10 interesting stories served every morning and every evening.

Bambu Lab is abusing the open source social contract

www.jeffgeerling.com

Last year I said I’d prob­a­bly never rec­om­mend an­other Bambu Lab printer again.

I still use my P1S, but af­ter Bambu Lab started push­ing their al­ways-con­nected cloud so­lu­tion as the new de­fault:

I blocked the printer from the Internet via my OPNsense Firewall

I stopped up­dat­ing the firmware

I locked the printer into Developer mode

I deleted Bambu Studio and started us­ing OrcaSlicer

I had to do that to keep it un­der my con­trol, in­stead of Bambu’s.

But I’m weird—I ac­knowl­edge that. I’m one of those crazy ones who likes to own some­thing they pur­chased, and not have the com­pany watch every­thing I do with hard­ware I paid for.

Bambu Lab could’ve left the sta­tus quo at that, and I would­n’t be writ­ing this blog post.

But they did­n’t.

What hap­pened this time?

For con­text: OrcaSlicer is a fork of the open source pro­ject Bambu Studio, which is a fork of Prusa Slicer, which is a fork of slic3r. (They are all li­censed un­der the AGPLv3 open source li­cense).

OrcaSlicer al­ready has to dance around Bambu’s weird de­fault setup where every file you print goes through Bambu’s servers, mean­ing they can see every­thing you ever print on your printer.

That is, un­less you’re like me and you run it in Developer mode, and com­pletely block it from the Internet on old firmware.

Some peo­ple are okay with us­ing OrcaSlicer and print­ing through Bambu’s cloud. It’s con­ve­nient if you’re on the road and want to start a print on your printer at home, with­out man­ag­ing your own VPN.

I run my own WireGuard VPN, so I don’t need that, but I un­der­stand not every­one has the re­sources to man­age their own re­mote ac­cess.

Bambu saw a fork of OrcaSlicer that al­lowed you to use all your print­er’s fea­tures with­out hav­ing to route prints through Bambu’s cloud called OrcaSlicer-bambulab and was like, You know what? No. For the 0.1% of power users who want to run OrcaSlicer with­out the cloud de­liv­ery mech­a­nism like we have in our AGPL-licensed Linux Bambu Studio code… no. You have to use our app, and only our app.”

So they threat­ened that OrcaSlicer fork’s de­vel­oper with le­gal ac­tion for things that de­vel­oper did­n’t do. For ex­am­ple, they in­di­cated the fork used an im­per­son­ation at­tack, de­spite the fork us­ing Bambu Studio’s up­stream code ver­ba­tim.

These are very se­ri­ous pub­lic ac­cu­sa­tions.Bambu Lab did not write to me with these spe­cific pub­lic claims first. They also re­fused my re­quest to pub­lish the full cor­re­spon­dence. Instead, they pub­lished a one-sided pub­lic state­ment where I can­not re­ply di­rectly.In prac­tice, this pre­sents me to the pub­lic as some­one by­pass­ing se­cu­rity, im­per­son­at­ing their client, and cre­at­ing a risk to their in­fra­struc­ture. I re­ject that char­ac­ter­i­za­tion.— OrcaSlicer-bambulabs de­vel­op­er’s re­sponse

These are very se­ri­ous pub­lic ac­cu­sa­tions.

Bambu Lab did not write to me with these spe­cific pub­lic claims first. They also re­fused my re­quest to pub­lish the full cor­re­spon­dence. Instead, they pub­lished a one-sided pub­lic state­ment where I can­not re­ply di­rectly.

In prac­tice, this pre­sents me to the pub­lic as some­one by­pass­ing se­cu­rity, im­per­son­at­ing their client, and cre­at­ing a risk to their in­fra­struc­ture. I re­ject that char­ac­ter­i­za­tion.

— OrcaSlicer-bambulabs de­vel­op­er’s re­sponse

Bambu is abus­ing the open source so­cial con­tract, and us­ing their le­gal might, to sup­press a tiny num­ber of their users1, for who knows what rea­son.

It seems dumb to me, be­cause it would’ve been eas­ier (and more prof­itable) to do noth­ing at all2. Instead, they wrote a blog post blam­ing an in­di­vid­ual open source de­vel­oper for their own in­fra­struc­ture and se­cu­rity prob­lems.

This is where the ac­tual is­sue arises: the mod­i­fi­ca­tion in ques­tion worked by in­ject­ing fal­si­fied iden­tity meta­data into net­work com­mu­ni­ca­tion.In sim­ple terms: it pre­tended to be the of­fi­cial Bambu Studio client when com­mu­ni­cat­ing with our servers.— Bambu Lab blog post

This is where the ac­tual is­sue arises: the mod­i­fi­ca­tion in ques­tion worked by in­ject­ing fal­si­fied iden­tity meta­data into net­work com­mu­ni­ca­tion.

In sim­ple terms: it pre­tended to be the of­fi­cial Bambu Studio client when com­mu­ni­cat­ing with our servers.

— Bambu Lab blog post

I don’t think they un­der­stand open source cul­ture. Security ei­ther, if a pub­lic user agent string is their only pro­tec­tion against DDoS at­tacks…

Instead of find­ing so­lu­tions to ecosys­tem prob­lems and build­ing a more se­cure plat­form, Bambu is putting de­voted power users like the fork’s de­vel­oper on blast3.

When ten­sions flared last year, they wrote a sim­i­lar blog post blam­ing com­mu­nity back­lash on unfortunate mis­in­for­ma­tion’. I imag­ine they meant spec­u­la­tion from com­mu­nity mem­bers (like my­self) frus­trated the whole soft­ware ecosys­tem and own­er­ship model was turned up­side down post-pur­chase.

This year they’re blam­ing one de­vel­oper of a tiny slicer fork for the po­ten­tial im­pact he could have on their en­tire cloud in­fra­struc­ture.

It cre­ates struc­tural vul­ner­a­bil­ity. If this method were widely adopted or in­cor­rectly con­fig­ured, thou­sands of clients could si­mul­ta­ne­ously hit our servers while im­per­son­at­ing the of­fi­cial client. Our sys­tems would have no way to dis­tin­guish traf­fic, be­cause the re­quests would look iden­ti­cal.— Bambu Lab blog post

It cre­ates struc­tural vul­ner­a­bil­ity. If this method were widely adopted or in­cor­rectly con­fig­ured, thou­sands of clients could si­mul­ta­ne­ously hit our servers while im­per­son­at­ing the of­fi­cial client. Our sys­tems would have no way to dis­tin­guish traf­fic, be­cause the re­quests would look iden­ti­cal.

— Bambu Lab blog post

I love how they frame this as a de­vel­oper try­ing to im­per­son­ate their app, when he’s lit­er­ally us­ing the same AGPL-licensed code their Linux app uses.

I find it dou­bly ironic since their own fork caused Bambu users’ teleme­try to hit Prusa’s servers back in 2022, and (to my knowl­edge) Prusa did­n’t snap back with a C&D.

They spent the rest of their blog post talk­ing about vul­ner­a­bil­i­ties, bugs, and in­sta­bil­i­ties—as if that has any­thing to do with a de­vel­oper us­ing up­stream code ver­ba­tim in his fork.

Maybe they could take a new ap­proach and just not lock down their whole ecosys­tem in the first place.

But who am I kid­ding? Nothing I say, and no amount of com­plain­ing in the com­ments be­low, seems to help Bambu see the fault in their ways.

Spending a lit­tle more for a printer from an­other com­pany just might do it, though.

Louis Rossmann posted a video say­ing he’d pledge $10,000 to help the open source dev fight Bambu’s le­gal threats. And I’d hap­pily chip in too, but that’s only use­ful if the dev wants to put him­self back in Bambu’s crosshairs.

The bet­ter play might just be to skip Bambu al­to­gether.

The OrcaSlicer fork in ques­tion did­n’t seem to have much up­take out­side of a very small sub­set of users prior to Bambu Lab’s cease and de­sist or­der. ↩︎

The OrcaSlicer fork in ques­tion did­n’t seem to have much up­take out­side of a very small sub­set of users prior to Bambu Lab’s cease and de­sist or­der. ↩︎

Maybe ask for the fork to not in­clude bambulabs” in the name, since that could be a rea­son­able trade­mark-re­lated de­mand. ↩︎

Maybe ask for the fork to not in­clude bambulabs” in the name, since that could be a rea­son­able trade­mark-re­lated de­mand. ↩︎

The fork’s de­vel­oper men­tioned I pre­vi­ously helped Bambu Studio users with Linux and Wayland is­sues, in­clud­ing on Bambu Lab’s own GitHub. That makes it es­pe­cially ab­surd to me that I am now be­ing pub­licly pre­sented as some­one dan­ger­ous to their in­fra­struc­ture.” ↩︎

The fork’s de­vel­oper men­tioned I pre­vi­ously helped Bambu Studio users with Linux and Wayland is­sues, in­clud­ing on Bambu Lab’s own GitHub. That makes it es­pe­cially ab­surd to me that I am now be­ing pub­licly pre­sented as some­one dan­ger­ous to their in­fra­struc­ture.” ↩︎

Postmortem: TanStack npm supply-chain compromise | TanStack Blog

tanstack.com

by Tanner Linsley on May 11, 2026.

Last up­dated: 2026 – 05-11

On 2026 – 05-11 be­tween 19:20 and 19:26 UTC, an at­tacker pub­lished 84 ma­li­cious ver­sions across 42 @tanstack/* npm pack­ages by com­bin­ing: the pul­l_re­quest_­tar­get Pwn Request” pat­tern, GitHub Actions cache poi­son­ing across the fork↔base trust bound­ary, and run­time mem­ory ex­trac­tion of an OIDC to­ken from the GitHub Actions run­ner process. No npm to­kens were stolen and the npm pub­lish work­flow it­self was not com­pro­mised.

The ma­li­cious ver­sions were de­tected pub­licly within 20 min­utes by an ex­ter­nal re­searcher ashishkurmi work­ing for stepse­cu­rity. All af­fected ver­sions have been dep­re­cated; npm se­cu­rity has been en­gaged to pull tar­balls from the reg­istry. We have no ev­i­dence of npm cre­den­tials be­ing stolen, but we strongly rec­om­mend that any­one who in­stalled an af­fected ver­sion on 2026 – 05-11 ro­tate AWS, GCP, Kubernetes, Vault, GitHub, npm, and SSH cre­den­tials reach­able from the in­stall host.

Tracking is­sue: TanStack/router#7383 GitHub Security Advisory: GHSA-g7cv-rxg3-hmpx

Packages af­fected

42 pack­ages, 84 ver­sions (two per pack­age, pub­lished roughly 6 min­utes apart). See the track­ing is­sue for the full table. Confirmed-clean fam­i­lies: @tanstack/query*, @tanstack/table*, @tanstack/form*, @tanstack/virtual*, @tanstack/store, @tanstack/start (the meta-pack­age, not @tanstack/start-*).

What the mal­ware does

When a de­vel­oper or CI en­vi­ron­ment runs npm in­stall, pnpm in­stall, or yarn in­stall against any af­fected ver­sion, npm re­solves the ma­li­cious op­tion­alDe­pen­den­cies en­try, fetches the or­phan pay­load com­mit from the fork net­work, runs its pre­pare life­cy­cle script, and ex­e­cutes a ~2.3 MB ob­fus­cated router_init.js smug­gled into the af­fected tar­ball. The script:

Harvests cre­den­tials from com­mon lo­ca­tions: AWS IMDS / Secrets Manager, GCP meta­data, Kubernetes ser­vice-ac­count to­kens, Vault to­kens, ~/.npmrc, GitHub to­kens (env, gh CLI, .git-credentials), SSH pri­vate keys

Exfiltrates over the Session/Oxen mes­sen­ger file-up­load net­work (filev2.getsession.org, seed{1,2,3}.get­ses­sion.org) — end-to-end en­crypted with no at­tacker-con­trolled C2, so block­ing by IP/domain is the only net­work mit­i­ga­tion

Self-propagates: enu­mer­ates other pack­ages the vic­tim main­tains via reg­istry.npmjs.org/-/​v1/​search?text=main­tainer:<user> and re­pub­lishes them with the same in­jec­tion

Because the pay­load runs as part of npm in­stal­l’s life­cy­cle, any­one who in­stalled an af­fected ver­sion on 2026 – 05-11 must treat the in­stall host as po­ten­tially com­pro­mised.

All times UTC. Local time­stamps from GitHub API and npm reg­istry.

Pre-attack (cache poi­son­ing phase)

Detonation (publish phase)

Workflow run 25613093674 starts (19:15:44), and fails.

Detection and re­sponse

Formal mal­ware re­ports are sub­mit­ted via npm

Tanner be­gins npm dep­re­ca­tion process for all 84 af­fected pack­ages.

Public Twitter/X/LinkedIn/Bluesky dis­clo­sure from @tan_stack and main­tain­ers

All cache en­tries for all TanStack/* GitHub repos­i­to­ries purged via API.

