October 02, 2026

hackergotchi for Qubes

Qubes

Qubes OS 4.3.2 has been released!

We’re pleased to announce the stable release of Qubes OS 4.3.2! This patch release aims to consolidate all the security updates and bug fixes that have occurred since the previous stable release. Our goal is to provide a secure and convenient way for users to install (or reinstall) the latest stable Qubes release with an up-to-date ISO. The ISO and associated verification files are available on the downloads page.

Announcements

What’s new in Qubes 4.3.2?

For an overview of what’s new in Qubes 4.3, see the Qubes 4.3 release notes.

How to get Qubes 4.3.2

In all cases, we strongly recommend making a full backup beforehand.

Known issues in Qubes 4.3.2

It’s possible that templates restored in 4.3.2 from a pre-4.3 backup may continue to target their original Qubes OS release repos (#8701). After restoring such templates in 4.3.2, enter the following additional commands in a dom0 terminal:

sudo qubes-dom0-update -y qubes-dist-upgrade
sudo qubes-dist-upgrade --releasever=4.3 --template-standalone-upgrade -y

This will automatically choose the templates that need to be upgraded. The templates will be shut down during this process.

Fresh templates on a clean 4.3.2 installation are not affected. Users who perform an in-place upgrade from 4.2 to 4.3 (instead of restoring templates from a backup) are also not affected, since the in-place upgrade process already includes the above fix in stage 4. For more information, see issue #8701.

View the full list of known bugs affecting Qubes 4.3 in our issue tracker.

What’s a patch release?

The Qubes OS Project uses the semantic versioning standard. Version numbers are written as [major].[minor].[patch]. Hence, we refer to releases that increment the third number as “patch releases.” A patch release does not designate a separate, new major or minor release of Qubes OS. Rather, it designates its respective major or minor release (in this case, 4.3) inclusive of all updates up to a certain point. See our supported releases for a comprehensive list of major and minor releases and our version scheme documentation for more information about how Qubes OS releases are versioned.

02 October, 2026 12:00AM

October 01, 2026

hackergotchi for SparkyLinux

SparkyLinux

Sparky news 2026/09

The 9th monthly Sparky project and donate report of the 2026: – Linux kernel updated up to 7.2.8, 6.18.54-LTS, 6.12.111-LTS (amd64 + i686-pae) – repos of Sparky 6 potolo (oldoldstable) based on Debian 11 bullseye has been removed – EOL – Sparky 2026.09 of the testing (semi-rolling) line released, including a new image of Labwc on Wayland Many thanks to all of you for supporting our open…

Source

01 October, 2026 02:48PM by pavroo

hackergotchi for ZEVENET

ZEVENET

SSL Offloading: What It Is, How It Works, and When to Use It

When a user connects to a website or application over HTTPS, the traffic between them is encrypted. That protects the data in transit, but it also creates work: somewhere in the infrastructure, the traffic has to be decrypted before the application can actually process the request.

In a simple setup, each application server handles that work itself. As an application scales across multiple servers, there’s another option: move that responsibility to the load balancer or Application Delivery Controller (ADC) sitting in front of them, so one system handles encryption instead of every backend doing it independently. That’s the basic idea behind SSL offloading — the ADC handles the secure connection with the user, decrypts the incoming traffic, and forwards the request to the right application server.

But there’s a question that actually determines the architecture: after the ADC decrypts the traffic, what happens between the ADC and the backend? It can stay decrypted, get encrypted again, or never be decrypted at the load balancer at all. Those three possibilities are what this article covers.

Why Do We Talk About Both SSL and TLS?

Before going further, it’s worth clarifying one point. SSL is the older protocol; modern HTTPS connections actually run on its successor, TLS. Even so, the term SSL offloading remains widely used across the industry, so you’ll also come across TLS offloading and SSL/TLS offloading describing the same concept.

This article uses SSL offloading as the general term, and TLS specifically when referring to the modern encryption protocol behind HTTPS.

What Is SSL Offloading?

SSL offloading means moving the work of handling secure HTTPS connections away from application servers and onto another system — typically a load balancer or ADC. Instead of every server managing encryption and decryption for its own client connections, the ADC becomes the single point that terminates HTTPS and decides which backend receives each request.

Take an application running on five servers. Without offloading, each server manages secure connections from users on top of running the application itself. With SSL offloading, the ADC becomes the entry point instead:

That’s the shift: instead of five separate servers each managing their own encrypted connections, the ADC becomes the single point where those connections are handled.

This is why SSL offloading is closely tied to load balancing: the same component that distributes traffic across a server pool can also take on the encrypted connection before it routes each request.

How Does SSL Offloading Work?

It helps to think of the connection as two separate parts:

The first part is straightforward: the user’s browser establishes a secure HTTPS connection with the ADC. The second part is where infrastructure teams have a choice. From that point, there are three possible flows: the ADC can decrypt and forward plain HTTP, decrypt and re-encrypt before forwarding, or leave the connection encrypted and pass it straight through to the backend.

Here’s what each of those three flows looks like in practice.

Three Ways an ADC Can Handle Encrypted Traffic

1. Decrypt at the ADC and send HTTP to the backend

The ADC handles the secure connection with the user. After decrypting the request, it sends plain HTTP traffic to the selected backend. This is the clearest form of SSL offloading: the backend no longer handles encryption or decryption for the client connection, and certificate management for that public-facing connection can be centralized at the ADC.

The trade-off matters just as much: the connection between the ADC and backend isn’t encrypted. That can be acceptable in a controlled network environment, but not in every architecture.

2. Decrypt at the ADC and encrypt again (SSL bridging)

The ADC still decrypts the incoming request — but why decrypt it if it’s going to be encrypted again? Because there’s useful work to do in between. Once decrypted, the ADC can read the HTTP request, apply application-aware routing, or let a Web Application Firewall inspect it. Only after that processing does the ADC open a new encrypted connection to the backend.

This is commonly called SSL bridging or TLS re-encryption: the ADC decrypts traffic at the edge and re-encrypts it before sending it on to the web server. It’s a useful middle ground: the ADC gets visibility into application traffic while the connection to the backend stays encrypted.

3. Do not decrypt at the load balancer (SSL/TLS passthrough)

Here the load balancer never decrypts the application traffic — it forwards the encrypted connection to a backend server, which handles decryption itself. This is known as SSL or TLS passthrough.

Passthrough is useful when the secure connection needs to terminate directly on the application server. The trade-off is visibility: because the load balancer can’t see inside the encrypted connection, it can’t perform the same application-level inspection or content-based routing that decryption enables.

Why Use SSL Offloading?

SSL offloading brings several benefits beyond the architecture itself:

Centralized management

Managing public-facing certificates and encryption settings independently on every backend server creates operational overhead. Moving the client-facing HTTPS connection to the ADC creates a single control point for those connections.

Application-aware traffic management

Once traffic is decrypted, the ADC can read the actual HTTP request instead of just seeing an encrypted stream — which makes it possible to route based on hostname, URL, or HTTP headers.

Security inspection

The same visibility matters for application security. A WAF needs access to the HTTP request to analyze URLs, parameters, headers, or request bodies for malicious activity — which is why decryption and application security are closely linked.

Reduced backend workload

Moving client-facing encryption off the application servers frees up resources for the application itself. How significant that is depends on traffic volume and infrastructure — in modern environments, operational simplicity and traffic visibility can matter just as much as the raw CPU savings.

SSL Offloading vs SSL Termination vs SSL Bridging vs SSL Passthrough

One common source of confusion is SSL termination vs SSL offloading. Vendors often use them interchangeably, but they emphasize different things: termination tells you where an encrypted connection ends and gets decrypted; offloading emphasizes that the encryption work has moved away from another component — usually the backend.

This overlap shows up across the industry: many vendors describe SSL termination and SSL offloading as effectively interchangeable. We use similar language ourselves — our HTTPS listener performs SSL offloading, and our TLS/SSL Inspection flow refers to that decryption stage as TLS termination.

In practice, the vendor label matters less than the actual traffic flow. Rather than choosing an architecture based on whether something is called “offloading” or “termination,” ask where the traffic is decrypted and whether it’s encrypted again before reaching the application server.

Which Approach Should You Use?

The decision comes down to two questions: does the ADC need to inspect HTTP traffic, and does that traffic also need to stay encrypted on the way to the backend.

  • Need HTTP/WAF visibility, and a plaintext backend connection is acceptable under your security policy → classic SSL offloading.
  • Need HTTP/WAF visibility, but the backend connection also has to stay encrypted — for compliance, or because the network segment isn’t fully trusted → SSL bridging / re-encryption.
  • The original secure connection needs to terminate only at the backend → passthrough.

There’s no universal “best” mode. The choice depends on the application’s security requirements, network boundaries, the ADC functionality you need, and your operational model.

Is SSL Offloading Secure?

SSL offloading doesn’t automatically make an architecture more or less secure — the important question is what happens after decryption.

With classic offloading, traffic between the ADC and backend can travel as plain HTTP, which means that network segment no longer carries encrypted data. Whether that’s appropriate isn’t just a question of whether the network is “internal” — it depends on your security policy, the trust boundaries of that network segment, and any compliance requirements that apply. If plaintext traffic isn’t acceptable, the ADC can decrypt the request for processing and then open a new encrypted connection toward the backend.

This also means the ADC itself becomes a security-critical component: it can access decrypted application traffic and manages the certificates used for those connections. Administrative access, updates, monitoring, and certificate management all matter as a result.

How SSL Offloading Works in SKUDONET

An HTTPS farm is a Layer 7 reverse-proxy service that handles secure HTTP traffic. When you use the HTTPS listener, the farm performs SSL offloading — moving the handling of client SSL/TLS connections away from the real application servers.

Decrypt, inspect, and control

TLS/SSL Inspection breaks this down into three stages:

The first stage is TLS termination — native TLS offloading. Once traffic is decrypted, Layer 7 security and traffic-management functions can operate on the request, which can then be re-encrypted before being forwarded to a backend when that architecture is required. This is also what makes WAF inspection possible on HTTPS traffic: our WAF checks requests only after the encrypted connection has been terminated, because it can’t inspect a payload that’s still encrypted.

Does the backend connection have to stay unencrypted?

No. Within an HTTP/S service, the HTTPS Backends option lets you encrypt traffic again before it reaches the backend servers:

This is documented as TLS Re-encryption to Backend — the same architecture described elsewhere as SSL bridging.

Centralized certificate management

Because we act as the HTTPS endpoint in this model, the HTTPS farm also manages the certificates and encryption settings tied to those client connections — SSL/TLS versions, cipher configuration, wildcard and SNI support, and Let’s Encrypt integration for automated renewal. Encryption management, load balancing, and application security inspection all happen at the same application delivery layer.

Conclusion

SSL offloading moves the handling of encrypted client connections from backend servers to the load balancer or ADC. What happens next — plaintext to the backend, re-encryption, or passthrough — is the part of the architecture that actually needs a decision, and it depends on where your organization needs traffic to stay encrypted, whether the ADC needs to see inside HTTP requests, and how you want to split that responsibility between the delivery layer and the backend.

On our platform, HTTPS farms provide SSL offloading at the application delivery layer, and TLS/SSL Inspection builds on the same model — decrypt, inspect, and re-encrypt — for teams that need both visibility and an encrypted path to the backend.

Want to see how SKUDONET can fit into your application delivery architecture? Explore SKUDONET Enterprise Edition.

FAQ

What is SSL offloading?

SSL offloading is the process of moving the handling of secure HTTPS connections from application servers to another system, typically a load balancer or Application Delivery Controller. The ADC decrypts the incoming connection and forwards the application request to a backend.

How does SSL offloading work on a load balancer?

The user establishes an HTTPS connection with the load balancer rather than directly with an application server. The load balancer decrypts the traffic, can process or inspect the HTTP request, and then forwards it to the selected backend.

What is the difference between SSL and TLS offloading?

SSL is the older protocol name that remains widely used in industry terminology such as “SSL offloading.” Modern HTTPS uses TLS. In today’s infrastructure, SSL offloading and TLS offloading generally refer to the same architectural concept.

What is the difference between SSL termination and SSL offloading?

SSL termination tells you where an encrypted connection is decrypted. SSL offloading emphasizes moving that processing away from the backend servers. Vendors often use the terms with some overlap, so checking the actual client-to-ADC and ADC-to-backend traffic flow is more reliable than relying on the label alone.

What is the difference between SSL offloading and SSL bridging?

In the classic SSL offloading model, the ADC decrypts HTTPS and can forward plaintext traffic to the backend. With SSL bridging or re-encryption, the ADC decrypts the request but creates a new encrypted connection before sending it to the backend.

What is SSL passthrough?

With SSL passthrough, the load balancer does not decrypt the HTTPS traffic. It forwards the encrypted connection to a backend server, where it is finally decrypted. This preserves backend control of the secure connection but limits the load balancer’s ability to inspect HTTP traffic.

Does SSL offloading improve server performance?

SSL offloading can reduce the encryption and decryption work performed by application servers. The actual performance impact depends on traffic volume, connection behavior, and infrastructure. Centralized certificate management and application visibility are also important reasons to use offloading.

Is SSL offloading secure?

It can be used securely, but the architecture must account for what happens after the ADC decrypts the request. If traffic to the backend isn’t encrypted, that network segment carries plaintext data. When that’s not appropriate, the traffic can be re-encrypted before being forwarded to the backend.

01 October, 2026 12:16PM by Isabel Perez

September 30, 2026

hackergotchi for VyOS

VyOS

VyOS Project September 2026 Update

Hello, Community!

Over the last month, two well-known subsystems changed the way they work. OpenVPN acquired a kernel data path that carries traffic. The REST API acquired authentication methods beyond a shared key. Much of everything else came from outside the core team, including the OpenVPN work, which was contributed by an upstream OpenVPN developer.

30 September, 2026 11:30PM by Taras Pudiak (taras@vyos.io)

hackergotchi for ARMBIAN

ARMBIAN

Armbian Newsletter September 2026

30 September, 2026 06:40PM by Michael Robinson

Booting every board, every night

Booting every board, every night

Armbian builds for hundreds of boards. A kernel bump that is clean on one SoC can leave another unbootable and no build log will tell you. So there is a rack, and the rack boots them.

Compiling is not evidence. A kernel that builds, packages that install, an image that flashes — none of it proves a board comes back after reboot. Armbian supports a very large number of boards across a dozen vendors and twenty SoC families, maintained largely by volunteers who each own one or two of them. The failure mode that hurts is not a broken build. It is a change that builds perfectly and quietly bricks the boot path on hardware nobody happened to have on their desk that week.

The automated test facility exists to close that gap. It is a rack of real boards, wired for remote power, that installs what Armbian published and then tries to use it: upgrade, switch kernel branches, reboot repeatedly, measure, report. What follows is what it does today, the hardware it takes to run, where AI fits into maintaining the stack around it, and the change we want to make next: moving hardware validation from nightly builds to pull requests.

What is in the rack

Fleet composition, as recorded in inventory

65 Boards under test 62 Distinct models 22 Vendors 20 SoC families

The boards are the point, and the spread is deliberate. Rockchip, Amlogic, Allwinner, NXP, Marvell, Broadcom, TI, Samsung, Qualcomm, SpacemiT and x86 are all represented, because that is where the differences live; a change to a shared kernel config lands differently on rockchip64 than on meson64, and only one of them will tell you so.

Vendors currently on the bench include Radxa, FriendlyELEC, Khadas, Orange Pi, Banana Pi, Odroid, Raspberry Pi, Pine64, SolidRun, Mekotronics, Kobol, Cubietech, Udoo, Inovato and Arduino. Of the 65, 56 are active and 9 are in a failed state at the moment article was done boards that need a hand in the rack. That number is itself a signal: a board that has stopped answering is a board that stopped being able to report, which is usually more interesting than a test that merely failed.

Every board is registered in NetBox, which is the source of truth for the whole system. Not just an asset list the orchestrator reads it to decide what a board can be tested with. Power is derived from cabling topology rather than a field someone typed: a board&aposs power port is cabled to an outlet on a controller device, and the controller carries the driver. If the cable is not in the model, the board is treated as having no managed power, and the tests that need a hard power cut are skipped rather than faked.

The hardware it takes

Per bench, and the shared infrastructure behind it

The cost of adding a board is not the board. It is the wiring around it. Each bench needs some subset of the following, and which subset a board has determines which tests it is eligible for.

Remote power Required

A way to cut and restore power without a human. Three backends are in use: PoE switch ports for anything powered over Ethernet, a switched rack PDU for mains devices, and a 24-channel relay board driven over GPIO for DC-barrel and USB-powered boards. Without this there is no cold-boot test, only a soft reboot which is exactly the case that tends to pass while the real one fails.

Network Required

Wired Ethernet on a managed switch. This is the control channel (the harness drives boards over SSH), the measurement channel for throughput tests, and on PoE benches, the power channel too. A board that only has Wi-Fi is testable but much harder to recover.

Power metering Strongly recommended

PoE ports meter per-port draw, so the harness samples watts throughout a run. This is how you tell a board that genuinely rebooted from one whose SoC never stopped executing the power trace is flat across what was supposed to be a power cycle.

Serial console Recommended

USB-to-TTL adapters on a powered hub, exposed over the network as named consoles. Without one, a board that fails to boot tells you nothing at all: you get silence and have to guess. Several boards in the rack currently lack one, and every hang on those is an investigation that stalls at "it does not come back".

Clean-flash path Not yet wired

An SD-card switcher that presents the card to a flasher host or to the board, or USB access for vendor recovery modes. This is what makes a board recoverable from software that does not boot. The framework supports it; no bench in the rack is currently wired for it, which is the single biggest constraint on what comes next.

Behind the benches sits the shared infrastructure, the part people underestimate when they picture "a few boards on a shelf":

  • Switching. Three core switches and four access switches, several of them PoE, which do double duty as the fleet&aposs power controllers. Between them they carry the control network, the test traffic and the power for a large fraction of the boards. This is no longer just a 1 GbE network: newer boards increasingly come with 2.5 GbE, while the uplinks and core need 10 GbE to aggregate traffic from many boards running tests in parallel. Without that headroom, the lab network itself becomes the bottleneck and network-performance results stop measuring the board under test.
  • Power delivery. A switched rack PDU, multi-channel DC supplies, multiple 16-way USB supply, switched power strips, and a UPS in front of all of it because a lab that loses power mid-write is a lab that corrupts SD cards.
  • Console and out-of-band. Dedicated console hosts, including a KVM device for the machines that need screen-level access.
  • Compute. Six servers in the same site, including two Ampere-class ARM machines, running the CI runners that execute the build and test jobs and the services the fleet depends on.

All of it is scripted. Each class of hardware has a small command-line tool with the same shape — status, on, off, powercycle so the harness does not care whether a board is switched by a PoE port, a PDU outlet or a relay channel. It resolves the path from the inventory model and calls whichever tool matches.

What a nightly run does

The cycle, end to end

The fleet does not stay powered. A full cycle brings it up, tests it, and puts it back to sleep. The last step runs even when everything before it failed.

  1. Power on The fleet is brought up from the PDU and the boards are given several minutes to boot.
  2. Scan and reconcile Every board is probed and the inventory updated: what version it is running, what kernel, when it was last seen. Drift between the model and reality is recorded rather than assumed away.
  3. Sync maintainer keys Board maintainers&apos SSH keys are pushed to the boards they own, so the person responsible for a board can log into the actual unit that failed.
  4. Run the board pipeline A matrix job per board, in parallel across the runners. This is the part below.
  5. Scan again Post-test state is captured; what the run left behind, not just what it reported.
  6. Power off Always, including after a failure. A rack left powered on a failed run is a rack that cooks.

Inside step four, each board runs the same pipeline. It upgrades to the nightly repository, reboots, and then walks every kernel branch that board is configured to test:

StepWhat it does
upgradePoint at the nightly repository and install what is currently published.
rebootVerify that the board comes back with what it already had installed.
For each branchRepeat the steps below for each kernel branch (current, edge, …).
↳ kernel-switchInstall that branch&aposs kernel and verify that it is fully configured.
↳ rebootPerform warm reboots, followed by a cold power cycle where switched power is available.
↳ hw-performanceTest CPU, memory, disk and temperature.
↳ dvfsVerify that the governor actually reaches the frequencies it claims.
↳ network-iperfMeasure throughput on each cabled network interface.
↳ store-versionsRecord exactly what is installed and running.
restore-stablePut the board back the way it was found.

Two details in there carry more weight than they look. The reboot module does warm reboots followed by a cold power cycle, because those fail differently: a board can survive reboot indefinitely and still not come back from a real power cut. Testing both is the only way to catch both failure modes. And kernel-switch verifies that the package is genuinely configured rather than trusting an exit code, because the interesting failures can leave a kernel half-installed while every command reports success.

What the results look like

Booting every board, every night

Current results are published publicly at docs.armbian.com/status/board-tests, refreshed as runs complete.

What it actually catches

Here are few examples from recent runs.

Reboots that hang on both kernels

One board fails every reboot attempt on both of its kernel branches. The power trace shows the draw holding steady through what should have been a restart — the SoC never stopped executing.

That points at firmware rather than the kernel, but the issue remains unresolved. It is also a good example of the console gap: that bench has no serial console, so the investigation is relying on power measurements and inference instead of a boot log.

A test that was wrong about x86

The frequency-scaling check assumed that a governor under load should reach at least 95% of the maximum advertised frequency. That works for ARM cpufreq, but not for Intel and AMD, where the driver manages turbo behaviour itself and the advertised maximum is not a promise.

Every x86 board was therefore failing a test that was itself wrong. The test was fixed by detecting the driver and applying the check only where it makes sense.

Telling a broken board from a broken runner

Self-hosted runners occasionally drop mid-job: the test finishes green, then the job dies later and the run is marked failed. Retrying everything would be wrong. A board pipeline power-cycles hardware and takes about half an hour, so retrying a genuine failure wastes rack time and keeps cycling a board that may already be unwell.

The retry logic therefore re-runs only jobs whose test step did not fail. A real hardware or test failure stays red rather than being hidden by an automatic retry.

Where AI fits

And where it explicitly does not

A large share of the tooling described here — the test modules, hardware control scripts, inventory reconciliation and documentation — is now written and maintained with AI assistance. That is worth being plain about, including the parts that go wrong.

What AI is genuinely good at is shortening the distance from symptom to candidate explanation. A board fails; there is a transcript, a package state, a power trace, a kernel version and forty thousand lines of shell across several repositories. Correlating those quickly, proposing a mechanism and drafting a patch is work that used to take an evening and can now take a few minutes.

What it is bad at is knowing when it is wrong. In the course of this work, an analysis confidently concluded that a particular board had never appeared in the test results. The conclusion came from a sample that covered about three-quarters of the archive and happened to miss both of that board&aposs records. The reasoning was sound; the evidence was partial; nothing in the output said so.

The point

AI shortens the distance from symptom to patch. It does not shorten the distance from patch to proof. Those are different problems, and only one of them has been made easier.

That is precisely why the rack matters more now, not less. If proposing changes gets cheaper while validating them does not, the amount of unverified change grows faster than our ability to verify it. And the most dangerous bugs here are exactly the ones that compile cleanly, install without error, and fail only when a specific board is asked to come back from a power cut.

A machine that is confidently wrong is a fine collaborator as long as something downstream can check it. Sixty-five boards that will actually try to boot are that something.

So the working rule is simple: AI is free to propose anything, but nothing reaches a board on its say-so. Hardware evidence is the gate, and every conclusion that matters is expected to point at a run, a trace or a package state rather than an argument.

What is next: validation at pull-request time

The change we want to make

Today the facility validates nightly builds. Whatever was published overnight gets installed on real hardware and exercised. That is genuinely useful, and it is how the bugs above were found, but it is validation after the fact. By the time a board fails, the change is already in the nightly repository and, depending on timing, already on users&apos machines.

The goal is to move that gate earlier: a pull request that touches a board family gets that family&aposs boards booted before it merges. Not the whole rack for every PR, just the boards the change can actually reach.

Several things have to be true first, and they are worth stating honestly rather than as a roadmap of solved problems.

Selection

A diff has to map to boards. A change to a board configuration file implicates that board; a change to a kernel family implicates every board in it; a change to the packaging code implicates everything. Select too broadly and every PR occupies the entire rack for half an hour. Select too narrowly and the one board that would have caught the regression never gets tested.

Artifacts

A PR build currently proves a compile. Hardware testing needs installable packages the rack can pull and install exactly as a user would, which means PR builds must publish to an isolated repository the fleet can reach. Our current build machinery is already stretched by existing CI and release workloads. Making hardware testing part of routine PR validation will require additional build capacity, storage and package-publishing infrastructure.

Time budget

A full board pipeline takes around thirty minutes. That is acceptable overnight and much too slow as a merge gate, particularly when a nightly cycle already has the rack. This needs a short profile for PRs: install, switch kernel, reboot warm and cold, and confirm it is running what was installed. Performance and throughput work can stay in the nightly run. It also needs real contention handling, so a PR does not simply queue behind a fleet cycle.

Recovery

This is the hard one, and it is a hardware problem rather than a software one. Testing unmerged code means occasionally installing a kernel that does not boot. Right now every bench in the rack is tested in place; there is no remote path to reflash a board whose boot is broken. A board that a bad PR bricks is a board that stays bricked until somebody walks to the rack.

So PR-stage testing starts on benches that can be recovered remotely: SD-card switchers for boards that boot from removable media, and vendor recovery modes over USB for those that support it. Wiring that up across the fleet is the prerequisite that gates everything else, and it is where the next round of hardware effort goes. Boards that cannot be recovered remotely stay on nightly testing, where a failure is an inconvenience instead of a dead unit.

Signal quality

A merge gate that fails for reasons unrelated to the change is worse than no gate: it trains people to ignore it. The distinction between a board failure and a broken bench, already important for nightly runs, becomes critical the moment a red result blocks a merge.

Helping

Infrastructure, capacity, partnerships

There are three practical ways to move this forward.

Bench infrastructure. Remote recovery is the immediate blocker for PR-stage testing, particularly SD-card switchers and the wiring around them. The network also needs to grow with the hardware being tested: managed PoE switches with 2.5 GbE access ports and 10 GbE uplinks, plus PoE splitters for boards that cannot be powered directly over Ethernet. These are not just infrastructure upgrades; they expand what can be tested, measured and recovered without somebody standing in front of the rack.

Build capacity. PR-stage hardware testing needs PR builds, and build queue time is already a constraint on how quickly a fix reaches hardware. More build capacity, storage and package-publishing infrastructure are needed to move validation from nightly runs into the pull-request workflow. If you can host a build server, the requirements are documented, and the current fleet is listed on the build machinery page.

Hardware partnerships. For vendors, the facility provides a way to keep hardware under continuous validation rather than testing it once around release. Devices covered by support and maintenance agreements can become part of the permanent test fleet, where kernel updates, upgrades, reboots, networking and other regressions are exercised on real hardware as Armbian evolves. The value is not the board itself; it is keeping that board working over its supported lifetime.

30 September, 2026 06:29PM by Igor Pecovnik

hackergotchi for Purism PureOS

Purism PureOS

PureOS Development Report: August 2026

We're already working on building PureOS Dawn Alpha images, and we're eager to get Dawn into your hands to test! As always, stability and reliability are paramount, so this month brings even more improvements on both fronts.

The post PureOS Development Report: August 2026 appeared first on Purism.

30 September, 2026 06:00PM by Purism

Over a Decade of Warrant Canaries

October 1st, 2026 will be ten years and 3 quarters worth of warrant canaries published by Purism.

The post Over a Decade of Warrant Canaries appeared first on Purism.

30 September, 2026 05:13PM by Purism

hackergotchi for ARMBIAN

ARMBIAN

JetHome boosts Armbian CI

JetHome boosts Armbian CI

JetHome (Shenzhen JetHome Technology Co.) donated a build server for Armbian. The server compiles Armbian images, kernels and U-Boot packages. Thank you, JetHome.

HW Specifications

CPU
2 × Intel Xeon Gold 6148, 80 threads
Memory
384 GB
Storage
3.84 TB SSD, plus 20 TB of disk
Network
2 × 1 Gbit/s, bonded
Build runners
40

That is about a tenth of the fleet&aposs capacity, running up to 3 kernel or 40 full image builds at once.

The server also remembers work it has already done:

  • Compiled code is reused. A rebuild takes under a minute instead of three.
  • Software packages are downloaded once and shared by all 40 build jobs.
  • Source code and ready-made parts, such as kernels, are fetched once and kept on the server.

The fleet today

18 build servers · 774 CPU threads · 322 build runners

With 2371 GB of memory across x86-64 and ARM servers. Part of the fleet sleeps and powers up only when builds are waiting.

Current build servers are sponsored by JetHome, the OSU Open Source Lab and netcup. Armbian members sponsor all other servers.

See the live list on the build machinery page.

We need more build servers!

More servers mean more than more boards. We want faster CI, and more building and testing of every pull request, so community developers get feedback sooner and fixes reach users faster. Today the build queue is longer than it should be.

