New in #LibreOffice 26.8: More descriptive fields – Displaying field names now includes clearer descriptions for document statistics fields, making complex documents easier to understand. https://wiki.documentfoundation.org/ReleaseNotes/26.8 #foss #opensource #freesoftware

#GNOME 50.6 Desktop Environment Released with Fixes for Nautilus, GNOME Shell, Mutter, and Orca https://9to5linux.com/gnome-50-6-desktop-environment-released-with-fixes-for-nautilus-gnome-shell

@gnome #Linux #OpenSource #FOSS

Alt...

GNOME 50.6

In front in the beautiful blue color you can see my SBC powering the playback of this Jazz masterpiece

https://mastodon.bsd.cafe/@Dendrobatus_Azureus/117457433608555207

#SBC #Pi5 #Raspberry #Linux #POSIX #opensource #programming

The week, it seems, is getting worse by the second. I will use my magic to curse Torvald, such should be how we deal with the techno-fascists who abet genocide, and shamelessly, gluttonously ruin the entire experience of life for others. He is going to become TorBALD very soon, inshallah.

(Omitting the 'S' from Torvalds because he is only half a man, much less many. Hallelujah.)

#noai #FOSS #linux #ai #generativeAI #llm #fascism #technofascism #opensource #torvalds

ImpressCMS 2.0.4 Beta is now available for testing

What's new:
- Internal link service with a CKEditor plugin
- Session keep-alive for logged-in users

What's fixed:
- Array config values no longer reading as empty
- System module updates resetting the db version to 47
- Login redirect logic
- CSRF protections improved

This is a pre-release. Please back up and test on a staging site, then report issues on GitHub.

More info: https://www.impresscms.org/modules/news/article.php?article_id=1067&title=imprescms-204-beta-released

#ImpressCMS #OpenSource #CMS #PHP #FOSS

Alt...

ImpressCMS logo with an orange speech bubble reading “2.0.4 Beta”. Text: “Pre-release. Ready for testing.” Features: CKEditor internal links, session keep-alive, CSRF hardening, bug fixes.

🎰 Linux kernel devs drop obligatory confession of AI tool usage

"The Maintainers Summit reached consensus to deprecate the Assisted-by Tag," said Sasha Levin, a Linux kernel developer and engineer at Nvidia, in a message to the Linux kernel mailing list last week. "Remove the documentation requiring it."

https://www.theregister.com/ai-and-ml/2026/10/14/linux-kernel-devs-drop-obligatory-confession-of-ai-tool-usage/5303140

#linux #kernel #ai #vibecoding #opensource

Mein Umzug auf einen neuen #PasswortManager (Open Source) | c't Magazin https://www.heise.de/news/Mein-Umzug-auf-einen-neuen-Passwort-Manager-Open-Source-11474408.html #Datenschutz #privacy #Bitwarden #Passbolt #PasswordSafe #Psono #KeePass #ProtonPass #Android #iOS #Windows #macOS #Linux #OpenSource #DigitalSovereignty #PasswordManager

Security Advisory: CVE-2025-60492 - Uncontrolled Recursion in GPAC/MP4Box

Processing a crafted MP4 file with specially constructed BIFS scene data causes unbounded recursion between BIFS decoder functions, exhausting the stack and crashing MP4Box.

Summary:
The `gf_bifs_dec_node` function in `bifs/field_decode.c` decodes MPEG-4 BIFS scene nodes by calling `BD_DecMFFieldList`, `gf_bifs_dec_field`, and `gf_bifs_dec_node_list`, which in turn call back into `gf_bifs_dec_node`. A crafted MP4 file with deeply or cyclically nested BIFS containers triggers this mutual recursion without a depth limit, consuming all available stack memory and crashing the process with a stack-overflow signal.

CWE:
CWE-674 - Uncontrolled Recursion

Affected Component:
```
bifs/field_decode.c:905
Function: gf_bifs_dec_node()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1687-ge44a4e2b0-master; commit `e44a4e2b0d193566619ada71599e70255699da94`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file whose embedded BIFS scene data contains deeply nested or mutually referencing node containers. Local access is required; the victim must invoke `MP4Box -x3d <crafted_file>` or any equivalent BIFS scene export command that triggers the recursive decoder path.

Impact:
The uncontrolled recursion exhausts the process stack, resulting in an immediate crash and Denial of Service. No evidence of arbitrary code execution was observed; stack-exhaustion crashes via recursion do not provide an exploitable control-flow primitive.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
8e7b9a3a04331286b89d1803c65a2d6edc11b4c4
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3324
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/59/59_Anchor_Create_scenegraph_mpeg4_nodes_c_171
- Fix: https://github.com/gpac/gpac/commit/8e7b9a3a04331286b89d1803c65a2d6edc11b4c4

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60488 - NULL Pointer Dereference in GPAC/MP4Box

Processing a crafted MP4 file with a missing Sample Description box triggers a NULL pointer dereference in `dump_isom_saps`, causing MP4Box to crash.

Summary:
The `dump_isom_saps` function in `applications/mp4box/filedump.c` iterates over track metadata to dump SAP (Sync Access Point) information. When the input MP4 contains a corrupted track structure where the Sample Description box (`stsd`) is absent, the function accesses track metadata pointers without prior validation, dereferencing a near-NULL address (0x1c, 28-byte struct offset) and triggering SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
applications/mp4box/filedump.c:1743
Function: dump_isom_saps()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1672-gc9a31d0e1-master; commit `c9a31d0e1b649a30814c6d81c5461859ed63d075`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file whose track structure lacks a valid `stsd` box. Local access is required; the victim must invoke `MP4Box -dsap 1 <crafted_file>` or any equivalent SAP analysis command that exercises the SAP dump path.

Impact:
The near-NULL pointer dereference (READ at address 0x00000000001c) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a near-NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e6d01820d7bf3967d931fedb379ee5f209bc133b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3321
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/57/57_dump_isom_saps_filedump_c_1743
- Fix: https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Any #opensource printers yet?

I need a new one but i dont want to be locked in or pay a fortune on ink. Was thinking about those thermal printers bus most if not all require sus apps

#hivemind #printers

Security Advisory: CVE-2025-60487 - NULL Pointer Dereference in GPAC/MP4Box

Processing an empty XML file with the `-dnal` option triggers a NULL pointer dereference in `gf_isom_get_esd`, causing MP4Box to crash.

Summary:
The `gf_isom_get_esd` function in `isomedia/isom_read.c` retrieves an Elementary Stream Descriptor for a given track. When processing an empty file with an `.xml` extension, the ISO media layer lacks a valid media descriptor structure; the function dereferences a near-NULL pointer at address 0x50 (80-byte struct offset) without validating the pointer beforehand, terminating the process with SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
isomedia/isom_read.c:1386
Function: gf_isom_get_esd()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1665-g3f20eb0cd-master; commit `3f20eb0cd22116367c036e6ffe6ace299b38d686`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies an empty or minimal file with an `.xml` extension. Local access is required; the victim must invoke `MP4Box -dnal 1 <crafted_file>.xml` or any equivalent NAL dump command that triggers the ESD retrieval path on an uninitialized media context.

Impact:
The near-NULL pointer dereference (READ at address 0x000000000050) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a near-NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e6d01820d7bf3967d931fedb379ee5f209bc133b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3320
- PoC: N/A (see issue)
- Fix: https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60490 - Use-After-Free in GPAC/MP4Box

Processing a crafted MPEG-2 Transport Stream file triggers a heap use-after-free in `gf_filter_pid_send_event_downstream` when a freed PID instance is accessed during event propagation.

Summary:
When parsing a crafted MPEG-2 TS file with malformed PMT descriptors and sync marker violations, `gf_filter_pid_inst_swap_delete` frees a PID instance at `filter_pid.c:551`. A stale reference to this freed 344-byte region is subsequently read in `gf_filter_pid_send_event_downstream` at line 7919 (READ of 8 bytes at offset 0 of the freed object) because the pointer is not cleared after deallocation.

CWE:
CWE-416 - Use After Free

Affected Component:
```
filter_core/filter_pid.c:7919
Function: gf_filter_pid_send_event_downstream()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1665-g3f20eb0cd-master; commit `3f20eb0cd22116367c036e6ffe6ace299b38d686`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MPEG-2 TS file containing broken PMT descriptor sizes, unsupported stream types, and missing sync markers. Local access is required; the victim must invoke `MP4Box -add <crafted_file> -new /dev/null` or any equivalent import command that triggers the filter PID event propagation path.

Impact:
The use-after-free (READ of size 8 at offset 0 inside a freed 344-byte heap region) results in process termination, causing Denial of Service. Arbitrary code execution is possible; the first MITRE request explicitly marks code execution impact as true, and use-after-free vulnerabilities at the start of a controlled heap object are a known code-execution primitive.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
d0793f92e04fe284a25c2a9335cc5edc68deb6d4
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3315
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/54/54_gf_filter_pid_send_event_downstream_filter_core_filter_pid_c_7919
- Fix: https://github.com/gpac/gpac/commit/d0793f92e04fe284a25c2a9335cc5edc68deb6d4

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60478 - Heap Use-After-Free in GPAC Packet Destruction

Processing a crafted MPEG-2 TS input with MP4Box DASH segmentation can trigger a heap use-after-free in `gf_filter_packet_destroy()`.

Summary:
Malformed program table data and empty DASH segment state can cause GPAC to mishandle packet ownership. The file output and PID packet drop path later destroy a packet object that has already been invalidated.

AddressSanitizer reports `heap-use-after-free` in `filter_core/filter_pck.c`.

CWE:
CWE-416 - Use After Free

Affected Component:
```
filter_core/filter_pck.c:678
Function: gf_filter_packet_destroy()
```

Relevant ASAN stack:

```
gf_filter_packet_destroy filter_core/filter_pck.c:678
gf_filter_packet_destroy filter_core/filter_pck.c:684
gf_filter_pid_drop_packet filter_core/filter_pid.c:7270
fileout_process filters/out_file.c:933
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
GPAC version: 2.5-DEV-rev1617-g856674b22-master
Commit: 856674b226d6cbe28a941ad223be38194cbf7d37
```

Attack Conditions:
An attacker supplies a crafted MPEG-2 TS file that is processed by MP4Box DASH segmentation:

```
./MP4Box -dash 100 47_gf_filter_packet_destroy_filter_core_filter_pck_c_678
```

Impact:
The observed impact is Denial of Service. Because the issue is a heap use-after-free, memory corruption risk is also present.

Fix / mitigation status:
The MITRE response in the local data records the fix as:

```
c592a144bbe339ee581ca88aaa3247362795b742
```

References:

- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60478
- Issue: https://github.com/gpac/gpac/issues/3300
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/47/47_gf_filter_packet_destroy_filter_core_filter_pck_c_678
- Fix: https://github.com/gpac/gpac/commit/c592a144bbe339ee581ca88aaa3247362795b742

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60482 - Use-After-Free in GPAC MP4Box AC-4 Descriptor Cleanup

Processing a crafted AC-4 stream with MP4Box can trigger a heap use-after-free in `gf_odf_ac4_cfg_clean_list()`.

Summary:
The recursive AC-4 descriptor cleanup path can revisit or count a list object that has already been freed. When MP4Box imports a crafted AC-4 input, descriptor destruction reaches `gf_odf_ac4_cfg_clean_list()` and then `gf_list_count()` on stale heap memory.

