Linux

Join Our First Meetup & Call For Speaker!

Cloud Native Community Japan in CNCF community. Open Community Groups, where Open Source communities thrive.

CNCJ AI Infra SIG発足のお知らせ ＆ 第1回 Meetup 開催・スピーカー募集開始！

CNCF community in Open Community Groups, where Open Source communities thrive.

Supply chain reality: “It’s upstream” is not a defense

Open source comes up in the context of underfunded teams that cannot afford premium tooling. Bob agrees the constraint is real, but he pushes back on the industry habit of outsourcing responsibility. Constraints don’t remove accountability when insecure or unmaintained components make their way into customer-facing products. If a defect ships in your product, it’s yours, even if it came from upstream. He also calls out a common failure pattern: vendors using unmaintained dependencies for years,

Outlook and Implications

The impact of this attack by North Korea-nexus actors is broad and has ripple effects as other popular packages rely on axios as a dependency. Notably, UNC1069 isn’t the only threat actor that has launched successful open source supply chain attacks in recent weeks. UNC6780 (also known as TeamPCP) recently poisoned GitHub Actions and PyPI packages associated with projects like Trivy, Checkmarx, and LiteLLM to deploy the SANDCLOCK credential stealer and facilitate follow-on extortion operations.

Skills Scale Infinitely

Right now I have 65+ skills in my system: Blogging — Full website publishing workflowSocialPost — Create X/LinkedIn posts with diagramsNewsletter — Unsupervised Learning writing and publishing Research — Multi-tier web scraping with Fabric patternsOSINT — Open source intelligence gatheringParser — Extract and structure content from URLs Development — Spec-driven feature implementationCreateCLI — Generate TypeScript CLI toolsCloudflare — Deploy workers and pages Telos — Life goals and project tra

What this model suggests for others

This model works because it’s built on partnership: internal shepherds who invest in their people, and open source project maintainers who open the door for them to contribute. The trust between those two sides is what makes the structure hold.For companies, that matters. Open source sustainability requires more than dependency management, sponsorship, or a call for employees to “go contribute.” It requires a practical operating model. Organizations need repeatable ways to connect contributor in

Kubernetes is already the foundation for AI

For more than a decade, the cloud native community has built the infrastructure that runs the modern internet. Kubernetes and the CNCF ecosystem gave organizations a common way to orchestrate complex, distributed applications across heterogeneous environments at global scale. AI workloads are landing on that same foundation because they need the same things: dynamic scheduling, observability, networking, and coordination that holds together when individual components fail. What is still missing

La fuite de données de cookies de l'UE, RefluXFS Linux root, Adobe WhatsApp défaut

TLDR Data23 juil.

Scope: public PoCs and observed Linux host behavior

WordPress Exploitation Underway (CVE-2026-63030), Author: Johannes Ullrich

Outlook and Implications

The impact of this attack by North Korea-nexus actors is broad and has ripple effects as other popular packages rely on axios as a dependency. Notably, UNC1069 isn’t the only threat actor that has launched successful open source supply chain attacks in recent weeks. UNC6780 (also known as TeamPCP) recently poisoned GitHub Actions and PyPI packages associated with projects like Trivy, Checkmarx, and LiteLLM to deploy the SANDCLOCK credential stealer and facilitate follow-on extortion operations.

Skills Scale Infinitely

Right now I have 65+ skills in my system: Blogging — Full website publishing workflowSocialPost — Create X/LinkedIn posts with diagramsNewsletter — Unsupervised Learning writing and publishing Research — Multi-tier web scraping with Fabric patternsOSINT — Open source intelligence gatheringParser — Extract and structure content from URLs Development — Spec-driven feature implementationCreateCLI — Generate TypeScript CLI toolsCloudflare — Deploy workers and pages Telos — Life goals and project tra

Skills Scale Infinitely

Right now I have 65+ skills in my system: Blogging — Full website publishing workflowSocialPost — Create X/LinkedIn posts with diagramsNewsletter — Unsupervised Learning writing and publishing Research — Multi-tier web scraping with Fabric patternsOSINT — Open source intelligence gatheringParser — Extract and structure content from URLs Development — Spec-driven feature implementationCreateCLI — Generate TypeScript CLI toolsCloudflare — Deploy workers and pages Telos — Life goals and project tra

Outlook and Implications

The impact of this attack by North Korea-nexus actors is broad and has ripple effects as other popular packages rely on axios as a dependency. Notably, UNC1069 isn’t the only threat actor that has launched successful open source supply chain attacks in recent weeks. UNC6780 (also known as TeamPCP) recently poisoned GitHub Actions and PyPI packages associated with projects like Trivy, Checkmarx, and LiteLLM to deploy the SANDCLOCK credential stealer and facilitate follow-on extortion operations.

