Connect with us
DAPA Banner

Tech

Alibaba’s small, open source Qwen3.5-9B beats OpenAI’s gpt-oss-120B and can run on standard laptops

Published

on

Despite political turmoil in the U.S. AI sector, in China, the AI advances are continuing apace without a hitch.

Earlier today, e-commerce giant Alibaba’s Qwen Team of AI researchers, focused primarily on developing and releasing to the world a growing family of powerful and capable Qwen open source language and multimodal AI models, unveiled its newest batch, the Qwen3.5 Small Model Series, which consists of:

  • Qwen3.5-0.8B & 2B: Two models, both ptimized for “tiny” and “fast” performance, intended for prototyping and deployment on edge devices where battery life is paramount.

  • Qwen3.5-4B: A strong multimodal base for lightweight agents, natively supporting a 262,144 token context window.

  • Qwen3.5-9B a compact reasoning model that outperforms the 13.5x larger U.S. rival OpenAI’s open soruce gpt-oss-120B on key third-party benchmarks including multilingual knowledge and graduate-level reasoning

To put this into perspective, these models are on the order of the smallest general purpose models lately shipped by any lab around the world, comparable more to MIT offshoot LiquidAI’s LFM2 series, which also have several hundred million or billion parameters, than the estimated trillion parameters (model settings) reportedly used for the flagship models from OpenAI, Anthropic, and Google’s Gemini series.

The weights for the models are available right now globally under Apache 2.0 licenses — perfect for enterprise and commercial use, including customization as needed — on Hugging Face and ModelScope.

Advertisement

The technology: hybrid efficiency and native multimodality

The technical foundation of the Qwen3.5 small series is a departure from standard Transformer architectures. Alibaba has moved toward an Efficient Hybrid Architecture that combines Gated Delta Networks (a form of linear attention) with sparse Mixture-of-Experts (MoE).

This hybrid approach addresses the “memory wall” that typically limits small models; by using Gated Delta Networks, the models achieve higher throughput and significantly lower latency during inference.

Furthermore, these models are natively multimodal. Unlike previous generations that “bolted on” a vision encoder to a text model, Qwen3.5 was trained using early fusion on multimodal tokens. This allows the 4B and 9B models to exhibit a level of visual understanding—such as reading UI elements or counting objects in a video—that previously required models ten times their size.

Benchmarking the “small” series: performance that defies scale

Newly released benchmark data illustrates just how aggressively these compact models are competing with—and often exceeding—much larger industry standards. The Qwen3.5-9B and Qwen3.5-4B variants demonstrate a cross-generational leap in efficiency, particularly in multimodal and reasoning tasks.

Advertisement
Qwen3.5 Small Models Series benchmarks

Qwen3.5 Small Models Series benchmarks against other similarly-sized/classed models. Credit: Alibaba Qwen

Multimodal dominance: In the MMMU-Pro visual reasoning benchmark, Qwen3.5-9B achieved a score of 70.1, outperforming Gemini 2.5 Flash-Lite (59.7) and even the specialized Qwen3-VL-30B-A3B (63.0).

Graduate-level reasoning: On the GPQA Diamond benchmark, the 9B model reached a score of 81.7, surpassing gpt-oss-120b (80.1), a model with over ten times its parameter count.

Video understanding: The series shows elite performance in video reasoning. On the Video-MME (with subtitles) benchmark, Qwen3.5-9B scored 84.5 and the 4B scored 83.5, significantly leading over Gemini 2.5 Flash-Lite (74.6).

Advertisement

Mathematical prowess: In the HMMT Feb 2025 (Harvard-MIT mathematics tournament) evaluation, the 9B model scored 83.2, while the 4B variant scored 74.0, proving that high-level STEM reasoning no longer requires massive compute clusters.

Document and multilingual knowledge: The 9B variant leads the pack in document recognition on OmniDocBench v1.5 with a score of 87.7. Meanwhile, it maintains a top-tier multilingual presence on MMMLU with a score of 81.2, outperforming gpt-oss-120b (78.2).

Community reactions: “more intelligence, less compute”

Coming on the heels of last week’s release of an already pretty small, powerful open source Qwen3.5-Medium capable of running on a single GPU, the announcement of the Qwen3.5-Small Models Series and their even smaller footprint and processing requirements sparked immediate interest among developers focused on “local-first” AI.

“More intelligence, less compute” resonated with users seeking alternatives to cloud-based models.

