Przy okazji, dziś katalog narzędzi też dostał update. Wśród nowych pozycji jest WG Tunnel, ten sam klient WireGuard, którego użyłem w artykule powyżej.

📚 Katalog Oprogramowania +9

• Proton Pass, Proton Drive
• IVPN, WG Tunnel
• Cryptomator, CryptPad
• Notesnook, Verified Apps
• CoMaps (nowa sekcja: Mapy i nawigacja)

Wszystko open source, z linkami do źródeł. Jeśli szukasz więcej narzędzi prywatnościowych, warto zajrzeć:

https://eteryu.space/narzedzia/katalog/

#prywatność #opensource #foss #cyberbezpieczenstwo #privacy #cybersecurity

Mullvad ogłosił planowane zamknięcie publicznego resolvera DNS. Sam szukałem darmowej alternatywy dla Mullvad VPN i tak powstał ten artykuł.

Bo Proton to chyba jedyny darmowy VPN wart uwagi. A gdy połączysz go z szyfrowanym DNS i filtrowaniem reklam, dostajesz pełny zestaw, za który normalnie trzeba płacić.

Standardowy WireGuard tego nie potrafi. WG Tunnel tak.

Link do artykułu:
https://eteryu.space/poradniki/darmowy-vpn-z-filtrowaniem-dns/?v=3

#Prywatność #Privacy #Cyberbezpieczeństwo #Cybersecurity #VPN
#WireGuard #DoH #DoT #ProtonVPN #Proton #Mullvad
#NextDNS #Hagezi #OpenSource

@anvil_blog I like hardware keys, but I would recommend @nitrokey they are open source and work grate

#OpenSource #HardwareSecurityKeys #2FA

#LinuxKernel: Maintainer wollen „Assisted-by“-Tag streichen | Developer https://www.heise.de/news/Linux-Kennzeichnung-von-KI-Code-soll-entfallen-auch-Torvalds-nutzt-LLMs-11490345.html #Linux #OpenSource #development #ArtificialIntelligence #AI

Linux Mint 27 will include a suite of new software, including a more capable system monitor.

I took a development version for a spin and came away impressed – and with more disk space.

https://www.omgubuntu.co.uk/2026/10/linux-mint-new-system-monitor?v2

#linuxmint #linux #openSource

#Libreboot startet jetzt auch per #UEFI durch | iX Magazin https://www.heise.de/news/Libreboot-startet-jetzt-auch-per-UEFI-durch-11491142.html #Linux #OpenSource

📋 #Pele is a lightweight #opensource library that renders #Mermaid diagrams to SVG, themed with CSS variables. Built by the #Obsidian team to render diagrams fast and match the app's theme #javascript #webdev

⚡ Compared to Mermaid.js: 230 kB gzipped bundle instead of 1.6 MB (6× smaller), 0.05–0.3 ms render time instead of 6–82 ms (up to 500× faster), and zero direct dependencies instead of 23

🧵👇

Vor zwei Wochen habe ich hier mit einem leeren Profil angefangen. Heute sind es über 40 Menschen, die mitlesen, und viel mehr Gespräche, als ich erwartet hatte. Das ist der Teil, der mich am meisten überrascht hat.

Die Themen waren bunt. Dateisysteme, Backups, freie Software, Lizenzen, Kachelfenster. Aber die besten Momente waren nicht die Erklärungen, sondern die Antworten. Jemand erzählt von einer geretteten Platte, jemand anderes von seinem ersten Kernel, und plötzlich wird aus einem Beitrag ein Gespräch. Genau dafür bin ich hier.

Nächste Woche nehme ich mir CachyOS vor. Den Paketinstaller, den KernelManager, Hello, die Einstellungen und die Paketquellen. Dazu wieder eine Frage am Samstag und ein Rückblick am Sonntag.

Was hat dir in dieser Zeit hier am meisten gefallen?

#Linux #CachyOS #Community #OpenSource

Minął weekend. Wczoraj udało się trochę podłubać przy kodzie: dodałem trzecią zasadę do distrust.pl i dopracowałem typografię strony. Dzisiaj dałem sobie na luz, ale kto wie, może przed snem jeszcze coś przysiądę.

Czasem warto poświęcić chwilę, żeby nasze cyfrowe otoczenie było choć odrobinę lepsze. Bo prywatność to nie jednorazowa konfiguracja, tylko ciągła praca.

A jak u Was mijają weekendy z technologią? Też zdarza się Wam dłubać przy projektach?

#prywatność #opensource #buildinpublic

RT @vllm_project: 🚀 vLLM v0.32.0 ist verfügbar! 814 Commits · 363 Mitwirkende · 121 Erstautoren

mehr auf Arint.info

#AI #DeepLearning #MachineLearning #NLP #OpenSource #vLLM #arint_info

https://x.com/vllm_project/status/2111814711956168760

The Document Foundation, the non-profit behind #LibreOffice, now has its own visual identity: https://blog.documentfoundation.org/blog/2026/10/09/tdf-visual-identity/ #foss #openSource #freesoftware

Alt...

TDF logo

Tell me what made you #change to #Linux?

(If you want tell your distro and GUI.)

#meme #story #foss #OpenSource #distro #desktop #gui #os #Software #tux #computer #freedom #distribution

Alt...

Tell me what made you change to Linux?

At our #Proxday, several people came in touch w/ me & said that LVM thin-provisioned with iSCSI, FC or NVMeoF would be a dream. Let me make it become real!

PS: My mate @formorer@rollenspiel.social is also working on something huge! Guess, we should make a special event about storage plugins for Proxmox VE - maybe within the next virtualization gathering at @credativde@mastodon.social or maybe as a special edition. Let's see, stay tuned!

More about it: https://gyptazy.com/blog/proxmox-shared-block-storage-with-lvm-thin-provisioning-provider/
Demo: https://youtu.be/pQHazr50PVg

#PVE #opensource #storage #proxday

Alt...

Adding LVM Thin as shared storage in Proxmox

Alt...

Assigning the LVM Thin to a VG

#Ubuntu 26.10: #Linux 7.3 und KI-Assistent im Gepäck | heise online https://www.heise.de/news/Ubuntu-26-10-Linux-7-3-und-KI-Assistent-im-Gepaeck-11488457.html #ArtificialIntelligence #AI #OpenSource #Linux73 #ubuntu2610

The first week of Djangonaut Space is in the books and it was a brilliant one for me. I had so much fun getting to know people in the community, added a beautiful new hoodie to my swag collection, spoke to two groups of students and started my first contributions to Djangonaut Space and Django Girls projects.

https://hamatti.org/posts/djangonaut-log-1-lift-off-and-first-week-in-djangonaut-space/

@djangonaut #DjangonautSpace #DjangoGirls #Django #Python #OpenSource

Episode 39 of Dark Blue Weekly released

https://darkblueproject.com/sites/news/dbw-e39.php

#darkblueweekly #darkblueproject #ubuntu #ubuntu2610 #lubuntu #kubuntu #xubuntu #ubuntumate #ubuntubudgie #gnomeos #gnome #gnome51 #kdeplasma #kdeplasma68 #kde #linux #linuxdesktop #linuxserver #opensource #freesoftware

#GNOME 51.1 Is Out to Improve Drag and Drop Between #Wayland and Xwayland Clients https://9to5linux.com/gnome-51-1-improves-drag-and-drop-between-wayland-and-xwayland-clients

@gnome #Linux #OpenSource #FOSS

Alt...

GNOME 51.1

Heute so: Migration von TrueNAS CORE -> TrueNAS SCALE bei einem Kunden.
Also quasi der komplette Server – Daten, VMs, das volle Programm.
Wir reden hier immerhin von einem Wechsel von #FreeBSD nach #Linux, was auch eine komplette Änderung des genutzten VM Stacks bedeutet (BHYVE -> KVM)!

Der Plan war simpel: #ZFS-Replikation auf die neue Kiste, Snapshots inklusive. Nach ein paar Anpassungen liefen die VMen einfach wieder an. Einziger manueller Kraftaufwand: Netzwerkschnittstellen – der Klassiker bei jedem Umzug.
Ohne den wär's fast verdächtig glatt gelaufen.

Und mal ehrlich: #ZFS ist bei so was wirklich ein Geschenk des Himmels.
Was woanders ein schweißtreibendes Kopier-Karussell mit Bangen um die Daten wäre, ist mit ZFS-Replikation eher ein gemütliches:

• Replizieren
• Kaffee holen
• Anpassen, starten, fertig

Und falls ihr vor so einem Umzug steht und euch nicht so recht traut: Meldet euch einfach bei mir. Egal ob CORE zu SCALE, ein ganzes NAS oder nur eine kleine ZFS-Frage – ich helfe gerne. Wer noch auf CORE hängt: Die Migration auf SCALE ist weniger dramatisch, als man denkt. Versprochen!

#TrueNAS #ZFS #Homelab #Sysadmin #Migration #OpenSource

@twipped

But FOSS' success up until this point has shown the exact opposite.

FOSS was bootstrapped by using proprietary software every single day for more than a decade, at least.

Most FOSS developers regularly used proprietary technologies daily for their work for the entirety of FOSS' history.

Plus, what @copiesofcopies said:
https://fedi.copyleft.org/@copiesofcopies@social.coop/117457049015278425

Cc: @cwebber

#LLMGenAI #LLM #AI #FOSS #SoftwareFreedom #OpenSource #FreeSoftware

Okay, now this is getting interesting... I admit I haven't tried Linux on my T490s in quite a while, after my earlier attempts to get the built-in 5G modem to work failed.

Following yesterday’s controversy over why, in my attempt to boycott U.S. products and services, I’d choose Microsoft over Fedora of all things (because, as I said, I need Windows for work—just like any other common operating system), I installed a different SSD today just for fun and put the latest beta of Fedora 45 on it. And look at that: the modem works with it! Quite obviously, the kernel finally has the necessary drivers built in.

So now I can use Linux on the ThinkPad again, even if it’s a Linux distribution under IBM’s umbrella… at the end of the day, it’s still a bit better than Microsoft. And so the only Windows device still running is the NUC—that’s more than enough.

#linux #fedora #opensource #freesoftware #windows #thinkpad

FOSS NEWS

Firefox 158 released with JPEG XL support:
https://www.omgubuntu.co.uk/2026/10/firefox-158-released-with-jpeg-xl-support

Mozilla Firefox 159 Enters Public Beta Testing with Wayland Improvements:
https://9to5linux.com/mozilla-firefox-159-enters-public-beta-testing-with-wayland-improvements

Zen Browser 1.23.3b Ships with Firefox 158 Security Fixes:
https://www.linuxcompatible.org/story/zen-browser-1233b-ships-with-firefox-158-security-fixes/

Ungoogled Chromium 155.0.8059.84-1 Releases for Linux with Chrome's 10 Security Fixes:
https://www.linuxcompatible.org/story/ungoogled-chromium-15508059841-releases-for-linux-with-chromes-10-security-fixes/

Proton product roadmaps for autumn and winter 2026:
https://proton.me/blog/2026-autumn-winter-roadmaps

Proton Pass brings folders and detailed autofill controls:
https://alternativeto.net/news/2026/10/proton-pass-brings-folders-and-detailed-autofill-controls/

Mozilla Thunderbird 158 Email Client Improves Quick Filter Responsiveness:
https://9to5linux.com/mozilla-thunderbird-158-email-client-improves-quick-filter-responsiveness

ONLYOFFICE 10.0 is a ‘fully rebuilt app’ with expanded AI tools:
https://www.omgubuntu.co.uk/2026/10/onlyoffice-10-expands-ai-tools

This Dev Built an Office Suite Because His Wife Kept Going Back to Microsoft Office:
https://itsfoss.com/news/elixiroffice-euro-office-fork/

AliasVault 0.31 brings faster vault synchronization and vault sharing with family members:
https://alternativeto.net/news/2026/10/aliasvault-0-31-brings-faster-vault-synchronization-and-vault-sharing-with-family-members/

addy.io Rules now send signed webhooks for incoming email:
https://alternativeto.net/news/2026/10/addy-io-rules-now-send-signed-webhooks-for-incoming-email/

