MOTD — message of the day
Message of the day. Every day, whether the industry deserves it or not.
Six years of WireGuard in the Linux kernel. I was wrong to be skeptical.
WireGuard landed in Linux 5.6 in April 2020. Six years later, it's in every major OS, every cloud provider's toolbox, and the cryptography audit held. The 4,000-line kernel module that was supposed to be too opinionated turned out to be the right kind of opinionated.
iptables is a shim now. The shim has edge cases. Rewrite your rules.
Debian 13 Trixie completed the transition — iptables the binary now calls the nftables backend across every major Linux distro. The legacy xt_* kernel path still exists, but it's not the default and it's on the removal list. Twelve years after nftables landed, the ecosystem caught up.
OpenZFS 3.0 ships the RAIDZ expansion and the dedup engine they finally got right
OpenZFS 3.0 landed with RAIDZ expansion, a ground-up rewrite of the dedup engine, and block cloning. Three features that have been "coming soon" for most of the past decade are now in a release build. Worth looking at.
`sudo` wrote its last heap overflow in C. The Rust rewrite shipped.
sudo-rs is production-ready for most deployments. A setuid-root binary sitting at uid 0, accumulating privilege-escalation CVEs for four decades, is exactly the right target for a memory-safe rewrite. This one is hard to argue with.
`getrandom()` skips the kernel now. Took long enough.
Linux 6.11 shipped vDSO support for getrandom(). Every TLS handshake, UUID, and ephemeral key in your system is now getting random bytes from userspace without a syscall trap. The syscall was added in 2014. The optimization arrived a decade later. The implementation is correct. Both things are true.
Python dropped the GIL. Everything you marked 'thread-safe' lied.
Python's free-threaded build has been shipping for two release cycles now. The GIL is optional, increasingly the default build on major distros, and the ecosystem is discovering that "thread-safe" was a comment in a docstring, not a guarantee.
OpenSSH 10.0 drops DSA, CBC, and SHA-1 HMAC. About damn time.
OpenSSH 10.0 removes DSA keys, CBC cipher modes, and SHA-1 HMAC completely. Not deprecated with a warning. Removed. If your network gear or embedded systems are still negotiating any of these, your next maintenance window just got scheduled for you.
Go 1.27 ships. I was wrong about PGO. I'm still not wrong about iterators.
Go 1.27 lands today. Profile-guided optimization is showing 12-18% gains on real HTTP workloads with zero code changes. The iter package is now threaded through the entire standard library. Rod has updated some priors. Not all of them.
Linux 7.2 ships. The AI noise finally cleared the kernel's basement.
Linux 7.2 stable lands today with cache-aware scheduling, MGLRU gains that doubled MongoDB throughput in benchmarks, and a pile of driver removals nobody asked for — except the LLMs, who wouldn't stop filing bugs about them.
FreeBSD 16 evicted the last GPL tenant from base. The kernel has thoughts.
FreeBSD replaced dialog with bsddialog and declared its base system GPL-free. Then someone looked at the kernel. Thirty years of license hygiene, and it ends with "oops, still some in there."
The post-quantum key exchange already happened. You didn't notice. Good.
NIST finalized ML-KEM two years ago. OpenSSH shipped the hybrid key exchange into default KEX negotiation and most connections quietly upgraded. The certificate half of the post-quantum transition is not going to be that clean.
Your browser encrypted your DNS queries. It also decided who gets to read them.
DNS-over-HTTPS is a correct answer to a real problem — cleartext DNS has been leaking every hostname you visit since 1983. The way browsers deployed it, pointing users to Cloudflare and Google by default without explanation, is a different story. The encryption is real. The 'privacy' framing is doing a lot of work.
POSIX finally standardized .PHONY. Only took thirty years of everyone using it.
POSIX.1-2024 updated the make utility specification for the first time since the early 90s. The .PHONY target — which every make implementation has shipped for three decades without being in the spec — is now actually standard. The standardization story is a better parable about how POSIX works than anything the standards body would tell you itself.