Advertisement

AI and tech educator Paul Couvert of Blueshell AI captured the industry’s shock regarding this efficiency leap.

“How is this even possible?!” Couvert wrote on X. “Qwen has released 4 new models and the 4B version is almost as capable as the previous 80B A3B one. And the 9B is as good as GPT OSS 120b while being 13x smaller!”

Couvert’s analysis highlights the practical implications of these architectural gains:

  • “They can run on any laptop”

  • “0.8B and 2B for your phone”

  • “Offline and open source”

As developer Karan Kendre of Kargul Studio put it: “these models [can run] locally on my M1 MacBook Air for free.”

Advertisement

This sentiment of “amazing” accessibility is echoed across the developer ecosystem. One user noted that a 4B model serving as a “strong multimodal base” is a “game changer for mobile devs” who need screen-reading capabilities without high CPU overhead.

Indeed, Hugging Face developer Xenova noted that the new Qwen3.5 Small Model series can even run directly in a user’s web browser and perform such sophisticated and previously higher-compute demanding operations like video analysis.

Researchers also praised the release of Base models alongside the Instruct versions, noting that it provides essential support for “real-world industrial innovation.”

The release of Base models is particularly valued by enterprise and research teams because it provides a “blank slate” that hasn’t been biased by a specific set of RLHF (Reinforcement Learning from Human Feedback) or SFT (Supervised Fine-Tuning) data, which can often lead to “refusals” or specific conversational styles that are difficult to undo.

Advertisement

Now, with the Base models, those interested in customizing the model to fit specific tasks and purposes an easier starting point, as they can now apply their own instruction tuning and post-training without having to strip away Alibaba’s.

Licensing: a win for the open ecosystem

Alibaba has released the weights and configuration files for the Qwen3.5 series under the Apache 2.0 license. This permissive license allows for commercial use, modification, and distribution without royalty payments, removing the “vendor lock-in” associated with proprietary APIs.

  • Commercial use: Developers can integrate models into commercial products royalty-free.

  • Modification: Teams can fine-tune (SFT) or apply RLHF to create specialized versions.

  • Distribution: Models can be redistributed in local-first AI applications like Ollama.

Contextualizing the news: why small matters so much right now

The release of the Qwen3.5 Small Series arrives at a moment of “Agentic Realignment.” We have moved past simple chatbots; the goal now is autonomy. An autonomous agent must “think” (reason), “see” (multimodality), and “act” (tool use). While doing this with trillion-parameter models is prohibitively expensive, a local Qwen3.5-9B can perform these loops for a fraction of the cost.

By scaling Reinforcement Learning (RL) across million-agent environments, Alibaba has endowed these small models with “human-aligned judgment,” allowing them to handle multi-step objectives like organizing a desktop or reverse-engineering gameplay footage into code. Whether it is a 0.8B model running on a smartphone or a 9B model powering a coding terminal, the Qwen3.5 series is effectively democratizing the “agentic era.”

Advertisement

The Qwen3.5 series shift from “chatbits” to “native multimodal agents” transforms how enterprises can distribute intelligence. By moving sophisticated reasoning to the “edge”—individual devices and local servers—organizations can automate tasks that previously required expensive cloud APIs or high-latency processing.

Strategic enterprise applications and considerations

The 0.8B to 9B models are re-engineered for efficiency, utilizing a hybrid architecture that activations only the necessary parts of the network for each task.

  • Visual Workflow Automation: Using “pixel-level grounding,” these models can navigate desktop or mobile UIs, fill out forms, and organize files based on natural language instructions.

  • Complex Document Parsing: With scores exceeding 90% on document understanding benchmarks, they can replace separate OCR and layout parsing pipelines to extract structured data from diverse forms and charts.

  • Autonomous Coding & Refactoring: Enterprises can feed entire repositories (up to 400,000 lines of code) into the 1M context window for production-ready refactors or automated debugging.

  • Real-Time Edge Analysis: The 0.8B and 2B models are designed for mobile devices, enabling offline video summarization (up to 60 seconds at 8 FPS) and spatial reasoning without taxing battery life.

The table below outlines which enterprise functions stand to gain the most from local, small-model deployment.

Function

Advertisement

Primary Benefit

Key Use Case

Software Engineering

Local Code Intelligence

Advertisement

Repository-wide refactoring and terminal-based agentic coding.

Operations & IT

Secure Automation

Automating multi-step system settings and file management tasks locally.