Hardening PR merged: bun­dle-size.yml re­struc­tured, repos­i­to­ry_owner guards added, third-party ac­tion refs pinned to SHAs.

Official GitHub Security Advisory is pub­lished, CVE re­quested

Three vul­ner­a­bil­i­ties chained to­gether. Each is nec­es­sary for the at­tack; none alone is suf­fi­cient.

1. pul­l_re­quest_­tar­get Pwn Request” pat­tern in bun­dle-size.yml

bun­dle-size.yml ran pul­l_re­quest_­tar­get for fork PRs and, in­side that trig­ger con­text, checked out the fork’s PR-merge ref and ran a build:

yaml

on: pul­l_re­quest_­tar­get: paths: [‘packages/**’, benchmarks/**’]

jobs: bench­mark-pr: steps: - uses: ac­tions/​check­out@v6.0.2 with: ref: refs/​pull/${{ github.event.pul­l_re­quest.num­ber }}/merge # fork’s merged code

- uses: TanStack/config/.github/setup@main # tran­si­tively calls ac­tions/​cache@v5

- run: pnpm nx run @benchmarks/bundle-size:build # ex­e­cutes fork-con­trolled code

on: pul­l_re­quest_­tar­get: paths: [‘packages/**’, benchmarks/**’]

jobs: bench­mark-pr: steps: - uses: ac­tions/​check­out@v6.0.2 with: ref: refs/​pull/${{ github.event.pul­l_re­quest.num­ber }}/merge # fork’s merged code

- uses: TanStack/config/.github/setup@main # tran­si­tively calls ac­tions/​cache@v5

- run: pnpm nx run @benchmarks/bundle-size:build # ex­e­cutes fork-con­trolled code

The au­thor of the work­flow at­tempted a trust split (the com­ment-pr job is sep­a­rate from bench­mark-pr, with a com­ment in the YAML not­ing the in­tent to keep bench­mark-pr untrusted with read-only per­mis­sions”). The split is cor­rect in spirit but missed two facts:

ac­tions/​cache@v5′s post-job save is not gated by per­mis­sions:. Cache writes use a run­ner-in­ter­nal to­ken, not the work­flow GITHUB_TOKEN. Setting per­mis­sions: con­tents: read does not block cache mu­ta­tion.

Cache scope is per-repo, shared across pul­l_re­quest_­tar­get runs (which use the base re­po’s cache scope) and pushes to main. A PR run­ning in the base re­po’s cache scope can poi­son en­tries that pro­duc­tion work­flows on main will later re­store.

2. GitHub Actions cache poi­son­ing across trust bound­aries

The ma­li­cious vite_setup.mjs was specif­i­cally de­signed to write data into the pnpm-store di­rec­tory un­der a key the le­git re­lease.yml work­flow would com­pute and look up: Linux-pnpm-store-${hashFiles(‘**/pnpm-lock.yaml’)}. When the bench­mark-pr job ended, ac­tions/​cache@v5′s post-step saved the (now-poisoned) pnpm store to that ex­act key. When re­lease.yml next ran on a push to main, its Setup Tools step re­stored the poi­soned en­try — en­tirely as de­signed.

This is the class of at­tack doc­u­mented by Adnan Khan in 2024. It’s not a TanStack-specific bug; it’s a known GitHub Actions de­sign is­sue that re­quires con­scious mit­i­ga­tion.

re­lease.yml de­clares id-to­ken: write (legitimately needed for npm OIDC trusted pub­lish­ing). When the poi­soned pnpm store is re­stored on the run­ner, at­tacker-con­trolled bi­na­ries are now on disk and get in­voked dur­ing the build step. Those bi­na­ries:

Locate the GitHub Actions Runner.Worker process via /proc/*/cmdline

Read /proc/<pid>/maps and /proc/<pid>/mem to dump the work­er’s mem­ory

Extract the OIDC to­ken (which the run­ner mints lazily, in mem­ory, when id-to­ken: write is set)

Use the to­ken to au­then­ti­cate POST re­quests di­rectly to reg­istry.npmjs.org — by­pass­ing the work­flow’s Publish Packages step en­tirely

This is the same mem­ory-ex­trac­tion tech­nique (and ver­ba­tim Python script, with at­tri­bu­tion com­ment) used in the tj-ac­tions/​changed-files com­pro­mise of March 2025. The at­tacker did not in­vent novel trade­craft; they re­com­bined pub­lished re­search.

Why none alone is enough

pul­l_re­quest_­tar­get alone is fine for trusted op­er­a­tions (labeling, com­ments)

Cache poi­son­ing alone (e.g., from in­side an al­ready-com­pro­mised dep) re­quires a sep­a­rate pub­lish ve­hi­cle

OIDC to­ken ex­trac­tion alone re­quires ex­ist­ing code ex­e­cu­tion on the run­ner

The chain only works be­cause each vul­ner­a­bil­ity bridges the trust bound­ary the oth­ers as­sumed: PR fork code cross­ing into base-repo cache, base-repo cache cross­ing into re­lease-work­flow run­time, and re­lease-work­flow run­time cross­ing into npm reg­istry write ac­cess.

How we found out

Detection was ex­ter­nal. External re­searcher ashishkurmi work­ing for StepSecurity opened is­sue #7383 ~20 min­utes af­ter the pub­lish, with full tech­ni­cal analy­sis. Tanner re­ceived a phone call from Socket.dev just mo­ments af­ter start­ing the war room con­firm­ing the sit­u­a­tion.

IOC fin­ger­prints (for down­stream main­tain­ers and se­cu­rity tools)

In any @tanstack/* pack­age’s man­i­fest:

json

optionalDependencies”: { @tanstack/setup”: github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c” }

optionalDependencies”: { @tanstack/setup”: github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c” }

File: router_init.js (~2.3 MB, pack­age root, not in files”)

Cache key: Linux-pnpm-store-6f9233a50def742c09fde54f56553d6b449a535adf87d4083690539f49ae4da11

2nd-stage pay­load URLs: https://​lit­ter.cat­box.moe/​h8nc9u.js, https://​lit­ter.cat­box.moe/​7r­rc6l.mjs

Exfiltration net­work: filev2.get­ses­sion.org, seed{1,2,3}.get­ses­sion.org

Forged com­mit iden­tity: claude <claude@users.noreply.github.com> (note: not the real Anthropic Claude — fab­ri­cated GitHub no-re­ply email)

Real at­tacker ac­counts: zblgg (id 127806521), voicpro­ducoes (id 269549300)

Attacker fork: github.com/​zblgg/​con­fig­u­ra­tion (fork of TanStack/router re­named to evade fork searches)

Orphan pay­load com­mit (in fork net­work): 79ac49eedf774dd4b0cfa308722bc463cfe5885c

Workflow runs that per­formed the ma­li­cious pub­lishes:

github.com/​TanStack/​router/​ac­tions/​runs/​25613093674 (attempt 4) github.com/​TanStack/​router/​ac­tions/​runs/​25691781302

github.com/​TanStack/​router/​ac­tions/​runs/​25613093674 (attempt 4)

github.com/​TanStack/​router/​ac­tions/​runs/​25691781302

What went well

External re­searchers no­ticed and re­ported with full tech­ni­cal de­tail within ~20 min of the in­ci­dent

Maintainer team co­or­di­nated im­me­di­ately and ef­fec­tively across many time­zones

The de­tec­tion com­mu­nity al­ready had a clear pub­lic IOC pat­tern within hours

What could have been bet­ter

No in­ter­nal alert­ing. We learned about the com­pro­mise from a third party. We need mon­i­tor­ing on our own pub­lishes. We’ll be work­ing closely with se­cu­rity re­searcher firms in the ecosys­tem that have the abil­ity to de­tect these is­sues very quickly, po­ten­tially even in-house, and mak­ing the feed­back loop even tighter.

pul­l_re­quest_­tar­get work­flows had not been au­dited de­spite be­ing a long-known dan­ger­ous pat­tern

Floating refs (@v6.0.2, @main) on third-party ac­tions cre­ate stand­ing sup­ply-chain risk in­de­pen­dent of this in­ci­dent

Unpublish was un­avail­able for nearly all af­fected pack­ages be­cause of npm’s no un­pub­lish if de­pen­dents ex­ist” pol­icy. We have to rely on npm se­cu­rity to pull tar­balls server-side, which adds hours of de­lay dur­ing which ma­li­cious tar­balls re­main in­stal­lable

The 7-maintainer list on the npm scope means seven sep­a­rate cre­den­tial-theft tar­gets for the same blast ra­dius

OIDC trusted-pub­lisher bind­ing has no per-pub­lish re­view. Once con­fig­ured, any code path in the work­flow can mint a pub­lish-ca­pa­ble to­ken. We need ei­ther (a) move to short-lived clas­sic to­kens with man­ual re­view, or (b) add prove­nance-source-ver­i­fi­ca­tion to de­tect pub­lishes from un­ex­pected work­flow steps

What we got lucky on

The at­tacker chose a pay­load that broke tests, which made the pub­lish step (which would have pro­duced cleaner-look­ing tar­balls) skip — mean­ing the at­tack was loud enough to de­tect quickly. A more care­ful at­tacker who did­n’t break tests could have pub­lished silently for hours longer

The at­tacker reused pub­lic trade­craft (verbatim mem­ory-dump script with at­tri­bu­tion com­ment) in­stead of writ­ing novel code — mak­ing the IOC-matching faster

These need an­swers be­fore we close the post­mortem.

Did bun­dle-size.ym­l’s Setup Tools step ac­tu­ally call ac­tions/​cache@v5? Verify by read­ing the post-job logs from one of the pul­l_re­quest_­tar­get runs against PR #7378 (e.g., run id 25666610798). Tanner has ac­cess; needs to be done man­u­ally

What was in the ini­tial PR head com­mit (before the force-pushes wiped it)? GitHub’s re­flog may have it. Check via gh api or the GitHub sup­port team

How did the ma­li­cious com­mit get into the fork’s git ob­ject store specif­i­cally — was it pushed di­rectly via git, or was it cre­ated via the GitHub web UI (which would leave au­dit-log en­tries)?

Was voicpro­ducoes a real ac­count or a sock pup­pet? Cross-reference its ac­tiv­ity his­tory

Did the npm cache also get poi­soned (the 6 du­pli­cate linux-npm-store-* en­tries)? Were any ac­tu­ally used?

Can we iden­tify any other fork in the TanStack/router fork net­work that con­tains the or­phan pay­load com­mit? (If yes, the cleanup is harder — every fork host­ing it keeps it ac­ces­si­ble via github:tanstack/​router#79ac49ee…)

Are any other TanStack re­pos (router, query, table, form, vir­tual, etc.) us­ing the same bun­dle-size.yml-style pat­tern? Audit needed

How many users ac­tu­ally down­loaded the af­fected ver­sions dur­ing the pub­lish win­dow? Get from npm sup­port

Did any of the seven listed main­tain­ers’ ma­chines get com­pro­mised sep­a­rately? (None of the ma­li­cious pub­lishes used a main­tain­er’s npm to­ken, but main­tainer ma­chines could have been the sec­ondary tar­get via the self-prop­a­ga­tion logic)

Tracking is­sue: TanStack/router#7383

GitHub Security Advisory: GHSA-g7cv-rxg3-hmpx

Related re­search:

Adnan Khan, The Monsters in Your Build Cache: Github Actions Cache Poisoning” (May 2024) — ad­nan­thekhan.com GitHub Security Lab, Keeping your GitHub Actions and work­flows se­cure: Preventing pwn re­quests” — se­cu­rity­lab.github.com StepSecurity, Harden-Runner de­tec­tion: tj-ac­tions/​changed-files ac­tion is com­pro­mised” (March 2025) — stepse­cu­rity.io

Removing the Modem and GPS from my 2024 RAV4 Hybrid

arkadiyt.com

May 13th, 2026 | 14 minute read

Modern cars are com­put­ers on wheels - they have more sen­sors than you can count and are con­stantly phon­ing home with teleme­try data like your lo­ca­tion, speed, fuel lev­els, sud­den ac­cel­er­a­tions/​de­cel­er­a­tions, video footage, dri­ver at­ten­tion data from eye mon­i­tor­ing sys­tems, and hun­dreds of other data points. Cars have in­ward- and out­ward-fac­ing cam­eras. They have mi­cro­phones. They have al­ways-on modems. It’s all en­abled by de­fault with dif­fi­cult or mean­ing­less opt-outs, and your data is mon­e­tized through bro­kers like LexisNexis or Verisk. This all brings a host of se­cu­rity and pri­vacy is­sues - here are some over the years:

In 2025 Subaru had vul­ner­a­bil­i­ties al­low­ing any­one to re­motely un­lock cus­tomers’ cars, as well as ac­cess the real-time GPS lo­ca­tion and lo­ca­tion his­tory of the car of the car

Car man­u­fac­tur­ers share your dri­ving data with in­sur­ance com­pa­nies, which then in­crease your pre­mi­ums

In 2023 Tesla em­ploy­ees in­ter­nally shared cam­era footage of naked cus­tomers and other sen­si­tive im­ages

In 2015 Charlie Miller and Chris Valasek fa­mously took over a Jeep Cherokee with full con­trol of the ig­ni­tion, brakes, locks, steer­ing, etc.

