Language Selection

English French German Italian Portuguese Spanish

Kde Planet

Syndicate content Planet KDE
Planet KDE
Updated: 2 days 5 hours ago

Season Of KDE – Project Update 1

Monday 22nd of February 2021 12:17:18 PM

It’s been a long time since I have published my first blog on SoK. To make up for that, I plan on writing successive blog posts to catch you all up with the progress of my project, foKusfoKus is a simple task management app for plasma mobile. 

I have written why we need a dedicated task management app instead of using a calendar app to plan our days in my proposal for SoK. Here I want to highlight the main reason for the need for a dedicated task management app. Calendar apps are great for static events like meetings, appointments, etc. Tasks management apps are great for actionable items(tasks) that we need to do in a day or a week. Sometimes the Calendar might become overpopulated with the “tasks”(which may be small things like listening to a podcastwalk the dog) and might be counter-productive. Using the Calendar and the Task management app in tandem together, we can be our most productive selves. As the task management app isn’t heavy, it won’t affect the performance of the device(if that is your concern). 

Like most other apps of KDE, foKus is also built using the Kirigami and Qt. I had to start the app from scratch as there were no todo apps that I could use as a base for my app. As I was new to this community (and also to programming, this is my first coding project), these past 40 days have been a challenge. I had a tough time writing the backend logic as it was full of pointers, classes, and objects which I didn’t understand back then(admitting the weakness was the first sign of improvement). But with the help of my mentor, I am learning more than ever and getting better every day.

As of today, foKus is at a better place than I have expected it to be. The basic model of the app will be ready after I add the local storage(to store the tasks, which I plan on doing tonight or mostly by tomorrow). The user interface of the app is still crude. I’ll refine it once the basic model is ready. 

That’s it for this post, and thank you for reading. Until next time, cheers!

The Application Of New Things

Monday 22nd of February 2021 12:13:00 PM
KDE has, for a very long time, had this thing called Get Hot New Stuff, which is the name for a whole pile of tech which all exists just so you can just click a button in your wallpapers dialog that will pop up a dialog where you can, well, get hot new wallpapers for your system. Or mouse cursors. Or Plasma themes. Or books in Peruse. Or templates in a bunch of apps, or any variety of other things.
For a while now, it's been possible to add something called an adoption command, which is what will make a button show up in that dialog, and in Discover, labelled "Use". It's been used in a few places, but i recently sat down and got a bunch of little tools done that lets you set various things from the command line, and that in turn allowed me to also add those tools as adoption commands for the Get Hot New Stuff dialogues which download the stuff that those tools can apply.
How To Use A Wallpaper
What that means is that, fresh off the back of the 5.21 release, we've got that merged in, and it should become available to anybody running master pretty much immediately, and anybody who doesn't, well, hopefully in not too long.
The specific things that have had an adoption command added are:
  • Window Decorations - that is, themes for KWin's Aurora theming engine
  • Wallpapers - technically there was already an adoption command set, but it didn't work very reliably
  • Cursor Themes - cursor as in mouse cursor
  • Color Schemes - the things which define what colours your entire desktop uses
  • Plasma Themes - what defines how Plasma draws all it's UI components (panels, applets, all that lovely stuff)
  • Global Themes - complete packages of full-desktop settings, which adapt the look and feel of your entire desktop to something new
What all this means is that when scrolling through the content of one of the dialogues which let you grab these things, if there's a way to just outright guess what the thing should be applied to, in a global sort of fashion, there should be an adoption command for it.
It also means that, apart from the KWin tool, which is not installed as a systemwide tool (look for kwin-applywindowdecoration in your libexec if you want a play), you can now interact with these things from the command line. This is more or less done the same way you've been able to do with Global Themes for a while now using lookandfeeltool, which with this patch also got a quick bit of attention to make sure it would work as an adoption command, as well as a quick rename to match the naming scheme for the new tools. The new tools are all named plasma-apply-(thingtheyapply), so if you just type that out and tap the tab button, you should see all of them show up for you to play with.
What Desktop Themes Does leinir Have?
Finally, if you spot a dialog that seems like it should have this, but doesn't, do give me a poke, either here or on, and we can try and sort it out. Also, if you look at the merge request itself, you'll notice how these tools really aren't particularly scary for the most part. If you would like somewhere nice and self contained to jump in and do some work? Well, there's a good spot for you :)The word of the day is: User. The thing you become upon clicking the Use button in a Get Hot New Stuff dialog ;)

Understanding KDE Plasma theming system

Monday 22nd of February 2021 09:38:19 AM

KDE Plasma's theming system is actually quite complex. It has many ways to be customized. It's normal ever for expert users to not fully get how it works. I'll try to explain how it works to the best of my knowledge.

For all of these topics, there's section on the KDE Store where you can see all the avaiable options and download them.

Global Theme

Let's start with the Global Theme. This has potentially control over many settings, but let's simplify it into the main smaller components it determines:

  • App Style
  • Plasma Style
  • Colors
  • Window Decorations
  • Fonts
  • Icons
  • Cursors
  • Splash Screen
  • Desktop Layout

When a global theme is set it can set all of these things, but it does not have to set all of them. This means that setting a Global Theme is actually a potentially “destructive” action, meaning that you might have to re-set your preferred App Style, Plasma Style, etc. if you had customized them. In fact, you can customize each one of the above elements to your liking!

Here's an example Global Theme, Sweet KDE:

App Style

This category lists the QStyles you have installed. These customize the appearance of the 'widgets' in your QT applications: buttons, frames, tabs, checkboxs, context menus, and so on. The QStyle covers QWidgets app natively, whilst we have a qcc2 theme that mimicks the QStyle for qml apps. In this KCM you can also customize the GTK theme for, err, GTK apps.

This is where Kvantum comes into play: it is a QStyle that reads from a SVG how to draw the various widgets. This makes it much simpler for Style creator to make a new style, as they only have to make in Inkscape the various components instead of writing C++; of course, it also limits what you can do with it (e.g.: it's impossible to customize animations). A distinction must then be drawn for “native” QStyles and the Kvantum styles. It is very rare to see an original QStyle, but they usually feel of “higher quality” compared to Kvantum ones.

A QStyle can choose to follow the global colorscheme or decide ignore it and use its own colors. Most Kvantum styles set their own colors. Most “native” QStyles follow the global colorscheme.

Here's an example of a “native” QStyle, Lightly:

Plasma Style

This one customized the look of Plasma: the panel, the task manager, the system tray icons, krunner, the app launcher, etc. Everything that's not a window is (usually) part of Plasma.

Similarly to Kvantum, Plasma themes are defined using SVGs. If you would like to know how to make one, I'm doing a guide on my youtube channel.

