Getty Images

England is on track to become one of the first countries in the world to eliminate hepatitis C, a dangerous virus that attacks the liver, figures show.

The target of treating 80% of all known cases has already been met, and deaths from the virus have fallen by 36% in the last decade, just short of what is needed by 2030.

Taking antiviral tablets for 8 to 12 weeks can cure more than 95% of cases.

Initiatives including A&E blood tests, GP registration testing and free at-home tests have helped to find people who were previously undiagnosed, says NHS England.

Silent disease

Hepatitis C is spread through contact with blood infected with the virus, such as by sharing needles with someone who has it.

Donor blood is already screened for it.

It is a silent disease, meaning people often have no symptoms until much later.

Untreated, it can cause serious and potentially life-threatening liver damage.

NHS England says that since 2015, more than 100,000 people have been diagnosed and treated for hepatitis C, meaning the country is already meeting that target.

Another goal - a 65% reduction in hepatitis C-related mortality compared with 2015 levels - has yet to be met, but might be before the 2030 target date.

Around 50,200 adults are living with hepatitis C, figures for England in 2024 suggest.

Estimates indicate 84.6% of those living with hepatitis C have been diagnosed - just short of the 90% target.

The Hepatitis C Trust says England is "on the cusp" of one of the most significant public health achievements in our country's history.

Prof Frankie Swords, NHS national medical director, added: "England is now leading the world in the mission to eliminate this disease and on course to beat the WHO's 2030 target, but we are determined to keep up the momentum and finish the job.

"We are committed to finding and treating everyone who needs support and would urge those at greater risk to come forward by ordering a free and confidential home-testing kit online."

Adults born in Ukraine, Romania, Estonia, Latvia, Poland, Albania, Lithuania, Bulgaria, Czechia or Slovakia are particularly urged to test, as some may have been infected through medical or dental procedures before 1991.

People can order a free, confidential NHS home self-testing kit without needing to speak to a GP.

NHS England

Paul Eatwell, 65, is one of the more than 100,000 people in England who have already been treated for hepatitis C

Paul Eatwell, 65, was diagnosed after a routine blood test.

The grandfather from Blackburn, Lancashire, said: "My first reaction was disbelief. I remember saying: 'Are you sure? Surely there's been some mistake.'

"I didn't feel ill. I kept wondering how I could possibly have caught it."

He says the medical support he received made a huge difference.

While it has not been established how Eatwell caught the virus, it has been suggested that surgery in South Africa decades ago may have been the cause.

Infected blood scandal

From 1970 to 1991, more than 30,000 people in the UK were infected with HIV and hepatitis C from contaminated blood products and fusions.

The infected blood scandal is known as the biggest treatment disaster in the NHS.

About 3,000 have since died and more deaths will follow.

A public inquiry found authorities covered up the scandal and exposed victims to unacceptable risks.

I was reading about compression recently when I stumbled upon something crazy: that compressors and LLMs are, at their core, trying to solve the exact same problem.

In this post, I’m going to walk us through the basics of compression to understand its deep relationship with language modeling. It’s probably going to blow your mind.

How compression works

There are many ways of shrinking data. Take minification, for example: it works by stripping code down to the bare minimum that machines need to parse. Human-readable variables are reduced to single letters; whitespace and comments are removed.

Click “Minify” to see it in action:

sum-numbers.js

// Sum every number in the list
function sumNumbers(numbers) {
  let total = 0;
  for (const number of numbers) {
    total += number;
  }
  return total;
}

Original source, 156 characters:

// Sum every number in the list
function sumNumbers(numbers) {
  let total = 0;
  for (const number of numbers) {
    total += number;
  }
  return total;
}

Minified to 62 characters — 60 percent smaller — by removing the comment, shortening the variable names to single letters, and stripping the whitespace, braces, and semicolons.

The resulting file is considerably smaller, and yet you’d almost never hear minification mentioned in the field of data compression. Why is that?

Minification is fairly straightforward: it just tosses out any syntax that’s not required by machines. But “true” compression relies on redundancy to condense data.

Consider the string “AAAAAAAAABBBBCCDAAADDDDDDDDD”of nine A’s, four B’s, two C’s, one D, three A’s, then nine D’s: there’s a lot of redundancy here. We could encode this as a shorter string by noting the total run of each character in order:

Original string: 9 A's, 4 B's, 2 C's, 1 D, 3 A's, 9 D's — 28 characters, 224 bits.

Replacing each run with its character and how many times it repeats gives A9B4C2D1A3D9 — 12 characters, 96 bits, 57 percent smaller.

Using standard 8-bit ASCII encoding, our original string requires 224 bits, whereas our compressed string (“A9B4C2D1A3D9”) needs only 96. Not bad!

The above technique is just one compression method (it’s called run-length encoding), but we can do much better. Actual compressors like gzip, Brotli, etc, rely on several methods to shrink data. Let’s take a look.

The anatomy of a compressor

There are roughly three “organs” of modern compression tools: transforms, models, and entropy coders. I’m talking about these terms as if they were clear and distinct things, but the lines can get a little blurry, and they are rarely used in isolation.

Transforms are the preprocessing steps that make our data easier to compress. The method we saw earlier (run-length encoding) is an example of a transform, but it’s worth noting that transforms don’t always shrink the data. Sometimes they can be used to create more redundancy, and the more redundancy, the more we can compress later on. We aren’t going to focus on transforms in this article, but they’re still an important part of any compression tool.

Models describe the shape of our data based on the frequencies of each symbol (whatever unit we’re using to look for redundancies: letters, numbers, tokens, or even binary code). For now, you can think of a model as a table that maps each symbol to its probability, but as we’ll see later on, they can get a lot more sophisticated.

Here’s an example based on our earlier string:

Original string: 9 A's, 4 B's, 2 C's, 1 D, 3 A's, 9 D's — 28 characters.

Counted by symbol: 12 A's, 10 D's, 4 B's, 2 C's.

Entropy coders are almost always the final step in any compression algorithm and are what produce the final compressed artifact: a raw bitstream, which is just a bare sequence of bits with none of the structure a file format would wrap around it.

I want to focus on the last two steps, because this is important. Our data model hands the entropy coder a set of probabilities to encode your data as efficiently as possible. Probabilities go in, compressed bitstream comes out:

Now, let’s be honest: this is all still a bit hand-wavy. What does an entropy coder even DO with all these probabilities? How does that help it do the squishing?

Squishing data with probabilities

Every entropy coder is a unique snowflake, and the way they use probabilities to compress your data differs wildly. To keep things simple, we’re going to focus on just one for now: arithmetic coding. I’m choosing it because it best illustrates how better probabilities make for better compression.

It’s also just really neat.

Arithmetic coding

What if I told you that you could represent an entire dataset with a single number? Does this sound crazy? I thought so too, but that’s exactly what arithmetic coding promises.

Let’s say we want to compress the string “ABABAAC”A B A B A A C. We can find the probabilities of each symbol (character) by dividing the total count by the total length of the string, which is 7:

Original string: 1 A, 1 B, 1 A, 1 B, 2 A's, 1 C — 7 characters.

Counted by symbol: 4 A's, 2 B's, 1 C.

We can represent these probabilities on a range from 0-1.

The range from 0 to 1, divided into one section per symbol, each as wide as that symbol’s probability and ordered widest first: A covers 0 to 0.571, B covers 0.571 to 0.857, C covers 0.857 to 1.

With this setup, we’re ready to do the actual compressing.

For each symbol in our string, starting with “A”, we shrink our range to fit within that symbol’s section. Importantly, we’re still dividing that new range with the same probabilities, but they now have new, smaller ranges.

Once we run out of symbols, we end up with a teeny weeny baby range: [0.38730, 0.38855).

The mixed brackets are intentional. Square brackets [ ] mean endpoint included, round brackets ( ) mean endpoint excluded. So [0, 1) is “all numbers from 0 to 1, including 0 but excluding 1”.

The final number that will represent our entire data can be any number in this range, and ideally, it should be the number that requires the fewest bits possible. You can calculate this with a bit of math, but because I’m nice I’ll just give you the answer: 0.3876953125. So let’s compare: Our original string, “ABABAAC”A B A B A A C, in its raw 8-bit ASCII code requires 56 bits in total, whereas our final number requires only 10.

Our final number is not a floating point—it’s a binary fraction. Floating points are binary fractions too, but they come in fixed widths, so you’d pay 32 or 64 bits whether you need them or not. Ours only needs 10.

So, we have our magical number, but how do we use it to decode our original message? Buckle up, this is going to seem like a magic trick.

Decompressing arithmetic codes

In addition to our magic number, our decompressor also receives the same probabilities we used to compress so it can rebuild that starting range of [0, 1). To decode our original message, it finds which section our magic number falls into and records that symbol. Then it shrinks the range to fit within that section, and repeats the whole process.

Pretty neat, huh?

We’ve now seen how an entropy coder can compress our data using a set of probabilities. As cool as arithmetic coding is (it’s not just me, right?), much of the heavy-lifting comes from the model. Remember: compression loves redundancy. Given this, what do you think would happen if our symbols had more repetition?

How probabilities affect compression

Here’s a new string where the letter A dominates, with a probability of 0.833.

Original string: 10 A's, 1 B, 1 C — 12 characters.

Counted by symbol: 10 A's, 1 B, 1 C.

It turns out, this skewed probability distribution makes a big difference. Let’s see how it stacks up against our old string when we apply arithmetic coding:

Our first string managed to compress to an average of 1.38 bits/symbol, whereas our longer string compressed to 0.82 bits/symbol. When your data is more skewed (i.e. the higher the probabilities of some of your symbols), the better the compression ratio.

This avg bits/symbol is a very important number. It’s called entropy, and it is the bedrock of compression.

“Wait, isn’t entropy a physics thing?” you might ask. Yes! But what we’re talking about is Shannon entropy, which is related to data compression (in the field of information theory). What’s cool is that its mathematical formula is nearly identical to the Gibbs formula for entropy in thermodynamics. Wild, huh?

Entropy

Consider the following sentence:

“Yesterday I saw an animal when I was walking downtown. It was a _____.”

How many guesses do you think it would take you to fill in the blank? If it was a common animal like bird, you might get it on the first try. But what if the answer was bear? That would probably take quite a few guesses.

Let’s say these are the possible answers, along with their probabilities written as fractions:

Knowing the probabilities, we can actually calculate how many guesses it would take to guess correctly, on average, per animal.

Now, notice that each animal is half as likely as the one before, with the exception of fox and bear (these are probabilities, so our numbers need to add up to 1). If we were to guess each animal in order, from most probable to least, we’d have a 50/50 chance of being right each time. As such, we can determine the number of guesses it would take to guess a given animal (on average) using a yes/no decision tree. We start with the most likely animal at the top, and work our way down:

Let’s get back to compression. Symbols with higher probabilities help us compress better, and we see the same pattern in our decision tree: the more probable animals require fewer guesses. If we treat the animals as symbols and swap the yes’s and no’s for 1’s and 0’s, the number of guesses becomes exactly the number of bits needed to represent each one. If we record the 1’s and 0’s we take to reach each animal you’ll see that the more common animals get shorter “codewords” (unique sequences of bits), and rarer animals get longer ones.

Assigning codewords to symbols like this is actually another type of entropy coder called Huffman coding, which is used in popular tools like gzip and Brotli. Instead of encoding our data into a single number, like with arithmetic coding, the Huffman method creates codewords to represent each symbol.

But there’s a problem: what happens when our probabilities aren’t neatly divided in half? If cat had a probability of 0.3973, then the likelihood of the answer being a cat or not a cat isn’t 50/50 anymore. Every path down the tree is a whole number of “guesses”, so we’re forced to round, and rounding means paying for bits we don’t need. How can we tell the absolute fewest number of bits required to represent a given symbol?

Turns out we can calculate this with a little bit of math:

number of bits = −log2(probability)

Quick refresher: logarithms are the reverse of exponents. For example, 242 to the power of 4 asks “What is 2 to the power of 4?”. On the flip side, log2(16)log base 2 of 16 asks “2 to the power of what number equals 16?”

If we plug in our animal probabilities, you’ll see we get the same number of bits as guesses from our decision tree:

If we get the average −log2(probability)negative log base 2 of probability of all our symbols, that tells us our entropy.

The most important thing to understand about entropy is that it’s the floor. This is the smallest number of bits per symbol we can achieve for a given set of data. It ain’t getting any more squished.

Note: this floor only applies when you don’t want to lose data, but compressors like JPEG or MP3 can get smaller by throwing out details that won’t be missed. This is called lossy compression. Everything discussed here is about lossless compression, where no data is lost, but both rely on models and probabilities to shrink data.

But wait, if there’s really a limit to how much you can compress data, why isn’t there just one mega God-compressor that we use on everything? Well, that’s because entropy is specific to a set of probabilities. If we can make our probability distribution more skewed, we can compress things more.

But how do we do that?

Context matters

Up until now, we’ve been working with a very simple type of model that only cares about a symbol’s frequency. count / total_symbols = its probability.

But context can greatly affect a symbol’s probability. For example, in the entire English language, the letter U has a probability of ~0.028. However, when preceded by a Q, this shoots up to ~0.999.

Wowza.

On top of that, higher probabilities compress into fewer bits. We saw this before in the arithmetic coding section, but now we can prove it with math:

• U: −log2(0.028)negative log base 2 of 0.028 ≈ 5.158 bits
• U (preceded by Q): −log2(0.999)negative log base 2 of 0.999 ≈ 0.001 bits

Using a single context to determine the probability of a symbol is called an order-1 model. It answers the question, “Given (some context), what is the probability of (symbol)?” With order-1, you factor in the previous symbol as your context, but you could expand this to order-2, order-3, order-4, and so on, which look at the previous N symbols.

But how do we feed this into an entropy coder? Previously our model was just a table of probabilities per symbol, but with context, we suddenly have a whole set of tables, one for each preceding symbol. So what do we do?

Let’s see what happens when we apply arithmetic coding to the string “TO BE OR NOT TO BE” using an order-1 model. Notice that with each symbol we encode, our new ranges contain a different set of probabilities.

Ok, but how much does using order-N models actually impact compression?

Take a look:

Wow! Using an order-1 model cut our compressed output by more than half! Clearly, adding context gives us stronger probabilities. In other words, it helps us predict what symbol comes next.

Do you know what else is really good at prediction?

Language modeling and compression

To say that there’s an overlap between LLMs and compression would be a huge understatement. In fact, in 2023, Google DeepMind released a paper arguing that language modeling and compression are two views of the same thing.

This might seem like an odd claim. After all, when you think of using LLMs, you probably think of typing a prompt into an AI chatbot and it responding with an answer. How is that compression?

Well, it’s not, but stick with me.

You might have heard LLMs described as “fancy autocomplete”, and this is essentially true. When you submit a prompt to an LLM, that becomes the context the model uses to return a set of probabilities for the next possible words. It then chooses one of those options and appends it to the context. Rinse and repeat. That’s how LLMs generate text.

While we’re here, let’s get some terminology straight. With LLMs, what it returns aren’t technically “words” but tokens: numbers that represent words or parts of words. Tokens are the vocabulary an LLM uses to parse context and generate responses.

Now consider this: while entropy coders are what produce the final raw bitstream, there’s nothing in them that you can tweak to get better results. They are fixed, deterministic, and lossless. If you want better compression, you need to tweak the model so we get higher probabilities per symbol. In other words, we need a better predictor. And when it comes to prediction, LLMs are basically as good as it gets:

Using LLMs for compression is similar to how they’re used to generate text, except that we don’t choose the next word. Why? Because we’re not trying to generate new text. We already know what the next word is! Here’s how it works: based on the previous tokens (i.e. based on the context), the model says, “These are the tokens I think come next, and their probabilities.” Then it looks at what the real next symbol is. Whatever probability the model assigned is what determines the cost, in bits. If the model is well-trained, the token it thinks has the highest probability will be the actual next symbol.

As you click through the demo, notice how the total bits (at the top) increases based on the probability for each token encoded. Again, the number of bits required to represent each token is determined by −log2(probability)negative log base 2 of probability.

Now, if the model is not well-trained, it pays a price. For example, if our context is “The rain in”, a poorly trained model might give “Bermuda” a probability of 0.82, but the actual next word is “Spain”, which it assigned a probability of 0.02. Remember, lower probabilities require more bits, so the model is dinged for guessing wrong:

We can see these differences with arithmetic coding as well. Remember: when we encode each symbol, we’re left with a smaller and smaller range. Encoding symbols with small probabilities (like when our model makes poor guesses) makes our ranges even tinier. Our final number needs to fit inside those ranges, and the smaller the range, the more precision is needed. More precision = more digits = more bits.

The actual total is rounded up, since computers can’t do “partial” bits.

That said, even archaic LLMs that are considered crappy by today’s standards can achieve some impressive compression ratios. Here’s how an order-1 model stacks up against GPT-2 with arithmetic coding in compressing a famous Charles Dickens quote:

“It was the best of times, it was the worst of times, it was the age of wisdom, it was the age of foolishness, it was the epoch of belief, it was the epoch of incredulity, it was the season of Light, it was the season of Darkness.”

• order-1 434 bits · 24% of original
• GPT-2 176 bits · 10% of original

So if LLMs are so great at compression, why aren’t we using them everywhere?

Compression in the wild

Unfortunately, how good a model is at compressing alone doesn’t give us the full picture. See, the goal of compression tools isn’t just to shrink data as much as possible. It’s to shrink the data as much as possible, given certain resource constraints.

Take HTTP responses: when your browser requests a webpage, it sends a header like Accept-Encoding: gzip, br, telling the server which compression formats it can decode (gzip, Brotli, etc). The server picks one to compress the response before sending it.

Let’s assume a server uses gzip to compress its response. When your browser receives this response, it uses a small, built-in model to decode the gzip-compressed bitstream into HTML, CSS, and JavaScript. The overhead is tiny. If we were to instead use an LLM for this job, both the browser and the server would need a copy of the LLM, which could be multi-gigabytes large. That’s a high price for good compression, and we haven’t even run the thing. Compressing (and decompressing) data would demand a lot of resources and degrade page load speed to an unusable degree. Imagine: for every stylesheet, every script, every JSON payload running an LLM to compress and decompress. Yuck.

