Let’s go for my web review for the week 2026-27.

What happened to the fight for the Internet?

Tags: tech, politics, surveillance

Excellent piece, where are the netizens who should be fighting back those bills? Looks like we became very complacent and passivity reigns this time around. Didn’t think it was related to the pervasive centralisation already in place… but indeed that might be a strong contributing factor.

https://dustycloud.org/blog/what-happened-to-the-fight-for-the-internet/

Age verification is just a precursor to attribution of speech

Tags: tech, politics, law, surveillance

Definitely this, we can’t trust this kind of mechanism for what they open the door to.

https://nonogra.ph/age-verification-is-just-a-precursor-to-attribution-of-speech-06-29-2026

my review of uruky

Tags: tech, web, search

Several times I bump into articles praising this one. I’ve been test driving it a bit, the experience is still a bit bare but it’s clearly maturing. Definitely an option to keep an eye on in my opinion.

https://blog.sulimans.space/my-review-of-uruky/

Zuckerberg’s increasingly bizarre war on whistleblowers

Tags: tech, social-media, facebook, ethics

There might be a method behind the madness of the thin skinned autocrat heading Meta… Unfortunately it probably works.

https://pluralistic.net/2026/06/27/zuckerstreisand-2/

Chatbots vs. Ozone

Tags: tech, geospatial, ai, machine-learning, gpt, economics, ecology

More reasons why the whole “data centers in space idea” is stupidly dangerous and likely unreachable.

https://blog.dshr.org/2026/05/chatbots-vs-ozone.html?m=1

Claude Code Is Steganographically Marking Requests

Tags: tech, ai, machine-learning, gpt, copilot, trust, security, privacy

You sure you can trust those systems? It’s proprietary software and they’re clearly on a slippery slop. For something so security sensitive this is concerning.

https://thereallo.dev/blog/claude-code-prompt-steganography

Prompt Injection as Role Confusion

Tags: tech, ai, machine-learning, gpt, cognition, security, safety

Interesting paper (go to the full one for all the details) which shows that with the current architecture it’s really hard if not impossible to make safe systems with LLMs. This gives interesting insights in the weird form of proto-cognition those models exhibit.

https://role-confusion.github.io/

Text Editor: Data Structures

Tags: tech, text, editor, design

Neat introduction to the right data structures to use when making a text editor.

https://www.averylaird.com/programming/the%20text%20editor/2017/09/30/the-piece-table.html

Engineering High-Performance Parsers with Data-Oriented Design

Tags: tech, data-oriented, architecture, performance, parsing

Interesting article applying data oriented design to parsing tasks. This is really a good approach for performance.

https://www.arshad.fyi/writings/engineering-high-performance-parsers

Data Access Patterns That Makes Your CPU Really Angry

Tags: tech, cpu, memory, hardware, performance

Interesting experiment on how to totally break the performance of memory accesses. This gives good insights on the whole chain works.

https://blog.weineng.me/posts/slowest_add/

The Physics of Memory

Tags: tech, javascript, memory, data-oriented, performance

Unsurprisingly cache locality is a very important factor. What’s interesting here is that it still applies to a language like Javascript where you’d expect to not have enough control on the memory layout to reap any benefits.

https://www.dmurph.com/posts/2026/06/ecs_vs_oop_benchmark/ecs_vs_oop_benchmark.html

High-performance Rust: Understanding and eliminating memory fragmentation

Tags: tech, rust, memory, embedded, performance

Interesting Rust options to limit the amount of heap allocations if you’re constrained by memory or for performance reasons.

https://kerkour.com/rust-high-performance-memory-fragmentation-allocations

Hobby’s algorithm for aesthetic Bézier splines

Tags: tech, graphics, mathematics

Interested in splines? This is a gentle introduction which points to further resources if you want to implement them.

https://www.jakelow.com/blog/hobby-curves#fn-2

What To Learn To Be A Real Time Graphics Programmer

Tags: tech, 3d, shader, mathematics, graphics

Wondering what to learn to get into graphics programming? This is a nice list.

https://blog.demofox.org/2026/07/01/what-to-learn-to-be-a-graphics-programmer/

Announcing Box3D

Tags: tech, physics, simulation, 3d

Exciting! This looks like a neat 3D physics engine.

https://box2d.org/posts/2026/06/announcing-box3d/

The essence of architectural work

Tags: tech, architecture, complexity

This is an ongoing series, but there are good insights about software architecture work in the first few articles. Shows quite well the important tradeoffs and the usual traps.

https://www.ufried.com/blog/essence_of_architecture_1/

Every bottlenose dolphin invents a unique whistle that becomes its name

Tags: biology, nature, cognition

So using personal names is not an inherently human trait, this is confirmed through research now. Before their were signs and suspicions, but now the trail of evidences is strong.

https://spacedaily.com/d-within-the-first-few-months-of-life-every-bottlenose-dolphin-invents-a-unique-whistle-that-becomes-its-name-for-the-rest-of-its-life-and-other-dolphins-learn-that-whistle-remember-it-and/

Notes from a burning Paris

Tags: climate, ecology

This is what things will look like in the coming years. Only probably worse, and for more and more people.

https://sarahwilson.substack.com/p/notes-from-a-burning-paris

Bye for now!

