AMD held its Advancing AI event in San Francisco this week and did not come to talk about your gaming PC. The headliners: sixth-generation EPYC "Venice" server processors, the Instinct MI455X accelerator, a full rack-scale system called Helios, and a software layer confusingly named ROCm.ai^[1]. The framing was pure 2026, all agentic AI and a projected $2 trillion market by 2030. Underneath the vocabulary, though, AMD shipped its most serious hardware argument in years, so let us separate the silicon from the slogans.

Venice is the Zen 6 server part, and the top configuration is a genuine escalation: up to 256 cores and 512 threads on a single socket in the dense Zen 6C variant, while a 96-core version with full-fat cores boosts to 5.0 GHz. AMD claims around 20 percent more performance per core over the previous generation, memory moves to 16 channels of DDR5-8000 with second-generation MRDIMM support, and I/O jumps to PCIe Gen 6 with up to 160 lanes in two-socket systems^[5]. There are four variants to keep straight: the flagship SP7 platform shipping late this year, a smaller SP8, a 3D V-Cache model in 2027, and a low-power "Verano" for AI host nodes in late 2027^[1]. What there is not: a price list, a complete SKU table, or independent benchmarks. Phoronix politely called it a soft launch^[5], which is the professional term for a keynote with excellent slides.

The rack is the pitch

The MI455X is AMD's first 2nm accelerator and carries 432 GB of HBM4 memory, half again as much as the MI355X, with claimed peaks of up to four times the low-precision throughput and 34 times the token throughput of its predecessor. Bolt 72 of them together with 18 Venice CPUs and Pensando networking and you get Helios: 2.9 exaflops of FP4 compute, 31 TB of HBM4, and 1.7 petabytes per second of memory bandwidth in a single rack^[3]. The word "bolt" is doing dishonest work in that sentence, because the backplane is the actual battleground. Nvidia's NVL72 moat was never 72 GPUs in a cabinet; it is NVLink, the copper spine that lets them behave like one enormous chip, and PCIe Gen 6 is nowhere near fast enough to substitute. AMD's answer is UALink, the open scale-up standard it organized with Broadcom, Cisco, and Intel, with the Pensando gear carrying rack-to-rack traffic over Ultra Ethernet^[3]. The backplane is also a plumbing project: 72 accelerators and 18 server CPUs put a single rack well north of 100 kilowatts, and no amount of moving air handles that. Helios is liquid-cooled or it is a bonfire, which means it lives in purpose-built facilities with water loops, not in the corner of an enterprise server room.

AMD's comparison slide claims 15 percent more peak compute and 50 percent more memory capacity than Nvidia's Vera Rubin NVL72, plus up to 30 percent more tokens per dollar^[2]. Tokens per dollar is vendor math, and vendor math always picks its own workload. What is not vendor math is the customer list: OpenAI brings Helios online in the fourth quarter, Anthropic committed to up to two gigawatts of capacity and is using Claude to optimize ROCm itself, and Meta, Microsoft, and Oracle all bought in^[3]. Hold that Anthropic number up to the light before nodding along, because two gigawatts is roughly the output of two full-size nuclear reactors. Nobody takes delivery of that; it is a multi-year buildout across multiple purpose-built data centers, and that is exactly why it matters more than any benchmark slide. AMD is signing utility-scale, years-long contracts, not one-off rack sales. Companies do not commit gigawatts to a rounding error.

Software, the permanent caveat

ROCm.ai, despite the name, is not a new version of ROCm. It is a layer on top: a command-line tool, "Skills" plug-ins that turn coding assistants like Claude, Codex, Cursor, and Gemini into what AMD calls ROCm superusers, and Hyperloom, an open-source agentic system that supposedly compresses weeks of inference optimization into hours^[4]. AMD claims an average 3.3x inference improvement over plain ROCm 7.0^[7]. The software story matters more here than any transistor count. Nvidia's moat was never the silicon; it is a decade of CUDA muscle memory across the entire industry. AMD has promised to fix its software story for roughly as long, and teaching the AI tools engineers already use to speak ROCm is at least a smarter bet than another documentation portal. Keep the cynicism calibrated, though: a coding agent that writes your ROCm scripts does nothing about the layer where AMD's software reputation actually went to die, the kernel panics, the PyTorch builds that refuse to compile, the drivers that fall over under sustained load. The top of the stack getting friendlier is welcome. The bare metal still has to prove it stays upright when 72 GPUs lean on it at once. ROCm.ai ships in August. I will believe the 3.3x when somebody outside AMD's payroll reproduces it.

One thread worth pulling before the applause dies down. Every chip announced on that stage runs on HBM, the stacked high-bandwidth memory that earns memory makers roughly twice the margin of ordinary DRAM^[9]. Two gigawatts for Anthropic here, a gigawatt campus there, and each commitment quietly consumes fab capacity that never comes back. When people ask why desktop memory still costs what it does^[10], this keynote is the answer wearing a lanyard. The AI buildout is not competing with your next PC for chips in the abstract. It is bidding for the same wafers, and it is not losing.

The roadmap extends the point. Zen 7 "Florence" is confirmed for 2028 with new ACE vector extensions developed with Intel, of all companies, and Zen 8 "Ravenna" already has a name and a 2030 window^[8]. That is the real pattern of the week: AMD no longer behaves like the cheaper alternative pacing Intel. It behaves like the second pole of a duopoly, pacing Nvidia in units of gigawatts. Venice looks like a grand slam on paper. Paper is, for the next two quarters, where it lives.

Some stories are about whether the science works. This one is about whether the system around the science works, and it is grimmer. A joint investigation by Science and Retraction Watch, published today, documents the case of a six-year-old girl, identified by the pseudonym Mei, who died in late March 2025, seven days after receiving an experimental base-editing therapy at Xinhua Hospital in Shanghai. Her death was never made public, and sixteen months later the public record still says the trial is going fine^[1]. Her condition was never going to kill her.

Mei carried a mutation in a gene called CHD3, a single wrong letter of DNA that causes Snijders Blok-Campeau syndrome, a neurodevelopmental condition diagnosed in only about 237 people worldwide. Her case was mild, and it was not life-threatening. What she received instead was a world first: a base editor, a CRISPR-derived tool that rewrites individual DNA letters, packaged into trillions of AAV9 viruses and infused into her spinal fluid on March 24, 2025^[1]. Within days she developed fever, kidney failure, and plummeting platelets. The cause of death was thrombotic microangiopathy, a known and sometimes fatal reaction to high-dose AAV, the virus family used in several approved gene therapies. The hospital's own ethics board later judged her death "definitely related" to the treatment^[2].

Gene therapy has been here before, and everyone in the field knows the name. In 1999, an eighteen-year-old named Jesse Gelsinger died four days after an adenovirus vector triggered an overwhelming immune response in a University of Pennsylvania trial. He had ornithine transcarbamylase deficiency in a mild, managed form, and he was not dying of it when he volunteered. His death froze the field for the better part of a decade, and the lesson it left, as the Science History Institute's retrospective on the case lays out, was specific: the more survivable the disease, the less toxicity a first-in-human dose is permitted to carry. Mei received a different vector, a different payload, and a quarter century of additional technique. What she shared with Gelsinger is the part that killed them both, a high dose of virus given to a patient who was not in mortal danger.

Every safeguard failed in sequence

The details here matter more than the outrage, so let me be precise. The trial ran under China's investigator-initiated track, a category that requires no review by the national drug regulator. The hospital ethics committee approved it on January 2, 2025, six weeks before the primate toxicology report was even finished. That report, dated February 17, showed moderate to severe liver damage in all four monkeys dosed. Four animals is a small toxicology cohort, which cuts both ways: it is too few to characterize a risk, and four out of four is not a rate anyone gets to average away. The consent form the family signed never mentioned death as a possible outcome, and it stated the sponsor would cover all costs. That was false: Mei's parents paid $860,000, including $130,000 wired to a researcher's personal account, for an unproven therapy that charging patients for is illegal in China^[1].

I keep a mental checklist for first-in-human stories: regulator review, independent ethics approval working from complete data, an honest consent form, no pay-to-participate, mandatory reporting of serious adverse events. This case failed all five, and not subtly. When Stanford bioethicist Hank Greely says "death should always be mentioned in a first-in-human trial," he is describing the floor, not the ceiling^[2]. Steven Gray, a gene therapy researcher at UT Southwestern, was blunter: "This shouldn't have gone to trial"^[1].

So why the hurry? Not the medical record; the calendar. In February 2025, a month before Mei's infusion, a team at Children's Hospital of Philadelphia dosed an infant with a base editor built for his mutation alone, a case written up in the New England Journal of Medicine and carried around the world as a first. Chinese genetics, meanwhile, has spent years trying to be first at something in this field that is not He Jiankui's edited babies, and that pressure runs from funding bodies down to individual labs. None of it excuses anything. It does explain the shape of the failure: the guardrails at Xinhua were not bypassed by sloppiness. They were bypassed by people racing for a headline, and a headline is what they got.

The paper that cleaned it up

The aftermath adds a second scandal on top of the first. The team behind the trial, led by neuroscientist Zilong Qiu, published the preclinical work in Nature this year, and the paper shows mice rescued from the same mutation, with no trace of Mei's treatment, her family's money, or her death^[3]. State broadcaster CCTV praised the research as "the first ray of hope." Nature says it was unaware of the death. Seven outside experts who reviewed the paper at Science's request raised data-integrity concerns, and several believe the problems may warrant retraction. The consequences, meanwhile, read like satire: a fine of roughly $3,600 for the hospital, verbal counseling for the overseeing physician, and no action against Qiu from his university^[1].

Then there is the safety net that was supposed to catch all of this. The trial was registered publicly, which turns out to be worse than if it had never been listed at all. The ClinicalTrials.gov entry was last updated on June 26, 2025, three months after Mei died, and it still presents the study as active and ongoing, with no death, no serious adverse event, and no halt anywhere in it^[4]. A registry entry is not transparency by itself. It is a claim about reality that somebody has to keep true, and this one was actively maintained as a fiction for months after the child it described was dead.

What this does and does not mean

The obvious reading is "gene editing kills," and it is the wrong one. AAV-based therapies have real, verified wins, and the reaction that killed Mei is a known risk that dosing discipline and honest consent exist to manage. The harder reading is about implementation. Joy Zhang, a sociologist at the University of Kent, put it cleanly: the case shows "the gap between what is intended and what has been put in place"^[2]. A regulatory track built to let hospitals try things became a track that let one hospital skip every review that would have said no.

Mei's father, also speaking under a pseudonym, told the investigators: "We did not realize how unusual and dangerous many of the arrangements were"^[1]. That sentence belongs over the door of every ethics committee on earth. The entire apparatus of human-subjects protection exists because families cannot be expected to spot an unusual arrangement. Spotting it is the institution's job. The institution did not do it, the paper trail was laundered into a prestigious journal, and a child is dead. Gene editing will move on from this, and on the evidence of its better days, it should. The record of what happened here has to move with it.

The headline did the rounds this spring: Linux gaming had finally broken 5 percent on Steam. It has a certain poetry, the year of the Linux desktop arriving as a round number, and the strange part is that the number was real, briefly. Valve's own March survey page showed Linux at 5.33 percent, and the enthusiast press reported it straight^[2]. What the write-ups skipped was everything around the number: that same March survey was visibly glitching, garbling Linux distro names into strings like "0 64 bit" and swinging its sample the way it does whenever the Chinese internet-cafe demographic shifts weight. By June, the current survey as I write this, Linux sits at 3.69 percent, down three tenths from May's just-under-4^[1]. So the 5.33 was not a fabrication; it came straight off Valve's page. The failure was softer and more familiar: nobody looked twice at an obviously glitching survey, because "year of the Linux desktop" is a headline that writes itself. Either way, the party is cancelled. So why does the trend line keep setting records anyway?

