Došla výplata…
KDE, OpenStreetMap, Wikipedie, Gentoo a Thunderbird obdarovány.
U FF si nejsem jist, zda si to zaslouží, takže letos nic.
André Polykanine reshared this.
You know what ““““AI”””” feature I’d actually use in Firefox? A locally-powered text-to-speech feature for the reader mode. Read me this web page in a natural voice, using some of the advances in recent models!
Is that possible to do efficiently in the browser, or are those models too big to be effective? Or would it need to lean on the OS APIs?
this is truly incredible: github.com/X11Libre/xserver/pu…
they are using system(3) inside a security-critical domain (the display server).
but yes, sure, my refusal of xlibre on security grounds is the problem
@metux, let the team know about the discussion of this feature. After my research, perhaps this will reduce the likelihood of malicious actions on the part of X clients and allow them to be identif...GitHub
In an academic sense, how bad is this actually? Assuming that X11 is already up and running before anybody can log in (no LD_PRELOAD or ENV fuckery) and "which" and "sh"/"bash" are a root-owned binaries that can't be substituted.
It's obviously dumb, but I'm kind of curious if this is actually exploitable.
@developing_agent there's a few different ways to exploit it
- if you can control PATH (or the binaries in the directories referenced by PATH), you can run whatever you want in an elevated context
- there is an unescaped %s format string passed directly to the dialog application, that %s is a window title
- probably other things i'm not thinking about right now
wouldn't it just be more efficient to send them a comment on the pull request instead of posting on the Fediverse where they'll never see it though
edit: and who can control the X server's PATH except root?
Somehow, through some weird observation I cannot understand, I don't think that helping the PR author, or even notifying the PR author about that possibility was ever the intention of this thread.
No idea how I came to that conclusion though.
there are quite a few reactionaries in my comments, some of which have been defederated in their entirety.
for the others:
1. although the system("which ...") use is silly, that isn't the problem here.
2. what do you think will happen when the code in this PR encounters a process named `" && :() { : | : & }; :&`? will it safely handle such a process name? before saying "that's impossible" please read setprocname(3), setproctitle(3), or in the case of Linux, understand that argv[0] is mutable.
3. yes, it is an open PR. it is also reflective of the code quality of many other PRs which have been merged to Xlibre already. how do you think that impacts its security record?
In 1974 I visited the UK for the first time. It was also the first time, that I could (at least very, very rudimentarily) understand the language in a foreign land.
So my parents had „the talk“ with me: Why people may react negatively to me being a German. There was a big war and a very bad man named Hitler. I didn’t understand anything at all.
Will future U.S. children have to go through a similar talk?
🔐 Did CryptPad help you this year?
Millions of documents were written and shared on CryptPad this year, all encrypted on the user’s device.
If every active user gave 5 EUR in December, the project could be funded for all of 2026 without external grants.
If you want to support private, open-source collaboration, you can donate here:
👉 opencollective.com/cryptpad
Thank you to everyone who already supports us 💚.
#CryptPad #FLOSS #Privacy #E2EE #DigitalSustainability
Collaborative suite, end-to-end encrypted and open-source. Made at XWiki.opencollective.com
😂 LOSER
Swiss Eurovision champion Nemo returns winner's trophy to protest Israel's inclusion | Euronews
euronews.com/culture/2025/12/1…
#NEMO #EUROVISION #SWITZERLAND #ISRAEL #PRESS
The contest, which turns 70 in 2026, strives to put pop before politics, but has repeatedly been embroiled in world events.Euronews.com
there is also the case of "the proprietary software vendor charge use a subscription so they can lock us in more easily and no longer sell licenses"
Case in point: Adobe.
Exchange email support has landed! We've invited members of our desktop team to Community Office Hours to give us all the details about what's in now and what's coming next!
blog.thunderbird.net/2025/12/v…
In our last video of 2025, we're celebrating the arrival of Exchange email support. Learn how we did it, what's in, and what's on the way!Monica Ayhens-Madon (The Thunderbird Blog)
The first one of these to be hosted by both @Derek and Robin, HKC Radio is running the 2023 Gala Presentation for the OSARA Christmas album.
Find all the albums here:
An annual fundraiser for software that makes music production accessible to people who are blind and vision impairedwww.christmasreapers.com
Pleast boost for reach:
On the subject of Linux phone accessibility, the developer of AT-SPI wrote:
There's a long-standing issue that Joanie filed against at-spi2-core for
touch screen support:
gitlab.gnome.org/GNOME/at-spi2…
Ande I haven't taken the time to figure out how best to handle this. I'm
not sure if evdev would do what we need, or we might want to work with the
maintainers of mutter, KWin, etc. to create a protocol for
intercepting/manipulating gestures. We would also need code that can
detect gestures from touch screen presses. NVDA has code that we might be
able to use as a model.