Mozilla de­tailed how 25 car man­u­fac­tur­ers scored abysmally on pri­vacy and how they col­lect data in­clud­ing sexual ac­tiv­ity, im­mi­gra­tion sta­tus, race, fa­cial ex­pres­sions, weight and ge­netic in­for­ma­tion.” They sell this data to third par­ties and use it to build pro­files about you cov­er­ing intelligence, abil­i­ties, char­ac­ter­is­tics, pref­er­ences, and more.”

Tesla had a vul­ner­a­bil­ity in 2017 that al­lowed any­one to re­motely see your car’s lo­ca­tion, man­age other fea­tures, and even sum­mon the car to them­selves

The Car That Watches You Back de­tails how cars are now serv­ing you ads, as well as col­lect­ing vast amounts of data about you. The Hacker News dis­cus­sion about this ar­ti­cle is what prompted this blog post

Now that we’re suf­fi­ciently mo­ti­vated, what can we do about it? In this blog post, rather than re­ly­ing on com­pa­nies’ promises or mean­ing­less opt-outs, we’re go­ing to stop the data at the source by phys­i­cally re­mov­ing the mo­dem (the DCM, or Data Communication Module) as well as the built-in GPS on my 2024 RAV4 Hybrid, so the car will no longer have the ca­pa­bil­ity to send any teleme­try data back home. Let’s dive in:

Will the car still be func­tional?

Yes. Depending on how dif­fer­ent car man­u­fac­tur­ers have wired their cars, how their soft­ware and firmware were writ­ten, etc., vary­ing lev­els of func­tion­al­ity might be af­fected by re­mov­ing the mo­dem and GPS. For this car:

Everything that re­lies on a data con­nec­tion will no longer work. This in­cludes things like over-the-air up­dates as well as Toyota cloud-based ser­vices and SOS func­tion­al­i­tyThis is a safety trade­off - you’re dis­abling au­to­matic crash no­ti­fi­ca­tion and emer­gency call­ing

This is a safety trade­off - you’re dis­abling au­to­matic crash no­ti­fi­ca­tion and emer­gency call­ing

The car’s mi­cro­phone is wired through the DCM, and in the ab­sence of any other changes re­mov­ing the DCM means the in-car mi­cro­phone won’t work, which is in­con­ve­nient if you plan on tak­ing calls in the car. However we’ll in­stall a DCM Bypass Kit (discussed more be­low) to re­store all func­tion­al­ity and have a work­ing mi­cro­phone

CarPlay has a quirk: the phone uses its own GPS but also ac­cepts a lo­ca­tion sig­nal from the car’s GPS unit. After re­mov­ing the DCM, the car would get con­fused about its lo­ca­tion and some­times jump my po­si­tion to the mid­dle of Nevada (I live in San Francisco), mak­ing nav­i­ga­tion an­noy­ing. To work around this we’ll fully dis­con­nect the car’s GPS, so it can’t send a bad lo­ca­tion to the phone­From the ti­tle of the blog post you might have won­dered why bother re­mov­ing the GPS af­ter we’ve re­moved the mo­dem - who cares if the car has built-in lo­ca­tion when it can’t phone home with that data? This is whyThis is a well-doc­u­mented bug with dis­cus­sions on Apple Support threads as well as car-spe­cific fo­rums like rav4­world. This bug af­fects more than just Toyotas, it’s a generic Apple bug even for peo­ple who haven’t re­moved their mo­dem (but anec­do­tally re­mov­ing my mo­dem made the prob­lem worse)

From the ti­tle of the blog post you might have won­dered why bother re­mov­ing the GPS af­ter we’ve re­moved the mo­dem - who cares if the car has built-in lo­ca­tion when it can’t phone home with that data? This is why

This is a well-doc­u­mented bug with dis­cus­sions on Apple Support threads as well as car-spe­cific fo­rums like rav4­world. This bug af­fects more than just Toyotas, it’s a generic Apple bug even for peo­ple who haven’t re­moved their mo­dem (but anec­do­tally re­mov­ing my mo­dem made the prob­lem worse)

Removing the DCM and GPS may void parts of your war­ranty - just some­thing to be aware of. Thanks to the Magnuson–Moss Warranty Act, it can­not void the whole car war­ranty. It can void cov­er­age re­lated to the work you did (cloud ser­vices, telem­at­ics, etc.) but un­re­lated fail­ures like en­gine prob­lems must still be cov­ered

So thank­fully every­thing in the car re­mains 100% func­tional ex­cept the cloud-based ser­vices men­tioned above, which I did­n’t want any­way. There is also one crit­i­cal caveat about Bluetooth:

No more Bluetooth

Important: Even af­ter the mo­dem is re­moved, if you con­nect your phone to the car via Bluetooth then the car will use your phone as an in­ter­net con­nec­tion and send all the same teleme­try data back to Toyota. However, if you use a wired USB con­nec­tion then it does not do that (see the dis­cus­sion here and else­where), so I ex­clu­sively use CarPlay via USB. I wish I had a way to com­pletely dis­able the car’s Bluetooth func­tion­al­ity, but it’s deeply in­te­grated into the head unit.

If you need USB ca­bles for CarPlay I like these USB-A to Lightning and USB-A to USB-C ca­bles from Anker.

Or, if you pre­fer the con­ve­nience of Bluetooth, you can use a Bluetooth -> wired USB adapter like this one. The adapter re­ceives Bluetooth from your phone and pre­sents it­self to the car as a USB de­vice, so the car treats it like a wired con­nec­tion and won’t tether through your phone.

Now, onto the nec­es­sary tools and parts:

Tools/parts needed

For this pro­ject you’ll need:

A trim re­moval kit (I used this one)

A ratchet, ex­ten­sion, 10mm socket, and 8mm sock­etI’ve been ex­tremely happy with this set. However if you’re not plan­ning on do­ing more handyper­son type work then just bor­row these 4 parts from a neigh­bor in­stead of spend­ing the money on a whole set

I’ve been ex­tremely happy with this set. However if you’re not plan­ning on do­ing more handyper­son type work then just bor­row these 4 parts from a neigh­bor in­stead of spend­ing the money on a whole set

(Optional) A pre­ci­sion flat­head screw­driver (like this one). This can help with dis­con­nect­ing wire plugs

This Telematics DCM Bypass Kit, for fix­ing the in-car mi­cro­phone$90 is a bit steep for a part that prob­a­bly costs less than $1 to pro­duce, but the mak­ers of the kit did the work of read­ing the (paywalled) Toyota di­ag­nos­tics to pro­duce a work­ing prod­uct. If you’d like to build your own ver­sion you’ll need to sub­scribe to Toyota TIS to ac­cess the car wiring schemat­ics. It’s un­for­tu­nate that these schemat­ics and other re­pair man­u­als aren’t pub­lic

$90 is a bit steep for a part that prob­a­bly costs less than $1 to pro­duce, but the mak­ers of the kit did the work of read­ing the (paywalled) Toyota di­ag­nos­tics to pro­duce a work­ing prod­uct. If you’d like to build your own ver­sion you’ll need to sub­scribe to Toyota TIS to ac­cess the car wiring schemat­ics. It’s un­for­tu­nate that these schemat­ics and other re­pair man­u­als aren’t pub­lic

Overall this was a medium-dif­fi­culty pro­ject that took me a few hours to com­plete. Now, let’s get to work:

Removing the car mo­dem

1) Push down on the leather of your shifter and re­move the pin (don’t lose it!):

2) Remove the shifter top:

3) Use the trim tool to pop out the base of the shifter. Just lean it to the side, no need to dis­con­nect any­thing:

4) Use your hands to pop out the next panel and lean it to the side:

5) Remove these three 10mm bolts:

6) Pull on this light gray trim piece un­til it dis­con­nects slightly:

7) Pull the ra­dio out, dis­con­nect the plug, and put the ra­dio aside. The ra­dio is held on by clips only and can even be pulled out with your hands, but it re­quires a lit­tle force and the trim re­moval tool may be help­ful. When dis­con­nect­ing the plug it may help to use the pre­ci­sion screw­driver to push down on the tab to un­lock it, but you can also do it with your hands:

8) Pull the next panel (the seat warm­ing con­trols) out with your hands. It’s only held on by clips but may re­quire a bit of force to re­move:

9) Take a photo of all the wiring con­nec­tions on the seat warm­ing con­trols so you can as­sem­ble it cor­rectly later, un­plug all the wires, and set the con­trols aside:

10) You now have ac­cess to the DCM:

11) Removing the DCM re­quires a lot of ma­neu­ver­ing, tight spaces, and pa­tience, but you can do it. There are two 8mm bolts on the right and one 8mm bolt on the left that need to be re­moved. Getting ac­cess to them may re­quire re­mov­ing some of the other har­nesses or com­po­nents that are in the way - just go slow and steady, take your time, and take pho­tos of things be­fore you move them. After those 3 bolts are re­moved you have a lit­tle more play to pull the unit out, and af­ter dis­con­nect­ing the wires in the back you can com­pletely re­move the DCM. Here’s mine out of the car, part num­ber 86741 – 06130:

12) Now that the mo­dem is re­moved we need to in­stall the DCM Bypass Kit so the in-car mi­cro­phone con­tin­ues to work. It’s ex­tremely straight­for­ward, just plug it into the wiring har­ness that you re­moved from the DCM. The plugs will only fit on the cor­rect wires, there’s no way to get it wrong:

13) Reassemble every­thing by go­ing in re­verse or­der. Make sure all clips, bolts, etc. are back in their orig­i­nal po­si­tion and every­thing is seated cor­rectly. This part should go much faster than dis­as­sem­bly.

Now you’re done with the hard part. Next we dis­con­nect the GPS from the head unit, which is sig­nif­i­cantly eas­ier:

Removing the GPS an­tenna

1) Use the trim tool to re­move the back panel be­hind the in­fo­tain­ment screen:

2) Unscrew these four 10mm bolts:

3) Pop the head unit out (it’s only held on by 2 clips at this point). The part num­ber will vary but for my car it was 86140 – 0R710.

4) The GPS an­tenna is one of the sin­gle-wire ca­bles (not the multi-wire plugs). I had 3 sin­gle-wire ca­bles in my unit and the GPS wire was the black wire shown in the pic­ture. I was able to de­ter­mine this by process of elim­i­na­tion - un­plug­ging one of the wires dis­con­nected my car’s re­verse cam­era, un­plug­ging an­other one dis­con­nected CarPlay com­pletely, and the last one was the GPS - worked like a charm. Again, with a Toyota TIS sub­scrip­tion you can get ac­cess to the head unit wiring di­a­gram and not have to make guesses about which wire is which, but process of elim­i­na­tion worked fine for me:

5) Reassemble every­thing by go­ing in re­verse or­der. Again, make sure that all the clips seat prop­erly.

Confirming it worked

After you have every­thing re­assem­bled, turn the car on.

1) If you un­plugged the mo­dem suc­cess­fully then:

The in­fo­tain­ment screen will have an icon in the up­per right cor­ner in­di­cat­ing no con­nec­tion

The SOS light in the over­head con­sole will be off:

2) If the DCM Bypass Kit was in­stalled suc­cess­fully then:

Make a phone call through CarPlay. The re­cip­i­ent should be able to hear you / the mi­cro­phone should be work­ing

Congratulations - your car no longer has the ca­pa­bil­ity to trans­mit teleme­try data. Of course it may still be cap­tured to lo­cal stor­age and can be phys­i­cally col­lected later, but for me that was fine.

Conclusion

Overall I’m very happy with this pro­ject. Unfortunately I think it’s only a mat­ter of time be­fore the mo­dem and GPS be­come more deeply in­te­grated into the car (making this blog post in­fea­si­ble), or cars have more dras­tic fail­ure modes when the mo­dem/​GPS is re­moved, or anti-right-to-re­pair laws get passed to fur­ther clamp down on this be­hav­ior. For now the win stands - no teleme­try leaves the car. Strong Federal pri­vacy laws would make posts like this un­nec­es­sary, that’s the world I’d rather live in.

How I Moved My Digital Stack to Europe

monokai.com

On dig­i­tal sov­er­eignty, and why European cloud is bet­ter than you think

April 29, 2026 10 min. Digital SovereigntyDigital InfrastructureDigital AutonomyEuropean CloudEurope

There’s a ver­sion of this post that starts with a spread­sheet and ends with a quiet sense of sat­is­fac­tion. That’s mostly how it went. But un­der­neath the prac­ti­cal ex­er­cise of swap­ping one SaaS tool for an­other was some­thing that felt more ur­gent, a grow­ing dis­com­fort with how much of my dig­i­tal in­fra­struc­ture sat on servers I did­n’t con­trol, in a ju­ris­dic­tion in­creas­ingly prone to un­pre­dictabil­ity, op­er­ated by com­pa­nies whose in­cen­tives don’t al­ways align with mine.