Because 3.69 percent is still the highest sustained share Linux has ever had on the survey, and the composition underneath it reads like a different industry than five years ago. SteamOS alone accounts for 0.84 points of the global total, which is the Steam Deck showing up as itself, and which makes the Deck roughly a quarter of the Linux pie. Behind it, in the same global terms: CachyOS at 0.52, Arch at 0.33, Mint at 0.29, Bazzite at 0.27^[1]. CachyOS sitting above Arch is not a typo, by the way. The gaming-first distro overtook its own upstream parent on the survey and has not looked back, which tells you what these installs are for. Look at what the list says: three of the top five Linux entries are gaming-first systems, one of which ships preinstalled on a handheld, and the desktop entries together now outweigh the Deck that started the run. Nobody in these numbers is switching to Linux to run spreadsheets. They are switching, or dual-booting, to play games.

The plumbing did this

The reason is the unglamorous stack I keep writing about. Proton 11 went stable last week, rebasing Valve's compatibility layer onto Wine 11 and dragging a pile of 1990s classics into the playable column^[4]. Wine 11.12 pulled controller handling and media playback in-house last month^[5]. The April beta cycle put the same stack in front of testers early^[3]. None of these made headlines outside the enthusiast press. All of them compound, and the survey line is what compounding looks like.

The tailwind everyone cites is Windows 10 reaching end of life, and it is real but slower than the discourse wants. Windows 10 still holds 23.56 percent of the survey against Windows 11's 70.44^[1]. The holdouts are not stampeding. They are trickling, and some fraction of them, the ones with a Steam Deck and a tolerance for tinkering, are landing on Bazzite or CachyOS instead of Windows 11. A trickle is how a platform gets from 2 percent to 4 in three years.

Read the survey like a survey

The survey is opt-in and monthly, single-month moves are noise, and this one has a documented habit of lurching: the same June data shows Simplified Chinese jumping 2.3 points, which is a sampling story, not a migration^[1]. Linux's own line has wobbled by whole tenths between months. If you want the honest sentence, it is this: Linux gaming has more than tripled its share since the Steam Deck launched, it is holding records in the high threes, and the 5 percent milestone was a glitch in Valve's own instrument that everyone repeated because it sounded like history.

The part I would actually watch is not the percentage. It is that Valve keeps staffing the plumbing: the Proton changelog, the ARM64 experiments, the hardware ambitions it declines to deny^[6]. Companies do not maintain multi-year compatibility projects for 3.69 percent of a market out of sentiment. They do it because the number keeps moving in the same direction. Slowly. Boringly. The way infrastructure always moves.

The slow collision between AI-generated bug reports and open-source maintainers just claimed its biggest piece of governance yet. Michael Catanzaro, who has run security issue tracking for GNOME since November 2020, announced three changes today: the disclosure deadline for GNOME vulnerabilities drops from 90 days to 30, security reports will no longer be forwarded to projects whose policies ban AI-generated content, and he is personally stepping down from the role this fall^[1].

Start with the deadline, because it sounds reckless and is actually honest. The industry-standard 90-day window assumes vendors need months to ship fixes. Catanzaro's observation after nearly six years of data is that GNOME maintainers either fix an issue within one to three weeks or never touch it, so the extra two months of confidentiality "only introduces a delay that is not useful"^[1]. A disclosure policy should describe reality. This one now does. Honest for GNOME, though, reads differently downstream. GNOME is the default desktop of RHEL, SUSE, and Ubuntu, and a 30-day clock leaves Red Hat and Canonical far less room to coordinate, backport, and test a fix across every supported release before the details go public. The window did not shrink for GNOME alone. It shifted the burden of speed onto the enterprise ecosystem, which now inherits the deadline whether its release calendars like it or not.

The slop problem

The second change is the one that will make people sit up. Several GNOME projects, in a policy trend that started with the Loupe image viewer, prohibit all LLM-generated contributions, including issue reports. But most incoming security reports now contain AI-generated text, so forwarding them would violate those projects' own rules. The pragmatic fix: reports meant for those projects get closed immediately in the central tracker, with a ping to the maintainers so nothing real dies silently^[1]. The distinction from forwarding is thin but real: the machine-written text itself stays out of the project's tracker, and the maintainers learn only that a report exists, which their own policy leaves them free to go read or ignore. If you want one sentence to describe where open source is in 2026, "we had to route around the AI policies" is a strong candidate.

Catanzaro has been unusually quantified about the flood. In June he wrote that he had reviewed "well over 100 vulnerability reports that I strongly suspect were generated by AI," counting only a particularly heavy four-week stretch, which makes it a very loose lower bound^[2]. And here the story stops being a clean maintainer-versus-AI binary, because the same June post calls banning AI-assisted reports "stupid" and warns that a ban "punishes your users": an expert with a good model files excellent reports, and he credits one with a real code-execution flaw in Evince, Atril, and Xreader. The disaster is the other tail, "an inexperienced human with a bad AI" producing reports where a significant share is outright spam. Sit with that tension: the man stepping down under a flood of machine-generated slop is the same man begging GNOME projects not to ban the tools that generate it, on the grounds that those tools in skilled hands are simply what security research looks like now. Since non-AI reports are the unusual case either way, he argues, policy written for them is fiction^[2].

Every project is inventing its own immune response

Compare the approaches now on the board. The Linux kernel's answer to suspected AI reports is immediate full disclosure, and not only on the theory that a vulnerability a chatbot can find is one attackers already have. The kernel security team keeps receiving the same AI-generated finding from multiple researchers within days of each other, because parallel scanners running over the same code converge on the same bugs. An embargo protects a secret, and there is no secret once five bots have found it independently. Catanzaro calls the kernel's approach pretty extreme and unkind to maintainers, and he is right on both counts^[1]. Fedora's bug tracker drowned earlier this summer when an AI agent went feral inside it^[4]. GNOME's own bug bounty program closed entirely after the reports it attracted turned out to be mostly noise, and curl killed its bounty for the same reason, two more casualties Catanzaro tallies in his post^[1]. Nobody has a good answer. Everybody has an answer shaped by what they can survive.

The part I keep coming back to is the resignation. Catanzaro stops triaging new reports in November and is asking for a successor, which means the project now has to find a volunteer willing to read a hundred machine-written vulnerability reports in a bad month, forever, for free^[3]. The AI industry likes to say its tools will handle the tedious work. In open-source security, the tools are generating the tedious work and billing the maintainers for it. Somebody should invoice the labs.

Something has changed in the way people talk about running their own servers, and you can hear it in the forums. The question used to be "what should I run?" asked by hobbyists, answered by hobbyists, filed under hobby. This year's community surveys, GitHub stars, and deployment statistics describe a different conversation: complete stacks that replace a household's cloud subscriptions, discussed in the tone of people comparing utility bills^[2].

The economics explain the tone. One XDA writer added up what he canceled, cloud storage, photo backup, password syncing, document drives, and landed at almost $1,100 a year, replaced by a single power-efficient mini PC humming in a corner^[1]. Do the arithmetic before repeating that number, though, because storage alone does not get you there: a 2TB Google One plan runs $100 a year and a password manager costs ten. The bill only climbs into four figures once the streaming subscriptions go on the pile, which is where most of these savings actually live, and we will get to what that implies. Subscription fatigue was a grumble in 2023. In 2026 it is a line item people are doing something about.

The spreadsheet is also the shallowest reason to do this, and the communities driving the shift say so themselves. The traffic is no longer confined to r/selfhosted and r/homelab; it spills through r/degoogle, r/privacy, and a widening ring of forums whose founding premise is not saving money but getting your life out of a corporation's hands. The deeper draws do not fit in a budget column: photos that no model trains on, documents that no classifier reads for ad targeting, and services that cannot raise their price, paywall a feature, or rewrite their terms because a quarterly earnings call went badly. Every cloud subscription is a lease on your own data, and the landlord renegotiates it annually, always in one direction. The people building home servers in 2026 are not just canceling bills. They are getting off the lease.

The 2026 stack

What are people actually running? The community answer has converged with remarkable consensus, and the 2026 shortlist fits on one card^[2][3].

Files and sync

Nextcloud or copyparty

Photos

Immich

Media

Jellyfin

Monitoring

Uptime Kuma, Netdata, or Beszel

Remote access

WireGuard or Headscale

Local LLM

LM Studio or Ollama, with Open WebUI for chat

Ten years ago this list was a part-time job to assemble. Today most of it ships as one-command containers with sensible defaults, and the details are the draw: copyparty turns nearly any machine into a file server from a single Python file, Immich does its machine-learning tagging locally, so the family album trains nobody's model, and the LLM row, whether LM Studio or Ollama does the serving, never sends a token off the box. One deliberate omission from the remote-access row: Tailscale is the name everyone knows, but its coordination server is somebody else's cloud, which is a strange dependency for a stack whose whole point is not depending on somebody else's cloud. Headscale, the self-hosted implementation of the same protocol, is the version consistent with the mission.

The media server story is the cleanest example of how this shift happens, so let it stand on its own. Plex spent years as the default answer, then spent its goodwill on increasingly aggressive monetization: paywalled features, remote-streaming nudges, the usual enshittification arc. Jellyfin, the fully open-source fork, absorbed the refugees, and its 2025 plugin explosion closed the remaining feature gaps. The verdict in this year's stack rundowns is blunt: the takeover is complete^[2]. And since we are being honest about the economics, a Jellyfin box that replaces four streaming services gets its library from somewhere, and the somewhere is usually the *arr stack quietly fetching what the household used to stream, filed on the forums under "Linux ISOs." I am not writing that guide. I am also not going to pretend the shelves stock themselves. No committee decided this. Users just left, the way water finds the crack.

Be honest about the invoice

Now the part the enthusiasm glosses over, and I say this as someone who runs this stack and has written about where home automation goes wrong^[5]. Self-hosting does not remove costs; it converts them. The cloud bill becomes hardware, electricity, and, above all, time. You are the backup strategy. You are the security patch at 11 pm. You are the one explaining to the household why the photos are "temporarily unavailable" during a kernel update. The community's own hard-won wisdom is that a small stack you maintain beats an impressive one that rots^[2]. The subscription you cancel is money. The subscription you become is labor.

Put numbers on two of those converted costs, because the cloud bundled them invisibly. The first is capital. The mini PC is the cheap part, $150 or so for a used office box; the storage is not, and moving a decade of photos plus a real media library onto big NAS drives, mirrored like they should be, is another $400 or more before you have saved a cent. The second is redundancy. One machine humming in a corner is not a backup, it is a single point of failure with the family photo album on it. The old 3-2-1 rule still applies, three copies, two kinds of media, one offsite, and the offsite copy means a small recurring bill to something like Backblaze B2 or a second box at a relative's house. Google Drive was never just storage. It was somebody else's fire, flood, and dead-drive insurance, and if you leave, that job leaves with you.

So who is this actually for? If a Saturday spent reading release notes sounds like recreation, you already know, and the tools have never been better^[4]. If it sounds like a second job, the honest advice is to pick one thing, photos or media, run it for a while, and see whether the trade fits before canceling anything. The renaissance is real. It just turns out the renaissance has a chores list, and your name is on it.

The e-reader is one of the stranger corners of consumer tech. The hardware is basically solved: a small e-ink panel, a low-power chip, a battery measured in days or weeks depending on how honest you are about your reading habits. And yet the mainstream options remain locked little fiefdoms where the store matters more than the reader, and the book you bought can vanish if a licensing department has a bad quarter. Which is why a cheap pocket reader from Xteink, paired with a community firmware called CrossPoint, is the most interesting thing to happen to e-readers in years^[1].

Let me describe the X4 honestly, because it is a highly specific object: a 4.3 inch, 220 PPI e-ink panel in a body the size of a deck of cards, under 80 grams, no backlight. The screen is the size an iPhone was in 2011, and if you read in bed with the lights off, this is not your device. Inside sits an ESP32-C3, a single-core RISC-V microcontroller with roughly 380KB of usable RAM, next to a microSD slot and a 650 mAh battery that Xteink rates at up to 14 days if you read one to three hours a day^[3]. Call it a week or two. Direct from the manufacturer it runs about $70; the $40 and $50 listings on AliExpress are real, but they carry a catch that complicates the 'one-click' promise. Out of the box it is deliberately limited, a vehicle for the vendor's own format and store. The hardware, though, is a gift. The C3 is one of the best-understood chips in the hobbyist world, and part of the RISC-V wave I have written about before^[7]. The gap between what the X4 is and what it could be was never technical. It was permission. I have not had an X4 on my own desk yet, so read this as a dispatch from a fast-growing community rather than a review.

