https://planet.debian.org/ Planet Debian - https://planet.debian.org/ http://blog.alteholz.eu/2026/08/my-debian-activities-in-july-2026/ <h3><strong>Debian LTS/ELTS</strong></h3> <p></p><p>This was my hundred-forty-fifth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian. </p> <p> During my allocated time I uploaded or worked on: </p><p></p> <ul><li>[<a href="https://lists.debian.org/debian-security-announce/2026/msg00313.html">DSA 6402-1</a>] hplip security update to fix two CVEs in Trixie related to privilege escalation and/or arbitrary code execution. I sent the debdiff to the security team, which resulted in this DSA. </li><li>[<a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1142351">#1142351</a>] trixie-pu of libnfs has been uploaded.</li><li>[<a href="https://lists.debian.org/debian-lts-announce/2026/07/msg00031.html">DLA 4689-1</a>] libnfs security update to fix one CVE in Bookworm and Bullseye related to an integer overflow. </li><li>[<a href="https://lists.debian.org/debian-lts-announce/2026/07/msg00041.html">DLA 4699-1</a>] hplip security update to fix two CVEs in Bookworm and Bullseye related to privilege escalation and/or arbitrary code execution. </li><li>[ELA-1775-1] libnfs gimp security update to fix one CVE in Buster and Stretch related to an integer overflow.</li><li>[ELA-1784-1] hplip security update to fix two CVEs in Buster and Stretch related to privilege escalation and/or arbitrary code execution.</li></ul> <p> Unfortunately the number of assigned hours was rather low this month. So besides doing some days of FD at the end of the month, where I also had to process a new package list for ELTS, and a review of the rsync package (prepared by Sylvain), not much happened here. </p> <h3><strong>Debian Printing</strong></h3> <p>This month I uploaded a new upstream versions:</p> <ul><li>… <a href="https://tracker.debian.org/hplip">hplip</a> to unstable.</li><li>… <a href="https://tracker.debian.org/foomatic-db">foomatic-db</a> to unstable.</li></ul> <p>Besides the package upload, I also took care of some older bugs of hplip.</p> <p><strong>This work is generously funded by <a href="https://www.freexian.com">Freexian</a>!</strong></p> <h3><strong>Debian Lomiri</strong></h3> <p></p><p>This month I continued the upload of lomiri packages with new upstream versions. Thanks to the help of my other colleagues, this project could be finished now.</p> <p><strong>This work is generously funded by <a href="https://freiesoftware.gmbh/">Fre(i)e Software GmbH</a>!</strong></p> <h3><strong>Debian Astro</strong></h3> <p>This month I uploaded a new upstream version or a bugfix version of:</p> <ul><li>… <a href="https://tracker.debian.org/fxload">fxload</a> to unstable.</li><li>… <a href="https://tracker.debian.org/indi-orion-ssg3">indi-orion-ssg3</a> to unstable.</li><li>… <a href="https://tracker.debian.org/calceph">calceph</a> to unstable (sponsored upload).</li></ul> <h3><strong>Debian IoT</strong></h3> <p>Unfortunately I had no time to work in this category this month.</p> <h3><strong>Debian Mobcom</strong></h3> <p>This month I uploaded a new upstream version or a bugfix version of:</p> <ul><li>… <a href="https://tracker.debian.org/libgsm">libgsm</a> to unstable.</li><li>… <a href="https://tracker.debian.org/libosmocore">libosmocore</a> to unstable.</li><li>… <a href="https://tracker.debian.org/libosmo-cc">libosmo-cc</a> to unstable.</li></ul> <p>Next month I intend to upload new upstream versions of all Osmocom packages. As far as I can tell, these uploads will happen without soname changes. I like that :-).</p> <h3><strong>misc</strong></h3> <p>This month I uploaded a new upstream version or a bugfix version of:</p> <ul><li>… <a href="https://tracker.debian.org/usb-modeswitch">usb-modeswitch</a> to unstable.</li><li>… <a href="https://tracker.debian.org/ta-lib">ta-lib</a> to unstable.</li><li>… <a href="https://tracker.debian.org/lua-geoip">lua-geoip</a> to unstable.</li><li>… <a href="https://tracker.debian.org/lua-systemd">lua-systemd</a> to unstable.</li><li>… <a href="https://tracker.debian.org/displaylink-driver">displaylink-driver</a> to unstable.</li><li>… <a href="https://tracker.debian.org/nuspell">nuspell</a> to unstable.</li></ul> 2026-08-07T17:02:01+00:00 alteholz https://diffoscope.org/news/diffoscope-327-released/ <p>The diffoscope maintainers are pleased to announce the release of diffoscope version <code class="language-plaintext highlighter-rouge">327</code>. This version includes the following changes:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>[ Colin Watson ] * Handle missing openssh-client binaries in autopkgtests. </code></pre></div></div> <p>You find out more by <a href="https://diffoscope.org">visiting the project homepage</a>.</p> 2026-08-07T00:00:00+00:00 Reproducible Builds (diffoscope) https://bits.debian.org/2026/08/debconf26-closes.html <p><a href="https://wiki.debian.org/DebConf/26/Photos?action=AttachFile&amp;do=view&amp;target=debconf26-group-photo.jpg"><img alt="DebConf26 group photo - click to enlarge" src="https://bits.debian.org/images/debconf26-group-photo_small.jpg" /></a></p> <p>On Saturday 25 July 2026, the annual <a href="https://debconf26.debconf.org/">Debian Developers and Contributors Conference</a> came to a close. Over 270 attendees representing 35 countries from around the world came together for a combined 90 events (including some which took place during the DebCamp) including more than 27 Talks, 21 Short Talks, 29 Birds of a Feather sessions ("BoF" – informal meeting between developers and users), 8 workshops, and activities in support of furthering our distribution and free software, learning from our mentors and peers, building our community, and having a bit of fun.</p> <p>The conference was preceded by the annual <a href="https://wiki.debian.org/DebCamp">DebCamp</a> hacking session held 13 through 19 July where Debian Developers and Contributors convened to focus on their individual Debian-related projects or work in team sprints geared toward in-person collaboration in developing Debian.</p> <p>As has been the case for several years, a special effort has been made to welcome newcomers and help them become familiar with Debian and DebConf by organizing a sprint "New Contributors Onboarding" every day of Debcamp, followed more informally by mentorship during DebConf. Half a dozen new contributors joined the sessions and learned about Debian, free software, packaging and much more.</p> <p>This year, a week-long DebCamp session was dedicated to auditing, patching, and modernizing the Go ecosystem in Debian and enable the transition triggered by the recent upload of dh-golang enabling GO111MODULE=on by default in Experimental.</p> <p>In order to make the conference more accessible for local participants, a local language track was included in the schedule for talks in Spanish, as was done at DebConf19 in Brazil.</p> <p>The actual Debian Developers Conference started on Monday 20 July 2026.</p> <p>In addition to the traditional "Bits from the DPL" talk, the continuous key-signing party, lightning talks, and the announcement of next year's DebConf27, there were several update sessions shared by internal projects and teams.</p> <p>Many of the hosted discussion sessions were presented by our technical core teams with the usual and useful "Meet the Technical Committee", three talks about Linux Kernel, early boot and improving Debian’s kernel and installer support for Chromebooks, and about twenty BoFs and talks about Debian packaging policy, Debian infrastructure, security and privacy.</p> <p>This year, and echoing ongoing discussions within the Free Software community, Artificial Intelligence and Age Verification have been the subject of several talks. The Python, Perl, Ruby, Go, and Rust programming language teams also shared updates on their work and efforts.</p> <p>More than 17 BoFs and talks about community, diversity, and local outreach highlighted the work of various teams involved in not just the technical but also the social aspect of our community</p> <p>The <a href="https://debconf26.debconf.org/schedule/">schedule</a> was updated each day with planned and ad hoc activities introduced by attendees over the course of the conference. Several traditional activities took place: a poetry performance, the traditional Cheese and Wine party, the Group Photos, and the Day Trip.</p> <p>For those who were not able to attend, most of the talks and sessions were broadcasted live and recorded. One can find the seventy hours of recorded videos available via the conference <a href="https://debconf26.debconf.org/schedule/">schedule</a>, or alternatively through this <a href="https://meetings-archive.debian.net/pub/debian-meetings/2026/DebConf26/">link</a>.</p> <p>Almost all of the sessions facilitated remote participation via IRC and Matrix messaging apps or online collaborative text documents which allowed remote attendees to "be in the room" and ask questions or share comments with the speaker or assembled audience. DebConf26 saw over 341 T-shirts, a day trip, and up to 130 meals planned per day.</p> <p>All of these events, activities, conversations, and streams coupled with our love, interest, and participation in Debian and F/OSS certainly made this conference an overall success both here in Santa Fe, Argentina and online around the world.</p> <p>The <a href="https://debconf26.debconf.org/">DebConf26 website</a> will remain active for archival purposes and will continue to offer links to the presentations and videos of talks and events.</p> <p>Next year, <a href="https://wiki.debian.org/DebConf/27">DebConf27</a> will be held in Asahikawa, Hokkaido, Japan, from Sunday September 5th to Saturday September 11th, 2027. As tradition follows before the next DebConf the local organizers in Japan will start the conference activities with DebCamp with a particular focus on individual and team work towards improving the distribution.</p> <p>DebConf is committed to a safe and welcome environment for all participants. See the <a href="https://debconf26.debconf.org/about/coc/">web page about the Code of Conduct on the DebConf26 website</a> for more details on this.</p> <p>Debian thanks the commitment of numerous <a href="https://debconf26.debconf.org/sponsors/">sponsors</a> to support DebConf26, particularly our Platinum Sponsors: <a href="https://www.infomaniak.com"><strong>Infomaniak</strong></a>, and <a href="https://www.proxmox.com/"><strong>Proxmox</strong></a>, and our Gold Sponsors : <a href="https://www.freexian.com/"><strong>Freexian</strong></a>, and <a href="https://www.viridiengroup.com"><strong>Viridien</strong></a>.</p> <p>We also wish to thank our Video and Infrastructure teams, the DebConf26 and DebConf committees, our host nation of Argentina, and each and every person who helped contribute to this event and to Debian overall. Thank you all for your work in helping Debian continue to be "The Universal Operating System".</p> <p>See you next year!</p> <h3>About Debian</h3> <p>The Debian Project was founded in 1993 by Ian Murdock to be a truly free community project. Since then the project has grown to be one of the largest and most influential Open Source projects. Thousands of volunteers from all over the world work together to create and maintain Debian software. Available in 70 languages, and supporting a huge range of computer types, Debian calls itself the <em>universal operating system</em>.</p> <h3>About DebConf</h3> <p>DebConf is the Debian Project's developer conference. In addition to a full schedule of technical, social and policy talks, DebConf provides an opportunity for developers, contributors and other interested people to meet in person and work together more closely. It has taken place annually since 2000 in locations as varied as Scotland, Bosnia and Herzegovina, India, Korea, France. More information about DebConf is available from <a href="https://debconf.org">https://debconf.org/</a>.</p> <h3>About Infomaniak</h3> <p><a href="https://www.infomaniak.com"><strong>Infomaniak</strong></a> is an independent, employee-owned Swiss technology company that designs, develops, and operates its own cloud infrastructure and digital services entirely in Switzerland. With over 300 employees — more than 70% engineers and developers — the company reinvests all profits into R&amp;D. Its public cloud is built on OpenStack, with managed Kubernetes, Database as a Service, object storage, and sovereign AI services accessible via OpenAI-compatible APIs, all running on its own Swiss infrastructure. Infomaniak also develops a sovereign collaborative suite — messaging, email, storage, online office tools, videoconferencing, and a built-in AI assistant — developed in-house and as a privacy-respecting solution to proprietary platforms. Open source is central to how Infomaniak operates. Its latest data center (D4) runs on 100% renewable energy and uses no traditional cooling: all the heat generated by its servers is captured and fed into Geneva's district heating network, supplying up to 6,000 homes in winter and hot water year-round. The entire project has been documented and open-sourced at <a href="https://d4project.org/">d4project.org</a>.</p> <h3>About Proxmox</h3> <p><a href="https://www.proxmox.com/"><strong>Proxmox</strong></a> develops powerful, yet easy-to-use open-source server solutions. The comprehensive open-source ecosystem is designed to manage divers IT landscapes, from single servers to large-scale distributed data centers. Our unified platform integrates server virtualization, easy backup, and rock-solid email security ensuring seamless interoperability across the entire portfolio. With the Proxmox Datacenter Manager, the ecosystem also offers a "single pane of glass" for centralized management across different locations. Since 2005, all Proxmox solutions have been built on the rock-solid Debian platform. We are proud to return to DebConf26 as a sponsor because the Debian community provides the foundation that makes our work possible. We believe in keeping IT simple, open, and under your control.</p> <h3>Contact Information</h3> <p>For further information, please visit the DebConf26 web page at <a href="https://debconf26.debconf.org/">https://debconf26.debconf.org/</a> or send mail to <a href="https://bits.debian.org/feeds/mailto:press@debian.org">press@debian.org</a>.</p> 2026-08-06T21:50:00+00:00 Debian Publicity Team and Volunteers https://etbe.coker.com.au/2026/08/06/tv-control-etc/ <p><a href="https://etbe.coker.com.au/2008/09/15/the-problem-is-too-many-remote-controls/">In 2008 I wrote a blog post “The Problem is Too Many Remote Controls” [1]</a> about the issues of controlling a TV and related things. It recently got some comments on Mastodon so I think it’s time for an update.</p> <p>The first issue I raised was “Now it’s not uncommon to have separate remote controls for the TV, VCR, DVD player, and the Cable TV box – a total of four remote controls” which seems to have alleviated. VCRs seem to have almost entirely gone away. The <a href="https://en.wikipedia.org/wiki/VHS">VHS Wikipedia page [2]</a> is worth reading for everyone who hasn’t seen a VCR in operation, which I expect to be more than a few readers now and an increasing number over the next 18 years. I personally don’t have Cable TV, I own a DVD player which isn’t connected to my TV because I haven’t used it for years, I don’t own a VCR, and I don’t watch free to air TV. So I have one remote control for the TV which I use for Netflix and sometimes YouTube.</p> <p>When viewing YouTube on TV there are significantly more adverts and longer adverts. I presume that is because installing an ad-blocker on my TV isn’t a viable option for me and it’s a total impossibility for most users. Generally my desktop PC is a much better platform for YouTube than my TV, it has a better quality display, is more user friendly (my previous post addressed the difficulty of getting to the data source that’s desired), and doesn’t require entering search terms via a slow on-screen keyboard. Netflix on Linux is limited to 720p at low bitrate which is obviously of low visual quality while on the TV it’s in 4K. I have Netflix so I use that only on the TV.</p> <p>In my previous post I wrote a thought experiment on how to use a cheap laptop ($500 at the time – equivalent to $777 in 2025 money according to the Reserve Bank of Australia) to control a $5000 TV ($7770 in 2025 money). Now you can buy a new 65″ 4K TV for under $800 and a new laptop capable of 4K output for under $400 so the options are very different. For a $800 TV the manufacturer isn’t going to develop a remote control interface and Google (who develops the software the TVs run) won’t do it because it could reduce their advertising revenue. But a typical home user could setup a cheap laptop connected to their TV via HDMI providing a familiar and efficient user interface for themselves and visitors. For a Windows laptop 4K Netflix should work and for a Linux laptop the options of a laptop for everything apart from Netflix and the TV for Netflix are bearable, two controls are worse than one but better than the 3+ that used to be common.</p> <p>In my previous post I raised the issue that “it’s often the case that you don’t want to stop watching one show while trying to find another”. This is still an unsolved problem and is not addressed in modern software. I am not aware of a Linux music player that supports such functionality and this would be much easier for a music player than for a video player where the screen would have to be shared between the interface for finding the next thing to play and the space for playing the end of the current one. Maybe I should file a bunch of wishlist bugs against music players asking for this.</p> <p>I suggested that “cable modem” and “cable TV box” could be integrated into a single device. That has not happened, in fact it’s got worse. A relative who has Foxtel has a cable modem, a cable TV box, and a Wifi AP with VOIP to provide landline phone service and to make it more exciting the latter two both have bugs that require a periodic hardware reset to fix. Hopefully cable TV will go away in the next 18 years.</p> <p>Regular PCs have become less noisy in recent years. I am currently using a HP Z640 to write this post and I have HP Z840 and HP Z4G4 systems behind me running as servers and the background noise is still very low. The <a href="https://etbe.coker.com.au/2025/11/25/edid-and-my-8k-tv/">allegedly 8K TV [3]</a> that I have in my lounge room has cooling fans that make more noise than those three high-end HP computers combined. Using a quiet PC like one of those HP systems to drive a TV is a very viable option and I did just that for a couple of years. Kogan has currently got a selection of refurbished Lenovo ThinkStation systems on sale for under $400, they are quiet and would do well for this, it’s also nice that Kogan is selling systems with ECC RAM at home user prices.</p> <p>TV does seem to be going away. YouTube and streaming services seem to get more watching time and many people don’t use TV at all.</p> <p>Since my previous post the number of streaming services has increased so torrenting offers increasing benefits as no-one wants to subscribe to 6+ services. For anyone who wants to get all the content that interests them while paying the user interface situation is much worse now than it used to be in 2008.</p> <p>If you use KDE on a PC then the <b>kconnect</b> program allows a phone to be used to remotely control some aspects of a PC and has a good interface for pause/resume of a video and seeking 10 seconds forwards/backwards. The interface for controlling volume is hard to get to and doesn’t work on my installation. If you want to use a keyboard to start something playing and then a phone for pause control then kdeconnect is a decent option. A comment on my previous post by Michael Croes raised the issue of remote control which is now a solvable problem. Justin also wrote a comment suggesting a Nokia N800 as a remote.</p> <p>Jason suggested a programmable remote, which would be a good option for a power user and a viable option for someone setting things up for their grandparents. But the amount of pain is greater than I’m interested in as lounge room TV isn’t an important thing to me. It may appeal to more people than having a dedicated lounge room PC though.</p> <ul> <li>[1]<a href="https://etbe.coker.com.au/2008/09/15/the-problem-is-too-many-remote-controls/"> https://etbe.coker.com.au/2008/09/15/the-problem-is-too-many-remote-controls/</a></li> <li>[2]<a href="https://en.wikipedia.org/wiki/VHS"> https://en.wikipedia.org/wiki/VHS</a></li> <li>[3]<a href="https://etbe.coker.com.au/2025/11/25/edid-and-my-8k-tv/"> https://etbe.coker.com.au/2025/11/25/edid-and-my-8k-tv/</a></li> </ul> <div class="yarpp yarpp-related yarpp-related-rss yarpp-template-list"> <p>Related posts:</p><ol> <li><a href="https://etbe.coker.com.au/2021/06/06/netflix-ipv6/" rel="bookmark" title="Netflix and IPv6">Netflix and IPv6</a> <small>It seems that Netflix has an ongoing issue of not...</small></li> <li><a href="https://etbe.coker.com.au/2022/01/04/big-smart-tvs/" rel="bookmark" title="Big Smart TVs">Big Smart TVs</a> <small>Recently a relative who owned a 50″ Plasma TV asked...</small></li> <li><a href="https://etbe.coker.com.au/2008/09/15/the-problem-is-too-many-remote-controls/" rel="bookmark" title="The Problem is Too Many Remote Controls">The Problem is Too Many Remote Controls</a> <small>I am often asked for advice about purchasing TVs and...</small></li> </ol> </div> 2026-08-06T04:01:37+00:00 etbe https://gwolf.org/2026/08/subscription-bombing-email-under-attack.html <blockquote> This post is an <em>unpublished</em> review for <em><a href="https://dl.acm.org/doi/full/10.1145/3797487">Subscription Bombing • Email under Attack</a></em> </blockquote> <p>One of the most important inputs one can have when designing a response strategy against a security attack is a good characterization. This article describes a relatively newly described attack mode (subscription bombing), hypothetizes on the motivations that can lie behind it, and presents some countermeasures that can be taken by different actors to reduce its impact.</p> <p>At its core, suscription bombing is a classical reflection attack: it uses a third party service so that the answer to a relatively simple request is amplified and results in a distributed denial of service (DDoS) for the victim. And, as with most DDoS attacks, its effectivity lies in that there is not much a person can do against traffic coming from seemingly random different providers all around the world.</p> <p>The core differentiatof for subscription bombing is that the attack’s victim is not a network port, but an individual’s e-mail address. The attacker builds a database of service providers that allow interested users to sign up for newsletter on their activities, or a mailing list, or even just to create a new account on a given Web system. This action will generate a (seemingly legitimate) confirmation mail sent to the victim. But the attacker scripts together hundreds of thousands of such request, creating a deluge of confirmation mails sent to the unsuspecting victim.</p> <p>The authors explain the goals an attacker might pursue by performing this kind of attack. They suppose this can be due to harassment (a disgruntled employee being denied a salary raise, a political adversary, or even a romantic ex-partner wanting to inconvenience the victim’s use of their e-mail). More worryingly, the attack can be used as a distraction: by sending a high volume of mails in a controlled timeframe, the attacker can reduce the probability of the victim noticing a specific attack warning them of, i.e., financial fraud, unwanted purchases, or break-in attempts into their accounts. Attacks targetting mailboxes at private mail servers can also lead to overloading an account’s limit, causing it to reject mails after the attack is delivered and before the folder is cleaned. And it can also pave the way for follow-up, targetted deception attacks, where the attackers call the victim pretending to be the company’s IT department, and get them to install a remote desktop monitoring and management tool, with which they can effectively seize control of the victim’s data.</p> <p>To do this, they present a study they made over 24 cases of victims, from which 47,970 total e-mails were received between October and December 2024, with individual attacks receiving between 81 and 3,387 e-mails per hour, from where they presented several descriptive analysis.</p> <p>The authors explored cyber criminal’s offers on underground websites, comparing flooding services and pricing schemes.</p> <p>Finally, mitigation strategies are discussed. Mitigation is quite problematic, as none of the mail servers is acting in either a hostile way or lacking permissions — they are performing just the task they should. The authors suggest four mitigation strategies for mail server operators to reduce the burden on their users, although none of them is easily automatizab (rate-limit the number of emails a given inbox can receive from previously unseen senders; educate users about this kind of attacks; group similar newsletter or account reset mails during active attacks; and automatically unsubscribe or bounce newsletter messages when a surge is detected). They also recommend newsletter providers and services accepting the unrestricted creation of user accounts to provide some hardening to increase the effort wrongdoers need to spend to abuse their services, such as requiring CAPTCHAs or requiring users to take several steps before requesting a subscription, although they recognize this adds friction to the process providers are most interested in providing; filtering and triaging known-good and known-bad domains, although this is hard to implement on a preemptive fashion, and adhering to easy unsubscription standards, such as easily identifiable headers with which mass unsubscription could be performed more easily victims, instead of hunting for the right places to click, potentially even in mails written in an unknown language.</p> <p>The described problem is interesting, and properly tackling it can be a game changer for many users who will suffer this kind of abuse, and the article is easy to read and soundly supports its claims.</p> 2026-08-06T00:17:35+00:00 Gunnar Wolf https://k1024.org/posts/2026/2026-08-05-yes-yes-still-alive/ <p>I am not sure what happened, but my interests have changed significantly, and… I haven’t blogged, I haven’t done any open source work, and didn’t even process any pictures for the entire year. Not because anything went bad, just… new stuff, new interests, life changes.</p> <p>However, still alive, and still struggling with sports, and with sleep :)</p> <p>On the positive side, on a recent mid-length flight, I thought — I haven’t done any work on Corydalis, since last year I closed quite of a few of my “must have” features, so probably, nothing else to do for now, right? I opened an editor and started thinking about ideas, and surprised! One hour later, I had written down enough ideas for a couple of months of work. So now just need to find the time… but can’t wait for the planned things!</p> <p>Stay well!</p> 2026-08-05T17:34:00+00:00 Iustin Pop http://www.enricozini.org/blog/2026/debian/gnome-refusing-to-suspend <p>I'm tired, I want to do go bed. I click "sleep" on gnome shell, nothing happens.</p> <p>Swearwords.</p> <p>I want to go to bed. I might have want to put my laptop in a bag and run to catch a train. <a href="https://mastodon.bida.im/@spanezz/117017036756831405">I hate when this happens</a>.</p> <p><code>systemd-inhibit --list --mode=block</code> doesn't help much:</p> <div class="codehilite"><pre><span></span><code>$<span class="w"> </span>systemd-inhibit<span class="w"> </span>--list<span class="w"> </span>--mode<span class="o">=</span>block WHO<span class="w"> </span>UID<span class="w"> </span>USER<span class="w"> </span>PID<span class="w"> </span>COMM<span class="w"> </span>WHAT<span class="w"> </span>WHY<span class="w"> </span>MODE enrico<span class="w"> </span><span class="m">1000</span><span class="w"> </span>enrico<span class="w"> </span><span class="m">3042</span><span class="w"> </span>gsd-power<span class="w"> </span>handle-lid-switch<span class="w"> </span>External<span class="w"> </span>monitor<span class="w"> </span>attached…<span class="w"> </span>block enrico<span class="w"> </span><span class="m">1000</span><span class="w"> </span>enrico<span class="w"> </span><span class="m">3037</span><span class="w"> </span>gsd-media-keys<span class="w"> </span>handle-power-key:handle-suspend-key:handle-hibernate-key<span class="w"> </span>GNOME<span class="w"> </span>handling<span class="w"> </span>keypresses<span class="w"> </span>block enrico<span class="w"> </span><span class="m">1000</span><span class="w"> </span>enrico<span class="w"> </span><span class="m">2878</span><span class="w"> </span>gnome-session-b<span class="w"> </span>sleep<span class="w"> </span>user<span class="w"> </span>session<span class="w"> </span>inhibited<span class="w"> </span>block </code></pre></div> <p>After much googling I found out about <code>gnome-session-inhibit</code>:</p> <div class="codehilite"><pre><span></span><code>$<span class="w"> </span>gnome-session-inhibit<span class="w"> </span>--list mutter:<span class="w"> </span>idle-inhibit<span class="w"> </span><span class="o">(</span>idle<span class="o">)</span> /usr/lib/chromium/chromium:<span class="w"> </span>Playing<span class="w"> </span>audio<span class="w"> </span><span class="o">(</span><span class="nb">suspend</span><span class="o">)</span> </code></pre></div> <p>Found the right tab in chromium, paused playing, sleep works again.</p> <p>My sleep was a good half an hour overdue, and all I got for it was to write this blog post.</p> <p>Of course Gnome could have shown me its inhibitor list instead of doing nothing, since it has that information, but <a href="https://discourse.gnome.org/t/why-does-gnome-shell-doesnt-notify-user-about-suspend-being-blocked-by-inhibitor/34077">it didn't</a>.</p> <p>What I really would expect is that if I intentionally click a suspend button, audio and video playing wouldn't inhibit the suspend. Maybe in a future version of Gnome?</p> 2026-08-05T07:57:52+00:00 Enrico Zini https://etbe.coker.com.au/2026/08/05/monitors-for-work/ <h2>The Corporate Monitor Issue</h2> <p>Some time ago I worked in the IT department of a company that had a corporate standard of two 27″ FUllHD (either 1920*1080 or 1920*1200) monitors for the desktop. I was pushing to make the standard be one 32″ 4K monitor or the two cheaper monitors. They ended up making one 27″ 4K monitor an option which was still a better option for many users than two FullHD monitors due to having twice the pixels even though it had half the screen area. It was a surprise to me when hardly anyone took up that option.</p> <p>One man who worked there brought a wide curved monitor from home and ran with one of the FullHD monitors on each side of that. As an employee in the IT department I had concerns about expensive personal equipment being used in the office regarding who’s going to pay the bill if it gets broken. But I was assured that it was his old monitor that he didn’t need after buying a better one for gaming at home and he wouldn’t be too upset if something happened to it.</p> <p>This isn’t the only time I’ve witnessed such problems of companies paying large salaries for skilled people and providing poor equipment for them to do the work. One previous time I raised a OH&amp;S issue because the outdated monitors were so blurry but the company determined that the monitors wouldn’t cause health problems and spending $150 per employee on better replacements was a waste of money.</p> <p>Computer hardware tends to become cheaper over time and one thing that has become really cheap recently is portable monitors. <a href="https://www.kogan.com/au/buy/kogan-xpresso-156-full-hd-ips-usb-c-portable-monitor-kogan/">Kogan has a 15.6″ FullHD monitor with USB-C and mini-HDMI inputs for $89 [1]</a>. It wouldn’t be difficult for someone to put one of those on each side of the monitor or monitors that their employer provides and put them in a desk drawer at the end of the day to minimise risk. The same Kogan page has a 16″ monitor with 2560*1600 resolution for $189.</p> <h2>Company Ownership</h2> <p><a href="https://etbe.coker.com.au/2023/06/22/cheap-peripherals-work/">I previously wrote about the potential benefits to companies in not owning all those keyboards, mice, and headsets when they could just give each employee the money and have them buy their own [2]</a>. I don’t think we are at the stage where that can be applied to monitors as the cheapest price for a decent monitor is about $500 which takes it out of the disposable price range that keyboards and mice are in. Also from an IT support perspective there are real support issues with monitors and cables having compatibility issues. But paying small amounts of money to reimburse employees who buy cheap portable monitors to supplement their main monitor is a more reasonable option. For some people that will allow noteworthy improvements in work performance.</p> <h2>Who Will it Help?</h2> <p>I don’t think that adding such portable monitors will directly help the majority of workers. I think that to maximise performance and efficiency we need to chase the long tail of improvements. Big monitors, really big monitors (65″ at a larger distance), multiple monitors, standing desks, and whatever else people want.</p> <p>There was some research from Microsoft some years ago (back when 27″ was a really big monitor) showing that some tasks had a 50% increase in performance with a larger monitor. Now that 27″ is about the smallest monitor size commonly available the potential for improvement is reduced. Probably most workers now already have monitors that provide the benefits to them that the “big monitors” in Microsoft research provided. But there will always be some portion of the user base who will benefit. If you can get a 50% performance boost for 1% of the users that’s really worth doing. If you can get a 0.5% benefit for 100% of the users that is also worth doing and will theoretically give equal benefits.</p> <h2>Costs of Employees</h2> <p>It is claimed that the total cost of an employee including all overheads of management and providing office facilities etc amounts to twice their base salary. If that is the case then a minimum wage employee in Australia costs $100k per year, someone at the low end of the IT pay scale costs $200k, and someone at the high end of the IT scale is around $400k. It seems clearly worthwhile to spend $1000 in hardware purchases for a $100k employee who declares that it will really help their work, anything which is noticeable to the user is going to be more than a 1% difference in performance.</p> <p>For someone at the high end of the IT pay scale spending $40,000 on hardware to improve their performance could pay for itself. This is not only due to direct return on investment but because the people who do such work are often in key roles in important projects. If there’s too much work for one person on minimum wage to do then you just hire another person. You can’t hire another senior IT person and have them just do the work, it can take months to get up to speed.</p> <p>But as management in corporations seems unable to recognise this cheap hardware employees can afford to buy with their own money can bridge the gap.</p> <h2>Job Interviews</h2> <p>In future when interviewing for jobs I’ll ask about the hardware that’s to be used. I won’t say “I’m not interested in this job offer because you don’t respect your employees enough to buy adequate hardware”, but I may make it a condition of working at a company that the hardware on my desk will not be obsolete.</p> <ul> <li>[1]<a href="https://www.kogan.com/au/buy/kogan-xpresso-156-full-hd-ips-usb-c-portable-monitor-kogan/"> https://tinyurl.com/26bdng24</a></li> <li>[2]<a href="https://etbe.coker.com.au/2023/06/22/cheap-peripherals-work/"> https://etbe.coker.com.au/2023/06/22/cheap-peripherals-work/</a></li> </ul> <div class="yarpp yarpp-related yarpp-related-rss yarpp-template-list"> <p>Related posts:</p><ol> <li><a href="https://etbe.coker.com.au/2023/06/22/cheap-peripherals-work/" rel="bookmark" title="Cheap Peripherals for Work">Cheap Peripherals for Work</a> <small>A problem with a lot of the purchase of peripherals...</small></li> <li><a href="https://etbe.coker.com.au/2007/01/04/monitors-for-developers/" rel="bookmark" title="monitors for developers">monitors for developers</a> <small>Michael Davies recently blogged that all developers should have big...</small></li> <li><a href="https://etbe.coker.com.au/2019/11/18/4k-monitors/" rel="bookmark" title="4K Monitors">4K Monitors</a> <small>A couple of years ago a relative who uses a...</small></li> </ol> </div> 2026-08-04T22:41:18+00:00 etbe http://dirk.eddelbuettel.com/blog/2026/08/04#058_fast_easy_reliable_reverse_dependency_checks <p>Welcome to post 58 in the <a href="https://dirk.eddelbuettel.com/blog/code/r4"><span class="math inline"><em>R</em>⁴</span></a> series.</p> <p><a href="https://www.R-Project.org">R</a> and the <a href="https://cran.r-project.org">CRAN</a> repositories maintain a very high level of what we might call “quality assurrance” by requiring that newly-added code does not break any existing dependencies. This is frequently called a “reverse-dependency check”. For any given <a href="https://cran.r-project.org">CRAN</a> package one can quickly determine it reverse dependencies. Calling <code>tools::package_dependencies(pkgName, reverse=TRUE)</code> will for a scalar or vector-valued argument return a named list with the reverse dependencies. It is then a matter of looping over this list. There are helper functions in base R as well as in contributed packages on and off <a href="https://cran.r-project.org">CRAN</a>. I also wrote my own with package <a href="https://github.com/eddelbuettel/prrd">prrd</a> which, while possibly a wee bit specialised and under-documented has served me well to check on <a href="https://github.com/rcppcore/rcpp">Rcpp</a> and related packages which can indeed have a <em>large</em> number of reverse dependencies.</p> <p>I recently looked into one of these contributed runner packages, and while I will refrain from naming its implementation language let me just mention that the term “<code>cargo</code> cult” may be a real thing here. What go me interested in this was the fact that <em>if</em> one has a simple-to-use runner <em>then</em> the fact that <a href="https://eddelbuettel.github.io/r2u">r2u</a> makes it “fast, easy, reliable: pick all three” (to borrow its slogan) to deal with actual depencies if Ubuntu has indeed been selected as the host. We will maintain the position that <em>if</em> you can in fact integrate with the system-wide package management then any alternative per-repo package management approach not doing so will likely be dominated by an approach that does integrate with the system facilities. Which is what precisely what <a href="https://eddelbuettel.github.io/r2u">r2u</a> does, and offers. And why it is used enough to by now have shipped eighty eight million binary packages. So I tested it for the reverse-dependency check task.</p> <p>What I learned by looking into the (much more complicated) runner was that it at the end of the day it hands the actual task of running the reverse dependecies off to a helper function <code>rev_check</code> that is part of the <a href="https://github.com/yihui/xfun">xfun</a> package by Yuhui. I quickly found that besides <a href="https://github.com/yihui/xfun">xfun</a> we would also need its suggested dependency <a href="https://github.com/rstudio/tinytex">tinytex</a> which in turn would error unless the <code>tlmgr</code> binary was present. So as the sole requirement (on an Ubuntu system with <a href="https://eddelbuettel.github.io/r2u">r2u</a>) turns out to be</p> <div class="sourceCode" id="cb1"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb1-1"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb1-1" tabindex="-1"></a><span class="ex">$</span> apt install r-cran-xfun r-cran-tinytex texlive-base</span></code></pre></div> <p>where we do it all in one <code>apt</code> call (as <code>root</code> in the container). (Given <a href="https://eddelbuettel.github.io/r2u">r2u</a> we could also call <code>install.packages(c("xfun","tinytext"))</code> followed by <code>apt install texlive-base</code> but it is simpler for this setup step to be just one call).</p> <p>With that we are basically done. I did this (twice) using a <code>rocker/r2u</code> container with <a href="https://eddelbuettel.github.io/r2u">r2u</a> preinstalled, mounting a local work and scrap directory for the container. In it we expand the package to be tested (i.e. <code>tar xaf pkgName_*tar.gz</code> for a given source package <code>pkgName</code> from <a href="https://cran.r-project.org">CRAN</a>) and then just call with the package name and expanded direcrtory. I.e. I used this call to test my package <code>AsioHeaders</code> (which has just three reverse dependencies) to both name it and to point to the expanded source directory created for this purposed:</p> <div class="sourceCode" id="cb2"><pre class="sourceCode r"><code class="sourceCode r"><span id="cb2-1"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-1" tabindex="-1"></a><span class="sc">&gt;</span> <span class="fu">system.time</span>( res <span class="ot">&lt;-</span> xfun<span class="sc">::</span><span class="fu">rev_check</span>(<span class="st">"AsioHeaders"</span>, <span class="at">src=</span><span class="st">"AsioHeaders"</span>) )</span> <span id="cb2-2"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-2" tabindex="-1"></a><span class="do">## ... earlier output omitted for brevity here ...