Minimum
Ideal
CPU
16 cores
32 cores
Memory
64 GB
128 GB
Storage (NVMe)
512 GB
1 TB
Upload
50 Mbit/s
1 Gbit/s

Both x86-64 and arm64 help. The server runs only Armbian builds, and we credit your hosting on the build machinery page.

Spare CPU cores and a fast uplink? Put them to work compiling Armbian for hundreds of boards.

Donate build capacity

30 September, 2026 03:26PM by Igor Pecovnik

Mali GPU with LiteRT-LM

Running Gemma 4 E2B on a Mali GPU with LiteRT-LM

Mali GPU with LiteRT-LM

This guide should work on any armbian minimal/console (trixie) system with a working Mali-g610 GPU.

DO NOT USE DESKTOP

Verified on: Orange Pi 5 Max (Rockchip RK3588, Arm Mali-G610 MC4), Armbian/Debian 13 (trixie), aarch64, 8 GB RAM.

Status summary: Both CPU (XNNPACK) and GPU (WebGPU/Dawn → Vulkan → panvk → panthor) work on the mainline panthor kernel — numbers below. The GPU path needed one line of local patching in
Mesa&aposs panvk driver (raise maxImageDimension3D 512 → 2048 to meet the WebGPU minimums that LiteRT&aposs Dawn library enforces; recipe in §5, rationale in §7.1). The model is multimodal (Text + Vision + Audio): the vision encoder runs on the same patched panvk via--vision-backend gpu (§5 "VL path" results). The vendor Rockchip libmali route and OpenCL remain unavailable on mainline panthor (§7.2, §7.3).

Stack (as shipped):

Gemma 4 E2B (.litertlm, int4)  →  LiteRT-LM CLI  →  LiteRT GPU accelerator (WebGPU/ML Drift)

Dawn (WebGPU impl) → Vulkan → panvk → panthor (kernel) → Mali-G610

1. Prerequisites

  • ARM (aarch64) Linux with a Mali GPU and at least 8 GB RAM.
  • Armbian/Debian 13 (trixie)
  • The panthor (or panfrost for older Mali) kernel driver active:
ls /dev/dri/renderD128          # render node must exist
lsmod | grep panthor            # or panfrost / lima

Full ARMv8.2-A dotprod support is required — LiteRT&aposs ARM64 binaries are built with it and will SIGILL otherwise:lscpu | grep -w asimddp (both A55 and A76 cores list it here).

2. Install Mesa + Vulkan for Mali (needs root)

sudo apt update
# Prefer the newest Mesa (backports on Debian) for the best panvk coverage of Valhall CSF GPUs:
sudo apt install -y -t trixie-backports mesa-vulkan-drivers libvulkan1 vulkan-tools
# Optional (see §7 — currently yields NO usable OpenCL device on panthor):
sudo apt install -y -t trixie-backports mesa-opencl-icd clinfo

Verify the GPU is visible to Vulkan:

vulkaninfo --summary | grep -iE "deviceName|driverName"
# Expect: deviceName = Mali-G610 MC4   driverName = panvk

3. Install the LiteRT-LM CLI (user space, no root)

curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv tool install litert-lm        # current: v0.17.x; incl. CPU (XNNPACK/YNNPACK) + GPU (WebGPU/Vulkan) backends

4. Get the model (Gemma 4 E2B, int4 .litertlm, 2.58 GB)

mkdir -p ~/litert-lm-bench && cd ~/litert-lm-bench
curl -L -o gemma-4-E2B-it.litertlm \
  https://huggingface.co/litert-community/gemma-4-E2B-it-litert-lm/resolve/main/gemma-4-E2B-it.litertlm
# or have the CLI fetch it for you:
#   litert-lm benchmark --from-huggingface-repo litert-community/gemma-4-E2B-it-litert-lm gemma-4-E2B-it.litertlm

Other ready models: google/gemma-3n-E2B-it-litert-lm (gemma-3n-E2B-it-int4.litertlm),litert-community/gemma-4-E4B-it-litert-lm, ... (see litert-lm list / HF).

5. Benchmark

Lock the CPU governor to performance first (fair, repeatable numbers):

sudo sh -c &aposfor c in /sys/devices/system/cpu/cpu[0-7]/cpufreq/scaling_governor; do echo performance > $c; done&apos

CPU baseline (XNNPACK, 8 threads):

litert-lm benchmark ~/litert-lm-bench/gemma-4-E2B-it.litertlm \
  -p 1024 -d 256 --backend cpu --cpu-thread-count 8 --cache disk --runs 2

GPU (patched panvk, §7.1). One-time local Mesa build — stays entirely in userland, the system Mesa is untouched:

# 1) Mesa source + one-line patch (26.1.2)
cd ~/litert-lm-bench
curl -L -o mesa.tar.xz https://archive.mesa3d.org/mesa-26.1.2.tar.xz
tar -xf mesa.tar.xz && cd mesa-26.1.2
python3 - <<&aposPY&apos
p = &apossrc/panfrost/vulkan/panvk_vX_physical_device.c&apos
s = open(p).read()
s = s.replace(&apos.maxImageDimension3D = PAN_ARCH <= 10 ? (1 << 9) : (1 << 14),&apos,
              &apos.maxImageDimension3D = (1 << 11), /* 2048 — meets WebGPU min */&apos)
open(p, &aposw&apos).write(s)
PY

# 2) build deps (the LLVM/CLC chain is required — panvk bakes CLC-compiled SPIR-V for libpan)
sudo apt install -y --no-install-recommends meson ninja-build pkg-config gcc g++ python3-mako \
  python3-yaml python3-ply libdrm-dev llvm-19-dev libllvmspirvlib-19-dev spirv-tools \
  libclang-19-dev libclang-cpp19-dev

# 3) panvk-only build (~10–25 min on the 5 Max)
meson setup build-panvk -Dvulkan-drivers=panfrost -Dgallium-drivers= -Dbuildtype=release \
  -Dllvm=enabled -Dmesa-clc=auto -Dplatforms= -Degl=disabled -Dgbm=disabled -Dglx=disabled \
  -Dopengl=false -Dglvnd=disabled -Dtools= -Dbuild-tests=false
ninja -C build-panvk -j6

# 4) benchmark with the patched driver, process-scoped. First put the WebGPU prebuilts
#    (libLiteRtTopKWebGpuSampler.so + libwebgpu_dawn.so etc., litert-lm repo tag v0.17.1,
#    prebuilt/linux_arm64) in ~/litert-lm-bench/prebuilt_v0171/ — see Troubleshooting.
export BUILD=~/litert-lm-bench/mesa-26.1.2/build-panvk
export VK_ICD_FILENAMES="$BUILD/src/panfrost/vulkan/panfrost_devenv_icd.aarch64.json"
export LD_LIBRARY_PATH="$BUILD/src/panfrost/vulkan:$HOME/litert-lm-bench/prebuilt_v0171"
export PATH="$HOME/.local/bin:$PATH"            # uv-installed CLI
litert-lm benchmark ~/litert-lm-bench/gemma-4-E2B-it.litertlm \
  -p 1024 -d 256 --backend gpu --cache disk --runs 2

First GPU run compiles the WebGPU/Vulkan shaders (one-time) and uploads GPU-rearranged weights (~0.8 GB weight cache); --cache disk persists both next to the model, so later loads start fast — the compile cost is NOT repaid on every run.

Results on this Orange Pi 5 Max (Mali-G610 MC4)

Backend Prefill (tk/s) Decode (tk/s) TTFT (s)
CPU (XNNPACK, 8 threads) 123.6 12.3 8.4
GPU (WebGPU/Dawn→Vulkan, patched panvk §5/§7.1) 374.0 8.7 2.9

Google&aposs on-device-class references for Gemma 4 E2B: S26 Ultra GPU 3808/52 tk/s, Raspberry Pi 5 CPU 133/7.6 tk/s. On this board the GPU wins the prefill race by ~3.0× (374 vs 124 tk/s) and TTFT by ~2.9× (2.9 vs 8.4 s), while decode stays on the CPU&aposs side (8.7 vs 12.3 tk/s) — as expected, decode is the bottleneck on Mali-class hardware; the Mali GPU is a prefill/TTFT accelerator here, not a decode accelerator.

GPU clock note (measured, no guesswork): the Mali-G610 is an integrated GPU sharing the board&aposs DDR. The devfreq governor (simple_ondemand, stock) boosts it to 1 GHz under load and parks it at 200 MHz idle — confirmed by sampling cur_freq at 400 ms during the run (233/263 samples at 1000 MHz, temps 41→56 °C, no thermal trip). Leave the governor alone: forcingperformance/min/max via sysfs was counterproductive (idle readbacks that look like the clock collapsed, and it destabilized perfectly good runs). The numbers above are at the stock governor&aposs real 1 GHz boost.

Results: Gemma 4 E4B (4B) — text GPU via the web flavor, vision GPU straight from stock

E4B (the 4B sibling) ships as three files in the HF repo: the stock gemma-4-E4B-it.litertlm (text+vision+audio, 3.66 GB) plus an -gpu and a -web (text-only, 2.97 GB) variant. On this 8 GB board the stock file cannot run on the GPU — two structural walls, both measured:

panthor job watchdog: a fixed one-shot pipeline dispatch (dmesg: job timeout ... seqno=144, same job on every E4B attempt) exceeds the driver&aposs compiled-in 1 s job timeout even at the real 1 GHz boost (E2B&aposs equivalent is seqno=77 and fits). The GPU is reset, Dawn reports VK_ERROR_DEVICE_LOST, generation aborts.

8 GB RAM ceiling: GPU buffers (pinned, unrescalable shmem) peak near 4–5 GB on top of the 3.66 GB model; every run ended in a global OOM-kill (EXIT=137) during iteration 2 even with a 2048-token KV cap + ringbuffers + disk cache.

The -web flavor dodges both — its finer op layout splits the killer dispatch under the 1 s bar and shrinks the GPU working set (peak 4.3 GB observed, holds 1 GHz the whole run):

Gemma 4 E4B lane Flavor Prefill (tk/s) Decode (tk/s) TTFT (s)
CPU (XNNPACK, 8 threads) stock 52.6 5.58 19.6
GPU (patched panvk) web (text-only) 75.1 4.54 13.9

(reproducible to the decimal across --runs 2; init 6.2 s; note --cache disk does not persist for the web flavor — expect a recompile each run. --speculative-decoding true gave no gain:4.37 vs 4.54 tok/s decode (this build ships no draft model).) Reference: Raspberry Pi 5 (16 GB, CPU) 51/3.2/20.5 — this board matches or beats it on every column. Same shape as E2B: GPU wins prefill +1.4× and TTFT 19.6→13.9 s, but decode stays CPU-favored (4.5 vs 5.6 tk/s).

E4B vision (VL) on GPU works — cpu text + gpu vision

The stock E4B&aposs vision encoder is a separate 1477-op subgraph that fits under the panthor watchdog and inside 8 GB even though the full stock model&aposs text lane does not. Drive it via the Engine API (this repo&aposs vl_bench.py --model ...), LLM lane = CPU, vision encoder = GPU (patched panvk): the test image (resized to 912×672 → 2394 patches, near E4B&aposs max_num_patches 2520) is encoded on the Mali.

E4B VL (LLM lane = cpu) vision cpu vision gpu (patched panvk)
TTFT (s) 12.3–12.5 9.6
Decode (tok/s) 7.33–7.37 7.28–7.39
Reply (same image) "coyote walking on a dirt path" identical

Text-only CPU control: TTFT ≈ 2.0 s (7-token prompt, decode ~7.8 tok/s). Isolated vision-encode cost: ~10.4 s CPU vs ~7.6 s GPU — the Mali cuts E4B vision latency by ~2.9 s/image (~27%). No watchdog hits, no OOM (peaks well below ceiling; vision weights are a fraction of a GB). Same conclusion as E2B: for vision work keep the LLM on CPU and let the GPU run the encoder.

# 1. SET ENVIRONMENT FOR GPU VISION DELEGATE
  export LITERT_VISION_DELEGATE=gpu

  # 2. RUN VL HARNESS FOR STOCK GEMMA-4-E4B
~/.local/share/uv/tools/litert-lm/bin/python vl_bench.py \
    --text cpu \
    --vision gpu \
    --image \
    --iters 3 \
    --model gemma-4-E4B-it.litertlm
# Ensure directory exists and download model
mkdir -p ~/litert-lm-bench
curl -L -o ~/litert-lm-bench/gemma-4-E4B-it-web.litertlm \
  https://huggingface.co/litert-community/gemma-4-E4B-it-litert-lm/resolve/main/gemma-4-E4B-it-web.litertlm

# Execute benchmark with standard LiteRT-LM flags
litert-lm benchmark ~/litert-lm-bench/gemma-4-E4B-it-web.litertlm \
  --backend=gpu \
  -p 1024 \
  -d 256 \
  --runs 2

Results: VL (vision) path

The benchmark sub-command only benches the text path. To time the vision encoder, drive the same engine via the Python API (vl_bench.py in this directory) — it loads the model, streams a real image (test_multi.jpg, httpbin.org/image/jpeg) + text through vision_backend=cpu|gpu and prints TTFT (vision encode + prefill + first token), per-chunk decode rate, and the reply. One sentence prompt, 13-token answer, ~290-token total prefill (280 vision + text), generations deterministic (temperature=0). Medians over 3+ runs after compile:

Combo (text / vision) VL TTFT (s) Decode (tok/s) Reply matches CPU?
cpu / cpu 8.93–9.40 17.4 baseline
cpu / gpu (patched panvk) 6.16–6.62 17.2 yes, identical
gpu / gpu (patched panvk) 5.62–6.16 9.8 yes, identical

Text-only controls (7-token prompt): CPU TTFT ≈ 0.8 s, GPU TTFT ≈ 0.57 s.

Isolating the vision cost (VL TTFT − text-only TTFT for the same text backend): ~8.1 s on a CPU vision encoder vs ~5.4 s GPU — the Mali GPU cuts vision-encoder latency by ~2.7–3 s per image (~30%), and the full-GPU combo is ~37% faster end-to-end (5.6 vs 8.9 s). The patched panvk covers the model&aposs separate VISION_ENCODER subgraph too (no extra Dawn limits tripped).

Caveat: for short generations (< ~20 tokens) GPU decode is slower than CPU (9.8 vs 17.4 tok/s) — per-iteration GPU sync overhead — so for chatty/VL replies the CPU text lane with GPU vision is often the best mix (6.2 s TTFT, CPU-fast decode).

Benchmarking the VL path yourself

# 1. FETCH SAMPLE TEST IMAGE
  curl -sL -o ~/litert-lm-bench/test_multi.jpg https://httpbin.org/image/jpeg

  # 2. SET PYTHON INTERPRETER PATH
  VL_PY=~/.local/share/uv/tools/litert-lm/bin/python

  # 3. BASELINE: TEXT (CPU) + VISION (CPU)
  $VL_PY ~/litert-lm-bench/vl_bench.py --text cpu --vision cpu --image --iters 3

  # 4. HYBRID: TEXT (CPU) + VISION (GPU) — EXPORT PANVK MESA ENVS FIRST
  export BUILD=~/litert-lm-bench/mesa-26.1.2/build-panvk
  export VK_ICD_FILENAMES="$BUILD/src/panfrost/vulkan/panfrost_devenv_icd.aarch64.json"
  export LD_LIBRARY_PATH="$BUILD/src/panfrost/vulkan:$HOME/litert-lm-bench/prebuilt_v0171"

  $VL_PY ~/litert-lm-bench/vl_bench.py --text cpu --vision gpu --image --iters 3

  # 5. FULL ACCELERATION: TEXT (GPU) + VISION (GPU)
  $VL_PY ~/litert-lm-bench/vl_bench.py --text gpu --vision gpu --image --iters 3

  # 6. TEXT-ONLY CONTROLS (ISOLATE VISION-ENCODER COST)
  $VL_PY ~/litert-lm-bench/vl_bench.py --text cpu --iters 3
  $VL_PY ~/litert-lm-bench/vl_bench.py --text gpu --iters 3

Prints per-iteration TTFT / decode tok/s / reply. Run cases sequentially — parallel GPU runs contend for the Mali GPU and inflate the numbers (observed 2× TTFT when two ran at once).

6. Inference

# 1. DIRECT CLI EVALUATION 
  litert-lm run ~/litert-lm-bench/gemma-4-E2B-it.litertlm \
    --cache disk --prompt "What is the capital of France?"

  # 2. INTERACTIVE REPL MODE
  litert-lm run ~/litert-lm-bench/gemma-4-E2B-it.litertlm

  # 3. OPENAI-COMPATIBLE API SERVER
  litert-lm serve ~/litert-lm-bench/gemma-4-E2B-it.litertlm

Vision (and audio) input uses run with attachments — one per --attachment, placed before the first user text (images and audio can be mixed):

litert-lm run ~/litert-lm-bench/gemma-4-E2B-it.litertlm \
  --attachment ~/litert-lm-bench/test_multi.jpg \
  --prompt "What is in this image? Answer in one sentence." \
  --vision-backend cpu          
  # or gpu (patched panvk, §5) — ~2.7–3 s faster vision encode

--vision-backend/--audio-backend pick the encoder lane independently of --backend (which chooses the LLM lane). Like --backend gpu, --vision-backend gpu needs the §5 env (VK_ICD_FILENAMES + LD_LIBRARY_PATH) exported for that run.

Notes:

--cache disk persists compiled artifacts next to the model — the first GPU load compiles shaders, later loads start instantly. The load time is NOT paid on every run. Observed caches: <model>_*_mldrift_program_cache.bin (compiled kernels) and<model>_*_mldrift_weight_cache.bin (GPU-rearranged weights, ~0.8 GB). The vision encoder&aposs kernels live in the same cache files — first GPU --vision-backend gpu run compiles, later
runs reuse.

GPU (patched panvk) is ~2.8× faster at prefill and ~2.7× on TTFT, but ~30% slower at decode — pick the lane by workload (§7.4).

Vision: --vision-backend gpu cuts vision-encode latency by ~2.7–3 s per image; CPU text + GPU vision is the best blend for short/chatty replies (§5 VL results).

Speculative decoding (--speculative-decoding true) can lift decode on CPU+GPU for rewrite/summarize/coding style prompts (Gemma 4 E2B supports it).

7. GPU deep dive: the blocker and how it was unblocked here

Everything below was reproduced with LiteRT-LM v0.17.1 (CLI + litert-lm-api), Mesa 26.1.2 (trixie-backports), kernel 7.2.4-edge-rockchip64 (mainline panthor).

7.1 The panvk limit blocker — RESOLVED with a one-line local patch

LiteRT&aposs WebGPU accelerator uses Dawn, which enforces the WebGPU spec minimums against the Vulkan driver and refuses to proceed when they are unmet. Stock panvk reports:

maxImageDimension3D = 512      # WebGPU spec requires ≥ 2048

Dawn logs exactly this (PhysicalDeviceVk.cpp:794: "Insufficient Vulkan limits for maxTextureDimension3D ... must be at least 2048"), and stock panvk then dies with a null-pointer dispatch (SIGSEGV, pc=0x0) inside the WebGPU path on the first real GPU execution. The root cause is the driver limit, not packaging: the crash is identical even with the WebGPU prebuilts (libLiteRtTopKWebGpuSampler.so + friends) fetched from the litert-lm repo prebuilt/linux_arm64 @ v0.17.1 on LD_LIBRARY_PATH.

The fix (validated on this board): panvk caps 3D textures at 512 for Valhall
(PAN_ARCH <= 10), but the Mali-G610 hardware handles 2048³ — raising the advertised limit to 2048 makes Dawn accept the adapter:

-.maxImageDimension3D = PAN_ARCH <= 10 ? (1 << 9) : (1 << 14),
+.maxImageDimension3D = (1 << 11),       /* 2048 — meets WebGPU min (was 512 on arch <= 10) */

Why it&aposs safe: Dawn only validates the advertised limit against its spec minimum, and the value also caps future image allocations — so if a kernel ever genuinely requested a 2048³ 3D texture, panvk would fail cleanly at allocation instead of corrupting anything. LiteRT/ML-Drift&aposs LLM and vision-encoder kernels allocate buffers and 2D textures only, so real GPU behaviour is unchanged; Dawn simply stops rejecting the adapter, the SIGSEGV disappears, and the full benchmark runs (§5). Confirmed via vulkaninfo on the patched build: maxImageDimension3D = 2048. All other WebGPU minimums (per-stage descriptors, workgroup sizes, buffer ranges) were already comfortably met.

The build is process-scoped (VK_ICD_FILENAMES + LD_LIBRARY_PATH per run), the system Mesa is never touched, and reverting is unsetting two variables. Unless/until Mesa raises this limit upstream for Valhall, keep this build around for LiteRT-LM GPU runs.

7.2 The vendor route (Rockchip libmali) — needs a different kernel

Rockchip&aposs proprietary blob would satisfy Dawn (it exposes Vulkan 1.3 with full limits), but the blob&aposs userspace talks to Rockchip&aposs proprietary kbase kernel driver (/dev/mali) and cannot attach to the mainline panthor driver:

"libmali-valhall-g610-g13p0-gbm"      → loads, exports NO Vulkan ICD (0 vk_* symbols)
"libmali-valhall-g610-g24p0-gbm"
  libMaliVulkan.so.1 (api 1.3.276)    → loads, "No mali devices found" then SIGSEGV (no /dev/mali)

Installable packages exist (tsukumijima/libmali-rockchip releases, e.g.
v1.9-1-20260312-bd33ee2), but they all presume the vendor kernel.

Unblock: flash a vendor-kernel image (kernel with kbase/mali.ko, e.g. Armbian images with the Rockchip BSP kernel), then install
libmali-valhall-g610-g13p0-gbm (or g24p0) and point Dawn/Vulkan at it
(VK_DRIVER_FILES/LD_LIBRARY_PATH). That same blob also provides OpenCL 3.0 (libMaliOpenCL.so + /etc/OpenCL/vendors/mali.icd), which would additionally satisfy the "would OpenCL be faster?" curiosity — for running LLMs, both WebGPU/Vulkan and OpenCL on the same GPU land in the same class of throughput; the win is the mature compiler&aposs fast startup, not raw speed.

7.3 OpenCL on the current kernel — not available

Mesa&aposs rusticl on panthor currently exposes zero devices (clinfo -l shows only the rusticl platform, no device). So there is no OpenCL device at all on the mainline stack, and LiteRT-LM has no Linux OpenCL accelerator anyway.

7.4 Practical advice for this board today

  • Chat / streaming (decode-bound): CPU is the better lane — 12.3 vs 8.7 tk/s decode.
  • Long prompts / RAG / document Q&A (prefill-bound): GPU pays off — 345 vs 124 tk/s prefill,
    3.1 vs 8.4 s TTFT.

Images / VL: --vision-backend gpu cuts vision-encode latency by ~2.7–3 s (~30%). Shortest VL TTFT is text+vision both on GPU (5.6 vs 8.9 s all-CPU), but keep the LLM on CPU when replies are short and chatty (6.2 s TTFT plus CPU-fast decode).

  • --speculative-decoding true can lift decode further on both lanes (Gemma 4 E2B supports it).

Serving an OpenAI-compatible endpoint (litert-lm serve)

litert-lm serve exposes an OpenAI API on 0.0.0.0:9379, so LAN clients (LiteCode, opencode, aider, Continue, scripts) use the board like any OpenAI endpoint. Import a model once (litert-lm import ./gemma-4-E2B-it.litertlm, registry at ~/.litert-lm/models/), then litert-lm serve. Per-model settings come from ~/.litert-lm/config.json (default + models.<id>), so clients stay plain-OpenAI:

{
  "default": { "backend": "cpu", "cpu_thread_count": 8, "cache": "disk" },
  "models": { "gemma-4-E2B-it.litertlm": { "speculative_decoding": true, "max_num_tokens": 4096 } }
}

Endpoints: GET /v1/models and POST /v1/chat/completions (streaming + non-streaming). OpenAI tools / tool_choice are bridged to the model&aposs function-calling template — verified to return valid tool_calls JSON (non-streaming and streamed) and to complete the full agent cycle (assistant tool_call → tool result → final answer). /v1/embeddings exists but is not tied to LLM models.

Even though litert-lm describe reports Supports Function Call: NO for Gemma 4, the serve layer still bridges tools into the model template (empirically verified); that flag only means the CLI&aposs interactive run has no native FC template.

RAM budget (E2B, CPU): max_num_tokens preallocates KV/ringbuffer arenas up front.Measured process RSS: 4096 → ~3.1 GB (4.9 GB free — recommended), 8192 → ~7 GB (1.1 GB free — works but leaves no headroom). Keep 4096 and let clients budget. Config keys (0.15+): backend, vision_backend, audio_backend, cpu_thread_count, cache,
max_num_tokens, speculative_decoding, thinking, thinking_budget,
gpu_decode_steps_per_sync, sampling. CLI flags override config. For a persistent border, run under systemd.

Verified client on this board

LiteCode (razvanneculai/litecode) — works end-to-end. Its Planner
({"synthesis","tasks"} strict JSON) and Executor (raw file content, no fences) prompts fit the 4096 budget; single-request task runs completed correctly and files linter-clean.
litecode.json:

{
  "provider": { "baseURL": "http://<yourIP>:9379/v1", "apiKey": "", "model": "gemma-4-E2B-it.litertlm" },
  "tokenLimit": 4096, "reservedOutputTokens": 1500, "systemPromptBudget": 1000, "maxParallelExecutors": 1
}

Troubleshooting

FATAL ERROR: This binary was compiled with dotprod enabled... → CPU lacks FEAT_DotProd, not supported by the ARM64 prebuilt wheels. RK3588 has it.

GPU benchmark errors but CPU works → with stock Mesa this is the §7.1 Dawn limit crash (maxImageDimension3D = 512); with the patched build, check vulkaninfo --summary again — panvk must list the Mali device and report maxImageDimension3D = 2048. ExportVK_ICD_FILENAMES+LD_LIBRARY_PATH for every run that should use the patched driver.

Could not load shared library libLiteRtTopKWebGpuSampler.so → the CLI wheel does not bundle the WebGPU samplers; fetch them from the litert-lm repo prebuilt/linux_arm64/ at the matching version tag (e.g. v0.17.1) and export their directory on LD_LIBRARY_PATH.

First GPU run is slow (one-time kernel compilation) — normal; use --cache disk so later loads skip it. Caches persist next to the model.

Bigger models (e.g. stock gemma-4-E4B-it.litertlm, 3.66 GB) fail on the GPU even with the patched driver: panthor ... job timeout in dmesg (fixed 1 s driver watchdog, not tunable; the model has a one-shot dispatch that exceeds it even at the real 1 GHz boost) theVK_ERROR_DEVICE_LOST, and/or a global OOM-kill (EXIT=137) when pinned GPU buffers + the model outgrow 8 GB. E2B fits, E4B-stock doesn&apost. Use the text-only -web flavor (gemma-4-E4B-it-web.litertlm, 2.97 GB) for E4B-on-GPU — its finer kernels stay under the watchdog and its GPU set peaks ~4.3 GB (§5 E4B section).

Join the conversation on the Armbian Forum and let us know how it runs on your hardware!

30 September, 2026 03:24PM by Michael Robinson

hackergotchi for GreenboneOS

GreenboneOS

CVE-2026-5430: Full Account Takeover in WSO2 API Management Products Now Actively Exploited

CVE-2026-5430 (CVSS 10), published August 6th, 2026, is a critical authentication bypass in WSO2 JSON Web Token (JWT) authentication affecting multiple WSO2 API management products. The flaw allows a token signed with an unsupported algorithm to bypass JWT authentication. Exploitation allows unauthorized access, compromise of administrative accounts, and full account takeover. Although the CVE was […]

30 September, 2026 10:07AM by Joseph Lee

hackergotchi for Tails

Tails

Tails 7.14

Changes and updates

  • Update Tor Browser to 15.0.24.

  • Update the Tor client to 0.4.9.13.

  • Update the Linux kernel to 6.12.111.

Fixed problems

  • Fix the default keyboard input method when starting a session in Korean. (#21779)

Get Tails 7.14

To upgrade your Tails USB stick and keep your Persistent Storage

  • Automatic upgrades are available from Tails 7.0 or later to 7.14.

  • If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade.

To install Tails 7.14 on a new USB stick

Follow our installation instructions.

The Persistent Storage on the USB stick will be lost if you install instead of upgrading.

To download only

If you don't need installation or upgrade instructions, you can download Tails 7.14 directly:

30 September, 2026 12:00AM

September 29, 2026

hackergotchi for GreenboneOS

GreenboneOS

New Distributor Partnership: CoreWin Brings OPENVAS to Ukraine and the Region

Greenbone is pleased to announce CoreWin as a new distribution partner. As a Ukraine-based value-added software distributor, CoreWin is well-positioned to make OPENVAS available in Ukraine, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Moldova, and Uzbekistan. Why Our CoreWin Partnership Matters Organizations across these regions, in both the public and private sectors, depend on reliable cyber security […]

29 September, 2026 09:50AM by Greenbone AG

September 28, 2026

hackergotchi for ARMBIAN

ARMBIAN

Github Highlights

Github Highlights

This week&aposs work centers on Rockchip platform maturation, kernel and toolchain modernization, and board-level enablement across vendors.