The firmware

CrossPoint closes that gap. It is a fully open-source reader firmware for the Xteink line: proper EPUB support, book uploads over WiFi from any browser on your network, KOReader synchronization, real typography controls, landscape rotation, the works^[2]. A modern EPUB does not fit in 380KB of RAM, and CrossPoint gets around the ceiling by aggressively caching parsed book data out to the microSD card, streaming a novel through a memory budget smaller than most web pages just to keep the device from falling over^[2]. The hands-on accounts describe a device transformed from curiosity into everyday reader^[4], and a fork called CrossInk has carried the work further for tinkerers. The whole thing is the open-source playbook running exactly as it should: a community saw a locked product with good bones and simply wrote the missing half.

One click, with an asterisk

The detail that elevates this from hobbyist project to actual phenomenon is the installer. Flashing firmware used to mean drivers, command lines, and the non-zero chance of a bricked gadget. CrossPoint's installer runs in a Chromium browser over USB-C, using WebSerial: plug in the reader, click once, done^[1]. Now the asterisk, because it decides which unit you should buy. That one-click story is true of readers bought direct from Xteink at around $70, which ship with USB flashing unlocked. The $40 units from AliExpress are frequently factory-locked, and CrossPoint's own documentation says those need a separate unlocker tool before the installer will even see them, along with a warning that interrupting the process can brick the device for good^[2]. The soldering-iron crowd will shrug at that. Everyone else should hear it plainly: pay the extra thirty dollars and the install is genuinely one click; chase the headline price and you are back in bootloader territory. The audience for a hackable pocket reader is not the people who already know how to flash a microcontroller. It is the people who never will, and for them the $70 unit is the one that keeps the promise.

The wider scene

CrossPoint is not alone in reading the moment. The Diptyx, an open-hardware dual-screen e-reader built around the beefier ESP32-S3, has been drawing attention on Crowd Supply, on the theory that the whole device, schematics included, should belong to its owner. Between that and the firmware scene, a pattern is emerging: e-readers are going the way 3D printers went, where the community first patched the locked products and then started replacing them outright. When Bambu Lab tried to wall off its printers, its own customers built the escape hatch within weeks^[6]. Xteink's buyers skipped the fight entirely and just wrote better firmware.

None of this kills the Kindle, obviously. A 4.3 inch panel with no light is a niche inside a niche, and most people will keep buying the reader that arrives in two days with the store attached. But the existence of a $70 device that does the job honestly, plus a one-click path to owning it outright, changes the negotiation. The locked ecosystem is no longer the only rational choice; it is merely the default. And defaults, as the 3D printer industry learned the expensive way, are one good alternative away from collapse.

Hardware pricing has been miserable for two years and it is not improving any time soon^[2]. Which is why the latest DIY Perks video landed so well with me: Matt, the channel's creator, built a genuinely beautiful all-in-one PC out of a motherboard from a smashed laptop and a screen from a shattered iMac, at roughly a third of what an equivalent new build would cost^[1].

The salvaged board he built around carries a current AMD processor, dedicated Nvidia RTX graphics, and 32 GB of DDR5 soldered on, and it cost less than a bare 32 GB kit of desktop memory. The display came off a decade-old iMac headed for the shredder, and its Retina panel still out-resolves most monitors sold new today. The oak-framed woodwork, the floorboard tripod, and the TV speakers finally pointed at an actual listener are his to show off, and I am not going to spoil them in text.

A price glitch in the parts bin

Why does hardware this capable sell this cheap? Because a salvaged laptop motherboard is only worth something to the handful of people repairing that exact model with that exact fault. It does not even have a power button, since modern laptops put the switch on the keyboard membrane and the keyboard never ships with the board, so to a normal buyer it is a dead slab. Demand that thin never caught the inflation that swallowed the rest of the market, and refurbishers pull boards out of broken machines faster than repair customers can absorb them, so the surplus sells at yesterday's prices. What the video demonstrates, with a forum thread of search terms and pinouts linked underneath it, is how little actually stands between that dead slab and a working computer.

The greenest computer is the one already built

The environmental case is the same argument in different clothes. A large share of a computer's lifetime footprint is locked in at the factory: the mining, refining, and chip fabrication that make a motherboard dwarf years of the electricity that will ever run it. Shredding a working board throws that whole investment away and then spends it all over again on the replacement, while reusing one skips the expensive part entirely. The shattered iMac is the cleanest picture of the problem you could ask for. The computer around the panel stopped being wanted years ago; the panel itself never stopped being excellent.

Go watch the video, because a written summary cannot do justice to a computer that looks more like furniture than electronics. The e-waste stream is quietly full of current-generation hardware priced as if it were obsolete, because the market only sees spare parts where a builder sees components. In a year when new hardware treats buyers this badly^[2], the repair bin might be the most honest computer store left.

When we last checked in, Nightmare Eclipse had just cancelled a mass zero-day dump scheduled for July 14, then un-cancelled the break, and teased a drop of "really interesting and possibly insanely controversial findings" for the same date anyway. The date has now come and gone, and the drop landed on schedule. What makes it worth a second look, though, is less what was in it than what was deliberately left out.

On July 14, the researcher published LegacyHive^[1], a privilege-escalation vulnerability in the Windows User Profile Service that lets a standard user mount another user's registry hive into their own session. In plain terms, a low-privilege account can reach straight into another user's live secrets, configuration, and stored credentials, an administrator's included. The underlying flaw works exactly as advertised: the proof of concept runs on every currently supported version of Windows desktop and server, including machines carrying the July 2026 security patch. What shipped, though, is not the exploit Nightmare Eclipse actually had. The GitHub release is a deliberately crippled version, stripped of the parts that would make it usable by anyone without their own research chops, and the README says so outright: "The PoC was stripped down as an attempt to prevent public exploitation."

Stripped for parts

The gap between this release and the ones that came before it is hard to miss, and none of it is accidental. The original, unmodified exploit required no extra credentials and could load any registry hive, not just the user-class hive the public version is limited to. The public version is practically tied in knots: it needs a second set of user credentials and an administrator's username just to run, and if it succeeds, it merely mounts the target hive into the current user's classes root. That hands a user a genuine step up in privilege, nowhere near the god-mode access the un-crippled exploit originally boasted. To get from the PoC to a working weapon, the README notes dryly, "you would need some brain cells."

That makes this a different kind of release from the ones that put Nightmare Eclipse on the map in April and May, when fully weaponized exploits went straight to GitHub alongside messages meant to needle Microsoft's Security Response Center. Those drops were functional attacks, ready to be picked up and run: BlueHammer turned Defender into a side door, RedSun added another route to SYSTEM, UnDefend let attackers switch the same product off, and YellowKey bypassed BitLocker with a USB stick. LegacyHive is built to be studied rather than run, closer to a blueprint with half the pages torn out than to a loaded weapon.

By their own telling, the reasons for pulling their punches were practical more than principled. In a blog post leading up to the release, they called it "the least interesting and least impactful bug" they had dropped since they started, adding that Microsoft had "legit just stopped pocking me and pissing me off" and that they were "conserving some energy." A separate post, dated July 8, read more like a confession: "Feeling depressed recently, I just wish if my brain power was used for good and not this. Dropping 0days is truly agonizing." Nobody outside their head can say whether that mood shaped the stripped-down release or just happened to coincide with it. Either way, the result is a working vulnerability disclosed in a way that gives defenders a head start over attackers, which the earlier drops pointedly did not.

The day LegacyHive dropped, the researcher posted a one-liner: "I wonder how many sweats were waiting for today." It is a jab at the exploit brokers, the zero-day buyers, and the attackers who had been counting on another weaponized release. They got a research artifact instead. The taunt lands the way most of their writing lands, and it makes clear the stripped-down release was deliberate. Nightmare Eclipse knew exactly what they were holding back, and who would go home empty-handed.

Look closely at the rest of the month, and it becomes clear this restraint wasn't isolated to LegacyHive. On July 9, five days before the drop, Nightmare Eclipse published findings on Windows Defender rather than an exploit for it. The most theatrical is a way to make Defender fill a machine's own disk: when it scans a file from a remote SMB share, it caches a local copy of any attached Alternate Data Stream with no size limit. Serve a malicious executable trailed by a massive Zone.Identifier stream, then hang the connection, and Defender will quietly choke the disk to zero free space, enough to leave Windows falling over. They reproduced it on Windows 11 25H2 and Windows Server 2025. As with anything posted to an anonymous blog, the specifics are unconfirmed. Either way, the posture matches LegacyHive's: map a weakness in public, and let the exposure do the work a weapon used to.

The pattern that matters

By the book, Nightmare Eclipse is still not a coordinated discloser. They publish on their own schedule, reserve no CVE, give the vendor no advance notice, sign their posts with PGP keys, and host mirrors on a domain called Church of Malware. What they do not do is cash in. They have not sold any of this to the brokers or governments who would pay a fortune for a working Windows zero-day; every drop goes out free and in public, reaching defenders and attackers on the same day. Their grievance is simple: they say they took the official reporting route first and got brushed off^[9]. Microsoft rejects that, insisting the researcher never properly reported the bugs in the first place. What is not in question is what came next: the company threatened them with criminal prosecution^[7], then backed off once the security community turned on it^[8]. Seen from there, the public drops look less like a grudge than the one lever that has reliably made Microsoft act.

The restraint matters for a reason the earlier drops obscured: Nightmare Eclipse can choose. The mass dump threatened for July 14 did not happen, and the exploit that did ship was built to be read, not run. The researcher who spent April and May proving they could put Microsoft on the back foot spent July proving they could choose not to. It's a fragile sort of optimism, resting entirely on the mood of an anonymous person under no obligation to keep showing restraint. Still, in a story that has been nothing but escalation since April, movement in the other direction is worth noticing.

There is no Patch Tuesday fix for LegacyHive yet, and the vulnerability works on fully patched systems. The defensive guidance, as it has been since the first drop, is to do what you can do: apply patches as they arrive, harden BitLocker with PINs and firmware passwords, and accept that for now the goal is to shrink the exposure rather than close it. The eclipse did not pass, and it has not gone away. But for the first time since April, it let a little light through.

You know the sponsorship read. Your favorite YouTuber leans into the camera and explains that for somewhere between $16 and $46 a month, a service called Incogni will scrub your name, address, and phone number from the data brokers who trade in them. A recent video essay from the channel NeuroEverything pulled on that thread until a whole corporate family tree came out with it^[1]. I have spent time since checking its receipts. Most of them hold up, a couple needed correcting, and the picture they add up to is stranger, and a good deal more systemic, than the pitch.

Start with the mechanics, because they contain the first problem. Before Incogni can ask a broker to delete your file, you give Incogni your full name, date of birth, home address, and phone number, and Incogni sends that bundle to hundreds of brokers to ask whether they have you. If a broker already had your file, fine, the request might work. If it did not, it has one now: accurate, current, and attached to a person demonstrably willing to pay monthly for privacy. Outside California and a handful of registry states, no American law compels the broker to do anything with the request except keep it. And handing over raw personal data is not even technically necessary. The proof shows up later in this story, from the company you would least expect.

Incogni's terms say it does not sell your personal data, and there is no evidence it does. The same terms permit sharing within its family of companies. Which raises the only question that matters: who is the family?

The illusion of independence

Incogni launched in early 2022 as a product of Surfshark, the VPN company. For years Surfshark and Nord Security, maker of NordVPN, denied persistent claims that they were connected, then in February 2022 they merged^[2], becoming Lithuania's second unicorn at a $1.6 billion valuation, a figure that doubled to $3 billion in 2023 after a $100 million injection from the growth investor Warburg Pincus^[3]. Both companies trace back to Tesonet, a Vilnius holding company founded in 2008, whose portfolio also touches the hosting company Hostinger, the eSIM brand Saily, and a stack of other consumer internet services^[4]. It does not hurt that 'European tech' still carries an ethics halo in these conversations, or that a Baltic holding company draws far less scrutiny from the Western tech press than the same org chart would in Delaware.

