Benson plagiarized Transcendental Meditation in the 1970s from one of Maharishi’s earliest researchers. He replicated studies on TM practitioners and renamed it Relaxation Response. Towards his final years when in his 90s, I interviewed him at Harvard. I have a video of that. He acknowledges his debt to Maharishi - but too late and too little.

AI is cloning office suites and it can reverse engineer apps for you. Also, people are fixing their smart TVs with AI. Check out the latest Local AI Weekly newsletter. itsfoss.com/newsletter/local…

REA (Reverse Engineer Anything) by @morluto is now a skill in Computer. Ask Computer to reverse-engineer an app and it inspects how the app works without its source code, then builds a working version. Tasks that use /reverse-engineer are free through October 31, up to 10,000 credits per user. Here are 5 apps Computer made with it, available to try for a limited time: 1) Figma: Design with layers and auto-layout, plus sign-in, cross-device sync, and multiplayer editing. Try it: ui-editing.pplx.app

This is well planned strategy by incumbents to limit open-weight models, developer access, and competition from Chinese labs. Anthropic CEO Dario Amodei's call to slow AI model development as a coordinated effort by industry leaders including Sam Altman and Elon Musk to impose centralized control over AI advancement. As industry leaders use safety rhetoric to limit open-weight models, developer access, and Chinese lab competition, preserving incumbent dominance over exponential advancements, safety concerns are portrayed as tools for incumbents to restrict access, preventing exponential open-source progress and preserving authoritarian-style oversight over AI advancement. Altman, Dario Amodei, and Elon Musk (via endorsement of slower development) seek centralized global control over AI to counter exponential growth, particularly from open-weight models and Chinese labs.

🚀 NX9-WG v1.1.0 is out. Not another WireGuard web panel. A Linux-native control plane for the kernel you already have. 🦀 Rust 📦 One binary 🗄️ SQLite desired state 🔗 Netlink + nftables in-process 🚫 No wg, ip, or iptables subprocesses What’s new in v1.1.0: • wg0 remains the protected primary overlay • Optional third-party WireGuard upstreams as separate kernel interfaces • Import → preview → confirm standard .conf files • Provider AllowedIPs stay on the upstream interface • No host default-route hijack • No automatic NAT • No automatic full-tunnel client egress • Optional/dynamic ListenPort: no forced 51820 collision • Kernel orphan detection + cleanup • Restart from desired state • Overlay vs Upstream interface roles • Tighter API, CLI and Web UI lifecycle controls A Proton config can become: wg0 → NX9-WG overlay proton0 → provider WireGuard interface without turning the provider into the system's routing authority. And if you never create an upstream? Your existing NX9-WG overlay behaves the same. Road-warrior access remains the official WireGuard app on Windows, macOS, iOS, Android and Linux—QR or .conf. No custom client required. Deliberately NOT in v1.1.0 ❌ Mesh ❌ Automatic “send this subnet through Proton” ❌ Automatic upstream failover ❌ Custom client application ❌ Provider-specific control APIs Those are separate architectural decisions, not things to quietly bolt onto the overlay. For CPE, gateways, embedded appliances and air-gapped boxes: If you wanted WireGuard administration without a Docker UI pretending to be the dataplane, NX9-WG is that layer. MIT / Apache-2.0. Run it. Fork it. Ship it in firmware. 🔗 GitHub: github.com/thakares/nx9-wg 🔗 Codeberg: codeberg.org/thakares/nx9-wg 🔗 v1.1.0: github.com/thakares/nx9-wg/r… #WireGuard #Rust #Linux #Networking #CPE #Embedded #OpenSource

For review: @Itsfoss @WireGuardVPN @CalixHQ @Adtran @CommScope @nokianetworks @vantiva @NETGEAR @TPLINK @ASUS @Ubiquiti @mikrotik_com @zyxel @GLiNetWiFi xitter.cf/thakares/status/209407…

