kd7swh.com

Linux User Net — week of September 21, 2026

2026-09-21T00:00:00Z

September 21, 2026

An updated look for the Raspberry Pi Desktop Raspberry Pi
LibreOffice 26.8 Sets Download Record as TDF Says “No AI” Is a Feature Linuxiac
Ubuntu's Rustification Has a New Milestone! Coreutils Migration is Complete It's FOSS
Adafruit's New CircuitPython 'Turbo' Brings Native Code To Tiny Boards Slashdot
Hackers reveal how Flock cameras really track cars and people Ars Technica
This developer created an app to detect nearby Meta glasses. It already has thousands of users. Business Insider
The Best ARM Linux Distros for Raspberry Pi, SBCs, and More Linux Stans
SDR- -: A Software-Defined Radio Application with Visual Signal Path RTL-SDR

Linux User Net — week of September 14, 2026

2026-09-14T00:00:00Z

September 14, 2026

Debian 13.7 Released With Many Bug Fixes Phoronix
The search company that plants trees just launched a Linux browser to help Europe battle big tech The Register
Switzerland tests a FOSS escape route from Microsoft 365 The Register
EV batteries last longer than drivers feared Ars Technica
LG Smart TVs Caught Mapping Your Network, Logging Audio With Screen Off — Here’s the Full Technical Breakdown The Cybersec Guru
The Best Arch-Based Linux Distros in 2026 (Ranked and Reviewed) Linux Stans
Awesome-Selfhosted: a listing of Free Software to run on your own network Web Site
CHUWI UniBook With Intel Wildcat Lake For A $449 Linux-Friendly Laptop Phoronix

Linux User Net — week of September 7, 2026

2026-09-07T00:00:00Z

September 7, 2026

SDR Oxide: SDR transceiver client for Linux SDR Oxide
FreeDV RADE: A New Approach to Digital Voice over HF, Now Integrated into Popular Radios ARDC
Debian 13 Is Taking Over 2,200+ Control Systems Across CERN Linuxiac
1 in 6 VPNs Track Your Location, According to New Report From Proton CNET
I rented a car, and within hours, my driver’s license was for sale Ars Technica
Nearly impossible? How Fairphone built the ethical, repairable Fairphone Gen 6+. Ars Technica
An HTML Browser Page that Uses Display Pixel Clock EMI Leakage to Transmit VHF Morse Code RTL-SDR

Linux User Net — week of August 31, 2026

2026-08-31T00:00:00Z

August 31, 2026

Debian Votes To Allow "Responsible Use Of Generative AI" Phoronix
Flatpak Secures €508K to Bring Stronger Sandboxing to Linux Apps Linuxiac
Brave Adds Email Aliases to Hide Your Real Address Reclaim the Net
Linux Just Escaped California’s Mandatory Age Checks – Windows and macOS Didn’t Linux Stans
Google forces Android apps to use memory more wisely as RAMpocalypse rages The Register
They confided in ChatGPT. Their secrets ended up in court. Yahoo
Helioclock to Debut at Huntsville Hamfest Amateur Radio Daily
Create your own cyberdeck Raspberry Pi

Linux User Net — week of August 24, 2026

2026-08-24T00:00:00Z

August 24, 2026

Memory prices climb 500% in 12 months Tom's Hardware
PINE64 has some very bad news for Linux hardware fans NERDS.xyz
Canonical is Funding a PhD to Automate C to Rust Translation for Ubuntu It's FOSS
The 6 AI-free Linux distros I recommend most - and why they're likely to stay that way ZDNet
Detect Movement in Your Home with WiFi Motion Xfinitiy
As Wisconsin cities flee Flock, its shared camera network loses value Ars Technica
Fairphone’s latest repairable phone is finally available in the US for $650 Ars Technica
Could Mecha Comet's Linux PC-Phone Hybrid Be the Future of Linux Smartphones? Slashdot

Linux User Net — week of August 17, 2026

2026-08-17T00:00:00Z

August 17, 2026

Linux Mint 22.3 Gets New HWE ISOs Powered by Linux Kernel 7.0 Linuxiac
BlueFerry Brings iMessage and SMS from iPhone to Linux Over Bluetooth Linuxiac
GeForce NOW On Linux Native App Exits Beta Phoronix
Firefox is now the last major browser that still supports uBlock Origin PC World
ESP32 Bit Pirate Updates: New LoRa and Meshtastic Analysis Features RTL-SDR
Ordinary WiFi can now identify you with near-perfect accuracy Science Daily
IP400 Project Project Web site

A Voice Worth Listening To

2026-08-15T00:00:00Z

A Voice Worth Listening To

Computers have been reading to me since grade school. Not with recordings of a person — with synthesizers: DECtalk from childhood on, Eloquence since college. People hear voices like these and reach for the word "robotic." They're right. They just think it's a criticism.