Rockchip received the largest share of attention, with RK3528 gaining a thermal driver, cooling-map refinements, and cleanup of legacy PCIe and pmdomain workarounds. The Radxa E24C now stores its U-Boot environment in SPI flash and reads switch port MAC addresses from EEPROM, while device trees for the Mixtile Blade 3, Core3588E, and Edge 2 were corrected. New board support was added for the Boardcon SBC3568, and the Rock 5T now ships an edge kernel. On the configuration side, hyphenated LINUXFAMILY handling was fixed in both the kernel selector and firmware remap logic for the rk35xx family.

Kernel and build infrastructure saw significant modernization. Mainline advanced to 7.3-rc5, several C23 build errors were resolved for D1 ATF, OpenSBI, and libbpf, and the default FRAME_WARN was restored on 64-bit configs. Deprecated patch directories for imx6 and the RK BSP 5.10 legacy kernel were retired, parallel patch queueing was optimized, and kernel-debs postinst ordering was hardened for DKMS safety. CI switched to remote ccache only, and ATF builds now honor USE_CCACHE correctly.

Board-level enablement spanned multiple vendors. ODROID-HC4 gained PCIe suspend, Wake-on-LAN, and RTC alarm support, along with a usable SPI NOR and SD card power-down. ODROID-XU4 was bumped from 6.15 to 7.2 on edge, the Amlogic C400 Plus received SD-boot and Wi-Fi profile fixes, and the Raspberry Pi 4B added support for Waveshare and Raspberry touchscreen v2 panels. The MorseMicro DKMS project also matured substantially with split MM6108/MM8108 packages, Linux 7.1 API compatibility, and initial NetworkManager udev integration.

#Armbian #EmbeddedLinux #Rockchip #Kernel #SBC

Changes

28 September, 2026 02:26PM by Michael Robinson

hackergotchi for GreenboneOS

GreenboneOS

CVE-2026-7273: Zyxel GS1900 Switches Actively Exploited Globally

CVE-2026-7273 (CVSS 8.8, EPSS 1.286% (69th)), published in mid-June 2026, is a stack-based buffer overflow that allows unauthenticated remote code execution (RCE) on Zyxel GS1900 series switches. The flaw is in the device’s firmware CGI program and can be triggered via crafted HTTP request. As of September 21st, 2026, CVE-2026-7273 is considered actively exploited and […]

28 September, 2026 11:23AM by Joseph Lee

hackergotchi for Volumio

Volumio

DSD versus PCM for Better Digital Listening

A favorite album can arrive in several digital forms, and the labels can feel more consequential than they are. In the discussion of DSD versus PCM, there is no universally superior format waiting to transform every system. There are different technical approaches, different playback requirements, and, most importantly, different recordings and masterings behind the files.

The useful question is not simply, “Which has more numbers on the spec sheet?” It is: which version of this music was prepared with care, and can your player, DAC, and system reproduce it as intended? Once those pieces are in place, both PCM and DSD can deliver deeply involving listening.

DSD versus PCM: two ways to represent music

PCM, or Pulse Code Modulation, represents an audio waveform by measuring its level at regular intervals. Each measurement is assigned a numerical value. The two specifications most listeners encounter are sample rate and bit depth: CD-quality PCM is 16-bit/44.1 kHz, while high-resolution releases may be 24-bit/96 kHz, 24-bit/192 kHz, or higher.

This is the foundation of digital audio as most people know it. PCM is used for CD, downloads, streaming, studio recording, editing, and mixing. It is mature, widely compatible, and exceptionally capable. A well-mastered 16-bit/44.1 kHz file can sound superb, while higher sample rates and bit depths can offer practical advantages during recording and production.

DSD, short for Direct Stream Digital, takes a very different route. Rather than storing multi-bit samples at a comparatively lower rate, it uses a one-bit stream sampled at an extremely high frequency. Standard DSD, often called DSD64, runs at 2.8224 MHz. DSD128 doubles that rate, and DSD256 doubles it again.

Because a one-bit signal has limited instantaneous resolution, DSD uses noise shaping. It moves much of its quantization noise out of the audible band and into ultrasonic frequencies. A DSD-capable DAC then uses filtering to remove that ultrasonic noise before the signal reaches your amplifier.

Neither approach is a simple shorthand for sound quality. PCM and DSD use different engineering compromises to preserve the musical signal. Their specifications cannot be compared line for line, so DSD64 is not directly equivalent to a particular PCM sample rate just because both are described as high resolution.

Why the format alone does not decide the sound

The mastering is usually the decisive factor. If a DSD download was made from an excellent analog tape transfer and a PCM version came from a compressed, heavily limited remaster, the DSD release may sound more open, relaxed, or natural. But that does not prove DSD is inherently better. It may simply be the better master.

The reverse happens often enough to matter. Many DSD releases originate from a PCM recording, mixing, or mastering chain. That is not automatically a problem. Modern PCM production can be transparent and highly precise. Still, converting a PCM master to DSD at the final stage does not restore information that was not present in the original recording.

For this reason, compare editions rather than formats in the abstract. Look for the release date, mastering engineer, recording provenance, and source notes when they are available. A carefully transferred DSD64 album can be more satisfying than a poorly handled DSD256 release. A thoughtful 24-bit/96 kHz PCM master can be every bit as compelling as an outstanding DSD file.

Your DAC also has a voice in the result. Some DACs process DSD natively, while others convert it internally to PCM. Some offer a direct DSD path that minimizes processing, and some use filter choices that subtly change the presentation. PCM playback has its own variables, including reconstruction filters, oversampling, and clocking. These design choices can be more audible than the format label on the file.

The practical case for PCM

PCM is the format of convenience without being a compromise in musical potential. It is supported by nearly every playback device, music service, recording application, and DAC. If your library combines CD rips, downloads, live recordings, and streaming favorites, PCM provides the broadest path to playing everything without friction.

It is also the natural format for music production. Editing, equalization, level adjustment, room correction, and digital volume control are generally performed in PCM. That flexibility matters if you use DSP in your system, whether for headphone equalization, subwoofer integration, or room correction.

PCM files can also be more storage-efficient than equivalent DSD releases. A 24-bit/96 kHz FLAC file preserves PCM audio without loss while taking less space than many DSD files. For a large personal library, that difference can become meaningful, especially when backups are part of the plan.

None of this means PCM has to sound clinical or merely practical. The best PCM playback is spacious, tonally complete, and remarkably faithful to the character of a recording. Its ubiquity comes from reliability and versatility, not from a lack of refinement.

When DSD makes sense

DSD is especially appealing when you have access to recordings created or transferred thoughtfully in DSD and a DAC designed to handle it well. Classical, jazz, acoustic, and archival recordings are common places to encounter carefully produced DSD releases, partly because subtle ambience, instrumental tone, and dynamic gradation are priorities for listeners and labels alike.

Some listeners describe excellent DSD playback as fluid, continuous, or unusually relaxed. Those impressions are valid personal responses, but they should not be treated as universal properties. Another listener may prefer the focus, immediacy, or tonal balance of a different PCM master through the same system.

DSD also asks a little more from the playback chain. Native DSD support varies by operating system, network player, USB driver, and DAC. Some systems send DSD as DoP, or DSD over PCM, which packages the DSD data for transport without converting the audio itself to PCM. Other systems can send native DSD. Both can work very well when properly implemented, but compatibility should be confirmed rather than assumed.

Higher-rate DSD files demand more from storage and network bandwidth, too. That is rarely an obstacle on a well-configured home network, yet it is worth considering if you maintain a large library or stream files to multiple rooms.

Choose the playback path before chasing formats

A capable music player should make format handling feel secondary to the listening experience. It should organize your library, identify the file type, send the signal appropriately to a compatible DAC, and keep your focus on the album rather than the file extension.

With a platform such as Volumio, the important setup question is whether your connected DAC supports DSD and which transport method it expects. In settings, avoid converting formats unnecessarily unless your DAC requires it or you are intentionally using DSP. If native DSD playback is available, test it with a familiar recording. If PCM conversion is required, do not assume you are losing the essence of the music before you listen.

There are a few practical checks worth making before buying a DSD-heavy library. Confirm the maximum DSD rate your DAC accepts. Check whether it supports native DSD, DoP, or both. Make sure your chosen output connection supports the rate you intend to play, since USB, network playback, and some digital connections have different capabilities. Finally, consider whether you use DSP, because it may mean DSD is converted to PCM for processing.

That last point is not a failure of the system. DSP can produce far larger audible improvements than changing file formats, particularly in a room with bass problems or poorly integrated speakers. A well-executed room correction profile and a great PCM master may bring you closer to the performance you want than a format change ever could.

A better way to build a high-resolution library

Treat DSD as a valuable option, not a collecting contest. Buy or keep DSD releases when they offer a preferred master, a recording you love, or a direct transfer with convincing provenance. Choose PCM when it is the best available edition, when you need broad compatibility, or when your system uses digital processing.

For an honest comparison, level-match as closely as possible and listen to complete passages, not just a few dramatic seconds. Use music whose phrasing, room ambience, vocals, and instrumental textures you know well. If two versions are from different masters, recognize that you are comparing production decisions as much as formats.

The file that earns a place in your library is the one that makes you stay for the next track. Let your ears, your system, and the quality of the mastering lead the decision.

The post DSD versus PCM for Better Digital Listening appeared first on Volumio.

28 September, 2026 02:33AM

September 27, 2026

hackergotchi for Qubes

Qubes

Qubes OS Summit 2026: Freedom of the Press Foundation and NovaCustom sponsorships; conference schedule available!

We’re proud to announce two new Qubes OS Summit 2026 sponsorships: Freedom of the Press Foundation (FPF) as a Gold-tier sponsor and NovaCustom as a Silver-tier sponsor!

Freedom of the Press Foundation logo

The FPF is a long-standing Qubes Partner. As a nonprofit organization, it is dedicated to supporting and defending public interest journalism. It leads the development of SecureDrop, an open-source whistleblower submission platform used by more than 50 media organizations around the world to securely accept documents from anonymous sources. FPF uses Qubes OS in the development of an integrated SecureDrop Workstation.

NovaCustom logo

NovaCustom builds custom laptops, mini PCs, and smartphones with a focus on privacy, security, and customization. They offer the freedom of Dasharo coreboot firmware, true repairability, and a plethora of customization options. Several NovaCustom models are officially certified for Qubes OS.

Conference schedule

We’re also pleased to share the official conference schedule, including a list of sessions and speakers, which you can find here:

https://pretalx.com/qubes-os-summit-2026/schedule/

(Please note that we’re still waiting on a few speakers to confirm their attendance, so this schedule is subject to change.)

On-site tickets are nearly halfway sold out, so if you’d like to join us in person, we recommend getting your tickets soon! See below for details.

When and where

Friday, October 30 @ 9:30 AM — Sunday, November 1 @ 3:00 PM (GMT+1)

Refugio Berlin
Lenaustraße 3-4
12047 Berlin
View on OpenStreetMap

Attend in person or online

There are three ways to attend the Summit:

  1. In person at Refugio Berlin
    • Requires a paid on-site ticket
    • Grants access to the hackathon (including interactive workshops) and any design sessions (depending on conference schedule)
    • Provides the opportunity to socialize, network, and mingle with like-minded individuals who are passionate about secure computing
    • Grants exclusive access to any non-livestreamed, non-recorded presentations (see below)
    • Grants access to attend presentations and participate as a live audience member
  2. Actively participate online
    • Requires a free virtual ticket
    • For those who are presenting remotely
    • For those who are attending presentations remotely and wish to ask questions or engage in active discussion in a live chat during the presentations
    • Does not grant access to the hackathon or any design sessions
    • Does not provide the opportunity to socialize, network, or mingle with like-minded individuals who are passionate about secure computing
    • Does not grant access to any non-livestreamed, non-recorded presentations (see below)
    • Does not grant access to attend presentations as a live audience member
  3. Passively view online
    • No ticket or registration required
    • For those who simply wish to watch the presentations via the public livestream and recorded videos
    • Does not provide the ability to ask questions or engage in active discussion during the presentations
    • Does not grant access to the hackathon or any design sessions
    • Does not provide the opportunity to socialize, network, or mingle with like-minded individuals who are passionate about secure computing
    • Does not grant access to any non-livestreamed, non-recorded presentations (see below)
    • Does not grant access to attend presentations as a live audience member

Note: As mentioned above, presenters have the option to request that their presentations not be recorded. If a presenter opts out of recording, there will be a “no recording” icon next to that presentation in the conference schedule. Only on-site attendees will be able to view that presentation. It will not be livestreamed or recorded for later viewing.

Become a sponsor

If you or your organization are interested in sponsoring Qubes OS Summit 2026 or becoming a Qubes Partner, please contact us at funding@qubes-os.org.

Code of conduct

This event is covered by the Qubes OS Project’s code of conduct.

27 September, 2026 12:00AM

September 26, 2026

hackergotchi for Volumio

Volumio

Hi Fi Streamer Buying Guide for Better Sound

A great hi fi streamer buying guide should begin with a simple truth: the right streamer does more than put a streaming app on your stereo. It becomes the place where your favorite albums, saved discoveries, radio stations, and carefully ripped files meet the system you already love. Choose well, and playing music becomes more immediate, more organized, and far less dependent on a phone’s tiny speaker-first interface.

The challenge is that streamers can look similar on a spec sheet while serving very different systems. Some are digital transports designed to feed an existing DAC. Others combine streaming and digital-to-analog conversion in one component. Some prioritize a large color display; others disappear into a rack and put control entirely in an app. The best choice is not necessarily the one with the longest feature list. It is the one that fits your listening habits, connections, and plans for the system.

Start With Your Listening Life

Before comparing formats or outputs, consider where your music actually lives. If you move between Qobuz, TIDAL, Spotify, internet radio, and a personal library, look for a player that brings those sources together in one clear interface. Constantly switching apps breaks the connection between choosing music and enjoying it.

Your local collection deserves equal attention. A capable streamer should make it practical to browse a network-attached drive, USB storage, or a computer-based library by artist, album, composer, genre, and resolution. If you own a substantial collection of CD rips or high-resolution downloads, library handling may matter more than another headline specification.

Also think about who uses the system. A dedicated screen and physical controls can be valuable in a shared living room. For listeners who prefer the listening chair and a tablet, a well-designed control app may be the better experience. Neither approach is inherently more audiophile. The point is to make choosing music feel natural enough that you do it more often.

Hi Fi Streamer Buying Guide: Transport or Built-In DAC?

This is the decision that shapes the rest of your purchase. A network transport receives and organizes digital music, then sends a digital signal to an external DAC. A streamer with a built-in DAC performs both jobs and usually connects directly to an integrated amplifier, preamplifier, or powered speakers.

Choose a transport if you already own a DAC whose sound and inputs you enjoy. It lets you preserve a valued part of your system while improving the streaming experience. It also offers a clear upgrade path: change the DAC later without replacing the streaming section. This route is especially sensible when your DAC has an excellent coaxial, optical, AES/EBU, or USB input.

Choose a streamer with an integrated DAC when you want fewer boxes, fewer cables, and a more direct path to music. A thoughtfully matched streaming DAC can be an elegant answer for an integrated amplifier with analog inputs, a minimalist system, or a second listening room. The trade-off is flexibility. If you later want a different DAC presentation or new digital input options, you may be replacing more of the chain.

Do not assume an external DAC is automatically superior. Implementation matters: power supply design, output stage, clocking, isolation, software integration, and the quality of the analog section all affect the final result. More importantly, the component must work well with the equipment around it.

Check Connections Before You Fall for Features

Make a short inventory of the inputs on your amplifier, preamplifier, DAC, and active speakers. Then choose a streamer that connects cleanly without adapters or compromises.

For digital transport use, coaxial S/PDIF is common and often preferred for its secure connection and broad DAC compatibility. Optical can be useful where electrical isolation is a priority, although its supported resolution may vary by component. AES/EBU is a professional-style balanced digital connection found on some higher-end DACs. USB can support high-resolution playback and is widely used, but its performance and reliability depend on both devices and cable setup.

For an integrated DAC streamer, look for balanced XLR outputs if your amplifier supports them and your system benefits from a balanced connection. RCA outputs remain entirely appropriate for many systems. If the streamer will feed powered speakers, confirm that it offers proper volume control and that the output level can be configured safely.

Network connection deserves the same care. Ethernet is usually the most dependable choice for a fixed hi-fi system, particularly with high-resolution files or a busy home network. Wi-Fi offers welcome placement freedom and can work very well when signal strength is strong. If your listening room has inconsistent coverage, solve that issue before blaming the streamer.

Sound Quality Is More Than File Resolution

It is easy to get distracted by maximum sample rates and format badges. High-resolution support is useful, but it is only one part of satisfying digital playback. A streamer should deliver a stable signal, low noise, confident dynamics, and a sense that instruments occupy believable space. It should also make ordinary CD-quality albums compelling, because much of the music people love is recorded at that resolution or below.

Pay attention to power. A well-designed internal supply can be excellent, while an external linear power supply may be a meaningful upgrade for some components and systems. The right answer depends on the streamer’s design, your system’s resolving ability, and whether you value a simpler installation over another chassis and cable. Treat power upgrades as system tuning, not a mandatory first purchase.

The analog stage matters greatly when the streamer includes a DAC. Its output circuitry influences tonal balance, drive, texture, and how comfortably the component works with long cables or particular preamp inputs. Reading specifications can narrow the field, but listening in your own system remains the best test when possible.

Choose Software You Will Still Enjoy Next Year

A streamer is both an audio component and a software product. Hardware may sit unchanged for years, but music services evolve, libraries grow, and your habits shift. That makes the control experience a core part of sound ownership, not an afterthought.

Look for a platform with active development, dependable updates, and support for the services you use today. Check whether it can search across your library and streaming subscriptions, handle favorites and playlists clearly, and preserve useful metadata. Album artwork, credits, composer sorting, and radio recommendations may seem secondary until they are the reason you rediscover music you had forgotten.

Compatibility should be specific, not assumed. Verify the exact streaming services, playback protocols, voice-control options, and multiroom capabilities that matter in your home. If you use a separate music-management platform, confirm the intended integration rather than relying on a similarly named feature. A streamer that is perfect on paper but interrupts your preferred listening routine will not feel like an upgrade.

For builders, software can also determine whether a DIY project remains enjoyable after the first successful boot. Volumio offers a route from accessible Raspberry Pi and PC-based players to dedicated hi-fi components, with one familiar music environment across both approaches. That continuity can be valuable when a first system later becomes a second-room player or a more ambitious project.

Size Your Budget Around the Whole System

A streamer should be proportionate to the rest of the chain. In a modest system, ease of use, reliable service support, and a clean analog or digital connection may create a larger improvement than pursuing exotic specifications. In a revealing system, output stage quality, isolation, power design, and DAC pairing become more audible and worth closer consideration.

Remember the small costs as well. You may need a better-quality Ethernet cable of the correct length, an additional digital interconnect, storage for a local library, or a network upgrade. None of these needs to be extravagant, but planning them avoids an incomplete setup on day one.

Resist buying for a hypothetical system five years away. A flexible transport can make sense if an external DAC is clearly in your future. Otherwise, buy for the music, equipment, and room you have now. The most satisfying purchase is one that removes friction immediately and leaves room for thoughtful changes later.

A Sensible Way to Audition

When you can audition a streamer, use music you know deeply rather than demonstration tracks alone. Play a dense recording, a sparse vocal, an acoustic instrument with natural decay, and something rhythmically demanding. Notice whether you keep analyzing the equipment or simply want to hear the next song.

Compare at matched volume levels, use the same DAC where possible, and give the interface a real test. Search for an album, queue a playlist, move from a streaming favorite to a local file, and hand the controls to someone else in your household. The best streamer should make those ordinary moments feel considered rather than technical.

Your final choice should invite a better ritual: sit down, find the record you meant to revisit, and let the system disappear long enough for the music to take over.

The post Hi Fi Streamer Buying Guide for Better Sound appeared first on Volumio.

26 September, 2026 02:40AM

September 24, 2026

hackergotchi for GreenboneOS

GreenboneOS

CVE-2026-48842: Unauthenticated SQL Injection Flaw in Roundcube Webmail Now Targeted

Overview of CVE-2026-48842, the unauthenticated SQL injection flaw in Roundcube Webmail, shown with its CVSS severity band and EPSS exploitation-probability score CVE-2026-48842 CVSS 8.1 · High EPSS 0.8% (54th) CVE-2026-48842 (CVSS 8.1, EPSS ≥ 54th pctl), published in May 2026, is an unauthenticated SQL injection flaw in Roundcube Webmail. Vulnerable instances warrant prompt attention due […]

24 September, 2026 12:08PM by Joseph Lee

hackergotchi for Deepin

Deepin

AiPy 上架 deepin 应用商店:你说需求,TA 来执行

Sorry, this entry is only available in 中文.

24 September, 2026 11:16AM by xiaofei

(中文) 小U同学更新:操作更少,秒回更快

Sorry, this entry is only available in 中文.

24 September, 2026 11:04AM by xiaofei

From XDG Standards to Global Co-Building: Linyaps Welcomes Its First Overseas Open-Source Contribution

Following its recognition by XDG standards, Linyaps has achieved another breakthrough in its internationalization efforts: the flutter-linglong-store community edition project recently welcomed an important contribution from its first overseas developer.   Developer alvarosamudio from the Spanish-speaking community submitted complete Spanish localization support for the Linyaps Store community edition. The PR covers all interfaces including app navigation, package management workflows, download queues, environment detection, and accessibility assistance, involving as many as 495 translation keys. All translations were completed one by one against the Chinese template, achieving high-quality delivery with no omissions or gaps. This contribution is not just an expansion in language dimensions—it marks ...Read more

24 September, 2026 10:02AM by Chen, Rong

hackergotchi for ZEVENET

ZEVENET

SKUDONET Enterprise Edition 10.2.2: Last Hop, a New WebGUI and More Control Over Application Delivery

SKUDONET Enterprise Edition 10.2.2 is now available, bringing new capabilities that give infrastructure teams more control over network paths, HTTP traffic and day-to-day ADC operations.

The release adds Last Hop support powered by eBPF, dynamic redirects for HTTP and HTTP/2 Farms, configurable backend Cookie values and a refreshed WebGUI, alongside performance, logging and reliability improvements across the platform.

What’s New in SKUDONET Enterprise Edition 10.2.2?

The main additions include:

  • Last Hop support for HTTP and HTTP/2 Farms
  • Dynamic redirects using regular expression capture groups
  • Configurable Cookie values for HTTP and HTTP/2 backends
  • A refreshed WebGUI
  • Improved HTTP and HTTP/2 error logging
  • CGI concurrency control and systemd integration
  • Internal performance optimizations
  • Fixes affecting SNI, L4xNAT, redirects and certificate renewal

Let’s look at the main changes in more detail.

Last Hop: More Control Over Asymmetric Routing

One of the most significant additions in Enterprise Edition 10.2.2 is Last Hop support for HTTP and HTTP/2 Farms.

In infrastructures with multiple routers, VLANs, stateful firewalls or redundant network paths, the route selected for a response can differ from the path through which the original connection reached the ADC.

From a routing perspective, both paths may be valid. From an application delivery perspective, however, this can introduce asymmetric routing which may result in stateful firewall sessions failing, inconsistent NAT behavior, dropped connections or security policies being applied differently depending on the traffic path.

SKUDONET Last Hop addresses this by using eBPF to dynamically learn the relevant Layer 2 path through which a connection reaches the ADC. Linux continues to perform its normal routing decision, while SKUDONET uses the learned information to preserve the appropriate return path when required.

This becomes especially relevant in multi-network environments and in architectures where a backend server can also act as a client of another load-balanced Virtual IP.

We’ve covered the architecture, eBPF implementation and asymmetric routing scenarios in much greater detail in our technical article: How SKUDONET Last Hop solves asymmetric routing with dynamic eBPF Layer 2 learning.

Dynamic Redirects for HTTP and HTTP/2 Farms

Application migrations and URL restructurings often involve large numbers of redirects, and managing every rule individually quickly becomes difficult when many URLs follow the same pattern.

Enterprise Edition 10.2.2 introduces dynamic redirects that can reuse regular expression capture groups. For example, instead of maintaining separate rules for URLs such as:

/old/products/100
/old/products/200
/old/products/300

a regular expression can capture the variable part of the URL and reuse it in the redirect destination:

/old/products/(.*) → /new/products/$1

This makes it possible to handle multiple related redirects with a single rule, simplifying configuration during website migrations, application reorganizations or URL normalization projects.

Configurable Cookie Values for Backend Persistence

Session persistence is essential when an application needs requests from the same user to keep reaching the same backend.

Enterprise Edition 10.2.2 adds the ability to configure the Cookie value associated with HTTP and HTTP/2 backends, giving more control over persistence behavior and allowing compatible services to use consistent backend cookie values when required, particularly useful when several services need to coordinate session affinity.

This type of session persistence allows persistence data to be shared across different farms and services. 

A Refreshed WebGUI for Day-to-Day Management

Enterprise Edition 10.2.2 also introduces an updated visual appearance for the SKUDONET WebGUI.

Managing an ADC involves much more than creating a load balancing service. Administrators regularly work with Farms, backends, certificates, networking configuration, security policies, monitoring and troubleshooting information. The refreshed WebGUI modernizes the visual experience while maintaining centralized access to the configuration and monitoring capabilities required to operate SKUDONET environments.

SKUDONET Enterprise Edition 10.2.2

Better WebGUI Resource Management

The release also introduces CGI concurrency control, which limits the number of simultaneous CGI requests handled by the WebGUI to help manage resource consumption during concurrent administration operations. WebGUI process management has also been integrated with systemd, aligning it more closely with standard Linux service management.

More Detailed HTTP and HTTP/2 Troubleshooting

Enterprise Edition 10.2.2 introduces more detailed error logs when reading client and backend headers in HTTP and HTTP/2 Farms, giving administrators more context when investigating malformed requests, backend communication problems or unexpected HTTP behavior.

Traffic Handling Performance Improvements

This release also includes internal performance optimizations that improve traffic handling efficiency. These changes apply automatically and don’t require administrators to modify existing Farm configurations.

Reliability and Bug Fixes in Enterprise Edition 10.2.2

Alongside the new functionality, this release addresses several issues affecting HTTP/2, L4xNAT, redirects and SSL certificate management.

SNI Matching Is Now Case-Insensitive in HTTP/2 Farms

SNI hostname matching in HTTP/2 Farms now ignores letter case, in accordance with RFC 6125. This prevents capitalization differences in hostnames from producing unexpected matching behavior.

Improved Maintenance Handling for L4xNAT Backends

The release corrects status handling when maintenance actions are applied to L4xNAT backends that are already marked as down, making backend state management more consistent during maintenance operations.

Correct Handling of Special Characters in Redirect URLs

Literal redirect destinations in HTTP and HTTP/2 Farms are now treated as exact strings, so special characters configured within the redirect destination are preserved as expected. This also provides clearer behavior between literal redirect destinations and the new regular-expression-based dynamic redirects.

Automatic WebGUI Certificate Updates After Let’s Encrypt Renewal

When a Let’s Encrypt certificate used by the management interface is renewed, the WebGUI now applies the updated certificate automatically, removing a manual step from certificate lifecycle management.

Upgrade to SKUDONET Enterprise Edition 10.2.2

SKUDONET Enterprise Edition 10.2.2 is now available for Enterprise Edition environments with access to current software updates.

Contact our team for more information.

24 September, 2026 08:00AM by Isabel Perez

hackergotchi for Univention Corporate Server

Univention Corporate Server

Guardian in Transition: Why We Are Switching to Cerbos

Over the past few years, we have built Guardian step by step and reported on the concept and initial results in our blog posts from 2023 and 2024. Guardian is the component in Nubus that answers a central question: Is this person allowed to perform this action?
Today, we would like to share openly what we have learned in the meantime—and what consequences we are drawing from it.

What we originally built—and why it was too much

The previous implementation was based on the Open Policy Agent and was developed entirely in-house: it included a custom management interface, rules written in the niche language Rego, and a database for storing them. For this reason, the UDM extension for role-based administration, available as a preview, was also implemented without integration with Guardian. During integration—particularly with the Univention Directory Manager—it became clear that the maintenance effort was disproportionately high and that the conceptual model did not fit well with a dynamically extensible system such as UDM.

Many of the problems were not simply implementation gaps but fundamental issues. To resolve them properly, we would have had to rebuild large parts of the system anyway.

A lean restart with Cerbos

Guardian, the authorization service for Nubus, now uses the open source project Cerbos as its policy decision backend, replacing the previous OPA-based implementation. Cerbos was selected specifically because it offers features well suited to the kind of authorization decisions Guardian needs to make. Univention will publish a dedicated blog post shortly explaining the reasoning behind this decision in more detail.