A couple of months ago I improved some of our dialogs and this time I worked on some more. Did you know that you can just paste the clipboard’s content into the Dolphin file manager or on the desktop to create a new file from it?

Tobias Fella added a proper “platform message dialog” for Qt to use. This replaces the hideous Qt Quick message dialogs you could see in some places. With that, we are also finally able to play our message box sounds for Qt-only applications using QMessageBox (instead of KMessageBox or KMessageDialog). To do this, Qt sends an QAccessible::Alert event that is then handled by the relevant platform accessibility integration. On Windows it for example calls the win32 PlaySound API. However, I didn’t want to mess with Qt’s AT-SPI¹ stack just for this. Now that we provide a custom dialog, we might as well play the sound from there.

Just like the “New File” dialog, the paste dialog mentioned above also displays the file icon now. It also tries to guess what kind of file it is and automatically suggests a matching file extension. For example, copying something that looks like HTML will suggest the name “pasted file.html”. You are of course still free to choose a different file name and extension.

An application can also suggest a name using the custom application/x-kde-suggestedfilename MIME type. Spectacle does this so a screenshot copied to clipboard and then pasted (rather than saved directly) will nevertheless use a “Screenshot_xyz” file name. The clipboard history now remembers the suggested name when it stores an entry so when you recall it later it will still use that name as expected.

When dropping a folder into Kate, all files contained within will be opened. Kate has always been able to open files on remote locations thanks to KIO but the drag and drop code only worked with local folders. This is now fixed and you can drop a folder from a SMB or other share into your Kate the same way as any local one.

A nifty addition to both the menu and settings page for choosing a syntax highlighting color scheme is a little preview icon similar to the application color scheme. This lets you roughly judge the appearance of the theme before selecting it.

Finally, KWin’s debug console (Open KRunner, type “KWin”) received a “Pick Window…” button. This way you can more easily find a particular window in the potentially long list of windows. The kwindowprop tool (KWin’s equivalent to xprop) now also includes the PID of the process owning the window.

1. Assistive Technology Service Provider Interface, a cross-desktop accessibility framework ︎

This week I shipped two new features for KeepSecret. KWallet XML Import (!34)

The Import menu on the wallet page is now a submenu with two options:

-KeepSecret…

-KWallet XML…

Both import formats are converted into the same internal format, allowing them to use the existing import code. I only implemented import support, since exporting to the old KWallet format wasn't necessary because KWallet is being deprecated.

Password Generator (!35)

I added a Generate button to the Create New Entry dialog. Clicking it generates a random 16-character password and fills the password field.

The password is generated in SecretItemProxy::generatePassword() using QRandomGenerator::global(), which uses the operating system's secure random source. A character set is built from the selected options (lowercase letters, uppercase letters, numbers, and symbols), and each character is chosen randomly from that set. This also allows passwords to include symbols like !@#$%^&*.

The function returns a QByteArray instead of a QString, matching the existing code and avoiding an unnecessary copy of the secret in C++.

During code review, Michael K83 pointed out that secrets stored in normal QByteArray or QString objects are not automatically erased from memory after use. He suggested looking at how ksecretd and KeePassXC handle secure memory.

Marco Martin explained that an even bigger challenge exists once the password reaches QML. The password becomes a QString inside the QML engine, where Qt may create multiple internal copies that cannot be explicitly cleared. It will be addressed separately in issue #25.

Over 180 individual programs plus dozens of programmer libraries and feature plugins are released simultaneously as part of KDE Gear.

Today they all get new bugfix source releases with updated translations, including:

• elisa: Change output device when global output is changed (Commit, fixes bug #512126)
• kdeconnect: Fix file transfers when notification sending is enabled (Commit, fixes bug #516765)
• kdenlive: Fix timeline playhead going out of view while playing (Commit, fixes bug #517494)

Distro and app store packagers should update their application packages.