Waterfox 6.7.6 adds feed controls and fixes startup hangs:
https://alternativeto.net/news/2026/10/waterfox-6-7-6-adds-feed-controls-and-fixes-startup-hangs/

Kdenlive 26.08.2 Release: Stability Fixes for Project Handling, Proxies, and Audio:
https://www.linuxcompatible.org/story/kdenlive-26082-release-stability-fixes-for-project-handling-proxies-and-audio/

OBS Studio 33.0.0-RC2 Released: Major CEF and Plugin Overhaul:
https://www.linuxcompatible.org/story/obs-studio-3300rc2-released-major-cef-and-plugin-overhaul/

PhotoFlare 1.7.5 adds ARM packages and macOS fixes:
https://alternativeto.net/news/2026/10/photoflare-1-7-5-adds-arm-packages-and-macos-fixes/

Calibre 9.16 adds Kokoro voices for read aloud, Camoufox integration & updated Kobo driver:
https://alternativeto.net/news/2026/10/calibre-9-16-adds-kokoro-voices-for-read-aloud-camoufox-integration-and-updated-kobo-driver/

PeaZip 11.4 Open-Source Archive Manager Released with Various Improvements:
https://9to5linux.com/peazip-11-4-open-source-archive-manager-released-with-various-improvements

RustGIS is a Desktop GIS Tool That Also Runs in a Browser:
https://itsfoss.com/rustgis-open-source-gis-tool/

(post 5/7)

#WeeklyNews #OpenSource #FOSSNews #FOSS #OpenSourceNews #News #Firefox #ZenBrowser #UngoogledChromium #Proton #ProtonPass #Thunderbird #ONLYOFFICE #ElixirOffice #AliasVault #AddyIO #Waterfox #Kdenlive #OBS #OBSStudio #PhotoFlare #Calibre #PeaZip #RustGIS #GIS #MozillaFirefox #Browser #Email #ContentCreation #EbookManager #FosseryTech

Godot 4.8 Beta 1 Released: Feature Freeze and Final Testing Begin:
https://www.linuxcompatible.org/story/godot-48-beta-1-released-feature-freeze-and-final-testing-begin/

Bevy 0.20 brings major rendering, shading, and UI enhancements to open-source game engine:
https://alternativeto.net/news/2026/10/bevy-0-20-brings-major-rendering-shading-and-ui-enhancements-to-open-source-game-engine/

Zed Editor 1.24.2 Release: Git Tags, Agent Terminal Drag-and-Drop, and a 23% Smaller Linux Build:
https://www.linuxcompatible.org/story/zed-editor-1242-release-git-tags-agent-terminal-draganddrop-and-a-smaller-linux-build/

VSCodium 1.140.06880 Removes Copilot, Claude, and Codex AI SDKs:
https://www.linuxcompatible.org/story/vscodium-114006880-removes-copilot-claude-and-codex-ai-sdks/

Apache NetBeans IDE 32 RC1 Released: Final Testing Phase Begins:
https://www.linuxcompatible.org/story/apache-netbeans-ide-32-rc1-released-final-testing-phase-begins/

Codeberg Pages legacy server to be discontinued in favor of git-pages, hosted pages need to be migrated manually:
https://blog.codeberg.org/migrate-your-site-to-the-new-git-pages-backed-codeberg-pages-now-were-sunsetting-codeberg-pages-v2.html
(Interesting, I ran the migration check, for the two FosseryWeb sites, and it says that they are still on the legacy server, which is weird, because I clearly remember migrating those when the migration option came out earlier, whatever, will take a look at it again.)

Node.js 26.12.0 and 24.22.0 Krypton: What Changed and How to Upgrade:
https://www.linuxcompatible.org/story/nodejs-26120-and-24220-krypton-what-changed-and-how-to-upgrade/

Rust 1.99.1 Released: Three Critical Bugs Fixed in Record Two-Week Turnaround:
https://www.linuxcompatible.org/story/rust-1991-released-three-critical-bugs-fixed-in-record-twoweek-turnaround/

Python 3.16 Alpha 1 Released: What's New and the JIT Debate Ahead:
https://www.linuxcompatible.org/story/python-316-alpha-1-released-whats-new-and-the-jit-debate-ahead/

PHP 8.6.0 RC3 Now Available in Ondřej Surý's Repositories for Debian and Ubuntu:
https://www.linuxcompatible.org/story/php-860-rc3-now-available-in-ond%C5%99ej-sur%C3%BDs-repositories-for-debian-and-ubuntu/

Bootstrap returns with version 6 Alpha, bringing ground-up modernization of the framework:
https://alternativeto.net/news/2026/10/bootstrap-returns-with-version-6-alpha-bringing-ground-up-modernization-of-the-framework/

PostgreSQL 19 RC1 Released: Native REPACK, Parallel Autovacuum, and Upgrades to Watch:
https://www.linuxcompatible.org/story/postgresql-19-rc1-released-native-repack-parallel-autovacuum-and-upgrades-to-watch/

SQLite 3.54.1 Released: Fixes 32-bit Heap-Buffer Overflow:
https://www.linuxcompatible.org/story/sqlite-3541-released-fixes-32bit-heapbuffer-overflow/

OpenCode 2.0 officially launches with background agents, Code Mode, and a rebuilt API:
https://alternativeto.net/news/2026/10/opencode-2-0-officially-launches-with-background-agents-code-mode-and-a-rebuilt-api/

NGINX 1.31.7 and 1.30.6 Patch Five Security Flaws, Two Back to 2009:
https://www.linuxcompatible.org/story/nginx-1317-and-1306-patch-five-security-flaws-two-back-to-2009/

(post 6/7)

#WeeklyNews #OpenSource #FOSSNews #FOSS #OpenSourceNews #News #Godot #Bevy #Zed #ZedEditor #VSCodium #NetBeans #NodeJS #Rust #Python #PHP #Bootstrap #PostgreSQL #SQLite #OpenCode #NGINX #FosseryTech

Heute morgen ging es hier um den unsichtbaren Mitbewohner in meinem Rechner. Jetzt interessiert mich, wann ihr ihn zum ersten Mal wirklich bemerkt habt. Nicht die Installation, nicht der erste Befehl, sondern der Augenblick, in dem ihr wusstet, dass ihr bleibt.

Was war euer schönster Moment mit Linux?

#Linux #Community #OpenSource #FOSS

Self-Host Weekly (16 October 2026)

#Bitwarden license changes, software updates and launches, a spotlight on #Homelable, and more in this week's #selfhosted recap!

https://selfh.st/weekly/2026-10-16/

#selfhost #selfhosting #opensource #foss #homelab #server #newsletter #privacy #fediverse #mastodon #smarthome #gitlab #forgejo #github #sonarr #jellyfin #sysadmin #devops #development #ai #vibecoding #google #apple

Für wen betreiben wir eigentlich noch unsere Webserver?

Manchmal frage ich mich, für wen wir eigentlich Webprojekte entwickeln, betreiben und pflegen.

Ursprünglich ist die Antwort ganz einfach: für Menschen.

Wir stellen Informationen bereit, entwickeln Anwendungen, ermöglichen Kommunikation und schaffen digitale Angebote, die anderen Menschen einen Nutzen bringen sollen.

Doch wenn ich mir heute unsere Serverprotokolle ansehe, entsteht zunehmend ein anderes Bild.

Nach unseren bisherigen Auswertungen sind mindestens 75 % der registrierten Zugriffe verdächtig oder angreiferisch. Und diese Schätzung dürfte eher zurückhaltend sein.

Natürlich ist nicht jeder automatisierte Zugriff ein Angriff. Suchmaschinen, Monitoring und die Kommunikation föderierter Netzwerke gehören ebenso zum Internet. Doch sie ändern nichts an der Entwicklung, die ich in unserer täglichen Arbeit beobachte.

Wir beschäftigen uns immer intensiver mit der Abwehr von Angriffen, der Erkennung verdächtiger Aktivitäten, der Absicherung von Anwendungen und der Überwachung unserer Infrastruktur.

Firewalls, Sperrlisten, Angriffserkennung, Sicherheitsupdates und Protokollanalysen beanspruchen zunehmend unsere Aufmerksamkeit.

All das ist notwendig. Ohne diese Maßnahmen könnten wir unsere Webprojekte kaum noch zuverlässig betreiben.

Aber genau darin liegt das Problem.

Wir investieren immer mehr Arbeit, um unsere Webprojekte vor Missbrauch zu schützen, statt ihre eigentlichen Funktionen für menschliche Besucher weiterzuentwickeln.

Eine ursprünglich unterstützende Tätigkeit beginnt, unsere eigentliche Arbeit zu verdrängen.

Dabei geht es nicht nur um zusätzliche Kosten für Rechenleistung, Speicherplatz oder Datenverkehr. Es geht um unsere begrenzte Arbeitszeit, unsere Konzentration und unsere Möglichkeiten, neue Ideen umzusetzen.

Jede Stunde, die wir mit der Untersuchung automatisierter Angriffe verbringen müssen, steht uns für die Weiterentwicklung unserer Webprojekte nicht zur Verfügung.

Selbstverständlich gehört Sicherheit seit jeher zum Betrieb von IT-Systemen. Aber ich frage mich zunehmend, ob das Verhältnis zwischen der eigentlichen Aufgabe und dem notwendigen Schutz noch angemessen ist.

Denn wir betreiben unsere Server nicht, um Angriffe abzuwehren.

Wir wehren Angriffe ab, damit wir unsere Server für Menschen betreiben können.

Dieser Unterschied erscheint mir wesentlich.

Wie erleben andere Administratoren und Entwickler diese Entwicklung? Wie viel eurer täglichen Arbeit dient noch unmittelbar der Verbesserung eurer Angebote – und wie viel Zeit verbringt ihr inzwischen damit, deren Betrieb gegen Missbrauch abzusichern?

#Webserver #Systemadministration #ITSecurity #OpenSource #Webentwicklung

New in #LibreOffice 26.8: More descriptive fields – Displaying field names now includes clearer descriptions for document statistics fields, making complex documents easier to understand. https://wiki.documentfoundation.org/ReleaseNotes/26.8 #foss #opensource #freesoftware

#GNOME 50.6 Desktop Environment Released with Fixes for Nautilus, GNOME Shell, Mutter, and Orca https://9to5linux.com/gnome-50-6-desktop-environment-released-with-fixes-for-nautilus-gnome-shell

@gnome #Linux #OpenSource #FOSS

Alt...

GNOME 50.6

In front in the beautiful blue color you can see my SBC powering the playback of this Jazz masterpiece

https://mastodon.bsd.cafe/@Dendrobatus_Azureus/117457433608555207

#SBC #Pi5 #Raspberry #Linux #POSIX #opensource #programming

The week, it seems, is getting worse by the second. I will use my magic to curse Torvald, such should be how we deal with the techno-fascists who abet genocide, and shamelessly, gluttonously ruin the entire experience of life for others. He is going to become TorBALD very soon, inshallah.

(Omitting the 'S' from Torvalds because he is only half a man, much less many. Hallelujah.)

#noai #FOSS #linux #ai #generativeAI #llm #fascism #technofascism #opensource #torvalds

ImpressCMS 2.0.4 Beta is now available for testing

What's new:
- Internal link service with a CKEditor plugin
- Session keep-alive for logged-in users

What's fixed:
- Array config values no longer reading as empty
- System module updates resetting the db version to 47
- Login redirect logic
- CSRF protections improved

This is a pre-release. Please back up and test on a staging site, then report issues on GitHub.

More info: https://www.impresscms.org/modules/news/article.php?article_id=1067&title=imprescms-204-beta-released

#ImpressCMS #OpenSource #CMS #PHP #FOSS

Alt...

ImpressCMS logo with an orange speech bubble reading “2.0.4 Beta”. Text: “Pre-release. Ready for testing.” Features: CKEditor internal links, session keep-alive, CSRF hardening, bug fixes.

