The other day me and @gregkh shot down a draft proposal to add a new role in the CVE ecosystem (SADP: "supplier ADP") that would append data to CVEs with details about dependencies and how they are or are not vulnerable to each particular CVE.
Imagine the amount of dependencies that use curl or the Linux kernel etc. These sweet innocent proposal makers thought in the terms of 5-10 dependencies per CVE. Not tens or hundreds of thousands which is far from unthinkable.
@jacques yeah, I think some of us realized that which also made us immediately realize the scale it would have to support to work - and how that alone would make the proposal not work.
@jacques Do you think the opposite can be done? e.g. push on downstream software to declare (through VEX or otherwise) whether or not they're vulnerable to something upstream?
@mlieberman @jacques we as producers of CVEs for a component cannot tell which users that are vulnerable nor how sever their problems are if they are vulnerable
@sjvn that’s been my experience for a lot of these things. Well intentioned ideas, but they don’t withstand contact with the realities of wide-scale reuse.
Don't miss out! Join us at the next Open Source Summit in Amsterdam, Netherland (August 25-29); or Seoul, South Korea (November 4-5). Join us at the premier ...
@karlemilnikka @bagder ah! det verkar som om när man postar en länk i mastodon-ekosystemet så besöker alla instanser min blogg samtidigt och då går den ner 5-10 minuter..
The NVDA 2025.3 Release Candidate is now available for testing. We encourage all users to download this RC and provide feedback. Unless any critical bugs are found, this will be identical to the final 2025.3 release.
This release includes improvements to Remote Access, SAPI5 voices, braille and the Add-on Store.
For number lovers: during the past 31 days, the #IzzyOnDroid repo saw almost 800,000 APK downloads – which roughly corresponds to 18 APKs/minute, or 1 APK every 3 seconds. And that's only from our main server, not counting the mirrors (coming soon™).
This is a repository of apps to be used with your F-Droid client. Applications in this repository are official binaries built by the original application developers, taken from their resp. repositories (mostly Github, GitLab, Codeberg).
📣 Do-It-Blind (DIB) online Besprechung am Montag, 8. September, um 19:00 Uhr. Du bist eingeladen! bbb.metalab.at/rooms/joh-szv-o… Wöchentlich am Montag besprechen wir neue Formen der digitalen und inklusiven Zusammenarbeit. Mach mit! 🛠️ #make #blind #inklusion
Learn using BigBlueButton, the trusted open-source web conferencing solution that enables seamless virtual collaboration and online learning experiences.
The other day I sent out this tweet As it took off, got an amazing attention and I received many different comments and replies, I felt a need to elaborate a little. To add some meat to this.
I have an app that uses long, base64 encoded data in URLs, and the fact that many systems I don't have control over, such as CDNs, AWS, etc, convert double slashes to single ones, presuming path and filename semantics is infuriating! Isn't it meant to be an opaque string by HTTP standards?
1. the URL is not a HTTP standard. It's a URL standard. Unfortunately, we have several such and nobody follows them strictly... 2. There is a base64url charset designed to be used in URLs. Used by for example DoH. 3. No, the path component is not "opaque" in a URL
before @ it's webfinger, after it domain after column port but since it's empty then assume 80, after / is route, after ? is a param and after # is a html id????
I’ve gotta be real with you, @Tutanota: I love your work and your company, but you need to add Web Key Directory compatibility.
At this point, PGP/WKD support for a privacy-focused email provider has to be as fundamental as supporting TLS. Proton does not own PGP.
I simply cannot in good conscience recommend Tuta over Proton to people generally speaking, knowing that Proton users benefit from E2EE when they email me on my self-hosted email servers, as well as when they email plenty of other providers (Posteo, Mailbox.org). And that is a shame, because trust me I would love to be able to point anywhere other than Proton when I’m asked this.
Keep your superior encryption for intra-Tuta emails, absolutely. Give it a different UI indicator so people know the difference, I don’t care. At the end of the day, not at least silently supporting in the background the only decentralized email encryption method we have is antithetical to what email is all about: interoperability.
People have been asking you about PGP for 8+ years, I know Autocrypt used to be on your roadmap and now it seemingly no longer is.
These days, most of us have a smartphone. They are so commonplace that we rarely stop to consider how amazing they truly are. The open-source project Phyphox has provided easy access to your phone’…
Come along to see the latest and greatest progress in the Matrix world! From huge government deployments to the latest innovations, hang out with your peers to share the best learning, insights, projects and tips!
Don't miss out! Join us at the next Open Source Summit in Amsterdam, Netherland (August 25-29); or Seoul, South Korea (November 4-5). Join us at the premier ...
While the Trump administration tries to cancel offshore wind for "national security" reasons, here's the CEO of Ukraine's largest private energy company
By appending :all:[separator] to the header name. The [separator] string is output between each header value if there are more than one to output.