AddressSanitizer reports `heap-use-after-free`.

CWE:
CWE-416 - Use After Free

Affected Component:
```
odf/descriptors.c:2411
Function: gf_odf_ac4_cfg_clean_list()

utils/list.c:664
Function: gf_list_count()
```

Relevant ASAN stack:

```
gf_list_count utils/list.c:664
gf_odf_ac4_cfg_clean_list odf/descriptors.c:2411
gf_odf_ac4_cfg_clean_list odf/descriptors.c:2400
dac4_box_del isomedia/box_code_base.c:9218
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
GPAC version: 2.5-DEV-rev1593-gfe88c3545-master
Commit: fe88c3545aadd597b250ccf23271d5d3de50ccc8
```

Attack Conditions:
An attacker supplies a crafted AC-4 file that is imported by MP4Box:

```
./MP4Box -add 46_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2411 -new /dev/null
```

Impact:
The observed impact is Denial of Service. Because the bug is a heap use-after-free, memory corruption risk is also present.

Fix / mitigation status:
The MITRE response in the local data records the fix as:

```
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
```

References:

- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60482
- Issue: https://github.com/gpac/gpac/issues/3297
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/46/46_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2411
- Fix: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60470 - Out-of-Bounds Read in GPAC MP4Box AC-4 Parser

An out-of-bounds read vulnerability exists in GPAC MP4Box when processing a crafted AC-4 stream. The issue occurs in `gf_ac4_parser_bs()` in `media_tools/av_parsers.c` and is reachable during media import through MP4Box commands such as `-info`.

Summary:
AddressSanitizer confirms a global-buffer-overflow at `media_tools/av_parsers.c:16137`. The parser reads 4 bytes past the end of the global `AC4_SAMPLE_DELTA_TABLE_441` array due to insufficient bounds checking of AC-4 sample delta table indexes.

The crafted AC-4 stream causes the AC-4 parser to access `AC4_SAMPLE_DELTA_TABLE_441` with an out-of-bounds index. The invalid read occurs while probing the AC-4 stream and then propagates through the MP4Box media import path.

Relevant AddressSanitizer trace:

```
==1845261==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f4214ddf8fc
READ of size 4 at 0x7f4214ddf8fc thread T0
#0 0x... in gf_ac4_parser_bs media_tools/av_parsers.c:16137
#1 0x... in ac4dmx_probe_data filters/reframe_ac4.c:546
#2 0x... in gf_filter_pid_raw_new filter_core/filter.c:4704
#3 0x... in filein_process filters/in_file.c:610
#4 0x... in gf_filter_process_task filter_core/filter.c:3187
#5 0x... in gf_fs_thread_proc filter_core/filter_session.c:2421
#6 0x... in gf_fs_run filter_core/filter_session.c:2728
#7 0x... in gf_media_import media_tools/media_import.c:1278
#8 0x... in convert_file_info applications/mp4box/fileimport.c:131
#9 0x... in mp4box_main applications/mp4box/mp4box.c:6520

0x7f4214ddf8fc is located 36 bytes before global variable 'AC4_SAMPLE_DELTA_TABLE_48'
defined in 'media_tools/av_parsers.c:14246:11' of size 56
0x7f4214ddf8fc is located 4 bytes after global variable 'AC4_SAMPLE_DELTA_TABLE_441'
defined in 'media_tools/av_parsers.c:14263:11' of size 56

SUMMARY: AddressSanitizer: global-buffer-overflow media_tools/av_parsers.c:16137 in gf_ac4_parser_bs
```

CWE:
CWE-125 - Out-of-bounds Read

Affected Component:
```
media_tools/av_parsers.c:16137
Function: gf_ac4_parser_bs()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
2.5-DEV-rev1593-gfe88c3545-master
Commit: fe88c3545aadd597b250ccf23271d5d3de50ccc8
```

Attack Conditions:
An attacker supplies a crafted input file that is processed by MP4Box. The issue can be reproduced locally with:
```
./MP4Box -info 43_gf_ac4_parser_bs_media_tools_av_parsers_c_16137
```

Attack vector: local crafted AC-4 file processed by MP4Box
User interaction: required

Impact:
denial of service via application crash

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3294
- Fix: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/43/43_gf_ac4_parser_bs_media_tools_av_parsers_c_16137
- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60470

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60476 - Heap Use-After-Free in GPAC MP4Box AC-4 Descriptor Cleanup

A heap use-after-free vulnerability exists in GPAC MP4Box when processing a crafted AC-4 file. The issue occurs in `gf_odf_ac4_cfg_clean_list()` in `odf/descriptors.c` during recursive cleanup of AC-4 configuration lists.

Summary:
AddressSanitizer confirms a heap-use-after-free at `odf/descriptors.c:2419`. The cleanup code accesses a list node after it has already been freed in a recursive cleanup path, causing MP4Box to crash.

The crafted AC-4 stream contains malformed configuration list data. During parsing and cleanup, `gf_odf_ac4_cfg_clean_list()` recursively destroys AC-4 configuration structures. A node is freed in a deeper cleanup level and later accessed again by the caller, resulting in a read from freed heap memory.

Relevant AddressSanitizer trace:

```
[AC4] Don't support presentation_version 0.
==1841011==ERROR: AddressSanitizer: heap-use-after-free on address 0x508000000470
READ of size 8 at 0x508000000470 thread T0
#0 0x... in gf_odf_ac4_cfg_clean_list odf/descriptors.c:2419
#1 0x... in gf_odf_ac4_cfg_clean_list odf/descriptors.c:2400
#2 0x... in gf_ac4_parser_bs media_tools/av_parsers.c:16101
#3 0x... in ac4dmx_process filters/reframe_ac4.c:388
#4 0x... in gf_filter_process_task filter_core/filter.c:3187
#5 0x... in gf_fs_thread_proc filter_core/filter_session.c:2421
#6 0x... in gf_fs_run filter_core/filter_session.c:2728
#7 0x... in gf_media_import media_tools/media_import.c:1278
#8 0x... in convert_file_info applications/mp4box/fileimport.c:131
#9 0x... in mp4box_main applications/mp4box/mp4box.c:6520

0x508000000470 is located 80 bytes inside of 88-byte region [0x508000000420,0x508000000478)
freed by thread T0 here:
#0 0x... in free
#1 0x... in gf_odf_ac4_cfg_clean_list odf/descriptors.c:2432
#2 0x... in gf_odf_ac4_cfg_clean_list odf/descriptors.c:2400

previously allocated by thread T0 here:
#0 0x... in malloc
#1 0x... in gf_ac4_raw_frame media_tools/av_parsers.c:15938
#2 0x... in gf_ac4_parser_bs media_tools/av_parsers.c:16113

SUMMARY: AddressSanitizer: heap-use-after-free odf/descriptors.c:2419 in gf_odf_ac4_cfg_clean_list
```

CWE:
CWE-416 - Use After Free

Affected Component:
```
odf/descriptors.c:2419
Function: gf_odf_ac4_cfg_clean_list()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
2.5-DEV-rev1593-gfe88c3545-master
Commit: fe88c3545aadd597b250ccf23271d5d3de50ccc8
```

Attack Conditions:
An attacker supplies a crafted input file that is processed by MP4Box. The issue can be reproduced locally with:
```
./MP4Box -info 42_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2419
```

Attack vector: local crafted AC-4 file processed by MP4Box
User interaction: required

Impact:
denial of service via application crash; local MITRE data also identifies potential arbitrary code execution risk

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3293
- Fix: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/42/42_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2419
- BDU: https://bdu.fstec.ru/vul/2025-08612
- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60476

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

A new issue of This Week In GNOME is now online!

#270 Visualized Community
https://thisweek.gnome.org/posts/2026/10/twig-270/

#ThisWeekInGNOME #FreeSoftware #FOSS #OpenSource

Security Advisory: CVE-2025-60469 - NULL Pointer Dereference in GPAC MP4Box AC-4 Parser

A NULL pointer dereference vulnerability exists in GPAC MP4Box when processing a crafted AC-4 stream. The issue occurs in `gf_ac4_presentation_ch_mode()` in `media_tools/av_parsers.c` and can be triggered by running MP4Box with the `-info` option on a malformed input file.

Summary:
AddressSanitizer confirms a segmentation fault at `media_tools/av_parsers.c:15641`. The parser attempts to read through a NULL or invalid pointer while handling an AC-4 stream with unsupported `presentation_version` and missing substream group information.

The crafted AC-4 stream declares an unsupported presentation version and omits required substream group data. MP4Box reports that `presentation_version 0` is unsupported and that substream group `1` cannot be found for presentation `0`. The error path then reaches `gf_ac4_presentation_ch_mode()` and dereferences an invalid pointer, resulting in a segmentation fault.

Relevant AddressSanitizer trace:

```
[AC4] Don't support presentation_version 0.
[AC4] Cannot find substream group 1 for presentation 0
AddressSanitizer:DEADLYSIGNAL
==1829578==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000048
==1829578==The signal is caused by a READ memory access.
==1829578==Hint: address points to the zero page.
#0 0x... in gf_ac4_presentation_ch_mode media_tools/av_parsers.c:15641
#1 0x... in gf_ac4_raw_frame media_tools/av_parsers.c:15976
#2 0x... in gf_ac4_parser_bs media_tools/av_parsers.c:16113
#3 0x... in ac4dmx_process filters/reframe_ac4.c:388
#4 0x... in gf_filter_process_task filter_core/filter.c:3187
#5 0x... in gf_fs_thread_proc filter_core/filter_session.c:2421
#6 0x... in gf_fs_run filter_core/filter_session.c:2728
#7 0x... in gf_media_import media_tools/media_import.c:1278
#8 0x... in convert_file_info applications/mp4box/fileimport.c:131
#9 0x... in mp4box_main applications/mp4box/mp4box.c:6520

SUMMARY: AddressSanitizer: SEGV media_tools/av_parsers.c:15641 in gf_ac4_presentation_ch_mode
```

