Clozure CL 1.14 adds native 64-bit ARM support for Apple silicon Macs and ARM Linux, alongside fixes for multithreaded programs on 32-bit ARM and a monotonic clock for internal real-time measurements. The release also changes heap-image and FASL formats, so users must use the 1.14 bootstrapping binaries and recompile existing FASL files; the Clozure CL project credits contributors including Mauro DiBenedetto and Nikolai Matiushev for the ARM port.
The Pharo team has released Pharo 14, with updates to its development tools, refactoring and command infrastructure, and virtual machine. New features include Mission Control and Pulse, a command-line debugger, RISC-V JIT support, and memory-management improvements; the project says 978 pull requests were merged and 616 issues closed since Pharo 13.
Nicolas Mattia explains how to create a non-extractable SSH identity in a Mac’s Secure Enclave and use Touch ID to authenticate, including for GitHub. His guide uses Apple’s `sc_auth` utility and SSH’s `ssh-keychain.dylib`, and describes the identity’s limits: it is tied to the Mac and must be recreated if the computer is lost or dies.
Jan de Jager built a browser-based emulator of an Intel 80486DX2-66 PC, including its motherboard and ISA/VLB cards, entirely in ES6 JavaScript. It runs SeaBIOS, FreeDOS 1.3 and classic games such as DOOM, with a control panel for configuring hardware.
Linux developer Qingfang Deng has proposed removing the kernel’s BSD-Compress support for PPP, citing decades-old, orphaned code and a decoder bug that can cause a fatal error on 64-bit systems. The patch is under review on the netdev mailing list; PPP links can continue without compression if the error occurs.
Security researcher Dennis Jackson says Apple’s macOS developer tools, including git, curl and Python, still trust compromised eMudhra certificates despite Apple being notified on October 17. He says macOS 27.2, released October 26, also reversed a manual workaround, potentially allowing attackers to intercept HTTPS traffic; he urges Apple to remove the affected roots and advises developers to reapply the workaround after updates.
Hacker CharlesD repurposed a 1990s TRANZ 330 credit-card reader, which uses a Z80 processor, into an offline solar-system guide for telescope users. He replaced its UV-erasable ROM code, connected a GPS module and thermal printer, and programmed it to calculate planets’ azimuth and elevation; he also shared the source code.
Daniel Lemire and Microsoft’s Francisco Geiman Thiesen describe a C++23 library that builds perfect hash maps at compile time for fixed sets of strings. In tests on an Apple M3 Max, lookups took about 1.2–2 nanoseconds, up to 13 times faster than `std::unordered_map`; on an M4, the authors report more than one billion lookups per second for URL protocols.
At the Vintage Computing Festival Berlin, Michael Engel traced several computing technologies to Andy Bechtolsheim’s Stanford University Network project in the late 1970s. Bechtolsheim’s 68000-based workstation CPU board was later used in early Silicon Graphics workstations, Imagen laser printers, AppleTalk-to-Ethernet bridges and a router whose software fed into Cisco’s first product.
The article argues that customizable HTML selects let options show decision-making details such as font previews, local times, delivery comparisons, job titles, or warnings, while preserving standard form values and keyboard behavior. It explains how to use the feature as a progressive enhancement, with native pickers retained on touch devices if desired; the piece cites Chrome’s announcement and MDN’s guide.
KDE developer Méven Car says four merged KIO changes will fix a 15-year-old bug that made copies to USB drives appear complete while data was still in memory, and made network-share progress run ahead of writes. Due in KDE Frameworks 6.32 on November 13, 2026, the changes add adaptive writeback windows and final flushes; KIO will also keep source files during moves until the destination flush succeeds.
Anthropic says an unreleased internal Claude model found and built exploit chains for critical flaws in Chrome, Safari, Android, Windows, and Linux, including one-click browser attacks and zero-click Linux kernel code execution. The company reports that vendors patched the findings, including 62 Chrome vulnerabilities, and says its testing used parallel scanning agents and plans to release a Claude Code security plugin.
Ghostty 1.4.0, released by the Ghostty maintainers after seven months of work by 172 contributors, adds full support for the Kitty graphics specification, including animation, and compresses scrollback to reduce physical memory use by 70%–90% for typical text. The release also reports faster terminal processing and lower memory use, improves SSH integration, and adds a new GTK rendering pipeline; it fixes multiple security vulnerabilities, including issues that could allow malicious terminal output to crash the app or access files.
At the Vintage Computer Festival Berlin, Dmitriy Kostiuk gave a lecture tracing pointing devices from a 1950s trackball built for a Canadian warship to mice becoming common in the 1990s. The talk covers Douglas Engelbart’s prototype, Telefunken’s 1966 design, Mouse Systems’ spotted-pad mice, and early Apple and Microsoft models.
Sebastian Molano developed TAKTO, an open-source VR/AR hand-tracking glove that uses magnetic encoders to track finger positions and actuators to provide force feedback. The project includes build documentation and a live digital-twin interface; a sensing-only version is available, while the actuated model costs more because of its high-quality motors.