Advertisement

Product & UX

Edge Interaction

Integrating native multimodal reasoning directly into mobile/desktop apps.

Data & Analytics

Advertisement

Efficient Extraction

High-fidelity OCR and structured data extraction from complex visual reports.

While these models are highly capable, their small scale and “agentic” nature introduce specific operational “flags” that teams must monitor.

  • The Hallucination Cascade: In multi-step “agentic” workflows, a small error in an early step can lead to a “cascade” of failures where the agent pursues an incorrect or nonsensical plan.

  • Debugging vs. Greenfield Coding: While these models excel at writing new “greenfield” code, they can struggle with debugging or modifying existing, complex legacy systems.

  • Memory and VRAM Demands: Even “small” models (like the 9B) require significant VRAM for high-throughput inference; the “memory footprint” remains high because the total parameter count still occupies GPU space.

  • Regulatory & Data Residency: Using models from a China-based provider may raise data residency questions in certain jurisdictions, though the Apache 2.0 open-weight version allows for hosting on “sovereign” local clouds.

Enterprises should prioritize “verifiable” tasks—such as coding, math, or instruction following—where the output can be automatically checked against predefined rules to prevent “reward hacking” or silent failures.

Advertisement

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Tech

Trump Administration To Pay French Company $1 Billion To Stop Offshore Wind Farms

Published

on

An anonymous reader quotes a report from NPR: The Trump administration will pay $1 billion to a French company to walk away from two U.S. offshore wind leases as the administration ramps up its campaign against offshore wind and other renewable energy. TotalEnergies has agreed to what’s essentially a refund of its leases for projects off the coasts of North Carolina and New York, and will invest the money in fossil fuel projects instead, the Department of Interior announced Monday.

The Trump administration has tried to halt offshore wind construction, but federal judges overturned those orders. Environmental groups denounced the TotalEnergies deal as an alternate way to block wind projects. President Donald Trump has gone all in on fossil fuels, which he says is the way to lower costs for families, increase reliability and help the U.S. maintain global leadership in artificial intelligence.

TotalEnergies pledged to not develop any new offshore wind projects in the United States. TotalEnergies CEO Patrick Pouyanne said in a statement that the company renounced offshore wind development in the United States in exchange for the reimbursement of the lease fees, “considering that the development of offshore wind projects is not in the country’s interest.” Pouyanne said the refunded lease fees will finance the construction of a liquefied natural gas plant in Texas and the development of its oil and gas activities, calling it a “more efficient use of capital” in the U.S. After it makes those investments, TotalEnergies will be reimbursed, up to the amount paid in lease purchases for offshore wind, according to the DOI.

Source link

Advertisement
Continue Reading

Tech

S’pore bizs are cashing in on the fresh pet food boom

Published

on

An entire S$150 million industry is being built around fresh pet food in Singapore

For decades, the answer to feeding your pet was simple: open a bag of kibble, scoop some into a bowl, and that’s it—you were done.

Dry kibble has always dominated the global pet food market, and Singapore is no exception. It is cheap to produce, easy to store, and heavily marketed. For most pet owners, it has simply always been “the way.”

But increasingly, pet owners are asking harder questions. What exactly goes into those brown pellets? What is their nutritional value? And why do so many pets, even on premium kibble, still suffer from chronic ailments?

For a growing number of Singapore pet owners, the answer has been to ditch the bag entirely. They are turning to fresh pet food—minimally processed, human-grade meals made from real ingredients like sous vide chicken and bone broth. It costs a lot more, but they’re willing to splurge.

Advertisement

To meet the demand, a new wave of local brands has emerged, reshaping a market that, for decades, had remained largely unchanged.

Among them are PetCubes and BOM BOM: two Singapore-based fresh pet food companies that are both seeing market traction that their founders could not have anticipated when they first started out.

Taking pet nutrition to a new level

For Dr Francis Cabana, Director of Nutrition at PetCubes, the journey into pet food began far from domestic kitchens.

With a PhD in Animal Nutrition, his career has spanned zoos and rescue centres around the world, eventually bringing him to Mandai, where he worked with the Singapore Zoo. There, he began consulting for a local pet food startup—PetCubes—which would later become his full-time focus.

Advertisement
(Left): PetCubes Director of Nutrition Dr Francis Cabana; (Right): PetCubes offers gently cooked and raw meals portioned in cubes, frozen and ready to thaw before serving./ Image Credit: PetCubes

Founded in 2013, PetCubes claims to be Singapore’s first fresh pet food company, entering the market at a time when the concept was virtually unheard of.