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
media_tools/av_parsers.c:15641
Function: gf_ac4_presentation_ch_mode()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
2.5-DEV-rev1593-gfe88c3545-master
Commit: fe88c3545aadd597b250ccf23271d5d3de50ccc8
```

Attack Conditions:
An attacker supplies a crafted input file that is processed by MP4Box. The issue can be reproduced locally with:
```
./MP4Box -info 41_gf_ac4_presentation_ch_mode_media_tools_av_parsers_c_15641
```

Attack vector: local crafted AC-4 file processed by MP4Box
User interaction: required

The prepared CVSS vector in the local data is:
```
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
```

Impact:
denial of service via application crash

Base score: 5.5, Medium.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3292
- Fix: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/41/41_gf_ac4_presentation_ch_mode_media_tools_av_parsers_c_15641
- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60469

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

🐧 Artikelreihe: Der Umstieg von TUXEDO OS auf Debian Testing

Ihr möchtet mehr über TUXEDO OS erfahren? Wir haben unsere bisherigen Artikel für euch zusammengestellt!

🔎 Was interessiert euch besonders: TUXEDO OS für Entwickler oder digitale Souveränität?

Viel Spaß beim Lesen!

👉 https://www.tuxedocomputers.com/de/Infos/News.tuxedo?tuxpage=1&tuxsort=false,true#2296,12591

#TUXEDO #Linux #Debian #OpenSource

Alt...

Schwarzer Kreis mit einem weißen, geometrisch stilisierten X in der Mitte, umgeben von einer breiten roten Pinselspirale, die teilweise überlappt.

Ich habe einen neuen Podcast: NET⫽SPLIT

Jetzt ist es offiziell, @daniel und ich haben zusammen einen #Podcast, @netsplit \o/

Geplant ist ein Laberpodcast rund um #OpenSource und Dezentralität, auch wenn die ganz genaue Ausrichtung noch nicht 100% fest steht.

Den Podcast veröffentlichen wir als Video- und Audio-Format über #PeerTube und natürlich auch #RSS und es kommt jeden Monat eine neue Folge raus.

Ich bin mega happy mit dem Projekt und ich hoffe, ihr schaut oder hört mal rein. Alle Abo-Möglichkeiten findet ihr auf unserer Website zusammen gefasst:

https://netsplit.fm/

P.S.: An alle @rebootpolitics -Fans, keine Sorge, mein geliebter Politik-Podcast läuft natürlich auch weiter und wir planen aktuell wieder neue Interviews und anderen Schabernack.

#NetSplit #RebootPolitics #Fediverse #XMPP

Alt...

Das NET⫽SPLIT-Cover. Links stehe ich, rechts Daniel und wir lächeln beide in dieKamera. Im Vordergrund ein weißer Schriftzug auf beerenfarbenen und mittelgrünem Grund: "NET⫽SPLIT, Ein Podcast mit Ückück und Daniel". Der Hintergrund ist leicht geblurt und in dunkelgrau gefärbt.

Dzięki za głosy w ankiecie! Wyniki są jasne: 75% z Was woli zostawić komentowanie na Mastodonie.

Myślałem o opcji hybrydowej z użyciem `mastodon-comments` (osadzenie dyskusji pod artykułem), ale idąc za Waszym głosem, po prostu odpuszczam temat.

Dyskusja kwitnie w Fediwersum i niech tam zostanie. Dzięki za pomoc w decyzji! 👋

#prywatność #opensource #privacy

🗳️ OWASP Board Election voting is OPEN!

3 Board seats are up for election. Make your voice heard and help shape OWASP’s future!

📩 Check your personal and OWASP email for your ballot.

⏰ Closes Oct 30, midnight UTC.

Vote now: https://owasp.org/board/elections/2026

#community #opensource #boardelections

Wine 11.20 brings more improvements for ARM64EC, XML validation and CDROMs https://www.gamingonlinux.com/2026/10/wine-11-20-brings-more-improvements-for-arm64ec-xml-validation-and-cdroms/

#Wine #OpenSource #Linux

Ich habe in den letzten zwei Monaten eine #Skill Suite für Continuous Refactoring gebaut. Sie funktioniert mit allen gängigen Agenten von #OpenCode, #ClaudeCode, #Cursor usw. Version 0.7.0 hat einen guten Schritt nach vorne gemacht, weshalb ich sie euch heute vorstellen möchte.

Schaut sie euch an unter https://continuous-refactoring.de/

#OpenSource #AgenticEngineering

There are decisions you don’t like to make—and you like implementing them even less. Take choosing an operating system, for example. Unfortunately, it’s not very productive to insist on open-source systems if they don’t work flawlessly on your own hardware.

Take, for example, my new Asus NUC 16 Pro with an Intel Ultra X7 processor and its built-in (soldered) components. The only Linux distribution that runs smoothly on it is Fedora. However, for political reasons (the U.S.), I no longer want to use it (although, from a user’s perspective, I do miss it—it’s simply the best Linux, period). But I haven’t been able to get U.S.-independent distributions like Debian to run properly on it; in some cases, the system wasn’t even recognized when I tried installing them from a USB drive. Another new experience… but then again, I’ve never had such relatively brand-new hardware that also requires a cutting-edge kernel. Maybe Ubuntu would work, but I don’t like Ubuntu or Canonical. That’s why I’m running Windows 11 Pro on it. Reluctantly, but everything works.

The same goes for my old ThinkPad T490s. Everything works wonderfully with any Linux distribution—except for the 5G modem. And I need that when I’m on the go. There’s no workaround for it either; I’ve probably scoured the entire web for one, but not a single tip helped. So here, too: Windows...

Now I actually have two Windows computers running again, for the sake of my sanity and to save time. At least I’m using only local accounts and the strictest possible privacy settings and tweaks you can apply to Windows. And I only use those two computers when necessary.

Most of my work continues to run on my two Debian systems, the FreeBSD computer, and, when necessary, on the Mac as well.

Still, it leaves a bad taste in my mouth, but I don’t want to let the devices sit around unused.

Is it just me, or are there others who feel torn like this???

#linux #opensource #freesoftware #windows #fedora #debian #freebsd #ubuntu #apple #usa

🚀 Fusion 1.2 is here!

What if your Laravel Eloquent models could work with Markdown files, not just database tables?

With Fusion, you can bring the power of Eloquent to Markdown-based content while keeping the Laravel experience you already know.

🔗 https://github.com/Hi-Folks/fusion

#laravel #markdown #eloquent #model #opensource #programming

#Ubuntu Touch OTA 2.1 Rolls Out with Support for Volla Tablet and Various Improvements https://9to5linux.com/ubuntu-touch-ota-2-1-rolls-out-with-support-for-volla-tablet-various-updates

@ubports #Linux #OpenSource #UbuntuTouch

Alt...

A screenshot of Ubuntu Touch's boot splash screen

30 Jahre #KDE : Plasma 6.8 setzt komplett auf #Wayland | heise online https://www.heise.de/news/KDE-Plasma-6-8-offeriert-nur-noch-Wayland-Sitzung-11487974.html #Linux #OpenSource

#PeaZip 11.4 Open-Source Archive Manager Released with Various Improvements and Bug Fixes https://9to5linux.com/peazip-11-4-open-source-archive-manager-released-with-various-improvements

#OpenSource #Linux #FreeSoftware

Alt...

A screenshot of PeaZip showing the built-in file manager.

The Wine 11.20 development release is out now bringing another set of improvements for running Windows apps / games on SteamOS / Linux.
https://www.gamingonlinux.com/2026/10/wine-11-20-brings-more-improvements-for-arm64ec-xml-validation-and-cdroms/

#OpenSource #Wine #Misc

Guten Morgen

Manchmal denke ich, mein Rechner hat einen unsichtbaren Mitbewohner. Er räumt auf, während ich schlafe, sortiert den Arbeitsspeicher und hält die Lüfter leise. Ich sehe ihn nie, aber ich merke, dass er da ist. Sein Name steht ganz klein in der Ecke des Anmeldebildschirms, und wenn ich genauer hinsehe, steht dort Linux.

Vielleicht ist das der schönste Trick an freier Software. Sie arbeitet so unauffällig, dass man sie erst bemerkt, wenn man weiß, wonach man sucht. Kennst du das Gefühl, dass da jemand mitarbeitet, den man nie zu Gesicht bekommt?

#Linux #OpenSource #FOSS #FreieSoftware

Come find us today in Open Source Conference in Tokyo!!

Thank you to our community who have organised a booth for our first time in the conference!!

https://event.ospn.jp/osc2026-fall/

#tokyo #conference #opensource

Linus Torvalds nutzt jetzt KI für den Linux-Kernel. Seine erste mit einem Sprachmodell entwickelte Patch-Serie beschleunigt bestimmte Lesezugriffe im Benchmark um den Faktor 23, enthielt bei der Prüfung aber direkt eine gefährliche Race Conditoin. Die Projektbetreuer streichen parallel die KI-Kennzeichnungspflicht, weil am Ende ohnehin der Mensch für seinen Code haftet. #Linux #OpenSource #KI #Programmierung

https://www.all-ai.de/news/news26/linux-ki-patch

If you ship open source to DoW: DoWI 8430.01 (effective September 8, 2026) requires SBOMs for all covered software, including transitive dependencies (§3.5.b), and a risk review of third-party and open source components (§3.5.i(2)).

On our side, Anchore Enterprise generates SBOMs at every build and imports vendor SBOMs. Here's the mapping:

https://anchore.com/blog/dow-instruction-8430-01-makes-software-evidence-a-condition-to-operate/

#SBOM #OpenSource #SoftwareSupplyChain

Linux users, let’s settle this.

Name one distro better than Arch Linux.

#Linux #LinuxDistro #OpenSource

Le teasing est terminé : ça pique, comme promis ! 🔥🚀
Mon nouveau service auto-hébergé est en ligne : Notesnook, des notes chiffrées de bout en bout, synchronisées sur tous vos appareils (navigateur, ordinateur, Android).

👉 Utiliser mon instance : https://wiki.blablalinux.be/fr/tutoriels-notesnook-utiliser-instance-blablalinux
🛠️ L'installer chez vous : https://wiki.blablalinux.be/fr/tutoriels-notesnook-installer-sur-son-serveur
🌐 Tous mes services : https://blablalinux.be/mes-services-publics/

#Notesnook #SelfHosting #AutoHébergement #OpenSource

Wine has updated to version wine-11.20. Check it out here: https://gitlab.winehq.org/wine/wine/-/releases/wine-11.20
#linux #foss #OpenSource

💾 Neue Möglichkeiten fürs N64!
Das SummerCart64 ist eine günstige, offene Alternative zu EverDrive & Co. – inkl. 64DD-Support, USB-Funktion, mp3-Player & mehr!
Für alle Bastler und Retro-Fans ein echter Geheimtipp 💡
➡️ Jetzt mehr erfahren: https://www.jungsi.de/summercart64-nintendo-64/
#Nintendo64 #Flashcart #RetroGaming #SummerCart64 #64DD #OpenSource #N64 #EverDriveAlternative

cve-watch 0.1.0

Fiz um monitor de vulnerabilidades críticas pra infra bolha-gcn e abri o código.

Ele consulta NVD, CISA KEV, avisos de segurança do GitHub e o tracker do Debian, e só avisa quando aparece algo crítico (CVSS ≥ 9 ou algo com exploração ativa confirmada) nos produtos que você lista.

Cada alerta diz:

• quando a falha foi publicada e há quantos dias
• se já existe versão corrigida (upstream e Debian)
• o link do aviso oficial

Notificações:

• Suporte a Mastodon (DM)
• Mattermost (canal)
• E-mail

Características:

• Python puro, sem dependências;
• Roda no cron
• Arquivo de configuração TOML para produtos e canais de monitoramento

Opcional:

• Heartbeat no Uptime Kuma, pra você saber se ele parou de funcionar

Monitores Bolha/GCN:

Aqui ele monitora vulnerabilidades do kernel linux, Proxmox, QEMU, Rancher/RKE2, Mastodon, Docker, nginx e cia.

Liçenca

• MIT

Source

• https://gitlab.gutocarvalho.net/open/cve-watch

#selfhosting #security #opensource #sysadmin

Kachelfenster und ich sind nie richtig Freunde geworden. Ich habe es mehrfach probiert, jedes Mal mit der besten Absicht, aber nach ein paar Tagen bin ich wieder bei den schwebenden Fenstern gelandet. Der Einstieg ist steil, bis die vielen Tastenkürzel im Kopf bleiben, vergeht eine Weile, und in dieser Zeit fühlt sich jeder Handgriff wie Suchen an. Ständig fehlte mir die gewohnte Bewegung mit der Maus, mit der ich ein Fenster einfach greife und dorthin ziehe, wo ich es gerade brauche. Bei mehreren Monitoren wurde es dann endgültig unübersichtlich, ich verlor den Überblick, auf welchem Bildschirm ein Fenster gerade liegt.

Den Reiz sehe ich trotzdem. Für jemanden, der den ganzen Tag im Terminal arbeitet, viele Fenster gleichzeitig offen hält und alles über die Tastatur steuert, ist so ein festes Raster ein echter Gewinn. Da sitzt jeder Handgriff, nichts verdeckt etwas anderes, und die Effizienz ist deutlich höher. Mein Alltag ist aber breiter gestreut, mal Browser, mal Bildbearbeitung, mal ein kurzer Blick in eine Datei. Da war mir das strenge Raster zu sehr auf einen Arbeitsstil zugeschnitten. Vielleicht ist es eine Frage der Gewohnheit, doch ich glaube inzwischen, dass ein Kachelsystem eher etwas für Profis ist, die ihren Rechner beruflich auf ein Ziel hin nutzen. Für mich als Privatanwender war die Umstellung zu groß und der Gewinn zu selten.

Wie nutzt du deinen Bildschirm, lieber gekachelt und aufgeräumt oder frei und schwebend?

#Linux #TilingWM #OpenSource #FOSS

As Microsoft ends support for Publisher, The Document Foundation offers a seamless solution. Learn how LibreOffice can open and edit your legacy PUB files.

#LibreOffice #MicrosoftPublisher #OpenSource #DocumentFoundation #TechNews

https://dailytechnow.com/libreoffice-rescues-microsoft-publisher-users/

RE: https://nrw.social/@41352_Einfach_besser_leben/117434345795993586

Morgen bin ich auch mit am Start und unterstütze in der Linux-Sonderschicht. Interessierten Leuten Linux näher bringen und auf dem eigenen System installieren. So ist die Befreiung von der Seuche (aka Windows) etwas leichter.

Mein kleiner Beitrag an die Community.

#foss #opensource #ehrenamt #noBigTech #unterstützung #EndofLife #linux #windows

Wazuh (open-source XDR & SIEM) in v4.14.9 released

https://secburg.com/posts/wazuh-4149-released/

#Wazuh #SIEM #XDR #InfoSec #OpenSource

Security Advisory: CVE-2025-60479 - NULL Pointer Dereference in GPAC/MP4Box

Processing a crafted MPEG-4 file with broken BIFS vector fields triggers a NULL pointer dereference in `StatSFVec2f`, causing MP4Box to crash during scene statistics collection.

Summary:
The `StatSFVec2f` function in `scene_manager/scene_stats.c` collects statistics for SFVec2f fields in an MPEG-4 BIFS scene. When the scene contains a crafted broken vector field, the statistics traversal passes a NULL pointer to `StatSFVec2f` without validation. The function dereferences the pointer at address 0x0, terminating the process with SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
scene_manager/scene_stats.c:192
Function: StatSFVec2f()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1678-gb7ffd9f96-master; commit `b7ffd9f96bc188dde148300d8c4e510b557563aa`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MPEG-4 file containing a malformed BIFS scene with invalid SFVec2f vector field structures. Local access is required; the victim must invoke `MP4Box -nstat <crafted_file>` or any equivalent scene statistics command that triggers the scene analysis path.

Impact:
The NULL pointer dereference (READ at address 0x000000000000) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
75786eb61b7cc838b57c3d4f8004b4f13b5b724c
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3322
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/58/58_StatSFVec2f_scene_manager_scene_stats_c_192
- Fix: https://github.com/gpac/gpac/commit/75786eb61b7cc838b57c3d4f8004b4f13b5b724c

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60489 - NULL Pointer Dereference in GPAC/MP4Box

Processing a crafted MP4 file with corrupted DTS timing metadata triggers a NULL pointer dereference in `dasher_insert_timeline_entry`, causing MP4Box to crash during DASH timeline construction.

Summary:
The `dasher_insert_timeline_entry` function in `filters/dasher.c` accesses timeline entry structures during DASH segment processing. When the input MP4 has corrupted DTS sequence data that produces empty DASH segments, the dasher fails to validate a timeline entry pointer before dereferencing it at address 0xc (12-byte struct offset), leading to a near-NULL read and SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
filters/dasher.c:7760
Function: dasher_insert_timeline_entry()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1692-g23819fdc0-master; commit `23819fdc02be8d3e92f0ef84831625d51981d7d2`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file whose DTS timing metadata produces empty segments during DASH packaging. Local access is required; the victim must invoke `MP4Box -segment-timeline -dash 10000 <crafted_file>` or any equivalent DASH segmentation command using segment timeline mode.

Impact:
The near-NULL pointer dereference (READ at address 0x00000000000c) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a near-NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
4860a1a6f128ccc9ae37b4b738d22029f9672457
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3325
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/60/60_dasher_insert_timeline_entry_filters_dasher_c_7760
- Fix: https://github.com/gpac/gpac/commit/4860a1a6f128ccc9ae37b4b738d22029f9672457

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60491 - Use-After-Free in GPAC/MP4Box

Processing a crafted MPEG-2 TS file with corrupted PMT descriptors triggers a heap use-after-free in `dasher_flush_segment`, causing MP4Box to crash during DASH segmentation.

Summary:
The `dasher_configure_pid` function in `filters/dasher.c` frees a PID context structure at line 986 when reconfiguring a stream from a crafted MPEG-TS input. The freed pointer is not nullified, and `dasher_flush_segment` subsequently reads 4 bytes at offset 336 within that freed 1096-byte region at line 8062 during the segment flush cycle, constituting a heap-use-after-free.

CWE:
CWE-416 - Use After Free

Affected Component:
```
filters/dasher.c:8062
Function: dasher_flush_segment()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1698-gfc2009fa7-master; commit `fc2009fa75631960743f8f7855dda8998167b5ab`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MPEG-2 TS file containing broken PMT descriptor sizes, reused PIDs, and sync marker violations. Local access is required; the victim must invoke `MP4Box -dash 1000 <crafted_file>` or any equivalent DASH segmentation command that triggers PID reconfiguration in the dasher module.

