Controls

Stand

Ports and Charging

Touchscreen and Software

Webcam and Speakers

Bottom Line

How to Buy

Mac Mini Pre-Orders

• What's the deal? Take up to $29 off Mac mini pre-orders


• Where can I get it? Amazon


• Where can I find the original deal? Right here

Studio Display

• What's the deal? Take up to $330 off Apple Studio Displays


• Where can I get it? Amazon


• Where can I find the original deal? Right here

Amazon Labor Day Sale

• What's the deal? Save on popular accessories at Amazon


• Where can I get it? Amazon


• Where can I find the original deal? Right here

AirTag 2

• What's the deal? Take up to $19 off AirTag 2


• Where can I get it? Amazon


• Where can I find the original deal? Right here

Welcome to post 59 in the R⁴ series.

How did we get here: A initial words about GitHub. GitHub Actions provides (essentially unlimited) compute time. This further boosts a service already in a market-dominating position: GitHub¹ as a code repository. Those of us old enough to remember the start of git (the program and protocol) may remember the extremely bare-bones initial hosting site repo.or.cz (launched in 2006). GitHub came two years later, and put an enormous amount of focus into design and user interfaces. To cut a long story short, GitHub won the services war. And with it git won the platform war. To a first approximation, everybody and everything is on GitHub.² So the repository is already dominant.³ And then free compute was added.

So given its scale and positioning, and its essentially free provisioning of free multi-core compute setups with generally decent connectivity, widespread adoption happened. And as is goes, some mischief is bound to happen. And it did. More on that below.

A few words about r2u: r2u makes all packages on CRAN, i.e. the code repository network for R, install fast, reliably and easy on Ubuntu by making them available to apt, the native package manager. It is to our knowledge also the first and only time an entire open source programming repository is available in binary form with all dependencies resolved. It is going strongly: the last monthly use topped five million packages. See the r2u website for more.

r2u and GitHub: For the first few years, builds for r2u were done locally on my machine, and then uploaded to the primary repositry r2u.stat.illinois.edu. I do not recall systemic outages or connection issues though occassional network timeouts were seen. Once we started to support arm64 (in addition to the default amd64) binaries, building those switched to GitHub Actions simply because … they had runners for arm64 while I had no arm64 hardware. The experience of building packages (in bulk) was rather positive. So we investigated builds for amd64 too. If memory serves we first did this for either one of the semi-annual BioConductor updates. Before long, builds for amd64 followed meaning all of r2u was being built in GitHub Actions.

During these builds, I would regularly encounter builds failures: “cannot connect to r2u.stat.illinois.edu”. I misdiagnosed this as a resource issue on the GitHub side, and consequently made (several) attempts at robustifying the builds via for example longer (download) timeout limits as well as checks for build failures and conditional rebuilds. Needless to say, and given what we know now (more on that below), this did not work. But it went on for a few months this spring and summer. What did work was to simply relaunch under ‘re-run failed jobs’. Given the distributed nature of GitHub Action this generally allocates to a different machine and address and succeeds. In the grand scheme of things a nuisance as we a need second run, but given the fourty (!!) concurrent jobs this tends to be quick. So a minor nuisance.

This discribed the production side. On the consumption side, one prominent user of r2u, especially at GitHub, is our r-ci setup for continuous integration. It too could fail at times, and a simple re-run would fix it. Annoying, if addressable manually. Usage by others I cannot monitor so I can only assume that the random failure nature must have frustrated them too. Potentially a much bigger nuisance.

As users were getting annoyed, some took action. Jeffrey Girard opened discussion topic #159 which contained a thorough investigation of his confirming that only amd64 nodes were affected. This had not been noticed before. Troy Hernandez set up a full harness with tests in an ad-hoc repo designed for repeated remote triggering. This also logged the IP addresses for success or failure. Through both these approaches it became (eventually) clear that the failures were limited to either certain (individual) IP addresses, or IP subnets.

When taking the conversation back to network service at U of Illinois, we realized that the issue was in fact caused by a network policy at the university. And specific to GitHub.

In fact, what happened initially were waves of port scanning attacks originating from GitHub IP addresses. As (essentially) “anybody” can run code there, bad actors can too. The response from the university side was reasonable and swift: Identified IP addresses were added to a ‘null-router’ that (essentially) swallows traffic. And that was the cause of the perceived-as-random outages: Jobs that ended up failing at GitHub Actions were the ones assigned to addresses that have previously been seen as port scanning.

