Post Syndicated from The Atlantic original https://www.youtube.com/watch?v=nUlbR-Jc0YM
[$] LWN.net Weekly Edition for March 26, 2026
Post Syndicated from jzb original https://lwn.net/Articles/1063660/
Inside this week’s LWN.net Weekly Edition:
- Front: Security collaboration; Manjaro governance; kernel development tools; PHP licensing; kernel direct map patches; sleepable BPF.
- Briefs: LiteLLM compromise; Tor in Taiwan; b4 v0.15.0; 24-hour sideloading; Agama 19; Firefox 149.0; GNOME 50; Krita 5.3.0 and 6.0.0; Quotes; …
- Announcements: Newsletters, conferences, security updates, patches, and more.
Intel Announces Arc Pro B70 and B65 Video Cards: Big Battlemage Brings Big Memory for AI Workstations
Post Syndicated from Ryan Smith original https://www.servethehome.com/intel-announces-arc-pro-b70-and-b65-video-cards-big-battlemage-brings-big-memory-for-ai-workstations/
Today Intel is expanding their Arc B-series video card lineup in a big way, with the launch of a pair of new Arc Pro graphics cards: the Arc Pro B70 and the Arc Pro B65. Joining Intel’s existing Arc Pro B-series video cards, the latest cards out of Intel are also the company’s most powerful […]
The post Intel Announces Arc Pro B70 and B65 Video Cards: Big Battlemage Brings Big Memory for AI Workstations appeared first on ServeTheHome.
Why Some Right-Wing Podcasters Are Vilifying Winston Churchill
Post Syndicated from The Atlantic original https://www.youtube.com/shorts/HobPtEnSZpA
Announcing Amazon Aurora PostgreSQL serverless database creation in seconds
Post Syndicated from Channy Yun (윤석찬) original https://aws.amazon.com/blogs/aws/announcing-amazon-aurora-postgresql-serverless-database-creation-in-seconds/
At re:Invent 2025, Colin Lazier, vice president of databases at AWS, emphasized the importance of building at the speed of an idea—enabling rapid progress from concept to running application. Customers can already create production-ready Amazon DynamoDB tables and Amazon Aurora DSQL databases in seconds. He previewed creating an Amazon Aurora serverless database with the same speed, and customers have since requested quick access and speed to this capability.

Today, we’re announcing the general availability of a new express configuration for Amazon Aurora PostgreSQL, a streamlined database creation experience with preconfigured defaults designed to help you get started in seconds.
With only two clicks, you can have an Aurora PostgreSQL serverless database ready to use in seconds. You have the flexibility to modify certain settings during and after database creation in the new configuration. For example, you can change the capacity range for the serverless instance at the time of create or add read replicas, modify parameter groups after the database is created. Aurora clusters with express configuration are created without an Amazon Virtual Private Cloud (Amazon VPC) network and include an internet access gateway for secure connections from your favorite development tools – no VPN, or AWS Direct Connect required. Express configuration also sets up AWS Identity and Access Management (IAM) authentication for your administrator user by default, enabling passwordless database authentication from the beginning without additional configuration.
After it’s created, you have access to features available for Aurora PostgreSQL serverless, such as deploying additional read replicas for high availability and automated failover capabilities. This launch also introduces a new internet access gateway routing layer for Aurora. Your new serverless instance comes enabled by default with this feature, which allows your applications to connect securely from anywhere in the world through the internet using the PostgreSQL wire protocol from a wide range of developer tools. This gateway is distributed across multiple Availability Zones, offering the same level of high availability as your Aurora cluster.
Creating and connecting to Aurora in seconds means fundamentally rethinking how you get started. We launched multiple capabilities that work together to help you onboard and run your application with Aurora. Aurora is now available on AWS Free Tier, which you gain hands-on experience with Aurora at no upfront cost. After it’s created, you can directly query an Aurora database in AWS CloudShell or using programming languages and developer tools through a new internet accessible routing component for Aurora. With integrations such as v0 by Vercel, you can use natural language to start building your application with the features and benefits of Aurora.
Create an Aurora PostgreSQL serverless database in seconds
To get started, go to the Aurora and RDS console and in the navigation pane, choose Dashboard. Then, choose Create with a rocket icon.