The architecture of extraction

This family tree matters because Tesonet also operates the other side of the house. When scrapers want to harvest the web at industrial speed, ordinary datacenter IP addresses get blocked by anti-bot systems almost immediately, so the workaround is the residential proxy: routing the scraper's traffic through IP addresses belonging to ordinary homes and phones, which makes automated harvesting look like somebody's household browsing. Tesonet's Oxylabs advertises more than 175 million such residential IPs across 195 countries. Decodo, formerly Smartproxy, adds a claimed 125 million more, and Oxylabs acquired the budget provider Webshare on top^[5]. By the essay's math, companies under this one roof control somewhere around 40 to 50 percent of the world's proxy market^[1].

Collecting hundreds of millions of household IPs takes more than volunteers. The method the industry has historically leaned on is the covert SDK: a chunk of code embedded in free utility apps and mobile games that quietly turns the device into a proxy node and resells its bandwidth, and the person who installed the app, not the proxy firm, wears the risk when their home IP gets banned for whatever the scraper did with it^[1]. Oxylabs says it sources its network ethically, pointing to an exclusive partnership with Honeygain, an app where users volunteer their unused bandwidth for pocket change. The arithmetic has a hole in it: community estimates put Honeygain's entire network at roughly 10 million devices. That leaves Oxylabs' other 165 million household IPs unexplained. And the partnership itself has been traced, executive by executive, to being an arrangement between Oxylabs and itself, with personnel moving between identical roles at the two companies under the same Tesonet umbrella^[6].

Put the two halves of the portfolio next to each other and the business model reads plainly enough: one family of companies charges you a monthly fee to petition data brokers on your behalf, while operating a large share of the infrastructure the brokers' suppliers use to gather data at scale. Nothing about that is illegal. Everything about it is worth knowing before you type your birth date into the form.

A conflict of interest with a face on it

Tesonet's conflict is structural, spread across holding companies and corporate registries, which makes it easy to file away as an abstraction and move on. For the personal version, look at OneRep, another big removal brand, which sells privacy services to individuals, medical professionals, and police departments. A 2024 investigation by Brian Krebs found that OneRep's founder and CEO, Dimitri Shelest, had founded dozens of people-search sites, and domain records tied him to Nuwber, a broker OneRep charges to remove people from^[7]. Shelest admitted founding Nuwber in 2015, around the same time he launched OneRep, and defended the ongoing stake by arguing that insider knowledge of the people-search business is what makes OneRep's removal technology good. Mozilla, which had bundled OneRep into Firefox Monitor, announced it would walk away^[8], and still took until late 2025 to finish walking^[9].

And here is the proof I promised earlier, from the direction I did not expect. OneRep, of all companies, gets this part of the engineering right. It interacts with brokers through email aliases and virtual phone numbers, as do competitors like Optery, so the opt-out process never hands a broker a fresh, verified copy of your real details. The removal service with the compromised founder never leaks your identity to the brokers, while the one owned by a privacy conglomerate demands it up front. That answers the question from the mechanics: transmitting your real name, address, and birth date is a design choice, not a requirement. The people best positioned to sell you the antidote keep turning out to be the people who bottled the poison.

The regulators aren't coming

The essay's grimmest claim is about Europe, and it is the one that needed the most correcting, so let me do that in public. The claim was that EU regulators received 10,000 complaints and acted on seven. The reality is more bureaucratic. Under GDPR's one-stop-shop rule, a multinational answers to the regulator where it is headquartered, and because tech companies flock to Dublin for the tax treatment, the under-resourced Irish Data Protection Commission is the de facto lead regulator for most of Big Tech. Its 2020 annual report shows it handled 10,151 cases that year, received 4,660 formal GDPR complaints and concluded 4,476 of them, mostly through amicable resolution, and served punitive enforcement notices over cookies and tracking technologies on precisely seven organizations^[10]. So no, not seven actions out of ten thousand. Seven punitive actions, though, is the accurate number, complex cross-border cases have queued for years at a time, and I am not sure the corrected version is more comforting.

The United States does not need correcting because there is barely anything to correct. There is no federal removal right. A few states run broker registries, and Texas caps annual fines at ten thousand dollars, a number a data broker can lose in a couch cushion. A broker weighing that fine against opening its database to deletion mandates does not need a calculator. The EFF found hundreds of known brokers simply declining to register at all^[11]. This is the same regulatory vacuum that lets a sports arena run facial recognition against its owner's enemies list^[13]; the data market is what that vacuum looks like at wholesale.

What actually works

One genuinely new thing arrives next month. California's Delete Act requires the state's privacy agency to run DROP, the Delete Request and Opt-Out Platform, slated for August: a resident files one free request and every registered broker in the state, more than 600 of them, must delete their data within 45 days and not reacquire it^[12]. It covers Californians and registered brokers only, which is two asterisks wide enough to drive a scraper through, but it is the first removal mechanism in America with actual teeth, and it costs nothing.

For everyone else, the boring advice remains undefeated. Data you never hand out does not need removing: aliases and virtual numbers by default, real details only for people with a legal reason to have them. And hold a permanent, healthy skepticism toward anyone charging a monthly fee to erase you from the internet, because as far as I can tell, the only party in this whole economy guaranteed to end up with your data is the one you paid to make it disappear.

Proton 11.0-1 went stable on July 7, after a beta run that started in April^[1]. If you have only ever pressed the install button on a Steam Deck and had a Windows game simply work, Proton is the translation layer doing that work, and this release is the biggest thing to happen to it in a while. The change underneath is a rebase onto Wine 11.0, the upstream project Proton is built from^[2].

A rebase is the least glamorous word in software, which is a shame, because this one carries a year of freight. Wine 11.0 shipped in January with roughly 6,300 changes and over 600 bug fixes, including the completed 64-bit WoW64 architecture that lets ancient 32-bit and even 16-bit-era software run inside a single modern Wine installation^[3]. I covered the upstream side of this pipeline when Wine 11.12 came out^[5]; Proton 11 is where all of that finally reaches the version of Wine most people run without knowing they run it.

Now for the part where the coverage and the changelog disagree. The enthusiast press has mostly led with NTSync, Wine 11's headline feature, which moves Windows-style thread synchronization into a Linux kernel driver (kernel 6.14 or newer) instead of faking it in userspace^[4]. The famous numbers, Dirt 3 leaping from 110 to 860 frames per second, come from the original patch series, and they are pathological best cases. Most games are not pathological. Valve's own release notes, meanwhile, do not say the word NTSync once. When the people shipping a feature are quieter about it than the people covering it, trust the shipping manifest. Expect steadier frame pacing in heavily threaded games and no miracles anywhere else.

The retro wins

My favorite part of the release notes is the guest list. Newly playable or promoted out of Proton Experimental: Resident Evil from 1996, Resident Evil 2 from 1998, both Dino Crisis games, SHOGUN: Total War, Metal Fatigue, Gothic 1 Classic, Breath of Fire IV, and Deadly Premonition, alongside comparatively modern holdouts like X-Plane 12, DCS World, and Warhammer: Vermintide 2^[1]. A 2026 infrastructure release whose proudest conquests are a quarter century old reads like a punchline, and it is the opposite of one. Old Windows games are the genuinely hard ones. They assume long-dead DirectX behaviors, video memory measured in single-digit megabytes, and installers written for operating systems that no longer exist. The completed WoW64 work is a big part of why this pile of ancient software suddenly became tractable.

The fix people actually noticed

The line in the changelog that will rescue the most actual evenings is plainer: an EA Desktop update had left many EA games unplayable, and 11.0-1 fixes them, along with the Steam Overlay that had died across much of the EA catalog^[1]. Read that sequence back. The launcher broke the games, and the compatibility layer repaired them. EA shipped the breakage, Valve shipped the fix, and nobody involved seems to find that arrangement strange anymore. Elsewhere in the notes, Crimson Desert's intro video plays again, and controller hotplug support now covers devices like the 8BitDo Ultimate 2C.

Under the hood, the component stack moves to current DXVK and VKD3D-Proton snapshots, Wine Mono 11.0, and Xalia 0.4.9, and the notes list FEX 2605 for ARM64EC builds^[2]. That last item is the one to squint at. FEX translates x86 code for ARM processors, and Valve does not maintain an ARM build pipeline for fun. Nobody at Valve is saying what it is for, and they do not have to. Companies telegraph their hardware plans in changelogs long before they admit them on a stage, and this line keeps getting updated.

If you want it today, pick Proton 11.0 from the compatibility menu in any game's properties on Steam. Or do nothing: it is now the default stable release, and the entire point of the project is that most people never find out any of this happened. As pitches go, invisibility is a strange one, but it is the rare kind that undersells.

There is a small detail worth pointing out in this website's source code. Down in the assets folder sits a file called mastodon.js, and its entire job is to reach out to mastodon.social, pull the last few posts from an account named @casually, and render them on the page in our own styling^[1]. Wiring a brand-new site straight into the open social web took an afternoon and asked nobody's permission, which is the whole appeal of the ecosystem. So it is worth stepping back to lay out what it actually is in 2026, past both the hype and the obituaries.

The fediverse is an easy thing to be lazy about. For years the coverage has swung between two equally useless poles. It is either the plucky Twitter killer that will finally set us free, or it is a dead mailing list for people who enjoy arguing about software licenses. In 2026 it is neither, and the truth is more interesting than either sales pitch. The decentralized social web quietly turned into real infrastructure this year, with real institutional money and real standards work behind it, and it still cannot get a newcomer through the front door without losing a good number of them on the way in. Neither camp likes hearing it.

The numbers

Start with the count, because that is where the distortion lives. Across the whole fediverse there are now more than 12 million registered accounts, with somewhere around 2 million of them active in any given month^[2]. Mastodon, the largest single piece of it, holds roughly 10.5 million of those registered accounts as of spring 2026^[3]. So far, so healthy.

The reality check is how many of those accounts actually show up. The monthly-active figure sits somewhere between 750,000 and a million, and Mastodon's own dashboard puts it around 785,000^[4]. That gap, ten million registered against fewer than one million active, is the single most important number for understanding where the network really stands. It is not a scandal. Every social network on earth carries a registered-to-active chasm like it. But it is the number both camps conveniently skip: far too big for the 'it's dead' crowd, far too small for anyone selling it as the next Twitter.

For context, Mastodon's monthly active users peaked at about 2.6 million in November 2022, in the frantic weeks right after Elon Musk closed his Twitter deal^[2]. It has not come close since. Read that pessimistically and it is a platform that caught lightning once and could not hold it. Read it the other way and it is a platform that kept most of its infrastructure, its developers, and a stubborn core of users through three years of the hype cycle wandering off to the next thing. A million people who chose to stay is a very different asset from ten million who signed up during a news event and drifted away. Small and real beats big and rented.

What actually shipped

None of that would matter if the software had stalled, and the genuine surprise of 2026 is that it didn't. Mastodon 4.6 arrived in June with the kind of release notes that suggest someone finally sat down next to a new user and watched them struggle^[5]. The headline feature is Collections, curated lists of up to 25 accounts you can publish and share. It is the closest the network has come to the 'starter pack' idea that made finding people on other platforms bearable, and it includes opt-in controls so nobody can drop you onto a list without your say-so^[6]. Quote posts, long resisted on principle, finally shipped as well, with controls attached.

The rest of the update went to long-overdue quality of life. You can now crop an image or add alt text without being kicked out to a separate settings page. Non-users can follow public accounts by email. There is even an opt-in year-in-review.

The more important change is one most users will never see. Support for a proposal with the deeply unglamorous name FEP-3b86, or Activity Intents, merged into Mastodon back in March^[7]. What it does is let a server advertise the correct URLs for common actions (follow, reply, boost, like) so a button sitting on some other website can hand you off to your own home server to actually complete the action^[8]. If that sounds trivial, it is quietly aimed at the single most hated moment in the fediverse: clicking Follow on a stranger's post, being told to copy a URL, paste it into your own instance, and try again. The plumbing to kill that ritual now exists. Whether the apps bother to use it is the next question.

