HardenedBSD's August/September 2026 status report reviews recent base-system and ports changes and upcoming release engineering activity. Key base changes include discouraging pkgbase use in bsdinstall, updating os-release files, enabling -ftrivial-var-auto-init=zero for video(4), fixing various manpage and login template links, documenting rejection of AI/LLM-generated works, and hardening ssh_config by disabling compression and TCP keepalives by default. Ports received a broken-dependency fix for math/libformfactor. The report also documents adding experimental support for clang's -fbounds-safety (exposed as -Xclang -fexperimental-bounds-safety) into the world build behind MK_BOUNDS_SAFETY, disabled by default and currently applied only to userland; kernel/kernel-module support will follow once the feature is production-ready. The change is presented as plumbing to let downstream projects opt into the bounds-safety approach, likened to Capsicum in requiring explicit code-level integration.
Infrastructure work described includes migrating rad.hardenedbsd.org and ngx-01 from VMs to jails (initial instability resolved), planned rsync VM migration after quarterly builds, and modernization of Tor Onion Service endpoints. Autosync was enhanced to push to multiple remotes and GitHub mirroring resumed on a six-hour cadence. A planned Rust orchestration daemon will interact with the Radicle control socket for lightweight CI/CD tasks. The report summarizes a Radicle vulnerability: malicious nodes could force disclosure of private repositories and only the initial handshake was encrypted while long-lived traffic was unencrypted. HardenedBSD does not use private Radicle repos and recommends connecting via the project's Tor Onion Service to mitigate exposure; coordination and testing are urged as Radicle migrates to iroh.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Google has announced that Chromebook update support will end in 2034, breaking its previous promise of 10 years of updates for all devices. This change affects those who bought Chromebooks in recent years, raising concerns over corporate transparency and device longevity. (osnews.com)
Russian missile strikes have taken out several popular piracy websites. The attacks are linked to the ongoing Russo-Ukrainian war. (tomshardware.com)
A U.S. immigration advocate sued the government after a border agent searched his phone without a warrant and copied data. He believes the government targeted him due to his activism and political work on immigration rights. (arstechnica.com)
Over 44,000 legal objections have been filed against Palantir's NHS data platform, demanding it be blocked from handling medical data. The campaign follows backlash over the company's involvement with the Israeli military and US immigration enforcement. (theguardian.com)
OpenAI claims that a Chinese AI model stole its intellectual property. The company alleges that it had previously appropriated IP from other sources. (theregister.com)
Android developers face new requirements to publish apps, including a $25 verification fee and identity verification, even for small-scale projects. These policies have caused frustration among developers who want to share their apps freely without extensive registration processes. (twitter.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.