Review pre-configured settings in the Create with express configuration dialog box. You can modify the DB cluster identifier or the capacity range as needed. Choose Create database.

You can also use the AWS Command Line Interface (AWS CLI) or AWS SDKs with the parameter --express-configuration to create both a cluster and an instance within the cluster with a single API call which makes it ready for running queries in seconds.To learn more, visit Creating an Aurora PostgreSQL DB cluster with express configuration.
Here is a CLI command to create the cluster:
$ aws rds create-db-cluster --db-cluster-identifier channy-express-db \
--engine aurora-postgresql \
–with-express-configuration
Your Aurora PostgreSQL serverless database should be ready in seconds. A success banner confirms the creation, and the database status changes to Available.

After your database is ready, go to the Connectivity & security tab to access three connection options. When connecting through SDKs, APIs, or third-party tools including agents, choose Code snippets. You can choose various programming languages such as .NET, Golang, JDBC, Node.js, PHP, PSQL, Python, and TypeScript. You can paste the code from each step into your tool and run the commands.
For example, the following Python code is dynamically generated to reflect the authentication configuration:
import psycopg2
import boto3
auth_token = boto3.client('rds', region_name='ap-south-1').generate_db_auth_token(DBHostname='channy-express-db-instance-1.abcdef.ap-south-1.rds.amazonaws.com', Port=5432, DBUsername='postgres', Region='ap-south-1')
conn = None
try:
conn = psycopg2.connect(
host='channy-express-db-instance-1.abcdef.ap-south-1.rds.amazonaws.com',
port=5432,
database='postgres',
user='postgres',
password=auth_token,
sslmode='require'
)
cur = conn.cursor()
cur.execute('SELECT version();')
print(cur.fetchone()[0])
cur.close()
except Exception as e:
print(f"Database error: {e}")
raise
finally:
if conn:
conn.close()
const { Client } = require('pg');
const AWS = require('aws-sdk');
AWS.config.update({ region: 'ap-south-1' });
async function main() {
let password = '';
const signer = new AWS.RDS.Signer({ region: 'ap-south-1', hostname: 'channy-express-db-instance-1.abcdef.ap-south-1.rds.amazonaws.com', port: 5432, username: 'postgres' });
password = signer.getAuthToken({});
const client = new Client({
host: 'channy-express-db-instance-1.abcdef.ap-south-1.rds.amazonaws.com',
port: 5432,
database: 'postgres',
user: 'postgres',
password,
ssl: { rejectUnauthorized: false }
});
try {
await client.connect();
const res = await client.query('SELECT version()');
console.log(res.rows[0].version);
} catch (error) {
console.error('Database error:', error);
throw error;
} finally {
await client.end();
}
}
main().catch(console.error);
Choose CloudShell for quick access to the AWS CLI which launches directly from the console. When you choose Launch CloudShell, you can see the command is pre-populated with relevant information to connect to your specific cluster. After connecting to the shell, you should see the psql login and the postgres => prompt to run SQL commands.

You can also choose Endpoints to use tools that only support username and password credentials, such as pgAdmin. When you choose Get token, you use an AWS Identity and Access Management (IAM) authentication token generated by the utility in the password field. The token is generated for the master username that you set up at the time of creating the database. The token is valid for 15 minutes at a time. If the tool you’re using terminates the connection, you will need to generate the token again.
Building your application faster with Aurora databases
At re:Invent 2025, we announced enhancements to the AWS Free Tier program, offering up to $200 in AWS credits that can be used across AWS services. You’ll receive $100 in AWS credits upon sign-up and can earn an additional $100 in credits by using services such as Amazon Relational Database Service (Amazon RDS), AWS Lambda, and Amazon Bedrock. In addition, Amazon Aurora is now available across a broad set of eligible Free Tier database services.

Developers are embracing platforms such as Vercel, where natural language is all it takes to build production-ready applications. We announced integrations with Vercel Marketplace to create and connect to an AWS database directly from Vercel in seconds and v0 by Vercel, an AI-powered tool that transforms your ideas into production-ready, full-stack web applications in minutes. It includes Aurora PostgreSQL, Aurora DSQL, and DynamoDB databases. You can also connect your existing databases created through express configuration with Vercel. To learn more, visit AWS for Vercel.

