LibreOffice turned 15 years old in September! We also had our annual conference, an update to the software, guidebook translations, news about migrations from Microsoft Office to LibreOffice, and more: blog.documentfoundation.org/bl… #foss #OpenSource #freesoftware
Here’s our summary of updates, events and activities in the LibreOffice project in the last four weeks – click the links to learn more… At the start of the month, the LibreOffice Conference 2025 took place in Budapest, Hungary.
I assume, libcurl will also be used on memory-constrained devices which may run any number of requests per power cycle (for example, IoT devices etc). Thus, even 500 bytes per connection can amount to a significant problem in the long run.
@moonfaced "if an attacker can trigger an arbitrarily high number of connections" sounds like a separate and quite important issue that is larger than any memory leak IMO
There may exist a connection frequency threshold sufficient to mitigate DoS attacks by limiting memory usage per active connection. However, memory leaks could accumulate over time, causing even low connection frequencies to result in substantial overall memory consumption.
amateur’s take: Is it „leak“ as in valgrind would tell you that you lost that final pointer to some memory? It could be a pre-stage to a security issue, but not per se. Was it a pointer to sensitive data you were supposed to memzero()?
i think from a philosophical standpoint the library ideally never leaks as only the application can make this decision if and how much is ok - but then if it is documented well it's kinda the applications decision to use the lib or not
since a memory leak alone can't reveal any information to an attacker, it can't be a security problem. It is, however, a potential DoS vulnerability, which isn't nearly as severe.
For even as small as 500 bytes, I would argue that it qualifies as a potential Denial of Service issue, since this could still cause problems in a program which makes many connections, and is running on a container/microcontroller with only a small amount of memory allocated.
It probably wouldn't get a very high severity rating or anything but I'd argue that it at least qualifies for a score.
IMO any memory leak should be eliminated, but I wouldn't really call it a security concern, may cause a crash in very niche situations, but probably not really a remotely practical DoS if it's such a small leak.
By itself, not a security problem, in my opinion. If someone embeds libcurl in a server side service, then it could cause a denial of service issue or result in unexpected reboots.
So my current perspective is that it's a possible ingredient for a security issue, but not a security issue in itself.
It's a security problem if the application crashing or the system running out of resources is one. So, on that condition, the correct answer is "0 bytes" (not offered) or "never". The results so far seem to bear that out.
strongly depends on your usecase. Many would say RCE is a security issue but not if your product is called lambda and you're AWS. On the other hand if you have curl embedded in a physical access system that fetches authorization via network and you only have a few kilobytes of RAM, then suddenly 1kB of RAM usage turns into a DoS. Similarly I'd consider my phone fairly secure but for a state actor it's easy to extract my pin (out of me). It all depends on your scenario.
I see the audience is very split on “at even the smallest size” and “never”. This is a question I can’t really answer by poll, because (unlike a remote code execution flaw) whether a slow bleed of resources until the system falls over constitutes a security flaw is very use-case dependent. If a device is low-resource but important (embedded controllers), even a tiny leak left dripping can escalate to a security incident. But in a big web server that’s probably already restarting everything on a cron timer, it’s just a nuisance.
@0xabad1dea agreed. It is really back to the old mantra of: since we don't know how its used, we can't really say if it is a security problem but it *might* be one... and a line needs to be drawn somewhere...
@0xabad1dea agreed; the line must be drawn on security problems.
However, I'd argue that it's still needs to be fixed at some priority. Is it a security concern? Unless it's leaking sensitive data, nah. But long uptime ESP32's and similar could conceivably experience A Problem.
What Problem? <shrug!> Maybe they just stop showing the weather. Maybe somebody ignored the "NOT FOR LIFE CRITICAL" labels on everything. But not a security problem.
Security use the CIA model, Confidentiality, Integrity and Availability. This is not a threat to either C or I, but Availability may be impacted over time, leading to a Denial of Service situation. Thus the size of the memory leak is not relevant, the precense is enough to call it a security problem.
Also, will the systems overall react correctly in a situation with limited resources?
So many stories of suffering in Africa are told by others; so few by the people living them. 'The World Was In Our Hands', an oral history of people living through the Boko Haram conflict, aims to correct this. @hrb has the review. continent.substack.com/p/revie…
So many stories of suffering in Africa are told by others; so few by the people living them. An oral history of people living through the Boko Haram conflict aims to correct this.