Alongside the new backend, the Guardian authorization service itself has changed how it is delivered: it is now shipped as a native UCS “component,” built as a Debian package that contains a Docker container, rather than as a Docker Compose–based App Center App. Setup and upgrades of Guardian follow the UCS component lifecycle as other Nubus services like OpenLDAP or Samba, although Cerbos runs in a Docker Container. This new approach reduces the complexity needed in the App Center Docker Compose handling and installations easier to automate in software deployment tools.

What this means for operators

Since Guardian has not yet been officially released as production-ready software, this change of direction comes at the right time: We are addressing conceptual debt before the component enters production use.

The previous management UI and its associated REST API will not be continued. Instead, we are creating a system from the outset that is fundamentally aligned with the actual requirements.

For everyone operating Nubus or UCS, Guardian will become easier to manage. Fewer components mean less effort when setting up, updating, and operating the environment. Changes to policies can be tracked and reverted using the same tools that are already used throughout the rest of the infrastructure.

Since Guardian has not previously been used in the standard components of Nubus or UCS, this change has no impact on existing installations or configurations—including the UDM preview of role-based administration.

What comes next

The new Cerbos-based Guardian component is taking concrete shape. Aspects such as extensible policies for customer-specific use cases and support for Nubus extensions such as UDM Extensions are still being worked on. These are solvable tasks—not open-ended questions.

An initial production-ready release for use with Univention software is coming soon. We will keep you informed here on the blog.

We welcome your feedback—whether in the comments or directly via our Help Forum.

Der Beitrag Guardian in Transition: Why We Are Switching to Cerbos erschien zuerst auf Univention.

24 September, 2026 07:49AM by Felix Botner

hackergotchi for Volumio

Volumio

Raspberry Pi for Better Home Music Streaming

A Raspberry Pi is small enough to disappear behind a hi-fi rack, yet capable enough to become the center of a more intentional listening system. For music lovers, that is its real appeal. It can turn a library of files, favorite streaming services, and a trusted DAC into one player that responds to the way you actually listen – from a phone, tablet, or computer, without making the music feel like another software project.

The board itself is not magic. Great results come from making a few sensible decisions about the Pi, its power, network connection, audio output, and software. Get those right, and the result can be a remarkably satisfying network music player for a second system, a desktop setup, or the main system in your home.

Why Raspberry Pi Fits a Serious Music System

Most computers are designed to do everything at once. They send notifications, run background tasks, update software, and ask for attention. A Raspberry Pi music player can take the opposite approach: one focused job, done quietly. It receives music from your library or streaming service, organizes it in one interface, and sends it to the rest of your system.

That focus matters more than raw processing power. Playing high-resolution music does not require a large desktop computer. It requires stable playback, reliable network access, sensible audio hardware, and software designed around listening. The Pi’s modest size, low power draw, and wide support from the maker community make it especially well suited to this role.

It also gives you room to grow. You might begin with a simple USB connection to a DAC you already own. Later, you may add dedicated digital output hardware, move music to network storage, or build a compact enclosure that belongs on the equipment shelf rather than the workbench. The system can evolve with your collection and your curiosity.

Start With the Listening Experience

Before choosing accessories, decide what you want the player to do. This is the question that prevents an enjoyable project from becoming a pile of parts.

If you want easy access to TIDAL, Qobuz, Spotify, internet radio, and local files, choose software that brings those sources together rather than sending you back to separate apps. If your priority is a carefully tagged collection of albums, look for strong library browsing and search. If the Pi will live in a family room, dependable operation and a clear control interface may matter more than advanced settings.

Volumio OS is built around that music-first approach, giving Raspberry Pi owners a dedicated playback environment that can combine local music, streaming services, and connected audio devices in one place. The point is not to spend every weekend adjusting settings. It is to choose an album, press play, and remain with the performance.

Choosing the Right Pi and Connection

For a dedicated streamer, a modern Raspberry Pi with enough memory for responsive browsing is generally the sensible choice. More memory can improve the feel of the interface and leave room for additional services, but it does not automatically improve sound quality. A music player rarely benefits from buying the most powerful configuration just for playback.

Network reliability deserves more attention. Ethernet is usually the cleanest choice for a stationary hi-fi system. It avoids the occasional dropouts and variable signal strength that can affect Wi-Fi, particularly in homes with crowded wireless networks. Wi-Fi remains perfectly practical when a cable is inconvenient, as long as the signal is strong and the player is positioned thoughtfully.

Storage depends on your library. The microSD card is normally used for the operating system, while music can live on a USB drive, a network-attached storage device, or another computer on your network. A network library is often the most flexible arrangement for larger collections because it keeps storage separate from the player. A directly connected drive is simpler for a compact system or a more modest archive.

USB DAC or Dedicated Digital Output?

This is one of the most useful decisions to understand. A USB DAC is often the easiest path. Connect the Pi to a compatible DAC by USB, configure the output in your music software, and you have a capable digital source with very little extra hardware. It is a sensible choice if you already own a DAC, integrated amplifier, or powered speakers with USB input.

Dedicated digital output boards can offer coaxial, optical, or I2S connections, depending on the hardware. They are worth considering when your DAC performs best through a particular input, when you want a more traditional hi-fi connection, or when you are building a system with a specific enclosure in mind.

Neither route wins in every system. USB can be excellent and convenient. A dedicated output can make equal sense when it matches the rest of the chain more naturally. The better choice is the one that gives you reliable operation, the connection your equipment needs, and a sound you enjoy over long sessions.

Power and Noise: Keep the Conversation Honest

Raspberry Pi audio discussions often turn immediately to power supplies and electrical noise. These details can matter, but they should be placed in context. A poor-quality supply can cause instability, interrupted playback, or unreliable peripherals. Start with a properly rated, dependable power supply before thinking about refinements.

From there, the audible effect of upgraded power will depend on the entire system. A resolving amplifier, DAC, speakers, and listening room may reveal differences that a casual desktop setup does not. Likewise, some DACs are more isolated from upstream noise than others. There is no universal verdict that applies to every Pi-based player.

A practical order of priorities is useful: first stable power, then reliable network and storage, then the correct digital connection, and finally experimentation with higher-end power or accessories if your system and ears justify it. This keeps the project centered on music rather than assumptions.

Build for Daily Use, Not Just First Playback

A successful Raspberry Pi streamer should be pleasant six months after you build it. That means considering the small details early.

Choose a case that protects the board and allows adequate ventilation. Avoid placing it where cables are under strain or where it will collect excessive heat. Give the system a stable network address if your setup benefits from easy access. Back up your library and keep its folder structure understandable. If you use a USB drive, make sure it has enough power and is formatted in a way your chosen software handles reliably.

Metadata deserves attention, too. Album artist, release date, genre, artwork, and consistent file naming make a library feel like a collection rather than a directory of loose files. A well-organized library changes the experience of discovery. You can move from a favorite record to related artists, revisit an overlooked year, or find a live performance without remembering exactly where you stored it.

The Limits Are Part of the Appeal

A Pi is not the best answer for every listener. If you want a finished component with a display, factory warranty, premium chassis, and no assembly at all, a dedicated streamer may be the better fit. If you need complex video handling, heavy multitasking, or specialized professional audio workflows, a general-purpose computer may make more sense.

But those limits explain why the Pi remains compelling. It is not trying to be every kind of device. It is a flexible foundation for listeners who want to shape a player around their system and habits. You can keep it simple, or you can refine it one choice at a time.

The most rewarding Raspberry Pi build is rarely the one with the longest specification sheet. It is the one that disappears when the first track begins, leaving your library, your system, and the music itself in clear view.

The post Raspberry Pi for Better Home Music Streaming appeared first on Volumio.

24 September, 2026 02:40AM

September 23, 2026

hackergotchi for SparkyLinux

SparkyLinux

Sparky 2026.09

New ISO images of SparkyLinux 2026.09 “Tiamat” of the semi-rolling line are now available. This new release is based on the Debian “Forky” testing branch. Key changes: – Packages updated from Debian and Sparky testing repositories as of September 21, 2026. – Linux kernel 7.2.6 (versions: 7.2.7, 6.18.53-LTS, and 6.12.111-LTS also available in Sparky repositories) – Firefox 140.16.0esr (156.0.

Source

23 September, 2026 06:14PM by pavroo

September 22, 2026

hackergotchi for ZEVENET

ZEVENET

SKUDONET Last Hop: Solving Asymmetric Routing with Dynamic eBPF Layer 2 Learning

Modern Application Delivery Controller (ADC) deployments rarely operate in simple networks. Enterprise environments commonly include multiple VLANs, routers, firewalls, gateways, backend networks and redundant paths. At the same time, application servers are increasingly interconnected: a server can be the backend of one load-balanced service while simultaneously acting as a client consuming another Virtual IP (VIP).

In these environments, an apparently simple question becomes important:

Should an ADC return traffic according to its routing table, or through the network path from which the connection actually arrived?

These two decisions are not always the same. When they differ, asymmetric routing can appear.

SKUDONET Last Hop addresses this problem by dynamically learning the relevant Layer 2 Last Hop using eBPF, allowing the ADC to preserve the appropriate return path without requiring administrators to redesign the network or maintain complex routing workarounds.

Understanding the problem: routing knows the destination, not the connection path

Consider a client accessing an application published through an ADC. The incoming connection may pass through a router or stateful firewall before reaching a Virtual IP.

DIAGRAM 1 — Normal incoming connection

The ADC receives the connection and delivers it to the appropriate backend. Eventually, the application response must return to the client. A conventional network stack performs a routing decision based primarily on the destination:

Destination IP → Routing table → Interface / Next Hop

That is perfectly valid IP routing behavior. However, there is a piece of information a conventional routing decision does not necessarily consider: through which Layer 2 path did this particular connection arrive? The best route towards an IP address and the correct return path for that specific connection are not necessarily the same thing.

When a valid routing decision creates the wrong return path

DIAGRAM 2 — Asymmetric routing

DIAGRAM 2 -Asymmetric routing

The connection entered through Firewall A, but its response leaves through Router B. From a pure IP routing perspective, both paths may be completely valid. From an application delivery perspective, the result is an asymmetric traffic path — and that creates real problems.

IP networking does not inherently require both directions of a communication to follow the same physical path. Real enterprise networks, however, contain devices that maintain connection state or apply security policies. If a stateful firewall creates state for Client → Firewall A → ADC but the response follows ADC → Router B → Client, Firewall A never sees the return traffic.

Depending on the infrastructure, this can lead to:

  • Stateful firewall sessions failing
  • Inconsistent NAT state
  • Security policies behaving unexpectedly
  • Connections dropped intermittently
  • Different paths applying different security controls
  • Difficult-to-diagnose application connectivity problems
  • Unexpected behavior in redundant network architectures

An ADC can have a perfectly valid route to a client and still use the wrong return path for that particular connection.

The problem with directly connected networks

DIAGRAM 3 — Multiple directly connected networks

DIAGRAM 3 — Multiple directly connected networks

The problem becomes more relevant when the ADC is connected to several networks directly — for example, VLAN A (clients), VLAN B (VIP) and VLAN C (backends).

Suppose a connection physically reaches SKUDONET through an intermediate router or firewall, but its source IP belongs to a network the ADC also knows directly. When the response is processed, the routing system sees that destination as directly reachable and selects that direct interface. The decision is correct according to the routing table — but it doesn’t reproduce the path through which the connection actually arrived.

This is one reason asymmetric routing problems can be difficult to troubleshoot: there may be nothing wrong with the routing table at all.

When a backend also acts as a client of another VIP

Modern application architectures make the distinction between “client network” and “backend network” increasingly artificial. The same server can simultaneously be a backend member of one load-balanced service, and consume another application through a different SKUDONET VIP.

DIAGRAM 4 — Backend also acting as a VIP client

DIAGRAM 4 — Backend also acting as a VIP client

Backend Server A is therefore both a load-balancing destination and a consumer of another load-balanced service. Because SKUDONET already has direct connectivity to Server A’s network, a conventional routing decision can select that direct path when returning traffic, even though the connection towards the other VIP entered through a different Layer 2 path. As application environments become more interconnected, assuming “backend networks only contain backends” is no longer realistic.

What happens without Last Hop

Without a Last Hop capability, the network infrastructure itself has to compensate for the asymmetry. Administrators can introduce static routes, Policy-Based Routing (PBR), source-specific routing, multiple routing tables, packet marks and routing rules, additional VLANs, additional NAT policies, firewall-specific routing rules, topology changes or per-service exceptions.

These approaches can solve individual scenarios, but their limitation is operational complexity. A workaround that’s manageable for two applications becomes difficult to maintain when an ADC publishes dozens or hundreds of VIPs across multiple networks: adding a VIP may require routing changes, moving an application may require new PBR rules, and troubleshooting means correlating ADC configuration, routing tables, firewall state, VLANs and PBR policies at the same time.

Enterprise ADCs handle this problem at the application delivery layer

Asymmetric routing in complex application delivery environments is not a new problem. Mature enterprise ADC platforms address it inside the application delivery layer rather than relying entirely on external routing workarounds.

F5 BIG-IP, for example, provides Auto Last Hop, which retains the MAC address associated with the incoming request and can use it for the return traffic. NetScaler ADC provides MAC-Based Forwarding (MBF), which similarly retains Layer 2 information about the upstream device and uses it when sending the response.

These mechanisms reflect an important architectural distinction. Last Hop awareness is not simply a routing feature; it is an ADC capability designed for environments where connection state, multiple network paths and application traffic intersect.

SKUDONET addresses the same class of enterprise networking problem with Last Hop, bringing this capability natively into its ADC architecture. Rather than depending on legacy MAC-caching logic, SKUDONET uses dynamic Layer 2 learning powered by eBPF within the Linux networking datapath.

This places SKUDONET alongside established enterprise ADC platforms in its ability to preserve the appropriate return path at the application delivery layer.

SKUDONET Last Hop: dynamic Layer 2 learning powered by eBPF

Instead of statically describing every possible return path, SKUDONET Last Hop learns the relevant information from the traffic itself. When a connection whose source belongs to a network SKUDONET already knows reaches the ADC, Last Hop identifies the Layer 2 path (including the associated MAC information)  through which it arrived, and stores it.

Conceptually:

Incoming traffic → Learn Layer 2 Last Hop → Store path information → Use it for the return traffic

This is implemented using eBPF, integrated with the Linux networking datapath. Linux still performs its normal routing decision first, selecting the interface through which the response would ordinarily leave. SKUDONET’s eBPF logic then checks that decision after routing and before the packet reaches the output interface: if the learned Last Hop indicates the response should leave through a different interface, the output is corrected accordingly.

DIAGRAM 5 — SKUDONET eBPF Last Hop learning

 

DIAGRAM 5 — SKUDONET eBPF Last Hop learning

There’s no need to create a static route for every learned connection path, redesign the surrounding network, or spread application-specific routing complexity across the infrastructure.

Last Hop works with routing, not instead of it

SKUDONET Last Hop does not replace a correctly designed routing infrastructure. Routers continue routing. Linux continues maintaining network reachability. Gateways, VLANs and interfaces continue performing their normal functions.

Last Hop solves a more specific problem: when the ADC already knows how a connection entered the system, that information is used to preserve the correct Layer 2 return path — instead of letting another valid routing decision introduce unwanted asymmetry.

Where SKUDONET Last Hop is especially useful

  • Multiple routers or default gateways
  • Stateful firewalls in front of the ADC
  • Multiple directly connected networks or VLANs
  • Complex Layer 2 and Layer 3 segmentation
  • Redundant network paths
  • Multi-homed ADC deployments
  • Environments requiring symmetric traffic paths
  • Legacy networks that can’t easily be redesigned
  • Large ADC installations where per-service routing policies become hard to maintain
  • Backend servers that also act as clients of other load-balanced VIPs
  • Architectures where traffic frequently crosses client, service and backend networks connected to the same ADC

Traditional routing vs SKUDONET Last Hop

DIAGRAM 6 — Side-by-side comparison

DIAGRAM 6 — Side-by-side comparison

Traditional routing vs SKUDONET Last Hop 

Traditional routing vs SKUDONET Last Hop

Less routing complexity, more intelligence at the application delivery layer

An ADC occupies a privileged position in the network: it sees connections entering the infrastructure, identifies the VIP being accessed, selects application servers and processes the traffic returning from those applications. Discarding information about the incoming path and trying to reconstruct it later through increasingly complex routing policies isn’t always the best architectural approach.

SKUDONET Last Hop uses information that’s already available when traffic enters the ADC, reducing the need for workarounds based on static routes or Policy-Based Routing — and keeps that intelligence where it belongs: inside the application delivery layer, instead of distributed across the network.

 

 

Frequently asked questions

What causes asymmetric routing in an ADC deployment?
Asymmetric routing happens when the routing table selects a valid but different interface for a response than the one the connection originally entered through. This is common when an ADC is connected to multiple networks, sits behind stateful firewalls, or when a server acts as both a backend and a client of another Virtual IP.

What is SKUDONET Last Hop?
SKUDONET Last Hop is a capability that dynamically learns the Layer 2 path a connection arrived through, using eBPF in the Linux networking datapath, and uses that information to send the response back through the correct interface.

How does SKUDONET Last Hop compare with enterprise ADC mechanisms?

F5 BIG-IP provides Auto Last Hop and NetScaler ADC provides MAC-Based Forwarding to preserve Layer 2 information for return traffic. SKUDONET addresses the same class of asymmetric-routing problem through dynamic Layer 2 Last Hop learning implemented natively with eBPF in the Linux networking datapath.

Does Last Hop replace routing infrastructure?
No. Routers, gateways and Linux’s own routing system continue to work normally. Last Hop only intervenes for specific connections where the learned entry path differs from what routing would otherwise select.

When should a company consider using Last Hop?
When the ADC deployment includes multiple routers or gateways, stateful firewalls, several VLANs, redundant paths, or servers that act simultaneously as backends and clients of other Virtual IPs.

22 September, 2026 02:34PM by Isabel Perez

hackergotchi for GreenboneOS

GreenboneOS

Patch Now! Heightened Risk Across Cisco Products in September 2026

So far, Cisco has published 97 new CVE IDs affecting its products this month. Although cyber security experts have noted that raw CVE count is not a direct measure of risk, the total makes September Cisco’s largest-ever month for coordinated CVE disclosures. Also, 32 of the CVEs are “umbrella CVEs”—clusters of multiple underlying vulnerabilities grouped […]

22 September, 2026 12:34PM by Joseph Lee

hackergotchi for Univention Corporate Server

Univention Corporate Server

UCS 5.2-7 Released

The latest patch-level release of Univention Corporate Server bundles all new features and improvements from the past months onto new installation media including a new authorization backend for Nubus Guardian, more control over password hash security, deeper Keycloak observability, and simplified Microsoft 365 classroom management for schools — alongside continued groundwork for the upcoming UCS 5.3. New with UCS 5.2-7 comes a major performance improvement for WLAN authentication at scale.

Faster RADIUS Authentication for Large Environments

WLAN authentication with username and password against the Nubus RADIUS service relies internally on an authentication helper plugin. In very large environments with a high volume of authentication requests, this helper had become a measurable source of CPU load, limiting how many authentications an installation could realistically process.

With UCS 5.2-7, this helper module has been rewritten in Rust. The result is a significant reduction in CPU consumption per authentication request, which directly translates into higher throughput on the same hardware. For organizations operating large WLAN infrastructures — for example in larger school networks — this means fewer authentication bottlenecks and more headroom before additional infrastructure is needed.

Administrators do not need to change any configuration to benefit from this improvement; it is available automatically once updated. Further technical background is available in the corresponding Bugzilla entry.

New Guardian Authorization Backend Based on Cerbos

Guardian, the authorization service for Nubus, now uses the open source project Cerbos as its policy decision backend, replacing the previous OPA-based implementation. Cerbos was selected specifically because it offers features well suited to the kind of authorization decisions Guardian needs to make. Univention will publish a dedicated blog post shortly explaining the reasoning behind this decision in more detail.

Alongside the new backend, the Guardian authorization service itself has changed how it is delivered: it is now shipped as a native UCS “component,” built as a Debian package that contains a Docker container, rather than as a Docker Compose–based App Center App. Setup and upgrades of Guardian follow the UCS component lifecycle as other Nubus services like OpenLDAP or Samba, although Cerbos runs in a Docker Container. This new approach reduces the complexity needed in the App Center Docker Compose handling and installations easier to automate in software deployment tools.

More Control Over Password Hash Security

As part of the ongoing preparation for eventually removing weaker password hashes from Nubus, this release delivers several improvements that give administrators more direct control today.

The Univention Directory Manager (UDM) now offers additional configuration options to define which hashing algorithms are used when storing passwords, including the ability to remove weaker hashes that may still be present for historical compatibility reasons. Administrators can choose which hashes are needed in their services and which can be removed – our documentation provides information about which functionality is lost of weaker hashes are removed.

In addition, the Active Directory Connector has been adapted to better support environments where Active Directory is configured with reduced encryption types, covering more real-world configurations than before.

Keycloak Metrics for Prometheus and Grafana

The Keycloak App now allows administrators to activate Keycloak’s built-in Metrics Endpoint directly from the app. Once enabled, detailed information about Keycloak usage and events becomes available for collection by Prometheus and visualization in Grafana, alongside other Nubus and UCS metrics administrators may already be tracking.

Screenshot from the Keycloak documentation
Keycloak Capacity Planning example dashboard

This gives IT teams better visibility into authentication load, login behavior, and potential issues in their identity infrastructure — without any manual instrumentation work. Details on enabling and using the metrics endpoint are available in the Keycloak App documentation.

Education Classes Support in the Microsoft 365 Connector

Schools and educational institutions running Nubus or UCS@school alongside Microsoft 365 can now let the MS365 Connector automatically activate Microsoft 365 “education classes” for selected groups. Administrators decide which groups should be treated as education classes, and the connector takes care of enabling the feature in Microsoft 365 accordingly.

This removes a manual, error-prone administrative step from the Microsoft 365 side and ensures that educational features stay consistent with how classes and groups are already managed in the identity system. More information is available in the Microsoft 365 integration manual.

Security and Bugfixes – and Preparation for UCS 5.3

As always, this patch-level release combines the security and bugfix updates of the past months into a new installation medium. As is the case across most open source solutions, the number of reported and fixed security issues continues to rise, partly driven by the growing use of AI-assisted code review.
Additional package updates not visible as a new feature are improvements or compatibility with the upcoming UCS 5.3. This covers two scenarios in particular — domains where UCS 5.2 and UCS 5.3 systems will need to run side by side during a transitional upgrade period, and compatibility with the updated Debian base that UCS 5.3 will build on.

Download and Further Information

UCS 5.2-7 is, as always, available in the download section. Further information about the included changes can be found in the release notes and help article.

Der Beitrag UCS 5.2-7 Released erschien zuerst auf Univention.

22 September, 2026 12:12PM by Ingo Steuwer

hackergotchi for Volumio

Volumio

Best Music Streamer Features That Matter Most

A great hi-fi system can make a weak front end painfully obvious. When your music comes from a laptop, a phone, a network drive, and several streaming apps, the best music streamer features are the ones that remove friction without flattening the character of the recording. The goal is not more technology in the listening room. It is a clearer, more direct path from the music you love to the system you have carefully chosen.

A music streamer should earn its place in a serious setup. It should organize your sources, deliver the right digital signal to your DAC or amplifier, and make choosing an album feel as natural as pulling a record from the shelf. Here is what to look for before deciding which capabilities matter most to you.

Best Music Streamer Features Start With Sound Quality

A streamer is often described as a convenience product. That misses the point. It is a digital source component, and its design affects how reliably and accurately your system receives music.

Start with the digital output options. If you already own a DAC or an integrated amplifier with a capable DAC section, look for the connection that best suits your system: USB, coaxial S/PDIF, AES/EBU, or optical. USB is widely supported and can carry high-resolution formats, while coaxial or AES/EBU may be a natural choice for established hi-fi systems. The best option is not universal. It depends on the inputs on your DAC and which connection sounds and performs best in your room.

Clocking, electrical noise management, and power supply quality also matter. Digital music is made of data, but the environment in which that data is delivered can influence the noise reaching sensitive audio circuitry. Better streamers pay close attention to component layout, isolation, and clean power. This does not mean every system needs an elaborate solution. It means a streamer should be designed as audio equipment, not merely as a small computer with an output.

Native support for high-resolution PCM and DSD is useful if your library includes those formats or if you subscribe to a service offering high-resolution music. Yet format support alone should not decide your purchase. A well-recorded CD-quality album played through a considered system can be deeply involving. Prioritize stable playback and a sound you enjoy over a specification race.

One Library for Streaming and Personal Music

For many listeners, the most valuable feature is not a number on a spec sheet. It is a unified library. Your favorite music may be split between ripped CDs, purchased downloads, a NAS drive, USB storage, and services such as TIDAL, Qobuz, and Spotify. Switching apps every time you change sources interrupts the listening session before it starts.

A capable streamer brings those sources into a single interface. You should be able to browse artists, albums, composers, genres, and playlists without needing to remember where each record lives. That matters especially for collectors with years of carefully tagged files alongside newer streaming discoveries.

Metadata Makes a Large Collection Feel Personal

Good library management goes beyond displaying album art. It should respect tags, support multiple artist credits, handle classical music intelligently, and make it easy to search your collection. Classical listeners may need composer, conductor, ensemble, and work-level browsing. Jazz fans may want to follow a sideman across several leaders’ records. Electronic listeners may want to move quickly between labels, remixers, and genres.

The interface should also make it easy to combine sources. A playlist that moves from a local live recording to a newly released streaming album should feel like one collection, not two separate systems forced together.

Be realistic about metadata, though. A streamer can display only the information contained in your files or supplied by a service. Cleaning up inconsistent file tags remains worthwhile, particularly for a large local library. The right platform makes that work visible and rewarding rather than hiding your collection behind folders and filenames.

A Control App Should Get Out of the Way

A music streamer lives or dies by its control experience. You will use it more often than any rear-panel connection, so the app deserves the same scrutiny as the hardware.

Look for fast search, clear album views, dependable queue management, and simple access to favorites. A good app should respond quickly when you tap an album and should make it obvious what is playing, where it is playing, and what will play next. Volume control, input selection, and playback settings should be available when needed without crowding the music browsing experience.

The strongest interfaces encourage discovery as well as retrieval. Recently played albums, new releases from favorite artists, radio features, and editorial recommendations can lead you somewhere unexpected. Still, discovery must not overwhelm ownership. If you have spent decades building a personal library, that library should remain at the center of the experience.

Volumio approaches this with a single music-player ecosystem designed to place local files, streaming services, and connected audio devices under one familiar interface. For listeners, the practical benefit is simple: less app switching and more time with the music.

Connectivity That Fits Your System, Not the Other Way Around

Network reliability is essential. Wired Ethernet is generally the strongest choice for a fixed hi-fi system, especially when high-resolution playback, large libraries, or a busy home network are involved. Wi-Fi is valuable when running a cable is impractical, but it should be implemented well and remain stable at the distance your system requires.

Beyond the network itself, consider how the streamer will connect to the rest of your home. Bluetooth can be useful for guests and casual listening, although it is not usually the first choice for critical playback. AirPlay and similar casting options can make everyday use more convenient for households with different devices. Roon compatibility may matter if it is already central to your library and discovery habits.

These features are not all equally necessary. A dedicated listening room with a wired network may need very little beyond reliable native streaming and a quality digital output. A shared living space may benefit more from easy casting and straightforward multi-user control. Buy for the way you actually listen, not for an imaginary future system.

Best Music Streamer Features for Everyday Listening

The right streamer should make daily listening easier in small but meaningful ways. Gapless playback is essential for live albums, DJ mixes, opera, and records designed as a continuous statement. Without it, a pause between tracks can break the atmosphere immediately.

Reliable playback queues are equally important. You should be able to add an album after the current track, reorder selections, save a queue as a playlist, and return to a session later. These may sound like modest software details, but they shape whether a streamer feels like an instrument for listening or another screen demanding attention.

Consider these practical capabilities together:

  • Gapless playback for albums and continuous mixes
  • Multiroom support if you want music in more than one space
  • Internet radio for local stations and global discovery
  • Automatic library updates when new files are added
  • Alarm, wake-up, or scheduled playback functions where they suit your routine

Multiroom deserves careful thought. It is excellent for bringing background music into a kitchen, office, or patio, but synchronized playback can introduce different priorities from a single dedicated hi-fi zone. If the main system is your focus, make sure multiroom convenience does not complicate the core listening experience.

Long-Term Support Is a Feature, Too

A streamer connects your hi-fi system to services and protocols that evolve. That makes software support part of the product, not an afterthought. Look for a company with a record of updates, active development, and clear support for the services you use.

This is especially important for DIY listeners building around a Raspberry Pi, Tinker Board, or PC. The hardware can be wonderfully flexible and cost-effective, but the software experience determines whether the project becomes a trusted source component or an unfinished weekend experiment. A mature platform saves time on setup, networking, library indexing, and everyday control while still leaving room to tailor the system.

