Design and Display

Chip, Performance, and Connectivity

Rear Camera

Front Camera

Battery and Charging

Storage and Pricing

Which to Choose?

• Single-core CPU score: 3,774


• Multi-core CPU score: 52,516

• Single-core CPU score: 2,920


• Multi-core CPU score: 39,059

• M5 Ultra: 52,516


• M3 Ultra: 39,059


• M5 Max: 35,119


• M5 Pro: 33,593


• M4 Max: 29,047


• M2 Ultra: 28,789


• M4 Pro: 24,894


• M3 Max: 24,649


• M1 Ultra: 23,328


• M6: 22,783


• M5: 17,948


• M2 Max: 17,387


• M3 Pro: 16,880


• M2 Pro: 16,725


• M4: 15,477


• M1 Max: 14,299


• M1 Pro: 13,914


• M3: 11,650


• M2: 9,809


• M1: 8,582

• OWC 11-Port Thunderbolt Dock - $179.99, down from $229.99


• OWC 11-Port Thunderbolt 5 Dock - $229.99, down from $319.99


• OWC Express 1M2 80G Enclosure - $114.99, down from $149.99


• OWC Express 4M2 Ultra Enclosure - $244.99, down from $449.99


• OWC ThunderBay 4 Enclosure - $309.99, down from $399.99


• OWC Thunderbolt 5 USB-C Cable, 1.0M - $19.99, down from $34.99


• OWC Thunderbolt 4 USB-C Cable, 2.0M - $39.99, down from $57.99

• Single-core CPU score: 4,071


• Multi-core CPU score: 22,783

• Single-core CPU score: 3,641


• Multi-core CPU score: 17,948

• M5 Ultra: 52,516


• M3 Ultra: 39,059


• M5 Max: 35,119


• M5 Pro: 33,593


• M4 Max: 29,047


• M2 Ultra: 28,789


• M4 Pro: 24,894


• M3 Max: 24,649


• M1 Ultra: 23,328


• M6: 22,783


• M5: 17,948


• M2 Max: 17,387


• M3 Pro: 16,880


• M2 Pro: 16,725


• M4: 15,477


• M1 Max: 14,299


• M1 Pro: 13,914


• M3: 11,650


• M2: 9,809


• M1: 8,582

• Open the Settings app on your iPhone.


• Tap on the Siri menu.


• Tap on Try Siri AI (Beta).


• Follow the prompts.