Impact:
The use-after-free (READ of size 4 at 336 bytes into a freed 1096-byte heap region) causes process termination, resulting in Denial of Service. Code execution cannot be ruled out; use-after-free vulnerabilities allow an attacker to control freed memory contents and potentially redirect execution flow.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
f6128214feb69cd689e4b9944a2621bc4ad8faf0
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3326
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/61/61_dasher_flush_segment_filters_dasher_c_8062
- Fix: https://github.com/gpac/gpac/commit/f6128214feb69cd689e4b9944a2621bc4ad8faf0

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60497 - NULL Pointer Dereference in GPAC/MP4Box

Processing a crafted MP4 file with an invalid sample description entry triggers a NULL pointer dereference in `GetESD`, causing MP4Box to crash during scene loading.

Summary:
The `GetESD` function in `isomedia/track.c` retrieves an Elementary Stream Descriptor for a track sample description. When the input MP4 contains an unknown atom type (`avC9`) instead of a valid `avcC` entry in the sample description, the OD (Object Descriptor) loader still attempts to read the ES descriptor via `GetESD`, which dereferences a NULL pointer at address 0x0 without prior validation, terminating the process with SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
isomedia/track.c:107
Function: GetESD()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1780-g50b5741f2-master; commit `50b5741f291126b610c59db433fc02e8a17f0c5d`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file whose sample description (`stsd`) contains an unrecognized atom type in place of a valid AVC configuration box. Local access is required; the victim must invoke `MP4Box -svg <crafted_file>` or any equivalent scene export command that triggers ISO media scene loading and ESD retrieval.

Impact:
The NULL pointer dereference (READ at address 0x000000000000) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
91083fcfce01aa596a13a6962768d13a60bfc8bb
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3336
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/62/62_GetESD_isomedia_track_c_107
- Fix: https://github.com/gpac/gpac/commit/91083fcfce01aa596a13a6962768d13a60bfc8bb

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60494 - NULL Pointer Dereference in GPAC/MP4Box

Processing a crafted MP4 file triggers an invalid memory read in `gf_props_equal_internal` during PID property comparison, causing MP4Box to crash.

Summary:
The `gf_props_equal_internal` function in `filter_core/filter_props.c` compares PID property values using `memcmp`. When importing a crafted MP4 file, the property comparison path at line 867 passes an invalid pointer as one of the `memcmp` arguments; the resulting read-access violation at address 0x11166094 crashes the process with SIGSEGV before the comparison completes.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
filter_core/filter_props.c:867
Function: gf_props_equal_internal()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1699-g31becc9e0-master; commit `31becc9e08b88e525a4a62013a4000de1c0f8fd9`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file containing invalid or truncated ODF descriptors and box structures. Local access is required; the victim must invoke `MP4Box -add <crafted_file>` or any equivalent import command that triggers PID property initialisation and the property comparison path.

Impact:
The invalid memory read (SEGV READ at address 0x000011166094) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; neither MITRE response marks code execution impact for this specific vulnerability.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
fcb9083292befe61d3e2466b18edfedba49da098
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3329
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/64/64_gf_props_equal_internal_filter_core_filter_props_c_867
- Fix: https://github.com/gpac/gpac/commit/fcb9083292befe61d3e2466b18edfedba49da098

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60496 - Divide by Zero in GPAC/MP4Box

Splitting a truncated MP4 file with uninitialized stream parameters triggers a divide-by-zero in `reframer_send_packet`, causing MP4Box to crash with SIGFPE.

Summary:
The `reframer_send_packet` function in `filters/reframer.c` computes split boundaries using stream parameters such as timescale and estimated file size. When upstream parsing of a truncated MP4 leaves these values uninitialized (zero), the arithmetic at line 1026 performs a division by zero, raising SIGFPE and terminating the process immediately.