For dedicated hardware, consider build quality and serviceability as well. A streamer may sit at the center of your system for years. Thoughtful engineering, stable firmware, and a company that understands both software and high-fidelity audio create more confidence than a long list of isolated features.

Choose Features Around the Music You Return To

The best streamer is not necessarily the one with the longest specification sheet. It is the one that makes you play more complete albums, revisit your own library, and spend less time negotiating between devices. Start with your sources, your DAC or amplifier, your network, and the way you listen with others at home. Then choose the features that make the next album feel effortless to play.

The post Best Music Streamer Features That Matter Most appeared first on Volumio.

22 September, 2026 02:34AM

hackergotchi for Deepin

Deepin

Linyaps 1.14 Released: Safer Upgrades, Smoother Debugging, Easier Management

Recently, Linyaps 1.14 was released. From 1.13.0 to 1.14.0, this update focused on fixing a set of real pain points—whether it is the “lost module” annoyance ordinary users encounter during upgrades, the trouble packagers have debugging applications, or operations teams’ needs around disk usage and compliance auditing, this version provides better solutions. The following sections are organized by role. Feel free to read the parts that matter to you.   Ordinary Users : Everyday use is easier; no more worrying about minor issues. If you only use Linyaps to install and run applications, you will feel these changes directly after ...Read more

22 September, 2026 02:12AM by xiaofei

hackergotchi for ARMBIAN

ARMBIAN

Github Highlights

Github Highlights

This cycle centers on expanded board and SoC support, kernel maintenance across sunxi, rockchip, and sophgo families, and infrastructure refinements to installer, extensions, and CI tooling.

New platform enablement covers a broad range of vendors and architectures. Notable additions include the EmbedFire LubanCat 3 v2 and Seeed reComputer RK3576 devkits, the TQ-Systems MBa62xx/MBa67xx TI K3 boards, the Tanix TX6s (Allwinner H616), and the ZTL A568 (RK3568). The Allwinner A733 line advances with a full HDMI display pipeline (DE33/RCQ), PCIe/NVMe, and U-Boot 2026.07 integration for sun55iw3, while the Sophgo SG200x family bumps edge to 7.2, gains TPU support for the Milk-V Duo S, and doubles the /boot partition to 256 MB.

Kernel work spans multiple maintenance streams. The sunxi 6.18 and 7.2 patch sets were rewritten against upstream changes, with fixes for a sun8i_thermal NULL-caldata Oops that also resolves a reboot hang, and a correction for H616/H618 analog LINEOUT playing at half speed. Rockchip receives an RK3588 SDMMC fix for bus-width > 1, plymouth and ttyGS0 gadget console improvements on RK35xx, and Radxa E24C network fixes. Amlogic meson64 gains GPIO wakeup sources, PCIe port service requirements, and a rebased MPS series, while the cix-6.18 sky1 PDC driver was converted to the new syscore API.

Tooling and distribution changes improve reliability and lifecycle handling. A new backward-compatible switch-alias mechanism formalizes deprecation, armbian-install gains an "spi" mode for self-contained boot on NVMe, SATA, or USB, and armbian_firmware now installs linux-headers before linux-image to satisfy first-pass DKMS. GitHub release lookups are checked and authenticated with GITHUB_TOKEN propagated through CI, kernel-deb postinst symlinks are made resilient to hook failures, and download-external mirrors only the newest version of each package to reduce archive bloat.

#Armbian #EmbeddedLinux #Rockchip #Allwinner #KernelDevelopment

Changes

22 September, 2026 01:46AM by Michael Robinson

September 21, 2026

hackergotchi for Deepin

Deepin

September 20, 2026

hackergotchi for Clonezilla live

Clonezilla live

Stable Clonezilla live 3.3.3-37 Released

This release of Clonezilla live (3.3.3-37) includes major enhancements and bug fixes.

ENHANCEMENTS AND CHANGES SINCE 3.3.3-15

  • The underlying GNU/Linux operating system was upgraded. This release is based on the Debian Sid repository (as of 2026/Sep/13).
  • The Linux kernel was updated to 7.1.13-1.
  • Partclone was updated to 0.3.50, which includes a fix for a Btrfs issue.
  • Clonezilla lite server now supports both PXEBoot and HTTPBoot network boot clients, including Secure Boot support for HTTPBoot mechanism.
  • Implemented LUKS2 Repository support.
  • Replaced deprecated net-tools commands with iproute2 alternatives and dropped dhclient-related code in favor of dhcpcd.
  • Configured dhcpcd to use clientid for stable IP reservations. Thanks to FoxKyong for suggesting this.
  • GRUB display enhancements: Configured preferred resolutions ('1920x1080,1024x768,auto') and fallback resolution (1024x768) to prevent microscopic boot menus and text distortion on 4K/HiDPI screens.
  • ocs-live-boot-menu: Conditionally run efitextmode under secure boot lockdown to prevent "prohibited by secure boot policy" error messages.
  • ocs-live-time-sync: Added an option to handle Local Time hardware clocks by detecting boot parameters (like 'utc=no') and prompting interactively when offline.
  • Bypass partition image conversion when restoring to identical base disks/partitions.
  • cnvt-ocsiso-qcow2: Refactored with dual-packaging modes (--use-vhd-mode and --use-iso-mode), flexible prefixing (--prefix), and fixed VHD boot kernel panics.
  • Enhanced CJK font scaling with large console fonts in fbterm using --font-size and optimized boot speed in ocs-console-font-size.
  • Added packages netpbm and fonts-unifont to the live system.

BUG FIXES

  • Fixed the RHEL 10 / AlmaLinux 10+ LVM system.devices locking issue. Thanks to Ray Fong for reporting this issue.
  • Fixed 'box' partition device error when empty Partition Devices occur (NUMDEV=0).
  • Fixed an issue where no size or file system was detected for a bare disk with a file system.
  • Fixed a bug where the TUI was not shown for poweroff/reboot/command after device-to-device cloning is finished.
  • Enabled Partclone ncurses TUI for direct device-to-device cloning.
  • Fixed console font size auto-detection mismatch on non-KMS/FHD setups.*

20 September, 2026 09:35AM by Steven Shiau

hackergotchi for Volumio

Volumio

How to Create a Network Audio Endpoint at Home

A great DAC and amplifier cannot show their full character if music reaches them through a noisy computer, a limited Bluetooth connection, or a different app for every service. To create a network audio endpoint is to give your hi-fi system a dedicated front door for digital music: one that receives audio over your home network and delivers it cleanly to the rest of your system.

For some listeners, that means adding a compact streamer to an existing DAC. For others, it means building a Raspberry Pi-based player that makes a treasured local library as easy to enjoy as a favorite album on Qobuz or TIDAL. The right approach depends on your system, your listening habits, and how much hands-on involvement you want.

What a network audio endpoint actually does

A network audio endpoint is the device at the listening end of your digital audio chain. It connects to your network, receives music from a streaming service, music server, phone, tablet, or computer, then passes that signal to a DAC, integrated amplifier, or active speakers.

It helps to separate three roles that are often confused. A music server stores or indexes files. A control point is the app or interface used to choose music. The endpoint is the playback device connected to your hi-fi. One product can perform all three roles, but they do not have to live in the same box.

That separation is useful. Your music library may be on a NAS in another room, while the endpoint sits quietly beside your rack. You can browse music from the listening chair without placing a laptop next to sensitive audio equipment. More importantly, the system can remain focused on playback rather than general-purpose computing.

Choose the endpoint architecture for your system

Before selecting hardware, look at the input you already have. If you own an external DAC you love, a digital endpoint with USB, coaxial, optical, or AES output may be the natural choice. USB is common and capable, but implementation matters on both the streamer and DAC. Coaxial and optical can be excellent choices when they match the available inputs and supported resolution of your equipment.

If your integrated amplifier has digital inputs, the endpoint can feed it directly. If it only accepts analog inputs, choose a network player with a built-in DAC or add a separate DAC between the endpoint and amplifier. Active speakers follow the same logic: use their digital input where appropriate, or provide a quality analog signal from a DAC.

There is no universal rule that says one connection always sounds better. A well-implemented output that suits the DAC is more valuable than a format chosen purely from a specification sheet. Keep cable length sensible, avoid unnecessary conversions, and begin with the connection your system was designed to use well.

DIY endpoint or dedicated streamer?

A DIY endpoint is compelling when you enjoy building, want to reuse hardware, or need a compact player for a second system. A Raspberry Pi, compatible audio board or USB DAC, power supply, case, storage if needed, and a network connection can become a remarkably capable source. It also gives you room to experiment with outputs and configuration.

The trade-off is responsibility. You choose the enclosure, manage the setup, troubleshoot network behavior, and decide where to spend on power and accessories. That is part of the appeal for many builders, but it is not every listener’s idea of a relaxing Saturday afternoon.

A dedicated network streamer is better suited to listeners who want an integrated, purpose-built component with refined industrial design, stable operation, and a straightforward place in a serious hi-fi rack. It can also make sense when physical isolation, output quality, power design, and long-term product support are priorities. The best route is the one that leaves you spending more time listening than maintaining a system.

What you need to create a network audio endpoint

The basic signal path is simple: network, endpoint, DAC, amplification, speakers or headphones. The details determine how enjoyable it is to use.

Start with a compatible playback device. This can be a small single-board computer, a PC repurposed for audio, or a dedicated streamer. Next, choose the audio output: a USB connection to an external DAC, a digital HAT or interface board, or an endpoint with an internal DAC. Finally, make sure your control device – usually a phone, tablet, or computer – is on the same home network.

A wired Ethernet connection is usually the first choice for a main hi-fi system. It is dependable, avoids the variability of crowded wireless environments, and makes high-resolution playback less dependent on router placement. Wi-Fi can work very well, especially for secondary rooms or installations where a cable is impractical. If it does not, solve the network issue before changing audio components. Dropouts are more often caused by coverage, router settings, or congestion than by the DAC.

Power deserves a practical rather than mystical approach. Use a stable, appropriately rated supply, keep power cables and network hardware tidy, and evaluate upgrades in your own system. Better power design can be worthwhile, particularly in revealing setups, but it should not distract from the fundamentals of placement, speaker setup, recordings, and a reliable network.

Set up the software around how you listen

Once the endpoint is connected, install a playback operating system designed for music. The setup process generally includes connecting to the network, selecting the audio output, naming the device, and confirming that your DAC is recognized at the formats it supports.

This is the point where a music-first interface changes the experience. Rather than treating local files, radio, and streaming subscriptions as separate destinations, look for software that presents them in a coherent library. Volumio is built around that idea, bringing playback control, local collections, and supported music services into one environment.

If you use a network-attached storage device, add the shared music folder and allow time for the library to index. Clean metadata pays off here. Consistent artist names, album artists, genre tags, cover art, and composer fields make a large collection easier to explore. A beautifully recorded album is less likely to be played when it is hidden under “Unknown Artist.”

For streaming, sign in to the services you use and check whether the endpoint supports the playback method you prefer. Some listeners value direct control from a single music interface. Others want to hand off audio from an app they already know. Both can be useful, but they offer different browsing experiences and may support different formats or queue behavior.

Configure quality without chasing settings

Begin with a sensible baseline. Set the endpoint to use the correct DAC output, leave volume at a fixed level if your amplifier or preamp is handling volume control, and avoid unnecessary resampling unless you have a specific reason to use it. If digital volume is necessary, make sure it is implemented appropriately and leave enough headroom to prevent accidental overload.

Then listen to familiar recordings. Use music with voices, acoustic instruments, dense arrangements, and quiet passages – not only spectacular audiophile test tracks. You are listening for continuity: stable playback, natural timing, convincing tone, and the sense that the system disappears behind the performance.

Resolution support matters, but it is only one part of the result. A reliable endpoint playing a well-mastered CD-quality album can be more rewarding than an unstable setup chasing the highest number displayed in an app. Let the music, not the menu, decide what deserves your attention.

Common endpoint problems and the practical fixes

If the endpoint does not appear in the control app, first confirm that both devices are on the same network and that the router is not isolating wireless clients from wired devices. Restarting the router and endpoint can clear a temporary address issue, but repeated failures suggest a network configuration problem worth investigating.

If the DAC is not detected, try another USB cable or input, then verify that the selected output is correct in the playback settings. For digital connections, confirm that the endpoint and DAC support the selected sample rate. An optical input, for example, may have different limits from USB.

When playback stops or stutters, test with a wired connection before adjusting audio settings. Move the endpoint closer to the router if using Wi-Fi, reduce competing network traffic, and make sure the power supply is adequate. Change one variable at a time. That makes the cause easier to identify and prevents a simple network problem from becoming an expensive guessing game.

Make the endpoint part of a better listening routine

The real value of a network endpoint is not merely that it puts music on a network. It removes friction between curiosity and listening. A well-organized library invites you back to albums you forgot you owned. A unified control experience makes it easier to move from a radio discovery to a favorite recording without reaching for another device.

Build the system around those moments. Give the endpoint a clear name, keep your library tidy, save a few playlists for different moods, and use the connection that lets your existing DAC and amplifier sound at home. When the technology becomes quiet in the background, the room belongs to the music again.

The post How to Create a Network Audio Endpoint at Home appeared first on Volumio.

20 September, 2026 02:35AM

September 18, 2026

hackergotchi for ZEVENET

ZEVENET

How Does a Web Application Firewall Work? Inside HTTP and HTTPS Traffic Inspection

An HTTPS request can pass every network-level check and still contain something your application should never process.

SQL injection, malicious JavaScript, malformed HTTP data or a dangerous file upload can all travel inside what appears to be a perfectly valid connection.

This is exactly where a Web Application Firewall comes into play.

The interesting part is not simply that it can block malicious traffic. What really matters is what happens between the moment a request reaches the infrastructure and the moment it is either rejected or forwarded to the application.

Let’s follow that request step by step.

The HTTP/S request journey through a Web Application Firewall

In our architecture, traffic follows a clear path:

Client → reputation and DoS/DDoS checks → TLS termination → WAF inspection → load balancer → backend

The Web Application Firewall operates before backend selection, so malicious requests can be stopped before the application has to process them. The response can also be inspected on its way back to the client.

That gives security teams a useful point of control inside the application delivery path, rather than leaving inspection to the application itself.

Step 1: Filter obvious threats before deep inspection

Not every connection needs the same level of analysis.

Before a request reaches deep application inspection, traffic can already be checked against reputation data, blocklists and abnormal connection behavior.

Our IPDS stack includes reputation-based filtering, real-time RBL checks and DoS/DDoS protection before the WAF stage.

This allows clearly suspicious traffic to be discarded earlier, while the WAF focuses on requests that require deeper analysis at application level.

Step 2: TLS termination makes HTTPS traffic inspectable

Most business applications today use HTTPS, which means the HTTP request is encrypted while it travels over the network.

A Web Application Firewall cannot inspect application content it cannot see.

That is why TLS termination happens before WAF inspection. In our architecture, HTTPS is decrypted inside the ADC and the HTTP request is then passed to the WAF engine for analysis.

This is what makes it possible to inspect the actual content of an encrypted request rather than just the connection around it.

Step 3: Inspecting the actual HTTP request

Once the request is visible, the Web Application Firewall can inspect much more than the URL.

The inspection can include:

  • URI and parameters
  • HTTP headers
  • request body
  • multipart forms
  • JSON
  • XML
  • file uploads

Each request also receives a unique transaction ID, which helps trace it across hostnames, services and backends.

This becomes especially useful in environments where the same infrastructure protects several applications, APIs or microservices.

Step 4: Rules decide what should be blocked

Inspection only becomes useful when the WAF has a clear way to evaluate what it sees.

Our WAF uses ModSecurity as the inspection engine and applies OWASP Core Rule Set v4.3.0, together with additional SKUDONET rules and threat intelligence.

These rules can detect patterns associated with attacks such as:

  • SQL injection
  • Cross-Site Scripting
  • Local and Remote File Inclusion
  • Remote Code Execution
  • command injection
  • malformed HTTP requests
  • protocol violations
  • scanners and bots
  • session manipulation
  • HTTP DoS patterns

The decision is made on the content and behavior of the request, not simply on where it came from.

Custom rules matter in production

Predefined rules are useful, but real applications rarely behave in exactly the same way.

A public API, an ERP and a customer portal may all need different security policies, even if they share the same infrastructure.

That is why administrators can inspect and modify existing WAF rules and also create their own. Custom rules can be applied at farm, service and VirtualHost level, while exclusions can be used when legitimate traffic requires a more specific policy.

The platform is also compatible with the ModSecurity rule language, giving technical teams a way to define more granular detection and blocking logic when needed.

Step 5: What happens when the WAF detects an attack?

Take a simple SQL injection attempt.

The connection itself may look completely normal. HTTPS works, the HTTP request is valid and the client is reaching an allowed endpoint.

The problem is inside the request.

Once the WAF inspects the relevant parameter or request body, a rule may identify a malicious pattern. If the request is considered unsafe, it is blocked before the backend processes it.

That is the key difference between network-level filtering and application-level inspection: the connection may be valid, while the content is not.

Our WAF is designed to detect attack categories including SQL injection, XSS, LFI/RFI, RCE, command injection and several HTTP anomalies.

Step 6: Legitimate traffic continues to the backend

If the request passes inspection, it continues to the load balancer, which selects the appropriate backend.

At that point, security and application delivery are part of the same request path.

The same infrastructure can handle:

  • TLS termination
  • WAF inspection
  • traffic distribution
  • backend selection
  • availability

Response inspection: protection does not end with the request

The client request is only half of the HTTP transaction.

Our WAF uses a four-phase inspection model:

  • Phase 1: request headers
  • Phase 2: request body
  • Phase 3: response headers
  • Phase 4: response body

This means the response from the backend can also be inspected before it is returned to the client.

For troubleshooting and security analysis, that provides a more complete picture of the transaction instead of looking only at inbound traffic.

False positives: when legitimate traffic triggers a rule

A Web Application Firewall has to block malicious traffic without constantly breaking legitimate requests.

That sounds obvious, but it is one of the main operational challenges of running a WAF in production.

A legitimate request can occasionally match a security rule because of an unusual parameter, payload or application behavior.

When that happens, the useful question is not simply “which rule blocked it?”, but also “why did it match?”

Our WAF logs include details such as:

  • triggered rule
  • matched variable
  • payload
  • severity
  • client IP
  • hostname
  • backend
  • anomaly score
  • transaction ID

Administrators can then adapt a rule or create an exclusion without weakening the entire policy.

Different applications need different WAF policies

Applying the same security policy to every service is rarely ideal.

Production, staging and QA may have different needs. An internal service may behave very differently from a public API. A legacy application may require exceptions that would make no sense elsewhere.

Our platform allows different farms, services and domains to use their own rule sets, blocklists and security policies within the same ADC instance.

That gives teams more flexibility to adapt protection to the application rather than forcing every application into the same security model.

Can WAF policies be automated?

In larger environments, manual security changes quickly become difficult to maintain.

Our REST API can be used to automate deployments, update rules from CI/CD pipelines, integrate security with external systems and react to backend events by creating dynamic rules.

For DevOps and platform teams, this makes WAF policy management easier to integrate into the same workflows already used for application delivery and infrastructure changes.

Does Web Application Firewall inspection affect performance?

Deep inspection is not free.

A Web Application Firewall may need to terminate TLS, parse HTTP, inspect headers and bodies, evaluate rules and, in some cases, inspect the response as well.

The impact depends on factors such as:

  • traffic volume
  • TLS workload
  • request and response size
  • number and complexity of rules
  • JSON/XML processing
  • file uploads
  • available CPU and memory

This is why WAF performance should be evaluated in the context of the actual application rather than only through generic throughput numbers.

How we integrate Web Application Firewall protection into application delivery

Our Web Application Firewall is built directly into the ADC rather than deployed as a separate security layer.

It works together with:

  • TLS termination
  • Layer 7 reverse proxying
  • reputation filtering
  • DoS/DDoS protection
  • load balancing
  • high availability
  • logging and profiling
  • REST API automation

The WAF uses ModSecurity and OWASP CRS v4.3.0, while administrators retain control over custom rules, exclusions and application-specific policies.

It can be deployed as an edge ADC, an on-premise reverse proxy or as part of a hybrid architecture protecting public applications, internal services, APIs, microservices and cloud workloads.

For teams managing critical applications, the advantage is not simply having another security feature.

It is being able to manage security, availability and traffic delivery within the same application path, with visibility into what is being blocked, why it is being blocked and where legitimate traffic is being sent.

FAQ

What is a Web Application Firewall?

A Web Application Firewall is a security layer that inspects HTTP and HTTPS traffic to detect and block malicious application-layer requests before they reach a web application. Unlike a traditional network firewall, it analyzes the content of web traffic rather than relying mainly on IP addresses, ports and network protocols.

How does a Web Application Firewall work?

A Web Application Firewall sits in the application traffic path and evaluates HTTP/S requests against security rules. It can inspect headers, parameters and request bodies, detect malicious patterns and either block the request or allow it to continue towards the backend.

Does a Web Application Firewall inspect HTTPS traffic?

Yes, provided the encrypted traffic is decrypted before application-layer inspection. In our architecture, TLS is terminated inside the ADC before the request reaches the WAF.

Can a Web Application Firewall inspect responses?

Yes. Our WAF inspects both request and response traffic through four phases covering request headers, request bodies, response headers and response bodies.

Can Web Application Firewall rules be customized?

The level of customization depends on the platform. In our case, administrators can inspect and modify existing rules, create custom rules and define exclusions at farm, service and VirtualHost level.

What attacks can a Web Application Firewall block?

Depending on its rules and configuration, a Web Application Firewall can detect attacks such as SQL injection, Cross-Site Scripting, Local and Remote File Inclusion, Remote Code Execution, command injection and malformed HTTP requests. Our WAF also includes detection for scanners, bots and several HTTP DoS patterns.

18 September, 2026 05:55PM by Isabel Perez

hackergotchi for Deepin

Deepin

(中文) 应用商店 | 微信 Linux 版功能大更新!

Sorry, this entry is only available in 中文.

18 September, 2026 07:46AM by xiaofei

hackergotchi for Volumio

Volumio

How to Improve Streamer Sound in Your Hi-Fi System

The difference between a merely convenient streamer and a compelling digital front end often appears in the quietest moments: the decay of a piano note, the placement of a vocalist, the space around a brushed cymbal. To improve streamer sound, start by treating the streamer as a real component in your hi-fi system, not just a box that delivers music from the internet.

A network player does more than move digital files from one place to another. It receives data, manages software, handles clocks and electrical noise, then passes a digital or analog signal to the next stage of your system. The goal is not to chase tweaks for their own sake. It is to remove the bottlenecks that keep your DAC, amplifier, and speakers from showing what a well-recorded album can do.

Improve Streamer Sound by Starting With the Signal Path

Before changing cables or adding accessories, map the path your music follows. Is the streamer using its own analog outputs into an integrated amplifier? Is it feeding an external DAC through USB, coaxial, or optical? Does your amplifier have a DAC section already? These answers determine where an upgrade will make a meaningful difference.

If your streamer has a capable internal DAC and your system is simple, its analog outputs may be the most direct route to satisfying sound. Fewer boxes and connections can mean less complexity, easier control, and a cleaner installation. A dedicated DAC, however, can be a worthwhile addition when the rest of the system is revealing enough to expose its strengths in conversion quality, output stage design, and connection flexibility.

There is no universally superior connection. USB can support high-resolution formats and allows an external DAC to control timing, but it can also carry electrical noise from connected equipment. Coaxial S/PDIF is often a strong, stable choice for systems with a quality digital input. Optical isolates electrically, which can be useful when hum or noise is present, though some implementations have lower resolution limits. Listen with your own equipment before assuming one interface wins.

Keep the path purposeful. A streamer connected to a DAC, then to a preamp or integrated amplifier, is usually all that is needed. Avoid unnecessary converters, splitters, and adapters. Each added device is another possible source of poor contacts, power noise, or setup errors.

Use Bit-Perfect Playback Where It Makes Sense

When you want to hear the native resolution of your files or streaming service, configure playback to avoid unwanted processing. Volume normalization, DSP, crossfeed, and resampling can all be useful tools, but they should be deliberate choices rather than accidental defaults.

Bit-perfect playback is not a guarantee of better music. Thoughtful room correction, for example, may produce a far larger improvement than preserving a file’s original sample rate. The point is control. Know whether your player is changing the signal and choose the setting that serves your system and listening priorities.

Give Your Streamer a Stable Network

Network problems do not always sound like obvious dropouts. They can show up as slow browsing, interrupted playback, or an experience that pulls attention away from the record. A reliable network lets your music player do its job without becoming the evening’s troubleshooting project.

Whenever practical, connect your streamer to the router or network switch with Ethernet. A wired connection is generally more consistent than Wi-Fi, especially in homes with thick walls, crowded wireless networks, or several devices streaming at once. Use a properly made cable of sensible length, route it away from power cords when convenient, and do not feel compelled to buy exotic network hardware before solving basic placement and connectivity issues.

Wi-Fi can still work extremely well. If wiring is not realistic, place the router thoughtfully, use the less crowded band available in your home, and make sure the streamer has a strong signal. Mesh systems can help in larger spaces, but node placement matters more than the number of units. Put one where it can receive a healthy signal, not at the farthest possible edge of coverage.

Your network does not need to become a laboratory. Begin with dependable hardware, current firmware, and a connection that remains stable through a full listening session. That is the foundation.

Power Matters, but Context Matters More

Digital audio components are sensitive to their power environment because the power supply supports processing, clocking, and output circuitry. A noisy or underperforming supply can limit the sense of ease, dimensionality, and low-level detail your system is capable of reproducing.

Start with the supplied power adapter if it is properly matched to the streamer and in good condition. Then listen for what your system needs. In a modest setup, speaker placement or a better DAC may be the more productive next move. In a revealing system, a well-designed linear power supply can be a meaningful refinement, particularly when the streamer is already performing at a high level.

The benefits are usually subtle rather than dramatic. You may notice blacker backgrounds, more stable images, or a calmer presentation when complex arrangements build. If a power change makes the sound brittle, overly etched, or simply different without being more musical, trust your ears and return to the configuration that keeps you listening longer.

Place power supplies and wall-wart adapters away from sensitive analog cables where possible. Keep power cords and signal cables separated rather than tightly bundled together. Good cable management is not glamorous, but it can reduce avoidable noise and makes diagnosing problems much easier.

Set Up Your DAC and Volume Control Correctly

A streamer and DAC can both offer digital volume control, fixed output options, and gain settings. Incorrect combinations can reduce usable resolution or create a sudden jump in level. Decide which component will control volume, then configure the other for a predictable operating range.

If you use an integrated amplifier or preamplifier, set the streamer or DAC to fixed output when appropriate and use the analog component for daily volume adjustment. If your system has a power amplifier directly connected to a DAC or streamer, a digital volume control may be necessary. In that case, begin at a low level and confirm the behavior carefully before playing music at normal volume.

Match output levels with care when comparing components. A slightly louder source nearly always sounds more exciting at first, which can lead to the wrong conclusion. Level-matched listening makes it easier to hear genuine differences in tone, timing, and spatial presentation.

Check for Noise Before Buying Anything

Hum, hiss, clicks, and intermittent distortion are not character traits of digital audio. They are clues. Disconnect unused sources, test another input, and make one change at a time. If noise appears when a cable TV box, computer, or charging device is connected elsewhere in the system, you may be dealing with a grounding issue rather than a problem with the streamer.

Start simple: confirm every connection is secure, restart the streamer and router, and update software when a stable release is available. Then isolate components methodically. A short evening of patient testing can save money and point to the real cause.

Use Software That Keeps Music at the Center

Sound quality includes the experience of choosing what to play. A player that unites your local library and favorite services reduces the friction of moving between albums you own and music you want to discover. It also encourages better listening habits: full albums, carefully made playlists, and spontaneous returns to records that deserve another spin.

Organize local files with consistent album artists, artwork, and metadata. A clean library makes a serious collection feel accessible instead of buried on a hard drive. For streaming, choose the highest quality tier that fits your service and connection, but do not let file-format debates replace listening. A great performance in a well-recorded standard-resolution release can be far more involving than an indifferent high-resolution track.

Volumio brings local music, streaming services, and connected audio devices into one music-first environment, whether you are building a Raspberry Pi player or choosing a dedicated streamer. The practical advantage is simple: less app switching, more time with the music.

Listen Before You Change the Next Thing

The most effective way to improve streamer sound is to make changes slowly and listen to familiar recordings. Choose a few tracks with voices, acoustic instruments, dense arrangements, and deep bass. Play them at a comfortable, repeatable volume. Give each change enough time that the novelty wears off.

Pay attention to whether music becomes more believable, not merely brighter or louder. Does a singer sound more present without becoming sharp? Can you follow the bass line when the arrangement gets busy? Do long sessions feel relaxed and involving? Those are better measures than a specification sheet alone.

Your streamer should disappear into the system, leaving the performance intact and your music collection close at hand. Build from a stable network, a clean signal path, sensible power, and thoughtful settings, then let the next album tell you where to go.