Like Vercel, we’re bringing our databases seamlessly into their experiences and are integrating directly with widely adopted frameworks, AI assistant coding tools, environments, and developer tools, all to unlock your ability to build at the speed of an idea.
We introduced Aurora PostgreSQL integration with Kiro powers, which developers can use to build Aurora PostgreSQL backed applications faster with AI agent-assisted development through Kiro. You can use Kiro power for Aurora PostgreSQL within Kiro IDE and from the Kiro powers webpage for one-click installation. To learn more about this Kiro Power, read Introducing Amazon Aurora powers for Kiro and Amazon Aurora Postgres MCP Server.

Now available
You can create an Aurora PostgreSQL serverless database in seconds today in all AWS commercial Regions. For Regional availability and a future roadmap, visit the AWS Capabilities by Region.
You pay only for capacity consumed based on Aurora Capacity Units (ACUs) billed per second from zero capacity, which automatically starts up, shuts down, and scales capacity up or down based on your application’s needs. To learn more, visit the Amazon Aurora Pricing page.
Give it a try in the Aurora and RDS console and send feedback to AWS re:Post for Aurora PostgreSQL or through your usual AWS Support contacts.
— Channy
[$] Collaboration for battling security incidents
Post Syndicated from jake original https://lwn.net/Articles/1063459/
The keynote for Sun Security Con
2026 (SunSecCon) was given by Farzan Karimi on how incident handling
can go awry because of a lack of collaboration between the “good
guys”—which stands in contrast to how attackers collaboratively operate.
He provided some “war stories” where security incident handling had
benefited from collaboration and others where it was hampered by its lack.
SunSecCon was held in conjunction with SCALE 23x in Pasadena
in early March.
Big Spring Sale BEST Deals 2026 – Price Tracked and Tested!
Post Syndicated from The Hook Up original https://www.youtube.com/watch?v=-LmQYxl6xfg
Police Stings & Deception #lastweektonight
Post Syndicated from LastWeekTonight original https://www.youtube.com/shorts/uadjffSgMII
Are IKEA Matter Sensors Good Enough for Home Assistant?
Post Syndicated from BeardedTinker original https://www.youtube.com/watch?v=joKC9fCGc4w
Setting up a Tor Relay at National Taiwan Normal University (Tor Blog)
Post Syndicated from jzb original https://lwn.net/Articles/1064671/
The Tor Blog has an interesting article
about the non-technical side of setting up a Tor Relay. It documents how a
computer science student at National Taiwan Normal University worked with the
university system to set up a relay and provides a template for future
attempts:
In Taiwan, anonymous networks do not lack technical documentation or
ideological support. The real scarcity is experience from actually working
through the real institutional system once. Especially in an environment where
academic networks are highly centralized and outbound connectivity is tightly
controlled, distributed anonymous infrastructure like Tor Relays is inherently
difficult to sustain.This implementation at National Taiwan Normal University was not meant to
provide a final answer for anonymous networks. It was a concrete attempt made
within real-world institutions. It may not immediately improve the performance
or security of anonymous networks, and it was not intended to become a directly
reproducible standard process. What it did achieve was leaving behind a clearly
visible path of practice—one that can be understood, referenced, and built
upon.
Избори 2026 – висока активност при заявленията, странни сигнали от Турция
Post Syndicated from Боян Юруков original https://yurukov.net/blog/2026/iz2026-zayavleniya/
Снощи изтече срокът за подаване на заявления за гласуване в чужбина за вота на 19-ти април. Поради редица промени в Изборния кодекс в последния момент, правата и възможността на десетки хиляди българи зад граница бяха ограничени. Това и променените правила за отваряне на секции накара много хора да подадат заявление. Описах процеса и защо е важно в началото на кампанията.
В крайна сметка 60897 българи са подали заявления електронно. Това са почти двойно спрямо изборите през октомври 2024-та и на трето място от 9-те вота в последните 10 години. От графиките ще видим, че рекордът от април 2021 се дължи на изключително силно начало на кампанията заради много добрата организация на доброволци и сдружения тогава. В последствия с облекчаването на режима на отваряне на секции и автоматичното им одобряване на база предишна активност в деня на изборите, нуждата от такава организация намаля. Този път, въпреки, че нямаше такава координирана кампания, видяхме огромен наплив на заявления. Това може да е индикация за сериозен интерес на вота напук на опитите за саботаж на изборния процес.
На тази графика виждаме процесът на събиране на заявления според деня от началото на кампанията, а на втората – по дни до края ѝ. Виждаме рязкото увеличение в последните два дни, за което ще стане дума после. Виждаме и че макар да е една от най-кратките кампании – едва 19 дни при предвидени 25 – успя да надхвърли като брой заявленията през ноември 2021-ва, когато имахме също толкова време за събиране.