Mastodon is no longer the whole story, a reality the microblogging-obsessed coverage keeps missing. Ghost, the newsletter and blogging platform, now speaks ActivityPub natively, so a Ghost site can be followed directly from Mastodon and its posts land in the same timeline as everyone else's^[9]. That is a real publisher with real paying customers wiring itself into the open network on purpose^[10]. Loops, a short-video app from the people behind the Pixelfed photo network, joined the fediverse too, offering the one thing nobody expected to be open: a TikTok-shaped feed that federates^[11]. The interesting growth is happening sideways, into formats Twitter never owned in the first place.

Who is minding the standard

Here is the part that actually convinced me the grown-up framing is fair. In February, Mastodon GmbH joined the World Wide Web Consortium, the standards body that stewards the web, and sent people to the kickoff of a new Social Web Working Group whose job is to formally maintain ActivityPub, the protocol the entire fediverse runs on^[12]. A protocol that lives or dies on one company's goodwill is fragile. A protocol with a chartered W3C working group behind it is the boring kind of durable that outlasts any single app^[13]. This is the same idea, moved up to the level of a standard, that the whole pitch rests on: no single owner who can quietly revoke it.

The money is following the same logic. Germany's Sovereign Tech Fund, the state-backed program that pays to maintain critical open-source infrastructure, awarded Mastodon a service agreement worth 614,000 euros, and a chunk of it is earmarked for something the network has promised for years and never delivered: end-to-end encrypted direct messages^[14]. The plan is built on MLS over ActivityPub, with a feature called message franking so a recipient can still report an abusive message without the server ever being able to read it^[15]. The timeline is honest to the point of being unflattering. The work is slated to begin late in 2026 and land by the end of the second quarter of 2027, and even that is contingent on the W3C task force finishing a specification and two independent servers proving they can actually talk to each other. Real, but not soon. That is roughly the fediverse's entire personality compressed into one roadmap.

The problem at the front door

Which brings us back to the front door, because for all the standards work, what a normal person hits first is still a wall. In April, the site We Distribute graded the network against its own list of the 'Seven Deadly Fediverse UX Sins' and handed the whole ecosystem a C+^[16]. Some of that friction is genuinely lifting. Missing replies, where a conversation looked one-sided because your server had never fetched the other half of it, earned an A- once Mastodon 4.5 started backfilling them automatically. Instance-selection paralysis, that dreaded first screen where you are told to pick a server before you have any idea what a server is, is easing as newer apps like Loops simply pick a sensible default and let you change it later.

But the ugliest sin barely moved. Remote interaction, the copy-paste follow dance, scored a D-, because even though the infrastructure to fix it now exists, the actual web experience most people land on still shoves the raw URL at you and wishes you luck. Content discovery got a C: the ingredients are all there, as the report puts it, but nobody has baked the cake yet. The uncomfortable lesson underneath the grades is the one the movement doesn't like to say out loud. Decentralization is not free. Every bit of control it hands the user (which server, which rules, which algorithm) arrives as a decision the user never asked to make, at the exact moment they only wanted to read a post.

A centralized app makes all of those choices for you and calls the result simplicity. That is the trade, and no run of good release notes erases it.

So that is what is behind our little button. Not a revolution, and not a graveyard. A network of roughly a million active people that spent 2026 getting slowly, unglamorously more real: better releases, a seat at the standards table, public money aimed squarely at its biggest missing feature, and a sign-up page that still fumbles the handoff. The fediverse doesn't need anyone's permission, or anyone's coverage, to keep going, and that is exactly the point. It just keeps federating on a protocol nobody owns, one confusing onboarding screen at a time.

On the summit floor this year, a company called DeepComputing did something that reads like a stunt and is closer to a statement of intent. It took a Framework Laptop 13, swapped in a mainboard built entirely around an open, royalty-free chip, and ran a 7-billion-parameter DeepSeek model on it live^[1]. No cloud. No GPU. The board even had a dedicated AI accelerator sitting right there on the chip, but they ignored it. They ran the model on the general-purpose cores alone just to show they could. The speed was not going to worry a data center, but that was never the pitch. The pitch was that the chip owed nobody a license fee to exist.

The claim

The backdrop to that demo is a number the industry has been repeating all year: RISC-V, the open instruction set that started life as a Berkeley teaching project, has crossed 25 percent of the global market and earned a seat as the 'third pillar' of computing next to x86 and ARM^[2]. It's a great headline, but the 25 percent figure is doing a lot of quiet heavy lifting.

Start with who is saying it. The 25 percent figure comes from RISC-V International, the trade body that shepherds the standard, which announced the milestone as running ahead of schedule and backed it with research from the analyst firm SHD Group^[3]. That does not make it wrong, but it does mean the headline was produced by the organization whose entire job is to promote the thing. SHD's own forecast is more careful than the round number suggests, projecting RISC-V chip shipments growing at roughly 47 percent a year toward something like a third of the market and 16 billion units by 2030^[4]. The eye-catching share is measured in units, not dollars, and it is a trajectory as much as a snapshot.

Unit volume is the asterisk that matters most. The bulk of RISC-V's penetration is not laptops or servers. It is tiny embedded cores, many of them buried invisibly inside larger chips where they manage power delivery or shuffle basic I/O, the kind of silicon you already own without knowing it^[5]. Counting those is fair, but it means '25 percent of the market' describes a world where RISC-V is simultaneously everywhere and almost nowhere you can actually see. And by the time the figure had bounced through the content mill, it had curdled into fully automated press releases declaring 'the end of the proprietary duopoly,' bylined to an AI and citing no analyst at all^[6]. Look past the automated hype, and what is left is more modest, and more interesting, than the slop version of it.

Why open silicon matters

Strip away the market math and here is why anyone builds on RISC-V in the first place. An instruction set is the contract between software and the chip that runs it, and for decades that contract came from exactly two places. Intel and AMD own x86. ARM licenses its designs, collects a royalty on every core shipped, and gets a say in who is allowed to build what. RISC-V is a published standard anyone can implement without asking permission or paying a fee^[7]. That is the whole idea, and it is the same idea that made Linux matter: not that it is always better, but that no single company can revoke it, price you out of it, or fold it into a licensing fight you had no part in.

The technically neat part is that it is one family rather than a pile of unrelated chips. The same base design scales from a microcontroller too small to run an operating system up to laptop-class parts, with optional extensions, like the ratified RVV vector instructions for the math AI workloads lean on, layered on top only where they are needed^[8]. A vendor picks the pieces that fit and skips the rest, and code written against the standard extensions travels between them. For anyone who has watched a device get orphaned because its chip vendor lost interest, an architecture nobody can pull out from under you is not an abstraction. It is the difference between hardware you own and hardware you are renting.

The proof of life

That argument only means anything if the hardware actually exists, and this year it walked onstage. The board behind the demo is the DC-ROMA RISC-V Mainboard III^[9], a drop-in replacement for the guts of a Framework Laptop 13. It pairs up to 32 GB of memory with SpacemiT's K3, an eight-core, 2.5 GHz chip that happens to be the first RISC-V part to support the modern RVA23 software profile. That profile matters more than the clock speed. It is the agreement that lets a mainstream Linux distribution and its prebuilt binaries just run, instead of every board needing its own bespoke build. The K3 also carries an on-chip AI accelerator, and in other hands the same silicon has driven demos running 30-billion-parameter models at ten to fifteen tokens a second^[10].

This is precisely what makes the CPU-only run worth dwelling on. The K3's marketed AI muscle lives in that accelerator, not its general-purpose cores, so loading DeepSeek 7B onto the plain CPU was never the fast path, and nobody would put those numbers up against a laptop with a real GPU. That was the flex. The point was not speed, it was that a fully open, repairable laptop could load a modern language model and answer you with no network connection and no proprietary silicon anywhere in the loop, and still have its fast path in reserve. Two years ago that was a slide in a keynote. Now it is a board you can preorder.

The reality check

None of which means you should put your x86 machine on the curb. Desktop-class RISC-V in 2026 is still slow and still rough around the edges. The shipping Linux boards, the StarFive VisionFive 2, the Milk-V Mars, the Banana Pi BPI-F3, land closer to an entry-level ARM single-board computer than to a modern laptop. The fastest way to ruin a weekend is to buy a board whose vendor never got its kernel support merged upstream^[8]. Stick to the mainline-supported chips and the experience is genuinely usable. Wander off them and you inherit an out-of-tree kernel and a forum thread where the manual should be. The software still trails the silicon.

Where RISC-V is actually winning is the unglamorous part of the market the hype tends to skip: embedded controllers, IoT parts, and the long tail of chips where shaving a royalty off every unit is the entire business case^[11]. It is also winning where politics pushes it. China has thrown its weight behind the open standard precisely because it is not American-controlled and cannot be sanctioned away, and its state press now frames RISC-V as a route to semiconductor self-sufficiency^[12]. Read that as strategy rather than a hardware review, but it is strategy with real money and real fabs behind it, and it is a large part of why the shipment curve climbs as steeply as it does.

We have watched a smaller version of this before. When the ArmSoM Sige6 quietly ditched Rockchip for Allwinner, the interesting part was never the chip. It was the crack it opened in a one-vendor corner of the market. RISC-V is that same move at the scale of the whole industry: not a better chip so much as a refusal to let two companies own the ground everything else has to stand on. The 25 percent is softer than the headline, the desktop story is years from comfortable, and the FOSDEM and Summit Europe schedules are still thick with talks about toolchains that do not quite work yet^[13]. But the direction is not really in doubt. An architecture nobody can lock down doesn't have to be the fastest. It just has to be impossible to take away.

There is a kind of science headline built to trigger the lizard brain, and 'scientists want to quarantine alien life on the Moon' is close to the platonic ideal of it^[1]. The actual proposal underneath is quieter, and more interesting than the monster-movie framing suggests. In a peer-reviewed paper in the journal Ambio, two researchers argue that as we start hauling samples back from Mars, asteroids, and the icy moons, the safest place to open the containers first is not a lab on Earth but a robotic facility on the Moon^[2]. The claim is not that Martian germs are coming for us, but that we are far less sure than we pretend about what could survive the trip.

What they are actually proposing

The idea is a dedicated biocontainment facility on the lunar surface, handled entirely by machines, where returned material would be examined and stored before any of it comes near Earth's biosphere^[2]. Samples from Mars and other bodies would be routed there first, screened by robotic systems, and only cleared for the trip home once they were judged safe^[3]. The Moon, in this telling, becomes a kind of airlock for the solar system: close enough to reach, isolated enough to contain a mistake, and, as far as we can tell, carrying no biosphere of its own to contaminate in either direction^[4].

This is invasion biology, not a monster movie

The framing that makes the paper worth reading is who wrote it. One of the authors, Anthony Ricciardi, is an invasion biologist, someone who studies what happens when a species turns up somewhere its new neighbors never evolved to handle^[2]. Read through that lens, the argument stops being about little green men and starts sounding like every zebra mussel and cane toad case study you have ever heard, scaled up to a planet. The point is not that life on Mars is likely. It is that biologists keep finding extremophiles on Earth thriving in radioactive, frozen, or acidic places that should be lethal, which quietly undercuts the comfortable assumption that anything from Mars simply could not make it here^[1]. When the probability is low but genuinely unknown, and the downside is irreversible, ecologists tend to argue for caution. That is what this is.

We have done planetary quarantine before, badly

None of this is unprecedented, which is the part the coverage tends to skip. When Apollo brought the first Moon rocks and astronauts home, NASA ran them through a Lunar Receiving Laboratory built for exactly this fear, that something in the samples might be dangerous^[5]. By most later accounts the containment was closer to ritual than reality. NASA spent millions on sealed rooms and biological isolation suits, and then cracked the command module open in the middle of the Pacific, hatch to the open sky, with the ocean breeze rolling across the astronauts and every surface they had touched, hours before any of it reached a clean room. It worked out because the Moon turned out to be sterile, not because the procedure was sound. That history cuts both ways. It shows we have taken the risk seriously enough to plan for it, but it reveals how fast a containment plan collapses into theater the moment the logistics get inconvenient.

Is it worth it?