Canonical announces the Enterprise Store as part of Ubuntu Pro

Canonical introduces a new way to manage software behind firewalls and in air-gapped environments with the Enterprise Store. The Enterprise Store makes software distribution manageable and scalable behind firewalls or in air-gapped environments. Available with an Ubuntu Pro subscription, the Ente...

ubuntu.com21 juil.

Le problème d'AI Chine Open Source vient d'être pire

Michael Spencer and Michael Fritzell from AI Supremacy21 juil.

Outlook and Implications

The impact of this attack by North Korea-nexus actors is broad and has ripple effects as other popular packages rely on axios as a dependency. Notably, UNC1069 isn’t the only threat actor that has launched successful open source supply chain attacks in recent weeks. UNC6780 (also known as TeamPCP) recently poisoned GitHub Actions and PyPI packages associated with projects like Trivy, Checkmarx, and LiteLLM to deploy the SANDCLOCK credential stealer and facilitate follow-on extortion operations.

Skills Scale Infinitely

Right now I have 65+ skills in my system: Blogging — Full website publishing workflowSocialPost — Create X/LinkedIn posts with diagramsNewsletter — Unsupervised Learning writing and publishing Research — Multi-tier web scraping with Fabric patternsOSINT — Open source intelligence gatheringParser — Extract and structure content from URLs Development — Spec-driven feature implementationCreateCLI — Generate TypeScript CLI toolsCloudflare — Deploy workers and pages Telos — Life goals and project tra

The people behind the number

While $100 million is a meaningful number, the real measure of impact is what it’s made possible for real people. GitHub Sponsors changed how I think about open source. It gave me a direct, sustainable way to fund the time it takes to build and maintain projects, instead of treating it like side work. That has let me invest more consistently in the projects and build with a much longer-term view. Thanks to GitHub Sponsors, I am able to give back to our community, build a business, and actually m

What we’ve learned

Building GitHub Sponsors over the past seven years has taught us a few things: Organizations move the needle. In 2022, nearly 40% of sponsorship funding came from organizations, with each organization-funded sponsorship worth an average of nearly 15x more than the average individual sponsorship. As more companies recognize their dependence on open source, this share continues to grow. Reducing friction matters. Every time we’ve made it easier to sponsor (e.g. adding invoice payments, expanding r

What’s next

This milestone proves that when the community shows up for open source, the impact is real. But the work isn’t done. The open source funding gap is still enormous, many critical projects remain underfunded, and maintainer burnout continues to be one of the biggest risks to the software supply chain. This $100 million is proof that the community can change how open source is sustained, one sponsorship at a time. The best way to keep this momentum going? Start sponsoring the projects you depend on

How you can get involved

Find new open source contributors to support.

GenAI adoption

Your friendly neighbourhood Open Source Coding Agent - Akash-nath29/Coderrr

Une vague de protocoles en puissance pour le commerce agentique

Avec UCP (Universal Commerce Protocol) et ACEP (Agentic Commerce Protocol), OpenAI ont ouvert la voie à des protocoles communs. Open source et décentralisé, UCP a fait ses débuts officiels en janvier. Développé au sein d’une coalition d’acteurs de la tech, du commerce en ligne et des systèmes de paiement (Carrefour, Shopify, Stripe, Visa, Walmart…), il repose principalement sur la déclaration de capacités au sein d’un fichier hébergé dans le dossier well-known. Également open source, ACP a fait

Outlook and Implications

The impact of this attack by North Korea-nexus actors is broad and has ripple effects as other popular packages rely on axios as a dependency. Notably, UNC1069 isn’t the only threat actor that has launched successful open source supply chain attacks in recent weeks. UNC6780 (also known as TeamPCP) recently poisoned GitHub Actions and PyPI packages associated with projects like Trivy, Checkmarx, and LiteLLM to deploy the SANDCLOCK credential stealer and facilitate follow-on extortion operations.