Във Великобритания и Германия виждаме аналогична крива както в предходните години. Типичното е да започва слабо и да се засилва постепенно в последните три-четири дни. Изключение прави април 2021-ва, когато имаше безпрецедентна кампания за подготовка още в ден едно.


Виждаме същото и за всички страни в чужбина включвайки Турция. Развитието на кампанията следи плътно тази от юли 2021-ва и я задминава предвид, че срокът беше с 4 дни по-кратък. Въпреки последното, бяха събрани почти толкова заявления. Кривите на всички държави в чужбина се аналогични и следват плавно покачване с леко засилване в последните няколко дни.

Сравнявайки с Турция виждаме нещо много различно. Не се вижда силното начало през април 2021-ва, каквото виждаме където и да е другаде. Тогава дори имаше малко заявления. През всички години виждаме монотонно събиране на заявления с почти никакво увеличение в последните дни. Кривите са много различни от другите държави и показват значително по-равномерен темп на подаване на заявления. Изключение прави кампанията през 2017-та, когато в първите 10 дни практически нямаше никакви подадени заявления, след което ударно бяха подавани с аналогична крива като другите години.
Тази година също е изключение в известен смисъл. Макар да започва аналогично на изборите през октомври 2024-та и април 2021-ва, подадените заявления оставаха доста под очакваното. В последните два ни обаче имаше рязък скок нагоре. Нетипичен за която и да е година преди това или друга държава. Докато за първите 17 дни от кампанията са били събрани 9434 заявления, само в последните два са подадени още 6100.

Всичко това създава впечатление за организирано и централизирано подаване на заявления в последния момент. Друг поглед над подаването на заявления в Турция може да видим тук. Разглеждам 30-те места с най-много заявления и броят подадени на всеки 30 мин. в последните два дни от кампанията. Виждат се клъстъри от линии, където равномерно са били подавани заявления за някои секции в конкретни части от деня и почти никакви заявления в други. Има доста, които следват закономертноста от други градове по света, където има много заявления вечерно време. Особено на 24-ти обаче виждаме доста такива групи от нетипично мотоно подаване в рамките на работния ден. По-голяма версия на графиката ще откриете тук, а тук има версия от последните пет дни за същите места.

Дори с подобна активност, броят на заявленията от Турция е рекордно нисък като брой за последните 10 години – едва 15500. Един от най-ниските е и като дял от общите заявления – 25.5%. Виждаме ясно, че активността на българските граждани в Турция по време на самия вот също намалява закономерно през годините. Това е нормално предвид емиграцията на младото поколение в Германия, междуособиците в Турция, както и загубата на доверие и контрол от страна на Пеевски сред хора, които не контролира финансово или чрез прокуратурата.
Разглеждайки броят заявления през времето. Виждаме сериозен интерес от Великобритания и Германия. Аналогично се вижда и в други държави в Европа. В Испания няма такъв интерес и почти няма заявления. Там ще бъдат отворени автоматично доста секции подобно на Германия, където има сериозен пик на заявленията. Това може да се обясни с липса на информационна кампания и активност на местните организации. В САЩ също не виждаме активност, въпреки, че подобно на Турция и Великобритания бяха ощетени от промените в изборния кодекс. Тук може да влияят сериозните социални и икономически проблеми там.