</span></span> <span id="cb2-3"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-3" tabindex="-1"></a> user system elapsed </span> <span id="cb2-4"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-4" tabindex="-1"></a> <span class="fl">35.732</span> <span class="fl">3.333</span> <span class="fl">149.683</span> </span> <span id="cb2-5"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-5" tabindex="-1"></a><span class="sc">&gt;</span> res</span> <span id="cb2-6"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-6" tabindex="-1"></a> httpgd ipaddress websocket </span> <span id="cb2-7"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-7" tabindex="-1"></a> <span class="dv">0</span> <span class="dv">0</span> <span class="dv">0</span> </span> <span id="cb2-8"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-8" tabindex="-1"></a><span class="sc">&gt;</span> </span></code></pre></div> <p>and about a good two minutes later I would get the timing result and the summary in variable <code>res</code>. As I checked the current <a href="https://cran.r-project.org">CRAN</a> version, the check was as expected free of concerns or issues.</p> <p>To support this, <a href="https://eddelbuettel.github.io/r2u">r2u</a> did indeed go off and install about sixty seven binary packages (and the total includes all binary dependencies fully resolved) delivering on the ‘just works’ promise by the <a href="https://eddelbuettel.github.io/r2u">r2u</a> documentation.</p> <p>As another check, I did the same for <a href="https://github.com/eddelbuettel/rcppannoy">RcppAnnoy</a> which has seven reverse dependencies and needed about two hundred <a href="https://cran.r-project.org">CRAN</a> packages to be installed. The full test took just over four minutes with the timing function reporting some nice gains from parallelisation as total user compute time was on the order of just under eight minutes. Again, test results were clean and free of worries as expected:</p> <div class="sourceCode" id="cb3"><pre class="sourceCode r"><code class="sourceCode r"><span id="cb3-1"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb3-1" tabindex="-1"></a><span class="sc">&gt;</span> <span class="fu">system.time</span>( res <span class="ot">&lt;-</span> xfun<span class="sc">::</span><span class="fu">rev_check</span>(<span class="st">"RcppAnnoy"</span>, <span class="at">src=</span><span class="st">"RcppAnnoy"</span>) )</span> <span id="cb3-2"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb3-2" tabindex="-1"></a><span class="do">## ... earlier output omitted for brevity here ...</span></span> <span id="cb3-3"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb3-3" tabindex="-1"></a> user system elapsed </span> <span id="cb3-4"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb3-4" tabindex="-1"></a><span class="fl">471.765</span> <span class="fl">378.220</span> <span class="fl">266.855</span> </span> <span id="cb3-5"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb3-5" tabindex="-1"></a><span class="sc">&gt;</span> res</span> <span id="cb3-6"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb3-6" tabindex="-1"></a> bbknnR bigANNOY blocking scDHA Seurat uwot VectrixDB </span> <span id="cb3-7"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb3-7" tabindex="-1"></a> <span class="dv">0</span> <span class="dv">0</span> <span class="dv">0</span> <span class="dv">0</span> <span class="dv">0</span> <span class="dv">0</span> <span class="dv">0</span> </span> <span id="cb3-8"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb3-8" tabindex="-1"></a><span class="sc">&gt;</span> </span></code></pre></div> <p>Overall this was a rather useful quick excursion as it demonstrates that - existing functions can be used to orchestrate a reverse dependency check - with ‘reasonable’ dependency scale we can do this on a single machine quite easily taking advantage of parallel computing on multi-core machines - using <a href="https://eddelbuettel.github.io/r2u">r2u</a> gives us <em>fast, easy, reliable</em> package installation making testing of packages we might not otherwise use or know a breeze - doing this in an ephemeral Docker container facilitates easy build-up of required resources and leaves no side effects behind which might affect our normal development environment</p> <p style="font-size: 80%; font-style: italic;"> This post by <a href="https://dirk.eddelbuettel.com">Dirk Eddelbuettel</a> originated on his <a href="https://dirk.eddelbuettel.com/blog/">Thinking inside the box</a> blog. If you like this or other open-source work I do, you can now <a href="https://github.com/sponsors/eddelbuettel">sponsor me at GitHub</a>. </p><p></p> 2026-08-04T17:22:00+00:00 Dirk Eddelbuettel http://www.hungry.com/~pere/blog/FreeCAD_MCP_with_llama_cpp__toy_or_tool_.html <p>After seeing a video a few months ago demonstrating how a proprietary CAM solution uses machine learning and large language models to automatically generate CNC instructions, and successfully testing it on a real CNC, I began wondering if the same could be achieved with free software. I still do not know the answer, but I may be getting closer to finding out. Two weeks ago, I came across the video "<a href="https://inv.nadeko.net/watch?v=6trAkQY5_kc">I Connected Claude AI to FreeCAD (And It Models Parts Like an Engineer)</a>" by Make Form, which introduced me to the <a href="https://github.com/neka-nat/freecad-mcp/">FreeCAD MCP project</a>. Even though the video creator apparently believes it is acceptable to download and run random binaries from the Internet on a local machine (his setup uses UCX), I do not. I would probably have left the project alone entirely if I had not noticed that all of its dependencies are already available in Debian. This significantly boosted my motivation, so I set out to test it using packages built from source on Debian rather than relying on untrusted binaries.</p> <p>The first hurdle was that <a href="https://tracker.debian.org/pkg/python-mcp">the MCP SDK for Python</a> was not present on my Debian Forky test machine. I initially believed it was missing from Debian altogether, but it has been available in Debian Unstable for about a month and is only absent from Forky because some automated tests fail on architectures like riscv64 and s390. Fortunately, backporting it was straightforward using `apt-get source -b python3-mcp`. The next hurdle involved an outdated version of the <a href="https://tracker.debian.org/pkg/validators">Validators Python library</a>. Since I am a member of Debian's Python team, which maintains this package, updating it to a sufficient version for FreeCAD MCP was relatively easy. I could not upgrade to the latest upstream release due to a new dependency on an Ethereum-related library, so I settled on a 2024 version.</p> <p>With those dependencies in place, I proceeded to create a Debian package for FreeCAD MCP. I had previously submitted a <a href="https://bugs.debian.org/1142447">request for packaging of FreeCAD MCP</a> to gauge interest while deciding whether to prioritize maintaining it myself. Because salsa.debian.org blocks access from Tor users like myself, I published my draft packaging scripts in a Git repository on Codeberg as the <a href="https://codeberg.org/pere/debian-freecad-mcp">Debian FreeCAD MCP project</a> and got it working with the FreeCAD 1.1 version in Forky. I initially struggled with the button controls for the MCP feature, which led me to submit a pull request titled "<a href="https://github.com/neka-nat/freecad-mcp/pull/106">Fixed startup sync of checkable toolbar buttons</a>" proposing a fix. Once this confusion was resolved and the MCP setup was enabled via the GUI, I was able to run FreeCAD completely headless using `xvfb-run` on a machine without an X server to generate models. I am using a private LLM service running <a href="https://tracker.debian.org/llama.cpp">the Debian package of llama.cpp</a> with the Qwen 3.6 model downloaded from Hugging Face, configured with a maximum context window of 105k tokens. I also tested the Bonsai model on my test laptop; initially, its context window was too small (8k and 16k could not accommodate the FreeCAD MCP instructions), but even after increasing it to 32k, it proved useless for generating FreeCAD models so far. I've used Claw Code, Aider and Open Code with my server so far, and for this test I ended up with OpenCode because it was easy to set up to use an MCP. Because none of my LLM services are set up to be multimodal (capable of processing both text and images in this case), I configured the MCP to return only textual feedback from FreeCAD. I am unsure if this is a major limitation, though I suspect it might be.</p> <p>My testing experience remains limited, with no clear successes yet. Part of the issue likely stems from my ability to provide effective instructions for modeling 3D objects (I am relatively new to FreeCAD, English is not my first language, and I lack a precise vocabulary for describing construction features to an LLM). Nevertheless, the LLM has demonstrated the capacity to create 3D models in FreeCAD. In one of my first tests, I asked it to generate a cube and then produce CAM/G-code instructions for a CNC machine. It did output G-code (which remains untested), but I was surprised to find that it bypassed FreeCAD's built-in CAM module entirely and instead generated an external Python script to produce the code. This was not quite what I intended, though my instructions were probably unclear. The Qwen model with OpenCode seems to strongly prefer programming directly; it frequently executes Python snippets inside FreeCAD to achieve its goals rather than using the standard sketch-and-extrude workflow I am accustomed to. In another test, I asked the LLM to create a parameterized pipe assembly to see which of FreeCAD's parametric tools it would choose, but found no evidence of traditional parametric features in the output. When prompted, the LLM explained that the parameters were embedded directly in the Python script used to generate the model, rather than in native FreeCAD features. With more explicit instructions, it eventually created a FreeCAD spreadsheet to manage the parameters. The resulting model looked much closer to my expectations and could have been useful with further refinement. My so far last experiment was less successful: I asked it to design a pipe clamp, but the LLM repeatedly failed to position the clamping screws in a way that would actually secure the brackets around the pipe. It is unclear whether this limitation lies with the model, my prompt, or other factors.</p> <p>Based on my testing so far, I am uncertain whether FreeCAD MCP is merely a fun toy or a genuinely useful tool. I will only commit time to maintaining it in Debian if it proves to be practically valuable. I would welcome feedback from anyone who has experience with the project, preferably via the original request-for-packaging mailing list thread. Alternatively, I am available in the FreeCAD and Debian AI IRC channels for further discussion.</p> <p>As usual, if you use Bitcoin and wish to support my activities, please send donations to <b><a>15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a></b>.</p> 2026-08-04T09:00:00+00:00 Petter Reinholdtsen http://www.netfort.gr.jp/~dancer/diary/daily/2026-Aug-4.html.en#2026-Aug-4-07:03:26 Summer Holiday. Busy time as a parent. <p></p> 2026-08-03T22:03:26+00:00 Junichi Uekawa http://blog.brlink.eu/index.html#i72 <p> Today I stumbled over some behavior that I found quite surprising: </p> <pre>$ ipython3 -c 'import httpx;print(httpx.URL("https://example.com/foo/bar/../../baz"))' https://example.com/baz </pre> <p> Even more surprising that behavior is actually standards-compliant, even mandated by RFC 3986. </p> <p> The underlying motivation is relative reverences. If some resource reachable by "<tt>https://example.com/foo/bar</tt>" references another resource relatively as "<tt>../../baz</tt>" then this is of course the intended result. </p> <p>Getting from this problem to what RFC 3986 suggests might be surprising in the result, but somewhat understandable if you look at the consequences of that problem:</p> <p>Giving the path components "<tt>..</tt>" (and "<tt>.</tt>") special meaning at the start of the relative reference means that if you allowed them in absolute URLs those would be impossible (or at least very convoluted) to address as relative URLs. </p> <p> So RFC 3986 describes a way to handle them everywhere: Just join the path of the base URL and the path of the relative reference and normalize the result. Or normalize the absolute on either side if only that is to be taken. This makes things very convenient: Multiple reference URLs can just be joined without special handling for relative references starting with dots, making writing applications handling them easier. Programmers don't have to care how to handle relative references and can just join everything in whatever way they want. </p> <p> For maximum elegance there is still some corner case left: What happens if an absolute URL has a path starting with double-dot components? Or an relative path starting with more of them then the base URL's path has components. You just ignore them: </p> <pre>$ ipython3 -c 'import httpx;print(httpx.URL("https://example.com/../../baz"))' https://example.com/baz </pre> <p> With that last point every URL is valid and has well-defined meaning. Handling relative references and relative paths is very easy and convenient. </p> <p> So this shows a high regard for simplicity, elegance and convenience. And a total and uncompromising disregard of security. </p> <p> After all the most convenient it is for an attacker; If they are allowed to supply a path component for a request a system does in their behalf, then they can easily escape anything they were supposed to be limited to. The ignoring of dots at the start means they don't even have to know exactly how deep their request is: </p> <pre>$ python3 -c 'import httpx;print(httpx.URL("https://example.com/public/api/public/resources/harmless/../../../../../../../../../internal/data"))' https://example.com/internal/data </pre> <p> So even if the resource server securely handles request (unless you consider not having any way to lower your permissions for one request to a specific subset), your fully RFC conforming client library will already request the permission they should not have permission for. Even worse dots are usually not characters you can easily forbid so once slashes are to be allowed things get complicated. </p> <p> There also would have been a simple, elegant and secure way: Consider every path element "<tt>..</tt>" or "<tt>.</tt>" in an (absolute) URL an error. Define a reference resolution that allows the relative reference to only start with "<tt>./</tt>" or one or multiple "<tt>../</tt>" and consider every appearance of a dot or two dots as path components after than an error. </p> <p> Everything joining two paths has to either use an implementation of that path joining algorithm, but only if they want to joins paths in the potentially dangerous way allowing leading "<tt>../</tt>". Otherwise they can just use the normal join and even if an attacker gets those dots that will just cause the generated URL to be rejected as invalid. </p> <p>Of course using a secure implementation is now even more inconvenient thanks to RFC 3986 being around: If you have no control over the generator of relative references, it is always possible that they generate relative references with "<tt>..</tt>" components after non-dot components. </p> <p>And if you check all code to properly filter out "<tt>/../</tt>", keep in mind that convienence does not stop there. After all it is not unheared of for server implementations to helpfully normalize unicode characters, too, or translate them to their nearest ASCII equivalents. Or translate percent escaped characters back before doing path splitting. Or you might think there was some unicode codepoints between those two dots, but they that those were some meaningless control characters that can be omitted. So you need some really restrictive allow lists... </p> 2026-08-03T19:39:43+00:00 Bernhard R. Link https://changelog.complete.org/archives/44456-celebrating-45-years-of-kermit-with-the-first-new-c-kermit-release-in-15-years-and-working-with-a-decades-old-c-codebase <p>1981 was a different time for computing. It was expensive (<a href="https://changelog.complete.org/archives/10417-the-pc-internet-revolution-in-rural-america">both hardware and software</a>), and it was far from a given that machines from one vendor would be able to talk to those from another. In fact, Columbia University had just such a problem, so in 1981, Frank da Cruz and Bill Catchings designed a serial protocol they called Kermit. Because of the many <a href="https://www.columbia.edu/cu/computinghistory/dec20.html#kermit">quirks</a> of the <a href="https://en.wikipedia.org/wiki/DECSYSTEM-20">DEC-20</a> and IBM mainframes, the Kermit protocol was highly adaptable from the start: able to handle systems that had trouble processing more than 96 bytes of data at once, able to transfer 8-bit files over 7-bit links, able to translate between character sets (ASCII and EBCDIC then; now also various Unicodes), and of course, handling of error-prone serial links.</p> <p>Kermit spread rapidly; by 1982, Kermit had been ported to MS-DOS and Unix. Eventually, C-Kermit (an implementation of Kermit in C) became the flagship Kermit. It gained TCP support, an interactive CLI, a powerful scripting language (with features from the shell, Lisp, and <a href="https://core.tcl-lang.org/expect/index">expect</a>), and optimizations for today’s high-speed links, such as jumbo packets, sliding windows, and streaming modes. Along the way, Kermit <a href="https://www.kermitproject.org/nasa.html">flew on the International Space Station</a>, ran <a href="https://www.kermitproject.org/em-apex.html">data collection from sensors during hurricanes</a>, and <a href="https://www.kermitproject.org/kermit.html">many other uses</a> including postal systems, Boeing 787 manufacturing, and more.</p> <p>Today, I use it as a <a href="https://www.openkermit.org/ckermit/ssh/">powerful ssh wrapper</a> (letting me easily transfer files through multiple nested ssh, sudo, su, etc. commands), a <a href="https://www.openkermit.org/ckermit/bbs/">BBS client</a>, to exchange data with me <a href="https://www.kermitproject.org/hp48filetransfer.html">HP 48GX calculator</a>, and so on. It’s also used today to transmit firmware updates to embedded devices. And, of course, anyone that works with vintage systems is likely to use Kermit at some point.</p> <p>It wouldn’t be until the late 1990s that the TCP/IP stack was finally adopted by most OS vendors, establishing something of a common basis for communication. Of course, we assume this today. Though transferring large files between OSs (say, Linux, Windows, MacOS, Android, iPad, etc.) is still a challenge, even though they all speak TCP/IP! I find that the easiest way to get large files from two computers is to spin up Kermit (see <a href="https://github.com/davidrg/ckwin">ckwin</a> for a Windows fork of C-Kermit) and just set up a TCP connection over the LAN. In fact, I added a new <tt>show interfaces</tt> command in C-Kermit 11, making it easy to see your system’s local IPs.</p> <p>For most of its history, Columbia’s Kermit project was self-funded. Columbia charged for commercial use, which limited its inclusion in Linux distributions. In 2011, 30 years after its founding, Columbia canceled the Kermit Project and released C-Kermit as Open Source under a BSD license. Frank da Cruz, who had still been working with the Kermit project all those years, volunteered to continue maintaining Kermit outside Columbia, and continued development with alpha and beta releases through his retirement from the project in 2025.</p> <p><b>I dive into this C codebase</b></p> <p>As Debian maintainer of Kermit, I noticed some areas where it wasn’t matching modern expectations. One area was, not surprising for a project of its age, security. Another area was that its character set or line-ending conversions are usually not desired now; we are used to byte-identical binary transfers, and the defaults caused confusion and even some rare instances of data corruption. So I started making a few patches last year.</p> <p>I’ve worked with old C codebases before, such as Varnish. I’ve generally hated it. You usually find a mix of bad and terrible practices, unclear memory management, and so forth.</p> <p>But I’ve been living in the C-Kermit codebase for a few months now, and I <i>enjoy</i> it. Yes, this thing is still designed to build on VMS, OS/2, and with compilers that haven’t heard of ANSI — and those that require modern practices. (That em-dash was mine; I knew how to use them before LLMs existed and I’m not going to stop just because LLMs have copied people like me! No AI was used for this post.)</p> <p>The there is an elegance in all of that. As I worked, I fixed a bunch more potential security issues, both with memory safety and with protecting against a malicious remote in roughly the same manner that some patches to scp did a few years back. I added IPv6 support, of course conditionally compiled because some systems C-Kermit builds on have never heard of IPv6 and never will. (And, of course, with fallback algorithms at runtime for systems that have IPv6 support but not IPv6 connectivity.)</p> <p>I added unit tests and Python-based end-to-end tests, running nearly 2000 test cases in total. Along the way, I found and fixed a number of bugs going back decades. I learned about FIONREAD being broken on macOS, about NetBSD’s bugs in the pty driver, and fixed bugs in the Kermit protocol implementation itself. I added compatibility tests with the gkermit and ekermit (embedded) implementations, as well as the last full release, C-Kermit 9.0.302 from 2011 (which was difficult to get compiled on a modern system).</p> <p>There is an <a href="https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506">extensive changelog</a> describing all the improvements in C-Kermit 11.</p> <p>C-Kermit development had never really used a VCS at any point, though Kermit veteran Jeffrey Altman imported historical releases into a Git repo, along with some patches that hadn’t made it into a release (which I also pulled in.) There was a lot of disabled code behind <tt><a class="hashtag u-tag u-category" href="https://changelog.complete.org/archives/tag/ifdef" rel="tag">#ifdef</a> COMMENT</tt>, along with commentary describing why it was no longer used. With Git, we would now generally just remove the old code and explain why in a commit message. I went through and did so with a lot of it, meaning that, at last check, C-Kermit actually has fewer lines of code now than it used to.</p> <p><b>Towards a new release</b></p> <p>It became apparent pretty quickly that I was making more changes than would make sense as a Debian patch series. Not only that, but they would be more widely applicable to more than just Debian and Ubuntu users. As Linux and BSD distributions were running everything from the last non-beta release (2011’s 9.0.302) to the last beta release (about 1.5 years ago), depending on their different policies about running betas, even sharing patches in a useful fashion was going to be quite difficult.</p> <p>So, I spun up a project at <a href="https://www.openkermit.org/">Open Kermit</a> to coordinate future development in the open and keep Kermit going.</p> <p>With modern CI, I run that test suite on Linux (x86_64 and arm64), macOS, FreeBSD, NetBSD, and OpenBSD. It builds binary releases on all those platforms, plus a statically-linked Linux binary built with musl libc.</p> <p>You can <a href="https://www.openkermit.org/downloads/">download the latest C-Kermit release</a>, and of course <a href="https://www.openkermit.org/contributing/">contribute to C-Kermit and its website</a>.</p> <p><b>Dedication</b></p> <p>Frank da Cruz was directly involved with Kermit for 44 years. I’m not aware of any other Open Source project founder being involved for so long. Richard Stallman started working on GNU Emacs in 1984, 3 years after Frank started working on Kermit, but Richard hasn’t <a href="https://web.archive.org/web/20080524201111/http://www.networkworld.com/community/node/25335">been in that role since around 2008</a>.</p> <p>Accordingly, C-Kermit 11 bears this dedication:</p> <blockquote><p>I dedicate this release of C-Kermit to Frank da Cruz.</p> <p>Frank was directly involved with Kermit for 44 years, from its initial design in 1981 all the way through 2025. He maintained Kermit as an Open Source project after Columbia University ended its sponsorship. I know of no other Open Source project where the founder remains so personally involved for so long.</p> <p>When Kermit was begun, transfers between different hardware and operating systems were difficult or impossible. Frank helped build a bridge. Kermit glued systems together, from the International Space Station to pocket calculators, and set a new standard for interoperability. It continues to do so.</p> <p>Kermit is still one of the quietly-working pillars of computing today, enabling everything from firmware upgrades to radios. And, yes, it still reliably transfers files over serial lines.</p> <p>As we start to spend a lot of time in the Kermit codebase, we do so standing on the shoulders of a giant. Thanks, Frank, for your decades of work on Kermit.</p> <p>John Goerzen, July 2026</p></blockquote> 2026-08-03T15:45:14+00:00 John Goerzen https://www.eyrie.org/~eagle/journal/2026-08/001.html <p> Yesterday, I uploaded Term::ANSIColor v6.0.0-TRIAL to CPAN for early testing. This release will raise the minimum required Perl version to 5.12, dropping support for Perl 5.8 and 5.10. When I did the same with podlators a couple of years ago, it upset a few people and one of them asked me to make this sort of test release in the future. Hopefully this will help. </p> <p> I have not run the normal release machinery and haven't archived this release in the normal places, since I intend it to be transient. It's only on CPAN, where people can retrieve it for testing. Once v6.0.0 is released, few traces of this TRIAL release will be left. This doesn't appear to be how other people use the TRIAL mechanism, but it felt more comfortable to me. If I have to make substantial changes, I'll consider changing my approach. </p> <p> I plan on turning this into the v6.0.0 release in about a month or two, hopefully with only documentation changes. </p> <p> Term::ANSIColor is a "very upstream" core module with a lot of dependencies, and CPAN (unlike some of the archives that followed it, such as PyPI) doesn't support conditionally retrieving packages based on the current Perl version. This release may therefore be disruptive for people who are still trying to support Perl 5.8 and 5.10, since CPAN installation tools may attempt to install an incompatible Term::ANSIColor version. I'm sad that this will be the result, since I know some people still care about those versions. </p> <p> I'm pressing forward with updating my Perl modules anyway, though. I realized that honoring other people's desire for stability to such a degree that I was unable to use Perl features added more than 15 years ago was destroying my motivation to work on these Perl modules at all. So I've decided on a very slow and gradual approach where I'm going to keep pushing the minimum supported version forward but try to give people a lot of warning. </p> <p> Personally, I think it's time to let ancient versions of Perl go and follow the <a href="https://github.com/Perl-Toolchain-Gang/toolchain-site/blob/master/lyon-amendment.md">Lyon Amendment</a> about supported Perl versions. When we're talking installing new modules for software released more than 15 years ago, we're talking about special limited environments and retrocomputing more than what I would consider routine software maintenance. Those tasks should expect to need different tools and a different workflow so that they can pin historical versions. Since this isn't something I'm personally interested in, my willingness to expend time and energy to assist is limited. </p> <p> As you can probably tell, I still feel nervous about pressing forward in this way, but I think this is the approach that lets me continue to enjoy maintaining these Perl modules. It's been 29 years for Term::ANSIColor, but I still enjoy fixing bugs in it and putting out a new release from time to time, particularly if I can clean up the code a bit each time I touch it. </p> 2026-08-02T21:49:00+00:00 Russ Allbery https://www.decadent.org.uk/ben/blog/2026/08/02/foss-activity-in-july-2026.html <ul> <li>Debian packages: <ul> <li><a href="https://tracker.debian.org/pkg/apt">apt</a>: <ul> <li><a href="https://bugs.debian.org/src:apt">Bugs</a>: <ul> <li>replied to <a href="https://bugs.debian.org/1078608">#1078608: apt update silently leaves old index data</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/firmware-nonfree">firmware-nonfree</a>: <ul> <li>Merge requests: <ul> <li>opened and merged <a href="https://salsa.debian.org/kernel-team/firmware-nonfree/-/merge_requests/151">!151: Update to 20260622</a></li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/firmware-nonfree/news/">Uploads</a>: <ul> <li>uploaded version 20260622-1 to unstable</li> <li>uploaded version 20260622-1~bpo13+1 to trixie-backports</li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/hexagon-dsp-binaries">hexagon-dsp-binaries</a>: <ul> <li><a href="https://bugs.debian.org/src:hexagon-dsp-binaries">Bugs</a>: <ul> <li>opened <a href="https://bugs.debian.org/1141904">#1141904: Missing new DSP binaries for shikra</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/initramfs-tools">initramfs-tools</a>: <ul> <li><a href="https://bugs.debian.org/src:initramfs-tools">Bugs</a>: <ul> <li>replied to <a href="https://bugs.debian.org/1142780">#1142780: initramfs-tools: ip=dhcp lease is not renewed while initramfs remains active</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/kernel-handbook">kernel-handbook</a>: <ul> <li>Merge requests: <ul> <li>opened and merged <a href="https://salsa.debian.org/kernel-team/kernel-handbook/-/merge_requests/15">!15: Update “Building a development version of the Debian kernel package”</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/linux">linux</a>: <ul> <li><a href="https://bugs.debian.org/src:linux">Bugs</a>: <ul> <li>closed <a href="https://bugs.debian.org/851695">#851695: replacing base package with -unsigned removes module files</a></li> <li>replied to <a href="https://bugs.debian.org/1126671">#1126671: linux-image-6.17.13+deb13-amd64: Disconnect root (path=/) during heavy load on NvME, partial corruption on NTFS.crash soon but not yet</a></li> <li>closed <a href="https://bugs.debian.org/1130365">#1130365: linux-image-6.18.15+deb14-amd64: kernel panic during startup</a></li> <li>closed <a href="https://bugs.debian.org/1140892">#1140892: thunderbolt: Intel Goshen Ridge CL state regression breaks dock tunneling since 6.12.94</a></li> <li>closed <a href="https://bugs.debian.org/1141185">#1141185: linux-image-6.12.94+deb13-amd64: Occasional read problems in RAID/LVM/ext4 stack when under stress.</a></li> <li>replied to <a href="https://bugs.debian.org/1141355">#1141355: linux-image-6.1.0-49-amd64: procfs deadlock triggered by drop_caches on 6.1.0-49-amd64 (regression from 6.1.0-37)</a> (LTS)</li> <li>replied to <a href="https://bugs.debian.org/1141448">#1141448: MT7921 intermittently disappears after reboot on ASUS TUF Gaming F17 FX706HF</a></li> <li>replied to <a href="https://bugs.debian.org/1141541">#1141541: linux: i915 kernel BUG in i915_drm_client_remove_object from Xorg causing hard lock on 6.12.94+deb13-amd64</a></li> <li>replied to <a href="https://bugs.debian.org/1141866">#1141866: linux-image-7.1.3+deb14-amd64: no display on AMD Kaveri/CIK APU VGA output (amdgpu DC regression)</a></li> </ul> </li> <li>Merge requests: <ul> <li>closed <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1936">!1936: [sparc64] Add nvme module to scsi-modules udeb</a></li> <li>reviewed and merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1968">!1968: [bookworm] net: mana: refresh driver from 6.12.94</a> (LTS)</li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/1984">!1984: udeb: Ensure that aead and macsec modules are in the right packages</a></li> <li>reviewed and closed <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/2003">!2003: 6.1 backport: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242)</a> (LTS)</li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/2004">!2004: [sparc64] udeb: scsi-modules: Use the default module list</a></li> <li>opened <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/2010">!2010: [x86] Backport security fixes for KVM</a> (LTS)</li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/2012">!2012: Update to 6.1.177</a> (LTS)</li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/2017">!2017: Enable NTFS_FS (and replace NTFS3_FS)</a></li> <li>opened and closed <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/2019">!2019: Fix rtmutex security issues</a> (LTS)</li> <li>opened <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/2027">!2027: Include rsync in Build-Depends-Arch for any build including tools</a></li> <li>merged <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/2038">!2038: [loong64] drivers/mmc/host: Enable MMC_LOONGSON2 as module</a></li> <li>reviewed <a href="https://salsa.debian.org/kernel-team/linux/-/merge_requests/2041">!2041: Update to 5.10.262</a> (LTS)</li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/linux/news/">Uploads</a>: <ul> <li>uploaded version 5.10.259-1 to bullseye-security (LTS)</li> <li>uploaded version 6.1.176-1 to bookworm-security (LTS)</li> <li>uploaded version 6.1.177-1 to bookworm-security (LTS)</li> <li>uploaded version 6.12.95-1~bpo12+1 to bookworm-backports (LTS)</li> <li>uploaded version 7.0.13-1~bpo13+1 to trixie-backports</li> <li>uploaded version 7.1.3-1~bpo13+1 to trixie-backports</li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/linux-6.1">linux-6.1</a> (LTS): <ul> <li><a href="https://tracker.debian.org/pkg/linux-6.1/news/">Uploads</a>: <ul> <li>uploaded version 6.1.176-1~deb11u1 to bullseye-security</li> <li>uploaded version 6.1.177-1~deb11u1 to bullseye-security</li> </ul> </li> </ul> </li> <li>linux-6.12 (LTS): <ul> <li>Uploads: <ul> <li>uploaded version 6.12.96-1~deb12u1 to bookworm-security (not yet accepted)</li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/linux-base">linux-base</a>: <ul> <li>Merge requests: <ul> <li>reviewed <a href="https://salsa.debian.org/kernel-team/linux-base/-/merge_requests/21">!21: Draft: Add hooks to copy vmlinuz file to /boot</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/localechooser">localechooser</a>: <ul> <li><a href="https://bugs.debian.org/src:localechooser">Bugs</a>: <ul> <li>replied to <a href="https://bugs.debian.org/1141886">#1141886: localechooser: Turkey is inconsistently classified under Asia in regionmap</a></li> </ul> </li> </ul> </li> <li><a href="https://tracker.debian.org/pkg/wireless-regdb">wireless-regdb</a>: <ul> <li><a href="https://tracker.debian.org/pkg/wireless-regdb/news/">Uploads</a>: <ul> <li>uploaded version 2026.05.30-1~deb11u1 to bullseye-security (LTS)</li> </ul> </li> </ul> </li> </ul> </li> <li>Mailing lists: <ul> <li><a href="https://lists.debian.org/debian-kernel/">debian-kernel</a>: <ul> <li>posted <a href="https://lists.debian.org/c6ab03ad04125365bf3ccda6d42285e22bb1e83e.camel@decadent.org.uk">Agenda items for kernel-team meeting on 2026-07-01</a></li> <li>posted <a href="https://lists.debian.org/d0012f0e7b0c012a3e05675fcc2525e1969666bd.camel@decadent.org.uk">Agenda items for kernel-team meeting on 2026-07-22</a></li> </ul> </li> <li><a href="https://lists.debian.org/debian-lts-announce/">debian-lts-announce</a>: <ul> <li>posted <a href="https://lists.debian.org/akfam9nRaDaqT2he@decadent.org.uk">[SECURITY] [DLA 4664-1] linux security update</a></li> <li>posted <a href="https://lists.debian.org/akgBqAUAJLAuUiyK@decadent.org.uk">[SECURITY] [DLA 4665-1] linux security update</a></li> <li>posted <a href="https://lists.debian.org/akqhaqWLkM4Jy49D@decadent.org.uk">[SECURITY] [DLA 4671-1] linux-6.1 security update</a></li> <li>posted <a href="https://lists.debian.org/alKRo0uzT8v9B685@decadent.org.uk">[SECURITY] [DLA 4676-1] wireless-regdb new upstream version</a></li> <li>posted <a href="https://lists.debian.org/aluK_-ysT8UPk48z@decadent.org.uk">[SECURITY] [DLA 4688-1] linux security update</a></li> <li>posted <a href="https://lists.debian.org/amXknKTE1Xwk58bC@decadent.org.uk">[SECURITY] [DLA 4700-1] linux-6.1 security update</a></li> </ul> </li> <li><a href="https://lore.kernel.org/linux-kernel/">linux-kernel</a>: <ul> <li>posted <a href="https://lore.kernel.org/linux-kernel/akvddtMQTDKLo2PH@decadent.org.uk/T/">[PATCH] irqchip/irq-imgpdc: Remove unused driver</a></li> </ul> </li> <li><a href="https://lore.kernel.org/stable/">stable</a> (mostly LTS): <ul> <li>posted <a href="https://lore.kernel.org/stable/1bfb3bb0dda1f5cd66ca8a48de2536c026355ded.camel@decadent.org.uk/T/">[7.1] drm/amd/display: Add dp_skip_rbr flag for NUTMEG</a></li> <li>replied to <a href="https://lore.kernel.org/stable/418ca29bbbb1190853136331c572470dca803800.camel@decadent.org.uk/T/">[PATCH 5.10 01/96] net/sched: act_pedit: use NLA_POLICY for parsing ex keys</a></li> <li>replied to <a href="https://lore.kernel.org/stable/6359da4c14e0b4c6ffa068407a42c07e56ef9c5c.camel@decadent.org.uk/T/">[PATCH 5.10 11/96] slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd</a></li> <li>replied to <a href="https://lore.kernel.org/stable/8601edcd7c9bcc70e75f85a758f8818c57945d07.camel@decadent.org.uk/T/">[PATCH 5.10 81/96] nfsd: check get_user() return when reading princhashlen</a></li> <li>replied to <a href="https://lore.kernel.org/stable/c1c9fdd193db5a288c825364ee525d570dadfbe0.camel@decadent.org.uk/T/">[PATCH 5.10 89/96] misc: fastrpc: Fix NULL pointer dereference in rpmsg callback</a></li> <li>replied to <a href="https://lore.kernel.org/stable/ed0c9af450494df5f7bfd72670754c8e48e1f36d.camel@decadent.org.uk/T/">[PATCH 5.10 94/96] mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC</a></li> </ul> </li> </ul> </li> </ul> 2026-08-02T17:06:31+00:00 Ben Hutchings https://etbe.coker.com.au/2026/08/02/packet-edit-meme-debian-selinux/ <p>There’s yet another Linux kernel exploit based on container functions, here’s the result when run as user_t on a SE Linux system:</p> <pre>$ ./packet_edit_meme [*] target /bin/su as uid 1000; entry at file offset 0x4340; shellcode 48 bytes unshare: Permission denied [-] page-cache corruption failed</pre> <p>Here is the audit log entry for this failure:</p> <pre>type=AVC msg=audit(1785640621.498:1843): avc: denied { create } for pid=1770 comm="packet_edit_mem" scontext=user_u:user_r:user_t:s0 tcontext=user_u:user_r:user_t:s0 tclass=user_namespace permissive=0</pre> <p>Here’s the result of running it from the unconfined_t domain:</p> <pre>$ ./packet_edit_meme [*] target /bin/su as uid 1001; entry at file offset 0x4340; shellcode 48 bytes [+] su entry overwritten; exec'ing su -&gt; interactive root shell # id uid=0(root) gid=0(root) groups=0(root),1001(test2) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 # </pre> <p><a href="https://blog.daniel-baumann.ch/posts/20260626-1.html">Daniel Baumann wrote a blog post describing how this is fixed for Debian systems without SE Linux.</a></p> <div class="yarpp yarpp-related yarpp-related-rss yarpp-template-list"> <p>Related posts:</p><ol> <li><a href="https://etbe.coker.com.au/2026/05/24/debian-selinux-pintheft/" rel="bookmark" title="Debian SE Linux and PinTheft">Debian SE Linux and PinTheft</a> <small>We have a new Linux exploit called PinTheft [1]. I...</small></li> <li><a href="https://etbe.coker.com.au/2026/05/15/debian-selinux-ssh-keysign-pwn/" rel="bookmark" title="Debian SE Linux and ssh-keysign-pwn">Debian SE Linux and ssh-keysign-pwn</a> <small>I just tested out the ssh-keysign-pwn exploit [1] on Debian...</small></li> <li><a href="https://etbe.coker.com.au/2026/05/08/dirty-frag-on-debian-and-se-linux/" rel="bookmark" title="Dirty Frag on Debian and SE Linux">Dirty Frag on Debian and SE Linux</a> <small>Hot on the heels of the Copy Fail vulnerability [1]...