• iPhone 18 Pro


• iPhone 18 Pro Max


• iPhone Duo


• iPhone 17e


• iPhone 17


• iPhone 17 Pro


• iPhone 17 Pro Max


• iPhone Air


• iPhone 16e


• iPhone 16


• iPhone 16 Plus


• iPhone 16 Pro


• iPhone 16 Pro Max


• iPhone 15 Pro


• iPhone 15 Pro Max

• iPhone 18 Pro


• iPhone 18 Pro Max


• iPhone Duo


• iPhone 17 Pro


• iPhone 17 Pro Max


• iPhone Air

Apple Watch Series 12

Apple Watch Ultra 4

• iPhone 17 Pro Max: $885


• iPhone 17 Pro: $785


• iPhone Air: $585


• iPhone 17: $585

• iPhone 16 Pro Max: $720 to $610


• iPhone 16 Pro: $630 to $510


• iPhone 16 Plus: $485 to $430


• iPhone 16: $480 to $430


• iPhone 16e: $310 to $270


• iPhone 15 Pro Max: $530 to $455


• iPhone 15 Pro: $420 to $370


• iPhone 15 Plus: $340 to $315


• iPhone 15: $335 to $305


• iPhone 14 Pro Max: $405 to $360


• iPhone 14 Pro: $335 to $285


• iPhone 14 Plus: $235 to $210


• iPhone 14: $235 to $195


• iPhone SE (3rd generation): $85 to $75


• iPhone 13 Pro Max: $340 to $320


• iPhone 13 Pro: $285 to $255


• iPhone 13: $205 to $175


• iPhone 13 mini: $155 to $145


• iPhone 12 Pro Max: $240 to $210


• iPhone 12 Pro: $195 to $165


• iPhone 12: $135 to $120


• iPhone 12 mini: $90 to $80


• iPhone SE (2nd generation): $45 to $40


• iPhone 11 Pro Max: $160 to $140


• iPhone 11 Pro: $145 to $125


• iPhone 11: $110 to $100


• iPhone XS Max: $95 to $85


• iPhone XS: $70 to $60


• iPhone XR: $90 to $75


• iPhone X: $60 to $50


• iPhone 8 Plus: $40 to $35

• Apple Watch Ultra 2: $305 to $265


• Apple Watch Ultra: $205 to $190


• Apple Watch Series 10: $165 to $150


• Apple Watch Series 9: $135 to $115


• Apple Watch Series 8: $95 to $90


• Apple Watch Series 7: $70 to $65


• Apple Watch Series 6: $45 to $40

• iPad Pro: $720 to $905


• iPad Air: $490 to $510


• iPad mini: $300 to $320


• iPad: $260 to $280

• MacBook Pro: $855 to $1,315


• MacBook Air: $580 to $705


• Mac mini: $480 to $620


• Mac Studio: $1,305 to $1,460


• iMac Pro: $315 to $340


• iMac: $380 to $385

• Google Pixel 9 Pro XL: $315 to $290


• Google Pixel 9 Pro: $305 to $275


• Google Pixel 9: $210 to $200


• Google Pixel 8 Pro: $155 to $150


• Samsung Galaxy S22+ 5G: $85 to $80


• Samsung Galaxy S22 5G: $85 to $80


• Samsung Galaxy S21+ 5G: $75 to $70


• Google Pixel 7: $60 to $65

I’ve long been interested in hardware key material storage devices. I’ve been a fan of yubikeys (I still remember when my fancy new NEO-N showed up), PIV (and its associated smattering of additional fields), SaaS HSMs, the kernel keyring, some tooling I’ve fairly satisfied with the design of at prior companies, and of course, our dear friend, the TPM. All that is not even to mention the scores of exotic hardware security modules one generally comes across from time to time when you’re keeping a sharp eye out that you wind up playing with.

The concept of storing private key material on a disk, or even having it in RAM has always skeeved me out, so I have a natural inclination to hardware modules, and how shifting keying material around can change your risks and threat model(s) in interesting ways.

I don’t remember when I first came across the MIFARE DESFire EV3, but a few weeks ago I did a deep-dive into the state of the art of authentication schemes using ID cards. My complete overview of what tradeoffs exist is pretty extensive (and likely not interesting to the vast majority of the world), but the tl;dr wound up being one of “use PIV” or “use MIFARE DESFire EV3”. I wound up picking DESFire for a recent project, and figured it’s worth talking a bit about what I learned, share some thoughts, and some code. That code is published on crates.io/desox, and docs, as is our custom, may be found at docs.rs/desox

DESFire supports DES (I’m sure most readers saw that one coming), 3DES (I didn’t bother playing with 3DES at all) or AES-128 (AFAICT always use this?) keying material. It’s worth noting that the DESFire only supports symmetric keys and is not designed for public key cryptography, and operates exclusively using shared symmetric key material. The DESFire EV series use those keys and related authentication schemes to interact with “files” stored on the on-chip EEPROM (2k, 4k, 8k, and 16k versions exist), or “applications” (groups of files and authentication keys).

Talking to a DESFire EV3

Interactions with the card are done over NFC (ISO/IEC 14443 Type A), and commands to/from the card may be in the usual ISO/IEC 7816-4 APDU format, or “unencapsulated” bytes sent to/from the card are sent using a fixed instruction set and return code structure – saving a few bytes per message. I’ve opted to use their undocumented and proprietary format – I found it easier to work with and with a maximum message of 60 bytes, the savings matter a lot.

While powered via NFC, the card maintains a small amount of state about the connection between the reader and the card in its RAM, including if the session is authenticated or unauthenticated. I’ll dig into how authentication happens later, but it’s worth knowing that sessions can become authenticated using one of the symmetric keys shared by the card and the reader. The vast majority of the DESFire commands I know about tend to work while either authenticated or unauthenticated, with a few exceptions (GetUid, ChangeKey, and ChangeKeySettings for example).

In general, I found working with this card particularly pleasant. There is a fair amount of backwards-compatible behavior and multiple methods of communication that confuse things a bit, but overall, it was better than average to integrate with. Kudos to the NXP team. If the docs on this chip were public, things would be orders of magnitude easier – it’s not entirely clear to my why they’re keeping so much of the interface documentation under NDA, but it’s the largest knock against the chip, by far.

Authentication

I found a lot of really great resources outlining how the handshake and protocol works for a DESFire EV3, especially from Ridrix, some public datasheets ThrRealRevK and posts from AndroidCrypto.

The gist here is that, because the DESFire only does symmetric key operations, the key exchange (a type of SKA – Symmetric Key Agreement) uses symmetric keys to establish a unique session key which is used to sign or encrypt data exchanged between the reader and the card. I’m not going to get too in-depth here, since there’s a ton of other resources out there to dig into – but I will do a quick high-level description to keep this post mostly self-contained.

The authentication protocol serves two main functions – to verify that both parties know the same shared secret, as well as to act as a SKA to construct a new session shared secret key. Here’s a quick overview of how a shared session key is derived between the reader and the card using our symmetric keys (AES-128 in the case below).

1. the reader requests to start authentication with the card (something like AA 00 to start an AES Authentication handshake with keyslot 0x00).
2. The card will then reply with AF (a status code that indicates more data is to follow), followed by 16 bytes (in the case of AES-128) of encrypted (using CBC) data.
3. The hosts then decrypts this block with the symmetric key from keyslot 0, returning the card’s session nonce.
4. The host generates 16 bytes (usually random) for its session nonce.
5. The host sends an instruction of AF (indicating a continuation of the previous command), followed by 32 bytes of encrypted data. When decrypted, the first 16 bytes are our nonce generated in step #4, followed by the 16 bytes provided by the card, decrypted in step #3, except where every byte is shifted to the left by one place (the 0th byte is copied to the end).
6. The card will reply with 00 indicating a successful operation, followed by 16 bytes, which when decrypted, is our session nonce from step #4, shifted to the left by one byte in the same way that we did in step #5 with the card’s nonce.
7. At this point, both the reader and card have confirmed the other party has the same symmetric secret key. The session is now “authenticated” and a “session key” is derived using the two nonce blocks. Two hashing keys (K1 and K2) are derived from this key, which is used to maintain an ongoing CMAC hash of the messages coming and going to/from the card.