The post How to Improve Streamer Sound in Your Hi-Fi System appeared first on Volumio.

18 September, 2026 02:43AM

hackergotchi for Qubes

Qubes

Qubes OS 4.3.2-rc1 is available for testing

The first release candidate (RC) for Qubes OS 4.3.2 is now available for testing. This patch release aims to consolidate all the security patches, bug fixes, and other updates that have occurred since the release of Qubes 4.3.1.

What’s new in Qubes 4.3.2?

  • Default Fedora template upgraded to Fedora 44
  • kernel-latest upgraded to Linux 7.2
  • Numerous bug fixes

When is the stable release?

That depends on the number of bugs discovered in this RC and their severity. As explained in our release schedule documentation, our usual process after issuing a new RC is to collect bug reports, triage the bugs, and fix them. If warranted, we then issue a new RC that includes the fixes and repeat the process. We continue this iterative procedure until we’re left with an RC that’s good enough to be declared the stable release. No one can predict with certainty, at the outset, how many iterations will be required (and hence how many RCs will be needed before a stable release), but we tend to get a clearer picture of this as testing progresses.

Since the changes between 4.3.1 and 4.3.2 are relatively minor, we currently don’t anticipate any major problems requiring a second RC. We currently expect to be able to publish the stable 4.3.2 release around the end of September.

How to test Qubes 4.3.2-rc1

If you’d like to help us test this RC, the best way to do so is by performing a clean installation with the new ISO. As always, we strongly recommend making a full backup beforehand and updating Qubes OS immediately afterward in order to apply all available bug fixes.

As an alternative to a clean installation, there’s also the option of performing an in-place upgrade without reinstalling. However, since Qubes 4.3.2 is a patch release, it’s essentially Qubes 4.3 inclusive of all updates to date, which largely amounts to just using a fully-updated 4.3 installation. By contrast, a clean installation covers other areas that could also benefit from testing, such as the installation procedure, which is why it’s the recommended testing method.

Regardless of your testing method, please help us improve the eventual stable release by reporting any bugs you encounter. If you’re an experienced user, we encourage you to join the testing team.

Known issues in Qubes OS 4.3.2

It’s possible that templates restored in 4.3.2 from a pre-4.3 backup may continue to target their original Qubes OS release repos (#8701). After restoring such templates in 4.3.2, enter the following additional commands in a dom0 terminal:

sudo qubes-dom0-update -y qubes-dist-upgrade
sudo qubes-dist-upgrade --releasever=4.3 --template-standalone-upgrade -y

This will automatically choose the templates that need to be upgraded. The templates will be shut down during this process.

Fresh templates on a clean 4.3.2 installation are not affected. Users who perform an in-place upgrade from 4.2 to 4.3 (instead of restoring templates from a backup) are also not affected, since the in-place upgrade process already includes the above fix in stage 4. For more information, see issue #8701.

View the full list of known bugs affecting Qubes 4.3 in our issue tracker.

What’s a release candidate?

A release candidate (RC) is a software build that has the potential to become a stable release, unless significant bugs are discovered in testing. RCs are intended for more advanced (or adventurous!) users who are comfortable testing early versions of software that are potentially buggier than stable releases. You can read more about Qubes OS supported releases and the version scheme in our documentation.

What’s a patch release?

The Qubes OS Project uses the semantic versioning standard. Version numbers are written as [major].[minor].[patch]. Hence, we refer to releases that increment the third number as “patch releases.” A patch release does not designate a separate, new major or minor release of Qubes OS. Rather, it designates its respective major or minor release (in this case, 4.3) inclusive of all updates up to a certain point. See our supported releases for a comprehensive list of major and minor releases and our version scheme documentation for more information about how Qubes OS releases are versioned.

18 September, 2026 12:00AM

September 17, 2026

hackergotchi for GreenboneOS

GreenboneOS

CVE-2026-85706: CVSS 10 GitLab CE/EE API Flaw Actively Exploited

CVE-2026-85706 (CVSS 10, EPSS 96th pctl), published on September 12th, 2026, is a critical path traversal flaw in the GitLab CE/EE repository Commits API and Repository Files API. Exploitation can allow an unauthenticated attacker to read arbitrary files from the GitLab server on affected self-managed instances. However, the unauthenticated exploit path requires at least one […]

17 September, 2026 10:25AM by Joseph Lee

hackergotchi for Deepin

Deepin

September 16, 2026

hackergotchi for Volumio

Volumio

How to Choose an OEM Audio Streaming Platform

A connected audio product can look exceptional, use premium components, and still disappoint the moment a listener opens the control app. That is why an OEM audio streaming platform is not simply a software component to add near the end of product development. It is the listening experience, the product roadmap, and often the reason a customer returns to the system every day.

For audio manufacturers, the question is not whether streaming belongs in the product. It does. The more useful question is how to introduce it without sacrificing sound quality, brand identity, or the pace needed to bring a new product to market.

What an OEM Audio Streaming Platform Must Do

An OEM streaming platform provides the software foundation for a connected music product. It can power a network streamer, integrated amplifier, active speaker, DAC, or custom installation product, bringing music services, local libraries, internet radio, multiroom capabilities, and device control into one coherent system.

That definition sounds simple, but the work behind it is substantial. A credible platform must recognize music from many sources, maintain service integrations as APIs evolve, handle a changing home network, present album artwork and metadata correctly, and make playback feel immediate. It must also support long-term software maintenance after a product has left the factory.

For high-fidelity brands, the platform has another responsibility: it must respect the audio path. Bit-perfect playback, support for high-resolution formats, reliable clocking strategies, careful driver integration, and predictable control over digital outputs all affect whether a streaming product belongs in a serious hi-fi system.

A platform that does only one of these jobs well can create friction elsewhere. An elegant interface means little if it cannot find a customer’s NAS library. Wide service support is not enough if updates regularly interrupt playback. Great technical specifications lose their meaning if the experience feels generic or difficult to operate.

Start With the Listener, Not the Feature List

The strongest product briefs begin with a real listening moment. Consider the owner who has years of carefully tagged FLAC files, a Qobuz subscription for new discoveries, and a favorite radio station for Sunday morning. They do not want three apps and a manual to move between them. They want their music, available from one familiar place.

This is where an OEM solution can become a meaningful part of a brand’s proposition. The interface should make discovery, library browsing, queue management, and device control feel natural. It should also reflect the type of listener the brand serves. A compact lifestyle speaker may prioritize fast setup and simple presets. A reference DAC or network transport may need deeper control over sample-rate handling, digital inputs, playback settings, and signal-path visibility.

There is no single correct level of complexity. The right choice depends on the product category and the audience. The mistake is treating all streaming users as identical, or assuming audiophiles will accept a difficult interface in exchange for better sound. They expect both.

The interface is part of the product’s voice

A branded app and user experience should feel like an extension of the physical product. The visual language, terminology, setup flow, and available settings all shape perception. This does not mean placing a logo on a generic control surface. It means making thoughtful decisions about what the listener needs to see, what can remain in the background, and how the product expresses its character.

Customization also requires discipline. Every unique workflow, screen, or feature may add development and maintenance obligations. A sensible OEM partner helps distinguish between differentiation that customers will actually feel and customization that only extends the launch schedule.

Sound Quality Requires More Than Format Support

It is easy to compare streaming platforms by supported services and audio formats. Those details matter, but they are only the entry point. The audible result depends on how the software and hardware are integrated as a complete playback system.

An OEM partner should be comfortable working with the manufacturer’s selected processing platform, network implementation, DAC architecture, display hardware, and control scheme. The goal is not merely to make audio play. It is to make the product behave predictably under real conditions, whether it is switching sample rates, recovering from a network interruption, reading a large local library, or playing a long queue without hesitation.

For products aimed at discerning listeners, ask direct questions about the audio path. Can the system preserve native resolution where the hardware supports it? How are volume control and DSP handled? What happens when playback moves between sources? How is gapless playback managed? Can the platform expose meaningful playback information without turning the interface into an engineering dashboard?

The answers should be clear and specific. “High resolution” is a useful capability, but it is not a complete sound-quality strategy.

Integration Should Reduce Risk, Not Move It In-House

Building streaming software internally may appear attractive, particularly for brands with a strong engineering culture. Full control has genuine value. It can make sense when streaming behavior is central to a company’s intellectual property, when the organization has a dedicated software team, and when it is prepared to maintain services and applications for years.

For many audio manufacturers, however, building from scratch moves a large and ongoing risk into the business. Streaming services change. Mobile operating systems change. Security standards change. Customers expect new features after purchase, not a fixed feature set frozen at launch.

An experienced OEM audio streaming platform reduces that burden by supplying proven technology and a development process built around audio products. It allows a manufacturer to focus resources where it has the clearest advantage: industrial design, analog and digital engineering, acoustic performance, distribution, and the identity of the brand.

This does not mean accepting a black box. The best collaboration is transparent. The manufacturer should understand the software architecture, integration boundaries, test process, update policy, and what is required when a new service or hardware revision arrives.

Ask who owns the long-term experience

A connected product is never truly finished at production. Before committing to a platform, establish how firmware releases are planned, tested, delivered, and supported. Clarify responsibility for customer-facing support, bug triage, certification requirements, and compatibility with future mobile devices.

It is also worth examining how the platform behaves when things go wrong. Home networks are unpredictable. Routers restart, Wi-Fi coverage varies, and customers may have complex libraries with inconsistent metadata. A mature system anticipates these realities and gives both the listener and support team useful ways to recover.

Service Choice and Local Music Need Equal Care

Streaming services are essential, but local music remains deeply important to many hi-fi customers. A personal library often represents decades of collecting, ripping, purchasing, and curating. It deserves more than a basic file browser.

Look for library management that handles common network storage setups, preserves artwork and metadata, supports browsing by artist, album, genre, and composer, and remains responsive as collections grow. Classical listeners, in particular, may need richer metadata handling than a conventional artist-and-album model provides.

At the same time, service integrations must be treated as living relationships. Support for TIDAL, Qobuz, Spotify, and internet radio should be reliable, clearly presented, and maintained over time. The platform should bring these sources together without pretending they are identical. A service’s editorial recommendations, a user’s saved albums, and a local library each serve a different purpose in the listening journey.

The result should be a system that encourages music rather than source management. Listeners should spend their time choosing an album, not figuring out which app can play it.

A Partnership Built Around the Product You Want to Make

Choosing an OEM platform is partly a technical evaluation, but it is also a partnership decision. The right team asks about your customer, product family, target price, hardware choices, and ambitions after the first launch. It understands that an active speaker and a flagship streamer may share a software foundation while needing very different expressions.

Volumio brings this perspective from both sides of the listening room: an ecosystem shaped by a global community of music lovers and makers, plus dedicated high-end products hand-assembled in Florence. That experience informs OEM collaborations where sound quality, usability, and a distinctive brand experience must coexist.

A productive development process should include early hardware validation, clear milestones, shared testing criteria, and room for careful tuning before the product reaches reviewers and customers. It should also leave space for future models. A platform that can support an expanding family of products creates continuity for customers and efficiency for the manufacturer.

Choose for the Second Year, Not Only Launch Day

A compelling launch matters, but connected audio products earn their reputation over the months that follow. The initial setup, the first software update, the addition of a favorite music service, and the way a product handles a growing library all become part of the ownership experience.

Choose an OEM audio streaming platform with enough technical depth to protect sound quality, enough flexibility to carry your brand, and enough long-term commitment to keep the product feeling current. When the technology stays quietly dependable, listeners can give their attention to the part that matters: the next record they cannot wait to hear.

The post How to Choose an OEM Audio Streaming Platform appeared first on Volumio.

16 September, 2026 02:44AM

hackergotchi for Tails

Tails

Tails 7.13

Changes and updates

  • Update Tor Browser to 15.0.23.

  • Update the Tor client to 0.4.9.12.

  • Simplify the shutdown procedure.

    Since Tails 7.10, you had to confirm shutting down in a Power Off dialog. For faster shutdowns, we removed this dialog when no application needs to be closed and no document needs to be saved before shutting down.

Get Tails 7.13

To upgrade your Tails USB stick and keep your Persistent Storage

  • Automatic upgrades are available from Tails 7.0 or later to 7.13.

  • If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade.

To install Tails 7.13 on a new USB stick

Follow our installation instructions.

The Persistent Storage on the USB stick will be lost if you install instead of upgrading.

To download only

If you don't need installation or upgrade instructions, you can download Tails 7.13 directly:

16 September, 2026 12:00AM

September 15, 2026

hackergotchi for GreenboneOS

GreenboneOS

Three New JFrog Artifactory CVEs Actively Exploited in the Wild

CVE-2026-82329, CVE-2026-42018, and CVE-2026-42016, all affecting JFrog Artifactory, were added to CISA’s Known Actively Exploited (KEV) in September 2026 [1][2][3]. Artifactory acts as a central repository for software build artifacts, binaries, packages, containers, files, releases, and increasingly AI/ML artifacts. A compromise of Artifactory could allow an attacker to steal sensitive artifacts and credentials, tamper with […]

15 September, 2026 01:01PM by Joseph Lee

hackergotchi for VyOS

VyOS

Why Multi-Cloud Routing Creates VPN Gaps: Here's How to Fix Them

Organizations go multi-cloud for good reasons, resilience and pricing leverage among them. What rarely gets budgeted is what happens to the network team once those workloads are actually live in AWS, Azure, and a datacenter at the same time.

Routing tables drift out of sync. VPN tunnels accumulate faster than anyone documents them. And the failover design that looked airtight in the diagram takes three times as long as planned the first time someone actually pulls the plug.

I want to be precise about why this happens, because it is not a monitoring problem, and another dashboard will not fix it. It is a routing architecture problem.

15 September, 2026 12:00PM by Gizem Yigit (g.yigit@vyos.io)

hackergotchi for ARMBIAN

ARMBIAN

Github Highlights

Github Highlights

This week&aposs work centers on new board and SoC enablement, a broad wireless driver and firmware overhaul, and continued kernel, boot, and installer refinements.

Board support expanded on multiple fronts. A new RK3562 family was introduced alongside the KICKPI K3B with mainline U-Boot and Linux, and mainline 7.2 bring-up landed for the S5P6818 platform covering NanoPC-T3+, NanoPi M3, and Fire3. The FriendlyELEC NanoPi R28S, Wildfire Lubancat 3 v2, OrangePi CM5 Base edition, and SpacemiT Musebook (current branch) were added, while the Mixtile Edge2 and Blade 3, Orange Pi 5 Max/Ultra, and Banana Pi M2 Ultra received targeted fixes for Bluetooth, eMMC, Ethernet, and thermal behavior.

Wireless support saw substantial cleanup and expansion. The rtl8723ds driver underwent an extensive warning-elimination pass — addressing -Wmissing-prototypes, -Wempty-body, -Wmaybe-uninitialized, -Wrestrict, and -Warray-bounds findings — with parallel improvements to rtl8189es/fs, rtl8192eu, rtl8852bs, and uwe5622. Firmware additions include MT7986 Wi-Fi and Airoha EN8811H blobs, AIC8800 D80 SDIO names, and AP6212 NVRAM for S5P6818 boards, complemented by Bluetooth and 5 GHz Wi-Fi fixes on Rockchip and AYN Odin 2 targets.

On the platform side, the mainline kernel was bumped to 7.3-rc2, a critical stmmac resume-ordering backport restores Ethernet after suspend on RK3588, and sunxi 6.18 and 7.2 gained fixes for eMMC boot hangs and post-reboot Ethernet loss. The installer engine now supports extlinux boards and native USB/NVMe boot on RPi-style hardware, zram-config was corrected for modern kernels, and BSP changes make SSH host key regeneration power-loss safe. Build infrastructure improvements include ORAS gitball use for U-Boot, better shallow-export handling during merge windows, and expanded CI coverage.

#Armbian #EmbeddedLinux #Rockchip #SBC #KernelDevelopment

Changes

15 September, 2026 01:02AM by Michael Robinson

hackergotchi for Qubes

Qubes

QSB-119: Potential attacker-controlled format string in qvm-open-in-vm

We have published Qubes Security Bulletin (QSB) 119: Potential attacker-controlled format string in qvm-open-in-vm. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions.

Qubes Security Bulletin 119


             ---===[ Qubes Security Bulletin 119 ]===---

                              2026-09-15

     Potential attacker-controlled format string in qvm-open-in-vm

User action
------------

Continue to update normally [1] in order to receive the security updates
described in the "Patching" section below. No other user action is
required in response to this QSB.

Summary
--------

Under certain circumstances (see "Technical details" below), if the user
invokes qvm-open-in-vm (either directly or through the "Edit in
disposable qube" GUI integration) on a file with an attacker-controlled
filename or path, the attacker might be able to execute code in the qube
in which the user invoked qvm-open-in-vm.

Impact
-------

An attacker who successfully exploits this vulnerability can take
control over the qube in which the user invoked qvm-open-in-vm.

Affected systems
-----------------

All supported Qubes OS releases are affected. Among official Qubes OS
templates, only Debian templates are affected.

Technical details
------------------

When qvm-open-in-vm is invoked with a file (not an URI), the source-side
part of the qrexec call is handled by the qopen-in-vm helper program.
After sending the file content to the other side, qopen-in-vm tries to
open a temporary file alongside the original file in order to save the
response in case the user has edited the file in the target qube. If
creating this file fails (e.g., because the directory is read-only),
qopen-in-vm creates a temporary file in /tmp and shows an error message
to the user. When printing this error message, it incorrectly invokes
the gui_nonfatal function, such that the original filename ends up in a
printf format string, which is unsafe.

For this vulnerability to be exploitable, multiple conditions must be
fulfilled:

 1. The attacker must trick the user into using qvm-open-in-vm to open a
    file that either
    a. has a filename (i.e., the last component of the file's path)
       longer than 248 bytes or
    b. is located in a directory that is not writable.

 2. The path (but not necessarily its last component) must
    contain printf-style conversion specifiers (such as '%n').

 3. qvm-open-in-vm must not have been invoked with the --view-only flag.

 4. The target qube must either
    a. send back the file content because its mtime changed (which
       usually happens because the user saved the file being edited,
       even if merely by overwriting it with the same content) or
    b. be compromised by the attacker.

 5. The build of qvm-open-in-vm must have been compiled without
    _FORTIFY_SOURCE hardening enabled (or set to a level below 2). Due
    to an unfortunate interaction between our build script and the way
    Debian handles this option, this hardening was not enabled for our
    Debian packages. (This problem did not affect our Fedora packages,
    for which the hardening was correctly enabled.) With enabled
    hardening, the program safely aborts with an error, making the bug
    unexploitable.

The first person to report this vulnerability tested its exploitability
on his system. He found that it was successfully exploited in less than
3 % of attempts. Moreover, his demonstration required a very long path
with multiple nested directories and that contained many format
specifiers. In the real world, the attacker may control only the last
part of the file name in most cases. And even when they do control the
full path, many users would likely find such a path suspicious, which
would likely make it more difficult for an attacker to successfully
trick the user into opening such a path.

Discussion
-----------

Normally, we do not issue Qubes security bulletins for purely "in-VM"
vulnerabilities (like this one) that do not involve crossing the VM
security boundary. However, we have decided to make an exception in this
case, since this is a bug in our code and since qvm-open-in-vm is
specifically intended to operate on untrusted input.

While qvm-open-in-vm is designed to be hardened, keep in mind that
handling less trusted data in a more trusted VM still can be risky for
other reasons, for example:

 - Unsafe handling of attacker-controlled paths is an easy mistake to
   make in the shell.
 - A file explorer could render the thumbnail of an untrusted file with
   a buggy parser.
 - You might accidentally open the file with an application other than
   qvm-open-in-vm, exposing the full attack surface of that application.

Patching
---------

The following package contains the security update that addresses the
vulnerability described in this bulletin:

  For Qubes 4.3, in affected templates and standalones:
  - qubes-core-agent version 4.3.48

This package will migrate from the security-testing repository to the
current (stable) repository over the next two weeks after being tested
by the community. [2] Once available, the package should be installed
via the Qubes Update tool or its command-line equivalents. [1]

In order for this security update to take effect, all affected templates
must be updated with the package above, then shut down. Afterward, all
qubes based on these templates (including disposables) must be
restarted. All affected standalones must be updated with the package
above.

Credits
--------

This vulnerability was first reported by Giulio Berra. Shortly after, it
was independently reported by Rafal Wojtczuk.

References
-----------

[1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html
[2] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html

--
The Qubes Security Team
https://www.qubes-os.org/security/

Source: qsb-119-2026.txt

Marek Marczykowski-Górecki’s PGP signature

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmqpVWsACgkQ1lWk8hgw
4GqZXQ//bjrYeDHG0AF5Zute1i8YgJD1TbvLAmI3wXDe5xJKL+gNhHyguqh3qtP3
cI5xGdY/GT940IP6QO2qHDnVxfU6QMuxEfMy6VSW0GeQ/lFbLco5Edt9UpELJCG2
h1IzyTNgtSm3C6pvrefQs6DL/A39Zl2QST0xTs/ECsJXSE7pc5BL7kO4HnSvSseQ
BMFDmsLFx/JcU4s8tBGPSGH7/8Oq7YYn/Ue2LaNk3z1s2l/V1H9Jpk8dpp/yA1Uh
oGkRcqio93YkqBArmJd9G1xCn33dJQHd1vffMNoDTNbuZJbrtm4ZhZSVLJ3W3CA0
ZTMaO34M83aImSaTPA+a7VLhBdBDXkfn/8ZHrT51m2flQL1uCE3C8l5H+bQYMeaE
EJE3I1b7v3NZoxJ6gXk/+YSWM+E7XbuSrc6f3CYpUue0B6vhHO29xXc71EiFWz1b
1zW4QSBIUd4yEl4B+tH5ZMB3pacSbTQsW1SCTU3I428meTFJW6yjN4cPNruHF2lH
Jz3JQIoKdXohJxruPaCh/ZAEWon+cz7ho98cvwH/x2zi0DoT3cyT6EtTVlD4Dg5c
/XiEC0ku+IARXCoYiQbMto5PiYzcoVbwv4H0iwuzOLOPwbPKhdfwJQinlMjd2ZDb
OdFehXOnmM34nwBcUANGV5ygFIttVR9bRBlz/2Wrvu88+nr7TGM=
=yTNV
-----END PGP SIGNATURE-----

Source: qsb-119-2026.txt.sig.marmarek

Simon Gaiser (aka HW42)’s PGP signature

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmqpXmAACgkQSsGN4REu
FJDGoQ//QmxpMyyFvnG9srj/zYaYuFcyWd7o2lqd4ugEAQVyNJOjAl0GlXnvKVWw
frH+QlZXT/BlQuV6ltzmmh2W5C43JtbBF+O6+Wnc7Imc6bDFf3rjo8xWdx6sptKA
wUVcFX/pO66TTMGjGsSLZNgB6HqZnokdANYpB7MkxxeV6cBPAjFwUoLvDSrba8KG
k8KBdBGw+FJ3Zt4583fW3DwKVJlbtp7SEpQG8HMswU+SHQBKclR+ceye/uwMzoej
HEI0Vg2Gd3lAewa34zxicNsHlHh7OKsGFI027BxdIpZoEwbLzMThfA0+TH6t/JsN
UEzh9lXD0cpuJIxHe0bSGrJL7kJN5CV9kztstr+YuH3lx52Blq7UAtw/8swvxvBB
8aFSeP8aXb9ldXuNtAxf581OmHAGmrxRpCOiQb0ehfBuNd6aQb+J29bjy1fc7F9e
9yaTlVk1cFSjKWCG/24IK2zz96sdWcoJMIE1FXNuwms4MAUNUFMPFqCT0keMeiqj
yaJfWvXtoAJQPGrYClbC7D+VYKFYokBbB7c1nabpCzzuJ9uFXuQfHsb7PMYnAJh4
2PLat+BiUxiO3AATHtcrl4DEwRlu7RYW99EB3ax6WUDyxBAVWHnZ8NVoRLgj4bfr
7FJjE0wu8mKT3on0o6RLlifo7mXl1lmXZM6YcB1QD0+/zod0Q6c=
=Zo3p
-----END PGP SIGNATURE-----

Source: qsb-119-2026.txt.sig.simon

What is the purpose of this announcement?

The purpose of this announcement is to inform the Qubes community that a new Qubes security bulletin (QSB) has been published.

What is a Qubes security bulletin (QSB)?

A Qubes security bulletin (QSB) is a security announcement issued by the Qubes security team. A QSB typically provides a summary and impact analysis of one or more recently-discovered software vulnerabilities, including details about patching to address them.

Why should I care about QSBs?

QSBs tell you what actions you must take in order to protect yourself from recently-discovered security vulnerabilities. In most cases, security vulnerabilities are addressed by updating normally. However, in some cases, special user action is required. In all cases, the required actions are detailed in QSBs.

What are the PGP signatures that accompany QSBs?

A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all QSBs so that Qubes users have a reliable way to check whether QSBs are genuine. The only way to be certain that a QSB is authentic is by verifying its PGP signatures.

Why should I care whether a QSB is authentic?

A forged QSB could deceive you into taking actions that adversely affect the security of your Qubes OS system, such as installing malware or making configuration changes that render your system vulnerable to attack. Falsified QSBs could sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project.

How do I verify the PGP signatures on a QSB?

The following command-line instructions assume a Linux system with git and gpg installed. (For Windows and Mac options, see OpenPGP software.)

  1. Obtain the Qubes Master Signing Key (QMSK), e.g.:

    $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc
    gpg: directory '/home/user/.gnupg' created
    gpg: keybox '/home/user/.gnupg/pubring.kbx' created
    gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc'
    gpg: /home/user/.gnupg/trustdb.gpg: trustdb created
    gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported
    gpg: Total number processed: 1
    gpg:               imported: 1
    

    (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.)

  2. View the fingerprint of the PGP key you just imported. (Note: gpg> indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.)

    $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494
    gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc.
    This is free software: you are free to change and redistribute it.
    There is NO WARRANTY, to the extent permitted by law.
       
       
    pub  rsa4096/DDFA1A3E36879494
         created: 2010-04-01  expires: never       usage: SC
         trust: unknown       validity: unknown
    [ unknown] (1). Qubes Master Signing Key
       
    gpg> fpr
    pub   rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key
     Primary key fingerprint: 427F 11FD 0FAA 4B08 0123  F01C DDFA 1A3E 3687 9494
    
  3. Important: At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you must authenticate the QMSK out-of-band. Do not skip this step! The standard method is to obtain the QMSK fingerprint from multiple independent sources in several different ways and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key.

    Tip: After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future.

  4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with q.

    gpg> trust
    pub  rsa4096/DDFA1A3E36879494
         created: 2010-04-01  expires: never       usage: SC
         trust: unknown       validity: unknown
    [ unknown] (1). Qubes Master Signing Key
       
    Please decide how far you trust this user to correctly verify other users' keys
    (by looking at passports, checking fingerprints from different sources, etc.)
       
      1 = I don't know or won't say
      2 = I do NOT trust
      3 = I trust marginally
      4 = I trust fully
      5 = I trust ultimately
      m = back to the main menu
       
    Your decision? 5
    Do you really want to set this key to ultimate trust? (y/N) y
       
    pub  rsa4096/DDFA1A3E36879494
         created: 2010-04-01  expires: never       usage: SC
         trust: ultimate      validity: unknown
    [ unknown] (1). Qubes Master Signing Key
    Please note that the shown key validity is not necessarily correct
    unless you restart the program.
       
    gpg> q
    
  5. Use Git to clone the qubes-secpack repo.

    $ git clone https://github.com/QubesOS/qubes-secpack.git
    Cloning into 'qubes-secpack'...
    remote: Enumerating objects: 4065, done.
    remote: Counting objects: 100% (1474/1474), done.
    remote: Compressing objects: 100% (742/742), done.
    remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591
    Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done.
    Resolving deltas: 100% (1910/1910), done.
    
  6. Import the included PGP keys. (See our PGP key policies for important information about these keys.)

    $ gpg --import qubes-secpack/keys/*/*
    gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported
    gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory
    gpg: no valid OpenPGP data found.
    gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key
    gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported
    gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported
    gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys
    gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported
    gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported
    gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported
    gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported
    gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported
    gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key
    gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported
    gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported
    gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key
    gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported
    gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key
    gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported
    gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed
    gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported
    gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory
    gpg: no valid OpenPGP data found.
    gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported
    gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported
    gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory
    gpg: no valid OpenPGP data found.
    gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported
    gpg: Total number processed: 17
    gpg:               imported: 16
    gpg:              unchanged: 1
    gpg: marginals needed: 3  completes needed: 1  trust model: pgp
    gpg: depth: 0  valid:   1  signed:   6  trust: 0-, 0q, 0n, 0m, 0f, 1u
    gpg: depth: 1  valid:   6  signed:   0  trust: 6-, 0q, 0n, 0m, 0f, 0u
    
  7. Verify signed Git tags.

    $ cd qubes-secpack/
    $ git tag -v `git describe`
    object 266e14a6fae57c9a91362c9ac784d3a891f4d351
    type commit
    tag marmarek_sec_266e14a6
    tagger Marek Marczykowski-Górecki 1677757924 +0100
       
    Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351
    gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST
    gpg:                using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A
    gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full]
    

    The exact output will differ, but the final line should always start with gpg: Good signature from... followed by an appropriate key. The [full] indicates full trust, which this key inherits in virtue of being validly signed by the QMSK.