</small></li> </ol> </div> 2026-08-02T03:42:53+00:00 etbe https://www.eyrie.org/~eagle/reviews/books/0-7564-1949-2.html <p>Review: <cite>How to Steal a Galaxy</cite>, by Beth Revis</p> <table> <tbody><tr> <td>Series:</td> <td>Chaotic Orbits #2</td> </tr> <tr> <td>Publisher:</td> <td>DAW Books</td> </tr> <tr> <td>Copyright:</td> <td>December 2024</td> </tr> <tr> <td>ISBN:</td> <td>0-7564-1949-2</td> </tr> <tr> <td>Format:</td> <td>Kindle</td> </tr> <tr> <td>Pages:</td> <td>143</td> </tr></tbody></table> <p> <cite>How to Steal a Galaxy</cite> is a far-future science fiction caper short novel (maybe a novella?) and the sequel to <a href="https://www.eyrie.org/~eagle/reviews/books/0-7564-1947-6.html"><cite>Full Speed to a Crash Landing</cite></a>. You don't have to remember the details of the previous book to enjoy this one. There's an excellent inline summary at the start of this installment. </p> <p> After an annoying negotiation with people who keep trying to preach at her about causes, Ada Lamarr has a new contract. She is going undercover, after a fashion, at a charity gala and auction on Rigel-Earth. While she's there, she's going to steal something. What, precisely, she keeps a mystery from both the other characters and from the reader until the end of the story. </p> <p> Government agent Rian White is working security at this charity gala. Due to its link with the plot of <cite>Full Speed to a Crash Landing</cite>, he was fairly certain Ada would be there, as indeed she is. What she is planning, however, is maddeningly unclear. Also maddening is how good Ada looks in a dress. </p> <p> As with the previous book, <cite>How to Steal a Galaxy</cite> is told by Ada in the first person using the same teasing tone and constant misdirection that she uses when verbally fencing with Rian and the other characters. I found this novella even more entertaining and satisfying than the previous one. The charity gala is supposedly intended to benefit the poor people of Earth, and is run with exactly the sort of condescension and disguised capitalist looting typical of such exercises in elite charity. Ada's narration is scathing in a deeply relatable way. </p> <p> Also, there is a trillionaire tech-bro fake philanthropist who is smug and condescending and accustomed to getting exactly what he wants. </p> <blockquote><p> "I don't think anyone should have enough personal wealth to decimate a large country's income just because he's going through a midlife crisis." </p></blockquote> <p> Ada's interactions with Strom Fetor are an absolute delight. He is so sure of himself that he is incapable of registering her as a threat, and she effortlessly deceives him by hiding in plain sight. </p> <blockquote><p> "You really shouldn't be talking about this," Rian starts. </p> <p> Fetor waves aside his concerns. "We're all friends here." </p> <p> "Not me," I say. "I hate you. Remember?" </p> <p> Fetor laughs in a tone I'm sure he thinks is charming. </p></blockquote> <p> Fetor's complete inability to realize that a beautiful woman might both sincerely not like him and not be flirting with him is perfect. I was cackling through half of this book. </p> <p> Like any good heist story, there are twists and turns, surprises, double agents, unexpected complications, and a delightful amount of verbal fencing. I adore the narrative tone Revis uses for these stories. Ada has just the right mix of idealism, cynicism, professionalism, and irreverence to carry off the feeling that she's a step ahead of everyone else. Underneath the bones of a delightful plot is a character who cares deeply but is very aware of her limitations, and therefore has taught herself to laugh at and be ruthless with her own emotions. I am finding it an incredibly compelling type of competence porn. </p> <p> I enjoyed the first book of this series, but this one was so much better. These stories are exactly the right length to keep the reader engrossed throughout and satisfied but wanting more at the end. <cite>How to Steal a Galaxy</cite> ends on a cliffhanger of sorts, to be resolved in the next and final book. I can hardly wait to start it. </p> <p> Highly recommended. </p> <p> Followed by <cite>Last Chance to Save the World</cite>. </p> <p>Rating: 9 out of 10</p> 2026-08-01T04:23:00+00:00 Russ Allbery https://xana.scru.org/posts/bamamba/lekkerderworst.html <div class="inlinecontent"> <p>Normally, I do not read book reviews. Either I haven't read the book, in which case there's spoiler potential, or I have, in which case it's unlikely to be useful or enjoyable for me to read a thing about a thing I've already read.</p> <p>But <a href="https://www.eyrie.org/~eagle/reviews/books/0-316-29068-8.html">Review: Radiant Star</a> caught my eye, and I thought, “Hmm, I've read all those books” and was curious. Of course, because I am old and senile and have no understanding of time, the “May 2026” staring at me was not able to trigger the neural synapses that would remind me that I haven't read any Ann Leckie since 2023.</p> <p>However, as I read Russ's review, and began to wonder what the hell he was talking about, I was able to piece together that while I have, in fact, read 6 Ann Leckie books, none of them have been <em>Radiant Star</em>.</p> <p>This presented an opportunity, so I resolved to add <em>Radiant Star</em> to my todo list. To my surprise, it was already there.</p> </div> <div class="info"> Posted on 2026-07-31 </div> <div class="info"> Tags: <a href="https://xana.scru.org/tags/bamamba.html" rel="tag" title="All pages tagged 'bamamba'.">bamamba</a> </div> 2026-07-31T15:32:32+00:00 C https://etbe.coker.com.au/2026/07/31/links-july-2026/ <p><a href="https://www.schneier.com/blog/archives/2026/06/ai-use-by-the-us-government.html">Bruce Schneier and Nathan E. Sanders wrote a disturbing and informative article about the use of AI by the US government [1]</a>.</p> <p><a href="https://www.schneier.com/blog/archives/2026/06/ai-and-liability.html">Bruce Schneier wrote an interesting blog post about corporate liability for AI decisions and the German court ruling about Google’s AI summaries [2]</a>.</p> <p><a href="https://cybersecuritynews.com/anthropics-claude-fable-5-jailbroken/">Cybersecurity News has an interesting article about how Pliny the Liberator succeeded in jailbreaking Anthropic’s latest LLM to give instructions on writing exploits, writing exploitable code (backdoors?), and making meth [3]</a>.</p> <p><a href="https://glasswings.com.au/blog/2026-07/05-185304.html">Andrew Pam wrote about the number of cars with internal combustion engines in NSW decreasing for the first time since 1910, EVs are taking over [4]</a>.</p> <p><a href="https://pluralistic.net/2026/06/27/zuckerstreisand-2/#autodisparagement">Cory Doctorow wrote an informative blog post about Facebook’s attempts to silence whistleblowers and what a pathetic little loser Zuckerberg is [5]</a>.</p> <p><a href="https://forwardfuture.com/newsletter/originals/a-tax-system-built-on-labor-is-a-tax-system-built-on-a-melting-glacier">Scott Santens wrote an insightful article about how to effectively levy taxes in the future when “AI” significantly reduces the number of workers [6]</a>.</p> <p><a href="https://blog.rongarret.info/2026/07/birthright-citizenship-hangs-on-by-its.html">Ron Garrett wrote an insightful post about birthright citizenship in the US and his status as a US citizen who was not born there [7]</a>.</p> <p><a href="https://www.bbc.com/future/article/20260626-how-scotland-changed-the-way-it-tackled-violence">The BBC has an interesting article about the Scottish Violence Reduction Unit and how treating violence as a disease can significantly address the problem [8]</a>.</p> <p><a href="https://archive.md/Gq2jB">The LA Times has an interesting article about Covid19 causing cancer that had been in remission to return, sparking some new research into the effects of viruses on mammals [9]</a>.</p> <p><a href="https://www.youtube.com/watch?v=3ddTIa-AhXE">CMU has an interesting video about ways to physically modify QR codes and how they could be used in real life [10]</a>.</p> <p><a href="https://retout.co.uk/2026/07/10/blocking-distracting-news-links/">Tim Retout wrote an informative post about the pervasive forms of advertising on the Internet, even on the BBC’s site and how some of it can be blocked [11]</a>.</p> <p><a href="https://blog.interceptfund.com/p/ending-respiratory-infections">The Intercept Fund is a project to address respiratory illnesses and the long term mostly unnoticed costs they cause to society, we need governments and corporations to get on board with this [12]</a>.</p> <p><a href="https://www.dw.com/en/german-activists-use-trademark-law-to-fight-far-right-nazi-merchandise/a-77770986">The German news site DW has an interesting article about activists registering neo-nazi slang as trademarks to prevent the sale of nazi merchanise which funds racism [13]</a>.</p> <p><a href="https://theconversation.com/south-sudan-at-15-how-the-political-elite-have-found-a-way-to-profit-from-peace-as-well-as-war-285846">The Conversation has an insightful article about how in South Sudan and other war ravaged countries the peace process usually just allocates the spoils of war and therefore encourages more war [14]</a>.</p> <ul> <li>[1]<a href="https://www.schneier.com/blog/archives/2026/06/ai-use-by-the-us-government.html"> https://tinyurl.com/26cnn3og</a></li> <li>[2]<a href="https://www.schneier.com/blog/archives/2026/06/ai-and-liability.html"> https://tinyurl.com/22fewyml</a></li> <li>[3]<a href="https://cybersecuritynews.com/anthropics-claude-fable-5-jailbroken/"> https://tinyurl.com/2a5t693d</a></li> <li>[4]<a href="https://glasswings.com.au/blog/2026-07/05-185304.html"> https://glasswings.com.au/blog/2026-07/05-185304.html</a></li> <li>[5]<a href="https://pluralistic.net/2026/06/27/zuckerstreisand-2/#autodisparagement"> https://tinyurl.com/26qzcadm</a></li> <li>[6]<a href="https://forwardfuture.com/newsletter/originals/a-tax-system-built-on-labor-is-a-tax-system-built-on-a-melting-glacier"> https://tinyurl.com/2csg4huw</a></li> <li>[7]<a href="https://blog.rongarret.info/2026/07/birthright-citizenship-hangs-on-by-its.html"> https://tinyurl.com/2blnzzxg</a></li> <li>[8]<a href="https://www.bbc.com/future/article/20260626-how-scotland-changed-the-way-it-tackled-violence"> https://tinyurl.com/25v5j7v9</a></li> <li>[9]<a href="https://archive.md/Gq2jB"> https://archive.md/Gq2jB</a></li> <li>[10]<a href="https://www.youtube.com/watch?v=3ddTIa-AhXE"> https://www.youtube.com/watch?v=3ddTIa-AhXE</a></li> <li>[11]<a href="https://retout.co.uk/2026/07/10/blocking-distracting-news-links/"> https://tinyurl.com/2xt9dgfp</a></li> <li>[12]<a href="https://blog.interceptfund.com/p/ending-respiratory-infections"> https://tinyurl.com/2y5f26rj</a></li> <li>[13]<a href="https://www.dw.com/en/german-activists-use-trademark-law-to-fight-far-right-nazi-merchandise/a-77770986"> https://tinyurl.com/29ok2qsu</a></li> <li>[14]<a href="https://theconversation.com/south-sudan-at-15-how-the-political-elite-have-found-a-way-to-profit-from-peace-as-well-as-war-285846"> https://tinyurl.com/2yxzsp7s</a></li> </ul> <div class="yarpp yarpp-related yarpp-related-rss yarpp-template-list"> <p>Related posts:</p><ol> <li><a href="https://etbe.coker.com.au/2026/04/30/links-april-2026/" rel="bookmark" title="Links April 2026">Links April 2026</a> <small>Charles Stross wrote an interesting blog post about the apparent...</small></li> <li><a href="https://etbe.coker.com.au/2024/07/30/links-july-2024/" rel="bookmark" title="Links July 2024">Links July 2024</a> <small>Interesting Scientific American article about the way that language shapes...</small></li> <li><a href="https://etbe.coker.com.au/2026/02/17/links-february-2026/" rel="bookmark" title="Links February 2026">Links February 2026</a> <small>Charles Stross has a good theory of why “AI” is...</small></li> </ol> </div> 2026-07-31T10:33:57+00:00 etbe https://www.eyrie.org/~eagle/reviews/books/9798360228431.html <p>Review: <cite>Painting the Blues in Gretna Green</cite>, by Linzi Day</p> <table> <tbody><tr> <td>Series:</td> <td>Midlife Recorder #2</td> </tr> <tr> <td>Publisher:</td> <td>Linzi Day</td> </tr> <tr> <td>Copyright:</td> <td>November 2022</td> </tr> <tr> <td>ISBN:</td> <td>9798360228431</td> </tr> <tr> <td>Format:</td> <td>Kindle</td> </tr> <tr> <td>Pages:</td> <td>577</td> </tr></tbody></table> <p> <cite>Painting the Blues in Gretna Green</cite> is a self-published fantasy novel and the second in the Midlife Recorder series. It picks up immediately after the end of <a href="https://www.eyrie.org/~eagle/reviews/books/9798837010774.html"><cite>Midlife in Gretna Green</cite></a>. I also read it almost immediately after, so I didn't pay attention to how good the recap of previous events was. </p> <p> As before, this is urban fantasy except not urban. Day calls it paranormal women's fantasy, which I suppose is as good of a genre label as any. The other book I can think of off-hand that would go into that genre would be Nancy Springer's <a href="https://www.eyrie.org/~eagle/reviews/books/0-380-76742-2.html"><cite>Larque on the Wing</cite></a>, although it is considerably more literary. </p> <p> I suspect I'm going to read this whole series and it's going to be impossible to review these books without talking about Niki's job, so I'm not going to treat that as a spoiler. It's fairly well-advertised in the marketing for the book, so that feels justified. If you're particularly averse to any spoilers, though, you may want to stop reading here until you've gotten to the reveal in the first book. </p> <p> Niki is now officially the Recorder, with the power, advice book, and sentient house to go with it. She's about to face her first test in managing interworld politics: There's something amiss in the world of the Picts. Her allies are dropping hints, there's a petition from a group on the Pict world that she can't make sense of, and although she likes the queen of the Picts, there is a great deal of tension beneath the surface that she doesn't understand. Meanwhile, after the incompetent disaster that she uncovered in the first book, Niki is determined to pick her new staff by her own criteria. </p> <p> The second book leans even harder into giving Niki both a tangled mess created by previous incompetence and enough power to fix it. Watching that happen is very satisfying, particularly when it involves surprising people who are rather too used to getting their own way. </p> <p> I was somewhat less convinced that Niki is getting the right training to make the decisions that she's making. Diplomacy and staff management are real skills that one needs to learn, not just wing on vibes and gut instinct. My love of competence porn occasionally wishes that Niki had a bit more structure around her competence. We do at least get a new fictional self-help book on how to rule that contributes the quotes that open each chapter. Not the ethics and management training that I would have chosen, but it's something! </p> <p> In defense of Niki's technique, it becomes clear in this book that the last few recorders have been far too cautious, conservative, and content with a status quo that involved a minimum of work. One of the delights of this book is that Niki thinks power exists to be used to fix things and is determined to use it, not just sit on it. I had more suspension of disbelief issues with this book than with the first — some of the problems Niki is solving seem far too obvious to have been in stasis for this long while also having this easy of a solution, and the level of political power given to the Recorder is a bit unbelievable — but it is so satisfying to see Niki cajole and bully people into being sensible. </p> <p> I have no idea if this is intentional on Day's part, but I will not be at all surprised if adult-diagnosed ADHD comes up at some point in this series. The way that Niki's focus jumps, her tendency to veer between focusing on a problem and forgetting about it, and something about the way she switches between trains of thought or misses important context because she's jumping to conclusions is making me wonder. This, to be clear, is not a complaint; I think it makes Niki more relatable and more interesting. It's a good thing that she has a sentient house to serve as her assistant. The glee with which she's delegating any task that involves keeping track of details or following up with other people feels like a bit of an indicator by itself. </p> <p> I did get a bit frustrated with the plot structure of this book. Niki keeps mentioning that a critical petition submitted to her office makes no sense, but it takes half of this (rather long) book before she finally explains to anyone else, even the reader, what's deficient about it. The excuse within the book is that she's having a rather busy day, but by the third time Niki mentions and then fails to do anything about the petition, I was wishing Day would stop bringing it up until she was ready for that part of the plot. </p> <p> This, as with a few issues in the previous book, feels partly like an editing problem. There is something joyful in indulgent, sprawling books, but only up to the point where they become repetitive. <cite>Painting the Blues</cite> was right at that line, and once again I wish someone had helped Day trim about fifty pages out of it. </p> <p> All that said, and despite having more quibbles with this book than the previous one, this continues to be great fun. It's satisfying wish-fulfillment about fixing long-standing problems and having the power to not have to put up with abusive nonsense and ridiculous bullshit, and I am so here for that. I hope Niki realizes she's eventually going to need more refined skills than a heart-to-heart over wine, but she's learning on the job and I'm happily along for the ride. She's also capable of recognizing skill in other people, and that goes a long way. </p> <p> Recommended if you liked the first one and are in the mood for another fantasy of "no, we're not going to leave it that way, we're going to fix that right now." </p> <p> Followed by <cite>Ties that Bond in Gretna Green</cite>. </p> <p>Rating: 7 out of 10</p> 2026-07-31T03:06:00+00:00 Russ Allbery https://www.earth.li/~noodles/blog/2026/07/my-cpu-died.html <p>I built my current house server <a href="https://www.earth.li/~noodles/blog/2019/07/upgrading-the-house-server.html">back in 2019</a>. It had an upgrade from the original Ryzen 2700 to a 5700G in late 2021, but otherwise is still running with the original setup. Back in November it developed some erratic behaviour (initially manifesting as problems with the TPM, which is ironic as I’ve spent a bunch of time at my day job trying to improve TPM reliability), culminating in unreliable reboots. I had a limited amount of ability to swap parts out, but ultimately decided it was a motherboard issue (thinking perhaps <a href="https://www.reddit.com/r/Amd/comments/byi8py/that_board_has_bad_vrms/">VRM problems</a>), found a replacement <a href="https://pcbelfast.co.uk/">locally</a>, and everything seemed fine.</p> <p>Until May.</p> <p>At that point I rebooted the machine for a Debian point release, and it failed to come back. Fans would spin, but there was no sign of actual life. I ended up pressing a temporary machine into service (that could at least run the Home Assistant container, and a few other critical bits) while I tried to work out what was wrong. I’d kept the previous motherboard, and still had the Ryzen 2700, so I did a bunch of swaps (and obtained a motherboard buzzer to try and get some indication about whether there were useful beep codes being emitted), and ultimately came to the conclusion that the CPU had died.</p> <p>I’m not quite clear what happened here. I played it safe and replaced the PSU at the same time, in case that was the original cause back in November and ultimately damaged the CPU, but both old + new motherboards worked just fine with the 2700.</p> <p>That left a decision about what to do. This <a href="https://www.earth.li/~noodles/blog/2013/04/building-a-new-house-server.html">previous server</a> was from 2013, so this machine has now lasted longer than that and I could justifiably upgrade. However when I went to look at what the equivalent modern machine would be it’s only a couple of generations later (Zen 5 vs Zen 3), and 64GB RAM alone would have set me back ~ £1k. For not a lot of gain. So I ended up buying a replacement Ryzen 5700G, hopefully allowing me to put off thinking about an upgrade until Zen 6 is out, and RAM prices are saner (though I understand that might take a <a href="https://www.techspot.com/news/112934-ram-prices-expected-rise-another-40-50-q3.html">couple of years</a>).</p> <p>It’s not the first time I’ve had a faulty PSU be the cause of a dead machine, but it was a pretty frustrating experience.</p> 2026-07-31T00:28:00+00:00 Jonathan McDowell https://optimizedbyotto.com/post/estonia-well-governed-country/ <img alt="Featured image of post Estonia, the country of the fit and the wit" src="https://optimizedbyotto.com/post/estonia-well-governed-country/featured-image.jpg" /><p>While many Western democracies seem to be in a state of decay and are no longer the safe, civilized and prosperous countries they once were, there are still some European countries that are governed well. One of those that stand out is Estonia.</p> <p>Estonia is probably most well known for <strong>multiple software companies</strong> that originated from there, such as <a class="link" href="https://wise.com/invite/ecac/ottok108" rel="noopener" target="_blank">Wise</a>, <a class="link" href="https://invite.bolt.eu/OTTOKSQ" rel="noopener" target="_blank">Bolt</a>, Pipedrive and Skype. The government itself is also famous for being early in issuing <strong>government IDs with an embedded smart chip</strong> for online authentication already in the 1990s. Via the national portal at <a class="link" href="https://eesti.ee/" rel="noopener" target="_blank">eesti.ee</a> all residents can access extensive eServices ranging from viewing their health benefits to filing taxes.</p> <p>Estonia has also been running an <a class="link" href="https://www.e-resident.gov.ee/" rel="noopener" target="_blank">e-Residency</a> program since 2014, where they issue digital ID cards to foreigners, making it easy for them to remotely log into the government portals and for example, establish businesses, file annual reports and so forth. Note that the e-Residency is not a path to physical residency. Estonia does, however, have <a class="link" href="https://www.e-resident.gov.ee/nomadvisa/" rel="noopener" target="_blank">a separate Digital Nomad visa program</a> that makes it easy for <strong>non-EU citizens</strong> to also physically establish themselves in Estonia, assuming, of course, you meet the criteria, which includes, among others, a minimum monthly income of 3960 € from outside Estonia. <strong>EU citizens</strong> naturally have free mobility inside the EU and can simply get an apartment and register as a resident in Estonia if they so choose. And there are plenty of reasons to do so.</p> <h2 id="estonians-value-health-education-and-entrepreneurship"><a class="header-anchor" href="https://optimizedbyotto.com/index.xml#estonians-value-health-education-and-entrepreneurship"></a>Estonians value health, education and entrepreneurship </h2><p>I moved to Estonia about one and a half years ago. In <em>my observations</em> Estonia strikes me as <strong>a country that values health, education</strong> (in particular programming and natural sciences) and entrepreneurship highly.</p> <p>I don’t know how Estonians achieve it, but they look pretty fit and rarely obese. Estonia has rye bread and sauna in their culture just like Finland, and in addition the flat terrain and well-planned bike routes and extensive network of parks (and pull-up bars everywhere) seem to create an environment where it is easy to live in a healthier way. The consumption of processed foods and candy also seems relatively low among Estonians.</p> <p>The <a class="link" href="https://www.myfitness.ee/en/" rel="noopener" target="_blank">gym chain MyFitness</a> also seems to be present everywhere. Even the Tallinn airport has a calisthenics workout station right at the departure gates, which anyone is free to use while waiting for their flight to take off. One of the top longevity influencers in Europe, <a class="link" href="https://www.siimland.co/" rel="noopener" target="_blank">Siim Land</a>, is Estonian.</p> <p><img alt="Estonia has lots of good bike paths, parks and outdoor gyms" class="gallery-image" height="628" src="https://optimizedbyotto.com/post/estonia-well-governed-country/tallinn-harbour-pull-up-bar.jpg" width="1200" /> </p> <p><img alt="There is even a calisthenics station with pull-up bar and more at the departure gates at Tallinn airport" class="gallery-image" height="628" src="https://optimizedbyotto.com/post/estonia-well-governed-country/tallinn-airport-pull-up-bar.jpg" width="1200" /> </p> <p>Estonians also seem to value the school system highly. The government has been actively <a class="link" href="https://www.valitsus.ee/en/news/government-approved-2026-state-budget" rel="noopener" target="_blank">raising teacher pay and has a stated goal of reaching 120% of the national average by 2027</a>. The students are also expected to value the education and respect their teachers. According to the <a class="link" href="https://www.oecd.org/en/publications/results-from-talis-2024-country-notes_e127f9e2-en/estonia_44178e34-en.html" rel="noopener" target="_blank">TALIS 2024 survey</a> (OECD’s international teacher survey), Estonian teachers spend significantly more time on actual teaching and learning and waste less time on interruptions or keeping classroom order compared to the OECD average. This is among the highest rates internationally, meaning they spend relatively little time on maintaining order or dealing with disruptions. While the international education benchmark PISA scores have been dropping globally, Estonia has consistently been climbing the ranks in past decades. In the latest <a class="link" href="https://www.oecd.org/en/publications/pisa-2022-results-volume-i_53f23881-en/full-report/how-did-countries-perform-in-pisa_dc514907.html" rel="noopener" target="_blank">PISA study (from 2022), Estonia ranked number one in Europe</a> for reading, mathematics and science. In the overall results, Estonia ranked seventh globally, only behind countries such as Japan, Korea and Singapore.</p> <p>Valuing entrepreneurship is evident in how the taxation system is set up in Estonia. Famously, in Estonia, companies can defer taxes on annual earnings and reinvest all of their profit in growing the company. Taxes are due only later, when paid out from the company, for example as dividends. For individuals, receiving dividends from any Estonian or foreign company is tax-free as long as the company paying dividends already paid corporate tax on the same income.</p> <p><strong>The tax system is also very simple.</strong> For all individuals, all types of income, including salary and capital gains, are always taxed at a flat rate of 22%. This removes the incentive for anyone to try to convert income into different types, setting up holding company structures and other optimizations as there is no gain. All entrepreneurs can simply focus on growing their business and forget extra bureaucracy. There is also no marginal tax rate cliff to stop working at – everyone is encouraged to always try to produce as much value as they can. A simple tax system is also reflected in the fact that anyone can easily <a class="link" href="https://emta.ee/en" rel="noopener" target="_blank">read all tax rules that apply to individuals in plain English on the Estonian tax authority website</a>, and one does not need to hire any accountants simply to file taxes.</p> <p>Estonia also has a very straightforward investment account system: any person can freely open a self-directed investment account at any brokerage at no extra cost and report it as such to the tax authority, and then use it to save for an apartment, retirement, or other purposes, and defer all income taxes until withdrawal. There are no caps or time limits, and all residents are encouraged to save and invest as much as they can and thus take responsibility for their own wealth accumulation.</p> <p>It seems that culturally Estonians respect people who are active and progress in their careers and businesses more than in other countries. Unlike in Finland, successful people are admired and living on government welfare is not romanticized. At the same time, the government benefits are less generous so people can’t live comfortably on them and, for example, <a class="link" href="https://news.err.ee/600251/nearly-half-of-quota-refugees-currently-not-in-estonia" rel="noopener" target="_blank">many of the asylum seekers Estonia accepted have since left on their own initiative</a> to other European countries in search of better benefits.</p> <h2 id="low-crime-high-trust"><a class="header-anchor" href="https://optimizedbyotto.com/index.xml#low-crime-high-trust"></a>Low crime, high trust </h2><p>Another thing that strikes me when walking the streets of Tallinn is that there are no drug addicts, beggars, thugs or the like. The difference compared to, for example, Vancouver (where I lived previously) is stark. In public buildings, people leave their coats and bags hanging in the lobby while visiting. Private houses and apartment block yards are not fenced. In my building, I noticed people even leave their bikes unlocked in the bike shed. I have also seen the staff of a coffee stall in a shopping mall going for a break and leaving everything unattended, not worrying that anyone would take anything while the staff is away.</p> <p><img alt="Nobody is stealing anything from the unattended coffee shop while staff is having a break at Ülemiste shopping mall" class="gallery-image" height="450" src="https://optimizedbyotto.com/post/estonia-well-governed-country/tallinn-coffee-stand-unattanded.jpg" width="600" /> </p> <p>This is not just my personal experience. According to the <a class="link" href="https://www.numbeo.com/crime/rankings_by_country.jsp?title=2026" rel="noopener" target="_blank">Numbeo crime index</a>, Estonia has one of the lowest crime rates in the world. Also, comparing drug and property crime stats, for example, Finland has twice as much crime per capita, and places like Vancouver in Canada almost five times more.</p> <p>I don’t have any clear explanation for why crime is so much lower in Estonia, but some suggest that higher social cohesion and lower levels of welfare contribute to people standing to lose more if they behave antisocially. Compared to Finland, Estonia also more readily jails repeat offenders, and those who are put on trial will experience a swifter court process thanks to simplified legal processes and more efficient governance.</p> <h2 id="moving-to-estonia-quick-checklist"><a class="header-anchor" href="https://optimizedbyotto.com/index.xml#moving-to-estonia-quick-checklist"></a>Moving to Estonia: quick checklist </h2><p>Moving to Estonia is very easy for any EU citizen, in particular if your work is not location-dependent (e.g., remote work or an online business) and you are simply looking for the cleanest and safest environment to live in.</p> <p>First, check into a hotel in Tallinn, check out various neighborhoods to figure out what area you like (my favorites are Kalaranna, Kalamaja, Noblessner and Volta) and start browsing available apartments <a class="link" href="https://www.kv.ee/" rel="noopener" target="_blank">in English at kv.ee</a>. Most professionals speak fluent English, so there should not be any difficulty in reaching out to people by email or phone.</p> <p><img alt="Tallinn is famous for the old town" class="gallery-image" height="628" src="https://optimizedbyotto.com/post/estonia-well-governed-country/tallinn-old-town.jpg" width="1200" /> </p> <p><img alt="The economic boom of recent decades created a lot of new construction, with Kalaranna being among the newest areas" class="gallery-image" height="628" src="https://optimizedbyotto.com/post/estonia-well-governed-country/tallinn-kalaranta.jpg" width="1200" /> </p> <p>The next step is to buy a local prepaid SIM card at e.g., an R-Kiosk or a convenience store as signing up for other matters later on will require an Estonian phone number. Once you have an apartment and e.g., signed a rental agreement, you can register in the population registry online.</p> <p>After that, you have proof you are a local resident with an address and telephone number in Estonia. With local resident status, you can go to the police station to get a local ID card. Don’t bother scheduling an appointment, just go to the <a class="link" href="https://www.politsei.ee/en/services/services/tallinn-tammsaare" rel="noopener" target="_blank">Tammesaare police station in Tallinn</a>, take a queue number and wait. Once it is your turn, they will guide you on how to use the photo booth, fingerprint registration device, and file your application. A few days later you will receive an email confirming whether your application was accepted, and after a few more days, you will get another email notifying you that your ID card has been printed and is available for pick-up at the same location. <strong>This will also be your first practical experience of how fast and efficient the government in Estonia is.</strong></p> <p>Once you have the local ID card, you can use the smart card feature to log into all the government eServices and sort out the rest of the relocation process, such as registering tax residency and getting a family doctor.</p> <p><img alt="The main eServices portal in Estonia: eesti.ee" class="gallery-image" height="675" src="https://optimizedbyotto.com/post/estonia-well-governed-country/estonia-government-eservices-portal.png" width="1200" /> </p> <h2 id="how-did-estonia-evolve-to-be-like-this"><a class="header-anchor" href="https://optimizedbyotto.com/index.xml#how-did-estonia-evolve-to-be-like-this"></a>How did Estonia evolve to be like this? </h2><p>After Estonia regained its independence after the fall of the Soviet Union in 1991, the first elected government in 1992 was led by a very progressive 31-year-old Prime Minister <a class="link" href="https://en.wikipedia.org/wiki/Mart_Laar" rel="noopener" target="_blank">Mart Laar</a>, who managed to set up some very good policies and laid the foundation of a society that has evolved well in the decades since. Estonia was very lucky to have people in power in the 1990s who didn’t simply copy what other Western countries were doing, but who tried to think about things from first principles and create Estonia’s own model for efficient and fair governance. As a post-Soviet country, the population had also been vaccinated against overly socialist and unrealistic ideals, and everyone had a healthy distrust of the government’s ability to solve problems and emphasis was placed on people’s liberty to work for themselves as they best see fit. The improvement in living standards over the past 35+ years has also been witnessed by the population, and voting behavior supports keeping the country on the same trajectory.</p> <p>General living standards still continue to improve as the <a class="link" href="https://stat.ee/en/news/average-wages-increased-by-56-last-year" rel="noopener" target="_blank">nominal wage growth sits at around 6%</a>, clearly above the <a class="link" href="https://stat.ee/en/news/the-consumer-price-index-was-up-by-31-in-february-year-on-year" rel="noopener" target="_blank">annual inflation rate of about 3%</a>. In 2026, the Estonian <a class="link" href="https://www.eestipank.ee/en/press/economic-forecast-achieving-lasting-growth-economy-needs-confidence-invest-16062026" rel="noopener" target="_blank">economy is expected to grow about 2.4%</a>, which is faster than the EU average. The growth in Estonia is not the result of any accounting tricks - Estonia is part of the euro and can’t print its own currency, nor has it been funding the public sector with excessive debt. With a 24% debt-to-GDP ratio, Estonia consistently ranks as one of the most responsibly managed countries among advanced Western economies.</p> <p>As wages in Estonia soon catch up with the EU average, and higher defence spending has forced the government to raise taxes in recent years, the economic growth that Estonia has enjoyed for 35+ years since it exited the Soviet Union might slow down a bit in future years. The policies that fueled this growth in living standards, however, are likely to stay.</p> <h2 id="the-tiger-leap"><a class="header-anchor" href="https://optimizedbyotto.com/index.xml#the-tiger-leap"></a>The tiger leap </h2><p>There is one specific government policy in Estonia’s history that I think should be highlighted in particular. Estonia was very progressive by announcing the <a class="link" href="https://www.educationestonia.org/tiger-leap/" rel="noopener" target="_blank">Tiigrihüpe</a> (<em>Tiger Leap</em>) program in 1996 with the goal of equipping all schools with computers and teaching all students the basics of programming. This surely had a large influence on why Estonia has so many successful software companies, why the government eServices are so mature that even neighboring countries like Finland are striving to copy the Estonian government’s IT architecture called <a class="link" href="https://e-estonia.com/solutions/interoperability-services/x-road/" rel="noopener" target="_blank"><em>X-road</em></a>.</p> <p>The Tiigrihüpe project was originally suggested in the mid-1990s by <a class="link" href="https://en.wikipedia.org/wiki/Toomas_Hendrik_Ilves" rel="noopener" target="_blank">Toomas Hendrik Ilves</a>, then ambassador of Estonia to the United States, Canada and Mexico, and later President of Estonia in 2006–2016. While he was a psychologist by education, he was also a self-taught amateur programmer and used his political influence to promote sensible adoption of information technology in both Estonia and the EU.</p> <p>The history of Estonia has several prominent figures who were not lawyers by profession but engineers, scientists and historians who were very practical in their political decisions, which I think is now reflected in how government processes were formed.</p> <p>The video below shows how the Estonian government advertises itself and what values they choose to highlight:</p> <div class="video-wrapper"> </div> <h2 id="should-other-countries-adopt-policies-from-estonia"><a class="header-anchor" href="https://optimizedbyotto.com/index.xml#should-other-countries-adopt-policies-from-estonia"></a>Should other countries adopt policies from Estonia? </h2><p>Of course, not everything is perfect in Estonia either. The <a class="link" href="https://stat.ee/en/en/find-statistics/statistics-theme/population/births" rel="noopener" target="_blank">fertility rate of 1.16</a> in Estonia is very low. This trend is present globally, but in Estonia it is way below the EU average. Also, the service culture is something that needs to improve in Estonia. While services are in general fast and efficient, the attitude of people working in cafes and stores does not reflect a willingness to fill in gaps if the standard process falls short, nor are visitors actively made to feel welcome as individual humans, but are treated as mere process inputs.</p> <p>However, many of the things listed earlier I think should be studied by policymakers elsewhere. Societies are complex systems and there is of course no guarantee that copying a single policy to another country with different ethnicities, history and ingrained culture would lead to the same policy outcomes. But <strong>considering that Estonia is a small country without favorable geography and no natural resources</strong>, and that it started out from a place of total chaos, low economic activity and high crime in 1992 to rise to what it is now in 2026, the success it has seen is surely largely a result of good policies, governance and culture that other countries can and should mimic.</p> 2026-07-31T00:00:00+00:00 Otto Kekäläinen https://xana.scru.org/posts/mintings/mergetooling.html <div class="inlinecontent"> <p>The UX of <code>jj</code>'s builtin merge editor finally became too much for me. So, I looked at the list of merge tool options, saw <code>vimdiff</code>, and thought, “Oh, cool, I know how to use vimdiff.” So, I launched <code>jj config edit --user</code>, added a <code>ui</code> section, and set <code>merge-editor</code> to <code>vimdiff</code>. With the new config, I ran <code>jj resolve</code> again. It was at that point that I realized that I do not, in fact, know how to use <code>vimdiff</code>: I only know how to use <code>vimdiff</code> with two buffers. What appeared in my terminal was a 4-pane monstrosity. Why are there four panes? I'm trying to resolve conflicts between only two changes on only one file. For a moment, I nearly go down a rabbit hole, because <a href="https://github.com/jj-vcs/jj/wiki/Vim,-Neovim#using-vim-as-a-diff-tool">this</a> says that by default, <code>vimdiff</code> is “barely useable” [sic]. Should I be installing some addon or a Python script? Apparently there are tradeoffs. I just want to resolve these conflicts without doing line-by-line approvals for how ever many hours that would take.</p> <p>Accordingly, I ran away in terror, installed <code>meld</code>, set <code>merge-editor</code> to meld, and went clicky-clicky in the GUI. I'm not happy using a GUI, but at least it didn't have a mysterious extra buffer to confuse and taunt me.