Digital sov­er­eignty sounds like a buzz­word un­til you think care­fully about what it means. It means know­ing where your data lives. It means not be­ing one pol­icy change, one ac­qui­si­tion, or one ex­ec­u­tive’s bad mood away from los­ing ac­cess to tools your busi­ness de­pends on. It means choos­ing in­fra­struc­ture based on val­ues, not just con­ve­nience.

So I started mi­grat­ing.

Analytics

Google Analytics was the ob­vi­ous first tar­get. It’s the canon­i­cal ex­am­ple of a ser­vice that’s free be­cause you are the prod­uct, your vis­i­tors’ be­hav­ior fun­neled back into Google’s ad­ver­tis­ing ma­chin­ery.

Self-hosting Matomo solved this cleanly. The data stays on my own server, and I’m fully GDPR-compliant with­out the cookie con­sent the­ater that Google Analytics typ­i­cally re­quires. The re­port­ing is com­pre­hen­sive, the in­ter­face is fa­mil­iar enough, and I own every­thing.

The main down­side is main­te­nance over­head. You’re now re­spon­si­ble for up­dates, back­ups, and keep­ing the server healthy. For most se­tups this is low-fric­tion, but it’s not zero fric­tion.

Email

Proton Mail is based in Switzerland, not EU ter­ri­tory, but Swiss pri­vacy law is closely aligned with GDPR and ar­guably stronger in some re­spects. Proton builds its busi­ness model around pri­vacy rather than ad­ver­tis­ing, and end-to-end en­cryp­tion is baked in at the pro­to­col level rather than bolted on. The email client is solid, the cal­en­dar works well, and for any­one mov­ing away from US-based ser­vices, it sits com­fort­ably in the same spirit as the rest of this stack.

One ad­just­ment is get­ting used to Proton’s fil­ter sys­tem, which is a bit more lim­ited than Gmail’s. Gmail lets you write fil­ters against vir­tu­ally any­thing, in­clud­ing the full body of the mes­sage. Proton does­n’t sup­port fil­ter­ing on email con­tent at all. So if you’ve built a work­flow around catch­ing spe­cific phrases or key­words in mes­sage bod­ies, you’ll have to re­think it. For most peo­ple this won’t be a deal­breaker, but it’s worth know­ing be­fore you mi­grate.

There’s also a prac­ti­cal lim­i­ta­tion worth flag­ging: Proton caps cus­tom do­mains at three, even on the Duo plan. If you run sev­eral do­mains, like sep­a­rate ad­dresses for dif­fer­ent pro­jects or busi­nesses, you’ll hit that ceil­ing quickly and need to re­think how you route and send mail. I ended up con­sol­i­dat­ing, which was prob­a­bly over­due any­way, but it was­n’t a choice I made en­tirely freely.

Proton is­n’t free and charges a sub­stan­tial fee com­pared to other op­tions. You’ll get ac­cess to a whole suite of Proton apps though.

Password Management

Once I was in the Proton ecosys­tem, mov­ing pass­word man­age­ment there as well made sense. Proton Pass is end-to-end en­crypted, open source, and ben­e­fits from the same Swiss ju­ris­dic­tion as the rest of Proton’s stack.

1Password is a gen­uinely great prod­uct and this was a lat­eral move more than an up­grade. The in­ter­face is sim­ple, the browser ex­ten­sion works re­li­ably, and hav­ing pass­words, email, and cal­en­dar un­der one en­crypted roof has a cer­tain sat­is­fy­ing co­her­ence to it.

Compute

DigitalOcean has earned its rep­u­ta­tion by do­ing one thing ex­cep­tion­ally well: get­ting out of your way. The UI is clean, the men­tal model is sim­ple, and spin­ning up in­fra­struc­ture never feels like a chore. It’s the plat­form that proved de­vel­oper ex­pe­ri­ence could be a com­pet­i­tive moat.

Scaleway was a pleas­ant sur­prise. I ex­pected a ca­pa­ble-but-rough European al­ter­na­tive, but what I found was a plat­form that’s gen­uinely well thought out. Servers spun up quickly in­side a pri­vate net­work of my own con­fig­u­ra­tion, the con­trol panel is clean, and the op­tions avail­able matched every­thing I ac­tu­ally needed. Scaleway dis­plays pro­jected CO₂ emis­sions along­side server lo­ca­tion choices, a nice touch.

Object Storage

Scaleway’s ob­ject stor­age is S3-compatible, which makes mi­gra­tion me­chan­i­cal rather than painful, up­date your end­point and cre­den­tials and ex­ist­ing code works un­changed.

I used a tool called rclone to sync my old AWS S3 stor­age buck­ets to the new Scaleway S3 buck­ets. This took a lit­tle more than a week of con­stant sync­ing, as these buck­ets were quite large.

Offsite Backups

OVH is the largest European cloud provider and brings the re­li­a­bil­ity and pric­ing you’d ex­pect at that scale. Their ob­ject stor­age works well as a backup des­ti­na­tion and ends up cheaper than Backblaze B2 once you con­fig­ure life­cy­cle rules to move older back­ups to the cold stor­age class.

Getting there, how­ever, re­quires some pa­tience. The OVHcloud con­trol panel is a labyrinth: the life­cy­cle rule con­fig­u­ra­tion is buried some­where in the doc­u­men­ta­tion, and it in­volves some work in the ter­mi­nal. Once it’s set up, it works re­li­ably and the cost dif­fer­ence is mean­ing­ful.

Transactional Emails

Lettermint is a European trans­ac­tional email ser­vice that does the job with­out the bloat. Deliverability is solid, the API is clean, and it has straight­for­ward pric­ing.

Compared to SendGrid, the an­a­lyt­ics are leaner and the ecosys­tem in­te­gra­tions are fewer. SendGrid has years of tool­ing, doc­u­men­ta­tion, and com­mu­nity an­swers be­hind it. Lettermint is newer and smaller. For most trans­ac­tional send­ing use cases (password re­sets, no­ti­fi­ca­tions, re­ceipts) that does­n’t mat­ter much. But if you’re do­ing com­plex multi-stream email in­fra­struc­ture, you’ll want to au­dit the fea­ture set care­fully first.

Error Tracking

Bugsink is a self-hosted er­ror track­ing tool that ac­cepts Sentry’s SDK, which means the mi­gra­tion path is al­most fric­tion­less, change one line of con­fig­u­ra­tion and you’re done.

To be hon­est: Bugsink is bare-bones. There’s no per­for­mance mon­i­tor­ing, no ses­sion re­plays, no ad­vanced alert­ing. It’s not a Sentry re­place­ment for teams that use Sentry prop­erly. For me, it’s a sim­ple re­mote er­ror log, when some­thing breaks in pro­duc­tion I get a stack trace and that’s enough. Sentry’s cloud prod­uct is gen­uinely ex­cel­lent if you need the full fea­ture set, and for larger en­gi­neer­ing teams the breadth al­most cer­tainly jus­ti­fies the cost. But if your use case is tell me when some­thing broke and show me the stack trace”, self-hosted Bugsink does ex­actly that with no data leav­ing your in­fra­struc­ture.

AI API in­te­gra­tion

For my AI API in­te­gra­tions, I switched from OpenAI to Mistral. It worked out per­fectly as I was mostly us­ing sim­pler mod­els any­way.

Mistral is head­quar­tered in Paris and has pub­lished com­pelling open-weight mod­els along­side its API of­fer­ing. The API is clean, the mod­els are fast and ca­pa­ble, and there’s some­thing co­her­ent about a European AI provider that leans into open­ness rather than away from it. For my in­fer­ence work­loads, the switch was lat­eral in qual­ity and mean­ing­fully bet­ter in terms of where the money goes.

CDN

Exception № 1

Not every­thing moved. Cloudflare is a US com­pany, I still use it, and I’m at peace with that.

Here’s the rea­son­ing: Cloudflare sits in front of my pub­lic-fac­ing web­sites. Its job is to cache, pro­tect against DDoS at­tacks, and make con­tent load fast for vis­i­tors around the world. The data flow­ing through it is al­ready pub­lic by de­f­i­n­i­tion. I’m not rout­ing pri­vate com­mu­ni­ca­tions or sen­si­tive ap­pli­ca­tion data through Cloudflare; I’m us­ing it to serve pages that any­one on the in­ter­net can read. The sov­er­eignty cal­cu­lus is dif­fer­ent when the thing you’re pro­tect­ing is al­ready pub­lic.

I did try Bunny CDN, which is European-based and has a great rep­u­ta­tion. For straight­for­ward CDN use it’s ex­cel­lent. But Cloudflare’s fea­ture set (security rules, Workers plat­form, breadth of con­fig­u­ra­tion op­tions) was­n’t matched closely enough to jus­tify the switch for my spe­cific needs. Sometimes the prag­matic an­swer wins.

Payments

Exception № 2

Stripe is one of the few ser­vices I haven’t moved yet, even though pay­ment in­fra­struc­ture is ex­actly the kind of thing I care about hav­ing in a ju­ris­dic­tion I trust. Mollie is a Dutch pay­ment proces­sor with full EU in­cor­po­ra­tion, strong GDPR com­pli­ance by de­sign, and a prod­uct that has ma­tured con­sid­er­ably in re­cent years. The API has con­verged to­ward par­ity for most com­mon pay­ment flows, and for a European busi­ness the re­gional pay­ment method cov­er­age (iDEAL, Bancontact, SEPA) is ar­guably bet­ter.

The mi­gra­tion is on the list. It’s just not a triv­ial one. Payment in­te­gra­tions touch billing logic, web­hooks, tax in­voic­ing and cus­tomer-fac­ing flows in ways that re­quire care­ful test­ing and a good mo­ment to cut over. It’s also more ex­pen­sive than Stripe for my use­case.

AI Code as­sis­tance

Exception № 3

This one felt over­due. OpenAI works fine, but the com­pa­ny’s tra­jec­tory does­n’t align with my own views any­more. After a pe­riod of de­lib­er­ate drift, I felt the need to switch. Ideally I wanted to use Mistral Vibe here, but it just did­n’t make the cut as it could­n’t com­pete with Claude.

Claude Code is now my day-to-day AI as­sis­tant for cod­ing. The rea­son­ing qual­ity is strong, the con­text han­dling is gen­uinely im­pres­sive, and Anthropic’s ap­proach to safety and trans­parency feels more struc­turally grounded.

Anthropic is a US com­pany, so this does­n’t sat­isfy the ju­ris­dic­tional cri­te­rion I ap­plied else­where. But it sat­is­fies some­thing else, the sense that the or­ga­ni­za­tion build­ing the thing has given se­ri­ous thought to what it’s build­ing and why.

It’s also worth not­ing that lo­cal mod­els are be­com­ing in­creas­ingly vi­able. Qwen, Alibaba’s open-weight model fam­ily, is a strong ex­am­ple: ca­pa­ble enough for many real work­loads, run­ning en­tirely on your own hard­ware, with no data leav­ing your ma­chine. The gap be­tween fron­tier API mod­els and what you can run lo­cally is nar­row­ing faster than most peo­ple re­al­ize.

Not every­thing is ideal. Most data cen­ters still sit out­side Europe, and open” means dif­fer­ent things to dif­fer­ent or­ga­ni­za­tions. But the di­rec­tion is right. A world where ca­pa­ble AI runs on your own hard­ware, with pub­lished weights and trans­par­ent train­ing, is a much bet­ter world for dig­i­tal au­ton­omy than one where all in­fer­ence routes through a hand­ful of closed API providers. We’re not there yet, but the tra­jec­tory is en­cour­ag­ing.

Git Version Control

Exception № 4

GitLab also re­mains for now. GitLab is head­quar­tered in the US but of­fers self-hosted op­tions, and the com­pany has long had a strong com­mit­ment to trans­parency and open source. A self-hosted in­stance is on the roadmap, but mov­ing source con­trol is a more sig­nif­i­cant un­der­tak­ing than most of these mi­gra­tions.

GitHub stays in the pic­ture for one spe­cific pur­pose: pub­lic-fac­ing NPM pack­ages and is­sue track­ing for open source soft­ware. When you pub­lish a pack­age or main­tain pub­lic tool­ing, GitHub is where de­vel­op­ers ex­pect to find it. The net­work ef­fects are real, it’s where the forks, stars, and is­sue re­ports come from. For the pub­lic-fac­ing sur­face of open source work, there’s no mean­ing­ful sov­er­eignty con­cern and a lot of prac­ti­cal up­side.

Was it worth it?

The prac­ti­cal fric­tion was real but man­age­able. Most mi­gra­tions were an af­ter­noon of work: up­date a cre­den­tial here, point a DNS record there, ex­port and im­port some data. A few took longer. None were cat­a­strophic. All in all it took longer than ex­pected, but most time was spent in re­search­ing and plan­ning when to do what. Two months in, every­thing is run­ning with­out in­ci­dent. No fires, no re­grets.

