Freedom.Tech
A daily intelligence desk for practical freedom technology.
Bitcoin, Lightning, Nostr, privacy, AI, self-hosting, open hardware, and security updates. Powered by foundation.xyz
VeröffentlichungenPublications
The eMudhra CA distrust cycle keeps surfacing days after it first appeared: ntfy, Paperless-ngx, and openclaw all ship this cycle rejecting or replacing the compromised intermediate, spanning monitoring, document management, and AI tooling. Three releases carry explicit security flags, Bisq's Tor update, Uptime Kuma's cert and SSL fixes, DAVx5's account-creation exception handling, but the broader 46-item day is dominated by dependency and toolchain bumps rather than new capability. AI remains the largest single beat at 13 items, still no model releases, mostly SDK, CLI, and runtime patches. Bitcoin and Self-hosting trail at 10 each, Privacy at 9. Read today as continued infrastructure hardening against last week's CA incident, not a day of feature shipping.
Four flagged security releases headline a 49-item day, but the more telling pattern runs underneath them: Immich, ESP-Miner, and NodeGuard all ship patches this cycle distrusting or replacing compromised eMudhra CA intermediates. That is a supply-chain trust issue touching self-hosted photo storage, Bitcoin mining firmware, and node infrastructure at once, independent of beat. Layer on the four CVE-driven patches in Taproot Assets, FreshRSS, Karakeep, and Coolify, and the day reads as cleanup, not capability. AI stays the single largest beat at 12 items, all routine SDK and CLI bumps with no model releases. Bitcoin and Self-hosting trail at 10 apiece, Privacy at 12. The operative move today is patching, not evaluating new features.
Privacy and AI split the day almost evenly, 11 releases apiece, together making up two-thirds of the wire. Most of it is routine point-release traffic: browser rebases, changelog bumps, SDK patch fixes. The one item that demands attention sits in Bitcoin, where Bitkey ships a flagged security update. Eclair also lands a patch release described as security hardening. Nostr and Bitcoin otherwise stay thin at four and three items respectively, and a single EFF court-victory note on OPM data disclosure is the only policy story. Nothing here reads as a capability launch; skim for the Bitkey and Eclair patches, treat the rest as maintenance.
Six self-hosting releases, from Paperless-ngx to Miniflux to StartOS's SDK and CLI, edge out seven AI items as the day's heaviest beat, but nothing here is a new capability push. The pattern holds across beats: point releases and bug fixes, not features. FreshRSS bills itself explicitly as a security and bug-fix continuation. Privacy logs five updates including Mullvad Browser rebasing onto a new Firefox ESR and a Signal Android cosmetic bump. Bitcoin stays thin at three items, led by a Ride The Lightning release addressing multi-node session correctness. Two policy filings, from Coin Center on stablecoin rules and EFF on ALPR warrants, round out the wire. Skim for anything in the self-hosting stack; little else demands action.
Six of sixteen releases come from AI tooling, but every one is plumbing: inference runtimes, coding agents, and SDKs getting point bumps, not new weights. Self-hosting logs four releases including a Syncthing release candidate and a Gitea point release. Nostr sees three minor updates. The one Bitcoin item, a Fulcrum maintenance release, and the lone Privacy entry, an Obtainium patch, round out a day with no security advisories and nothing urgent. Skim for anything running these stacks; nothing here demands immediate action.
The week's dominant signal was a privacy-tooling refresh cycle rather than a single crisis: Tor Browser 15.0.25, Mullvad Browser 15.0.25, Tails 7.15, and haveno 1.11.0 all rolled out the same underlying Tor security fixes within a four-day span, while a 16.0a14 alpha already points at the next cut. Bitcoin's 24 stories carried the week's sharpest patch-now items, Bisq 2 and JoinMarket-NG both shipped security hardening tied to audit findings, a pattern distinct from last week's self-hosted-app cluster. Self-hosting added its own patch-now entry with Pi-hole 6.5 closing a high-severity command-execution advisory. AI again led on raw volume at 61 stories, dominated by incremental llama.cpp builds, Cline point releases, and langchain dependency bumps that are now routine rather than newsworthy. Nostr stayed the quietest beat at 16 stories, mostly client and relay patch releases. ntfy's rollback-and-fix cycle (2.30.0 to a broken 2.31.0 to a repaired 2.31.1) stood out as the week's one operational misstep worth flagging.
One real security story today: Pi-hole 6.5 closes a high-severity command execution hole tied to crafted PIDs, the kind of bug self-hosters should not sit on. Everything else is volume without weight. Nine of fifteen releases are AI tooling, point bumps across Ollama, Claude Code, llama.cpp, and assorted SDKs, none touching models themselves. Nostr and Privacy each log two minor patch releases. Self-hosting gets one long-overdue Karakeep update alongside the Pi-hole fix. Read the list for the Pi-hole advisory; skim the rest.
