Open Source Fights Back: Forks, Exemptions, and a Python Migration

California lawmakers voted unanimously — a genuinely rare event in Sacramento — to exempt software distributed under GPL, MIT, BSD, and Apache licenses from the state's age verification law. The law would have required platforms distributing certain software to verify user ages, raising the prospect that Linux distributions, package managers, and open-source repositories could fall within its scope. The Hacker News thread explored the technical absurdity of applying age verification to a package manager, but also the deeper legal logic the exemption encodes: open-source licensing, by distributing power so thoroughly that centralized gatekeeping becomes impossible, structurally addresses some of the problems that age verification laws target through an entirely different mechanism.

A security bulletin from the QubesOS team tempered the week's open-source optimism. Advisory QSB-118 describes an arbitrary code execution vulnerability in the operating system's copy-to-VM feature's error-reporting backchannel. QubesOS is built around compartmentalization — applications run in separate virtual machines so that compromising one does not automatically compromise the rest — making the irony of the vulnerability pointed: the attack exploits the error-reporting mechanism, the very feature designed to signal that something has gone wrong. The team published patches, but the incident illustrates that security architecture cannot immunize a system from implementation bugs in the mechanisms that necessarily cross compartment boundaries.

The FreeCORE project announced a fork of TrueNAS Core, the open-source, FreeBSD-based network-attached storage platform built around the ZFS filesystem. iXsystems, the company behind TrueNAS, has been shifting focus toward TrueNAS Scale, its Linux-based enterprise product, and the community felt the original version was being deprioritized. FreeCORE, detailed at freecore.org, aims to establish a governance model resembling a community foundation rather than a company-controlled project. The Hacker News thread drew sixty-four comments — substantial for a storage-software fork — from users invested in data integrity who worry about losing the platform underpinning their home labs and small-business infrastructure. The pattern is familiar: MariaDB emerged from MySQL, LibreOffice from OpenOffice, and now FreeCORE from TrueNAS Core.

CCP Games announced that EVE Online — which has been running since 2003 on a notoriously complex economic simulation — is beginning its migration from Python 2 to Python 3. Python 2 reached end-of-life in January 2020, meaning CCP has spent six years backporting security patches, forgoing modern Python libraries, and watching technical debt compound. Engineers who have completed similar migrations at scale warned that Python 2 to Python 3 is not a simple version bump: semantic changes in string handling, integer division, and print functions mean that code which appears to work can silently behave differently. For a subscriber base historically estimated at 300,000 to 400,000 active accounts, the migration represents an enormous engineering investment that produces zero visible features for players — but remaining on Python 2 indefinitely becomes increasingly untenable as the broader ecosystem moves on.

Providing a fitting coda, the Python Software Foundation announced that RISC-V is now a Tier 1 supported architecture for CPython, the reference Python implementation. The designation means official builds, maintained continuous integration, and guaranteed release artifacts for RISC-V hardware. Hacker News commenters noted that the move matters especially for embedded and edge computing, where RISC-V is already competitive and Python's approachability makes it attractive for IoT deployments. With SiFive, Alibaba, and a growing roster of chip designers investing in RISC-V implementations, official Python support removes one friction point from deploying Python workloads on what many believe will be a defining hardware architecture of the coming decade.