Research notes from august 2026. The current month, and the essays, live on the writing page.
On July 9, the European Parliament reversed its own March rejection and extended the ePrivacy derogation — the legal cover that lets platforms scan private...
FITKO — Germany's Federal IT Cooperation — is piloting Neo, a Matrix-based communication infrastructure for government-to-citizen (G2C) exchanges....
Mecklenburg-Vorpommern is replacing Microsoft SharePoint with a self-hosted Nextcloud deployment running on AGPLv3 software. 5,000 public-sector workers are...
Bill C-22 compels interception capability. Bill C-36 reformulates privacy obligations. Bill C-34, the Safe Social Media Act, is the third leg: it creates a...
Keycloak 26.7.2, released August 19, fixes CVE-2026-18963 — a CVSS 9.1 unauthenticated account takeover via password reset state validation bypass. An...
Canada's federal private-sector privacy law has been PIPEDA since 2000 — a law written before smartphones, social media, and modern data brokering. Bill...
NYC Mesh received $898,000 from New York State to expand its volunteer-run mesh network into Central Brooklyn, where 25% of households lack internet access....
In September 2026, two incident reporting regimes land within weeks of each other. The EU Cyber Resilience Act's vulnerability reporting obligations take...
In 2016 Microsoft built Azure Germany — a sovereign cloud where Deutsche Telekom held the keys and Microsoft's own staff couldn't get in. It was the most...
Proxmox VE 8.4 receives its last security updates in August 2026. The upgrade path to 9.x runs through pve8to9, and 9.2 is the version worth landing on —...
Nextcloud Hub 26 Spring shipped Euro-Office 1.0 on June 9 — a browser-based office suite built on a clean-room OOXML implementation by a European tech...
On July 23, 2026, India's cybercrime agency gave GitHub three hours to remove three BitChat repositories. The notice named no illegal content — it targeted...
On June 15, 2026, the federal government introduced Bill C-36, the Protecting Privacy and Consumer Data Act. If enacted, it replaces PIPEDA — Canada's...
AWS spent €7.8 billion building a "European Sovereign Cloud" in Brandenburg — a German GmbH with EU staff, euro billing, and separate certificates. It's...
On June 12, 2026, the US government ordered Anthropic to cut off foreign access to Claude Fable 5 and Mythos 5. Anthropic couldn't verify nationality in...
OpenStack 2026.1 (Gazpacho) shipped April 1 — the 33rd release from a community of 500 contributors across 100 organizations delivering 9,000 code changes....
On July 17, the Hoopa Valley Public Utilities District opened a data center on tribal land in Humboldt County, California. The facility houses the...
On August 12, researchers confirmed active exploitation of CVE-2026-59310 — a CVSS 9.8 directory traversal in VMware vCenter's Syslog server. APT actors...
On August 2, 2026, Article 50 of the EU AI Act became enforceable. The high-risk obligations got delayed to December 2027 — but transparency, GPAI...
FOSSY 2026 ended August 9 in Vancouver. The Software Freedom Conservancy's fourth annual conference surfaced three themes that matter for community...
On August 5, five teams in the Rust project adopted a policy governing LLM use in contributions to rust-lang/rust. The line is narrow and specific: LLMs are...
As of August 2026, 19 US states have comprehensive consumer privacy laws. There is no federal privacy law. Three new state laws took effect January 1...
Oracle is halving its Always Free ARM tier on August 18 — 4 OCPU / 24 GB becomes 2 OCPU / 12 GB, and anything over the new limit gets terminated...
Proxmox VE 9.2 shipped official Arm64 support on August 5 — full feature parity across KVM, LXC, ZFS, and Ceph, best-effort on UEFI-based ARMv8 hardware,...
Shared Services Canada's 2026-27 Departmental Plan names "Digital Sovereignty" as one of three key priorities. $2.36 billion in planned spending. A...
Keycloak 26.7 shipped SCIM user provisioning, Shared Signals Framework for real-time security events, AuthZen for standardized authorization, MCP...
The enterprise security market is shaped by two interlocking gatekeeping systems — analyst rankings and compliance certifications — that often reward...
On September 11, 2026, the EU Cyber Resilience Act's first compliance deadline lands. Manufacturers of products with digital elements placed on the EU...
A category-by-category inventory of Canadian sovereign cloud infrastructure finds no Canadian CDN, no Canadian DBaaS, no Canadian DNS, no Canadian...
Matrix federation works technically, but most users are on matrix.org. The Homeserver Decentralisation Working Group just graduated to official Foundation...
Matrix 1.19 shipped July 8 with encrypted room history sharing (MSC4268) and custom emoji (MSC2545). Encrypted history sharing was removed five years ago...