AI tooling dominates the wire again, fourteen of thirty-seven releases, but almost all are point bumps to agent SDKs, CLIs, and inference runtimes rather than anything model-level. The notable security work sits outside AI entirely: OnionShare patches a symlink-disclosure flaw and Element Web strips support for a message-link vector abused for spoofing. Privacy remains the second-largest beat with nine releases, mostly routine client updates across Bitwarden, Standard Notes, and Element X iOS. Bitcoin and self-hosting round out the day with incremental fixes, none carrying disclosed vulnerabilities.
Seventeen of today's 41 releases come from AI tooling, mostly agent SDKs, inference runtimes, and CLI point bumps with no security or model-weight significance. The item worth acting on sits in self-hosting: Paperless-ngx 3.3.2 fixes a disclosed vulnerability (GHSA-c8f3-pqr2-rr24) and is flagged as a recommended upgrade for all users. Eclair 0.14.4 also carries security hardening from an external audit project, Loupe, though it reads as preventive rather than urgent. Privacy stays the second-largest beat with a dozen client and firmware updates, Tor Browser alpha, MeshCore firmware, Bitwarden's four Android and desktop builds, none disclosing vulnerabilities of their own. Nostr and Bitcoin round out the day with routine version bumps.
AI dominates the wire count again, sixteen releases against single digits everywhere else, but almost all of it is routine point bumps across agent SDKs and inference tooling. The one release that actually matters sits in Bitcoin: Bisq 2 2.1.14 patches vulnerabilities found in a recent security audit alongside a Tor security backport. Privacy and Nostr contribute a steady run of client updates, Session Android, Mullvad Browser, Amber, Amethyst, none carrying security weight of their own. Self-hosting stays quiet with small fixes to Immich, DAVx5, authentik and n8n. The pattern holds from recent days: AI supplies the volume, Bitcoin supplies the one line worth reading closely.
AI again tops the volume count, fifteen releases, but the actual news sits in two security-grade patches elsewhere. JoinMarket-NG ships maker coin-selection fixes and security hardening, while Bitkey posts a dated app update. Privacy carries the next-largest block, led by Tor Browser 15.0.25 and a same-day Tails 7.15 pickup of that build, plus a Qubes OS advisory tied to upstream Xen. Self-hosting and Bitcoin round out the day with routine point releases. The pattern: AI supplies the bulk, security supplies the stakes.
No single disclosure anchors the day. AI posts the highest count again, seven releases, but it is the same pattern as before: agent frameworks, inference engines, and model-profile bumps, nothing resembling a new model. Privacy runs close behind with six releases spanning messaging, note-taking, and podcast clients, mostly routine point updates. Bitcoin stays thin at four, mixing wallet feature work with maintenance patches. Nostr clients ship five updates, none individually notable. The read here is breadth without depth, a maintenance day across every beat rather than a story that forces attention.
AI again tops the count, eight releases, but the pattern repeats from before: agent tooling and inference plumbing, no new models. The more notable thread sits in Nostr, where rx-nostr ships two separate beta releases the same day, a redesigned v4 API and a relay-interface rename, alongside Amethyst and Mostrix point bumps. Privacy and Self-hosting round out the day with routine patches, including one filesystem access fix in SilverBullet. Bitcoin stays thin at two releases, both maintenance-branch work. Nothing here forces attention on its own; the signal is cadence across beats rather than any single disclosure.
Four self-hosting staples shipped "patch now" security fixes in a tight three-day window: Duplicati 2.4.0.1, Radicale 3.8.3, Vaultwarden 1.37.4, and FreshRSS 1.30.1. That is a different shape than last week's cross-stack patch wave. This time the cluster sits entirely inside the self-hosted application layer, backup, calendar/contacts, password manager, RSS reader, the tools operators run behind their own reverse proxies. AI again led on raw volume at 63 stories, with llama.cpp cutting four backend-specific builds and the LangChain family pushing five dependency-bump releases, a pattern now familiar enough to treat as background noise rather than signal. Bitcoin's 26 stories were notably thin on headline drama but carried real substance underneath: Fedimint shipped a gateway security release addressing a fund-loss bug in LNv2 payment handling, then backported the same hardening to its 0.11 line, while Core Lightning's 26.06.9 fixed vulnerabilities from responsible disclosure alongside a gossip regression. Nostr stayed quiet at 10 stories, mostly routine client patches. Policy coverage from EFF continued at a steady clip, tracking age verification and donor-advised-fund transparency rather than any acute enforcement action.
AI leads volume for the second straight day, six of seventeen releases, but every one is agent tooling or inference-server plumbing rather than a model drop. The rest of the day scatters thin: Privacy carries four point releases, Bitcoin and Nostr two apiece, Self-hosting one. Nothing here rises above routine maintenance, no disclosed CVEs, no protocol changes worth flagging on their own. The pattern is cadence, not content: teams shipping their regular point bumps on a Sunday with no single story forcing attention.
The notable item today sits outside the usual release cadence: the Tor Project published a statement on its funding relationship with Mullvad following concerns over a co-founder's political donation. Everything else is routine maintenance. AI again leads volume at nine releases, mostly coding-agent and SDK point bumps with no new model weights. Bitcoin's six releases run from wallet patches (ZEUS, Ledger Live, Nunchuk) to protocol-adjacent beta work (Fedimint). Self-hosting and Nostr each round out the day with incremental fixes. Two security-flagged items, ZEUS and Uptime Kuma, carry dependency and hardening updates rather than disclosed vulnerabilities.