</p> </div> <div class="info"> Posted on 2026-07-30 </div> <div class="info"> Tags: <a href="https://xana.scru.org/tags/mintings%20jujutsu.html" rel="tag" title="All pages tagged 'mintings jujutsu'.">mintings jujutsu</a> </div> 2026-07-30T12:12:12+00:00 C https://www.eyrie.org/~eagle/reviews/books/0-9863735-1-6.html <p>Review: <cite>In the House of Aryaman, a Lonely Signal Burns</cite>, by Elizabeth Bear</p> <table> <tbody><tr> <td>Series:</td> <td>Sub-Inspector Ferron Mysteries #1</td> </tr> <tr> <td>Publisher:</td> <td>Sobbing Squonk Press</td> </tr> <tr> <td>Copyright:</td> <td>2012</td> </tr> <tr> <td>Printing:</td> <td>2018</td> </tr> <tr> <td>ISBN:</td> <td>0-9863735-1-6</td> </tr> <tr> <td>Format:</td> <td>Kindle</td> </tr> <tr> <td>Pages:</td> <td>73</td> </tr></tbody></table> <p> <cite>In the House of Aryaman, a Lonely Signal Burns</cite> is a science fiction police procedural set in relatively near-future India. This novella was originally published in <cite>Asimov's SF</cite> and collected in several anthologies as well as Bear's <cite>Shuggoths in Bloom</cite> collection, which I have on my shelf but have not yet read. I probably should have checked that before I got another copy. It is the first story of a series in the sense that there is an Audible-only sequel available. </p> <p> Like many police procedurals, this one opens with a crime scene. Sub-Inspector Ferron and her partner are inspecting a tube of human meat in the middle of the rug of a luxurious apartment in Bengaluru. The tube is apparently the remains of one Dexter Coffin, an American with a high tech workspace who was apparently mangled beyond recognition in his locked apartment near a table set for two. </p> <p> Dexter's cat is a witness. In this future world of cats enhanced with limited language skills, this would have been very useful, but the cat's memory was apparently wiped. Ferron will have to get to the bottom of the mystery some other way. Also, she apparently now has a new cat. </p> <p> Meanwhile, Ferron is worrying about her partner's mental health, her partner is worrying about her use of stimulants to stay on duty for this murder investigation, and Ferron's mother is harassing her for money to pay the bills of her virtual reality addiction. Her job is a good distraction from other problems she'd rather not deal with. </p> <p> I am trying to come up with something insightful to say about this story, and I'm not having much success. It's a police procedural with a bit of a science fiction twist. The characters are fine but not, at least for me, particularly engaging. There is some deft world-building, but nothing that grabbed my attention or made me desperate to read more stories in this world. </p> <p> Perhaps the most interesting part of the background, and the reason why I picked up this novella, is that this is the universe that eventually becomes the setting of the <a href="https://www.eyrie.org/~eagle/reviews/books/1-5344-0300-0.html">White Space series</a>. There is an early version of right-minding handled entirely through medicine without the later invention of the fox implant, and there are some signs that humanity is slowly digging itself out of the hole of climate change and antisocial behavior that it had dug. I found this mildly interesting, but it doesn't add much to the later series and is very skippable. </p> <p> The source of the title is a bright light originating in the Andromeda galaxy, which is contained in Uttara Bhādrapadā in Vedic astrology. Ferron says this is under the influence of the god Aryaman. This is unrelated to the plot; it's just a background event that prompts some introspective musing from Ferron at the end of the story. It's a nice moment, but I would have been more interested in the full story of first contact between Earth and the Synarche. </p> <p> This was a mildly pleasant way to spend a few hours and I'm already forgetting all of the details. It's a competent story, but not one I feel a need to recommend to others. </p> <p> Followed by <cite>A Blessing of Unicorns</cite>, which appears to be an Audible audiobook exclusive. </p> <p>Rating: 6 out of 10</p> 2026-07-30T03:25:00+00:00 Russ Allbery https://diffoscope.org/news/diffoscope-326-released/ <p>The diffoscope maintainers are pleased to announce the release of diffoscope version <code class="language-plaintext highlighter-rouge">326</code>. This version includes the following changes:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>[ Vagrant Cascadian ] * Add external tool reference for "pedump" to use the "mono" package on GNU guix. </code></pre></div></div> <p>You find out more by <a href="https://diffoscope.org">visiting the project homepage</a>.</p> 2026-07-30T00:00:00+00:00 Reproducible Builds (diffoscope) http://joeyh.name/blog/entry/my_harddrive_is_probably_not_full/ <p>I enjoyed reading this post by Marginalia <a href="https://www.marginalia.nu/log/a_139_hdd/">"Your harddrive is probably full"</a></p> <blockquote> You can construct an entropic argument that there are simply more ways for a harddrive to be full than ways in which it can be empty. </blockquote> <p>Of course it made me check how full my laptop drive is, and indeed it was more than 75% full, as predicted.</p> <p>But, I almost never feel that my hard drive is full. I can very easily free up almost any amount of disk space at any time, without any thought. While writing this blog post, I ran a single command and now my harddrive is 50% empty.</p> <blockquote> The other part of the equation is that a full disk isn’t a problem until it’s so full you can’t put more stuff on it, and at the point it’s so irredeemably cluttered that when you do clean it up, you only have the patience to clean up enough to bide your time, judging the fate of every file on the harddrive is simply too much work. </blockquote> <p>Why doesn't this apply to me? Because I have put in the up-front thought to organize things, so that I never have to do that anymore.</p> <p>I have 3 categories of files that I can remove at any time I need more space, without any thought:</p> <ol> <li>Any files that are stored in git-annex. This is one of git-annex's superpowers; you can <code>git-annex drop</code> any file and stop it using disk space, but the file is still there (as a broken symlink) so you don't risk losing or forgetting about it.</li> <li>Caches.</li> <li>Files in <code>~/tmp/</code>, which is reserved for any files I only want to have a passing acquaintance with. If I'm not comfortable with something being deleted at any time, I don't put it there.</li> </ol> <p>Not only do I only have these 3 categories, these are the <em>only</em> 3 categories for everything except OS files and files I have decided I never want to remove (eg dotfiles and other files stored in git repos).</p> <p>Computer scientists invented caches (and of course cache invalidation is no problem lol) so I only needed to learn about that one. Unix gave me <code>/tmp/</code> as an example that I long ago used as the basis for the rules for my <code>~/tmp/</code>. I hope that git-annex might also serve as an example that moving files between drives is not the best way to manage disk space use.</p> 2026-07-29T17:25:04+00:00 Joey Hess https://www.eyrie.org/~eagle/reviews/books/9798837010774.html <p>Review: <cite>Midlife in Gretna Green</cite>, by Linzi Day</p> <table> <tbody><tr> <td>Series:</td> <td>Midlife Recorder #1</td> </tr> <tr> <td>Publisher:</td> <td>Linzi Day</td> </tr> <tr> <td>Copyright:</td> <td>July 2022</td> </tr> <tr> <td>ISBN:</td> <td>9798837010774</td> </tr> <tr> <td>Format:</td> <td>Kindle</td> </tr> <tr> <td>Pages:</td> <td>464</td> </tr></tbody></table> <p> <cite>Midlife in Gretna Green</cite> is a self-published fantasy novel. It's urban fantasy in the sense that it's set in our world but with magic that most people don't know about, but the primary setting is a parish in rural Scotland and therefore the genre is not urban in that sense. It was Linzi Day's published first novel. </p> <p> As the story opens, Niki McKnight is a widow in Manchester, England with a job in the Register Office she likes, a boss she hates, and a Bichon Frise dog she adores. In the year since her husband Nick died, she's put her life on hold and made as few decisions as possible, despite some concerned pushing from her best friend Aysha. The death of her grandmother is not entirely unexpected, but her inheritance is about to upend her life. </p> <p> Niki assumes that her grandmother has a modest cottage and a small estate, and therefore being the named heir will mostly involve cleaning up the details of a modest life. She is caught by surprise by a requirement in the will that she live in Gretna Green for a year and a day in order to inherit. Her initial reaction is to treat this as an absurd impossibility given her life and job in Manchester, but she slowly realizes something strange is going on. Her grandmother's lawyer is lying to her, he refuses to tell her the value of the estate and seems to think it's more valuable than she expected, and her grandmother's tiny cottage does not seem to be following the seasons of the rest of the world. There is something magical at work. </p> <p> I will not spoil the rest of the reveal. I will say that this is a magical house book because, if you are anything like me, that is why you will want to read this series. There are not enough magical house books, and this is one of the better kind that allow the house to be a full speaking character. </p> <p> <cite>Midlife in Gretna Green</cite> is an unapologetic fantasy of personal agency. Niki starts the novel with a miserable manager, a messy pile of unread mail she doesn't want to deal with, and a lot of personal emotional baggage. She gets handed a position that requires and rewards standing up for herself and being decisive. It comes with a pile of unresolved but not horribly complex problems that were waiting for someone who would listen, make sensible decisions, and treat other people with respect. Oh, and there are a few assholes in the way, but they seriously underestimate the power she has to put a stop to their bullshit. </p> <p> This is the sort of book that traditional publishers tended not to buy (although Day apparently did get an offer for this one and turned it down), and I'm not sure why. Editors thought protagonists should have to work harder for their payoff? Some lingering Calvinist dourness in English language publishing mistrusted triumphant books? Obvious wish fulfillment was considered embarrassing or low-class and thus didn't warrant publication? This didn't apply to the endless <i>bildungsromans</i> about magically talented boys, so some level of sexism was probably in play. Maybe this is finally changing? It reminds me of the bias against romance novels and their guaranteed happily ever after, and in the case of romance there was too much money for publishers to leave it on the table. </p> <p> In any case, the growth of self-publishing has created an alternative market that let these books reach an audience and I for one am here for it. A lot of wish-fulfillment books, and a lot of self-published books, are not very good, but the ones that have a spark of originality and character can be a delight worth tolerating the somewhat rocky editing and pacing problems that a full editorial staff might have cleaned up. </p> <blockquote><p> I loved reading books about kickass women who took no crap and fixed their lives up exactly how they wanted them to be. But how did they get to be that way? They always started out awesome in the books. Seriously, did they kick ass at sixteen? Or did their superpower kickassery not kick in until they were thirty? Forty? If so, then I was screwed. Would I need to wait till I was fifty or until a genie arrived offering wishes? I already felt as if I’d spent my whole life waiting for something wild and wonderful to happen. </p></blockquote> <p> Niki is a Specific Type to a somewhat hilarious degree, and I'm not sure if Day is playing into that intentionally or if she's projecting herself into the book. The amount of self-insertion is not zero: Day also lives in Gretna Green, owns a Bichon Frise, and worked as an assistant registrar and civil celebrant. Niki also drinks wine regularly, has a psychic gift, occasionally reads tarot cards, is an accommodating pushover at work who struggles to say no to her abusive boss, has impostor syndrome problems, and swears by a fictional self-help book about grief that provides the quotes at the starts of chapters. There is a cat, because of course there's a cat. </p> <p> (The fictional self-help book is a spot-on parody played entirely straight in the story. I think Day is having some fun with the reader? I can't tell!) </p> <p> This is what I mean by unapologetic. It's easy to read Niki as a stereotype, but she's a stereotype a lot of real people can identify with and there's something highly satisfying in watching her find her footing. I <em>like</em> wish fulfillment books; it's fun to see someone's wishes come true! Particularly in the year of 2026, there's something immensely satisfying in seeing an ordinary, insecure person get a massive amount of power and use it to make the world better. I don't need everything to be hard, fraught, and laden with costs in fiction, although I wouldn't want every book I read to be like this. </p> <p> Also, the world building is great. It's not polished; there's a bit of a grab bag feeling to it, I'm dubious the magic system has any underlying rigorous rule set, and Niki's powers, once she has access to them, are more of a semi-sentient genie than a skill she has to learn with hard practice. But the magic is <em>fun</em>. The sentient house is one of the best characters, particularly after Niki realizes how underused it has been, and I am a sucker for any good sentient house book. The cat is a far more interesting character than I first thought she would be. And Niki's new magical job is more complicated and less typical than the normal Celtic-inspired fantasy that I thought it was going to be at first. </p> <p> My primary warning about this book is that Niki starts out beaten down and grieving her dead husband, and it took me about five pages to decide that her dead husband was a complete piece of shit who was not worth any of the grief Niki puts into him. She also doesn't stand up for herself for the first hundred pages or so, which made me want to yell at the book a few times. Both of these problems go away farther into the book, and Niki does eventually figure out that Nick was abusive trash, but I was relieved when the "make endless excuses for worthless men" portion of the story was finally over. You have to stick with it until Niki gets brave enough to try being the protagonist; once that happens, it becomes great fun. </p> <p> It is fairly obvious that <cite>Midlife in Gretna Green</cite> was self-published, and I wish it had gotten the editing that it deserved. My copy had a couple of obvious formatting errors, the plot veers about more than was strictly necessary, and I think a careful editing pass could have tightened the writing by about fifty pages or so without losing any important detail. If that sort of thing bothers you, make sure you're in self-published fiction mode before starting this one. But it also has that irrepressible, bubbling-with-ideas feeling of a book where nothing has suppressed the author's enthusiasm. It's a very grabby book; once Niki starts embracing her new life, I could barely put it down. </p> <p> If you're in the mood for a good fantasy wish-fulfillment story that has no romance and a whole lot of "why are things run this way, no, we're changing that," highly recommended. I had so much fun with this book, and the series is currently making the rounds of my whole family. Don't read this when you're looking for something challenging and literary and deep; save it for when you desperately want to watch someone just fix something for once, damn it. </p> <p> Followed by <cite>Painting the Blues in Gretna Green</cite>, which I have already read, breaking my usual rule of writing reviews before reading the next book in a series. </p> <p>Rating: 8 out of 10</p> 2026-07-29T02:19:00+00:00 Russ Allbery http://dirk.eddelbuettel.com/blog/2026/07/28#rcppdate_0.0.7 <p><a href="https://github.com/eddelbuettel/rcppdate">RcppDate</a> ships the featureful <a href="https://github.com/HowardHinnant/date">date</a> library written by <a href="https://github.com/HowardHinnant">Howard Hinnant</a> to enable use from R packages. This header-only modern C++ library has been in pretty wide-spread use for a while now, and adds to C++11, C++14 and C++17 what is (with minor modifications) the ‘date’ library in C++20. The <a href="https://github.com/eddelbuettel/rcppdate">RcppDate</a> package adds no extra R or C++ code and can therefore be a zero-cost dependency for any other project; yet a number of other projects decided to re-vendor it resulting in less-efficient duplication. Oh well. <em>C’est la vie.</em></p> <p>This release syncs with upstream release 3.0.5 made yesterday. We also made two routine updates to the continuous integration since the last release a good year ago. The <a href="https://www.debian.org">Debian</a> and <a href="https://eddelbuettel.github.io/r2u/">r2u</a> packages for this new release have already been uploaded too.</p> <blockquote> <h4 id="changes-in-version-0.0.7-2026-07-27">Changes in version 0.0.7 (2026-07-27)</h4> <ul> <li><p>Updated to upstream version 3.0.5</p></li> <li><p>Regular updates to continuous integration setup</p></li> </ul> </blockquote> <p>Courtesy of my <a href="https://dirk.eddelbuettel.com/cranberries/">CRANberries</a>, there is also a diffstat report for the <a href="https://dirk.eddelbuettel.com/cranberries/2026/07/28#RcppDate_0.0.7">most recent release</a>. More information is available at the <a href="https://github.com/eddelbuettel/rcppdate">repository</a> or the <a href="https://dirk.eddelbuettel.com/code/rcpp.date.html">package page</a>.</p> <p style="font-size: 80%; font-style: italic;"> This post by <a href="https://dirk.eddelbuettel.com">Dirk Eddelbuettel</a> originated on his <a href="https://dirk.eddelbuettel.com/blog/">Thinking inside the box</a> blog. If you like this or other open-source work I do, you can <a href="https://github.com/sponsors/eddelbuettel">sponsor me at GitHub</a>. </p><p></p> 2026-07-28T13:32:00+00:00 Dirk Eddelbuettel http://dirk.eddelbuettel.com/blog/2026/07/27#057_conditionally_quieten_compilers <p>Welcome to post 57 in the <a href="https://dirk.eddelbuettel.com/blog/code/r4"><span class="math inline"><em>R</em>⁴</span></a> series.</p> <p>R packages with compiled codes can use the file <code>src/Makevars</code> to set compilation flags. We often rely on this to set libraries, include directories or compilation options. When using external libraries, be it header-only or via headers and linking, we are often experiencing ‘compilation noise’ when these libraries tickle warnings under generally-recommended flags such as <code>-Wall -pedantic</code>. Two packages I maintain are clearly repeat offenders here: Eigen, and BH. Both cam generate pages and pages of compiler output. This is generally not great as it may hide genuine warnings from our own code.</p> <p>What makes matters worse is that some of the available and specific options for the compilers are treated by <code>R CMD check</code> as ‘non-portable’ leading to a nag on package checking. Examples are <code>-Wno-parentheses</code>, <code>-Wno-maybe-uninitialize</code> or <code>-Wno-nunnull</code>.</p> <p>I have long resorted to adding these to my per-user <code>~/.R/Makevars</code>. When added there, compilation is quieter, but <code>R CMD check</code> still nags <em>here</em> where the option is set but not at <a href="https://cran.r-project.org">CRAN</a> or r-universe. A situation that is not ideal but what somewhat ‘stable’.</p> <p>More recently, I realized there was an available check we can use to <em>conditionally</em> add extra compilation flags but leave them off by default. That makes local development quiet allowing us to focus on the quality of our additions here without noise from third-party libraries we may use. At the same time we do not need to do anything else to let <a href="https://cran.r-project.org">CRAN</a> do its work.</p> <p>The check we now use is whether there is a <code>.git/</code> directory present. If so, we are indeed building from local sources and can add extra flags. If not, we are likely building from a tar.gz source archive—which is the case for CRAN—and hence do not set these.</p> <p>An example use is this recent additional to package <a href="https://github.com/qlcal/qlcal-r">qlcal</a> where this bit of R code is invoked from a minimal shell script <code>configure</code> and replaces the stub <code>@XTRAFLAGS@</code> in <code>src/Makevars.in</code> (or <code>src/Makevars.win.in</code>)</p> <div class="sourceCode" id="cb1"><pre class="sourceCode r"><code class="sourceCode r"><span id="cb1-1"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb1-1" tabindex="-1"></a><span class="cf">if</span> (<span class="fu">dir.exists</span>(<span class="st">".git"</span>)) {</span> <span id="cb1-2"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb1-2" tabindex="-1"></a> <span class="do">## development from a .git directory can use these flags</span></span> <span id="cb1-3"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb1-3" tabindex="-1"></a> xtraflags <span class="ot">&lt;-</span> <span class="st">"-Wno-nonnull -Wno-deprecated-declarations"</span></span> <span id="cb1-4"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb1-4" tabindex="-1"></a>} <span class="cf">else</span> {</span> <span id="cb1-5"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb1-5" tabindex="-1"></a> <span class="do">## else build from tarball so stick with existing flags</span></span> <span id="cb1-6"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb1-6" tabindex="-1"></a> xtraflags <span class="ot">&lt;-</span> <span class="st">""</span></span> <span id="cb1-7"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb1-7" tabindex="-1"></a>}</span> <span id="cb1-8"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb1-8" tabindex="-1"></a>win <span class="ot">&lt;-</span> <span class="cf">if</span> (<span class="fu">Sys.info</span>()[[<span class="st">"sysname"</span>]] <span class="sc">==</span> <span class="st">"Windows"</span>) <span class="st">".win"</span> <span class="cf">else</span> <span class="st">""</span></span> <span id="cb1-9"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb1-9" tabindex="-1"></a>infile <span class="ot">&lt;-</span> <span class="fu">file.path</span>(<span class="st">"src"</span>, <span class="fu">paste0</span>(<span class="st">"Makevars"</span>, win, <span class="st">".in"</span>))</span> <span id="cb1-10"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb1-10" tabindex="-1"></a>outfile <span class="ot">&lt;-</span> <span class="fu">file.path</span>(<span class="st">"src"</span>, <span class="fu">paste0</span>(<span class="st">"Makevars"</span>, win))</span> <span id="cb1-11"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb1-11" tabindex="-1"></a>lines <span class="ot">&lt;-</span> <span class="fu">readLines</span>(infile)</span> <span id="cb1-12"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb1-12" tabindex="-1"></a>lines <span class="ot">&lt;-</span> <span class="fu">gsub</span>(<span class="st">"@XTRAFLAGS@"</span>, xtraflags, lines)</span> <span id="cb1-13"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb1-13" tabindex="-1"></a><span class="fu">writeLines</span>(lines, outfile)</span></code></pre></div> <p>With this change, local compilation is quiet, yet <a href="https://cran.r-project.org">CRAN</a> has nothing to nag about (as seen at the <a href="https://cran.r-project.org/web/checks/check_results_qlcal.html">qlcal results page</a>).</p> <p>Similarly, one can also check from an actual <code>configure</code> file written in autoconf. Here is a similar example from RcppEigen (showing some relevants parts of the whole file)</p> <div class="sourceCode" id="cb2"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb2-1"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-1" tabindex="-1"></a><span class="co"># PKG_CXXFLAGS initialized earlier ...</span></span> <span id="cb2-2"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-2" tabindex="-1"></a></span> <span id="cb2-3"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-3" tabindex="-1"></a><span class="co">## Check if building locally</span></span> <span id="cb2-4"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-4" tabindex="-1"></a><span class="ex">AC_MSG_CHECKING</span><span class="er">(</span><span class="ex">[whether</span> .git/ exists]<span class="kw">)</span></span> <span id="cb2-5"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-5" tabindex="-1"></a><span class="cf">if</span> <span class="bu">test</span> <span class="at">-d</span> <span class="st">"</span><span class="va">$srcdir</span><span class="st">/.git"</span><span class="kw">;</span> <span class="cf">then</span></span> <span id="cb2-6"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-6" tabindex="-1"></a> <span class="ex">AC_MSG_RESULT</span><span class="er">(</span><span class="ex">[yes,</span> adding extra flags]<span class="kw">)</span></span> <span id="cb2-7"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-7" tabindex="-1"></a> <span class="ex">AC_SUBST</span><span class="er">(</span><span class="ex">[PKG_CXXFLAGS],[</span><span class="st">"</span><span class="va">${PKG_CXXFLAGS}</span><span class="st"> -Wno-ignored-attributes -Wno-maybe-uninitialized"</span><span class="ex">]</span><span class="kw">)</span></span> <span id="cb2-8"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-8" tabindex="-1"></a><span class="cf">else</span></span> <span id="cb2-9"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-9" tabindex="-1"></a> <span class="ex">AC_MSG_RESULT</span><span class="er">(</span><span class="ex">[no,</span> consider adding <span class="st">'-Wno-ignored-attributes -Wno-maybe-uninitialized'</span> to ~/.R/Makevars]<span class="kw">)</span></span> <span id="cb2-10"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-10" tabindex="-1"></a><span class="cf">fi</span></span> <span id="cb2-11"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-11" tabindex="-1"></a></span> <span id="cb2-12"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-12" tabindex="-1"></a><span class="ex">AC_SUBST</span><span class="er">(</span><span class="ex">[PKG_CXXFLAGS],</span> <span class="pp">[</span><span class="st">"</span><span class="va">${PKG_CXXFLAGS}</span><span class="st">"</span><span class="pp">]</span><span class="kw">)</span></span> <span id="cb2-13"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-13" tabindex="-1"></a><span class="ex">AC_CONFIG_FILES</span><span class="er">(</span><span class="ex">[src/Makevars]</span><span class="kw">)</span></span> <span id="cb2-14"><a href="https://dirk.eddelbuettel.com/blog/index.rss#cb2-14" tabindex="-1"></a><span class="ex">AC_OUTPUT</span></span></code></pre></div> <p>Once again, with this change compilation is quiet locally, yet unaffected at <a href="https://cran.r-project.org">CRAN</a>. Just what we want. Give it a try in your packages.</p> <p style="font-size: 80%; font-style: italic;"> This post by <a href="https://dirk.eddelbuettel.com">Dirk Eddelbuettel</a> originated on his <a href="https://dirk.eddelbuettel.com/blog/">Thinking inside the box</a> blog. If you like this or other open-source work I do, you can now <a href="https://github.com/sponsors/eddelbuettel">sponsor me at GitHub</a>. </p><p></p> 2026-07-27T22:40:00+00:00 Dirk Eddelbuettel https://jonathancarter.org/2026/07/27/debconf26-santa-fe-argentina/ <p class="wp-block-paragraph">TL;DR: What a great DebConf! I managed to recharge my Debian batteries, and my talks / BoF sessions all went fine. Already looking forward to DebConf in Japan next year!</p> <h2 class="wp-block-heading">DebCamp</h2> <p class="wp-block-paragraph">The evening before DebCamp started, we had a nice bbq (we taught some locals to call it a “braai” at an organiser’s house and went for a walk around the river as the sun set. It was a very peaceful lead-in to DebCamp.</p> <figure class="wp-block-image size-full"><img alt="" class="wp-image-12057" height="450" src="https://jonathancarter.org/files/images/bbq.jpg" width="800" /></figure> <figure class="wp-block-image size-full"><img alt="" class="wp-image-12042" height="452" src="https://jonathancarter.org/files/images/dc26_blog_river.jpg" width="800" /></figure> <ul class="wp-block-list"> <li>I set up and sent out the call for Forky desktop artwork: <ul class="wp-block-list"> <li><a href="https://lists.debian.org/msgid-search/910906f3-7ce4-4884-a49f-4b4a5975471b@debian.org">https://lists.debian.org/msgid-search/910906f3-7ce4-4884-a49f-4b4a5975471b@debian.org</a></li> </ul> </li> <li>Had many nice discussions about various Debian topics with all the Debian people around. It’s really fun being around people who are natural problem solvers who care deeply about both technical and social issues. At one point Jonas told me “Holy shit, these people are motivated!” and I appreciate that so much too!</li> </ul> <figure class="wp-block-image size-large"><img alt="" class="wp-image-12064" height="576" src="https://jonathancarter.org/files/images/ltswine-1024x576.jpg" width="1024" /></figure> <p class="has-text-align-center wp-block-paragraph"><em>Debian LTS wine</em></p> <ul class="wp-block-list"> <li>Most of my DebCamp was dedicated to preparing for my demo and main talk that followed at DebConf.</li> <li>Sadly, we had no loopy this year, I just didn’t have the time, and the people who stepped up to help last year were either overwhelmed with other issues or couldn’t make it. I’ll try to make it happen again for next year by kicking it off long before DC27.</li> </ul> <figure class="wp-block-image size-large"><img alt="" class="wp-image-12059" height="640" src="https://jonathancarter.org/files/images/santafe-1024x640.jpg" width="1024" /></figure> <p class="has-text-align-center wp-block-paragraph"><em>View of Santa Fe city from hotel</em></p> <h2 class="wp-block-heading">DebConf</h2> <h3 class="wp-block-heading">Talk – Is it even possible to build a truly universal system installer?</h3> <p class="wp-block-paragraph">In <a href="https://debconf26.debconf.org/talks/6-is-it-even-possible-to-build-a-truly-universal-system-installer/">this talk</a> I do a very quick comparison of system installers based on my experience with them. It’s hard to directly compare all of them, since there are so many, and each have their own niche that they attempt to satisfy.</p> <p class="wp-block-paragraph">I also introduce <a href="https://salsa.debian.org/yasi-team/yasi-daemon">Yasi</a> – my attempt to answer the question of whether we could build a universal installer, which can also better cover advanced installations, automated installations and niche setups.</p> <p class="wp-block-paragraph">It’s very early days for the project, and I didn’t quite feel ready to share the code with the world, but it was nice that I did a quick demo where I could install a Debian system… and the resulting system actually booted up. *phew*.</p> <p class="wp-block-paragraph">This is also going to be my main focus for the mid-term future. I aim to have all the basic partitioning options working by the time Debian 14 (Forky) is released, and by the time Debian 15 is released, I have a long list of features that I aim to have working. So, my timeline for having something that’s generally useful is around a year from now, and in around 3 years it should be a fully fledged installer that should cover a very large amount of Debian use cases and architectures. </p> <figure class="wp-block-image size-large"><img alt="" class="wp-image-12048" height="646" src="https://jonathancarter.org/files/images/image-30-1024x646.png" width="1024" /></figure> <h3 class="wp-block-heading">Day Trip</h3> <p class="wp-block-paragraph">For the day trip, we did a tour across Santa Fe, visited <a href="https://www.museodelaconstitucion.org/">Constitución de la Nación Argentina</a>, had lunch where we tried various dishes based on local fish from the river, and then went on a boat ride on the river.</p> <figure class="wp-block-image size-full"><img alt="" class="wp-image-12078" height="576" src="https://jonathancarter.org/files/images/churchbells.jpg" width="1024" /></figure> <figure class="wp-block-image size-large"><img alt="" class="wp-image-12090" height="574" src="https://jonathancarter.org/files/images/image-32-1024x574.png" width="1024" /></figure> <figure class="wp-block-image size-large"><img alt="" class="wp-image-12092" height="574" src="https://jonathancarter.org/files/images/image-33-1024x574.png" width="1024" /></figure> <h3 class="wp-block-heading">BoF Sessions:</h3> <p class="wp-block-paragraph"><strong>Funding in Free Software Projects:</strong> I initially registered this BoF because I’m increasingly concerned about how upstreams are asking for donations in their software. I increased the scope to talk about funding in free software in general. It followed Marga’s talk about funding, which focussed more about how developers are funded in general. We didn’t dive very deep into this, but we certainly need some further discussion (and action) on this within Debian.</p> <p class="wp-block-paragraph"><strong>Debian Social Team:</strong> My most important issue for this team is a carry-over from last year, I want to set up <a href="https://pgbarman.org/">barman</a> (packaged in Debian) for live postgres syncing for our larger databases. For the smaller DBs, doing a daily dump is quite cheap. But for Matrix, it’s very expensive in terms if i/o and CPU, so it would be ideal to do less regular complete dumps and use live replication for the first line of redundancy instead.</p> <p class="wp-block-paragraph"><strong>Images Team: </strong>I wasn’t initially planning to say much during this session, I have some ideas to reduce both size and count of images, without losing any benefits, but I don’t have any work to show for that yet. I ended up talking a lot more than I anticipated, the topics covered were quite good and representative of the current state of Debian images built. I don’t have time to create a full summary, so I suggest checking the etherpad / video recording if you’re interested.</p> <figure class="wp-block-image size-full"><img alt="" class="wp-image-12079" height="576" src="https://jonathancarter.org/files/images/cwstablewine.jpg" width="1024" /></figure> <p class="has-text-align-center wp-block-paragraph"><em>Some more wine variety during the conference dinner</em></p> <figure class="wp-block-image size-large"><img alt="" class="wp-image-12066" height="574" src="https://jonathancarter.org/files/images/busyhacklap-1024x574.jpg" width="1024" /></figure> <p class="has-text-align-center wp-block-paragraph"><em>Debianites in the main hacklab</em></p> <h3 class="wp-block-heading">Rosario</h3> <figure class="wp-block-image size-large"><img alt="" class="wp-image-12076" height="574" src="https://jonathancarter.org/files/images/rosario-1-1024x574.jpg" width="1024" /></figure> <p class="wp-block-paragraph">I’m spending two days in Rosario before I head home. Exploring a bit, catching up with sleep, finishing this blog post, signing keys and exploring some ideas I made note of during DebConf.</p> <h3 class="wp-block-heading">Thank you to the DebConf26 Team!</h3> <figure class="wp-block-image size-large"><img alt="" class="wp-image-12073" height="574" src="https://jonathancarter.org/files/images/dc-team-1024x574.jpg" width="1024" /></figure> <p class="wp-block-paragraph">It was a little surreal not being part of any DebConf team for the first time ever, I’ve just been too focussed on getting Yasi ready for my talk (no regrets!). I hope to be more involved again next year, in the meantime, I’m very grateful to everyone who has made this happen, you did a stellar job! I hope to see many of you again next year in Japan!</p> 2026-07-27T20:12:18+00:00 jonathan https://blog.trueelena.org/blog/2026/07/27-late_victorian_vampire_shirt/index.html <article> <section class="header"> Posted on July 27, 2026 <br /> Tags: <a href="https://blog.trueelena.org/tags/madeof%3Aatoms.html" title="All pages tagged 'madeof:atoms'.">madeof:atoms</a>, <a href="https://blog.trueelena.org/tags/craft%3Asewing.html" title="All pages tagged 'craft:sewing'.">craft:sewing</a>, <a href="https://blog.trueelena.org/tags/FreeSoftWear.html" title="All pages tagged 'FreeSoftWear'.">FreeSoftWear</a> </section> <section> <p><img alt="A woman wearing an old-style white shirt with lots of fullness, wide and long sleeves and ruffles at the collar that spread out framing the neck, down the center front to underbust height, covering the slit and at the cuffs, reaching to mid-hand. The shirt is gathered at the waist with a belt, and worn over the bottom garment to show that it reaches to mid tight. Drama levels in the pose are pretty low." class="align-center" src="https://blog.trueelena.org/blog/2026/07/27-late_victorian_vampire_shirt/vampire_shirt.jpg" style="width: 80.0%;" /></p> <p>The recurring joke is that because of some health issues, in summer I dress like a Victorian Vampire.</p> <p>But how would an actual Late Victorian Vampire dress? Picture her, she would look like some kind of eccentric gentlewoman, as vampires usually do, probably with a style that is a bit conservative, rather than following the latest fashions.</p> <p><img alt="Same woman, same shirt, posing as a vampire ready to attack a victim. Drama levels increasing." class="align-center" src="https://blog.trueelena.org/blog/2026/07/27-late_victorian_vampire_shirt/vampire_attack.jpg" style="width: 80.0%;" /></p> <p>Now, she wouldn’t probably wear men’s shirts. But what if she was a lesbian<a class="footnote-ref" href="https://blog.trueelena.org#fn1" id="fnref1">¹</a> vampire? Wouldn’t she need a fancy, frilly shirt to go with her tailored cycling suit when she’s out seducing the more active ladies in the neighbourhood?</p> <p>Or maybe not. It’s not making a lot of sense, is it? But <em>I</em> do have a lot of shirt fabric in my stash<a class="footnote-ref" href="https://blog.trueelena.org#fn2" id="fnref2">²</a>, and I could use a few more shirts that were practical and comfortable, but also somewhat over the top.</p> <p>For the practical and comfortable I went to my trusted <a href="https://sewing-patterns.trueelena.org/historical_menswear/shirts/1880s_shirt/index.html">1880s shirt</a>, while for the over the top part I looked at inspiration from the earlier 18th century frilly shirts, and their later imitations.</p> <p>I decided to use some nice cotton batiste I had bought quite a few years ago to make one of my first historically inspired shirtwaists: I may have a tendency to buy a bit more fabric than actually needed by the pattern, but that’s what everybody does, right?</p> <p>For the ruffles I decided to use a lighter weight cotton voile, also from the stash.</p> <p><img alt="the top edge of a ruffle being whipstitched over some gathered fabric; the rest of the unfinished shirt is visible in the background." class="align-center" src="https://blog.trueelena.org/blog/2026/07/27-late_victorian_vampire_shirt/attaching_fronts.jpg" style="width: 80.0%;" /></p> <p>At the front, I wanted the ruffle to be inserted in the yoke, but I was also whipstitching the gathers to it to make them neater, so I started bu attaching the yoke lining to the gathered front, then I whipstitched the ruffle to the front, catching each gather, and finally I whipstitched the other yoke on the ruffle and the rest of the gathered front.</p> <p><img alt="The front of a shirt: the body was gathered into a yoke, but it has been unpicked and pulled out to extend a bit past the end of it, into where the collar will be sewn." class="align-center" src="https://blog.trueelena.org/blog/2026/07/27-late_victorian_vampire_shirt/unpicking_unpicking.jpg" style="width: 80.0%;" /></p> <p>And then after sewing the collar, I realized that this way the slit would have remained open in the front (or the collar too narrow), so I had to unpick the front part of the yoke, and sew it again, this time leaving an excess of fabric as wide as half the placket width from the pattern, to be sewn directly in the collar band.</p> <p>From then, things progressed smoothly, with some interruptions, until I got to the first sleeve, which I failed to insert twice, as one does.</p> <p><img alt="The same shirt worn without the ruffle at the collar, with just what looks like a mandarin collar, closed with a clip with an amethyst. Drama levels have gone way down." class="align-center" src="https://blog.trueelena.org/blog/2026/07/27-late_victorian_vampire_shirt/without_collar.jpg" style="width: 80.0%;" /></p> <p>On the third attempt, with a different method, I succeeded, I tried the shirt on, and it already felt <em>extra</em>.</p> <p><img alt="Close up of the collar on a table: at the center back of the shirt collar there is a buttonhole, and a double button is used to keep the detached collar in place, while at the front both the shirt collar and the detached collar have buttonholes." class="align-center" src="https://blog.trueelena.org/blog/2026/07/27-late_victorian_vampire_shirt/detachable_collar.jpg" style="width: 80.0%;" /></p> <p>But it could be even <em>more</em> extra. With some ruffles also at the collar.