From here on out, the session is “authenticated”, and responses from the card which were previously “plain” will now contain a 8-byte CMAC signature, which can be used to ensure that the replies in question come from the active session.

In my implementation of the handshake I opted to encode the handshake state into rust types, just so I wouldn’t make any mistakes. The Handshake type contains the session internals (session nonce values, keying state, to include IV, etc). This means the authentication flow (from within my code) uses the Handshake struct to generate the commands to send to the card in order:

/// Create a new `Handshake`, and return the
/// start auth command (something like `AA 00`)
fn Handshake::<Initial>::begin(
 output: &mut [u8],
 key: [u8; 16],
 key_id: u8,
) -> (Self, &[u8]);

After we get a reply back from the card (the encrypted version of the card’s session nonce, sometimes called Rnd_B in code I’ve seen), we transition states from Initial into HalfOpen.

/// Given the card's encrypted response, generate
/// our session nonce and generate a reply
/// (something that starts with `AF` followed by
/// 32 bytes of encrypted data).
fn Handshake::<Initial>::rnd_b(
 self,
 output: &mut [u8],
 input: &[u8]
) -> (Handshake::<HalfOpen>, &[u8]);

Now that we’re “HalfOpen”, we’re waiting to hear back from the card to ensure that it, too, can byte-shift our provided nonce. Once we have the card’s reply, we can check it using our complete helper, transitioning from HalfOpen to Successful.

/// Check to ensure that the card replied with
/// our nonce byte-shifted by one place, indicating
/// that they know the symmetric secret in
/// this key slot.
fn Handshake::<HalfOpen>::complete(
 self,
 input: &[u8]
) -> Handshake::<Successful>;

Once the Handshake is successful, the only thing left to do is consume the Handshake struct and turn it into the shared session key by running it through the key derivation function.

/// Consume the `Handshake` struct and return the
/// new shared session secret key.
fn Handshake::<Successful>::into_key(self) -> [u8; 16];

From here on out we can use this session key for the remainder of our interactions with the card – signing messages from (and sometimes to!) the card, or encrypted messages to and from the card. This key is used in CBC block mode, where the session IV is updated with the last block of the encrypted data.

Unit Testing

A nice proprietary of the SKA scheme we’re using as part of DESFire is that the derived session key is actually deterministic if you control your nonce RNG (ok, actually, pretty true for most key agreements, but anyway), which means it is possible to capture traffic over the NFC interface, and “replay” the NFC I/O with cooked RNGs and ensure byte-identical messages and keys are generated. Within desox-rs this is called replay (I’m creative), and I’ve got a few replay sessions checked into VCS, which exercise a signficant amount fo the API surface. All were derived from an actual session with a real DESFire card, and can be updated with a live card and a --cfg flag.

Each replay file is a set of lines (request-response transactions), each containing two space-delimited hex encoded NFC messages. For instance, here’s an authentication handshake in replay format:

1a00 afc7bbd82ff8fefae8
afc6dab54df2278d2952d560821be7e4c3 007d9abe94a9b14748

The code that generated that exchange came from the test stored adjacent to that file – a handshake with the default DES key (all zeros), and an RndA value hardcoded to 32c28fdafd3960de.

let mut card = card
 .authenticate_with_rnd_a(
 0x00,
 Key::Des([0; 8]),
 Key::Des(hex_literal::hex!("32 c2 8f da fd 39 60 de")),
 )
 .await
 .unwrap();

Since the card’s RndB is similarly unchanging (I’m replaying this file every time), this will always derive the same session key, which means messages (including encrypted ones or CMAC signed responses) will be identical, as well. If you’re playing with the DESFire yourself, feel free to grab my replay files if you need a “known good” baseline.

By default this will run using the MockBackend, replaying each file – expecting a byte-identical request, and responding with the harcoded customary reply. If the code (or test!) needs to change, updating the tests is done by swapping the MockBackend out for a real one. Since I had to do this a bunch during development, running cargo test with RUSTFLAGS="--cfg desox_replay_rw" will, on run, overwrite the replay file(s) for the executed test(s), ensuring all line-protocol changes are explicitly caught and reviewed.

Observations

Most commands, even ones which require authentication, are transmitted without CMAC signature(s) or encryption. CMAC signatures from the reader to the card are not really used (except for writes to a file which specifies communication must be CMAC signed), ditto for encryption (although that one is used for key change operations, in addition to file writes on files that specify encrypted communication must be used). The vast majority of commands take a “plain” request from the reader, and return a CMAC signed response.

By my eye, this means that a malicious reader, or something otherwise capable of holding the card online after communication with an authentic reader is complete are able to execute privilaged commands (since one can simply ignore the CMAC signatures on responses), so long as the command doesn’t require the reader to provide CMAC signatures (or encryption), or allow the card to power down.

Fun with DESFire

I’ve played around a bit with ways to use the DESFire cards in interesting configurations, given what they’re capable of. Here’s some half-baked thoughts I had while mucking around with the cards – these are all poorly thought out sketches of some things we can do given the specific tradeoffs I see with the DESFire card. It’s also worth noting that I don’t have any of the actual documentation, and am not a cryptographic grown-up, so take these sketches with a massive grain of salt.