As of now, I am no longer the author of more than half the lines added to the #curl repository. The "others" have overtaken me. I have now added less than half the lines.
Statistically, I think that means you'll be responsible for fewer bugs as well! Though, as the project leader, you still get all the blame for the bad stuff while everyone else gets the praise for the good stuff. 😅
Very cool accomplishment and a testament to your investment in mentorship and scaling yourself. Our egos often make it difficult to achieve what you have, so I think you deserve a lot of kudos for it. 💖
But I'll still ask you to fix my Internet-connected toaster... 😜
@bagder Yeah, I suspect the stats are odd because those countries are pretty low traffic so a small number of modern computers probably skew their stats. Looking at yesterday's stats for DPRK, the main client we saw was an iPhone running iOS 18.5 & using Chrome. There's a couple of Macs, a Windows machine and a couple of Android phones and that's about it. This is all assuming no GeoIP errors & ignoring VPN usage with out-of-country exits of course...
European SMEs have united to direct a strong open letter to urge ministers of EU member states to oppose Chat Control and to defend privacy and a strong European tech industry.
I know that you have to make threats in negotiations. But with this "exit from Europe", as a consumer, I would be very curious to know where all these tech companies want to go instead. A lot of people are currently switching to European companies, often with difficulty, for reasons. I can't imagine that they would then switch somewhere else again.
That's great! And yes, of course, my English was perhaps bad. At the moment, this "leave the EU" comes from many of the other companies, latest was Signal.
I wanted to say this alternative can be used for fighting (as a threat for economics) but it can also unsettle the users very much. Also "customers will lose trust in our services and turn to foreign providers." I don't think so! People who have chosen European companies out of purpose would not leave for the USA or China ...
@NatureMC Personally I have my email hosted in Switzerland, which got something similar to chat control earlier this year, so I am looking to move. Iceland looks good.
Former minister of Justice, Marco Buschmann on X: "#Chatkontrolle ist so, als wenn man Briefe vorsorglich öffnet und man nachschaut, ob nicht etwas Illegales darin stehen könnte. Sowas hat im Rechtsstaat keinen Platz. Diese Linie habe ich als Justizminister durchgesetzt. Ein Kurswechsel wäre ein Jammer!"
@cynik_obecny připravil přehlednou stránku 👉 about.mamutovo.cz , kde najdete informace o instanci Mamutovo.cz, odkazy na služby, kontakty a první návody pro uživatele.
🌱 Web vzniká jako komunitní projekt propojený s Oscloudem a bude se dál rozšiřovat — přibydou další tipy, návody a zajímavosti ze svět #fediverse .
📣 Pomozte nám o Mamutovu dát vědět! Sdílejte odkaz dál, ať se o naší komunitě dozví co nejvíce lidí. Každé zmínění, boost nebo odkaz na web pomůže. 💚
@zoufalec hele, je to zatím ve výrobě, musím tomu ještě věnovat čas, ale @archos už se nemohl dočkat a vypustil to do světa. Budu na tom teď dva dny makat, než půjdu do práce
@archos Vsak pisu klid. Dobry to je. A aspon jsem se dozvedel, ze "nase instance je nase". To je super! Tak at vam neda moc prace to doladit a brzo vsechno funguje na jednicku!
Does anyone know why NVDA is often quiet on command prompts? It doesn't read input (I have set it to read words in edit controls) and it doesn't read output. Restarting NVDA usually fixes it.
porque UIA está rota. Lo que comentas suele suceder después de que la consola muestre un montón de líneas muy deprisa mientras NVDA la está enfocando. Algún buffer se desborda y produce un error. Si te fijas, tampoco vas a leer otros lugares, como la barra de tareas.
Nikdy nezapomenu, co posledního jsme si řekli. Je to smutné a banální a typické jak ze špatné knížky: S Danou Drábovou jsme si slíbili, že spolu musíme někdy zajít na pivo a „všechno to“ probrat. Už nezajdeme.
