Texas Linux Fest 2026: Evidence Sets the Ceiling

In 1978, the University of Texas Harry Ransom Center acquired one of only 20 complete copies of the Gutenberg Bible. Finished in Mainz in 1455, the Latin Bible was the first substantial book in Europe printed with movable type. The Austin copy stays on view, and the complete text can be read online. The Harry Ransom Center keeps the copy open to the public.

A text stays useful when people can still open it and check the source.

Texas Linux Fest 2026 brought more than 400 attendees to Austin on November 6 and 7. The volunteer-run event gathered Linux users, open source maintainers, infrastructure engineers, and security practitioners for two days of hands-on learning and technical talks.

Workshop day built skills through direct practice. The second day widened the view to the systems, communities, and policies surrounding those skills. The strongest talks kept returning to one shared idea. Reliable decisions begin with evidence people can inspect.

Evidence sets the ceiling.

Workshop Day Put the Tools in People's Hands

Friday was workshop day. Aleksey Tsalolikhin opened “Power Editing with Vi: Basics” with the small commands that make the editor feel predictable. Movement through hjkl, forward and backward search, line jumps, insertion, and the repeat command gave attendees a practical vocabulary for working inside the terminal.

Aleksey presenting “Power Editing with Vi: Basics.” Photo shared on Bluesky.

Michael Schwartz followed with “Build a Safer sudo with Cedar.” The workshop used Cedar policies to authorize privileged Linux operations. Attendees could test rules for viewing logs, checking service status, and restarting a service while keeping the policy readable.

Michael presenting “Build a Safer sudo with Cedar.” Photo shared on Bluesky.

Both workshops made system behavior visible. Vi shows the effect of each command immediately. Cedar turns authorization into policy that can be read and tested. That foundation carried into Saturday's talks.

Privacy Keeps Legitimate Markets Working

Don Marti, founder of Aloodo and former editor of Linux Journal, opened the main conference day with “Surviving the Rugpull Economy.” Privacy helps markets work by preserving enough information symmetry for people and legitimate businesses to make informed choices.

Don presenting “Surviving the Rugpull Economy.” Photo shared on Bluesky.

Online advertising weakened that balance. Automated auctions reward the cheapest attention, and fraud can buy the same placement as a legitimate business. Slop sites capture revenue while trustworthy publishers absorb the cost of producing useful information.

Scams now sit inside ordinary browsing. The FBI recommends ad blockers as a safety measure. Enterprise security guidance increasingly includes browser controls, network filtering, and managed-device policies that reduce exposure to malicious ads.

Don called for deliberate choices that reward legitimate companies and support trustworthy marketplaces. Reputation systems and user reviews need defenses against manipulation. Privacy tools help people preserve control over the signals used to target them.

Open Source Communities Are Learning to Govern AI Contributions

Eduardo Robles examined AI's growing role in open source with “Attack of the AI Bots!!” Maintainers now receive low-quality generated patches alongside a rising volume of vulnerability reports and supply chain attacks.

Eduardo presenting “Attack of the AI Bots!!” Photo shared on Bluesky.

Projects have responded in different ways. Some reject AI-assisted contributions. Others accept the tools while enforcing contribution guidelines and review standards. Strong governance gives maintainers a practical way to judge the work that arrives.

AI clean-room engineering complicates the issue. One model can describe software behavior and another can implement that description. Services such as Malus promote this workflow as a path around open source license obligations. The approach raises hard questions about originality, provenance, and the evidence needed to show independent implementation.

Eduardo's conclusion was grounded in community practice. Communication, mentorship, and consistent enforcement can help FOSS projects absorb new tools while preserving quality. Contribution history and review remain evidence of how code entered the project.

Observability Quality Determines AI Reliability

Peter Zaitsev, founder of Percona and co-founder of Coroot, presented “Using eBPF for Kubernetes Observability Without the Overhead.” His model separated incident work into four stages. Systems collect evidence and analyze relationships. An LLM interprets the evidence. A human engineer decides what to do.

Peter presenting “Using eBPF for Kubernetes Observability Without the Overhead.” Photo shared on Bluesky.

“Zero evidence plus a brilliant model equals confident fiction.”