Test 764 verifies
Idea-by: kapsiR on github
Ref: #...
Contact with Europeans in the 19th century first provided the Yapese at Palau with iron tools, that made the cutting and shaping of the stones much easier. Not much later, the Yapese made deals with Europeans to use their ships to transport the stones back to Yap. These arrangements enabled the manufacture of much larger and heavier rai stones, up to 4 meters in diameter, as well of a larger number of them. However, these "modern" stones were less valuable than more ancient ones.
Anyone know anything about these Mokerlink switches? I'm seeing products I can't find from other vendors. Nobody's really making small 8-10 port 10gbit gear
4 x 2.5G Ethernet Ports, compliant IEEE802.3bz (2.5G) standard, support 10/100/1000M/2.5G adaptive. 2 x 10G SFP Port(compatible 1G/2.5G Module, not include SFP Module). 45Gbps backplane bandwidth, Port 1-4 support IEEE 802.
So, if I write you a document before a meeting, you use AI to summarize that document, and then during that meeting you rely incorrect or partial information, not only you wasted everybody's time, but you also made it clear that you don't think I'm capable of relying information synthetically, moreover you're clearly stating that you're not intelligent enough to read a simple document.
Using AI makes you "look" fast and productive, but in reality it paints you as cheap and lazy
I appreciate more a "sorry, I didn't have time to read this" than whatever partially regurgitated slop people use these days to expedite their brain rot
Supporting Indonesians monetarily, video contains fatal injury
Sensitive content
I asked Indonesians where people overseas could monetarily help with the riots, and it seems like solidarity with prisoners is the way to go given the number of arrests that are happening there.
You can donate to Serikat Tahanan/Prisoners Union, an Indonesian anarchist prisoner's collective through "Donasi" button on this website:
Questioning whether or not I've overreacted as the post *is* in the Introductions subforum, I read every single introductory post on the Ubuntu Discourse made in 2025. Every one was focused on the person's technical and professional backgrounds and what skills they want to learn or tech topics they're interested in.
One guy mentioned off-hand about being busy moving around the country with his wife and kids. Another guy is 75 and mentioned in a reply to someone inquiring about his early career that women did the punch cards and men did the programming when he started. Those were the only two other semi-questionable comments if you want to really be pedantic.
Not a single mention of personal life details like this in any other post.
Read the room.
(also revealing your name and birth date like that is a bit of an opsec issue this guy should be coached on... honestly where is the mod at on this, they should really be censoring that in his post)
hey, do you folks have recommendations for an USB fingerprint reader that works reliably with Fedora (or ideas how I could get mine to work)?
Mine (a "Benss" branded Elan 04f3:0c3d) is supposed to work, but I can't get it to verify prints - Apparently fprintd really doesn't handle "tap to scan" readers well, like the one I've got.
I've tried tapping, swiping, in every direction, I'm running out of ideas
This is local Amsterdam news (in Dutch) about the library putting on a display of books banned from American schools and libraries, in little stars-and-stripes coffins. They say it’s because whatever nonsense America gets up to, the Dutch need to be ready to guard against it being pushed here a few years later. at5.nl/nieuws/234309/wat-je-in…
in anticipation of another bike trip, i've constructed porteur bag #2, refined and refreshed.
- first bag i've made with a liner! (robic nylon) - structured like a big tote bag but with a zipper and a square footprint - two wire gate clips to make attachment / straps experiments easier - same ecopak material as my frame bag - cordura on the bottom for durability
overall: an improvement, attachment to the rack is simpler and faster. could be slightly taller, and maybe all ecopak
Oh, this is great! Thanks for all the links in your post about the previous bag; this is going to be useful for me as I seem to build one bag every few years.
“Unlike a typical mesh, which stores per-vertex 3D positions, a mescher stores per-vertex 2D screen-space positions and a per-edge depth difference. Whereas differences in depth across edges must sum up to zero as we travel around a standard mesh, this is not necessarily the case for a mescher. It is a mathematical way of describing the perceptual impossibility.” anadodik.github.io/publication…
Thank you to everyone who attended the World Blindness Summit & WBU General Assembly last week in São Paulo, Brazil. It was an honour for NV Access to attend, and to have NV Access General Manager, James Boreham and NV Access director Emma Bennison present. It was an informative and uplifting week and a chance to meet many new people and hear people's hopes for the future!
For anyone who thinks Wayland compositors are being overly restrictive by not allowing applications to set absolute positions for their windows, as I did, there are good reasons for this restriction. canonical-mir.readthedocs-host…
Preamble: Design is all about balance, and the design of graphical user interfaces has a lot of interests to be balanced. In the context of Wayland, the principle interested parties are the designe...
Yes, this is a problem for some applications. But such applications can still run under Xwayland, and that will likely remain the case for a long time. So I think the Wayland community's approach of carefully, deliberately addressing specific use cases through protocol extensions is correct, though it's annoying to application developers in the short term.