All of this is theoretically on my list of things to do. Of course, help
would be welcome if anyone else was able to take it on.
end quote
For blind people to switch to Linux on phones, we need to use the touch screen. If anyone can help with this, it would allow the blind to take one step closer to being capable of creating our own accessibility, our own environments, in the way that helps us most. See NVDA as a great example of how that goes.
#accessibility #blind #foss #linux #phones #pinephone
Orca currently is able to register grabs for, be notified of, and consume keyboard events of interest. It should be able to do the same for touch/gestures.GitLab
reshared this
Here's an interesting bit* of Canadian history and woodworking trivia, brought to you by me being enraged at a screw stripping while I was trying to remove it.
Most people are familiar with two types of screws & drivers: the old fashioned slot screw and the cross-shaped Phillips screw.
What if I told you there was a better way?
In 1908, a Canadian inventor named Peter Lymburger Robertson invented a screw with a square hole for the driver. If you've done any woodworking, you're probably familiar with it. This screw/driver design was very popular, as it is self-centering and the driver rarely slips out of the screw.
So why didn't the Robertson screw catch on in the USA? I blame Henry Ford. He initially was the Robertson screws biggest fan, as it was found to remarkably increase production speed. So Ford tried to get Robertson Inc. to give him an exclusive contract. Robertson wasn't interested. In the 1930s, an American inventor, Henry Phillips, created a screw/driver with a cross-shaped slot. Mr. Ford liked this screw because it worked well with powered screwdrivers. I think he also had sour grapes over Robertson rejecting him. At any rate, Ford's adoption of the Phillips screw/driver made it very popular throughout the USA.
If you've ever tried to build Ikea furniture, you probably know the frustration of cheaply-made Phillips screws. If your screwdriver is not the precise size for the screw, it will slip out of that cross repeatedly or just turn helplessly, unable to engage with the screw. In either case, there's a chance of stripping the screwhead. This can also happen when overtightening.
My husband insists on replacing stock Ikea (and other manufacturer's) screws with Robertsons, especially on anything that requires good structural strength or is made from a harder material. Worst case is that the screwdriver bit gets stuck in the screw, but this is easily remedied. With a Phillips screw, if it strips, you're hooped. You have a loose screw or an embedded screw that's never coming out.
tl;dr: I recommend replacing Phillips screws/drivers with Robertson ones, especially if you find your Phillips screws stripping regularly.
This has been a Canadian Heritage Moment.
interestingengineering.com/inn…
*pun not initially intended, but I kept it because lols
#screws #PhillipsScrews #RobertsonScrews #canada #woodworking #ikea #screwdrivers #HenryFord
Overshadowed by the Philips screw, the Robertson one actually offers certain advantages.Christopher McFadden (Interesting Engineering)
Phillips is a PITA for sure. I tend to use Torx where possible; Robertson seems to have similar qualities. I'm not sure about the IP situation there.
These days, a drill clutch in the chuck allows the operator to set a rough maximum torque; with non-slipping fasteners and powerful or single-speed drills, this prevents accidents. In its absence the Phillips cam-out acts analogously. So, I wonder if the drill clutch was only introduced after the episode you described.
it just make Robertson even more appealing.
I'm a European immigrant. I discovered Robertson screws here and it's one the better things Canada do... unlike insisting on using limbs as measurements.
Before the Gaza Humanitarian Foundation started operating in May 2025, substantial food entered Gaza, but Hamas seized much of it, diverted large quantities to fighters, and sold the remainder on the black market at prices ordinary Gazans could not afford. None of this appeared in wire service imagery.
honestreporting.com/how-hamas-…
Gaza-based photographers reinforced a global famine narrative, producing images that aligned with a political storyline rather than a complete reality.
Key takeaways Before the Gaza Humanitarian Foundation started operating in May 2025, substantial food entered Gaza, but Hamas seized much of it, divertedDavid Katz (HonestReporting)
This release fixes audio ducking: we now call sync and idle on NVWavePlayer.GitHub
Zach Bennoui reshared this.
Matt Campbell reshared this.
Great software is free software.
Out of the many brilliant #FOSS tools out there, ZDNet’s Jack Wallen picks seven he considers so good he’d gladly “throw down some cash“.