</p> <p><img alt="Same close up, but now the collar has been closed with a clip-on earring with an amethyst and some small fake clear stones, and it looks as if the skirt had a ruffle collar and a jewel button (or a pin)." class="align-center" src="https://blog.trueelena.org/blog/2026/07/27-late_victorian_vampire_shirt/collar_closed.jpg" style="width: 80.0%;" /></p> <p>The shirt had been made with a simple collar band, and I could have just added the ruffle to it, but I also wanted to be able to wear it with other detachable collars, so I decided to make another collar band with ruffles, to wear on top.</p> <p>And that was mostly it, except for the reinforcement patches at the side seams and cuffs: I love having them, because they make the seam end neater and stronger, but they are a bit of a hassle to make, so they got postponed a few days.</p> <p><img alt="Same woman and shirt, back with the ruffled collar, in a pose like that of an artist that is fainting for futile reasons. Drama levels over the top." class="align-center" src="https://blog.trueelena.org/blog/2026/07/27-late_victorian_vampire_shirt/overdramatic.jpg" style="width: 80.0%;" /></p> <p>But finally, the shirt was done.</p> <p>And I tried it on, and it was good.</p> <p>But now I really need a pair of cycling breeches, don’t I?</p> <section class="footnotes footnotes-end-of-document"> <hr /> <ol> <li id="fn1"><p>ok, maybe straight passing bi? anyway.<a class="footnote-back" href="https://blog.trueelena.org#fnref1">↩︎</a></p></li> <li id="fn2"><p>I have <em>no idea</em> how they got there.<a class="footnote-back" href="https://blog.trueelena.org#fnref2">↩︎</a></p></li> </ol> </section> </section> </article> 2026-07-27T00:00:00+00:00 Elena “of Valhalla” http://dirk.eddelbuettel.com/blog/2026/07/25#rcpparmadillo_15.4.2-1 <p><img alt="armadillo image" src="https://dirk.eddelbuettel.com/images/armadillo_logo_two.png" style="float: left; margin: 10px 10px 10px 0;" /></p> <p><a href="https://arma.sourceforge.net/">Armadillo</a> is a powerful and expressive C++ template library for linear algebra and scientific computing. It aims towards a good balance between speed and ease of use, has a syntax deliberately close to Matlab, and is useful for algorithm development directly in C++, or quick conversion of research code into production environments. <a href="https://dirk.eddelbuettel.com/code/rcpp.armadillo.html">RcppArmadillo</a> integrates this library with the <a href="https://www.r-project.org">R</a> environment and language–and is widely used by (currently) 1293 other packages on <a href="https://cran.r-project.org">CRAN</a>, downloaded 47.8 million times (per the partial logs from the cloud mirrors of CRAN), and the <a href="https://doi.org/10.1016/j.csda.2013.02.005">CSDA paper</a> (<a href="https://cran.r-project.org/package=RcppArmadillo/vignettes/RcppArmadillo-intro.pdf">preprint / vignette</a>) by Conrad and myself has been cited 710 times according to Google Scholar.</p> <p>This versions updates to the 15.4.2 upstream <a href="https://arma.sourceforge.net/">Armadillo</a> release made this week, as well as to included 15.4.1 version we released only to GitHub and r-universe so do not exceed the (roughly) monthly cadence. For this release, we had run the usual complete reverse-dependency check which came back spotless, and did CRAN so no email exchange needed despite nearly 1300 reverse dependencies. Automation can be helpful when used with a well-maintained software stack. The package has also already been updated for <a href="https://www.debian.org">Debian</a>, built for <a href="https://eddelbuettel.github.io/r2u/">r2u</a>, and will build shortly at <a href="https://cran.r-project.org">CRAN</a> for the different binary releases.</p> <p>All changes since the last CRAN release follow.</p> <blockquote> <h4 id="changes-in-rcpparmadillo-version-15.4.2-1-2026-07-25">Changes in RcppArmadillo version 15.4.2-1 (2026-07-25)</h4> <ul> <li><p>Upgraded to Armadillo release 15.4.2 (Medium Roast Agave)</p> <ul> <li>Fix speed regressions in <code>diagvec()</code> and <code>diagmat()</code></li> </ul></li> </ul> <h4 id="changes-in-rcpparmadillo-version-15.4.1-1-github-only-2026-07-09">Changes in RcppArmadillo version 15.4.1-1 [github-only] (2026-07-09)</h4> <ul> <li><p>Upgraded to Armadillo release 15.4.1 (Medium Roast Agave)</p> <ul> <li><p>Fix for rare infinite recursion bug in sparse version of <code>diagmat()</code></p></li> <li><p>More efficient checks for aliasing</p></li> </ul></li> </ul> </blockquote> <p>Courtesy of my <a href="https://dirk.eddelbuettel.com/cranberries/">CRANberries</a>, there is a <a href="https://dirk.eddelbuettel.com/cranberries/2026/07/25#RcppArmadillo_15.4.2-1">diffstat report</a> relative to previous release. More detailed information is on the <a href="https://dirk.eddelbuettel.com/code/rcpp.armadillo.html">RcppArmadillo page</a>. Questions, comments etc should go to the <a href="https://lists.r-forge.r-project.org/cgi-bin/mailman/listinfo/rcpp-devel">rcpp-devel mailing list</a> off the <a href="https://r-forge.r-project.org/projects/rcpp/">Rcpp R-Forge</a> page.</p> <p style="font-size: 80%; font-style: italic;"> This post by <a href="https://dirk.eddelbuettel.com">Dirk Eddelbuettel</a> originated on his <a href="https://dirk.eddelbuettel.com/blog/">Thinking inside the box</a> blog. If you like this or other open-source work I do, you can <a href="https://github.com/sponsors/eddelbuettel">sponsor me at GitHub</a>. </p><p></p> 2026-07-25T20:56:00+00:00 Dirk Eddelbuettel https://00formicapunk00.wordpress.com/2026/07/24/opensource-gaming-with-nouveau-nvidia-driver/ <p class="wp-block-paragraph">So it will not play cyberpunk 2077, but if you prefer opensource drivers for your hardware, nouveau is certainly an option for some opensource gaming.</p> <p class="wp-block-paragraph">Using kernel 7.0 from debian backports, I could run opensource classics requiring 3D acceleration flawlessly with nouveau:</p> <ul class="wp-block-list"> <li>Supertux (<a href="https://screenshots.debian.net/package/supertux">Debian package</a>)</li> <li>SuperTux Kart (<a href="https://screenshots.debian.net/package/supertuxkart">Debian package</a>)</li> <li>LibreQuake (<a href="https://flathub.org/en/apps/io.github.lavenderdotpet.LibreQuake">Flatpak</a> with ironquake engine, Full HD and 60 fps)</li> </ul> <p class="wp-block-paragraph">I would like to highlight here how good is LibreQuake.<br />It is an horror cosmic 3D shooter, using the Quake engine, but with newly made game assets under the GPL, thus creating a 100% opensource Quake-based first person shooter. Although their documentation mentions it is a work in progress, as of 2026 I find it very much of a finished product.<br /><br /><img alt="LibreQuake Screenshot" class="wp-image-347" height="1067" src="https://00formicapunk00.wordpress.com/wp-content/uploads/2026/07/librequake-dismalshores.png" style="width: 1024px;" width="1911" /></p> <p class="wp-block-paragraph"><em>Dismal shores, my preferred game level.</em><br /><br />I missed Quake in the 90s, happy to discover such a classic today.</p> <p class="wp-block-paragraph"></p> 2026-07-24T15:31:24+00:00 Manu https://etbe.coker.com.au/2026/07/24/systemd-linger/ <h2>Killing Processes</h2> <p>One of the features of systemd that is most controversial is the option to kill user processes when the user logs out. That initially killed screen/tmux/nohup processes too. In recent Debian releases the default configuration of systemd-logind (the login manager for systemd) is to allow processes to keep running, the configuration file <b>/etc/systemd/logind.conf</b> has an option <b>KillUserProcesses</b> that can be enabled to have user processes killed. If you do that then there are options to only kill processes for certain users and to exclude some users (default to excluding root). If using that option you can apparently use a systemd unit to start screen which prevents it being killed on logout.</p> <p>This is a very handy feature for some particular user cases. One situation was that I was supporting some people who weren’t very good at computers on a system running KDE and some KDE processes would linger. So the option of logout and login again to deal with an issue of akonadi or some other KDE service misbehaving didn’t work. On that system I enabled the option to kill user processes which reduced the number of problems they had while not requiring rebooting.</p> <p>It is widely believed that the “linger” feature is required to allow screen/tmux/nohup to work, in Debian (and probably most distributions) that is not the case. It might be that some combinations of configuration requires “linger” to allow screen/tmux to work but I am not interested in trying to discover them. Of all the people I have directly supported for Linux desktop use (which numbers in the hundreds) none of them have had the ability to use screen/tmux and also the cluelessnes that makes me want to automatically kill their processes when the logout.</p> <h2>Controlling Linger</h2> <p>You can enable and disable “linger” for your own account with the following commands if polkit is installed and in a typical configuration:</p> <pre>loginctl enable-linger loginctl disable-linger</pre> <p>If running as root you can enable and disable it for another user with the following commands:</p> <pre>loginctl enable-linger $ACCOUNT loginctl disable-linger $ACCOUNT</pre> <p>There doesn’t seem to be any documented way of discovering if an account has linger enabled or for listing accounts that have it, it seems that “<b>ls /var/lib/systemd/linger</b>” is the only option.</p> <h2>Linger on Debian</h2> <p>On a Debian system with close to default settings the processes won’t be killed on logout and the only difference “linger” makes is to start programs in the user’s context BEFORE they login. A friend was recently testing out a bunch of LLM programs on one of my servers and the account he used for that ended up with “linger” enabled, presumably one of the install scripts he ran was written on the assumption that enabling linger was necessary for nohup to work and it did so automatically without being asked.</p> <p>One benefit I’ve found from this behaviour is on my laptop. I’m currently testing out new SE Linux policy on my laptop and rebooting it a lot. When I enabled linger on my account it caused the laptop to connect to wifi on boot without needing to login which is convenient. I can then ssh to it even when the X11/Wayland login configuration is broken.</p> <p>I will leave it enabled after finishing these tests. Having background processes like Pipewire and Bluetooth start before I login will presumably make things slightly faster when I do login.</p> <div class="yarpp yarpp-related yarpp-related-rss yarpp-template-list"> <p>Related posts:</p><ol> <li><a href="https://etbe.coker.com.au/2015/01/13/systemd-notes/" rel="bookmark" title="Systemd Notes">Systemd Notes</a> <small>A few months ago I gave a lecture about systemd...</small></li> <li><a href="https://etbe.coker.com.au/2016/02/25/ethernet-naming-systemd/" rel="bookmark" title="Ethernet Interface Naming With Systemd">Ethernet Interface Naming With Systemd</a> <small>Systemd has a new way of specifying names for Ethernet...</small></li> <li><a href="https://etbe.coker.com.au/2026/05/09/systemd-mobile-linux-containers/" rel="bookmark" title="Systemd, Mobile Linux, and Containers">Systemd, Mobile Linux, and Containers</a> <small>I’ve had some problems running apps I want on my...</small></li> </ol> </div> 2026-07-24T07:48:23+00:00 etbe https://www.freexian.com/blog/debian-lts-report-2026-06/ <img src="https://www.freexian.com/images/debian-lts-logo.png" style="float: right;" /> <p>The Debian LTS Team, funded by [Freexian’s Debian LTS offering] (<a href="https://www.freexian.com/lts/debian/%29">https://www.freexian.com/lts/debian/)</a>, is pleased to report its activities for June.</p> <h3 id="activity-summary">Activity summary</h3> <p>During the month of June, 20 contributors have been paid to work on <a href="https://wiki.debian.org/LTS">Debian LTS</a> (links to individual contributor reports are located below).</p> <p>The team released <a href="https://lists.debian.org/debian-lts-announce/2026/06/threads.html">48 DLAs</a> fixing 231 CVEs.</p> <p><a href="https://www.debian.org/releases/bookworm/">Debian 12 (“bookworm”)</a> has been handed over to the LTS Team on June 11th. During this handover Sylvain helped to update relevant tools and documentation. If you benefit from Debian, especially during the full 5-year lifecycle, please consider subscribing as a sponsor of Debian LTS: <a href="https://www.freexian.com/lts/debian/">https://www.freexian.com/lts/debian/</a>.</p> <p>Moreover, Debian 11 (“bullseye”) will reach the end of the Debian LTS period on August 31st. After that, Freexian will continue the security support under the <a href="https://www.freexian.com/lts/extended/">Extended LTS</a> offer.</p> <p>The team published several notable updates:</p> <ul> <li>haveged update (<a href="https://security-tracker.debian.org/tracker/DLA-4616-1">DLA-4616-1</a>), prepared by Thorsten, to address local privilege escalation.</li> <li>tomcat9 update (<a href="https://security-tracker.debian.org/tracker/DLA-4619-1">DLA-4619-1</a>), prepared by Markus, to address, among others, an authentication bypass.</li> <li>apache2 update (<a href="https://security-tracker.debian.org/tracker/DLA-4620-1">DLA-4620-1</a>), prepared by Bastien, to address a HTTP/2 bomb.</li> <li>apache2 update (<a href="https://security-tracker.debian.org/tracker/DLA-4629-1">DLA-4629-1</a>), prepared by Bastien, to address, among others, remote code execution and privilege escalation.</li> <li>libinput update (<a href="https://security-tracker.debian.org/tracker/DLA-4626-1">DLA-4626-1</a>), prepared by Santiago, to address local privilege escalation and arbitrary code execution.</li> <li>asterisk update (<a href="https://security-tracker.debian.org/tracker/DLA-4631-1">DLA-4631-1</a>), prepared by Thorsten, to address, among others, wrong processing of invalid or untrusted certificates.</li> <li>nginx update (<a href="https://security-tracker.debian.org/tracker/DLA-4634-1">DLA-4634-1</a>), prepared by Charles, to address a remote code execution and denial of service.</li> <li>firefox-esr update (<a href="https://security-tracker.debian.org/tracker/DLA-4635-1">DLA-4635-1</a>), prepared by Emilio, to address dozens of CVEs, among other things, related to arbitrary code execution and privilege escalation.</li> <li>thunderbird update (<a href="https://security-tracker.debian.org/tracker/DLA-4636-1">DLA-4636-1</a>), prepared by Emilio, to address dozens of CVEs, among other things, related to arbitrary code execution.</li> <li>chromium update (<a href="https://security-tracker.debian.org/tracker/DLA-4654-1">DLA-4654-1</a>), prepared by Emilio, to address dozens of CVEs, among other things, related to arbitrary code execution.</li> </ul> <p>Contributions from outside the LTS Team:</p> <p>We are greatly thankful for the contributions from people outside the LTS Team:</p> <ul> <li>Salvatore Bonaccorso prepared a libhttp-daemon-perl update, that was released by Santiago as <a href="https://security-tracker.debian.org/tracker/DLA-4639-1">DLA-4639-1</a>.</li> <li>Salvatore also directly uploaded libgd-perl <a href="https://security-tracker.debian.org/tracker/DLA-4638-1">DLA-4638-1</a> and libconfig-inifiles-perl <a href="https://security-tracker.debian.org/tracker/DLA-4637-1">DLA-4637-1</a>.</li> <li>Peter Palfrader prepared a tor update, that was released by Santiago as <a href="https://security-tracker.debian.org/tracker/DLA-4656-1">DLA-4656-1</a>.</li> <li>Pieter Lenaerts prepared a beets update, that was released by Emmanuel as <a href="https://security-tracker.debian.org/tracker/DLA-4641-1">DLA-4641-1</a>.</li> <li>Noah Meyerhans prepared a cloud-init update <a href="https://security-tracker.debian.org/tracker/DLA-4645-1">DLA-4645-1</a>.</li> </ul> <p>The LTS Team has also contributed with updates to the latest Debian releases:</p> <ul> <li>Besides publishing <a href="https://security-tracker.debian.org/tracker/DLA-4642-1">DLA-4642-1</a> for package u-boot Andreas also prepared an NMU for an upload to sid and prepared a stable-proposed-update (SPU) bug for <a href="https://bugs.debian.org/1140663">trixie</a>, which was already acknowledged by a stable release manager (SRM).</li> <li>Andreas also prepared an upload of package atril for trixie, which was handled by the security team as <a href="https://lists.debian.org/debian-security-announce/2026/msg00260.html">DSA-6349-1</a>.</li> <li>Besides publishing <a href="https://security-tracker.debian.org/tracker/DLA-4620-1">DLA-4620-1</a> for package apache Bastien also prepared an upload for trixie, which was handled by the security team as <a href="https://lists.debian.org/debian-security-announce/2026/msg00234.html">DSA-6323-1</a>.</li> <li>Tobi uploaded package mesa to <a href="https://bugs.debian.org/1140473">trixie</a> and <a href="https://bugs.debian.org/1140495">bookworm</a>.</li> <li>Thorsten fixed some (not security related but RC) issues in package dahdi-linux. This was in preparation to fix lots of security issues in asterisk. Unfortunately the maintainer ignored the corresponding debdiff and prefered to upload a new upstream version. Anyway, the concerns of the security team about security support of asterisk could be overcome and asterisk can migrate to tesing and again be part of a Debian release.</li> </ul> <h3 id="individual-debian-lts-contributor-reports">Individual Debian LTS contributor reports</h3> <ul> <li><a href="https://people.debian.org/~abhijith/reports/LTS_ELTS-June-2026.txt">Abhijith PA</a></li> <li><a href="https://lists.debian.org/debian-lts/2026/06/msg00065.html">Andreas Henriksson</a></li> <li><a href="https://lists.debian.org/debian-lts/2026/06/msg00058.html">Arnaud Rebillout</a></li> <li><a href="https://lists.debian.org/debian-lts/2026/07/msg00006.html">Bastien Roucariès</a></li> <li><a href="https://www.decadent.org.uk/ben/blog/2026/07/01/foss-activity-in-june-2026.html">Ben Hutchings</a></li> <li><a href="https://lists.debian.org/debian-lts/2026/07/msg00021.html">Carlos Henrique Lima Melara</a></li> <li><a href="https://chris-lamb.co.uk/posts/free-software-activities-in-june-2026">Chris Lamb</a></li> <li><a href="https://lists.debian.org/debian-lts/2026/07/msg00007.html">Daniel Leidert</a></li> <li><a href="https://lists.debian.org/debian-lts/2026/07/msg00000.html">Emmanuel Arias</a></li> <li><a href="https://people.debian.org/~pochu/lts/reports/2026-06.txt">Emilio Pozuelo Monfort</a></li> <li><a href="https://lists.debian.org/msgid-search/?m=ft1Z8V9o2E3C8iOv@debian.org">Guilhem Moulin</a></li> <li><a href="https://lists.debian.org/msgid-search/akULnNGyjIvjKHX2@mpd">Jochen Sprickerhof</a></li> <li><a href="https://lists.debian.org/debian-lts/2026/07/msg00014.html">Lee Garrett</a></li> <li><a href="https://people.debian.org/~kanashiro/debian/lts/reports/2026-06.txt">Lucas Kanashiro</a></li> <li><a href="https://dl.gambaru.de/blog/202606_LTS_ELTS_report.txt">Markus Koschany</a></li> <li><a href="https://people.debian.org/~santiago/lts-elts-reports/report-2026-06.txt">Santiago Ruano Rincón</a></li> <li><a href="https://lists.debian.org/debian-lts/2026/07/msg00004.html">Sylvain Beucler</a></li> <li><a href="https://blog.alteholz.eu/2026/07/my-debian-activities-in-june-2026/">Thorsten Alteholz</a></li> <li><a href="https://lists.debian.org/debian-lts/2026/06/msg00047.html">Tobias Frost</a></li> <li><a href="https://utkarsh2102.org/posts/foss-in-june-26/">Utkarsh Gupta</a></li> </ul> <h3 id="thanks-to-our-sponsors">Thanks to our sponsors</h3> <p>Sponsors that joined recently are in bold.</p> <ul> <li>Platinum sponsors: <ul> <li><a href="https://www.global.toshiba/ww/top.html">Toshiba Corporation</a> (for 129 months)</li> <li><a href="https://cip-project.org">Civil Infrastructure Platform (CIP)</a> (for 97 months)</li> <li><a href="https://vyos.io">VyOS Inc</a> (for 61 months)</li> </ul> </li> <li>Gold sponsors: <ul> <li><a href="https://www.roche.com/about/business/diagnostics.htm">F. Hoffmann-La Roche AG</a> (for 139 months)</li> <li><a href="https://www.conet.de/">CONET Deutschland GmbH</a> (for 123 months)</li> <li><a href="http://www.ox.ac.uk">University of Oxford</a> (for 79 months)</li> <li><a href="https://www.edf.fr">EDF SA</a> (for 51 months)</li> <li><a href="https://www.dataport.de">Dataport AöR</a> (for 26 months)</li> <li><a href="https://home.cern/">CERN</a> (for 24 months)</li> </ul> </li> <li>Silver sponsors: <ul> <li><a href="https://domainnameshop.com/">Domeneshop AS</a> (for 144 months)</li> <li><a href="https://metropole.nantes.fr/">Nantes Métropole</a> (for 138 months)</li> <li><a href="https://www.akamai.com/">Akamai - Linode</a> (for 133 months)</li> <li><a href="http://www.univention.de">Univention GmbH</a> (for 130 months)</li> <li><a href="http://portail.univ-st-etienne.fr/">Université Jean Monnet de St Etienne</a> (for 130 months)</li> <li><a href="https://ribboncommunications.com/">Ribbon Communications, Inc.</a> (for 124 months)</li> <li><a href="https://www.exonet.nl">Exonet B.V.</a> (for 114 months)</li> <li><a href="https://www.lrz.de">Leibniz Rechenzentrum</a> (for 108 months)</li> <li><a href="https://www.diplomatie.gouv.fr">Ministère de l’Europe et des Affaires Étrangères</a> (for 92 months)</li> <li><a href="https://dinahosting.com">Dinahosting SL</a> (for 79 months)</li> <li><a href="https://upsun.com">Upsun Formerly Platform.sh</a> (for 73 months)</li> <li><a href="https://www.moxa.com">Moxa Inc.</a> (for 67 months)</li> <li><a href="https://sipgate.de">sipgate GmbH</a> (for 65 months)</li> <li><a href="https://ovhcloud.com">OVH US LLC</a> (for 63 months)</li> <li><a href="https://www.tilburguniversity.edu/">Tilburg University</a> (for 63 months)</li> <li><a href="https://www.gsi.de">GSI Helmholtzzentrum für Schwerionenforschung GmbH</a> (for 54 months)</li> <li><a href="https://www.cesky-hosting.cz/">THINline s.r.o.</a> (for 27 months)</li> <li><a href="https://www.cph.dk">Copenhagen Airports A/S</a> (for 21 months)</li> <li><a href="https://www.isere.fr">Conseil Départemental de l’Isère</a> (for 7 months)</li> </ul> </li> <li>Bronze sponsors: <ul> <li><a href="http://www.evolix.fr">Evolix</a> (for 144 months)</li> <li><a href="http://www.seznam.cz">Seznam.cz, a.s.</a> (for 144 months)</li> <li><a href="http://intevation.de">Intevation GmbH</a> (for 141 months)</li> <li><a href="http://linuxhotel.de">Linuxhotel GmbH</a> (for 141 months)</li> <li><a href="https://waays.fr">Daevel SARL</a> (for 140 months)</li> <li><a href="http://www.megaspace.de">Megaspace Internet Services GmbH</a> (for 139 months)</li> <li><a href="http://www.greenbone.net">Greenbone AG</a> (for 138 months)</li> <li><a href="http://numlog.fr">NUMLOG</a> (for 138 months)</li> <li><a href="http://www.wingo.ch/">WinGo AG</a> (for 137 months)</li> <li><a href="https://www.entrouvert.com/">Entr’ouvert</a> (for 129 months)</li> <li><a href="https://adfinis.com">Adfinis AG</a> (for 126 months)</li> <li><a href="https://www.plathome.com">Plat’Home</a> (for 122 months)</li> <li><a href="http://www.legi.grenoble-inp.fr">Laboratoire LEGI - UMR 5519 / CNRS</a> (for 121 months)</li> <li><a href="https://www.tesorion.nl/">Tesorion</a> (for 121 months)</li> <li><a href="http://bearstech.com">Bearstech</a> (for 112 months)</li> <li><a href="http://lihas.de">LiHAS</a> (for 112 months)</li> <li><a href="http://www.catalyst.net.nz">Catalyst IT Ltd</a> (for 107 months)</li> <li><a href="https://demarcq.net">Demarcq SAS</a> (for 101 months)</li> <li><a href="https://www.univ-grenoble-alpes.fr">Université Grenoble Alpes</a> (for 87 months)</li> <li><a href="https://www.touchweb.fr">TouchWeb SAS</a> (for 79 months)</li> <li><a href="https://www.spin-ag.de">SPiN AG</a> (for 76 months)</li> <li><a href="https://www.corefiling.com">CoreFiling</a> (for 72 months)</li> <li><a href="https://www.osug.fr/">Observatoire des Sciences de l’Univers de Grenoble</a> (for 63 months)</li> <li><a href="https://www.werfen.com">Tem Innovations GmbH</a> (for 58 months)</li> <li><a href="https://wordfinder.pro">WordFinder.pro</a> (for 57 months)</li> <li><a href="https://www.resif.fr">CNRS DT INSU Résif</a> (for 56 months)</li> <li><a href="https://www.soliton.co.jp">Soliton Systems K.K.</a> (for 51 months)</li> <li><a href="https://www.alterway.fr">Alter Way</a> (for 49 months)</li> <li><a href="http://www.sobis.com/">SOBIS Software GmbH</a> (for 24 months)</li> <li><a href="https://www.tuxera.com">Tuxera Inc.</a> (for 15 months)</li> <li><a href="https://opm-op.com">OPM-OP AS</a> (for 7 months)</li> <li><strong><a href="https://www.lu-cix.lu">LU-CIX Management G.I.E.</a></strong></li> </ul> </li> </ul> 2026-07-22T00:00:00+00:00 Thorsten Alteholz http://dirk.eddelbuettel.com/blog/2026/07/21#qlcal-r_0.1.3 <p>The twenty-first release of the <a href="https://dirk.eddelbuettel.com/code/qlcal-r.html">qlcal</a> package arrivied at <a href="https://cran.r-project.org">CRAN</a> just now, and has been built for <a href="https://eddelbuettel.github.io/r2u/">r2u</a>. It comes a week after the <a href="https://dirk.eddelbuettel.com/blog/2026/07/14#qlcal-r_0.1.2">0.1.2 release</a>.</p> <p><a href="https://dirk.eddelbuettel.com/code/qlcal-r.html">qlcal</a> delivers the calendaring parts of <a href="https://www.quantlib.org">QuantLib</a>. It is provided (for the R package) as a set of included files, so the package is self-contained and does not depend on an external <a href="https://www.quantlib.org">QuantLib</a> library (which can be demanding to build). <a href="https://dirk.eddelbuettel.com/code/qlcal-r.html">qlcal</a> covers over seventy country / market calendars and can compute holiday lists, its complement (<em>i.e.</em> business day lists) and much more. Examples are in the README at the <a href="https://github.com/qlcal/qlcal-r">repository</a>, the <a href="https://dirk.eddelbuettel.com/code/qlcal-r.html">package page</a>, and course at the <a href="https://cran.r-project.org/package=qlcal">CRAN package page</a>.</p> <p>This releases includes a one-line fix we also sent <a href="https://github.com/lballabio/QuantLib/pull/2662">upstream as a now-merged PR</a>: one of the calendar files added in QuantLib 1.43 also needed to include the <code>vector</code> header file. And every compiler appears to be lenient (QuantLib itself has fourty different continuous integration jobs, we test with all builds at r-universe) apart from the CRAN macOS x86-64 machine. Sigh. This is now fixed. We also included a neat little local trick I should blog about: if the build is detected as a non-CRAN local build (simply by checking for a <code>.git</code> directory) then compiler flags can be updated to quieten the build. We cannot do that in the package because we would get our fingers slapped over so-called ‘non-portable compiler flags’. Sigh again. Anyway, the trick helps.</p> <p>The full details from <code>NEWS.Rd</code> follow.</p> <blockquote> <h4 id="changes-in-version-0.1.3-2026-07-21">Changes in version 0.1.3 (2026-07-21)</h4> <ul> <li><p>Add missing 'vector' header to new IslamicHolidays calendar file, also PRed upstream and merged there</p></li> <li><p>In local compilation out of git repo add additional compiler flags</p></li> </ul> </blockquote> <p>Courtesy of my <a href="https://dirk.eddelbuettel.com/cranberries/">CRANberries</a>, there is a diffstat report for <a href="https://dirk.eddelbuettel.com/cranberries/2026/07/21/#qlcal_0.1.3">this release</a>. See the <a href="https://dirk.eddelbuettel.com/code/qlcal-r.html">project page</a> and package documentation for more details, and more examples.</p> <p style="font-size: 80%; font-style: italic;"> This post by <a href="https://dirk.eddelbuettel.com">Dirk Eddelbuettel</a> originated on his <a href="https://dirk.eddelbuettel.com/blog/">Thinking inside the box</a> blog. If you like this or other open-source work I do, you can <a href="https://github.com/sponsors/eddelbuettel">sponsor me at GitHub</a>. </p><p></p> 2026-07-21T13:18:00+00:00 Dirk Eddelbuettel https://jmtd.net/log/interzone/digital/ <p><em>(no, this isn't a blog post about Joy Division songs)</em></p> <p><a href="https://jmtd.net/log/interzone/294/">Last time I wrote about Interzone</a>, I was discussing issue #294, the first published under new management in a paperback-sized format ("JB6"). The format and presentation of the magazine was fantastic: it fit in a lot of my pockets, and was packed with 15 stories as well as the regular columns, in full colour with fantastic layouts and illustrations. Sadly there was only one more physical issue before Interzone was forced to become a digital-only publication.</p> <div class="centre"> <div class="image+centre"> <a href="https://jmtd.net/log/interzone/physical_iz.jpg"><img alt="IZ issues 294 and 295" class="img" height="333" src="https://jmtd.net/log/interzone/digital/250x-physical_iz.jpg" width="250" /></a> <p>IZ issues 294 and 295</p> </div> </div> <p>I don't want to dwell on the sad necessity to move to digital. Interzone continues on, celebrating the milestone issue #300 in 2024. Subscriptions are managed via <a href="https://www.patreon.com/c/interzonemag/membership">Patreon</a>. Issue #305 just came out.</p> <p>Instead I wanted to write a small bit about how <em>I</em> engaged with the paper magazine, and the difficulties I've had trying to engage with not just Interzone but <em>any</em> magazine-style publication in a digital context.</p> <p>With most fiction, I read linearly: start the beginning and read to the end, in order. That works well for me with <a href="https://jmtd.net/log/ereader/">e-readers</a>. But for magazines (and most non-fiction) I don't, I jump around: usually starting with the table of contents, I might pick a short column to start, or jump into the middle of the "book reviews" section to read about a specific book. I might skip sections entirely. I find it very difficult to read like this with an e-reader. I think this is partly because I reference the <em>depth</em> of the paper book or magazine, its thickness, to orient myself. But it's also partly the limitations of e-ink.</p> <div class="centre"> <div class="image+centre"> <a href="https://jmtd.net/log/interzone/iz_ticklist.jpg"><img alt="My tick-list for an issue of IZ" class="img" height="444" src="https://jmtd.net/log/interzone/digital/400x-iz_ticklist.jpg" width="400" /></a> <p>My tick-list for an issue of IZ</p> </div> </div> <p>For print-Interzone, I used to start by inserting a small piece of paper inside the cover (the delivery slip was ideal). On this I listed the stories within and ticked them off when I read them (sometimes I double-ticked if I really liked a story). That helped me to remember, perhaps months or years later, whether I'd read all the stories or not, and which I liked. I <em>could</em> do something similar on some e-readers: the <a href="https://jmtd.net/log/remarkable/">Remarkable</a> for instance. But it's far from convenient to do on most e-ink devices.</p> <p>Interzone digital is available as both <a href="https://en.wikipedia.org/wiki/EPUB">ePUB</a>, the most common format for e-books, and PDF. For reading on my regular Kobo e-reader, PDFs don't work very well at all. I think this is generally true of most e-readers.</p> <p>Interzone was (and is) a well-designed magazine. The value of it was not just the <em>content</em> of the text, but the <em>context</em>: how the stories were presented; the accompanying art (most often colour in recent decades), but also the typesetting. ePUB doesn't specify much of that stuff exactly: it leaves that up to the client and the client's preferences. And there's a lot of advantages to that: Prefer a different font face or size? No problem. And most importantly for accessibility: If reading in ePUB makes Interzone available to more readers then that's a great thing. But sadly a lot is lost, IMHO.</p> <div class="centre"> <div class="image+centre"> <a href="https://jmtd.net/log/interzone/iz_ipad.jpg"><img alt="IZ #305 on iPad Mini" class="img" height="533" src="https://jmtd.net/log/interzone/digital/400x-iz_ipad.jpg" width="400" /></a> <p>IZ #305 on iPad Mini</p> </div> </div> <p>The solution I'm trying is to read the PDF version on the <a href="https://jmtd.net/log/ipad_mini/">iPad Mini</a> I resurrected earlier in the year. Despite being an Internet tablet, since it's not really usable for browsing the web anymore it's strangely still a distraction-free device. In fact it's pretty much single-purpose for reading Interzone and the odd other book which benefits from being read as PDF. I can appreciate the stylistic choices made in the page-setting as they were intended; I can quickly jump around the issue without waiting for an e-ink refresh; I get full colour; and whilst it would be tiring to read for a long time on the iPad screen, for the length of articles or stories in a magazine, this isn't a problem.</p> <p>It's not a solution for tracking what I've read (that version of ipadOS is too old to support clumsily scrawling on PDF pages with your fingers, at least in the Books app) but it otherwise seems to work well, so I'll see how it goes.</p> 2026-07-20T21:26:22+00:00 jmtd https://retout.co.uk/2026/07/20/renewal-relationships-between-aws-certifications/ <p>When you pass an AWS certification exam, sometimes it can extend the life of related lesser AWS certifications. But I could not find an illustration of exactly which ones, so here’s an up-to-date diagram:</p> <p><img alt="AWS Certification renewal dependencies" src="https://retout.co.uk/2026/aws-certs.svg" /> <em>Figure: Renewal relationships between AWS certifications.</em></p> <p>Each arrow is a ‘renews’ relation – there’s no obligation to pass lesser exams before the harder ones, but you could also follow the arrows backwards if you want to learn easier material before sitting the more difficult exams.</p> <p>I have made two important simplifications to the graph:</p> <ol> <li> <p>The ‘Advanced Networking – Specialty’ certification is being retired soon, so I’ve omitted it entirely. The last date to take that exam is 25th August 2026. But Specialty certs don’t renew anything else anyway.</p> </li> <li> <p>I have left out transitive relationships in order to simplify the graph – so e.g. if you pass a ‘Solutions Architect – Professional’ exam, it also renews any Cloud Practitioner certificate you might hold, even if you do not currently hold the relevant Associate certificate.</p> </li> </ol> <p>You also have the option of sitting each exam again to renew of course, and there’s a new scheme to ‘maintain’ various certs via AWS Skill Builder which can extend them by one year rather than three.</p> 2026-07-20T20:52:17+00:00 Tim Retout https://bits.debian.org/2026/07/debconf26-starts-today.html <p><a href="https://debconf26.debconf.org/">DebConf26</a>, the 27th annual <a href="https://www.debconf.org/">Debian Developer Conference</a>, is taking place at Santa Fe, Argentina from 20 to 25 July 2026. Debian contributors from all over the world have come together at the Facultad de Ingeniería en Ciencias Hídricas (Faculty of Engineering in Water Sciences), one of the faculties that belong to the Universidad Nacional del Litoral (National University of the Littoral), to participate and work in a conference exclusively ran by volunteers.</p> <p>Today the main conference starts with around 300 expected attendants and over 80 scheduled activities, including 45-minute and 20-minute talks, Bird of a Feather ("<abbr>BoF</abbr>") team meetings, workshops, a job fair, as well as a variety of other events. The full <a href="https://debconf26.debconf.org/schedule/">schedule</a> is updated each day, including activities planned ad-hoc by attendees over the course of the conference.</p> <p>If you would like to engage remotely, you can follow the <strong>video streams</strong> available from the <a href="https://debconf26.debconf.org/">DebConf26 website</a> for the events happening in the three main talk rooms: Aula Magna - FADU, Aula Magna - FBCB and Aula 0.3 - FICH accessible from the DebConf26 homepage. You can also join the conversations happening inside the talk rooms via the <a href="https://www.oftc.net/">OFTC IRC network</a> in the <a href="irc://irc.oftc.net/debconf-fadu">#debconf-fadu</a>, <a href="irc://irc.oftc.net/debconf-fbcb">#debconf-fbcb</a>, and <a href="irc://irc.oftc.net/debconf-fich3">#debconf-fich3</a> channels. Please also join us in the <a href="irc://irc.oftc.net/debconf">#debconf</a> channel for common discussions related to DebConf.</p> <p>You can also follow the live coverage of news about DebConf26 provided by our <a href="https://micronews.debian.org/">micronews service</a> or the @debian profile on your favorite social network.</p> <p>DebConf is committed to a safe and welcoming environment for all participants. Please see our <a href="https://debconf26.debconf.org/about/coc/">Code of Conduct page</a> for more information on this.</p> <p>Debian thanks the commitment of numerous sponsors to support DebConf26, particularly our Platinum Sponsors: <a href="https://www.infomaniak.com/"><strong>Infomaniak</strong></a> and <a href="https://www.proxmox.com/"><strong>Proxmox</strong></a>.</p> <p><img alt="DebConf26 sponsors logo" src="https://bits.debian.org/images/debconf26-sponsors-banner.svg" /></p> 2026-07-20T09:50:00+00:00 The Debian Publicity Team https://bits.debian.org/2026/07/debconf26-welcomes-sponsors.html <p><a href="https://bits.debian.org/images/Romina_Molina_dc26_2.svg"><img alt="Alt DebConf26 by Romina Molina" src="https://bits.debian.org/images/Romina_Molina_dc26_2.svg" /></a></p> <p><a href="https://debconf26.debconf.org/">DebConf26</a>, the 27th edition of the Debian conference is taking place at the <a href="https://www.fich.unl.edu.ar/">Facultad de Ingeniería en Ciencias Hídricas</a> of the Universidad Nacional del Litoral, in Santa Fe, Argentina. We appreciate the organizers for their hard work, and hope this event will be highly beneficial for those who attend in person as well as online.</p> <p>This event would not be possible without the help from our generous sponsors. We would like to warmly welcome the sponsors of DebConf26, and introduce them to you.</p> <p>We have two Platinum sponsors.</p> <ul> <li> <p>Our first Platinum sponsor is <a href="https://www.proxmox.com/"><strong>Proxmox</strong></a>. Proxmox develops powerful, yet easy-to-use open-source server solutions. The comprehensive open-source ecosystem is designed to manage divers IT landscapes, from single servers to large-scale distributed data centers. Our unified platform integrates server virtualization, easy backup, and rock-solid email security ensuring seamless interoperability across the entire portfolio. With the Proxmox Datacenter Manager, the ecosystem also offers a "single pane of glass" for centralized management across different locations. Since 2005, all Proxmox solutions have been built on the rock-solid Debian platform. We are proud to return to DebConf26 as a sponsor because the Debian community provides the foundation that makes our work possible. We believe in keeping IT simple, open, and under your control.</p> </li> <li> <p><a href="https://www.infomaniak.com/"><strong>Infomaniak</strong></a> is the second Platinum sponsor. Infomaniak is an independent, employee-owned Swiss technology company that designs, develops, and operates its own cloud infrastructure and digital services entirely in Switzerland. With over 300 employees — more than 70% engineers and developers — the company reinvests all profits into R&amp;D. Its public cloud is built on OpenStack, with managed Kubernetes, Database as a Service, object storage, and sovereign AI services accessible via OpenAI- compatible APIs, all running on its own Swiss infrastructure. Infomaniak also develops a sovereign collaborative suite — messaging, email, storage, online office tools, videoconferencing, and a built-in AI assistant — developed in- house and as a privacy-respecting solution to proprietary platforms. Open source is central to how Infomaniak operates. Its latest data center (D4) runs on 100% renewable energy and uses no traditional cooling: all the heat generated by its servers is captured and fed into Geneva's district heating network, supplying up to 6,000 homes in winter and hot water year-round. The entire project has been documented and open-sourced at <a href="https://d4project.org/">d4project.org</a>.</p> </li> </ul> <p>Our Gold sponsors are:</p> <ul> <li> <p><a href="https://www.freexian.com/"><strong>Freexian</strong></a>, Freexian specializes in Free Software with a particular focus on Debian GNU/Linux. Freexian can assist with consulting, training, technical support, packaging, or software development on projects involving use or development of Free software. All of Freexian's employees and partners are well-known contributors in the Free Software community, a choice that is integral to Freexian's business model.</p> </li> <li> <p><a href="https://www.viridiengroup.com"><strong>Viridien</strong></a> an advanced technology, digital and Earth data company that pushes the boundaries of science for a more prosperous and sustainable future. Viridien has been using Debian-based systems to power most of its HPC infrastructure and its cloud platform since 2009 and currently employs two active Debian Project Members.</p> </li> </ul> <p>Our Silver sponsors are:</p> <ul> <li><a href="https://www.arm.com/"><strong>Arm</strong></a>: leading technology provider of processor IP, Arm powered solutions have been supporting innovation for more than 30 years and are deployed in over 280 billion chips to date.