AI-generated patch spam killed AppleTalk, AI agents are blamed for misrouting incidents, and a 70-year pattern says the ‘no more code’ promise won’t land any differently this time.
- Linux drops AppleTalk – AI-generated patch spam forced the issue — Phoronix · Jun 17
Linux 7.2 removes AppleTalk’s ~4,000 lines of kernel networking code, with Jakub Kicinski citing a burst of AI-generated patches that nobody was reviewing as the final push to drop it. AppleTalk has been dead since Apple killed it in macOS 10.6 back in 2009, so there’s no practical loss here – but the removal mechanism is notable: AI patch spam is now actively accelerating the cleanup of legacy code by making the maintenance cost visible. The uAPI headers stay for now to reduce controversy. Code moves to github.com/linux-netdev/mod-orphan for anyone still curious. This follows Linux 7.1 similarly dropping ARCnet, ISDN, and ham radio drivers for the same reason, so expect AI-generated noise to keep surfacing neglected subsystems as removal candidates. - Is a codeless future an illusion? — Thoughtworks · Jun 15
The “AI will eliminate code” narrative is the latest in a 70-year cycle of predictions – COBOL for executives, 4GLs for non-programmers, visual UML diagrams – none of which eliminated code, they just changed what it looks like. The core argument here: making a natural language prompt precise enough to correctly specify a complex system means you’ve written a specification, and an unambiguous specification is, by definition, source code. Yes, tools like Copilot and Cursor let engineers complete coding tasks up to 55% faster, but writing is a small fraction of the job – someone still has to read, validate and own those 500 AI-generated lines, and hiding source code behind a generation layer removes the audit trail for security flaws and license compliance. The more realistic outcome is a division of labor: humans govern architecture and domain model, AI handles boilerplate and test generation, and version-controlled source code stays the binding contract between intent and execution. - Your AI agent just blamed the network team. Now what? — LeadDev · Jun 15
AI diagnostic agents are moving into production incident response – autonomously querying network configs, app logs, database metrics, and cluster state to identify root causes across team boundaries, without the 3 am politics that let senior engineers deflect blame onto whoever’s easiest to bully. The author, two years into deploying multi-agent RCA systems at a large enterprise, argues the technical architecture is the easy part: the harder problems are credential scoping, blast radius controls, and getting organizational buy-in from every team whose infrastructure the system will query before you turn it on. The key practical frames: start read-only in shadow mode for at least 30 days, never grant write access until accuracy is proven across real incidents, and treat every investigation as generating a full reasoning trail – a directed graph of hypotheses tested, evidence weighed, and dead ends logged. Without that trail, the system is a black box, and operations teams won’t trust a black box with their production environment. The progression from shadow mode to limited automated remediation is described in three phases, with the author’s observation that most orgs stall between phases one and two – and that rushing phase three risks a trust failure, not just a technical one. - Sandbox AI coding agents with microVMs on Fedora Linux — Fedora Magazine · Jun 15
Running AI coding agents like Claude Code or Codex unattended on your workstation is risky – they’ll happily poke around your production cluster over kubectl or SSH, and prompt injection attacks are a real concern. Containers share the host kernel, so a kernel privilege-escalation vuln breaks that boundary; microVMs give each agent its own kernel via a hypervisor, which raises the bar meaningfully without much added friction. This walkthrough uses Fedora’s native podman with the crun-krun runtime (`dnf install crun-krun`), where you pass `–runtime=krun` and podman silently boots each container as a microVM – startup is in the hundreds of milliseconds. The article covers a full working setup for a Python/uv project using podman-compose, including the UID/GID translation and SELinux volume labels (`U,z`) that trip people up, plus a wrapper script that reduces per-project setup to three commands: init, build, run. A few gotchas: the default CPU/RAM allocation is too small and will OOM; libkrun must be >= 1.8 for Enter-key handling; and the USER Dockerfile directive is ignored at boot, so you need an entrypoint to switch users. The author is explicit that microVMs aren’t bulletproof – for genuinely dangerous workloads, use a full VM. - LivePerson cut Logstash costs by more than half by benchmarking GCP machine types — Elastic Blog · Jun 16
LivePerson’s observability team benchmarked five GCP machine types for their Filebeat → Kafka → Logstash pipeline and found that switching from the default e2-standard-2 to n4d-standard-2 (AMD Milan) cut cost-per-event from $5.95 to $2.70 per 1,000 EPS – more than halving processing costs at roughly 25% higher monthly instance price. The n4d also delivered 100%+ throughput improvement on Logstash, meaning fewer instances are needed, which shrinks the required Kafka partition count and the cluster itself. On the Kafka side, swapping GZIP for LZ4 compression added independent throughput gains on both producer and consumer paths. The AMD vs. Intel split within the same e2-standard-2 machine type also produced operationally significant differences, which matters because e2 instances don’t pin to a CPU platform. The team’s broader point: cloud instance families age out of competitiveness quietly, so benchmarking throughput-per-dollar periodically – not just at initial deployment – is where the real cost leverage sits. These results are GCP-specific; AWS and Azure would need their own benchmarks.
