May 13 2025 Raspberry Pi 5, EU Cyber Resilience and AI Acts, End of 10, RAID and backup strategies

Bernie shared progress on his project to obtain a time-lapse video of his apple tree throughout the year by taking a photograph of it every midday. This had become possible with the arrival of the Raspberry Pi 5 complete with RTC. Ideally, he would like to use solar power to charge the batteries; so the first thing he needed to do was to measure the power consumption to ensure that there would always be adequate power. He had calculated that he would need 6Wh for each cycle and that the solar panel could provide 3.5Wh with 4 hours of sunlight.

He had written a Python program, power.py, to handle taking the photograph; this had a 4 minute delay at the start of the program and a 1 minute delay to shutdown so that he could interact with the program if necessary. The RTC connects via the GPIO and uses Unix time. So the program only needed to take the photograph and then give the time in Unix seconds to the RTC to let it know when to wake everything up for the next photograph.

One problem was that Raspberry Pi hats assume that there is 3v rail and a 5v rail but he would want to save power by turning one off; Raspberry Pi have suggested that new hats should not make this assumption.

Steve asked whether it was possible to detect when the battery was low but Bernie hoped he would not need this. However, there is an option for the RTC to have its own battery if that turns out to be necessary.

Bernie has gone for a low profile heat sink rather than a fan and is looking at the 2GB version of the Raspberry Pi 5 as this has lower power consumption than the 16GB version. He has a solar power manager with three rechargeable batteries to store the power generated by the solar panels.

John noted that the release of Valkey 8.1 had been greeted by messages of support from Amazon AWS, Canonical, Ericsson, Oracle, Google, Huawei and Percona!

He mentioned that the EU has published two regulations both of which contain definitions, albeit slightly different ones, of open source. He thinks that this may be the first time that open source has been defined in a legal document. In both cases, open source software that is not being monetised is exempt from certain provisions.

The aims of the Cyber Resilience Act are to

1. reduce the number and severity of vulnerabilities in digital products;
2. ensure that cybersecurity is maintained throughout a well-defined product’s life cycle;
3. enable users to make informed decisions based on cybersecurity criteria when selecting and operating digital products.

It introduces the concept of ‘Open Source Software Stewards,’ that is, a ‘legal person other than a manufacturer,’ who must:

• implement and document a cybersecurity policy (Article 24(1));
• cooperate with market surveillance authorities upon request (Article 24(2));
• report any known, actively exploited vulnerabilities, notify severe incidents, and inform impacted users while providing mitigation measures (Article 24(3)).

The Act enables the establishment of voluntary security attestation programs, allowing developers and users to assess conformity with cybersecurity requirements (Article 25).

However, it provides an exemption specifically for open source software that is provisioned without commercial intent:

software the source code of which is openly shared and which is made available under a free and open-source licence which provides for all rights to make it freely accessible, usable, modifiable and redistributable.

The AI Act defines four levels of risk to living individuals associated with AI:

• Unacceptable where AI systems present a clear threat to the safety, livelihoods and rights of individuals in the EU. The Act prohibits eight practices, including AI systems used for harmful deception, social scoring, and criminal risk assessments or predictions.
• High risk where AI systems present serious risks to the health, safety or fundamental rights of individuals in the EU, including:
• AI systems intended to be used as a safety component of a product, and
• AI systems used in critical infrastructure and justice contexts.
• Transparency where AI systems present transparency risks to individuals in the EU, such as generative AI applications. The Act introduces disclosure obligations, including ensuring that AI-generated content is identifiable as AI-generated.
• Minimal or no risk where AI systems present minimal or no risks to individuals in the EU, including AI-enabled video games and spam filters.

Open source software which is not monetised is exempt from complying with the requirements relating to minimal or no risk, that is:

Software and data, including models, released under a free and open-source licence that allows them to be openly shared and where users can freely access, use, modify and redistribute them or modified versions thereof, can contribute to research and innovation in the market and can provide significant growth opportunities for the Union economy … The licence should be considered to be free and open-source also when it allows users to run, copy, distribute, study, change and improve software and data, including models, under the condition that the original provider of the model is credited, the identical or comparable terms of distribution are respected.

Steve commented that the first definition would not satisfy Richard Stallman because it did not define ‘free’ to mean free from any non-free software.

John shared qdirstat, a graphical interface for examining the contents of a drive, which had originally been developed as part of KDE but which is now a free-standing program.

Finally, John raised the possibility of joining END OF 10 to offer advice to people on dealing with the end of Windows 10 and possibly make the August meeting a chance for people to come along and discuss the options. This was supported.

Steve shared a problem he had had with his backup regime. He has a Raspberry Pi 4 which runs a cron job overnight making a daily backup and deleting the backup that is seven days old with a similar arrangement for weekly and monthly backups; however, though he had been receiving emails saying that the backup had been completed, he had discovered that it had not been. So he had taken to writing a file to the disk before beginning the backup and then checking that the file existed in the backup when it was complete. If so, the file would be deleted; if not, he would receive an alert that the backup had been been completed correctly.

He had wondered whether a message app might be better for something like this. He had also had problems with the disk reverting to read-only after backup; John commented that he had occasionally had a similar problem with older USB sticks which did had become loose in the socket.

Bernie mentioned the empathetic AI program which had been adjusted to be less confrontational but had ended up supporting the user in decisions which it should not have supported!

Steve recounted his problem trying to set up a replacement for his existing RAID setup of two data disks and one parity disk; he had acquired a Topton N100 motherboard which has a SO-DIMM slot which can take up to 32GB though only 16GB is guaranteed. He now needed a case with at least five slots as he planned to migrate the contents of the existing RAID to a mirror RAID of two 6GB drives and he described the several attempts he had made to buy the Fractal Design case that he wanted from different suppliers none of whom were able to deliver. He was now on his fourth supplier.

The meeting concluded with a brief discussion of backup strategies and the need to have an off-site location for a backup.

Past Meetings