For a task as trivial as squishing HTTP responses, LLMs are comically overkill: once you factor in the model’s size, you’d be shipping gigabytes to save a few KB. But even if you were trying to compress datasets that dwarf the size of the LLM, the astronomical amount of compute required would still make this impractical.

Two sides, same coin

Compressing data down to its entropy is, at this point, a solved problem. Arithmetic coding, developed in the late 1970s, lands within a couple bits of the limit, and these days entropy coders compete on speed and memory, not ratio.

The open question is how small we can make our entropy. Better models—better predictors—help us lower this number. LLMs are fantastic at this (setting aside the overhead cost), but what’s really interesting is that they’re trained to minimize that exact bits-per-symbol number. With LLMs this is called cross-entropy, but it’s the same underlying formula. So while in compression entropy measures how small we can shrink things, in language modeling, it’s a number we reduce to make our model better at prediction. If you’d like to dig into the nitty-gritty of this, check out this article by Chris Olah.

At the end of the day, though, both LLMs and compression algorithms are predictors. They’re two expressions of the same underlying math. Compression is prediction, and LLMs are compressors.

On January 1, 1870, Jay Cooke, hailed as an American hero for his role in financing the Union effort in the Civil War, signed a contract that would, if you squint, lead to world war.

In 1864, Congress had created the Northern Pacific Railway Company with the goal of linking the Great Lakes and Puget Sound with tracks that would eventually run from Duluth to Tacoma; the charter included 40 million acres of land adjacent to the proposed line in exchange for accomplishing the build-out. For the ensuing six years, however, Northern Pacific struggled to secure financing, even as the Union Pacific and Central Pacific railroads built towards each other, driving the golden spike linking Sacramento and Omaha in May 1869.

Northern Pacific had approached Cooke about funding in 1866, but lacked the generous federal guarantees that undergirded Union Pacific and Central Pacific (which, it should be noted, led to an incredible amount of graft); Cooke, himself no stranger to the financial power of the federal government, wasn’t interested. Ultimately, however, Northern Pacific gave him an offer he couldn’t resist: a commission of 12 percent on every bond, and $200 of Northern Pacific stock for every $1,000 in bonds he sold.

Cooke soon found that his institutional peers agreed with his earlier refusal, and weren’t interested in his bonds, so he leaned on the same tactics he honed selling war bonds: appeals to patriotism, control of the media, and promises of railroad fortunes, backed by industrial-scale distribution. At the peak Cooke employed 1,500 salespeople and funded 1,300 newspapers (through a combination of advertising and direct payments) with a brand burnished by the Civil War. Retail investors could already buy railway bonds; Cooke made them his primary funding mechanism.

This was, to be certain, an incredible innovation. It used to be the case that if you couldn’t get loans from the government or from banks, you couldn’t get much money at all. The problem was that Northern Pacific’s capital needs were endless, and by September 1873, as credit tightened worldwide thanks to a crash on the Vienna stock exchange and the demonetization of silver, Cooke, who had been funding Northern Pacific from deposits in between bond issuances, could find no more buyers. The subsequent bankruptcy of Jay Cooke & Company triggered the Panic of 1873, culminating in endless railroad bankruptcies across the country, a multi-year depression, multi-decade deflation, and, one could argue, the financial conditions that made Europe, four decades later, into a tinder box.

Northern Pacific did eventually finish their line, by the way, with multiple bankruptcies along the way; ultimately, they were one of four railroads that were merged to form the Burlington Northern Railroad. Burlington Northern would eventually merge with the Atchison, Topeka and Santa Fe Railway to form BNSF Railway; Berkshire Hathaway would purchase the parent corporation in 2009.

Blowing Through Debt

If this story sounds vaguely familiar it might be because Cooke is — for obvious reasons — a central character in Liaquat Ahamed’s new book, 1873, released earlier this year. Ahamed is not shy about drawing a link between the collapse of the railroad buildout and the current AI moment; the book’s very first page — even before page 1 — is about translating sums of money, and concludes thusly:

In order to grasp the true significance of sums of money that relate to the economic situation of whole countries — such as the size of the indemnity imposed on France after the Franco-Prussian war — it is most useful not simply to make allowances for changes in the cost of living but instead to adjust for changes in the size of economies. To translate such figures into comparable 2026 magnitudes, multiply by a factor of 1,200. Thus the $500 million that went into U.S. railway bonds annually during the boom years of the early 1870s would today be the equivalent of $600 billion, roughly what is projected to be invested by major tech companies in 2026.

Microsoft CEO Satya Nadella is certainly aware of the connection: he cited 1873 as “the book to be read” on the company’s recent earnings call. Perhaps it’s not a coincidence, then, that Microsoft, alone amongst the hyperscalers, still boasts substantial free cash flow — $19.6 billion last quarter. Microsoft is the one hyperscaler still abiding by the dictum used to deny the existence of a bubble: its CapEx isn’t funded by debt.

This was, believe it or not, a defense that could be used for nearly all of Big Tech a year ago; then, between September and November, Oracle, Meta, Alphabet, and Amazon issued a combined $80 billion in debt for building out infrastructure. That was only the beginning: after raising a combined $108 billion in all of 2025, these four companies have, as of July 7, already raised $194 billion this year. Unsurprisingly, spreads are rising, and 86% of the bonds issued this year are already trading at higher yields than at issuance. Cover for recent issuance has fallen to less than 2x, from 5x in February.

The real shock, however, came at the beginning of June, when Google announced it would raise $85 billion in equity, including a special $10 billion issuance to the aforementioned Berkshire Hathaway. I wrote at the time in The Google Capital Company:

It is worth noting that $10 billion is a relatively small amount of money to both companies. To that end, perhaps the primary utility is as a signaling mechanism. On Google’s side, the signal is that the expected demand is actually far greater than anyone thinks, and that the company is ready and willing to fund supply using all means at its disposal, including equity; for them Berkshire Hathaway’s investment is an endorsement of this view and a validation of the wisdom of the investment. And, on the flip side, if the signal is correct, then Berkshire Hathaway is getting a deal and putting its cash flow machines to work building the future.

I concluded:

Implicit in this analysis was that there was enough compute capacity in the world to be bought; what happens, however, when and if there isn’t? What if the ultimate battle — the one that determines who gets compute — becomes a matter of who can bring the most cash to bear? And what if that advantage compounds, such that the company with the most cash capacity ends up with the most compute capacity (which we already know they will sell, in addition to using themselves) driving the ability to generate more cash? In that world, what company would be your best bet?

The implied answer, of course, was Google.

DeepMind Drama

Google right now is no one’s bet, at least in terms of the frontier. After the departure of DeepMind CEO Demis Hassabis (technically promoted to chairman, but no longer in charge of day-to-day operations) and Gemini co-lead and former Chief Scientist Jeff Dean, along with a host of other prominent researchers, SemiAnalysis declared that Gemini is Cooked:

For all intents and purposes, we believe DeepMind is no longer a frontier lab. We said as much a few months ago to our Tokenomics clients due to large numbers of departures from their reinforcement learning teams and poor compute allocation. Google will continue meandering on and releasing models, but their odds of reaching SOTA again have dropped to zero.

Furthermore, the biggest beneficiary of today’s news is neither Anthropic nor OpenAI—it’s Google Cloud. Whereas Gemini and GCP used to desperately fight for compute allocation, it’s now clear that Thomas Kurian won. We expect GCP revenue growth to meaningfully accelerate as a result.

From later in the post:

We’ve obviously been quite bearish on DeepMind thus far, and if we had to steelman the case for why they’ll still be able to train a true SOTA model in the future, it would go something like the following:

• The current setup clearly wasn’t working. With the existing leadership team, their odds of catching up to Anthropic/OpenAI looked extremely slim.
• Now that they’ve cleaned house, the new guys can start from a blank slate. Maybe they’ll even acqui-hire a neolab like SSI or Thinking Machines.
• With this new team, their odds of catching up to the frontier actually increase.

Perhaps there’s some world in which this happens, but we think the odds are basically zero. The issue with Google was not Jeff Dean nor Noam Shazeer, but rather their extremely bureaucratic, painfully slow, and strategically timid culture. Remember that DeepMind had an AI chatbot 1 year before ChatGPT but was not allowed to release it due to fears of disrupting their core business.

Actually, you could make the case the problem was also Hassabis and DeepMind. I explained in an Update after Google I/O how Hassabis’ vision of the frontier was fundamentally different from the other frontier labs because he believed in world models, not just text/code, and concluded:

What falls out of [Hassabis’ vision] are models with multimodality — in contrast to Claude, which outputs text only — and, it must be said, not nearly as impressive coding capabilities. This gets at the point of this entire digression: I think it’s possible that the reason Google is widely considered to be behind both Anthropic and OpenAI in terms of coding, particularly long-running agentic workflows that depend just as much on the harness as the model itself, simply comes down to their research team having other priorities. That’s why the coding parts of this keynote fell on the Antigravity team, not DeepMind, and why Hassabis was barely on stage.

From this perspective, last week’s events are less surprising, and were arguably foretold at I/O: Hassabis might be right about world models being the path to AGI, but Google has run out of patience in terms of letting him find out; Google co-founder Sergey Brin is reportedly deeply involved and closely allied with Koray Kavukcuoglu, the new DeepMind CEO, and I wouldn’t be surprised if the company is pivoting to Anthropic’s more text- (and thus code-) centered approach.

Google’s Infrastructure Bet

What is fascinating about Google’s position is that these machinations do not necessarily mean the Berkshire Hathaway bet was a bad one; indeed, it’s arguably good news. This is what the SemiAnalysis article was driving towards, and it’s a point I made last week about Google’s recent earnings:

The story seems to be very similar to last quarter, with even more Google Cloud growth: 82% year-over-year (compared to 63% last quarter, and 32% a year ago), with 36% margins (compared to 33% last quarter, and 21% a year ago). I wondered then how much of this growth was actually Anthropic, and while we didn’t get clear confirmation this quarter, I thought this answer from CEO Sundar Pichai on the earnings call about why Google needs to rent 3rd-party capacity was notable:

I think on the bridge deal, the main thing I would say is, look, there are — on the margin, there are very, very large customers of ours on Cloud who we are trying to support them through this extraordinary moment. And the incremental opportunities they are bringing to us, while a short‑term cost over a few months may be very high, in the lifetime of the deal, as we bring more capacity on, is highly ROI‑positive. So those are factors we are taking into account. So are you willing to take upfront a six‑month deal to be able to serve the customer in what is a multiyear opportunity where the margins and the returns are very, very attractive over that multiyear horizon? So hopefully that gives some color on how we’ve thought about those opportunities.

That customer is almost certainly Anthropic.

Again from SemiAnalysis:

More than 20% of total TPU shipments from 3Q26 to 4Q27 are being sold directly to Anthropic. This is excluding the hundreds of thousands of TPUs GCP already rents to Anthropic today, and the many hundreds of thousands more they’ve committed to rent to Anthropic and Meta over the next 6 quarters…

If you’ve ever listened to an interview of Google Cloud CEO Thomas Kurian, you know he is not AGI pilled. In one podcast, for example, he argued that it’s great for TPUs to become “general purpose infrastructure” that supports customers like Citadel, the Department of Energy, and generic high performance computing. And when asked why he was selling compute to Anthropic despite them competing with Gemini, he said this was the natural consequence of Google being a “platform company.”

Kurian said the same thing to me in a Stratechery Interview:

We sell different parts of our stack. One of the things people don’t realize is we monetize many different parts of the stack in different ways. Like Anthropic, there’s a lot of labs that use our stack — in fact, most of the large AI labs use our stack. So if somebody uses TPUs to either to train their model or to use it for inference, we’re monetizing that part of the stack, that gives us resources to then fund our R&D and other investments. Some of the labs use our TPU and our Gemini model, others may use our TPU and then buy our cybersecurity protection for their models. So as a platform player, we have to allow our technology to be monetized in as many ways as possible and we don’t see it as a zero sum.

We’ll see how zero sum compute actually is — there are reports Google’s researchers have been starved for compute — but the overall takeaway is that whether or not Google is competing for the frontier, they are absolutely competing to dominate AI infrastructure. And, in a world where intelligence is a commodity, TPUs in particular are a big deal.

Last month, in Who’s Afraid of Chinese Models?, I talked about commodity markets in the context of frontier labs versus everyone else; in commodity markets marginal costs are determinative of not just profitability but also viability, and I made the case that the frontier labs are well-positioned to have superior cost structures for any given unit of intelligence.

That cost structure, at least for now, includes the cost of renting compute, and it seems likely that TPUs are cheaper than Nvidia GPUs; Anthropic may have built for TPUs (and Amazon’s Trainium chips) because only Google and Amazon had the wherewithal to fund them, but at this point that ability may very well be a significant advantage. The fact that Anthropic is straight up buying TPUs for its own data centers (converting compute costs from marginal costs to capital costs) suggests that is the case.

What is notable is how amenable Google is to share, even at the price of needing to issue equity. This, however, fits the Berkshire Hathaway model that I wrote about in The Google Capital Company:

One of the businesses Berkshire Hathaway used the See’s profits for was on the opposite end of the spectrum in terms of capital utilization: BNSF Railway. Railways require a lot of capital to operate; BNSF consumed $3.8 billion last year; they also make a lot of money: BNSF’s net income was $5.5 billion on revenue of $23.4 billion. To put that in perspective, the total amount that Berkshire Hathaway has made from See’s Candies is probably less than $3 billion (the last disclosure was “over $2 billion” in 2019), i.e. less than BNSF made last year…

In fact, you can make the case that Abel is actually just replaying Buffett’s strategy, only this time Berkshire Hathaway is See’s Candies, and Google is BNSF. At the end of last quarter Berkshire Hathaway had $373 billion in cash, and $25 billion in free cash flow in 2025. How many companies could actually employ that cash in a way that generated a high rate of return?

It’s hard to imagine a better option than Google. The company is not only investing in AI, but has optionality in terms of outcomes: its Services business benefits from the investment, it is in contention at the model layer with Gemini, and it can sell capacity to the frontier labs. Moreover, that capacity has a sustainable cost advantage because of TPUs, which means that in a world where compute becomes a commodity — as hard as that is to imagine right now — Google is the hyperscaler that is poised to make the most profit.

Notice that I didn’t say margin; if that were Google’s concern they would almost certainly be making different choices. Profit, however, is an absolute number, and Google is bringing everything to bear — first its cash flow, then its debt, and now its equity — on making money from the infrastructure build-out.

Nvidia’s Investable Asset Class

Today corporate executives and financial engineers don’t need to control newspapers; thanks to his new X account, Nvidia CEO Jensen Huang can go straight to the public. From an X Article posted last night:

NVIDIA AI Factory Compute Is Becoming an Investable Asset Class

Today, we announced partnerships with Apollo, BlackRock, Blackstone, Brookfield, Goldman Sachs and KKR to establish independent financing platforms designed to mobilize over $500 billion of third-party capital to support the buildout of AI infrastructure over time.

This is a major milestone for NVIDIA and the AI industry. We have moved from an era in which companies bought chips and built data centers project by project to one in which AI factories can be financed as productive infrastructure — with repeatable platforms, long-term institutional capital and a diverse customer base that uses compute to create revenue.

AI has reached an inflection point. It is moving from research into production. AI is creating real value, and the infrastructure behind it is becoming one of the world’s most productive assets. In AI, compute is revenue.

Huang argues that Nvidia-based AI factories are fungible, protecting residual value, and that CUDA makes AI factories better over time, extending their economic value; according to Huang:

These are the characteristics of an investable infrastructure asset: it produces revenue, serves a broad market, improves in performance over time and can be redeployed.

Thus the attempted formalization of a new investment structure:

The demand for AI infrastructure is extraordinary. But access to capital is uneven. Many great AI companies, enterprises and AI clouds have demand for compute but do not yet have access to financing at the scale or cost required to build quickly. That is why we are partnering with the world’s leading long-term capital providers.

Apollo, BlackRock, Blackstone, Brookfield, Goldman Sachs and KKR are also among the world’s leading infrastructure investors, with deep expertise in underwriting long-lived, productive assets. Together, we are creating repeatable financing platforms to help the AI ecosystem build the factories it needs.

What Apollo et al. are, are new sources of capital beyond the investment grade debt markets. In that sense this proposed structure is somewhat akin to Google’s equity issuance: a way to secure funding beyond bonds. The difference, however, is stark: whereas equity dilutes the upside for investors without adding risk to the company, this structure preserves Nvidia’s margins by finding new pools of capital willing to bear risk.

It’s not a total free ride for Nvidia: the company is backstopping opportunities with up to 25% residual-value based financing, suggesting that Huang believes his “investable asset class” pitch much more than the market does. That is, in a certain sense, a price cut, as the goal is to reduce the cost of capital for entities building data centers with Nvidia chips, by putting Nvidia’s profits on the line for uncertain investments. That guarantee is downstream from Google’s (and soon Amazon’s) aggressiveness: why build a data center with Nvidia chips if you can buy TPUs or Trainiums (Nvidia chips are likely better, but if the constraint on new data centers is capital, lower up-front prices may matter more than token efficiency).

Nvidia’s bigger problem is one that has been apparent for a long time; I wrote back in 2024:

In the before-times, i.e. before the release of ChatGPT, Nvidia was building quite the (free) software moat around its GPUs; the challenge is that it wasn’t entirely clear who was going to use all of that software. Today, meanwhile, the use cases for those GPUs is very clear, and those use cases are happening at a much higher level than CUDA frameworks (i.e. on top of models); that, combined with the massive incentives towards finding cheaper alternatives to Nvidia, means both the pressure to and the possibility of escaping CUDA is higher than it has ever been (even if it is still distant for lower level work, particularly when it comes to training).

The situation today, with Anthropic and OpenAI appearing to pull away, is even more problematic: Anthropic has not been dependent on CUDA for years, and OpenAI is moving in that direction, at least for inference. If those companies win then Nvidia’s profits will be squeezed — indeed, the implication of that backstop is they already are (this, needless to say, is why Huang’s first post was an open letter in defense of open models).