🎰 Linux kernel devs drop obligatory confession of AI tool usage

"The Maintainers Summit reached consensus to deprecate the Assisted-by Tag," said Sasha Levin, a Linux kernel developer and engineer at Nvidia, in a message to the Linux kernel mailing list last week. "Remove the documentation requiring it."

https://www.theregister.com/ai-and-ml/2026/10/14/linux-kernel-devs-drop-obligatory-confession-of-ai-tool-usage/5303140

#linux #kernel #ai #vibecoding #opensource

Mein Umzug auf einen neuen #PasswortManager (Open Source) | c't Magazin https://www.heise.de/news/Mein-Umzug-auf-einen-neuen-Passwort-Manager-Open-Source-11474408.html #Datenschutz #privacy #Bitwarden #Passbolt #PasswordSafe #Psono #KeePass #ProtonPass #Android #iOS #Windows #macOS #Linux #OpenSource #DigitalSovereignty #PasswordManager

Security Advisory: CVE-2025-60492 - Uncontrolled Recursion in GPAC/MP4Box

Processing a crafted MP4 file with specially constructed BIFS scene data causes unbounded recursion between BIFS decoder functions, exhausting the stack and crashing MP4Box.

Summary:
The `gf_bifs_dec_node` function in `bifs/field_decode.c` decodes MPEG-4 BIFS scene nodes by calling `BD_DecMFFieldList`, `gf_bifs_dec_field`, and `gf_bifs_dec_node_list`, which in turn call back into `gf_bifs_dec_node`. A crafted MP4 file with deeply or cyclically nested BIFS containers triggers this mutual recursion without a depth limit, consuming all available stack memory and crashing the process with a stack-overflow signal.

CWE:
CWE-674 - Uncontrolled Recursion

Affected Component:
```
bifs/field_decode.c:905
Function: gf_bifs_dec_node()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1687-ge44a4e2b0-master; commit `e44a4e2b0d193566619ada71599e70255699da94`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file whose embedded BIFS scene data contains deeply nested or mutually referencing node containers. Local access is required; the victim must invoke `MP4Box -x3d <crafted_file>` or any equivalent BIFS scene export command that triggers the recursive decoder path.

Impact:
The uncontrolled recursion exhausts the process stack, resulting in an immediate crash and Denial of Service. No evidence of arbitrary code execution was observed; stack-exhaustion crashes via recursion do not provide an exploitable control-flow primitive.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
8e7b9a3a04331286b89d1803c65a2d6edc11b4c4
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3324
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/59/59_Anchor_Create_scenegraph_mpeg4_nodes_c_171
- Fix: https://github.com/gpac/gpac/commit/8e7b9a3a04331286b89d1803c65a2d6edc11b4c4

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60488 - NULL Pointer Dereference in GPAC/MP4Box

Processing a crafted MP4 file with a missing Sample Description box triggers a NULL pointer dereference in `dump_isom_saps`, causing MP4Box to crash.

Summary:
The `dump_isom_saps` function in `applications/mp4box/filedump.c` iterates over track metadata to dump SAP (Sync Access Point) information. When the input MP4 contains a corrupted track structure where the Sample Description box (`stsd`) is absent, the function accesses track metadata pointers without prior validation, dereferencing a near-NULL address (0x1c, 28-byte struct offset) and triggering SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
applications/mp4box/filedump.c:1743
Function: dump_isom_saps()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1672-gc9a31d0e1-master; commit `c9a31d0e1b649a30814c6d81c5461859ed63d075`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file whose track structure lacks a valid `stsd` box. Local access is required; the victim must invoke `MP4Box -dsap 1 <crafted_file>` or any equivalent SAP analysis command that exercises the SAP dump path.

Impact:
The near-NULL pointer dereference (READ at address 0x00000000001c) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a near-NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e6d01820d7bf3967d931fedb379ee5f209bc133b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3321
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/57/57_dump_isom_saps_filedump_c_1743
- Fix: https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Any #opensource printers yet?

I need a new one but i dont want to be locked in or pay a fortune on ink. Was thinking about those thermal printers bus most if not all require sus apps

#hivemind #printers

Security Advisory: CVE-2025-60487 - NULL Pointer Dereference in GPAC/MP4Box

Processing an empty XML file with the `-dnal` option triggers a NULL pointer dereference in `gf_isom_get_esd`, causing MP4Box to crash.

Summary:
The `gf_isom_get_esd` function in `isomedia/isom_read.c` retrieves an Elementary Stream Descriptor for a given track. When processing an empty file with an `.xml` extension, the ISO media layer lacks a valid media descriptor structure; the function dereferences a near-NULL pointer at address 0x50 (80-byte struct offset) without validating the pointer beforehand, terminating the process with SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
isomedia/isom_read.c:1386
Function: gf_isom_get_esd()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1665-g3f20eb0cd-master; commit `3f20eb0cd22116367c036e6ffe6ace299b38d686`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies an empty or minimal file with an `.xml` extension. Local access is required; the victim must invoke `MP4Box -dnal 1 <crafted_file>.xml` or any equivalent NAL dump command that triggers the ESD retrieval path on an uninitialized media context.

Impact:
The near-NULL pointer dereference (READ at address 0x000000000050) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a near-NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e6d01820d7bf3967d931fedb379ee5f209bc133b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3320
- PoC: N/A (see issue)
- Fix: https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60490 - Use-After-Free in GPAC/MP4Box

Processing a crafted MPEG-2 Transport Stream file triggers a heap use-after-free in `gf_filter_pid_send_event_downstream` when a freed PID instance is accessed during event propagation.

Summary:
When parsing a crafted MPEG-2 TS file with malformed PMT descriptors and sync marker violations, `gf_filter_pid_inst_swap_delete` frees a PID instance at `filter_pid.c:551`. A stale reference to this freed 344-byte region is subsequently read in `gf_filter_pid_send_event_downstream` at line 7919 (READ of 8 bytes at offset 0 of the freed object) because the pointer is not cleared after deallocation.

CWE:
CWE-416 - Use After Free

Affected Component:
```
filter_core/filter_pid.c:7919
Function: gf_filter_pid_send_event_downstream()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1665-g3f20eb0cd-master; commit `3f20eb0cd22116367c036e6ffe6ace299b38d686`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MPEG-2 TS file containing broken PMT descriptor sizes, unsupported stream types, and missing sync markers. Local access is required; the victim must invoke `MP4Box -add <crafted_file> -new /dev/null` or any equivalent import command that triggers the filter PID event propagation path.

Impact:
The use-after-free (READ of size 8 at offset 0 inside a freed 344-byte heap region) results in process termination, causing Denial of Service. Arbitrary code execution is possible; the first MITRE request explicitly marks code execution impact as true, and use-after-free vulnerabilities at the start of a controlled heap object are a known code-execution primitive.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
d0793f92e04fe284a25c2a9335cc5edc68deb6d4
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3315
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/54/54_gf_filter_pid_send_event_downstream_filter_core_filter_pid_c_7919
- Fix: https://github.com/gpac/gpac/commit/d0793f92e04fe284a25c2a9335cc5edc68deb6d4

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60478 - Heap Use-After-Free in GPAC Packet Destruction

Processing a crafted MPEG-2 TS input with MP4Box DASH segmentation can trigger a heap use-after-free in `gf_filter_packet_destroy()`.

Summary:
Malformed program table data and empty DASH segment state can cause GPAC to mishandle packet ownership. The file output and PID packet drop path later destroy a packet object that has already been invalidated.

AddressSanitizer reports `heap-use-after-free` in `filter_core/filter_pck.c`.

CWE:
CWE-416 - Use After Free

Affected Component:
```
filter_core/filter_pck.c:678
Function: gf_filter_packet_destroy()
```

Relevant ASAN stack:

```
gf_filter_packet_destroy filter_core/filter_pck.c:678
gf_filter_packet_destroy filter_core/filter_pck.c:684
gf_filter_pid_drop_packet filter_core/filter_pid.c:7270
fileout_process filters/out_file.c:933
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
GPAC version: 2.5-DEV-rev1617-g856674b22-master
Commit: 856674b226d6cbe28a941ad223be38194cbf7d37
```

Attack Conditions:
An attacker supplies a crafted MPEG-2 TS file that is processed by MP4Box DASH segmentation:

```
./MP4Box -dash 100 47_gf_filter_packet_destroy_filter_core_filter_pck_c_678
```

Impact:
The observed impact is Denial of Service. Because the issue is a heap use-after-free, memory corruption risk is also present.

Fix / mitigation status:
The MITRE response in the local data records the fix as:

```
c592a144bbe339ee581ca88aaa3247362795b742
```

References:

- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60478
- Issue: https://github.com/gpac/gpac/issues/3300
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/47/47_gf_filter_packet_destroy_filter_core_filter_pck_c_678
- Fix: https://github.com/gpac/gpac/commit/c592a144bbe339ee581ca88aaa3247362795b742

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60482 - Use-After-Free in GPAC MP4Box AC-4 Descriptor Cleanup

Processing a crafted AC-4 stream with MP4Box can trigger a heap use-after-free in `gf_odf_ac4_cfg_clean_list()`.

Summary:
The recursive AC-4 descriptor cleanup path can revisit or count a list object that has already been freed. When MP4Box imports a crafted AC-4 input, descriptor destruction reaches `gf_odf_ac4_cfg_clean_list()` and then `gf_list_count()` on stale heap memory.

AddressSanitizer reports `heap-use-after-free`.

CWE:
CWE-416 - Use After Free

Affected Component:
```
odf/descriptors.c:2411
Function: gf_odf_ac4_cfg_clean_list()

utils/list.c:664
Function: gf_list_count()
```

Relevant ASAN stack:

```
gf_list_count utils/list.c:664
gf_odf_ac4_cfg_clean_list odf/descriptors.c:2411
gf_odf_ac4_cfg_clean_list odf/descriptors.c:2400
dac4_box_del isomedia/box_code_base.c:9218
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
GPAC version: 2.5-DEV-rev1593-gfe88c3545-master
Commit: fe88c3545aadd597b250ccf23271d5d3de50ccc8
```

Attack Conditions:
An attacker supplies a crafted AC-4 file that is imported by MP4Box:

```
./MP4Box -add 46_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2411 -new /dev/null
```

Impact:
The observed impact is Denial of Service. Because the bug is a heap use-after-free, memory corruption risk is also present.

Fix / mitigation status:
The MITRE response in the local data records the fix as:

```
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
```

References:

- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60482
- Issue: https://github.com/gpac/gpac/issues/3297
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/46/46_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2411
- Fix: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60470 - Out-of-Bounds Read in GPAC MP4Box AC-4 Parser

An out-of-bounds read vulnerability exists in GPAC MP4Box when processing a crafted AC-4 stream. The issue occurs in `gf_ac4_parser_bs()` in `media_tools/av_parsers.c` and is reachable during media import through MP4Box commands such as `-info`.

Summary:
AddressSanitizer confirms a global-buffer-overflow at `media_tools/av_parsers.c:16137`. The parser reads 4 bytes past the end of the global `AC4_SAMPLE_DELTA_TABLE_441` array due to insufficient bounds checking of AC-4 sample delta table indexes.

The crafted AC-4 stream causes the AC-4 parser to access `AC4_SAMPLE_DELTA_TABLE_441` with an out-of-bounds index. The invalid read occurs while probing the AC-4 stream and then propagates through the MP4Box media import path.

