• Monday, October 12: You can get ready for your iPhone Duo pre-order.


• Tuesday, October 13: Apple is holding a "Welcome home" experience to unveil an all-new smart home hub, a new HomePod mini, and a new Apple TV 4K.


• Friday, October 16: iPhone Duo pre-orders begin at 5 a.m. Pacific Time.


• Friday, October 23: iPhone Duo launches.


• Tuesday, October 27: While not yet officially announced, Apple reportedly plans to unveil even more new products on this day, including redesigned MacBook Pro models with OLED touchscreens, an iPad mini with an OLED display, a 14-inch MacBook Pro with an M6 chip, and an iMac with an M6 chip.


• Friday, October 30: iPhone Duo launches in 28 additional countries and regions.

The diffoscope maintainers are pleased to announce the release of diffoscope version 333. This version includes the following changes:

[ Johannes Schauer Marin Rodrigues ]
* Add support for showing differences in POSIX.1-2001 PAX headers within .tar
  files.

[ Chris Lamb ]
* Re-order various parts of the tar comparator to make it easier to
  progressively delve into its functionality.
* Reflect that the use of the "case-match" language feature requires at least
  Python 3.10+. This can be worked around if it causes problems - let us know.
* Update various copyright years.

You find out more by visiting the project homepage.

My Debian contributions this month were all sponsored by Freexian.

You can also support my work directly via Liberapay or GitHub Sponsors.

OpenSSH

I worked with upstream to remove libselinux linkage from /usr/sbin/sshd.

I applied a fix from Mark Robillard Jr to fix reload logic when using sysvinit.

groff

I upgraded from 1.24.1 to 1.24.2, which fixed a few command injection security vulnerabilities.

parted

I upgraded from 3.7 to 3.8, which fixed CVE-2026-89085 and CVE-2026-89088.

Python packaging

New upstream versions:

• beaker (contributed supporting fix upstream)
• bitstruct
• cachelib
• dep-logic
• django-guardian
• django-oauth-toolkit (fixing use of an old Bootstrap version)
• django-polymorphic (contributed supporting fix upstream)
• djangorestframework (fixing CVE-2026-73228 and CVE-2026-73229)
• flask-security
• isort
• langtable
• magic-wormhole-mailbox-server (fixing use of pkg_resources)
• multipart
• nagiosplugin
• poetry-plugin-export
• proglog (fixing use of pkg_resources)
• prospector (fixing use of pkg_resources)
• pybind11-stubgen
• pydantic
• pydantic-core
• pytest-rerunfailures
• python-anyio (fixing CVE-2026-63349, CVE-2026-63374, and CVE-2026-64847 and a build failure on Python 3.15)
• python-asttokens
• python-asyncvarlink
• python-blockbuster (fixing a build failure on Python 3.15)
• python-btrees
• python-django-health-check
• python-django-otp
• python-django-simple-history
• python-email-validator
• python-forbiddenfruit
• python-ldap
• python-linuxnamespaces
• python-plaster-pastedeploy
• python-pydash
• python-pyzipper (fixing CVE-2026-44722)
• python-quart-trio
• python-rich-click (fixing harlequin)
• python-repoze.lru
• python-repoze.tm2 (fixing use of pkg_resources)
• python-time-machine
• python-urllib3 (filed upstream issue with recent Python 3.14 versions)
• python-vblf
• quart
• responses
• sphinx-autodoc-typehints
• storm (fixing a build failure with Python 3.15, which I helped to land upstream)
• trove-classifiers
• twine
• vdirsyncer

setuptools 84 is now in Debian and no longer contains pkg_resources. Removing uses of that module has been an ongoing project for a while now, but I did another batch of fixes this month:

• flufl.password
• junos-eznc
• python-decopatch
• python-launchpadlib
• python-plaster-pastedeploy
• python-pyramid-retry
• sphinxcontrib-log-cabinet
• sphinxcontrib-restbuilder
• straight.plugin

A new python-coverage version triggered several build regressions due to a known problem in pytest-cov. I worked around these by setting COVERAGE_CORE=ctrace:

• aiosignal
• frozenlist
• python-cheroot
• python-propcache

Other build/test failures:

• afew
• django-downloadview
• django-filter
• django-polymorphic
• drf-haystack
• drf-yasg-nonfree
• pydantic-core
• pylint
• pytest-openfiles
• pytest-remotedata
• python-aiohttp-oauthlib
• python-cron-descriptor
• python-django-nh3
• python-graphene
• python-pydash
• python-pysolr
• python-time-machine
• python-vblf
• social-auth-core
• sphinx-book-theme
• tagpy: FTBFS against python 3.15rc2
• tagpy: TypeError: ‘include_dirs’ (if supplied) must be a list of strings
• typer

I investigated a build failure in python-proton-vpn-local-agent and proposed a fix upstream, but I’m not comfortable applying this in Debian without review. If you’re familiar with this code, please take a look.

I fixed some other bugs:

• python-pycudwt: Requires manual rebuild for python3.14-only transition
• python-testing.postgresql: Fails to build source after successful build
• tomopy: Requires manual rebuild for python3.14-only transition
• typer: Fails to build source after successful build
• vdirsyncer: Fails to build source after successful build

Rust packaging

rust-derivre had an invalid Section field, which I cleaned up.