Both are formant synthesizers. Instead of playing back stitched-together recordings, they model the human vocal tract as mathematics and compute speech from rules, in real time, in a few megabytes of memory. Rules have consequences that recordings can't match. The same text always sounds exactly the same. The voice starts speaking the instant it has something to say. And it stays intelligible when you speed it up — not a little faster, but several times faster than conversation. Research on trained blind listeners has measured comprehension at up to nearly three times the rate sighted listeners can follow, and the test material at those speeds was formant synthesis, precisely because it stays crisp where recorded speech smears. The phenomenon is not unique to sound: RSVP reading — rapid serial visual presentation, words flashed one at a time at a fixed point so the eye never has to travel — has been shown to let some readers with vision disabilities read roughly twice as fast as a page allows. Strip away the mechanics of presentation and trained readers accelerate, whatever the channel. Veteran screen-reader users describe running their speech at 800 words a minute. At those rates a voice stops being a person you listen to and becomes an instrument you play.

Modern neural text-to-speech is astonishing, and I don't begrudge it a thing. For an audiobook or a podcast — long-form listening, where naturalness is the point — the new local models like Piper are a genuine gift. But a screen reader is a thinking tool, and there the classics still win on the merits. When Samuel Proulx, a blind accessibility advocate, evaluated the newest lightweight AI voices for screen-reader use in January 2026, the disqualifiers were immediate: they can't begin speaking until they've been handed a whole chunk of text, they skip words, they misread numbers. Neural synthesis answers the question "how human can a computer sound?" Formant synthesis answers a different one: "how fast can you think?"

The voices themselves have histories worth knowing. DECtalk descends from the work of Dennis Klatt at MIT, whose synthesizer — published openly in 1980 — Digital Equipment Corporation turned into a commercial product in the early 1980s. Its flagship voice, Perfect Paul, was modeled on Klatt's own. The most famous synthetic voice of the twentieth century, Stephen Hawking's, came from a sibling of the same lineage — a Speech Plus CallText 5010, not DECtalk itself, whatever the family resemblance suggests. He kept it for thirty years — "I have not heard a voice I like better," he said in 2006. Klatt himself lost his voice to thyroid cancer in the last years of his life, while the voice he had modeled on it went on speaking for thousands of us. Every DECtalk phrase still carries him.

Eloquence, the engine IBM shipped as ViaVoice text-to-speech, is the other voice of my life. It is the default voice of JAWS (Job Access With Speech, the screen reader that has dominated blind employment for decades) and of the Kurzweil 1000 reading software, and these days Apple offers it under license across its products. The voice I hear today is, to my ear, the voice I heard in college — and that constancy is not stagnation. It's a feature. At 500 words a minute, you want a voice that never surprises you.

Which brings me to the software this note is really about. T.V. Raman came to it through mathematics. His Cornell dissertation system, AsTeR — the Audio System For Technical Readings — turned documents written in TeX, the typesetting language of mathematics, into structured audio. It didn't read lines off a page; it parsed the document's logic and voiced it, rendering nested equations with pitch and pausing, so that a blind scholar could work through the technical literature independently. The dissertation won the ACM Doctoral Dissertation Award in 1994; its interface lived inside Emacs even then, and its Common Lisp source is public today. That same year, at Digital Equipment Corporation's research lab, Raman started Emacspeak, releasing it as open source in April 1995 — the dissertation's insight carried from documents to the whole of computing. He has always insisted it is not a screen reader, and the distinction is the whole idea. A screen reader speaks the screen: point one at a calendar and it reads a grid of numbers, because a grid of numbers is what's displayed. Emacspeak lives inside the application — it is built on Emacs, an editor with fifty years of lineage that is really a programmable environment in the Lisp programming language — so it speaks the information instead: the date. Code comments arrive in a different voice than the code around them: audio formatting, Raman named it — syntax highlighting for the ear.