CWE:
CWE-369 - Divide By Zero

Affected Component:
```
filters/reframer.c:1026
Function: reframer_send_packet()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1780-g50b5741f2-master; commit `50b5741f291126b610c59db433fc02e8a17f0c5d`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a truncated MP4 file that causes the ISO media parser to leave stream parameters (timescale, file size estimate, or sample rate) at zero. Local access is required; the victim must invoke `MP4Box -split-size 8000 <crafted_file>` or any equivalent split command that triggers the reframer size-estimation path.

Impact:
The divide-by-zero (SIGFPE) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; floating-point exceptions of this type are not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
f03c946aae129980f0426d4cbae9746d0536fee6
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3334
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/65/65_reframer_send_packet_filters_reframer_c_1026
- Fix: https://github.com/gpac/gpac/commit/f03c946aae129980f0426d4cbae9746d0536fee6

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

RT @TencentHunyuan: TRANSLASATION: 🚀 Hy Memory 2.0 ist da – open-source Modell, Framework und MemHub. Ihr privater Gedächtnisverwalter. Das Framework verarbeitet Chat-, Arbeits- und Code-Gedächtnisse. #1 unter den open-source Lösungen auf 4 Benchmarks. Hy-Memory-30B-A3B schlägt Opus 5 in den meisten Frameworks. MemHub (CLI + Mac) synchronisiert mit über 10 KI-Tools. https://t.co/Z79ZGcc2gj

mehr auf Arint.info

#HyMemory #KIGedächtnis #KIInnovation #MemHub #OpenSource #PrivateSpeicherung #arint_info

https://x.com/TencentHunyuan/status/2111027329816465435

RT @perplexity_ai: Wir machen SPACE, die Sandbox-Plattform, die jede Aufgabe in Perplexity Computer ausführt, quelloffen. SPACE gibt jeder Agent-Aufgabe ihre eigene Firecracker-Mikrovirtualisierungsinstanz und steuert Zugriffsrechte und ausgehenden Datenverkehr von außerhalb der VM. Jetzt verfügbar unter der Apache-2.0-Lizenz: https://t.co/DzSmq6o1xA

mehr auf Arint.info

#AI #Apache2 #MicroVM #OpenSource #Perplexity #SPACE #arint_info

https://x.com/perplexity_ai/status/2110778478312481167

Small one in Matomo core.

Someone else had already found the fix. GitHub issue #25147: https://github.com/matomo-org/matomo/issues/25147 - searching for lowercase öppettider did not find Öppettider, Swedish å/ä/ö just do not fold across case under a plain ASCII regex. The reporter pasted the exact one-line patch himself, add a u flag next to the existing i.

I turned that into an actual pull request: the flag change, a docblock explaining why /i alone was not enough, and a test covering å/ä/ö in both directions.

Merged into 6.x-dev today by chippison. PR: https://github.com/matomo-org/matomo/pull/25159

#Matomo #OpenSource #PHP #Unicode #WebDev #OSS

Alt...

Merged into Matomo

Libreboot startet jetzt auch per UEFI durch

Windows 11 per UEFI starten: Libreboot stellt seinen Bootweg um und unterstützt deutlich mehr Hardware – teils vorerst nur zum Selbstbauen.

https://www.heise.de/news/Libreboot-startet-jetzt-auch-per-UEFI-durch-11491142.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Chromebook #Firmware #IT #Linux #OpenSource #UEFI #Windows #news

Canonical officially launches Ubuntu 26.10 Stonking Stingray. Discover the new GNOME 51 desktop, Rust core tools, and advanced security enhancements.

#Ubuntu #Linux #StonkingStingray #GNOME #OpenSource

https://dailytechnow.com/canonical-releases-ubuntu-26-10-stonking-stingray/

This mockup is the design touchstone for Agora -- it's the visual design language it's pursuing.

#programming #linux #freeBSD #openBSD #wayland #opensource #floss

Introducing the Accessible Components Library from @TetraLogical!

https://tetralogical.com/blog/2026/10/14/accessible-components-library/

Eight common components with documented accessibility requirements, test scenarios, and working automated tests that check them.

• Free to use and adapt
• Human-readable tests written in Gherkin
• Mapped to WCAG 2.2, levels A to AAA

#Accessibility #OpenSource #WCAG #AccessibleComponents

Alt...

The text “Introducing the TetraLogical Accessible Components Library” with a pink building Lego block with four circular studs on top. On the side of the block, there are coding symbols (a left angle bracket, a slash, and a right angle bracket) in orange and purple. The TetraLogical logo appears at the bottom right.

New post: Open Tabs CW42/2026

Defrosting fridges and more strange AI topics this week.

https://stoeps.de/posts/2026/open-tabs-cw42/

Reply to this toot to leave a comment - replies will appear below the article automatically.

#omb #ai #escape #ghost #homework #opensource #politics #sandbox #security #stupidity

🛡️ secdb-cli 0.7.0 is out.

It's the open source command-line client for ZEN SecDB: CVE lookup, SSVC, and auditing of packages, SBOMs, dependency manifests, Linux hosts and Docker images.

What's new:

- secdb search: full-text search across CVEs, CWEs, security advisories, NASL plugins and ExploitDB entries. Filter by record type and by date, combine terms with OR, exclude them, search exact phrases. CVEs in the CISA KEV catalog are marked, and every result links to its record.

- --jq: filter the JSON output of any command with a jq expression, without installing jq. Handy in CI images and on Windows.

- Safer terminal output: control characters coming from third-party feed data are stripped before they reach your terminal.

Examples:
secdb search fortinet kev:true --since 30d
secdb search '"remote code execution"' --type cve
secdb audit sbom --file bom.json --fail-on high --jq '.[].advisories[].id'

💾 Binaries for Linux, macOS and Windows:
https://github.com/giterlizzi/secdb-cli/releases/tag/v0.7.0

#InfoSec #VulnerabilityManagement #OpenSource #Golang #CVE #NTTDATA #ZENSecDB

Remember Windows Phone and its iconic Live Tiles? Now imagine that interface… running on Linux instead of Windows.

That’s the idea behind ztOS, a mobile Linux project based on Arch Linux ARM, featuring ztMETRO, an interface inspired by Windows Phone 8.1, and native Linux applications.

It runs on the Samsung Galaxy S9 with a mainline Linux kernel. Wi-Fi, 4G and the touchscreen are already working, but the camera, Bluetooth and call audio still need work.

It’s still in alpha, so it’s nowhere near ready for daily use. But it’s an interesting alternative vision for Linux on smartphones.

https://github.com/z3r0n3br4instorm/ztOS

Would you try a Linux phone with a Windows Phone-inspired interface, or do you prefer the Android experience?

#LinuxMobile #OpenSource #Linux

Linux: Kennzeichnung von KI-Code soll entfallen – auch Torvalds nutzt LLMs

Kernel-Maintainer wollen die Kennzeichnung für KI-Patches abschaffen, weil nur wenige sie setzen. Auch Linus Torvalds programmiert inzwischen mit KI.

https://www.heise.de/news/Linux-Kennzeichnung-von-KI-Code-soll-entfallen-auch-Torvalds-nutzt-LLMs-11490345.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#IT #KünstlicheIntelligenz #LinusTorvalds #LinuxKernel #OpenSource #Softwareentwicklung #news

All of those who has this strong distaste for #systemd being doing too much, not being Unix like and providing too many components ... they should really spend some time to poke around the source code of the BSD distributions ...

https://cgit.freebsd.org/src/tree/
https://radicle.network/nodes/index.radicle.garden/rad:z2HLHXgL1xevBNQsf8BmQW7MpJmtm
https://cvsweb.netbsd.org/bsdweb.cgi/src/
https://github.com/openbsd/src

#linux #bsd #foss #opensource

RT @UnslothAI: NVIDIA veröffentlicht 2 neue Modelle: Nemotron-3.5-Bolt und Nemotron-3.5-Super-VL. Nemotron-3.5-Bolt-74B-A9B läuft auf 24 GB RAM und bietet erstklassige Leistung für seine Größe. Super-VL-120B-A12B läuft auf 82 GB RAM. Bolt GGUF: https://t.co/1WCKKPvFtW Anleitung: https://t.co/RIgVixplpT Super https://t.co/njSMjAOxgc https://t.co/I50NStQe8C

mehr auf Arint.info

#KI #MachineLearning #Nemotron #NVIDIA #OpenSource #TechNews #arint_info

https://x.com/UnslothAI/status/2110753351545843811

RT @ComfyUI: Higgsfield hatte versprochen, seine gesamte Plattform quelloffen zu machen. Das taten sie nicht.

mehr auf Arint.info

#AI #Comfy #DeveloperPlatform #Higgsfield #KünstlicheIntelligenz #OpenSource #arint_info

https://x.com/ComfyUI/status/2110870071933645103

Support KDE with a donation:

https://kde.org/fundraisers/yearend2026/"

#donate #FreeSoftware #OpenSource #KDE #fundraiser

Alt...

K&👽, the KDE wizard, points his staff out of a poster which reads "I want you" and "to support KDE" at the bottom. The link to the fundraiser is included at the bottom as is a QR that points to the same place. Konqi is featured with the "30" and "KDE" logos associated with the anniversary. The art by Tyson Tan is distributed under CC By-SA 4.0 license.

25 Jahre Open Source in der Stadtverwaltung in Treuchtlingen
Erfolgsmeldung zu langjähriger Open Source Nutzung

Die bayerische Stadt Treuchtlingen setzt seit 25 Jahren Linux auf den Arbeitsplätzen ihrer Verwaltung ein, einzelne Open Source Lösungen sogar seit 1999. Die Open Source Business Alliance (OSBA) würdigt die Kommune zum Jubiläum als frühes Beispiel dafür, wie Open Source Software im Verwaltungsalltag funktioniert.

Quelle: https://www.ossdirectory.com/de/topnews/details/25-jahre-open-source-in-der-stadtverwaltung-in-treuchtlingen

#opensource #bayern #osba #linux #diday

Tor Guard Relay v2.2.0 is out! 🧅🐋

A server is replaceable. Recovering the same relay identity needs a plan.

This update focuses on clearer diagnostics, safer updates and encrypted recovery, so running a relay means more than watching a container stay green.

What's new:
🛡️ Tor 0.4.9.14 or newer required in both variants
🩺 Current-run health, readiness and doctor diagnostics
🔐 Verified encrypted backups and staged offline recovery
🛠️ Validated configuration changes and safer reloads
📦 AMD64 + ARM64 images published from the exact candidates that passed validation
🔄 Reviewed dependency updates and ongoing security audits

The write-up also covers the rebuild improvements, protected registry cleanup and real deployment screenshots.

⚠️ Upgrading? Read the upgrade guidance first. Legacy plaintext backup helpers are retired.

🔗 https://brokenbot.net/v2.2.0

Already running it? I'd love feedback on the diagnostics and backup workflow. Bug reports and suggestions are welcome 🐛💡

Protecting privacy, one relay at a time ✨

#Tor #Privacy #OpenSource #Docker #SelfHosting #Infosec

Hello everybody out there using Linux – ich baue einen (freien) Nachrichten-Planeten für Linux und Open Source. Nur ein Hobby, wird nicht groß und professionell wie Google News.

Ich brüte seit ein paar Wochen daran: Planet FOSS sammelt Meldungen aus Blogs, Magazinen und YouTube-Kanälen auf Deutsch und Englisch und verlinkt immer aufs Original. Schau mal rein und klickt euch durch.

Welche Quellen fehlen euch?

https://planetfoss.net

#PlanetFOSS #Linux #OpenSource #FOSS #RSS

Kolibri-1 denkt deutsch. Hilft das auch beim Antworten?

Aleph Alphas Kolibri-1 ist ein neues KI-Modell, das speziell für deutsche Texte optimiert wurde und auch auf Deutsch argumentiert. iX hat es ausprobiert.

