Last year, my position was that we still had time to design PQ authentication mechanisms.

Now, based on the pace of progress and on statements like Google's, I believe:

1. we need to finish rolling out PQ key exchange yesterday
2. we need to start rolling out PQ auth now
3. it's too late to ship any new non-PQ design or system

https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/

> builds a GRUB replacement in 2016
> spends 5 years breaking GRUB piece by piece
> strips LUKS encryption from /boot "for security"
> proposes to remove: btrfs, xfs, zfs
> keeps SquashFS, two CVEs, one rated 7.8 HIGH
> controls the signing keys for all of it
> Canonical promoted him.

https://www.sambent.com/canonicals-grub-saboteur-has-a-10-year-plan

If you are traveling to or through Hong Kong, here is a new thing to consider when you are deciding whether or not to take your devices with you and how you should set them up.

https://hk.usconsulate.gov/security-alert-2026032601/

RE: https://social.treehouse.systems/@wwahammy/116264430375745593

I want everyone who says "this is the law, distros need to comply" I want you to explain a plausible set of circumstances to lead to the following:

* That the AG of California will sue a random Linux distro which has effectively no money
* Prove who the OS distributor actually is (is it the committers? Committers of what part? Their bank account with $12 in it?)
* Prove by preponderance of the evidence how many children used the OS in order to set the fines
* get a judge and jury to think this isn't a massive waste of their time
* That it isn't just a violation of the law but is a "negligent" or "intentional" violation
* all the while, the OS maker and everyone else having effectively zero knowledge of who uses it since there's no continuing relationship with users.

How does all of this happen?