Let’s go for my web review for the week 2024-14. I will be vacationing next week, so I might skip next week post. We’ll see.

German state moving 30,000 PCs to LibreOffice

Tags: tech, foss

Well done LibreOffice! I’d love to see many more announcements like this one.

https://blog.documentfoundation.org/blog/2024/04/04/german-state-moving-30000-pcs-to-libreoffice/

oss-security - backdoor in upstream xz/liblzma leading to ssh server compromise

Tags: tech, ssh, security, supply-chain

Good analysis of the backdoor recently discovered in xz. Really a bad situation. Luckily it was probably detected before it could do any real damage. What’s especially striking is the amount of patience it required, it’s really been put in place over a long stretch of time to reduce chances of detection.

https://www.openwall.com/lists/oss-security/2024/03/29/4

A Microcosm of the interactions in Open Source projects

Tags: tech, foss, community, security

Excellent post showing unhealthy consumer/maintainer dynamics in FOSS projects. This particular example was instrumental in getting the xz backdoor in place.

https://robmensching.com/blog/posts/2024/03/30/a-microcosm-of-the-interactions-in-open-source-projects/

Bullying in Open Source Software Is a Massive Security Vulnerability

Tags: tech, foss, security, burnout

You think the xz vulnerability was a one time event? Think again, this kind of bullying with ulterior motives happen regularly to critical projects.

https://www.404media.co/xz-backdoor-bullying-in-open-source-software-is-a-massive-security-vulnerability/

OSQI

Tags: tech, foss, sustainability, quality, security

Definitely a good idea, we’d need several such institutes across the world. Would governments be willing to try this?

https://www.tbray.org/ongoing/When/202x/2024/04/01/OSQI

Keeping your data from Apple is harder than expected | Aalto University

Tags: tech, apple, privacy

Can we let the myth of Apple being a proper steward with data privacy to rest please? I don’t know why people took their claims for granted to start… with so much opacity, it’s not a claim you could trust.

https://www.aalto.fi/en/news/keeping-your-data-from-apple-is-harder-than-expected

A ‘Law Firm’ of AI Generated Lawyers Is Sending Fake Threats as an SEO Scam

Tags: tech, ai, machine-learning, gpt, scam

AI supercharged scam. I guess we’ll see more of those.

https://www.404media.co/a-law-firm-of-ai-generated-lawyers-is-sending-fake-threats-as-an-seo-scam/

AI bots hallucinate software packages and devs download them • The Register

Tags: tech, ai, machine-learning, copilot, gpt, security, supply-chain

You should be mindful of the dependencies you add. Even more so when the name of the dependency has been proposed by a coding assistant.

https://www.theregister.com/2024/03/28/ai_bots_hallucinate_software_packages/

Towards 1-bit Machine Learning Models

Tags: tech, ai, machine-learning, power, energy

Smaller models with smarter architectures and low-bit quantized models are two venues for more efficient use. I’m really curious how far they’ll go. This article focuses on low-bit quantized models and the prospects are interesting.

https://mobiusml.github.io/1bit_blog/

LLaMA Now Goes Faster on CPUs

Tags: tech, ai, machine-learning, gpt, llama, optimization, performance, cpu

Excellent work to improve Llama execution speed on CPU. It probably has all the tricks of the trade to accelerate this compute kernel.

https://justine.lol/matmul/

Zoomer Tries RSS: In Praise of Yarr - tudor’s website

Tags: tech, rss, social-media

More people turning to RSS as a substitute for social media. There’s hope.

https://tudorr.ro/blog/zoomer-tries-rss/

KDE6 release: D-Bus and Polkit Galore | SUSE Security Team Blog

Tags: tech, processes, dbus, kde, security

Interesting article, shows quite well the complexities of D-Bus and Polkit. Unsurprisingly such complexity easily leads to mistakes which can compromise security. This then hints to interesting things to keep in mind when you have to deal with D-Bus and Polkit.

https://security.opensuse.org/2024/04/02/kde6-dbus-polkit.html

NTP Pool - The Internet Timekeeper | RIPE Labs

Tags: tech, ntp, dns, time

Fascinating article which explores the behavior of the NTP Pool. If you wondered how it gives you an NTP server to query, you’ll know the answer. It also covers the consequences of its restrictive approach. This even raises security concerns. Still even though it’s not perfect this keeps being an essential service mostly run by volunteers.