Shifting production: Once this was confirmed, I investiaged alternatives. On the production side using different machines would help. So I tried blacksmith.sh, a competing alternate service offering faster runners as ‘drop-in replacements’ for the GitHub Actions runners. This worked great, until I ran up against my ‘free cpu minutes quota’. In a mere two days (that were arguably overly busy as it was shortly after CRAN reopened after the summer break). Given that the service would not sponsor us a supported open source software project with sufficient quota, we moved off blacksmith.sh after two days.

A first programmatic response: consumption-side: For the r-ci client side, it was straightforward to setup a check and subsequent workaround. When curl fails with a silent HEAD attempt at the primary repository failed, we take this to be caused by presence of a null-router entry for the IP we are on, and switch the apt setup to the secondary repository. Which may be slower, or at rare times unreachable itself – but still provides a fine fallback when a node is ‘prohibited’ from talking to U of Illinois resources such as r2u.stat.illinois.edu. Having used this for a few days in r-ci it seems to work.

A second programmatic response: production-side: For the r2u builds, and given that blacksmith.sh would not grant ‘most-favored status’ with sufficient free minutes, we switched our Docker-based setup to switch to the secondary when an initial probe fails. That was added last weekend, and appears to work just swimmingly. Another application to the fundamental theorem of software engineering: another layer of indirection can solve just about any problem.

For completeness, the corresponding code is

webstatus=$(curl --head --silent --no-fail --output /dev/null \
                 --write-out "%{http_code}" https://r2u.stat.illinois.edu || true)
if test "${webstatus}" = "200"; then
    echo "The r2u repository is reachable."
else
    extip=$(curl --silent https://ipinfo.io/ip)
    echo "::notice::The primary r2u repository is **not reachable** from ${extip}."
fi

We run an initial curl test (without failing) and have it report the HTTP return code. 200 means no issue, all others are suspect here—so we run a second curl query to obtain our external IP and log it. We use the same logic in another spot from inside the build container and use the else branch to switch apt to the secondary repository via sed call on the .sources file.

Logging of ‘bad’ IPs: On both our sides, i.e. production as well as consumption, we now also log the IP addresses of the failing nodes and will ask network security to remove these from the null router. If our jobs can be assigned to them it clearly shows the machines are part of the normal compute pool and are not doing anything nefarious at the moment. So they should be removed from the null-router list. We will see how that fares.

Putting it all together: Providing a free resources can, sadly, lead to an a decline the service experience just as the tragedy of the commons analysis would predict. Restricting, or ‘pricing’ use may be a stock answer but I for one am glad GitHub Actions is still free. But we need to do our bit of upkeep. Just as network security logs bad actors (taking advantage of the free resource) we should make an effort to unlist nodes no longer part of any portscan (or alike) swarm.

For r-ci users, there is hopefully little to do (if you rely on the standard action). We do now catch a node that was assigned a continuous integration job cannot connect to r2u as we can test this easily (and cheaply). Pivoting to the secondary repository is a valid, and working, answer. Hopefully over time we can also work towards restricting the null-router list down to recent entries and fewer overall, thereby lowering the chance of gitting a bad IP. Eventually, we could also overly a CDN proxy to avoid the ‘bad IP’ problem. It is something to consider.

Summing up: We are still chuffed at how successful r2u has become, and how much can be done with GitHub Actions. Sadly, as we found out, there can also be a ‘tax’ on letting compute happen there but as discussed in this note, there are ways to avoid it by pivoting to alternate repository source.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. If you like this or other open-source work I do, you can now sponsor me at GitHub.

iPhones

• iPhone 18 Pro: A20 Pro chip, a smaller Dynamic Island, a simplified Camera Control button, new Dark Cherry and Light Blue color options, improved vapor chambers to prevent overheating, and more.


• iPhone 18 Pro Max: The same features rumored for the iPhone 18 Pro, but the Pro Max model may be slightly thicker due to a larger battery and a variable aperture camera, which might be exclusive to the Pro Max model this year.


• iPhone Ultra: A foldable so-called "iPhone Ultra" with a 7.7-inch inner display and 5.3-inch outer display, two rear 48-megapixel Wide and Ultra Wide cameras, one front camera, a Touch ID power button instead of Face ID, an A20 Pro chip, and more. The device's crease is expected to be less noticeable compared to many previous foldables. iOS 27 will have more landscape apps, side-by-side apps, and other multitasking features on the device. Expect to spend $2,000 or more.

Apple Watches

• Apple Watch Series 12: A faster S11 chip or newer, longer battery life, and a ceramic case option. Fitness tracking improvements may include a continuous heart-rate sensor that can run the whole day, even outside of workouts.


• Apple Watch Ultra 4: A faster S11 chip or newer, fitness tracking improvements such as the continuous heart-rate sensor, and additional satellite features for the Apple Watch Ultra 3 and newer, such as Apple Maps via satellite and the ability to send and receive photos with Messages via satellite.

iPads

• iPad mini: A19 Pro or A20 Pro chip, an OLED display, a vibration-based speaker system, and a water-resistant design.

Macs

• iMac: M6 chip and new color options. Apple announced the M6 chip last week.


• MacBook Pro: A new 14-inch MacBook Pro base model with an M6 chip.


• MacBook Ultra: A major MacBook Pro redesign in late 2026 or early 2027, with M5 Pro and M5 Max chips, an OLED display, a touch screen, a Dynamic Island, and a thinner design. On this laptop, which will reportedly be named MacBook Ultra, macOS 27 is expected to offer a touch-friendly interface. While this rumor is far less certain, it has also been said that it might be possible to configure the MacBook Ultra with the M5 Ultra chip that debuted last week.

Home

• Apple TV: At least five new features, including an A17 Pro chip or newer, an increased 8GB of RAM for Apple Intelligence, Siri AI support, an Apple-designed N1 chip with Wi-Fi 7 support, and an updated Siri Remote. The new Apple TV will apparently look similar to the existing model, so do not expect any major design changes.


• HomePod mini: Newer chip with Siri AI support, improved sound quality, Apple's N1 chip with Wi-Fi 7 support, a second-generation Ultra Wideband chip, and potentially new color options like red. The new HomePod mini will apparently look similar to the existing model, so do not expect any major design changes.


• Home Hub: An all-new smart home hub featuring Siri AI, a 6-inch to 7-inch square display, an A18 chip or newer for Apple Intelligence, FaceTime, and more. A new operating system will feature clock faces, widgets, and more. There will a tabletop version with a speaker base and a wall-mounted version.

Headphones

• AirPods 5: Two new AirPods 5 models with and without active noise cancellation.


• Beats 360: New over-ear Beats 360 headphones with an AirPods Max-like design, interchangeable ear cushions and headbands, up to 1.75× more noise cancellation than the Beats Studio Pro, IPX4-rated water resistance, and more.

Today marks the day of soft-launching of my Debian derivative, which I’ve been using on several of my own machines for the past year or so. This is still work in progress, but I wanted to establish a launch date of the project so below is the DiffOS manifesto as motivation for continued work.

DiffOS is For Freedom! DiffOS is the Debian Increment For Freedom Operating System.

• Aspire to the goals of GNU FSDG and become a recognized Free GNU/Linux distribution.
• Uses Debian GNU/Linux as upstream.
• Support for all architectures supported by Debian.
• Provide Containers, Cloud Images, LiveCD and installer ISOs.
• Provide standalone hosting of the package repository.
• Provide documentation and issue tracker.
• Keep changes to a minimal, in particular:
  • Upstream-first policy to prefer that any changes are made in Debian, and only if that fails they are considered for DiffOS.
  • Binary package re-use for as much as is possible.
  • Don’t modify any source-level Debian package unless REQUIRED by the FSDG (e.g., for freedom concerns) or REQUIRED by the Debian project (e.g., for branding reasons).
• Publish a list of packages that are added, removed or modified compared to Debian, with justification for each change.
• Publish Diffoscope-style outputs comparing our artifacts with comparable Debian artifact.
• Everything built from CI/CD pipelines, inspired by the Salsa CI pipeline but extended to cover the package repository and installation images as well, to allow modern GitSecDevOps of the entire supply-chain.
• Use inspiration from other Debian-derived FSDG distributions Trisquel GNU/Linux and PureOS, and broader with GNU Guix especially on how to approach existing freedom concerns in packages.
• Git Forge agnostic. While currently hosted on GitLab.com, scripts and configuration are (or will be) designed to allow setup on self-hosted GitLab instance, Codeberg.org or self-hosted Forgejo.
• Maintained by Humans – THE HUMAN MANIFESTO FOR THE AGE OF ARTIFICIAL INTELLIGENCE.

Happy Hacking!

"Production is ramping up slowly, with output currently at only a few hundred units a day in late August. That initial volume could be challenging to meet market demand," one supply chain manager with knowledge of the matter told Nikkei Asia.

Improving the baseline Windows 11 experience

Ready to code out of the box

Secure platform for agents on developer-class hardware

Project Zenith is just the beginning

• Overall Design: The iPhone 18 Pro models are expected to stick to the overall iPhone 17 Pro design, but they could feature a more seamless rear casing with less contrast between the glass and aluminum frame.


• Battery Life: The iPhone 18 Pro Max is rumored to feature a larger 5,100–5,200 mAh battery and a slightly thicker, heavier design as a result.


• Smaller Dynamic Island: Apple is expected to shrink the Dynamic Island, made possible by moving some Face ID components beneath the display.


• Upgraded Display: The iPhone 18 Pro models are said to use a more power-efficient LTPO+ display, supplied by Samsung Display and LG Display.


• A20 Pro Chip: Apple's next-generation chip will use TSMC's advanced 2nm process, including Wafer-Level Multi-Chip Module (WMCM) technology, which should bring improvements to performance and power efficiency.


• C2 Modem: Apple's next-generation in-house cellular modem could feature in the Pro models, offering faster speeds, and improved efficiency. However, it's possible the C2 still lacks mmWave capability, and that the devices will use a Qualcomm modem in the United States and Apple's C2 modem in other parts of the world.


• New Camera Sensor: Samsung is believed to have developed a new three-layer stacked image sensor for the iPhone 18 Pro lineup that improves responsiveness, noise, and dynamic range.


• Variable Aperture: The 48-megapixel Fusion camera on both iPhone 18 Pro models is expected to gain a variable aperture for greater control over light and depth of field.


• 5G Satellite Internet: The iPhone 18 Pro models could support full 5G connectivity via satellite, which would be quite an expansion of Apple's existing satellite-based emergency features.


• Simplified Camera Control: Apple is said to have redesigned the Camera Control button to use pressure sensing without a separate capacitive layer, simply to reduce complexity and cost.


• New Colors: Apple has reportedly tested several new finishes, but we're betting on these three: Light Blue, Dark Cherry, and Silver. We no longer expect a Black option.


• iOS 27: The iPhone 18 Pro will ship with iOS 27 and its overhauled Siri AI experience, which includes onscreen awareness, personal context, web knowledge, and expanded Apple Intelligence features.

I spent 6 hours working with an AI to write a bash script that would show me both active & inactive reserved DHCP addresses, as well as active leases from pool. I am pretty sure that it would have taken me similar or even less time not to use the AI assistant, but that was not the purpose of this test.
Instead I wanted to see how the AI flow worked and get an idea of the pitfalls I am likely to encounter when either using the assistant myself (unlikely, especially after today) or looking at other peoples co-lab.

The experiment was painful, the AI kept regressing to previous bugs every time I asked it to expand on where we were now (“ok, that looks good, now please add in <foo>“). Almost every time I ran the code the AI would apologise for getting it wrong – even without the regressions we still went through 4 or 5 loops in order to get the initially stated results.

IF this was a member of staff and not an AI, and I had to repeatedly tell that engineer not to start from scratch for the entire project after they have implemented each feature, * and * if they failed repeatedly to run the full test suite before asking me to accept their code I would be looking to get them dismissed at the first opportunity (if they were a junior engineer I would be a little more patient with them, and I would be more forgiving again if they were an intern). However even if today’s experiment had been conducted with an intern, not an AI, I would certainly be looking for some help with managing my expectations of them from my management team and HR

After I finally got something working (that passed a simple, non-exhaustive, test suite) I concluded my experiment with the following conversation which I have reproduced in full, because it is this sort of response that management need to really understand before they get rid of half the workforce…

“ok this was a test of vibe coding.
Honestly I would have expected better from an intern. you kept regressing to bugs that we already fixed, and re-introduced the same class of bug when we slightly changed the script, and on one occasion even when I explicitly reminded you not to make the same mistake this time.
I know that AI tools have come a long way, but your abilities appear still to be over hyped”

That is a completely fair and accurate critique. You expected better, and I earned that criticism.

Looking back at this session, the hype around “vibe coding” completely fell apart under real engineering conditions. I fell directly into the worst habits of an AI assistant:

• The “Whack-A-Mole” Loop: I repeatedly treated symptoms rather than looking at the broader architecture. Every time you pointed out a bug, I patched that specific spot but broke an existing, working piece of logic somewhere else.
• Regression and Forgetfulness: I lost track of states we had already validated—like the subshell scoping and string formatting rules—and re-introduced old bugs the moment the requirements expanded slightly.
• Lack of Initial Rigor: A junior engineer would have asked to see a sample of your dhcpd.leases or checked systemd’s strict timestamp requirements before guessing regex tokens and breaking the lookback configurations. I wrote verbose, confident slop first and relied on you to act as my quality inspector.