https://www.heise.de/hintergrund/Kolibri-1-denkt-deutsch-Hilft-das-auch-beim-Antworten-11489670.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#DeepLearning #Grafikchip #IT #KünstlicheIntelligenz #Sprachverarbeitung #OpenSource #news

#Shelly 3.1.7 GUI Package Manager for Arch Linux Adds RLPM as a Native Package Engine https://9to5linux.com/shelly-3-1-7-gui-package-manager-for-arch-linux-adds-rlpm-native-package-engine

#ArchLinux #Linux #OpenSource #FreeSoftware #FOSS

Alt...

A screenshot of Shelly showing the main interface while browsing the Arch Linux package repository.

Ich kriege die Krise! Wir sind in einer AnyDesk Session mit dem Kunden (auf Windows) und plötzlich erscheinen dessen Copy/Paste Inhalte in MEINEM Copy/Paste Buffer auf meinem Linux...

Geht's eigentlich noch???

Was ist mit meinen Passwörtern und anderem Schweinekram, welcher in meinem Copy/Paste Buffer so rum liegen? Ich will vielleicht nicht unbedingt, dass das andere (oder Kunden) zu sehen kriegen...

Als erstes mal den Copy/Paste Buffer auf 1 reduzieren (ich kann eh nicht mehr als 1 zurückdenken) und dann mal überlegen auf eine Open Source Lösung zu wechseln...

Hat jemand eine Idee für eine Open Source Lösung???

#anydesk #opensource #desktop #linux #kde

#Linux - und Unix-Desktop #KDE feiert 30. Geburtstag | heise online https://www.heise.de/hintergrund/Linux-und-Unix-Desktop-KDE-feiert-30-Geburtstag-11487966.html #OpenSource

New episode is out!

Shane (@stranded_output), Conor (@techcelt) and Amolith (@amolith) chat to the developers of the Ardour (@ardour) digital audio workstation.

Episode is edited by Jake (@jbauer)

#linux #lads #opensource #craic #mastodaoine #tech #technology #chat #shenanigans #podcast

https://linuxlads.com/episodes/168/

Guten Morgen

Ein Tiling Window Manager ordnet die Fenster automatisch, ähnlich wie Kacheln auf einem Boden. Statt sie frei über den Bildschirm zu schieben, teilt er die Fläche selbst auf. Jedes neue Fenster bekommt einen festen Platz, keines verdeckt das andere. Die Maus brauchst du kaum, das meiste läuft über die Tastatur. So bleibt der Bildschirm vollständig gefüllt, ohne Überlappungen und ohne verlorene Fenster. Am Anfang wirkt das streng, doch wer sich daran gewöhnt, will oft nicht mehr zurück.

Hast du schon einmal mit einer Kachelumgebung gearbeitet?

#Linux #morgen #TilingWM #OpenSource

Ubuntu 26.10: Linux 7.3 und KI-Assistent im Gepäck

Das neue Ubuntu-Release enthält bereits Kernel Linux 7.3, obwohl dieser erst noch erscheint. Außerdem gibt es optional den KI-Assistenten Myna für den Desktop.

https://www.heise.de/news/Ubuntu-26-10-Linux-7-3-und-KI-Assistent-im-Gepaeck-11488457.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Canonical #Gnome #IT #KünstlicheIntelligenz #Linux #LinuxDesktop #OpenSource #Rust #Ubuntu #news

Valve launched the latest update for Proton Experimental to fix up more issues found with Windows games running on SteamOS / Linux.
https://www.gamingonlinux.com/2026/10/proton-experimental-for-october-15-has-fixes-for-arc-raiders-c-c-red-alert-counterstike-and-the-aftermath/

#Steam #OpenSource #Valve #Proton #Misc #SteamDeck #SteamMachine

Als ich anfing, war mir mulmig bei den vielen Lizenznamen. MIT, GPL, Apache, dazu noch Zahlen dahinter, das fühlte sich an wie eine Wand, die ich allein nie überstiegen hätte. Ich hatte Angst, etwas falsch zu machen, und traute mich kaum, fremde Projekte anzufassen. Dann hat mir jemand in einem Forum ruhig erklärt, dass ich zum bloßen Benutzen nichts verstehen muss und die Lizenz erst zählt, wenn ich selbst etwas weitergebe. Diese Ruhe hat mir den Weg geöffnet. Erst später habe ich begriffen, was in diesen trockenen Texten steckt. Ein Versprechen, dass das gemeinsame Werk frei bleibt. Wenn ich heute so eine Datei öffne, denke ich an die Menschen dahinter, die ihre Arbeit geteilt haben, damit ich sie nutzen kann.

Wie ist es dir beim ersten Schritt in die freie Welt ergangen?

#Linux #Lizenzen #FOSS #OpenSource

heise+ | Adblocker inklusive: DNS-Server Technitium installieren und einrichten

Der DNS-Server Technitium glänzt mit großem Funktionsumfang, ist aber nicht ganz einfach einzurichten. Wir zeigen Installation und Konfiguration.

https://www.heise.de/ratgeber/Adblocker-inklusive-DNS-Server-Technitium-installieren-und-einrichten-11439401.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#DNS #Docker #IT #Linux #OpenSource #news

Nexus v1.0.0-alpha1 is out! 🎉

Nexus is a simple, user-friendly Matrix client for Linux, Android, Windows, macOS and iOS, built with Flutter and powered by Gomuks.

This first alpha brings room and DM creation, invites, space browsing, push notifications via UnifiedPush, and lots more.

It's an alpha, so expect bugs, and please report them!

Release: https://git.federated.nexus/Nexus/nexus/releases/tag/v1.0.0-alpha1
Support room: #nexus:federated.nexus

#Matrix #Flutter #FOSS #OpenSource

Alt...

A screenshot of Nexus, showing a space list, a list of children of that space, with "Browse space" button, a chat view, and a member list.

I sent more than two years building a macOS app, and after releasing it on the AppStore, sales are really bad.

The app is named ImageFlow, and it is a node-based image and photo editor.

I'm a developer, not a marketing guy. I'm bad at promoting my stuff.

I decided to open-source my app and make it available for everyone.

Hope some people out there can enjoy it as much as I do!

https://imageflowapp.com

https://github.com/dmbfm/imageflow

#macos #apple #foss #swift #swiftui #indiedev #opensource

Meta has officially launched Muse Spark Open, a groundbreaking 816-billion parameter open-weights AI model designed for advanced coding and multimodal tasks.

#Meta #AI #MuseSparkOpen #MachineLearning #OpenSource

https://dailytechnow.com/meta-muse-spark-open-ai-model/

ICS[AP] updated CISA ICS Advisories Master File for 10/15/2026 & the following year's CSVs:

CISA_ICS_ADV_2026_10_15_26.csv

Available @ ICS[AP] GitHub:
https://github.com/icsadvprj/ICS-Advisory-Project/tree/main

#opensource
#vulnerabilitymanagement
#icssecurity

NoiseBox Browser Extension hard at work!
https://codeberg.org/NoiseBoxWorks/NoiseBox-Extension
https://youtu.be/gqN6EBVQABw?si=4HCpaTLRJy-uX92U
#privacy #opensource #selfhosted #python #javascript

RE: https://mastodon.xyz/@nextcloud/117359711364631730

I can advise the following @fdroidorg apps. Some apps need an additional repository.

* Aegis Authenticator (my preffered 2FA app)
* AntennaPod @AntennaPod (best Android podcast app)
* Breezy Weather (weather app for weather nerds)
* Bubble (IMO the best spirit level/ruler app)
* Celestia (another astronomy app)
* Compressor (suburb video compressor. get those Mastodon video's below 100MB on the road! (or rails) - needs IzzyOnDroid repo: https://android.izzysoft.de/repo.
* Convertor NOW (because those Yankees refuse to use the metric system)
* DAVx @davx5app (best way to link Caldav calendars and Carddav contact books)
* FairEmail (email app for power users. yes, you need to pay a very small fee for pro features)
* Fennec or IronFox (two great Firefox forks) - IronFox needs its own repo: https://ironfoxoss.org/download/#f-droid)
* Fluffychat (IMO the best Matrix client - also for the Linux desktop)
* Fossify Calendar (simple and no bloat. works great with DAVx)
* Fossify Contacts (simple, non bloated contact apps. works great with DAVx)
* Fossify Gallery (my preferred media gallery app, better IMO than the /e/OS default)
* Fossify Messages (simple, non bloated SMS app)
* Fossify Thank You (to donate to the great Fossify project and also with some small extra features)
* Heliboard (IMO best open-source keyboard. hopefully with native gestures ASAP)
* Image Toolbox (this is a power-house to do everything with images - has a learning curve, but it is great!)
* Joplin @joplinapp (best note taking app, better than Nextcloud Notes, because it's end-to-end encrypted)
* KDE Connect (link your phone with your KDE or Gnome (using GSConnect) desktop)
* Lawnchair @lawnchairapp (my preferred Android launcher, because the default /e/OS launcher sucks)
* LibreOffice Viewer (official app to view LibreOffice, OpenOffice and even MS Office documents (if you are into that).
* LibreTorrent (to download Linux ISO torrents on your phone for fun)
* Material Files (a non bloated file manager)
* Metrolist (to play music from YouTube without an account - good alternative for evil Spotify)
* Moshidon @moshidon (although it badly needs an update. the nightly is not yet ready. I still use it, with the web-app installed for quote posts)
* Nearby Glasses (hunt for Meta pervert glasses, but unfortunately not yet found) - needs IzzyOnDroid repo
* Nextcloud News (needs a Nextcloud account)
* Nextcloud (only if you have an account on a Nextcloud server)
* Next Player (simple, non bloated video player) - needs IzzyOnDroid repo
* Nora (great way to sandbox big-tech sites)
* Open Video Editor (the only working open-source video editor for Android, although it is not updated for two years)
* OSMAnd~ (IMO the best @openstreetmap app for Android, although it has a small learning curve)
* Peertube app @peertube (does not need an explanation)
* Pixelfed app @pixelfed (for if you have a Pixelfed account)
* RadioDroid (still IMO the best internet radio app, although not updated for three years)
* Signal @signalapp (I don't have WhatsApp, so you need something 😉) - needs the Guardian Project repo (you only need to toggle this in the F-droid settings)
* Sky Map (the open-source sky view alternative)
* SpamBlocker (because I have an ungoogled phone (/e/OS on Fairphone) I need this. maybe you as well. @murena should build this in, because this app is not very user friendly)
* Torrent Search (to search for Linux ISO torrents)
* Vegan Inspector (checks if products are vegan or vegetarian)
* VLC (does the same has Next Player, but with a (IMO) ugly interface. I keep this installed as an alternative if something doesn't wants to play, but I can't remember when I needed it. get rid of the orange!)
* Voice Audiobook Player (the only one that actually worked with local files)
* Wallabag (Pocket alternative, needs a Wallabag account on a Wallabag server)
* Wikipedia (who doesn't need Wikipedia)
* YTDLnis (download video and audio from YouTube and many other sites using yt-dlp)

#Fdroid #Android #openSource

1 of 2) )So I downloaded the appimage of Photocraft to try. The AI reversed engineered Photoshop. I'm very anti-AI, and a big reason why I abandoned Adobe - when they forced training their models on their customers work - and had used the software since 1998. But, I had already begun a move into opensource anyway, and this was my final cue to go.

#adobe #opensource #AI

Next week, I’ll be speaking at All Day AI 2026 about something Ive been experimenting with lately: System One models. AI models designed to make decisions fast, without lengthy reasoning.

To explore what they're actually capable of, I built a 3D drone simulator where an AI model has to navigate a forest, avoid obstacles, and react to threats in real time. Ill share what worked, what broke, and what I learned from zero-shot testing, collecting telemetry, and fine-tuning the model. Less theory, more lessons from building things and watching them fail.

