7 min read · 12 sources

AI crawlers have eaten kernel.org. The maintainer running git.kernel.org reports that bots scraping for LLM training data now tie up 14 to 16 CPU cores across five geo-distributed nodes, 24/7, just rendering commits as HTML instead of using a git clone. That is more compute than every legitimate user combined, including clones. The crawlers hit roughly 6 million requests a day, and AI scrapers are an estimated 98% of total traffic.

The asymmetry is the punchline. linux.git sits at about 1.48 million commits, with roughly 922 forks – each fork exposing billions of valid URLs to scrapers, all rendering to HTML. Anubis proof-of-work challenges only partially contain the load, so kernel.org has had to disable expensive anonymous features and reduce crawlable URLs. For anyone running a public web-facing data service, the implication is direct: LLM scrapers can dominate your infrastructure bill through inefficient access patterns, and rate-limiting is no longer optional.

Reaktives HPA konnte GPU-Nodes nicht schnell genug bereitstellen, also sahen Nutzer 15 - 20 % Fehlerraten während eines Traffic-Spikes - und die Lösung war ein Bi-LSTM, das 10 Minuten voraus prognostiziert.

Kubernetes 1.37 makes pod identity finally real

Source: kubernetes.io ↗

Pod Certificates and Cluster Trust Bundles ship as GA in Kubernetes 1.37, replacing service account JWTs as the production-recommended way to identify workloads. The old mechanism was a bearer token – anyone who got a copy could impersonate the workload. Pod Certificates hand out X.509 certs instead, giving pods private keys that never leave the workload and turning pod-to-service auth into mTLS with proof of possession.

No built-in signers ship in core Kubernetes yet. The project has released Tinycert as a third-party signer so teams can experiment before committing. The integration sits in the kubelet and control plane, and node restriction admission still enforces least-privilege token request policies. For anyone running mTLS service meshes, the migration path finally exists in upstream Kubernetes rather than as a SPIFFE/SPIRE sidecar.

ReactOS 0.4.16 ships after 18 months with a real installer

Source: reactos.org ↗

ReactOS 0.4.16 is out after roughly 18 months of work. The headline change is a unified image: a single ISO replaces the old separate bootcd and livecd, and a graphical installer replaces the old text-mode flow. There is also a new Server Core installation mode.

The driver story matters more than the UI. A long-standing Nvidia slowdown – traceable to system PTE exhaustion in the kernel memory manager – is fixed, which is a real correctness fix, not a workaround. A rewritten ExtEscape path resolves AMD OpenGL blanking, and HD audio support is broader. Storage gets asynchronous networking, and the Wine fork has been rebased substantially closer to upstream Wine 10.0. Anyone doing Windows driver portability work or testing win32k.sys stability should look at the release notes directly.

Datadog saves $1M a month on AI by picking a cheaper model

Source: datadoghq.com ↗

Datadog writes that it is saving over $1 million per month on LLM spend, and the headline lever is mundane: the Claude Code default model moved from Opus 4.8 to Sonnet, which costs roughly 60% less on input and output tokens. The switch was validated by measuring agent task performance before rollout, not by vibes.

The surrounding mechanics matter for the rest of us. Datadog’s AI Costs feature in Cloud Cost Management normalizes spend by provider, model, and token category – so per-workflow cost is trackable the same way per-VM cost already is. Guardrails on token budgets, context-window tuning, and agent evaluation harnesses fill out the playbook. The post’s thesis: the same FinOps discipline that worked for EC2 rightsizing works for LLMs, and the savings come from configuration, not from rewriting workflows.

Predictive autoscaling for GPU workloads that HPA cannot save

Source: cncf.io ↗

Two Adobe platform engineers built a predictive autoscaler for GPU pods on Kubernetes after a production incident where reactive HPA simply could not keep up. GPU nodes take 3 to 5 times longer to provision than CPU nodes – firmware, CUDA init, driver load – so when traffic spiked, users saw 15 to 20% error rates before the cluster caught up.

The replacement runs a Go controller every 60 seconds, ingests the past hour of Prometheus metrics (CPU, memory, latency, RPS, NVIDIA GPU utilization), and forecasts demand 10 minutes ahead using a Bi-LSTM. ARIMA, Prophet, and vanilla LSTM were all rejected during evaluation. The architecture splits into Predict, Provision, and Absorb phases – provision pre-warms capacity, absorb lets the model over-correct without thrash. A graduated scaler caps scale-out at 20 pods per minute so the scheduler is not overwhelmed, and a heuristic burst detector backstops traffic shapes the model has not seen. In hackathon validation, 23 of 23 checks passed, with the predictor catching simulated spikes 11 minutes early.