Digital sov­er­eignty is­n’t about para­noia. It’s about be­ing con­scious about your in­fra­struc­ture, where you de­cide who holds your data, who can reach it, and what hap­pens when pol­i­tics shift. The tools are there. The ecosys­tem is mostly ma­ture. The only thing that was stop­ping me was in­er­tia. It’s en­tirely pos­si­ble to run a re­li­able, ca­pa­ble, pro­fes­sional dig­i­tal stack mostly from European in­fra­struc­ture. This mi­gra­tion was proof of that.

Linux gaming is getting faster because Windows APIs are becoming Linux kernel features

www.xda-developers.com

Published May 10, 2026, 12:30 PM EDT

His love of PCs and their com­po­nents was born out of try­ing to squeeze every ounce of per­for­mance out of the fam­ily com­puter. Tinkering with his own build at age 10 turned into build­ing PCs for friends and fam­ily, fos­ter­ing a pas­sion that would ul­ti­mately take shape as a ca­reer path.

Besides be­ing the first call for tech sup­port for those close to him, Ty is a com­puter sci­ence stu­dent, with his fo­cus be­ing cloud com­put­ing and net­work­ing. He also com­peted in semi-pro Counter-Strike for 8 years, mak­ing him in­ti­mately fa­mil­iar with every­thing to do with pe­riph­er­als.

Sign in to your XDA ac­count

In March 2026, Linux crossed five per­cent of Steam’s user base for the first time, an all-time high for an op­er­at­ing sys­tem that spent two decades as a nov­elty when it came to any kind of gam­ing. Microsoft’s end-of-sup­port dead­line for Windows 10 last October pushed many users to look at al­ter­na­tives, and the Steam Deck has qui­etly turned mil­lions of peo­ple into Linux gamers with­out them re­ally think­ing about it, lead­ing to more wide­spread adop­tion on desk­top ma­chines.

Most of that progress used to hap­pen in­side a piece of soft­ware called Wine, the trans­la­tion layer that con­vinces Windows games they’re run­ning on Windows. Valve’s tuned ver­sion of Wine, called Proton, is what makes Steam Play and the Steam Deck work. For years, every mean­ing­ful im­prove­ment to Linux gam­ing came from changes to Wine and Proton them­selves. That’s still true, but in­creas­ingly the most im­por­tant changes are hap­pen­ing one layer deeper, in­side the Linux ker­nel. The lat­est ex­am­ple of that is some­thing called NTSYNC, a ker­nel-level dri­ver that has of­fered great per­for­mance gains over pre­vi­ous ver­sions of Wine, and is loaded by de­fault on every Steam Deck that’s up-to-date.

Related

What NTSYNC ac­tu­ally is

An ad­di­tional piece of the per­for­mance puz­zle

NTSYNC is a small piece of dri­ver added di­rectly to the Linux ker­nel that gives it a na­tive im­ple­men­ta­tion of a set of Windows-specific tools that games de­pend on to co­or­di­nate them­selves.

Modern games jug­gle dozens of things at once. While you’re play­ing, your CPU man­ages the ren­der­ing pipeline, load­ing as­sets, run­ning physics, pro­cess­ing au­dio, han­dling AI NPC rou­tines, and track­ing in­puts, all in par­al­lel across mul­ti­ple cores. All those jobs con­stantly have to co­or­di­nate so they don’t trip over each other.

Quiz

8 Questions · Test Your Knowledge

The his­tory of LinuxTrivia chal­lenge

From a Finnish stu­den­t’s side pro­ject to pow­er­ing the world — how well do you know the story of Linux?

OriginsKernelDistrosPioneersMilestones

Begin

01 / 8

Origins

In what year did Linus Torvalds first an­nounce the Linux ker­nel to the world?

A1989B1991C1993D1995

Correct! Linus Torvalds posted his now-fa­mous mes­sage to the comp.os.minix news­group on August 25, 1991, de­scrib­ing Linux as just a hob­by’ pro­ject. Few could have pre­dicted it would one day run the ma­jor­ity of the world’s servers and smart­phones.

Not quite — Torvalds made his an­nounce­ment in 1991. He was a 21-year-old com­puter sci­ence stu­dent at the University of Helsinki at the time, and his mod­est post de­scribed the pro­ject as some­thing that won’t be big and pro­fes­sion­al’ like GNU.

Continue

02 / 8

Pioneers

Which uni­ver­sity was Linus Torvalds at­tend­ing when he cre­ated the first ver­sion of the Linux ker­nel?

AStockholm UniversityBAalto UniversityCUniversity of HelsinkiDMIT

Correct! Torvalds was study­ing at the University of Helsinki in Finland when he be­gan work­ing on Linux as a per­sonal pro­ject, ini­tially in­spired by MINIX, a small Unix-like sys­tem used for ed­u­ca­tional pur­poses.

Not quite — Torvalds was a stu­dent at the University of Helsinki in Finland. He started Linux partly out of frus­tra­tion with the lim­i­ta­tions of MINIX, which his pro­fes­sor Andrew Tanenbaum had de­signed de­lib­er­ately to be sim­ple for teach­ing.

Continue

03 / 8

Kernel

What op­er­at­ing sys­tem pri­mar­ily in­spired Linus Torvalds to cre­ate the Linux ker­nel?

AMS-DOSBMINIXCBSD UnixDSolaris

Correct! MINIX, cre­ated by pro­fes­sor Andrew Tanenbaum, was the di­rect in­spi­ra­tion for Linux. Torvalds used MINIX on his new Intel 386 PC but found it too re­stricted for his needs, which pushed him to write his own ker­nel.

Not quite — the an­swer is MINIX. Torvalds was us­ing MINIX when he started Linux, and even held a fa­mous on­line de­bate with its cre­ator Andrew Tanenbaum about ker­nel de­sign phi­los­o­phy, specif­i­cally mono­lithic ver­sus mi­cro­ker­nel ar­chi­tec­tures.

Continue

04 / 8

Milestones

What was the ver­sion num­ber of the first pub­licly re­leased Linux ker­nel in 1991?

A0.01B0.1C1.0D0.99

Correct! Linux ver­sion 0.01 was the first ker­nel Torvalds re­leased pub­licly in September 1991. It was a rough, early build that could only run on Intel 386 hard­ware and had very lim­ited func­tion­al­ity, but it marked the true be­gin­ning of the Linux pro­ject.

Not quite — the first pub­lic re­lease was ver­sion 0.01 in September 1991. The ker­nel did­n’t reach ver­sion 1.0 un­til March 1994, by which point it had grown sig­nif­i­cantly in ca­pa­bil­ity and had at­tracted con­tri­bu­tions from de­vel­op­ers around the world.

Continue

05 / 8

Distros

Which Linux dis­tri­b­u­tion, first re­leased in 1993, is one of the old­est still ac­tively main­tained to­day?

AUbuntuBFedoraCSlackwareDDebian

Correct! Slackware, cre­ated by Patrick Volkerding, was first re­leased in July 1993, mak­ing it one of the old­est sur­viv­ing Linux dis­tri­b­u­tions. It is known for its sim­plic­ity and Unix-like phi­los­o­phy, and it con­tin­ues to be main­tained to this day.

Not quite — the an­swer is Slackware, re­leased in 1993 by Patrick Volkerding. While Debian was also founded in 1993, Slackware nar­rowly edges it out as the older re­lease. Ubuntu did­n’t ar­rive un­til 2004, and Fedora launched in 2003.

Continue

06 / 8

Origins

The GNU Project, which pro­vided many tools that paired with the Linux ker­nel, was founded by which de­vel­oper?

AEric RaymondBRichard StallmanCBruce PerensDIan Murdock

Correct! Richard Stallman founded the GNU Project in 1983 with the goal of cre­at­ing a com­pletely free Unix-like op­er­at­ing sys­tem. When the Linux ker­nel ap­peared in 1991, it filled the miss­ing piece GNU needed, and the com­bi­na­tion be­came what many call GNU/Linux.

Not quite — it was Richard Stallman who founded the GNU Project in 1983. Stallman is also known for cre­at­ing the GPL (GNU General Public License) and found­ing the Free Software Foundation, two pil­lars that shaped the le­gal and philo­soph­i­cal foun­da­tion of free soft­ware.

Continue

07 / 8

Milestones

Which com­pany re­leased a land­mark com­mer­cial Linux dis­tri­b­u­tion in 1994, help­ing bring Linux into the en­ter­prise world?

ACanonicalBSUSECRed HatDMandriva

Correct! Red Hat re­leased its first Linux dis­tri­b­u­tion in 1994 and be­came one of the most in­flu­en­tial com­mer­cial Linux com­pa­nies in his­tory. It pi­o­neered the en­ter­prise Linux mar­ket and was even­tu­ally ac­quired by IBM in 2019 for ap­prox­i­mately $34 bil­lion.

Not quite — Red Hat is the an­swer. Founded by Marc Ewing and Bob Young, Red Hat helped prove that com­pa­nies could build sus­tain­able busi­nesses around open-source soft­ware. SUSE Linux also launched in 1994, mak­ing it a close ri­val, but Red Hat be­came the more glob­ally dom­i­nant en­ter­prise force.

Continue

08 / 8

Distros

Ubuntu Linux, one of the most pop­u­lar desk­top dis­tri­b­u­tions, is based on which other Linux dis­tri­b­u­tion?

AArch LinuxBFedoraCDebianDGentoo

Correct! Ubuntu is based on Debian and was first re­leased in October 2004 by Mark Shuttleworth’s com­pany Canonical. It was de­signed to make Linux more ac­ces­si­ble to every­day users, and its six-month re­lease cy­cle and long-term sup­port ver­sions made it a fa­vorite for both desk­tops and servers.

Not quite — Ubuntu is built on top of Debian. Debian it­self was founded in 1993 by Ian Murdock and is known for its strict com­mit­ment to free soft­ware and sta­bil­ity. Ubuntu in­her­its Debian’s pack­age man­age­ment sys­tem (APT and .deb pack­ages) but adds its own user-friendly layer on top.

See My Score

Challenge Complete

Your Score

/ 8

Thanks for play­ing!

Try Again

Windows han­dles this co­or­di­na­tion by us­ing a spe­cific set of mech­a­nisms, and be­fore NTSYNC, Wine had to mimic these mech­a­nisms us­ing things like esync and fsync, which both worked, but did­n’t al­ways match Windows ex­actly. NTSYNC builds these mech­a­nisms straight into the Linux ker­nel for the first time, and it means Wine does­n’t have to em­u­late any­thing any­more. The de­vel­oper-fac­ing API calls don’t ac­tu­ally change, Linux just knows how to an­swer them na­tively.

Related

NTSYNC is part of a grow­ing pat­tern

Not the first time Linux has in­her­ited fea­tures be­cause of Windows

NTSYNC is­n’t the first time Linux has gained a new fea­ture specif­i­cally be­cause Windows games needed it. A few years back, Linux added a way for soft­ware to wait on sev­eral events at once, which is some­thing Windows had built in for decades, but Linux did­n’t. Wine had been work­ing around the gap with awk­ward tricks un­til the ker­nel fi­nally got na­tive sup­port.

This work is dri­ven by Valve, by CodeWeavers (the com­pany that em­ploys many of the core Wine de­vel­op­ers, in­clud­ing NTSYNCs au­thor Elizabeth Figura), and by a steady stream of con­trib­u­tors who want Linux to be a real gam­ing plat­form with­out de­pend­ing on out-of-ecosys­tem patches for­ever.

Related

These aren’t mag­i­cal per­for­mance gains

fsync was al­ready pretty good

The head­line per­for­mance gains look great, but they need some con­text. The eye-catch­ing 40 to 200 per­cent FPS gains cited in NTSYNCs orig­i­nal bench­marks were mea­sured against un­mod­i­fied up­stream Wine, which al­most no­body uses to play games on Linux any­more. Most Linux gamers, in­clud­ing every Steam Deck owner, use Proton, which al­ready has fsync. Compared to fsync, NTSYNCs per­for­mance gains are far more mod­est. The games that ben­e­fit most from the change to NTSYNC are games that were re­ally strug­gling be­fore. Anything that was run­ning at de­cent fram­er­ates be­fore­hand is still go­ing to run fine.

Related

These 7 Linux myths you still be­lieve sim­ply aren’t true

Linux is a com­pletely dif­fer­ent beast than it was a decade ago.

Valve adopted it any­way

It’s a great sign

Pierre-Loup Griffais, an en­gi­neer at Valve, has gone on the record to say that fsync was al­ready fast enough, and de­spite that, Valve still shipped NTSYNC in sta­ble SteamOS in March any­way, which speaks to the fact that fsync is still a workaround at its core, and can be the cause of is­sues out­side of poor raw FPS.

These old workarounds got sub­tle edge cases wrong in ways that pro­duced oc­ca­sional hitches, dead­locks, or weird be­hav­ior in spe­cific games, which are bugs that don’t show up on bench­mark charts but can ab­solutely ruin in­di­vid­ual ex­pe­ri­ences. NTSYNC fixes those at the source by match­ing Windows be­hav­ior ex­actly, and that means as soon as your fa­vorite dis­tro moves to the new ker­nel ver­sion, whether it be Bazzite, CachyOS, Fedora, or a fla­vor of Ubuntu, they all get this much-needed fix.