Relevant AddressSanitizer trace:

```
==1845261==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f4214ddf8fc
READ of size 4 at 0x7f4214ddf8fc thread T0
#0 0x... in gf_ac4_parser_bs media_tools/av_parsers.c:16137
#1 0x... in ac4dmx_probe_data filters/reframe_ac4.c:546
#2 0x... in gf_filter_pid_raw_new filter_core/filter.c:4704
#3 0x... in filein_process filters/in_file.c:610
#4 0x... in gf_filter_process_task filter_core/filter.c:3187
#5 0x... in gf_fs_thread_proc filter_core/filter_session.c:2421
#6 0x... in gf_fs_run filter_core/filter_session.c:2728
#7 0x... in gf_media_import media_tools/media_import.c:1278
#8 0x... in convert_file_info applications/mp4box/fileimport.c:131
#9 0x... in mp4box_main applications/mp4box/mp4box.c:6520

0x7f4214ddf8fc is located 36 bytes before global variable 'AC4_SAMPLE_DELTA_TABLE_48'
defined in 'media_tools/av_parsers.c:14246:11' of size 56
0x7f4214ddf8fc is located 4 bytes after global variable 'AC4_SAMPLE_DELTA_TABLE_441'
defined in 'media_tools/av_parsers.c:14263:11' of size 56

SUMMARY: AddressSanitizer: global-buffer-overflow media_tools/av_parsers.c:16137 in gf_ac4_parser_bs
```

CWE:
CWE-125 - Out-of-bounds Read

Affected Component:
```
media_tools/av_parsers.c:16137
Function: gf_ac4_parser_bs()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
2.5-DEV-rev1593-gfe88c3545-master
Commit: fe88c3545aadd597b250ccf23271d5d3de50ccc8
```

Attack Conditions:
An attacker supplies a crafted input file that is processed by MP4Box. The issue can be reproduced locally with:
```
./MP4Box -info 43_gf_ac4_parser_bs_media_tools_av_parsers_c_16137
```

Attack vector: local crafted AC-4 file processed by MP4Box
User interaction: required

Impact:
denial of service via application crash

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3294
- Fix: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/43/43_gf_ac4_parser_bs_media_tools_av_parsers_c_16137
- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60470

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60476 - Heap Use-After-Free in GPAC MP4Box AC-4 Descriptor Cleanup

A heap use-after-free vulnerability exists in GPAC MP4Box when processing a crafted AC-4 file. The issue occurs in `gf_odf_ac4_cfg_clean_list()` in `odf/descriptors.c` during recursive cleanup of AC-4 configuration lists.

Summary:
AddressSanitizer confirms a heap-use-after-free at `odf/descriptors.c:2419`. The cleanup code accesses a list node after it has already been freed in a recursive cleanup path, causing MP4Box to crash.

The crafted AC-4 stream contains malformed configuration list data. During parsing and cleanup, `gf_odf_ac4_cfg_clean_list()` recursively destroys AC-4 configuration structures. A node is freed in a deeper cleanup level and later accessed again by the caller, resulting in a read from freed heap memory.

Relevant AddressSanitizer trace:

```
[AC4] Don't support presentation_version 0.
==1841011==ERROR: AddressSanitizer: heap-use-after-free on address 0x508000000470
READ of size 8 at 0x508000000470 thread T0
#0 0x... in gf_odf_ac4_cfg_clean_list odf/descriptors.c:2419
#1 0x... in gf_odf_ac4_cfg_clean_list odf/descriptors.c:2400
#2 0x... in gf_ac4_parser_bs media_tools/av_parsers.c:16101
#3 0x... in ac4dmx_process filters/reframe_ac4.c:388
#4 0x... in gf_filter_process_task filter_core/filter.c:3187
#5 0x... in gf_fs_thread_proc filter_core/filter_session.c:2421
#6 0x... in gf_fs_run filter_core/filter_session.c:2728
#7 0x... in gf_media_import media_tools/media_import.c:1278
#8 0x... in convert_file_info applications/mp4box/fileimport.c:131
#9 0x... in mp4box_main applications/mp4box/mp4box.c:6520

0x508000000470 is located 80 bytes inside of 88-byte region [0x508000000420,0x508000000478)
freed by thread T0 here:
#0 0x... in free
#1 0x... in gf_odf_ac4_cfg_clean_list odf/descriptors.c:2432
#2 0x... in gf_odf_ac4_cfg_clean_list odf/descriptors.c:2400

previously allocated by thread T0 here:
#0 0x... in malloc
#1 0x... in gf_ac4_raw_frame media_tools/av_parsers.c:15938
#2 0x... in gf_ac4_parser_bs media_tools/av_parsers.c:16113

SUMMARY: AddressSanitizer: heap-use-after-free odf/descriptors.c:2419 in gf_odf_ac4_cfg_clean_list
```

CWE:
CWE-416 - Use After Free

Affected Component:
```
odf/descriptors.c:2419
Function: gf_odf_ac4_cfg_clean_list()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
2.5-DEV-rev1593-gfe88c3545-master
Commit: fe88c3545aadd597b250ccf23271d5d3de50ccc8
```

Attack Conditions:
An attacker supplies a crafted input file that is processed by MP4Box. The issue can be reproduced locally with:
```
./MP4Box -info 42_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2419
```

Attack vector: local crafted AC-4 file processed by MP4Box
User interaction: required

Impact:
denial of service via application crash; local MITRE data also identifies potential arbitrary code execution risk

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3293
- Fix: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/42/42_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2419
- BDU: https://bdu.fstec.ru/vul/2025-08612
- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60476

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

A new issue of This Week In GNOME is now online!

#270 Visualized Community
https://thisweek.gnome.org/posts/2026/10/twig-270/

#ThisWeekInGNOME #FreeSoftware #FOSS #OpenSource

Security Advisory: CVE-2025-60469 - NULL Pointer Dereference in GPAC MP4Box AC-4 Parser

A NULL pointer dereference vulnerability exists in GPAC MP4Box when processing a crafted AC-4 stream. The issue occurs in `gf_ac4_presentation_ch_mode()` in `media_tools/av_parsers.c` and can be triggered by running MP4Box with the `-info` option on a malformed input file.

Summary:
AddressSanitizer confirms a segmentation fault at `media_tools/av_parsers.c:15641`. The parser attempts to read through a NULL or invalid pointer while handling an AC-4 stream with unsupported `presentation_version` and missing substream group information.

The crafted AC-4 stream declares an unsupported presentation version and omits required substream group data. MP4Box reports that `presentation_version 0` is unsupported and that substream group `1` cannot be found for presentation `0`. The error path then reaches `gf_ac4_presentation_ch_mode()` and dereferences an invalid pointer, resulting in a segmentation fault.

Relevant AddressSanitizer trace:

```
[AC4] Don't support presentation_version 0.
[AC4] Cannot find substream group 1 for presentation 0
AddressSanitizer:DEADLYSIGNAL
==1829578==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000048
==1829578==The signal is caused by a READ memory access.
==1829578==Hint: address points to the zero page.
#0 0x... in gf_ac4_presentation_ch_mode media_tools/av_parsers.c:15641
#1 0x... in gf_ac4_raw_frame media_tools/av_parsers.c:15976
#2 0x... in gf_ac4_parser_bs media_tools/av_parsers.c:16113
#3 0x... in ac4dmx_process filters/reframe_ac4.c:388
#4 0x... in gf_filter_process_task filter_core/filter.c:3187
#5 0x... in gf_fs_thread_proc filter_core/filter_session.c:2421
#6 0x... in gf_fs_run filter_core/filter_session.c:2728
#7 0x... in gf_media_import media_tools/media_import.c:1278
#8 0x... in convert_file_info applications/mp4box/fileimport.c:131
#9 0x... in mp4box_main applications/mp4box/mp4box.c:6520

SUMMARY: AddressSanitizer: SEGV media_tools/av_parsers.c:15641 in gf_ac4_presentation_ch_mode
```