Again, a Plasma Style can choose to follow the colorscheme or ignore it. If it does follow the colorscheme, it will display a round rainbow in the theme selector. This is why there's a Breeze theme, a Breeze Light one and a Breeze Dark one: Breeze follows coloscheme, Breeze Light forces a light coloscheme, and Breeze Dark forces a dark coloscheme.

Here's an example of a Plasma Theme called ROUNDED. (That's the name, yeah.)


Here you can define the colorscheme of everything. Of course, it will be up to single components (App Style, Plasma Style, Titlebar) to decide whether to actually follow the coloscheme or now.

The coloscheme is one of the few components that the users can edit straight away. Just click on the edit icon of any existing coloscheme and KColorSchemeEditor will pop up. I've heard there might be a redesign of this dialog coming up!

Window Decoration

This one customize the titlebar, which is the component with the app name and the minimize, maximize, close buttons. I'll admit I'm a bit more ignorant of how this one works: I think there are two types of decorations, one written in C++ and another mostly in QML through Auroræ. Again, the decoration can decide whether to follow the colorscheme or not.

In this KCM you can also decide how to customize the buttons in the titlebar: whether to keep the minimize button or ditch it, but also whether to have the App Menu as a button there, have a keep above button, a shade one, etc.

Here's an example of a third party decoration, FormaN:


This is where the various icons are customized. These are used both in apps and in Plasma; although the Plasma Theme can override some of them. In this KCM you can also customize the icon size in various places: toolbars, dialogs, the panel.

Icons are actually usually compatible with GTK and other DEs as well. However, there might be missing icons!


Again, this one is pretty intuitive. In this KCM you can also customize the size of the cursor.

Here's Volantes, a third party cursor theme:

Splash Screen

Here you can customize the loading screen to use when you are logging in Plasma. You can actually choose to have no loading screen at all, but you will be displayed a Plasma that might not be ready (e.g.: Panel not shown yet).

These are written in QML.

Here's an example of a third party splash screen, Quarks: (gotta say, it's beautiful. Highly recommended)

Desktop Effects

There are various “effects” that Kwin – the window manager – can provide to the user. These are usually graphical: animations, blur, transparency, etc. I cannot go over them all, but I'll say that you can find more of them on the store, such as the grayscale effect and a rubberband maximize animation. The default ones are mostly C++, but it's possible to also write QML ones.

Kwin Scripts

These are scripts that can interact with your windows in various ways. A common exaple are tiling scripts, that arrange your windows for you. But there are many others: a shortcut to minimize and restore windows, forcing blur behind windows, grouping windows, etc. These can use the JS API.

Wallpaper Types

Well, it's not like a static image is for everyone. A wallpaper can be many things: a slideshow, a vide. In general, these plugins define how wallpaper looks and behaves: some might blur it when a window is opened (highest rated one), some might use shaders for cool 3D animations, some tint the wallpaper based on the hour of the day.

Wallpaper Image

Yes, there's a section on the KDE Store for these as well.

Anything else?

Well, yeah, it just doesn't stop here. However, other sections are less used and I'm not sure I remember them all. So I'll stop here! Hopefully I've made stuff a bit more clear. Also, I've only showed sections that you can customize with third party themes or plugins, but of course there are so many other things you can customize Plasma!

That's all, see you!

My name's Niccolò Venerandi, my website is here, you can contact me on Telegram as [at] veggero and you can support my work on KDE on liberapay, paypal or patreon.

Season of KDE 2021 and my first time blogging

Saturday 20th of February 2021 03:17:17 PM
Season of KDE 2021 and my first ever blog

Hi everyone! I am Rohan Asokan. I am currently doing my undergraduate studies in Computer Science in IIITH, a university in India. I can program quite proficiently in C, C++, Javascript, Python and have some knowing some basic Q#, R, FORTRAN, QBasic (I don’t think even primitve coders know about this anymore). I am interested in AI/ML (obviously, cuz that seems to be trend anyways) and any tech that seems really simple but is infact as good as it gets, out of which my favourite is Ray Tracing and Ray Marching - I do have some projects on this, do checkout my github.

I am a fan of camelCase and PascalCase, so ig that says a lot about me. ;)

I am also a decent full-stack developer and am well versed with some common javascript and python frameworks for full stack development - Flask, Django, Express.js, Node.js, React.js, Vue.js, Svelte.js..(Guess I’ll just stop there out of modesty).

I am also quite a bit of a gamer myself - ping me if you wanna play a few matches of Valorant or Rocket League even.

I am quite a curious soul, looking for all kinds of stuff to get myself into. And by came SoK, and I just couldn’t keep myself from getting my feet wet and that’s how the story begins. One project seemed to impress me quite a lot - Kalk, a calculator built over the Kirigami Framework and that is exactly what I am working on. But, what happened next is the story for another day and until then have a great time.

Some Socials:


Twitter - Not very active on it though

Github - I am developer afterall, so this counts as a social ;)


Discord - arena_grenade#7429

unique_ptr difference between libstdc++ and libc++ crashes your application

Saturday 20th of February 2021 01:51:48 PM
KDE Project:

Thanks to the KDE FreeBSD CI, which runs our code on top of libc++, we discovered an interesting difference between libstdc++ and libc++'s implementation of unique_ptr. This is quite unexpected, and the actual result for users is even more unexpected: it can lead to crashes in specific situations. This happens when a widget -- using unique_ptr for its d pointer, as is customary these days -- installs an event filter. That event filter will be triggered during destruction of child widgets (at least for the QEvent::Destroy event, I've also seen it with QEvent::Leave events for instance). And, depending on how the event filter is written, it might use the d pointer of the widget, possibly before checking the event type. That's where it gets interesting: the libc++ implementation of unique_ptr sets it to null *before* calling the destructor (because it's implemented in terms of reset(nullptr);. In libstdc++ however, unique_ptr's destructor just calls the destructor, its value remains valid during destruction.

Here's a testcase of the crash, extracted from the KIO code for which you can see the fix here. It works with gcc/libstdc++, and crashes with clang/libc++, because MyWindow::eventFilter() is using a d pointer that is null already.
In this particular case the fix is easy, testing the event type before anything else. That's good practice anyway, for performance reasons. But there are other cases, where the situation was a bit different and the solution was to remove the event filter upon destruction.

I like unique_ptr, but beware of the interaction with event filters...

Join the KDE e.V.

Saturday 20th of February 2021 01:13:00 PM

The KDE e.V. is a registered non-profit organization that represents the KDE Community in legal and financial matters.

The KDE e.V. is for example responsible for paying the servers that run our GitLab instance and all our other web services. The e.V. takes care of sponsoring developer sprints and contributor travel costs, too.

You did participate at some Akademy? This wouldn’t have been possible without the KDE e.V., both by sponsoring and helping to organize the event!