“Back then, pet owners really only had two options: highly processed kibble or time-consuming home cooking,” he shared. “We wanted to bridge that gap with something that was both convenient and biologically appropriate.”

But being first came with challenges. Early growth was slow, and convincing pet owners and even veterinarians required extensive education.

“Every conversation was a hard-fought battle,” he said. “We were essentially teaching the market from scratch.”

Over time, however, that persistence paid off. Today, PetCubes operates its own ISO 22000 and HACCP-certified facility in Singapore and has expanded across Hong Kong and Malaysia. It has also achieved a milestone few fresh pet food brands can claim: being stocked in veterinary clinics locally.

Advertisement
BOM BOM founder Jason Wang./ Image Credit: BOM BOM

While PetCubes emerged from industry expertise, BOM BOM was born out of a deeply personal experience.

Its founder and CEO, Jason Wang, didn’t set out to start a business. In fact, he was preparing for retirement when his dog, Kyubi, began suffering from a host of chronic health issues, from digestive problems to joint conditions.

Frustrated by the lack of clear answers from conventional treatments, Jason began researching pet nutrition himself.

“What started as a personal journey quickly became a much bigger realisation,” he explained. “Many of the issues Kyubi faced were linked to diet, specifically, highly processed kibble.”

Unable to find a product that met his standards, Jason began preparing fresh meals himself. The results were dramatic: within weeks, Kyubi showed visible improvements in his digestion, skin, and energy levels, to the point where friends began asking him to prepare meals for their pets as well.

Advertisement

Eventually, the kitchen-based passion project he started in 2016 became BOM BOM, formally established in 2017.

Today, the company serves around 10,000 customers in Singapore and operates a 5,000 sq ft SFA-licensed facility in Tiong Bahru. It also has a presence in South Korea, with a 9,000 sq ft factory set up in Seoul to cater to its customers there.

The business’s growth has been largely bootstrapped, expanding at over 30% CAGR over the past decade, shared Jason.

What really goes into the bowl

BOM BOM provides personalised meal plans based on a pet’s individual micronutrient needs, age, and health condition. Their menu includes raw diets, cooked meals, raw edible bones for dental health, and even bone broth./ Image Credit: BOM BOM

The shift towards cooked pet food is driven largely by pet humanisation: the idea that pets are family members deserving of the same quality of care and nutrition as humans.

While dry kibble still dominates due to convenience and affordability, its growth has plateaued. In contrast, the fresh and cooked pet food segment—still only about 10–20% of the market, according to Jason—is expanding rapidly.

Advertisement

The fresh dog food market in Singapore was estimated to have reached about S$150 million in 2025, driven by rising pet ownership and premiumisation trends.

Inside PetCubes’ facility, fresh meals are prepared, cooked, and portioned with strict quality control./ Image Credit: PetCubes

Pet owners who have made the switch are noticing real, tangible changes in their pets’ health.

Dr Francis notes that after just three days on PetCubes, pets’ stools become smaller, darker, and less odorous—a clear sign their bodies are absorbing real nutrition instead of passing synthetic fillers.

PetCubes achieves these results through its thoughtfully crafted menu, which features 12 single-protein options ranging from rabbit and venison to crocodile and even insects.

Each meal is “gently cooked” at 75–80°C for at least 45 minutes—a low-and-slow method that eliminates pathogens while preserving delicate nutrients like vitamins, antioxidants, and proteins, which are often destroyed during the high-heat extrusion process used for kibble. The brand also offers raw options for pets that prefer an uncooked diet.

Advertisement

On the other hand, BOM BOM focuses on customised nutrition. Each meal is crafted on demand for individual pets based on age, breed, activity level, and specific health conditions.

Its smart factory rigorously checks portioning, fat content, and ingredient quality, while lab-tested produce and strict farm-to-bowl SOPs ensure freshness and safety.

This precision-led approach means pets often see measurable improvements in digestion, energy, coat health, and even chronic conditions—demonstrating the benefits of nutrition tailored to the individual rather than a one-size-fits-all formula.

Making an impression on the traditional market

As the category grows, so does competition.

Advertisement

New fresh, frozen, and freeze-dried brands are entering the market at an accelerating pace, offering pet owners a wider range of options than ever before. But perhaps the most telling sign of disruption is how traditional players are responding.