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
media_tools/av_parsers.c:15641
Function: gf_ac4_presentation_ch_mode()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
2.5-DEV-rev1593-gfe88c3545-master
Commit: fe88c3545aadd597b250ccf23271d5d3de50ccc8
```

Attack Conditions:
An attacker supplies a crafted input file that is processed by MP4Box. The issue can be reproduced locally with:
```
./MP4Box -info 41_gf_ac4_presentation_ch_mode_media_tools_av_parsers_c_15641
```

Attack vector: local crafted AC-4 file processed by MP4Box
User interaction: required

The prepared CVSS vector in the local data is:
```
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
```

Impact:
denial of service via application crash

Base score: 5.5, Medium.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3292
- Fix: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/41/41_gf_ac4_presentation_ch_mode_media_tools_av_parsers_c_15641
- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60469

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

🐧 Artikelreihe: Der Umstieg von TUXEDO OS auf Debian Testing

Ihr möchtet mehr über TUXEDO OS erfahren? Wir haben unsere bisherigen Artikel für euch zusammengestellt!

🔎 Was interessiert euch besonders: TUXEDO OS für Entwickler oder digitale Souveränität?

Viel Spaß beim Lesen!

👉 https://www.tuxedocomputers.com/de/Infos/News.tuxedo?tuxpage=1&tuxsort=false,true#2296,12591

#TUXEDO #Linux #Debian #OpenSource

Alt...

Schwarzer Kreis mit einem weißen, geometrisch stilisierten X in der Mitte, umgeben von einer breiten roten Pinselspirale, die teilweise überlappt.

Ich habe einen neuen Podcast: NET⫽SPLIT

Jetzt ist es offiziell, @daniel und ich haben zusammen einen #Podcast, @netsplit \o/

Geplant ist ein Laberpodcast rund um #OpenSource und Dezentralität, auch wenn die ganz genaue Ausrichtung noch nicht 100% fest steht.

Den Podcast veröffentlichen wir als Video- und Audio-Format über #PeerTube und natürlich auch #RSS und es kommt jeden Monat eine neue Folge raus.

Ich bin mega happy mit dem Projekt und ich hoffe, ihr schaut oder hört mal rein. Alle Abo-Möglichkeiten findet ihr auf unserer Website zusammen gefasst:

https://netsplit.fm/

P.S.: An alle @rebootpolitics -Fans, keine Sorge, mein geliebter Politik-Podcast läuft natürlich auch weiter und wir planen aktuell wieder neue Interviews und anderen Schabernack.

#NetSplit #RebootPolitics #Fediverse #XMPP

Alt...

Das NET⫽SPLIT-Cover. Links stehe ich, rechts Daniel und wir lächeln beide in dieKamera. Im Vordergrund ein weißer Schriftzug auf beerenfarbenen und mittelgrünem Grund: "NET⫽SPLIT, Ein Podcast mit Ückück und Daniel". Der Hintergrund ist leicht geblurt und in dunkelgrau gefärbt.

Dzięki za głosy w ankiecie! Wyniki są jasne: 75% z Was woli zostawić komentowanie na Mastodonie.

Myślałem o opcji hybrydowej z użyciem `mastodon-comments` (osadzenie dyskusji pod artykułem), ale idąc za Waszym głosem, po prostu odpuszczam temat.

Dyskusja kwitnie w Fediwersum i niech tam zostanie. Dzięki za pomoc w decyzji! 👋

#prywatność #opensource #privacy

🗳️ OWASP Board Election voting is OPEN!

3 Board seats are up for election. Make your voice heard and help shape OWASP’s future!

📩 Check your personal and OWASP email for your ballot.

⏰ Closes Oct 30, midnight UTC.

Vote now: https://owasp.org/board/elections/2026

#community #opensource #boardelections

Wine 11.20 brings more improvements for ARM64EC, XML validation and CDROMs https://www.gamingonlinux.com/2026/10/wine-11-20-brings-more-improvements-for-arm64ec-xml-validation-and-cdroms/

#Wine #OpenSource #Linux

Ich habe in den letzten zwei Monaten eine #Skill Suite für Continuous Refactoring gebaut. Sie funktioniert mit allen gängigen Agenten von #OpenCode, #ClaudeCode, #Cursor usw. Version 0.7.0 hat einen guten Schritt nach vorne gemacht, weshalb ich sie euch heute vorstellen möchte.

Schaut sie euch an unter https://continuous-refactoring.de/

#OpenSource #AgenticEngineering

There are decisions you don’t like to make—and you like implementing them even less. Take choosing an operating system, for example. Unfortunately, it’s not very productive to insist on open-source systems if they don’t work flawlessly on your own hardware.

Take, for example, my new Asus NUC 16 Pro with an Intel Ultra X7 processor and its built-in (soldered) components. The only Linux distribution that runs smoothly on it is Fedora. However, for political reasons (the U.S.), I no longer want to use it (although, from a user’s perspective, I do miss it—it’s simply the best Linux, period). But I haven’t been able to get U.S.-independent distributions like Debian to run properly on it; in some cases, the system wasn’t even recognized when I tried installing them from a USB drive. Another new experience… but then again, I’ve never had such relatively brand-new hardware that also requires a cutting-edge kernel. Maybe Ubuntu would work, but I don’t like Ubuntu or Canonical. That’s why I’m running Windows 11 Pro on it. Reluctantly, but everything works.

The same goes for my old ThinkPad T490s. Everything works wonderfully with any Linux distribution—except for the 5G modem. And I need that when I’m on the go. There’s no workaround for it either; I’ve probably scoured the entire web for one, but not a single tip helped. So here, too: Windows...

Now I actually have two Windows computers running again, for the sake of my sanity and to save time. At least I’m using only local accounts and the strictest possible privacy settings and tweaks you can apply to Windows. And I only use those two computers when necessary.

Most of my work continues to run on my two Debian systems, the FreeBSD computer, and, when necessary, on the Mac as well.

Still, it leaves a bad taste in my mouth, but I don’t want to let the devices sit around unused.

Is it just me, or are there others who feel torn like this???

#linux #opensource #freesoftware #windows #fedora #debian #freebsd #ubuntu #apple #usa

🚀 Fusion 1.2 is here!

What if your Laravel Eloquent models could work with Markdown files, not just database tables?

With Fusion, you can bring the power of Eloquent to Markdown-based content while keeping the Laravel experience you already know.

🔗 https://github.com/Hi-Folks/fusion

#laravel #markdown #eloquent #model #opensource #programming

#Ubuntu Touch OTA 2.1 Rolls Out with Support for Volla Tablet and Various Improvements https://9to5linux.com/ubuntu-touch-ota-2-1-rolls-out-with-support-for-volla-tablet-various-updates

@ubports #Linux #OpenSource #UbuntuTouch

Alt...

A screenshot of Ubuntu Touch's boot splash screen

30 Jahre #KDE : Plasma 6.8 setzt komplett auf #Wayland | heise online https://www.heise.de/news/KDE-Plasma-6-8-offeriert-nur-noch-Wayland-Sitzung-11487974.html #Linux #OpenSource

#PeaZip 11.4 Open-Source Archive Manager Released with Various Improvements and Bug Fixes https://9to5linux.com/peazip-11-4-open-source-archive-manager-released-with-various-improvements

#OpenSource #Linux #FreeSoftware

Alt...

A screenshot of PeaZip showing the built-in file manager.

The Wine 11.20 development release is out now bringing another set of improvements for running Windows apps / games on SteamOS / Linux.
https://www.gamingonlinux.com/2026/10/wine-11-20-brings-more-improvements-for-arm64ec-xml-validation-and-cdroms/

#OpenSource #Wine #Misc

Guten Morgen

Manchmal denke ich, mein Rechner hat einen unsichtbaren Mitbewohner. Er räumt auf, während ich schlafe, sortiert den Arbeitsspeicher und hält die Lüfter leise. Ich sehe ihn nie, aber ich merke, dass er da ist. Sein Name steht ganz klein in der Ecke des Anmeldebildschirms, und wenn ich genauer hinsehe, steht dort Linux.

Vielleicht ist das der schönste Trick an freier Software. Sie arbeitet so unauffällig, dass man sie erst bemerkt, wenn man weiß, wonach man sucht. Kennst du das Gefühl, dass da jemand mitarbeitet, den man nie zu Gesicht bekommt?

#Linux #OpenSource #FOSS #FreieSoftware

Come find us today in Open Source Conference in Tokyo!!

Thank you to our community who have organised a booth for our first time in the conference!!

https://event.ospn.jp/osc2026-fall/

#tokyo #conference #opensource

Linus Torvalds nutzt jetzt KI für den Linux-Kernel. Seine erste mit einem Sprachmodell entwickelte Patch-Serie beschleunigt bestimmte Lesezugriffe im Benchmark um den Faktor 23, enthielt bei der Prüfung aber direkt eine gefährliche Race Conditoin. Die Projektbetreuer streichen parallel die KI-Kennzeichnungspflicht, weil am Ende ohnehin der Mensch für seinen Code haftet. #Linux #OpenSource #KI #Programmierung

https://www.all-ai.de/news/news26/linux-ki-patch

If you ship open source to DoW: DoWI 8430.01 (effective September 8, 2026) requires SBOMs for all covered software, including transitive dependencies (§3.5.b), and a risk review of third-party and open source components (§3.5.i(2)).

On our side, Anchore Enterprise generates SBOMs at every build and imports vendor SBOMs. Here's the mapping:

https://anchore.com/blog/dow-instruction-8430-01-makes-software-evidence-a-condition-to-operate/

#SBOM #OpenSource #SoftwareSupplyChain

Linux users, let’s settle this.

Name one distro better than Arch Linux.

#Linux #LinuxDistro #OpenSource

Le teasing est terminé : ça pique, comme promis ! 🔥🚀
Mon nouveau service auto-hébergé est en ligne : Notesnook, des notes chiffrées de bout en bout, synchronisées sur tous vos appareils (navigateur, ordinateur, Android).

👉 Utiliser mon instance : https://wiki.blablalinux.be/fr/tutoriels-notesnook-utiliser-instance-blablalinux
🛠️ L'installer chez vous : https://wiki.blablalinux.be/fr/tutoriels-notesnook-installer-sur-son-serveur
🌐 Tous mes services : https://blablalinux.be/mes-services-publics/

#Notesnook #SelfHosting #AutoHébergement #OpenSource

Wine has updated to version wine-11.20. Check it out here: https://gitlab.winehq.org/wine/wine/-/releases/wine-11.20
#linux #foss #OpenSource

💾 Neue Möglichkeiten fürs N64!
Das SummerCart64 ist eine günstige, offene Alternative zu EverDrive & Co. – inkl. 64DD-Support, USB-Funktion, mp3-Player & mehr!
Für alle Bastler und Retro-Fans ein echter Geheimtipp 💡
➡️ Jetzt mehr erfahren: https://www.jungsi.de/summercart64-nintendo-64/
#Nintendo64 #Flashcart #RetroGaming #SummerCart64 #64DD #OpenSource #N64 #EverDriveAlternative

cve-watch 0.1.0

Fiz um monitor de vulnerabilidades críticas pra infra bolha-gcn e abri o código.

Ele consulta NVD, CISA KEV, avisos de segurança do GitHub e o tracker do Debian, e só avisa quando aparece algo crítico (CVSS ≥ 9 ou algo com exploração ativa confirmada) nos produtos que você lista.

Cada alerta diz:

• quando a falha foi publicada e há quantos dias
• se já existe versão corrigida (upstream e Debian)
• o link do aviso oficial

Notificações:

• Suporte a Mastodon (DM)
• Mattermost (canal)
• E-mail

Características:

• Python puro, sem dependências;
• Roda no cron
• Arquivo de configuração TOML para produtos e canais de monitoramento

Opcional:

• Heartbeat no Uptime Kuma, pra você saber se ele parou de funcionar

Monitores Bolha/GCN:

Aqui ele monitora vulnerabilidades do kernel linux, Proxmox, QEMU, Rancher/RKE2, Mastodon, Docker, nginx e cia.

Liçenca

• MIT

Source

• https://gitlab.gutocarvalho.net/open/cve-watch

#selfhosting #security #opensource #sysadmin

Kachelfenster und ich sind nie richtig Freunde geworden. Ich habe es mehrfach probiert, jedes Mal mit der besten Absicht, aber nach ein paar Tagen bin ich wieder bei den schwebenden Fenstern gelandet. Der Einstieg ist steil, bis die vielen Tastenkürzel im Kopf bleiben, vergeht eine Weile, und in dieser Zeit fühlt sich jeder Handgriff wie Suchen an. Ständig fehlte mir die gewohnte Bewegung mit der Maus, mit der ich ein Fenster einfach greife und dorthin ziehe, wo ich es gerade brauche. Bei mehreren Monitoren wurde es dann endgültig unübersichtlich, ich verlor den Überblick, auf welchem Bildschirm ein Fenster gerade liegt.

Den Reiz sehe ich trotzdem. Für jemanden, der den ganzen Tag im Terminal arbeitet, viele Fenster gleichzeitig offen hält und alles über die Tastatur steuert, ist so ein festes Raster ein echter Gewinn. Da sitzt jeder Handgriff, nichts verdeckt etwas anderes, und die Effizienz ist deutlich höher. Mein Alltag ist aber breiter gestreut, mal Browser, mal Bildbearbeitung, mal ein kurzer Blick in eine Datei. Da war mir das strenge Raster zu sehr auf einen Arbeitsstil zugeschnitten. Vielleicht ist es eine Frage der Gewohnheit, doch ich glaube inzwischen, dass ein Kachelsystem eher etwas für Profis ist, die ihren Rechner beruflich auf ein Ziel hin nutzen. Für mich als Privatanwender war die Umstellung zu groß und der Gewinn zu selten.

Wie nutzt du deinen Bildschirm, lieber gekachelt und aufgeräumt oder frei und schwebend?

#Linux #TilingWM #OpenSource #FOSS

As Microsoft ends support for Publisher, The Document Foundation offers a seamless solution. Learn how LibreOffice can open and edit your legacy PUB files.

#LibreOffice #MicrosoftPublisher #OpenSource #DocumentFoundation #TechNews

https://dailytechnow.com/libreoffice-rescues-microsoft-publisher-users/

RE: https://nrw.social/@41352_Einfach_besser_leben/117434345795993586

Morgen bin ich auch mit am Start und unterstütze in der Linux-Sonderschicht. Interessierten Leuten Linux näher bringen und auf dem eigenen System installieren. So ist die Befreiung von der Seuche (aka Windows) etwas leichter.

Mein kleiner Beitrag an die Community.

#foss #opensource #ehrenamt #noBigTech #unterstützung #EndofLife #linux #windows

Wazuh (open-source XDR & SIEM) in v4.14.9 released

https://secburg.com/posts/wazuh-4149-released/

#Wazuh #SIEM #XDR #InfoSec #OpenSource

Security Advisory: CVE-2025-60479 - NULL Pointer Dereference in GPAC/MP4Box

Processing a crafted MPEG-4 file with broken BIFS vector fields triggers a NULL pointer dereference in `StatSFVec2f`, causing MP4Box to crash during scene statistics collection.

Summary:
The `StatSFVec2f` function in `scene_manager/scene_stats.c` collects statistics for SFVec2f fields in an MPEG-4 BIFS scene. When the scene contains a crafted broken vector field, the statistics traversal passes a NULL pointer to `StatSFVec2f` without validation. The function dereferences the pointer at address 0x0, terminating the process with SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
scene_manager/scene_stats.c:192
Function: StatSFVec2f()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1678-gb7ffd9f96-master; commit `b7ffd9f96bc188dde148300d8c4e510b557563aa`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MPEG-4 file containing a malformed BIFS scene with invalid SFVec2f vector field structures. Local access is required; the victim must invoke `MP4Box -nstat <crafted_file>` or any equivalent scene statistics command that triggers the scene analysis path.

Impact:
The NULL pointer dereference (READ at address 0x000000000000) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
75786eb61b7cc838b57c3d4f8004b4f13b5b724c
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3322
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/58/58_StatSFVec2f_scene_manager_scene_stats_c_192
- Fix: https://github.com/gpac/gpac/commit/75786eb61b7cc838b57c3d4f8004b4f13b5b724c

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60489 - NULL Pointer Dereference in GPAC/MP4Box

Processing a crafted MP4 file with corrupted DTS timing metadata triggers a NULL pointer dereference in `dasher_insert_timeline_entry`, causing MP4Box to crash during DASH timeline construction.

Summary:
The `dasher_insert_timeline_entry` function in `filters/dasher.c` accesses timeline entry structures during DASH segment processing. When the input MP4 has corrupted DTS sequence data that produces empty DASH segments, the dasher fails to validate a timeline entry pointer before dereferencing it at address 0xc (12-byte struct offset), leading to a near-NULL read and SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
filters/dasher.c:7760
Function: dasher_insert_timeline_entry()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1692-g23819fdc0-master; commit `23819fdc02be8d3e92f0ef84831625d51981d7d2`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file whose DTS timing metadata produces empty segments during DASH packaging. Local access is required; the victim must invoke `MP4Box -segment-timeline -dash 10000 <crafted_file>` or any equivalent DASH segmentation command using segment timeline mode.

Impact:
The near-NULL pointer dereference (READ at address 0x00000000000c) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a near-NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
4860a1a6f128ccc9ae37b4b738d22029f9672457
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3325
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/60/60_dasher_insert_timeline_entry_filters_dasher_c_7760
- Fix: https://github.com/gpac/gpac/commit/4860a1a6f128ccc9ae37b4b738d22029f9672457

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60491 - Use-After-Free in GPAC/MP4Box

Processing a crafted MPEG-2 TS file with corrupted PMT descriptors triggers a heap use-after-free in `dasher_flush_segment`, causing MP4Box to crash during DASH segmentation.

Summary:
The `dasher_configure_pid` function in `filters/dasher.c` frees a PID context structure at line 986 when reconfiguring a stream from a crafted MPEG-TS input. The freed pointer is not nullified, and `dasher_flush_segment` subsequently reads 4 bytes at offset 336 within that freed 1096-byte region at line 8062 during the segment flush cycle, constituting a heap-use-after-free.

CWE:
CWE-416 - Use After Free

Affected Component:
```
filters/dasher.c:8062
Function: dasher_flush_segment()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1698-gfc2009fa7-master; commit `fc2009fa75631960743f8f7855dda8998167b5ab`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MPEG-2 TS file containing broken PMT descriptor sizes, reused PIDs, and sync marker violations. Local access is required; the victim must invoke `MP4Box -dash 1000 <crafted_file>` or any equivalent DASH segmentation command that triggers PID reconfiguration in the dasher module.

