The default Python interpreter now officially treats RISC-V as a supported platform.

Top Story

The default Python interpreter now officially treats RISC-V as a supported platform. CPython has been added to PEP 11 as a tier 3 target, which means builds on RISC-V hardware are now maintained, tested against real machines, and expected to work — a formal contract rather than a best-effort patch that might rot. It is the kind of quiet, unglamorous commit that matters more than most of the flashier releases in this week’s feed: the world’s most-used programming language has quietly de-risked the open ISA that a growing slice of silicon is betting on.

Tier 3 is worth being precise about. It is not tier 1, where the core developers run the tests themselves and gate releases on passing. It is not even tier 2, which requires automated testing in CI. Tier 3 means the platform is “known to work” — patches that break RISC-V are not merged deliberately, but they are not blocked, either. The maintenance burden is shared with the community rather than owned by the core team. So today’s announcement is a floor, not a ceiling. But it is a real floor: before this, RISC-V was a support surface with no official status in PEP 11 at all, which meant no one was accountable when it broke.

The infrastructure behind the upgrade is the more interesting part. The RISE Project has supplied CPython with several real RISC-V machines running buildbots — actual silicon, not emulation — and those have been catching architecture-specific bugs that only show up on hardware. Ludovic Henry, Furkan Onder, and Emma Smith get named credit, and the work was funded in part through a Sovereign Tech Agency fellowship. That last detail is worth noticing: public-funding bodies underwriting open infrastructure are still rare enough that it deserves a clause, and it is a reminder that this kind of portability work rarely pays for itself.

The roadmap matters as much as the milestone. The maintainer says the next move is bringing RISC-V into CPython’s own CI via RISE’s RISC-V runners, which would catch problems before a patch is merged instead of after — turning tier 3’s “tested on real hardware” into “tested on every change.” Then comes the harder push to tier 2, and after that the genuinely interesting work: architecture-specific optimizations that exploit RISC-V’s vector extension and other capabilities rather than just running on them. Porting is table stakes; tuning is where RISC-V either earns its place or stays a curiosity.

Read the announcement against the rest of today’s edition and a pattern appears. Linux gets carved out of California’s age-verification law, Haiku ships a beta, and CPython lands on RISC-V — the open stack advancing in increments on every front at once. Meanwhile three separate trust-boundary failures landed today: a claimed 820-million-record Alipay leak, a default-root Docker configuration, and a Qubes dom0 escape. Open infrastructure is getting more capable and more attacked at the same time, and this story sits on the capable side.

What this changes is narrower and more concrete than an industry-wide pronouncement. A project that wants to run on RISC-V no longer has to justify the architecture to Python; the compatibility risk has moved from “might not build” to “should work, tell us if it doesn’t.” For engineers evaluating RISC-V hardware, that is the difference between an experiment and an option. The specific thing to watch now is CPython’s CI: if the RISE runners land and RISC-V shows up in pre-merge testing, tier 2 stops being a hope and becomes a question of effort, not infrastructure. That is the single decision that decides how fast the open ISA graduates from “officially supported” to “maintained like the big two.” RISC-V is now officially supported by CPython

Also Today

Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel · Source Qubes Security Bulletin 118 is a dom0 escape that no hardening workaround patches around: a compromised qube can hand a file name straight to the shell inside dom0. The path runs from qvm-copy-to-vm’s error reporting, where sanitize_remote_filename() strips non-ASCII and double quotes but leaves shell meta-characters intact, into display_error(), which builds a kdialog/zenity command and runs it with system(). A qube that sends a malicious last-received filename wins root in the one domain that is supposed to be trustworthy by construction. All releases are affected; the fix lands in qubes-core-dom0-linux 4.3.22. The defensible reading is not that Qubes failed, but that its security model ultimately rests on one string-cleanup function and one unchecked system() call — which is exactly the class of bug that model is meant to contain and only barely does.

California lawmakers unanimously pass Linux exemption from age-verification law · Source California’s AB 1856 passed 39-0 in the Senate and now heads to Newsom, pulling GPL/MIT/BSD/Apache-distributed operating systems out of the Digital Age Assurance Act’s age-verification mandate months before it takes effect January 1, 2027. The carve-out is written as a license test, so Debian, Fedora, Ubuntu, Arch, the BSDs, and GrapheneOS are out of scope, and a second exclusion covers packages installed via apt and pacman. The original “user” definition that classified every California device owner as a child is gone too, and the amendment bans asking for age signals unless law requires it. The line that matters: the exemption does not shrink the law — it shrinks who the law reaches, leaving Windows, macOS, iOS, and Android collecting ages while the open-source stack that resisted quietly walks away.