Risky Business

This might not cost Nvidia anything in the end: if AI revenues truly take off, then the debt markets will open back up, and ultimately companies will go back to funding infrastructure investment through free cash flows. Right now, however, is the danger zone, as hyperscalers blow through the debt markets and Google at least starts to tap equity. To the extent Nvidia competes through novel funding mechanisms that, at the end of the day, draw on things like insurance floats and pension funds and other long-run liabilities that are the bread and butter of the asset managers the company is partnering with, the risk — unmarked, unlike equity — is considerably higher.

That’s why I started with 1870 and Cooke’s ill-fated agreement with Northern Pacific. Yes, the upside the deal afforded Cooke was incredible, but it was incredible for a reason: it was very risky, and pioneering new funding mechanisms only served to spread the pain when it all blew up. It’s one thing to spend all of your free cash flow; it’s another thing to tap the debt markets. And, beyond that, it’s a completely new nerve-racking thing to bring safety-seeking assets to bear. AI better deliver before it’s too late.

Core libraries

• All modules specified by the R7RS small language are now available in the core system.
• The internal string representation has been converted to UTF-8, making strings fully UNICODE capable.
• The (chicken blob) module has been replaced with (chicken bytevector), containing R7RS compatible bytevector operations. Bytevectors are now fully equivalent to SRFI-4 u8vectors.
• The read-syntax for blobs (#${...}) has been removed. Bytevectors can be read using #u8(...) or #u8"...".
• char-name now allows removing a named character definition.
• open-input-file and open-output-file accept a file encoding, supported are currently UTF-8 (the default) and Latin-1 (ISO-8859-1).
• file-read, file-write, set-pseudo-random-seed! and random-bytes require a bytevector argument and do not accept strings.
• process-fork, process-run, process, and process* return now a process-object instead of a PID, use process record accessors to retrieve exit-status and input/output ports. process-wait and process-signal accept either a PID or a process object as argument.
• File-locking operations in the (chicken file posix) module now use the flock(2) system call, operator over whole files, are thread-safe and use a simpler interface. file-test-lock has been removed.
• read-u8vector, read-u8vector! and write-u8vector have been removed, use the equivalent operations from the (chicken io) module instead.
• Added read-bytevector, read-bytevector! and write-bytevector to the (chicken io) module.
• Removed set-port-name!, use the SRFI-17 setter for port-name instead.
• Added port-encoding to the (chicken port) module.
• make-input-port and make-output-port take their optional port methods as keyword arguments now.
• Added make-binary-input-port and make-binary-output-port.
• Locatives on strings are now indexed by code-point, not byte.
• symbol-escape now also controls whether symbols are printed in escaped ("|...|") mode or not.
• Symbol printing is stricter in deciding when symbols should be escaped or not.
• The following primitives have been moved from (chicken base) to R7RS modules:
  • exact-integer?, exact-integer-sqrt?, vector-copy!, make-parameter, call/cc, open-input-string, open-output-string, get-output-string, input-port-open?, output-port-open?, parameterize and port? moved from the (chicken base) to the (scheme base) module.
  • case-lambda moved from (chicken base) to (scheme case-lambda).
  • features moved from (chicken platform) to (scheme base).
  • write-string moved from (chicken io) to (scheme base) and its signature changed to the R7RS one.
  • define-record-type moved to (scheme base) and is generative, to be compliant with R7RS.
  • syntax-error has been removed from (chicken syntax) and is now a macro and part of (scheme base).
• record-instance? and make-record-instance accept non-symbolic type specifiers to support generative record types.
• The new (chicken number-vector) module now provides a superset of SRFI-4, including 64 and 128-bit complex number vectors, the srfi-4 module is still available but exports only those procedures as are specified in SRFI-4.
• The second (optional) parameter for load and load-relative may be either an environment or an evaluation procedure.
• The module aliases srfi-0, srfi-6, srfi-9, srfi-11, srfi-23, srfi-39 and srfi-98 have been removed (all of these are covered by R7RS).
• The modules r4rs, r5rs, r4rs-null and r5rs-null have been renamed to (scheme XXX).
• Hexadecimal escape sequences in strings and extended symbols must be terminated by the ; character, following R7RS.
• The #ci/#cs read syntaxes have been removed, use #![no-]fold-case markers instead.
• include and include-relative accept multiple filenames, include-ci has been added.
• Added include-path to (chicken platform) module.
• Added number-vector-data to (chicken memory representation) module.
• define-library has been extended to support the export-all specification.
• The platform-identifier "mingw32" has been renamed to "mingw".
• Library procedures that return paths now always convert them to contain forward slashes, make-pathname always uses "/" for path separation.
• Added expand1 to (chicken syntax) module for expanding a macro only once, also added the ",x1" command to "csi" for this.
• Added the (chicken version) module.
• delete-file* and delete-file now behave consistently with broken symlinks.
• number->string now accepts bases up to 36, where before it only accepted bases up to 16 (thanks to Diego A. Mundo).
• string->number now handles ambiguous cases involving the character "i" in bases higher than 18 more consistently.
• make-rectangular returns a complex number if the imaginary part is inexact zero.
• string->number and the reader accept and handle correctly complex numbers with a negative inexact zero as the imaginary part.
• imag-part returns exact zero when given a non-complex number.
• max and min ignore nan values when given any non-nan argument.

Syntax expander

• syntax-rules attempts to better support tail patterns with ellipses (#1736).

FFI changes

• Strings and symbols passed to foreign code are not copied, they are passed directly, any mutations done by external code will be visible on the Scheme side.
• Complex numbers, C structs and unions can now be passed directly as arguments and returned as results when interfacing to C code.

Tools

• The compiler and interpreter option -r5rs-syntax has been renamed to -r7rs-syntax and does not disable extended symbol syntax ("|...|") anymore.
• The "feathers" debugger has been removed from the core and is now available as an egg.
• The set-describer! procedure has been removed from the csi module.
• The "csc" program now accepts tool flags (e.g. -compiler, -cc etc) which have paths with spaces in them without requiring the user to double-quote them. As a consequence, it no longer accepts programs with space separated flags for tool arguments (e.g. "csc -cc 'gcc -debug'" etc). If this is desired, write a short shell script which calls the tool with your flags.
• chicken-install now locks the cache directory during egg-installation.
• Added component type installed-c-object to egg format.
• The csc-options and link-options configuration clauses in egg specifications now allow custom-config forms to produce arbitrary computed compiler and linker options.
• Added scripts/smoke-test.sh to automate basic testing of chicken-core.

Compiler

• Added the -merge-reusable-closures and -merge-shareable-closures options that enable closure reuse and sharing to reduce memory allocations. These options are enabled automatically by optimization levels 1 (reuse) and 2 (sharing), respectively.

Build system

• A "configure" script is now used to prepare the sources for building everything. This simplifies the use of "make", allows more elaborate platform sanity checks and follows conventions.
• On Windows the minimal "mingw" build is not supported anymore, a POSIX shell and the basic sete of command-line utilities is now required (formerly the "mingw-msys" build). Chris Wellons "w64devkit" is now the recommended toolchain. The platform identifier "mingw-msys" has been renamed to "mingw".
• The system can now be built with "zig cc" as a C compiler/linker replacement.

5.4.0

Security fixes

• CVE-2022-45145: Neutralize possible escape characters in egg metadata to avoid arbitrary OS command injection during egg installation, reported by Vasilij Schneidermann who also provided the necessary patches to mitigate this problem.
• The runtime option "-:b" has been removed, as it was deemed too insecure to be able to drop to a REPL from the CLI of any program.
• Runtime option processing has been hardened: processing now stops on the first non-runtime option or after "-:", whichever comes first.

Core libraries

• Fix type declarations for file-select (reported by Anton Idukov).
• Change create-temporary-{file,directory} fallback code on Windows to use %USERPROFILE%/AppData/Local/Temp if that environment variable is set.
• Added new thread-safe API for POSIX signals ("make-signal-handler", "signal-ignore" and "signal-default") and deprecated the existing one.
• Added "make-finalizer" to execute finalizers in a thread-safe manner.
• Added weak pairs to (chicken base), with similar behaviour to Chez Scheme.
• Added "locative-index", kindly contributed by John Croisant.
• Added "fp*+" (fused multiply-add) to "chicken.flonum" module (suggested by Christian Himpe).
• Added flonum-specific hyperbolic functions and their inverse to "chicken.flonum" module (suggested by Christian Himpe).
• The process-execute procedure now sets argv[0] to the unmodified filename. Previously, the directory part would be stripped.
• Added support for embedded strings and characters in SRFI-4 vector literals.
• read-with-source-info is now documented and officially supported, from the (chicken syntax) module. read/source-info is still exported from the undocumented internal (chicken compiler support) module, but using it from there is deprecated.
• Added "export/rename" to (chicken module) for renaming identifiers on export.
• The values of the TMPDIR, TMP and TEMP environment variables are no longer memoized (fixes #1830).
• Condition objects produced by procedures that change errno now have an errno property.
• Deprecated "chicken-home" and added "include-path" in the chicken.platform module.
• Irregex has been updated to upstream 0.9.11 plus an additional fix for sre->string. The 0.9.11 release fixes a few problems related to utf-8 handling (which should not affect CHICKEN) and expands the definition for the 'whitespace character set to include vertical tab, carriage return and form feed.

Tools

• Fix scripts generated by chicken-install on Windows to not quote >> when echoing into files which would result in empty egg-info files (reported and fixed by Jani Hakala).
• The -R option for csi and csc now accepts list-notation like e.g. (srfi 1). Fixes #1809, reported by Wolfgang Corcoran-Mathe.
• Fix shell quotation in options passed from csc to other tools. Fixes #1302, reported by Xin Wang.
• The -prelude and -postlude options for csc work properly again.
• chicken-install now retrieves the latest egg version when instructed to install an egg that's already installed (#1802).
• When location is specified in setup.defaults, chicken-install will consider two location layouts when looking for eggs: / and //.
• chicken-install: Fix #1684 (programs that specify component-dependencies should build-depend on their import libraries).
• chicken-install now caches eggs installed from local locations.
• chicken-install now accepts the -location command line option (short: -l) to specify local directories where to get egg sources from.
• chicken-install now gives a warning on unexpected properties (#1492).
• chicken-install now uses a directory specific for cache metadata (VERSION, STATUS and TIMESTAMP files) to avoid collisions with source files on case-insensitive file systems like on MacOS (#1753, reported by Kon Lovett).

Syntax expander

• When passing a module as an environment to eval, correctly resolve identifiers in macro expansions (#1295 reported by Caolan McMahon).
• Internal definitions honor rebindings of core special forms (#1132).
• Globally defining an identifier previously bound to a macro now fully shadows the macro (#1166, reported by Michele La Monaca).

Compiler

• When emitting types files, the output list is now sorted, to ensure deterministic build output (fixes #1783, reported by "ss2").

Build system

• Fix compiler warnings about zero-sized memset (reported by Claude Marinier).
• Disable broken test-create-temporary-file on Windows (reported by "jjhoo").
• Drop use of XCODE_... environment variables on MacOS.
• Add build directory to rpath on MacOS so that the test suite picks up correct libchicken, even if CHICKEN is already installed (thanks to Christian Himpe).
• Default "cc" on BSD systems for building CHICKEN to avoid ABI problems when linking with C++ code.

Runtime system

• Make line numbers available for error output and during syntax expansion in the interpreter as well as the compiler.

5.3.0

Core libraries

• In (chicken process-context posix), the setters for current-user-id, current-effective-user-id and current-group-id now check that the new user/group value is a fixnum instead of blindly passing it on to the C implementation (which would cause bogus user ids to be set). Fixes #1787, thanks to Christopher Brannon.
• The srfi-17 module now exports the getter-with-setter and setter procedures, not just the set! macro (thanks to Lassi Kortela).
• Fix hang in chicken-install -update-db on Windows (thanks to Mark Fisher for reporting and Jani Hakala for debugging and patch).
• Fixed an inadvertant error during error reporting in the numerator and denominator procedures when passed non-finite flonums (#1730).
• Fixed a bug where optimisations for irregex-match? would cause runtime errors due to the inlined specialisations not being fully-expanded (see #1690).
• Irregex has been updated to upstream 0.9.10, which fixes behaviour of irregex-replace/all with positive lookbehind so all matches are replaced instead of only the first (reported by Kay Rhodes), and a regression regarding replacing empty matches which was introduced by the fixes in 0.9.7 (reported by Sandra Snan). Also, the http-url shorthand now allows any top-level domain and the old "top-level-domain" now also supports "edu" (fixed by Sandra Snan). Also, a problem was fixed with capturing groups inside a kleene star, which could sometimes return incorrect parts of the match. Finally, "bol" handling was fixed to handle newlines consistently so that multiple matches don't overlap (reported by Sandra Snan).
• current-milliseconds has been deprecated in favor of the name current-process-milliseconds, to avoid confusion due to naming of current-milliseconds versus current-seconds, which do something quite different. Also, its definition has been tweaked to guarantee that it returns the time since process startup. On Windows, it will now return sane values after 24 days of uptime. On UNIX, the values returned will be precise to the millisecond instead of rounded down to the nearest second at startup (which would result in erratic startup times).
• The default mode for files created by file-open has been changed to 0666 (plus whatever change the effective umask applies), rather than 0744 (see #1698).
• Fixed type database entry for "log" with second arg (fixes #1725).
• Made topological-sort behave better when dependency target is listed multiple times by concatenating dependencies (fixes #1185).

Module system

• Reexported macros now work when the reexporting module redefines identifiers from the original (fixes #1757, reported by Sandra Snan).
• When using "except" in "import" to omit reexported macros, they are really not imported (#1771, reported by Sandra Snan).

Runtime system

• Sleeping primordial thread doesn't forget mutations made to parameters in interrupt handlers anymore. (See #1638. Fix contributed by Sebastien Marie.)
• A feature corresponding to the word size is available regardless of the word size (#1693).
• The default maximum heap size on 64-bit platforms is now the theoretical maximum addressable memory size (#1675). Use -:m if you would like to override this at run-time.
• Deprecated C_(a_i_current_)milliseconds in favor of C_(a_i_)current_process_milliseconds to match the Scheme-level deprecation of current-milliseconds.
• Officially deprecated C_pair() in favor of C_a_pair(); it has been deprecated for years.
• At program cleanup, finalizers are only forced when the live finalizer count is non-zero.
• The symbol srfi-87 has been added to the list of built-in feature identifiers.
• Garbage collection algorithm has been changed to reduce thrashing when heap is almost full, by growing the heap sooner. A new -:hf option was added to tweak when heap growth should occur.
• Added -:R runtime option to initialize rand() state deterministically (should help with #1650 and benchmarking).

Compiler

• Statically linked programs using built-in libraries are supported again (fixes #1788, a regression from 5.2.0).
• Avoid re-using argvector when inline rest operations are being used in CPS calls (#1703, thanks to Jakob L. Keuze).
• An emit-types-file declaration has been added, which corresponds to the compiler flag of the same name (#1644, thanks to Marco Maggi for the suggestion).
• Fixed a bug caused by a bad interaction between two optimizations: argvector rest ops would be applied even if a procedure already got its rest arg consed at the call site (#1756, thanks to Sandra Snan).

Build system

• Fix build with tcc.
• Fix a few tests on Windows so the suite passes once again.
• Auto-configure at build time on most platforms. Cross-compilation still requires PLATFORM to be set, and it can still be provided manually, but it is no longer required in the common case.
• Fix Linux to MingW cross-compilation (#1768, thanks to Théo Cavignac).
• The clean target for make now also removes build configuration files.
• The distclean target for make has been removed (now clean does what distclean used to do).

Tools

• Fix a problem with egg installation scripts on Windows, where the platform was not correctly identified, depending on the shell used during installation of the core system (thanks again to Mark Fisher for reporting and helping in finding the culprit).
• Fixed a bug in chicken-install (#1744) that would cause Error: (string->number) bad argument type: #!eof in some cases.
• If chicken-install has a program prefix/suffix, it now writes to a cache directory matching its program name (#1713, thanks to Alice Maz).
• Fixed bug in chicken-install regarding variable quotation on UNIX-like systems which prevented installation into paths with spaces (#1685).
• Fixed a similar bug in chicken-install for paths with spaces on mingw and mingw-msys (#1727, thanks to Josh Helzer for reporting and Vasilij Schneidermann for the patch).

Module system

• Fixed a memory leak when calling (import) multiple times in a row on the same module (#1772; reported by "plugd" on IRC).

5.2.0

Core libraries

• Fix memory-statistics by returning semi-space bytes and used semi-space bytes like the documentation says. Old implementation returned full-heap size and (full-heap - used-semi-space).
• for-each and map now behave consistently in compiled and interpreted mode, like in SRFI-1. They now stop when the shortest list is exhausted instead of raising an exception (fixes #1422).
• There is now a srfi-88 module which contains just the three procedures from the (chicken keyword) module defined by the SRFI.
• A feature identifier named "srfi-88" is now registered.
• The procedures record-printer and set-record-printer! and a corresponding SRFI-17 setter have been added. These deprecate define-record-printer which isn't a "real" definition (see #1294).
• On Windows, decompose-directory no longer crashes when a drive letter is present in the supplied path string.
• irregex-replace[/all] have been fixed for empty matches, so they will no longer drop characters and ignore the replacement (#1661).
• Irregex has been updated to upstream 0.9.7, which also improves how empty matches are treated in irregex-fold and irregex-split.

Runtime system

• Quoted empty keywords like ||: and :|| are now read like prescribed by SRFI-88 in the corresponding keyword mode.
• Symbols containing quoted empty prefixes or suffixes like ||:abc and abc:|| will be read correctly as symbols now (fixes #1625, thanks to Andy Bennett).
• IEEE floating point negative zero is now properly handled: it can be read, written and distinguished by eqv? and equal?, but not = (fixes #1627, thanks to John Cowan).
• ##sys#check-exact and its C implementations C_i_check_exact and C_i_check_exact_2 have been deprecated (see also #1631).
• When garbage collector is manually invoked from a finalizer, raise an error instead of hanging forever (fixes #1586).
• define-record-type will now give an error if the constructor definition refers to field that's not listed elsewhere (see #1633).
• Added new -:hu option to set the memory usage low watermark percentage at which the heap should be shrunk, and changed the calculation to actually reflect this (see #1379).

