The Free Software Foundation "has never supported Raspberry Pi," writes their deputy directory Sean O'Brien, "as it depends on nonfree software for the boot process, leaving an important part of the computer outside the user's control."

But they're now decrying "an even more intrusive restriction on user freedom" — the binary-blob bootloader changes that limit your ability to upgrade RAM: The restriction is not new: the relevant checks were introduced in the device firmware around 2024. However, these hardware handcuffs have only recently received wider attention. Though a user can desolder the original memory and install electrically compatible RAM, the nonfree firmware may refuse to recognize the additional memory, or simply decide not to boot the computer at all. Even replacement RAM of the same capacity can be rejected.

This is worse than Raspberry Pi's longstanding dependence on nonfree firmware in an important way. It is not only nonfree software, but it is Digital Restrictions Management (DRM), used in this case to prevent the owner of the computer from making a modification that the hardware is otherwise capable of supporting. That distinction matters. Soldered RAM is difficult for most people to replace since it is a physical characteristic of the hardware. In the case of Raspberry Pi boards, users have demonstrated that the hardware itself can be modified successfully....

Raspberry Pi justifies the use of DRM on the basis of being able to identify altered computers. There may be legitimate reasons for wanting to identify such altered computers. Unscrupulous sellers have reportedly replaced memory on lower-capacity boards and resold them as more expensive models, sometimes using unreliable or defective components. But preventing fraud and maintaining quality does not require taking control away from users. A Raspberry Pi could record its original factory configuration in a cryptographically verifiable form. Raspberry Pi could use free software that warns the user when the installed RAM differs from original factory configuration. Raspberry Pi could provide tools allowing buyers to verify what hardware originally shipped with a board. None of those measures requires a software-enforced limit on what an owner may do with the computer...

If compatible hardware can be installed successfully, the manufacturer should not create restrictions to prevent the owner from using it. Restrictions on hardware upgrades are deeply troubling from an organization like Raspberry Pi that has stated their commitment to longevity as a guiding principle. Free software is ultimately about who controls the computer. The user should control it, not the manufacturer that sold it....

The people who own these computers must also have the freedom to modify, repair, and upgrade them, without restrictions imposed by nonfree software limiting their potential.
Hackaday recently argued the restriction was "no big deal." noting there's ways to bypass the restriction" The bootloader is stored in the SPI flash chip, which can be reflashed using the built-in mask ROM over USB and rpiboot, and you are not prevented from flashing older versions of the bootloader, so far... If you have the skills to upgrade your RAM, you most certainly have the skills to downgrade the Raspberry Pi bootloader...

My advice: don't lament Raspberry Pi RAM upgrades, especially given they're only slightly harder to perform now. Very few hackers ever performed them, the main audience for them turned out to be dodgy hardware resellers online... Think of the users that will no longer be fooled by a shady seller on Amazon, especially now that the perverse incentives for board mods and reusing harvested RAM chips are at their highest.

BoingBoing reports: Mark Stephens, better known under the pen name Robert X. Cringely, died last week at 73. Stephens chronicled the tech industry of the late 1980s and early 1990s — the age of Bill Gates' rise, Steve Jobs' repose, the dawn of the world wide web — and produced the famed documetary Triumph of the Nerds, based on his own bestselling Accidental Empires: How the Boys of Silicon Valley Make Their Millions, Battle Foreign Competition, and Still Can't Get a Date.

Though not the first InfoWorld columnist to write under the Cringely name, he was responsible for its persona and fought successfully to keep it after he left the magazine in 1995.
"I loved the man," writes Darth Technoid (Slashdot reader #83,199): I first met him in the 1990s, while he was still working at InfoWorld, and we became friends immediately. He helped me get a job or two, and he was always filled with crazy (meaning really good) ideas.

I'll miss him and his creativity greatly.
Cringely answered questions from Slashdot's readers in 2000. And Cringely led an interesting life, as you can tell from Slashdot's January, 2020 story Robert Cringely Attempts an Air-Launching Space Startup: "How does a 67-year-old hack with three minor children recover from going blind, losing his home and business in a horrible fire (like 2,000 others, we are still fighting with insurance companies), while appeasing an angry crowd of Kickstarter supporters armed with pitchforks and shovels?"

