FrOSCon 2026
FrOSCon took place at Hochschule Bonn-Rhein-Sieg in Sankt Augustin on 15 and 16 August 2026. Two days of free software, open-source projects, conversations, and a surprising number of things that were supposed to be quick looks.
FrOSCon is a two-day conference about free software and open source. Its programme covers a wide range of technical and social topics. Admission is free thanks to the support of its partners.
Most talks are available as recordings on media.ccc.de.
Notes and discoveries
The Cyber Resilience Act: Where do we stand?
The talk focused on open-source developers, maintainers, foundations, the new term "Open Source Software Steward", and how the legal obligations of commercial integrators affect upstream projects.
The timeline was more concrete than the first quick note suggested: Reporting of actively exploited vulnerabilities and serious security incidents begins on 11 September 2026. The CRA becomes fully applicable on 11 December 2027. Non-commercial open-source development is generally outside its scope. Grey areas remain around donations, paid maintainer positions, dual licensing, and employment by foundations.
OctoPrint: Controlling a 3D printer from the browser
OctoPrint provides a web interface for 3D printers and does much more than start a print job. Printers and running jobs can be monitored and controlled remotely, including webcam video, progress information, GCODE visualisation, and temperature control for the hotend and print bed.
Maintaining software can become a lot of work. The talk also made clear what is rewarding about it, as well as the less pleasant sides.
OctoPrint website Talk recording
The slides for the OctoPrint talk are available separately:
TLS, mTLS, SNI, ECH, CAA, HTTPS, PKI, Certificates, and a little PQC
Sven Höxter gave a practical overview of TLS, mTLS, SNI, ECH, CAA, HTTPS, PKI, and certificates. The table summarises the methods and terms covered in the talk:
| Method / term | Characteristic | Typical use |
|---|---|---|
| TLS | Encrypts and authenticates the transport connection | HTTPS and other secure network connections |
| mTLS | Both sides prove their identity with a certificate | Internal APIs, service-to-service communication, zero-trust environments |
| SNI | The requested hostname is sent during the TLS setup | Multiple HTTPS domains on one IP address |
| ECH | Also encrypts the sensitive part of the ClientHello containing the target hostname | More privacy when establishing an HTTPS connection |
| CAA | DNS specifies which certificate authorities may issue certificates | Restricting and controlling certificate issuance |
| HTTPS Resource Record | Associates HTTPS services and connection parameters with DNS | Modern hints for clients connecting to a service |
| PKI | Trust model made up of certificates, certificate authorities, and validation | Building and managing certificate chains |
| x509 | Standard format for many digital certificates | TLS certificates and other identity credentials |
| PQC | Cryptography intended to remain robust against future quantum computers | Preparing for the next generation of transport encryption |
The talk deliberately avoided most of the underlying mathematics and an ASN.1 detour. Instead, it focused on developments around TLS 1.3, current implementations, and how HTTPS may change in the coming years.
curl: More than HTTP
I missed this talk, unfortunately. curl is much more than a tool for simple HTTP checks. It is also useful for REST API debugging, Kubernetes ingress, SMTP, LDAP, comparing HTTP and HTTPS, and analysing TLS certificates.
The verbose mode makes curl interesting in day-to-day support. Requests, responses, headers, redirects, and the TLS handshake can be inspected directly without starting a specialised client. This small command-line tool becomes a universal diagnostic tool for network and API problems.
Overte: Self-hosted VR worlds
Overte is an open-source platform for virtual worlds and social VR. Worlds can be created and self-hosted, either as VR experiences or desktop applications. It also provides avatar interaction, spatial audio, physics, collaborative building, and JavaScript scripting.
The interesting part is the lack of a central authority: The server can be run independently, and using it does not require an account with the platform operator. For now, getting started still requires a connection to a PC.
Log management with Loki
The talk showed how Loki, Grafana, and Alloy could be used to build a central logging infrastructure. Loki stored log lines but did not index their entire content, only timestamps and labels. This reduced storage and operating costs while still being sufficient for many search and analysis tasks.