• 26.04 release notes for information on tarballs and known issues.
• Package download wiki page
• 26.04.3 source info page
• 26.04.3 full changelog

At FOSDEM 2025 I presented my (intentionally controversial) proposal how to keep copyright and licensing info in minified JS/CSS and asked for feedback, including from front-end developers.

Two months later, I took the feedback from FOSDEM and held a small workshop session with a group consisting of OSPO leaders, FOSS lawyers and a handful of FOSS developers at LLW 2025.

This blog post was finished¹ more than a year after both, so I will not be summarizing my FOSDEM talk, and suggest you listen to it (esp. the Q&A part), if you are interested in the details.

But I will summarize the results of both sessions below.

Are SDPX IDs enough for compliance or not (given their templating)¶

Someone argued that for certain licenses – specifically, e.g. the MIT and BSD family – even the SPDX License List has a some templating in place, and as such identifying it with just an SPDX ID would not fulfil the license obligations, by strict reading of the license.

That is a concern that I identified already in my original proposal and I agree that my proposed approach has a certain amount of “handwaving”, which is not 100% risk-proof.

(Spoiler: we fix this issue in the final proposal. Wait for the next blog post in this series.)

Impact on size of the minifed code¶

A common concern from web developers was how much keeping the SPDX/REUSE tags in the minified code would impact the its size.

With the help of the wonderful Lukas Taegert-Atkinson of Rollup fame, we managed to get a good idea what the impact adding REUSE/SPDX tags to all the files would have on the size of the minified code.

As an PoC Lukas made the following change to the build process of Rollup Browser, so we could compare the size of the minified code before and after the diff.

diff --git a/rollup.config.ts b/rollup.config.ts

--- a/rollup.config.ts  (revision 384d5333fbc3d8918b41856822376da2a65ccaa3)
+++ b/rollup.config.ts  (date 1742569205307)
@@ -152,7 +152,22 @@
            collectLicensesBrowser(),
            writeLicenseBrowser(),
            cleanBeforeWrite('browser/dist'),
-           emitWasmFile()
+           emitWasmFile(),
+           {
+               name: 'add-fake-tags',
+               transform(code) {
+                   return {
+                       code: `/*!
+* SPDX-SnippetBegin
+* SPDX-SnippetCopyrightText: © 2021 Test Dummy <dummy@test.example>
+* SPDX-License-Identifier: BSD-2-Clause
+*/
+${code}
+/*! SPDX-SnippetEnd */`,
+                       map: { mappings: '' }
+                   };
+               }
+           }
        ],
        strictDeprecations: true,
        treeshake

If Rollup Browser was built as per default, the full minified code resulted in 374 KiB.

After the patch that caused (dummy) snippet-level SPDX tags to be inserted into all the code (Rollup itself and its dependencies), the size grew to 415 KiB though.

That is a 11% increase in size. Not exactly negligible, but definitely far from terrible. And if tooling were to be updated, with de-duplication we could possibly take that number down quite a bit too.

In the previous tiny Svelte + Rollup + Terser PoC, both with and without SPDX tags are 12 KiB, so we need take a magnifying glass to compare 12.681 bytes with tags, and 12.324 bytes without them – that is just a 3% difference.

And in the previous React Scripts (+ WebPack + Terser) PoC, the overall build size is virtually unchanged, but oddly enough while some files become bigger, others become smaller.

With REUSE tags, the total size of build/static/ is 536 KiB (specifically, 531.070 bytes):

build/static/css:
.rw-r--r-- 1.038 hook  3 apr 01:54  main.05c219f8.css
.rw-r--r-- 1.759 hook  3 apr 01:54  main.05c219f8.css.map

build/static/js:
.rw-r--r--   4.534 hook  3 apr 01:54  453.2a77899f.chunk.js
.rw-r--r--  10.597 hook  3 apr 01:54  453.2a77899f.chunk.js.map
.rw-r--r-- 143.544 hook  3 apr 01:54  main.608edf8e.js
.rw-r--r--   1.205 hook  3 apr 01:54  main.608edf8e.js.LICENSE.txt
.rw-r--r-- 368.393 hook  3 apr 01:54  main.608edf8e.js.map

and without the SPDX tags, the total size of build/static/ is also 536 KiB (specifically, 529.880 bytes):

build/static/css:
.rw-r--r--   779 hook  3 apr 01:53  main.f855e6bc.css
.rw-r--r-- 1.427 hook  3 apr 01:53  main.f855e6bc.css.map

build/static/js:
.rw-r--r--   4.534 hook  3 apr 01:53  453.2a77899f.chunk.js
.rw-r--r--  10.597 hook  3 apr 01:53  453.2a77899f.chunk.js.map
.rw-r--r-- 143.544 hook  3 apr 01:53  main.608edf8e.js
.rw-r--r--   1.070 hook  3 apr 01:53  main.608edf8e.js.LICENSE.txt
.rw-r--r-- 367.929 hook  3 apr 01:53  main.608edf8e.js.map

Which is a difference of measly 0.2%.