The first thing that came to mind when implementing this is how the authentication scheme can shift the boundary of what is and is not trusted (assuming good secure keying, and provided the key slots and card/application permissions are configured correctly). Rather than push the key material out to the machine connected to the NFC reader (“reader machine”), I instead tried turning the NFC reader and computer into something psuedo-untrusted by “merely” having it pass messages from the card to a trusted remote system (“remote machine”). This means that the “reader machine” is exchanging NFC data with the card, but that data is being decrypted, encrypted and processed by the trusted “remote machine” – the reader is unable to derive the session key.

For each of these, I wind up needing to authenticate – so there’s still a few latent risks, but these can mostly be mitigated by asking for a readbacks of any changed file(s), setting key permissions carefully, and requesting the card’s UID via the encrypted channel – all of which would require the symmetric secrets (which undermine the whole security model if comprimised).

This general construction is also subject to a hostile takeover of the untrusted “reader machine”, since most commands (including destructive ones!) are sent in “PLAIN” mode – the reader machine can wait until authentication is complete and then inject commands into the card and “simply” ignore the CMAC signatures on responses, severing ties with the remote machine. As such, we also need to take steps to ensure that the key being used is not one that allows any access beyond what is allowed. Here were some ideas I sketched out off the back of this theory.

The “second-factor”

Given some established (and authenticated) connection, part of the initial authentication flow may use the DESFire card to prove physical control over it as part of a handshake. This can serve as a second factor during some authentication flow, requiring physical card presence at a reader to fully initialize a connection. This does have one glaring downside, however – it’s phishable. To use this “for real”, we’d need to take some steps to prevent obvious MITM flows (XOR the NFC messages with the URI as seen by the client?), but maybe there’s something interesting there.

This also has a second interesting attribute – when used as part of a physical system authentication flow, this becomes a logical place to inject access control, being able to determine if some person is permitted to operate some device at that particular time (Is “Joe” current on his Laser Cutter certifications?) I think of the ideas I landed on, while conceptually interesting (using an employee id card as a 2FA token, it’s very fast), this one is the least likely to turn into something real.

The “encrypted-cookie”

This construction, when paired with an encrypted DESFire file, allows the “remote machine” to read/write an ’encrypted cookie’ to the card – storing small amount of encrypted data that the “remote machine” can read/write, but not the “reader machine”, since this uses an encrypted and authenticated channel from the “remote machine” directly to the DESFire card, without any intermediate hosts needing to be fully trusted. I keep calling this the “encrypted cookie” in my head because it feels conceptually similar to how Ruby on Rails and Laravel handles cookies.

We’d need to take a few extra steps here (for instance, ensure that you read the cookie back over the encrypted channel after writing to prevent a malicious reader from dropping writes) to secure the system, but it feels like the structure of this is definitely decent.

The “takeover”

This time, let’s say the computer attached to the NFC reader (“reader machine”) is semi-trusted. For this scheme, our trusted “remote machine” and the “reader machine” pass messages over the network to handle authentication to the card (as above), where the handshake data is being decrypted, encrypted and processed by the trusted “remote machine” as usual. However, once the authentication handshake is complete and a session key has been derived, the “remote system” return the session key to the “reader machine”, giving it a one-time-use key and authenticated session to the card.

We need to be careful about global/application permissions and key access control to files – but in this construction, we can allow the “reader machine” to take over privileged actions using a scope-limited DESFire key without handing over the card’s true keying material (preventing cloning of the card). This can be helpful to ensure messages to/from the card are truely from the card (verifying CMAC signatures), enables the “reader machine” to directly read/write to/from encrypted file(s), but allows the symmetric key material to remain in as few places as possible – which is critical given compromising that secret will undermine the security of the entire system.

1. Navigate to Settings and privacy by tapping your profile picture in the top-left corner.


2. Select Content and display.


3. Switch off the toggle next to Include kids and family music in taste profile.

"We're excited to bring Apple TV and Apple Arcade to iCloud+ users in over 100 countries in one convenient subscription," said Eddy Cue, Apple's senior vice president of Services and Health. "iCloud+ users can now securely store and share personal content across their devices, enjoy the absolute best in original storytelling from Apple TV, and explore an incredible lineup of hundreds of games through Apple Arcade."

Heads up, Debian IKE/IPsec users.

Starting with strongSwan 6.1.0-1 (currently in Debian unstable and targeted at Debian 14 Forky), the IKEv1 protocol has been disabled. This is aligned with upstream decision. Considering IKEv2 is already nearly old enough to drink in the USA (RFC 4306 will turn 21 next December) and IKEv1 has weaknesses, the disabling is long overdue amd will permit upstream to remove some code in the upcoming years.

At this point there is no good reason not to migrate to IKEv2 and exposing IKEv1 code in all Debian installation is no longer relevant. All IKEv1 users using Debian 13 Trixie (either site to site, gateway or roadwarrior client) should investigate IKEv2 protocol (or other options).

Note that some plugins have also been disabled upstream for security/maintenance reasons and we followed suite in Debian. The Debian relevant ones are: af-alg, led, padlock.

Debian Contributions: 2026-08

Contributing to Debian is part of Freexian’s mission. This article covers the latest achievements of Freexian and their collaborators. All of this is made possible by organizations subscribing to our Long Term Support contracts and consulting services.