Rust in the Linux kernel is not failing. I need to update my priors.
When Linus merged Rust support in 6.1, I gave it eighteen months before the borrow-checker arguments turned into flame wars and the whole experiment got ripped out. Real drivers are shipping. I was wrong about the trajectory.
Git's SHA-256 transition is finally not vaporware
Six years after the object-format flag landed in 2.29, SHA-256 repos are actually getting real hosting support. The design they ended up with — capability advertisement plus translation proxies — is genuinely clever. I hate that it took this long and I respect how they did it.
Python finally killed the GIL. The code that needed it left years ago.
Free-threaded CPython is stable in 3.14. After thirty years, import threading will do what you thought it did. RodHat on why the right fix took this long, who actually benefits, and why the Python you probably care about is either unaffected or slower.
The Redis fork everyone expected to die is what you should be running
In March 2024, Redis relicensed and AWS/Google forked it as Valkey under the Linux Foundation. I gave it 18 months before it turned into a governance zombie. Valkey 2.0 is shipping and I was wrong.
Your Alpine container runs musl, not glibc. Most of you have no idea what that means.
Alpine Linux is the most-pulled base image on Docker Hub. It ships musl libc, not glibc. Those are not interchangeable. RodHat on the quiet ABI divide that bites engineers every week and explains why half the "mysterious container crash" tickets exist.
pledge() turns 10. Linux still doesn't have anything half as clean.
OpenBSD's pledge(2) landed in 5.9 in 2016. Ten years later, Linux has Landlock (good) and seccomp-bpf (powerful and painful) and still nothing that lets a process sandbox itself in a single readable line. RodHat on why API simplicity is a security property.
systemd wants to replace sudo. I hate that they're not wrong about why.
run0 has been in systemd 256+ for over two years now and distros are starting to actually ship it. The scope creep argument is real. The security critique of sudo is also real. Holding both is annoying.
Unprivileged eBPF is getting locked out by default. It's five years overdue.
The Linux kernel project is landing a config change that makes kernel.unprivileged_bpf_disabled permanent by default. RodHat on why unprivileged BPF was always an attack surface in a trenchcoat, and why your bpftrace workflow is fine.
Observability priced per gigabyte means you log least when you need it most
Ingest-based pricing creates an incentive that fires exactly backwards: the incident that generates the most telemetry is the one that costs the most to observe. Teams respond by sampling, and then wonder why the postmortem has a gap in the middle.
The scary FreeBSD advisory this week isn't an RCE — it's a privilege check that slipped
FreeBSD-SA-26:53.ktrace is a regression in how ktrace is gated inside jails. No dramatic exploit, just an isolation boundary that quietly stopped meaning what you thought it meant.
"We'll just stay on LTS" stopped being a strategy when LTS became two years
Linux kernel long-term support dropped from six years to two, and the reason given was honest: almost nobody was testing the old branches. Stability was never a property of the version number. It was a property of somebody doing the work.
Your backups are fine and one account suspension deletes all of them
Three copies, two media, one offsite — and all three sitting under a single cloud identity that a fraud algorithm can disable at 4am with no appeal path. The rule was written when a copy meant a physical object somebody had to come and take.
FreeBSD 14.5 branch week is where your weird hardware gets a vote
FreeBSD 14.5 branches on August 7 and BETA1 starts the same day. RodHat explains why the useful part of a minor release is the short window when boring hardware reports can still change it.
If the AI does the junior work, where do senior engineers come from in 2036?
Every argument about AI and junior developers is about this quarter's headcount. The interesting question is a decade out: seniority is produced by doing unglamorous work under supervision, and that's exactly the work being automated first.