That crowd still wants long-time tech pundit Robert X. Cringely to deliver on his Kickstarter-funded project to create custom Minecraft servers. So in a new blog post this week, Cringely writes that "I went looking for venture money to recapitalize MineServer and I simultaneously started a satellite launch company to fund my eventual retirement. I am not making this up..."

He's now found a Beverly Hills patron who wants to be a co-investor in the Minecraft servers, but "I will have to earn the matching money on my own, which is what I have been trying to do with my other startup, Eldorado Space."
Slashdot has often linked to Cringely's commentary over the years, as far back as 1998 and as recently as this summer. ("Tech Pundit Cringely Co-Founds Startup '2Brains Inc' to Solve LLM Hallucinations.")

• July, 1999: Cringely's take on "Pirates of Silicon Valley"
• April, 2009: Three Mile Island Memories
• June, 2011: IBM Did Not Invent the Personal Computer
• March, 2019: Cringely's Final Predictions: Apple Becomes a Financial Service and Hedge Fund
• June, 2019: Cringely Predicts The End Of Broadcast TV Within A Decade
• April, 2020: Not Just 'The Death of IT'. Cringely Also Predicts Layoffs For Many IT Contractors
• January, 2021: Robert Cringley Predicted 'The Death of IT' in 2020. Was He Right?
• June, 2023: Cringely Predicts Moore's Law Will Continue — Because of AI

But my favorite Cringely memory is Steve Jobs: The Lost Interview, the full 70-minute interview from 1995 that a 40-year-old Jobs gave to Cringely during filming for Triumph of the Nerds. ("And they actually sent someone to wake up the Pope....") There's various pirated copies on YouTube and an online transcript, but only 10 minutes made the broadcast — at the time Jobs was still at NeXT after his departure from Apple. But when Cringely rediscovered the videotape, the entirety of the interview was released to theaters in 2012 six months after Steve Jobs' death.

Share your own memories of Robert Cringely in the comments...

"Cloudflare has acquired Deno, the company behind the [server-side] JavaScript and TypeScript runtime created by Ryan Dahl, the inventor of Node.js," Forbes reported last week.

But Deno "has no future at Cloudflare, which will maintain the runtime for another year before ending its development," writes The Register. "That's OK with Dahl. 'I am now of the opinion that if you're choosing Node.js for building servers, you're doing it wrong,' Dahl told The Register."

It all started with his team's work on the platform Deno Deploy, "We wanted to make running applications as straightforward as possible," Dahl wrote on the official Deno blog. "But building and operating Deploy also showed us how much complexity remained underneath that developer experience. I wanted to simplify that layer, too." This led to celld. Building on the Cloudflare Workers programming model, celld lets developers build distributed applications from the start while making the system simple to operate. What excites me greatly is that the scaling is built into the programming model, rather than infrastructure each app has to assemble itself.... We want to make this programming model the default way to build servers, whether you run on Cloudflare's network or your own infrastructure.

Joining also means choosing where to focus our effort... Deno will remain open source, and we welcome others who want to continue its development. Deno Deploy will continue operating for six months before shutting down. We will provide migration support for paying customers moving to Cloudflare Workers. [Deno's JSR package registry for JavaScript and TypeScript] will continue operating, with its infrastructure moving to Cloudflare.
Forbes argues that this acquisition of Deno "turns a long-standing objection to Cloudflare Workers, the claim that applications built on it cannot easily leave, into a selling point." For CIOs evaluating serverless and edge platforms, portability now has a concrete answer... Released in August, [celld] is a single Rust binary that runs Workers and Durable Objects across many machines, with object storage as its only external dependency. Operators run multiple celld instances against one storage bucket, and the software handles placement, routing and persistence. Dahl and Belder will now lead an effort to merge celld into workerd and make self-hosting a supported way to run Workers applications. With this, customers can build an application on Cloudflare's network and move it to a private data center without rewriting it.
"With Deno, we improved the experience of writing JavaScript," Dahl argues on the Cloudflare blog, "but we didn't fundamentally change what developers had to assemble around the runtime. The bigger problems are around networked applications: distributing computation, coordinating state, data storage in general, and autoscaling to meet demand..." Could the programming model make partitioning across machines part of the design from the start? The solution clicked into focus when I read about Cloudflare's Durable Objects. It provided a very powerful abstraction: the distributed singleton with a SQLite database. Each Durable Object is like a small, individually addressable server with its own relational database. Its JavaScript execution is single-threaded (which is easy to reason about), it handles WebSockets, and its local SQLite database can be accessed synchronously. By building a chat application using one Durable Object per channel, you have sharded your data and WebSocket connections, and thus made your application scalable... What excites me is the leverage this model gives developers: compute, relational databases, queues, and real-time communication primitives designed for applications distributed across machines.
Now Dahl and 12 of his Deno colleagues "will work to build out Cloudflare's Workers platform," explains The Register, "expanding it for potential open-source use. He feels this approach is the way to go." "Right now, every other server is really operating at the Linux VM layer. That is not what Cloudflare Workers are," he said...