Replacing lxc with Incus for Debian CI, by Antonio Terceiro

At the beginning of this month, the default backend for tests was changed to incus-lxc, leaving only a few dozen packages explicitly configured to run as lxc. Those packages got bug reports filed and once those bugs are fixed they will be migrated over to incus-lxc. This marks an important milestone for Debian CI, as the low level of isolation between the worker host OS and the OS under test when using lxc was a significant source of instability in our platform. Common causes for test failures when comparing runs under plain lxc with runs with incus-lxc are documented in the wiki page linked from the bug reports.

security-tracker git performance, by Helmut Grohne

Developers working with Debian’s security-tracker have reported degrading performance for a while. The options for solving this are few with repository sizes now reaching 30GB for a repository whose working tree is a mere 60MB. While there have been a number of proposals for changing the storage layout, Helmut evaluated options not requiring such changes. Much of the problem hinges on the 50MB data/CVE/list file that is updated in most commits. Efficiency hinges on representing its content in git packs.

Practically, git frequently fails to represent its content as a delta and stores a full copy that is typically compressed to 12MB. Add a few thousand 12MB full blobs and you quickly have a large repository. In particular, the copy at salsa.debian.org stores many such full blobs, so pulling from it consumes significant bandwidth.

One might think that running git gc helps, but its utility is limited here. When git stores objects in packs, it stores the history in reverse. It starts with the current version and represents older objects as differences (deltas) to more recent objects. A delta effectively is a sequence of copying ranges from a base object and insertion of new content. Given that humans tend to add content over time, those additions are often represented as deletions. The crux here is finding that base object. Given that the data/CVE/list file is large, finding it involves comparing quite a few versions of it with each other. This requires both a significant amount of RAM and CPU time. How many objects git considers for this comparison is controlled with the --window option. It is beneficial if the base object does not come from a direct child commit but skips over commits. In doing so, long chains of deltas are avoided. The --depth option controls the maximum chain length.

In this search, git combines all objects into a single window to facilitate file renames. As such, it tends to compare data/CVE/list with data/DSA/list, data/DLA/list and others. This is less than helpful and tends to evict all data/CVE/list versions from the comparison window such that a new full blob of it becomes required. Since the security-tracker repository rarely renames files, we can ask git to instead consider one window per filename via --path-walk. Once doing so, it becomes quite a bit better at finding suitable deltas. The technique is less applicable to older history (2025 and earlier), but given a lot of RAM and a bit of partitioning, git gc can shrink that as well. Combining these techniques, we can shrink the repository into 700MB and keep new growth somewhat under control.

Temporarily, Helmut is providing a proof-of-concept mirror at git://git.subdivi.de/~helmut/security-tracker.git using these techniques. Avoid pulling from it directly as it does not provide a secure transport. While it does reduce the amount of data being downloaded, it does not resolve a number of related problems. After downloading, a git client will still expend considerable amounts of CPU on verifying received deltas and attempting to git blame data/CVE/list is not improved in any way. Still, there is work on integrating some of the improvements back into salsa.

OpenSSH GSS-API split, by Colin Watson

In an option review Colin did in 2024, shortly after the xz-utils backdoor, he explained that having GSS-API authentication and key exchange support in the main OpenSSH packages is problematic. The key exchange patch is large and intrusive. Even linking to the necessary libraries isn’t without risk: as the Ebury malware attack demonstrated way back in 2009, each extra library linked into security-critical daemons such as sshd (or nowadays into its privilege-separated helper programs) can modify the behaviour of the daemon even if you aren’t doing anything that would involve calling into that library. Of course some of that risk remains, but as Damien Miller wrote, minimizing the number of libraries that end up in the address space of sshd and friends is still valuable.

This split is now complete in testing. As of openssh 1:10.4p1-5, the OpenSSH client and server are built without GSS-API authentication and key exchange support. If you need those features, install openssh-client-gssapi or openssh-server-gssapi instead, as appropriate. Debian 13 (trixie) already has packages with those names that just depend on the regular openssh-client and openssh-server so that you can pre-emptively install them, as documented in the release notes.

The new openssh-*-gssapi packages have relatively tight dependencies on openssh-common, in order for the testing migration system to ensure that we can’t forget to keep them up to date. This will mean a bit more ongoing work on each new upstream version, but it should be manageable.

Catching up on DebConf video publication, by Stefano Rivera

DebConf 25 videos suffered terribly from a bug in voctomix that stopped us from being able to publish the videos immediately after the conference. Ivo De Decker did some work on the videos earlier this year, fixing enough of the audio problems to make the videos at least intelligible.

While at MiniDebConf Winterthur Stefano published all the videos from 2025 and 2026 to PeerTube and YouTube. DebConf 25 and DebConf 26 videos as well as all the videos from miniconfs that had got caught up in the backlog were published.

Miscellaneous contributions

• Carles used po-debconf-manager to review and submit Catalan translations for six packages.
• Carles prepared a prototype of building webwml and running “tidy” (linter) in Salsa.
• Carles created different webwml merge requests with different fixes: invalid links to different architectures, 404s to external sites, fixed templates with invalid URL to favicon.ico, making USE_SAMPLE_FILES=1 to avoid fetching external files, typos in English, etc.
• Carles updated the LibreOffice Wiki page.
• Emilio managed several transitions, such as glibc 2.43, perl 5.42, kdepim, nginx, gnome-desktop 51, python3.14-only, and many others.
• Emilio updated libxfont to 2.0.9, xorg-server to 21.1.24, xwayland to 24.1.13, and fixed a FTBFS bug in terminator.
• Antonio deployed the website for MiniDebConf Beijing 2026, and archived the Hamburg 2026 and Kanpur 2026 MiniDebConf websites.
• Antonio released auto-apt-proxy 18, adding new features and fixing bugs; that needed a followup 18.1 release to fix an issue identified in the testing migration tests.
• Antonio did several Salsa maintenance tasks, including his first platform security update and investigating an issue that was causing the background tasks to be severely delayed, imparting the site usability.
• Thorsten tried to fix some bugs in hplip and cups. Unfortunately this did not result in an upload this month, but stay tuned!
• Helmut continued to report undeclared file conflicts and correspond about them.
• Helmut reviewed and merged Johannes Schauer Marin Rodrigues’ work on adding hurd support to debvm.
• Helmut fixed a pile of minor issues in the support libraries underpinning unschroot.
• Helmut adapted rebootstrap to archive regressions and improved its handling of non-default gcc versions.
• Helmut fixed the rendering of decompressed logs at crossqa.debian.net.
• Helmut sent patches for two cross build failures.
• Colin deployed the fix for Invalid link rel=“canonical” on bugs.debian.org. In the process he found a few bugs in recent undeployed code and fixed them.
• Santiago continued helping Aryan Karamtoth with the GSoC project on introducing livepatching support for linux. Several challenges have been identified in the recent couple of months, and Santiago is trying to guide Aryan to address them and design the solution. The mentoring is done in collaboration with Emmanuel Arias.
• Lucas onboarded a co-maintainer for Valkey.
• Lucas has started to work on a draft for the Debian Outreach project for onboarding newcomers interested in Debian packaging via a video course.
• Stefano worked on the after-math of DebConf 26, handling the bursary expense reimbursement process and winding down the conference finances.
• Stefano uploaded Python 3.15 RC 1 to Debian unstable.
• Stefano did some budgeting and travel planning for the DebConf 27 site-visit in Asahikawa, Japan. The DebConf committee sends a couple of members to meet with the local team and view the venue together, in advance of the next DebConf.

• Which iPhones Support Every iOS 27 Feature?

Extend Your Photos and Lock Screen Wallpaper

Organize Your Safari Tabs

Use Natural Language for Reminder and Calendar Entries

Inline Reply to Messages From Android Users

Upgrade Your Wallet Passes

Describe Your Next Shortcut

Get a Better Flyover of Your City

Ask Siri What Your Camera Sees

Make Your Lock Screen Clock More Compact

Generate Photo-realistic Images with Image Playground

Tweak Liquid Glass Opacity

Create a Slideshow from Any Album

Easily Switch Between Siri and ChatGPT

Build a Browser Extension With a Prompt

Get AI Summaries of HomeKit Camera Footage (iCloud+ Only)

Equalize Your AirPods

Customize Siri's Voice

Rate Your Photos

Ask Questions About Your Surroundings

Auto-Update Your Weak Passwords

Save a Still From a Video

Give Your Alarms Their Own Volume

Share Your Location for as Long as You Want

Show Both Camera Views on a FaceTime Call

Draw in Messages

Get Notified About a Webpage Change

Reframe a Photo

Get Spending Insights in Wallet

Get Context When on a Call

Learn What's Trending Around You in Maps

Write With Siri Anywhere You Type

Ask Siri About Whatever's on Your Screen

Put Siri to Work in Your Inbox

Swipe Down for Search or Ask

Turn a Paper Ticket Into a Wallet Pass

Use One Phone Number on Two iPhones

Redeem a Gift Card by Tapping It

Let Android Friends Into Your Shared Albums

Find the Photos You Actually Took

Erase Bigger Things From Your Photos

Give One Widget a Whole Home Screen Page

Stop Sending Accidental Voice Messages

Let Failed Messages Resend Themselves

Redo a Genmoji Without Starting Over

Pair Your iPhone With a Treadmill

Track Perimenopause in the Health App

See Rain and Wind Hour by Hour

Watch Video in CarPlay While You're Parked

Approve Every Website Your Child Visits

Notice Your Old iPhone Getting Faster

The Reproducible Builds project relies on several projects, supporters and sponsors for financial support, but they are also valued as ambassadors who spread the word about our project and the work that we do.

This is the ninth installment in a series featuring the projects, companies and individuals who support the Reproducible Builds project. We started this series by featuring the Civil Infrastructure Platform project, and followed this up with a post about the Ford Foundation as well as recent ones about ARDC, the Google Open Source Security Team (GOSST), Bootstrappable Builds, the F-Droid project, David A. Wheeler, Simon Butler and Kees Cook.

Today, however, we will be talking with Jochen Sprickerhof, one of the newer members of the Reproducible Builds project core team.

Vagrant Cascadian: Could you tell me a bit about yourself? What sort of things do you work on?