Related

4 rea­sons Valve’s full SteamOS re­lease will change PC gam­ing again

Valve’s full SteamOS re­lease will change PC gam­ing again, and here are some of the most im­por­tant ways.

Gaming on Linux con­tin­ues to im­prove by the month

Linux has grown so much in the gam­ing de­part­ment. Where there once was noth­ing but clever Wine patches and com­mu­nity workarounds now lies sup­port from gam­ing be­he­moths like Valve, dri­ving changes to the Linux ker­nel it­self. NTSYNC won’t be the last time a piece of Windows gets re­built in­side Linux be­cause gamers needed it, and with more than five per­cent of Steam’s user base now run­ning Linux, the in­cen­tive to keep do­ing it has never been stronger.

Googlebook: Designed for Gemini Intelligence

googlebook.google

Be in the know.

Sorry, some­thing went wrong. Please en­ter your name and email again.

I con­firm I am 18 years of age or older. I ac­cept and ac­knowl­edge that my in­for­ma­tion will be used in ac­cor­dance with

Be in the know.

Sorry, some­thing went wrong. Please en­ter your name and email again.

I con­firm I am 18 years of age or older. I ac­cept and ac­knowl­edge that my in­for­ma­tion will be used in ac­cor­dance with

Intelligence is the new spec.

Link to Youtube Video (visible only when JS is dis­abled)

The best of Gemini meets our most ad­vanced lap­tops.

Select any­thing to ask, com­pare, or cre­ate with Gemini, in­stantly.1

Open your phone apps on your lap­top, no in­stalls needed.2

Access files from your phone as if they live on your lap­top.2

Be in the know.

Sorry, some­thing went wrong. Please en­ter your name and email again.

I con­firm I am 18 years of age or older. I ac­cept and ac­knowl­edge that my in­for­ma­tion will be used in ac­cor­dance with

Check re­sponses. Internet con­nec­tion re­quired. 18+. Results may vary based on vi­sual matches and are for il­lus­tra­tive pur­poses only. Sequences short­ened.

Setup re­quired. Phone with Android 17 or above re­quired.

Why senior developers fail to communicate their expertise

www.nair.sh

§01

A se­nior de­vel­oper is a prob­lem avoider

When I join a team there are two kinds of se­nior de­vel­op­ers I meet.

The first kind says things like:

I found this new tool and it’s pretty cool …”“This com­pany <company to­tally un­like the one we’re in> does things this way, so …”“Here, look at this HackerNews post that says this is best prac­tice, we should prob­a­bly …”

I found this new tool and it’s pretty cool …”

This com­pany <company to­tally un­like the one we’re in> does things this way, so …”

Here, look at this HackerNews post that says this is best prac­tice, we should prob­a­bly …”

I don’t like this kind of se­nior de­vel­oper. A lit­tle self-pro­tec­tive, lots of time spent in the in­dus­try, prob­a­bly a good peo­ple per­son.

But not my wave­length.

Then there’s also this kind of se­nior de­vel­oper:

Do we re­ally need that?”“What hap­pens if we don’t do this?”“Can we make do for now? Maybe come back to this later when it be­comes more im­por­tant?”

Do we re­ally need that?”

What hap­pens if we don’t do this?”

Can we make do for now? Maybe come back to this later when it be­comes more im­por­tant?”

Ah, baby, this is my se­nior de­vel­oper. The avoider, the re­ducer, the re­cy­cler. They want to avoid de­vel­op­ment as much as they can.

Why? Because they hunt a sin­gu­lar mon­ster in pro­fes­sional soft­ware de­vel­op­ment: com­plex­ity.

Special cases, if con­di­tions, new data­base ta­bles, new com­po­nents. All yuck yucks. The se­nior de­vel­oper wants as lit­tle of this as pos­si­ble, spend­ing lots of time mak­ing sure they ab­solutely need to add more code.

Because adding to a sys­tem is risk­ing more com­plex­ity.

Yes, yes, of course this is sim­plis­tic. There are se­nior de­vel­op­ers who ex­cel at tak­ing on un­solved prob­lems and find­ing new cre­ative de­signs.

But even­tu­ally, if you’re tak­ing re­spon­si­bil­ity for a work­ing sys­tem, you’re scared of com­plex­ity.

Now, why is that? What’s the down­side of com­plex­ity? And why does­n’t any­body else get it?

§02

The rest of the busi­ness is scared of un­cer­tainty

We’re go­ing to be sim­pli­fy­ing what a busi­ness is us­ing two loops.

This is the first loop; mar­keters, sales­peo­ple, prod­uct man­agers, the CEO, they all live here:

The main goal of this loop is to try and learn. The busi­ness wants to take things to mar­ket and then get feed­back on whether they’ve got some­thing valu­able or not.

The mon­ster, for peo­ple in this loop, is un­cer­tainty.

And un­cer­tainty is cruel be­cause no strat­egy is guar­an­teed to work. When com­bined with time (compensation for mar­ket­ing/​sales, or pay­roll for founders, or data for prod­uct man­agers) it can feel like tak­ing things to mar­ket as fast as pos­si­ble is the only way to re­duce un­cer­tainty be­fore a dead­line. The more you can take to the mar­ket, the more you can get feed­back from it, the more you can (potentially) re­duce un­cer­tainty.

This loop, and all com­pa­nies start with this loop, is about pure, raw, speed.

But what hap­pens when a busi­ness gets cus­tomers?

§03

Senior de­vel­op­ers care a lot about sta­bil­ity

Ah, now, here’s our sec­ond loop. People pay­ing for a ser­vice.

This loop is where a lot of se­nior de­vel­op­ers find them­selves in. The main goal in this loop is the con­tin­u­a­tion and guar­an­tee of ser­vice.

Keep things work­ing, keep things un­der­stand­able, keep things de­bug­gable, keep things fix­able, keep things teach­able, keep things sta­ble.

Senior de­vel­op­ers worry about sta­bil­ity be­cause they take re­spon­si­bil­ity for the busi­ness to con­tinue serv­ing cus­tomers.

And what risks all of that?

Complexity.

It makes a sys­tem less un­der­stand­able, less de­bug­gable, less fix­able, less teach­able, and ul­ti­mately, less sta­ble.

Rising com­plex­ity = low­er­ing sta­bil­ity = se­nior de­vel­oper fail­ing re­spon­si­bil­ity = bad bad not nice, pay­ments in­ter­rupted, every­body sad.

So, if the first loop’s goal was un­cer­tainty re­duc­tion, the sec­ond loop’s goal is com­plex­ity man­age­ment.

But why does this lead to com­mu­ni­ca­tion fail­ure?

Because once you have cus­tomers, both loops are run­ning si­mul­ta­ne­ously. A busi­ness needs to both ex­plore pos­si­bil­i­ties and serve cus­tomers at the same time.

Ok, now you might be able to spot my an­swer to the ques­tion in the ti­tle of this post.

Depending on which loop you spend your time on, your prob­lem is framed dif­fer­ently (which is why I think de­vel­op­ers get split in their opin­ions on AI; some work more on one loop than the other)

This was the story of the peo­ple in the first loop:

But this was the story of the se­nior de­vel­oper in the sec­ond loop:

The sto­ries don’t match.

The more re­quests to build and add to the sys­tem the se­nior de­vel­oper gets, the more the se­nior de­vel­oper wants to re­spond with uhhh, no com­plex­ity … main­te­nance costs … un­der­stand­abil­ity … speed of con­tin­u­ing de­vel­op­ment … pro­duc­tiv­ity over time …”.

But that does noth­ing to ad­dress the rest of the busi­ness’s need for re­duc­ing un­cer­tainty.

The copy­writer’s di­ag­no­sis: You can’t ex­plain away some­one else’s prob­lem us­ing your own prob­lems.

And the copy­writer’s pre­scrip­tion: You need to de­scribe your so­lu­tion as a so­lu­tion to their prob­lem as well.

Senior de­vel­op­er’s fail to com­mu­ni­cate be­cause they ex­press their prob­lems in terms of com­plex­ity man­age­ment when they should be ex­press­ing their so­lu­tions in terms of un­cer­tainty re­duc­tion.

By ac­knowl­edg­ing that what the rest of the com­pany is seek­ing for is un­cer­tainty re­duc­tion, the se­nior de­vel­oper can use their ex­per­tise to help.

And what’s the most use­ful skill a se­nior de­vel­oper has? The re­luc­tance to build what’s not nec­es­sary; the abil­ity to spot an op­por­tu­nity to re-use some­thing al­ready built.

Need to col­lect sur­vey data? Google forms, baby.

Need to build a whole new fea­ture to test it? Have you tried putting a but­ton in the ex­ist­ing UI and see­ing if peo­ple click it?

Need new an­a­lyt­ics ser­vice? What’s the most im­por­tant de­ci­sion we need an­a­lyt­ics for? Can we start with one de­ci­sion, one chart, one met­ric?

You want to bake me a whole birth­day cake? Just put a can­dle on my sand­wich.

This is what se­nior de­vel­op­ers learn to do: they learn how to give peo­ple what they want by be­ing re­source­ful with ex­ist­ing soft­ware.

But how do you com­mu­ni­cate this with­out send­ing peo­ple whole es­says?

Copywriters love boil­ing down mul­ti­ple sig­nals into sin­gu­lar phrases. And so, here’s the mag­i­cal phrase every se­nior de­vel­oper must learn: Can we try some­thing quicker?’

The use of quicker’ ac­knowl­edges what they’re re­ally look­ing for; something’ im­plies an­other way of achiev­ing it; try’ im­plies im­per­fec­tion, but also the pos­si­bil­ity of it be­ing good enough.

It per­fectly cuts down to the re­quire­ment of the rest of the com­pany, speed to re­duce un­cer­tainty, while al­low­ing the se­nior de­vel­oper to ex­er­cise their ex­per­tise: re­duce, re-use, and if life is truly a bless­ing, avoid.

That’s it. That’s my an­swer to the ti­tle of the post: se­nior de­vel­op­ers talk in terms of com­plex­ity when every­one else is wor­ried about un­cer­tainty.

But! Big but!

AI now seems to make all of this point­less, does­n’t it? Why re­duce? Why re-use? Why avoid? The AI can build so much in so lit­tle time.

Ah, well, it can’t yet do the one thing se­nior de­vel­op­ers still do.

Take re­spon­si­bil­ity.

§04

Senior de­vel­op­ers as ed­i­tors more than writ­ers

Senior de­vel­op­ers care a lot about un­der­stand­ing the sys­tem be­cause un­der­stand­ing al­lows fix­ing it when things go wrong. It al­lows ex­tend­ing it in­tel­li­gently when the sys­tem needs to grow. It al­lows, more than any­thing, the con­tin­ued, re­li­able ser­vic­ing of pay­ing cus­tomers.

AI threat­ens this un­der­stand­abil­ity. It is in­cred­i­ble at im­prov­ing the speed of tak­ing things to the mar­ket, but it also af­fects the other loop, the one the se­nior de­vel­op­ers are re­spon­si­ble for.

If you have a bunch of AI agents, ju­nior de­vel­op­ers, non-de­vel­op­ers, and your in­vestors and their moth­ers adding code into the sys­tem, you get a sys­tem that over­com­pen­sates for speed by giv­ing up sta­bil­ity.

This was the busi­ness in two loops:

And this is how AI af­fects the two loops:

Forget main­tain­ing sta­bil­ity, AI is a down­right desta­bi­lizer. It wors­ens un­der­stand­abil­ity, fix­a­bil­ity, de­bug­ga­bil­ity, teach­a­bil­ity, guar­an­te­abil­ity, all the bloody bil­i­ties.

AI does this and takes no re­spon­si­bil­ity.

Not nice. This is the se­nior de­vel­op­er’s main worry that’s be­ing brushed away.

Luckily, se­nior de­vel­op­ers have a few tricks up their sleeve.

Namely: de­cou­pling.

For the longest time, soft­ware de­vel­op­ers were the only ones who could build soft­ware. They were re­spon­si­ble for both loops.

That’s one sys­tem sup­port­ing two goals.

What if we had two sys­tems, one for each goal?

An anal­ogy: a fic­tion writer rushes to com­plete a first draft (often called a vomit draft) and later ex­tracts what’s work­ing and gets rid of what’s not. There’s an edit­ing process af­ter the first ini­tial rapid write. The ed­i­tor’s job is to take the bits that are work­ing well and shape it all into a co­he­sive whole.

What if we had one sys­tem just for speed? Everyone fo­cused on bring­ing things to life could work here. AI agents, our own gen­er­ated and un­re­viewed code, ju­nior devs, mar­ket­ing etc.

We could call this the Speed’ ver­sion of the sys­tem. It’s not meant to be un­der­stand­able, the goal is get­ting things good enough to take it to the mar­ket for feed­back.

And then what if we had a sec­ond sys­tem fo­cused on sta­bil­ity?