https://labs.ripe.net/author/giovane_moura/ntp-pool-the-internet-timekeeper/

Fast Development In Rust, Part One

Tags: tech, rust, performance, refactoring, type-systems, memory

Nice balanced view on some of Rust characteristics. This is much less naive than some of the “Rust is great” posts out there.

https://blog.sdf.com/p/fast-development-in-rust-part-one

On Garbage Collection

Tags: tech, memory, system

This is indeed a more interesting way to perceive garbage collection. This also lead to proper questions to explore on the topic.

https://xorvoid.com/on_garbage_collection.html

Optimizing SQLite for servers

Tags: tech, databases, sqlite, server, performance, complexity

With some tuning SQLite can go a long way, even for server type workloads. There are still a few caveats but in some case this can reduce complexity and cost quite a bit.

https://kerkour.com/sqlite-for-servers

Enforcing conventions in Django projects with introspection - lukeplant.me.uk

Tags: tech, craftsmanship, developer-experience, django, python

Another example of enforcing conventions using automated checks. This time using Python and Django tricks.

https://lukeplant.me.uk/blog/posts/enforcing-conventions-in-django-projects-with-introspection/

A proposal to add signals to JavaScript.

Tags: tech, javascript, web, frontend

A proposal for data bindings as first class citizens in JavaScript? This could be a good thing indeed.

https://github.com/proposal-signals/proposal-signals

Git as debugging tool - Lucas Seiki Oshiro

Tags: tech, git, version-control

Or why a clean commit history can help quite a lot to find how and why a bug was introduced. This shows a few nice tricks around git log to speed up the process.

https://lucasoshiro.github.io/posts-en/2023-02-13-git-debug/

Improvements to static analysis in the GCC 14 compiler | Red Hat Developer

Tags: tech, c, memory, static-analyzer, compiler

Improved static analysis for C straight from GCC. This is definitely welcome.

https://developers.redhat.com/articles/2024/04/03/improvements-static-analysis-gcc-14-compiler#

On Invariance and Inconsistency

Tags: tech, programming, safety, logic, mathematics

On the importance of invariants and consistent requirements in our trade. Admittedly it’s a long demonstration but it show the point well.

https://www.hansdieterhiep.nl/blog/on-invariance-and-inconsistency/

TDD’s Missing Skill: Behavioral Composition - by Kent Beck

Tags: tech, tests, tdd, design

This is indeed too often overlooked. Producing a test list and picking the tests in the right order is definitely a crucial skill to practice TDD. It goes hand in hand with software design skills.

https://tidyfirst.substack.com/p/tdds-missing-skill-behavioral-composition

Basic Things

Tags: tech, organization, community, craftsmanship

Lots of good advices of course. It goes a long way to improve the quality of the project and the ease to on-board people. This is quite some initial work though.

https://matklad.github.io/2024/03/22/basic-things.html

Programming Apprenticeships

Tags: tech, teaching, learning, pairing

Funny experiment. This shows what you can achieve in terms of teaching and learning during pair programming setups. Shadowing someone is a powerful approach.

https://two-wrongs.com/programming-apprenticeships.html

Mentorship, coaching, sponsorship: three different — and equally important — tools for developing talent - Jacob Kaplan-Moss

Tags: management, coaching, mentoring

This is a nice way to frame the three activities. They help people progress but in different ways.

https://jacobian.org/2024/apr/1/mentorship-coaching-sponsorship/

Ping Me, Please!

Tags: tech, remote-working, asynchronous, communication

When you’re distributed, this is all about asynchronous communication. You can’t walk to a person desk (and you should probably avoid it anyway if colocated).

https://www.yegor256.com/2024/04/01/ping-me-please.html

Bye for now!

Recently news went around about explicit sync being merged into Wayland protocols, and in the wake of that I saw a lot of people having questions about it, and why it was such a big deal… So here’s a short-ish explanation of what it is, why it’s needed and what the benefits are over the old model.

Why is synchronization needed?

When applications “render” things, that rendering doesn’t happen immediately. Instead, they effectively record a list of commands with OpenGL or Vulkan for the GPU to execute, and that list then gets handed to the GPU to execute at its own pace.

This is needed for performance reasons: If the CPU had to wait for the GPU to execute each command one by one, both CPU and GPU would often sit around, doing nothing except waiting for the other one to finish its task. By executing commands on the GPU while the CPU does other things, like preparing new commands for the GPU, both can do a lot more work in the same time.