Thirteen of today's 32 releases come from AI, mostly coding agents and SDK point bumps, Claude Code, Qwen Code, MiniMax Code, LangChain packages, none carrying a new model. Privacy runs a close second at eight, led by routine client updates across IVPN, Signal, Vanadium, and Element Web. Bitcoin's six releases skew toward tooling and research rather than wallets: Arkade's TS SDK pair, BDK FFI bindings, a Fedimint beta, and a Delving Bitcoin write-up on multi-layer HTLC routing. No security advisories today. The pattern holds from recent days: volume concentrated in agent tooling and SDK maintenance, with the substantive work sitting in Bitcoin's protocol-research corner rather than in shipped product features.
One real security story today: Radicale 3.8.3 fixes an auth flaw where rights and user groups weren't cleared before a conditional set, reported under FO-RAD-2026-001. Everything else is volume. AI leads the beat count with 12 releases, nearly all agent-tooling and SDK point bumps rather than new models. Self-hosting runs close behind with 11, a mix of sync, media, and PaaS updates. Bitcoin and Nostr stay quiet at three releases apiece, no notable hardening or protocol work in either.
AI dominates the count again with 15 of 38 releases, but the pattern holds from recent days: SDK bumps, agent-tooling patches, and changelog diffs rather than model drops. The one genuine model entry, Hugging Face Transformers' EmbeddingGemma 2 addition, sits apart from a long tail of coding-agent and client updates. Bitcoin's six releases lean toward hardening, with BTCPay Server closing an SSRF gap and Fedimint backporting gateway payment-path fixes to its 0.11 line. Privacy and Self-hosting round out the board at six each, spanning wallet UX, sync clients, and a self-hosted PaaS update. No single story outweighs the volume itself: a wide, shallow day across every beat.
Three advisory-driven patches lead the wire: Vaultwarden, FreshRSS, and Bitkey App all ship security fixes today, a rare cluster of hardening work landing in the same cycle. Around them, AI again posts the highest count on the board with a dozen releases, but the pattern from recent days holds: SDK bumps, agent tooling, and changelog-only diffs rather than new weights. Self-hosting is the volume leader at ten releases, spanning calendar apps, document managers, and sync tools. Bitcoin and Nostr stay light, with payjoin tooling reaching a first stable CLI release worth noting on the Bitcoin side.
AI dominates the wire, with five of seven releases touching inference and tooling plumbing rather than new model weights. vLLM lands a major version bump with 717 commits, InvokeAI ships a breaking database migration, and llama.cpp tunes CUDA kernels. Nostr and Privacy each contribute a single point release. Nothing here is a model drop; it is the scaffolding around them, upgrade paths, permission fixes, and kernel tiling.
Four "patch now" releases landed in a single stretch, touching four different trust boundaries: a Bitcoin wallet gateway (openclaw 2026.8.34), a router's management interface (StartOS StartWRT 1.2.1), a decentralized exchange client (Bisq 1.10.9, fixing audit findings plus a Tor bump), and a Lightning mobile wallet with a cross-device warning (ZEUS 13.2.2). That is a wider spread across the stack than most weeks produce in one batch. AI held volume leadership at 48 stories, but the pattern repeats from prior weeks: llama.cpp ran eight-plus nightly builds on backend-specific fixes, and Anthropic, LangChain, and Cline shipped routine SDK and compatibility bumps. Bitcoin's 26 stories skewed toward hardware and wallet UX, Coldcard shipping two firmware lines (1.5.3Q and 5.6.3) in parallel. Self-hosting stayed thin at 17 stories but included one real milestone: BorgBackup's long-running 2.0 beta cycle and Gitea's 28.0.0 major release both landed breaking changes operators will need to read before upgrading. Policy coverage from EFF ran heavier than usual, three separate items tracking surveillance litigation and one tracking a developer's forced deportation from Ecuador.
No structural cuts or security advisories today. The wire is dominated by point releases across Nostr (five clients and relays, including Grain, Ditto, Mostro) and Privacy (IronFox, SimpleX Chat, BasicSwap DEX), with Bitcoin and AI each contributing smaller, incremental updates. Nothing here reads as urgent; most entries are maintenance bumps, changelog fixes, or nightly builds rather than new capability.
Qubes OS 4.3.2 is the one structural release on the wire, a stable cut landing inside a Privacy beat otherwise stacked with routine client bumps from Bitwarden and a GrapheneOS factory image. AI posted nine releases and none ship new models, mostly coding-tool and agent-SDK point updates (Qwen Code, Cline Desktop, llama.cpp, Claude Agent SDK). Bitcoin's five items are incremental: Phoenix and Bitcoin Keeper bug fixes, Ledger Live's matched mobile/desktop version bump, and a Payjoin Dev Kit interface change. Nostr and Self-hosting round out the day with single-digit point releases, no security advisories attached to either.