Raman made that argument at book length in Auditory User Interfaces: Toward the Speaking Computer (1997): an auditory interface, in his words, works "directly with the computational core of the application" — a peer of the interface built for the eye, not a translation of it. I bought the hardcover as a young student and found it intriguing; it is a rare volume now, and it still sits on my bookshelf, a reminder of how long this effort has been running and of the community that still gathers around it. The idea carried far beyond one program: at Google, Raman went on to lead Android accessibility from its inception. But Emacspeak is the argument running on your machine. The project's own catalog counts 210 speech-enabled applications, from mail and web and shells to EPUB and DAISY talking books. In 1999 it entered the Smithsonian's permanent research collection. It is my primary speech tool at home. I write software with it, and I read with it.

And I listen to radio with it. Emacspeak's media layer will play any stream you point it at, so a software-defined radio receiver elsewhere on my network arrives in the same audio desktop as my code and my mail. I use it for the BBC too — broadcasts that were on shortwave when I was a kid now arrive over the network. Fitting, then, that one of Raman's last commits to the project trimmed its BBC radio playlists.

About those commits. For thirty years Emacspeak shipped like a metronome — a release every May and November, each one named after a dog. Release 60.0, "DreamDog," landed in May 2024. That July, Raman published a thirty-year retrospective, "Emacspeak — A Speech Odyssey", dedicated to his guide dogs Aster, Hubbell, and Tilden. The dedication was a bookend: Auditory User Interfaces, twenty-seven years earlier, is inscribed "To My Guiding Eyes, Aster." His last commit is dated August 26, 2024. The clock has been quiet since. That is the whole public record, and all I will repeat here — except one line from the retrospective that reads like a thesis for everything above: "Open Source is essential for discovering new interaction paradigms."

Here is what happened next, and it is the part that proves him right: nothing collapsed. The mailing list is active this summer — users adapting Emacspeak to new macOS releases, to Windows Subsystem for Linux, to Telegram, to AI language tools — and its archives run back more than a quarter of a century. Greg Priest-Dorman keeps the mail server running; Debian's accessibility team keeps the package alive. A speech server for the Mac, written in Swift (Apple's programming language), is maintained by a community member outside the main repository. It plugs into the same speech-server protocol Raman designed in 1995 — a protocol now old enough to be driving neural voices that did not exist when it was written. Open-source software doesn't need its author's permission to stay alive. Neither do its users.

The catch — there is always a catch — is that the classic voices make you work for them. Every Linux system can already talk: eSpeak NG, the free formant voice, is everywhere, small, and reliable. But it is the voice that is there, not the voice you would choose — and choosing means asking a modern system to host engines it has forgotten. DECtalk's source survives in community hands, never formally open-sourced, written in a dialect of 1990s C that today's compilers greet with suspicion. On Linux, Eloquence has only ever been 32-bit binary code, and the licensed route to it today is Voxin. That is what my emacspeak-docker project is for — and despite the name, it is two doors, not one. On Debian-, Arch-, or Fedora-family systems, a single script sets up Emacspeak and its speech servers natively, handling each distribution's own package manager and 32-bit plumbing as it goes. Everywhere else, the container. Either way, the installer narrates its own progress and fails loudly at the exact step that broke — an installer you can debug by ear — and every trap along the way is written down in the guide, whose stated goal is that this setup "never has to be reverse-engineered again." When the smoke test passes, ViaVoice announces it in its own voice: "Outloud is alive. Eloquence speaks again."

There are no perfect accessibility tools. Not on any platform, not at any price — anyone who depends on this stuff learns that early. And price is its own gatekeeper: commercial assistive technology routinely runs to thousands of dollars, which keeps it, for some of the people who need it most, entirely out of reach. Open tools are there for everyone, ready to be shaped to the person using them. What they offer is not perfection; it is standing. DEC is gone. IBM withdrew its engine from sale a generation ago. The author of my audio desktop has gone quiet. And none of it can take the voices away, because the source is in the hands of the people who need it. A blind user on a proprietary platform is a customer, and customers get what ships. A blind user on an open one is a participant — able to keep a forty-year-old voice speaking on this year's kernel, to tune it, to fix it, and to hand it to the next person. That is what I grew up listening to, and it read this sentence back to me just now. A synthesizer from the 1980s on a 2026 Linux box is still, by every measure that matters to the person listening, a voice worth listening to.