Like PetCubes, BOM BOM’s fresh meals are processed with strict quality control./ Image Credit: BOM BOM

According to Dr Francis, major kibble brands have begun adopting language like “raw-inspired” and “ancestral feeding”—a shift he sees as validation rather than competition.

“When billion-dollar companies start mimicking your messaging, it proves that the demand for less processed, natural food has truly made an impression on the traditional market,” he said.

“The disruption is happening because we’ve raised the bar on what a pet’s bowl should look like, and now the rest of the industry is trying to keep pace.”

Jason echoes a similar sentiment but adds that the next phase of growth must go deeper.

Advertisement

Right now, there are no consistent standards defining what “fresh” actually means. As a result, brands can label their products as fresh without ensuring they are truly nutrient-dense or biologically appropriate.

“The industry needs to move beyond using fresh as a marketing term. We need clearer nutritional standards, greater transparency, and better education on long-term health outcomes.”

A market still finding its feet

Image Credit: PetCubes

While both PetCubes and BOM BOM see fresh feeding as still being in its early stages, the opportunities for growth are undeniable.

In Singapore, both brands are actively expanding their presence to reach more mainstream consumers. PetCubes has strengthened its footprint in major retailers like Pet Lovers Centre, while continuing to grow its online and subscription channels.

It has already seen striking growth. “We’ve grown our revenue by over 400%,” said Dr Francis, adding that the business produces “hundreds of thousands of fresh meals” annually.

Advertisement

BOM BOM, on the other hand, is extending beyond its direct-to-consumer model with selective retail partnerships and broader e-commerce availability, ensuring pet owners can access fresh, personalised meals more conveniently.

For both brands, expansion isn’t just about sales—it’s about making science-backed or precision-led fresh nutrition widely accessible.

But challenges remain.

Fresh food comes with higher production costs, including sourcing premium, human-grade ingredients. Cold chain logistics are critical to ensure meals remain safe and nutritious, but add complexity to distribution. Shelf lives are also shorter compared to traditional kibble, which requires careful inventory management and can limit mass adoption.

Advertisement

Additionally, the need for consumer education is ongoing. Many pet owners are still unfamiliar with fresh feeding or hesitant to move away from conventional options.

Still, if current trends are anything to go by, the trajectory is clear: the demand for fresh pet food is rising, and the market is ripe for growth.

  • Read other articles we’ve written on Singaporean businesses here.

Featured Image Credit: @trufflewhuffle via Instagram/ BOM BOM

Advertisement

Source link

Continue Reading

Tech

Marathon review: Bungie’s extraction shooter lacks compelling reasons to play it

Published

on

Why you can trust TechRadar


We spend hours testing every product or service we review, so you can be sure you’re buying the best. Find out more about how we test.

With its incredibly expressive and vibrant art direction, there’s a lot to like about extraction shooter Marathon from an aesthetic standpoint. Its own brand of brightly colored science fiction is a sight to behold, and there’s a real sense of wonder in the first few hours as you explore each of the three early maps, soaking it all in.

Review info

Platform reviewed: PC
Available on: PS5, Xbox Series X|S, PC
Release date: March 5, 2026

Advertisement

Source link

Continue Reading

Tech

Claude Code and Cowork can now use your computer

Published

on

Anthropic announced today that its Claude Code and Claude Cowork tools are being updated to accomplish tasks using your computer. The latest update will see these AI resources become capable of opening files, using the browser and running dev tools.

When enabled, the Claude AI chatbot will first prioritize connectors to supported services such as the Google workplace suite or Slack, but if a connector isn’t available, it will be able to still execute an assigned task. Claude should ask for permission before taking these actions, but Anthropic still recommended not using this feature to handle sensitive information as a precaution.

Claude computer use will initially be available to Claude Pro and Claude Max subscribers on macOS. This feature is still in a research preview, so will continue to be adjusted based on Anthropic’s user feedback. It will also support use with Anthropic’s Dispatch feature, which allows a person to message the chatbot in a single continuous conversation across phone and desktop.

Claude Cowork was introduced in January. It’s an iteration of the Claude Code AI agent for programmers that is designed for more casual users.

Advertisement

Source link

Continue Reading

Tech

Television giants team up against dominant streaming OS & Apple TV

Published

on

The Association of Commercial Television and Video on Demand Services called on the EU antitrust chief to bring DMA-style regulation to set-top boxes — Apple TV also mentioned for some reason.