Jochen Sprickerhof: I am a freelance programmer working on Open Source. Mainly doing Debian, F-Droid and some smaller software projects. In general I made it a habit to look into every software I use and try to fix bugs or add features I need. In Debian, I maintain about 180 packages with topics covering home banking, build systems and robotics. Most of my time, I currently work on reproduce.debian.net, where we try to bit-for-bit reproduce the packages distributed by Debian.

Vagrant: Could you describe the path that lead you to working on reproducible builds?

Jochen: I started my Debian journey as a teenager, converting my school to Debian and serving as its system administrator for 13 years. After studying Applied System Science, I joined the university’s robotics labs, where I worked on the Robot Operating System (ROS) and the Point Cloud Library (PCL). In the end, I enjoyed programming more than writing papers, so I eventually left academia for a robotics startup. Some years ago, I realized that the open source work I was doing in my spare time was actually the work I cared most about. Nowadays I am really grateful that I can spend my days working on things I find important and have lots of fun with.

Vagrant: What projects did you recently make big progress on?

Jochen: A recent example is metasnap.debian.net. It is a ‘meta archive’ of snapshot.debian.org which is itself archive of all packages in Debian. But let me explain it the other way round: with reproduce.debian.net, we try to reproduce the packages as they are distributed by the Debian archive. For that, we need the same build environment (compilers, libraries, build tools, etc) that was used by Debian back when the original package was compiled. Luckily, snapshot.debian.org has all those packages, but they are not easily accessible via apt, Debian’s package manager. So, metasnap provides a mapping from a package name and version pair to the APT repo on snapshot.debian.org needed to download it from. It was created by josch some time ago, and it’s awesome work. But when we tried to reproduce more and more packages on reproduce.debian.net, we found that some were missing packages from the build environment — even though they where visible on snapshot.debian.org. We found that metasnap excluded some archive areas because they where not expected to be needed. Reimporting all the data took more than two months and surfaced a couple more flaws.

With this fixed, we were able to build more packages, only to find out that metasnap also needs better support for version numbers. Luckily we were able to rewrite the data in a day instead of starting the import again.

Vagrant: You have been working on infrastructure to support reproducible builds for a while. Has recent adoption of reproduce.debian.net into the Debian release tooling changed the focus of your work?

Jochen: Quite a bit. When we started reproduce.debian.net in 2024, only around 33% of the packages could be reproduced successfully. Today we are above 98%. Most were not bugs in the packages themselves but in the infrastructure. Similar to the metasnap issue I reference above, packages just needed a rebuild because something else, like the toolchain, was fixed in the meantime. In May, people from the Debian release team and the Reproducible Builds project sat together and decided that the overall state is good enough, and now packages that regress on reproducibility are blocked from entering the next Debian release. But that does not mean all the work is on the shoulders of Debian package maintainers. Since then I have been constantly looking at the migration tooling to spot regressions and provide fixes. Furthermore, a couple of maintainers reached out to us for help and I hope more will do so in future.

Vagrant: What is one small thing you (or others) have not yet gotten to that you would really like to see?

Jochen: The central tool to reproduce Debian packages is debrebuild, also written by josch. Currently it has two ways to retrieve the build dependencies of a package. Either it uses metasnap.debian.net (as explained above), or it can access the Debian unstable APT repository directly. This allows to test packages locally before everything is indexed on metasnap by compiling against Debian unstable. But actually there are many other APT repositories to query, like Debian stable or even derivatives. Adding support for an optional list of APT repositories in debrebuild would be great. That would also be a big step to support reproducing other Debian based distributions.

Vagrant: … and one big thing?

Jochen: It would be great to integrate metasnap.debian.net into snapshot.debian.org. There is some discussion on it already in Debian bug #650783.

Vagrant: What are the tools you use the most?

Jochen: According to my fish shell history:

$ history | cut -d' ' -f1 | sort | uniq -c | sort -nr | head -10
  36199 git
  20941 vi
  12271 rm
   8599 cd
   7917 ls
   6407 apt
   5631 grep
   4249 mv
   3655 dpkg
   2873 cp

Vagrant: So, is the fish shell reproducible? I remember it did not used to be…

Jochen: You can check for yourself — it was last time I checked. But looking through the other commands, neovim sadly is not. I hope we can fix that in future.

Vagrant: Oh, that’s a nice URL to check for reproducible package… you can just pass the source package name to check the current results?

Jochen: Yes. Another one is udd.debian.org/reproducibility/, where you can list all packages of a Debian maintainer. It also lists source reproducibility and has nice filters as well.

Vagrant: What tools do you use specifically working on reproducible builds?

Jochen: I don’t have statistics for that, but I would say sbuild to build the package, debrebuild to reproduce it, and diffoscope to analyze the differences. Obviously I also need run apt source <package> or use git-buildpackage to get the sources and all the tools I mentioned above.

Vagrant: So how many packages are left to build reproducibly, and once those are finished, what is next?

Jochen: Right now, reproduce.debian.net shows over 98% reproducibility, though there are still over 650 package left and some will probably need a lot of work. But actually I think making packages reproducible is just the first step. For me, this is a project to build confidence in the system. To reproduce a package we have two parts: the source of the package and the build environment. Fixing the packages means gaining confidence in the first part but we still rely on the individual build environments for each package as we need to use the same compiler that was used when the package was build initially. Because of this, we have to keep around every historical version of all toolchain packages. I really would like to remove this extra archive, which means we would have to rebuild all of Debian around release time. I am dreaming of a Debian release where you could bit-for-bit reproduce every package just from the released versions. Due to how Debian works, however, this is not a trivial rebuild and it would need some work on the infrastructure. By the way, initially there was a third component to pay attention to: any connection to the outside world during the build. Luckily we fixed the Debian build daemons to not allow network connections during the build some time ago.