And guess what? Nextcloud is one of them. Well, we wouldn’t settle for less 😉
zdnet.com/article/7-open-sourc…
These apps are free, but I'd be willing to throw down some cash for them. Here's why.Jack Wallen (ZDNET)
Můj první toot na GrapheneOS. Začínám se pomalu zabydlovat.
Co používáte za aplikace na soukromém (bez googlu) účtu? Hlavně náhradu těch googlových, jako jsou
Kontakty
Kalendář
E-mail
Jaké další aplikace si do toho hlavního účtu má smysl přidat? Na starém mobilu jich mám tunu, spíš občasně poużívaných 🙇
@Milu FairEmail umí také více účtu, ale Thunderbird není špatný.
Já porad nevím co je špatného na Owner profilu mít Google play, které běží v sandboxu. Nemá v systému žádná práva, je to jak běžná aplikace.Sice teď mám také víc profilů, ale stále si říkám, jestli mi za to stojí.
Newpipe mně momentálně nepřehraje žádné video.
Wrapper for Syncthing - Open and decentralized file synchronizationf-droid.org
@schmaker
Já mám taky Aurora store na apky co na fdroid nejsou a potřebuji je.
Jinak mě asi ta jejich kamera stačí. Nejsem zas nějaký fotící maniak a pro mě je to dobrá kvalita. Skromná jsem 🥸
Na počasí mě asi nejvíce vyhovuje Cirrus. Vyzkoušela jsem jich hodně a toto rozložení mi vyhovuje.
Jinak asi máte Zdeňku pravdu, že u GOS ty apky z play nebudou problém ale za mě osobně se mi líp dýchá čím míň jich tam mám. Jen pocit.
A ted mi při mé hlouposti došlo, že už máte Milane ten pixel s GOSem? Já myslela až po novém roce? 🙃
@archos @nacelnik01
A navigaci používáš jakou ?
No, nevyhovuje mi to, ale tahat 2 mobily nechci.
V 🍎 snad nějak jde oddělit práce a soukromí.
I'm a bit worried about the discourse around #ai.
It's totally OK to have strong opinions either way, but I feel like in certain circles it's becoming a purity test.
Do you hold the RIGHT opinions about AI, how it's trained and how it's used?
I think pointing out the dangers is important. Pointing out the risks is important, but recognizing that the situation is nuanced and complex is important as well.
@matt
To make an analogy to something much less divisive: it was clear to me that at some point, we would want to move away from subversion to some other version control system. It was also clear that the market would eventually settle down, and whatever won would have a clear upgrade path from subversion -- but that couldn't be said for all of the intermediate contenders.
So it was prudent to avoid moving until the winner clearly emerged.
I am letting people play with LLMs in controlled circumstances, wtihout ever putting their results into production and clearly marking what they do and how they got there. Someday it may crash and burn; someday it might produce something worthwhile and sustainable. But until then, the responsible thing to do is not to do it.
@dashdsrdash @matt You are absolutely correct for any situation where correctness cannot be trivially and unarguably verified.
There are situations however where correctness is a binary toggle and as plain as the nose on my face.
Does the web interface look like how I want?
Did this Python code build the correct bag of infrastructure needed to run the site?
These are trivially answerable questions.
@matt
Gosh, no. "The web interface looks the way I want" is not "the web interface is correct", and the entire history of software development as a craft slowly working its way into an engineering discipline is the story of why those things are different.
There are things which have provably correct answers, and beyond the trivial ones, they tend to be things like "use this well-tested theorem prover".
The problem with repeatedly feeding LLM output to a theorem prover and checking for correctness is the same problem as with bogosort, the canonically worst of all possible sorting algorithms.
(In case you have forgotten bogosort:
10 LIST.randomize-order
20 if LIST.sorted != true then goto 10
@dashdsrdash
> "The web interface looks the way I want" is not "the web interface is correct"
Case in point: accessibility.
Könnte man der #Nextclout mitteilen, dass man das *High-performance backend* nicht benötigt, und bekäme dann wieder einen grünen Haken im Admin-Panel, fände ich das sehr schön.
Rust 1.92.0 has been released! 🌈 🦀
This version adds RwLockWriteGuard::downgrade(), adds Location::file_as_c_str(), improves diagnostic and validation for various attributes, no longer warns for unused Result<(), Infallible>, and more!
Check out the announcement: blog.rust-lang.org/2025/12/11/…
Empowering everyone to build reliable and efficient software.blog.rust-lang.org
Štěpán Škorpil
in reply to Marián Kyral • • •Marián Kyral
in reply to Štěpán Škorpil • • •