Apple TV set-top box under a monitor, back lit, with the Siri Remote in front of it
Apple TV targeted by TV group

The Apple TV set-top box is likely the best way to access and stream media, but that performance comes at a price. So, like other markets Apple is involved in, consumers trend toward cheaper options.
However, because of Apple’s control over its ecosystem, it is often grouped in with other market leaders regardless of reported market share estimates. According to a report from Reuters, the Association of Commercial Television and Video on Demand Services in Europe (ACT) has asked EU antitrust chief Teresa Ribera to have set-top boxes and smart TVs under the DMA as gatekeepers.
Continue Reading on AppleInsider | Discuss on our Forums

Source link

Continue Reading

Tech

Mazda discloses security breach exposing employee and partner data

Published

on

Mazda discloses security breach exposing employee and partner data

Mazda Motor Corporation (Mazda) announced that information belonging to its employees and business partners had been exposed in a security incident detected last December.

Mazda is one of Japan’s largest automotive manufacturers, with an annual production of 1.2 million vehicles and revenue of nearly $24 billion.

The company said the attackers exploited a vulnerability in a system related to warehouse management for parts procured from Thailand. The system did not contain any customer data. Also, the breach is limited to 692 records.

“Mazda Motor Corporation has identified traces of unauthorized external access to a management system used for warehouse operations related to parts procured from Thailand,” reads Mazda’s announcement.

Advertisement

“Following this discovery, the Company promptly reported the matter to the Personal Information Protection Commission – an external bureau of the Japanese Cabinet Office – and implemented appropriate security measures and conducted an investigation in cooperation with an external specialist organization.”

The investigation revealed that the potentially exposed information includes the following data types:

  • User IDs
  • Full names
  • Email addresses
  • Company names
  • Business partner IDs

Although Mazda says it has detected no misuse of that information, the company recommends that impacted individuals remain vigilant because the risk of phishing attacks and scams targeting them is significant.

Apart from notifying the authorities, Mazda also implemented additional security measures on its IT systems, including reducing internet exposure, applying security patches, increasing monitoring for suspicious activity, and introducing stricter access policies.

At the time of writing, no ransomware group has publicly claimed the attack on the Japanese company.

Advertisement

BleepingComputer has contacted Mazda to learn more about the incident, and we will update this post with an official response as soon as it reaches us.

Although a data breach was never officially confirmed by Mazda, the Clop ransomware group in November 2025 posted Mazda.com and MazdaUSA.com on its data leaks site, claiming it compromised both the Japanese automaker and its U.S. subsidiary.

Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.

Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.

Source link

Advertisement
Continue Reading

Tech

Linux Fu: UPNP A Port Mapping Odyssey

Published

on

If you’ve ever run a game server or used BitTorrent, you probably know that life is easier if your router supports UPnP (Universal Plug and Play). This is a fairly old tech — created by a standards group in 1999 — that allows a program to open an incoming port into your home network. Of course, most routers let you do this manually, but outside of the Hackaday universe, most people don’t know how to log into their routers, much less how to configure an open UDP port.

I recently found myself using a temporary setup where I could not access the router directly, but I needed some open ports. That got me thinking: if a program can open a port using UPnP, why can’t I? Turns out, of course, you can. Maybe.

Caveats

The first thing, of course, is that you need your firewall open, but that’s true no matter how you open up the router. If the firewall is in the router, then you are at the mercy of the router firmware to realize that if UPnP opens something up, it needs to open the firewall, too.

You might think, “Of course it will do that.” However, I’ve found there is a lot of variation in the firmware from different vendors, and if you aren’t in control of the router, it is more likely to have buggy firmware.

Advertisement

The other caveat is that the router needs UPnP enabled; if it isn’t and you have to get into it anyway, you might as well set up port forwarding in the usual way. I was in luck. The router I was behind had UPnP turned on.

In Theory

There are several libraries aimed at working with UPnP and many of them come with simple test clients. I decided to install miniupnpd, which has the upnpc utility. You don’t have to be root to run it. In theory, it should be very simple to use. You can use -l to list all the router’s current UPnP ports. The -a option adds a port, and -d deletes it. There are a few other options, but that covers most of the common use cases.

So, to open external port 2222 to port 22 on 192.168.1.133 you should be able to say:

upnpc -e 'HaD Test' -a 192.168.1.133 22 2222 tcp 3600

The -e option lets us make up a creative title for the mapping. The 3600 is the number of seconds you need the port open. Easy, right? Well, of course not.