Creepy Crawlies · Source git.kernel.org now spends 14-16 of its 90 CPU cores just rendering commits as HTML for scrapers, and legitimate traffic is roughly 2% of what hits it. The numbers monsieuricon publishes are the uncomfortable kind: 6M daily requests for random commits, 33% now solving the Anubis proof-of-work that was supposed to be the wall, sourced from residential and mobile proxy IPs that vanish after 4-5 requests. The structural complaint is the sharpest one — these LLM training pipelines clone nothing, instead rendering 1.48M commits across 922 forks into billions of valid URLs, the most expensive possible way to consume data that is already freely clonable. Kernel.org is responding by disabling features and gating anonymous access. The project remains a goldmine for trainers precisely because it is guaranteed pre-AI content, and this post is the honest cost sheet of being the purest corpus on the internet.

Understanding ChatGPT Work · Source Simon Willison’s dissection of ChatGPT Work cuts through the marketing to show it is actually two products, and the cloud one is what matters: model selection across Sol/Luna/Terra, a code-execution container with open internet access, a full headless Chrome that runs Playwright against live pages, a persistent shared /workspace filesystem, and one-prompt deployment to Cloudflare Workers. His own test built a working site cataloguing all 223 registered tools — only discoverable because he asked the agent to enumerate them. He also flags that Work combines all three legs of his lethal-trifecta model — private data, untrusted content, and a way to exfiltrate — with no clear answer from OpenAI on prompt-injection protection beyond the Codex auto-review. The whole piece is an argument that OpenAI could resolve the confusion by publishing the system prompt and tool descriptions, and the fact that nobody can document the product except by interrogating it is the review worth remembering.

Omarchy: Any User Process Can Escalate to Root · Source Omarchy shipped its default user in the docker group, which is root by another name: any process in the user session can ask the root-owned daemon to mount / and read /etc/shadow without a password, sudo, or a prompt. The PoC is two commands — id shows the docker group, and one docker run -v /:/hostroot alpine reads the shadow file. The documentation spun it as running Docker “as the normal user and not as root,” which is precisely backwards, and the tradeoff was opt-out, applied silently to the default account. The fix lands in 4.0.1, with group membership removed in August. The broader point the report lands is the one that should sting: as AI agents run more of our tooling, a default that hands every agent harness root on day one turns an ordinary app compromise into a machine compromise, and distros aimed at developers cannot keep treating the docker group as convenience.

In Brief

• A BreachForums post dated August 24 claims to be holding 820 million Alipay user records — name, phone, gender — as a ~5GB archive, unverified as of this writing. (Source)
• AWS open-sourced Kiro Crew, a system for running multiple Kiro coding agents asynchronously across sessions, tools, and tasks. (Source)
• Cloudflare extended its AI Search to let agents and developers run retrieval over custom data through the same built-in search service. (Source)
• A 12TB Steam “teraleak” surfaced more than a decade of lost PC gaming history, including abandoned Half-Life 2: Episode 3 assets. (Source)
• Haiku R1/beta6 shipped roughly two years after the last beta and a week after the project’s 25th birthday. (Source)
• NASA’s Nancy Grace Roman Space Telescope launched on a Falcon Heavy from Kennedy Space Center to study dark matter and dark energy. (Source)
• A $1 line on Texas car insurance policies funded Flock surveillance cameras, per a Texas Tribune report, even as Governor Abbott moved to block more of them. (Source)
• Apple was caught off guard by AI-driven demand and announced new Mac mini and Mac Studio models on unusually short notice. (Source)
• A British poll found two-thirds of respondents don’t trust the government with their private messages. (Source)
• Claude Code now appends the session URL to commit messages and PR descriptions by default, prompting a GitHub issue over the leak of conversation links. (Source)
• A new open-source Linux driver pushes Silicon Motion’s SM750 GPU to 2048-wide output with bandwidth-saving colour conversion and update optimisations. (Source)
• StemDeck, a free, open-source, fully local AI stem separator, was released. (Source)

One Line

Training an LLM on content produced by the LLM gives it the equivalent of a digital prion disease.

— monsieuricon, on git.kernel.org’s AI-crawler problem (people.kernel.org)