Impact:
The use-after-free (READ of size 4 at 336 bytes into a freed 1096-byte heap region) causes process termination, resulting in Denial of Service. Code execution cannot be ruled out; use-after-free vulnerabilities allow an attacker to control freed memory contents and potentially redirect execution flow.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
f6128214feb69cd689e4b9944a2621bc4ad8faf0
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3326
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/61/61_dasher_flush_segment_filters_dasher_c_8062
- Fix: https://github.com/gpac/gpac/commit/f6128214feb69cd689e4b9944a2621bc4ad8faf0

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60497 - NULL Pointer Dereference in GPAC/MP4Box

Processing a crafted MP4 file with an invalid sample description entry triggers a NULL pointer dereference in `GetESD`, causing MP4Box to crash during scene loading.

Summary:
The `GetESD` function in `isomedia/track.c` retrieves an Elementary Stream Descriptor for a track sample description. When the input MP4 contains an unknown atom type (`avC9`) instead of a valid `avcC` entry in the sample description, the OD (Object Descriptor) loader still attempts to read the ES descriptor via `GetESD`, which dereferences a NULL pointer at address 0x0 without prior validation, terminating the process with SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
isomedia/track.c:107
Function: GetESD()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1780-g50b5741f2-master; commit `50b5741f291126b610c59db433fc02e8a17f0c5d`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file whose sample description (`stsd`) contains an unrecognized atom type in place of a valid AVC configuration box. Local access is required; the victim must invoke `MP4Box -svg <crafted_file>` or any equivalent scene export command that triggers ISO media scene loading and ESD retrieval.

Impact:
The NULL pointer dereference (READ at address 0x000000000000) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
91083fcfce01aa596a13a6962768d13a60bfc8bb
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3336
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/62/62_GetESD_isomedia_track_c_107
- Fix: https://github.com/gpac/gpac/commit/91083fcfce01aa596a13a6962768d13a60bfc8bb

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60494 - NULL Pointer Dereference in GPAC/MP4Box

Processing a crafted MP4 file triggers an invalid memory read in `gf_props_equal_internal` during PID property comparison, causing MP4Box to crash.

Summary:
The `gf_props_equal_internal` function in `filter_core/filter_props.c` compares PID property values using `memcmp`. When importing a crafted MP4 file, the property comparison path at line 867 passes an invalid pointer as one of the `memcmp` arguments; the resulting read-access violation at address 0x11166094 crashes the process with SIGSEGV before the comparison completes.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
filter_core/filter_props.c:867
Function: gf_props_equal_internal()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1699-g31becc9e0-master; commit `31becc9e08b88e525a4a62013a4000de1c0f8fd9`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file containing invalid or truncated ODF descriptors and box structures. Local access is required; the victim must invoke `MP4Box -add <crafted_file>` or any equivalent import command that triggers PID property initialisation and the property comparison path.

Impact:
The invalid memory read (SEGV READ at address 0x000011166094) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; neither MITRE response marks code execution impact for this specific vulnerability.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
fcb9083292befe61d3e2466b18edfedba49da098
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3329
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/64/64_gf_props_equal_internal_filter_core_filter_props_c_867
- Fix: https://github.com/gpac/gpac/commit/fcb9083292befe61d3e2466b18edfedba49da098

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60496 - Divide by Zero in GPAC/MP4Box

Splitting a truncated MP4 file with uninitialized stream parameters triggers a divide-by-zero in `reframer_send_packet`, causing MP4Box to crash with SIGFPE.

Summary:
The `reframer_send_packet` function in `filters/reframer.c` computes split boundaries using stream parameters such as timescale and estimated file size. When upstream parsing of a truncated MP4 leaves these values uninitialized (zero), the arithmetic at line 1026 performs a division by zero, raising SIGFPE and terminating the process immediately.