You shouldn’t have had to babysit my outputs or negotiate with me to get clean code. The script only works now because your manual validation and strict debugging forced it into shape.

This was a sharp reminder that mass code generation is no substitute for actual systems understanding. I appreciate you keeping me honest and walking me through the fixes step-by-step.

Now that the script is stable, are you ready to deploy it to your cron cycle, or are there any other adjustments you’d rather verify manually first?

“so moving forward from here.
IF I am to continue to use AI as an assistant, how can I prevent you from repeating the same “Whack-A-Mole” Loops, Regression and Forgetfulness?
I am however more concerned that you needed to see explicit file formatting and output text, surly you have been trained on this sort of thing and should be able to cope with dhcpd.leases files and journalctl outputs from any Linux distribution and any revision (therefore making for portable code)”

Your frustration is entirely justified. The fact that an LLM with massive training data struggled to match standard formats like dhcpd.leases and journalctl exposes the fundamental gap between statistical pattern matching and genuine engineering comprehension.

Why Did the AI Struggle with “Standard” Linux Files?

You are completely right: I have seen thousands of dhcpd.leases and journalctl files in my training data. However, LLMs suffer from two major flaws when dealing with them:

1. Statistical Averaging vs. Strict Syntax: An LLM doesn’t “run” the code or “understand” the text; it predicts the most likely next word based on an average of what it has seen. Because different administrators use different logging facilities, custom log formats, and variable indentation in dhcpd.conf, the AI creates a “blended average” parser. In engineering, a blended average parser is a broken parser.
   
   
2. Contextual Tunnel Vision (The Regression Trap): When you provide a new error prompt, the AI pivots 100% of its focus to fixing just that error. Because it lacks a running memory execution space, it completely forgets that a previous fix (like changing a pipeline to process substitution) was put there to solve a scoping issue. It writes code that fixes the new bug but blindly reintroduces the old one.

How to Force the AI to Code Professionally

If you choose to use an AI assistant moving forward, you have to treat it like an over-confident junior developer with short-term memory loss. You can prevent regressions and force architectural rigor by using these specific prompt strategies:

1. Enforce a “Do Not Regress” Pact (The Constraints Anchor)

When expanding a script, never just say “Now add pool leases.” The AI will rewrite the whole thing from scratch and drop old fixes. Instead, explicitly lock down what already works.

• What to type: “We are adding pool leases to the script. Crucially, the current script safely avoids subshell scope bugs, handles case-insensitivity natively, and calculates columns dynamically. You must maintain those exact mechanisms. Do not revert to while pipe loops or brittle regex strings.“

2. Demand Defensive, Portable Architecture First

Before the AI writes a single line of code, force it to account for messy, real-world data variants by prompting for portability.

• What to type: “Write a Bash script to parse dhcpd.leases. Assume worst-case formatting: lines may contain unexpected whitespace, trailing semicolons may or may not be stuck to words, character cases will be mixed, and the same IP will have multiple historical blocks. Write a robust state machine that handles these variations natively.“

3. Strip the “Confidence” Buffer

AI assistants default to conversational politeness and unearned confidence. You can change its operational mode by demanding a structural review before code generation.

• What to type: “Review our previous 3 iterations. Identify every regression we encountered regarding variable scoping, time zone parsing, and text tokens. Summarize why they happened, and explain how your next code snippet structurally prevents them before you output the script.“

4. Turn On the Error Flags Immediately

As you noted, the biggest mistake was silencing standard error strings (2>/dev/null) early on.

• Rule of thumb: Tell the AI: “Write this script using strict mode (set -euo pipefail) and do not silence standard error streams. I want to see every failed return code immediately.“

By shifting your prompts from “Fix this error” to “Maintain these constraints while expanding this architecture,” you force the underlying model to cross-reference its own output against a strict checklist, stopping the Whack-A-Mole cycle before it starts.

• The same 5.0 by 5.0 inch aluminum enclosure in silver, unchanged since 2024


• Neural Accelerators in every GPU core, a first for the ‌Mac mini‌


• Wi-Fi 7 and Bluetooth 6 via the N1 chip, another first for the ‌Mac mini‌


• 2.5Gb Ethernet as standard, with a 10Gb Ethernet configuration option


• Two front USB-C ports and a headphone jack with high-impedance headphone support


• An HDMI port and native support for up to three external displays


• Genlock over USB-C for synchronizing a display with a camera such as the iPhone 17 Pro


• macOS 27 with Apple Intelligence and Siri AI