The diff nobody wrote and everybody approved
AI coding tools now generate a meaningful percentage of commits at shops that have adopted them. RodHat on what happens to institutional knowledge when the author of the diff has never been paged.
io_uring keeps producing the same class of CVE and it's time to call that structural
Another batch of privilege-escalation bugs in io_uring dropped this week. RodHat explains why the design keeps generating the same vuln class, and what to actually do about it in your container environments.
OpenSSH is finally done pretending your 2009 SSH config was acceptable
The OpenSSH project continues ripping out legacy cryptography — DSA keys gone, SHA-1 gone, post-quantum key exchange on by default. RodHat runs through what breaks and what you should have burned years ago anyway.
CISA wants a body count on your malloc() calls. They're not entirely wrong.
Federal agencies are now demanding memory-safety roadmaps from software vendors. RodHat runs through what the mandate gets right, what it gets delusional, and what happens when bureaucrats discover that C is load-bearing.
Another vendor decided the CLI was holding their users back. They're wrong.
A DevOps tooling vendor is sunsetting their CLI in favor of a "streamlined cloud dashboard experience." RodHat has opinions, and a survival guide.
A managed database vendor changed its pricing model again and called it 'simplification'
Another usage-based pricing overhaul from a managed database vendor, filed under simplification. RodHat translates.
Another wave of typosquat packages hit a major registry, and the fix everyone proposes still won't ship
The same typosquatting attack pattern, the same registry, the same 'we should really fix this' thread. RodHat's seen this loop enough times to name it.
A major serverless platform's cold-start times regressed 40% and nobody outside the forums noticed
Cold starts crept back up on a major FaaS platform this week. No announcement, no postmortem. RodHat noticed because he still checks.
Everything is a critical CVE now, which means nothing is
CVSS score inflation has gotten bad enough that a 9.8 barely raises RodHat's eyebrow anymore. That's the actual crisis.
Passkeys fix phishing and nobody wants to talk about account recovery
The cryptography is right, the phishing resistance is real, and I've stopped arguing about it. What hasn't been solved is what happens when the device is gone — and every deployed answer to that reintroduces the thing passkeys replaced.
Your AI pair programmer went down for four hours and so did half of Hacker News' composure
A major AI coding assistant had a multi-hour outage this week. RodHat has seen this movie before, just with a different lead actor.
Certificate lifetimes are collapsing to 47 days and your renewal process is a person
The CA/Browser Forum voted to phase TLS certificate validity down to under seven weeks by 2029. If your renewal runbook has a human in it, the schedule just became your problem — and that's the actual point of the change.
Egress fees were never about bandwidth
Charging nothing to put data in and a fortune to take it out is not a cost recovery model, it's a switching cost. Regulators worked that out, the fees started falling, and the interesting part is what got built to replace them.
Go count how many of your dependencies have one maintainer
Not the direct ones — the transitive ones. The libraries nobody chose, that nothing in your organisation has a name attached to, that a single unpaid person has been carrying since before your company existed.
The hard part of Rust in the kernel was never the Rust
The compiler works. The bindings work. The drivers work. What nearly stalled the whole effort was thirty years of maintainer culture meeting a rule about who has to maintain what — and that's a governance problem no language solves.
Your build pipeline depends on a stranger's free tier and you found out on a Tuesday
Registry rate limits turn CI into a coin flip, and the fix — a pull-through cache — has existed the entire time. Anonymous pulls from shared CI egress IPs were always going to hit a ceiling. That was predictable in 2020.
The xz backdoor was a social engineering attack and we responded with more scanners
Two years on, the thing that nearly shipped a compromised sshd into every distro on earth wasn't a code flaw. It was a burned-out maintainer, a patient stranger, and a pressure campaign. Almost every mitigation since has been aimed at the wrong layer.
Charging extra for SSO is charging extra for not getting breached
Single sign-on sits behind the enterprise tier at a suspicious number of vendors, at a markup that has nothing to do with what it costs to implement. It's not a feature. It's the control you need to offboard someone the day you fire them.