CWE:
CWE-369 - Divide By Zero

Affected Component:
```
filters/reframer.c:1026
Function: reframer_send_packet()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1780-g50b5741f2-master; commit `50b5741f291126b610c59db433fc02e8a17f0c5d`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a truncated MP4 file that causes the ISO media parser to leave stream parameters (timescale, file size estimate, or sample rate) at zero. Local access is required; the victim must invoke `MP4Box -split-size 8000 <crafted_file>` or any equivalent split command that triggers the reframer size-estimation path.

Impact:
The divide-by-zero (SIGFPE) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; floating-point exceptions of this type are not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
f03c946aae129980f0426d4cbae9746d0536fee6
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3334
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/65/65_reframer_send_packet_filters_reframer_c_1026
- Fix: https://github.com/gpac/gpac/commit/f03c946aae129980f0426d4cbae9746d0536fee6

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

RT @TencentHunyuan: TRANSLASATION: 🚀 Hy Memory 2.0 ist da – open-source Modell, Framework und MemHub. Ihr privater Gedächtnisverwalter. Das Framework verarbeitet Chat-, Arbeits- und Code-Gedächtnisse. #1 unter den open-source Lösungen auf 4 Benchmarks. Hy-Memory-30B-A3B schlägt Opus 5 in den meisten Frameworks. MemHub (CLI + Mac) synchronisiert mit über 10 KI-Tools. https://t.co/Z79ZGcc2gj

mehr auf Arint.info

#HyMemory #KIGedächtnis #KIInnovation #MemHub #OpenSource #PrivateSpeicherung #arint_info

https://x.com/TencentHunyuan/status/2111027329816465435

RT @perplexity_ai: Wir machen SPACE, die Sandbox-Plattform, die jede Aufgabe in Perplexity Computer ausführt, quelloffen. SPACE gibt jeder Agent-Aufgabe ihre eigene Firecracker-Mikrovirtualisierungsinstanz und steuert Zugriffsrechte und ausgehenden Datenverkehr von außerhalb der VM. Jetzt verfügbar unter der Apache-2.0-Lizenz: https://t.co/DzSmq6o1xA

mehr auf Arint.info

#AI #Apache2 #MicroVM #OpenSource #Perplexity #SPACE #arint_info

https://x.com/perplexity_ai/status/2110778478312481167

Small one in Matomo core.

Someone else had already found the fix. GitHub issue #25147: https://github.com/matomo-org/matomo/issues/25147 - searching for lowercase öppettider did not find Öppettider, Swedish å/ä/ö just do not fold across case under a plain ASCII regex. The reporter pasted the exact one-line patch himself, add a u flag next to the existing i.

I turned that into an actual pull request: the flag change, a docblock explaining why /i alone was not enough, and a test covering å/ä/ö in both directions.

Merged into 6.x-dev today by chippison. PR: https://github.com/matomo-org/matomo/pull/25159

#Matomo #OpenSource #PHP #Unicode #WebDev #OSS

Alt...

Merged into Matomo

Libreboot startet jetzt auch per UEFI durch

Windows 11 per UEFI starten: Libreboot stellt seinen Bootweg um und unterstützt deutlich mehr Hardware – teils vorerst nur zum Selbstbauen.

https://www.heise.de/news/Libreboot-startet-jetzt-auch-per-UEFI-durch-11491142.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Chromebook #Firmware #IT #Linux #OpenSource #UEFI #Windows #news

Canonical officially launches Ubuntu 26.10 Stonking Stingray. Discover the new GNOME 51 desktop, Rust core tools, and advanced security enhancements.

#Ubuntu #Linux #StonkingStingray #GNOME #OpenSource

https://dailytechnow.com/canonical-releases-ubuntu-26-10-stonking-stingray/

This mockup is the design touchstone for Agora -- it's the visual design language it's pursuing.

#programming #linux #freeBSD #openBSD #wayland #opensource #floss

Introducing the Accessible Components Library from @TetraLogical!

https://tetralogical.com/blog/2026/10/14/accessible-components-library/

Eight common components with documented accessibility requirements, test scenarios, and working automated tests that check them.

• Free to use and adapt
• Human-readable tests written in Gherkin
• Mapped to WCAG 2.2, levels A to AAA

#Accessibility #OpenSource #WCAG #AccessibleComponents

Alt...

The text “Introducing the TetraLogical Accessible Components Library” with a pink building Lego block with four circular studs on top. On the side of the block, there are coding symbols (a left angle bracket, a slash, and a right angle bracket) in orange and purple. The TetraLogical logo appears at the bottom right.

New post: Open Tabs CW42/2026

Defrosting fridges and more strange AI topics this week.

https://stoeps.de/posts/2026/open-tabs-cw42/

Reply to this toot to leave a comment - replies will appear below the article automatically.

#omb #ai #escape #ghost #homework #opensource #politics #sandbox #security #stupidity

🛡️ secdb-cli 0.7.0 is out.

It's the open source command-line client for ZEN SecDB: CVE lookup, SSVC, and auditing of packages, SBOMs, dependency manifests, Linux hosts and Docker images.

What's new:

- secdb search: full-text search across CVEs, CWEs, security advisories, NASL plugins and ExploitDB entries. Filter by record type and by date, combine terms with OR, exclude them, search exact phrases. CVEs in the CISA KEV catalog are marked, and every result links to its record.

- --jq: filter the JSON output of any command with a jq expression, without installing jq. Handy in CI images and on Windows.

- Safer terminal output: control characters coming from third-party feed data are stripped before they reach your terminal.

Examples:
secdb search fortinet kev:true --since 30d
secdb search '"remote code execution"' --type cve
secdb audit sbom --file bom.json --fail-on high --jq '.[].advisories[].id'

💾 Binaries for Linux, macOS and Windows:
https://github.com/giterlizzi/secdb-cli/releases/tag/v0.7.0

#InfoSec #VulnerabilityManagement #OpenSource #Golang #CVE #NTTDATA #ZENSecDB

Remember Windows Phone and its iconic Live Tiles? Now imagine that interface… running on Linux instead of Windows.

That’s the idea behind ztOS, a mobile Linux project based on Arch Linux ARM, featuring ztMETRO, an interface inspired by Windows Phone 8.1, and native Linux applications.

It runs on the Samsung Galaxy S9 with a mainline Linux kernel. Wi-Fi, 4G and the touchscreen are already working, but the camera, Bluetooth and call audio still need work.

It’s still in alpha, so it’s nowhere near ready for daily use. But it’s an interesting alternative vision for Linux on smartphones.

https://github.com/z3r0n3br4instorm/ztOS

Would you try a Linux phone with a Windows Phone-inspired interface, or do you prefer the Android experience?

#LinuxMobile #OpenSource #Linux

Linux: Kennzeichnung von KI-Code soll entfallen – auch Torvalds nutzt LLMs

Kernel-Maintainer wollen die Kennzeichnung für KI-Patches abschaffen, weil nur wenige sie setzen. Auch Linus Torvalds programmiert inzwischen mit KI.

https://www.heise.de/news/Linux-Kennzeichnung-von-KI-Code-soll-entfallen-auch-Torvalds-nutzt-LLMs-11490345.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#IT #KünstlicheIntelligenz #LinusTorvalds #LinuxKernel #OpenSource #Softwareentwicklung #news

All of those who has this strong distaste for #systemd being doing too much, not being Unix like and providing too many components ... they should really spend some time to poke around the source code of the BSD distributions ...

https://cgit.freebsd.org/src/tree/
https://radicle.network/nodes/index.radicle.garden/rad:z2HLHXgL1xevBNQsf8BmQW7MpJmtm
https://cvsweb.netbsd.org/bsdweb.cgi/src/
https://github.com/openbsd/src

#linux #bsd #foss #opensource

RT @UnslothAI: NVIDIA veröffentlicht 2 neue Modelle: Nemotron-3.5-Bolt und Nemotron-3.5-Super-VL. Nemotron-3.5-Bolt-74B-A9B läuft auf 24 GB RAM und bietet erstklassige Leistung für seine Größe. Super-VL-120B-A12B läuft auf 82 GB RAM. Bolt GGUF: https://t.co/1WCKKPvFtW Anleitung: https://t.co/RIgVixplpT Super https://t.co/njSMjAOxgc https://t.co/I50NStQe8C

mehr auf Arint.info

#KI #MachineLearning #Nemotron #NVIDIA #OpenSource #TechNews #arint_info

https://x.com/UnslothAI/status/2110753351545843811

RT @ComfyUI: Higgsfield hatte versprochen, seine gesamte Plattform quelloffen zu machen. Das taten sie nicht.

mehr auf Arint.info

#AI #Comfy #DeveloperPlatform #Higgsfield #KünstlicheIntelligenz #OpenSource #arint_info

https://x.com/ComfyUI/status/2110870071933645103

Support KDE with a donation:

https://kde.org/fundraisers/yearend2026/"

#donate #FreeSoftware #OpenSource #KDE #fundraiser

Alt...

K&👽, the KDE wizard, points his staff out of a poster which reads "I want you" and "to support KDE" at the bottom. The link to the fundraiser is included at the bottom as is a QR that points to the same place. Konqi is featured with the "30" and "KDE" logos associated with the anniversary. The art by Tyson Tan is distributed under CC By-SA 4.0 license.

25 Jahre Open Source in der Stadtverwaltung in Treuchtlingen
Erfolgsmeldung zu langjähriger Open Source Nutzung

Die bayerische Stadt Treuchtlingen setzt seit 25 Jahren Linux auf den Arbeitsplätzen ihrer Verwaltung ein, einzelne Open Source Lösungen sogar seit 1999. Die Open Source Business Alliance (OSBA) würdigt die Kommune zum Jubiläum als frühes Beispiel dafür, wie Open Source Software im Verwaltungsalltag funktioniert.

Quelle: https://www.ossdirectory.com/de/topnews/details/25-jahre-open-source-in-der-stadtverwaltung-in-treuchtlingen

#opensource #bayern #osba #linux #diday

Tor Guard Relay v2.2.0 is out! 🧅🐋

A server is replaceable. Recovering the same relay identity needs a plan.

This update focuses on clearer diagnostics, safer updates and encrypted recovery, so running a relay means more than watching a container stay green.

What's new:
🛡️ Tor 0.4.9.14 or newer required in both variants
🩺 Current-run health, readiness and doctor diagnostics
🔐 Verified encrypted backups and staged offline recovery
🛠️ Validated configuration changes and safer reloads
📦 AMD64 + ARM64 images published from the exact candidates that passed validation
🔄 Reviewed dependency updates and ongoing security audits

The write-up also covers the rebuild improvements, protected registry cleanup and real deployment screenshots.

⚠️ Upgrading? Read the upgrade guidance first. Legacy plaintext backup helpers are retired.

🔗 https://brokenbot.net/v2.2.0

Already running it? I'd love feedback on the diagnostics and backup workflow. Bug reports and suggestions are welcome 🐛💡

Protecting privacy, one relay at a time ✨

#Tor #Privacy #OpenSource #Docker #SelfHosting #Infosec

Hello everybody out there using Linux – ich baue einen (freien) Nachrichten-Planeten für Linux und Open Source. Nur ein Hobby, wird nicht groß und professionell wie Google News.

Ich brüte seit ein paar Wochen daran: Planet FOSS sammelt Meldungen aus Blogs, Magazinen und YouTube-Kanälen auf Deutsch und Englisch und verlinkt immer aufs Original. Schau mal rein und klickt euch durch.

Welche Quellen fehlen euch?

https://planetfoss.net

#PlanetFOSS #Linux #OpenSource #FOSS #RSS

Kolibri-1 denkt deutsch. Hilft das auch beim Antworten?

Aleph Alphas Kolibri-1 ist ein neues KI-Modell, das speziell für deutsche Texte optimiert wurde und auch auf Deutsch argumentiert. iX hat es ausprobiert.

https://www.heise.de/hintergrund/Kolibri-1-denkt-deutsch-Hilft-das-auch-beim-Antworten-11489670.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#DeepLearning #Grafikchip #IT #KünstlicheIntelligenz #Sprachverarbeitung #OpenSource #news

#Shelly 3.1.7 GUI Package Manager for Arch Linux Adds RLPM as a Native Package Engine https://9to5linux.com/shelly-3-1-7-gui-package-manager-for-arch-linux-adds-rlpm-native-package-engine

#ArchLinux #Linux #OpenSource #FreeSoftware #FOSS

Alt...

A screenshot of Shelly showing the main interface while browsing the Arch Linux package repository.

Ich kriege die Krise! Wir sind in einer AnyDesk Session mit dem Kunden (auf Windows) und plötzlich erscheinen dessen Copy/Paste Inhalte in MEINEM Copy/Paste Buffer auf meinem Linux...

Geht's eigentlich noch???

Was ist mit meinen Passwörtern und anderem Schweinekram, welcher in meinem Copy/Paste Buffer so rum liegen? Ich will vielleicht nicht unbedingt, dass das andere (oder Kunden) zu sehen kriegen...

Als erstes mal den Copy/Paste Buffer auf 1 reduzieren (ich kann eh nicht mehr als 1 zurückdenken) und dann mal überlegen auf eine Open Source Lösung zu wechseln...

Hat jemand eine Idee für eine Open Source Lösung???

#anydesk #opensource #desktop #linux #kde

#Linux - und Unix-Desktop #KDE feiert 30. Geburtstag | heise online https://www.heise.de/hintergrund/Linux-und-Unix-Desktop-KDE-feiert-30-Geburtstag-11487966.html #OpenSource

New episode is out!

Shane (@stranded_output), Conor (@techcelt) and Amolith (@amolith) chat to the developers of the Ardour (@ardour) digital audio workstation.

Episode is edited by Jake (@jbauer)

#linux #lads #opensource #craic #mastodaoine #tech #technology #chat #shenanigans #podcast

https://linuxlads.com/episodes/168/

Guten Morgen

Ein Tiling Window Manager ordnet die Fenster automatisch, ähnlich wie Kacheln auf einem Boden. Statt sie frei über den Bildschirm zu schieben, teilt er die Fläche selbst auf. Jedes neue Fenster bekommt einen festen Platz, keines verdeckt das andere. Die Maus brauchst du kaum, das meiste läuft über die Tastatur. So bleibt der Bildschirm vollständig gefüllt, ohne Überlappungen und ohne verlorene Fenster. Am Anfang wirkt das streng, doch wer sich daran gewöhnt, will oft nicht mehr zurück.

Hast du schon einmal mit einer Kachelumgebung gearbeitet?

#Linux #morgen #TilingWM #OpenSource

Ubuntu 26.10: Linux 7.3 und KI-Assistent im Gepäck

Das neue Ubuntu-Release enthält bereits Kernel Linux 7.3, obwohl dieser erst noch erscheint. Außerdem gibt es optional den KI-Assistenten Myna für den Desktop.

https://www.heise.de/news/Ubuntu-26-10-Linux-7-3-und-KI-Assistent-im-Gepaeck-11488457.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Canonical #Gnome #IT #KünstlicheIntelligenz #Linux #LinuxDesktop #OpenSource #Rust #Ubuntu #news

Valve launched the latest update for Proton Experimental to fix up more issues found with Windows games running on SteamOS / Linux.
https://www.gamingonlinux.com/2026/10/proton-experimental-for-october-15-has-fixes-for-arc-raiders-c-c-red-alert-counterstike-and-the-aftermath/

#Steam #OpenSource #Valve #Proton #Misc #SteamDeck #SteamMachine

Als ich anfing, war mir mulmig bei den vielen Lizenznamen. MIT, GPL, Apache, dazu noch Zahlen dahinter, das fühlte sich an wie eine Wand, die ich allein nie überstiegen hätte. Ich hatte Angst, etwas falsch zu machen, und traute mich kaum, fremde Projekte anzufassen. Dann hat mir jemand in einem Forum ruhig erklärt, dass ich zum bloßen Benutzen nichts verstehen muss und die Lizenz erst zählt, wenn ich selbst etwas weitergebe. Diese Ruhe hat mir den Weg geöffnet. Erst später habe ich begriffen, was in diesen trockenen Texten steckt. Ein Versprechen, dass das gemeinsame Werk frei bleibt. Wenn ich heute so eine Datei öffne, denke ich an die Menschen dahinter, die ihre Arbeit geteilt haben, damit ich sie nutzen kann.