Всичко описано до тук дава информация за заявленията и активността през годините. Подробна информация ще намерите на картата и детайлната таблица, където се следеше в реално време с история по часове.
Колко и къде точно ще бъдат самите секции ще разберем тепърва. Според хронограмата трябва да са ясни в рамките на следващата седмица. Решението за това се взима от ЦИК на база препоръка от МВнР. Адресите ще бъдат обявени от МВнР след това. Ще се опитам да създам навреме карта с всички секции най-късно седмица преди вота. Тогава ще изпратя личен email на всичките над 3000 абонирани за бюлетина на Glasuvam.org, посочили в близост до кой град биха предпочели да гласуват. Абонирайте се, ако искате да получите най-близките секции до вас и съвети за процеса на гласуване.
The Far-Right Algorithm: Anti-Churchill, Anti-West | The David Frum Show
Post Syndicated from The Atlantic original https://www.youtube.com/watch?v=3sa_a98wvsI
LibreQoS v2.0 released
Post Syndicated from jzb original https://lwn.net/Articles/1064669/
Version
2.0 of the LibreQoS traffic-management and network operations
platform has been released.
This release makes LibreQoS easier to operate, easier to understand,
and much more useful for day-to-day network work. Now users can see
more of what is happening across the network, troubleshoot subscriber
issues with better tools, and work from a much stronger local
WebUI.This release includes many capabilities that reflect ideas and
direction long championed by our late colleague, Dave Täht.Dave’s work helped shape the understanding of bufferbloat and the
importance of latency under load across the networking community. His
influence continues to guide both LibreQoS and the broader effort to
improve Internet quality.
The project has also announced
the release of the LibreQoS Bufferbloat Test
v2, also dedicated to Täht. It runs in a user’s browser to look at
“latency under load, jitter, loss, and what those things mean for
“.
the kinds of traffic people actually care about: browsing, streaming,
video calls, audio calls, backups, and gaming
[$] More efficient removal of pages from the direct map
Post Syndicated from corbet original https://lwn.net/Articles/1064090/
The kernel’s direct map provides code running in kernel mode with direct
access to all physical memory installed in the system — on 64-bit systems,
at least. It obviously makes life easier for kernel developers, but the
direct map also brings some problems of its own, most of which are
security-related. Interest in removing at least some pages from the direct
map has been simmering for years; a couple of patch sets under
discussion show some use cases for memory that has been removed from the
direct map, and how such memory might be efficiently managed.
Five new stable kernels
Security updates for Wednesday
Post Syndicated from jzb original https://lwn.net/Articles/1064634/
Security updates have been issued by Debian (chromium), Fedora (chromium, containernetworking-plugins, musescore, and python-multipart), Mageia (perl-XML-Parser, roundcubemail, trilead-ssh2, vim, and webkit2), Oracle (389-ds:1.4, gimp:2.8, glibc, gnutls, kernel, libarchive, nginx:1.24, opencryptoki, python3, uek-kernel, vim, yggdrasil, and yggdrasil-worker-package-manager), Red Hat (delve, osbuild-composer, and skopeo), Slackware (mozilla), SUSE (dpkg, go1.26-openssl, gstreamer-plugins-ugly, kernel, libssh, ovmf, python-pyasn1, python-tornado6, python311, salt, sqlite3, and systemd), and Ubuntu (linux-aws-fips, linux-azure, linux-azure-fips, linux-fips, linux-gcp-fips, linux-iot, linux-kvm, pjproject, and redis).
From Vectors to Verdicts: Web App Testing with Vector Command
Post Syndicated from Ed Montgomery original https://www.rapid7.com/blog/post/pt-vectors-verdicts-web-app-testing-vector-command
If it’s online, it’s a target
Web applications are no longer just business enablers, they’re often the front door to an organization. They can often generate revenue, enforce identity, connect systems and hold customer and business data.
“75% of successful Vector Command breaches were conducted through web apps.” –Principal Security Consultant, Vector Command Team at Rapid7
From SaaS platforms and identity providers to customer portals and internal tools, attackers increasingly rely on web applications as their initial access point. In fact, application-driven attacks account for a significant percentage of real-world breaches. But testing web applications for real risk isn’t the same as scanning for bugs; that’s where Vector Command (Rapid7’s continuous managed red team service) comes in.

How Vector Command approaches web applications
Vector Command evaluates web applications the same way real attackers do, by asking a single question: Can this application be used to meaningfully compromise the organization?
Rather than attempting to enumerate every possible vulnerability, Vector Command focuses on exploitation paths that lead to real outcomes, such as:
-
Account takeover
-
Session hijacking
-
Abuse of SaaS trust relationships
-
Access to internal systems through vulnerabilities, such as malicious file uploads, injection issues, or misconfigurations in common web frameworks
-
Lateral movement across applications
-
Exfiltration of source code, if found during a breach
Testing begins without authentication against externally facing applications, the external attack surface, or to put it another way, what a potential threat actor can see. If legitimate paths exist – self-registration, broken authentication and authorization controls, misconfigurations exposing unintended application functionality, or overall poor site hygiene leaking information that needs further research – those paths are pursued as part of a broader attack chain.
The result isn’t a long list of low-risk findings, but rather a clear picture of what actually works.

