The expiration of Microsoft’s 2011 Secure Boot certificates in 2026 presents potential challenges for Linux users on consumer hardware. While existing installations are unlikely to fail immediately when dates roll over, new distributions or updates may face boot issues unless firmware is updated with the newer 2023 keys. To maintain security and compatibility, users should update their system BIOS/UEFI via vendor tools or fwupd and verify readiness by testing current distribution ISOs on live USB sticks. Disabling Secure Boot entirely to avoid these hurdles is discouraged as it increases vulnerability to rootkits.
>"On many systems, you can use Linux's firmware update stack, fwupd, to handle this from within your distro. To take this step, run the following commands as the root user:"
>
>`fwupdmgr refresh && fwupdmgr get-updates && fwupdmgr update`
>"On many systems, you can use Linux's firmware update stack, fwupd, to handle this from within your distro. To take this step, run the following commands as the root user:"
>
>`fwupdmgr refresh && fwupdmgr get-updates && fwupdmgr update`
This guide provides a comprehensive setup for using the Ghostty terminal emulator with Anthropic's Claude Code agentic coding tool. It highlights how Ghostty’s native splits, notification forwarding, and state restoration features minimize friction during long sessions where an AI agent is modifying files and running tests.
The article covers several key optimizations:
- Core configuration for typography (JetBrains Mono Nerd Font), themes, and window persistence to restore layouts between restarts.
- Implementation of the SAND keybinding pattern for intuitive split pane management.
- Three distinct workspace presets: Standard Split, Three-Pane Neovim Layout, and Multi-Project Tab Layout.
- Automation scripts for installing necessary fonts, configuring a compatible Starship prompt (to avoid issues with Powerlevel10k), and setting Ghostty as the default terminal handler.
- A specialized tmux script designed to handle remote sessions while ensuring Claude Code notifications and extended keys pass through correctly.
- Specific JSON settings to synchronize Claude Code's theme and system notification behavior with Ghostty’s environment.
The article covers several key optimizations:
- Core configuration for typography (JetBrains Mono Nerd Font), themes, and window persistence to restore layouts between restarts.
- Implementation of the SAND keybinding pattern for intuitive split pane management.
- Three distinct workspace presets: Standard Split, Three-Pane Neovim Layout, and Multi-Project Tab Layout.
- Automation scripts for installing necessary fonts, configuring a compatible Starship prompt (to avoid issues with Powerlevel10k), and setting Ghostty as the default terminal handler.
- A specialized tmux script designed to handle remote sessions while ensuring Claude Code notifications and extended keys pass through correctly.
- Specific JSON settings to synchronize Claude Code's theme and system notification behavior with Ghostty’s environment.
Secluso is an open-source DIY home security camera system built around the Raspberry Pi Zero 2 W. It focuses on privacy by using true end-to-end encryption (E2EE) via Messaging Layer Security (MLS), ensuring that even untrusted relays cannot decrypt video feeds. The system features on-device AI for detecting humans, pets, and vehicles. To enhance security, the core software is written in Rust to prevent memory-related bugs and includes post-quantum encryption to protect data against future threats.
- Raspberry Pi Zero 2W based hardware architecture
- End-to-end encryption using MLS (RFC 9420)
- On-device AI for human, pet, and vehicle detection
- Memory-safe software core written in Rust
- Post-quantum encryption support
- Minimal Yocto-based Secluso OS
- Support for self-hosted relays or official beta services
- Raspberry Pi Zero 2W based hardware architecture
- End-to-end encryption using MLS (RFC 9420)
- On-device AI for human, pet, and vehicle detection
- Memory-safe software core written in Rust
- Post-quantum encryption support
- Minimal Yocto-based Secluso OS
- Support for self-hosted relays or official beta services
The article argues that giving AI agents access to flexible command-line interfaces is more efficient than using many specialized MCP servers because it reduces context window bloat and enables powerful tool composition through piping.
* Specialized tools often clutter the model's context, while a single CLI allows data to flow directly between processes without increasing token costs.
* Terminal access facilitates complex workflows like multi-environment tasks and cross-tool automation that are cumbersome with individual MCP servers.
* Although providing terminal access increases security risks, these can be managed through sandboxing and restricted user permissions.
* Specialized tools often clutter the model's context, while a single CLI allows data to flow directly between processes without increasing token costs.
* Terminal access facilitates complex workflows like multi-environment tasks and cross-tool automation that are cumbersome with individual MCP servers.
* Although providing terminal access increases security risks, these can be managed through sandboxing and restricted user permissions.
This article explores the feasibility of running Large Language Models (LLMs) locally using only a CPU, challenging the assumption that expensive GPUs are strictly necessary. By testing eight different models on an older Intel i5 laptop with 12GB of RAM via Ollama, the author identifies which models offer practical usability for everyday tasks.
Key points include:
- Using tokens per second as a more critical metric for usability than model size or RAM usage alone.
- Why 1B to 2B parameter models provide the best balance of responsiveness and reasoning on low-end hardware.
- The effectiveness of GGUF quantization (specifically Q4_K_M) in reducing resource demands.
- A comparison of various model tiers, from ultra-fast tiny models like Qwen 0.6B to slower, high-capability models like Ministral 3 8B.
Key points include:
- Using tokens per second as a more critical metric for usability than model size or RAM usage alone.
- Why 1B to 2B parameter models provide the best balance of responsiveness and reasoning on low-end hardware.
- The effectiveness of GGUF quantization (specifically Q4_K_M) in reducing resource demands.
- A comparison of various model tiers, from ultra-fast tiny models like Qwen 0.6B to slower, high-capability models like Ministral 3 8B.