Alloy handled collection and preprocessing, Loki handled storage, and Grafana handled visualisation. Queries used LogQL with label selectors and processing pipelines. The talk demonstrated this with failed SSH logins: events were collected, analysed by different criteria, and displayed on a world map according to their origin.
| Component | Characteristic | Use | |
|---|---|---|---|
| Alloy | Collects and preprocesses logs before sending | Agent on servers, VMs, or Kubernetes | |
| Loki | Indexes labels and timestamps instead of every log line | Central, storage-efficient log storage | |
| Grafana | Makes logs and queries visible | Search, dashboards, and correlation with metrics | |
| LogQL | Query language with label selectors and pipelines | Filtering, parsing, and analysing logs |
The stack came from the cloud-native world but was not limited to it. Traditional Linux servers and smaller infrastructures could also benefit when logs needed to be searched centrally and compared with other observability data without direct server access.
YaCy as a RAG search engine
YaCy is a free, distributed search engine based on peer-to-peer principles. In the context of RAG, the project YaCy Expert is particularly interesting: a YaCy search provides relevant context that a language model can then use to answer a question.
The advantage of this combination is the separation of retrieval and text generation. The search index determines which documents provide the basis, while the language model turns them into an understandable answer. This can keep answers more closely tied to a controlled corpus and is interesting for self-hosted or privacy-conscious knowledge bases.
Cognitive Utilities: From simple AI calls to a coding agent
The repository cognitive-utilities uses small, executable examples to show how AI usage can be expanded step by step. It starts with direct API calls and structured responses, moves through filters, map-reduce and tool calls to agentic loops, and ends with a coding agent with controlled command and file execution.
The visible progression is particularly useful: the LLM, prompt, tools, and loop remain visible as individual building blocks instead of disappearing behind a large agent framework. The examples run with local models through Ollama, offering a way to experiment without a cloud API. For a workshop or for understanding the mechanics, that is much more useful than an agent that merely appears to work.
Spec Kitty: Spec-driven development for coding agents
Spec Kitty is an open-source CLI for spec-driven development with AI coding agents. The workflow starts with a specification and continues through planning and tasks to implementation, review, acceptance, and merge. The idea is refreshingly unmagical: humans define the goal, architecture, and acceptance criteria; agents work in traceable worktrees; and the process ends with real review gates instead of blind trust in the next block of generated code.
The project artefacts stay in the repository, so a SaaS service is not required. It also provides work-package lanes, a local dashboard, and an audit trail. That is an interesting alternative to "vibe coding": less prompt magic, more verifiable intermediate states.
The open-source stack for sovereign LLMs
The talk sorted out the confusion around local and self-hosted LLMs. Open weights do not automatically mean open source: the weights may be available without revealing the data and methods used to create them. That also does not necessarily make true forking and further development possible.
A useful distinction is what currently limits inference. A compute-bound model is limited by compute power, while a bandwidth-bound model is limited by memory and data-path throughput. This affects which hardware and optimisations make sense.
For multi-user operation, vLLM was highlighted as an inference server. vLLM offers high performance but also many tuning knobs. Batching, memory management, the KV cache, and the hardware determine whether the theoretical performance holds up in practice.
Other interesting developments mentioned were Meta Muse Glimmer, NVIDIA approaches to small-language-model agents, KServe, and llm-d. Muse Glimmer targets local agentic workflows. KServe and llm-d belong to the layer where models are deployed in clusters and served to multiple users.
The mental model from the talk helps classify new tools by their role in the inference stack: model, runtime, server, orchestration, and operations. That distinction is usually missing just before a harmless local experiment turns into a rabbit hole.
KV cache: Context as inference state
The KV cache is currently a very active topic in LLM infrastructure. During inference, it stores the already computed key and value tensors from the attention layers. These values do not need to be calculated again for the next token. This saves compute and improves latency and throughput, but consumes memory, especially with long contexts and many concurrent requests.