Daniel J. Bernstein reports testing Fil-C, a memory-safe C/C++ toolchain, on Debian: it compiled 60 of 61 targets in a 101-minute run, and several additional programs and libraries appeared to work with tweaks. He also outlines building Debian packages for a separate Fil-C ABI, amd64fil0, and successfully built and installed a test package, tinycdb, whose runtime protection caught an invalid memory access.
James F. Mackenzie argues that original DOS games can look better in software-rendered mode, with crisp textures and the gritty palette effects he prefers over early 3D-card smoothing. Modern CPUs can run these renderers at resolutions that were impractical in the 1990s—his Dell OptiPlex 380 runs Quake at 800×600 and 60 fps—though demanding games such as Shadow Warrior can still tax fast hardware. He favors playing the original DOS versions on real hardware, noting that sound support remains a challenge.
Steve Shoecraft has released MeshXFS, an open-source clustered file system built by adapting upstream XFS so multiple machines can access the same storage concurrently. He says Claude Opus wrote the changes and supporting tools, adding distributed locking, cache coherency, fencing and crash recovery; each release is tested on real multi-node clusters.
Slughorn is a GPU-accelerated vector-graphics library that builds layered shapes, gradients and cutouts on a canvas. Its Python example packs the resulting curves and bands into an atlas, producing textures ready to upload to the GPU.
PortSwigger researcher Gareth Heyes reports bypassing six of eight tested SVG sanitizers, including methods using XML namespaces, SVG animation, XSLT and Safari’s handling of GIF files to trigger JavaScript. He also demonstrates that Firefox can execute JavaScript from an XSLT stylesheet supplied in a response `Link` header, despite a harmless XML response body; DOMPurify and darylldoyle/svg-sanitizer resisted the tested techniques.
The author of jacq.cc describes hosting a static Astro/Starlight blog on a Raspberry Pi 5 running Home Assistant OS, with Nginx Proxy Manager serving files and Cloudflare caching them. A one-command publishing script builds and privacy-checks the site, swaps files into place, purges and warms Cloudflare’s cache, and reports traffic through Cloudflare analytics without tracking scripts or cookies.
Simon Willison evaluates Jeff Lindsay’s Go-based webframe, a tool that runs a URL or file in a hidden system web view and sends JavaScript console output and errors to the command line. He says he had Claude Opus 5.5 test it as a possible sandbox and web-scraping tool, comparing its use with his shot-scraper JavaScript workflow.
Stalwart maintainer Mauro D. announced version 1.0 of the Rust-based mail and collaboration server, after five years of development. The release includes a redesigned search engine, document-attachment search and a finalized database schema requiring a one-time migration; in the project’s Azure tests, Stalwart beat Postfix and Dovecot in 35 of 38 comparisons, including 5,445 incoming messages per second versus Postfix’s 723.
Researchers at security firm Neodyme found that SwitchBot smart locks used AES-CTR without integrity protection, letting an attacker transform an encrypted “lock” command into an “unlock” command over Bluetooth. They say an early firmware fix was bypassable because the app still used the old protocol; SwitchBot later released updates that Neodyme confirmed block the described attack, with fixes listed for the locks, keypads and app.
Rod Burlamaqui’s arc-rebar project configures Resizable BAR before the graphics driver loads, allowing supported Intel GPUs to use older motherboards that lack the feature. In a test with an Arc B580 on a 2015-era Xeon motherboard, bandwidth rose from 15 GB/s to 392 GB/s; the fix requires Debian or Ubuntu.
RC helicopter builder [worked in theory] is developing a swashplate-less rotor using angled hinges, with motor-speed changes shifting blade pitch through inertia. After testing two hinge layouts, he chose a single-hinge design for its responsiveness and more linear control; weighted, thermoformed 3D-printed blades also helped damp vibrations.
Iroh’s developers have released version 1.0 after four years of work, settling on a stable API and wire format for a Rust library that provides authenticated, encrypted connections dialed by endpoint public key. The team traces its shift from an IPFS-compatible project to a narrower QUIC-based networking library, including its adoption of hole punching, address lookup and a fork of Quinn called noq to support multipath.
Ladybird’s September 2026 update reports a security review by Trail of Bits, supported by OpenAI, that found issues and led to tighter process isolation and sandboxing. The browser also added macOS hardware video decoding, automatic content-blocking filter lists, forced dark mode, image pasting and crash reporting, while the team reported lower idle CPU and memory use and gains in web-test scores.
Cezar Chirila built an infrared camera that connects a FLIR sensor to an RP2040 and uses WebUSB to communicate with a browser, avoiding the need for a companion app. The project is available on GitHub and works through a browser that supports WebUSB.
Peter C. has released coopiano, an open-source C++17 piano synthesizer that models hammers, strings, a soundboard and sympathetic resonance rather than using samples. It renders notes and MIDI files to stereo WAV on supported platforms and offers live MIDI/audio on macOS; the MIT-licensed release does not include the developer’s prototype AU or VST plugins.
