Free, Libre, and Open Source Software Leftovers

posted by Roy Schestowitz on Aug 26, 2026

• Jim Nielsen ☛ Have You Heard the Good News About Microlighter?

  Dave Rupert wrote about shipping microlighter: a tool for handling syntax highlighting using the CSS Custom Highlights API. I saw his post the day he released it, and I had an implementation PR up for my blog by end of day.

  Then, like I do with so many things, I let it sit there.

• James Cherti ☛ Configuring Emacs Eglot for Optimal Performance

  Eglot ships with Emacs as a built-in, lightweight LSP client, and its default configuration is sufficient for most projects. However, working with large codebases can cause noticeable latency. When Eglot becomes sluggish, the problem may involve work performed by Eglot and Emacs as well as the language server itself. JSON-RPC event logging, filesystem watching, diagnostics, completion, and other editor activity can all contribute to latency.

  This article covers practical changes for keeping Eglot responsive when working with large projects.

• James Cherti ☛ Copy-paste without Emacs org-mode or markdown-mode formatting bleeding into other buffers

  When text is copied from an org-mode or markdown-mode buffer and pasted into another Emacs buffer, its visual formatting can sometimes follow it. For instance, text displayed with a particular color, background, or font weight in an Org or Markdown buffer can retain that appearance after being inserted into a Python buffer.

  This can be undesirable because the inserted text may then display with the source buffer's face text property instead of relying on the destination buffer's normal font-lock or syntax highlighting.

• Andrew Nesbitt ☛ Hardening the Override Flag

  I’ve been reading through the recent run of incidents where package-manager infrastructure was the attack surface, as one does on a Sunday afternoon. One question I kept coming back to was whether the tools have any defences at the flag and config level. Every package manager has an override that turns off a check: --allow-unauthenticated, --break-system-packages, --ignore-scripts, an env var that points the resolver at a different registry. If a compromised install script can pass those as easily as a person at a keyboard can, the check does very little. So I went looking at how command-line tools more generally handle their dangerous overrides, sudo and curl and rm and the rest, and the catalogue got long enough to write up on its own.

• SaaS/Back End/Databases

  • PostgreSQL ☛ pg_statviz 1.2 released with PostgreSQL 19 support and new features

    Just in time for the PostgreSQL 19 betas, I'm excited to announce release 1.2 of pg_statviz, the minimalist extension and utility pair for time series analysis and visualization of PostgreSQL internal statistics.

  • Tyler Hillery ☛ I love SQL; I Hate SQL

    SQL. You either love it or you hate it.

    I fall in the love camp. My introduction into coding was through SQL. Everyone has their native language they think in and mine is SQL.

• Education

  • APNIC ☛ AI, IPv6, and the future Internet at IETF 126

    IETF 126 welcomed 1,230 on-site participants and 672 remote attendees, setting a new attendance record. The sessions I attended focused mainly on Working Group and Birds of a Feather (BoF) discussions covering IP addressing, DNS operations, and AI.

    From the sessions I attended, consensus is gradually emerging across discussions in the IPv6 Maintenance (6MAN), Distributed Mobility Management (DMM), DNS Operations (DNSOP) Working Groups and the Internet Architecture Board (IAB) Open Meeting: IPv6 and DNS will play increasingly important roles in the AI era. IPv6 provides the addressing scale needed for large-scale AI deployments, while DNS remains essential for service discovery and connectivity.

  • Bruce Schneier ☛ Black Hat State of Security Vendors

    Andy Ellis has a roundup of the security vendors at Black Hat this year.

  • Duha Inc ☛ State of Security Vendors: Blackhat 2026 - Duha

    We have entered into an AI world. While nearly half of booths didn’t directly mention AI or agents in their taglines, the effects of AI are everywhere. Multiple spaces (Identity, SaaS, AppSec, Data) have almost every vendor leading with AI; existing unsolved problem areas just got worse.

    At the same time, there’s a clear trichotomy in the market: tools that tell you how bad things are; tools that stop adversaries, and tools that prevent problems from occurring. While you’d suspect that the tools that fix things would dominate, the tools that merely tell you how bad things are seem to be frustratingly plentiful.

• Licensing / Legal

  • Tom MacWright ☛ Placemark is now fully open source

    The big upside here is that this makes Placemark cleanly open source: all of its dependencies have proper open source licenses like MIT, ISC, Apache-2.0, BSD-3-Clause, or similar[2]. Mapbox GL's license is not open source and requires the developer to have a Mapbox account and follow their Terms of Service. So: you can now fork Placemark and build cleanly-licensed open source applications on its codebase. I recommend it!