>"Orange Pi is an open source single-board card computer, a new generation of arm64 development board, which can run operating systems such as Android TV 12, Ubuntu and Debian. The Orange Pi Zero 2w development board uses the Allwinner H618 system-on-chip, and can optionally have 1GB or 1.5GB or 2GB or 4GB LPDDR4 memory."
PiShrink is a bash script designed to automatically shrink Raspberry Pi images, making them easier to store and faster to flash onto SD cards. Once the shrunk image is booted, it will automatically resize itself to match the maximum capacity of the target SD card. The tool also supports compression using gzip and xz, with an option for parallel compression across multiple CPU cores to improve speed.
Key points:
- Automatic shrinking of Raspberry Pi images
- Boot-time filesystem expansion to full SD card size
- Support for parallel multi-core compression
- Compatibility with Linux, Windows (via WSL 2), and macOS (via Docker)
Key points:
- Automatic shrinking of Raspberry Pi images
- Boot-time filesystem expansion to full SD card size
- Support for parallel multi-core compression
- Compatibility with Linux, Windows (via WSL 2), and macOS (via Docker)
Linux kernel developer Greg Kroah-Hartman has introduced a new fuzzing tool and AI bot named gregkh_clanker_t1000 that is actively uncovering bugs within the Linux kernel. The tool has already assisted in merging nearly two dozen patches for various subsystems including ALSA, HID, SMB, Nouveau, and IO_uring. Notably, this AI operates as a local large language model (LLM) running on a Framework Desktop powered by AMD Ryzen AI Max (Strix Halo), rather than relying on cloud-based services.
Key points:
* The gregkh_clanker_t1000 tool has contributed numerous bug fixes to the mainline kernel since early April.
* The system utilizes local LLM processing for privacy and efficiency.
* Hardware setup involves a Framework Desktop with AMD Ryzen AI Max+ Strix Halo.
* Emphasis on using an open-source software stack for demanding AI workloads.
Key points:
* The gregkh_clanker_t1000 tool has contributed numerous bug fixes to the mainline kernel since early April.
* The system utilizes local LLM processing for privacy and efficiency.
* Hardware setup involves a Framework Desktop with AMD Ryzen AI Max+ Strix Halo.
* Emphasis on using an open-source software stack for demanding AI workloads.
The Orange Pi Zero 3W is a new compact single-board computer measuring 65 x 32 mm. It features the Allwinner A733 octa-core processor, combining Cortex-A76 and Cortex-A55 cores with an integrated NPU for AI workloads and a RISC-V coprocessor for real-time tasks. The board supports up to 16GB of LPDDR5 memory and offers versatile display options including Mini HDMI, MIPI-DSI, and DisplayPort via USB-C.
* Allwinner A733 SoC with octa-core CPU and 3 TOPS NPU
* Up to 16GB LPDDR5 RAM support
* Connectivity includes Wi-Fi 6, Bluetooth 5.4, and PCIe 3.0
* Multiple display outputs supporting up to 4K resolution
* Support for Android, Debian, Ubuntu, and OpenHarmony
* Allwinner A733 SoC with octa-core CPU and 3 TOPS NPU
* Up to 16GB LPDDR5 RAM support
* Connectivity includes Wi-Fi 6, Bluetooth 5.4, and PCIe 3.0
* Multiple display outputs supporting up to 4K resolution
* Support for Android, Debian, Ubuntu, and OpenHarmony
Post-Mortem: Backup Failure via Filesystem Limit Exhaustion
**Incident Summary:**
A website backup process failed after a single 1.6MB GIF (a "Friends" reaction animation) was replicated 246,173 times within the storage system, inflating its size to 377GB and triggering filesystem limits.
**Root Cause:**
The issue stemmed from a security policy in the Discourse platform's "secure uploads" feature. To maintain security contexts, when a file moves between private and public scopes (e.g., PM to public post), the system generates a new copy with a randomized SHA1 hash rather than referencing the original. High community usage of a specific GIF caused massive data duplication.
**Technical Failure Chain:**
1. **Data Inflation:** Excessive duplication led to 377GB of backup bloat from a single asset.
2. **Failed Mitigation (Hardlinks):** An initial attempt to use hardlinks to group identical hashes failed because the number of duplicates exceeded the **ext4 filesystem limit of ~65,000 hardlinks per inode**. This resulted in approximately 181,000 fallback downloads, failing to resolve the bloat.
**Resolution:**
New logic was implemented for the backup process: The system attempts to create hardlinks first; if the filesystem returns an `EMLINK` error (too many hardlinks), it automatically switches to creating a local copy and designates that as the "primary" file until the limit is reached again. This ensures compatibility across all filesystems without manual configuration.
**Incident Summary:**
A website backup process failed after a single 1.6MB GIF (a "Friends" reaction animation) was replicated 246,173 times within the storage system, inflating its size to 377GB and triggering filesystem limits.
**Root Cause:**
The issue stemmed from a security policy in the Discourse platform's "secure uploads" feature. To maintain security contexts, when a file moves between private and public scopes (e.g., PM to public post), the system generates a new copy with a randomized SHA1 hash rather than referencing the original. High community usage of a specific GIF caused massive data duplication.
**Technical Failure Chain:**
1. **Data Inflation:** Excessive duplication led to 377GB of backup bloat from a single asset.
2. **Failed Mitigation (Hardlinks):** An initial attempt to use hardlinks to group identical hashes failed because the number of duplicates exceeded the **ext4 filesystem limit of ~65,000 hardlinks per inode**. This resulted in approximately 181,000 fallback downloads, failing to resolve the bloat.
**Resolution:**
New logic was implemented for the backup process: The system attempts to create hardlinks first; if the filesystem returns an `EMLINK` error (too many hardlinks), it automatically switches to creating a local copy and designates that as the "primary" file until the limit is reached again. This ensures compatibility across all filesystems without manual configuration.