  8. Verify PGP signatures, e.g.:

    $ cd QSBs/
    $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt
    gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST
    gpg:                using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A
    gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full]
    $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt
    gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST
    gpg:                using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490
    gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full]
    $ cd ../canaries/
    $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt
    gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST
    gpg:                using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A
    gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full]
    $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt
    gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST
    gpg:                using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490
    gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full]
    

    Again, the exact output will differ, but the final line of output from each gpg --verify command should always start with gpg: Good signature from... followed by an appropriate key.

For this announcement (QSB-119), the commands are:

$ gpg --verify qsb-119-2026.txt.sig.marmarek qsb-119-2026.txt
$ gpg --verify qsb-119-2026.txt.sig.simon qsb-119-2026.txt

You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the QSB-119 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

15 September, 2026 12:00AM

September 14, 2026

hackergotchi for GreenboneOS

GreenboneOS

“MikroTrick” Exploit Chain Targets SSH-Exposed MikroTik RouterOS Devices

According to CERT Polska, active exploitation of MikroTik RouterOS has been underway since at least September 2nd, 2026. The chain leverages CVE-2026-67276 (CVSS 9.2) and CVE-2026-86060 (CVSS 9.2) against devices whose SSH service is reachable from public networks. A successful breach yields full control of the targeted system. MikroTik has published fixes for the flaws […]

14 September, 2026 11:27AM by Joseph Lee

hackergotchi for Volumio

Volumio

Rivo Transport Review for Serious Listening

A digital transport has one job that matters: deliver the music you love to your DAC without turning every listening session into an app-management exercise. This Rivo transport review focuses on how that promise translates to a real hi-fi system, from the first connection to the quieter, more revealing moments that make you stay with an album until the end.

Rivo is not a DAC, an amplifier, or a lifestyle speaker. It is a dedicated network music transport for listeners who already own a DAC they value and want a better, more focused way to feed it. That distinction is central to both its appeal and its limitations.

What Rivo Is Designed to Do

Rivo sits between your music sources and your DAC. It brings local libraries, streaming services, internet radio, and connected digital sources into one control experience, then sends a digital signal to the DAC through the output that best suits the system.

That makes it a particularly sensible choice for an established hi-fi setup. Perhaps you have a DAC built into an integrated amplifier, a separate converter with a sound you know well, or an outboard DAC that has become the heart of your system. In each case, Rivo lets you improve the streaming front end without replacing components that already earn their place on the rack.

The product is hand-assembled in Florence and designed around a simple idea: a music transport should feel like part of a serious audio system, not like a generic computer placed near one. Its compact, purposeful enclosure and dedicated architecture reflect that intention. Rivo is made for the listener who would rather choose a record than troubleshoot a signal path.

Rivo Transport Review: The Listening Case

A transport does not add analog character in the way a DAC, preamp, or power amplifier might. Its influence is more fundamental. It provides a stable, considered path for digital music before conversion, while making the experience of finding and playing that music easier.

In a revealing system, that can mean more than convenience. When the source is dependable, the listener can concentrate on timing, texture, space, and dynamics rather than wondering whether a stream will stop, a device will disappear, or a different app is needed for every service. The benefit is not a dramatic hi-fi effect that can be reduced to a slogan. It is a more settled relationship with the system.

Rivo supports high-resolution playback and is built to preserve the capabilities of a compatible DAC. The exact formats and maximum resolutions that matter will depend on the output you use and on the DAC itself, so this is worth checking before purchase if DSD or a particular PCM resolution is essential to your collection. For most listeners, the more meaningful result is that standard and high-resolution material can live side by side in one library without forcing a change in listening habits.

There is also a practical advantage to a dedicated transport over using a phone, tablet, or general-purpose computer as the source. The music player remains available to the whole household, and the system can be controlled without dedicating a personal device to playback. Cue an album from the couch, add a favorite to a queue, or browse a local collection while a radio station plays in another room. It feels less like casting and more like owning a music system.

Connections That Respect Your DAC Choice

Rivo offers several digital output options, including USB, coaxial S/PDIF, AES/EBU, and I2S through HDMI. This flexibility is one of its strongest qualities because digital inputs are not interchangeable in every system.

USB is often the natural starting point for a modern standalone DAC, particularly where the DAC’s USB input supports the widest range of formats. AES/EBU is valuable for DACs with a balanced digital input and can be a preferred connection in systems built around professional-style digital hardware. Coaxial S/PDIF remains an excellent, familiar option for many integrated amplifiers and converters. I2S can be compelling when both components support matching pin assignments, but that detail matters: HDMI-shaped I2S connections are not universally wired the same way.

The right output is therefore not a matter of status. It is the one that is properly implemented by your DAC and sounds right in your system. If possible, begin with the connection recommended by your DAC manufacturer, then compare another option only after the basics are stable. A well-chosen cable and a correct configuration are more useful than chasing a complicated chain of adapters.

Rivo is also network-ready for wired or wireless use. Ethernet is the sensible default for a fixed hi-fi system, especially if your library is stored on a network drive or your home Wi-Fi has busy periods. Wireless can still be the right answer where a cable run is impractical. The best choice is the one that lets playback remain reliable without making the room less livable.

One Library, Fewer Fragments

The software experience is where a dedicated transport either earns its role or becomes another box to maintain. Rivo runs on Volumio, bringing local files, major streaming services, web radio, and network storage into a single music environment.

For listeners with years of carefully ripped CDs, downloaded albums, and newly saved streaming favorites, this matters. A library is more than a folder of files. It is the accumulated map of what you have heard, what you return to, and what you want to share. Rivo is designed to make that library accessible alongside streaming rather than treating local music as an afterthought.

The interface can be controlled from a phone, tablet, or computer on the same network. That familiar device-first approach keeps the hardware itself clean and focused. You can search across sources, browse by artist or album, build a queue, and return to recently played music without moving among disconnected apps.

The experience is not identical across every service, and it should not be presented as such. Features such as recommendations, editorial content, and service-specific discovery tools remain shaped by the streaming platform. But for playback and library management, having a consistent home for your music can remove a surprising amount of friction.

Who Will Get the Most From Rivo?

Rivo makes the strongest case for a listener who already has a DAC worth keeping. It may be the DAC in a high-quality integrated amplifier, a separate converter chosen after careful auditions, or part of an existing digital setup that has been limited by an aging streamer or a computer-based source.

It also suits people who want to bring several musical lives together: a NAS full of lossless files, a favorite streaming subscription, internet radio for discovery, and perhaps a USB drive containing a smaller curated collection. Instead of asking which app owns which album, the system gives you a single place to begin.

For builders, Rivo can be an appealing step up from a DIY player. Volumio’s free software remains a rewarding route for Raspberry Pi, PC, and Tinker Board projects, especially for listeners who enjoy selecting hardware and shaping every detail. Rivo serves a different need. It provides a finished, purpose-built transport for those who want the same music-first philosophy in a refined component designed for the hi-fi rack.

When Rivo May Not Be the Right Fit

The clearest trade-off is simple: Rivo does not include a DAC. If you need both streaming and digital-to-analog conversion in one component, a network player with an integrated DAC may be a more direct fit. Likewise, if your system relies entirely on analog inputs and has no digital input available, adding Rivo means adding a DAC as well.

It is also not aimed at the listener whose only requirement is occasional background streaming from one phone app. Rivo rewards attention to a broader collection and a better audio chain. Its value grows when it becomes the regular front door to listening, not an accessory used once a month.

Before choosing any transport, take stock of the DAC inputs you have, the services you use most, where your library is stored, and whether Ethernet is available. Those four answers will tell you more than a long feature list.

For the listener with a capable DAC and a collection that deserves more than scattered apps, Rivo offers a thoughtful way to make the system feel whole again. Put on an album you know by heart, begin with the connection your DAC favors, and give the music enough time to show you what a dedicated source can bring to the room.

The post Rivo Transport Review for Serious Listening appeared first on Volumio.

14 September, 2026 02:42AM

September 12, 2026

hackergotchi for ArcheOS

ArcheOS

Preserving the Past: Ötzi's Digital Twin

 Hello everyone,

Our article regarding the 3D documentation of Ötzi and the archaeological artifacts found with him has been published in the scientific journal Heritage. The open-access paper can be read and downloaded directly from the journal's website or on ResearchGate .

I had previously teased a few of these topics here on ATOR—such as developing a 3DHOP extension to view the mummy in X-ray mode and utilizing the open-source DCMTK libraries to analyze DICOM data from CT scans. However, the new paper details the project's specific challenges and the solutions adopted.


In particular, the article explains:

  •     How we achieved higher detail in surveying leather artifacts using Displacement Mapping, a technique we first experimented with during the Forensic Facial Approximation (FFA) of Santa da Genova;
  •     How we overcame challenges related to specular reflections on non-Lambertian surfaces;
  •     How, in the case of the bear-fur cap, we applied neural radiance fields (NeRF) algorithms using the open-source software nerfstudio;
  •     How we reconstructed a multimodal Digital Twin of Ötzi, capable of simultaneously displaying both the mummy’s 3D surface model (obtained via SfM) and the internal skeletal structure (derived from CT DICOM data).


The seeds of this research were presented in Turin during ArcheoFOSS 2023, but this paper expands significantly on the methodologies developed throughout the Ötzi project.


As always, all software tools used in this work are FLOSS. You can also read the official press release from the South Tyrol Museum of Archaeology here.



I hope you find the article useful. Have a nice day!


12 September, 2026 04:33PM by Luca Bezzi (noreply@blogger.com)

hackergotchi for Volumio

Volumio

Audio OEM: Build a Streamer People Want

A beautiful component can earn attention at a hi-fi show. What earns a permanent place in a listening room is the experience after the customer gets home. For an audio OEM, that experience is increasingly defined by software: how quickly music starts, whether a local library feels alive, how naturally streaming services fit together, and whether the product remains reliable years after purchase.

Connected audio is no longer an optional add-on to a traditional hardware range. It is where listeners choose music, manage their systems, discover artists, and form an opinion about a brand every day. Building that experience well requires more than adding a network module to an existing amplifier, DAC, or speaker.

The connected product is the real product

A network streamer sits at the meeting point of several expectations that used to be separate. A customer may want to play a carefully tagged NAS library one evening, use Qobuz the next, send music from a phone during a dinner party, and control volume across an integrated system without thinking about protocols or source switching.

From the listener’s perspective, these are simple requests. For a manufacturer, they involve streaming integrations, library indexing, playback architecture, control apps, hardware drivers, account authentication, network behavior, and ongoing support. A product can sound extraordinary and still create frustration if its interface is slow, its setup process is brittle, or software maintenance is treated as a one-time launch task.

That is why the strongest connected products begin with a clear listening promise. Is the goal to make a reference DAC easier to live with? To bring a brand’s amplifier heritage into multiroom listening? To give a compact all-in-one system the confidence of a serious source component? The technical choices should serve that promise, not obscure it.

What an audio OEM partnership should provide

An audio OEM relationship is often described as a shortcut to market. Speed matters, but it is not the full value. The right partner gives a brand a mature foundation while leaving room for the product to feel recognizably its own.

That foundation should include dependable playback from local and networked sources, major streaming-service support, a coherent control experience, and an update path that can evolve with changing services and customer expectations. It should also account for the less visible work: certification requirements, security updates, diagnostic tools, provisioning, and the support questions that arrive after thousands of units are in homes.

For a hi-fi manufacturer, this allows internal engineering teams to concentrate on the areas where they create genuine distinction. That may be analog output design, clocking, power supply architecture, industrial design, speaker integration, or a carefully voiced amplifier stage. It is a better use of expertise than repeatedly rebuilding the basic plumbing of digital music playback.

There is a trade-off. A fully bespoke platform can provide maximum control, but it brings a long development cycle and a permanent software obligation. A ready-made platform can launch sooner and benefit from proven behavior, but only if it is flexible enough to support the brand’s hardware, visual language, and intended customer journey. The practical answer is rarely all-or-nothing. Most successful projects pair a stable music platform with purposeful customization.

Differentiation is not just a new control app

It is tempting to define differentiation through appearance alone: a new app skin, a front-panel display, or a distinctive enclosure. These choices matter, particularly in premium audio, where an object should feel at home beside the rest of a system. But the deeper differentiators are often felt rather than announced.

A listener notices whether browsing an album collection is immediate. They notice whether the product wakes reliably, remembers its state, and handles high-resolution playback without ceremony. They notice whether a search result makes sense when local albums and streaming catalog results appear together. Those details create confidence, and confidence gives customers a reason to stay with a product instead of replacing it when their habits change.

A strong platform should therefore be customizable at the level that matters. Manufacturers may need tailored input behavior, unique display flows, product-specific settings, branded onboarding, or integration with their own control ecosystem. The objective is not to make proven software unrecognizable. It is to make the overall experience feel intentional.

Start with the listening journey, then specify the hardware

Hardware requirements become clearer when they are built around real use cases. Consider the difference between a dedicated transport feeding an external DAC and an all-in-one amplifier with streaming built in. Both may share network and software foundations, yet their priorities are different.

The transport owner may expect detailed control over digital outputs, playback formats, and DAC compatibility. The all-in-one owner may value clear setup, volume behavior, input selection, and an interface the entire household can use. A portable or compact product may need fast Wi-Fi provisioning and minimal physical controls. A flagship component may call for a high-resolution display, elaborate metadata presentation, and deep system integration.

These decisions affect processing power, memory, storage, connectivity, display hardware, thermal design, and the relationship between the playback engine and audio board. They also affect the test plan. A product intended for an enthusiast with a wired network and a large library should still be evaluated in the imperfect conditions found in real homes: crowded Wi-Fi, mesh routers, changing passwords, mixed file formats, and family members who expect music to work on the first attempt.

This is where experienced integration pays for itself. The challenge is not merely proving that a prototype plays music in a lab. It is ensuring that the finished product behaves gracefully across a wide range of systems and routines.

Updates are part of the ownership experience

Digital music changes after a product ships. Streaming services adjust their requirements. Mobile operating systems evolve. New playback capabilities emerge. Security expectations rise. A connected component that cannot be maintained gradually becomes less valuable, regardless of the quality of its audio circuitry.

Manufacturers should treat the update strategy as part of the product specification from day one. That means deciding how updates are delivered, how releases are tested, what happens if an installation is interrupted, and how customers learn about useful new features without being overwhelmed by technical detail.

It also means setting honest expectations. Frequent updates are not always a sign of quality if they introduce instability. Conversely, silence is not reassuring when services and devices around the product continue to change. The ideal cadence is measured: regular maintenance, careful validation, and meaningful improvements that respect a customer’s time and listening habits.

A proven platform can reduce this burden because its update mechanisms, device management, and playback behavior have already met a broad community of users. Volumio brings that perspective from an ecosystem shaped by both dedicated hi-fi components and hands-on music lovers building their own players.

The questions worth asking before development begins

Before selecting a software and integration partner, a manufacturer should look beyond the feature checklist. Features can appear equivalent on a presentation slide while the real-world experience differs substantially.

Ask how local libraries are indexed and presented, not only which file formats are supported. Ask how service integrations are maintained when APIs change. Ask whether the platform can accommodate the intended hardware architecture and user interface. Ask how issues are diagnosed after deployment, and who owns each layer of support.

It is also worth asking which parts of the experience can be shaped without creating an expensive fork that becomes difficult to maintain. A good partner will be direct about boundaries. Some standardized behaviors protect reliability and make future updates practical. Other areas should be open to design because they are central to the manufacturer’s identity.

Finally, evaluate the partnership as a long-term collaboration rather than a software purchase. Connected products have a lifecycle. The teams involved need a shared way to prioritize improvements, investigate field issues, and make thoughtful decisions when a new opportunity or constraint appears.

Build for the moment music becomes personal

The most compelling connected components do not ask customers to think about software. They let a favorite album begin with the right sense of occasion, whether it comes from a decades-old local collection or a newly discovered release. The interface recedes, the system feels coherent, and the brand earns trust through every ordinary listening session.

That is the standard worth designing for: not simply a streamer that can connect, but a music experience that gives people another reason to sit down, choose an album, and listen.

The post Audio OEM: Build a Streamer People Want appeared first on Volumio.

12 September, 2026 02:08AM

September 11, 2026

hackergotchi for Univention Corporate Server

Univention Corporate Server

Who Does the Cloud Trust When You Log In?

Around 5,000 Dropbox accounts were accessed using Lenovo IDs that had apparently not been properly verified. The incident highlights an aspect of cloud security that is often overlooked in public debate. This is not about a conventional security vulnerability, but about whose judgement a service relies on when it accepts a login.

Dropbox allows users to sign in with a password or through accounts held with other providers, including Google, Apple and Lenovo. These providers act as authentication services. Users who sign in this way authenticate with the third-party provider. The email address serves as the link between the two services.

Anyone could create a Lenovo ID simply by entering an email address. Lenovo did not, however, check whether the person creating the account actually had access to that mailbox. Anyone who knew or guessed the email address associated with another person’s Dropbox account could therefore create a new Lenovo ID and use it to sign in to Dropbox. Dropbox accepted this as sufficient proof of identity, provided two-factor authentication (2FA) was not enabled for the account. This is how an attacker gained access to the affected accounts.

A successful login says little about someone’s identity

When users sign in to a digital service, another provider often verifies their identity. The application then receives only confirmation that the user has been successfully authenticated. This creates a chain of trust: the application relies on the authentication service, which in turn depends on the reliability of the accounts and evidence it uses.

That is what makes this case significant. No Dropbox password was guessed or stolen. All it took was a Lenovo ID that anyone could create. Dropbox accepted the resulting confirmation without questioning how reliable it was. In other words, a successful login did not answer the crucial question in this case: was the person signing in really who they claimed to be?

This is a significant security risk

An incident like this is serious even for a personal account. When companies store business data in the cloud, trade secrets, personal data, internal communications, and information from customers and partners are at stake.

Few organisations would accept a Lenovo ID for access to their own corporate network. Yet when the same data is accessed through a cloud service, organisations often apply different standards and rely on the provider’s authentication mechanisms.

At a minimum, a service must authenticate employees exclusively through their organisation’s authentication service. It must be possible to disable all other sign-in methods.

Before approving a service such as Dropbox, organisations must therefore establish which identity sources it accepts and how those sources verify identities. They must also check whether additional authentication factors can be made mandatory, who can change these settings, and how access rights are revoked when employees change roles or leave the organisation. These checks remain necessary, regardless of the provider’s size or how well known it is.

Why authentication services should be open source

The same applies to external identity services such as Microsoft Entra ID and Okta. They are often central components of modern IT architectures, but may in turn trust systems that are unknown to the organisations using them. With some caveats, this also applies to directory services operated in-house, such as Active Directory. Without access to the source code, it is impossible to fully verify whether a system contains deliberate or unintended mechanisms for bypassing authentication requirements. Where a service runs does not, by itself, answer that question.

This is why the authentication service itself must be open source and capable of being operated independently. Only when the source code is accessible can organisations examine which bypass mechanisms exist, which dependencies a service has, and which sign-in methods it actually accepts. This also makes independent audits possible. Depending on the solution, organisations retain greater control over how the service is operated and developed.

The German Federal Office for Information Security (BSI) rightly points out that using free and open-source software does not, by itself, guarantee a secure system. Open-source software must still be maintained and operated securely. However, the BSI also notes that open-source software offers significant strategic advantages in managing security. That is where its value lies: open source provides a key foundation for a high level of security.

Digital sovereignty starts with access

Digital sovereignty is often associated with where data is stored or which cloud infrastructure an organisation chooses. Yet it begins with digital identity. An organisation must be able to understand and control who verifies identities, which systems trust one another, and who can change or revoke those relationships. Without that control, it remains unclear on what basis access to the organisation’s data is granted.

By using a cloud service, a company transfers part of its IT operations to an external provider. Responsibility for its data and for access to that data remains with the company.

The Dropbox-Lenovo case is therefore more than an isolated security incident. It illustrates why the sign-in methods used by cloud services matter: one system accepts another system’s assertion and uses it to decide who can access data. The organisation using the service may have no control over that decision.

The key question is: who decides who can access our data, and can we verify that decision?

Source reference: This article is based on the German-language heise report titled “Ich mach mir eine Lenovo-ID und hol mir Deine Dropbox-Dateien,” published on September 2, 2026: https://www.heise.de/news/Fremde-Dropbox-Konten-ueber-Lenovo-ID-zugaenglich-11437565.html.

Der Beitrag Who Does the Cloud Trust When You Log In? erschien zuerst auf Univention.

11 September, 2026 01:50PM by Peter Ganten

hackergotchi for Deepin

Deepin

September 10, 2026

hackergotchi for Volumio

Volumio

OEM Streamer Launch Case Study for Audio Brands

A connected audio product can look finished long before it feels finished. The enclosure may be beautiful, the DAC section may measure well, and the first prototype may play music without issue. But an OEM streamer launch case study reveals where the real work happens: in the moments when a listener moves from a local library to Qobuz, changes rooms, updates firmware, or simply wants an album to begin without thinking about the technology behind it.

For an established audio brand, adding streaming is not just a feature decision. It is a decision about product identity, customer support, software ownership, sound quality, and the speed at which a new product can reach the market. This representative case study follows the path of a premium hi-fi manufacturer preparing its first network streamer. The details are generalized, but the launch questions are familiar to many audio teams.

The Brief: Add Streaming Without Losing the Brand

The manufacturer had earned its reputation through traditional separates: amplification, digital conversion, and carefully voiced analog stages. Its customers valued long product lifecycles, tactile controls, and a presentation that made recordings feel immediate and involving. Yet dealers were increasingly hearing the same request: customers wanted access to streaming services and personal music libraries without adding another app, another remote, or another box of uncertain quality.

The initial brief sounded straightforward. Create a network streamer with a premium digital output, a clear display, support for major music services, and a companion control experience. The product also needed to fit the brand’s industrial design language and sit comfortably in systems ranging from compact integrated amplifiers to reference-level DACs.

The more useful version of the brief was more demanding: make digital music feel like a natural part of the brand’s established listening experience.

That distinction shaped every decision that followed. A generic streaming module could have accelerated the first prototype, but it would have limited differentiation. Building every layer internally would have offered maximum control, but required a software organization, certification effort, and maintenance commitment that the manufacturer was not structured to carry.

The OEM Streamer Launch Case Study: Three Early Decisions

The project began with three decisions that prevented expensive changes later.

1. Define the listening journey before the feature list

The team started with use cases rather than a checklist of protocols. A customer might browse a NAS library by artist, select a radio station during breakfast, hand control to a family member, or use the streamer as a transport into an existing DAC. Each journey had to be clear on a phone or tablet, stable over a home network, and understandable without a manual.

This exposed an early trade-off. More sources and settings can make a product seem more capable, but they can also make it feel less inviting. The team chose to prioritize a unified music experience: local files, streaming services, internet radio, and network playback presented in one coherent environment. Advanced settings remained available, but they did not interrupt the first listen.

2. Establish where sound quality is won or lost

Streaming software does not replace audio engineering. The manufacturer wanted the streamer to preserve the timing, low-level detail, and tonal character that customers associated with its components. That required a clear division of responsibility between the digital transport, clocking approach, power supply design, output stage, and the customer’s downstream equipment.

The OEM platform needed to support the desired audio architecture without forcing a one-size-fits-all sound. In this case, the brand selected a dedicated network and processing section, isolated it carefully from sensitive audio circuitry, and retained control over its output implementation. The software partner supplied the playback intelligence and interface foundation; the audio brand concentrated its effort where its own engineering voice mattered most.

3. Treat updates as part of the product, not a post-launch fix

A network player is never entirely static. Streaming service requirements change. New control features become relevant. Bugs appear in combinations of routers, libraries, and mobile devices that cannot all be predicted in a lab.

The launch plan therefore included a defined firmware-update process, release validation, customer communication, and support escalation path. This was not as visible as the front panel or product photography, but it was essential to protecting dealer confidence after the first units shipped.

From Prototype to a Product People Want to Use

The first engineering sample proved that the selected hardware could play high-resolution music and connect reliably in a controlled environment. It did not yet prove that the product was ready for customers.

The next phase focused on integration. The display needed to feel connected to the control app rather than like a separate system. Input and output labels had to match the language customers would see in setup. Network onboarding had to work for listeners who knew nothing about IP addresses, while still offering useful options to experienced installers. The team also tested how quickly the unit recovered after power interruptions, router restarts, and service sign-ins.

These details influence perceived quality more than many specifications do. A streamer that sounds exceptional but takes several attempts to join a network creates doubt before the first track plays. Conversely, a thoughtfully guided setup gives listeners confidence that the product belongs in their system.

The manufacturer also resisted the temptation to overload the first release. A requested feature that had not been thoroughly tested was deferred rather than added late. That choice can be difficult when launch calendars are tight, but it avoids turning early customers into unpaid beta testers. The strongest first release is not the one with the longest feature list. It is the one that delivers its promised listening experience consistently.

What the OEM Partnership Changed

Working with an experienced streaming platform partner changed the economics and the risk profile of the launch. Instead of creating playback software, app infrastructure, source integrations, account management, and update mechanisms from zero, the manufacturer could build on technology already shaped by real listening habits and a broad device ecosystem.

For a partner such as Volumio, the role is not simply to provide software that plays music. It is to help translate an audio brand’s product vision into a connected experience that feels intentional from setup to daily use. That can include hardware-platform guidance, interface customization, integration support, testing, and an ongoing path for product updates.

This model does involve trade-offs. The manufacturer must align its roadmap with an external platform and agree on responsibilities for support, certification, and release timing. It also needs to decide how much of the user experience should carry its own visual identity versus using familiar platform conventions. Those conversations are productive when they happen at the beginning, not after industrial design and electronics are already fixed.

The Launch Result: Fewer Friction Points, More Listening

At launch, the product was evaluated on more than sound quality. Dealers could demonstrate it without a lengthy explanation. Customers could bring together music services and personal collections in one place. Owners using external DACs had a refined transport option, while listeners building a simpler system could begin with a single component and grow later.

The most meaningful result was not a dramatic specification claim. It was a reduction in friction. Customers spent less time deciding which app to open or which input to select, and more time with the music they already loved.

The support team benefited as well. Because the product had a consistent setup flow and a planned update process, common questions could be identified and resolved systematically. Product feedback became useful input for future software releases rather than a collection of isolated complaints.

Lessons for Audio Brands Planning Their First Streamer

An OEM streaming project succeeds when the hardware, software, and listening experience are planned as one product. Start by deciding what the listener should be able to do in the first five minutes and after five months of ownership. Then build the technical architecture around that reality.

It also helps to be honest about differentiation. An audio brand does not need to reinvent every layer of connected playback to make a distinctive product. Its identity may live in industrial design, sonic voicing, DAC implementation, display behavior, physical controls, dealer relationships, or the way all of those elements work together. The right OEM partner protects room for that identity while removing the burden of rebuilding proven streaming foundations.

Finally, allow enough time for home-network testing. Real homes are less predictable than product labs, and real listeners are less patient than engineering teams. Testing across routers, services, library sizes, and control devices is part of delivering high-fidelity playback, not an administrative step before shipping.

A great streamer should disappear once the music starts. For an audio brand, that is the standard worth designing toward: technology that feels considered, dependable, and fully at home in the listening room.

The post OEM Streamer Launch Case Study for Audio Brands appeared first on Volumio.

10 September, 2026 01:43AM

OEM Streamer Launch Case Study for Audio Brands

A connected audio product can look finished long before it feels finished. The enclosure may be beautiful, the DAC section may measure well, and the first prototype may play music without issue. But an OEM streamer launch case study reveals where the real work happens: in the moments when a listener moves from a local library to Qobuz, changes rooms, updates firmware, or simply wants an album to begin without thinking about the technology behind it.

For an established audio brand, adding streaming is not just a feature decision. It is a decision about product identity, customer support, software ownership, sound quality, and the speed at which a new product can reach the market. This representative case study follows the path of a premium hi-fi manufacturer preparing its first network streamer. The details are generalized, but the launch questions are familiar to many audio teams.

The Brief: Add Streaming Without Losing the Brand

The manufacturer had earned its reputation through traditional separates: amplification, digital conversion, and carefully voiced analog stages. Its customers valued long product lifecycles, tactile controls, and a presentation that made recordings feel immediate and involving. Yet dealers were increasingly hearing the same request: customers wanted access to streaming services and personal music libraries without adding another app, another remote, or another box of uncertain quality.

The initial brief sounded straightforward. Create a network streamer with a premium digital output, a clear display, support for major music services, and a companion control experience. The product also needed to fit the brand’s industrial design language and sit comfortably in systems ranging from compact integrated amplifiers to reference-level DACs.