The ever-fickle Dahl first debuted Deno in 2018 as a rewrite of Node. The name 'Deno' is an anagram of Node, and it was Dahl's attempt to fix everything he felt he got wrong with Node — built-in fetch, a permission model, native TypeScript support et al. Sequoia backed Dahl's company for $21 million in 2022, and as of August, Deno amassed 400,000 monthly users. Nonetheless, Node's gravity proved too heavy for Deno to achieve escape velocity.

"What we found over years of working on Deno is that you can't really deviate from Node.js very much," Dahl told The Register. "As we continued to try to get adoption for Deno, we found we had to essentially backpedal on some of the original promises and become more Node compatible over time, and that left us as a kind of an alternative Node.js implementation." Going forward, Cloudflare will supply Deno with bug fixes and security patches for the next year, while Dahl looks for a new home for the MIT-licensed open source project.
Dahl's worked could bring "yet another revolutionary turn for server-side JavaScript," the article argues, "offering a runtime that would require only 300 KB of memory per instance, rather than the hundreds of megabytes now required for Node/Deno. Such savings could quickly add up for a cloud provider, especially one serving the voracious agentic market."

And as Dahl wrote on the Deno blog, "The need for better abstractions is especially acute with AI. Durable Objects bring together capabilities that are particularly useful for agent harnesses: inexpensive, serverless execution, persistent state, WebSockets, and a high-level JavaScript interface. This is what I'm most excited to explore and why celld focuses on Durable Objects."

Millions of current and former students at California's public school have had their data stolen — including names, date of birth, and addresses — stolen in a breach, reports the Los Angeles Times.

The breach affects students "who took the state's mandated standardized tests that annually assess their academic proficiency, education officials announced Friday." The compromised information affects many more than the state's current 5.7 million public-school students as the breach dates back to 2023 enrollments. Students who left California but did not confirm their transfer to another school also were affected, dating back to 2006.

The data breach involved [nonprofit] Educational Testing Service or ETS, which provides extensive services to California [including test participation and assessment data]... Affected former students, including those who are now adults, are eligible for 24 months of free identity-protection services and identity-restoration help if there is identity theft. Officials said that parents and guardians may want to consider requesting a free credit freeze for their children who are under 16 to help prevent unauthorized accounts from being opened in the names of their children.
The breach involved a compromised login credential, according to a web page about the incident from California's Department of Education. The compromised credential was then used to copy files with student information at "various" times between May 22 and September 18, 2026, which drew concern from a cybersecurity expert interviewed by the Los Angeles Times: "A stolen login credential should not become a months-long passport to millions of students' personal records," said Anton Dahbura, executive director of the Johns Hopkins University Information Security Institute. "If that is what happened here, the critical question is why authentication safeguards, access restrictions, and monitoring systems failed to detect and stop the unauthorized activity."

He added: "Incidents like this expose a fundamental weakness in how we manage student data: School systems may outsource the storage and processing of sensitive information, but they cannot outsource the consequences of a breach. When millions of student records are concentrated with a single vendor, one security failure can become a statewide problem with consequences that follow children for years."
A spokesperson for ETS told the Times that they've now implemented additional safeguards, including strengthened access controls, enhanced monitoring, and more third-party review of their security practices.