Advertisement

Under the Hood

UPnP covers several different areas, including IP assignment and streaming media. However, the part of it we are using is for NAT traversal. Your router identifies as an Internet Gateway Device that other UPnP-aware programs can locate.

Unfortunately, there are two versions of the gateway device specification, and there are many compatibility problems. You are also at the mercy of the vendor’s correct interpretation of the spec.

UPNP has been known to be a security risk. In 2011, a tool appeared that let some UPnP devices map ports when asked from outside your network. Easy to imagine how that could be a bad thing.

UPNP devices advertise services that others can use, and, hopefully, your router advertises that it is a gateway. The advertisement itself doesn’t tell you much. But it does let you fetch an XML document that describes the device.

Advertisement

For example, part of my XML file looks like this:

11urn:schemas-upnp-org:device:InternetGatewayDevice:1OpenWRT routerOpenWRT
http://www.openwrt.org/OpenWRT routerOpenWRT router1
http://www.openwrt.org/00000000uuid:00000000-0000-0000-0000-000000000000
urn:schemas-upnp-org:service:Layer3Forwarding:
1urn:upnp-org:serviceId:L3Forwarding1/L3F.xml/ctl/L3F/evt/L3Furn:
schemas-upnp-org:device:WANDevice:1WANDeviceMiniUPnPhttp://miniupnp.free.fr/WAN DeviceWAN Device20260105
...

In Practice

There are a few strange things about the way upnpc works. First, when you do a list, you’ll get an error at the end. Apparently, that’s normal. The program simply asks for entry zero, one, two… until it gets an error (a 713 error).

However, when I tried to add an open port to this particular router, it always failed, giving me an error that implied that the port was already in use. Of course, it wasn’t.

Through experimentation, I figured out that the UPnP service on the router (the one I can’t get into) isn’t running as root. So any port number less than 1,024 is unmappable in either direction. Of course, this may not be a problem for you if you have a sane router. You could argue whether this is a bug or not, but it certainly didn’t give a good error message.

Advertisement

Testing, One, Two…

Just to do a simple test, I issued the following command. (with my firewall off, just for testing):

upnpc -e HADTEST -a 192.168.1.133 8022 8023 tcp 3600

I verified the port opening using the -l option. Then I stood up a really dumb telnet-style server on the local port (8022):

socat readline TCP-LISTEN:8022,reuseaddr,fork

From a machine on another network, I issued a telnet command to my public IP (198.37.197.21):

Advertisement
telnet 198.37.197.21 8023

Of course, I could have used 8022 for both ports, but I wanted it to be clear which argument was which. At this point, typing some things on the remote machine should show right up on the local machine, punching through the firewall.

In case you forgot, you can escape out of Telnet using Control-] and then a “q” will close the program. You can also just terminate the socat program on the local side.

More Than One Way

It is a bummer I couldn’t open up an ssh port using this method, although you can run sshd on a high port and get there that way. But it is better than nothing. Better still would have been to replace the router, but that wasn’t an option in this case.

There are other tools out there if you are interested. NAT-PMP is easy to use from Python, for example. There’s also something called PCP (not the performance co-pilot, which is something else). Many routers don’t support either of these, and we hear that implementations are often buggy, just like UPnP.

Advertisement

For the record, NAT-PMP didn’t give me a better error message, either. So the moral is this: if you can, just punch a hole in your router the old-fashioned way. But if you can’t. Linux almost always gives you another option.

Source link

Advertisement
Continue Reading

Tech

United States FCC bans import of all new foreign-made consumer routers

Published

on

After pressure from regulatory committees about fears of Chinese spies and botnets, the FCC has placed a ban on all new foreign-made consumer routers.

Three tri-band routers side-by-side, white cylinders with the number 7 engraved in the surface
TP-Link may be affected by latest US ban

Regulators have become increasingly interested in routers after Chinese brands took more than 65% market share during the pandemic. US router makers like Netgear pushed back with lawsuits and lobbying, and it seems to have borne some fruit, though the result may cause problems for everyone.
According to a report from Reuters, the FCC has deemed all foreign-made routers a national security concern. This seems to imply that the United States wants all routers manufactured in the country via “secure supply chains.”
Continue Reading on AppleInsider | Discuss on our Forums

Source link

Continue Reading

Tech

Delve halts demos, Insight Partners scrubs investment post amid ‘fake compliance’ allegations

Published

on

Delve, a Y Combinator-backed compliance startup accused of fabricating certifications for its customers, has disabled the “book a demo” feature on its website.