The more useful version of the brief was more demanding: make digital music feel like a natural part of the brand’s established listening experience.

That distinction shaped every decision that followed. A generic streaming module could have accelerated the first prototype, but it would have limited differentiation. Building every layer internally would have offered maximum control, but required a software organization, certification effort, and maintenance commitment that the manufacturer was not structured to carry.

The OEM Streamer Launch Case Study: Three Early Decisions

The project began with three decisions that prevented expensive changes later.

1. Define the listening journey before the feature list

The team started with use cases rather than a checklist of protocols. A customer might browse a NAS library by artist, select a radio station during breakfast, hand control to a family member, or use the streamer as a transport into an existing DAC. Each journey had to be clear on a phone or tablet, stable over a home network, and understandable without a manual.

This exposed an early trade-off. More sources and settings can make a product seem more capable, but they can also make it feel less inviting. The team chose to prioritize a unified music experience: local files, streaming services, internet radio, and network playback presented in one coherent environment. Advanced settings remained available, but they did not interrupt the first listen.

2. Establish where sound quality is won or lost

Streaming software does not replace audio engineering. The manufacturer wanted the streamer to preserve the timing, low-level detail, and tonal character that customers associated with its components. That required a clear division of responsibility between the digital transport, clocking approach, power supply design, output stage, and the customer’s downstream equipment.

The OEM platform needed to support the desired audio architecture without forcing a one-size-fits-all sound. In this case, the brand selected a dedicated network and processing section, isolated it carefully from sensitive audio circuitry, and retained control over its output implementation. The software partner supplied the playback intelligence and interface foundation; the audio brand concentrated its effort where its own engineering voice mattered most.

3. Treat updates as part of the product, not a post-launch fix

A network player is never entirely static. Streaming service requirements change. New control features become relevant. Bugs appear in combinations of routers, libraries, and mobile devices that cannot all be predicted in a lab.

The launch plan therefore included a defined firmware-update process, release validation, customer communication, and support escalation path. This was not as visible as the front panel or product photography, but it was essential to protecting dealer confidence after the first units shipped.

From Prototype to a Product People Want to Use

The first engineering sample proved that the selected hardware could play high-resolution music and connect reliably in a controlled environment. It did not yet prove that the product was ready for customers.

The next phase focused on integration. The display needed to feel connected to the control app rather than like a separate system. Input and output labels had to match the language customers would see in setup. Network onboarding had to work for listeners who knew nothing about IP addresses, while still offering useful options to experienced installers. The team also tested how quickly the unit recovered after power interruptions, router restarts, and service sign-ins.

These details influence perceived quality more than many specifications do. A streamer that sounds exceptional but takes several attempts to join a network creates doubt before the first track plays. Conversely, a thoughtfully guided setup gives listeners confidence that the product belongs in their system.

The manufacturer also resisted the temptation to overload the first release. A requested feature that had not been thoroughly tested was deferred rather than added late. That choice can be difficult when launch calendars are tight, but it avoids turning early customers into unpaid beta testers. The strongest first release is not the one with the longest feature list. It is the one that delivers its promised listening experience consistently.

What the OEM Partnership Changed

Working with an experienced streaming platform partner changed the economics and the risk profile of the launch. Instead of creating playback software, app infrastructure, source integrations, account management, and update mechanisms from zero, the manufacturer could build on technology already shaped by real listening habits and a broad device ecosystem.

For a partner such as Volumio, the role is not simply to provide software that plays music. It is to help translate an audio brand’s product vision into a connected experience that feels intentional from setup to daily use. That can include hardware-platform guidance, interface customization, integration support, testing, and an ongoing path for product updates.

This model does involve trade-offs. The manufacturer must align its roadmap with an external platform and agree on responsibilities for support, certification, and release timing. It also needs to decide how much of the user experience should carry its own visual identity versus using familiar platform conventions. Those conversations are productive when they happen at the beginning, not after industrial design and electronics are already fixed.

The Launch Result: Fewer Friction Points, More Listening

At launch, the product was evaluated on more than sound quality. Dealers could demonstrate it without a lengthy explanation. Customers could bring together music services and personal collections in one place. Owners using external DACs had a refined transport option, while listeners building a simpler system could begin with a single component and grow later.

The most meaningful result was not a dramatic specification claim. It was a reduction in friction. Customers spent less time deciding which app to open or which input to select, and more time with the music they already loved.

The support team benefited as well. Because the product had a consistent setup flow and a planned update process, common questions could be identified and resolved systematically. Product feedback became useful input for future software releases rather than a collection of isolated complaints.

Lessons for Audio Brands Planning Their First Streamer

An OEM streaming project succeeds when the hardware, software, and listening experience are planned as one product. Start by deciding what the listener should be able to do in the first five minutes and after five months of ownership. Then build the technical architecture around that reality.

It also helps to be honest about differentiation. An audio brand does not need to reinvent every layer of connected playback to make a distinctive product. Its identity may live in industrial design, sonic voicing, DAC implementation, display behavior, physical controls, dealer relationships, or the way all of those elements work together. The right OEM partner protects room for that identity while removing the burden of rebuilding proven streaming foundations.

Finally, allow enough time for home-network testing. Real homes are less predictable than product labs, and real listeners are less patient than engineering teams. Testing across routers, services, library sizes, and control devices is part of delivering high-fidelity playback, not an administrative step before shipping.

A great streamer should disappear once the music starts. For an audio brand, that is the standard worth designing toward: technology that feels considered, dependable, and fully at home in the listening room.

The post OEM Streamer Launch Case Study for Audio Brands appeared first on Volumio.

10 September, 2026 01:43AM

September 09, 2026

hackergotchi for Deepin

Deepin

hackergotchi for Qubes

Qubes

Qubes Canary 048

We have published Qubes Canary 048. The text of this canary and its accompanying cryptographic signatures are reproduced below. For an explanation of this announcement and instructions for authenticating this canary, please see the end of this announcement.

Qubes Canary 048


                    ---===[ Qubes Canary 048 ]===---


Statements
-----------

The Qubes security team members who have digitally signed this file [1]
state the following:

1. The date of issue of this canary is September 09, 2026.

2. There have been 118 Qubes security bulletins published so far.

3. The Qubes Master Signing Key fingerprint is:

       427F 11FD 0FAA 4B08 0123  F01C DDFA 1A3E 3687 9494

4. No warrants have ever been served to us with regard to the Qubes OS
   Project (e.g. to hand out the private signing keys or to introduce
   backdoors).

5. We plan to publish the next of these canary statements in the first
   fourteen days of December 2026. Special note should be taken if no new
   canary is published by that time or if the list of statements changes
   without plausible explanation.


Special announcements
----------------------

None.


Disclaimers and notes
----------------------

We would like to remind you that Qubes OS has been designed under the
assumption that all relevant infrastructure is permanently compromised.
This means that we assume NO trust in any of the servers or services
which host or provide any Qubes-related data, in particular, software
updates, source code repositories, and Qubes ISO downloads.

This canary scheme is not infallible. Although signing the declaration
makes it very difficult for a third party to produce arbitrary
declarations, it does not prevent them from using force or other means,
like blackmail or compromising the signers' laptops, to coerce us to
produce false declarations.

The proof of freshness provided below serves to demonstrate that this
canary could not have been created prior to the date stated. It shows
that a series of canaries was not created in advance.

This declaration is merely a best effort and is provided without any
guarantee or warranty. It is not legally binding in any way to anybody.
None of the signers should be ever held legally responsible for any of
the statements made here.


Proof of freshness
-------------------

Wed, 09 Sep 2026 06:09:30 +0000

Source: DER SPIEGEL - International (https://www.spiegel.de/international/index.rss)
Fake Jewish Lineage: The Passport Scheme that Exploited Germany’s Nazi History
BYD, Geely, Xpeng: Germany’s Vaunted Auto Industry in Dire Straits Amid Chinese Surge
Amodei vs. Altman: How the Race for AI Dominance Is Increasing the Risks
Boats from Eastern Libya: How Europe Is Bowing to a Libyan Warlord on Migration
Moaning for the Mainland: How Taiwan Satisfies China's Lust for Pornography

Source: NYT > World News (https://rss.nytimes.com/services/xml/rss/nyt/World.xml)
AfD’s Far Right Win Puts New Pressure on Germany’s Leader Merz
Chinese Ship Takes Arctic Shortcut: Smart Business? Or a Political Flex?
Israeli Allies Ban Trade With Settlements as U.K. Cites ‘Ethnic Cleansing’
Saudi Arabia and Yemen’s Houthis Edge Back to the Brink of War
Carney Says Retaliation Against U.S. Tariffs Was Unavoidable

Source: BBC News (https://feeds.bbci.co.uk/news/world/rss.xml)
US strikes Iranian oil tankers as Tehran targets American base in Jordan
Paul Adams: British-Israeli relations at lowest ebb in decades
US slaps import ban on Canadian alcohol, motorbikes and other goods
'Constantly on my mind' - 9/11 agony endures for bereaved, 25 years on
South Park creators rename show 'South America' in apparent dig at Trump

Source: Blockchain.info
000000000000000000017721d9b2add64d85980a3bb8587851798bb854c3d514


Footnotes
----------

[1] This file should be signed in two ways: (1) via detached PGP
signatures by each of the signers, distributed together with this canary
in the qubes-secpack.git repo, and (2) via digital signatures on the
corresponding qubes-secpack.git repo tags. [2]

[2] Don't just trust the contents of this file blindly! Verify the
digital signatures! Instructions for doing so are documented here:
https://doc.qubes-os.org/en/latest/project-security/security-pack.html

--
The Qubes Security Team
https://www.qubes-os.org/security/

Source: canary-048-2026.txt

Marek Marczykowski-Górecki’s PGP signature

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmqhJaEACgkQ1lWk8hgw
4GpAUA//dvesbc30xLrZ5hRrJgPBBOaMIXjLZk2il/EljKLAMLdPOk5Y01kNLLGS
nvnLU0M5U8y1Oqlfj7WybABht8SrPSBg9gI1CrRvA69urz5V6VHDUsqAMhXozdLK
FgT4+SuQfiAvlXOdjPljcZO4jWXWcQMWjecYTTiQdnMNC90VkrncYjNeioh6rhaL
oCim2t5ynb9wpyo7zzG9KNDtDUzPSAphSZoJhb3PJXNOxHV6RLsyoz9b1wa1c3xp
IJdS1EzMf/1/bmlZwg9FnLcGVOO/TdyOSKxP4d54SVt/JmYfpk2qAVfn/NWjlzVc
LqcwebzGHQ56A4kyvc04PEuMzryneYDmxboKtwKUnOyMdnOxHtpbqh/jX6T/GodA
wO8oJdoT5l1ugLfFK/sGluSx6FnFoczgukFxk+cIn3l38mEUAQLshWRNL3gk8LkW
cKTFBBntwlV2XfmJBFhOM4s6N74RTrNhxWlsgT4LyOCcFRIT8CCLicmvmxSgjWJo
v3p+pKqLNFe0GU64KUlt3Fvc0m4hyvxPZbmzA/UOevMzssX5BHkRXQDJaknLppy+
yZp/gfBX575wlgWn+khXPYQSIcHyEuZifZoMaGnfU0OgjPMcmC4SY9xQf2cH/dN+
gTyhd0+s9RfyWDdA2l1ZvG10t1Pz5SIJecPXHFMk+F6qHEpjezI=
=wcFj
-----END PGP SIGNATURE-----

Source: canary-048-2026.txt.sig.marmarek

Simon Gaiser (aka HW42)’s PGP signature

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmqhK+QACgkQSsGN4REu
FJCzHQ//ejKjw9KcCp8EKE/pMMSeCHmIOBDqZFsM0Ifo4rzyCVc2TqLZ6K0JviuQ
5otz/lor5rI4Z1wCR4fZO7YwWHewaX7w7yILp6tRV+9el22lhWPJMl7BavjBK92d
8WUiuab0DrlxROUDtm62mgzQ5dHcqQjj/bZZhSeq/69e/L3OJsWclOdAOt+LjSUa
rXYD+bB23PZh3FGdvW0znTLbs/0XpH+RmDld8LbQvbZP6LH1+751Xxz6qe7sFOIa
iIxDuUlqo9ZU43enZhN0Vug+wGltiZk3njzpPvvURKNGWyrZKo4m8tR1BdoJ+8Qy
KasUPBOWrZh99IFonBCAUY5dFJScujtOWh/nihbX531nnV7X1XkUc2rieaW7zGye
brxjG4s3h4/r6IfH3K38cCLw3m5luvSmOm0F1zt9xthnUp7PnNK+qOOkPNzWptsA
upPVS/rjPlfAm01GDU+aqWVpv4kF74TGTMnQj112eRz+LyEnrx9LWqJZ4YsrvgYP
OsrCPnfCPF0fgNsKKbMJ12b17rIXGXw/aKEqL/V3XVJUKbaGTlJU8GbBsQG7a1oD
JpEWdU7I7RR40UXwGHNUnS5bSCVdAhlNEs/tnyWW2zEScAkZXu/wJTGaPA6wcTkd
l1Um8S7H4Q2rRTCMGziJHjTUjdlMegcjrkEmHOzM3r78fCsZJgY=
=vexT
-----END PGP SIGNATURE-----

Source: canary-048-2026.txt.sig.simon

What is the purpose of this announcement?

The purpose of this announcement is to inform the Qubes community that a new Qubes canary has been published.

What is a Qubes canary?

A Qubes canary is a security announcement periodically issued by the Qubes security team consisting of several statements to the effect that the signers of the canary have not been compromised. The idea is that, as long as signed canaries including such statements continue to be published, all is well. However, if the canaries should suddenly cease, if one or more signers begin declining to sign them, or if the included statements change significantly without plausible explanation, then this may indicate that something has gone wrong.

The name originates from the practice in which miners would bring caged canaries into coal mines. If the level of methane gas in the mine reached a dangerous level, the canary would die, indicating to miners that they should evacuate. (See the Wikipedia article on warrant canaries for more information, but bear in mind that Qubes Canaries are not strictly limited to legal warrants.)

Why should I care about canaries?

Canaries provide an important indication about the security status of the project. If the canary is healthy, it’s a strong sign that things are running normally. However, if the canary is unhealthy, it could mean that the project or its members are being coerced in some way.

What are some signs of an unhealthy canary?

Here is a non-exhaustive list of examples:

  • Dead canary. In each canary, we state a window of time during which you should expect the next canary to be published. If no canary is published within that window of time and no good explanation is provided for missing the deadline, then the canary has died.
  • Missing statement(s). Canaries include a set of numbered statements at the top. These statements are generally the same across canaries, except for specific numbers and dates that have changed since the previous canary. If an important statement was present in older canaries but suddenly goes missing from new canaries with no correction or explanation, then this may be an indication that the signers can no longer truthfully make that statement.
  • Missing signature(s). Qubes canaries are signed by the members of the Qubes security team (see below). If one of them has been signing all canaries but suddenly and permanently stops signing new canaries without any explanation, then this may indicate that this person is under duress or can no longer truthfully sign the statements contained in the canary.

No, there are many canary-related possibilities that should not worry you. Here is a non-exhaustive list of examples:

  • Unusual reposts. The only canaries that matter are the ones that are validly signed in the Qubes security pack (qubes-secpack). Reposts of canaries (like the one in this announcement) do not have any authority (except insofar as they reproduce validly-signed text from the qubes-secpack). If the actual canary in the qubes-secpack is healthy, but reposts are late, absent, or modified on the website, mailing lists, forum, or social media platforms, you should not be concerned about the canary.
  • Last-minute signature(s). If the canary is signed at the last minute but before the deadline, that’s okay. (People get busy and procrastinate sometimes.)
  • Signatures at different times. If one signature is earlier or later than the other, but both are present within a reasonable period of time, that’s okay. (For example, sometimes one signer is out of town, but we try to plan the deadlines around this.)
  • Permitted changes. If something about a canary changes without violating any of the statements in prior canaries, that’s okay. (For example, canaries are usually scheduled for the first fourteen days of a given month, but there’s no rule that says they have to be.)
  • Unusual but planned changes. If something unusual happens, but it was announced in advance, and the appropriate statements are signed, that’s okay (e.g., when Joanna left the security team and Simon joined it).

In general, it would not be realistic for an organization to exist that never changed, had zero turnover, and never made mistakes. Therefore, it would be reasonable to expect such events to occur periodically, and it would be unreasonable to regard every unusual or unexpected canary-related event as a sign of compromise. For example, if something usual happens with a canary, and we say it was a mistake and correct it (with valid signatures), you will have to decide for yourself whether it’s more likely that it really was just a mistake or that something is wrong and that this is how we chose to send you a subtle signal about it. This will require you to think carefully about which among many possible scenarios is most likely given the evidence available to you. Since this is fundamentally a matter of judgment, canaries are ultimately a social scheme, not a technical one.

What are the PGP signatures that accompany canaries?

A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all canaries so that Qubes users have a reliable way to check whether canaries are genuine. The only way to be certain that a canary is authentic is by verifying its PGP signatures.

Why should I care whether a canary is authentic?

If you fail to notice that a canary is unhealthy or has died, you may continue to trust the Qubes security team even after they have signaled via the canary (or lack thereof) that they been compromised or coerced.

Alternatively, an adversary could fabricate a canary in an attempt to deceive the public. Such a canary would not be validly signed, but users who neglect to check the signatures on the fake canary would not be aware of this, so they may mistakenly believe it to be genuine, especially if it closely mimics the language of authentic canaries. Such falsified canaries could include manipulated text designed to sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project.

How do I verify the PGP signatures on a canary?

The following command-line instructions assume a Linux system with git and gpg installed. (For Windows and Mac options, see OpenPGP software.)

  1. Obtain the Qubes Master Signing Key (QMSK), e.g.:

    $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc
    gpg: directory '/home/user/.gnupg' created
    gpg: keybox '/home/user/.gnupg/pubring.kbx' created
    gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc'
    gpg: /home/user/.gnupg/trustdb.gpg: trustdb created
    gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported
    gpg: Total number processed: 1
    gpg:               imported: 1
    

    (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.)

  2. View the fingerprint of the PGP key you just imported. (Note: gpg> indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.)

    $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494
    gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc.
    This is free software: you are free to change and redistribute it.
    There is NO WARRANTY, to the extent permitted by law.
       
       
    pub  rsa4096/DDFA1A3E36879494
         created: 2010-04-01  expires: never       usage: SC
         trust: unknown       validity: unknown
    [ unknown] (1). Qubes Master Signing Key
       
    gpg> fpr
    pub   rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key
     Primary key fingerprint: 427F 11FD 0FAA 4B08 0123  F01C DDFA 1A3E 3687 9494
    
  3. Important: At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you must authenticate the QMSK out-of-band. Do not skip this step! The standard method is to obtain the QMSK fingerprint from multiple independent sources in several different ways and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key.

    Tip: After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future.

  4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with q.

    gpg> trust
    pub  rsa4096/DDFA1A3E36879494
         created: 2010-04-01  expires: never       usage: SC
         trust: unknown       validity: unknown
    [ unknown] (1). Qubes Master Signing Key
       
    Please decide how far you trust this user to correctly verify other users' keys
    (by looking at passports, checking fingerprints from different sources, etc.)
       
      1 = I don't know or won't say
      2 = I do NOT trust
      3 = I trust marginally
      4 = I trust fully
      5 = I trust ultimately
      m = back to the main menu
       
    Your decision? 5
    Do you really want to set this key to ultimate trust? (y/N) y
       
    pub  rsa4096/DDFA1A3E36879494
         created: 2010-04-01  expires: never       usage: SC
         trust: ultimate      validity: unknown
    [ unknown] (1). Qubes Master Signing Key
    Please note that the shown key validity is not necessarily correct
    unless you restart the program.
       
    gpg> q
    
  5. Use Git to clone the qubes-secpack repo.

    $ git clone https://github.com/QubesOS/qubes-secpack.git
    Cloning into 'qubes-secpack'...
    remote: Enumerating objects: 4065, done.
    remote: Counting objects: 100% (1474/1474), done.
    remote: Compressing objects: 100% (742/742), done.
    remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591
    Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done.
    Resolving deltas: 100% (1910/1910), done.
    
  6. Import the included PGP keys. (See our PGP key policies for important information about these keys.)

    $ gpg --import qubes-secpack/keys/*/*
    gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported
    gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory
    gpg: no valid OpenPGP data found.
    gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key
    gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported
    gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported
    gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys
    gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported
    gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported
    gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported
    gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported
    gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported
    gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key
    gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported
    gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported
    gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key
    gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported
    gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key
    gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported
    gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed
    gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported
    gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory
    gpg: no valid OpenPGP data found.
    gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported
    gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported
    gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory
    gpg: no valid OpenPGP data found.
    gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported
    gpg: Total number processed: 17
    gpg:               imported: 16
    gpg:              unchanged: 1
    gpg: marginals needed: 3  completes needed: 1  trust model: pgp
    gpg: depth: 0  valid:   1  signed:   6  trust: 0-, 0q, 0n, 0m, 0f, 1u
    gpg: depth: 1  valid:   6  signed:   0  trust: 6-, 0q, 0n, 0m, 0f, 0u
    
  7. Verify signed Git tags.

    $ cd qubes-secpack/
    $ git tag -v `git describe`
    object 266e14a6fae57c9a91362c9ac784d3a891f4d351
    type commit
    tag marmarek_sec_266e14a6
    tagger Marek Marczykowski-Górecki 1677757924 +0100
       
    Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351
    gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST
    gpg:                using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A
    gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full]
    

    The exact output will differ, but the final line should always start with gpg: Good signature from... followed by an appropriate key. The [full] indicates full trust, which this key inherits in virtue of being validly signed by the QMSK.

  8. Verify PGP signatures, e.g.:

    $ cd QSBs/
    $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt
    gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST
    gpg:                using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A
    gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full]
    $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt
    gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST
    gpg:                using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490
    gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full]
    $ cd ../canaries/
    $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt
    gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST
    gpg:                using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A
    gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full]
    $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt
    gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST
    gpg:                using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490
    gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full]
    

    Again, the exact output will differ, but the final line of output from each gpg --verify command should always start with gpg: Good signature from... followed by an appropriate key.

For this announcement (Qubes Canary 048), the commands are:

$ gpg --verify canary-048-2026.txt.sig.marmarek canary-048-2026.txt
$ gpg --verify canary-048-2026.txt.sig.simon canary-048-2026.txt

You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the Qubes Canary 048 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

09 September, 2026 12:00AM

September 08, 2026

hackergotchi for ZEVENET

ZEVENET

The Human Side of Cybersecurity: How to Make Security Content More Engaging

Cybersecurity often involves technical terminology, complex technologies, and serious warnings. While all of these are important, people still play a critical role in keeping organizations secure. Employees need to know how to recognize a phishing email, customers should understand how to behave safely online, and website users need to know how to protect their data.

The harder security information is to understand and the more formal or technical the language, the less likely people are to pay attention to it.

Making cybersecurity content engaging does not mean trivializing the subject. It means communicating important information in a way that is clear, relatable, and memorable. Simple language, relevant examples, visual content, and even appropriate humor can make security communication far more effective.

Why Human-Friendly Security Content Matters

Technical security concepts can quickly become overwhelming for people who do not work in IT. Terms such as phishing, credential stuffing, DDoS attacks, and zero-day vulnerabilities may be familiar to cybersecurity professionals, but they can be confusing to employees and customers.

A more human-centered approach can make security content easier to understand and engage with. Instead of explaining every technical detail of a threat, focus on what it means, why it matters, and what people can do about it.

For example, instead of explaining that phishing attacks use social engineering techniques to steal login credentials, consider a more relatable scenario: “Imagine receiving a fake email that appears to come from your bank. Before entering your password, check that you are actually on the bank’s legitimate website.”

This gives readers practical knowledge they can apply in a real-world situation.

Turn Technical Ideas Into Everyday Situations

Real-world examples are particularly useful because they help people recognize threats when they encounter them.

A security article might use familiar situations such as a fake delivery notification, an unexpected password reset request, or a suspicious login alert.

This creates a connection between an abstract cyber threat and something the reader already recognizes, making the threat easier to understand and remember.

Use Visuals to Explain Security Concepts

Most people can process visual information more quickly than lengthy technical explanations. Diagrams, screenshots, graphics, and even simple illustrations can help explain how an attack works and what users should do to protect themselves.

For example, a simple visual could highlight the differences between a legitimate login page and a phishing page. Another could illustrate the steps someone should follow when evaluating a suspicious email.

Make Security Content More Memorable With Humor

Not everything about cybersecurity has to be frightening. Used appropriately, humor can make educational content more relatable, particularly when addressing common mistakes people make in their everyday digital lives.

Memes, for example, can be an effective way to communicate simple security tips through familiar situations and clear messages. A security team might create a humorous image about using the same password for every account or clicking a link from an unknown sender without checking where it came from.

Using a meme generator can help teams turn everyday security situations into entertaining visuals that employees are more likely to remember.

However, humor should never undermine the main security message. Jokes about victims, security breaches, financial losses, or other serious incidents should be avoided.

Encourage People to Take Action

Good security content should always give readers a clear next step. Explaining a threat without showing people what they can do about it may leave them informed, but not necessarily prepared.

Useful actions might include:

  • Enable multi-factor authentication on important accounts.
  • Use strong, unique passwords and a reputable password manager.
  • Check links and sender addresses before clicking or opening anything.
  • Report suspicious messages to the appropriate security team.
  • Keep operating systems, browsers, and applications up to date.

These recommendations should also reflect the needs of the audience. An employee may need clear instructions on how to report a phishing email, while a website owner may need guidance on protecting an application against automated attacks or large volumes of malicious traffic.

Make Security a Conversation

Security awareness is more effective when people feel comfortable asking questions.

Organizations can encourage this through newsletters, short training sessions, internal communications, quizzes, and other educational resources. Security teams do not have to wait until something goes wrong to communicate with employees; they can share useful advice on a regular basis.

This helps make cybersecurity part of employees’ everyday routines while also giving them opportunities to learn from common mistakes and real-world situations.

Build Trust Through Clear Communication

Trust is essential to effective cybersecurity communication. People need to feel that the security information they receive is relevant, understandable, and useful.

Avoid unnecessary jargon and technical concepts that your audience may not understand. When technical terminology is necessary, explain it in clear and accessible language.

A more approachable tone can also make security messages more effective. It is possible to capture people’s attention without frightening them, particularly when clear explanations, relatable examples, and useful visuals are used together.

Conclusion

Cybersecurity may be a highly technical field, but people remain a critical part of keeping organizations secure.

By using simple language, relatable examples, relevant visuals, and appropriate humor, companies can create security content that is easier to understand and remember.

The goal is not simply to make cybersecurity more engaging. It is to help people understand the risks they face, recognize potential threats, and know what actions they can take to improve their security.

08 September, 2026 03:12PM by Isabel Perez

hackergotchi for ARMBIAN

ARMBIAN

Github Highlights

Github Highlights

This cycle centers on Linux 7.2/7.3 kernel enablement across out-of-tree drivers, new board support and platform fixes across Rockchip, SpacemiT, and Amlogic, and a broad documentation and CI cleanup.

Kernel progression dominated the driver ecosystem, with 7.3 patch sets prepared for rockchip64, meson64, and the UEFI targets, and edge bumps to 7.2.3 landing for qcs6490, qrb2210, and sc8280xp. A wave of Wi‑Fi drivers was re-enabled and bumped for 7.3 compatibility, including rtl8189es/fs, rtl8192eu, rtl8723ds, rtl8852bs, uwe5622, and bcmdhd-dkms, most addressing the strncpy removal and the cfg80211 remain_on_channel cookie signature change. The rk35xx vendor kernel also advanced to the 6.1.172 rkr7.2 SDK.

Board and platform work introduced GL.iNet GL-MT2500, Xiangcheng XC3399FR, and NanoPi R28S, alongside U-Boot bumps to v2026.07 for Helios64, Odroid N2, Khadas VIM3L, and Mixtile Core3588e. Notable hardware corrections include a cold-boot switch fix on BananaPi R2, RK808 LDO mapping repair on Firefly RK3399 to restore analog audio, RTC correction on Orange Pi Zero 3W, an MSDOS partition table workaround for GPT/eGON on Orange Pi 4A, and SPI controller selection on NanoPi NEO3 Plus. SpacemiT K3 saw defconfig refinements and a transition from extlinux to boot.scr on the Pico ITX.

Infrastructure work focused on documentation consolidation and workflow hardening: a new "Armbian vs Debian & Ubuntu" comparison page, pinned third-party actions with scoped GITHUB_TOKEN, removal of dead PDF plumbing and unused announce workflows, and CI adjustments including GHCR visibility reporting and a lower stall-retry threshold in the SDK. The configng TUI received usability improvements to help text and top-level navigation.

#Armbian #EmbeddedLinux #Rockchip #LinuxKernel #SBC

Changes

08 September, 2026 01:36PM by Michael Robinson