What Vector Command does not do
Vector Command is intentionally not a replacement for a full web application penetration test, although Rapid7 does offer this service.
It does not:
-
Guarantee full application coverage.
-
Enumerate non-exploitable low-severity or theoretical vulnerabilities.
-
Review source code unless it’s obtained during an attack.
If your goal is to understand every potential flaw in an application, a dedicated web app penetration test is the right approach. However if your goal is to understand whether your sprawling stack of externally facing applications can be used to break into your organization, Vector Command is designed for that purpose.
A real-world example: when the ticketing system becomes the attack path
In one recent Vector Command engagement, attackers didn’t exploit a zero-day or complex vulnerability.
Instead, they targeted an externally accessible and very popular, SaaS ticketing portal used by IT. Through a well-placed social engineering attempt, they gained access to an internal support workflow. Any organization could register for the customer’s SaaS deployment, which was used to host IT documentation and their ticketing system.
The Vector Command team submitted a ticket to the customer’s IT team, seeking assistance to help fix an application installation issue. A SharePoint URL was provided to IT to view the software documentation, however… This SharePoint site was a proxy phishing portal, created by our Vector Command experts, designed to capture Office365 login sessions and the user’s MFA prompts.
Hook, line and cookie: the result?
The unsuspecting IT help-desk employee had been phished and was convinced to run the Rapid7 payload, giving our Vector Command team access. The engagement demonstrated how easily trust relationships could be abused. From there, a malicious link led to session capture within a trusted collaboration platform.
-
Account takeover
-
Session theft
-
Lateral movement using legitimate tools
-
Access granted without triggering traditional defenses
No single “critical bug” caused the breach. It was the interaction between applications, identity, and trust that made it possible. That’s exactly the kind of risk Vector Command is designed to uncover and each one of our red team members has a particular speciality, when used together, they are formidable.
Vector Command and web app pentesting: better together
Vector Command and web application penetration testing serve different, but complementary purposes. Web app pentests help teams build more secure applications, while Vector Command helps teams understand how those applications affect real-world security exposure.
One improves code; the other tests assumptions.
A final thought
Vector Command doesn’t try to answer “What could be wrong?”, answering instead, “What would actually succeed?”
Modern breaches rarely hinge on a single critical bug. They succeed because trusted systems interact in ways no one has validated.Vector Command tests those assumptions, continuously.
Devices and Chill Stream on Wednesday 3/25 7PM Central
Post Syndicated from digiblur DIY original https://www.youtube.com/watch?v=brBN9mf2jFI
A Wonder Lost: The Pink and White Terraces
Post Syndicated from The History Guy: History Deserves to Be Remembered original https://www.youtube.com/watch?v=rzvBQs1b3g8
Sen. Wyden Warns of Another Section 702 Abuse
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2026/03/sen-wyden-warns-of-another-section-702-abuse.html
Sen. Ron Wyden is warning us of an abuse of Section 702:
Wyden took to the Senate floor to deliver a lengthy speech, ostensibly about the since approved (with support of many Democrats) nomination of Joshua Rudd to lead the NSA. Wyden was protesting that nomination, but in the context of Rudd being unwilling to agree to basic constitutional limitations on NSA surveillance. But that’s just a jumping off point ahead of Section 702’s upcoming reauthorization deadline. Buried in the speech is a passage that should set off every alarm bell:
There’s another example of secret law related to Section 702, one that directly affects the privacy rights of Americans. For years, I have asked various administrations to declassify this matter. Thus far they have all refused, although I am still waiting for a response from DNI Gabbard. I strongly believe that this matter can and should be declassified and that Congress needs to debate it openly before Section 702 is reauthorized. In fact, when it is eventually declassified, the American people will be stunned that it took so long and that Congress has been debating this authority with insufficient information.
Over the decades, we have learned to take Wyden’s warnings seriously.