Google is expanding its Android Earthquake Alerts System from 98 to more than 200 regions worldwide, using smartphone sensors to detect early earthquake activity and warn users before potentially dangerous shaking begins. The update also enhances the system's "Be Ready" alerts with estimated earthquake magnitudes, epicenter information, maps showing affected areas, and additional safety guidance. From a Google blog post: Be Aware: A straightforward alert for estimated light shaking, letting you know an earthquake has been detected nearby.
Be Ready: A detailed alert for stronger shaking, alerting you to prepare to take action.
Take Action: A full-screen alert for moderate to heavy shaking, giving you immediate advice on how to stay safe.

We've built-out our Be Ready alert with new helpful guidance. In the coming months, you'll see a map with a radius of where we've detected shaking, estimated earthquake magnitude, action you can take, and a button to learn more about the earthquake as information comes in.

An anonymous reader quotes a report from Wired: Prediction market boosters often tout the platforms as barometers of public opinion, or even "truth machines" offering a clearer picture of where things are headed than polling or other data. In 2024, for example, Kalshi beat many pollsters in forecasting the outcome of the US presidential race. But their trading activity can also tell more perplexing stories. Two global election markets on Polymarket's offshore platform, for instance, generated over $600 million in trading volume, far more than most political markets typically attract. Most of the activity took place buying and selling contracts tied to long-shot candidates who ultimately did not win. The report focuses on suspicious trading activity surrounding elections in Ethiopia and Romania, where researchers uncovered $284 million in questionable trades tied to Ethiopia's election and periods when 99.6% of trading volume in a Romanian election market was flagged as suspected "wash trading."

According to Wired, "wash trading is a type of market manipulation in which accounts repeatedly buy and sell assets to create the illusion of heavy trading activity, when in reality, money is simply moving back and forth." Some accounts may also be artificially inflating their activity to qualify for potential cryptocurrency token rewards, a practice known as "activity farming."

In response to the Ethiopian trading activity, Polymarket told Wired that the company "immediately flagged this activity, investigated, and blocked the accounts from trading." The company did not explain why the suspicious trades were allowed to continue for months before action was taken.

Meta is facing criticism over updated commercial terms taking effect October 30 that could give the company broad permission to scrape content from websites linked to business accounts and use it to train AI. Legal experts warn the changes could undermine lucrative AI licensing deals for news publishers, with no direct opt-out for businesses that accept the terms. Ars Technica reports: As Nieman Lab reported Thursday, this will affect all business accounts but is particularly shocking for news publishers who could perhaps charge Meta millions in licensing fees to continually access their articles for AI training. Currently news organizations are fighting a battle with OpenAI over whether such training without licensing is fair use, and Meta's terms seemingly risk granting it sweeping permissions, no matter which way the court leans. "While journalism isn't the only industry that will be affected by this update, virtually every news organization has at least one Meta business account, including Nieman Lab," the lab said.

[...] Notably, there is no mention of AI, but it's inferred from a single use of the word "train" and references to automated scraping and crawling. Meta's spokesperson told Nieman Lab that Meta has no plans to use the terms as a legal basis to ignore robots.txt instructions that block scraping on news sites. The company still allows news organizations to opt out of scraping and provides instructions on how to block crawling. A spokesperson told Ars that "there is no change to how Meta uses web crawlers; any suggestion to the contrary is false." However, should courts affirm that AI training non-news articles is fair use, news organizations question if Meta's stance might change, and the terms could be used to freely grab access to content by legally overriding robots.txt instructions.

An anonymous reader quotes a report from Reuters: Private credit's expanding role in financing AI infrastructure faced one of its clearest market tests this week as CoreWeave's bonds fell to distressed levels, raising questions about how lenders are pricing a boom built on chips, data centers and customer contracts. CoreWeave has about $50 billion of debt, according to LSEG data, making it one of the largest borrowers linking private credit to the AI buildout. The cost of insuring its debt against default climbed to about 1,200 basis points this week, while yields on some of its bonds rose to roughly 15% to 16%, signaling sharply increased investor concern over its credit risk. "There is still a price. Investors are still comfortable financing it, but they're demanding more compensation for it," said James Martin, senior US credit strategist at SMBC, referring to projects further from completion.