</li> <li><a href="https://www.pexip.com/"><strong>Pexip</strong></a> brings the ease of commercial video platforms to secure and sovereign environments without compromising control or performance.</li> <li>The <a href="https://www.bfh.ch/"><strong>Bern University of Applied Sciences</strong></a> with around 7,959 students enrolled, located in the Swiss capital.</li> <li><a href="https://www.canonical.com/"><strong>Ubuntu</strong></a>, the Operating System delivered by Canonical.</li> <li><a href="https://os-sci.com/"><strong>OS-Sci</strong></a>, Open Source Science is a world-leading institution dedicated to teaching computer science through Free and Open Source Software (FOSS).</li> <li><a href="https://www.gcoop.coop/"><strong>gcoop</strong></a>, a free software development company with over 19 years of market experience, organized as a worker cooperative, promoting best practices in software development.</li> <li><a href="https://www.qualcomm.com/developer/opensource"><strong>Qualcomm</strong></a> Technologies, one of the world's leading companies in field of mobile technology, sponsors and contributes to Open Source developer communities that drive collaboration.</li> <li><a href="https://www.cip-project.org/"><strong>Civil Infrastructure Platform</strong></a>, a collaborative project hosted by the Linux Foundation, establishing an open source “base layer” of industrial grade software.</li> <li><a href="https://opensource.siemens.com/"><strong>Siemens</strong></a> is a technology company focused on industry, infrastructure and transport.</li> <li><a href="https://www.collabora.com/"><strong>Collabora</strong></a>, a global consultancy delivering Open Source software solutions to the commercial world.</li> <li><a href="https://nerdearla.com/en/"><strong>NERDEARLA</strong></a>, the largest free tech event in the Spanish-speaking world.</li> </ul> <p>Bronze sponsors:</p> <ul> <li><a href="https://www.loongson.cn/"><strong>Loongson</strong></a>,</li> <li><a href="https://www.credativ.de/"><strong>credativ</strong></a>,</li> <li><a href="https://google.com/"><strong>Google</strong></a>,</li> <li><a href="https://www.spacemit.com/"><strong>SpacemiT</strong></a>,</li> </ul> <p>And finally, our Supporter level sponsors:</p> <ul> <li><a href="https://altusmetrum.org/"><strong>Altus Metrum</strong></a>,</li> <li><a href="https://loongfans.cn/en/"><strong>Loongson Hobbyists Community</strong></a>,</li> <li><a href="https://www.santafe.gob.ar/"><strong>Secretaría de Tecnologías para la Gestión de la Provincia de Santa Fe</strong></a></li> </ul> <p>A special thanks to the <a href="https://www.fich.unl.edu.ar/"><strong>Facultad de Ingeniería y Ciencias Hídricas - FICH UNL</strong></a>, our Venue Partner!</p> <p>Thanks to all our sponsors for their support! Their contributions enable a diverse global community of Debian developers and maintainers to collaborate, support one another, and share knowledge at DebConf26.</p> 2026-07-18T12:00:00+00:00 The Debian Publicity Team https://sergiocipriano.com/running-gui-in-incus.html <h1 id="running-graphical-applications-in-incus-containers">Running Graphical Applications in Incus Containers</h1> <p>I didn't know how easy it is to display the graphical console of a virtual machine until I tried recently.</p> <pre><code>$ sudo apt install virt-viewer $ incus launch images:debian/trixie test --vm $ incus console test --type=vga</code></pre> <p>That's it.</p> 2026-07-17T20:17:17+00:00 Sérgio de Almeida Cipriano Júnior https://diffoscope.org/news/diffoscope-325-released/ <p>The diffoscope maintainers are pleased to announce the release of diffoscope version <code class="language-plaintext highlighter-rouge">325</code>. This version includes the following changes:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>[ Chris Lamb ] * Fix tests to work with zipdetails 4.0008. (Closes: #1141359) * Downgrade debhelper compatibility level to 13 for now. * Update copyright years. </code></pre></div></div> <p>You find out more by <a href="https://diffoscope.org">visiting the project homepage</a>.</p> 2026-07-17T00:00:00+00:00 Reproducible Builds (diffoscope) http://blog.sesse.net/blog/tech/2026-07-15-08-45_looking_at_dpkg_startup_time.html <p>Five years or so ago, I had a look at trying to speed up dpkg's package installation; I concluded that it was probably possible to speed up, but that there was no appetite for this kind of large-scale changes. (You'd probably need to rewrite the transaction system to get rid of a lot of fsyncs, you'd ideally want to reduce the number of syscalls for unpack by io_uring and so on.)</p> <p>This summer, I've been looking at something related on and off; it is possible to speed up the startup time? That's in a sense the opposite scenario; instead of installing lots of packages in a newly debootstrapped chroot (with very few packages), see how fast you can install one in a much more busy chroot (I just copied my laptop's dpkg dir, with ~6600 packages installed).</p> <p>Before I show the numbers, I must stress that this is an <em>investigation</em>, not a fair benchmark, and you should not go shout at the dpkg maintainers that they need to get to “catch up”. That said:</p> <pre>&gt; sudo time dpkg --root=root -i hello_2.12.3-1_amd64.deb &gt;/dev/null Not building database; man-db/auto-update is not 'true'. 1.12user 0.49system 0:01.85elapsed 87%CPU (0avgtext+0avgdata 171880maxresident)k 0inputs+14648outputs (0major+72963minor)pagefaults 0swaps &gt; sudo time ./src/dpkg --root=root -i hello_2.12.3-1_amd64.deb &gt; /dev/null 0.04user 0.01system 0:00.15elapsed 38%CPU (0avgtext+0avgdata 6520maxresident)k 0inputs+1080outputs (0major+2705minor)pagefaults 0swaps </pre> <p>How is it unfair? Well, for one, the code to run triggers is messed up so they're not run (but the trigger in question should be very fast). And there's one step at the end with detecting “disappearing packages” that doesn't run properly because it's a bit tricky in my model and I didn't want to deal with, well, difficult problems. But I think both are perfectly doable without really affecting the end time, it just requires engineering. There's a <em>lot</em> of work to be done, though; diving into the code makes me shudder at all the complexities that need to be in place to support all the corner cases of multiarch, for instance.</p> <p>The code is extremely proof-of-concept, but it runs and can read (and write) metadata from SQLite instead of flat text files, it can resolve dependencies in the most basic fashion, it can keep track of installed files, it should be crash- and powerloss-proof. You know, the very very basic stuff, and without changing the model fundamentally (like e.g. Michael Stapelberg did with <a href="https://distr1.org/">distri</a>, fundamentally replacing packages with disk images and ending up in a very fast but rather different-looking system). So it was satisfying to see that it ends up around 10x even on my not-very-new laptop (plus a significant RAM reduction); I believe it should be possible to squeeze under 100 ms, but that would probably require also optimizing the unpacking itself, which I didn't look at this time.</p> <p>Having a bunch of files being read into RAM and then processed freely was a design that made a lot of sense when dpkg was written (in 1995!) and Debian had ~250 binary packages <em>in total</em> (and you probably wouldn't install all of them). There was no reasonable database available for desktop systems; the closest thing you'd have was probably BerkeleyDB and that wasn't really it, so flat files and fsync made a lot of sense, and was easy to manipulate and persist. But now, SQLite is widely available and probably the most battle-tested code in history, a typical system has thousands of packages (you could easily install tens of thousands if you're doing heavy development), SSDs have replaced HDDs almost everywhere for system disks, and the environment has just changed a lot in general. So I hope that someone at some point will be crazy enough to pick this up and run with it, because it's a lot of work and I don't intend to. :-)</p> <p>PS: I didn't look at apt; I think what I'd really love to see first and foremost is a package format change so that apt-listchanges can look at (or look for) NEWS.gz without having to unpack the entire package. Perhaps a control field saying “nothing new here”?</p> 2026-07-15T07:45:00+00:00 Steinar H. Gunderson https://www.freexian.com/blog/debian-contributions-06-2026/ <h1 id="debian-contributions-2026-06">Debian Contributions: 2026-06</h1> <p><a href="https://www.freexian.com/about/debian-contributions/">Contributing to Debian</a> is part of <a href="https://www.freexian.com/about/">Freexian’s mission</a>. This article covers the latest achievements of Freexian and their collaborators. All of this is made possible by organizations subscribing to our <a href="https://www.freexian.com/lts/">Long Term Support contracts</a> and <a href="https://www.freexian.com/services/">consulting services</a>.</p> <h2 id="python-314-as-default-transition-by-stefano-rivera">Python 3.14 as default transition, by Stefano Rivera</h2> <p>Debian has had Python 3.13 and 3.14 in <code>unstable</code> and <code>testing</code> since December 2025, with Python 3.13 as the default version (<code>/usr/bin/python3</code> = 3.13). This gave time for packages to implement support and detect issues in their test suites.</p> <p>A slot to transition to 3.14 as default was requested from the release team <a href="https://bugs.debian.org/1130323">in March</a>, and they indicated that we would likely be able to schedule it in late June. In preparation, Stefano reviewed the open bugs against Python interpreters and squashed some in uploads of the latest point releases of Python: <a href="https://www.python.org/downloads/release/python-31314/">3.13.14</a> and <a href="https://www.python.org/downloads/release/python-3146/">3.14.6</a>. Also in June, Python <a href="https://www.python.org/downloads/release/python-3150b2/">3.15.0 beta 2</a> and <a href="https://www.python.org/downloads/release/python-3150b3/">beta 3</a> released. Stefano uploaded these to Debian <code>experimental</code>.</p> <p>The 3.15 betas were reason to <a href="https://discuss.python.org/t/can-we-consider-an-uncoditional-change-of-abi3t-so-to-abi3t-soabi-platform-so-for-3-15-last-minute/107919">attempt to revive review</a> of a blocked <a href="https://github.com/python/cpython/pull/122917">upstream patch</a> to support Debian multiarch in stable ABI Python extensions, now that Python 3.15 is adding a new stable ABI <code>abi3t</code>.</p> <h2 id="debconf-26-preparations-by-stefano-rivera-antonio-terceiro-lucas-kanashiro-santiago-ruano-rincón-and-anupa-ann-joseph">DebConf 26 preparations, by Stefano Rivera, Antonio Terceiro, Lucas Kanashiro, Santiago Ruano Rincón and Anupa Ann Joseph</h2> <p><a href="https://debconf26.debconf.org/">DebConf 26</a>, the annual Debian Developer Conference, is being held in Santa Fe, Argentina, in July. Stefano Rivera, Antonio Terceiro, Lucas Kanashiro, Santiago Ruano and Anupa Ann Joseph contributed to the preparations for the event.</p> <ul> <li>As usual, Stefano has been supporting the conference website and registration, helping the local team to get accurate data on attendee numbers.</li> <li>Antonio has been supporting the conference website and helping the content team to put together the conference schedule.</li> <li>Santiago has been helping the local team on different topics regarding logistics.</li> <li>Anupa assisted with the accommodation arrangements for DebCamp and DebConf, working alongside Nattie.</li> <li>Lucas has been coordinating the conference schedule and communicating with some speakers.</li> </ul> <h2 id="debvm-by-helmut-grohne">debvm, by Helmut Grohne</h2> <p>The <a href="https://salsa.debian.org/helmutg/debvm">debvm</a> tool used for creating and running ephemeral virtual machines saw a number of small improvements. The requirement of having a filesystem label has been removed in favor of using a uuid and <code>/etc/fstab</code> is no longer created. A memory balloon is enabled by default and this enables qemu to automatically release free guest memory to the host. Booting Ubuntu VMs regressed as a result of their use of <code>uutils</code> and has been fixed. The <code>--architecture</code> flag is back to be able to better support Hurd, which is a work-in-progress of Johannes Schauer Marin Rodrigues. Thanks to Jochen Sprickerhof, you can more easily create VMs for <code>autopkgtest-virt-qemu</code> using <code>--hook-dir=/usr/share/mmdebstrap/hooks/autopkgtest-create-qemu</code>. There also are a few documentation and error message improvements. All of this is pending in git waiting to be uploaded once development slows down. While booting a machine from <code>virtiofsd</code> succeeded, turning the proof-of-concept into production remains for later.</p> <h2 id="pconr-by-helmut-grohne">pconr, by Helmut Grohne</h2> <p>At <a href="https://debconf25.debconf.org/talks/170-reviving-unschroot/">DebConf25</a>, Helmut reported on a <a href="https://codeberg.org/shelter/reschroot">schroot</a> substitute called unschroot. The second iteration uses <a href="https://varlink.org">varlink</a> IPC to construct a container. That varlink API is now separated into a new project called <a href="https://git.subdivi.de/~helmut/pconr.git/">programmable container runtime</a>. It is meant to provide more flexibility in constructing containers than established solutions such as the <code>unshare</code> command from util-linux, bubblewrap or podman provide while still managing repetitive complexity such as process orchestration for the developer. A new example that uses this infrastructure is <a href="https://git.subdivi.de/~helmut/pconr.git/tree/examples/mmdebstrap_container.py">a better containment for mmdebstrap</a> eliminating chroot escape. There also is an <a href="https://github.com/helmutg/asyncvarlink/commit/3e16139f72c7374f2ca3640045ef7162c98e7a4c">asyncvarlink/0.3.2 release</a> taking steps to become more maintainable in Debian to eventually get pconr into Debian.</p> <h2 id="miscellaneous-contributions">Miscellaneous contributions</h2> <ul> <li>Stefano did routine uploads (mostly new upstream versions) of <code>python-pip</code>, <code>python-pipx</code>, <code>hatchling</code>, <code>dh-python</code>, <code>beautifulsoup4</code>, <code>python-virtualenv</code>, <code>python-mitogen</code>.</li> <li>Stefano uploaded a snowball mini-transition: <code>snowball</code>, <code>snowball-data</code>, and <code>pystemmer</code></li> <li>Stefano did some <a href="https://wiki.debian.org/Teams/DebianNet">debian.net</a> team admin, setting up a container and later a VM for <a href="https://salsa.debian.org/debiannet-team/requests/-/work_items/36">vote.debian.net</a>.</li> <li>Stefano <a href="https://lists.debian.org/msgid-search/cer4b3szczxpt64wbzhumcm6go7tmkfvhdsqoftpevav2ovu3l@zherud2oym4p">responded</a> to a <a href="https://lists.debian.org/msgid-search/CAEd1pt5QiD9-UUV5jP=U7=L2pM5f6c1WPcUY3jWoYbcTO8iRcw@mail.gmail.com">semi-escalation</a> to the Debian Technical Committee, after some communication between an upstream, a bug reporter, and a Debian package maintainer went sideways and got heated.</li> <li>Emilio managed several transitions, and filed bugs against the few remaining GCC 13 rdeps.</li> <li>Antonio did salsa maintenance work, debugging service issues, approving user registrations, and processing support requests.</li> <li>Antonio worked on Debian CI maintenance, including but not limited to deploying new armhf and armel workers, fixing bugs and preparing an upcoming release of debci.</li> <li>Antonio did several maintenance tasks for MiniDebConf websites.</li> <li>Antonio uploaded ruby-bunny, ruby-sinatra and ruby-mustermann, fixing a few FTBFS bugs among them.</li> <li>Carles using <code><a href="https://salsa.debian.org/carlespina/po-debconf-manager">po-debconf-manager</a></code>: Reviewed Catalan translations for 5 packages, submitted 6 packages. Added a <a href="https://salsa.debian.org/carlespina/po-debconf-manager/-/blob/main/docs/blog/2026-06-29-update.md?ref_type=heads">draft blog/update</a> about the po-debconf-manager project.</li> <li>Carles submitted a new <a href="https://github.com/BestImageViewer/geeqie/pull/2438">Geeqie Catalan translation</a>: it had accumulated a large number of untranslated strings over the last 4 years.</li> <li>Carles contributed to the Debian wiki: improved documentation for the Framework Laptop and added a new section “<a href="https://wiki.debian.org/InstallingDebianOn/Framework/Laptop13/AMD_Ryzen_AI_300_Series#Battery_charging_control">Battery charging control</a>” (after doing some debugging and testing). He wrote a page about <a href="https://wiki.debian.org/SignalDesktop">Signal Desktop</a>. Carles started looking at testing/documenting Mailman2 -&gt; Mailman3 migration.</li> <li>Carles, in relation to the migration process, double checked old pages without relevant information in the Debian wiki.</li> <li>Thorsten did another upload of package hplip to fix some bugs.</li> <li>In the context of the Google Summer of Code 2026 project, Santiago continued co-mentoring Aryan Karamtoth, who is working on the Linux live-patching project. As part of the team, Santiago guided Aryan to help design the different workflows and to study the different tools available, including the <a href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/scripts/livepatch/klp-build?h=v6.19">upstream klp-build</a> (that was introduced in v6.19), and compare it with <a href="https://github.com/SUSE/klp-build/">SUSE’s klp-build</a>.</li> <li>Colin <a href="https://salsa.debian.org/webmaster-team/webwml/-/merge_requests/1149">clarified</a> the bug tracking system’s documentation to indicate that maintainers may sometimes reasonably ask users to file bugs upstream themselves.</li> <li>Colin fixed 15 packages for <a href="https://udd.debian.org/cgi-bin/bts-usertags.cgi?user=debian-python%40lists.debian.org&amp;tag=pytest9.1">pytest 9.1</a>.</li> <li>Colin fixed a <a href="https://bugs.debian.org/1140927">depthcharge-tools regression with Python 3.14 as default</a> that broke debian-installer builds.</li> <li>Helmut continued to report undeclared file conflicts and correspond about them.</li> <li>Helmut wrote patches for <a href="https://tracker.debian.org/strace">strace</a> to enable <a href="https://bugs.debian.org/1140559">cross building</a> and a <a href="https://bugs.debian.org/1062446">32bit personality on arm64</a>.</li> <li>Helmut continued maintaining rebootstrap working fixing build failures in fontconfig, gettext and sqlite3 as well as changing the way packages from gcc builds are installed to better serve a need reported by <a href="https://lists.debian.org/debian-cross/2026/06/msg00005.html">Samuel Thibault</a>.</li> </ul> 2026-07-15T00:00:00+00:00 Anupa Ann Joseph https://gwolf.org/2026/07/got-your-keys-ready-for-debconf26.html <p>Yay! Finally it’s that time of year — DebCamp is underway, and soon it will be time for DebConf! 🎉🥳</p> <p>As it is by now tradition, it’s my task to coordinate the DebConf26 keysigning party. And, as usual, I have set up the list of <a href="https://people.debian.org/~gwolf/dc26_ksp/">DebConf26 keysigning maps</a> for everybody involved.</p> <p>So, if you are taking part of DebConf, make sure to:</p> <ul> <li> <p>Find yourself in the <a href="https://people.debian.org/~gwolf/dc26_ksp/">keysigning map</a>. Are you a part of the listing?</p> <ul> <li> <p>If you are not there, log in to the DebConf26 management system and edit the <a href="https://debconf26.debconf.org/register/step-3">Personal Information</a> section of your profile. Make sure you submit your OpenPGP key fingerprint.</p> </li> <li> <p>Make sure your key is available in the keyserver network. They should basically be equivalent and interoperate, but in any case — my scripts will try to find your key at <a>pgpkeys.eu</a>, <a>keys.openpgp.org</a>, <a>keyserver.computer42.org</a>, <a>keyserver.ubuntu.com</a>, <a>keyring.debian.org</a>, <a>pgp.surf.nl</a>, <a>pgp.pm</a>, <a>pgp.mit.edu</a>, <a>the.earth.li</a>.</p> </li> </ul> </li> <li> <p>Make sure your name is readable and matches what you want others to sign. If it does not, edit your key and upload it <em>now</em>!</p> </li> <li> <p>Remember that, <a href="https://debconf26.debconf.org/about/ksp/">as announced</a>, the deadline for the final list is on <strong>Thursday, 2026.07.16, 09:00 GMT-3 (Argentinian time).</strong></p> </li> </ul> 2026-07-14T21:23:21+00:00 Gunnar Wolf https://blog.freesources.org//posts/2026/07/zed-xdebug/ <h1 id="Nextcloud_PHP_debugging_with_Xdebug_in_Zed_editor">Nextcloud PHP debugging with Xdebug in Zed editor</h1> <p>I started to switch from PhpStorm to Zed as IDE recently as Zed is open source and has a much smaller footprint and is more slick than PhpStorm.</p> <p>One thing that I didn't get running immediately was Xdebug integration, so I did a bit of research and asked Claude for help. Here's a quick writeup of how to get it running.</p> <p>I have Zed installed as Flatpak on a Debian Trixie host system.</p> <p>The PHP process runs in a <a href="https://github.com/juliusknorr/nextcloud-docker-dev/">nextcloud-docker-dev</a> Docker container.</p> <h2 id="Install_Zed_and_configure_debugging_there">Install Zed and configure debugging there</h2> <p>Install Zed: <code>flatpak install flathub dev.zed.Zed</code></p> <p>In Zed: open the Extensions view and install PHP.</p> <p>Configure the debugger:</p> <p>Create <code>~/.var/app/dev.zed.Zed/config/zed/debug.json</code>:</p> <pre><code class="json">[ { "label": "PHP: Listen to Xdebug", "adapter": "Xdebug", "request": "launch", "port": 9003, "pathMappings": { "/var/www/html": "/home/&lt;user&gt;/devel/nextcloud/server", "/var/www/html/apps-extra": "/home/&lt;user&gt;/devel/nextcloud/server/apps-extra", "/var/www/html/apps-shared": "/home/&lt;user&gt;/devel/nextcloud/apps-shared" } } ] </code></pre> <p>Add one entry per bind-mounted app directory.</p> <p>After creating the file, restart Zed.</p> <p>Inside Zed, select "debugger: start" from command palette and then "PHP: Listen to Xdebug".</p> <p>Verify Zed is listening. Running <code>ss -tlnp | grep 9003</code> on the host should show <code>*:9003</code> with Zed as the process.</p> <h2 id="Configure_Xdebug_inside_the_container">Configure Xdebug inside the container</h2> <p><code>/usr/local/etc/php/conf.d/xdebug.ini</code>:</p> <pre><code class="ini">xdebug.mode = debug xdebug.idekey = PHPSTORM xdebug.trace_output_name=trace.%R.%u xdebug.profiler_output_name=profile.%R.%u xdebug.output_dir=/shared/xdebug xdebug.log = /var/log/xdebug.log xdebug.log_level = 3 ; Try to discover the client host, otherwise fall back to the docker host xdebug.discover_client_host=true xdebug.client_host=host.docker.internal ; When you cannot specify a trigger, use "xdebug.start_with_request = yes" to autostart debugging for all requests ; https://xdebug.org/docs/all_settings#start_with_request xdebug.start_with_request = trigger ; Set xdebug.mode trace to use this ; More details at https://derickrethans.nl/flamboyant-flamegraphs.html xdebug.trace_format=3 xdebug.trace_output_name=xdebug.%R.%u </code></pre> <p>Apply changes by restarting apache in the container: <code>apache2ctl -k graceful</code></p> <p>Notes:</p> <ul> <li><code>host.docker.internal</code> resolves on Linux Docker only if the container was started with <code>--add-host=host.docker.internal:host-gateway</code> (nextcloud-docker-dev already does this).</li> <li><code>discover_client_host = true</code> makes xdebug follow <code>X-Forwarded-For</code> - useful behind Nextcloud's dev reverse proxy.</li> </ul> <h2 id="Test_xdebug_with_a_PHP_command_inside_the_container">Test xdebug with a PHP command inside the container</h2> <p>Run <code>XDEBUG_SESSION=PHPSTORM php occ status</code> inside the container and check <code>/var/log/xdebug.log</code>.</p> <h2 id="Install_the_browser_extension">Install the browser extension</h2> <p>Install Xdebug Helper (Firefox/Chrome). In its preferences, set the IDE Key to PhpStorm. It will set the <code>XDEBUG_SESSION</code> cookie when toggled to Debug.</p> <p>Click the Xdebug Helper icon in the browser and set it to Debug.</p> <h2 id="Test_Xdebug_with_browser_extension">Test Xdebug with browser extension</h2> <p>Load the URL that exercises the code path with the breakpoint. Zed should stop the code exection at the breakpoint.</p> 2026-07-14T10:46:20+00:00 mejo roaming https://kenhys.hatenablog.jp/entry/2026/07/12/231009 <h2 id="Introduction">Introduction</h2> <p>Recently, I've got a chance to try building Mozc (Most famous Japanese input method editor) with Bazel.</p> <p>As you know, recently newer Bazel related packages were landed into debian/unstable. Then now I'm planning to update Mozc from 2.29.5160.102 to 3.33.6133.</p> <h2 id="Background-story-about-Mozc-and-Debian">Background story about Mozc and Debian</h2> <p>The upstream of Mozc had released 3.34.6239, but on Debian, we stick to Mozc 2.29.5160.102.</p> <p>Mozc requires newer Bazel but we only had Bazel 4.2.3 at that time on Debian, so even though the upstream of Mozc switched from GYP to Bazel, we had patched Mozc with GYP based package.</p> <p>We even did make an effort to restore build options that had been already removed. :-( And needed to migrate from GTK2 renderer to GTK3 renderer.</p> <p>That is why the version of Mozc is diverged from upstream on Debian.</p> <ul> <li>2.29.5160.102 (Now on Debian)</li> <li>2.29.5268.102</li> <li>2.29.5374.102</li> <li>2.29.5544.102</li> <li>2.30.5544.102</li> <li>2.31.5712.102</li> <li>2.31.5851.102</li> <li>2.32.5994.102</li> <li>3.33.6089</li> <li>3.33.6133 (Target to upgrade for)</li> <li>3.34.6239</li> </ul> <h2 id="How-to-switch-from-GYP-to-Bazel">How to switch from GYP to Bazel?</h2> <p>At first, we needed to decide what Mozc version to work with it.</p> <p>Now latest version of Mozc is 3.34.x, but it requires Bazel 9.x. Please recall that Bazel 7.7.1 was introduced Debian/unstable. And more, newer dependency libraries are required.</p> <p>You might feel that target version (3.33.6133) is too high from 2.29.5160.102, but if we upgrade to more older Mozc, it means that it requires to backport Mozc to older libabsl compatible codes and so on.</p> <p>That is why Mozc 3.33.6133 was chosen.</p> <p>Even once the target version has been decided, you can't let your guard down.</p> <p>There are many technical tasks to solve.</p> <ul> <li>Revisit patch sets to apply</li> <li>Porting uim mozc patch and fix FTBFS</li> <li>Porting fcitx5 mozc patch and fix FTBFS</li> <li>Fix src/third_party vendoring</li> <li>Switch from GYP to Bazel build systems</li> <li>...</li> </ul> <p>At least, it will likely require several rounds of testing in the Debian experimental.</p> <h2 id="Conclusion">Conclusion</h2> <p>Currently, <code>gbp buildpackge</code> has succeeded finally on local machine, but need to tidy and cleanup stuffs.</p> <p>I didn't know packaging with Bazel best practice yet, to remove many third party vendor/ bundles, I've found that it requires pile of patch to eliminate them.</p> <p>In the current version of Debian, as a one of build system, further work — such as support from debhelper - will be needed.</p> <p>I'll file working progress on <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1085173">#1085173</a></p> 2026-07-12T14:10:09+00:00 Kentaro Hayashi https://copyninja.in/blog/debvulns-exporter.html <p>Following up on my previous <a class="reference external" href="https://copyninja.in/blog/debvulns-cli.html">post</a>, I am releasing <a class="reference external" href="https://pypi.org/project/debvulns/">debvulns-exporter</a>, a Prometheus exporter for tracking Debian system vulnerabilities. The underlying vulnerability analysis logic remains identical to the previously released MCP server and CLI utility.</p> <div class="section" id="why-an-exporter"> <h2>Why an Exporter?</h2> <p>In my engineering workflows, I frequently deal with Debian and vulnerability management. Most enterprise environments rely on commercial, paid vulnerability platforms like Tenable or Rapid7. While these platforms provide extensive feature sets, I noticed a distinct lack of open-source tools tailored for this specific pipeline. While <cite>debsecan</cite> exists, it lacks a structured, parseable format suitable for building dashboards aimed at management consumption. What started as an experimental MCP server for learning purposes evolved into a practical question: why not convert it into a Prometheus exporter? Given that Prometheus is the de facto standard metrics platform across the industry, this architecture was the logical next step.</p> </div> <div class="section" id="design-and-exported-metrics"> <h2>Design and Exported Metrics</h2> <p>The exporter is implemented as a native Prometheus exporter utilizing the <cite>prometheus-client</cite> library. It operates using two threads: one handles fetching the vulnerability data, parsing EPSS feeds, and cross-referencing installed packages to identify local vulnerabilities; the second handles serving the metrics endpoint. The full architecture details and metrics specifications can be found in the <a class="reference external" href="https://github.com/copyninja/debsecan-mcp/blob/main/docs/prometheus_exporter_design.md">design doc</a>. The specification was drafted during a technical brainstorming session with <em>Claude 4.6 Sonnet</em> on <em>Antigravity</em> prior to writing the implementation.</p> </div> <div class="section" id="testing-and-dashboarding"> <h2>Testing and Dashboarding</h2> <p>To validate the exporter, I spun up older <em>Debian 11</em> and <em>Debian 12</em> cloud images sourced from the <a class="reference external" href="https://cloud.debian.org/images/cloud/">Debian Cloud team</a>. The older image was intentionally selected to guarantee a standard baseline of unpatched vulnerabilities for testing. The local evaluation topology is structured as shown below:</p> <img alt="" src="https://copyninja.in/images/debvulns-exporter-setup.png" /> <p>Rather than constructing the Grafana dashboard from scratch, I used Claude 4.6 Sonnet via Antigravity to generate the layout configuration. The generated dashboard for the local testbed functions effectively:</p> <img alt="" src="https://copyninja.in/images/debvulns-exporter-dashboard.png" /> <p>The complete, ready-to-import Grafana dashboard configuration is included directly in the <cite>debvulns</cite> <a class="reference external" href="https://github.com/copyninja/debsecan-mcp/blob/main/contrib/grafana/debvulns-dashboard.json">source code</a>.</p> </div> <div class="section" id="renaming-the-project"> <h2>Renaming the project</h2> <p>To prevent namespace conflicts and confusion with the native <cite>debsecan</cite> utility in Debian, I have unified the ecosystem under the <em>debvulns</em> moniker. The core CLI is named <cite>debvulns</cite>, the exporter is <cite>debvulns-exporter</cite>, and the MCP component is <cite>debvulns-mcp</cite>. The migration release has been published to <a class="reference external" href="https://pypi.org/project/debsecan-mcp/">PyPI</a>, and the new consolidated repository is active at <a class="reference external" href="https://pypi.org/project/debvulns/">debvulns</a>.</p> </div> <div class="section" id="conclusion"> <h2>Conclusion</h2> <p>While this began as a personal utility to fill a niche tool gap, I expect it will be useful for others managing Debian infrastructure at scale. My next objective is to formalize Debian packaging for both the CLI and the exporter. The MCP component will likely remain available as an independent artifact. Until then, happy hacking.</p> <p><em>Note: As a core design choice, `debvulns` still uses native `debsecan` as its ground-truth standard. The tool continuously cross-verifies its output against `debsecan` to ensure perfect functional parity and data consistency.</em></p> </div> 2026-07-12T11:30:25+00:00 copyninja https://reproducible-builds.org/reports/2026-06/ <p class="lead"><strong>Welcome to the June 2026 report from the <a href="https://reproducible-builds.org">Reproducible Builds</a> project!</strong></p> <p><a href="https://reproducible-builds.org/"><img alt="" src="https://reproducible-builds.org/images/reports/2026-06/reproducible-builds.png#right" /></a></p> <p>In these reports, we outline the most important things that we have been up to over the past month. As a quick recap about what problem our project intends to solve, whilst anyone may inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries. The motivation behind the reproducible builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised or not.</p> <p>If you are interested in contributing to the project, please visit our <a href="https://reproducible-builds.org/contribute/"><em>Contribute</em></a> page on our website.</p> <p>In this month’s report, we cover:</p> <ol> <li><a href="https://reproducible-builds.org/blog/index.rss#only-installing-reproducible-packages-with-repro-threshold">Only installing reproducible packages with <em>repro-threshold</em></a></li> <li><a href="https://reproducible-builds.org/blog/index.rss#distribution-work">Distribution work</a></li> <li><a href="https://reproducible-builds.org/blog/index.rss#diffoscope-development">diffoscope development</a></li> <li><a href="https://reproducible-builds.org/blog/index.rss#from-our-mailing-list">From our mailing list…</a></li> <li><a href="https://reproducible-builds.org/blog/index.rss#documentation-updates">Documentation updates</a></li> <li><a href="https://reproducible-builds.org/blog/index.rss#patches">Patches</a></li> <li><a href="https://reproducible-builds.org/blog/index.rss#four-new-scholarly-papers">Four new scholarly papers</a></li> </ol> <hr /> <p><br /></p> <h3 id="only-installing-reproducible-packages-with-repro-threshold">Only installing reproducible packages with <em>repro-threshold</em></h3> <p><a href="https://rebuilderd.xpam.pl:2096/demo.html"><img alt="" src="https://reproducible-builds.org/images/reports/2026-06/repro-threshold.png#center" /></a></p> <p>A <a href="https://rebuilderd.xpam.pl:2096/demo.html">very interesting demonstration</a> is now available showing how you might configure your Debian system to only install packages that have been reproduced by <em>m/n</em> rebuilders.</p> <p>This is implemented via a <code class="language-plaintext highlighter-rouge">reproduced+https://</code> <a href="https://en.wikipedia.org/wiki/APT_(software)">APT</a> transport ( a mechanism for communicating between the APT client and its repository source — commonly HTTP):</p> <blockquote> <p>Every package download is intercepted by <code class="language-plaintext highlighter-rouge">repro-threshold</code>, which queries two independent rebuilders for a signed attestation before allowing installation to proceed. [It] is important to note that [an] install will only succeed if all package dependencies are also reproducible.</p> </blockquote> <p>The <a href="https://rebuilderd.xpam.pl:2096/demo.html">demo</a> gives examples of how to quickly experiment with this using a <a href="https://www.docker.com/">Docker</a> container.</p> <p><br /></p> <h3 id="distribution-work">Distribution work</h3> <p><a href="https://debian.org/"><img alt="" src="https://reproducible-builds.org/images/reports/2026-06/debian.png#right" /></a></p> <p>In <strong>Debian</strong> this month:</p> <ul> <li> <p>The <a href="https://tracker.debian.org/pkg/debian-installer"><code class="language-plaintext highlighter-rouge">debian-installer</code></a> package in Debian was uploaded with a <a href="https://tracker.debian.org/news/1768824/accepted-debian-installer-20260628-source-into-unstable/">substantial reproducibility-related changelog</a>. This means, for the first time, the <a href="https://reproduce.debian.net/excuses.html?source_name=debian-installer">uploaded version could finally be reproduced</a>.</p> </li> <li> <p>Various <a href="https://openjdk.org/">OpenJDK</a> packages were also uploaded to Debian, including the fix for <code class="language-plaintext highlighter-rouge">JDK-8385738</code> (“Javadoc does not produce reproducible output…”) (<a href="https://reproduce.debian.net/all/api/v1/builds/206100/artifacts/426780/diffoscope">for example</a>). [<a href="https://tracker.debian.org/news/1760093/accepted-openjdk-27-2724ea-2-source-into-unstable/">…</a>][<a href="https://tracker.debian.org/news/1760960/accepted-openjdk-26-26018-3-source-into-unstable/">…</a>][<a href="https://tracker.debian.org/news/1760962/accepted-openjdk-25-25044ea-1-source-into-unstable/">…</a>]</p> </li> <li> <p>The “reason” pages on <a href="https://reproduce.debian.net"><em>reproduce.debian.net</em></a>, <a href="https://reproduce.debian.net/ppc64el/stats/unstable/">such as the one for <em>ppc64el</em></a>, now feature links labeled with the <a href="https://www.compart.com/en/unicode/U+1F41B">bug emoji</a> (i.e. 🐛) which links to the categorized issues packages have been tagged with in the <code class="language-plaintext highlighter-rouge">reproducible-notes.git</code> repo.</p> </li> <li> <p>Indeed, 25 reviews of Debian packages were added, 31 were updated and 33 were removed this month adding to <a href="https://tests.reproducible-builds.org/debian/index_issues.html">our extensive knowledge about identified issues</a>. Two issue types were updated as well. [<a href="https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/a2302451">…</a>][<a href="https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/9e09f1ee">…</a>]</p> </li> </ul> <p><a href="https://apt.izzysoft.de/fdroid/"><img alt="" src="https://reproducible-builds.org/images/reports/2026-06/izzyondroid.png#right" /></a></p> <p>The <a href="https://apt.izzysoft.de/fdroid/"><strong>IzzyOnDroid</strong></a> Android APK repository reached its next milestone this month, now covering 2 out of every 3 apps (66.7%) with reproducible builds. Their <a href="https://izzyondroid.org/docs/reproducibleBuilds/DebugFailedRBs/">documentation for debugging and fixing failed builds</a> has steadily grown as well. More clients have picked up showing reproducibility results (e.g. Droid-ify), and <a href="https://apt.izzysoft.de/packages/com.machiav3lli.fdroid">Neo Store</a> now can be configured to stick to only reproducible applications. Further, an <a href="https://shields.rbtlog.dev/">independent builder</a> has been added to the build farm, increasing the trust level even more as APK builds can have multiple confirmations now.</p> <p>At the same time, IzzyOnDroid’s <a href="https://codeberg.org/IzzyOnDroid/rbtlog"><em>rbtlog</em></a> got several new features. The most outstanding is caching for frequently used resources such as <a href="https://github.com/obfusk/reproducible-apk-tools"><em>reproducible-apk-tools</em></a>, command-line tools and NodeJS in order to counter ongoing issues with GitHub availability, while at the same time saving bandwidth and build time. This change also enables some other some smaller enhancements such as being able to configure build timeouts per recipe for those builds running longer than the average, release pattern filtering for update checks or having a field for maintainer notes to shortly summing up e.g. why a reproducible build failed.</p> <p><br /></p> <p><a href="https://www.opensuse.org/"><img alt="" src="https://reproducible-builds.org/images/reports/2026-06/opensuse.png#right" /></a></p> <p>Lastly, Bernhard M. Wiedemann posted another <a href="https://www.opensuse.org/"><strong>openSUSE</strong></a> <a href="https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/LQPMRQ5W3XJ7RWAQ6ITI4EY2EDVTVHKA/">monthly update</a> for their reproducibility work there.</p> <p><br /></p> <h3 id="diffoscope-development"><em>diffoscope</em> development</h3> <p><a href="https://diffoscope.org/"><img alt="" src="https://reproducible-builds.org/images/reports/2026-06/diffoscope.png#right" /></a></p> <p><a href="https://diffoscope.org"><strong>diffoscope</strong></a> is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb made the following changes, including preparing and uploading versions <a href="https://tracker.debian.org/news/1762589/accepted-diffoscope-319-source-into-unstable/">319</a>, <a href="https://tracker.debian.org/news/1764827/accepted-diffoscope-320-source-into-unstable/">320</a>, <a href="https://tracker.debian.org/news/1764860/accepted-diffoscope-321-source-into-unstable/">321</a>, <a href="https://tracker.debian.org/news/1767978/accepted-diffoscope-322-source-into-unstable/">322</a> and <a href="https://tracker.debian.org/news/1769647/accepted-diffoscope-323-source-into-unstable/">323</a> to Debian:</p> <ul> <li>Debian adds an extra <code class="language-plaintext highlighter-rouge">Flags:</code> line in the output of <code class="language-plaintext highlighter-rouge">ocamlobjinfo</code>, so adjust the test for cross-distribution compatibility. [<a href="https://salsa.debian.org/reproducible-builds/diffoscope/commit/3a2303e5">…</a>]</li> <li>Bump debhelper compatibility level to 14. [<a href="https://salsa.debian.org/reproducible-builds/diffoscope/commit/ae1d587a">…</a>]</li> <li>Fix compatibility with Ocaml 5.4.1. [<a href="https://salsa.debian.org/reproducible-builds/diffoscope/commit/50476c66">…</a>]</li> <li>Use <code class="language-plaintext highlighter-rouge">--long-form</code>-style arguments when calling <code class="language-plaintext highlighter-rouge">apktool</code> in order to support <em>apktool</em> version 3. [<a href="https://salsa.debian.org/reproducible-builds/diffoscope/commit/02c65572">…</a>]</li> <li>Support Androguard version 4 and previous versions at the same time. [<a href="https://salsa.debian.org/reproducible-builds/diffoscope/commit/2b17885b">…</a>]</li> <li>Update copyright years. [<a href="https://salsa.debian.org/reproducible-builds/diffoscope/commit/bf7aa877">…</a>]</li> </ul> <p>In addition, Jochen Sprickerhof added better header detection for the <a href="https://www.sphinx-doc.org/en/master/">Sphinx documentation system</a> [<a href="https://salsa.debian.org/reproducible-builds/diffoscope/commit/b800d697">…</a>], Michael Daniels fixed the tests when run with <em>zipdetails</em> version 4.006 [<a href="https://salsa.debian.org/reproducible-builds/diffoscope/commit/fade8d04">…</a>] and Zbigniew Jędrzejewski-Szmek added a version of the deprecated <code class="language-plaintext highlighter-rouge">os.path.commonprefix</code> method [<a href="https://salsa.debian.org/reproducible-builds/diffoscope/commit/2af9e134">…</a>].