The controversy, detailed last week in a Substack post by an anonymous whistleblower known as “DeepDelver,” has also apparently led Insight Partners to scrub an article explaining its $32 million investment in the startup. DeepDelver, who claims to be a former client, alleged that Delve, which was valued at $300 million during its Series A funding round last year, fabricated compliance data for its customers.

The original text of the article, written by Insight Partners managing directors Teddie Wardi and Praveen Akkiraju, among others, and titled, “Scaling AI-native compliance: How Delve is saving companies time and money on compliance busywork,” remains viewable here via the Wayback Machine, an internet archive that preserves snapshots of web pages.

Delve’s co-founders Karun Kaushik and Selin Kocalar, as well as Insight Partners, did not immediately respond to TechCrunch’s request for comment.

Advertisement

On its website, Delve claims to have helped customers such as Microsoft, Chase, PayPal, American Express, and the AI search company Perplexity cut “hundreds of hours” of compliance busywork. However, it remains unclear how many of these companies are still active users of the platform.

Founded in 2023, Delve says it leverages AI to automate the process of obtaining security and regulatory certifications, including SOC 2, HIPAA, and GDPR — standards that govern data security, health information privacy, and European data protection, respectively.

In their Substack post, DeepDelver alleged that Delve “fabricated evidence of board meetings, tests, and processes that never happened,” then forced customers to “choose between adopting fake evidence or performing mostly manual work with little real automation or AI.”

Techcrunch event

Advertisement

San Francisco, CA
|
October 13-15, 2026

The post further alleges that Delve’s platform rubber-stamps its own reports rather than undergoing a second layer of independent auditing.

Advertisement

Delve responded to the accusations by saying it does not issue compliance reports at all, and that instead it is an “automation platform” that ingests information about compliance and then provides auditors with access to that information.

Delve also said that its customers “can opt to work with an auditor of their choosing or opt to work with one from Delve’s network of independent, accredited third-party audit firms.” Those auditors, the startup said, are “established firms used broadly across the industry, including by other compliance platforms.”

In response to the accusation that it’s providing customers with “fake evidence,” Delve countered that it’s simply offering “templates to help teams document their processes in accordance with compliance requirements, as do other compliance platforms.”

While the company is denying DeepDelver’s allegations, the disabling of the “book a demo” function and the scrubbing of Insight Partners’ investment thesis article suggest that the startup is in damage control, and that investors may be distancing themselves from the company.

Advertisement

Source link

Continue Reading

Tech

Trucker Caught Free Wheeling Over 60 Miles Without A Tire

Published

on





Ask most truckers about their must-haves in a good semi-truck, and you might get answers like quality seats, a reliable power supply, and practical storage space. Having tires on the wheels might seem like too obvious an answer, although it seems one trucker in Canada didn’t have “make sure all the tires are still there” on their checklist. The Ontario Provincial Police recently issued a warning on social media to remind drivers that they should always check their tires before traveling after pulling over a truck on Highway 17. According to the post, the truck had driven more than 60 miles with one tire missing.

The driver of the vehicle is now facing multiple charges of unsafe operation of a vehicle as a result. According to CTV News, the unnamed 41-year-old driver was from Calgary, while the tractor and trailer were operated by a company in Steinbach. The company was also hit with charges due to the vehicle’s unsafe condition. Police took the vehicle off the road after the stop, with repairs required before it could resume service.

Advertisement

U.S. truckers can remove one tire in certain situations

Road rules can vary between the U.S. and Canada, and there are plenty of common U.S. driving habits that can get you a ticket north of the border. According to the Federal Motor Carrier Safety Administration, U.S. truckers are allowed to remove one defective tire from a set of dual tires as long as the weight on the remaining tires does not exceed the legal limit.

However, that is assuming they have four tires on an axle to begin with. Images provided by the Ontario Provincial Police show the stopped truck did not have dual tires, leaving one rim in contact with the road. As such, it would have quickly attracted the attention of local law enforcement on either side of the border.

Advertisement

Even drivers who meticulously keep track of the condition of their tires will eventually have to replace them, and changing a truck tire is harder than you’d think. Attempting to change a semi-truck tire without knowing what you’re doing can result in injury, and so it’s best left to the professionals.



Advertisement

Source link

Continue Reading

Trending

Copyright © 2025