However, in practice, rendering commands don’t stand alone on their own. You might be running one task to render an image, and another one to process the result into something else, or to read it back to the CPU, so that it can be saved as a file on disk. If you do that without synchronization, you might be reading from the image in the middle of rendering, or even before the GPU has started to work on the buffer at all.

The “old” model: Implicit sync

Traditionally with graphics APIs like OpenGL, the necessary synchronization has been done implicitly, without the application’s involvement. This means that the kernel and/or the userspace graphics driver look at the commands the application is sending to the GPU, check which images the commands are using, which previous tasks have to be completed before it, and potentially make the application wait until the dependencies of the commands it wants to execute are resolved.

The so-called dma buffer infrastructure that the Linux graphics stack uses for exchanging images between applications - like Wayland apps and the compositor - also uses the same model. When the render commands from the compositor try to read from an app’s buffer, the kernel will delay the command’s execution until the app has completed its rendering to the buffer.

This model makes it easy for application developers to write correctly working applications, but it can also cause issues. The most relevant of them for Wayland is that the application isn’t aware of which tasks it’s synchronizing to, and it can happen that you accidentally and unknowingly synchronize to GPU commands that don’t have any relevance to your task.

This has been a problem that Wayland compositors have been affected by for a long time: When presenting application images to the screen, compositors picked the latest image that the application has provided, which could still have GPU tasks running on it, instead of an earlier image that’s actually ready for presentation. This meant that sometimes presentation was delayed by the kernel, and you’d see a frame be dropped entirely, instead of just a slightly older image. This issue has been solved for most compositors in the last two years using the kernel’s implicit-explicit sync interop mechanism¹; I won’t explain the details of that here, but you can read Michel Dänzer’s blog post about it instead.

The “new” model: Explicit sync

The name already suggests exactly what it does: Instead of the driver or the kernel doing potentially unexpected things in the background, the application explicitly tells the relevant components (driver / kernel / compositor / other apps) when rendering is complete and what tasks to synchronize to in the first place, using various synchronization primitives.

On the application side, explicit sync is used in Vulkan, and the Wayland protocol specifically is used internally by OpenGL and Vulkan drivers to synchronize with the Wayland compositor.

This explicit way of synchronizing GPU commands doesn’t just help avoid accidental synchronizations, it also helps improve performance by reducing the work drivers have to do. Instead of having to figure out the dependencies of tasks from a relatively opaque list of commands, apps just tell them directly.

An important thing to mention here is that we already had a protocol for explicit sync, zwp_linux_explicit_synchronization_unstable_v1, but it shared a limitation with implicit sync: In order to get a synchronization primitive, it still required the GPU commands to be first submitted to the kernel. The new protocol in contrast allows to create and share synchronization primitives without submitting work to the GPU first, which - at least in theory - will allow applications to squeeze a little bit more performance out of your hardware in the future.

Do keep in mind though that these performance improvements are minor. While there may be some special cases where implicit sync between app and compositor was the bottleneck before, you’re unlikely to notice the individual difference between implicit and explicit sync at all.

Why the big fuzz then?

If we already have most of the compositor-side problems with implicit sync solved, and explicit sync doesn’t bring major performance improvements for everyone, why is it such big news then?

The answer is simple: The proprietary NVidia driver doesn’t support implicit sync at all, and neither commonly used compositors nor the NVidia driver support the first explicit sync protocol, which means on Wayland you get significant flickering and frame pacing issues. The driver also ships with some workarounds, but they don’t exactly fix the problem either:

• it delays Wayland commits until rendering is completed, but it goes against how graphics APIs work on Wayland and can cause serious issues, even crash apps in extreme cases
• it delays X11 presentation until rendering is completed, but as Xwayland copies window contents sometimes, that still often causes glitches if Xwayland is also using the NVidia GPU for those copies

There’s been a lot of discussions around the internet between people experiencing the issues constantly, and others not seeing any, and now you should know why it doesn’t seem to affect everyone: It’s not a deterministic “this doesn’t work” problem but a lack of synchronization, which means that a lot of factors - like the apps you use, the CPU and GPU you have, the driver version, the kernel, compositor and so on - decide whether or not you actually see the issue.

With the explicit sync protocol being implemented in compositors and very soon in Xwayland and the proprietary NVidia driver, all those problems will finally be a thing of the past, and the biggest remaining blocker for NVidia users to switch to Wayland will be gone.