@mischievoustomato so far ... screen brightness buttons, probably fingerprint reader? Everything else is working fine, but wifi is slow until my replacement wifi card comes in the mail
even Thunderbolt is working. I didn't understand the non-Mac world where there's a security model and you can choose authorization requirements before using Thunderbolt devices. I turned the auth off in the BIOS and all that started working.
@hub Even the flu can have consequences, short-term, and long-term... but no one tells you that... you gotta read up on that shite. Because the province and country DGAF if the workforce is sick/sickly... until they are. :/
Does anyone know if there's like an FTP directory of everysingle Playback magazine, where I can just download them all? I hate having to go by magazine date through the Internet Archive.
Years ago I knew of a phone number in the US that you could call, and if I recall correctly, you'd hear a man and a woman talking seemingly to each other, reading the Harvard sentences (cs.cmu.edu/afs/cs.cmu.edu/proj…). I think this was used for telephone company technicians to test circuits, audio quality, etc. My dad and I were actually looking for something like this a few days ago, a phone number you can call and it will continuously make noise at you for as long as you kept the call up. Does anyone have that number or one similar? Please boost for reach. Thanks.
“OpenAI and Ive [are] working on a device roughly the size of a smartphone that users would communicate with through a camera, microphone and speaker. One person suggested it might have multiple cameras.”
So… like… a phone?
“…designed to sit on a desk or table but can also be carried around by the user.”
So… like… a phone?
“…sensors would gather data throughout the day that would help to build its virtual assistant’s ‘memory.’”
Today was spent writing user stories from your feedback, but my god can we please talk voiceover on macOS 26?
In VSCode, voiceover read single characters instead of whole lines when arrowing up and down, and arrow left / right too quickly caused letters to be read out twice.
Voiceover flat out ignored set preferences. I cannot stress this enough, mouse cursor was set to ignore voiceover cursor, and speak object under mouse was set to off, those toggles were broken.
Nice, nice, nice, I went to report and the mods had already gotten it. Thank you moderator friends. I still wish I knew whether you like us to report things we might run across before you get to them or not. #JustTryingToHelp. Thanks again for all you do.
I don't know why everyone is running from #BlueSky, but anyway, welcome to you all. Hope you'll find friends here on #Mastodon. It's not easier than everywhere else, probably, but if you have a hobby, a passion, a particularity, even the strangest one, the chances are high someone on Mastodon shares it with you.
Something to do with the CEO of BS banning someone she didn't like even though said user was on another instance, thus demonstrating that BS is not actually decentralized.
Ох, я и забыл о существовании такой платформы. Может цензуру ввели, или наоборот. История с твиттером хорошо показала сколько идейных оттуда побежали когда нафиг разогнали всех этих красноволосых модераторов.
If you haven't heard of #gnu #guix we're a free software project that's created a hosted package manager (think homebrew or flatpak) and a GNU/Linux distribution.
GNU Guix uses the functional packaging approach pioneered by #nix and adds a user-experience and system configuration system. It uses a DSL that's based on Guile Scheme. You can use it configure your home environment, dev environments or the entire system using a declarative and transactional definition.
We hope to tell people about the project and our latest news. We'd love to engage with people around #freesoftware #guile #scheme and more general #linux topics!
Lenovo's tool on Windows didn't properly detect or upgrade two critical firmware issues (one is the notorious Thunderbolt bug) but Ubuntu's fwupdmgr tool detected it correctly and applied the updates
@SrRochardBunson mine just required pressing ENTER. This is the first Lenovo I've touched in years but feel free to ping me on Delta if you want to troubleshoot further. I'll help the best I can!
I've only spent 5 minutes with Ubuntu Desktop but holy shit this is nicer than Windows 11. Detected my external monitor, made a sane choice to extend not mirror, lets me close laptop lid without going to sleep by default, my Thunderbolt Dock is working ...
Tried to change my default terminal emulator to foot, as seen by #GNOME software (e.g. #GNOMENautilus ), and found out that GNOME uses a #hardcoded list of terminal emulators. After looking on Stack Exchange, it appears you can't change it. Such a botch, are the answers I was reading out-of-date or can you just not change your default terminal in GNOME software?