Join me on October 22 at 5 PM ET.

#AllDayAI #MachineLearning #AI #OpenSource

New blog post! I'm sharing some personal notes from my experiments with FreeBSD and the HumanWare BrailleNote Apex.

These are just personal notes, but I hope they may also be useful to others who want to start connecting a Braille display to FreeBSD, or to curious developers who want to understand how their software is used by people relying on screen readers and other assistive technologies.

Article: https://alfonsosiciliano.gitlab.io/posts/2026-10-15-freebsd-apex.html

#FreeBSD #Accessibility #A11y #UNIX #OpenSource #Braille #Coding #DeviceDrivers #AssistiveTechnology #ScreenReaders #OpenSourceHardware #BSD

I would like to remind you again that #FOSSTorrents has got torrents for many #opensource games, softwares and operating systems.

https://fosstorrents.com

They have the #BSD family, #Linux distros, softwares like #LibreOffice, #Blender and also games like #wesnoth #warzone2100 #supertuxkart among tons of others.

If you have the disk space and spare bandwidth, consider seeding the #torrent of your choice.

And if you have enough money in your pocket, consider donating to them!

Boosts appreciated!

#foss #torrenting #seedbox

Alt...

A partial screenshot from fosstorrents.com. The header, from the left, has got their logo and in the menu there are items "Distributions", "Games" and "Software". On the right side of the menu, there are social links for X, Bluesky, Discord and RSS. And on the most right part, there is a progress bar showing how much operational costs of 2026 is covered. Currently it's ~900 USD and only like 1/5 is covered. Below the menu, there is a search box. And below it, there is a gallery of the "Newest releases"

The first session of AI Inside Drupal Essentials starts Nov 9.

If you can build sites in Drupal and you're comfortable with Composer, Drush, and Git, you're ready. No PHP needed for 18 hours of live, hands-on AI training with a human-in-the-loop approach.

https://www.drupaleasy.com/academy/aide/course-information

#Drupal #OpenSource

RSS-Reader zu langweilig? Klassische Planeten-Seiten zu dröge? Bevor das Projekt „richtig“ startet, hätte ich gern Feedback.

Planet FOSS sammelt über 100 Seiten ein, sortiert alles nach Rubriken und Themen und zeigt euch auf einen Blick, worüber in der Linux- und Open-Source-Welt gerade berichtet wird. Auf Deutsch, auf Englisch oder in beiden Sprachen:

https://planetfoss.net/

#Linux #OpenSource #News

"Passkeys Are Not a Trap"? Nice Try Scott Helme, founder and CEO of a company that markets a "Passkeys Protection" offering.

https://scotthelme.co.uk/passkeys-are-not-a-trap/

Sorry, your article is patronizing me about what attestation is, then explaining that passkeys today don't give websites an attestation at all - though a site can ask. And in so doing, it completely fails to address the main criticism of the "Passkeys are a trap" blog post, i.e. that passkeys are the boiling frog of BigTech control on authentication.

https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-not-use-them

The only point I concede is that TOTP are vulnerable to phishing. And yet, if I really have to choose, I prefer that risk rather than handing over control to Google, Apple, and co. In any case, hardware authenticators like Yubikey / NitroKey are the preferred solution.

Sorry, not convinced. Passkeys are a trap. Do not use them.

#passkeys #security #cybersecurity #bigtech #google #apple #enshittification #bigtech #digitalsovereignty #opensource #infosec #passwords #phishing #totp

Die #GodotEngine wird mir ja seit Dome Keeper immer sympathischer. Jetzt hat Jan Bojaryn mit dem Spieleentwickler Raffaele Picca von #Bippinbits gesprochen. Die Engine scheint ja wirklich auf Erfolgskurs:

https://www.heise.de/hintergrund/Fuer-welche-Art-von-Spielen-sich-die-Engine-Godot-eignet-ein-Interview-11469567.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Spiele #OpenSource

Ubuntu 26.10 is now available to download.

It ships with GNOME 51 and Linux 7.3, adds a new window tiling features and expanded Rust tooling.

Full recap on the changes to look out in the link ⤵ https://www.omgubuntu.co.uk/2026/10/ubuntu-2610-new-features

#ubuntu #linux #openSource

Alt...

Bento grid detailing various Ubuntu 26.10 features.

Stats time! #LibreOffice code contributors, translators, downloads and more – see the State of the Project, October 2025 – September 2026: https://blog.documentfoundation.org/blog/2026/10/07/state-of-the-project-oct-25-sept-26/ #foss #openSource #freesoftware

Alt...

Bar chart showing growing LibreOffice downloads

Lead the way Dutchies. 🍊 🇳🇱

🤮 #Microslop
✅ #OpenSource

*plays Rollout by Ludacris*

🔗 https://www.zdnet.com/business/dutch-tax-authorities-cancel-microsoft-365-cloud-rollout/

KI-Code im Linux-Kernel muss nicht mehr markiert werden

Das Linux-Kernel-Team wird wohl eine Regel entfernen, durch die Arbeiten an der Codebasis gekennzeichnet werden sollen, wenn sie durch KI-Tools unterstützt wurden.

https://www.linux-magazin.de/news/ki-code-im-linux-kernel-muss-nicht-mehr-markiert-werden/

#linux #opensource

@uba

Alt...

Ein Mann mit einem grünen Band um den Hals, gestikuliert mit beiden Händen. Im Hintergrund ist ein großes, stilisiertes Bild von Pferden zu sehen.

Our Block League bots now play on Hyperium and fill Station2 matches to 3v3, with smoother movement and less all-or-nothing shooting. Quikbild now accepts oe for œ and ae for ä, and the hub's volleyball court is now a parkour course

https://aes.land/en/light/blog/2026_10_15-changelog/

#Luanti #Gaming #Videogames #FreeSoftware #GameDev #OpenSource

Strata has released version 1.0, its first stable milestone.

Built in Rust and GTK4, the open-source file manager features icon grid, list, and Miller column layouts, alongside Vim-style keyboard navigation and fuzzy filename searching.

Version 1.0 introduces keyboard-accessible tabs with session restoration, improved drag-and-drop handling, and large directory optimizations.

Previews are sandboxed using Bubblewrap.

https://en.hacks.gr/kykloforise-i-proti-statheri-ekdosi-1-0-toy-strata-gia-linux/

#Linux #Rust #GTK4 #OpenSource

Alt...

Κυκλοφόρησε η πρώτη σταθερή έκδοση 1.0 του Strata για Linux

New in #LibreOffice 26.8: Mixed page sizes – Impress and Draw can now use different page sizes within the same document – a long-requested feature for more flexible presentations. https://wiki.documentfoundation.org/ReleaseNotes/26.8 #foss #opensource #freesoftware

#proxmox #pve #opensource

Dank „Vibe-Coding“: Epic veröffentlicht neuen Launcher auch für Linux

Dank kräftiger Hilfe von KI-Agenten gibt es den neuen Launcher für den Epic Games Store als Preview auch für Linux. Auch Fortnite soll jetzt portiert werden.

https://www.heise.de/news/Dank-Vibe-Coding-Epic-veroeffentlicht-neuen-Launcher-auch-fuer-Linux-11489203.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Entertainment #EpicGames #Spiele #Linux #LinuxGaming #OpenSource #news

Canada could save millions by developing its own operating system instead of relying on Microsoft Windows
#Canada #DigitalSovereignty #Microsoft #Linux #OpenSource #Cybersecurity #TechPolicy #Software #DigitalGovernment #The14Media
https://the-14.com/canada-could-save-millions-by-developing-its-own-operating-system-instead-of-relying-on-microsoft-windows/

🗳️ OWASP Board Election voting is OPEN!

3 Board seats are up for election. Make your voice heard and help shape OWASP’s future!

📩 Check your personal and OWASP email for your ballot.

⏰ Closes Oct 30, midnight UTC.

Vote now: https://owasp.org/board/elections/2026

#community #opensource #boardelections

KDE veröffentlicht Plasma 6.8 zum 30jährigen Jubiläum

Das KDE-Projekt hat die Desktop-Umgebung Plasma 6.8 pünktlich zum 30. Jahrestag der Gemeinschaft angekündigt.

https://www.linux-magazin.de/news/kde-veroeffentlicht-plasma-6-8-zum-30jaehrigen-jubilaeum/

#linux #opensource

@uba

Alt...

Das Bild zeigt drei Szenen des KDE-Desktops. Links ist ein Konsolenfenster mit verschiedenen Icons und Menüs. In der Mitte ist ein Fenster mit der Überschrift "KWord" und einer Liste von Optionen. Rechts ist ein weiteres Fenster mit einem Menü und einer Liste von Icons.

Train netmap is an offline-first single HTML page that follows your train across Finland and records how good the mobile connection is along the way, so the next trip on the same line can tell you when the connection comes back.
https://github.com/rollecode/train-netmap

#OpenSource #OfflineFirst #Finland

Alt...

Map for Helsinki-Oulu trip

#Libreboot 26.10 Open-Source BIOS/UEFI Firmware Released with Full UEFI Support and Support for over 200 Intel/AMD Chromebooks https://9to5linux.com/libreboot-26-10-open-source-bios-uefi-firmware-released-with-full-uefi-support

#Linux #OpenSource #FOSS #Chromebook

Alt...

Libreboot logo

p2pchat: looking for experienced devs to help build an offline messenger for the protests in india

We’re working on p2pchat, an open-source phone-to-phone messaging app for keeping people in contact when mobile internet is cut off.

There are mass protests led by the youth that are happening now in India, and internet shutdowns are already part of the response. Mobile internet was suspended around Jantar Mantar in Delhi on 2 October as people gathered to protest. Internet Society’s shutdown record documents it. Losing connectivity makes it harder to find people, coordinate and share information at the time you need to.

That’s why we used “vibecoding” to get a prototype together quickly. We started from an existing open-source Bluetooth messaging app and used AI-assisted coding to build on it. We wanted people to have actual code to inspect and test while these protests are happening. Now we need experienced human developers to review the code and help with the parts that handle people’s messages and identities.

The current prototype uses Bluetooth Low Energy for nearby messaging. with relay explicitly enabled, a phone can carry encrypted packets and pass them to another phone it encounters later. That’s the idea behind messages hopping between devices. delivery still depends on phones meeting, and reliable background operation needs physical-device testing.

There are private chats, group messaging, forums/channels and public broadcast screens. the encryption construction is custom and unaudited. Tor isn’t implemented yet. public broadcasts are public, including to hostile participants.

We need help with:

• reviewing the existing E2EE, identity verification, key storage and forward-secrecy limits, and deciding what should be replaced with a maintained, reviewed protocol.
• implementing native Tor transport for internet messaging, with peer onion addresses bound to verified contacts and protection against connections accidentally bypassing Tor.
• auditing relay hopping: consent, duplicate handling, expiry, storage limits, malicious packets and what forwarding behaviour reveals about users. we also need real Android/iOS background and multi-phone tests.
• reviewing and implementing the sensitive parts of forums and public broadcasts: sender authentication, impersonation, spam and abuse handling, and keeping private messages out of public internet gateways.