Wie ist es dir beim ersten Schritt in die freie Welt ergangen?

#Linux #Lizenzen #FOSS #OpenSource

heise+ | Adblocker inklusive: DNS-Server Technitium installieren und einrichten

Der DNS-Server Technitium glänzt mit großem Funktionsumfang, ist aber nicht ganz einfach einzurichten. Wir zeigen Installation und Konfiguration.

https://www.heise.de/ratgeber/Adblocker-inklusive-DNS-Server-Technitium-installieren-und-einrichten-11439401.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#DNS #Docker #IT #Linux #OpenSource #news

Nexus v1.0.0-alpha1 is out! 🎉

Nexus is a simple, user-friendly Matrix client for Linux, Android, Windows, macOS and iOS, built with Flutter and powered by Gomuks.

This first alpha brings room and DM creation, invites, space browsing, push notifications via UnifiedPush, and lots more.

It's an alpha, so expect bugs, and please report them!

Release: https://git.federated.nexus/Nexus/nexus/releases/tag/v1.0.0-alpha1
Support room: #nexus:federated.nexus

#Matrix #Flutter #FOSS #OpenSource

Alt...

A screenshot of Nexus, showing a space list, a list of children of that space, with "Browse space" button, a chat view, and a member list.

I sent more than two years building a macOS app, and after releasing it on the AppStore, sales are really bad.

The app is named ImageFlow, and it is a node-based image and photo editor.

I'm a developer, not a marketing guy. I'm bad at promoting my stuff.

I decided to open-source my app and make it available for everyone.

Hope some people out there can enjoy it as much as I do!

https://imageflowapp.com

https://github.com/dmbfm/imageflow

#macos #apple #foss #swift #swiftui #indiedev #opensource

Meta has officially launched Muse Spark Open, a groundbreaking 816-billion parameter open-weights AI model designed for advanced coding and multimodal tasks.

#Meta #AI #MuseSparkOpen #MachineLearning #OpenSource

https://dailytechnow.com/meta-muse-spark-open-ai-model/

ICS[AP] updated CISA ICS Advisories Master File for 10/15/2026 & the following year's CSVs:

CISA_ICS_ADV_2026_10_15_26.csv

Available @ ICS[AP] GitHub:
https://github.com/icsadvprj/ICS-Advisory-Project/tree/main

#opensource
#vulnerabilitymanagement
#icssecurity

NoiseBox Browser Extension hard at work!
https://codeberg.org/NoiseBoxWorks/NoiseBox-Extension
https://youtu.be/gqN6EBVQABw?si=4HCpaTLRJy-uX92U
#privacy #opensource #selfhosted #python #javascript

RE: https://mastodon.xyz/@nextcloud/117359711364631730

I can advise the following @fdroidorg apps. Some apps need an additional repository.

* Aegis Authenticator (my preffered 2FA app)
* AntennaPod @AntennaPod (best Android podcast app)
* Breezy Weather (weather app for weather nerds)
* Bubble (IMO the best spirit level/ruler app)
* Celestia (another astronomy app)
* Compressor (suburb video compressor. get those Mastodon video's below 100MB on the road! (or rails) - needs IzzyOnDroid repo: https://android.izzysoft.de/repo.
* Convertor NOW (because those Yankees refuse to use the metric system)
* DAVx @davx5app (best way to link Caldav calendars and Carddav contact books)
* FairEmail (email app for power users. yes, you need to pay a very small fee for pro features)
* Fennec or IronFox (two great Firefox forks) - IronFox needs its own repo: https://ironfoxoss.org/download/#f-droid)
* Fluffychat (IMO the best Matrix client - also for the Linux desktop)
* Fossify Calendar (simple and no bloat. works great with DAVx)
* Fossify Contacts (simple, non bloated contact apps. works great with DAVx)
* Fossify Gallery (my preferred media gallery app, better IMO than the /e/OS default)
* Fossify Messages (simple, non bloated SMS app)
* Fossify Thank You (to donate to the great Fossify project and also with some small extra features)
* Heliboard (IMO best open-source keyboard. hopefully with native gestures ASAP)
* Image Toolbox (this is a power-house to do everything with images - has a learning curve, but it is great!)
* Joplin @joplinapp (best note taking app, better than Nextcloud Notes, because it's end-to-end encrypted)
* KDE Connect (link your phone with your KDE or Gnome (using GSConnect) desktop)
* Lawnchair @lawnchairapp (my preferred Android launcher, because the default /e/OS launcher sucks)
* LibreOffice Viewer (official app to view LibreOffice, OpenOffice and even MS Office documents (if you are into that).
* LibreTorrent (to download Linux ISO torrents on your phone for fun)
* Material Files (a non bloated file manager)
* Metrolist (to play music from YouTube without an account - good alternative for evil Spotify)
* Moshidon @moshidon (although it badly needs an update. the nightly is not yet ready. I still use it, with the web-app installed for quote posts)
* Nearby Glasses (hunt for Meta pervert glasses, but unfortunately not yet found) - needs IzzyOnDroid repo
* Nextcloud News (needs a Nextcloud account)
* Nextcloud (only if you have an account on a Nextcloud server)
* Next Player (simple, non bloated video player) - needs IzzyOnDroid repo
* Nora (great way to sandbox big-tech sites)
* Open Video Editor (the only working open-source video editor for Android, although it is not updated for two years)
* OSMAnd~ (IMO the best @openstreetmap app for Android, although it has a small learning curve)
* Peertube app @peertube (does not need an explanation)
* Pixelfed app @pixelfed (for if you have a Pixelfed account)
* RadioDroid (still IMO the best internet radio app, although not updated for three years)
* Signal @signalapp (I don't have WhatsApp, so you need something 😉) - needs the Guardian Project repo (you only need to toggle this in the F-droid settings)
* Sky Map (the open-source sky view alternative)
* SpamBlocker (because I have an ungoogled phone (/e/OS on Fairphone) I need this. maybe you as well. @murena should build this in, because this app is not very user friendly)
* Torrent Search (to search for Linux ISO torrents)
* Vegan Inspector (checks if products are vegan or vegetarian)
* VLC (does the same has Next Player, but with a (IMO) ugly interface. I keep this installed as an alternative if something doesn't wants to play, but I can't remember when I needed it. get rid of the orange!)
* Voice Audiobook Player (the only one that actually worked with local files)
* Wallabag (Pocket alternative, needs a Wallabag account on a Wallabag server)
* Wikipedia (who doesn't need Wikipedia)
* YTDLnis (download video and audio from YouTube and many other sites using yt-dlp)

#Fdroid #Android #openSource

1 of 2) )So I downloaded the appimage of Photocraft to try. The AI reversed engineered Photoshop. I'm very anti-AI, and a big reason why I abandoned Adobe - when they forced training their models on their customers work - and had used the software since 1998. But, I had already begun a move into opensource anyway, and this was my final cue to go.

#adobe #opensource #AI

Next week, I’ll be speaking at All Day AI 2026 about something Ive been experimenting with lately: System One models. AI models designed to make decisions fast, without lengthy reasoning.

To explore what they're actually capable of, I built a 3D drone simulator where an AI model has to navigate a forest, avoid obstacles, and react to threats in real time. Ill share what worked, what broke, and what I learned from zero-shot testing, collecting telemetry, and fine-tuning the model. Less theory, more lessons from building things and watching them fail.

Join me on October 22 at 5 PM ET.

#AllDayAI #MachineLearning #AI #OpenSource

New blog post! I'm sharing some personal notes from my experiments with FreeBSD and the HumanWare BrailleNote Apex.

These are just personal notes, but I hope they may also be useful to others who want to start connecting a Braille display to FreeBSD, or to curious developers who want to understand how their software is used by people relying on screen readers and other assistive technologies.

Article: https://alfonsosiciliano.gitlab.io/posts/2026-10-15-freebsd-apex.html

#FreeBSD #Accessibility #A11y #UNIX #OpenSource #Braille #Coding #DeviceDrivers #AssistiveTechnology #ScreenReaders #OpenSourceHardware #BSD

I would like to remind you again that #FOSSTorrents has got torrents for many #opensource games, softwares and operating systems.

https://fosstorrents.com

They have the #BSD family, #Linux distros, softwares like #LibreOffice, #Blender and also games like #wesnoth #warzone2100 #supertuxkart among tons of others.

If you have the disk space and spare bandwidth, consider seeding the #torrent of your choice.

And if you have enough money in your pocket, consider donating to them!

Boosts appreciated!

#foss #torrenting #seedbox

Alt...

A partial screenshot from fosstorrents.com. The header, from the left, has got their logo and in the menu there are items "Distributions", "Games" and "Software". On the right side of the menu, there are social links for X, Bluesky, Discord and RSS. And on the most right part, there is a progress bar showing how much operational costs of 2026 is covered. Currently it's ~900 USD and only like 1/5 is covered. Below the menu, there is a search box. And below it, there is a gallery of the "Newest releases"

The first session of AI Inside Drupal Essentials starts Nov 9.

If you can build sites in Drupal and you're comfortable with Composer, Drush, and Git, you're ready. No PHP needed for 18 hours of live, hands-on AI training with a human-in-the-loop approach.

https://www.drupaleasy.com/academy/aide/course-information

#Drupal #OpenSource

RSS-Reader zu langweilig? Klassische Planeten-Seiten zu dröge? Bevor das Projekt „richtig“ startet, hätte ich gern Feedback.

Planet FOSS sammelt über 100 Seiten ein, sortiert alles nach Rubriken und Themen und zeigt euch auf einen Blick, worüber in der Linux- und Open-Source-Welt gerade berichtet wird. Auf Deutsch, auf Englisch oder in beiden Sprachen:

https://planetfoss.net/

#Linux #OpenSource #News

"Passkeys Are Not a Trap"? Nice Try Scott Helme, founder and CEO of a company that markets a "Passkeys Protection" offering.

https://scotthelme.co.uk/passkeys-are-not-a-trap/

Sorry, your article is patronizing me about what attestation is, then explaining that passkeys today don't give websites an attestation at all - though a site can ask. And in so doing, it completely fails to address the main criticism of the "Passkeys are a trap" blog post, i.e. that passkeys are the boiling frog of BigTech control on authentication.

https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-not-use-them

The only point I concede is that TOTP are vulnerable to phishing. And yet, if I really have to choose, I prefer that risk rather than handing over control to Google, Apple, and co. In any case, hardware authenticators like Yubikey / NitroKey are the preferred solution.

Sorry, not convinced. Passkeys are a trap. Do not use them.

#passkeys #security #cybersecurity #bigtech #google #apple #enshittification #bigtech #digitalsovereignty #opensource #infosec #passwords #phishing #totp

Die #GodotEngine wird mir ja seit Dome Keeper immer sympathischer. Jetzt hat Jan Bojaryn mit dem Spieleentwickler Raffaele Picca von #Bippinbits gesprochen. Die Engine scheint ja wirklich auf Erfolgskurs:

https://www.heise.de/hintergrund/Fuer-welche-Art-von-Spielen-sich-die-Engine-Godot-eignet-ein-Interview-11469567.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Spiele #OpenSource

Ubuntu 26.10 is now available to download.

It ships with GNOME 51 and Linux 7.3, adds a new window tiling features and expanded Rust tooling.

Full recap on the changes to look out in the link ⤵ https://www.omgubuntu.co.uk/2026/10/ubuntu-2610-new-features

#ubuntu #linux #openSource

Alt...

Bento grid detailing various Ubuntu 26.10 features.

Stats time! #LibreOffice code contributors, translators, downloads and more – see the State of the Project, October 2025 – September 2026: https://blog.documentfoundation.org/blog/2026/10/07/state-of-the-project-oct-25-sept-26/ #foss #openSource #freesoftware

Alt...

Bar chart showing growing LibreOffice downloads

Lead the way Dutchies. 🍊 🇳🇱

🤮 #Microslop
✅ #OpenSource

*plays Rollout by Ludacris*

🔗 https://www.zdnet.com/business/dutch-tax-authorities-cancel-microsoft-365-cloud-rollout/

KI-Code im Linux-Kernel muss nicht mehr markiert werden

Das Linux-Kernel-Team wird wohl eine Regel entfernen, durch die Arbeiten an der Codebasis gekennzeichnet werden sollen, wenn sie durch KI-Tools unterstützt wurden.

https://www.linux-magazin.de/news/ki-code-im-linux-kernel-muss-nicht-mehr-markiert-werden/

#linux #opensource

@uba

Alt...

Ein Mann mit einem grünen Band um den Hals, gestikuliert mit beiden Händen. Im Hintergrund ist ein großes, stilisiertes Bild von Pferden zu sehen.

Our Block League bots now play on Hyperium and fill Station2 matches to 3v3, with smoother movement and less all-or-nothing shooting. Quikbild now accepts oe for œ and ae for ä, and the hub's volleyball court is now a parkour course

https://aes.land/en/light/blog/2026_10_15-changelog/

#Luanti #Gaming #Videogames #FreeSoftware #GameDev #OpenSource

Strata has released version 1.0, its first stable milestone.

Built in Rust and GTK4, the open-source file manager features icon grid, list, and Miller column layouts, alongside Vim-style keyboard navigation and fuzzy filename searching.

Version 1.0 introduces keyboard-accessible tabs with session restoration, improved drag-and-drop handling, and large directory optimizations.

Previews are sandboxed using Bubblewrap.

https://en.hacks.gr/kykloforise-i-proti-statheri-ekdosi-1-0-toy-strata-gia-linux/

#Linux #Rust #GTK4 #OpenSource

Alt...

Κυκλοφόρησε η πρώτη σταθερή έκδοση 1.0 του Strata για Linux

New in #LibreOffice 26.8: Mixed page sizes – Impress and Draw can now use different page sizes within the same document – a long-requested feature for more flexible presentations. https://wiki.documentfoundation.org/ReleaseNotes/26.8 #foss #opensource #freesoftware

#proxmox #pve #opensource

Dank „Vibe-Coding“: Epic veröffentlicht neuen Launcher auch für Linux

Dank kräftiger Hilfe von KI-Agenten gibt es den neuen Launcher für den Epic Games Store als Preview auch für Linux. Auch Fortnite soll jetzt portiert werden.

https://www.heise.de/news/Dank-Vibe-Coding-Epic-veroeffentlicht-neuen-Launcher-auch-fuer-Linux-11489203.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Entertainment #EpicGames #Spiele #Linux #LinuxGaming #OpenSource #news