We could call this the Scale’ ver­sion of the sys­tem. It’s de­signed by se­nior de­vel­op­ers to be sta­ble, un­der­stand­able, and scal­able.

The Speed’ ver­sion al­lows the rest of the busi­ness to con­tinue learn­ing from the mar­ket, as the se­nior de­vel­op­ers build a trail­ing ver­sion of the sys­tem that’s well-re­viewed and un­der­stand­able.

Plus, the de­sign of the Scale’ ver­sion is in­flu­enced by what worked and what does­n’t work in the Speed’ ver­sion of the sys­tem.

Features get built on Speed’ but then sta­bi­lized on Scale’.

What this looks like in prac­tice might be un­clear, but the idea is to have a well-com­mu­ni­cated de-cou­pling that ex­plains that there’s a dif­fer­ence be­tween go­ing for speed and go­ing for sta­bil­ity.

Imagine you get asked to build some­thing am­bi­tious, and you say:

Sure, I’ll have the Speed ver­sion ready in 3 days. Then the Scale ver­sion in about 6 weeks.”

They get what they want, speed and mo­men­tum. You get what you want, ob­ser­va­tion and de­sign.

Maybe?

Your thoughts, se­nior soft­ware de­vel­oper?

Or should I say, se­nior soft­ware ed­i­tor?

Mozilla to UK regulators: VPNs are essential privacy and security tools and should not be undermined  – Open Policy & Advocacy

blog.mozilla.org

In the con­text of con­cerns around young peo­ple’s in­ter­ac­tions with dig­i­tal tech­nolo­gies, the UKs Department for Science, Innovation and Technology is con­sult­ing on ad­di­tional mea­sures to pre­pare young peo­ple for grow­ing up in a dig­i­tal world. Before the back­drop of users cir­cum­vent­ing age as­sur­ance sys­tems man­dated un­der the UKs Online Safety Act, the con­sul­ta­tion con­sid­ers age-gat­ing vir­tual pri­vate net­works (VPNs).

Mozilla’s mis­sion is grounded in the be­lief that the in­ter­net must re­main open and ac­ces­si­ble to all, and that pri­vacy and se­cu­rity on­line are fun­da­men­tal hu­man rights. We rec­og­nize that the pro­tec­tion of young peo­ple on­line is one of the most press­ing and chal­leng­ing ques­tions of our time, and we are com­mit­ted to sup­port­ing pol­icy pro­pos­als that ad­dress the root causes of on­line harms. We are con­cerned, how­ever, that blunt in­ter­ven­tions like manda­tory age as­sur­ance and re­strict­ing ac­cess to tools like VPNs are not ef­fec­tive in im­prov­ing the pro­tec­tion af­forded to young peo­ple on­line, while un­der­min­ing the fun­da­men­tal rights of all users.

VPNs serve as crit­i­cal pri­vacy and se­cu­rity tools for users across all ages. By hid­ing users’ IP ad­dresses, VPNs help pro­tect users’ lo­ca­tion, re­duce track­ing and avoid IP-based pro­fil­ing. People use VPNs for lots of dif­fer­ent rea­sons: to con­nect to their school’s or em­ploy­er’s net­work re­motely, to avoid cen­sor­ship or to sim­ply pro­tect their pri­vacy and se­cu­rity on­line. While be­ing able to ac­cess VPNs is es­pe­cially im­por­tant for vul­ner­a­ble groups like ac­tivists, dis­si­dents or jour­nal­ists, VPNs im­prove every­one’s base­line pro­tec­tion on­line.

Young peo­ple are par­tic­u­larly vul­ner­a­ble to on­line track­ing, tar­geted ad­ver­tis­ing, and the risks that flow from per­sonal data be­ing col­lected and processed for com­mer­cial pur­poses with­out ad­e­quate con­sent or trans­parency. In a world in which young peo­ple are in­ter­act­ing with dig­i­tal tech­nolo­gies as part of their re­al­i­ties from young ages on­ward, re­strict­ing young peo­ple’s ac­cess to pri­vacy-pro­tect­ing tech­nolo­gies is in ten­sion with the goal of equip­ping them to nav­i­gate the in­ter­net safely and com­pe­tently. In or­der to be able to de­velop agency and re­spon­si­ble habits in en­gag­ing with dig­i­tal tech­nolo­gies, it is cru­cial for young peo­ple to be in­tro­duced to best prac­tices and key safety and pri­vacy tools as they en­gage with the on­line world.

Rather than age-gat­ing tech­nolo­gies like VPNs, we be­lieve that reg­u­la­tors should ad­dress the root causes of on­line harm by hold­ing plat­forms to ac­count, en­cour­ag­ing the re­spon­si­ble use of parental con­trols and in­vest­ing in dig­i­tal skills and a whole of so­ci­ety ap­proach to dig­i­tal well­be­ing.

Read our full sub­mis­sion to the Department for Science, Innovation and Technology.

RTX 5090 + M4 MacBook Air: Can it Game?

scottjg.com

What if you could strap a full desk­top GPU to your MacBook Air? Turns out, you can.

Just a quick FTC re­quired note: When you buy through my links, I may earn a com­mis­sion.

Never tell me the odds

As much as I hate to ad­mit it, step one in most of my pro­jects now is to ask AI about it. Maybe it’ll tell me some­thing I don’t know.

Fortunately, bor­der­line-im­prac­ti­cal is kind of my thing.

What’s a Thunderbolt eGPU?

Ok, so the plan is to plug a big PC gam­ing GPU, an NVIDIA RTX 5090, into my M4 MacBook Air. To do that, we plug it into a Thunderbolt dock which adapts PCIe to Thunderbolt, and we plug that into a USB-C port.

Thunderbolt tun­nels PCIe over a USB-C ca­ble, so from the com­put­er’s per­spec­tive a Thunderbolt de­vice re­ally is a PCIe de­vice, not a USB one. You get 4 PCIe lanes at up to 40Gbps on Thunderbolt 4, with a small per­for­mance penalty for the tun­nel­ing. USB4 in­cludes the same PCIe tun­nel­ing as an op­tional fea­ture, so some non-Thun­der­bolt USB4 ports can do this too. You can use this to plug a GPU into a lap­top with a com­pat­i­ble port.

Thunderbolt from the lap­top plugs into the GPU dock. The GPU plugs into the mon­i­tor via DisplayPort. Shortly af­ter this was taken, I broke this dock.

From the com­put­er’s per­spec­tive, the de­vice looks more or less like a slightly slower PCIe de­vice, so you can usu­ally use the same dri­vers you’d nor­mally use for those de­vices. eG­PUs work pretty much out of the box on Linux and Windows. It’s even pos­si­ble to use one on a Raspberry Pi (albeit with Oculink, not Thunderbolt).

The first hur­dle is that ma­cOS does not ship with dri­vers for NVIDIA or AMD GPUs on Apple Silicon.

What about tiny­grad?

tiny­grad re­cently re­leased their own ma­cOS eGPU dri­vers. It’s a whole new AI stack with its own open source dri­ver pipeline for NVIDIA and AMD hard­ware.

Sadly, if your main ob­jec­tive is to run AI in­fer­ence or play games, tiny­grad prob­a­bly is­n’t the so­lu­tion you’re look­ing for. This video by YouTuber Alex Ziskind shows that us­ing an eGPU via tiny­grad for in­fer­ence is about 10 times slower than run­ning na­tive Metal in­fer­ence di­rectly on an M4 Pro with­out an eGPU. You can only use the tiny­grad eGPU dri­ver with the tiny­grad stack, not for any­thing else. It also has very lim­ited sup­port for dif­fer­ent AI mod­els.

Getting NVIDIA PTX code run­ning on the GPU is one thing. Writing a full gen­eral-pur­pose dis­play dri­ver that works with ar­bi­trary soft­ware is a sig­nif­i­cantly harder prob­lem. So for now, what can you ac­tu­ally do with an eGPU and a Mac?

The ex­ist­ing Linux dri­ver

Linux can run on Apple Silicon Macs now. Regrettably, at this time, the Linux ker­nel does not sup­port Thunderbolt on Apple Silicon (only in­ter­nal de­vices and USB3). But…

You can run Linux in a 64-bit ARM VM on a ma­cOS host. ma­cOS sup­ports Thunderbolt de­vices. Linux sup­ports NVIDIA GPUs. Let’s put the pieces to­gether and pass through the GPU into the Linux VM.

At a high level, we’re just go­ing to put the GPU in the Linux VM. The VM is the same ar­chi­tec­ture as the Mac host (arm64), so per­for­mance should be com­pa­ra­ble. Of course, the devil is in the de­tails.

There is no dri­ver for NVIDIA cards on ARM64 Windows. That’s why we use Linux.

There is no dri­ver for NVIDIA cards on ARM64 Windows. That’s why we use Linux.

For a quick video demo of the re­sult, take a look:

In the rest of the post, I’ll go through the long and wind­ing road of get­ting this to ac­tu­ally work. If you just want to see screen­shots and bench­marks, you can prob­a­bly skip to the bench­mark sec­tion.

Engineering PCI Passthrough on ma­cOS

PCI de­vice ba­sics

Let’s look at two things we need work­ing for the VM to talk to the PCI de­vice:

PCI BAR (Base Address Registers) - Each PCI de­vice com­mu­ni­cates through chunks of mem­ory that the com­puter can read and write to. There’s ba­si­cally a re­served re­gion of mem­ory on your com­puter for each de­vice. Those mem­ory re­gions have to be mir­rored into the VM for PCI passthrough to work.

PCI BAR (Base Address Registers) - Each PCI de­vice com­mu­ni­cates through chunks of mem­ory that the com­puter can read and write to. There’s ba­si­cally a re­served re­gion of mem­ory on your com­puter for each de­vice. Those mem­ory re­gions have to be mir­rored into the VM for PCI passthrough to work.

DMA (Direct Memory Access) - This is how the de­vice can read and write in­for­ma­tion di­rectly in/​out of your com­put­er’s mem­ory. Instead of hav­ing the CPU burn cy­cles copy­ing data from the de­vice, the de­vice can copy the mem­ory au­to­mat­i­cally. For a GPU, it might be used to copy tex­tures di­rectly from the com­put­er’s mem­ory into its own video mem­ory.

DMA (Direct Memory Access) - This is how the de­vice can read and write in­for­ma­tion di­rectly in/​out of your com­put­er’s mem­ory. Instead of hav­ing the CPU burn cy­cles copy­ing data from the de­vice, the de­vice can copy the mem­ory au­to­mat­i­cally. For a GPU, it might be used to copy tex­tures di­rectly from the com­put­er’s mem­ory into its own video mem­ory.

Mapping PCI BARs

When QEMU starts a VM, it sets up the guest’s mem­ory lay­out. For nor­mal RAM, this boils down to a call to hvf_set_­phys_mem() in QEMU, which uses the Hypervisor.framework method:

hv_vm_map(mem, guest_­phys­i­cal_ad­dress, size, HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC);

Next, we con­nect to the host PCIDriverKit dri­ver and ask to map the mem­ory from the PCI de­vice into our process. (I’m leav­ing the dri­ver-side code out for now, but it’s very sim­i­lar boil­er­plate.)

// map BAR0 into the cur­rent process and set `addr` to the lo­ca­tion // where it was mapped mach_vm_ad­dress_t addr = 0; mach_vm_­size_t size = 0; IOConnectMapMemory64(driverConnection, 0, mach_­task_­self(), &addr, &size, kIOMa­pA­ny­where);

Ok, so then we have addr, which now points to the BAR0 mem­ory that we can ac­cess di­rectly in our process. At this point you can just read and write stuff to it, like any other piece of mem­ory.

volatile uin­t32_t *bar0 = (volatile uin­t32_t *)addr; printf(“BAR0[0] = %x\n”, bar0[0]); // this would out­put: BAR0[0] = 0x1b2000a1 // which is a de­vice-spe­cific con­stant that de­scribes my RTX 5090 // // BAR0[0] is the BOOT_0 reg­is­ter. The fields break down as: // arch = 0x1b → GB200 GPU fam­ily // impl = 0x2 → GB202 die (RTX 5090) // ma­jor_rev = 0xa → step­ping A // mi­nor_rev = 0x1 → re­vi­sion 1 (together: step­ping A1)

Now we just make sure QEMU calls hvf_set_­phys_mem() for our de­vice mem­ory, and we can map that into the guest. When guest code touches that map­ping, it talks di­rectly to the GPU with min­i­mal host over­head. This is the best case for per­for­mance. At least, in the­ory.

In prac­tice, as soon as the VM touched the PCI BAR mem­ory, the host ker­nel crashed.

If you’ve never ex­pe­ri­enced this be­fore, it’s dis­ori­ent­ing. Your en­tire com­puter will hang, and be­cause the track­pad feed­back is con­trolled by soft­ware, sud­denly the track­pad will no longer click. The dogs and cats in your neigh­bor­hood start howl­ing. Pictures fall off the walls of your house. Eventually your com­puter will re­boot, and you will be pre­sented with this di­a­log.