The effect on the stateless model is interesting: the LLM does not actually learn, but the running inference process has a concrete state. The cache holds the context for a session or request. If it is shared between requests or inference servers, that state can even be used across processes and GPUs.
KV caching is therefore more than a small model-server optimisation. Routing, scheduling, and memory management need to know which instance already holds the relevant context. Cache-aware routing can prevent the same context from being rebuilt for every user, at the cost of additional work around memory, lifetime, eviction, and privacy.
Collabora Office and the Euro Stack
Collabora Office is evolving. Alongside the web version, new native applications are now available. This matters because an office suite should also work offline and locally, in environments where organisations want to control their data and update cycles.
The talk placed Collabora Office and Collabora Online in the context of digital sovereignty. Open standards such as ODF and open-source software can reduce dependence on proprietary providers. Migration projects in Schleswig-Holstein and the Austrian military were given as examples.
The Euro Stack is not a single product or a finished European operating system. It is better understood as a European digital ecosystem of open standards, open-source software, sovereign infrastructure, and providers whose development and operations remain traceable. Office suites such as Collabora are a visible part of it because public authorities and companies create documents every day and need them to remain accessible over time.
The idea may sound like infrastructure policy, but it quickly reaches the office: organisations that control document formats, data flows, and update cycles have more options during a migration than those tied to one provider and its cloud.
Collabora Online and Collabora Office EuroStack initiative Talk recording
Luanti: Developing voxel games
Luanti was presented at an exhibitor stand as an open-source platform for voxel games. The engine naturally brings the familiar block world to mind, but it is less a single game than a platform: it provides different games, mods, textures, and the option to build your own worlds.
Luanti provides a Lua API for creating content. It allows game mechanics and extensions to be written without having to implement voxel rendering or networking. The community publishes finished content through ContentDB.
It does not include an editor itself. Blender and Blockbench were recommended. They can be used to prepare custom models and game content for a Luanti world. The combination of an open engine, a modding interface, and tools for trying out game ideas directly is appealing.
Lightning talks: nspawn, CoverGrid, and MOTIS
The lightning talks produced several small but very different discoveries.
systemd-nspawn and machinectl are part of systemd’s toolkit for lightweight containers. `machinectl` manages such containers; for example, an image can be imported from a tar archive with `import-tar`. This is a direct approach for test systems and well-defined services without bringing in a large container platform.
CoverGrid, or mcg, is a GTK client for the Music Player Daemon (MPD) that focuses on albums rather than individual tracks. Its interface presents the music collection as an album cabinet. The project is by suruatoel and is hosted on Codeberg.
CoverGrid / mcg suruatoel on Codeberg
MOTIS is an open-source routing system for roads, public transport, and intermodal connections. A route can combine different modes of transport, including walking, cycling, buses, trains, and shared mobility such as bike sharing, e-scooters, or car sharing. The related project Transitous builds on it to provide a community-run, provider-neutral public transport routing service.
postmarketOS: Linux on old smartphones
postmarketOS is a Linux distribution for smartphones and tablets. Instead of leaving a device to its manufacturer and its last Android release after a few years, the project tries to keep as much normal Linux infrastructure running on mobile hardware as possible. The distribution is based on Alpine Linux and works to bring devices closer to the mainline Linux kernel.
The result is not equally complete on every model. Calls, cameras, graphics, Wi-Fi, and mobile data can work to different degrees depending on the device. That honest range is part of the project: supported does not automatically mean every function works perfectly. In return, the software remains readable, modifiable, and independent of the original vendor support.
postmarketOS is especially interesting as an alternative to the short life of many smartphones. Old hardware can continue as a Linux device, test platform, or mobile terminal instead of being discarded because updates stopped.
Kahoot raffle
Kahoot combines quiz questions, competition, and a little stage chaos: participants use their own devices and immediately see how they compare with the group.
Finale
FrOSCon 2026 was fun. The supporting programme with companies and FOSS projects was interesting as always, and the Saturday evening event led to some memorable encounters. I still have a few talks to catch up on online.