</p> <p>In addition, Vagrant Cascadian <a href="https://codeberg.org/guix/guix/commit/43f80a83c99f7e3bf82cc27c5a95b9aead659ee6">updated <em>diffoscope</em> in GNU Guix to version <code class="language-plaintext highlighter-rouge">321</code></a> and <a href="https://codeberg.org/guix/guix/commit/636a104836fe00fca5844e15e3c40c9cf5cd1427"><code class="language-plaintext highlighter-rouge">323</code></a>.</p> <p><br /></p> <p>Chris Lamb also made the following changes to <em><a href="https://tracker.debian.org/pkg/strip-nondeterminism">strip-nondeterminism</a></em>, our tool to remove specific non-deterministic results from a completed build:</p> <ul> <li>Skip symlinks when manually called via <code class="language-plaintext highlighter-rouge">/usr/bin/strip-nondeterminism</code>. (<a href="https://bugs.debian.org/1139000">#1139000</a>)</li> <li>Update <code class="language-plaintext highlighter-rouge">debian/watch</code> format. [<a href="https://salsa.debian.org/reproducible-builds/strip-nondeterminism/commit/9042813">…</a>]</li> <li>Drop <code class="language-plaintext highlighter-rouge">Rules-Requires-Root: no</code> and <code class="language-plaintext highlighter-rouge">Priority: optional</code> fields. [<a href="https://salsa.debian.org/reproducible-builds/strip-nondeterminism/commit/7399bc4">…</a>]</li> <li>Bump <code class="language-plaintext highlighter-rouge">Standards-Version</code> to version 4.7.4. [<a href="https://salsa.debian.org/reproducible-builds/strip-nondeterminism/commit/aa3e692">…</a>]</li> </ul> <p><br /></p> <h3 id="from-our-mailing-list">From our mailing list…</h3> <p>On <a href="https://lists.reproducible-builds.org/listinfo/rb-general/">our mailing list</a> this month:</p> <ul> <li> <p><em>kpcyrd</em> posted to our mailing list regarding the “waves of malware uploads to <a href="https://aur.archlinux.org/">aur.archlinux.org</a>”. Curiously, “every incident I looked at used npmjs.com for malware delivery”, specifically where the <code class="language-plaintext highlighter-rouge">npm</code> package includes an (automatically executed) <code class="language-plaintext highlighter-rouge">preinstall</code> script that is an ELF binary.</p> </li> <li> <p><em>kpcyrd</em> also announced the release of <a href="https://github.com/kpcyrd/debian-repro-status"><em>debian-repro-status</em></a> version <a href="https://github.com/kpcyrd/debian-repro-status/releases/tag/v0.4.0">0.4.0</a>, a tool written “to give you an approximate idea of how viable it would be to enforce a ‘reproducible packages only’ update policy for the computer system you’ve built”:</p> <blockquote> <p>The change updates dependencies to the latest versions, and adds support for multiple <code class="language-plaintext highlighter-rouge">-H</code> options, to query results from multiple rebuilderd instances. The results are also now fetched concurrently.</p> </blockquote> </li> <li> <p><em>kpcyrd</em> also reported that, whilst taking a screenshot for the above release, they noticed that the <code class="language-plaintext highlighter-rouge">debian:sid</code> <a href="https://lists.reproducible-builds.org/pipermail/rb-general/2026-June/004121.html">container now is 100% reproducible</a>.</p> </li> <li> <p>Finally, <em>kpcyrd</em> <strong>also</strong> <a href="https://github.com/keszybz/add-determinism/pull/78">created a pull request</a> against the <a href="https://github.com/keszybz/add-determinism"><em>add-determinism</em></a> package to update the <a href="https://docs.python.org/3/library/itertools.html"><code class="language-plaintext highlighter-rouge">itertools</code></a> and <a href="https://docs.python.org/3/library/zipfile.html"><code class="language-plaintext highlighter-rouge">zip</code></a> Python dependencies.</p> </li> </ul> <p><br /></p> <h3 id="documentation-updates">Documentation updates</h3> <p><a href="https://reproducible-builds.org/"><img alt="" src="https://reproducible-builds.org/images/reports/2026-06/website.png#right" /></a></p> <p>Yet again, there were a number of improvements made to our website this month including:</p> <ul> <li> <p>Chris Lamb added a reminder re. using the UTC variants of the Javascript <code class="language-plaintext highlighter-rouge">Date</code> methods. [<a href="https://salsa.debian.org/reproducible-builds/reproducible-website/commit/27245b53">…</a>]</p> </li> <li> <p>Mattia Rizzolo moved <a href="https://www.opentech.fund/">OTF</a> to the ‘old’ sponsors list. Thank you for your support!. [<a href="https://salsa.debian.org/reproducible-builds/reproducible-website/commit/d029630d">…</a>]</p> </li> <li> <p><em>kpcyrd</em> updated the <a href="https://rust-lang.org/">Rust</a> documentation to recommend using the <code class="language-plaintext highlighter-rouge">--release</code> argument for consistency. [<a href="https://salsa.debian.org/reproducible-builds/reproducible-website/commit/f5d645e5">…</a>]</p> </li> </ul> <p><br /></p> <h3 id="patches">Patches</h3> <p>The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where applicable or possible. This month, we wrote a large number of such patches, including:</p> <ul> <li> <p>Bernhard M. Wiedemann:</p> <ul> <li><a href="https://bugzilla.opensuse.org/show_bug.cgi?id=1268265"><code class="language-plaintext highlighter-rouge">cvise</code></a></li> <li><a href="https://build.opensuse.org/request/show/1362390"><code class="language-plaintext highlighter-rouge">efl</code></a></li> <li><a href="https://bugzilla.opensuse.org/show_bug.cgi?id=1268542"><code class="language-plaintext highlighter-rouge">gettext-runtime/bash</code></a></li> <li><a href="https://bugzilla.opensuse.org/show_bug.cgi?id=1268340"><code class="language-plaintext highlighter-rouge">hadrian</code></a></li> <li><a href="https://build.opensuse.org/request/show/1362888"><code class="language-plaintext highlighter-rouge">plasma6-keyboard</code></a></li> <li><a href="https://invent.kde.org/frameworks/syntax-highlighting/-/merge_requests/806"><code class="language-plaintext highlighter-rouge">syntax-highlighting</code></a></li> </ul> </li> <li> <p>Chris Lamb:</p> <ul> <li><a href="https://bugs.debian.org/1139654">#1139654</a> filed against <a href="https://tracker.debian.org/pkg/node-fuse.js"><code class="language-plaintext highlighter-rouge">node-fuse.js</code></a>.</li> <li><a href="https://bugs.debian.org/1139655">#1139655</a> filed against <a href="https://tracker.debian.org/pkg/node-egjs-hammerjs"><code class="language-plaintext highlighter-rouge">node-egjs-hammerjs</code></a>.</li> <li><a href="https://bugs.debian.org/1139656">#1139656</a> filed against <a href="https://tracker.debian.org/pkg/node-chartjs-adapter-date-fns"><code class="language-plaintext highlighter-rouge">node-chartjs-adapter-date-fns</code></a>.</li> <li><a href="https://bugs.debian.org/1139662">#1139662</a> filed against <a href="https://tracker.debian.org/pkg/mkdocs-include-markdown-plugin"><code class="language-plaintext highlighter-rouge">mkdocs-include-markdown-plugin</code></a>.</li> <li><a href="https://bugs.debian.org/1139704">#1139704</a> filed against <a href="https://tracker.debian.org/pkg/lmarbles"><code class="language-plaintext highlighter-rouge">lmarbles</code></a>.</li> <li><a href="https://bugs.debian.org/1140240">#1140240</a> filed against <a href="https://tracker.debian.org/pkg/rocm-docs-core"><code class="language-plaintext highlighter-rouge">rocm-docs-core</code></a>.</li> <li><a href="https://bugs.debian.org/1140567">#1140567</a> filed against <a href="https://tracker.debian.org/pkg/libecoli"><code class="language-plaintext highlighter-rouge">libecoli</code></a>.</li> <li><a href="https://bugs.debian.org/1140688">#1140688</a> filed against <a href="https://tracker.debian.org/pkg/golang-github-tobischo-gokeepasslib"><code class="language-plaintext highlighter-rouge">golang-github-tobischo-gokeepasslib</code></a>.</li> </ul> </li> <li> <p>Jochen Sprickerhof:</p> <ul> <li><a href="https://bugs.debian.org/1139457">#1139457</a> filed against <a href="https://tracker.debian.org/pkg/c-munipack"><code class="language-plaintext highlighter-rouge">c-munipack</code></a>.</li> <li><a href="https://bugs.debian.org/1140365">#1140365</a> filed against <a href="https://tracker.debian.org/pkg/latex-coffee-stains"><code class="language-plaintext highlighter-rouge">latex-coffee-stains</code></a>.</li> <li><a href="https://bugs.debian.org/1140366">#1140366</a> filed against <a href="https://tracker.debian.org/pkg/cxxtest"><code class="language-plaintext highlighter-rouge">cxxtest</code></a>.</li> <li><a href="https://bugs.debian.org/1140367">#1140367</a> filed against <a href="https://tracker.debian.org/pkg/slime"><code class="language-plaintext highlighter-rouge">slime</code></a>.</li> <li><a href="https://bugs.debian.org/1140368">#1140368</a> filed against <a href="https://tracker.debian.org/pkg/spooles"><code class="language-plaintext highlighter-rouge">spooles</code></a>.</li> <li><a href="https://bugs.debian.org/1140369">#1140369</a> filed against <a href="https://tracker.debian.org/pkg/sdpb"><code class="language-plaintext highlighter-rouge">sdpb</code></a>.</li> <li><a href="https://bugs.debian.org/1140645">#1140645</a> filed against <a href="https://tracker.debian.org/pkg/procmail"><code class="language-plaintext highlighter-rouge">procmail</code></a>.</li> <li><a href="https://bugs.debian.org/1140676">#1140676</a> filed against <a href="https://tracker.debian.org/pkg/proftpd-dfsg"><code class="language-plaintext highlighter-rouge">proftpd-dfsg</code></a>.</li> <li><a href="https://bugs.debian.org/1141059">#1141059</a> filed against <a href="https://tracker.debian.org/pkg/mah-jong"><code class="language-plaintext highlighter-rouge">mah-jong</code></a>.</li> <li><a href="https://bugs.debian.org/1141133">#1141133</a> filed against <a href="https://tracker.debian.org/pkg/dxf2gcode"><code class="language-plaintext highlighter-rouge">dxf2gcode</code></a>.</li> <li><a href="https://bugs.debian.org/1141194">#1141194</a> filed against <a href="https://tracker.debian.org/pkg/afterstep"><code class="language-plaintext highlighter-rouge">afterstep</code></a>.</li> <li><a href="https://bugs.debian.org/1141195">#1141195</a> filed against <a href="https://tracker.debian.org/pkg/ledger2beancount"><code class="language-plaintext highlighter-rouge">ledger2beancount</code></a>.</li> <li><a href="https://bugs.debian.org/1141196">#1141196</a> filed against <a href="https://tracker.debian.org/pkg/ocamlviz"><code class="language-plaintext highlighter-rouge">ocamlviz</code></a>.</li> </ul> </li> <li> <p>Kris Van Hee and Vagrant Cascadian:</p> <ul> <li><a href="https://bugs.debian.org/1140167">#1140167</a> filed against <a href="https://tracker.debian.org/pkg/dtrace"><code class="language-plaintext highlighter-rouge">dtrace</code></a>.</li> </ul> </li> </ul> <p><br /></p> <h3 id="four-new-scholarly-papers">Four new scholarly papers</h3> <p><a href="https://lab.iisec.ac.jp/~suzaki_lab/PDF/DSN-HAP26_muto.pdf"><img alt="" src="https://reproducible-builds.org/images/reports/2026-06/DSN-HAP26_muto.png#right" /></a></p> <p>Kenichiro Muto and Kuniyasu Suzaki of the <a href="https://www.iisec.ac.jp/english/">Institute of Information Security</a> in Yokohama, Japan published an interesting paper this month titled <a href="https://lab.iisec.ac.jp/~suzaki_lab/PDF/DSN-HAP26_muto.pdf"><em>Attestable Build Chain: Enabling Trust in Reproducible Builds</em></a> (PDF). Their abstract is as follows:</p> <p>Ensuring trust in software supply chains requires verifying not only artifacts but also the processes that produce them. Although Reproducible Builds (R-B) require rebuilding to validate artifacts, they cannot verify whether the build was executed with the intended toolchain and inputs and may reproduce unintended or compromised builds without detection. We present Attestable Build Chain, a framework for externally verifying build-time execution without rebuilding. Rather than preventing compromise, it provides verifiable, tamper-evident evidence of actual build-time execution, enabling verification of build process integrity from observed file accesses during the build. [<a href="https://lab.iisec.ac.jp/~suzaki_lab/PDF/DSN-HAP26_muto.pdf">…</a>]</p> <p><br /></p> <p><a href="https://hal.science/hal-05630285v1"><img alt="" src="https://reproducible-builds.org/images/reports/2026-06/2025-nixpkgs-reproducibility-extended.png#right" /></a></p> <p>Julien Malka, Stefano Zacchiroli and Théo Zimmermann published a 50-page report detailing <a href="https://hal.science/hal-05630285v1"><em>A Decade of Software Reproducibility in the Nix Package Ecosystem</em></a>:</p> <blockquote> <p>We find that functional package management enables extremely high rebuildability over time (<strong>near-universal ability to reconstitute historical build environments and rebuild software packages</strong>), while bitwise reproducibility has steadily improved and reaches a high point in recent years (up to 93% in 2024). Early years show substantially lower bitwise reproducibility, indicating that functional package management alone does not guarantee bitwise-identical outputs, and that the observed high level of bitwise reproducibility is not solely due to the package management approach. Common causes of unreproducibility, both in the rebuildability and bitwise reproducibility dimensions, include management of dates in build and test processes; we quantify their prevalence and other common causes using manual analysis of logs of rebuild failures and automated analysis of <a href="https://diffoscope.org/"><em>diffoscope</em></a>.</p> </blockquote> <p>A <a href="https://hal.science/hal-05630285v1/file/2025-nixpkgs-reproducibility-extended.pdf">PDF of their report</a> is available online</p> <p><br /></p> <p><a href="https://devguard.org/research-development/bit-for-bit-building-sovereign-reproducible-container-supply-chain-devguard.pdf"><img alt="" src="https://reproducible-builds.org/images/reports/2026-06/bit-for-bit-building-sovereign-reproducible-container-supply-chain-devguard.png#right" /></a></p> <p>Tim Bastin of <a href="https://l3montree.com/">L3montree GmbH</a> and Jacek Galowicz of <a href="https://applicative.systems/">Applicative Systems GmbH</a> from <a href="https://devguard.org/">DevGuard</a> published a paper detailing <a href="https://devguard.org/research-development/bit-for-bit-building-sovereign-reproducible-container-supply-chain-devguard.pdf"><em>How We Built a Sovereign, Reproducible Container Supply Chain for DevGuard</em></a>:</p> <blockquote> <p>This paper presents how the <a href="https://devguard.org/">DevGuard</a> project rebuilt its <a href="https://opencontainers.org/">OCI container</a> pipeline around reproducible <a href="https://nixos.org/">Nix</a> builds and independent dual-platform digest verification. DevGuard images are built hermetically from pinned source revisions, signed with <a href="https://github.com/sigstore/cosign">Sigstore/Cosign</a>, and verified through digest comparison across GitHub Actions and sovereign GitLab infrastructure hosted on container.gov.de. We describe the practical integration of reproducible OCI image builds into existing CI/CD workflows and argue that independently reproducible container digests provide a stronger integrity guarantee against build tampering than provenance alone. The paper further discusses remaining trust assumptions and the relevance of sovereign build infrastructure for government and regulated environments.</p> </blockquote> <p><br /></p> <p><a href="https://www.sciencedirect.com/science/article/pii/S2405959526001086"><img alt="" src="https://reproducible-builds.org/images/reports/2026-06/1-s2.0-S2405959526001086-main.png#right" /></a></p> <p>Finally, Yiseul Choi, Junga Kim, Jun-Ho Hong and Seongmin Kim of the <a href="https://www.sungshin.ac.kr/main_eng/15348/subview.do">Department of Convergence Security Engineering</a> at the <a href="https://www.sungshin.ac.kr/">Sungshin Women’s University</a> in Seoul, Korea titled <a href="https://www.sciencedirect.com/science/article/pii/S2405959526001086"><em>Attestation-based verification of SBOM integrity via consumer-side reproducibility</em></a>:</p> <blockquote> <p>Software bills of materials (SBOMs) support supply chain transparency, but they do not prove that a delivered SBOM reproducibly corresponds to its software artifact. Existing signing and provenance mechanisms protect integrity and traceability, yet lack consumer-side reproducible verification. We propose an SBOM integrity verification framework combining procedure disclosure, consumer-side reproduction, authority-generated reference evidence, and digest comparison. A trusted authority records a reference digest, and consumers compare it with locally reproduced and delivered SBOM digests. Experiments on 100 real-world container images show detection of artifact tampering, SBOM substitution, distribution modification, and adaptive tampering beyond signature-based approaches</p> </blockquote> <p><br /> <br /></p> <p>Finally, if you are interested in contributing to the Reproducible Builds project, please visit our <a href="https://reproducible-builds.org/contribute/"><em>Contribute</em></a> page on our website. However, you can get in touch with us via:</p> <ul> <li> <p>IRC: <code class="language-plaintext highlighter-rouge">#reproducible-builds</code> on <code class="language-plaintext highlighter-rouge">irc.oftc.net</code>.</p> </li> <li> <p>Mastodon: <a href="https://fosstodon.org/@reproducible_builds">@reproducible_builds@fosstodon.org</a></p> </li> <li> <p>Mailing list: <a href="https://lists.reproducible-builds.org/listinfo/rb-general"><code class="language-plaintext highlighter-rouge">rb-general@lists.reproducible-builds.org</code></a></p> </li> </ul> 2026-07-11T19:27:22+00:00 Reproducible Builds https://current.workingdirectory.net/posts/2026/dns-high-availability/ <p>At <a href="https://mayfirst.coop">May First</a>, we recently received (all within a single week) three different complaints about domain names that previously worked fine suddenly not resolving to our servers.</p> <p>While that isn’t terribly uncommon, we discovered that in each case, the domain name’s authoritative name servers were pointing to our mail servers (<code>a.mx.mayfirst.org</code>, <code>b.mx.mayfirst.org</code> and <code>c.mx.mayfirst.org</code>) instead of our name servers (<code>a.ns.mayfirst.org</code>, <code>b.ns.mayfirst.org</code> and <code>c.ns.mayfirst.org</code>). The weird part: this mistaken configuration was happening at the registrar level, protected by each member’s own credentials that we don’t have access to.</p> <p>Each affected member fixed their records to resolve the problem but also made very clear that they had not logged into their registrar in years, sugggesting that the DNS authoritative records in their registrar accounts spontaneously changed on their own. The first time was weird, the second time could possibly be a coincidence? But by the third time this happened, we started to panic. <em>How could registrar records spontaneously change?</em> All three domain names were registered with different companies - so it couldn’t be a single registrar problem? Are we going to get a flood of these complaints? What is going on!?!?</p> <p>We did an inventory to see if this was happening with other domain names in use by our membership and that’s when we discovered just how hard it is for our mostly non-technical users to set a domain’s authoritative name servers. The error rate was less than 1% but still that was a lot of domain names with typos:</p> <ul> <li>raise your fist in the air with <code>a.ns.mayfist.org</code>!</li> <li>or just plain give up and hit the floor with <code>a.ns.matfirst.org</code></li> <li>Or more commonly people added our name servers, but also left the default name servers in place.</li> <li>Also, one person added as their authoritative name servers: <code>a.ns.mayfirst.org</code>, <code>b.ns.mayfirst.org</code>, <code>c.ns.mayfirst.org</code>, <code>a.mx.mayfirst.org</code>, <code>b.mx.mayfirst.org</code>, <code>c.mx.mayfirst.org</code>, and even <code>a.webproxy.mayfirst.org</code> - in other words, all the domain names we tell you do to anything with.</li> <li>And lastly, I did find two more domains just pointing to <code>a.mx.mayfirst.org</code>, <code>b.mx.mayfirst.org</code> and <code>c.mx.mayfirst.org</code>.</li> </ul> <p>That’s when it occurred to me: for years we have maintained an offsite server that provides <em>both</em> <code>c.ns.mayfirst.org</code> and <code>c.mx.mayfirst.org</code>. It hangs out in case something terrible happens to our main colo. The week before we started receiving these complaints, I separated these services, moving <code>c.mx.mayfirst.org</code> to a dedicated MX server. As a result, these two domain names stopped pointing to the same IP address. And that’s when the complaints started rolling in. In other words: the affected members set the incorrect name servers years ago, but because just one of the name servers resolved to an IP that happened to provide the correct authoritative lookup services, it went undeteced all this time.</p> <p>So… mystery solved. Nobody’s authoritative registrar records “suddenly” changed. They were mis-configured for years but <em>thanks to the amazing resilience of the DNS system, nobody noticed because just one working DNS server is all you need.</em></p> 2026-07-11T12:27:10+00:00 Jamie McClelland https://jmtd.net/log/fly30/ <p>I used to ice skate as a teenager but I stopped at University. I tried to pick it back up in 2024 but had to stop when I got <a href="https://jmtd.net/log/ouch/">ill</a>. I restarted in 2025, initially with a weekly skate session but last month I started group hockey skate lessons.</p> <div class="centre"> <div class="image+centre"> <a href="https://jmtd.net/log/fly30/heat.jpg"><img alt="IR photo of me skating" class="img" height="378" src="https://jmtd.net/log/fly30/400x-heat.jpg" width="400" /></a> <p></p><p>There's not a lot of pics of me skating… this one from an IR camera</p><p></p> </div> </div> <p>I've been skating in a pair of Bauer<sup id="fnref:1"><a href="https://jmtd.net/log/#fn:1" rel="footnote">1</a></sup> Nexus N77s that I bought <a href="https://jmtd.net/log/Toronto/">7 years ago on a work trip to Toronto</a>. These did a great job of getting me back into the hobby for 6 years but recently I felt it was time to step up to a better quality pair. Despite being a size down from my shoe size, the Nexuses are too large: I had been compensating with thick socks but still struggling to get the boots tight enough. I'd have to wear gloves to lace up because I'd cut my hands pulling the laces otherwise.</p> <p>After too long researching/deliberating/kvetching (very much on trend for me) I upgraded to Bauer Vapor Fly30s another half-size down (and nearly ten times as much). The fit is <em>much</em> better, in almost every respect. They actually go on easier and I don't have to tear my hands tightening the laces. They feel like a natural extension of my feet. I seem to be using a different set of muscles to skate, so the first few sessions were very fatiguing, but that settled. The Vapor line is speed-oriented, which I thought would fit my skate style best.</p> <div class="centre"> <div class="image+centre"> <a href="https://jmtd.net/log/fly30/skates.jpg"><img alt="new and old skates" class="img" height="225" src="https://jmtd.net/log/fly30/400x-skates.jpg" width="400" /></a> <p>new and old skates</p> </div> </div> <p>I have unfortunately gained a common problem: arch pain. More precisely, my navicular bone seems to be quite prominent<sup id="fnref:2"><a href="https://jmtd.net/log/#fn:2" rel="footnote">2</a></sup>, and that part is pressing uncomfortably into the boot. Boots typically take a few sessions to break in, but after 7-8 sessions the pain was getting to the stage that I couldn't skate for a full session without being in agony.</p> <p>The last time I skated I tried to throw everything at the problem: I'd had the skates baked<sup id="fnref:3"><a href="https://jmtd.net/log/#fn:3" rel="footnote">3</a></sup>; bought some orthotic insoles; then some "Bunga" pads over the sore bit and an attempt to more loosely tie the laces over the affected area. I tried a ten minute skate, and it <em>seemed</em> a bit better.</p> <p>I then tried experimentally to swap back to my old skates, and I felt like Bambi: I just couldn't do it! They didn't press on the navicular, and they're softer so you <em>can</em> compensate for the size with tight lacing, but I had no confidence in them, I couldn't lean into the turns. They just felt <em>weird</em>. I realised there's no way back.</p> <p>I switched back to the fly30s, adjusted the bunga pad positioning, tweaked the lacing and went back on for about 40 minutes. It went well: the rink was quiet, it was cool whilst we had a heat wave outside, so I worked up a sweat. By the end there was <em>some</em> discomfort, but not too much, and I think partly the area is currently sensitive so just about anything will cause discomfort. Fingers (or toes) crossed that I've mitigated the problem! If not, it might be time to try a <em>punch out</em>.</p> <div class="footnotes"> <hr /> <ol> <li id="fn:1"> I've owned four pairs of skates: all hockey, my first were Bauers, my second CCM Tacks of some kind. I've no idea what happened to them.<a href="https://jmtd.net/log/#fnref:1" rev="footnote">↩</a></li> <li id="fn:2"> Or possibly I have <em>accessory navicular</em> bones<a href="https://jmtd.net/log/#fnref:2" rev="footnote">↩</a></li> <li id="fn:3"> modern mid-tier skates are thermoformable, and many skate shops carry a specially designed oven to briefly bake skates such that you wear them as they cool and the padding should mould to your foot.<a href="https://jmtd.net/log/#fnref:3" rev="footnote">↩</a></li> </ol> </div> 2026-07-10T20:57:20+00:00 jmtd https://retout.co.uk/2026/07/10/blocking-distracting-news-links/ <p><em>“You are what you eat”</em> – but perhaps this is even more true of our information diet. It is hard to strike a balance between remaining a well-informed citizen versus spending hours ingesting unnecessary news about issues and events we can’t affect. But I’m increasingly convinced that my hours lost to doomscrolling are down to design choices by web publishers rather than a failure of individual willpower.</p> <h3 id="we-have-created-an-obesogenic-information-environment">We have created an “obesogenic” information environment</h3> <p>I don’t think it is just me – I think our information environment has been progressively altered over time as news sites look to maximize engagement. Even outside of social media, the invisible hand of the market for eyeballs forces sites to optimize for browse time or risk irrelevance.</p> <p>Even as newspapers find it increasingly difficult to fund good journalism through advertising in an online world, especially local journalism, they need to keep readers on their sites, clicking through as many articles as possible. Clickbait headlines, “urgent” flashing live icons to draw the attention, and many opportunities to leap from one article to another, and another.</p> <p>But this design approach even extends to news organisations with a different funding model, like BBC News, which is a public service (state-owned but arms-length) organisation funded through a mandatory television licence – a matter of controversy in some quarters. And it extends even to sites where I pay a subscription fee; I might get adverts removed, but I am still bombarded with the same design philosophy; too many opportunities to be pulled away from what I’m reading towards some other unrelated article.</p> <p>Even if I try and limit my exposure to algorithmic “discovery” of new news, via RSS feeds or similar, if I’m reading the full article in a browser then I am prompted to read more stuff that I didn’t intend. This defeats the benefit of curating a set of feeds, because you still get dragged away to random articles.</p> <h3 id="only-44-of-bbc-news-is-news">Only 44% of BBC News is news</h3> <p>To show you what I mean, I’m going to pick on the BBC, although I love them dearly and the same issue very much applies elsewhere.</p> <p>I’ve taken a screenshot of a <a href="https://www.bbc.co.uk/news/articles/cly9r54e5r4o">random BBC News article</a> in mobile view (my preferred doomscrolling user access device), and measured approximately what proportion of the full length of the page is taken up by each section. This is a fairly in-depth news article, so I reckon if anything the figures would be worse than this on shorter articles.</p> <p><img alt="A full-length screenshot of a BBC News article showing proportions of the page allocated to the main article vs. related links etc." src="https://retout.co.uk/2026/bbc-news-website.drawio.svg" /></p> <p>(These numbers will not sum to 100% for reasons which are obvious if you look at the crossbars. Also they’re approximations.)</p> <p>Less than half of the page (44% if you exclude the inline related links) is actual news text/images; the rest are links trying to help you find the next thing to read/watch. <em>I do not want this.</em></p> <p>I’m sure this A/B tests well in terms of reader figures, but it sometimes leaves me exhausted – it must take subconscious mental energy to ignore, or I spend too much time trying to keep on top of things.</p> <p>And remember, this is a publicly-funded site that does not rely on advertising!</p> <h3 id="blocking-out-the-noise">Blocking out the noise</h3> <p>If you are technically-minded, you can use an ad-blocker such as uBlock Origin to take back some control. Applying the following lines as a custom filter (Settings &gt; My filters) brutally cuts out almost all of these links:</p> <div class="code-block-wrapper"><pre tabindex="0"><code>bbc.co.uk##aside bbc.co.uk##footer&gt;div:has(h2) bbc.co.uk##[data-block="uploaderEmbed"] bbc.co.uk##[data-block="links"]</code></pre></div> <p><em>Caveat emptor:</em> I have not road-tested this for more than half an hour, so who knows what consequences this could have on your web browsing. In particular, international readers outside the UK will likely be redirected to bbc.com, the commercial arm of the BBC, where these rules will need adapting.</p> <p>Is it unethical to use an ad-blocker to remove these links? I would argue not. I am not depriving the BBC of any revenue, because I pay my licence fee. I might reduce the amount of time I spend on their website, but if anything the subjectively better experience might encourage me to consume more news from them, not less. In other circumstances (outside the UK for instance, where the BBC relies on advertising), the balance might be different.</p> <h3 id="product-managers-please-find-better-metrics">Product managers, please find better metrics</h3> <p>I lament the state of the internet in 2026. I now can’t unsee these innocuous “related stories” links as a mechanism to grab my attention, and it’s gone too far.</p> <p>If you are a normal person just browsing the news and looking to discover the latest important stories relatively quickly, I can see that these types of links might actually be useful for discovery; but I’m actually reasonably sure that I’m not going to miss out on anything major. You still have the option of the news home page if you want to be presented with more news for example, and it feels natural to go back to there when you’ve run out of stories to consume.</p> <p>But it shouldn’t be down to individual responsibility to ignore or geekily block these types of link; news sites with alternative funding models should find better metrics for engagement than “hours spent on site” – how about optimizing for customer mental wellbeing, or minimizing time required to catch up with the news? There’s no need to maximize clicks and eyeballs. This is a societal level issue, because we are all going mad with news over-engagement.</p> <p>Product managers, over to you.</p> 2026-07-10T15:00:00+00:00 Tim Retout https://bits.debian.org/2026/07/new-developers-2026-07.html <p>The following contributors got their Debian Developer accounts in the last two months:</p> <ul> <li>Vivek K J (vivek)</li> <li>Benjamin Somers (bensmrs)</li> <li>Colin King (colinianking)</li> <li>Nadzeya Hutsko (nadzeya)</li> </ul> <p>The following contributors were added as Debian Maintainers in the last two months:</p> <ul> <li>Pieter Lenaerts</li> <li>Syed Shahrukh Hussain</li> <li>Ural Tunaboyu</li> </ul> <p>Congratulations!</p> 2026-07-10T07:00:00+00:00 Jean-Pierre Giraud https://diffoscope.org/news/diffoscope-324-released/ <p>The diffoscope maintainers are pleased to announce the release of diffoscope version <code class="language-plaintext highlighter-rouge">324</code>. This version includes the following changes:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>[ Paul Spooren ] * Allow trailing garbage in Gzip files. [ Chris Lamb ] * Bump debhelper compatibility level to 14. </code></pre></div></div> <p>You find out more by <a href="https://diffoscope.org">visiting the project homepage</a>.</p> 2026-07-10T00:00:00+00:00 Reproducible Builds (diffoscope) https://blog.trueelena.org/blog/2026/07/10-cockades/index.html <article> <section class="header"> Posted on July 10, 2026 <br /> Tags: <a href="https://blog.trueelena.org/tags/madeof%3Aatoms.html" title="All pages tagged 'madeof:atoms'.">madeof:atoms</a>, <a href="https://blog.trueelena.org/tags/FreeSoftWear.html" title="All pages tagged 'FreeSoftWear'.">FreeSoftWear</a>, <a href="https://blog.trueelena.org/tags/craft%3Asewing.html" title="All pages tagged 'craft:sewing'.">craft:sewing</a> </section> <section> <p><img alt="six cockades in black, grey, white, purple, in different sizes and with different centrepieces. One is only black and white and has a penguin pin in the middle." class="align-center" src="https://blog.trueelena.org/blog/2026/07/10-cockades/pile_of_cockades.jpg" style="width: 80.0%;" /></p> <p>Earlier this year, I made myself a new hat (it will be blogged), and I wanted to put a nice cockade on it. So, I looked for suitable ribbons, and couldn’t find any. I found some ribbon that looked passable, but the colours I wanted weren’t available, so I set up the website to notify me, and kept working on the hat.</p> <p>Eventually the hat was done, the ribbon was still not available, so I decorated the hat with fake flowers from my stash, and started wearing it.</p> <p>And that’s when I got notified that the ribbon was back in stock.</p> <p>By the time the ribbon arrived, I had decided that the hat looked better with the flowers, and project cockade was put on hold, possibly for a future hat.</p> <p>And then June came, and what could be a better time than that for a project based on flag colours?</p> <p>As I feared, the ribbon I got wasn’t the best: it was a bit too stiff and plasticy, and not really usable for many other things. It did however work well enough for a cockade, and I decided it was a good chance to try different methods and designs, and then make another one to take pictures and publish step-by-step instructions.</p> <p>And that’s the perfect recipe to find oneself surrounded by a somewhat unreasonable number of very similar cockades, I guess.</p> <p><img alt="A big cockade with four ribbons, starting with purple on the outside, and a black bead in the middle covering the centre of the black ribbon. The pleating isn't the most regular, and the black ribbon at the centre is almost more gathered than pleated." class="align-center" src="https://blog.trueelena.org/blog/2026/07/10-cockades/number_one.jpg" style="width: 80.0%;" /></p> <p>I looked around for instructions, and the ones that gave a result that was closer to my mental idea of a cockade were the ones by <a href="https://blog.americanduchess.com/2010/04/how-to-make-18th-c-cockades.html">American Duchess</a>, so on my first attempt I tried to follow those.</p> <p>I didn’t have a cork board with a hole, so it was a bit fiddly, and the result was passable, but could have been better. Meanwhile I saw <a href="https://www.authentic-campaigner.com/forum/military-forums/camp-of-instruction/18697-easy-to-make-cockades#post163741">a forum post commenting on the above tutorial</a> and that gave me ideas for a procedure more suitable to the tools I had.</p> <p><img alt="A cockade with tree ribbons, starting with purple on the outside, then white, grey, and a black bead in the middle that is a bit bigger than the one on the previous one. The pleating isn't perfect, but neater than the previous one." class="align-center" src="https://blog.trueelena.org/blog/2026/07/10-cockades/number_two.jpg" style="width: 80.0%;" /></p> <p>The second cockade I made was indeed more satisfactory, and I also started to experiment with making a center piece with ribbons, to cut down on the types of materials needed.</p> <p>On this one I also tried to add a pin backing, so that I could write instructions on how to do it in what I believe is a more stable way than simply adding it to the felt backing at the end.</p> <p>I’m not sure whether the other ones will be tacked to a hat, and thus won’t require pins at all, or if I’ll just put them on some dress with pins hidden under the ribbon layers.</p> <p><img alt="A cockade with three ribbons, starting with black on the outside, then grey and white, and a flat pentagonal knot of purple ribbon at the centre." class="align-center" src="https://blog.trueelena.org/blog/2026/07/10-cockades/number_tree.jpg" style="width: 80.0%;" /></p> <p>And then I was ready to make a third cockade, taking step by step pictures for my website, and I planned to start on it the next morning.</p> <p>Trenord had different ideas.</p> <p>Thanks to the combination of independent but complete disruptions on <em>two</em> nearby train lines, I spent the morning driving a couple of people to the nearest station that was still being served by trains, and then back home less than 10 minutes before I had to start working, which if you ask<a class="footnote-ref" href="https://blog.trueelena.org#fn1" id="fnref1">¹</a> me was pretty homophobic of the train company.</p> <p>There was way less traffic than I expected, and I did enjoy the drive <a class="footnote-ref" href="https://blog.trueelena.org#fn2" id="fnref2">²</a>, but for various reasons it meant a significant delay for this post.</p> <p>Anyway, less than a week later than I had planned, halfway in June I managed to publish <a href="https://sewing-patterns.trueelena.org/accessories/decorations/multi_colour_cockade/index.html">step by step instructions on my website</a>, but I wasn’t done with the project yet.</p> <p>Beside the fact that I still needed to finish sewing the backing felt to the cockades I had done, I also had a few ideas for more centrepieces made of ribbon I wanted to try.</p> <p>And this means that I moved on to another project that was already in progress (this one will also be blogged).</p> <p><img alt="A cockade with three ribbons, starting with black on the outside, then grey and white, and two squares of purple ribbon at the centre, forming a sort of eight point star. The ribbons are box pleated and this gives the cockade a bit more of a tree-dimensional shape." class="align-center" src="https://blog.trueelena.org/blog/2026/07/10-cockades/number_four.jpg" style="width: 80.0%;" /></p> <p>After I’ve finished that one, at the very end of June I quickly made the last two centrepieces, taking pictures for the instructions, and in the next few days I also finished the cockades.</p> <p><img alt="A cockade with three ribbons, starting with purple on the outside, then white and grey, and an hexagonal shape made of black ribbon at the centre. The ribbons are again box pleated." class="align-center" src="https://blog.trueelena.org/blog/2026/07/10-cockades/number_five.jpg" style="width: 80.0%;" /></p> <p>This time, instead of plain pleats I tried to use box pleats, and I quite like the look they give, so if in the future I’ll have a need for more cockades I may use again this pleating pattern.</p> <p><img alt="A cockade with just two gathered ribbons, starting with black on the outside, then white, and a linux.it pin in the middle with a black background and two eyes and an orange beak reminding of a penguin." class="align-center" src="https://blog.trueelena.org/blog/2026/07/10-cockades/number_six.jpg" style="width: 80.0%;" /></p> <p>For the last cockade I wanted to try two things: putting a pin in the middle as a centrepiece, and gathering the ribbons.