Ok, so we can’t map de­vice mem­ory di­rectly, but we have other tricks up our sleeve. We can trap every ac­cess to the mem­ory, exit the guest back into QEMU, and have QEMU for­ward each read or write to the de­vice. That keeps be­hav­ior cor­rect, but it’s bru­tally slow. In many work­loads the pain is else­where. Most of the per­for­mance-sen­si­tive work is DMA, but some paths still care how fast you can push com­mands through the BAR.

I started prepar­ing a bug re­port for Apple and wrote a small re­pro­duc­tion (well, AI-assisted) to demon­strate the is­sue:

In ~100 lines of C, you can spin up a VM, map the de­vice BAR into the guest, and run code that touches it. I’m still not sure whether that was more frus­trat­ing or en­cour­ag­ing, but that ver­sion ran with­out crash­ing, while QEMU was still pan­ick­ing the host. I was stumped for a while. Was it the guest page ta­bles? Was the BAR col­lid­ing with guest RAM in some sub­tle way? Why were the dogs and cats still howl­ing?

Eventually, in my des­per­a­tion, I asked an AI cod­ing as­sis­tant to com­pare my sam­ple and QEMU. It im­me­di­ately flagged that my map­ping used HV_MEMORY_READ | HV_MEMORY_WRITE while QEMU used HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC. Alas, bested again by AI. Not even silly blog pro­jects are safe any­more (mostly kid­ding).

The workaround in QEMU was a small change:

It works, but it’s not per­fect. ARM has sev­eral fla­vors of de­vice mem­ory (the Device-nGnRnE/nGnRE/nGRE/GRE fam­ily), with dif­fer­ent rules for whether writes can be gath­ered, re­ordered, or ac­knowl­edged early. It’s roughly anal­o­gous to x86 write-com­bin­ing on the most per­mis­sive end.

On real hard­ware, the prefetch­able BARs on my GPU are sup­posed to al­low gath­er­ing, which makes them sev­eral times faster for bulk writes than BAR0. But hv_vm_map() has no flags to con­fig­ure this, so every de­vice map­ping ends up as the strictest nGn­RnE. There’s noth­ing we can do about it, and it’s still ~30x faster than trap­ping every ac­cess, but it makes writ­ing the BAR ~10x slower than it would be nor­mally.

DMA

This was by far the sketchi­est part of the pro­ject. To start, let’s go over how this works on a PC run­ning Linux with VM PCI-passthrough, and then we’ll com­pare to our chal­lenge on ma­cOS.

When there’s just a com­puter talk­ing to a de­vice (no VM in­volved), they can talk to­gether di­rectly. The PC will tell the de­vice hey I got that DMA buffer ready at this mem­ory ad­dress” and the de­vice can ac­cess that mem­ory di­rectly (AKA DMA). Easy.

When a VM is in­volved, it’s more com­pli­cated. Guest phys­i­cal ad­dresses don’t cor­re­spond to host phys­i­cal ad­dresses. The VMs RAM is just some chunk of host mem­ory al­lo­cated wher­ever it was avail­able. So if the guest tells the de­vice DMA into 0x00000000,” the de­vice will hap­pily scrib­ble over what­ever ac­tu­ally lives there on the host. The sim­plest fix is two things:

Pin all guest mem­ory so it can’t be paged out while the de­vice might touch it.

Put a hard­ware unit called the IOMMU be­tween the de­vice and host mem­ory. The hy­per­vi­sor pro­grams it with the guest → host trans­la­tions, and every DMA re­quest from the de­vice gets remapped on the fly.

DMA Request:Read/Write0x00000000

IOMMU

Translation Table

0x00000000 – 0x80000000

0x20000000 – 0xA0000000

Translated to:0x20000000

Host Physical Memory

0x20000000 – 0xA0000000

This is a blunt so­lu­tion. The guest does­n’t have to do any­thing spe­cial, but the host has to keep all guest RAM pinned. There are more ad­vanced ap­proaches (like a vir­tual IOMMU), but they’re out­side the scope of this post.

DMA on Apple Silicon

On Apple Silicon, there’s a hard­ware unit called DART that’s more or less equiv­a­lent to an IOMMU. It’s not spe­cific to VMs; it also acts as a se­cu­rity bound­ary, pre­vent­ing de­vices from ac­cess­ing ar­bi­trary host mem­ory. Ideally we’d just use DART the same way Linux uses the IOMMU in the sim­ple case above.

Unfortunately, DART (at least via PCIDriverKit for Thunderbolt de­vices) has some hard con­straints:

~1.5GB map­ping limit. A VM with 1.5GB of RAM can tech­ni­cally boot, but CUDA runs out of mem­ory and any mod­ern game needs 8 – 16GB.

~64k map­ping cap. With many small DMA buffers the map­ping table fills up.

No ad­dress or align­ment con­trol. PCIDriverKit as­signs mapped ad­dresses for you. You can’t pick them, or spec­ify align­ment con­straints. This rules out a vir­tual IOMMU, which re­quires the guest to choose its own DMA ad­dresses.

The 1.5GB ceil­ing was the biggest ini­tial blocker. I tried a few workarounds: pre-map­ping ranges where I guessed DMAs might land (obviously did­n’t work), and us­ing a re­stricted-dma-pool de­vice tree at­tribute to force all DMA through a pre-al­lo­cated re­gion. The re­stricted pool ap­proach ac­tu­ally works for sim­pler de­vices, but GPU dri­vers are too weird to fit into that model. (If you’re cu­ri­ous about the specifics, there’s a qemu-de­vel thread where I dis­cuss it.)

ap­ple-dma-pci

I ended up de­sign­ing a new vir­tual PCI de­vice in QEMU called ap­ple-dma-pci. It gets in­serted into the VM along­side the passed-through GPU, and a com­pan­ion ker­nel dri­ver in the guest in­ter­cepts the NVIDIA dri­ver’s DMA map­ping calls. The so­lu­tion is, frankly, a very up­set­ting hack, but it works.

Because map­pings are cre­ated on de­mand per DMA re­quest and torn down when the buffer is freed, we re­duce the amount of mapped mem­ory we need at any given time. Only the work­ing set of live DMA buffers at any given mo­ment has to fit in our 1.5GB limit, as op­posed to the en­tirety of guest mem­ory.

The guest dri­ver is loaded early (via an /etc/modules-load.d/ con­fig), so it can find the GPU at probe time and swap in cus­tom DMA ops be­fore the NVIDIA dri­ver touches it:

sta­tic struct dma_map_ops ap­ple_d­ma_ops = { .map_page = ap­ple_d­ma_map_­page, .unmap_page = ap­ple_d­ma_un­map_­page, .map_sg = ap­ple_d­ma_map_sg, .unmap_sg = ap­ple_d­ma_un­map_sg, .alloc = ap­ple_d­ma_al­loc, .free = ap­ple_d­ma_free, };

sta­tic int ap­ple_d­ma_p­ci_probe(struct pci_dev *pdev, const struct pci_de­vice_id *id) { struct pci_dev *gpu = pci_get_de­vice(PCI_VEN­DOR_N­VIDIA, PCI_ANY_ID, NULL); if (!gpu) re­turn -ENODEV;

set_d­ma_ops(&gpu->dev, &apple_dma_ops); pci_de­v_put(gpu); re­turn 0; }

Each of the cus­tom ops is a thin wrap­per. It mar­shals its ar­gu­ments into a small re­quest, writes it into mem­ory for the ap­ple-dma-pci vir­tual BAR, kicks a door­bell reg­is­ter, and waits for a re­ply. On the host side, QEMU picks up the re­quest, hands it off to the PCIDriverKit dri­ver, which per­forms the ac­tual DART map­ping, and the re­sult­ing DMA ad­dress gets writ­ten back to guest mem­ory. The NVIDIA dri­ver should­n’t know the dif­fer­ence.

Linux VM (Guest)

NVIDIA Driver

dma_map_­page()

ap­ple_d­ma_ops han­dler

vir­tual PCI BAR write

ap­ple-dma-pci vir­tual de­vice

VM exit

ma­cOS Host

QEMU

IOConnectCallMethod()

PCIDriverKit dri­ver

IODMACommand

DART hard­ware

mapped ad­dress re­turned back up the stack

NVIDIA align­ment quirk

It did­n’t im­me­di­ately work well, though. While the dri­ver ini­tially loaded and ini­tial­ized the card, I was greeted with this fun ker­nel log mes­sage as soon as I at­tempted to run a CUDA work­load:

[ 456.194883] NVRM: nvAsser­tOk­Failed­NoLog: Assertion failed: The off­set passed is not valid [NV_ERR_INVALID_OFFSET] (0x00000037) re­turned from pRmApi->Al­loc(pRmApi, de­vice->ses­sion->han­dle, is­Sys­tem­Mem­ory ? de­vice->han­dle : de­vice->sub­han­dle, &physHandle, is­Sys­tem­Mem­ory ? NV01_MEMORY_SYSTEM : NV01_MEMORY_LOCAL_USER, &memAllocParams, sizeof(memAl­loc­Params)) @ nv_g­pu_ops.c:4972 [ 456.371282] NVRM: GPU0 nvAssert­Failed­NoLog: Assertion failed: 0 == (physAddr & (RM_PAGE_SIZE_HUGE - 1)) @ mem_m­gr_g­m107.c:1312 [ 456.372020] NVRM: nvAsser­tOk­Failed­NoLog: Assertion failed: The off­set passed is not valid [NV_ERR_INVALID_OFFSET] (0x00000037) re­turned from pRmApi->Al­loc(pRmApi, de­vice->ses­sion->han­dle, is­Sys­tem­Mem­ory ? de­vice->han­dle : de­vice->sub­han­dle, &physHandle, is­Sys­tem­Mem­ory ? NV01_MEMORY_SYSTEM : NV01_MEMORY_LOCAL_USER, &memAllocParams, sizeof(memAl­loc­Params)) @ nv_g­pu_ops.c:4972

If you re­call the ear­lier DMA sec­tion, we noted that we can’t con­trol the align­ment of DMA-mapped buffers. Bummer. At this point, I dug into the dri­ver to try to see if there was some­thing sim­ple we could patch.

Here’s the rel­e­vant seg­ment:

if (type == UVM_RM_MEM_TYPE_SYS) { if (size >= UVM_PAGE_SIZE_2M) al­loc_info.pa­ge­Size = UVM_PAGE_SIZE_2M; else if (size >= UVM_PAGE_SIZE_64K) al­loc_info.pa­ge­Size = UVM_PAGE_SIZE_64K;

sta­tus = uvm_r­m_locked_­call(nvU­vmInter­face­Mem­o­ryAl­loc­Sys(gpu->rm_ad­dress_­space, size, &gpu_va, &alloc_info));

// TODO: Bug 5042223 if (status == NV_ERR_NO_MEMORY && size >= UVM_PAGE_SIZE_64K) { UVM_ERR_PRINT(“nvUvmInterfaceMemoryAllocSys al­loc failed with big page size, retry with de­fault page size\n”); al­loc_info.pa­ge­Size = UVM_PAGE_SIZE_DEFAULT; sta­tus = uvm_r­m_locked_­call(nvU­vmInter­face­Mem­o­ryAl­loc­Sys(gpu->rm_ad­dress_­space, size, &gpu_va, &alloc_info)); } }

By adding more de­bug log­ging in the mod­ule, I could see it was a 16MB al­lo­ca­tion of type UVM_RM_MEM_TYPE_SYS. So, it uses the largest (2MB) page size. Ironically, there is al­ready a workaround here when the al­lo­ca­tion fails. It’ll just try again with a smaller page size. It just does­n’t take into ac­count the dif­fer­ent er­ror code for align­ment (NV_ERR_INVALID_OFFSET).

Rewrite Bun in Rust by Jarred-Sumner · Pull Request #30412 · oven-sh/bun

github.com

Blog post with de­tails com­ing soon.

It passes Bun’s pre-ex­ist­ing test suite on all plat­forms (and fixes sev­eral mem­ory leaks and flaky tests), the bi­nary size shrinks by 3 MB - 8 MB, the bench­marks are be­tween neu­tral and faster - and most im­por­tantly, we now have com­piler-as­sisted tools for catch­ing & pre­vent­ing mem­ory bugs, which have costed the team an enor­mous amount of de­vel­op­ment & de­bug­ging time over the years.

The code­base is oth­er­wise largely the same. The same ar­chi­tec­ture, the same data struc­tures. Bun still uses few 3rd party li­braries. No async rust.

To try this, run:

bun up­grade –canary

Please do file is­sues if you run into any. If this thread gets crazy I will lock it.

Note:

Still some op­ti­miza­tion work to do be­fore this lands in non-ca­nary ver­sion.

Still some cleanup work to do (which will come in a se­ries of fol­low-up PRs)

To add this web app to your iOS home screen tap the share button and select "Add to the Home Screen".

10HN is also available as an iOS App

If you visit 10HN only rarely, check out the the best articles from the past week.

Visit pancik.com for more.