Linux User Net — week of August 10, 2026

2026-08-10T00:00:00Z

August 10, 2026

Google Chrome Quietly Arrives on ARM64 Linux Linuxiac
Bottles 65 Released with Over 100 Changes for Windows Apps on Linux Linuxiac
GNOME Receiving Additional Design Help Thanks To Sovereign Tech Agency Fellowship Phoronix
Memory capacity for all of 2027 has reportedly been booked and sold, with no more DRAM or HBM available TweakTown
Migrate PC: A Tool That Automates the Transition from Windows to Linux Linux Tech+
Airgapped QR Code Transfer Web App Project site
9GRadio: An Android RTL-SDR App for Spectrum Monitoring and Decoding Analog/HAM/Aviation/Marine Radio Traffic RTL-SDR

Blast Radius, Decided in Advance

2026-08-09T00:00:00Z

Blast Radius, Decided in Advance

On August 4th, 2026, a worm started spreading through npm, the package repository that most JavaScript projects — including the static site generator that builds this page — pull their dependencies from. Researchers nicknamed it "Shai-Hulud: Here We Go Again." It began with a poisoned release of a small package called keyv and, within hours, had copied itself into roughly 444 package names across a dozen organizations.

The mechanism was ugly and clever. npm packages can declare scripts that run automatically during install, and this worm used a preinstall script — node setup.mjs — to execute before any of a project's own code ever ran. That script downloaded a runtime and used it to harvest whatever was lying around: cloud credentials (AWS, Google Cloud, Azure), GitHub and npm tokens, SSH (secure remote login) private keys, Kubernetes tokens, database connection strings. Then it planted hooks so that simply reopening the project later would fire the payload again — a .claude/settings.json file with a SessionStart hook aimed at AI coding agents like Claude Code, and a .vscode/tasks.json file with a folderOpen task aimed at the editor. It topped this off with host persistence via a background process and used public GitHub repos as a dead drop for command and control. It is a genuinely well-engineered piece of malware, in the way that's uncomfortable to admire.

I'd run npm install on this site's toolchain on August 8th, squarely inside the exposure window. So I went and audited it.

What I found was nothing. My dependency tree is small: Eleventy, the static site generator, and its RSS plugin, as the only direct dependencies. Neither poisoned package appeared anywhere in the tree. The only install script in the whole thing belongs to an optional macOS-only package that never even runs on my Linux machine. Clean bill of health — and I want to be honest about what that means. This was a fire drill, not a fire. Docker (a tool for running software inside an isolated, disposable container) didn't catch the worm, because the worm was never here to catch.

But the audit wasn't pointless, because of what it confirmed. My whole toolchain lives inside Docker. There's no Node.js installed on my actual machine at all; the container is the toolchain. And the one rule I've held since I set this up is that the container mounts only the project directory — nothing else on my computer is ever visible to it. My GitHub token, meanwhile, lives in my operating system's keyring, not in the project, so it was never inside the container even while npm was running.

Which means that in the world where I had picked up a poisoned dependency, the story stays small. The payload runs inside a container that gets thrown away and rebuilt identically next time, holding no credentials worth stealing, unable to see the keyring where my real token lives, with no path out to the host where Claude and my editor actually run to plant a persistent hook. The blast radius wasn't something Docker fought for me in the moment of infection. It was something I'd already decided, weeks earlier, before there was any attack to have a radius at all.

This is the part of Unix-like culture I've come to love: the long lineage of isolation primitives, each one narrowing what a piece of untrusted code is allowed to touch. chroot gave a process a fake root directory back in the 1970s. BSD jails hardened that into a real boundary. Linux namespaces and cgroups (control groups, which limit and account for a process's resources) split it further. Containers packaged the whole lineage into something a solo person can spin up before breakfast, and rebuild identically on their desk or in continuous integration. Running an install script you didn't write, from a registry you don't fully control, is exactly the situation this lineage exists for.

So the thing worth celebrating isn't that I dodged something scary. I didn't — there was nothing to dodge. It's that the boring setup work, done once and with no worm in mind, is the reason the audit was a non-event instead of a scramble. A solo builder doesn't get a security team. But you can still decide, in advance, what an attacker is allowed to touch. Do that early enough, and your best security incidents are the ones you barely notice.