The obvious objection is cost. Building and operating anything on the Moon is one of the most expensive things our species knows how to do, and NASA's near-term lunar plans are already stretched across landers, habitats, and surface infrastructure^[6]. A robotic biocontainment lab on top of that is not a small ask, and it is fair to wonder whether the money buys down a risk we cannot even put a number on. The counterargument is the one insurance runs on. A risk stays acceptable right up until the exact moment it is not, and a self-replicating biological mistake does not sit down to recalculate the premium. It just spreads.

The people who plan these missions are not blind to the problem. Mars Sample Return already takes containment seriously in its own way, with a 'break the chain' philosophy meant to keep unsterilized Martian material from ever touching the outside of the spacecraft that carries it home^[6]. Whether the answer is a maximum-containment lab on Earth or a robotic outpost on the Moon is a real and unsettled debate, not a fringe one^[7]. The most useful thing this proposal does is force the question while it is still cheap to change the plan. A lunar facility is probably a long shot on cost alone. But the instinct behind it, to decide how careful to be before the samples are in the air rather than after, is the one that matters, because this is not a decision anyone gets to make twice^[8]. Almost every mistake in the history of exploration was, in the end, survivable and correctable. A living one, turned loose in our own atmosphere, would be the first we could not take back.

The supergiant isopod is one of those animals the internet adopted years ago: a deep-sea crustacean that can reach the size of a small dog, all armor plates and too many legs, like a woodlouse designed by a committee with a grudge. Its main claim to fame is going years without eating, including one captive individual that reportedly refused food for more than five years before it died^[1]. A team at the Institute of Oceanology under the Chinese Academy of Sciences, publishing in the journal Cell, has now worked out how the animal pulls this off, and the answer turns out to be a two-part system rather than a single trick^[2].

Why the deep sea starves you

To see why this is impressive, you have to picture the environment. On the deep-sea floor there is no sunlight and almost no local food production. Most of what arrives falls from far above as 'marine snow,' the slow drift of dead plankton and waste, punctuated only rarely by something large, a dead fish or a whale, hitting the bottom^[3]. An animal down there lives feast-to-famine on a schedule it does not control, and famine is the default setting. Survival means either burning energy to hunt for food that is not there, or evolving to need almost none at all.

A stomach built for the binge

The first half of the isopod's answer is storage. The researchers found that its stomach takes up roughly two-thirds of its entire body, a cavernous larder far larger than anything its shallow-water relatives carry^[2]. When a windfall does arrive, the animal can gorge and bank an enormous amount of it at once, then draw that reserve down slowly over the long stretch until the next meal^[4]. It is the biological version of buying in bulk because you do not know when the store will reopen.

The frugal engine

The second half is metabolism. The team reports that the isopod runs at an extremely low basal metabolic rate, the baseline energy cost of simply staying alive^[2]. Turn that dial down far enough and a full stomach can last an implausibly long time, because the body is barely spending. Big cold-water animals already tend toward slow metabolisms, but the study frames this as the other half of a deliberate pairing: a huge tank and a very frugal engine, evolved together to fit a place where food is both rare and unpredictable^[5].

Borrowed from bacteria

The paper's most surprising claim, and one that deserves a healthy dose of scientific skepticism, involves a gene called ND1 that is tied to suppressing energy metabolism in the cold. The researchers suggest that this gene appears to have been transferred into the isopod's genome from bacteria, an example of horizontal gene transfer, where DNA moves between unrelated organisms instead of being passed down from parents^[4]. Horizontal transfer into an animal is unusual, and the sort of finding that invites close scrutiny before anyone treats it as settled. But if it holds up, it means part of this creature's talent for near-starvation was, in a sense, borrowed from microbes^[2].

A few caveats are worth noting. The famous five-year figure is a reported maximum from captivity, not a routine, and captive animals behave differently from wild ones^[1]. And as with almost every metabolism study, the write-ups reach quickly for human applications: longevity research, obesity treatment, better aquaculture^[2]. Treat those as the hopeful coda they are, not the result. The actual finding is cleaner, and honestly more satisfying than any of them. A very large animal, in a place with almost nothing to eat, gets by on a giant pantry and an engine idled almost to a stop, with maybe an assist from a gene it picked up from bacteria.

Summer is here, and with it the seasonal sales. Plenty of storefronts are running discounts right now, but itch.io is worth singling out for one reason in particular: its open revenue sharing. Sellers there decide what cut the platform takes, anywhere from zero to a hundred percent, with a default of just 10 percent^[1]. In practice that means a larger share of what you spend lands with the people who actually made the game. The summer sale^[2] runs through July 6th, so here are three picks worth a look: two I just bought to try out, and one I already have and think more people should play.

Riftborne

Developer

Pitio Productions

Genre

Strategy, Simulation

Platforms

Linux (x86_64, ARM), Windows

Riftborne is about as unusual as a strategy game gets: a real-time grand strategy title that runs entirely inside your terminal, from developer Pitio Productions, on Linux and Windows^[3]. You start with a single base and grow it into a network of colonies, fleets, supply lines, and contracts. Along the way you build ships, take part in factional warfare, raid neighbors for rare resources, and train spies to infiltrate enemy bases for intel. The developer is upfront that this is a slow, long-form game built around patience and scale, with enemies that adapt to your playstyle over time and even across new saves. It is not a campaign you finish in a weekend.

A game that lives entirely in a terminal is easy to file away as a curiosity and move on, but it was the track record that actually kept it on my list. It released back in March, already sits above 90 percent positive reviews, and has shipped more than 40 updates since launch, alongside a community that looks both active and welcoming. At $6.39 during the sale, down from $7.99, it was an easy one to grab, and I plan to see how far my terminal empire gets this week.

Rebel Wars

Developer

Mananuk

Genre

Shooter

Platforms

ZX Spectrum, Linux, Windows, macOS, Android

Rebel Wars, from developer Mananuk, is a top-down boarding-and-rescue shooter with a twist: it was built for the ZX Spectrum, so it runs on original 1980s hardware as well as Linux, Windows, macOS, Android, and any device that can emulate the platform^[4]. You play a Star Alliance soldier raiding enemy corvettes for objectives like hostage rescues, data recovery, planting explosives, and hacking computers. There are four ship models to learn, access cards to track down for restricted areas, and 360 randomized mission combinations, so no two runs lay out quite the same.

You will not need a forty-year-old machine wedged in a closet to play it, thankfully, so I'll be running it through the Fuse emulator^[5] the developer recommends. At €0.50 on sale, down from €1.00, it is a cheap way to try a game made for the platform. If you want to go further, Mananuk also bundles ten complete ZX Spectrum games together as The Spectrum Compilation for €1.00, down from €2.00^[6], a solid starting point for anyone curious about the system.

Hypnospace Outlaw

Developer

Jay Tholen, TetroniMike

Genre

Simulation

Platforms

Linux, Windows, macOS

Hypnospace Outlaw, by Jay Tholen and TetroniMike, is the one on this list I have already played, and the one I most want to talk other people into. Originally released in 2019^[7], it casts you as a volunteer 'enforcer' moderating a fictional late-90s internet that runs on a remarkably detailed fake operating system. Underneath the period-perfect web pages and desktop clutter there is a real story, and a lot of small things to find.

Half the fun is bumping into things you were not looking for, so I will say almost nothing more about what is actually in there. If you enjoy sandbox games that lean on atmosphere and discovery, it is an easy recommendation, and at $4.99 during the sale, down from $19.99, there has rarely been a cheaper time to try it.

These are only three of the games that caught my eye. There are thousands more indie titles, developer tools, and game assets discounted until July 6th^[2], so it is worth browsing the sale yourself to see what stands out, and supporting the creators behind the work along the way.

The world's memory supply is being vacuumed into a handful of data centers, and the bill is landing in your hands. The scale of the boom driving that is hard to overstate. Back in April of this year, the global market collectively bought $110.5 billion of semiconductors, the first time the industry has ever cleared $100 billion in thirty days, and an astonishing 93.9 percent jump over the same month a year earlier^[1]. The trade body that tracks these things now expects the full year to close above $1.51 trillion, a milestone it did not expect to reach for years^[2]. For the semiconductor manufacturing industry, it's an unprecedented period of profits. For the rest of us, it is just the start.

There seem to be two competing narratives being pushed through the media at the moment. One says the memory manufacturers are gouging and abandoning ordinary buyers to chase the AI gold rush. The other, unsurprisingly argued most directly by the people selling the memory, claims you've misread the situation entirely, that the shortage is simply a brutal limitation of physics. While the manufacturers are technically correct, their latest business decisions and forced lock-in contracts paint a clear picture of their intent to continue brazenly abusing those limitations. The shortage is real, it is by design, and it has no chance of letting up soon. As long as the companies involved are allowed to get away with it, they will continue posting the kind of margins normally reserved for software monopolies. Digging into the numbers as they are today is the only honest way to untangle what is happening.

It started inside the fabs

Three companies, Samsung, SK Hynix, and Micron, control more than 95 percent of the world's DRAM production^[3]. When demand exploded for High Bandwidth Memory, the stacked, interconnected DRAM that is necessary for AI accelerators to function at higher bandwidths, those three made a rational choice. HBM reportedly carries margins near 60 percent against roughly 40 percent for ordinary commodity DRAM^[4], so they aimed their best capacity at it. The problem with this harsh shift is that wafer fabrication is close to a zero sum game. Every line they convert to produce memory for AI accelerators is a line no longer making the memory that goes in laptops, phones, and routers. The vacuum has created a force on the market that is just begging to have its long-term ramifications become very clear.

The rush to fill that vacuum has been fiscally brutal, even to the largest names in the market. Conventional DRAM contract prices rose somewhere between 90 and 98 percent quarter over quarter in the first three months of 2026, then climbed another 58 to 63 percent in the second quarter on top of that already inflated base^[5]. NAND flash, the storage side, actually outpaced DRAM in the second quarter with increases of 70 to 75 percent^[5]. The strangest symptom is at the bottom of the stack. Supplies of older nodes tightened so hard that DDR4 spot prices climbed past newer DDR5 in some configurations, an inversion that has started to turn the normal march of progress on its head^[6], and demand has since reached back even further, slowly dragging up the price of legacy DDR2 and DDR3 parts that were supposed to be effectively obsolete^[7].

The shortage comes for everything with a chip in it

The Verge put the consumer side of things plainly: the price of RAM has tripled, quadrupled, even sextupled depending on the chip, and it is not just a problem for people who build their own PCs^[8]. The damage continues to show up everywhere a computer hides. IDC figures memory is now 15 to 20 percent of the materials cost of a midrange phone, and the same firm that once expected average phone prices to rise about $9 now expects as much as 8 percent, with steeper hikes on cheap phones where the cost gets passed straight to you^[8]. Qualcomm's chief executive told investors a coming dip in its phone business would be "100 percent" down to the memory shortage, and added, with unusual candor for an earnings call, "we just wish there was more memory"^[8]. Game consoles, handhelds, even the next generation of PlayStation and Xbox have been repriced or pushed back for the same reason^[8].

The most overlooked casualties are the cheap boxes nobody thinks about. Counterpoint Research found that memory prices for consumer gear like broadband routers, gateways, and set top boxes jumped more than 600 percent, nearly seven times, over a roughly nine month stretch into early 2026, against a threefold rise for smartphone memory in the same window^[9]. These are devices built on razor-thin margins, and those margins have rapidly disappeared. A year ago, memory was around 3 percent of the bill of materials for a low- to mid-range router. Today it is over 20 percent^[9]. That is the kind of shift that quietly stalls fiber rollouts and keeps a whole generation of affordable consumer hardware from being built at all.

Micron says you have the story wrong

Into the chaos walked Christopher Moore, Micron's vice president of marketing for its mobile and client business, who sat down with Wccftech in January and politely told everyone they had misunderstood the situation^[10]. His argument, while delivered with PR-flavored and lawyer-approved fluff, is worth examining for what it is. Micron, he said, is still serving consumers, just through different channels, supplying memory to the Dells and Asuses of the world rather than selling sticks directly^[10]. The real driver, in his telling, is not malice but scale. The share of the market that data centers demand "used to be 30, 35 percent, and then to 40 percent, and now to 50 and 60 percent," and the entire industry is simply short. "This is not a Micron issue," he said, "it's an industry issue"^[10].