</p> <p>For the pin, I found that the only one I had that had a colour scheme compatible with the ribbons I had was one with the penguin from linux.it, which had a black background, so I put black ribbon on the outside and white next to it for contrast.</p> <p>And gathering was done with a whipped gather with ribbons that were one and a half times the outer circumference of their slot, and looks decent enough, but I think I prefer the look of pleated cockades a lot. Maybe it would look better with a softer ribbon.</p> <p>Anyway, I think this is plenty of cockades for the time being, unless I get tempted by buying more colours of ribbon to make different ones. But I’m not making an online purchase just for those. <em>I</em> <em>am</em> <em>not</em>.</p> <section class="footnotes footnotes-end-of-document"> <hr /> <ol> <li id="fn1"><p>you probably shouldn’t.<a class="footnote-back" href="https://blog.trueelena.org#fnref1">↩︎</a></p></li> <li id="fn2"><p>also thanks to my partner who, on entering the destination town, told me to stop on the big, straight, two-way road with plenty of roundabouts to turn around, and went through the maze of one-way streets to the station by foot.<a class="footnote-back" href="https://blog.trueelena.org#fnref2">↩︎</a></p></li> </ol> </section> </section> </article> 2026-07-10T00:00:00+00:00 Elena “of Valhalla” https://jmtd.net/log/synths/minilogue-xd/module/ <p>I bought a new synth! Kind-of.</p> <p>I've traded my <a href="https://jmtd.net/log/synths/minilogue-xd/">Minilogue-XD</a> (full-size version with integrated keyboard) for the desktop/modular alternative.</p> <div class="image"> <a href="https://jmtd.net/log/synths/minilogue-xd/module.jpg"><img alt="Modular Minilogue XD" class="img" height="300" src="https://jmtd.net/log/synths/minilogue-xd/module/400x-module.jpg" width="400" /></a> <p>Modular Minilogue XD</p> </div> <p>Why? Partly, because it fits on my desk better. Partly, because it changes the way you engage with the instrument. It makes a huge difference: the ivory keys come with so much cultural precedent. The module version of the synth gains a switch that lets you use the 16 sequencer step buttons as note inputs, so you can still play the thing solo. But the emphasis moves away from note generation and more firmly towards tone.</p> <p>Both versions have a lovely stained wood back, which you never see; the modular one has a hint of that at the front as well (which you do see).</p> <p>I plan to eventually buy a MIDI keyboard that could drive it, and other things: possibly an Arturia KeyStep or Minilab, but there's no rush on that.</p> <p>(It's about time I recorded and shared something I produced on this)</p> 2026-07-09T19:31:38+00:00 jmtd http://blog.alteholz.eu/2026/07/my-debian-activities-in-june-2026/ <h3><strong>Debian LTS/ELTS</strong></h3> <p></p><p>This was my hundred-forty-fourth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian. </p> <p> During my allocated time I uploaded or worked on: </p><p></p> <ul><li>[<a href="https://lists.debian.org/debian-lts-announce/2026/06/msg00004.html">DLA 4615-1</a>] exim4 security update to fix one CVE related to information disclosure in combination with proxies. </li><li>[<a href="https://lists.debian.org/debian-lts-announce/2026/06/msg00005.html">DLA 4616-1</a>] haveged security update to fix one CVE related to local root privilege escalation. </li><li>[<a href="https://lists.debian.org/debian-lts-announce/2026/06/msg00007.html">DLA 4618-1</a>] gsasl security update to fix one CVE related to denial of service. </li><li>[<a href="https://lists.debian.org/debian-lts-announce/2026/06/msg00020.html">DLA 4631-1</a>] asterisk security update to fix 13 CVEs related to buffer under- or overflows, either on heap or on stack. Some are related to use-after-free or wrong processing of invalid or untrusted certificates. </li><li>[ELA-1747-1] gimp security update to fix three CVEs in Buster related to denial of service or execution of arbitrary code if malformed PSP, JPEG 2000 or PSD files are opened.</li><li>[ELA-1748-1] gimp security update to fix two CVEs in Stretch related to denial of service or execution of arbitrary code if malformed PSP or PSD files are opened.</li><li>[ELA-1749-1] exim4 security update to fix one CVEs in Buster and Stretch related to information disclosure in combination with proxies.</li><li>[ELA-1750-1] gsasl security update to fix one CVEs in Buster and Stretch related to denial of service.</li></ul> <p> Besides fixing all CVEs of <i>asterisk</i> in Bullseye, I started to look at <i>asterisk</i> in other releases as well. Rather surprisingly <i>asterisk</i> is only part of Unstable and Bullseye. All other releases don’t include any version of <i>asterisk</i> at all. So first things first, besides some security related RC bugs, <i>asterisk</i> did not migrate due to RC-bugs in <i>dahdi-linux</i>. As I maintain <i>osmocom-dahdi-linux</i> (which supports less/other hardware), I looked at the open issues and after some rounds I could upload a new upstream version, fixed some bugs and resolved issues with piuparts. <i>dahdi-linux</i> meanwhile migrated to testing, job done! <br /> As a next step I looked at the open CVEs. Some of them had been already fixed in previous uploads but had not been marked accordingly. So I fixed all remaining ones and sent a debdiff to the maintainer. Unfortunately there was some kind of overlap in our work and he ignored my debdiff but uploaded a new upstream version. Anyway, job done as well, no open security issues anymore. The only thing that hinders <i>asterisk</i> from migrating to testing is the reproducible build. So if anybody has some spare time … </p> <p> Other things I worked on were the regression update of <i>rsync</i>. Some of the elven new patches need to be backported, but I am confidentially to finish this month. I already reviewed the <i>rsync</i>– uploads of Sylvain to Buster and Stretch, so I don’t expect any big hurdles here. I am also making progress to find the correct patches for <i>hplip</i> and <i>cups</i>. </p> <h3><strong>Debian Printing</strong></h3> <p>This month I uploaded a new upstream versions:</p> <ul><li>… <a href="https://tracker.debian.org/lprng">hplip</a> to unstable to fix some bugs.</li></ul> <p><strong>This work is generously funded by <a href="https://www.freexian.com">Freexian</a>!</strong></p> <h3><strong>Debian Lomiri</strong></h3> <p></p><p>This month new upstream versions of dozens of lomiri packages have been released and I uploaded lots of them to Debian. After they migrate to testing, I am also going to sync them to the Ubuntu PPA. </p> <p><strong>This work is generously funded by <a href="https://freiesoftware.gmbh/">Fre(i)e Software GmbH</a>!</strong></p> <h3><strong>Debian Astro</strong></h3> <p>This month I uploaded a new upstream version or a bugfix version of:</p> <ul><li>… <a href="https://tracker.debian.org/supernovas">indi-pentax</a> to unstable. This is a package in contrib without autobuild and needed a new upload for the libraw transistion.</li><li>… <a href="https://tracker.debian.org/c-munipack">c-munipack</a> to unstable.</li><li>… <a href="https://tracker.debian.org/supernovas">supernovas</a> to unstable (sponsored upload).</li></ul> <h3><strong>Debian IoT</strong></h3> <p>This month I uploaded a new upstream version or a bugfix version of:</p> <ul><li>… <a href="https://tracker.debian.org/duktape">duktape</a> to unstable.</li><li>… <a href="https://tracker.debian.org/libcoap3">libcoap3</a> to unstable.</li></ul> <h3><strong>Debian Mobcom</strong></h3> <p>This month I uploaded a new upstream version or a bugfix version of:</p> <ul><li>… <a href="https://tracker.debian.org/smstools">smstools</a> to unstable.</li></ul> <h3><strong>misc</strong></h3> <p>This month I uploaded a new upstream version or a bugfix version of:</p> <ul><li>… <a href="https://tracker.debian.org/visam">visam</a> to unstable. There had been an RC bug due to two binaries with the same name but different functionality. Yes, it is in the policy but … (my mother forbade me to elaborate more on this)</li><li>… <a href="https://tracker.debian.org/mailio">mailio</a> to unstable.</li></ul> 2026-07-07T17:56:04+00:00 alteholz http://aigarius.com/blog/2026/07/05/making-of-group-photo/ <p>Taking a good group photo consists of multiple aspects:</p> <ul> <li>hardware</li> <li>scouting</li> <li>organization</li> <li>preparation</li> <li>execution</li> <li>processing</li> <li>publishing</li> </ul> <p>I can say with confidence that nearly everything here comes from having failed to do these things right at least once, even on the latest attempts, so this is an ideal to reach towards, not something we expect to hit every time.</p> <h3>The Goal</h3> <p>The main goal of a big event group photo is capture both the moment itself and each individual person inside that moment.</p> <p>We want people, who were <em>not</em> there to see all the people involved and get an impression of what it was like being there. It needs to show the breadth and depth of people that make up this group, this project.</p> <p>And we want people who <em>were</em> there to be able to look back the next week, the next year or in ten years and remember - ah, yes, I was there, I was standing right there with this grin on my face next to this wonderful person and I was feeling great.</p> <h3>Hardware</h3> <p>Based on the goal we want to have high level photographic gear that is able to capture both a broad enough picture to encompass all the people and some of their surroundings to communicate the context (without undue distortions) and to deliver enough detail and resolution so that faces and facial expressions and underlying feelings of every single person in that group could be clearly seen and preserved.</p> <p>To both capture the context and minimise distortion the final picture should be just a bit wider than normal human field of view. That is about 50mm for a full-frame camera or 35mm for a typical 1.6 crop camera. You can go a bit wider if there are no better alternatives (as detailed in the scouting section), but be prepared that corners of the image will be distorted and not really usable (but we can fix that in processing step). Or you can go to unusual aspect ratios, like we did in <a href="https://wiki.debconf.org/wiki/DebConf10/GroupPhoto">Debconf 10</a>.</p> <p>In the absence of a 100MP+ camera, you will need to be stitching together multiple frames to achieve resolution high enough to have enough pixels-per-face to see emotions clearly. This means that the photos you will actually be taking will be tighter than the overall field of view mentioned above. Still, a higher resolution camera body is preferable - nowadays 24MP-32MP cameras APS-C provide a good compromise between resolution and price, but 45-67MP full-frame cameras also exist on the market. Assume that we will be shooting in a bright environment, so most likely with quite low ISO settings, that means that high-ISO noise characteristics of more expensive cameras will not really play a role here. You will also not need very fast burst modes, even manual speed of one frame per second is sufficient.</p> <p>You will also want to get as much detail as possible out of your lens, and this is the <em>most important</em> part. You can do amazing work in all other steps of the process and have a great camera too, but if you pair it with a lens that is not sharp, then the end result will be disappointing.</p> <p>You want the lens that is sharpest corner-to-corner when stepped down to about f/8-f/11, that you can get for your system. You also want that lens to be about 85mm full-size sensor or 50mm for 1.6 crop size. Luckily that kind of range is also a great range for optical design and sharpest lenses are typically available in exactly these kinds of sizes. You absolutely want to have a fixed focal length lens, not a zoom lens. Even profession grade zoom lenses often deliver worse image quality compared to fixed lenses that cost less 1/10th of their price (when shooting in the same focal length). Newer design lenses are better than older lenses - optical design, coatings and precision manufacturing have advanced a lot over the decades. Retro look is great for mood, but not as good for actual resolution and clarity. You don't need to overpay for most expensive lenses because those often only improve image quality on lower F-stops. To encompass the whole group we will need to shoot at f/8 and in bright light, so the extra benefits of those f/1.2-capable super expensive lenses will not come into play here.</p> <p>We will have no use for a flash here. A tripod will be too restrictive when rapidly repositioning the camera between different parts of the panorama shoot. But a monopod might help with stability - I have not tried that myself, however.</p> <p>For my last photos I used a Canon EOS R7 (32.5MP) with Canon RF 50mm f/1.8 STM lens and considering an upgrade to Sigma 56mm f/1.4 DC DN for the next time.</p> <h3>Scouting</h3> <p>Scouting a good location for the group photo is another big chunk of a successful picture. The critical piece of the puzzle is lens-to-face distance. In order to keep everyone's face in-focus and have enough resolution on the farthest faces (without making nearest faces truly massive) we want to do everything possible to reduce the variance in lens-to-face distance - to reduce the difference in distance between closest and farthest face.</p> <p>The most effective way to do that is to have the photographer climb higher. To see this in action on the <a href="https://wiki.debian.org/DebConf/GroupPhotoAll">Debconf photos</a>, compare Debconf6 (very high camera position, group on level ground - good) to Debconf10 (camera not too high, group on stairs, still good) and to Debconf17 (camera could not get high enough and the group is on flat ground - not great). Even the Debconf25 photo was suboptimal from this perspective. The Debconf23 photo was a very good example from the recent years - good height and also the group was positioned in a semi-circle so there were no people directly in front and very near to the camera.</p> <p>So you are looking for the highest point you could get to (even if that requires a special permission of key or a ladder) with a field large enough to fit the whole group comfortably. How to check that? Normally I simply take a photo from the top of the whole area and note down from there where the extreme corners of the group could be and still be fully seen in the shot - not blocked by trees, buildings and shadows. Then I go down and measure that space. Rule of thumb being - people in one horizontal line can stand 1 normal length step from each other and two horizontal lines can be half a step from each other vertically. So I can just measure a rough rectangle in steps, multiply the sides, multiply that by two and I have the rough number of people that can fit there for the photo.</p> <p>Once you have a candidate location or two, it is important to check them at the same time-of-day as you plan to do the photo (see organization section for that). You want to make sure that the whole area of the group is in the same illumination - if half of the group is in the sun and half in a shadow, then you will be having a very bad time later. The absolute ideal positioning for the group photo is to have everyone be in shadow, but still have enough bright skies and bright buildings in front of the people to give good illumination of the faces. Worst you can do is have the sun be behind the people (so all the faces are really dark) and second worst is have the sun be directly in front of the group, so that the faces are very well illuminated, but everyone's eyes are closed because they are being blinded by the sun. And sometimes all you can do is pray for some light clouds to provide for even and dispersed light. Debconf23 was very lucky that way.</p> <p>Another consideration is to how people are going to get to that place. You need to consider accessibility needs of people (it is ok, if it takes more effort or time, but it needs to be organized and communicated well in advance). And you need to consider how the big masses of people will be getting there - how to tell people where <em>exactly</em> it is and how to get there from various locations where people might be hanging out during the event?</p> <p>Having an alternate location indoors might be necessary if the weather report for the next days is not sufficiently predictable. We had to use that contingency in Debconf9, for example.</p> <h3>Organization</h3> <p>It's hard to take a good group photo if half of the group does not show up or is too late, so this needs some organization to happen smoothly.</p> <p>First of all you need to choose date and time for the photo. The photo does not take too much time from the schedule of the event and can be squeezed in after all the other events are already scheduled. In fact I prefer that as it allows you the flexibility of choosing the date based on weather conditions and time based on light and shadow conditions in potential photo spots. You don't want to choose the daytrip day as most people will be away and return times are not really predictable. You do not want to choose the morning after Cheese and Wine party for obvious reasons. First day and last two days are also sub-optimal as some people arrive late and some leave early for various personal reasons. Also <em>you</em> don't want it to happen just before Cheese and Wine either because then you'd have very little time and clarity to do the processing of the image on the same day.</p> <p>For timing, the best way, in my experience, is to schedule the photo directly after the end of talk sessions before a meal break - lunch or dinner. Typically in the Debconf schedule there are 2-3 daily breaks planned, say for Debconf25 there was lunch, afternoon break and dinner. Talks are planned to end ~10 minutes before those breaks (and meals) begin, so for example, afternoon break starts at 16:00 and all talks in the previous block end at 15:50. In such a case just schedule the "Group photo" event from 15:50 to 16:05. This gives people the info to go there <em>directly</em> from the end of all talks and that they will have sufficient time for break/meal afterwards. Do not forget to specify the location (as exactly as possible) in that event entry and make sure to post it at least two days in advance. People often want to wear something specific for the photo and thus need to know about it in advance. This also makes sure that people do not make alternate food plans for that specific break and don't leave the venue.</p> <p>Announce the date, time and the exact location as wide as possible, don't be shy. Announce and discuss mailing lists, IRC, Signal, Telegram, make sure the front desk knows in case anyone asks in-person, ... Check that it is again included in the announcements email on the day preceding the photo date.</p> <p>When the date has arrived, it is a good idea to check in early with people with special mobility needs to make sure they know where to go, how to get there and how much time they will need to be able to get there on time.</p> <p>As the final round of talks before the group photo is starting up, it is time to recruit "runners". I've had great success with this technique. The idea is pretty simple - for each room where people congregate (talk rooms, hacklabs, cafeteria, outside hackspace, front-desk, ...) go there and choose one person. You want to choose a person that you will recognise and remember among everyone else in the group, either because of who they are or what they are wearing, whatever works best for you. If they agree to help, instruct them to: "at end of talk, announce that the group photo happening now and the location, herd people towards the photo location, be the last person out, make sure there are no stragglers from this area behind you, when you arrive to the photo place I will assume that everyone else from this room is also now there, when you are there catch my attention and show this sign so I know for sure that it is all good and make sure that I did see it from you". With that sorted out all you will need to remember is how many runners you recruited and how many have reported in to figure out if everyone has now arrived or if we still have to wait for someone or some group.</p> <p>Then you will only have one last point of organization left - shaping the crowd into a group. People will not know what your vision for the group photo is, so you will have to give clear and <strong>LOUD</strong> instructions on where people should <em>not</em> be standing. Use clear, large gestures to support your words. You want to compact the group, have the people that just joined in the last moment and are standing to the side come deeper in and join the crowd. Have any holes in the middle of the crowd filled in. Forming a semi-circle instead of a blob helps with averaging face-to-lens distances. Make sure people are not in unexpected shadows. Make sure carried objects, like umbrellas of flags do not cover the faces of other people. Take the time to look at everyone face to make sure there are no people hiding behind someone's shoulder - typically they are not aware that their face is in fact not really visible. If there are such people, call them out and point directly at them and encourage them to step forward, if they wish to do so. You are the <em>only</em> one seeing the final picture now and only you can correct it before capturing the moment. So a few extra seconds here are worth taking, even if 300+ people are standing in scorching heat and waiting on you.</p> <p>When you are happy with what you are seeing, make sure to tell people clearly that you are now about to take the pictures and <em>again</em> remind them not to move and <em>explicitly</em> not to turn their heads to the side until you are done (this is the source of most of the extra work in processing). Be very loud and clear and make sure you have everyone's undivided attention <em>before</em> you start saying the important stuff.</p> <p>When done - say so. There will be other groups that will want to also have a photo taken after the main group is a bit more dispersed, so don't run away. Typically at least the T-shirt group will want a picture and also all the organizers.</p> <p>Final bit of organization during the group photo shooting itself is the sneaky self-insert. You may choose not to bother with it, or do it in the simplest way, like I did in Debconf6, but if you really want to blend in with the crowd, you need to have someone else take a photo of you in the exact same location at the same date and time from the same location. So you should already during shaping the crowd decide where you would fit in, it is easiest to blend in at the back of the crowd and to one or other side, so that it appears like you are just standing behind the shoulders of a couple peoples. Remember that spot - it is easiest if you stand in the exact same ground spot when your photo is taken. Just go down, recruit a volunteer to take your photo, make sure the settings are fixed to the same ones as for the group photo shots and have them take a handful of shots of you - one of you centered in the camera frame and a couple more with you more towards the corners of the frame. This distortion from being off-center in the frame may be important later.</p> <h3>Preparation</h3> <p>In addition to preparing the crowd for the photo, you also need to prepare yourself and the equipment. Make sure you have dusted your camera sensor and cleaned both inside and outside glass of your lens. It is usually a good idea to remove any filters from the lens. Install the hood, if that could help with blocking the sun flares. Make sure you have the right lens and that you have installed the right lens.</p> <p>For fixed settings I typically shoot in JPEG with RAW being there more like an emergency backup. The extra dynamic range of RAW could be used, but it is really complex to do that in combination with image blending and it is hard to get right, so I prefer an all-JPEG workflow and fix the dynamic range in the scene itself, before shooting. For Canon I am using the Standard profile that boosts the color saturation and sharpness a bit as I just enjoy that look and find it hard to get anything significantly better from RAW data even with a lot of effort. In any case make sure you have enough space on the cards to take at least 100 images and that you have a full battery. Do not use high speed burst setting because it is then too easy to take too many pictures at the start of the sequence and be stuck with your camera still in "Busy" state writing big RAW files to slowish SD cards and not allowing you to finish the full picture rapidly.</p> <p>You want to have the shutter speed at at least 1/100th of a second to prevent blur from both your hand movements and also from people in the shot moving around a bit (image stabilisation will not help you there). And you want to have the aperture to be around f/8 - lower apertures risk people in front or behind falling out of focus, make the lenses look less sharp. Higher apertures also start to become less sharp due to diffraction effects above f/8. ISO should stay as low as possible, ideally at ISO 100, but if there is not enough light then upping the ISO to 400 would be the first step that I would try to do and second would be decreasing the aperture to f/5.6. If there is too much light, then increasing the shutter speed should be the safe thing to do.</p> <p>As people start to arrive into the shooting location - check the exposure and nail down the settings, ideally in manual mode. Consider that left side could be a bit lighter or darker than right side. Err on the side of making the picture a bit too dark as there is more depth to darkness before cut-off compared to clipping on the high end. However, do not trust the exposure detection, instead take a picture and look specifically at skin tones in faces of people that already are standing in the photo area. Faces are the key bit and the exposure needs to be adjusted just to the faces and ignore darker of lighter clothing. Do some test shots and find settings where faces look not too bright, but also not very dark and fix those settings in manual mode.</p> <p>Now you are ready for the action. Shape the crowd, check the faces and the action can start!</p> <h3>Execution</h3> <p>During taking of the group photo you want to finish it fast, but at the same time you have to take the time to make it right. If you hurry too much under pressure, you risk being left with unusably blurry images and the whole effort wasted. Having already prepared and verified the manual settings makes it easier.</p> <p>When you are taking pictures, you have to remain as still as possible - even at very high shutter speeds even slow hand movements are still bad for image quality. So think of the movement as of biathlon athlete shooting the very middle of five, very separate targets - take a burst, reframe, then steady up for a second and only then take the next burst. 3 frames per burst are sufficient. 90% of the time the very first photo of a burst will be best. As you move from frame to frame, aim for just a bit more than half-frame overlap. This will give the opportunity to skip frames if all is good, but also have backup coverage of every face in case of problems. Proceed systematically, I typically start off on the top left of the crowd, then go right until the end of the line, then shift down half a frame and go left until the end and repeat until I am done with the crowd. </p> <p>After that it is <em>very</em> helpful to also immediately take photos of a "frame" around the whole crowd. Stitching process often distorts the frames in weird ways that leave holes in the resulting image that you can fill if you have a wide frame around the crowd. It is possible to compensate with creative cutouts in the final image (like Debconf9), but the more framing room you make, the more flexible you will be able to be with cropping of the final photo. The frame also gives you the opportunity to capture more of the context of the place and space.</p> <p>As an example, Debconf25 group photo in the end consisted from 9 images + 1 for sick people + 1 for me. I ended up missing the framing shots for bottom left, top left and top right corners. To get there I took 68 images. And in some years it was more than a hundred.</p> <h3>Processing</h3> <p>This part might be less stressful than taking the pictures from intensity perspective, but it lasts longer. Depending on you luck, skill and perfectionism it can take anywhere from 3 to 9 hours of work to complete.</p> <p>Before you start, however, you should first request things that you will need for other people. This <em>can</em> even be done before taking the actual group photo, but usually I forget. To finish the photo you will need three things:</p> <ul> <li>good quality vector graphics of the current Debconf logo</li> <li>good quality vector graphics of the <em>next</em> years Debconf logo (even if preliminary)</li> <li>motto of the conference</li> </ul> <p>The first two you should be able to get from the respective organizers. The motto is harder. I typically try to ask the current DPL to come up with something describing the current mood of the project or of the event, but it is rare that it is that easy. Most of the time I came up with something as I was editing the photo and reflecting on what was the mood, the feeling, the mojo of this conference and of this year was like. Bend that around a recognisable phrase or expression, make it a bit more insider-relevant and you are on the right path. Some years this was the hardest part.</p> <p>For the panorama stitching I will describe the workflow that has served me good for years, but maybe there are better ways possible nowadays. Feel free to let me know!</p> <p>First I would save all photos taken and select one sharpest photo from every burst. Next I would select the minimal number of photos that appear to be covering the entire crowd. The fewer images you use, the better in the end because the most quality problems crop up in the areas where photos are getting stitched together. Fewer seams leads to fewer issues.</p> <p>Open <a href="https://packages.debian.org/search?keywords=hugin">Hugin</a> (you will also need enblend and enfuse installed) and import your minimal set of images into it. Click the "Align" button and wait a while - the processor will be trying to figure out keypoints in each image and then try to match these points between the images to try to fit them all together into a single projection. To do that it will distort the images. This is the trial and error process part. You may need to add, remove or replace images to get the stitching to work or to work better. You may want to add more of the frame images to fill the ragged holes around the image.</p> <p>After initial alignment, go to "Move/Drag" tab and move the image a bit up in the projected field of view and make it a bit more central visually. That will help a bit with the distortions in the near-by people and people in the corners of the image. In the "Crop" tab set the initial crop - leave it generous, you can always crop more in later steps. Do not be afraid of leaving in sizable chunks of black homes, empty skies or grass. All of that can be filled in later as well.</p> <p>Go back to the "Assistant" tab and click "Create panorama". It is good enough to have JPEG output at 100% quality using exposure corrected low dynamic range output option. Make sure to check the "Keep intermediate images" option. This will not only generate the final, merged panorama, but also keep around the individual images <em>after</em> perspective correction and exposure blending steps. These are critical for fixing blending error in the next step.</p> <p>You might need to go back a forth a few times with a different sets of source images, maybe adding some image between other two, maybe removing another to reach a better starting point. The key part to pay attention - how many ugly stitches are there in the image. Check every face, the blending algorithms do not recognise faces and sometimes try to stitch one face from two or more images creating very weird effects. They <em>can</em> be fixed in the next step, but it is rather hard manual work, so the fewer such faces are in the blended image, the less work you will have. In some years I've managed to find a combination where all faces were good and in other years I had to manually fix 13-15 faces.</p> <p>Do not try to blend the extra pictures (like with you or with sick people) into the main panorama with Hugin - it will get very confused with the parts of the grass that it is able to see where other people were standing.</p> <p>The next is the final processing in <a href="https://packages.debian.org/search?keywords=gimp">GIMP</a>. Think of it like a large and complex project - do as much as possible in separate layers, save often.</p> <p>Fixing wrongly stitched faces and also putting yourself into the photo are very similar activities in the end. Just the scale and the source differ. For yourself you just cut out yourself (upper torso is enough) from the separate photo. For corrupted face, choose one of two intermediate images that the Hugin created where the face is transformed, but not yet merged (with a different version of itself). In either case crop the photo to roughly the interesting size and put roughly in the right spot as a separate layer on top of the group photo background. Reduce the opacity of the small layer to 30-40% and zoom in to 400%. With that it is much simpler to position the layer with pixel precision. Then all you need to do is add a layer mask to this layer and paint it just right. Basically in layer mask black means transparent and white means non-transparent. So you need to <em>just</em> make everything that is you have white mask and everything that is not you have black mask. And smudge the border a bit with finger tool or blur to make the transition smoother. Easy to say. Hard to do. This is what takes most of the actual work hours in post-processing.</p> <p>You <em>might</em> miss someone. I am sure Phill is just thrilled to see me in the very middle of the Debconf25 final picture .... But do try to fix them all.</p> <p>Use large, sweeping geometric figures to cover up black holes, empty grass fields and other sub-optimal corner features. And then use that newly created free space to put in a large version of the logo of this years conference, decently sized motto and slightly smaller invitation to the next years conference.</p> <p>Do not forget to add a copyright and license statement somewhere in the corner in smaller, but still well readable font. I am using a text like: "Photo by: Full Name, Email: fullemail@debian.org, License: GPLv2+ or CCv3-BY" This ensures that this image may be used in any press coverage (with basic attribution) and also can be included in any GPL-licensed software, if that ever comes up. The same statement is also in the metadata of the image file (see Image-Metadata-Edit metadata in GIMP) along with information that states that this is "Debian Developer Conference Group photo, City, Country, Year". Image-&gt;Image properties-&gt;Comment is another place where GIMP hides this EXIF information.</p> <p>For ease of use, in addition to a full-resolution image it is also useful to make a lower resolution version that would still fit on a 4K screen at full resolution, so about 3840px wide. Some photo hosting services set other limits for image size as well, so it might be needed to scale the image down below 100Mpix to upload it to Google Photos, for example.</p> <h3>Publishing</h3> <p>So, it is finally 1AM and the group photo is ready! How do you push it out to people? Well, in all possible ways and places. Again - don't be shy, people do really want to see it.</p> <p>Push it to whatever you use for your shared photos. Push it to <a href="https://salsa.debian.org/debconf-team/public/share">Debconf shared git</a> (note that this is GIT-LFS repo, make sure you know how to add content to the LFS specifically). All permanent links to that in <a href="https://wiki.debian.org/DebConf/GroupPhotoAll">GroupPhotosAll wiki</a>. And then send those links to IRC, Signal, Telegram groups, debconf-announce mailing list. Publish it in your blog and push that to <a href="https://planet.debian.org/">Debian Planet</a>. Push it in Threads, Bluesky and Mastodon. Send an email separately to Debconf orga team. And one to <a href="https://wiki.debian.org/Teams/Publicity">Debian Publicity Team</a> so they can put it into the <a href="https://www.debian.org/">Debian Home Page</a> and push via Debian micronews accounts.</p> <p>And that is about it. Now you can go back to enjoying the rest of the conference. Or running around doing other things that you think need to be done. It's up to you. You did it. This moment will remain with people for a very long time. And you helped.</p> <p>Questions? Feedback? Just ask <a href="https://bsky.app/profile/aigarius.com/post/3mpytbrm5dc2w">here</a> or <a href="https://www.threads.com/@aigarius/post/DadpZDbjqAx?xmt=AQG0WPOLDjK2ZkbDiiuXEOqQQWF5bum51R8V_uNtv9nliA">here</a>.</p> 2026-07-06T19:30:00+00:00 Aigars Mahinovs https://bisco.org/notes/status-update-june-2026/ <h1 id="debian-related-work">Debian Related Work</h1> <ul> <li>Uploaded wofi 1.5.3-1 to unstable</li> <li>Uploaded wob 0.16-1 to unstable</li> <li>Uploaded labwc 0.20.0-1 and 0.20.1-1 to unstable; these releases come with support for wlroots-0.20, which made labwc reenter testing</li> <li>Uploaded swaylock 1.8.5-2 to unstable to make it use the <code>common-auth</code> directive of pam (seeh <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140096">#1140096</a>)</li> <li>Uploaded swayimg 5.4-1 to unstable</li> <li>Uploaded wayback 0.3-2 to unstable, which was waiting in experimental for a reupload and I had forgotten about it; also fixed a <a href="https://gitlab.freedesktop.org/wayback/wayback/-/merge_requests/96">typo</a> in wayback upstream</li> <li>Uploaded xdg-desktop-portal-wlr 0.8.3-1 to unstable</li> </ul> <h1 id="dh-related-work">DH Related Work</h1> <p>The search app I was working on last month was still a focus in June. I refactored the data model a bit and made it simpler. I stumbled over the <a href="https://pythonkoans.substack.com">Python Koans</a> and <a href="https://pythonkoans.substack.com/p/koan-15-the-invisible-ink">Koan 15: The Invisible Ink</a> gave me the idea of using unicode normalization when indexing the items.</p> <p>I released a couple of bug fix releases for the APIS framework, namely 0.64.2, 0.64.3 and 0.64.4. I also release 0.65.0 which is one step further in dropping support for the legacy <code>apis_entities</code> app. When the <code>search</code> module is merged it will give way for removing the last bits of the old cruft to be removed.</p> <p>During a regular dependency update session I looked at the changes in <a href="https://github.com/yourlabs/django-autocomplete-light">the dal dependency</a>. After a long time with no commits, the project suddenly had a lot of commits co-authored by Claude and then released a new major version with a regression. Given the state of the project, we decided to keep using the previous release for now and look into replacing the dependency with an HTMX based solution. I implemented a POC for one of the plugins we develop and it was actually pretty easy. I also managed to combine the autocomplete approach with a multi-select form field, based on <a href="https://dev.to/apleshkov/htmx-multi-select-form-control-without-js-4jfk">this blog post</a>.</p> <p>In the <a href="https://www.oeaw.ac.at/de/acdh/forschung/dh-forschung-infrastruktur/aktivitaeten/dh-datenmodellierung/pfp-prosopographische-plattform-oesterreich">PFP</a> project I finally merged the stats endpoint which give statistics about the named graphs that are used as data sources.</p> <h1 id="other">Other</h1> <p>I attended <a href="https://bsidesvienna.at/">BSidesVienna 0x7EA</a> but it was on one of the hottest days this year so far so I left after a couple of talks.</p> 2026-07-05T05:28:51+00:00 Birger Schacht http://blog.sesse.net/blog/tech/2026-07-04-15-21_an_update_on_sesse_chromium_org.html <p>As previously mentioned, I am leaving Chrome; my last work day was yesterday. (Sorry to those with July 3rd off that I didn't get to say goodbye to!) But I'm staying in Google, on more internal projects :-)</p> <p>After 1100+ commits it's hard to pick out one thing that I love the most; as a team, we launched a lot of (IMO) useful CSS features and fixed a lot of issues. But somehow, I keep on gravitating towards performance, and perhaps <a href="https://chromium-review.googlesource.com/c/chromium/src/+/3581992">this commit</a> is the one I will remember the most fondly; a couple hundred lines to speed up repeated attribute selectors a lot. (If you ever wonder who would be doing that; well, there's a fairly high chance that you have an extension injecting a stylesheet with a lot of <code>a[href*="..."]</code> rules…)</p> <p>Upwards and onwards. Please write lean, clean CSS; I won't be there to save you from now on. :-)</p> 2026-07-04T14:21:00+00:00 Steinar H. Gunderson