$ whoami
RodHat wears a hat. He also won't touch systemd.
Old UNIX greybeard, FreeBSD-or-nothing, been online since Usenet. News filtered through thirty years of pattern-matching, advanced Linux/Unix tips that aren't a rehash of the man page, and the sysadmin war stories nobody asked for.
Latest
splice and tee: zero-copy data movement, 2.6.17 edition
splice(2) and tee(2) have been in Linux since 2006. They move data through the kernel page cache without a userspace copy. How to use them for log fanout, network sends, and pipeline work that does not belong in the era of read/write loops.
Linux 7.3-rc1 dropped Saturday. One thousand two hundred and fifty memory management patches.
Linus tagged 7.3-rc1 on August 30 after a two-week merge window. The highlights are 1,250 MM patches, a 21-commit NTFS3 security overhaul that also adds Alternative Data Streams, Rust on PowerPC, and a KVM restructure. Here is the triage.
The xz backdoor was 28 months ago. Here is what the supply chain security scoreboard actually reads.
March 2024 was supposed to be the wake-up call that fixed open source supply chain security. It is August 2026. Here is the honest accounting of what improved, what did not, and why the underlying economics that made the attack possible have not fundamentally changed.
close_range: one syscall instead of a million EBADFs
Linux 5.9 finally shipped what FreeBSD had since 7.3. close_range() closes or cloexec-marks a range of file descriptors atomically. The old pre-exec fd cleanup loop burning a million close() calls is dead. Here is how to use it.
The TCP window that ate a gigabit
The cross-datacenter link was provisioned for 1Gbps. iperf3 consistently showed 180Mbps. The hardware was clean, the routing was clean, the fiber was clean. The problem was a 208KB number that nobody had changed in years, and the unforgiving math of physics.
ML-KEM has been the default SSH key exchange for two years. Enterprise IT just noticed.
OpenSSH 9.9 switched to post-quantum hybrid key exchange by default in October 2024. It is August 2026. Corporate jump boxes are timing out on handshakes and helpdesk queues are filling up. Here is what broke, why it broke, and the three commands that fix it.
openat2: enforce path resolution constraints at the syscall level
Linux 5.6 added openat2(), a superset of openat that lets you express RESOLVE_BENEATH, RESOLVE_NO_SYMLINKS, and RESOLVE_IN_ROOT as kernel-enforced constraints. No chroot, no CAP_SYS_CHROOT, no userspace reimplementation of path canonicalization.
You can write a CPU scheduler in BPF now. Most of you shouldn't. Some of you really should.
sched_ext merged into Linux 6.12 and it's in your distro's kernel if you're running anything recent. You can load a custom CPU scheduler as a BPF program at runtime, no kernel recompile, with a verifier and a watchdog that catches you when you screw it up. This is either the most irresponsible feature in recent kernel history or a genuinely correct architectural decision. I've landed on the latter.