Carlyle estimates that private credit could finance roughly $1 trillion of the AI infrastructure buildout but warns that aggressive lending could create concentration risks similar to those seen in software lending. "The clearest lesson is not to avoid AI compute exposure, but to set concentration limits before the buildout accelerates further, not after," Carlyle said.

prisoninmate shares a report from 9to5Linux: Ubuntu 26.10 (Stonking Stingray) has been released today, and it is now available for download for those eager to update their Ubuntu systems to a newer release. Powered by the upcoming Linux 7.3 kernel series, Ubuntu 26.10 ships with the latest GNOME 51 desktop environment, TPM-backed full disk encryption (FDE) support on computers without a hardware root of trust, updated Settings to show whether a computer is certified for Ubuntu, and 100% Rust coreutils.

There are several App Center enhancements in Ubuntu 26.10, such as a unified app-details view for Snap and Debian packages, a dedicated Drivers page where you can review the available graphics drivers, including NVIDIA driver branches, and support for installing codecs for one-time playback when a media file uses a codec that's not installed.' Other additions include an optional, locally processed AI-powered speech-to-text tool called Myna, system-wide controls for disabling Ubuntu Insights data collection, and better integration with Microsoft Entra ID. Also worth mentioning are the security and software updates that will be available for nine months, through July 2027.

"Along with the dangers of continuing cyberattacks, the International Monetary Fund (IMF) reports that the threat of an AI market crash is putting the global markets at risk," writes Slashdot reader databasecowgirl, citing the IMF's latest semiannual Global Financial Stability Report. Here's a summary: Three salient risks could trigger a sharp tightening of financial conditions and market turmoil. Weaker or less durable investment and profitability in artificial intelligence could lead to a correction in AI-related asset prices, amplified by rising leverage and concentrated exposures. Resurgent inflation or fiscal concerns could drive a sharp rise in sovereign bond yields, with potentially broad repercussions across financial markets. Meanwhile, increasingly sophisticated cyber threats pose growing risks as finance becomes more digital and interconnected.

Underlying financial vulnerabilities could amplify these risks and turn market stress into systemic events. Although the global banking system remains broadly resilient, pockets of weaker banks persist. Liquidity mismatches among insurers and pension funds have increased, while rising leverage and contingent liquidity risks in private credit could amplify stress.

While hedge funds support market functioning in calm times, their use of leverage and exposure to crowded trades could exacerbate market stress too and create spillovers to prime brokers. Some emerging markets have seen policy buffers erode, and frontier economies have increasingly relied on less transparent forms of financing.

Finally, although markets for tokenized assets remain small and could offer efficiency gains in several areas, they can create new channels for the buildup of leverage and mismatches in liquidity and maturity, in addition to elevating risks related to technology and infrastructure. These vulnerabilities underscore the need for policies that strengthen resilience, enhance transparency, contain excessive leverage, and improve preparedness for future shocks. The full report can be found here (PDF).

An anonymous reader quotes a report from TechCrunch: Flock's founder and CEO Garrett Langley doesn't think the risks of introducing surveillance technology at scale outweigh the rewards. "If we want to live in a society where, if you commit a crime, you have a higher probability of being held accountable, we shouldn't pause progress," Langley said, speaking onstage during a panel at TechCrunch Disrupt 2026 in San Francisco on Wednesday.

During the interview, the controversial founder of the surveillance maker of license plate cameras and other recording devices deflected hard questions about the criticism Flock now faces -- which has since led to canceled contracts and even layoffs. Instead, Langley tended to respond to questions with anecdotes from conversations with police chiefs and city leaders across the United States, and tales of the supposed numerous crimes Flock has solved, rather than offer tangible solutions to people's concerns.

In doing so, Langley positioned Flock as an advance in technology that was somewhat inevitable. He stressed that if people wanted to live in a better society -- that is, one with reduced crime -- they would have to offer up their privacy in return. [...] "Technology, at its core, in its definition, is just doing things better. It's not doing things perfect," he said. "Driverless cars, I think, is a fair analogy. Driverless cars, I think, are definitively safer than human drivers. And when there's one accident, I don't think the answer is to shut down driverless cars. The answer is to say, 'Hey, let's talk about how we prevent more accidents in the future.'"