Compiler

• Fixed a bug in lfa2 pass which caused "if" or "cond" nodes to be incorrectly unboxed if the "else" branch had a flonum result type (#1624, thanks to Sven Hartrumpf).
• Inline files no longer refer to unexported foreign stub functions (fixes #1440, thanks to "megane").
• In some cases, rest argument lists do not need to be reified, which should make using optional arguments and case-lambda faster (#1623).
• Values from foreign types which have an argument or return value converter are no longer inferred to have the Scheme type which corresponds to the raw foreign type, which was incorrect (#1649).

Module system

• Trying to export a foreign variable, define-inlined procedure or define-constant variable gives a friendly error instead of saying the variable doesn't exist (fixes #1346).
• When modules are registered, they no longer pollute the global environment with imports made in that module (fixes #1548).

Tools

• The new "-module-registration" options causes module registration code to always be included in the program, even when it has also been emitted as a separate file (for example with "-J").
• chicken-install now correctly checks server response code to avoid interpreting error response bodies (like 404, 500) as Scheme code.
• chicken-install now follows HTTP redirects when downloading eggs.
• chicken-install will now change to the correct drive before attempting to change to the egg directory (fixes #1647).

5.1.0

Core libraries

• Symbols ending or starting with a colon are now always pipe-quoted when written by write to ensure they can be read back with a different keyword-style setting.
• Read-write invariance of special symbols starting with #! other than #!key, #!rest or #!optional is now preserved (#1572).
• When using (set-file-position!) on a port, its EOF status will now be reset.
• In (chicken file posix), the values of perm/irgrp, perm/iwgrp, perm/ixgrp, perm/iroth, perm/iwoth and perm/ixoth are now correctly defined (they were all for "usr"; #1602, thanks to Eric Hoffman).
• In (chicken file posix), file-truncate now accepts also accepts port objects, for consistency with other file procedures. All such procedures from (chicken file posix) now have the correct types in types.db (fixes #1609, thanks to Robert Jensen).
• Add the system-config-directory and system-cache-directory procedures in the chicken.platform module. These procedures follow the XDG specification and also give sensible results on Windows.
• Fix get-environment from (chicken process-context) to raise an error when passed #f instead of segfaulting.
• Qualified symbols (##foo#bar style) are no longer encoded by a byte prefix inside the symbol name. This ensures read-write invariance of symbols which start with a low-byte character (fixes #1077, except for keywords, which start with NUL bytes).
• Fix a missing export (list->s64vector) in SRFI-4.

Runtime system

• Keywords are now distinct types; they are not a subtype of symbols.
• Use arc4random on FreeBSD (thanks to Tobias Kortkamp and gahr).
• Removed the unused, undocumented (and incorrect!) C functions C_delete_symbol_table and C_set_symbol_table.
• Continuations which discard additional values beyond the first no longer accept multiple values via direct invocation after being captured through call/cc, only via values (revert of #1390, due to #1601).
• SRFI-4 vector predicates, reference, set and length procedures should now be faster in tight loops as they're inlineable (#757).
• Keywords are now interned in a separate keyword table, not in the standard symbol table. This brings full read-write invariance for symbols (they can now also start with NUL bytes). Keywords no longer have plists. Fixes #1576.
• Increased the "binary compatibility version" to 11.

Compiler

• Restored optimized implementations of =, +, -, /, * and quotient in fixnum-arithmetic mode (fixes #1604 mostly; thanks to "chickendan").
• Added an optimization pass for reducing the amount of boxing of intermediate floating point values, enabled by the "-lfa2" compiler option.
• The "lfa2" pass is now enabled at optimization levels 2 or higher.

Module system

• When you try to import the module you are currently defining into itself, an error will be raised. This prevents an infinite loop in the compiler when later trying to import that same module (fixes #1506, thanks to Kristian Lein-Mathisen).

Foreign function interface

• Improved hygiene in FFI macro expansions, which means you don't have to import "scheme" or "(chicken base)" for them to work.

Type system

• It is now possible to quote free variables in type declarations, which acts as shorthand for forall (thanks to "megane").

Tools

• csi now uses (system-config-directory) to find csirc and falls back to $HOME/.csirc when needed.
• chicken-install now uses (system-config-directory) to find a user defined setup.defaults file; it also uses (system-cache-directory) for its egg cache directory when the CHICKEN_EGG_CACHE environment variable is not defined.

Egg specifications

• Allows "cond-expand" and "error" forms in egg specification files.
• Add "c-object" and "object" properties to link separately compiled C objects into CHICKEN code.

5.0.0

Runtime system

• Added support for the full numeric tower, including various new procedures taken from the "numbers" egg. All calculations will now return exact numbers where possible, so code relying on flonums being returned may need to be changed if rational numbers do not provide the desired performance.
• Port directionality has been generalized from a simple input/output flag to a bitmap, to allow for multidirectional ports.
• Weak symbol GC is faster, simpler, and can now collect all unreferenced symbols instead of a maximum of 997 per major GC.
• The -:w option has been removed; symbols are now always collected.
• Increased the "binary compatibility version" to 9.
• Continuations which discard additional values beyond the first now also accept multiple values via direct invocation after being captured through call/cc, not just via values (#1390).
• Removed the deprecated C_locative_ref and C_mutate2 C functions.
• The trace buffer no longer holds on to thread objects, allowing them to be garbage collected sooner (#1356, thanks to Kristian Lein-Mathisen).
• On Cygwin and MinGW, the "build-platform" now corresponds to the tool chain used (gnu, clang, unknown) like on *nix, while the software-version is now "cygwin" or "mingw32" instead of "unknown". This also means the features list will now contain the tool chain on all platforms.
• Symbols starting with #% are no longer treated specially and need to be quoted with pipes. This makes the "%" sign available for use in custom/user-defined sharp-sign read syntax.

Compiler

• Fixed an off by one allocation problem in generated C code for (list ...).
• The "-scrutinize" compiler option has been removed.
• The "-module" compiler option (aliased as "-m") now expects a module name.
• The generated C output of the compiler is now deterministic: it will be bit-for-bit identical when compiling the same Scheme file with the same version of the compiler.
• the "-consult-type-file" and "-emit-type-file" options have been renamed to "-consult-types-file" and "-emit-types-file", respectively.

Tools

• The new "-link" option to csc allows linking with objects from extensions.
• The new "-libdir" option to csc allows overriding the runtime library directory.
• The ambiguous "-l" option for csc has been removed (#1193).
• Removed deprecated "-n" shorthand for "-emit-inline-file" from csc.
• Removed "chicken-bug" tool.

Core libraries

• Removed support for memory-mapped files (posix), queues (data-structures), binary-search (data-structures), scan-input-lines (utils), group-information (posix) object-eviction (lolevel), and compile-file (utils). These are now available as eggs.
• Removed the srfi-1, srfi-13, srfi-14, srfi-18, srfi-69, and utils units. These are now available as eggs.
• Added the executable-pathname procedure for retrieving a path to the currently-running executable.
• Removed all support for SWIG.
• Removed interrupts-enabled declaration specifier.
• sleep now suspends the current thread when threading is enabled, otherwise it sleeps the process. The new process-sleep procedure in unit posix can be used to sleep the process unconditionally.
• with-error-output-to-port from the ports module has been renamed to the more common with-error-to-port, and with-error-to-string has been added for completeness (thanks to Michael Silver).
• A new make-bidirectional-port procedure has been added to the ports unit that will combine separate input- and output- ports into a single bidirectional port.
• New input-port-open? and output-port-open? procedures have been added for testing whether a port is open in a specific direction.
• An include-relative form has been added to the (chicken base) module. This works like load-relative but for textual inclusion.
• Keywords are now always written in "portable" style by WRITE, so that the reader's keyword style doesn't need to match the writer's.
• The environment variable CHICKEN_PREFIX has been removed.
• Added the glob->sre procedure to the irregex library.
• Removed the get-host-name and system-information procedures. These are available in the "system-information" egg.
• Removed the eval-when, select and ensure macros. These are available in the "miscmacros" egg.
• Removed the require-extension-for-syntax macro.
• Renamed bit-set? to bit->boolean because of swapped argument order with respect to SRFI-33 and SRFI-60, which was confusing (fixes #1385, thanks to Lemonboy).
• file-{read,write,execute}-access will now raise an exception when the file doesn't exist or some other non-access related problem is detected (fixes #1386, thanks to Vasilij Schneidermann).
• change-file-mode was renamed to set-file-permissions! and SRFI-17 generalized set! support has been added for file-permissions. This procedure now also accepts a file descriptor or a port.
• file-permissions now returns one value: the permission integer.
• read-file has been renamed to read-list.
• read-all was dropped, as read-string with #f as its NUM argument is equivalent.
• read-lines and read-all no longer accept a string naming a file, only ports.
• The procedures for random numbers have been reimplemented; access to system-specific entropy is available, together with a reasonably good pseudo random number generator (WELL512).
• glob now returns an empty list for non-existent or inaccessible directories, instead of erroring out.
• file-copy and file-move have been renamed to copy-file and move-file, for consistency with delete-file and rename-file.
• rename-file now refuses to overwrite an existing file unless an optional "clobber" argument is provided.
• The r4rs module no longer exports eval, which was not in R4RS.
• process, process* and process-execute now expect lists of the form (("NAME" . "VALUE") ...) instead of the previous (("NAME=VALUE") ...) as their environment argument.
• repository-path is now a parameter containing a list of strings instead of a string, as the search path for libraries can now contain multiple directories.
• file-read-access?, file-write-access? and file-execute-access? have been renamed file-readable?, file-writable? and file-executable? into the (chicken file) module.

Module system

• The compiler has been modularised, for improved namespacing. This means names from the compiler should not leak out into the compiled program's (macro) namespace anymore.
• The core units have been converted to modules under the "chicken" namespace.
• Added support for list-style library names.
• The "use" and "use-for-syntax" special forms have been removed in favor of "import" and "import-for-syntax" to reduce confusion.
• Module imports are now lexically scoped: identifiers provided by an (import ...) inside (let ...) won't be visible outside that let.
• Modules implementing an interface can now correctly export extra identifiers (bug reported by Martin Schneeweis, fix by "megane").
• Eggs management
• Egg-installation and building has been completely overhauled.
• .meta + .setup files have been merged into a single declarative ".egg" file.
• More static checks for egg descriptions, simplified generation of OS-specific build + install commands that is (hopefully) more practical for package maintainers.
• Egg sources are cached locally to reduce download and rebuild times.
• Dropped many obscure or unimportant options and features from chicken-install: (-keep-installed, -reinstall, -proxy, -no-install, -username, -password, -init, -deploy, -keep-going, -scan, -csi, -show-depends, -show-foreign-depends, -prefix).
• Added new "-from-list" option to chicken-install.
• Eggs can now be installed and located in multiple directories, using the CHICKEN_REPOSITORY_PATH + CHICKEN_INSTALL_REPOSITORY environment variables.
• Static compilation of eggs is now fully supported and static versions of compiled eggs are available by default.
• In a statically built chicken, the egg-tools ("chicken-install", "...-status", "...-uninstall") are still available, but only support static compilation of eggs.

Foreign function interface

• The foreign type specifier "ssize_t" is now accepted, and "size_t" arguments now only accept positive integers. Return values of type size_t are no longer truncated on 32-bit platforms.

A Newspaper Classifieds Story

I can smell the newsprint. Photo by AbsolutVision on Unsplash

One of my first big personal successes in my career was way back in 2000, when I became Polo Ralph Lauren’s in-house photographer. It was my second staff photography job, the first one being at Christie’s auction house. Polo offered me twice what I was making at Christie’s, and accepting the position was a no-brainer. It felt great as a young photographer who’d only been in New York for a few years to have found myself in what seemed like a dream job.

But looking back, one of the most interesting things about it was how I found this dream job, through a relic of an earlier time: a classified listing in the newspaper.

At least, that’s how I’ve been telling the story for years. I found the job listing in the New York Times classifieds. I did, right? I mean, memories can change over time. Maybe it wasn’t the New York Times. I think it was. What else would it have been? Have I told the story so many times that I’ve altered my memory to something it wasn’t?

Well, I’m a New York Times subscriber, which gives me access to 150 years of scanned newspapers through the Times Machine. So I decided to see if I could actually find the classified listing that got me that job.

Luckily, I’m also a bit of a digital hoarder. I have every email I’ve sent or received since 1997. All my high school and college notebooks and papers have been converted to PDF for longevity and searchability, just in case I ever really want to know what I thought of The Great Gatsby in high school. I’ve scanned everything my parents stored in boxes from my childhood and recycled all the paper. I’m far more likely to reference something I can find on my hard drive than something in a box 2000 miles away.

So it didn’t take me long to search my archives and find the cover letter I wrote when I applied for the job. And that gave me an approximate date to search the Times classifieds.

I won’t bury the lede any further. I found it. And it didn’t take long. I figured it was probably a Sunday paper, since that’s when I would have been most likely to actually get the paper. So I went to the Times Machine archive for the Sunday before my cover letter was dated, and went to the job listings. I had to remember what it was like to look for a job. I went to the jobs section, found the “P” listings for Photographers.

I remember now the frustration of looking for a photography job in the classifieds. Most of the listings were not for the kinds of photography jobs I wanted. There seemed to always be a listing for school portrait photographers, and jobs that didn’t really require much of an understanding of composition. They seemed to me like jobs that happened to use cameras. But I kept looking.

And then there it was. On January 16, 2000.

It’s kind of hard to read. But it says:

PHOTOGRAPHER
Leading Fashion Company seeks staff photographer. Subjects include showroom interiors, store windows as well as product. Demonstrated proficiency in the use of 4x5 camera. Heavy volume. Full benefits. Please fax resume to CWP 212-[phone number]

CWP are the initials of the woman who would eventually become my boss.

But here is where I really do question my memory. There are two things that just seem impossible.

First, I remember looking up the phone number and finding out that it was Polo Ralph Lauren, so I was excited to apply and felt like I had an edge since I actually knew who I was applying to rather than just a random “leading fashion company.” But could that have been what happened? Where would I have looked it up? Google was around, but would they have indexed something with the phone number of a fax machine? It’s not impossible, but it’s a memory I question.

The other one is a bit more bizarre. I could swear that my boss-to-be left a message on my answering machine to the effect of, “Hi, this is [so-and-so] at Ralph Lauren. I’ve just gone through a butt load of resumes and I’d like you to come in for an interview.”

But after I got the job and got to know her, I just can’t imagine her saying “butt load of resumes.” But really, I could have sworn that’s what she said. Unfortunately, I didn’t digitize my old answering machine tapes as part of my digital archive.

I shared this story, this remnant of job search days of yore, with someone recently, and they said, “You should post that on LinkedIn!” And I thought, “Yes! It’s totally the kind of thing people on LinkedIn would read.”

And then I remembered that I’m not the kind of person who posts things on LinkedIn. But I do post things for all of you fine folks. So I decided to share that story here.

What about you? Did you ever find a job, a date, a couch, or anything else in the newspaper classifieds? Tell me about it!

Thanks for reading as always. See you next time!

David

Small businesses pay hidden toll after money-transfer rule change to curb illicit activities near the US-Mexico border

Evangelina Ornelas, co-owner of Nachita’s Grocery, where customers frequently went for money transfers. Now concerns are growing about how the government might use the personal data collected from ordinary customers.

Last April, the Trump administration rolled out its latest tool in the fight against Mexican cartels: an aggressive crackdown on money transfers near the US-Mexico border.

The administration said that, in an effort to stop money laundering and other illicit activity, it would now require any business providing financial services in the region to report cash transactions over $200. Previously, the amount had been $10,000.

But rather than dealing a crushing blow to the cartels, business owners and legal experts say the policy has devastated small businesses across the region, and the largely immigrant communities who rely on them to pay rent and bills and send money to family.

One of those mom-and-pop businesses is Nachita’s, a grocery store in one of the oldest neighborhoods in El Paso, Texas, that also provides small-scale financial services.

The family-run grocery has been a community lifeline for generations, says owner Evangelina Ornelas. In a working-class neighborhood near the US-Mexico border, where many people don’t have a bank account, these money services are a vital resource. For years, the predominantly Latino residents of numerous apartments surrounding Ornelas’s store used to regularly walk in to pay bills, pick up money orders for rent and wire money to families south of the border. The grocery store – along with its on-site kitchen – also benefited.

“People would come in to do a money transfer, and while they were here they’d get a burrito or purchase grocery items,” she recalled.

But last year, when a new policy from the US treasury department’s financial crimes enforcement network (FinCen) came into effect, it upended her operations. Now she had to report these low-level transactions, along with addresses, social security numbers and other personal identifying information.

Nachita’s Grocery in El Paso, Texas. For years, primarily Latino customers regularly paid bills, picked up money orders and wired money to family in Mexico.

With the changes, people became reluctant to make these transactions, Ornelas said, because they worry it will open them up for government surveillance or targeting by immigration authorities in the current intensified enforcement. Many elderly customers with limited mobility could no longer pay bills, and renters are unable to purchase money orders to pay for housing. The long lines of immigrants waiting to send money home have dwindled.

“I don’t think it was to prevent money laundering,” Ornelas said of the policy. “It didn’t look like it from what I was seeing. I was seeing a lot of people who were just not able to pay their bills or not able to send money to their families.”

Casas de cambio, as businesses that provide money services are commonly known in Spanish-speaking communities, have long been an integral part of the border region’s financial ecosystem. They are at dedicated storefronts and grocery stores like Nachita’s as independent businesses or authorized agents for industry giants such as Western Union and Moneygram. Residents, tourists and those who lack bank accounts, or just prefer the businesses to traditional banks, regularly use them to conduct transactions.

The new FinCen policy has faced criticism from legal and privacy experts, and has been met with legal challenges that call it arbitrary, unjustifiable and a violation of the fourth amendment that protects the rights of people against unreasonable searches and seizures. The transaction threshold was eventually raised from $200 to $1,000 in September 2025, but small business owners say even this amount has still drowned them in paperwork, made compliance tasks challenging for their bare-bones staff and caused steep business losses.

