatory Al use disclosure

15:32 KDE Plasma 6.8 is released

17:13 Ubuntu 26.10 released

19:16 Mint 27 looks like a big release

21:27 Steam Client is finally moving to 64bit

22:27 Netherlands backs away from MS365 rollout

24:16 Dev behind vibe coded Adobe suite bashes FOSS projects

25:57 Framework triples their funding for CachyOS

27:11 Firefox releases a commercial Enterprise version

28:57 New EuroOffice fork that looks like MS Office

30:54 Valve releases CAD files for Steam Frame

32:32 Sponsor: Tuxedo Computers

Links:

GNOME OS released in Preview

https://os.gnome.org/

Epic Games Store has a Linux client, EAC will support Linux too

https://onlineservices.epicgames.com/news/introducing-easy-anti-cheat-linux-v2

https://www.gamingonlinux.com/2026/10/epic-games-launcher-preview-arrives-native-linux-support-fortnite-for-linux-is-coming-and-upgraded-easy-anti-cheat/

https://codon.org.uk/~mjg59/blog/p/epics-eac2-v2-seems-fairly-easily-bypassable/

Torvalds' Al generated kernel patches & talks more about Al

https://www.phoronix.com/news/Linus-Torvalds-Claude-Code

https://www.techradar.com/pro/linux-founder-linus-torvalds-says-ai-is-a-gateway-drug-into-programming-but-cautions-about-using-ai-for-serious-work

Kernel devs ponder removing mandatory Al use disclosure

https://www.phoronix.com/news/Linux-Dropping-Assisted-By-Req

KDE Plasma 6.8 is released

https://kde.org/announcements/plasma/6/6.8.0/

Ubuntu 26.10 released

https://ubuntu.com//blog/canonical-releases-ubuntu-26-10-stonking-stingray

Mint 27 looks like a big release

https://blog.linuxmint.com/?p=5086

Steam Client is finally moving to 64bit

https://steamcommunity.com/groups/SteamClientBeta/announcements/detail/703282384630448403

Netherlands backs away from MS365 rollout

https://www.zdnet.com/business/dutch-tax-authorities-cancel-microsoft-365-cloud-rollout/

Dev behind vibe coded Adobe suite bashes FOSS projects

https://www.techradar.com/computing/office-suites/developer-who-vibe-coded-free-adobe-clones-reveals-apps-to-take-down-microsoft-office-next-and-says-there-is-no-reason-to-save-broken-software

Framework triples their funding for CachyOS

https://discuss.cachyos.org/t/announcement-framework-is-tripling-its-support-for-cachyos/37042

Firefox releases a commercial Enterprise version

https://blog.mozilla.org/en/firefox/introducing-firefox-enterprise/

New EuroOffice fork that looks like MS Office

https://itsfoss.com/news/elixiroffice-euro-office-fork/

https://github.com/leag1234/elixiroffice

Valve releases CAD files for Steam Frame

https://www.gamingonlinux.com/2026/10/steam-frame-cad-files-released-plus-an-update-on-reservation-waiting-times/