Lukas was also quick to point out that a ballpark estimation of how much extra space this would take is quite easy to calculate, as all it is needed is to count all files that would be included in the final JS (or CSS) bundle and multiply that with the size of the SPDX tags. As such, the impact would be bigger on projects that have many very short source code files, while smaller on those that have fewer, but longer source code files. Again, this is without taking any de-duplication into account.

So we can come up with a generic formula:

size = normal_minified_size + (number_of_files × 4_extra_lines)

What was the cause of the problem with the Snippet-Begin and Snippet-End tags?¶

You may recall in my original proposal that there was an issue with the SPDX-Snippet-Begin and SPDX-Snippet-End tags being jumbled in the resulting minified code.

According to Lucas, this is most likely something Terser caused when associating comments to functions and then optimizing the code. He is fairly positive it can be solved though.

(Again, spoiler: this will be a moot issue in the end. Wait for the next blog post.)

Do we need tags in the minified code?¶

Of course, a very good question is whether we need the REUSE/SPDX tags in the minified code itself. Especially, given that we do not require something as strict for other non-source code (e.g. compiled code).

I admit, I do not think we actually need to.

To be honest, why that is in the original proposal, is because I was trying to push just how far we can bring license compliance in client-side JS/CSS by just leveraging already existing standards and tools. It turns out we can push it very far – arguably ad absurdum ;)

So, no, I do not think we need that, but it was a good thought experiment and I think it was necessary to get discussion going².

Alternative proposal: SBOM¶

But if we do not keep it in the code we ship, where do we keep the license/copyright info then?

At LLW 2025 we had a pretty intense session where ultimately we came up with an alternative proposal to generate an SBOM and ship that instead. This solves a lot of issues and is something that license compliance officers are already familiar with. It would also bring it closer to how we manage licensing when shipping non-web software.

The SBOM approach would require use of tooling and by the end of the day we were left with a bunch of loose threads, but in general, this sounds like a good way forward.

Conclusion: plan B in the making¶

Was all the effort now wasted?

Not at all.

Web pages and (SaaS) web applications are still a bit of a different beast, so we learned a lot in the past two years due to this exercise.

I am pretty confident we now have a way how to fulfil the license obligations:

• without making the web page too heavy;
• burdening web developers any more than other programmers;
• shipping machine-readable compliance artifacts; as well as
• making the information ready for human consumption too.

In the next blog post I will present the final proposal.

hook out → I think we’re slowly onto something …

Welcome to another edition of “This month in KDE Linux” — KDE’s in-progress operating system.

This month was pretty smooth; we had no build delivery drama, and all OS images we shipped were of satisfactory quality. The project is maturing, and we’re 78% of the way towards completing the beta milestone.

QA & testing

Bhushan Shah and Thomas Duckworth continued working on the project to build a robust and modern automatic QA system. It’s really really close to being integrated at this point, and will act as a full-stack integration test for all of KDE Plasma in addition to a test system for KDE Linux specifically.

More user-friendly installation

Hadi Chokr did the huge amount of work necessary to transform KDE Linux’s .raw image file into a hybrid image that’s also a valid .iso file! This allows KDE Linux to be installed more easily using VM software that often expects to be given an .iso file.

Remember that you’ll still need to turn on UEFI mode, as KDE Linux still intentionally doesn’t support the legacy BIOS system!

Better audio CD ripping

Harald Sitter, Jan Rathmann, and I completed a small project to get KDE’s Audex app up on Flathub as a replacement for the audiocd-kio software we had previously been pre-installing on the image.

The problem with audiocd-kio is that it included two System Settings pages of questionable utility that offered a fairly old-fashioned UX. Now we don’t include those things, and instead we document how to download Audex and use it to rip CDs. And this way, you get automatic metadata lookup, too!

Easier log collection

Felix Araújo built a tool to ease the collection of logs called collect-logs. It also does some data sanitization. This will be very useful for bug reporting purposes!

Rudimentary “Developer Mode”

I created a very simple system to show and hide developer tools, and they’re hidden by default until you run toggle-developer-mode, which is documented here.

This reduces clutter in the launcher widgets of users who aren’t software developers. In the future we’ll add more to this script, and we might consider moving more tools off the base image and into Flatpak apps or even downloadable meta-packages, thereby coming full circle by re-inventing packaging. Go figure.