If you have used a moderately complex application there are chances that you have interacted with what is called a “modal” dialog. A modal dialog is a dialog that requires you to close/address it before you can continue interacting with the main application window. This can be implemented by the application in a straightforward manner but compositor didn’t know if a dialog was modal or not.

That is until now the new xdg-dialog-v1 protocol allows applications to mark their dialogs as modal or not modal. This allows the compositor to adapt its behavior according to this hint. For example when trying to activate the main window it can activate the modal dialog instead. It also enables KWin to use the darkening effect on the parent window on Wayland.

I implemented support for the protocol into KWin and Qt which will be part of the Plasma 6.1 and Qt 6.8 releases respectively. The protocol was created from functionality in GTK and Mutter by Carlos Garnacho and I am happy seeing the overall Wayland eco-system now being able to benefit from it.

We’re thrilled to announce that due to the incredible engagement and enthusiasm from our community, the Kubuntu Council has decided to extend the submission deadline for the Kubuntu Brand Graphic Design Contest! Originally set to close at 23:59 on March 31, 2024, we’re giving you more time to unleash your creativity and submit your designs. The new deadline is now set for 23:59 on Saturday, 6th April 2024.

The decision comes in response to multiple requests from community members who are keen on participating but needed a bit more time to polish their submissions. We’ve been overwhelmed by the vibrant community response so far and are eager to see more of your innovative designs that embody the spirit of Kubuntu.

New Timeline:

• Extended Submission Deadline: 23:59, Saturday, 6th April 2024
• Review by Kubuntu Council: Sunday, 7th April 2024
• Announcement of Results: Monday, 8th April 2024, at 20:00 UTC

The results will be announced via an update on the Kubuntu website, so stay tuned!

This extension is our way of saying thank you for the incredible effort and participation from the Kubuntu community. We want to ensure that everyone who wishes to contribute has the opportunity to do so. Whether you’re putting the finishing touches on your design or just getting started, now is your chance to be part of shaping the visual future of Kubuntu.

We look forward to seeing your creative concepts and designs. Let’s make this contest a showcase of the talent and passion that defines our community. Good luck to all participants, and thank you for making Kubuntu not just a powerful Linux distribution, but a vibrant community as well.

For contest details, submission guidelines, and to submit your work, visit the official Kubuntu Brand Graphic Design Contest page on our website. Let’s create something amazing together!

The Kubuntu Council

Additional Information may be found in the original Kubuntu Graphic Design Contest Post

Apply now: Contest Page

With this blog post, we introduce the QtQuickComputeItem - a Qt Quick item that allows you to easily integrate compute shader into your Qt Quick Code.
Compute
Shader are used to perform arbitrary computations on the GPU. For
example, the screenshot below shows a Qt Quick application that
generates Gray Scott Reaction Diffusion patterns.  The simulation is executed by a compute shader that is configured directly in QML.

Continue reading Use Compute Shader in Qt Quick at basysKom GmbH.

Marknote 1.1.0 is out! Marknote is the new WYSIWYG note-taking application from KDE. Despite the latest release being just a few days ago, we have been hard at work and added a few new features and, more importantly, fixed some bugs.

Marknote now boasts broader Markdown support, and can now display images and task lists in the editor. And once you are done editing your notes, you can export them to various formats, including PDF, HTML and ODT.

Marknote’s interface now seamlessly integrates the colors assigned to your notebooks, enhancing its visual coherence and making it easier to distinguish one notebook from another. Additionally, your notebooks remember the last opened note, automatically reopening it upon selection.

We’ve also introduced a convenient command bar similar to the one in Merkuro. This provides quick access to essential actions within Marknote. Currently it only creates a new notebook and note, but we plan to make more actions available in the future. Finally we have reworked all the dialogs in Markdown to use the newly introduced FormCardDialog from KirigamiAddons.

We have created a small feature roadmap with features we would like to add in the future. Contributions are welcome!

Packager section

You can find the package on download.kde.org and it has been signed with my GPG key.

Note that this release introduce a new recommanded dependencies: md4c and require the latest Kirigami Addons release (published a few hours ago).

It’s again time for a new Kirigami Addons release. Kirigami Addons is a collection of helpful components for your QML and Kirigami applications.

FormCard

I added a new FormCard delegate: FormColorDelegate which allow to select a color and a new delegate container: FormCardDialog which is a new type of dialog.

Aside from these new components, Joshua fixed a newline bug in the AboutKDE component and I updated the code examples in the API documentation.