[...] From Langley's answers, it's clear that the ethics around how Flock should be used is a decision he would much rather leave up to others. "We don't want to tell city leaders how to do their job," he noted. "We will provide recommendations, we'll provide defaults, but we're going to minimize the number of mandated features, functions, and policies," he said. Langley went on to argue that society too often judges technology "not on how it compares to the past, but how it compares to perfect." He acknowledged that "Flock is far from perfect" but maintained that its technology helps police departments compensate for staffing shortages and improve public safety.

When pressed about potential abuse and privacy concerns, Langley offered few specifics, instead arguing that safeguards could be implemented without disrupting police operations. He insisted the benefits of what Flock offers outweigh the controversy. "There's millions and millions of people who have a better life today because [of] Flock," he said, adding that "it's worth it because one day they might be a victim."

An anonymous reader quotes a report from The Guardian: Uber has begun a trial of autonomous vehicles on the streets of Manchester as it looks to bring robotaxis to cities around the UK. The first self-driving cars are operating, using the technology of its partner firms Pony and Verne, with whom Uber recently launched Europe's first autonomous taxi service in the Croatian capital, Zagreb. Uber said it was "excited to take this first step toward making this technology accessible to people across the UK."

In social media posts, Verne said it had "started our autonomous vehicle testing in Manchester," while Pony said there were "plans to bring robotaxis to the city" and that testing was under way. The tests involve the company mapping the streets of the city in north-west England with a safety driver behind the wheel and no passengers. Limited passenger services started last month in London, but with a safety driver in the front seat of cars supplied by Wayve under Transport for London's licensing rules for private hire vehicles.

The next steps are unclear. Opposition from Uber drivers, their unions and the capital's politicians to the rollout of robotaxis is mounting. The GMB and ADCU unions have both said thousands of drivers jobs will be lost and have called for help for those affected. A critical report from London assembly's transport committee this week called for the government to devolve authority over autonomous taxi services. It said there was "considerable uncertainty about many of the claimed benefits of autonomous passenger vehicles", and fears over the impact on public transport and congestion, as well as safeguarding and accessibility for disabled passengers. There has been no official application to launch passenger services in Manchester so far.

An anonymous reader quotes a report from Ars Technica: Schools and libraries from around the U.S. pleaded with the Federal Communications Commission to drop the idea of ending E-Rate, a $2 billion-a-year program that connects students and library visitors to the Internet. FCC Chairman Brendan Carr has criticized school districts for having "experimented with a massive increase in screen time for students," and said E-Rate expanded too far beyond its original purpose of "supporting basic Internet access to schools and libraries for educational purposes." In June, Carr led a 2-1 vote to issue a Notice of Proposed Rulemaking (NPRM) seeking public comment on whether E-Rate should be "limited or sunset to reflect today's extensive connectivity rates."

Carr's proposal could result in E-Rate cutting the discounts that schools and libraries receive for telecom services and equipment, and imposing more restrictions on how E-Rate money can be used. The FCC seeking comment on whether to sunset the program also raises the possibility that Carr might choose to axe E-Rate entirely. The National Association of Elementary School Principals told the FCC that it "strongly supports the continued operation of the E-Rate program and urges the Commission to reject proposals that would eliminate, substantially restrict, or impose new conditions on this essential source of connectivity assistance for schools and libraries." The Carr FCC already scaled E-Rate back last year by ending funding for schools and libraries to lend out Wi-Fi hotspots and for Wi-Fi service on school buses. "Importantly, the FCC does not have the authority to terminate the E-Rate program. The E-Rate program is mandated by Congress, and the FCC is responsible for administering it," the American Library Associated told the FCC.

The American Library Association said "the FCC lacks the authority and expertise to regulate screen time or determine educational outcomes." In a filing, the group pointed out that under U.S. law, determinations about what content is inappropriate for children "shall be made by the school board, local educational agency, library, or other authority responsible for making the determination."