Pulumi Kubernetes 4.34.0 turns CRDs into provider extensions

Source: pulumi.com ↗

Pulumi Kubernetes provider v4.34.0 ships support for Kubernetes 1.37 and a feature that lets any Custom Resource Definition be loaded directly as a provider extension. The flag is pulumi package add kubernetes --extension "name=... crd-manifest=...", and the generated SDK lands in sdks/ under the same provider instance. CRD provisioning now works across all supported Pulumi languages including YAML.

The reference in Pulumi.yaml makes the extension regenerable via pulumi install – you no longer ship generated SDK files in the repo. Existing crd2pulumi users migrate by updating the SDK package name with no stack-state changes. The relevant threshold for anyone using Gateway API, Argo CD, or Crossplane is Pulumi v3.255.0+. The practical win: schematized, autocomplete-supported types for CRDs without a separate codegen step in CI.

Two essays: taste and bug blindness

Source: dustycloud.org ↗

One essay argues that taste in engineering and design is built by practicing the craft directly. The thesis is that LLMs generate statistical means of their training data, and using them as practitioners short-circuits the trial-and-error loop that builds personal style. Offloading work to a model, on this account, accustoms you to the model’s patterns and erodes the judgment you were hoping to deploy against its output. It is opinion, not measurement.

A second makes a complementary point about quality culture. People who work on a system daily learn unconscious workarounds, then mistake their own fluency for the product being good. The author points to hundreds of small issues in everyday software that practitioners stop noticing. Dogfooding helps only if engineers actively call out the adaptations they have made. No version numbers, no benchmarks – but the operational lesson is concrete: rotating fresh testers through a surface, and writing down what they stumble on, catches friction the team has normalized away.

vphone-cli: a virtual iPhone for security research

Source: github.com ↗

vphone-cli boots a virtual iPhone on Apple Silicon Macs using Apple’s Virtualization.framework plus Private Cloud Compute research VM infrastructure. It targets macOS 15+ and the iOS 26.1 IPSW. The CLI automates the full pipeline: IPSW download and merge, boot-chain patching, DFU restore with SHSH, CFW install, and first boot. Five patch variants range from “less” – patchless with four boot-chain patches – up to jailbreak-style variants that bypass more of the security model. SIP and AMFI relaxation are required to use private PV=3 entitlements with unsigned binaries.

The repo exposes a control socket for screenshots, touch input, and clipboard, plus a companion MCP server, which makes it usable for AI-driven end-to-end testing of iOS apps. The toolchain is opinionated: Python 3.13, cmake, ldid-procursus, keystone. Existing vphone users get VM management – create, clone, export, import, with APFS clone for fresh device identity. The Apple Silicon and Xcode/iOS SDK dependencies are real; this is not a general-purpose emulator.

Quick links: checkstyle, Oracle alarms, federal AI renewals

Source: github.com ↗

Checkstyle is an LGPL-2.1 static analysis tool for Java. The example in the README uses checkstyle-10.18.1-all.jar with an XML config enabling the FallThrough TreeWalker check, invoked as java -jar checkstyle-*.jar -c config.xml Test.java, which emits per-line violation messages like [ERROR] Test.java:9:9: Fall through from previous branch of switch statement [FallThrough]. It plugs into Maven or a standalone JAR and runs in CI for naming, formatting, imports, and similar checks.

Oracle’s Kubernetes Default Alarms Quick Start is a configurable cluster and namespace monitoring package delivered through OCI Marketplace and Resource Manager. The pitch is standardizing alerting and routing by team ownership rather than ad-hoc per-cluster rules.

Datadog’s federal AI post is a planning piece for US federal agencies ahead of September 30, 2026, when OneGov introductory pricing expires. OpenAI ChatGPT Enterprise has been $1 per agency, Anthropic Claude $1 per seat, Google Gemini for Government $0.47 per agency. AI Costs in Cloud Cost Management currently tracks Bedrock, Anthropic, Gemini, OpenAI, Vertex AI, GitHub Copilot, and Cursor. The advice is the obvious one: build a unified cost and usage baseline now, model FY27 pricing scenarios, and decide what to renew, resize, replace, or retire before the reset.