“It’s invasive and it’s unconstitutional,” Rob Johnson, a senior attorney at the Institute for Justice, said of the policy. Shortly after it took effect in Texas and California, the non-profit law firm and the Texas Association of Money Services Businesses sued the Trump administration on behalf of small business owners.

At Nachita’s Grocery, the long lines of people waiting to send money home have dwindled.

Johnson said the higher, $1,000 threshold remains problematic. “Two hundred dollars is the equivalent of a grocery cart, but $1,000 is the equivalent of a monthly rent payment,” he said. “And either way, you’re talking about an amount of money that is an ordinary, normal amount of money for an ordinary person to be using.”

In and out of court, the heightened surveillance has raised alarm over perceived government overreach that targets establishments in neighborhoods primarily with residents of Mexican descent.

The FinCen policy throws a blanket of suspicion, critics say, on everyone making everyday cash transactions. “It’s really an unfair measure,” said Esperanza Gómez, who runs a small business that provides money services in San Diego. “And on top of that, it’s going to put us out of business.”

For Ornelas, the regulations that came with the threat of hefty fines, even for inadvertent errors, were confusing, deeply upsetting and difficult to manage. She was buried in mounds of new paperwork from cash transactions that exceeded $200 and grew frustrated over steadily losing customers worried about their privacy who would not, or could not, provide a social security number or other required US government document.

By the time the reporting threshold was bumped to $1,000, the money services portion of Ornelas’s business was all but dead.

A legal battle over reporting requirements

Cross-border money transfers – also known as remittances – from immigrants are a brisk business for casas de cambio and a lifeline for households across the globe whose livelihood often depends on them. In Mexico alone, the world’s top recipient of US remittances, the amount of money flowing south from 2023 to 2025 exceeded $60bn each year. The cash transactions are a thorn in the side of the Trump administration, which considers them a loophole that allows undocumented people to send home money they have earned working in the country illegally.

Money transfers from immigrants are brisk business for casas de cambio and a lifeline for households across the globe whose livelihood often depends on them.

In July 2025, Donald Trump signed into law sweeping federal legislation that included a 1% tax on international money transfers. Congressional Republicans originally had sought to require a 5% tax along with proof of US citizenship for these transactions to discourage illegal immigration, but modified it after intense pushback. This year, several states – including Arizona– considered legislation to mandate verification of legal status for those wiring money out of the country, but ultimately failed to pass it.

Such attempts have not gone unnoticed in Latino and immigrant communities, where the FinCen policy has become intertwined with Trump’s aggressive campaign to deport those living in the country unlawfully. “We are going through difficult times generally speaking,” said Gómez, who is fighting the policy in court. “But it has really hit us twice as hard because the immigration raids are obviously targeting our people, and now they’re really going after the customers we serve.”

When FinCen issued its sweeping order in March 2025, it set off a legal battle.

The policy took effect a month later. Known as a geographic targeting order, it first covered 30 zip codes along the border in Texas and California for six months. FinCen has since renewed it multiple times, and in March 2026 the agency broadened its scope to cover several more counties – some far from the border – including New Mexico’s Bernalillo county and Arizona’s Maricopa county. As of 23 February, a total of 86 businesses covered by the policy had filed 700,000 reports, according to a partly redacted FinCen internal memo reviewed by the Guardian.

Multiple businesses have filed at least four lawsuits over the policy, and to some degree the pushback has been successful. Federal district judges have blocked the policy’s implementation for all affected businesses in California, and for the businesses in Arizona and Texas that have sued. The federal government appealed and in July the ninth circuit court of appeals upheld the pause. A decision from the fifth circuit court of appeals is pending.

Andy Payan, who runs a convenience store and gas station in El Paso, Texas, that offers check-cashing services, is among the small businesses that are part of the Institute for Justice lawsuit.

While some of the lawsuits now playing out stem from the initial policy’s $200 reporting threshold, the new, $1,000 threshold has also been challenged by a small business in Phoenix, Arizona, that sued FinCen in April. The plaintiff in the case, Kiosko Multiservicios, contends the requirement is a time-consuming, unsustainable burden that threatens to crush its business because it cannot afford to hire more employees to comply with it.

In its suit, Kiosko Multiservicios notes that in March, about 4,000 of transactions processed – including payroll check cashing and sales of money orders – exceeded $1,000. And, according to the government’s own estimate, for small businesses without automated filing procedures like Kiosko, each report takes 24 minutes to complete. That’s in addition to time spent explaining to customers why the detailed personal information is needed, the suit states.

Like banks and other financial institutions, casas de cambio were already required to comply with state and federal regulations. Ashley Light, the owner of a small family business in downtown El Paso, said that besides adhering to strict regulations, the establishments must comply with anti-money-laundering programs that include training on how to identify suspicious transactions. But unless there’s suspected wrongdoing, she said, it would be an invasion of privacy to include identifying information of customers making legal, everyday transactions in a database used for criminal investigations. FinCen’s collected data is shared with the Internal Revenue Service and various law enforcement agencies.

Ashley Light, the owner of a small family business in downtown El Paso, says her business already complies with strict state and federal regulations.

Light and Andy Payan, who runs a nearby convenience store and gas station that offers check-cashing services, are both part of the Institute for Justice lawsuit. While he’s all for battling financial crime, Payan said, he thinks the policy’s focus on small businesses like his family’s is off the mark. “The amounts that money launderers would need to launder are much too big to be laundered through here,” he said. “They buy gold, they buy real estate, they buy cars.”

Neither FinCEN, nor the US treasury department, responded to requests for comment.

A secretive surveillance program?

About two miles from Payan’s business, Nachita’s Grocery stands out on a corner within the city’s south side. Painted in brilliant blue and white, its walls depict its strong roots in the historic neighborhood through images of the original store and its founders, the great-grandparents of Evangelina Ornelas.

She and her mother, Evangelina Terrones, now manage the business in El Segundo Barrio, or the Second Ward. Their neighborhood is within walking distance of the Rio Grande, the natural boundary between El Paso and Mexico’s Ciudad Juárez, and was largely shaped by waves of immigrant arrivals from south of the border dating to the 19th century. The enclave stretches across a square mile punctuated with colorful murals and multi-story brick tenements known as presidios that bond its present to its past.

Ornelas, 35, grew up in the neighborhood and regularly helped out at the store, then at another nearby location, when her grandparents were at the helm. “My childhood revolved around the grocery store,” she fondly recalled during a work break. Years later, after her mother took the reins, Ornelas joined the family business full-time. Overseeing the money services section became her responsibility.

A business owner stands in front of her bright blue and white store with signs advertising bill payments in Spanish

Evangelina Ornelas, co-owner of Nachita’s Grocery, grew up helping her grandparents in the store and now oversees the money services section.

Now concerns are mounting about how the government will use the vast trove of personal data being collected on ordinary customers. While it’s not exactly clear how FinCen and its law enforcement partners – including Customs and Border Protection and Homeland Security Investigations, the intelligence arm of Immigration and Customs Enforcement (ICE) – plan to use it, their fears are based on precedent.

Saira Hussain, a senior attorney with the Electronic Frontier Foundation, a non-profit that advocates for people’s digital rights, said the FinCen policy had shades of a secretive surveillance program, run by a non-profit known as the Transaction Records Analysis Center (Trac) with the blessing of the Arizona attorney general’s office. For years, it has collected millions of financial records sent to or from Mexico, but FinCen bypassed this program in favor of the geographical targeting order that explicitly targets small-dollar transactions common at mom-and-pop businesses like Nachita’s.

In 2022, Ron Wyden, the senator from Oregon, exposed the obscure program, which deposited huge amounts of records in a database accessible to hundreds of law enforcement agencies. And in 2025, the Honolulu Civil Beat reported that the database was used to track a man for deportation who had no criminal record but had wired money to family in Mexico multiple times.

Hussain said she believed the FinCen policy was part of the Trump administration’s efforts to create fear in immigrant communities and squeeze out undocumented people from the nation’s financial system. “It really does sound like they’re trying to bend the laws that exist to carry out those whims.”

Signs advertising international money transfers are seen as customers walk by

Nachita’s Grocery, where the money services area will be soon shut down.

Back in El Segundo Barrio, these days immigrants rarely stop by Nachita’s to send money home and Ornelas cannot sell money orders, which she said were much needed for rent in the neighborhood. She’s getting ready to shut down the money services side of the store, but not without regret.

She thinks about customers she’s known most of her life. “The elderly who live a block away, where are they going to go?” she wondered.

Reporting for this story was supported by the Fund for Investigative Journalism

OpenSSH Release Notes

OpenSSH 10.5/10.5p1 (2026-08-11)

OpenSSH 10.5 was released on 2026-08-11. It is available from the mirrors listed at https://www.openssh.com/. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support.

Recently the OpenSSH team have received a large number of security bug reports, many of which are findings from AI models or made with AI assistance. While many AI reports are determined not to have security impact when considered in the context of a realistic threat model, we very much welcome these reports, especially when combined with human triage, analysis, test-cases and particularly when accompanied by proposed fixes.

We have seen a number of cases where a security bug identified by AI tools is subsequently independently discovered by a different researcher. This suggests that adversaries who do not report bugs to OSS projects are likely to be able to discover these bugs too. Given this, the OpenSSH team will, for now, be making more frequent releases to get bugfixes into users' hands more quickly rather than batching them until the next planned release.

Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at: https://www.openssh.com/donations.html

Potentially-incompatible changes

• Portable OpenSSH now requires ECC (Elliptic Curve Cryptography) support in libcrypto, including support for the NISTP521 curve. ECC is included in the default build configurations of all versions of all libcrypto implementations currently supported by OpenSSH, including LibreSSL, OpenSSL, BoringSSL and AWS LC. The --without-openssl build configuration is not affected.

Changes since OpenSSH 10.4

This release contains a number of security fixes and small bugfixes.

Security

• ssh-agent(1): fix an interaction between agent locking and the session-bind@openssh.com extension that is used to identify forwarded agents. These binding requests were refused when the agent was locked, with the result that operations that were intended to be limited to local use only could be performed remotely, including the ability to add PKCS#11 tokens and make use of keys that had destination restrictions applied. Reported by sn0x-sharma

• ssh(1): avoid potential realloc use-after-free in the client if a remote forwarding is added via the local session multiplexing socket while a remote forwarding open request is pending with the server. Report and fix from Brian Mingus of Cognatory

• sshd(8): make the authorized_keys "restrict" keyword apply correctly to tunnel forwarding too (which is administratively disabled by default). Reported by Erichen, Institute of Computing Technology, Chinese Academy of Sciences

New features

• ssh-keygen(1): add ability to set or clear the touch-required and verify-required flags on FIDO private keys when resetting a private key's passphrase.

• ssh(1): tweak ordering of certificates tried during pubkey authentication to prefer FIDO keys that do not require user presence (touch) first, and FIDO keys that require user verification via PIN or biometrics last. This effectively tries low-friction authenticators before higher friction ones.

• ssh(1): add a "ssh -Z user@host" mode that prints the keys that will be tried for public key authentication in the order that they will be used.

• sshd(8) use setproctitle(3) to identify sshd-session when its acting as a post-authentication monitor.

Bugfixes

• ssh-keyscan(1): make reading the server banner a non-blocking operation to prevent a stuck server from blocking a many-host keyscan from proceeding.

• sshd(8): use sshpkt_fatal() instead of plain fatal() for errors in the packet code as this provides context of the failing peer (address, port, user, etc).

• sshd(8): when signing hostkey proofs for a client UpdateHostKeys request, allow each hostkey to perform at most one signature operation.

• sshd(8) fix GSSAPI option names, that were broken during a servconf.c refactoring in openssh-10.4; bz3974.

• ssh-keygen(1): pass back errors from ed25519 key generation, which theoretically can fail. GHPR702.

• sshd(8): move check of public key type against allowed algorithms to before parsing of the key sent by the peer. This removes at least some key parsing and verification paths from the pre-auth attack surface. Suggested by Christopher Paul Rohlf of Anthropic.

• ssh-keygen(1): fix double frees (impossible to reach outside of a test harness), and also use freezero where possible. From Christopher Paul Rohlf at Anthropic.

• sshd(8): fix ChannelTimeout and RekeyLimit not being applied in sshd_config Match blocks.

• sshd(8): in sshd config dump mode, write all directives in mixed case for consistency

Portability

• sshd(8): re-allow PAMServiceName inside a Match block, which was incorrectly disabled during a refactoring in openssh-10.4. bz3987

Checksums:

• SHA1 (openssh-10.5.tar.gz) = 273163972f623bb9bffef9fd75a85c74d3b22633

• SHA256 (openssh-10.5.tar.gz) = 9Zhp0C/mDWNLmnatq68mtbqOUhvbyYcffH04dsHUwZQ=

• SHA1 (openssh-10.5p1.tar.gz) = 3067e2af7c526b31c7e94bc3ed38904ef791eb2c

• SHA256 (openssh-10.5p1.tar.gz) = 1E0oqDnqna+WnMaRUP3lmRCys5Nh2tgaO9bL0ZIY2xE=

Please note that the SHA256 signatures are base64 encoded and not hexadecimal (which is the default for most checksum tools). The PGP key used to sign the releases is available from the mirror sites: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Reporting Bugs:

• Please read https://www.openssh.com/report.html Security bugs should be reported directly to openssh@openssh.com

OpenSSH 10.4/10.4p1 (2026-07-06)

OpenSSH 10.4 was released on 2026-07-06. It is available from the mirrors listed at https://www.openssh.com/. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at: https://www.openssh.com/donations.html

Potentially-incompatible changes

• sshd(8): configuration dump mode ("sshd -G") now writes directives in mixed case (e.g. "PubkeyAuthentication") whereas previously it emitted only lower-case names.

• sshd(8): on Linux systems with the seccomp sandbox enabled, failures to enable SECCOMP or NO_NEW_PRIVS are now fatal. Previously sshd(8) would log the error but continue operation, to support systems that lacked these features. Now systems that lack these should instead disable the sandbox at configure time.

• ssh(1), sshd(8): make the transport protocol stricter by disconnecting if the peer sends non-KEX messages during a post- authentication key re-exchange. Previously a malicious peer could continue sending non-key exchange messages without penalty. These would be buffered, causing memory to be wasted up until the connection terminated or the server/client hit a memory limit. Implementations that do not restrict messages sent during key exchange as per RFC4253 section 7.1 may be disconnected. Reported by Marko Jevtic.

Changes since OpenSSH 10.3

This release contains a number of security fixes as well as general bugfixes and a couple of new features.

Security

• sftp(1): when downloading files on the command-line using "sftp host:/path .", a malicious server could cause the file to be downloaded to an unexpected location. This issue was identified by the Swival Security Scanner.

• scp(1): when copying files between two remote destinations, do not allow a malicious server to write files to the parent directory of the intended target directory. This issue was identified by the Swival Security Scanner.

• sshd(8): when using the "internal-sftp" SFTP server implementation (this is not the default), long command lines were previously truncated silently after the 9th argument. If a security-relevant option was in the 10th or later position, it would be discarded. Reported by Steve Caffrey.

• sshd(8): add a documentation note to mention that the GSSAPIStrictAcceptorCheck option is ineffective when the server is joined to a Windows Active Directory. Reported by Yarin Aharoni of Safebreach.

• sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes as it was documented to do. Note that PermitTunnel is not enabled by default. Reported independently by Huzaifa Sidhpurwala of Redhat and Marko Jevtic.

• sshd(8): avoid a potential pre-authentication denial of service when GSSAPIAuthentication was enabled (this feature is off by default). This was not mitigated by MaxAuthTries, but would be penalised by PerSourcePenalties. This was reported by Manfred Kaiser of the milCERT AT (Austrian Ministry of Defence).

• sshd(8): fix a number of cases where the minimum authentication delay was not being enforced. Reported by the Orange Cyberdefense Vulnerability Team.

• ssh(1): fix a possible client-side use-after-free if the server changes its host key during a key reexchange. This was reported by Zhenpeng (Leo) Lin of Depthfirst.

New features

• All: add experimental support for a composite post-quantum signature scheme that combines ML-DSA 44 and Ed25519 as specified in draft-miller-sshm-mldsa44-ed25519-composite-sigs.

  This scheme is not enabled by default. To use it, you'll need to add it to HostKeyAlgorithms, PubkeyAcceptedAlgorithms, etc. Keys may be generated using "ssh-keygen -t mldsa44-ed25519".

• ssh(1), sshd(8): replace the wildcard pattern matcher with an implementation based on an NFA. This avoids exponential worst-case behaviour for the old implementation.

Bugfixes

• ssh-agent(1): fix incorrect reply to "query" SSH_AGENTC_EXTENSION requests. bz3967

• sshd(8): avoid sending observably different messages for valid vs invalid users in GSSAPIAuthentication (disabled by default).

• ssh(1), sshd(8): fix several bugs that incorrectly classified bulk traffic as interactive. bz3972, bz3958

• ssh-keygen(1), ssh-add(1): skip unsupported key types when downloading resident keys from a FIDO token. Previously, downloads would abort when one was encountered. GHPR657

• ssh(1): fix a potential use-after-free on an error path if cipher_init() fails.

• sshd(8): perform stricter encoding and validation of transport state passed between sshd privilege separation subprocesses. This somewhat further hardens the server against attacks on sshd-auth or sshd-session subprocesses.

• ssh-agent(1): avoid possible runtime denial of service by enforcing some limits on the length of usernames in key use constraints.

• sftp(1): fix two separate one-byte out-of-bounds reads, in SSH2_FXP_REALPATH and batch command processing.

• sftp-server(8): disallow use of the copy-data extension to read and write to the same inode simultaneously.

• ssh(1), sshd(8): avoid strlen(NULL) crash if an X11 channel was created before the x11-req SSH_MSG_CHANNEL_REQUEST was sent. GHPR679

• sftp(1), scp(1): avoid a situation where sftp_download() could get stuck in a loop if a broken server repeatedly returned zero length while reading a file.

• ssh(1): avoid leaking DNS0x20 case-randomised names into names canonicalised using CanonicalizePermittedCNAMEs. bz3966

• sftp-server(8): avoid truncation of pathnames passed to lstat() during SSH_FXP_REALPATH handling on systems where PATH_MAX is not the actual max. GHPR688

• ssh(1), sshd(8): correct arming of poll(2) event masks for some socket-type channels. GHPR660

• sshd(8): major refactor of sshd_config parsing and management code, to allow for more exact serialisation/deserialisation across privilege separation boundaries.

