root@kryptonwolf:~/writing$

writing — september 2026

Research notes from september 2026. The current month, and the essays, live on the writing page.

Open-Registration Spam on Matrix Got Beaten Without Closing the Doors. The Playbook Is a Plugin Now.

A homelab operator ran public rooms on a server with open registration and spent months absorbing a spam campaign — over 6,000 accounts, from several...

The Council Put Excluding Private Messages on the Table. The Condition Is Written Into the Question.

Council document 13158/26, published by Patrick Breyer, shows the Irish presidency asked the 27 ambassadors whether to exclude the scanning of private...

Mastodon Turned Off iPhone Photo Decoding Last Week. The Reason Is a Bug Class Your Whole Stack Shares.

On September 15, Mastodon shipped a four-branch security release — 4.7.2, 4.6.8, 4.5.18, 4.4.25 — whose one security line reads "temporarily disable HEIF...

The FCC Wants to Put a 120-Day Clock on the Permits Your Community Network Is Built On

On August 7 the FCC published a proposed rule that would presume a city has "effectively prohibited" broadband service if it doesn't act on every...

France's Local Governments Launched Their Own Closed Matrix Federation. The Design Choices Matter More Than the Press Release.

On September 14, ADULLACT and the Déclic network launched the Matrix Federation of Local Governments — a closed federation where every municipality runs its...

Gorgeous Broadband: A 25-Year-Old Idle Fiber Loop in The Dalles Just Became a Community ISP

The Dalles, Oregon launched Gorgeous Broadband on September 22 — a community-owned residential ISP running on QLife, a fiber loop the city, county, and PUD...

Southwick Lost the Vote by Fourteen Ballots. So It Built a Pilot With Money It Already Had.

Southwick, Massachusetts fell fourteen votes short of a $16M town-wide fiber build last year — then pivoted to a pilot network funded entirely from money...

KolliCloud Is a Working Answer to the Bus-Factor-One Problem. It Also Refuses to Pretend the Economics Are Solved.

Local-IT's KolliCloud bundles roughly fifteen FOSS apps — Nextcloud, Authentik, Matrix, Vaultwarden, OnlyOffice — behind one sign-on, with backup and...

The Carriers Wouldn't Come. The Colville Tribes Built the Network Anyway. Now There Is a Credible Number on What That Was Worth.

Commercial carriers declined to serve the Colville Reservation in Washington — 1.4 million acres of mountains, too few subscribers, rights-of-way crossing...

The State Can't Order the Scan. So the Scan Went Voluntary. The Decision Now Lives With Whoever Operates the Server.

The sixth political trilogue on the EU Child Sexual Abuse Regulation is confirmed for September 29 — Council document 11501/26 — with an adoption push at...

Keycloak 26.7.4: the Support-Staff Role That Could Become Realm Admin

Keycloak 26.7.4 shipped September 16 with six CVE fixes, sixteen days after the twenty-CVE batch. The one to read twice is CVE-2026-17526: a user holding...

The Demand Went to Cloudflare, Not to the Data Center

In June, the No Gods No Masters cooperative finished a two-year migration off OVH, Ionos, and Linode onto a self-built micro data center — ten servers, a...

€7 Million for the Open Internet Stack — NLnet's Restack Fund Opens Its First Calls

The NLnet Foundation opened the first calls under Restack — the European Commission's €7 million successor to NGI Zero's grantmaking — with the first...

Lehi Fiber's Year One: The Honest Take-Rate Numbers Every Municipal Network Debate Needs

Lehi, Utah's city-owned open-access fiber network published its one-year operating numbers on September 17: 7,000+ subscribers, a 30% take rate, up from 23%...

The EU Data Act Just Made Exit an Architecture Requirement

Two EU Data Act deadlines landed in the same week. September 12, 2026 started the access-by-design obligation: connected products sold into the EU must now...

Nextcloud 35 Ships Today. What It Changes for the People Running It.

Nextcloud 35 "Hub 26 Summer" releases today. The headline for community operators is Nextcloud Teams — one workspace per team with team-owned resources,...

Three German States Are Sharing One Kubernetes Platform. That's the Copyable Part.

Kube3 — eight universities in Baden-Württemberg, Bavaria, and North Rhine-Westphalia building shared Kubernetes-as-a-Service so small IT teams stop having...

Netherlands Is Building a Government Cloud and Publishing the Blueprints

In March 2026 Germany's IT-Planungsrat made the Sovereign Cloud Stack standards binding across every level of German public administration — over 50 named...

Community Networks Already Run on Open Source. The Procurement Has to Catch Up.

A June 2026 Connect Humanity study of Brazil's 11,853 small ISPs found that free and open source software is already the default operating choice for...

MikroTrick: Someone Is Taking Routers Without Passwords. Your Community Network Is Probably the Target.

CERT Polska confirmed active exploitation of a MikroTik RouterOS chain — CVE-2026-67276 (SSH authentication bypass) plus CVE-2026-86060 (crafted-username...

Gitea 1.27.3: The Fork Gate Broke Again, and the RCE You Should Have Patched in July Is Being Exploited

Gitea 1.27.3 (August 29) fixes 26 CVEs in a single patch release — three of them bypasses of the fork pull-request approval gate, the exact control this...

Sovereign AI Is the New Sovereignty Washing

On September 8, Palantir named Nebius its "preferred sovereign AI infrastructure partner" and promised to bring Nebius compute "inside the Palantir...

Six Privacy Bills Are Sitting on the Governor's Desk. One Changes the Math for Every Website You Run.

California's legislature closed its session on August 31 and sent Governor Newsom six privacy and AI bills, including SB 690 — CIPA reform that would strip...

Mastodon's 2FA Bypass Broke the LDAP/SSO Path. If You Patched Keycloak and Stopped, You Stopped One Layer Short.

Mastodon 4.7.1 (September 1) fixed three security holes backported across every maintained branch. The headline bug is blunt: on servers using LDAP, PAM, or...

Slaughter Killed the FTC's Independence. The EU-US Data Deal Is Built on It.

On June 29 the US Supreme Court held the FTC's independence unconstitutional. The EU's adequacy decision relies on that independence 259 times. The decision...

Keycloak 26.7.3: Twenty CVEs in Twelve Days, Two of Them Fixing Fixes

On August 19, Keycloak 26.7.2 fixed the password-reset account takeover this site called upgrade-immediately urgent. Twelve days later, 26.7.3 shipped fixes...

The Three-Year Window: Proxmox VE 7 Root Bypass Was Exploited Before It Had a Name

On September 1, Proxmox published PSA-2026-00043-1: a single HTTP request — no password, no second factor — mints a full root@pam ticket on Proxmox VE 7.0...

Belgium Runs Its Government on a Fork. AGPL Got Us the Code. Nothing Got Us the Funding.

Belgium's BEAM messenger — built for roughly 750,000 civil servants and military — is a fork of Element's AGPL-licensed Matrix stack, and BSC published its...

WhatsApp's Third-Party Chats Went Live. It's Not Federation.

Meta's DMA-mandated third-party chats are finally reaching general Android builds — announced November 2025, two niche partners, one-on-one chats only,...