This is pre-alpha and has not had an independent security audit. please don’t rely on it for sensitive protest communications yet. The urgency is why we’re asking for help now; the prototype still needs that review before anyone should trust it in the field.

repo: lindisboy/p2pchat

If you’ve worked on secure messaging, Tor or mobile networking, a focused review of one part of the code would help. The repo has the threat model and implementation notes, including known limits and unfinished work. Please follow the security policy when reporting vulnerabilities.

To understand the seriousness and the urgency and forgive the “AI slop” approach, please do read up and follow what is happening in India. There are sickening scenes unfolding as fascistic state forces violently crack down on the youth and middle class led protests for the resignation of the Chief Election Commissioner of India, though many especially the lawyers are even calling for legal action including improsenment against the entire far right BJP/RSS government and many of the police force that is unleashing terrible police brutality. Even then, the determination of the people is not relenting and protests will continue to grow. Please follow these pages for more updates

www.instagram.com/onlytheoreticallyhot www.instagram.com/harshdelhise www.instagram.com/kahaniistaan www.instagram.com/vibhugroverr www.instagram.com/cockroachjantaparty www.instagram.com/neowsibora www.instagram.com/meghnads/ www.instagram.com/watchthestate/

For more information surrounding the specific government policies that triggered this unrest: …substack.com/…/vote-chori-sir-and-current-outbur…

This is an urgent call for help! I am reaching out to this community because I do not wish to have many eyes on this beyond the people who can really understand why this is needed. Though many of us are working towards a socialist revolution in line with what Indian revolutionary Bhagat Singh talks about in his important final letter before being martyred - “To Young Political Workers” (www.marxists.org/archive/bhagat-singh/…/02.htm) - we are also forming a United front against the fascist BJP government.

I understand there are many communists and socialists here and I believe we can come together and work towards something meaningful, which maybe even if its not necessary in this wave of protests, could be of paramount importance in the future.

Lastly… NOTE: I want to caution that there have been multiple instances of the “BJP IT Cell” and pro-government people doxxing the identities of people who provide tools and support for the protests. Something like this leaking could also become a big media controversy on how these protesters get “foreign support”. So this post will be removed soon (especially once helpful volunteers are found) for safety purposes to prevent Indian state actors from discovering who is working on this project.

We require all the guidance and support we can get! Even if you cannot support on the tech side of things, we would greatly appreciate material monetary support towards building a revolution in India!

Thank you

Alt...

p2pchat: looking for experienced devs to help build an offline messenger for the protests in india

Mach dich digital unabhängig, wechseln auf die gute Seite! "make-togeter" – in Anlehnung an den #DiDay – 17.10. – 13 bis 16 Uhr, Wo: Bücherhalle 'Mercado', Hamburg Altona.
Helfende Köpfe und Hände zur Unterstützung sind auch wieder erwünscht. Mitmachen ist alles ;-)
#OpenSource #linux
#DigitaleSouveränität

Alt...

Auch diesen Samstag (17.10.) bieten wir ein niedrigschwelliges 'make-togeter' in Anlehnung an den #DiDay. Dies sollte KEINE Frontalvortags-Veranstaltung, sondern ein Laientreffen auf Augenhöhe werden. Dennoch würden wir uns sehr freuen, wenn der Eine oder die Andere mit weitreichenderen Kenntnissen z.B. Smartphone (#GraphenOS, #Linux Distros neben Mint o.Ä.) unterstützend dazu kommen. Helfende Köpfe und Hände zur Unterstützung sind erwünscht! Wo: Bücherhalle 'Mercado', Hamburg Altona. #OpenSource #linux #DigitaleSouveränität

Tribal Trouble: real-time strategy game released in version v2.1.96-103.1009

https://playingtux.com/en/articles/2026/10/tribal-trouble-v21961031009-released/

#Linux #Gaming #LinuxGaming #RTS #Strategy #Steam #OpenSource

IPFire: VPN-Clients finden ihre DNS-Namen wieder

IPFire 2.29 Core Update 204 ist da. Es behebt einen Fehler bei der Namensauflösung für VPN-Clients und aktualisiert zahlreiche Systempakete.

https://www.heise.de/news/IPFire-VPN-Clients-finden-ihre-DNS-Namen-wieder-11488965.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Systemverwaltung #DNS #Firewall #Ipsec #IT #OpenSource #Security #VPN #news

Bazzite Linux continues growing - now with over 100K Weekly Active Devices https://www.gamingonlinux.com/2026/10/bazzite-linux-continues-growing-now-with-over-100k-weekly-active-devices/

#Bazzite #DistroNews #OpenSource #Linux #LinuxGaming

RE: https://nrc.social/@MarloesdeKoning/117443878800925446

Dutch bank ABN Amro (one of the big 3) is at risk of being hit by US sanctions, because of services it provides to the ICC.

Worst case scenario ABN AMRO would be excluded from the international banking system, which would be the "corporate death penalty" and has already caused another bank, the Amsterdam Trade Bank, to go under.

#digitalsovereignty #opensource #ICC #USpol

Findet die Fediverse-Community die Aktion um "ArtCraft"* gut oder nicht gut?

*ArtCraft ist ein KI-Nachbau der Adobe-Suite, weil dem Entwickler die Abo-Geschichte auf die Nerven ging. Ist Open Source und frei verfügbar.

Werden da die " Grossen" mit den eigenen Waffen geschlagen?!

#artcraft #ki #ai #rebellion #OpenSource #creativity #creativedesign #software #revolution #opinion

https://getartcraft.com/apps

Six of the open source vendors behind #openDesk, including Element, have formed Open Productivity: a joint venture bringing the sovereign digital workplace to businesses and critical infrastructure operators.

We provide openDesk's secure, real-time comms, built on #Matrix. Each organisation can run its own server and keep control of its data, while still talking securely to suppliers, regulators and partners.

https://element.io/blog/vendors-behind-opendesk-join-forces-as-open-productivity/

#OpenSource #DigitalSovereignty

Linus Torvalds used a Claude Code Linux kernel patch to triple small data read speeds via RCU memory management, though the experimental code needs testing.

#LinuxKernel #ClaudeCode #LinusTorvalds #Anthropic #OpenSource

https://securityonline.info/claude-code-linux-kernel-patch/?utm_source=mastodon&utm_medium=jetpack_social

Bazzite Linux continues to be a popular choice for a SteamOS-like on handhelds, TV PCs and for desktops too with a new milestone hit.
https://www.gamingonlinux.com/2026/10/bazzite-linux-continues-growing-now-with-over-100k-weekly-active-devices/

#OpenSource #DistroNews #Misc #Bazzite

Tools des Monats: RustGIS, ein neues Open Source GIS / Tools of the Month: RustGIS, a new open-source GIS https://geoobserver.de/2026/10/15/tools-des-monats-rustgis-ein-neues-open-source-gis/ #RustGIS #rust #gistribe #gischat #fossgis #foss4g #OSGeo #spatial #geospatial #opensource #gis #geo #geoObserver pls RT

What if your office suite worked offline, sent no documents to outside services and cost nothing? LibreOffice 26.8 comes from The Document Foundation, a non-profit in Berlin, and most of the people who built it are volunteers. The post also shows where to start and which store versions to avoid paying for. https://choosingeurope.eu/2026/10/15/libreoffice/

#LibreOffice #OpenSource #ODF #Europe

GE-Proton 11-9 (and GE-Proton 11-8 just before it) have been released to bring more improvements for Windows games on SteamOS / Linux.
https://www.gamingonlinux.com/2026/10/ge-proton-11-9-arrives-with-improvements-for-video-playback-wayland-controllers-and-more/

#OpenSource #Proton #NewRelease #Misc #GEProton

Happy Birthday @kde, der Linux- und Unix-Desktop KDE feiert 30. Geburtstag. Wir gratulieren mit einem Artikel

https://www.heise.de/hintergrund/Linux-und-Unix-Desktop-KDE-feiert-30-Geburtstag-11487966.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege

#KDE #KDEPlasma #Linux #LinuxDesktop #OpenSource #Qt

The very popular Arch-based Linux distribution CachyOS is growing up, with Framework expanding their direct funding support of it.
https://www.gamingonlinux.com/2026/10/framework-expands-funding-support-for-cachyos-linux/

#OpenSource #DistroNews #Misc #CachyOS #Framework

💻 Frage an die FOSS-Gemeinde: Wie haltet ihr es mit KI beim Programmieren?

Debian hat im August entschieden: weder Verbot noch Freibrief, die Verantwortung bleibt bei den Menschen. Papst Leo XIV. mahnt in seiner Enzyklika „Magnifica Humanitas" sinngemäß: KI darf Menschlichkeit und eigenes Denken nicht verdrängen.

Wo liegen für euch die Grenzen? Ich selbst nutze openSUSE Leap 16. Und ihr? 🐧

#Linux #FOSS #OpenSource #KI #Debian #openSUSE #Fedikirche

Palantir Software Processes Reports From EU Message Scanning

Some platforms in the EU voluntarily scan private messages for problematic content (CSAM). They report suspicious findings to NCMEC, a U.S. center.

https://vsx.global/ncmec-palantir-eu-reports/

#infosec #privacy #opensource #digitalsovereignty

Avoin Internet on vaarassa, sen peruspilarit ovat kaupallisten toimijoiden jatkuvasti kovenevassa puristuksessa ja tarvitsevat tukea. Lahjoittamisen sijaan löytyy kuitenkin toinen keino, parempi keino: osta heidän tukikaupastaan tavaraa. Se tukee näitä toimijoita, mutta myös antaa niille näkyvyyttä ja toki saat vastapalveluksena hyvää merchiä! Tässä omat suosikkini mitä tukea ostamalla tyylikkäitä paitoja ja muuta. (jatkuu)

#AvoinInternet #OpenSource

Using big corp #LLMs for #OpenSource development, right now, while the #AI development and running is paid for by VC money, is the biggest corporation giveaway to free software. Ever.

#heiseshow: KI-Klone, PC-Markt, Mathematiker vs. OpenAI

In der #heiseshow: KI-Klone machen etablierten Anbietern Konkurrenz, der PC-Markt bricht ein und Mathematiker wehren sich gegen KI-generierte Lösungen.

https://www.heise.de/news/heiseshow-KI-Klone-PC-Markt-Mathematiker-vs-OpenAI-11488029.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#heiseshow #eGovernment #Entertainment #IT #Journal #KünstlicheIntelligenz #OpenSource #Tesla #news

GitHub now expires npm trusted publishing setups that miss a first publish within 48 hours, closing a repo name reuse flaw in 1,500+ packages.

#npm #TrustedPublishing #GitHub #GitHubActions #SupplyChainSecurity #OIDC #OpenSource #DevSecOps

https://securityonline.info/npm-trusted-publishing/?utm_source=mastodon&utm_medium=jetpack_social

Você já parou pra pensar quanto da sua vida o Instagram conhece?
Seus gostos, horários, rostos, locais… tudo vira dado. E vira anúncio.

Mas existe uma alternativa: o Pixelfed — uma rede de fotos sem anúncios, sem rastreamento e de código aberto. Você escolhe o servidor, é dono dos seus dados e o feed é cronológico (sem algoritmo).
#Pixelfed #SoftwareLivre #OpenSource #Privacidade #Fediverso #Descentralização #Instagram #TecnologiaLivre #DireitosDigitais #LGPD #AlternativasLivres #CódigoAberto