• ssh-add(1): open connection to the agent only after getopt() processing has completed, to give options like "-v" a chance to display debug information about this operation.

• crypto code: fix bounds checking when signing messages of length greater than will fit in a size_t. In OpenSSH, message sizes are bounded by SSHBUF_SIZE_MAX so this was unreachable.

• crypto code: add signature malleability and pubkey validity checks to ed25519 verification. SSH doesn't depend on these properties

• crypto code: fix ECDSA order check for curves with cofactor != 1. All supported EC curves have cofactor 1, so this was unreachable.

• sshd(8): differentiate between execution failures and a subsystem that was not found when logging why a subsystem failed to start. GHPR637

• All: use safer idioms for timegm(3) and mktime(3) error detection.

• ssh(1), sshd(8): avoid accepting invalid cipher or MAC lists in config files or command-line arguments. This could cause runtime failures later.

• ssh(1): fix NULL deref crash during pubkey auth when using a PEM style private key with no corresponding .pub key adjacent to it.

• sshd(8): don't print an error message when trying to load a host private key when PKCS#11 keys are in use, as these don't need the private half on the filesystem. GHPR664

• All: don't use deprecated ERR_load_crypto_strings(). GHPR650

• ssh(1): properly report errors during configuration default setting. GHPR649

• ssh(1): use correct directive name (Match instead of Host) in error message. bz3968

• sftp(1): fix "ls -ln" which was not correctly showing numeric UID/GIDs but rather user and group names. bz3953

• sshd(8): avoid possible NULL dereference if an allocation fails during config parsing. bz3948

• All: fix ineffective guards against loading overly large public keys in several places. bz3969 and bz3970

• sftp(1): ensure file descriptors used by sftp to communicate to its ssh(1) subprocess don't leak into executed subprocesses (e.g. via "!"). GHPR693

Portability

• Sync fmt_scaled.c with OpenBSD upstream, picking up an exactness fix for large exponents (GHPR671)

• sshd(8): remove duplicate sandbox entry for clock_gettime64.

• ssh(1), sshd(8): use correct IPTOS_DSCP_VA value if not provided by the system headers.

• Sync getrrsetbyname.c with OpenBSD upstream, picking up robustness fixes.

• Disable replacements in openbsd-compat for strvisx(3) and stravis(3), as these are unused in OpenSSH

• Avoid fortify warnings on Android bz3954

• Fix a number of memory leaks on error paths in the portability code. GHPR681

• Revise the README.privsep documentation to reflect sshd's recent switch to a multi-binary model.

Checksums:

• SHA1 (openssh-10.4.tar.gz) = 8502b516230865e229d55045bb4ccc67aeae905b

• SHA256 (openssh-10.4.tar.gz) = qUVI+wMg4mVpiQbXvfMVkF3Zuyy2JrS+ZjN764mtyGE=

• SHA1 (openssh-10.4p1.tar.gz) = ae8650a71cc52dbbd049519cee276ae6d65c2c4d

• SHA256 (openssh-10.4p1.tar.gz) = 72Am3SrqjVYFljjV0yYpAsiSzrqfiDlYNeDQbT+2Mjg=

Please note that the SHA256 signatures are base64 encoded and not hexadecimal (which is the default for most checksum tools). The PGP key used to sign the releases is available from the mirror sites: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Reporting Bugs:

• Please read https://www.openssh.com/report.html Security bugs should be reported directly to openssh@openssh.com

OpenSSH 10.3/10.3p1 (2026-04-02)

OpenSSH 10.3 was released on 2026-04-02. It is available from the mirrors listed at https://www.openssh.com/. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at: https://www.openssh.com/donations.html

Potentially-incompatible changes

• ssh(1), sshd(8): remove bug compatibility for implementations that don't support rekeying. If such an implementation tries to interoperate with OpenSSH, it will now eventually fail when the transport needs rekeying.

• sshd(8): prior to this release, a certificate that had an empty principals section would be treated as matching any principal (i.e. as a wildcard) when used via authorized_keys principals="" option. This was intentional, but created a surprising and potentially risky situation if a CA accidentally issued a certificate with an empty principals section: instead of being useless as one might expect, it could be used to authenticate as any user who trusted the CA via authorized_keys. [Note that this condition did not apply to CAs trusted via the sshd_config(5) TrustedUserCAKeys option.]

  This release treats an empty principals section as never matching any principal, and also fixes interpretation of wildcard characters in certificate principals. Now they are consistently implemented for host certificates and not supported for user certificates.

• ssh(1): the -J and equivalent -oProxyJump="..." options now validate user and host names for ProxyJump/-J options passed via the command-line (no such validation is performed for this option in configuration files). This prevents shell injection in situations where these were directly exposed to adversarial input, which would have been a terrible idea to begin with. Reported by rabbit.

Changes since OpenSSH 10.2

This release contains some relatively minor security fixes as well as a number of feature improvements and general bugfixes.

Security

• ssh(1): validation of shell metacharacters in user names supplied on the command-line was performed too late to prevent some situations where they could be expanded from %-tokens in ssh_config. For certain configurations, such as those that use a "%u" token in a "Match exec" block, an attacker who can control the user name passed to ssh(1) could potentially execute arbitrary shell commands. Reported by Florian Kohnhäuser.

  We continue to recommend against directly exposing ssh(1) and other tools' command-lines to untrusted input. Mitigations such as this can not be absolute given the variety of shells and user configurations in use.

• sshd(8): when matching an authorized_keys principals="" option against a list of principals in a certificate, an incorrect algorithm was used that could allow inappropriate matching in cases where a principal name in the certificate contains a comma character. Exploitation of the condition requires an authorized_keys principals="" option that lists more than one principal and a CA that will issue a certificate that encodes more than one of these principal names separated by a comma (typical CAs strongly constrain which principal names they will place in a certificate). This condition only applies to user-trusted CA keys in authorized_keys, the main certificate authentication path (TrustedUserCAKeys/AuthorizedPrincipalsFile) is not affected. Reported by Vladimir Tokarev.

• scp(1): when downloading files as root in legacy (-O) mode and without the -p (preserve modes) flag set, scp did not clear setuid/setgid bits from downloaded files as one might typically expect. This bug dates back to the original Berkeley rcp program. Reported by Christos Papakonstantinou of Cantina and Spearbit.

• sshd(8): fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys. Previously if one of these directives contains any ECDSA algorithm name (say "ecdsa-sha2-nistp384"), then any other ECDSA algorithm would be accepted in its place regardless of whether it was listed or not. Reported by Christos Papakonstantinou of Cantina and Spearbit.

• ssh(1): connection multiplexing confirmation (requested using "ControlMaster ask/autoask") was not being tested for proxy mode multiplexing sessions (i.e. "ssh -O proxy ..."). Reported by Michalis Vasileiadis.

New features

• ssh(1), sshd(8): support IANA-assigned codepoints for SSH agent forwarding, as per draft-ietf-sshm-ssh-agent. Support for the new names is advertised via the EXT_INFO message. If a server offers support for the new names, then they are used preferentially.

• ssh-agent(1): implement support for draft-ietf-sshm-ssh-agent "query" extension.

• ssh-add(1): support querying the protocol extensions via the agent "query" extension with a new -Q flag.

• ssh(1): support multiple files in a ssh_config RevokedHostKeys directive. bz3918

• sshd(8): support multiple files in a sshd_config RevokedKeys directive bz3918

• ssh(1): add a ~I escape option that shows information about the current SSH connection.

• ssh(1): add an "ssh -Oconninfo user@host" multiplexing command that shows connection information, similar to the ~I escapechar.

• ssh(1): add an "ssh -O channels user@host" multiplexing command to get a running mux process to show information about what channels are currently open.

• sshd(8): add 'invaliduser' penalty to PerSourcePenalties, which is applied to login attempts for usernames that do not match real accounts. Defaults to 5s to match 'authfail' but allows administrators to block such attempts for longer if desired.

• sshd(8): add a GSSAPIDelegateCredentials option for the server, controlling whether it accepts delegated credentials offered by the client. This option mirrors the same option in ssh_config. GHPR614

• ssh(1), sshd(8): support the VA DSCP codepoint in the IPQoS directive.

• sshd(8): convert PerSourcePenalties to using floating point time, allowing penalties to be less than a second. This is useful if you need to penalise things you expect to occur at >=1 QPS.

• ssh-keygen(1): support writing ED25519 keys in PKCS8 format. GHPR570

• Support the ed25519 signature scheme via libcrypto.

Bugfixes

• sshd(8): make IPQoS first-match-wins in sshd_config, like other configuration directives. bz3924

• sshd(8): fix potential crash when MaxStartups is using a single argument (i.e. not using the MaxStartps x:y:z form) to a value below 10. bz3941

• sshd(8): fix a potential hang during key exchange if needed DH group values were missing from /etc/moduli.

• ssh-agent(1): fix return values from extensions to be correct wrt draft-ietf-sshm-ssh-agent: extension requests should indicate failure using SSH_AGENT_EXTENSION_FAILURE rather than the generic SSH_AGENT_FAILURE error code. This allows the client to discern between "the request failed" and "the agent doesn't support this extension".

• ssh(1): use fmprintf for showing challenge-response name and info to preserve UTF-8 characters where appropriate. Prompted by GitHub PR#452.

• scp(1): when uploading a directory using sftp/sftp (e.g. during a recursive transfer), don't clobber the remote directory permissions unless either we created the directory during the transfer or the -p flag was set. bz3925

• All: implement missing pieces of FIDO/webauthn signature support, mostly related to certificate handling and enable acceptance of this signature format by default. bz3748 GHPR624 GHPR625

• sshd_config(5): make it clear that DenyUsers/DenyGroups overrides AllowUsers/AllowGroups. Previously we specified the order in which the directives are processed but it was ambiguous as to what happened if both matched.

• ssh(1): don't try to match certificates held in an agent to private keys. This matching is done to support certificates that were loaded without their private key material, but is unnecessary for agent-hosted certificate which always have private key material available in the agent. Worse, this matching would mess up the request sent to the agent in such a way as to break usage of these keys when the key usage was restricted in the agent. bz3752

• sftp(1): if editline has been switched to vi mode (i.e. via "bind -v" in .editrc), setup a keybinding so that command mode can be entered.

• ssh(1), sshd(8): improve performance of keying the sntrup761 key agreement algorithm.

• ssh(1), sshd(8): enforce maximum packet/block limit during pre-authentication phase.

• sftp(1): don't misuse the sftp limits extension's open-handles field. This value is supposed to be the number of handles a server will allow to be opened and not a number of outstanding read/write requests that can be sent during an upload/download.

• sshd(8): don't crash at connection time if the main sshd_config lacks any subsystem directive but one is defined in a Match block. bz3906

• sshd_config(5): add a warning next to the ForceCommand directive that forcing a command doesn't automatically disable forwarding.

• sshd_config(5): add a warning that TOKENS are replaced without filtering or escaping and that it's the administrator's responsibility to ensure they are used safely in context.

• scp(1): correctly quote filenames in verbose output for local-local copies. bz3900

• sshd(8): don't mess up the PerSourceNetBlockSize IPv6 mask if sscanf didn't decode it. GHPR598

• ssh-add(1): when loading FIDO2 resident keys, set the comment to the FIDO application string. This matches the behaviour of ssh-keygen -K. GHPR608

• sshd(8): don't strnvis() log messages that are going to be logged by sshd-auth via its parent sshd-session process, as the parent will also run them though strnvis(). Prevents double-escaping of non-printing characters in some log messages. bz3896

• ssh-agent(1): escape SSH_AUTH_SOCK paths that are sent to the shell as setenv commands. Unbreaks ssh-agent for home directory paths that contain whitespace. bz3884

• All: Remove unnecessary checks for ECDSA public key validity.

• sshd(8): activate UnusedConnectionTimeout only after the last channel has closed. Previously UnusedConnectionTimeout could fire early after a ChannelTimeout. This was not a problem for the OpenSSH client because it terminates once all channels have closed but could cause problems for other clients (e.g. API clients) that do things differently. bz3827

• All: fix PKCS#11 key PIN entry problems introduced in openssh-10.1/10.2. bz3879

• scp(1): when using the SFTP protocol for transfers, fix implicit destination path selection when source path ends with "..". bz3871

• sftp(1): when tab-completing a filename, ensure that the completed string does not end up mid-way through a multibyte character, as this will cause a fatal() later on. GHPR#587

• ssh-keygen(1): fix crash at exit (visible via ssh-keygen -D) when multiple keys loaded.

• scp(1)/sftp(1): correctly display bandwidths >2GBps in the progress meter.

Portability

• sshd(8): fix condition introduced in openssh 10.2p1 stable branch here a PAM module that changed the requested username between SSH_MSG_USERAUTH_REQUEST messages during authentication could confuse the PAM stack and let it proceed with a different understanding of the active username than the rest of sshd. Reported by Mike Damm.

• sshd(8): immediately report interactive instructions to clients when using keyboard-interactive authentication with PAM. bz2876

• sshd(8): fix duplicate PAM messages under some situations.

• sshd(8): don't leak PAM handle on repeat invocations. bz3882

• All: support linking libcrypto implementations (e.g. BoringSSL) that require libstdc++.

• sshd(8): fix ut_type for btmp records, correctly using LOGIN_PROCESS and USER_PROCESS.

• sshd(8): allow uname(3) in the seccomp sandbox. This is needed by zlib-ng on RISC-V platforms.

• All: remove remaining OpenSSL_add_all_algorithms() calls. We already have OPENSSL_init_crypto() in the compat layer. Prompted by github PR#606

• All: fix builds on older Mac OS wrt nfds_t.

• mdoc2man: several improvements including better support for Dl and Ns inside Ic.

Checksums:

• SHA1 (openssh-10.3.tar.gz) = 854863c04cd28242d73ac6c3ee9c37fa756f1a2f

• SHA256 (openssh-10.3.tar.gz) = aCU5P47rM+m4N8/i2JOHMOMhafMYqBhvQQSnPXczN5M=

• SHA1 (openssh-10.3p1.tar.gz) = 9c78838ec07af14aff54f3755ac56ce6812452a9

• SHA256 (openssh-10.3p1.tar.gz) = VmgqNruS3PS08Bb9jsjnQFm3mo3iXBXWcNcx59GORfQ=

Please note that the SHA256 signatures are base64 encoded and not hexadecimal (which is the default for most checksum tools). The PGP key used to sign the releases is available from the mirror sites: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Reporting Bugs:

• Please read https://www.openssh.com/report.html Security bugs should be reported directly to openssh@openssh.com

OpenSSH 10.2/10.2p1 (2025-10-10)

OpenSSH 10.2 was released on 2025-10-10. It is available from the mirrors listed at https://www.openssh.com/. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at: https://www.openssh.com/donations.html

Future deprecation warning

• A future release of OpenSSH will deprecate support for SHA1 SSHFP records due to weaknesses in the SHA1 hash function. SHA1 SSHFP DNS records will be ignored and ssh-keygen -r will generate only SHA256 SSHFP records.

  The SHA256 hash algorithm, which has no known weaknesses, has been supported for SSHFP records since OpenSSH 6.1, released in 2012.

Changes since OpenSSH 10.1

This is a bugfix release, primarily to fix a problem that rendered ssh(1) unusable when ControlPersist was enabled.

Bugfixes

• ssh(1): fix mishandling of terminal connections when ControlPersist was active that rendered the session unusable. bz3872

• ssh-keygen(1): fix download of keys from PKCS#11 tokens.

• ssh-keygen(1): fix CA signing operations when the CA key is held in a ssh-agent(1). bz3877

Portability

• All: support platforms without mmap(2), e.g. WASM builds such as https://hterm.org

• All: fix builds on FreeBSD for missing fnctl.h include.

• All: fix builds on MacOS <10.12 Sierra, which lacks clock_gettime(3)

• sshd(8): don't PAM_RHOST if the remote host is the "UNKNOWN" placeholder name. Avoids potential hangs in some PAM modules as they try to resolve it. Note, sshd(8) only uses the "UNKNOWN" name when the connection is not on an IPv4 or IPv6 socket.

Checksums:

SHA1 (openssh-10.2.tar.gz) = 6fcda8004bad0fb0eaee60e8308f91b605ad0dce SHA256 (openssh-10.2.tar.gz) = y0rCEdrVc4OJRZLg0u3F0frAgz87ydeTktCk3rQfVj8=

SHA1 (openssh-10.2p1.tar.gz) = c34efade16109f065ec8c834f237bcedd8d7ef5c SHA256 (openssh-10.2p1.tar.gz) = zMQsBBmTeVkmP6Hb0W2vwYxWuYTANWLSk3zlamD3mLI=

Please note that the SHA256 signatures are base64 encoded and not hexadecimal (which is the default for most checksum tools). The PGP key used to sign the releases is available from the mirror sites: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Reporting Bugs:

• Please read https://www.openssh.com/report.html Security bugs should be reported directly to openssh@openssh.com

OpenSSH 10.1/10.1p1 (2025-10-06)

OpenSSH 10.1 was released on 2025-10-06. It is available from the mirrors listed at https://www.openssh.com/. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at: https://www.openssh.com/donations.html

Future deprecation warning

• A future release of OpenSSH will deprecate support for SHA1 SSHFP records due to weaknesses in the SHA1 hash function. SHA1 SSHFP DNS records will be ignored and ssh-keygen -r will generate only SHA256 SSHFP records.

  The SHA256 hash algorithm, which has no known weaknesses, has been supported for SSHFP records since OpenSSH 6.1, released in 2012.

Potentially-incompatible changes

• ssh(1): add a warning when the connection negotiates a non-post quantum key agreement algorithm.

  This warning has been added due to the risk of "store now, decrypt later" attacks. More details at https://openssh.com/pq.html

  This warning may be controlled via a new WarnWeakCrypto ssh_config option, defaulting to on. This option is likely to control additional weak crypto warnings in the future.

• ssh(1), sshd(8): major changes to handling of DSCP marking/IPQoS

  In both client and server the default DSCP (a.k.a IPQoS) values were revised and the way these values are used during runtime has changed.

