Sebastian Krzyszkowiak @dos@librem.one

Updates on the xz situation:
https://tukaani.org/xz-backdoor/

https://lore.kernel.org/lkml/20240330144848.102a1e8c@kaneli/

And there's a new commit in the git repo:
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=f9cf4c05edd14dedfe63833f8ccbe41b55823b00

Hey it's totally cool that #microsoft #GitHub blocked access to one of the repositories in the very center of the xz backdoor saga.

It's not like a bunch of people are scrambling to try and make sense of all this right now, or that specific commits got linked to directly from media and blogposts and the like.

Cool, cool.

I know the next 3-7 days will be filled with exaggeration and doomsday talk, but IMHO the #xz backdoor, though seemingly meticulously planned for a long time, failed miserably as it was caught at a stage where it wasn't widely deployed but only in testing/prerelease distros. Yes, it made it quite far in the supply chain but it ultimately failed. The mess is being cleaned up, no cases of actual use of the exploit in the wild are known thus far. The immune system of FOSS has worked. Again.

damn this lzma/xz backdoor is wild

https://www.openwall.com/lists/oss-security/2024/03/29/4

If you feel the leaders of your FOSS projects are insufficiently anti-capitalist or anti-fascist or anti-racist or what have you, you can just ignore them, take the software, and do whatever you want with it, with whomever you please, you don't need anyone's permission

First known symbolic gesture observed in birds; scientists recorded the Japanese tit using repetitive wing movements to signal "after you" to others.

https://www.u-tokyo.ac.jp/focus/en/press/z0508_00339.html?utm_source=join1440&utm_medium=email&utm_placement=newsletter

I'm at an EU workshop for Apple to discuss and justify its DMA compliance plans. They've been forced into 3 huge u-turns by EU (killing PWAs, removing Epic Games' developer licenses, sideloading) so I'm interested to see their demeanour. Will it be humility, or the usual 'fuck you, we're Apple'? There are people from EU companies that Apple blithely planned to bankrupt by sneakily removing PWAs here. And regulators have human feelings too; no-one like "fuck you". I'll be here all day (try the baguettes!)

It always gives me joy when I see that people find useful the /sys/kernel/debug/devices_deferred sysfs entry that I only added to scratch my own itch 🙂

This time in a FOSDEM talk by @a3f about the Linux kernel drivers and devices matching mechanism: https://fosdem.org/2024/schedule/event/fosdem-2024-3222-linux-matchmaking-helping-devices-and-drivers-find-each-other/

#linux #kernel #FOSDEM

With a bit of help from #phoc the next phosh-osk-stub release can (optionally) hide when a keyboard gets attached.

#phosh #LinuxMobile

I was going to try to find the time for an occasional video, and to make an impact (get eyeballs, and people into #MobileLInux, which is the goal, obviously), I thought about putting these on YouTube.

After seeing some negative comments (not directed at me, but at the understaffed, underfunded open-source projects I showcase), I am not sure. F*** these people, seriously.

After being kneecapped by a #patents troll years ago, #Mozilla Location Services, the only somewhat trusted (non-Google/Apple) "Wi-Fi positioning system" (geolocation based on triangulating collected #WiFi SSIDs), is now shutting down: https://github.com/mozilla/ichnaea/issues/2065

MLS was how #GeoClue could get a meters-accurate location without a #GPS receiver / sky line-of-sight.

It was used by many #GNOME / #KDE apps to get instantaneous neighborhood-level location (for maps, local weather…) on #Linux laptops.

phosh 0.37.0 is out 🚀📱:

- Wi-Fi selection via quick settings
- Build custom quick settings via plugins
- Caffeine quick settings
- Support fractional-scale-v1 protocol
- Updated #squeekboard layouts
- Improved Sound file and favorites selection
- Hardware specific pages in Tour
- Support notches of 16 more phones
- Support trie predictor in p-o-s
- Support more emojis in p-o-s

Check out the full release notes at https://phosh.mobi/releases/rel-0.37.0/

#phosh #gnome #linux #mobile #LinuxMobile #GNOMEMobile

#Librem5 and notebook sharing the same keyboard and mouse.

Moving the mouse over the edge of the screen into the direction of the other device brings the mouse focus to the other device - just like moving the mouse between displays in a dual screen setup.

The keyboard focus follows. It is like a kvm that is controlled by the mouse position.

Let's #deskhop!

Holy Pangolin Studio make small indie games, animations, illustrations and handmade art. You can follow at:

➡️ @holypangolin

They have an Itch page at https://holypangolin.itch.io

#HolyPangolinStudio #HolyPangolin #GameDev #Art #Artists #Animation #Animations #IndieGames #Gaming #VideoGames #Surreal #Surrealism #Fruit

We now provide nightly builds for Phosh and some related 📦 targeting #Debian Trixie thus making the current development
versions easier to test on Debian and Debian based distributions like @mobian (and hopefully in the future #PureOS):

More details at
https://phosh.mobi/posts/phosh-nightly/

The #KiCad user survey is live! We welcome inputs from everyone doing PCB design:
https://app.formbricks.com/s/clt62soc802ap12xtbfroodc6

The survey should take less than 10 minutes to complete

so it turns out that DisplayPort is "open-source" because VESA (a consortium of multinational corporations) does not, as of present day, have a history of impeding some of the other multinational corporations from releasing some of the related code under an open-source license

that's a pretty weak definition of "open-source", folks

also if you call your HDMI port a "XXMI" port or whatever, the HDMI Forum can't go after you any more VESA can, go wild, everyone does this