Coroot tested 11 models against the same incident context. Five passed, four produced partial answers, and two failed. Model size did not predict success. Some cheaper models performed better than larger alternatives.

Dependency graphs help contain the search. Symptoms in upstream services often follow a failure deeper in the graph. Correlation between two rising curves provides a lead, while connection-level evidence can show whether the affected request used the failing database path.

eBPF collects that evidence at kernel hook points. One agent per Kubernetes node can observe network traffic, processes, and I/O without application code changes. In-kernel aggregation ships summaries instead of every raw event.

Metrics, traces, and container logs receive the same workload identity. That shared identity helps investigators connect a latency spike with retransmits, a slow disk write, or a specific container. The resulting AI explanation can only be as strong as the evidence underneath it.

Secure Travel Starts With a Data Boundary

Justin Campbell used a border search to frame “The Right to rm -rf: Building a Global, Self-Hosted Backup and Restore Platform.” Officials retained his devices during secondary screening. Someone later initiated an SSH login from the laptop while it was expected to remain offline.

Justin presenting “The Right to rm -rf.” Photo shared on Bluesky.

His threat model begins with keeping data from crossing the border. Files are backed up and removed before travel, then restored afterward. A self-hosted server uses ZFS for storage and encryption, while Samba handles local transport.

Remote restoration requires a controlled path back home. Nebula supplies an overlay network. A registration service and time-sensitive port-knocking sequence create temporary access. PiKVM keeps decryption under human control.

The design trades restoration time for a smaller exposure window. Its central claim is direct. Data outside the device cannot be copied from the device. A clear boundary gives the owner evidence about where sensitive material exists.

Agentic Infrastructure Needs Executable Guardrails

Cody Lee Cochran extended the evidence theme into automation with “Agentic Infrastructure Lifecycle Management.” Infrastructure work includes building, updating, deploying, testing, and destroying environments. Agents need each stage expressed as a repeatable operation.

Cody presenting “Agentic Infrastructure Lifecycle Management.” Photo shared on Bluesky.

ShellCheck, shfmt, and generated documentation turn shell scripts into artifacts an agent can inspect. Wrapper scripts make discovery rules explicit. A write mode can remain separate from validation so automated gates only report problems.

Git hooks bring those checks to the commit boundary. Return codes tell an agent what succeeded and what needs repair. Test suites provide the evidence required to trust a generated change.

Cody connected this work to service-management lifecycle practices. A mature skill can guide an agent through the same repeatable process a human operator follows. Standard structure gives both groups a shared contract.

Authentication Needs Lifecycle Management

Cornelius Kölbel, project lead for privacyIDEA, closed the event with “Centrally Managed Multi-Factor Authentication for All Your Users' Notebooks.” The session followed authentication from passwords and one-time codes through asymmetric cryptography and device-bound passkeys.

Cornelius presenting centrally managed multi-factor authentication for notebooks. Photo shared on Bluesky.

TOTP and HOTP depend on a symmetric secret that the verifying system must access. Enrollment and device migration create opportunities for that secret to be copied. Asymmetric authentication lets the verifier keep a public key while the private key remains with the user.

Traditional PKI brings certificate issuance, expiration, and revocation infrastructure. FIDO2 reduces that burden. Device-bound passkeys provide strong possession evidence while privacyIDEA adds centralized enrollment and disablement.

Lost devices make lifecycle management essential. Administrators need a reliable way to enroll replacement authenticators and revoke old ones across managed notebooks. The authentication ceremony provides strong evidence only while the surrounding inventory stays accurate.

Open Systems Earn Trust Through Inspectable Evidence

Texas Linux Fest moved from editor commands to market economics, then through AI contributions, kernel observability, backups, infrastructure automation, and passkeys. Each topic depended on knowing what happened inside the system.

Privacy preserves information boundaries. Contribution history supports open source governance. eBPF exposes runtime behavior. Tests and hooks show whether an agentic change satisfies its contract. Authentication records which key proved possession.

Human judgment remains accountable for the final decision. Better evidence gives that judgment a higher ceiling.

The Gutenberg Bible in Austin remains on view because a complete copy can still be opened and checked. Texas Linux Fest spent two days on systems that earn trust the same way. Source, evidence, and policy stay useful when people can inspect them.