Open Source news and engineering summaries

Mitchell Hashimoto, a long-time GitHub user and creator of Ghostty, announced that the project will leave GitHub due to recurring infrastructure outages that hinder productivity. Citing frequent downtime for pull requests and GitHub Actions, Hashimoto is planning to migrate independently while maintaining a read-only mirror, emphasizing that the decision stems from a desire to prioritize reliable software development.

A Matplotlib PR proposed replacing np.column_stack with np.vstack().T for a 36% performance boost. The PR was closed because it was created by an AI agent, violating community policy. This sparked a heated debate regarding AI contributions, open-source gatekeeping, and the ethics of personal attacks by automated agents.

Godot maintainers are struggling with an influx of low-quality, AI-generated code contributions, often referred to as 'AI slop'. This deluge is taxing human resources, forcing maintainers to verify the authorship and functional validity of every submission. The community is exploring funding for more staff and potential platform migration to handle the overwhelming volume.

Daniel Stenberg, the lead developer of the widely used open-source networking tool cURL, has announced the termination of the project's vulnerability reward program. This decision follows a surge in low-quality bug reports, many of which are identified as AI-generated slop that wastes the time of the small maintenance team. While users expressed concerns that this move might impact the security of the tool, which is a staple in Windows, macOS, and Linux, Stenberg emphasized that the current volume of bogus submissions threatens the mental health and sustainability of the project. Effective at the end of the month, the project will pivot away from paid bounties to protect its limited resources from automated misinformation.

F-Droid reports that Google’s planned Android lockdown remains a threat despite public misconceptions. The community is raising awareness via in-app banners. Meanwhile, F-Droid Basic 2.0-alpha3 was released with UI improvements, and various apps like Conversations and ProtonVPN received updates, focusing on removing proprietary dependencies and adopting modern protocols.

Bose has announced a surprisingly consumer-friendly strategy for its legacy SoundTouch smart speakers. Originally slated to lose official cloud support in February, Bose has extended the deadline to May 6th, 2026. Crucially, the company is open-sourcing the API documentation, allowing developers and enthusiasts to create custom tools to maintain functionality. Instead of bricking the devices, a final update to the SoundTouch app will introduce local controls, preserving features like Bluetooth, AirPlay, Spotify Connect, and physical AUX connections. This move provides a rare alternative to the industry standard of rendering old hardware useless once cloud services are discontinued, drawing comparisons to community-driven efforts like the Rebble Alliance for Pebble watches.

Mastodon is a decentralized social networking platform. To access its web application profile or interface, users must enable JavaScript in their browsers. Users who prefer not to use a web browser can opt for various native apps available across different platforms for a more integrated experience.

Valve has released CAD files for the Steam Controller and Puck, allowing users to create custom accessories like skins or mounts. The release includes STL and STP files under a creative commons license, encouraging community innovation while permitting commercial inquiries. This initiative follows Valve's history of open hardware support for devices like Steam Deck and Index.

The cURL project has officially announced the termination of its bug bounty program effective January 31, 2026, following a relentless surge of AI-generated garbage reports. Daniel Stenberg, the creator of cURL, initiated this change by removing all program references from the documentation and GitHub after the project was overwhelmed by low-quality HackerOne submissions. Despite previous warnings and potential bans, the influx of unresearched reports continued into early 2026, forcing the team to prioritize their time over financial incentives for security researchers. Moving forward, the project will still accept vulnerability reports via GitHub or mailing lists, but no monetary rewards will be provided. Stenberg emphasized that this decision aims to eliminate the profit motive for those using LLM tools to generate bogus reports, and he remains firm on critiquing those who submit issues they do not fundamentally understand or cannot reproduce.

Google plans to mandate central developer registration for all Android apps by September 2026, requiring government ID and fees. This policy effectively kills the open-source spirit of Android, threatens apps from F-Droid, and creates a significant censorship and privacy risk, drawing widespread opposition from developers and privacy advocates who view it as a total control move.

Homebrew 6.0.0 is now available, featuring a new tap trust security mechanism, a faster internal JSON API, and Linux sandboxing via Bubblewrap. This release includes improved defaults, parallelized brew bundle operations, enhanced startup performance, and initial support for macOS 27 (Golden Gate), while strengthening supply-chain security and refining the package management experience across macOS and Linux.

Mastodon is a decentralized social networking platform. Its official web interface requires JavaScript to function properly. Users who prefer not to use JavaScript or seek a more integrated experience are encouraged to utilize native apps available for various operating systems and platforms.

MalusCorp's Liberate Open Source service uses proprietary AI and clean room methodology to recreate open source projects from scratch. By analyzing only public documentation, the system generates legally distinct, functionally equivalent code, allowing corporations to bypass license obligations like attribution, copyleft, and AGPL requirements with proprietary-friendly licensing.

The Framework Laptop 13 Pro features Intel Core Ultra Series 3 processors, 20-hour battery life, and an upgraded CNC aluminum chassis. It emphasizes repairability, modularity, and excellent Linux support, offering a high-performance experience with replaceable components like LPCAMM2 memory and customizable ports. It is designed for users seeking a durable, open, and customizable professional machine.

Flipper One is an ambitious, open-source Linux hardware platform based on an ARM architecture, designed as a pocket-sized multi-tool for network analysis and computing. Unlike Flipper Zero, it focuses on high-performance networking, modular connectivity, and upstream Linux kernel support, fostering an open collaborative development process through a public developer portal.

Linus Torvalds has addressed the ongoing debate within the Linux kernel community regarding contributions generated by AI and large language models. He argues that creating specific documentation to address 'AI slop' is futile because bad actors will not disclose their use of these tools. Torvalds advocates for treating AI as just another tool in the development process rather than making ideological statements. He emphasizes that kernel documentation should serve good actors and remain neutral, avoiding both the hype and the fear surrounding GenAI technologies. His stance focuses on maintaining high-quality code through existing review processes rather than relying on ineffective policy documentation to filter low-quality, automated submissions.

In this detailed overview, Harald Schäfer, CTO of comma.ai, advocates for companies to build and operate their own data centers rather than relying on cloud providers. He argues that self-hosting fosters better engineering incentives, provides greater control over infrastructure, and is significantly more cost-effective for consistent workloads like ML training—estimating a savings of $20M compared to cloud equivalents. The post details the technical architecture of comma's $5M facility, which features 600 GPUs across 75 in-house 'TinyBox Pro' machines, a custom outside-air cooling system, and 4PB of SSD storage. On the software side, comma utilizes tools like Slurm for workload management, PyTorch for training, and custom open-source solutions like 'minikeyvalue' for distributed storage and 'miniray' for task orchestration. This level of vertical integration allows for efficient model training and rapid code iteration within a streamlined, monorepo-based environment.

Bambu Lab is facing criticism for aggressive legal actions against an open-source developer of an OrcaSlicer fork. The company accuses the developer of impersonation and security risks for bypassing their mandatory cloud-based ecosystem. Critics argue Bambu Lab is violating the open-source social contract and misusing legal threats to suppress users demanding printer ownership and local control.

OpenCode is a privacy-first, open source AI coding agent available as a desktop app, terminal interface, and IDE extension. It supports major LLMs like Claude, GPT, and Gemini, features LSP integration, multi-session capabilities, and GitHub Copilot connectivity, enabling developers to build efficiently while maintaining strict data privacy.

Project Gutenberg is a volunteer-led digital library offering over 75,000 free eBooks. Since 1971, it has provided public domain literature without fees or required registration. The platform relies on community contributions for digitizing and proofreading texts, ensuring accessibility across standard web browsers and eBook readers for global readers.