  Interactive traffic is now assigned to the EF (Expedited Forwarding) class by default. This provides more appropriate packet prioritisation information for the intermediate network, such as wireless media (cf. RFC 8325). Non-interactive traffic will now use the operating system default DSCP marking. Both the interactive and non-interactive DSCP values may be overridden via the IPQoS keyword, described in ssh_config(5) and sshd_config(5).

  The appropriate DSCP marking is now automatically selected and updated as needed over the course of a connection's lifetime. ssh(1) and sshd(8) will switch between the interactive and non-interactive IPQoS values depending on the type of SSH channels open at the time. For example, if an sftp session is using the connection alongside a shell session, then the non-interactive value will be used for the duration of the sftp. A connection which contains only interactive sessions is marked EF.

• ssh(1), sshd(8): deprecate support for IPv4 type-of-service (ToS) keywords in the IPQoS configuration directive.

  Type of Service (ToS) was deprecated in the late nineties and replaced with the Differentiated Services architecture, which has significant advantages for operators because it offers more granularity.

  OpenSSH switched its default IPQoS from ToS to DSCP values in 2018 (openssh-7.7).

  IPQoS configurations with 'lowdelay', 'reliability', or 'throughput' will be ignored and will instead use the system default QoS settings. Additionally, a debug message will be logged about the deprecation with a suggestion to use DSCP QoS instead.

• ssh-add(1): when adding certificates to an agent, set the expiry to the certificate expiry time plus a short (5 min) grace period.

  This will cause the agent to automatically remove certificates shortly after they expire. A new ssh-add -N option disables this behaviour.

• All: remove experimental support for XMSS keys. This was never enabled by default. We expect to implement a new post-quantum signature scheme in the near future.

• ssh-agent(1), sshd(8): move agent listener sockets from /tmp to under ~/.ssh/agent for both ssh-agent(1) and forwarded sockets in sshd(8).

  This ensures processes that have restricted filesystem access that includes /tmp do not ambiently have the ability to use keys in an agent.

  Moving the default directory has the consequence that the OS will no longer clean up stale agent sockets, so ssh-agent now gains this ability.

  To support $HOME on NFS, the socket path includes a truncated hash of the hostname. ssh-agent will, by default, only clean up sockets from the same hostname.

  ssh-agent(1) gains some new flags: -U suppresses the automatic cleanup of stale sockets when it starts. -u forces a cleanup without keeping a running agent, -uu forces a cleanup that ignores the hostname. -T makes ssh-agent put the socket back in /tmp.

Changes since OpenSSH 10.0

This release contains a minor security fix as well as a number of feature improvements and bugfixes.

Security

• ssh(1): disallow control characters in usernames passed via the commandline or expanded using %-sequences from the configuration file, and disallow \0 characters in ssh:// URIs.

  If an ssh(1) commandline was constructed using usernames or URIs obtained from an untrusted source, and if a ProxyCommand that uses the %r expansion was configured, then it may be possible for an attacker to inject shell expressions that may be executed when the proxy command is started.

  We strongly recommend against using untrusted inputs to construct ssh(1) commandlines.

  This change also relaxes the validity checks in one small way: usernames supplied via the configuration file as literals (i.e. that have no % expansion characters) are not subject to these validity checks. This allows usernames that contain arbitrary characters to be used, but only via configuration files. This is done on the basis that ssh's configuration is trusted.

  This issue was reported by David Leadbeater.

New features

• ssh(1), sshd(8): add SIGINFO handlers to log active channel and session information.

• sshd(8): when refusing a certificate for user authentication, log enough information to identify the certificate in addition to the reason why it was being denied. Makes debugging certificate authorisation problems a bit easier.

• ssh(1), ssh-agent(1): support ed25519 keys hosted on PKCS#11 tokens.

• ssh(1): add an ssh_config(5) RefuseConnection option that, when encountered while processing an active section in a configuration, terminates ssh(1) with an error message that contains the argument to the option.

  This may be useful for expressing reminders or warnings in config files, for example:

  Match host foo RefuseConnection "foo is deprecated, use splork instead"

• sshd(8): make the X11 display number check relative to X11DisplayOffset. This will allow people to use X11DisplayOffset to configure much higher port ranges if they really want, while not changing the default behaviour.

• unit tests: the unit test framework now includes some basic benchmarking capabilities. Run with "make UNITTEST_BENCHMARK=yes" on OpenBSD or "make unit-bench" on Portable OpenSSH.

Bugfixes

• sshd(8): fix mistracking of MaxStartups process exits in some situations. At worst, this could cause all MaxStartups slots to fill and sshd to refuse new connections.

• ssh(1): fix delay on X client startup when ObscureKeystrokeTiming is enabled. bz#3820

• sshd(8): increase the maximum size of the supported configuration from 256KB to 4MB, which ought to be enough for anybody. Fail early and visibly when this limit is breached. bz3808

• sftp(1): during sftp uploads, avoid a condition where a failed write could be ignored if a subsequent write succeeded. This is unlikely but technically possible because sftp servers are allowed to reorder requests.

• sshd(8): avoid a race condition when the sshd-auth process exits that could cause a spurious error message to be logged.

• sshd(8): log at level INFO when PerSourcePenalties actually blocks access to a source address range. Previously this was logged at level VERBOSE, which hid enforcement actions under default config settings.

• sshd(8): GssStrictAcceptor was missing from sshd -T output; fix

• sshd(8): Make the MaxStartups and PerSourceNetBlockSize options first-match-wins as advertised. bz3859

• ssh(1): fix an incorrect return value check in the local forward cancellation path that would cause failed cancellations not to be logged.

• sshd(8): make "Match !final" not trigger a second parsing pass of ssh_config (unless hostname canonicalisation or a separate "Match final" does). bz3843

• ssh(1): better debug diagnostics when loading keys. Will now list key fingerprint and algorithm (not just algorithm number) as well as making it explicit which keys didn't load.

• All: fix a number of memory leaks found by LeakSanitizer, Coverity and manual inspection.

• sshd(8): Output the current name for PermitRootLogin's "prohibit-password" in sshd -T instead of its deprecated alias "without-password". bz#3788

• ssh(1): make writing known_hosts lines more atomic by writing the entire line in one operation and using unbuffered stdio.

  Usually writes to this file are serialised on the "Are you sure you want to continue connecting?" prompt, but if host key checking is disabled and connections were being made with high concurrency then interleaved writes might have been possible.

Portability

• sshd(8): check the username didn't change during the PAM transactions.

• sshd(8): don't log audit messages with UNKNOWN hostname to avoid slow DNS lookups in the audit subsystem.

• All: when making a copy of struct passwd, ensure struct fields are non-NULL. Android libc can return NULL pw_gecos, for example.

• All: Remove status bits from OpenSSL >=3 version check.

• sshd(8), ssh(1): Use SSH_TUN_COMPAT_AF on FreeBSD. Otherwise tun forwarding from other OSes fails as soon as the first IPv6 message is sent by the other side.

• ssh(1), ssh-agent(8): check for nlist function presence before attempting to use it instead of relying on the presence of the nlist.h header.

• All: fill in missing system header files.

  Create replacement header files inside openbsd-compat for common headers that are missing on a given platform. Usually these are just empty, but in some cases they'll include the equivalent file. This avoids having to wrap those includes in '#ifdef HAVE_FOO_H' and reduces the diff between Portable OpenSSH and OpenBSD.

• sshd(8): handle futex_time64 properly in seccomp sandbox.

• Add contrib/gnome-ssh-askpass4 for GNOME 40+ using the GCR API.

• sshd(8): let ga_init() fail gracefully if getgrouplist does.

• ssh-agent(1): exit 0 from SIGTERM under systemd socket-activation.

• build: wrap some autoconf macros in AC_CACHE_CHECK.

Checksums:

SHA1 (openssh-10.1.tar.gz) = 8eef44a945a9a9a5a99213ab0d57e35b7ba60e75 SHA256 (openssh-10.1.tar.gz) = j9ymvhvdGMeAvh1oTI2YmOAwv7Ao70gbGPyPedgQsBU=

SHA1 (openssh-10.1p1.tar.gz) = 7fd17b99d1beffb47cd380d64079e920bb0bd91f SHA256 (openssh-10.1p1.tar.gz) = ufx6K4JXlGem8vQ+SoHI4d/aYU3bT5slWq/XAgu/B1g=

Please note that the SHA256 signatures are base64 encoded and not hexadecimal (which is the default for most checksum tools). The PGP key used to sign the releases is available from the mirror sites: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Reporting Bugs:

• Please read https://www.openssh.com/report.html Security bugs should be reported directly to openssh@openssh.com

OpenSSH 10.0/10.0p2 (2025-04-09)

OpenSSH 10.0 was released on 2025-04-09. It is available from the mirrors listed at https://www.openssh.com/. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at: https://www.openssh.com/donations.html

Potentially-incompatible changes

• This release removes support for the weak DSA signature algorithm, completing the deprecation process that began in 2015 (when DSA was disabled by default) and repeatedly warned over the last 12 months.

• scp(1), sftp(1): pass "ControlMaster no" to ssh when invoked by scp & sftp. This disables implicit session creation by these tools when ControlMaster was set to yes/auto by configuration, which some users found surprising. This change will not prevent scp/sftp from using an existing multiplexing session if one had already been created. GHPR557

• This release has the version number 10.0 and announces itself as "SSH-2.0-OpenSSH_10.0". Software that naively matches versions using patterns like "OpenSSH_1*" may be confused by this.

• sshd(8): this release removes the code responsible for the user authentication phase of the protocol from the per-connection sshd-session binary to a new sshd-auth binary. Splitting this code into a separate binary ensures that the crucial pre-authentication attack surface has an entirely disjoint address space from the code used for the rest of the connection. It also yields a small runtime memory saving as the authentication code will be unloaded after the authentication phase completes. This change should be largely invisible to users, though some log messages may now come from "sshd-auth" instead of "sshd-session". Downstream distributors of OpenSSH will need to package the sshd-auth binary.

• sshd(8): this release disables finite field (a.k.a modp) Diffie-Hellman key exchange in sshd by default. Specifically, this removes the "diffie-hellman-group*" and "diffie-hellman-group-exchange-*" methods from the default KEXAlgorithms list. The client is unchanged and continues to support these methods by default. Finite field Diffie Hellman is slow and computationally expensive for the same security level as Elliptic Curve DH or PQ key agreement while offering no redeeming advantages. ECDH has been specified for the SSH protocol for 15 years and some form of ECDH has been the default key exchange in OpenSSH for the last 14 years.

• sshd(8): this release removes the implicit fallback to compiled-in groups for Diffie-Hellman Group Exchange KEX when the moduli file exists but does not contain moduli within the client-requested range. The fallback behaviour remains for the case where the moduli file does not exist at all. This allows administrators more explicit control over which DH groups will be selected, but can lead to connection failures if the moduli file is edited incorrectly. bz#2793

Changes since OpenSSH 9.9

This release contains a minor security fix as well as a number of feature improvements and bugfixes.

Security

• sshd(8): fix the DisableForwarding directive, which was failing to disable X11 forwarding and agent forwarding as documented. X11 forwarding is disabled by default in the server and agent forwarding is off by default in the client.

New features

• ssh(1): the hybrid post-quantum algorithm mlkem768x25519-sha256 is now used by default for key agreement. This algorithm is considered to be safe against attack by quantum computers, is guaranteed to be no less strong than the popular curve25519-sha256 algorithm, has been standardised by NIST and is considerably faster than the previous default.

• ssh(1): prefer AES-GCM to AES-CTR mode when selecting a cipher for the connection. The default cipher preference list is now Chacha20/Poly1305, AES-GCM (128/256) followed by AES-CTR (128/192/256).

• ssh(1): add %-token and environment variable expansion to the ssh_config SetEnv directive.

• ssh(1): allow %-token and environment variable expansion in the ssh_config User directive, with the exception of %r and %C which would be self-referential. bz#3477

• ssh(1), sshd(8): add "Match version" support to ssh_config and sshd_config. Allows matching on the local version of OpenSSH, e.g. "Match version OpenSSH_10.*".

• ssh(1): add support for "Match sessiontype" to ssh_config. Allows matching on the type of session initially requested, either "shell" for interactive sessions, "exec" for command execution sessions, "subsystem" for subsystem requests, such as sftp, or "none" for transport/forwarding-only sessions.

• ssh(1): add support for "Match command ..." support to ssh_config, allowing matching on the remote command as specified on the command-line.

• ssh(1): allow 'Match tagged ""' and 'Match command ""' to match empty tag and command values respectively.

• sshd(8): allow glob(3) patterns to be used in sshd_config AuthorizedKeysFile and AuthorizedPrincipalsFile directives. bz2755

• sshd(1): support the VersionAddendum in the client, mirroring the option of the same name in the server; bz2745

• ssh-agent(1): the agent will now delete all loaded keys when signaled with SIGUSR1. This allows deletion of keys without having access to $SSH_AUTH_SOCK.

• Portable OpenSSH, ssh-agent(1): support systemd-style socket activation in ssh-agent using the LISTEN_PID/LISTEN_FDS mechanism. Activated when these environment variables are set, the agent is started with the -d or -D option and no socket path is set. GHPR502

• ssh-keygen(1): support FIDO tokens that return no attestation data, e.g. recent WinHello. GHPR542

• ssh-agent(1): add a "-Owebsafe-allow=..." option to allow the default FIDO application ID allow-list to be overridden.

• Add a work-in-progress tool to verify FIDO attestation blobs that ssh-keygen can optionally write when enrolling FIDO keys. This tool is available under regress/misc/ssh-verify-attestation for experimentation but is not installed by "make install".

• ssh-keygen(1): allow "-" as output file for moduli screening. GHPR393

Bugfixes

• sshd(8): remove assumption that the sshd_config and any configs it includes can fit in a (possibly enlarged) socket buffer. Previously it was possible to create a sufficiently large configuration that could cause sshd to fail to accept any connection. sshd(8) will now actively manage sending its config to the sshd-session sub-process.

• ssh(1): don't start the ObscureKeystrokeTiming mitigations if there has been traffic on a X11 forwarding channel recently. Should fix X11 forwarding performance problems when this setting is enabled. bz3655

• ssh(1): prohibit the comma character in hostnames accepted, but allow an underscore as the first character in a hostname.

• sftp(1): set high-water when resuming a "put". Prevents bogus "server reordered acks" debug message.

• ssh(1), sshd(8): fix regression in openssh-9.8, which would fail to accept "Match criteria=argument" as well as the documented "Match criteria argument" syntax in ssh_config and sshd_config. bz3739

• sftp(1), ssh(1): fix a number possible NULL dereference bugs, including Coverity CIDs 405019 and 477813.

• sshd(8): fix PerSourcePenalty incorrectly using "crash" penalty when LoginGraceTime was exceeded. bz3797

• sshd(8): fix "Match invalid-user" from incorrectly being activated in initial configuration pass when no other predicates were present on the match line

• sshd(8): fix debug logging of user specific delay. GHPR#552

• sshd(8): improve debug logging across sub-process boundaries. Previously some log messages were lost early in the sshd-auth and sshd-session processes' life.

• ssh(1): require control-escape character sequences passed via the '-e ^x' command-line to be exactly two characters long. Avoids one byte out-of-bounds read if ssh is invoked as "ssh -e^ ..." GHPR368

• ssh(1), sshd(8): prevent integer overflow in x11 port handling. These are theoretically possible if the admin misconfigured X11DisplayOffset or the user misconfigures their own $DISPLAY, but don't happen in normal operation. bz#3730

• ssh-keygen(1): don't mess up ssh-keygen -l output when the file contains CR characters; GHPR236 bz3385.

• sshd(8): add rate limits to logging of connections dropped by PerSourcePenalties. Previously these could be noisy in logs.

• ssh(1): fix argument of "Compression" directive in ssh -G config dump, which regressed in openssh-9.8.

• sshd(8): fix a corner-case triggered by UpdateHostKeys when sshd refuses to accept the signature returned by an agent holding host keys during the hostkey rotation sub-protocol. This situation could occur in situations where a PKCS#11 smartcard that lacked support for particular signature algorithms was used to store host keys.

• ssh-keygen(1): when using RSA keys to sign messages with "ssh-keygen -Y", select the signature algorithm based on the requested hash algorithm ("-Ohashalg=xxx"). This allows using something other than the default of rsa-sha2-512, which may not be supported on all signing backends, e.g. some smartcards only support SHA256.

• ssh(1), sshd(8), ssh-keyscan(1): fix ML-KEM768x25519 KEX on big-endian systems.

• Many regression and interop test improvements.

Portability

• All: add support for AWS-LC (AWS libcrypto). bz3784

• sshd(8): add wtmpdb support as a Y2038 safe wtmp replacement.

• sshd(8): add support for locking sshd into memory, enabled with the --with-linux-memlock-onfault configure flag.

• Add support for building a standalone sk-libfido2 library, enabled by --with-security-key-standalone

• ssh(1), sshd(8), ssh-keyscan(1): include __builtin_popcount replacement function for compilers that lack it.

• All: Check for and replace le32toh, le64toh, htole64 separately. It appears that at least some versions of endian.h in glibc do not have the latter two. bz#3794

• Remove ancient RHL 6.x config in RPM spec.

Checksums:

• SHA1 (openssh-10.0.tar.gz) = 933f4fded0497ef6a588381257276e156a70f9c3

• SHA256 (openssh-10.0.tar.gz) = oaJ+cXLCVoCZAz9W5W1vF7ko4GJW6iq7JmblrPUA34Q=

• SHA1 (openssh-10.0p2.tar.gz) = ac4205e827aea383bf316a33a0e2d5b66b85fcf8

• SHA256 (openssh-10.0p2.tar.gz) = AhoucJoO30JQsSVr1anlAEEakN3avqgw7VnO+Q652Fw=

Please note that the SHA256 signatures are base64 encoded and not hexadecimal (which is the default for most checksum tools). The PGP key used to sign the releases is available from the mirror sites: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Reporting Bugs:

• Please read https://www.openssh.com/report.html Security bugs should be reported directly to openssh@openssh.com

OpenSSH 9.9p2 (2025-02-18)

OpenSSH 9.9p2 was released on 2025-02-18. It is available from the mirrors listed at https://www.openssh.com/. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at: https://www.openssh.com/donations.html

Changes since OpenSSH 9.9p1

This release fixes two security bugs.