You mean annoying forever, because "just use Xwayland" is not actually a solution if we want all apps on Wayland. The linked article is extremely opinionated, e.g. the "shell components" argument is void since that one can be solved by giving clients sufficient hints. All examples are also from single-window apps. 1/x
Also note that this restriction applies mostly to arbitrary applications. The end-user can still configure their compositor to do absolute positioning of windows as they see fit. And privileged (shell) components have their dedicated protocol to do their own thing.
I myself am immediately suspicious of anyone who has an issue with this. It's just a lot of application developers who for whatever reason think they know better than the desktop where windows should be positioned, which is so weird. Like, stay in your lane? Just leave window management to the desktop?
No, i am being blunt and firm with my requirements. We can pivot to unprofessional if that's what you wankpuffins want
(edit: some more detail. this concerns them insisting i follow a policy that does not fit with my health needs as a disabled person, which i'm not going along with)
In July 2024, Apple supply chain analyst Ming-Chi Kuo said he expected Samsung to begin shipping 48-megapixel Ultra Wide camera sensors to Apple for...
Bug Hunter (1990) is one of those rare puzzle platformers written exclusively for the Acorn 32-bit machines.
Whenever I stumble on an Archimedes title, I perk up. These machines—descendants of Acorn’s BBC line—were the first computers powered by ARM CPUs. Think about that: ARM, the chipset now running your phone, your tablet, your Nintendo Switch, even your M-series Mac.
Back in 1990, ARM wasn’t about pocket gadgets. It was pitched as the next big leap in desktop computing. Only problem was the Acorn Archimedes barely left the UK, and outside of classrooms, almost nobody touched one.
That’s a shame, because games like Bug Hunter show what these machines could do. The hero is Hysteron Proteron—a bioengineered soldier gone wrong. A lab mix-up left him a spineless bug-eyed creature who can’t actually fight. So the army threw him on pest control duty.
His gimmick: suckered feet that let him scuttle along floors, ceilings, and walls, and the ability to pick up objects and drop them on unsuspecting insects. Kill them all, move to the next room, repeat. Simple, but clever.
Graphically, it’s impressive for 1990. Crisp sprites, fluid enough movement, and backgrounds that look every bit as solid as what you’d see on the Amiga or Genesis. The SNES wasn’t even out yet, and here’s Acorn pushing visuals in that league.
Sound, though, is the usual British compromise: no music, just effects. Still, compared to the PC speaker squawks of DOS games, those crunchy bug-splat noises were fine.
What makes Bug Hunter stand out isn’t just the gameplay—it’s the personality. One room even has a parody movie poster on the wall: Schwarzenegger in Decorator, with the tagline “They picked the wrong man…” It’s little details like that which make it feel less like a generic extermination game and more like someone’s sly passion project. Which it was.
Ian Richardson, a solo dev at the time, built this thing himself. He’d later go on to Gremlin and Ocean before becoming a respected figure in UK game development. He passed away in 2021, but Bug Hunter remains a testament to his early craft.
The sequel, Bug Hunter in Space, came out the same year, expanding the concept to alien ships and teleports. And Bug Hunter & Moon Dash was even sold together on a single disk, though everyone agrees Moon Dash was the weaker half. Bug Hunter’s the one people remember—the one schoolkids used to sneak onto Archimedes machines in British classrooms.
So if you ever find an Acorn 32-bit, don’t pass this up. Bug Hunter is charming, tough, and a reminder that the ARM revolution didn’t start with iPhones. It started with a bug-eyed mutant wandering the walls on a forgotten British computer.
If you've ever dry cleaned your clothes (you have, right?), you've likely wondered how the "dry" part happens. And it may even have crossed your mind that it's a chemical process. Of course you'd be right.
Question for fellow #NVDA users: why has the Office Desk addon been discontinued? I saw the message from the addon itself and read the homepage. It says it has been discontinued and that I should uninstall it, but it doesn't give a reason for it. I'd understand if it said something like, "The features in this addon have been merged into the core," or something like that, but it doesn't. #Accessibility #Blind #ScreenReader
"As of Sept 1, Joseph Lee (me) no longer maintains the add-on (Office Desk add-on is end of life). This add-on hasn’t been updated in some time, and as part of winding down NVDA work, I’m letting this add-on go. Therefore, when installing Office Desk 25.09, an “end of life” dialog will be presented, advising you to uninstall the add-on. I asked the add-ons community to maintain this add-on should they wish to do so"
@NVAccess I appreciate the link to the post. That being said, I think it would have been good for Joseph to point this out in the official notice as well. I am not subscribed to the user group, and it'd be nice to see for those of us who choose not to subscribe. I receive tons of emails on a daily basis, and I prefer not adding onto that if I can help it.
FoxVK
in reply to SuspiciousDuck • • •SuspiciousDuck
in reply to FoxVK • • •