TableView

This new component is intended to provide a powerful table view on top of the barebone one provided by QtQuick and similar to the one we have in our QtWidgets application.

This was contributed by Evgeny Chesnokov. Thanks!

Other components

The default size of MessageDialog was decreased and is now more appropriate.

James Graham fixed the autoplay of the video delegate for the maximized album component.

Packager section

You can find the package on download.kde.org and it has been signed with my GPG key.

While everyone is busy analyzing the highly complex technical details of the recently discovered xz-utils compromise that is currently rocking the internet, it is worth looking at the underlying non-technical problems that make such a compromise possible. A very good write-up can be found on the blog of Rob Mensching...

"A Microcosm of the interactions in Open Source projects"

Ιστορία του Fedora

Αξιοσημείωτα χαρακτηριστικά του Fedora

1. Κυκλοφορεί με το αυθεντικό GNOME ως προεπιλογή

2. Φιλικό προς το χρήστη

3. Προσφέρει λογισμικό αιχμής

4. Το Fedora είναι αξιόπιστο

Εκδόσεις Fedora

1. Workstation

2. Silverblue

3. Kinoite

4. Sericea

Fedora Spins

1. KDE Plasma Desktop

2. XFCE Desktop

3. Cinnamon Desktop

4. MATE-Compiz Desktop

5. i3 Tiling Window Manager

6. Sway Tiling Window Manager

7. LXQt Desktop

8. Budgie Desktop

9. SOAS (Sugar on a Stick)

10. Phosh

Σε ποιον απευθύνεται το Fedora;

I didn’t work much on KDE for the first half of March, but still managed to squeeze out some good features and bugfixes. I’m also starting on the Wayland grant work I teased soon, so look forward to news on that next month.

Plasma

[Bugfix] The text and buttons are now centered in KCMs that launch external applications, such as the System Monitor in KInfoCenter. [6.1]

[Bugfix] Fix numerous spacing and layout issues in the Date & Time KCM. [6.1]

[Bugfix] Actually disable the calendar in the Date & Time KCM when NTP is enabled. Basically fixing the bug you see in the above screenshot where the date picker is still enabled. [6.1]

[Bugfix] (Haven’t been able to continue it yet) but disable the searchbox and filter actions when there’s no command output. If you don’t have the “aha” installed you shouldn’t be able to search for non-existent text under “Firmware Security”. [6.1]

[Bugfix] In the Bluetooth KCM, “game controllers” are now called as such where it was previously “joypads”. [6.1]

[Bugfix] The same device type names used in the Bluetooth KCM, are now used in it’s applet.

Tokodon

[Feature] Added an alert badge for pages in the sidebar. Currently only used for follow requests, but plan on adding it on other pages soon. [24.05]

[Feature] Allow popping out the status composer on desktop. This allows you to compose toots while doing something else in the application, like browsing or searching for the correct hashtag. [24.05]

[Bugfix] I implemented more key navigation fixes. This set of fixes are centered around interacting with media attachments. There’s still a long way to go before you can use Tokodon from a keyboard alone, but it’s getting there. [24.05]

[Bugfix] Ported from Qt5Compat.GraphicalEffects. I usually don’t mention boring refactors, this one is special. Volker found that this old GraphicalEffects module eats up 4 MB of storage on Android so this is a pretty big win! [24.05]

[Bugfix] Numerous UnifiedPush notification fixes. It’s not perfect yet, but much better than it was before. [24.02]

NeoChat

[Bugfix] Simple change, I made the tabs in the developer tools full-width. [24.05]

[Bugfix] Now lonely question marks are excluded from links as they should be. Websites that don’t handle this will throw up an error instead, so this eliminates lots of user error. [24.02]

[Bugfix] Fixed the quick format bar not working. [24.02]

PlasmaTube

Lots of small UX changes this month. Including moving more actions to the header, reducing video title duplication and more. I can’t make a good screenshot right now because Invidious is currently broken due to Google’s changes. [24.05]

Kirigami

[Bugfix] I did a little digging on where one of the color roles came from, and now noted where the disabled text color comes from (on KDE Plasma). Still needs approval though 🙂 [6.1]

[Bugfix] (Not approved yet) Stop the back button from appearing even when we explicitly requested it gone. [6.1]

Documentation

Note that Plasma Framework is now libplasma in the Breeze README. [6.1]

Clarify that the default alignment for Kirigami’s ActionToolbar is AlignLeft, not AlignRight. [6.1]

That’s all for this month!