His second point is the one most worth explaining, because the industry issue is one of an industry with very few players. Building modern memory is not a simple endeavor. Every time a fab switches the density of chip it makes, say from a 12 gigabyte chip to a 16 gigabyte chip, total output drops while the lines retool^[10]. So Micron is now asking customers to hold their configurations steady to allow running as few variations as possible, and keep output volume up. And the new capacity everyone keeps pointing to will not arrive on the schedule people imagine. Micron broke ground on its Idaho facility three years ago and pulled its start into mid-2027, but in Moore's own words you will not see "real output, meaningful output" until at least 2028, once qualification and customer acceptance are done^[10]. On the engineering, he is right. The shortage cannot be quickly resolved, and the nearest hope of meeting demand is genuinely years out.

The margins say otherwise

Here is where the numbers start to warp reality, the income statements. In the quarter it reported on June 24, Micron booked $41.5 billion in revenue, up 74 percent in three months, at an operating margin of 81.2 percent^[11]. Its own breakdown shows the gains were almost entirely price, not volume: DRAM bit shipments rose in the low single digits while average selling prices climbed in the low 60s^[11]. That is not a company simply struggling to meet demand. That is a company having the best year of its life, made painfully clear in May when its market value crossed $1 trillion for the first time^[12].

Micron is not alone in this market, and it is not even the biggest winner. Samsung, the volume leader in conventional DRAM, raised memory prices 100 percent year over year in the first quarter and then, unbothered, raised them another 30 percent for the second^[13]. Its semiconductor division alone turned 53.7 trillion won in operating profit for the quarter^[14]. SK Hynix, meanwhile, posted a 72 percent operating margin and a net cash position around 35 trillion won, having paid down its debt to a rounding error along the way^[15]. The three suppliers have each enjoyed the most profitable quarters they have ever seen because of this sudden overwhelming demand, and the continued eye-watering price hikes are unlikely to break their pace for the foreseeable future.

The cavalry is not coming, at least not on time

The obvious fix, you'd rightly think, is to build more fabs at home. This is already underway, and already too slow. The U.S. CHIPS and Science Act put roughly $280 billion behind the effort, including $52.7 billion in direct support for chip manufacturing^[16]. The tier one projects are enormous. TSMC has expanded its Arizona footprint to about $165 billion, and Micron is anchoring a $100 billion campus in New York as well as a $50 billion operation in Idaho^[17]. But these facilities take years to build, and the timelines don't look great. Meaningful memory output won't be on the table until 2028 at the earliest. Subsidies can derisk a fab, they cannot make concrete cure faster.

And subsidies do not work everywhere. A $1.9 billion chip plant proposed by EMP Shield in Coffey County, Kansas, pitched as 1,200 jobs and a slice of the supply chain for rural America, was denied CHIPS Act funding and has gone essentially nowhere since^[18]. It is a painful reminder that you cannot conjure a semiconductor manufacturing industry by simply trying to fund and manufacture the fabs. The money will go first to the places that already have the labor, the logistics, and the incumbents, which is to say the places that have decades of supporting infrastructure and logistics ready to support this type of facility.

The only real exit is rebuilding the machine

If brute force manufacturing cannot close the gap fast enough, the next strategy might be to need less memory in the first place. That work is happening in university cleanrooms rather than megafabs. Through the JUMP 2.0 program, run with the Semiconductor Research Corporation and DARPA, researchers are chasing architectures that merge memory and logic instead of endlessly shuttling data between them^[19]. At the University of Kansas, that means atomically thin memory resistors aimed at neuromorphic computing, hardware that mimics the brain's synapses to fold storage and processing into the same tiny components^[20]. Done right, it would cut the sheer volume of DRAM an AI workload needs. While improving efficiency is far from a promise of satiated demand, the efforts are unlikely to make things worse, at least as far as Jevons Paradox, the tendency for efficiency gains to just spur more total consumption, can be avoided.

While memory used to be a commodity, bought and sold on a volatile spot market that rose and fell with PC demand, that market is effectively dead^[5]. The big buyers now lock in binding, multiyear supply agreements just to guarantee they can keep their machines running, and the suppliers have every reason to keep it that way. While trillion-dollar companies run by billionaires will continue to get taxpayer-funded subsidies to help pay the ever increasing rates, the rest of us will just continue to foot the bill.

Wine 11.12 is out, the latest in the project's roughly biweekly development series^[1]. The release notes list three notable changes plus the usual round of bug fixes.

The first is that Wine now bundles libswresample and libswscale, the audio-resampling and video-scaling libraries from FFmpeg, imported from its upstream 8.1.1 release. With them in place, Wine's resampler, color converter, and video processor are reimplemented on top of FFmpeg's libraries rather than GStreamer.

The bundled Mono engine, which runs .NET applications without Microsoft's runtime, is updated to version 11.2.0. The XSLPattern parser in MSXML has also been reimplemented, which resolves a long-standing syntax-error bug in several Corel installers, including Paint Shop Pro and CorelDRAW Graphics Suite X3 and X4.

Bug fixes

The release closes 27 bugs in total. Among them, Need for Speed Most Wanted no longer registers a continuous "up" input when a gamepad is connected, and Super Hexagon no longer ignores input after a selection is made on the title screen when a gamepad is present. The release also adds fractional-scaling support under Wayland and an option in winecfg for 7.1 surround sound output.

The source is available from WineHQ as wine-11.12.tar.xz^[2], with binary packages to follow from the usual distribution download sites.

Most software gets slower as it gets bigger. It accretes committees, hesitations, and the kind of caution that turns a year of work into a changelog nobody finishes reading. The Godot game engine has spent the last few years doing the opposite. Since the 4.0 rewrite landed in early 2023 it has been on a tear, and the new 4.7 release^[1] keeps the streak going, arriving stuffed with enough features that summarizing them honestly is a losing battle. I will try anyway.

Some of the additions quietly change how a scene looks. 4.7 adds a rectangular area light^[3], a light source shaped like an actual panel instead of an idealized point, which is how soft lighting behaves in the real world. If you have ever tried to fake a window or a softbox with a cluster of fiddly spotlights, this is the feature that deletes that whole workaround.

The one I would point a newcomer at, though, is the Godot Android Build Environment reaching a stable release^[2]. In plain terms, you can now build games on an Android phone or tablet, with the editor running on the device itself. That is a genuinely radical idea: the full toolchain for making a game, running on the cheapest computer most people already own. It is exactly the kind of access that the proprietary engines, with their desktop-class requirements and account logins, never bothered to prioritize.

So what are you waiting for? Go check it out.

The recommendation is an easy one, because the price is zero. If you have ever idly wanted to make a game, the barrier has rarely been lower: download it, follow one of Brackeys' tutorials^[4], and you can have something running by the afternoon. And if it earns a place in your toolkit, the project runs on donations^[5], which is worth keeping in mind.

The quiet story under the patch notes is a simple one: a free, community-built tool that keeps getting better on its own schedule. In a corner of the industry that increasingly rents you your tools, an engine you can download, modify, and keep is worth a look. Especially at this price.

There is a particular kind of science story that should make you slow down rather than speed up: the breakthrough that arrives precisely on a corporate marketing schedule. Microsoft has now done this more than once, announcing that it has built a quantum bit out of a brand-new state of matter. Each time the claim is dressed for maximum reach, and each time independent physicists go to the data and come back saying the same thing. It does not show what the announcement says it shows. At this point the repetition is not a run of bad luck. It is a method, and the thing being reliably manufactured is not a qubit but a headline^[1].

The dream is real, and it deserves a fair hearing. Microsoft is chasing a topological qubit, one that would store information not in a single fragile particle but spread across a state of matter assembled from elusive things called Majorana zero modes. If it worked, the qubit would be shielded from noise at the level of physics itself, which is the single hardest problem in quantum computing. That is a prize worth a decade of effort. It is also a prize that makes everyone, including the people chasing it, very eager to believe they have already arrived.

This is not the first time the arrival has been announced. In 2018 a Microsoft-funded team published a celebrated paper claiming to have seen the telltale signature of these modes. An outside physicist asked for the raw data the paper had left out and found that measurements contradicting the headline had simply been deleted from the graphs. Nature retracted the paper in 2021^[2], and the authors apologized for what an investigation called insufficient scientific rigour^[3]. A second related paper was pulled the next year. The lesson Microsoft drew was reasonable on its face: build a tool to take the fallible humans out of the loop.

The tool that was supposed to fix it

That tool was a piece of software, the Topological Gap Protocol, meant to scan the messy experimental data and return a yes-or-no verdict on whether the new state of matter was present, with no room left for wishful thinking. In February 2025 it underwrote the headline. Microsoft unveiled the Majorana 1 chip and described it, in its marketing, as the first processor powered by a topological core and proof of a new state of matter that had only ever existed in theory^[4]. The peer-reviewed paper underneath was far more modest, and the journal made sure everyone knew it: Nature took the unusual step of attaching a note stating plainly that the results were not evidence for the Majorana modes being claimed.

Physicists noticed the gap between the paper and the press release at once. The device, several pointed out, demonstrated a way to take a reading, not a working qubit anyone could actually control^[5]. Something might be in there, the careful version went, but they cannot steer it, and a thing you cannot steer is not yet a computer.

Then, in 2026, the supposedly incorruptible software was audited. Henry Legg, a theoretical physicist at the University of St Andrews, went through Microsoft's released code and raw data and published a critique in Nature. As AI Weekly reported, what he found was not subtle. The program contained basic coding mistakes, including one that scrambled the data by reordering it the wrong way. More damning, it carried a filter hard-coded to display only the single most favorable patch of a device and hide everything else, which is the automated version of the exact cherry-picking the tool was built to prevent. He also showed the verdict could flip from yes to no depending on an arbitrary choice about where to crop the graph. Loosen the definition of success a little, search a big enough field of noise, and you will always find a shape, the way people find a face in a piece of toast.

Microsoft's response is its own kind of tell. The company did not really dispute that the code did these things. It recast them as minor bugs, and recast the tool itself, sold for years as an objective referee, as merely a practical aid for tuning chips. The head of the quantum effort compared criticizing the software to doubting that airplanes fly because you dislike one dial on the dashboard, and waved at confidential evaluations by a government funding agency as evidence the work was sound. When you are caught hiding data, the honest move is to correct the record. Microsoft instead moved the goalposts and hid behind a classified shield no outsider can inspect. That is not the conduct of a company that wants to be right. It is the conduct of a company that wants to keep the headline.

Right on cue, a bigger announcement

Here is where the pattern closes the loop. Weeks before that critique appeared, Microsoft announced Majorana 2, a next-generation chip promising a thousandfold improvement, a new material discovered with the help of AI, and a headline qubit lifetime of twenty seconds. The twenty seconds is real, but it measures the wrong thing. It is how long the chip holds an ordinary, classical state, not how long it holds the fragile quantum superposition that makes a qubit useful at all. As Legg put it, a classical bit has a lifetime of years, and that does not make it a good qubit. The measurements that would actually demonstrate quantum behavior were left, in the paper's own words, to future work.

Lay the events end to end and this stops looking like science colliding with hype and starts looking like a playbook. A breakthrough is announced with a full marketing apparatus behind it. Outsiders find the evidence was massaged. A quiet correction lands somewhere almost no one will read it. And right on schedule, a larger, shinier announcement arrives to bury the bad news before it can travel. You do not have to prove a single measurement was faked to see the shape of it. The marketing never needed the physics to be real. It only needed the headline to land before the correction did, and it has now done exactly that twice.

That works because there are two audiences and two stories. The hedged, careful version goes into the journal, where the caveats sit in the margins and the editors have to bolt on a disclaimer by hand. The triumphant version goes into the press release, where no caveat survives. Almost everyone meets only the second one, and by the time a physicist publishes the rebuttal, the headline has already done its job on investors, partners, recruits, and the public.