// In other news
ai
- GLM-5.2: Built for Long-Horizon Tasks (Hugging Face Blog) · Jun 17 — GLM-5.2 targets long-horizon agentic tasks and claims the top spot on frontend coding benchmarks – worth running against your own evals before trusting the leaderboard.
- Predicting model behavior before release by simulating deployment (OpenAI Blog) · Jun 16 — OpenAI’s Deployment Simulation replays real conversation data to predict model behavior pre-release, potentially reducing the gap between red-teaming and production failure modes.
- datasette 1.0a34 (Simon Willison) · Jun 16 — datasette 1.0a34 ships a significant new feature in the release notes – concrete alpha progress toward 1.0 from a project that’s been in alpha for years.
- Quoting Georgi Gerganov (Simon Willison) · Jun 16 — llama.cpp author Georgi Gerganov attests Qwen3.6-27B is genuinely capable for local coding tasks after 1.5 months of daily use – practitioner signal worth more than most benchmarks.
- The Fable 5 Export Controls Harm US Cyber Defense (Simon Willison) · Jun 16 — Security researchers argue US AI export controls actively weaken domestic cyber defense by restricting access to open models needed for offensive-tool research and red-teaming.
cloud
- Amazon S3 annotations: attach rich, queryable context directly to your objects (AWS News Blog) · Jun 16 — S3 Annotations lets you attach up to 1 GB of mutable, queryable metadata directly to objects – designed for AI agent workflows that need to discover and filter objects without reading object content.
- Cloudflare DMARC Management is now generally available (Cloudflare Blog) · Jun 16 — Cloudflare DMARC Management is now GA and free for all customers, adding unified SPF/DKIM/DMARC reporting and record analysis to push domains toward full enforcement.
- Introducing Brazos: Bringing liquid cooling to air-cooled data centers (Google Cloud Blog) · Jun 16 — Google’s Brazos system retrofits liquid cooling into existing air-cooled data centers for chips exceeding 1000W TDP – relevant context for anyone evaluating GPU hosting costs for the next hardware generation.
- Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing Artificial Intelligence, Cyber, Medical, and National Defense Research (Google Cloud Blog) · Jun 15 — Google Threat Intelligence documents a China-nexus actor systematically targeting US medical research, AI, and defense-adjacent organizations – specific enough to drive a threat-hunt against your own telemetry.
- How Atlas scales hundreds of merchant databases with Cloud SQL Enterprise Plus edition (Google Cloud Blog) · Jun 16 — Atlas runs hundreds of per-merchant Cloud SQL databases on Enterprise Plus edition – a concrete multi-tenant isolation pattern worth reading if you’re evaluating database-per-tenant versus shared schemas.
culture
- Building Reliable Agentic AI Systems (Martin Fowler) · Jun 16 — Bayer’s engineering team documents patterns for building reliable agentic AI systems in production, covering failure modes and mitigation strategies from a named enterprise deployment.
- The New EU Open Source Strategy is the Best in the World, but Where Should the Commission Start? (SUSE Blog) · Jun 16 — The EU Cloud and AI Development Act co-legislative process has started; SUSE argues the new open source strategy is the strongest globally but the Commission needs a concrete implementation roadmap now.