🚀 nx9-wg is not another WireGuard panel. There are already plenty of tools that create peers, generate QR codes and bring up WireGuard. The harder problem is: What happens after the configuration is applied? Most WG management stacks look roughly like: 🌐 Web UI ↓ 📄 Config files ↓ ⚙️ wg / wg-quick ↓ 🔧 ip / nft / sysctl ↓ 🐧 Linux kernel That works. But a VPN control plane for a router, CPE, SD-WAN appliance or private WAN needs something more. 🧠 nx9-wg is built around desired state and reconciliation. SQLite stores authoritative desired state. The reconciliation engine compares it with live system state. Then nx9-wg talks directly to Linux through: 🔹 WireGuard Generic Netlink 🔹 RTNETLINK for links, addresses and routes 🔹 libnftables. so.1 for firewall and NAT 🔹 procfs for forwarding ❌ No wg subprocess. ❌ No wg-quick. ❌ No ip subprocess. ❌ No nft subprocess. ❌ No Node runtime. ❌ No Python runtime in the appliance path. Just one Rust binary coordinating the network state. That architectural difference matters. 🔄 Why does reconciliation matter for a VPN? A VPN is not: create peer → generate QR → done It is a live relationship between: 👤 peers 📡 interfaces 📍 tunnel addresses 🛣️ routes 🔥 firewall policy 🌐 NAT ↔️ forwarding 💾 persistent state 🐧 kernel state And systems drift. Someone changes a route manually. A peer disappears from the database but remains active in the kernel. A firewall rule changes. A reboot reconstructs only part of the expected state. Docker, CNI, libvirt or another networking component changes something underneath you. The dangerous failure is often silent divergence. The database says one thing. The kernel is doing another. nx9-wg treats: 💾 SQLite = authoritative desired state 🐧 Linux kernel = live state 🔄 reconciliation = convergence mechanism The lifecycle is: Plan → Apply → Verify → Converged Or: PartialFailure / DriftRemains If the system is already converged, applying the same desired state should be a no-op. That is a much more useful property than another dashboard. 📡 Why does this matter for CPE firmware? ➡️ Routers and CPE devices have different constraints from a desktop Linux server. You want: ⚡ small runtime footprint 🔒 explicit privilege boundaries 💾 deterministic persistent state 🔄 predictable reboot recovery 🧩 simple integration 🐧 native Linux networking 🛠️ diagnosability without a cloud dependency A CPE should be able to reboot at 03:00, read its persistent state, reconstruct the required kernel state, reconcile it, verify it and become converged again. That is a firmware problem. Not a UI problem. The same model can apply to: 🏠 SMB routers 📡 broadband CPE 🌐 SD-WAN appliances 🏭 industrial gateways 🏢 managed VPN appliances 🛰️ private WAN edge devices 📶 small ISP infrastructure The useful abstraction becomes: interface → peer → address allocation → route → firewall → NAT → forwarding → diagnostics → backup A vendor can build its own product experience around that control plane instead of rebuilding the networking state machine from scratch. 📜 And the license matters. nx9-wg is MIT OR Apache-2.0. That is intentional. A firmware vendor can potentially: 🔧 integrate the binary 📦 vendor the crates 🧩 add board-specific integration 🔍 audit the Netlink implementation 🏗️ build its own product layer 🚀 ship it as part of a commercial appliance without introducing a copyleft requirement. ✅ Apache-2.0 provides an explicit patent grant. ✅ MIT keeps the licensing model simple. ❌ No license server. ❌ No mandatory cloud. ❌ No telemetry requirement. ❌ No SaaS dependency. For vendors building networking products, that flexibility matters. 🏢 What about small and medium-sized companies? They do not necessarily need another VPN SaaS dashboard. They need infrastructure they can own. nx9-wg is aimed at capabilities such as: 🔐 site-to-site VPN 👨‍💻 road-warrior access 🏠 private LAN access 👥 peer lifecycle management 💾 backup and restore 📋 auditability 🔎 diagnostics 🖥️ CLI + Web UI 💾 persistent desired state without making the company's network dependent on somebody else's subscription. The expensive failure is not: "Our dashboard needs another widget." It is: "The tunnel is up, the route is wrong, and nobody knows why." Reconciliation gives you somewhere to start answering that question. ⚠️ One important WireGuard invariant Server-side AllowedIPs and client-side full-tunnel policy are not the same thing. For server peers, nx9-wg derives /32 or /128 cryptokey routes from assigned tunnel addresses. A client wanting: 0.0.0.0/0 for full-tunnel traffic is a different concern. Conflating those two concepts is an easy way to break a multi-peer VPN. That distinction belongs in the control plane. Not in a UI dropdown. 🧪 And I'm not going to oversell the validation. Physical validation has been performed. The multi-path remote LAN scenario was tested across: 📱 cellular 5G 📶 Wi-Fi 📱 phone STA + AP hop 💻 SSH access into the protected LAN But throughput soak and roaming-during-session are not being claimed as completed validation. Unit tests matter. They are not a substitute for a real client on the other side of a real tunnel. That distinction matters in networking software. 🧠 The idea behind nx9-wg is simple: 💾 Desired state lives in SQLite. 🐧 Live state lives in the Linux kernel. 🔄 Reconciliation sits between them. 🔐 The operator keeps control of the infrastructure. That is what makes nx9-wg interesting to me. Not another pretty WireGuard panel. A native Linux control plane that can potentially sit underneath: 📡 a CPE 🌐 a router 🏭 an industrial gateway 🏢 an SMB network 🛰️ a private WAN 🚀 or a commercial networking product GitHub: github.com/thakares/nx9-wg Codeberg: codeberg.org/thakares/nx9-wg v1.0.0 | MIT OR Apache-2.0