A study commissioned by CCIA Europe, whose members include Amazon, Google, and Meta, estimates that the EU's proposed Cloud and AI Development Act could impose 115 billion euros ($128 billion) in costs over a decade as governments and companies migrate workloads and rewrite software. The figure is more than six times the European Commission's upper estimate. However, roughly 80 billion euros ($89 billion) of it comes from a modeled scenario assuming sovereignty rules are extended to 25% of cloud workloads in essential private-sector industries.The Register reports: The report specifically targets Article 31 of the proposed legislation, which it says could allow the Commission to extend sovereignty requirements into essential private-sector services. CCIA argues that forcing businesses to move away from existing cloud infrastructure could trigger expensive software redevelopment projects, with code rewriting and re-architecting accounting for 69 percent of its estimated costs.

Luxembourg would apparently take the biggest hit, with the study putting the cost at 1,711 euros per worker over ten years. Denmark (905 euros), Austria (900 euros), and Finland (864 euros) also face hefty bills, as does Ireland (856 euros), which hosts the European headquarters of several US tech giants. CCIA is urging EU governments to overhaul the proposed legislation, limit sovereignty restrictions to sensitive workloads, and abandon requirements based on corporate origin or personnel nationality in favor of what it calls risk-based technical safeguards.

"Member States cannot rely on the Commission's incomplete estimates when deciding CADA's strict sovereignty requirements for cloud and AI providers," said Mitchell Rutledge, CCIA Europe's policy manager. "Taxpayers and businesses will foot the bill, yet the official assessment missed 70 percent of CADA's true impact." For AWS and Google, offering European customers greater control over their data also helps retain business that might otherwise migrate to European competitors. It's a rather convenient arrangement: sell customers sovereignty on one hand, while an industry association representing your interests warns governments against imposing too much of it on the other.

An anonymous reader quotes a report from ZDNet: The Netherlands' Tax and Customs Administration has abandoned its planned Microsoft 365 public-cloud rollout. Why? The reasons were clear at the Open Source Summit Europe conference, where the Linux Foundation (LF) released the 2026 State of Open Source in Europe. In it, the nonprofit, pro-open-source organization revealed that 94% of European Union (EU) organizations say digital sovereignty is important, with 61% considering it very important. As Thierry Carrez, the Linux Foundation Europe GM, said in his keynote, "Europe has clearly heard the message on digital sovereignty."

In an interview onstage at the summit, Nithya Ruff, chair of the LF board, added that it's not just Europe: "Digital sovereignty is a need that the entire world feels, whether it's Sierra Leone or the US or China." It's not just the Dutch tax collectors, though. The Netherlands is also exploring switching from Windows and proprietary software to Linux and open-source programs across the board. [...] The Netherlands had planned to switch to Microsoft 365 in 2025. The idea then was to complete the rollout by the end of 2026. About 5,000 employees had already migrated when the Dutch Advisory Council on ICT Assessment recommended reversing the public-cloud rollout in June. The government paused the plan in July; the latest announcement replaces that rollout with an on-premises/open-source approach.

The Tax and Customs Administration isn't replacing all of Microsoft Office with a single open-source suite, at least not yet. Instead, the government will keep the existing Microsoft software for now. Looking ahead, State Secretary for Finance Eelco Eerenberg set out the replacement timetable in a letter to Parliament: "In 2027, the provision for mail and calendar will be realized on-premises. Later in 2027 and 2028, European open-source solutions for personal storage and collaboration will follow. This allows us to work toward a sustainable and more autonomous solution for these functionalities." [...] For now, the on-premises email/calendar environment will still use Microsoft software, including Outlook. The open-source portion concerns personal storage and collaboration, not a wholesale replacement of Word, Excel, PowerPoint, or the entire desktop environment. As for why the Netherlands pulled back, the ICT assessment found serious concerns over "information security, information processing and future-proofing." Key issues included routing confidential documents through American servers, relying on standard Microsoft encryption rather than Double Key Encryption, and inadequate end-to-end encryption for Teams calls. The assessment also identified "vendor lock-in, reduced flexibility, concerns about digital sovereignty, and the absence of an adequate exit strategy" as dealbreakers.

ZDNet notes that other Dutch government agencies are developing an open-source alternative called DAWO (Digital Autonomous Work Environment for Government), which would begin by replacing Windows with the Linux distribution NixOS.