- AI models can disappear overnight. Is your engineering team built to survive it? (LeadDev) · Jun 17 — Model deprecation is accelerating and teams that hard-code provider APIs without abstraction layers are one sunset notice away from an incident – concrete architectural advice for reducing that exposure.
dev
- AI agents expose the security checks you never actually wrote (Stack Overflow Blog) · Jun 15 — Attackers compromised 20,000 Instagram accounts by exploiting missing authorization checks in Meta’s AI – a concrete case study for why agentic systems surface auth gaps that human UIs obscure.
iac
- Introducing tfctl: The CLI for HCP Terraform and TFE (HashiCorp Blog) · Jun 16 — tfctl is HashiCorp’s first dedicated CLI for HCP Terraform and Terraform Enterprise, exposing the full platform API for scripting and AI agent integration without the web UI.
- What’s new with Terraform + Ansible (HashiCorp Blog) · Jun 16 — Terraform Ansible Collection 2.0 and pyTFE land together, aimed at teams managing infrastructure lifecycle across both tools without duplicating state or provisioning logic.
k8s
- From data residency to digital sovereignty: Architectural patterns for cloud native platforms (CNCF Blog) · Jun 16 — Concrete architectural patterns for cloud-native data sovereignty compliance under EU Data Act and NIS-2, grounded in requirements that have been fully applicable since January 2025.
- Blog: Spotlight on SIG Storage (kubernetes.dev) · Jun 15 — SIG Storage 2026 spotlight covers current priorities and in-flight work for Kubernetes storage – useful orientation before hitting the KEP tracker directly.
linux
- Linux 7.2 Adds Ability To Limit Programs To Only Open Regular Files, Avoid Being Tricked Or Doing Silly Things (Phoronix) · Jun 16 — Linux 7.2 adds OPENAT2_REGULAR to openat2, letting programs restrict themselves to regular files only – a sandboxing primitive useful for hardening file-processing daemons.
- Linux 7.2 Improves Anonymous/Unnamed Pipe Performance For Shell Pipelines & More (Phoronix) · Jun 16 — Linux 7.2 improves anon_pipe_write throughput for shell pipelines and inter-process communication – measurable gains on pipe-heavy workloads like log processing and build systems.
- Btrfs Now Enables Large Folios By Default, Lands Huge Folios With Linux 7.2 (Phoronix) · Jun 16 — Btrfs enables large folios by default in Linux 7.2 and adds huge folio support, reducing memory management overhead for large sequential reads on CoW workloads.
- Linux Enacts Guidance To Tighten Acceptance Of New File-Systems Into The Kernel (Phoronix) · Jun 16 — Linux kernel docs now codify stricter acceptance criteria for new filesystems, explicitly targeting poorly-maintained submissions that accumulate technical debt in the VFS layer.
sec
- Threat tactic spotlight: Subdomain takeover (AWS Security) · Jun 16 — AWS walks through subdomain takeover via dangling DNS records – a consistently underrated attack vector that affects any team that deletes cloud resources without cleaning up CNAME entries.
- Flock Cameras Are Being Used for Stalking (Schneier on Security) · Jun 16 — Police officers in a dozen-plus US cases have used Flock surveillance camera network access to stalk individuals, raising direct questions about access controls and audit logging in shared law-enforcement platforms.
web
- What’s new in Gutenberg 23.4? (June 17, 2026) (Make WordPress Core) · Jun 17 — Gutenberg 23.4 lands media refinements and developer-facing API changes – worth scanning before it rolls into a WordPress core release.
- LaraOwl: Self-Hosted Monitoring for Laravel Applications (Laravel News) · Jun 15 — LaraOwl is a self-hosted monitoring package for Laravel that keeps application telemetry on your own infrastructure rather than a SaaS third party.
- Subscriptionify: Feature-Based Subscription Management for Laravel (Laravel News) · Jun 15 — Subscriptionify adds feature-flag-based subscription gating to Laravel apps, letting you tie plan limits to named features rather than hardcoded tier logic.
Dropped AppleTalk, sandboxed the agents, halved the Logstash bill — small wins add up. See you tomorrow.

Leave a comment