Documentation

I wrote documentation for how to configure input methods for Chinese, Japanese, Korean, and Vietnamese text input, in consultation with several speakers of these languages.

And in the near future, we plan to pre-install some of these tools to make things easier for the world’s 1.7 billion people who use one of them to communicate on their digital devices.

Grab bag

Thomas Duckworth made Plasma Browser Integration continue to be enabled by default with the latest version of Firefox.

I fixed ydotool, which I had previously broken by trying to force to run as a systemd service. Turns out it can’t do that. So now it’s at least disabled by default.

Yago Raña Gayoso enabled shell completions for kde-builder.

Aleix Pol Gonzalez removed a few pre-installed GTK libraries that it turns out weren’t used for anything.

Vishal Rao prevented the live session from writing to the system’s real-time clock, which could be a nuisance for people who don’t end up installing the OS and go back to their already-installed OS.

Clément Villemur made the Calamares installer not bug you to connect to the internet, because it doesn’t actually need internet access.

And that wraps up June! There are a lot of projects in flight right now, from finishing up the new QA system, to building moving the base OS with BuildStream, to hardening the kernel, to improving each image’s changelogs.

So there’s still lots to do! If you’re a fan of the project, please help out; there are many ways:

• User support: help support people on discuss.kde.org using KDE Linux.
• Issue reporting: install KDE Linux and report issues.
• Documentation: improve docs; submit merge requests here.
• Flatpak: fix packaging or code issues in Flatpak-packaged apps.
• OS development: help build KDE Linux! There’s plenty to do.

Rust has achieved something extraordinary: it genuinely excites people to write software. But when it comes to building a real user interface, the ecosystem is still finding its footing. There are numerous options to pick your Rust UI framework from, including those gaining traction, like Iced and egui. Most of the available UI frameworks, however, are still establishing themselves in production environments and fall short in feature-richness. Qt Bridges, a bridging technology in public beta for Rust, brings something different to the table: over three decades of real-world use, commercial support, and a framework that already runs in automotive dashboards, medical devices, and industrial systems worldwide. Qt Bridge for Rust makes that maturity available to Rust developers, providing access to a UI framework that lets you keep your Rust codebase while using Qt Quick’s feature-rich UI libraries and APIs, hardware acceleration, and genuine cross-platform support.

Qt Bridges is a project we have been developing since 2025 to bring Qt’s UI framework capabilities to other programming languages, without going through the full set of bindings. The focus is on the interaction with backend data objects, seamlessly integrated as QML components in a Qt Quick interface.

A while ago, Steam OS 3.8 was released. Among its many improvements, it includes a particularly important one for the Desktop Mode: it finally uses a Wayland session by default.

There are many reasons why this is important for both us and our users. It is more stable, more feature-rich, and does a better job showcasing what Plasma can do.

For now, though, I just want to highlight one neat little feature that is especially handy on a touchscreen device like the Steam Deck: touchscreen gestures.

Out of the box, a three-finger vertical swipe enters Overview mode, showing thumbnails of all open windows. This provides a much more touch-friendly way to multitask, and you can also close a window with a downward swipe gesture. Of course this is a feature available on any device with a touchscreen.

For a while now, my colleagues and I over in Techpaladin Software have been working on software support for the Steam Machine, so it’s so awesome to see the product released!

Like everyone else, I was surprised by the pricing… until I went out and looked at what other hardware costs these days. It seems like in the past 6 months, everything with RAM got 50-100% more expensive. It’s kinda nuts. In light of, shall we say, industry trends (ahem), the price seems reasonable to me.

…especially if you see it less as a single-purpose gaming console and more as a desktop computer that offers a 10-foot UI living room gaming experience. Its horsepower is competitive for the price, and it offers the flexibility of a well-integrated desktop PC user experience. But don’t take it from me; ask Linus Sebastian, who’s rapidly becoming one of the biggest KDE boosters on YouTube:

Some choice quotes from the video:

And from the moment I fired it up and said “goodbye Steam Big Picture Mode”, and started using it as a desktop, I went… “This is what I’ve been waiting for the whole time.”

– Linus Sebastian

Plasma’s great.

– Linus Sebastian

“Plasma on retail hardware” has been my long-term goal for KDE since I first got involved a decade ago. This product is another example that not only can it work, but it can be as good or better than competing offerings.

So congratulations to everyone in KDE and outside of it who helped make this a reality! I’m unbelievably happy at how well KDE software is working for this use case these days, and I see even greater things in the future.