@ebassi I don't see xdg-terminal-exec in this distro's repositories yet, so I think I'll launch foot manually and wait on the XDG spec, at least for now. Thanks
You know what would be cool? A wind-up clock with a totally mechanical braille display. No batteries. It would sort of work like that braille caliper thingy.
I had such one back in late Soviet Union. It was not a display per se, it was just a watch and an alarm clock (two separate devices) with carved dots on the face. Like modern Braille watches, but with no batteries.
When I got my previous job back in 2020, I was very seriously thinking of getting one because I had to assist at various meetings where talking watches and phones were absolutely unacceptable, because you know, when someone is talking, hearing like "It's eleven forty five" is… well, it's a no no. But then, unfortunately, covid hit.
Speaking of image alt text, as a photographer who tries to put care into this, I would really love it if there were a single standard EXIF field in which alt text could be embedded and from which the text was reliably extracted when the image was uploaded. It would be much easier to write a description once and have it live with the image rather than have to manage it separately (or write it on the fly when posting).
Normaalgezien zijn hun activeiten gericht op studenten informatica, maar voor de installparty zijn ook buitenstaanders welkom. Als je meer wilt weten over #linux , wilt testen of met hulp wilt installeren, wees welkom!
Hey folks, so I’ve put it off as long as I could, but, sadly, my main machine is dying, so I need to raise some funds to replace it and some other old ass electronics that are on their last legs.
I tend to buy all refurbished stuff and it’s been a minute since I’ve upgraded my gear (I can’t install the latest anything on my current set up. Yeah, that OLD), so I can get what I need for around 3k.
The easiest way to contribute is to use the long term GoFundMe I have or my Kofi to make one offs. Either one is cool. I know most folks don’t like Paypal for obvious reasons, but if you want to use that, just send me a DM and I’ll give you that info.
In any event, thanks in advance for the help so I can continue development on my projects and working with others to push this independent social media thing forward.
It’s an exciting time in social media right now and I’m itching to do more, so it would be nice to have a computer that works when I need it to LOL!
Ok, I wanted to drop a quick update because I’m a bit touched right now now.
It’s only been a couple of hours and the new machine fund is at $648/$3000
At this pace I’ll hit my goal in a day or two. I wasn’t expecting that.
I’m not gonna cry on the fedi, but thank you. The work is hard and often lonely, but this makes me feel like it’s appreciated by far more people than I think.
Being able to upgrade my stuff is going to make a massive difference, so I’d hug everyone that has given if I could.
After one solid day, the Help Ro Replace His Old Ass Electronics Fund is at $1005.78/$3000, which is a fantastic start.
A big shout out to everyone that has not only given, but also left some very kind words of encouragement and affirmation. Those small acts of kindness mean a lot to me.
Let’s keep it going. There’s a good chance we can knock this out this week, so I can get some new stuff and keep pushing #fipamo and #thebadspace forward, as well as some other tidbits I can't talk about publicly just yet.
The pace slowed on day two, but some contributions were received from some kind souls, so the Help Ro Get New Gear Before His Stuff Dies Fund (yes, I’m changing the name everyday lol) currently stands at $1096/$3000.
I still feel optimistic about getting this taken care of this week because of all the boosts and contribution this has gotten in the last couple of days, so thanks to everyone who shared this everywhere.
As much as I like to believe I can duct tape stuff together to keep working, it’s just come to a point where I need to get my hands on new equipment to continue doing what I do.
I’m a bit bummed this is happening when I decide to rebuild both of my projects in Rust because I’m on such a good pace, but I’m past due for an upgrade, so here we are.
In any event, the support received so far has been very encouraging, ha, which only makes me want to push harder.
And we’re just a little over a third of the way there, which I have to admit is pretty exciting after a couple of days.
So let’s keep pushing this thing forward and it’ll knocked out in no time.
Thanks, y’all.
ps. When the goal is hit, there will be a memorial service for my old stuff. Ha, it’s been good to me all these years, so I want to give them a proper send off. I’ll post a vid of the affair.
TheBen
in reply to LibreOffice • • •Kerplunk
in reply to LibreOffice • • •Glad you are here Libreoffice and friends.
Wonderful replacement for US tech microcrap orifice spyware
devSJR
in reply to LibreOffice • • •I remember all the voices who said you are doomed to fail. Anyway.
Happy birthday.