If you are an active KDE contributor, consider to join the e.V. to be able to vote on its future direction. This includes very important things like the KDE Free Qt Foundation.

At the moment, already a lot of our KDE community members are e.V. members, too.

But naturally, as people enter and leave our community, we need to outreach to new contributors to join the e.V.. The e.V. shall stay a representation of the currently active KDE contributors/community and not some club of KDE oldies =)

Just take a look at the 2002 e.V. meeting group photo below:

A few of this people are still active, some of them many of the current active KDE community members have never heard of. The group pictured above isn’t that diverse either. It looks a bit like you take a group photo of some computer science course in a university in Germany of that time. And yes, I am on that photo, too (as usual, wrongly written as Cullman, like my nice county). I actually fished that picture out of my private data storage .P

Let’s take a look at the Akademy 2020 group photo below (CC BY 4.0, created by the Akademy team):

This looks a lot more like the KDE community we all know and love. Therefore it would be fantastic if active people take care to join the e.V., too!

If you want to join, just take a short look at this guide.

You will need some e.V. member that suggests you, I assume you will know someone from the e.V. members list to ask to do so.

This week in KDE: Plasma 5.21 is finally here!

Saturday 20th of February 2021 05:09:06 AM

This week we released Plasma 5.21 and have been hard at work fixing the bugs you fine folks have found with it.

Web Review, Week 2021-07

Friday 19th of February 2021 10:02:20 PM

We’re now well into February 2021 and I didn’t even do a proper recap of 2020. Needless to say I’ve been quite a bit neglecting this space… at the same time I’ve been reading quite a lot (as usual) and I have been posting said articles on the Fediverse (with a bot cross-posting to Twitter as well). Very often I posted just the title and they’d happen in batches which was probably annoying.

That’s why for 2021 I think it’s time for a new experiment in this space. I’ll try to post a weekly web review here. Obviously topics of choice will be Free Software but I might cover other areas which might be a bit more surprising (management, business, sociology… you name it). Hopefully that will make it more interesting than if I stay too focused.

Without further ado… let’s go for my first web review!

FOSDEM 2021 - Open Source is More Than Just a License

Tags: tech, free-software, criticism, ethics

Very interesting FOSDEM talk which I see as part of the debate about “Open Source as just licenses”/“Post Open Source”. This shows very well how the OSD is very narrow and that their should be a better alignment between what is labelled FOSS and the actual customs. This is something which licenses alone can’t capture.

Acceptance of Pattern Matching PEPs 634, 635, 636, Rejection of PEPs 640 and 642 - python-committers -

Tags: python

Looking forward to Python 3.10 in October which will finally get pattern matching!

C++ | unique_ptr, shared_ptr, weak_ptr, or reference_wrapper for class relationships - nextptr

Tags: c++

Interesting use of reference_wrapper… I wonder why it didn’t occur to me earlier as a good use to deal with ownership like that.

Au-delà des licences libres ? · Bastien Guerry - Informatique et liberté

Tags: tech, free-software, criticism, ethics, economics

This is a bit of a less rigorous counterpoint of the paper from Nathan Schneider “the tyranny of openness”. I think it’s interesting to see that despite a few strawmen it reaches a somewhat similar conclusion: it’s not just about licenses, it’s also about customs”.

The Clubhouse App and the Rise of Oral Psychodynamics - Insight

Tags: tech, culture, literacy

Interesting account on orality vs literacy. Never occurred to me before this article that orality could be written (somewhat Twitter) and that literacy could be spoken (for example news anchors). This is why you sometimes end up with a) people talking like a book or b) people writing like they talk.

Reclaim Your Face - Reclaim Your Face

Tags: tech

Petition for a new low to regulate facial recognition

You are invited to contribute to the future « Contributing to Free-Libre Open Source Software » MOOC by Télécom Paris and Framasoft – Framablog

Tags: tech, free-software, mooc, framasoft

You know a thing or two about contributing for FOSS? You’d like that knowledge to be passed on? Here is your chance with that MOOC in development.

LAPD Asked for Ring Surveillance Video Related to Black Lives Matter Protests

Tags: tech, surveillance, capitalism, ring, amazon

Some more example of surveillance capitalism as a mean to social control. Are we surprised? Not really… still they all need to be documented and known to the public.

The Tyranny of Openness: What Happened to Peer Production?

Tags: tech, free-software, criticism, feminism, ethics, economics

This is a great paper. Truly mind bending in my opinion. In my case it helped me pinpoint things in the FOSS movement which I felt were there while being unable to clearly explain them. This is a clear enabler and explains why we need to move beyond the “licensing and only licensing” position the FOSS movement is in, it’s the only chance to finally encompass ethics and economics which are both very much needed. It’s the only chance to converge toward proper commons without the faked meritocracy distortion.

I could go on much longer… but it’s not the point here. Go read it!

And if you’re still wondering “why not more women in the FOSS movement?” or “why are women mostly in community stewardship roles?”, well there are answers for that too.

I’ll close with two quotes which I found really important in that paper:

“Ehmke stresses that information ethics and social ethics need not be mutually exclusive but that they should coexist. She frequently celebrates what Open Source has achieved through information freedoms and hopes for more through the addition of social ethics. […] Yet this evolution means being open in new ways and more closed in others.”

”“The frame of social provisioning reveals how the unrest in Open Source emerges from a cluster of basic concerns that peer production communities have taught themselves to treat as invisible or inadmissible. It remains to be seen whether Open Source can stretch to incorporate more of its participants’ humanity.”

Basic Intro to Elliptic Curve Cryptography - Qvault

Tags: tech, cryptography, security

Nice and very approachable introduction to the use of elliptic curves for cryptography. I think I finally understood properly how those work. :-)

CSS transitions and hover animations, an interactive guide

Tags: tech, css, animation, design

Very nice introduction to animations with CSS. Per usual for me coming from a QML background it often sounds more involved than it should be but overall nice facilities are now provided straight from the browser.

Ekylibre convertit les agriculteurs au logiciel libre | Les Echos

Tags: free-software, agriculture

Article in French

Very nice to see some initiative toward providing Free Software for agriculture use. I have some concerns regarding the type of agriculture which will use this though.

Critical Thinking isn’t Just a Process - Insight

Tags: politics, epistemology, science, lies, authoritarianism

As usual with Zeynep Tufekci a mind bending article about the heuristics one might use at times when official institutions are simply trying to lie to your face and when they switch to authoritarian mode. This is indeed times when it becomes very hard to trust information and make sense of the world… how to overcome that? Well there are a few examples in that article.

Ces pays sont toujours officiellement en guerre, et ils l’ont oublié |

Tags: history, surprising, war

Article in French

Surprising history little article about how even on something as important as declaring a war as over, sometimes simply… we forget.