Vagrant: Thanks for all that work, and taking the time to tell us a bit about yourself!

Jochen: Thanks a lot for the interview!

For more information about the Reproducible Builds project, please see our website at reproducible-builds.org. If you are interested in ensuring the ongoing security of the software that underpins our civilisation and wish to sponsor the Reproducible Builds project, please reach out to the project by emailing contact@reproducible-builds.org.

Liquid Glass

• Here's How Liquid Glass Is Changing in iOS 27


• iOS 27: Tone Down Liquid Glass Transparency


• Get Clear App Icons on Your iPhone Home Screen

Siri and Apple Intelligence

• Siri AI in iOS 27: Features, Requirements, and How It Works


• Here's What's New With Visual Intelligence in iOS 27

Messages

• iOS 27: 13 Ways the Messages App is Smarter and Less Annoying


• iOS 27 Adds New Drawing Tool to Your iPhone's Messages App


• iOS 27 Lets You Hide the Messages Button Everyone Hits by Mistake

Phone and FaceTime

• iOS 27: All the New Phone and FaceTime Features

AirPods

• Every New AirPods Feature in iOS 27


• Set a Custom EQ for Your AirPods in iOS 27

Safari

• iOS 27: All the New Safari Features

Apple Maps

• iOS 27: All the New Apple Maps Features

Mail

• iOS 27: What's New With the Mail App

Calendar, Reminders, and Notes

• Everything New in Calendar and Reminders in iOS 27


• iOS 27 Adds Four New Features to Notes App, Including Markdown Copy-and-Paste

Photos

• What's New in the iOS 27 Photos App

Wallet

• iOS 27 Wallet App Gets 7 New Features

Health

• iOS 27 Apple Health App Redesign: Every New Feature Coming in 2026


• iOS 27: All the New Health and Fitness Features

Weather

• iOS 27 Weather App: All the New Features

Home and HomePod

• iOS 27 Home App: 10+ New HomeKit Features


• Apple Intelligence Home Features Require 2TB iCloud+ Plan in iOS 27


• iOS 27 Brings New Functionality to HomePod

Shortcuts

• iOS 27 Makes the Shortcuts App Much Less Intimidating

Lock Screen

• iOS 27 Brings These Five New Features to Your iPhone Lock Screen


• iOS 27's New Compact Clock Gives Your Wallpaper Room to Breathe


• Add a Volume Slider to Your iPhone Lock Screen


• iOS 27 Lets You Dismiss the 'Now Playing' Lock Screen Widget

Control Center and Settings

• Open the Current App's Settings From Control Center


• iOS 27 Finally Unlinks Alarm Volume From Your iPhone Ringer


• iOS 27 Adds a Useful New Copy-and-Paste Feature to Your iPhone

CarPlay

• iOS 27: 8+ New CarPlay Features

Find My

• iOS 27 Adds These New Features to Find My, Including 'Hide Location'

Apple TV

• iOS 27 Lets You Update Your Apple TV Using Your iPhone


• iOS 27 Lets You Add Apple TV Remote to Your iPhone's Home Screen

iCloud

• iOS 27: All the New iCloud Features

Screen Time and Parental Controls

• iOS 27 Adds New Parental Controls: Ask to Browse, Time Allowances, and a Redesigned Screen Time

Performance and Recovery

• 10 iOS 27 Performance Improvements You'll Actually Notice


• iOS 27 Adds Mac-Like Recovery Mode for iPhone and iPad


• iOS 27: Access the New iPhone Recovery Screen

Limited and Delayed Features

• Two iOS 27 Features Won't Be Ready Launch


• Two iOS 27 Features Are Only Available on iPhone 17 Pro and iPhone Air


• iOS 27 Features You Can't Use in the EU

Read More

Liquid Glass

Toolbars, Sidebars, and Windows

Siri AI

Visual Intelligence

Write with Siri

iPhone Mirroring

Shortcuts

Safari Extensions

• Display a reading time estimate as a badge on the extension


• Close duplicate tabs pointing to the same URL when I click the extension


• Highlight this word


• Create a 3-minute focus timer for the page


• Set the minimum font size to 14pt


• Every time I open a new tab, draw me a flower


• Highlight and show the dimensions of webpage elements when I click them


• Enter design mode for a website so that I can edit the contents


• Save this recipe

Safari Tab Grouping and Notifications

Performance Improvements

How to Install

Full System Requirements

Plaintiffs have resolved their claims in this Action against Defendant Apple Inc. ("Apple").
Plaintiffs accordingly move under Federal Rule of Civil Procedure 41(a)(2) to dismiss with prejudice their claims against Apple. Apple does not oppose this Motion.
For the avoidance of doubt, Plaintiffs do not seek to dismiss any of their claims against Defendants OpenAI Foundation (f/k/a OpenAI, Inc.); OpenAI, L.L.C.; and OpenAI OpCo, LLC.