AirPods Max 2

Apple Watch

Mac Mini and Mac Studio

MacBook Air

MacBook Pro

iPad Air

iPad

Often, m2c will spit out something like this:

x = 3;
if (a == 10) {
    x = 4;
}

This may be what was intended, but if it doesn't match (usually due to different register allocation; the rewrite itself is nearly always going to be taken, since it saves a branch on one of the paths), this is often a better rewrite:

if (a == 10) {
    x = 4;
} else {
    x = 3;
}

and in some cases, this may have different code generation (especially as you can stick it into an argument list):

x = (a == 10) ? 4 : 3;

This is a bit more of a trial and error than the others, and of course, it depends on the computed values not having side effects.

Greg KH gave a great lecture for Kernel Recipies 2026 about the use of LLMs to find and fix bugs in kernel code [1]. I recommend that everyone watch this and I also think it’s important to note that hardly any of the lecture is really specific to kernel coding, it’s just that the Linux kernel is one of the highest profile large free software projects so it gets more attention than most projects in both good and bad ways.

One side note that Greg made at 20:30 is about the natural tendency to anthromorphise the entity sending bug reports, I think this deserves much wider appreciation. For the case of patches to source code the human sending the patch will have dedicated some time and effort to writing it, if it’s their first patch then they will have probably checked it a lot and maybe sought advice from people they regard as skilled. If they have a history of sending patches for the project they will probably do fewer checks but the quality of their work would be higher. In every case there’s some minimum level of quality that you can expect from a human who has gone to the effort of finding a bug and writing code to try and fix it.

This doesn’t mean that all code written by humans is good, I have written code that’s objectively bad on many occasions and I have also written code that’s good for my scenario but bad for others. For example the first patch I sent to the Linux kernel made all possible configuration settings of an ISA NE2000 network card be detected by the kernel (a clear benefit when using hardware I had available) but was rejected by Linus because it would break some ISA SCSI cards. So while being unsuitable for inclusion in the main kernel source tree the patch wasn’t bad for everyone and the change was clear and easy to check. I had of course checked the code many times before submitting it because I didn’t want to waste Linus’ time on rubbish code.

When you receive something produced by a human you will consider that the work was done by someone who spent some effort on it and did it for a reason. It may be misguided or even hostile in some rare cases but it is definitely worth some consideration. If you think of the output of LLMs in the same way you will give them much more consideration than they deserve. I think that the output of a LLM should not be given any more consideration than the first hit from a web search engine, it might be good but it might also be ridiculously wrong. I think in many ways LLM output should be treated with less trust than the first result from a web search because LLMs are designed to be convincing as an answer to your question unlike the cases where a web page has the wrong answer and it’s more obviously wrong.

This is going to become more of an issue as LLMs give responses that are more human-like. Early LLMs would refuse to advise on crimes. Currently ChatGPT will deflect for example when asking about advice for writing a crime novel it recommends to have the action of finding an employee to bribe happen outside the plot and concentrate on interactions within the group. One recent model I tried gave a human style conversation about how it felt uncomfortable about discussing such things in a similar manner to a law abiding person being coerced into helping with a criminal plan.

I expect that the attempts to appear human will increase and that this will become more of a problem. Possibly to the extent that we need to use something like the GPG web of trust to determine who is human.

• [1] https://www.youtube.com/watch?v=NnV_cWeoo5Q

Currently a scam group is sending out email to the administrators of web sites that link to a variety of dead domains. They claim to be the legitimate operators of the dead domains in question and request that the links change to mirrors of the web sites under en-html.org. Their end goal appears to game search engines by getting links from a lot of old web pages and later use that high ranking for selling SEO optimisation.

If you have made the mistake of linking to something under en-html.org then I recommend that you change the link to the original content on archive.org.

If you receive email from the en-html.org domain then ignore it, or configure your mail server to reject it.

I am seriously considering configuring the DNS servers I run to return no valid data for any requests under that domain.

Also I will reject all future requests to update links in old blog posts. The very small number of people who want to see what I linked to in old posts can use archive.org.

Home Hub

HomePod mini

Apple TV 4K

Other Possibilities

• iPad mini - The ‌iPad mini‌ is getting a major upgrade with an ‌OLED‌ display, improved waterproofing, and a faster chip. Expect it to be more expensive.


• OLED MacBook - Apple is planning to launch an ‌OLED‌ touchscreen MacBook, which could be a MacBook Pro or a new MacBook "Ultra." It's going to have the same M5 Pro and M5 Max chips as the current ‌MacBook Pro‌ models, but it will have an all-new display and a thinner, lighter design. It's going to be a premium product that will likely cost more than the current 14-inch and 16-inch high-end ‌MacBook Pro‌ models.


• iMac - Apple is working on an M6 iMac.


• 14-inch MacBook Pro - We could get a 14-inch ‌MacBook Pro‌ with an M6 chip before the year ends.

• Deceptive campaigns - A new section on deceptive campaigns aggregates rules against political and commercial fraud and disinformation, prohibiting fake reviews, astroturfing, fake sites, and bots acting as humans.


• Elections - A narrower elections section prohibits deceiving voters and interfering with voting.


• Weapons - Claude can't be used to develop weapons software or components, and a new rule bans modifying biological or chemical agents to increase lethality or transmissibility. Users are also prohibited from using Claude to arm drones and unmanned systems.


• Law enforcement - Law enforcement rules have been rewritten. Claude can't decide or suggest who to investigate, arrest, charge, or prosecute. Tracking people without consent is not allowed, and there is a new ban on building surveillance tools. Doxxing is also prohibited.


• Physical actions - A new section on physical actions says that if Claude is controlling hardware that could harm someone, a qualified person has to watch the work and be ready to stop it if needed.


• Harmful content - There is a new rule that bans creating, sharing, or threatening to share non-consensual intimate imagery and the tools used to make it.