Is Westernisation fact or fiction? The case of Japan and the US | Aeon Essays

Tags: history, japan, culture

Fascinating piece on how Japan dealt with the arrival of westerners. But also how the westerners did (and still) perceive the relationship with a lot of delusion due to arrogance and racism biases. It is a good example on how the winners tend to attempt to rewrite history.

It also shows how Japan somewhat turned into an inspiration for other Asian countries. I learned a lot.

Le gouvernement va créer une mission logiciels libres et communs numériques - ZDNet

Tags: tech, politics, free-software

Article in French

For once a step in the right direction the creation of this mission. It goes in the right direction indeed but let’s hope it’ll be respected.

Droit à la réparation : les fermiers obligés de pirater le firmware de leurs propres tracteurs en raison de l’enfermement propriétaire des constructeurs, l’UE et les USA œuvrent à changer la donne

Tags: tech, repair, vendor-lockin, embedded

Article in French

One more article on the preposterous vendor lock-in we experience with some devices (and yes, nowadays a tractor is yet another device with embedded code). Or why right to repair becomes an important freedom to defend.

Uncovering a 24-year-old bug in the Linux Kernel – Skroutz Engineering

Tags: tech, linux, tcp, bug

Interesting exploration for a low level bug in the TCP stack. A proof that it’s not always the network being at fault. ;-)

Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies | by Alex Birsan | Feb, 2021 | Medium

Tags: tech, security, supply-chain

Very interesting new supply chain attack. Shows one of the big downsides of the very convenient packaging tools everyone uses lately. Interestingly in that particular case it seems less risky only with the publicly available components, it’s in the context of private repositories that the risk arises. Root cause seems to be the lack of control on how those tools resolve between private and public repositories.

Developers mentoring other developers: practices I’ve seen work well - The Pragmatic Engineer

Tags: tech, mentoring

Lots of good advice on how mentoring can be done. There are enough of them that you can pick and choose what makes sense for your own context. I like this kind of toolbox approaches.

Technical Mentorship Reimagined: Time-bound and No Awkward Asks Necessary — Culture

Tags: tech, mentoring

Interesting ideas on how mentorship can be organized in a company. This is obviously examples coming from a specific context but still, the whole time bound and matchmaking approach is a good food for thought. It sounds a bit too mechanical and systematic for my taste but I guess it makes sense in their context. A few good extra resources provided as well.

Hope this will be useful to someone. Depending how this goes in the coming weeks I might adjust the frequency, we’ll see. Bye for now!

KDDockWidgets 1.3.0 released!

Friday 19th of February 2021 10:00:57 AM

We’ve released KDDockWidgets 1.3.0! KDDockWidgets is a framework for custom-tailored docking systems in Qt.

The main highlights for this release are PySide6 and experimental QtQuick support.

The QtQuick backend isn’t production ready, but you can already build with -DKDDockWidgets_QTQUICK=ON, run the examples under examples/qtquick/dockwidgets/ and start reporting issues.

Here’s the full list of changes:

  • Experimental QtQuick support (#49)
  • PySide6 support
  • Added static DockWidgetBase::byName() (#126)
  • The enum KDDockWidgets::AddingOption has been deprecated, use KDDockWidgets::InitialVisibilityOption instead
  • You can now pass a preferred initial size to MainWindow::addDockWidget() (#95)
  • Added DockWidgetBase::Option_DeleteOnClose
  • Added Config::Flag_CloseOnlyCurrentTab
  • Layout restorer now restores maximized/minimized state too (#81)
  • Fixed dock indicators sometimes not appearing on Windows (#103)
  • Fixed Flag_NativeTitleBar not working
  • Fixed drag offset when dragging too fast with mouse
  • Fixed bug where last tab index position wouldn’t be remembered in case user had manually reordered tabs (#154)
  • Fixed crash when hosting a QQuickWidget (#150)
  • Fixed CMake Visual Studio generator not working
  • Sidebar overlays now maintain their size when toggled (#155)
  • Added DockWidget::setFloatingGeometry() (#144)

Additionally, we’ve released version 1.2.1. It’s just a bug fix release over the 1.2 branch, which is now closed.

  • Support for resizing dock widgets when they are in overlay/popup mode (autohide/sidebar feature)
  • Fixed title bar close button enabled state not being restored with Layout saver (#137)
  • Installs a version header (kddockwidgets_version.h) that defines a version string and other useful versioning macros (#138)
  • DockWidgetBase::eventFilter() is protected instead of private (regression vs v1.1) (#148) It’s recommended that you rebuild your application when updating KDDW, as MSVC encodes private/protected in the name mangling.
  • Fixed WASM build on Windows (#163)
  • Fixed sidebar overlay not getting hidden when clicking on the main window docking area (#157)


You can find 1.3.0 here and 1.2.1 here.

Prebuilt packages for some popular Linux distributions are here:

About KDAB

If you like this blog and want to read similar articles, consider subscribing via our RSS feed.

Subscribe to KDAB TV for similar informative short video content.

KDAB provides market leading software consulting and development services and training in Qt, C++ and 3D/OpenGL. Contact us.

The post KDDockWidgets 1.3.0 released! appeared first on KDAB.

First Milestone

Friday 19th of February 2021 12:00:00 AM

In this blog post, I’d like to give an overview of what I’ve been doing for the past month since I’ve joined SoK this year. It has been an amazing journey so far and I’m really looking forward to completing the project and seeing how the whole thing looks in the end.

In January, I had been accepted as a SoK student, in which I’m going to work to extend Peruse functionality to support visualising Jump objects on the screen. Peruse is an awesome comic book reader/creator that make reading/creating a comic book really easy and it supports the ACBF format. Some of those comic books might have something called Jump object, a Jump object is a clickable area on a comic book page which links to another page in the book, clicking on that area should navigate the reader to the target page. This can be used to create/read Interactive Fiction Books, such as Create Your Own Adventure type comic books. By the end of SoK, Peruse will be able to visualise Jump objects on pages in a nice, and attractive way, while also providing the functionality to create and preview how they’d look like on the screen.

The Overview

Before we started this journey, I had been discussing how to go and execute the plan deducted with Leinir, my awesome mentor whom I feel very lucky to have, I’ve learned A LOT from them and they have been really supportive and helpful. First, we decided to try creating arbitrary jumps on different pages in any book and visualising them as just basic rectangles on the screen, so that I can get used to the code and learn more about the code base.

We decided to modify Peruse’s ACBF Library so that it returns the Jump objects directly, instead of returning them as a list of positions, which we’ll then use to directly access those objects easily in the QML or the frontend part of the Reader, and that’ll help us in retrieving the Q_PROPERTY of those objects directly. Here’s the merged MR.

After that MR got merged, I tried experimenting with how we’d like to visualise/represent those Jump objects in a nice, and attractive way. Leinir and I settled on representing them using circular shapes, inspired by how modern interactive/point and click games work. Here is the MR created for this. Essentially, I created a new component to handle the Jump objects called JumpHandler, in which it’ll take the actual Jump object from the loaded data model from the ACBF library and it’ll extract from it the location, and dimensions information. Each JumpHandler component draws itself on the page/frame and adjusts itself according to the zooming ratio. In order to integrate that new component, we had to modify the ImageBrowser to support loading enough JumpHandlers for the Jump objects on each page, simply using a Repeater instance.

Here’s a small video of how Reader represents the objects now:

There are still some minor details that should be sorted out in the MR, then it should be ready to get merged


In conclusion, I’m really happy with the progress so far, and really happy that I’ve joined SoK this year. It has been a great jounrey with a lot of new experiences and things to learn, I’ve learned a lot about QML, its tricks, and best practices (thanks to Leinir). For the next steps, we’re planning to start working on Creator. Currently, Creator supports creating new Jump objects, however, it doesn’t yet support modifying existing ones. So, stay tuned for the next blog post and wish me luck.

GCompris in the Italian PublicCode catalogue

Wednesday 17th of February 2021 01:02:22 PM

The Italian PublicCode catalogue on Developers Italia is a searchable database of open source software that is either developed by Italian public institutions, or sourced from third parties, that can be used by Italian public insitutions.

Nowadays, Italian public institutions have to revise the catalogue when seeking software to cover their requirements and, only if there is no option that fits their needs in the catalogue, can they seek a proprietary alternative or develop a new one. And if they develop a new one, it needs to be open source and added to the catalogue.

I first learned about the concept at Akademy 2019, with the keynote by Leonardo Favario who presented the project. Recently, some discussions in the KDE community reminded me about it, and I finally decided to try and include GCompris in this catalogue.

In practice it is very simple to do:

– There is a specification for metadata description, called publiccode.yml.
– A project only needs to add a publiccode.yml file at the root of their source repository, and it will be found by the catalogue’s crawler.
– If the file is correct, and contains at least the minimum information required, the software will be added to the catalogue.

Also, the publiccode.yml specification is meant to be international and used by any country. Beside Italy, there are already a few other countries planning to use it.

I see this as a very good achievement, as it can help governments to recognize the relevance of Free and Open Source software for public institutions. Therefore I encourage other projects to support the effort by adding a publiccode.yml file in their source code. That will help promoting all the great solutions we already have in the Free Software ecosystem.

And for other interested KDE projects, please join the conversation on the corresponding Phabricator task, you may find some useful tips.

Sok 2021 Update

Wednesday 17th of February 2021 07:46:48 AM

I started my Sok project in January and in February my college decided to have the end semester exams, hence I had to halt the work a little bit but since my exams are done I have resumed work and will be continuing with the project.

Currently I have figured out the APIs and done test runs for twitter and mastodon but for some reason Facebook just doesn't want to comply and let me use their API . Now I'm figuring out the final endpoints for my API and then will start work on a basic frontend for the same.

The next step would be to enable proper logging of everything and dockerize this to enable the promo team for testing then same.

Looking forward to Completing this awesome and very useful project.

Calamares CI Extended

Tuesday 16th of February 2021 11:00:00 PM

Calamares is a modular installer for Linux distributions using Qt and KDE technologies. It is used by dozens of Linux distro’s for that crucial step of “get the ISO onto the HDD”, or some modern variant thereof. It’s modular, so distro’s can pick-and-choose what is needed: OpenRC or systemd, for instance. But it’s hard to cover everything that Linux distributions might need, so Calamares also has an “extensions” repository for more specialised modules. Let’s take a look.

Calamares window with modules highlighted

The screenshot here shows the first screen of Calamares (in demonstration mode, so “real” distro’s will probably have distro-specific styling). There’s a number of user-visible “pages” to Calamares: welcome, location, etc. There are modules that are responsible for each of those; the main Calamares distribution contains a configurable welcome module, and an alternative QML-based welcomeq module as well – plenty of choice for distro’s.

There are more modules than what is visible here, though: all the invisible steps like making a user, settting up the display manager, configuring OpenRC (or systemd) .. those are modules as well. For these invisible steps there are certainly some that make sense only for specialised distro’s, so while Calamares aims to be modular and address “most” of what a Linux needs to get installed, there is always one more module for that special case (like pre-installing CDE theming, or whatever).

So in the end there are two repositories for Calamares bits:

  • Calamares which is the main program, libraries, support bits, CMake infrastructure and all the modules that are generally useful (and some that aren’t, for historical reasons),
  • Calamares Extensions which contains more modules, more branding examples, and generally shows off that Calamares can be extended with “third party” code as well: distro’s can use this also to build their own collection of modules (although, as always, pull requests are welcome: I’d be happy to move as much as possible upstream if it is of interest to more than one single distro).

One extra ideas behind the extensions repo is that it is a test of how-reusable-is-Calamares-code and does-my-CMake-code-actually-work. So it is supposed to (naively) build C++ modules that use the full plugin API of Calamares. But this gives rise to a slight problem: how to shuffle the latest bits around. In a Continuous Integration (CI) setup things get built on every push. In split repositories, that becomes a little complicated unless you build all the repositories at every build: and that gets kind of expensive, computationally.

(This is by no means a surprising or new insight: KDE’s sysadmin team has roughly this in, KDE’s CI where one of the challenges is building KDE Applications against recent KDE Frameworks)

Drawing of CI flow

What I ended up doing is making a tarball of the build of Calamares, then shipping it across to CI builds of the extensions modules. To avoid excessive builds and tarball transfers, I’ve decided to do the tarballs every night, rather than on every push.

So part of my nightly CI build on KDE neon is to make install DESTDIR=stage followed by tar czf calamares.tar.gz stage to get all the bits that Calamares would have built. This is only slightly yucky: if I was more fastidious I might use CPack to build an installable package. Regardless, on pushes to the extensions repository, I can pick up that tarball as if it was a package, and unpack it to the container that is going to do the build of the extension modules. There is also a nightly build of the extensions repository that behaves the same.

What this gets me is that extensions try to build against a recent Calamares all the time, and changes to Calamares propagate to the extensions build as well. If (when) I break something, this will show up on IRC with a meaningful message.

Artifact upload is done with actions/upload-artifact@v2, one of the “standard” GitHub actions. The standard artifact download action does not know how to fetch artifacts from another repository, so I used dawidd6/action-download-artifact@v2. That does know how, so I can move the tarball around.

All this feels way more convoluted and clunky than GitLab. I’m glad KDE uses GitLab CI for some bits (and Jenkins for the rest) since all the time it feels like I’m fighting the system. Seriously, it takes a third-party action to move artifacts across repo’s? At this point I may as well be writing shell scripts again with a one-step action.

These build artifacts are never used by any distro: they’re for Calamares project consumption. Many distro’s do their own nightly builds: neon and Manjaro, for instance, build nightly packages for testing (and I’m grateful for their reports of problems as well). Why not use those packages instead? Well, getting those packages can be a bit tricksy outside of the scope of the distro-CI, and part of what I’m testing is the bits most distro’s won’t package anyway: the Calamares “SDK” for use by the extensions repo. So the various builds are complementary and catch different things.

One thing the CI is good for is making IRC lively(-ish) with notifications, I like that too.

<cala-ci> OK ci-push-xtn in calamares/calamares-extensions adriaandegroot on refs/heads/calamares <cala-ci> .. f2e59e6 [image-slideshow] Add an example QML slideshow for images

Plasma Pass 1.2.0

Tuesday 16th of February 2021 06:00:00 AM

Plasma Pass, a Plasma applet for the Pass password manager version 1.2.0 is out.

The applet now supports OTP codes (in the format supported by the pass OTP plugin). The ‘clock’ icon appears next to all passwords, even those that do not have OTP code. This is a limitation caused by the passwords being stored in files encrypted and being decrypted only when the user requests it - so the applet cannot know whether there’s an OTP code available in the password file until you click on it. There were also some small fixups and UI improvements.



SHA-256: 01f0b03b99e41c067295e7708d41bbe581c0d73e78d43b50bf86b4699969f780 SHA-1: 07a32d21b0c4dd38cad9c800d7b8f463f42c39c6


0ABDFA55A4E6BEA99A83EA974D69557AECB13683 Daniel Vrátil <>

Feel free to report any issues or feature requests to KDE Bugzilla.

KFluff — Kate’s External Tools

Monday 15th of February 2021 08:28:08 PM
I’ve been learning C++ lately. About two months ago I finished Codecademy’s C++ course (honestly really good for the basics), a month ago I managed to fetch the C++ Fundamentals book from PacktPub for free, and now I’m mostly following this amazing YouTube online course by The Cherno and taking a look at C++ Weekly. … Continue reading "KFluff — Kate’s External Tools"

Latte Dock v0.10~ | Templates, templates...

Monday 15th of February 2021 06:05:00 PM


Hello everyone,

let's improve our layout and view templates in order to make distros and users life easier when they share their Latte layouts and views. View in Latte stands for a Dock or Panel.


1. Layout Templates

Just go to Layouts Editor, select any layout you want, Export->Export As Template . A dialog will appear to choose which applets will maintain their configuration. You can use it to dismiss configuration for applets that contain any of your personal data such as user credentials, passwords etc. Layout templates and Layout files are identical structures with the only difference that for templates the user has approved the applets configuration.

- export template dialog -

- new layout menu - For distros it is suggested to add their layout templates in folder: shell/package/contents/templates/ because this way they will always be available to their users to readd them through Layouts Editor -> New Layout menu.

For users all their extracted user layout templates can be found at folder: ~/.config/latte/templates  

2. View Templates

In the same manner Docks and Panels can become templates that the user can easily readd them through Dock/Panel Settings -> New [Actions menu]. Both for distros and users view templates are again found at folders:
  • shell/package/contents/templates/ 
  • ~/.config/latte/templates
- Dock, New Actions Menu -

3. Full Configuration Import/Export

You can be sure of course that your templates are included in your Latte Export Configuration file which is used from users to take a Full Backup of your Latte configuration. You can find it at: Layouts Editor -> File -> Import/Export Configuration

- Export Full Configuration -

4. Donations

Personally I do not think donations are necessary. Easier thing you can do is to just install from KDE Store the Latte related widgets, they work just fine even with plasma panels. KDE Store provides me some monthly beers because of this. Funny thing is that Latte Separator that I developed in a day provides me most of the beers and Latte Dock that I develop plenty of hours daily for the last three years provides me almost none.. :) I mention it as a funny fact, please do not take it differently.

In a case, if you still want to donate you can use the following:

You can find Latte at Liberapay ,    

or you can split your donation between my active projects in kde store.

Qt for MCUs 1.7 released

Monday 15th of February 2021 12:21:22 PM

The first Qt for MCUs release of 2021 is out! Download it to get the latest features and create ever lighter yet impressive-looking Qt applications for microcontroller-powered devices.

OpenUK Belonging

Monday 15th of February 2021 11:23:12 AM

OpenUK is an organisation promoting open tech, come join us and belong. OpenUK Belonging video.

Sign up to our letter by sharing it on social media with the #OpenUKBelonging? OpenUK seeks Belonging Partners – not for profit organisations who encourage a range diversity and inclusion through their activities –  to be a part of our ecosystem to advance belonging in Open Technology together and sign up to this letter by sharing it on social media. We will launch these partnerships on International Women’s Day on 8 March and will support each of the partners throughout the year.

The Kate Text Editor - Valentine's Day 2021

Sunday 14th of February 2021 06:33:00 PM

Kate, KTextEditor and Co. did get a nice stream of updates in the first two weeks of February 2021.

I will just pick a few things I really liked, if you want to have a full overview, you can go through the list of all merged patches.

Even more multi-threading in search in files

After the initial parallelization of the actual search in files as described here, Kåre came up with the idea to parallelize the creation of the file list we use for the search, too.

We worked together on this in merge 220 and merge 221, the result will allow for even faster searches if no initial file list is provided already by e.g. the project plugin.

I didn’t actually believe that would be worth the hassle, but Kåre provided impressive speedups in merge 220, from over 30 seconds down to around 3 seconds, nice!

Improvements to the color picker plugin

The new color picker plugin got some further improvements by Jan Paul, if you missed what it does, see screenshot below, it shows the color for #hexcodes inline in the text editor view + provides a color picker to alter it.

Open a project per command line

So far, Kate projects can only be opened indirectly by opening a file inside the project or launching Kate from a terminal inside some directory of a project.

Alexander rectified this now, Kate will allow to open a project just by passing the directory as argument after this merge.

This sounds like a rather trivial change, but I guess it will make working with projects more natural.

Allow to switch branches in Git

Waqar works on better Git integration. This has been an idea since years but we never got around to it ;=) Finally we see some progress.

The current implementation inside the project plugin shows prominently the current branch of your clone below the project name. Pressing this button allows you to either switch to an existing branch or create a new one and switch to it. As usual, this quick open like dialog provides the fuzzy matching we now use close to everywhere in Kate.

Improving LSP contextual help

Waqar worked on better visualization of the contextual help via LSP, too. So far, we just used some normal tooltips, unfortunately that doesn’t work that well for the rich content we get from typical LSP servers like clangd. Now we have some custom widget for this with proper highlighting and font/color matching the editor theme.

Improved website theme

Perhaps this change is obvious, as already visible if you read this post on our website, but we now use the shared theming other KDE websites use, too. If you read this from some aggregator, take a look at the start page screenshot below.

Carl worked on this, he did a fantastic job.

There were several iterations until we arrived at the current state, thanks a lot (to Carl and naturally all others involved here)!

A big thanks to all the people that help to translate our websites (and tools), too!

Help wanted!

You want more nifty stuff? More speed? More of everything?

You want to make our website even nicer?

Show up and contribute.

We have a lot of ideas but not that many people working on them :)


A matching thread for this can be found here on r/KDE.

AST Matchmaking made easy

Sunday 14th of February 2021 02:08:09 PM

The upcoming version of Clang 12 includes a new traversal mode which can be used for easier matching of AST nodes.

I presented this mode at EuroLLVM and ACCU 2019, but at the time I was calling it “ignoring invisible” mode. The primary aim is to make AST Matchers easier to write by requiring less “activation learning” of the newcomer to the AST Matcher API. I’m analogizing to “activation energy” here – this mode reduces the amount of learning of new concepts must be done before starting to use AST Matchers.

The new mode is a mouthful – IgnoreUnlessSpelledInSource – but it makes AST Matchers easier to use correctly and harder to use incorrectly. Some examples of the mode are available in the AST Matchers reference documentation.

In clang-query, the mode affects both matching and dumping of AST nodes and it is enabled with:

set traversal IgnoreUnlessSpelledInSource

while in the C++ API of AST Matchers, it is enabled by wrapping a matcher in:

traverse(TK_IgnoreUnlessSpelledInSource, ...)

The result is that matching of AST nodes corresponds closely to what is written syntactically in the source, rather than corresponding to the somewhat arbitrary structure implicit in the clang::RecursiveASTVisitor class.

Using this new mode makes it possible to “add features by removing code” in clang-tidy, making the checks more maintainable and making it possible to run checks in all language modes.

Clang does not use this new mode by default.

Implicit nodes in expressions

One of the issues identified is that the Clang AST contains many nodes which must exist in order to satisfy the requirements of the language. For example, a simple function relying on an implicit conversion might look like.

struct A { A(int); ~A(); }; A f() { return 42; }

In the new IgnoreUnlessSpelledInSource mode, this is represented as

ReturnStmt `-IntegerLiteral '42' and the integer literal can be matched with returnStmt(hasReturnValue(integerLiteral().bind("returnVal")))

In the default mode, the AST might be (depending on C++ language dialect) represented by something like:

ReturnStmt `-ExprWithCleanups `-CXXConstructExpr `-MaterializeTemporaryExpr `-ImplicitCastExpr `-CXXBindTemporaryExpr `-ImplicitCastExpr `-CXXConstructExpr `-IntegerLiteral '42'

To newcomers to the Clang AST, and to me, it is not obvious what all of the nodes there are for. I can reason that an instance of A must be constructed. However, there are two CXXConstructExprs in this AST and many other nodes, some of which are due to the presence of a user-provided destructor, others due to the temporary object. These kinds of extra nodes appear in most expressions, such as when processing arguments to a function call or constructor, declaring or assigning a variable, converting something to bool in an if condition etc.

There are already AST Matchers such as ignoringImplicit() which skip over some of the implicit nodes in AST Matchers. Still though, a complete matcher for the return value of this return statement looks something like

returnStmt(hasReturnValue( ignoringImplicit( ignoringElidableConstructorCall( ignoringImplicit( cxxConstructExpr(hasArgument(0, ignoringImplicit( integerLiteral().bind("returnVal") ) )) ) ) ) ))

Another mouthful.

There are several problems with this.

  • Typical clang-tidy checks which deal with expressions tend to require extensive use of such ignoring...() matchers. This makes the matcher expressions in such clang-tidy checks quite noisy
  • Different language dialects represent the same C++ code with different AST structures/extra nodes, necessitating testing and implementing the check in multiple language dialects
  • The requirement or possibility to use these intermediate matchers at all is not easily discoverable, nor are the required matchers to saitsfy all language modes easily discoverable
  • If an AST Matcher is written without explicitly ignoring implicit nodes, Clang produces lots of surprising results and incorrect transformations
Implicit declarations nodes

Aside from implicit expression nodes, Clang AST Matchers also match on implicit declaration nodes in the AST. That means that if we wish to make copy constructors in our codebase explicit we might use a matcher such as

cxxConstructorDecl( isCopyConstructor() ).bind("prepend_explicit")

This will work fine in the new IgnoreUnlessSpelledInSource mode.

However, in the default mode, if we have a struct with a compiler-provided copy constructor such as:

struct Copyable { OtherStruct m_o; Copyable(); };

we will match the compiler provided copy constructor. When our check inserts explicit at the copy constructor location it will result in:

struct explicit Copyable { OtherStruct m_o; Copyable(); };

Clearly this is an incorrect transformation despite the transformation code “looking” correct. This AST Matcher API is hard to use correctly and easy to use incorrectly. Because of this, the isImplicit() matcher is typically used in clang-tidy checks to attempt to exclude such transformations, making the matcher expression more complicated.

Implicit template instantiations

Another surpise in the behavior of AST Matchers is that template instantiations are matched by default. That means that if we wish to change class members of type int to type safe_int for example, we might write a matcher something like

fieldDecl( hasType(asString("int")) ).bind("use_safe_int")

This works fine for non-template code.

If we have a template like

template struct TemplStruct { TemplStruct() {} ~TemplStruct() {} private: T m_t; };

then clang internally creates an instantiation of the template with a substituted type for each template instantation in our translation unit.

The new IgnoreUnlessSpelledInSource mode ignores those internal instantiations and matches only on the template declaration (ie, with the T un-substituted).

However, in the default mode, our template will be transformed to use safe_int too:

template struct TemplStruct { TemplStruct() {} ~TemplStruct() {} private: safe_int m_t; };

This is clearly an incorrect transformation. Because of this, isTemplateInstantiation() and similar matchers are often used in clang-tidy to exclude AST matches which produce such transformations.

Matching metaphorical code

C++ has multiple features which are designed to be simple expressions which the compiler expands to something less-convenient to write. Range-based for loops are a good example as they are a metaphor for an explicit loop with calls to begin and end among other things. Lambdas are another good example as they are a metaphor for a callable object. C++20 adds several more, including rewriting use of operator!=(...) to use !operator==(...) and operator<(...) to use the spaceship operator.

[I admit that in writing this blog post I searched for a metaphor for “a device which aids understanding by replacing the thing it describes with something more familiar” before realizing the recursion. I haven’t heard these features described as metaphorical before though…]

All of these metaphorical replacements can be explored in the Clang AST or on CPP Insights.

Matching these internal representations is confusing and can cause incorrect transformations. None of these internal representations are matchable in the new IgnoreUnlessSpelledInSource mode.

In the default matching mode, the CallExprs for begin and end are matched, as are the CXXRecordDecl implicit in the lambda and hidden comparisons within rewritten binary operators such as spaceship (causing bugs in clang-tidy checks).

Easy Mode

This new mode of AST Matching is designed to be easier for users, especially newcomers to the Clang AST, to use and discover while offering protection from typical transformation traps. It will likely be used in my Qt-based Gui Quaplah, but it must be enabled explicitly in existing clang tools.

As usual, feedback is very welcome!

More in Tux Machines

Mozilla Leftovers

  • Firefox 86 brings multiple Picture-in-Picture, “Total Cookie Protection”

    In December 2019, Firefox introduced Picture-in-Picture mode—an additional overlay control on in-browser embedded videos that allows the user to detach the video from the browser. Once detached, the video has no window dressing whatsoever—no title bar, min/max/close, etc. PiP mode allows users who tile their windows—automatically or manually—to watch said video while consuming a bare minimum of screen real estate. Firefox 86 introduces the concept of multiple simultaneous Picture-in-Picture instances. Prior to build 86, hitting the PiP control on a second video would simply reattach the first video to its parent tab and detach the second. Now, you can have as many floating, detached video windows as you'd like—potentially turning any monitor into something reminiscent of a security DVR display. The key thing to realize about multi-PiP is that the parent tabs must remain open—if you navigate away from the parent tab of an existing PiP window, the PiP window itself closes as well. Once I realized this, I had no difficulty surrounding my Firefox 86 window with five detached, simultaneously playing video windows.

  • This Week in Glean: Boring Monitoring [Ed: Mozilla insists that it is not surveillance when they call it "data science" and "big data"]

    Every Monday the Glean has its weekly Glean SDK meeting. This meeting is used for 2 main parts: First discussing the features and bugs the team is currently investigating or that were requested by outside stakeholders. And second bug triage & monitoring of data that Glean reports in the wild. [...] It probably can! But it requires more work than throwing together a dashboard with graphs. It’s also not as easy to define thresholds on these changes and when to report them. There’s work underway that hopefully enables us to more quickly build up these dashboards for any product using the Glean SDK, which we can then also extend to do more reporting automated. The final goal should be that the product teams themselves are responsible for monitoring their data.

  • William Lachance: Community @ Mozilla: People First, Open Source Second [Ed: Is this why Mozilla pays its CEO over 3 million dollars per year (quadruple the older sum) while sacking even its own people and spying on Firefox users (people)?]

    It seems ridiculously naive in retrospect, but I can remember thinking at the time that the right amount of “open source” would solve all the problems. What can I say? It was the era of the Arab Spring, WikiLeaks had not yet become a scandal, Google still felt like something of a benevolent upstart, even Facebook’s mission of “making the world more connected” sounded great to me at the time. If we could just push more things out in the open, then the right solutions would become apparent and fixing the structural problems society was facing would become easy! What a difference a decade makes. The events of the last few years have demonstrated (conclusively, in my view) that open systems aren’t necessarily a protector against abuse by governments, technology monopolies and ill-intentioned groups of individuals alike. Amazon, Google and Facebook are (still) some of the top contributors to key pieces of open source infrastructure but it’s now beyond any doubt that they’re also responsible for amplifying a very large share of the problems global society is experiencing.

LXTerminal 0.4.0 released.

Terminal emulator of LXDE had no releases for more than two years. Not much was added, not much was fixed but still some work done. Could be more of course but what we can do with our forces, that we do. Let hope we can do more later. Read more

Security Leftovers

  • Security updates for Wednesday

    Security updates have been issued by openSUSE (firefox and tor), Oracle (stunnel and xterm), Red Hat (virt:8.2 and virt-devel:8.2 and xterm), SUSE (avahi, gnuplot, java-1_7_0-ibm, and pcp), and Ubuntu (openssl).

  • Why not rely on app developer to handle security? – Michał Górny

    One of the comments to the The modern packager’s security nightmare post posed a very important question: why is it bad to depend on the app developer to address security issues? In fact, I believe it is important enough to justify a whole post discussing the problem. To clarify, the wider context is bundling dependencies, i.e. relying on the application developer to ensure that all the dependencies included with the application to be free of vulnerabilities. In my opinion, the root of security in open source software is widely understood auditing. Since the code is public, everyone can read it, analyze it, test it. However, with a typical system install including thousands of packages from hundreds of different upstreams, it is really impossible even for large companies (not to mention individuals) to be able to audit all that code. Instead, we assume that with large enough number of eyes looking at the code, all vulnerabilities will eventually be found and published. On top of auditing we add trust. Today, CVE authorities are at the root of our vulnerability trust. We trust them to reliably publish reports of vulnerabilities found in various packages. However, once again we can’t expect users to manually make sure that the huge number of the packages they are running are free of vulnerabilities. Instead, the trust is hierarchically moved down to software authors and distributions. Both software authors and distribution packagers share a common goal — ensuring that their end users are running working, secure software. Why do I believe then that the user’s trust is better placed in distribution packagers than in software authors? I am going to explain this in three points.

  • Sysdig Donates Module to CNCF to Improve Linux Security

    Sysdig announced today it has donated a sysdig kernel module, along with libraries for the Falco security platform for Kubernetes, to the Cloud Native Computing Foundation (CNCF) as part of an effort to advance Linux security.

  • Linux Foundation Announces DizmeID Foundation to Develop and Enable a Self-Sovereign Identity Credential Network

    The Linux Foundation, the nonprofit organization enabling mass innovation through open source, today announced the DizmeID Foundation and technical project with the intent to support digital identity credentialing. The effort will combine the benefits of self-sovereign identity with necessary compliance and regulation, with the aim to enable wallet holders with ownership and control over their digital identity and data access and distribution.

  • Linux Foundation Announces DizmeID Foundation to Develop and Enable a Self-Sovereign Identity Credential Network

Best Free And Open Source Photoshop Alternatives

Photoshop is quite synonymous with Graphics design nowadays, but it is not the only king in the room. Photoshop doesn’t come with a friendly interface for beginners. No doubt photoshop offers you freedom of using features quite independently, but everything comes at a cost. There are some other options too that are worth considering for users who are looking for open source and free photoshop alternatives. These free and open source photoshop alternatives are not only useful for beginners but also useful for professionals who are thinking of switching from photoshop. And the good thing is that these free applications make no compromise with the quality of work. So, what to do if you are a bit tight on budget and want to learn to design without paying the monthly subscription as in Photoshop. Well, I have prepared a list of free and open-source applications like photoshop to create awesome designs without compromising quality. Read more