Security

• Fix CVE-2025-26465 - ssh(1) in OpenSSH versions 6.8p1 to 9.9p1 (inclusive) contained a logic error that allowed an on-path attacker (a.k.a MITM) to impersonate any server when the VerifyHostKeyDNS option is enabled. This option is off by default.

• Fix CVE-2025-26466 - sshd(8) in OpenSSH versions 9.5p1 to 9.9p1 (inclusive) is vulnerable to a memory/CPU denial-of-service related to the handling of SSH2_MSG_PING packets. This condition may be mitigated using the existing PerSourcePenalties feature.

Both vulnerabilities were discovered and demonstrated to be exploitable by the Qualys Security Advisory team. We thank them for their detailed review of OpenSSH.

For OpenBSD, fixes to these problems are available as errata; refer to https://www.openbsd.org/errata.html

Bugfixes

• ssh(1), sshd(8): fix regression in Match directive that caused failures when predicates and their arguments were separated by '=' characters instead of whitespace (bz3739).

• sshd(8): fix the "Match invalid-user" predicate, which was matching incorrectly in the initial pass of config evaluation.

• ssh(1), sshd(8), ssh-keyscan(1): fix mlkem768x25519-sha256 key exchange on big-endian systems.

• Fix a number of build problems on particular operating systems / configurations.

Checksums:

• SHA1 (openssh-9.9p2.tar.gz) = edefe960645780dee78059c444d4261667ad3056
• SHA256 (openssh-9.9p2.tar.gz) = karbYD4IzChe3fll4RmdAlhfqU2ZTWyuW0Hhch4hVnM=

Please note that the SHA256 signatures are base64 encoded and not hexadecimal (which is the default for most checksum tools). The PGP key used to sign the releases is available from the mirror sites: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Reporting Bugs:

• Please read https://www.openssh.com/report.html Security bugs should be reported directly to openssh@openssh.com

OpenSSH 9.9/9.9p1 (2024-09-19)

OpenSSH 9.9 was released on 2024-09-19. It is available from the mirrors listed at https://www.openssh.com/. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at: https://www.openssh.com/donations.html

Future deprecation notice

OpenSSH plans to remove support for the DSA signature algorithm in early 2025. This release disables DSA by default at compile time.

DSA, as specified in the SSHv2 protocol, is inherently weak - being limited to a 160 bit private key and use of the SHA1 digest. Its estimated security level is only 80 bits symmetric equivalent.

OpenSSH has disabled DSA keys by default since 2015 but has retained run-time optional support for them. DSA was the only mandatory-to- implement algorithm in the SSHv2 RFCs, mostly because alternative algorithms were encumbered by patents when the SSHv2 protocol was specified.

This has not been the case for decades at this point and better algorithms are well supported by all actively-maintained SSH implementations. We do not consider the costs of maintaining DSA in OpenSSH to be justified and hope that removing it from OpenSSH can accelerate its wider deprecation in supporting cryptography libraries.

Currently DSA is disabled at compile time. The final step of removing DSA support entirely is planned for the first OpenSSH release of 2025.

DSA support may be re-enabled on OpenBSD by setting "DSAKEY=yes" in Makefile.inc. To enable DSA support in portable OpenSSH, pass the "--enable-dsa-keys" option to configure.

Potentially-incompatible changes

• ssh(1): remove support for pre-authentication compression. OpenSSH has only supported post-authentication compression in the server for some years. Compression before authentication significantly increases the attack surface of SSH servers and risks creating oracles that reveal information about information sent during authentication.

• ssh(1), sshd(8): processing of the arguments to the "Match" configuration directive now follows more shell-like rules for quoted strings, including allowing nested quotes and -escaped characters. If configurations contained workarounds for the previous simplistic quote handling then they may need to be adjusted. If this is the case, it's most likely to be in the arguments to a "Match exec" confition. In this case, moving the command to be evaluated from the Match line to an external shell script is easiest way to preserve compatibility with both the old and new versions.

Changes since OpenSSH 9.8

This release contains a number of new features and bugfixes.

New features

• ssh(1), sshd(8): add support for a new hybrid post-quantum key exchange based on the FIPS 203 Module-Lattice Key Enapsulation mechanism (ML-KEM) combined with X25519 ECDH as described by https://datatracker.ietf.org/doc/html/draft-kampanakis-curdle-ssh-pq-ke-03 This algorithm "mlkem768x25519-sha256" is available by default.

• ssh(1): the ssh_config "Include" directive can now expand environment as well as the same set of %-tokens "Match Exec" supports.

• sshd(8): add a sshd_config "RefuseConnection" option that, if set will terminate the connection at the first authentication request.

• sshd(8): add a "refuseconnection" penalty class to sshd_config PerSourcePenalties that is applied when a connection is dropped by the new RefuseConnection keyword.

• sshd(8): add a "Match invalid-user" predicate to sshd_config Match options that matches when the target username is not valid on the server.

• ssh(1), sshd(8): update the Streamlined NTRUPrime code to a substantially faster implementation.

• ssh(1), sshd(8): the hybrid Streamlined NTRUPrime/X25519 key exchange algorithm now has an IANA-assigned name in addition to the "@openssh.com" vendor extension name. This algorithm is now also available under this name "sntrup761x25519-sha512"

• ssh(1), sshd(8), ssh-agent(1): prevent private keys from being included in core dump files for most of their lifespans. This is in addition to pre-existing controls in ssh-agent(1) and sshd(8) that prevented coredumps. This feature is supported on OpenBSD, Linux and FreeBSD.

• All: convert key handling to use the libcrypto EVP_PKEY API, with the exception of DSA.

• sshd(8): add a random amount of jitter (up to 4 seconds) to the grace login time to make its expiry unpredictable.

Bugfixes

• sshd(8): relax absolute path requirement back to what it was prior to OpenSSH 9.8, which incorrectly required that sshd was started with an absolute path in inetd mode. bz3717

• sshd(8): fix regression introduced in openssh-9.8 that swapped the order of source and destination addresses in some sshd log messages.

• sshd(8): do not apply authorized_keys options when signature verification fails. Prevents more restrictive key options being incorrectly applied to subsequent keys in authorized_keys. bz3733

• ssh-keygen(1): include pathname in some of ssh-keygen's passphrase prompts. Helps the user know what's going on when ssh-keygen is invoked via other tools. Requested in GHPR503

• ssh(1), ssh-add(1): make parsing user@host consistently look for the last '@' in the string rather than the first. This makes it possible to more consistently use usernames that contain '@' characters.

• ssh(1), sshd(8): be more strict in parsing key type names. Only allow short names (e.g "rsa") in user-interface code and require full SSH protocol names (e.g. "ssh-rsa") everywhere else. bz3725

• regress: many performance and correctness improvements to the re-keying regression test.

• ssh-keygen(1): clarify that ed25519 is the default key type generated and clarify that rsa-sha2-512 is the default signature scheme when RSA is in use. GHPR505

• sshd(8): fix minor memory leak in Subsystem option parsing; GHPR515

• All: additional hardening and consistency checks for the sshbuf code.

• sshd(8): reduce default logingrace penalty to ensure that a single forgotton login that times out will be below the penalty threshold.

• ssh(1): fix proxy multiplexing (-O proxy) bug. If a mux started with ControlPersist then later has a forwarding added using mux proxy connection and the forwarding was used, then when the mux proxy session terminated, the mux master process would issue a bad message that terminated the connection.

Portability

• sync contrib/ssh-copy-id to the latest upstream version.

• regress: improve portablility for some awk(1) usage (e.g. Solaris)

• In the contrib/redhat RPM spec file, without_openssl was previously incorrectly enabled unconditionally.

• sshd(8) restore audit call before exit that regressed in openssh-9.8. Fixes an issue where the SSH_CONNECTION_ABANDON event was not recorded.

• sshd(8): add support for class-imposed loging restrictions on FreeBSD. Allowing auth_hostok(3) and auth_timeok(3) to control logins.

• Build fixes for Musl libc.

• Fix detection of setres*id on GNU/Hurd

Checksums:

• SHA1 (openssh-9.9.tar.gz) = 080acf6ff0b862e8faa3baa3920a079536d28e85

• SHA256 (openssh-9.9.tar.gz) = h1xwa7CVcJfN7I9MgxxPBpUELzo+tnmLy+6slYHTUtw=

• SHA1 (openssh-9.9p1.tar.gz) = 5ded7eb0add0b02b5d1a1c4bf5cb2c89d2117b53

• SHA256 (openssh-9.9p1.tar.gz) = s0P7zb/4fxWxmG5uFdbU/Jp9NgZr5rf7UHCHuo+WbAI=

Please note that the SHA256 signatures are base64 encoded and not hexadecimal (which is the default for most checksum tools). The PGP key used to sign the releases is available from the mirror sites: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Reporting Bugs:

• Please read https://www.openssh.com/report.html Security bugs should be reported directly to openssh@openssh.com

OpenSSH 9.8/9.8p1 (2024-07-01)

OpenSSH 9.8 was released on 2024-07-01. It is available from the mirrors listed at https://www.openssh.com/. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at: https://www.openssh.com/donations.html

Security

This release contains fixes for two security problems, one critical and one minor.

1. Race condition in sshd(8)

A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges.

Successful exploitation has been demonstrated on 32-bit Linux/glibc systems with ASLR. Under lab conditions, the attack requires on average 6-8 hours of continuous connections up to the maximum the server will accept. Exploitation on 64-bit systems is believed to be possible but has not been demonstrated at this time. It's likely that these attacks will be improved upon.

Exploitation on non-glibc systems is conceivable but has not been examined. Systems that lack ASLR or users of downstream Linux distributions that have modified OpenSSH to disable per-connection ASLR re-randomisation (yes - this is a thing, no - we don't understand why) may potentially have an easier path to exploitation. OpenBSD is not vulnerable.

We thank the Qualys Security Advisory Team for discovering, reporting and demonstrating exploitability of this problem, and for providing detailed feedback on additional mitigation measures.

2. Logic error in ssh(1) ObscureKeystrokeTiming

In OpenSSH version 9.5 through 9.7 (inclusive), when connected to an OpenSSH server version 9.5 or later, a logic error in the ssh(1) ObscureKeystrokeTiming feature (on by default) rendered this feature ineffective - a passive observer could still detect which network packets contained real keystrokes when the countermeasure was active because both fake and real keystroke packets were being sent unconditionally.

This bug was found by Philippos Giavridis and also independently by Jacky Wei En Kung, Daniel Hugenroth and Alastair Beresford of the University of Cambridge Computer Lab.

Worse, the unconditional sending of both fake and real keystroke packets broke another long-standing timing attack mitigation. Since OpenSSH 2.9.9 sshd(8) has sent fake keystoke echo packets for traffic received on TTYs in echo-off mode, such as when entering a password into su(8) or sudo(8). This bug rendered these fake keystroke echoes ineffective and could allow a passive observer of a SSH session to once again detect when echo was off and obtain fairly limited timing information about keystrokes in this situation (20ms granularity by default).

This additional implication of the bug was identified by Jacky Wei En Kung, Daniel Hugenroth and Alastair Beresford and we thank them for their detailed analysis.

This bug does not affect connections when ObscureKeystrokeTiming was disabled or sessions where no TTY was requested.

Future deprecation notice

OpenSSH plans to remove support for the DSA signature algorithm in early 2025. This release disables DSA by default at compile time.

DSA, as specified in the SSHv2 protocol, is inherently weak - being limited to a 160 bit private key and use of the SHA1 digest. Its estimated security level is only 80 bits symmetric equivalent.

OpenSSH has disabled DSA keys by default since 2015 but has retained run-time optional support for them. DSA was the only mandatory-to- implement algorithm in the SSHv2 RFCs, mostly because alternative algorithms were encumbered by patents when the SSHv2 protocol was specified.

This has not been the case for decades at this point and better algorithms are well supported by all actively-maintained SSH implementations. We do not consider the costs of maintaining DSA in OpenSSH to be justified and hope that removing it from OpenSSH can accelerate its wider deprecation in supporting cryptography libraries.

This release, and its deactivation of DSA by default at compile-time, marks the second step in our timeline to finally deprecate DSA. The final step of removing DSA support entirely is planned for the first OpenSSH release of 2025.

DSA support may be re-enabled in OpenBSD by setting "DSAKEY=yes" in Makefile.inc. To enable DSA support in portable OpenSSH, pass the "--enable-dsa-keys" option to configure.

Potentially-incompatible changes

• all: as mentioned above, the DSA signature algorithm is now disabled at compile time.

• sshd(8): the server will now block client addresses that repeatedly fail authentication, repeatedly connect without ever completing authentication or that crash the server. See the discussion of PerSourcePenalties below for more information. Operators of servers that accept connections from many users, or servers that accept connections from addresses behind NAT or proxies may need to consider these settings.

• sshd(8): the server has been split into a listener binary, sshd(8), and a per-session binary "sshd-session". This allows for a much smaller listener binary, as it no longer needs to support the SSH protocol. As part of this work, support for disabling privilege separation and disabling re-execution of sshd(8) has been removed. Further separation of sshd-session into additional, minimal binaries is planned for the future.

• sshd(8): several log messages have changed. In particular, some log messages will be tagged with as originating from a process named "sshd-session" rather than "sshd".

• ssh-keyscan(1): this tool previously emitted comment lines containing the hostname and SSH protocol banner to standard error. This release now emits them to standard output, but adds a new "-q" flag to silence them altogether.

• sshd(8): (portable OpenSSH only) sshd will no longer use argv[0] as the PAM service name. A new "PAMServiceName" sshd_config(5) directive allows selecting the service name at runtime. This defaults to "sshd". bz2101

• (portable OpenSSH only) Automatically-generated files, such as configure, config.h.in, etc will now be checked in to the portable OpenSSH git release branch (e.g. V_9_8). This should ensure that the contents of the signed release branch exactly match the contents of the signed release tarball.

Changes since OpenSSH 9.7

This release contains mostly bugfixes.

New features

• sshd(8): as described above, sshd(8) will now penalise client addresses that, for various reasons, do not successfully complete authentication. This feature is controlled by a new sshd_config(5) PerSourcePenalties option and is on by default.

  sshd(8) will now identify situations where the session did not authenticate as expected. These conditions include when the client repeatedly attempted authentication unsucessfully (possibly indicating an attack against one or more accounts, e.g. password guessing), or when client behaviour caused sshd to crash (possibly indicating attempts to exploit bugs in sshd).

  When such a condition is observed, sshd will record a penalty of some duration (e.g. 30 seconds) against the client's address. If this time is above a minimum configurable threshold, then all connections from the client address will be refused (along with any others in the same PerSourceNetBlockSize CIDR range) until the penalty expire.

  Repeated offenses by the same client address will accrue greater penalties, up to a configurable maximum. Address ranges may be fully exempted from penalties, e.g. to guarantee access from a set of trusted management addresses, using the new sshd_config(5) PerSourcePenaltyExemptList option.

  We hope these options will make it significantly more difficult for attackers to find accounts with weak/guessable passwords or exploit bugs in sshd(8) itself. This option is enabled by default.

• ssh(8): allow the HostkeyAlgorithms directive to disable the implicit fallback from certificate host key to plain host keys.

Bugfixes

• misc: fix a number of inaccuracies in the PROTOCOL.* documentation files. GHPR430 GHPR487

• all: switch to strtonum(3) for more robust integer parsing in most places.

• ssh(1), sshd(8): correctly restore sigprocmask around ppoll()

• ssh-keysign(8): stricter validation of messaging socket fd GHPR492

• sftp(1): flush stdout after writing "sftp>" prompt when not using editline. GHPR480

• sftp-server(8): fix home-directory extension implementation, it previously always returned the current user's home directory contrary to the spec. GHPR477

• ssh-keyscan(1): do not close stdin to prevent error messages when stdin is read multiple times. E.g. echo localhost | ssh-keyscan -f - -f -

• regression tests: fix rekey test that was testing the same KEX algorithm repeatedly instead of testing all of them. bz3692

• ssh_config(5), sshd_config(5): clarify the KEXAlgorithms directive documentation, especially around what is supported vs available. bz3701.

Portability

• sshd(8): expose SSH_AUTH_INFO_0 always to PAM auth modules unconditionally. The previous behaviour was to expose it only when particular authentication methods were in use.

• build: fix OpenSSL ED25519 support detection. An incorrect function signature in configure.ac previously prevented enabling the recently added support for ED25519 private keys in PEM PKCS8 format.

• ssh(1), ssh-agent(8): allow the presence of the WAYLAND_DISPLAY environment variable to enable SSH_ASKPASS, similarly to the X11 DISPLAY environment variable. GHPR479

• build: improve detection of the -fzero-call-used-regs compiler flag. bz3673.

• build: relax OpenSSL version check to accept all OpenSSL 3.x versions.

• sshd(8): add support for notifying systemd on server listen and reload, using a standalone implementation that doesn't depend on libsystemd. bz2641

Checksums:

• SHA1 (openssh-9.8.tar.gz) = bc45cedae7f70b41e9922ef4c9f56e74b9a659b7

• SHA256 (openssh-9.8.tar.gz) = Dnc69VLWFBFdiaz8wySPlvHjb7wZfh/kblQ8ISuQr1Y=

• SHA1 (openssh-9.8p1.tar.gz) = a0bb501b11349f5c5c33a269351be091dc2c2727

• SHA256 (openssh-9.8p1.tar.gz) = 3YvQAqN5tdSZ37BQ3R+pr4Ap6ARh9LtsUjxJlz9aOfM=

Please note that the SHA256 signatures are base64 encoded and not hexadecimal (which is the default for most checksum tools). The PGP key used to sign the releases is available from the mirror sites: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Reporting Bugs:

• Please read https://www.openssh.com/report.html Security bugs should be reported directly to openssh@openssh.com

OpenSSH 9.7/9.7p1 (2024-03-11)

OpenSSH 9.7 was released on 2024-03-11. It is available from the mirrors listed at https: