The Iron Sysadmin

This week on Hot Takes and Cold Storage: AI policy wars, a legislative win with an asterisk, and a supply chain security milestone that deserves more attention than it’s getting. 🔥 HOT TAKES California and Colorado carve Linux out of age verification laws, but California’s bill simultaneously expands age-gating to the open web. The EFF isn’t happy. Flatpak’s next architecture may require systemd, raising questions about non-systemd distro compatibility Flathub bans all AI-generated code, docs, and submissions, effective immediately Debian mandates reproducible builds, the first major general-purpose distro to do so, and a real structural response to the XZ backdoor 🎙️ DEEP DIVE: AI for Everyone, But Can You Trust It? PewDiePie just dropped Odysseus, a fully open source self-hosted AI workspace, and handed the concept of digital self-reliance to a hundred million people. Meanwhile, I’ve been fighting with OpenClaw trying to get it running against a local LLM, and what I found in Vitalik Buterin’s April post has me thinking hard about limits. The open source community can’t agree on AI-generated code policy, and that debate is happening in public right now. 📰 STORY LINKS California/Colorado Age Verification: https://www.techtimes.com/articles/317449/20260530/california-age-verification-bill-clears-assembly-linux-spared-websites-added-age-gating-regime.htm https://ostechnix.com/colorado-california-age-verification-law-open-source-exempt/ Flatpak + systemd: https://linuxiac.com/flatpaks-future-may-leave-non-systemd-distros-behind/ https://www.osnews.com/story/145071/flatpak-will-depend-on-systemd/ Flathub AI Ban: https://linuxiac.com/flathub-now-rejects-ai-assisted-apps-and-submissions/ https://www.gamingonlinux.com/2026/05/flathub-moves-to-ban-nearly-all-apps-and-submissions-made-with-generative-ai/ Debian Reproducible Builds: https://www.phoronix.com/news/Debian-Must-Ship-Reproducible https://itsfoss.com/news/debian-makes-reproducible-builds-mandatory/ PewDiePie / Odysseus: https://github.com/pewdiepie-archdaemon/odysseus https://virtualuncle.com/pewdiepie-odysseus-self-hosted-ai-workspace/ Vitalik Buterin on local AI and OpenClaw security: https://vitalik.eth.limo/general/2026/04/02/secure_llms.html Linux Kernel AI policy: https://www.tomshardware.com/software/linux/linux-lays-down-the-law-on-ai-generated-code-yes-to-copilot-no-to-ai-slop-and-humans-take-the-fall-for-mistakes-after-months-of-fierce-debate-torvalds-and-maintainers-come-to-an-agreement https://gigazine.net/gsc_news/en/20260413-linux-a-generated-code-assisted-by/ QEMU AI Policy: https://linuxiac.com/qemu-may-relax-its-ban-on-ai-generated-contributions/ https://www.theregister.com/ai-and-ml/2026/05/29/qemu-mulls-relaxing-ai-contribution-ban/5248638 The Iron Sysadmin publishes bi-weekly. Find us on the fediverse: 📺 PeerTube: https://video.ironsysadmin.com 🎙️ Podcast: https://pods.ironsysadmin.com

Welcome back to Hot Takes and Cold Storage! After a brief hiatus around Red Hat Summit season, Nate is back with a packed episode. Hot Takes: Microsoft quietly added Copilot as a co-author to VS Code git commits — even with AI tools disabled. They reversed it after developer backlash, but it’s another reason to consider VSCodium. The Dutch government has launched its own self-hosted Forgejo instance as a digital sovereignty move, joining a growing trend of nations taking control of their code infrastructure. US states continue filling the federal privacy vacuum. California’s AB 2561 now prohibits apps and OSes from resetting your privacy settings, and Connecticut passed a law requiring data brokers to register with the state. MiciMike is producing a drop-in replacement PCB for the Google Home Mini Gen 1 that turns it into a Home Assistant Voice device — completely local, ESP-based, and available to back on Crowd Supply. And in a story that writes itself: a CISA contractor stored AWS GovCloud admin credentials, a Firefox password CSV, and deployment documentation in a public GitHub repo. For six months. With secret scanning disabled. Cold Storage (Deep Dive): The TanStack Supply Chain Worm On May 11, 2026, over 170 packages were compromised across npm and PyPI. 84 malicious versions across 42 TanStack packages were published in a six-minute window, also hitting Mistral AI, UiPath, and OpenSearch. This is the first documented supply chain worm to ship with valid SLSA provenance certificates. We break down the pull_request_target exploit pattern, how the attacker poisoned the GitHub Actions cache without touching any credentials, and how the worm propagated itself through every developer it infected — including a vindictive payload that wiped your home directory if you revoked your token. The community response was fast and transparent, and that’s the real win. Links: Microsoft Copilot co-author controversy: https://www.msn.com/en-us/news/technology/microsoft-secretly-made-copilot-co-author-your-code-until-developers-revolted/ar-AA22CHBL Dutch government self-hosts Forgejo: https://www.opensourceforu.com/2026/04/dutch-government-backs-forgejo-for-sovereign-open-source-github-alternative/ California AB 2561 & state privacy law roundup: https://www.troutmanprivacy.com/2026/05/proposed-state-privacy-and-ai-law-update-may-18-2026/ Connecticut data broker registration: https://www.troutmanprivacy.com/2026/05/proposed-state-privacy-and-ai-law-update-may-11-2026/ MiciMike Google Home Mini replacement PCB: https://www.cnx-software.com/2026/04/29/micimike-open-source-drop-in-pcb-converts-google-home-mini-into-a-local-voice-assistant/ Back MiciMike on Crowd Supply: https://www.crowdsupply.com/micimike-rev-devices/micimike-home-mini-drop-in-pcb

Stop letting tech giants trample your privacy. In this week’s recap, we’re diving into the latest controversy surrounding Discord user privacy and their new “Teen by Default” age verification system which might already be shadow-surveilling you via AI. We also have some positive news: Mastodon is finally fixing its onboarding friction to help decentralized social media go mainstream, and ASUS is leading a new charge to unify the gaming on linux experience through the Open Gaming Collective. In this episode: Discord Privacy Alert: Why their new age-scan policy is a nightmare for internet freedoms. Mastodon Adoption Fix: How redesigned profiles and improved onboarding are fighting centralization. Linux Gaming Unified: What the “Open Gaming Collective” means for the future of open source gaming. Show Notes & Timestamps [00:00] Intro: The State of Internet Freedoms Nate’s take on the recurring cycle of corporate overreach and the need for open source alternatives. [02:15] Discord’s “Teen by Default” & AI Surveillance The Gist: All users must verify their age or face restricted “teen” account status starting March 2026. Privacy Concerns: Discord is leveraging Persona (a 3rd party with links to Palantir) for facial age estimation scans. The “Shadow” AI: Discord claims many users won’t need to scan because they’ve already been analyzing chat patterns to “peg” user ages. History Repeating: Reminder of the 2025 data breach involving a 3rd party vendor. Links: https://discord.com/press-releases/discord-launches-teen-by-default-settings-globally https://www.techbuzz.ai/articles/discord-walks-back-age-verification-fears-for-most-users https://www.windowscentral.com/gaming/discord-leave-windows-central-readers https://www.nytimes.com/2025/05/30/technology/trump-palantir-data-americans.html [08:45] Mastodon: Breaking the Barriers to Entry New leadership is attacking the “adoption problem” by simplifying server choices. Key Updates: Email notifications for non-account holders and profile redesigns for creators. Admin Tools: Introduction of automated content scanning and external block-lists to fight spam. Links: https://dataconomy.com/2026/02/19/mastodon-is-finally-fixing-its-biggest-entry-barrier/ [14:20] Linux Gaming: The Open Gaming Collective ASUS’s Linux division launches a collective to standardize the Linux gaming stack. Goal: Move away from translation layers (Proton) toward native open source development. Supported Distros: Bazzite, Nobara, ChimeraOS, and more. Links: https://www.techpowerup.com/345777/open-gaming-collective-forms-to-enhance-linux-gaming

3D Printer DRM: Washington State Proposal The Issue: A proposed bill in Washington State would require 3D printer manufacturers to include firmware that identifies and blocks the printing of firearm parts. The Penalty: Violations could carry up to five years in prison and a $15,000 fine. The Concern: While the “spirit” is to prevent unregistered firearms, Nate points out this is already illegal. The real danger lies in the implementation: Permission to Print: Printers may need to "check-in" with an authority to compare jobs against a database. The Slippery Slope: This technology could easily be expanded to block copyrighted materials (like LEGO) or cosplay items (like Disney/Star Wars props). Sources: [Tom's Hardware Article ](https://www.tomshardware.com/3d-printing/washington-state-proposes-new-3d-printed-gun-controls-with-blocking-features-and-blueprint-detection-algorithm-proposal-would-carry-sentences-of-five-years-in-prison-usd15-000-fine-for-violation) BillTrack50 - Washington Bill Details [YouTube: Loyal Moses Discussion](https://www.youtube.com/watch?v=QvBVZIJWejs) Voidlink: The New Frontier of Linux Malware Overview: A new malware toolkit called Voidlink has been discovered, specifically targeting Linux in the cloud and containerized environments. AI-Authored: Researchers suspect the code was generated using AI, allowing for more rapid and complex development. Advanced Modular Design: Unlike typical “one-off” scripts, Voidlink is a modular framework with over 30 components. Capabilities: Includes modules for stealth, privilege escalation, lateral movement, and reconnaissance. Dynamic Loading: Attackers can load or unload these modules as needed depending on the target environment. Sources: [Ars Technica - Never-before-seen Linux Malware](https://arstechnica.com/security/2026/01/never-before-seen-linux-malware-is-far-more-advanced-than-typical/) [InfoSecurity Magazine - Voidlink Built Using AI](https://www.infosecurity-magazine.com/news/voidlink-linux-malware-built-using/) [ The Hacker News - Voidlink Framework](https://thehackernews.com/2026/01/voidlink-linux-malware-framework-built.html)

Is 2026 the year of the Linux desktop? Join Nate, the Iron Sysadmin, as we break down ZDNet’s 2026 predictions, the rise of immutable Linux distributions like RHEL, and why users are ditching Windows. In this week’s news recap, we explore the evolving landscape of open-source software and digital freedom. We discuss the growing “Rust-in-the-kernel” movement, the reality of immutable operating systems going mainstream, and the concerning fall of Firefox’s market share. We also take a deep dive into the Freedom House 2025 assessment of global internet freedom and the “unbundling” of Twitter into decentralized protocols. ZDNet’s 2026 Predictions: https://www.zdnet.com/article/linux-and-open-source-2026-predictions/ Freedom House’s Assessment of Internet Freedom: https://freedomhouse.org/report/freedom-net/2025/uncertain-future-global-internet Net Influencer’s article on on Twitter’s users “Unbundled”: https://www.netinfluencer.com/twitter-alternatives-in-2026-the-platform-didnt-get-replaced-it-got-unbundled/

This week on the Open Source News Recap, we dive into a major conflict at the heart of the open-source community: FFmpeg vs. Google over AI-generated bug reports. What responsibility do billion-dollar tech companies have to community-maintained projects like FFmpeg? Plus, we cover significant announcements from the enterprise Linux space, including Red Hat Enterprise Linux (RHEL) 10.1 and 9.7 releases and Canonical’s extended 15-year support for Ubuntu LTS releases. In gaming, Valve just announced new hardware, including the powerful Steam Machine and a new Steam Controller. Finally, we discuss a critical warning from the UN about the need for ethical guardrails around the rapidly advancing Brain Tech Revolution. Show Notes Open Source Conflict: FFmpeg vs. Google Google is using an AI code assistant to analyze and report bugs. This is creating extra load on small, community-maintained open-source projects, like FFmpeg. FFmpeg is a set of tools that read, convert, and re-encode all video formats, and it is leveraged by many sites, including YouTube, Plex, VLC, browsers like Chrome and Firefox, and Amazon. The FFmpeg community thinks it is reasonable that a company worth as much as Google should submit a patch along with their bug reports. This issue raises the question of whether AI-analyzed bugs are even of any value, as one valid bug was related to ancient media from an old Lucas Arts game. https://thenewstack.io/ffmpeg-to-google-fund-us-or-stop-sending-bugs/ Enterprise Linux News Red Hat announced the release of RHEL 10.1 and 9.7. Highlights of the release include: validated hardware drivers for AI accelerators from NVIDIA, AMD, and Intel; improvements around the Command Line Assistant; soft-reboots; and progress on Post-quantum crypto. https://www.redhat.com/en/about/press-releases/red-hat-delivers-evolving-foundation-modern-it-latest-version-red-hat-enterprise-linux Canonical is now providing up to 15 years of commercial support for Ubuntu LTS releases, which highlights the growing maturity in the enterprise Linux space. https://www.phoronix.com/news/Ubuntu-LTS-Canonical-15-Years Valve and Linux Gaming Updates Valve announced a new Steam Controller and new hardware, including the Steam Machine. Support for the new Steam Controller has already been pushed into the SDL3 library. This is a strong indicator of Valve’s commitment to upstreaming Linux-related gaming features. Valve also announced a new wireless VR Headset with controllers, which is slated for early 2026. https://www.phoronix.com/news/Steam-Machines-Frame-2026 Tech Ethics and Decentralization The UN is urging ethical guardrails for the Brain Tech Revolution, warning on the freedom of thought. Brain-monitoring neurotechnology is advancing faster than ethical and legal safeguards, raising concerns about mental privacy. Devices that let you interact with devices using thoughts are especially concerning, as they could compromise people’s rights to free thought. https://news.un.org/en/story/2025/11/1166277 A report by Bybit’s Lazarus Security Lab revealed that 16 major blockchains have built-in fund-freezing capabilities. They used an AI code analysis assistant along with manual review to uncover three types of freeze mechanisms: hardcoded, configuration-based, and on-chain contract freezing. The study suggests that transparency around these mechanisms is important and should be a core pillar of blockchain governance. https://www.investing.com/news/cryptocurrency-news/bybits-lazarus-security-lab-reveals-hidden-fundfreezing-functions-across-16-major-blockchains-4351254

In this week’s Iron Sysadmin Open Source News Recap, Nate breaks down the biggest tech stories, including the controversial arrival of Quote Posts in Mastodon 4.5, now with anti-harassment controls. We analyze why Linux gaming is surging on Steam, recently surpassing MacOS. Plus, we cover Nvidia’s move into open-source drivers with the new Nova project for their next-gen accelerators , and dive into the details of Microsoft Azure’s 8-hour outage. Tune in for your weekly dose of open source news and community updates! 🎙️ Show Notes: Week of November 7th This week, Nate dives into some big updates for open source social networking, major growth in Linux gaming, an interesting move from Nvidia, and another cloud provider facing downtime. Social Media & Open Source News Mastodon 4.5 Introduces Quote Posts: The platform has finally rolled out quote-posting, a feature that was previously unavailable. Quote posts are considered controversial on platforms like X and Threads due to frequent abuse and being used to single-out users in an effort to harass them. Mastodon aims to mitigate this by allowing users to set quoting permissions, which the platform will then respect, giving users more control over their interactions. https://www.techbuzz.ai/articles/mastodon-4-5-brings-quote-posts-with-anti-harassment-controls Nvidia’s Open Source Initiative: Nvidia engineers are developing a new open-source driver named Nova. The driver is currently being prepared to support select GPU’s, namely the Hopper and Blackwell generations. These do not appear to be gaming adapters, but likely for compute. https://www.techpowerup.com/342552/3-of-steam-users-play-on-linux-a-third-of-them-on-steamos Gaming & Operating Systems Linux Gaming Market Share Rises: Linux gaming now accounts for 3% of all Steam users. This figure is greater than the 2.11% of users on MacOS. Approximately one-third of the Linux users are on SteamOS, with the remaining two-thirds on other Linux distributions. Windows still holds a dominant share at over 94% of Steam users, with 3% of that being Windows 11. https://www.phoronix.com/news/Hopper-Blackwell-Nova-Prep Cloud & Tech Outages Microsoft Azure Suffers Outage: Azure had its own outage last week. The outage began at 3:45 PM UTC on Wednesday and lasted until 12:05 AM Thursday. The core issue affected the “Azure Front Door” (AFD) service, which is the CDN for Azure. This impacted a number of downstream services. The problem sounds like a config mishap: an “inadvertent tennant config”. https://www.crn.com/news/cloud/microsoft-s-eight-hour-azure-outage-5-things-we-ve-learned-so-far Events Defcon 610 Pub Crawl: A reminder that the Defcon 610 Pub Crawl is happening this weekend (November 8th) in Easton, Pennsylvania! https://www.meetup.com/defcon610/events/311572906

Join Nate for this week’s open-source news recap, covering a major milestone in Linux gaming viability, a significant shift in the Ubuntu display server, and an update on a fan-favorite Netflix show. The episode also reminds listeners about the upcoming DevCon 610 pub crawl and highlights a funding initiative supporting the open and free internet. Intro & DefCon 610 Announcement Reminder to mark calendars for the DefCon 610 Pub Crawl and CTF on November 8th at Noon. https://www.meetup.com/defcon610/events/311572906/ Linux Gaming Milestone New data shows that nearly 90% of Windows games now run on Linux. The viability of gaming on Linux is higher than ever, largely due to the Proton/WINE translation layer. Nate discusses the nuances of game compatibility, including issues with kernel-level anti-cheat. https://www.tomshardware.com/software/linux/nearly-90-percent-of-windows-games-now-run-on-linux-latest-data-shows-as-windows-10-dies-gaming-on-linux-is-more-viable-than-ever Ubuntu’s Display Server Shift Ubuntu 25.10 ships without X11, fully embracing Wayland as the default display server]. This transition has caused some controversy online, though many other distributions like Fedora and Red Hat have already made the move. The host notes that X11 was no longer being well-maintained. https://thenewstack.io/ubuntu-25-10-scraps-x11-for-wayland-a-solid-step-forward/ Funding the Open Internet The NLnet Foundation reports on the NGL Zero fund, which is dedicated to furthering the open internet. This grant funded 29 free and open-source projects at every layer of the technology stack, from hardware and infrastructure to web frameworks. https://nlnet.nl/news/2025/20251016-selection-NGI0CommonsFund.html Pop Culture: Stranger Things Season 5 Discussion about the announcement and trailer drop for Stranger Things Season 5. The series, which debuted in 2016, is noted for its 80s nostalgia and focus on nerdy themes. The final season is expected in November. https://arstechnica.com/culture/2025/10/netflix-drops-a-doozy-of-a-trailer-for-stranger-things-s5

Link for the DEF CON 610 Hacker Pubcrawl: https://www.meetup.com/defcon610/events/311572906 On to the news: We can’t not talk about AWS. https://www.techpolicy.press/amazon-cloud-outage-reveals-democratic-deficit-in-relying-on-big-tech/ Technical details: https://www.forbes.com/sites/kateoflahertyuk/2025/10/23/aws-outage-new-analysis-explains-what-went-wrong-and-why/ An issue with Dynamo-db caused a cascading failure Between 11:48 p.m. on Oct. 19 and 2:40 a.m. on October 20, Amazon DynamoDB experienced “increased API error rates” in its Virginia US-East-1 Region, the main region for deploying applications. Caused by a “latent defect” in the services DNS management. This lead to queries for the services endpoint to return empty. And because of how DNS works, even once the issue is fixed, you’ll still have this long tail of failures as dns caches clear and refresh. This apparently lead to high traffic on network load balancers to result in health check failures on the service. And at the same time, new ec2 instances started failing to start up. Even once they were started, they suffered from network connectivity issues. Which then lead to MORE network load balancer issues. On to linux gaming! https://www.windowscentral.com/gaming/linux-supercharges-the-rog-xbox-ally-x-higher-fps-smoother-performance-and-a-big-win-for-handheld-gaming ASUS ROG Xbox Ally X, and xbox handheld that launched recently, apparently well received Buuut once people got their hands on it, they started to feel less great about its software stack. Windows was left a little bloated, and the UI left some room for improvement That is until someone threw bazzite on it, and now its amazing. Im paraphrasing bt have a look at the article, it shows significant FPS improvements on the games that were tested, and basically plays like a steamdeck. And the Fediverse gets a fuzzer https://asml.cyber.harvard.edu/category/projects/ Harvard apparently has an applied social media lab, because of course they do. The ASML has announced an activitypub fuzzer. A tool meant to help Activitypub developers test their api compatibility. The tool mimics common Fediverse activity and helps developers test their applications without putting them into the wild and watching them catch fire. The GIMP has decided to take over ownership if its own snap https://www.omgubuntu.co.uk/2025/10/official-gimp-snap-package-announced Previously the snap was maintained by snapcraft, a community associated with Canonical thats been propping up the snap repos The GIMP project has decided to start managing this build on their own. This doesn;t change how you get gimp on ubuntu however, just who owns the package. If anything this should give users more confidence in the quality of the snap! The Fedora Foundation has changed their stance on AI generated Code https://www.theregister.com/2025/10/23/fedora_agrees_policy_allowing_ai_assisted_code_contribs/ There are strict guidelines around using AI strictly as a code assistant, not as a primary author. This follows a decision last year that prevented any use of AI code.

It’s END OF 10 week (let’s talk about that) F-Droid facing developer identification issues after google’s software verification announcement. https://www.bleepingcomputer.com/news/security/f-droid-project-threatened-by-googles-new-dev-registration-rules/ More NPM supply chain attacks, this time from North Korea https://currently.att.yahoo.com/att/north-korean-hackers-target-crypto-221509651.html Doom Dark Ages gets performance improvements and steam deck verified https://www.gamingonlinux.com/2025/10/doom-the-dark-ages-gets-a-major-performance-upgrade-for-handhelds-now-steam-deck-verified/ Gaming on linux has come a long way https://www.reddit.com/r/linux_gaming/comments/1o50o79/gaming_on_linux_keeps_getting_better_especially/ Gonna be honest, i had trouble watching the video, but he made some good points. Linux gaming has in fact come a long way, and i love seeing folks who are not already linux users giving it a try. Mastodon is working on a new “packs” feature. https://www.theverge.com/news/794988/mastodon-bluesky-starter-packs-fediverse Meant to help user onboarding, by helping them find people to follow I love this alternate approach to a curated outrage algorithm It sounds like packs are meant to be groups of people based on topics. So a topic based on Linux, might include folks like linux influencers, users, developers, folks who you might want to follow. You are notified when you are added to a pack, and can remove yourself if youd like. The open internet is dead.. https://www.techpolicy.press/the-open-internet-is-dead-what-comes-next/ The open internet has been hollowed out by big tech and corporate monopolies.