There is something rotten at the core of this

The internal failure it points to is the part that should genuinely alarm people. A campaign like this does not escape a lab by accident. Somebody wrote the words new state of matter over a result the journal had already flagged as no such thing. Somebody approved those words. They passed through communications, through legal, through executive sign-off, and went out as a polished global rollout, and at no step did anyone with the authority to stop it decide that being wrong on purpose was a problem worth raising. A functioning company has a dozen people in that chain who can pull the cord. Microsoft shipped it anyway, and then shipped it again. You do not get there without something being badly wrong in the culture doing the signing off.

And the damage does not stay inside Microsoft. Every time one of the largest companies on Earth launders marketing through Nature, it spends down a kind of public trust that took a century to build and that no quarterly number will replace. People already struggle to know which science to believe, and corporations that treat peer review as a stage prop are a large part of why, degrading a shared resource for a temporary edge. This is also not the only corner where the company's internal compass looks broken. The same instinct, take the expedient path and manage the optics later, runs through its long habit of leaning on outside security researchers while dragging its feet on paying them, the backdrop to our reporting on the Nightmare-Eclipse zero-day streak. Different department, same rot.

None of this means the topological qubit is impossible, and the physics deserves to be said plainly, because it deserves better than the people marketing it. The idea is beautiful, and a real version would earn every superlative. But beauty is not evidence, a roadmap is not a result, and a press release is not a discovery. What would count is boring and specific: a qubit you can control along more than one axis, measured the same way more than once, on more than one device, with no software quietly choosing which data you are allowed to see. Until that exists, the honest way to read a Microsoft quantum headline is as what the pattern says it is. Not a dispatch from the frontier of physics, but an advertisement, and one the company has taught us to distrust the hard way, one buried caveat at a time.

For about ten weeks this spring, the two biggest operating systems on Earth told two very different stories about how computer security actually works. The more frightening story is not the one that made the front pages. On Linux, a run of serious kernel flaws set off the usual alarms across the security and dev-ops world, got dissected in the open, and were patched through upstream channels before anyone could weaponize them. On Windows, a single anonymous person with a grudge took Microsoft's defenses apart in public, one zero-day at a time, and is openly promising worse.

The comparison is not about which codebase is more broken. Both had genuinely dangerous bugs this spring. It is about who found them and what happened next. The Linux flaws were unearthed the hard way, by a sprawling open-source community and a roster of professional security teams reading public code. The Windows flaws were the work of one person, posting under the names Chaotic Eclipse and Nightmare-Eclipse, operating entirely outside coordinated disclosure. For the first few weeks, almost nobody outside security circles noticed.

It took a community to find them

The Linux flaws were not minor, and the security world did not treat them as such. They drew coordinated scrutiny across kernel mailing lists, distribution advisories, and the trade press, the kind of attention open code exists to attract. The bugs sat in load-bearing parts of the system. Two of them, CVE-2026-43284^[1] and CVE-2026-46300^[2], lived deep in the network stack, where a lost shared-fragment marker could let the kernel decrypt an encrypted ESP packet in place, over memory it did not privately own, a classic path to leaking or corrupting data that is supposed to be sealed. A third, CVE-2026-46333^[3], tightened the access-control logic ptrace uses to decide what one process may read out of another. A fourth, CVE-2026-31431^[4], tore a clever in-place operation out of the kernel's crypto layer and reverted to a safer copy.

What reflects well on Linux, rather than badly, is that every one of those bugs was found and fixed in daylight. They were caught by people who read kernel code for a living, reported through normal channels, assigned identifiers, fixed at the source, and folded into distribution updates, each changelog carrying the same plain verdict, that the vulnerability has been resolved. No proof-of-concept was dumped on an unsuspecting public, no working exploit raced a patch to users, and no wave of in-the-wild attacks followed. The noise was the system working as designed: thousands of eyes, many of them paid professionals at large security firms and national response teams, turning flaws into fixes before anyone could weaponize them.

One researcher, one grudge

The other streak began on April 3, when a researcher operating as Chaotic Eclipse posted a fully working Windows privilege-escalation exploit straight to GitHub, with no coordinated disclosure, no CVE, and no patch, alongside a message aimed at Microsoft's Security Response Center: "I was not bluffing Microsoft, and I'm doing it again." The grudge underneath it, by the researcher's own account, was an earlier disclosure attempt that went nowhere.

The exploit, dubbed BlueHammer, is almost poetic in its cruelty: it turns Defender's own machinery into the way in. As Cyderes picked it apart, it is a textbook time-of-check-to-time-of-use race. During an update-and-remediation pass, Defender briefly spins up a Volume Shadow Copy snapshot of the disk. BlueHammer baits a scan, then uses opportunistic locks to freeze Defender at exactly the wrong instant, leaving that snapshot mounted, and with it the SAM, SYSTEM, and SECURITY registry hives that are normally locked tight while Windows is running. From there the exploit reads out the boot key, decrypts the machine's stored secrets, and walks an ordinary user up to NT AUTHORITY\SYSTEM, the highest level of local control. The security product is the side door. Microsoft patched it on April 14 as CVE-2026-33825 and credited two other researchers, Zen Dodd and Yuanpei Xu. Nightmare-Eclipse went unmentioned, and the snub did not cool things down.

Out of the lab, into a breach

Two weeks later the floodgates opened, though you would not have guessed it from the headlines. BlueHammer went into active exploitation in the wild around April 16, as Security Today warned, tracked closely by a handful of vendors and largely overlooked everywhere else. The next day, as Help Net Security reported, the researcher dropped two more Defender flaws: RedSun, another privilege-escalation route, and UnDefend, which lets an ordinary user block Defender from receiving signature updates or switch it off entirely. Investigators soon found all three being used by a real attacker.

From there it stopped being a proof of concept and became an incident. Huntress, with corroborating reporting from Cyber Security News, traced a live intrusion that reached for the Nightmare-Eclipse toolkit after breaking in through a compromised FortiGate SSL VPN, ran hands-on-keyboard reconnaissance, and staged a tunneling binary that Huntress nicknamed BeigeBurrow for follow-on access. The intruder, by the investigators' read, was clumsy and not especially familiar with the tools. That is the quiet horror of a public exploit dump: it hands a near-nation-grade capability to whoever downloads it, skill optional.

By April 22 this had a government deadline attached. CISA added CVE-2026-33825 to its Known Exploited Vulnerabilities catalog, the list that, under a standing federal directive, legally obliges agencies to patch within a fixed window. The federal government runs on Windows, guards those machines with Defender, and encrypts their disks with BitLocker. Every one of those three pillars was about to be a headline.

Then they went for the disk

On May 13, the day after Microsoft's monthly Patch Tuesday, Nightmare-Eclipse went for the disk. They released YellowKey, a BitLocker bypass, and GreenPlasma, another route to SYSTEM. As The Register described it, YellowKey ships as files on a USB drive: plug it in, complete the right key sequence, and you are dropped into an unrestricted shell on a BitLocker-protected machine, without ever cracking the encryption itself.

YellowKey needs physical access, which usually earns a flaw a shrug. Not here. BitLocker is the thing standing between a stolen laptop and the data on it. Rik Ferguson of Forescout told The Register that if the claim holds up, "a stolen laptop stops being a hardware problem and becomes a breach notification." Gavin Knapp of Bridewell called it "a huge security problem for organizations using BitLocker," the kind that turns every lost device in a corporate or government fleet into a potential disclosure event.

Then Nightmare-Eclipse said the part that detonates the room: that YellowKey is not just a bug but a backdoor, allegedly injected by Microsoft itself. The experts who spoke to The Register were clear there is no way to verify that from anything published so far, and it should be treated as exactly what it is, an unproven accusation from a hostile, anonymous source. But it lands in a climate where the bypass is real, the exploitation is real, and the vendor is visibly on the back foot. In that setting, a claim does not have to be true to do damage. It only has to be plausible enough to repeat.

A ransom note, not a disclosure

By late May the fuller picture, pulled together by Barracuda, counted six zero-days in six weeks: BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, and MiniPlasma. The last is a privilege-escalation bug tied to a flaw that was supposedly fixed back in 2020. The posts that came with them read less like disclosures than a hostage note, threatening a mass release of remote code execution flaws, the most dangerous class of bug, and claiming a "dead man's switch" rigged to dump more exploits on its own.

What happened next is best read straight from the researcher's own PGP-signed blog, and it should be taken for exactly what it is: the unverified word of a hostile, anonymous source. By that telling, the loudest threat fizzled. On June 9 he called off the mass drop he had set for July 14 and apologized for the panic it caused, writing that "the big thing is not happening" because a single exploit, RoguePlanet, had drained him. RoguePlanet shipped instead on that day's Patch Tuesday, the timing he says he favors to "create more pressure on Microsoft." He describes it as a race condition that began as a full remote code execution, set off by luring a victim into opening a booby-trapped disk image on a network share, until a mid-May Defender update broke the technique and left even him unsure whether it is still anything more than local privilege escalation. A second BitLocker bypass, GreatXML, followed a day later.

The quieter claim is the more unsettling one. In his telling, the exploits are built to run silently, using a Defender scan flag that suppresses the usual threat pop-up so that when the race succeeds, nothing warns the user at all, a trick he says he first spotted in real-world attack samples. He claims signature-based blocking does not hold, because small changes to the code slip past it, and that the only real mitigation is to wait for Microsoft to patch. Treat the specifics as a boast until a vendor confirms them, but the third-party incident reports already show these tools working in the wild.

Microsoft's public answer has been measured to the point of strangeness. After the first drop, its only comment was that it "supports coordinated vulnerability disclosure," a line about process offered to a person busy tearing the process to shreds. On May 15 it said it "is aware of the purported vulnerabilities and is actively investigating the validity and potential applicability of these claims across our platforms and services." The defensive guidance tells the rest: patch what has a patch, and for YellowKey, set a BitLocker startup PIN and a firmware password. Barracuda is blunt that this only hardens the machine, and that the flaw "may still be exploitable." The advice amounts to accepting that, for now, there is no fix. Read another way, it is the standard playbook for a hostile actor. Engage publicly and you validate their leverage. Starve them of oxygen and you at least stop feeding it. For a while that seemed to work. After the early flurry Microsoft went quiet, leaning on broad, behind-the-scenes mitigations in Defender rather than public statements, and by the researcher's own account the silence helped stall him, alongside a stretch of depression he says pushed him to step away. He even concedes the mitigations cut both ways: some of his bugs died, but the same changes, he claims, left Defender easier to evade in general.

This is where the government angle stops being abstract. The same agencies CISA orders to patch are the ones most exposed to everything else, because they bought the whole stack. Defender is the default guard on those endpoints, and it is the thing being turned inside out. BitLocker is the control that makes a lost government laptop a non-event, and it is the thing being bypassed. When one vendor's software is the ground floor for federal agencies, hospitals, courts, and utilities, a monoculture forms, and a monoculture has a property attackers love. One motivated person, with one grudge, can put all of it on the same clock.

Living in the shadow

Set the two streaks side by side and the asymmetry, not the bug count, is the alarming part. The Linux flaws, for all their technical depth, were the product of a vast public immune system: an open-source community and a long roster of professional research teams, all working to find and fix in the open. The Windows zero-days came from exactly one anonymous person who needed no committee and asked no permission. One side shows how security is supposed to scale. The other shows how little it now takes to put a near-ubiquitous operating system, and the governments and hospitals that run on it, on the back foot.

And the thing that turned a run of bugs into a crisis was never the code. It was the relationship around it. Linux's flaws went to maintainers. Microsoft's went to the public, dropped there by someone the company had, by his own account, already brushed off. Nightmare-Eclipse proved that the disclosure relationship itself can be the vulnerability, and that one is not on any Patch Tuesday list.

For a moment in mid-June it looked like the streak might simply burn out. The researcher announced a break, citing exhaustion and a bout of depression, and signed off with "hope we meet again, friends." It did not last. On June 23 he was back, declaring the break over and teasing a July drop of "really interesting and possibly insanely controversial findings," this time promising only enough code to prove the flaw exists rather than a working exploit. Take that for what it is, a taunt from an anonymous source with every reason to bluff. But the pattern underneath it is the real story. One person, with one grudge and no permission, can keep a trillion-dollar vendor and everyone downstream of it on edge for months, then walk away and walk back whenever he likes. The eclipse did not pass. It just proved it can come and go as it pleases.