Niccolò Venerandi
48 piecesBy this author
pages
How I do articles and videos
Open Source World · 9 min · p. —Weekly Digest #3
3 min · p. —
The Linux Experiment ditches Firefox, but I'm not sold
Browsers · 9 min · p. —
Roundtable: we love the Frameworks 12 and Desktop
Roundtables · · p. —France wants backdoors in end-to-end encryption
Four days ago, Tuta, the providers of an end-to-end encrypted email service, published a blogpost titled: "France is about to pass the worst surveillance law in the EU. We must stop them now!".
According to them, this French law would allow the government - amongst other things - to have backdoors on all end-to-end encrypted services, remotely activate the microphones and cameras, and tighten up censoring content.
This sounds pretty bad. To see where their claims are born from, let's take a step back to November 2023.
Due to an (alleged) rise in drug trafficking in France, a commission was created by the initiative of the right-wing Les Républicains group. In May 2024, they submitted a report named: "A necessary leap forward: getting France out of the drug trafficking trap".
The rapporteur and president of this commission (respectively, Étienne Blanc from Les Républicains and Jérôme Durain from Socialiste, Écologiste et Républicain) decided, a few months later, to propose a similarly named law following the recommendations of the commission.
This bill currently includes 24 articles, all written in French, a language I sadly do not understand. A few of them are what you would expect given this context, such as the creation of a national anti-narcotics prosecutor's office or strengthening the anti-drug office (Ofast).
This bill is worked upon by a specific commission, which concluded its work with a report on the 22nd of January 2025, a couple of weeks ago.
A few days after that, an amendment was proposed to the law, which added one more article; I quote from its "Subject matter":
This amendment introduces platforms to implement the necessary technical measures to enable intelligence services to access the intelligible content of correspondence and data transiting through the platforms.
This is the amendment that Tuta found to be deeply concerning. This amendment forces encrypted messaging apps to decrypt any message at the government's request within 72 hours; to enforce this requirement, it introduces a 1.5M€ or 2% of company income fine.
Indeed, the Senate voted on the new bill from the 28th of January to the 4th of February, and the amendment made it to be article 8(a) of the bill.
The current French law already requires criptology services to provide the government with access to messages with 72 hours, but until the law also had the following sentence: "Authorized agents may ask the aforementioned service providers to implement these agreements themselves within seventy-two hours, unless they demonstrate that they are unable to meet these requests". The bill completely deletes this part, making the request effectively mandatory.
Instead, the sentence "They cannot make any contractual or technical arguments that would hinder them" is added. It's not easy to read through the legal jargon here, especially in French, but this does seem to justify Tuta's worries.
Tuta argues that creating government backdoors for end-to-end encrypted services would also break European data protection laws like the GDPR:
The GDPR pass the control over personal data back to the people by forcing companies to protect personal data, possibly also with end-to-end encryption. Furthermore, Germany’s IT Security Act mandates that critical infrastructure (including IT systems) must be protected from cyber threats and unauthorized access, and Germany’s Telecommunications Act (TKG) regulates the security of communication services and data.
They also quote the following statement of the European Data Protection Supervisor:
Encryption, or the encoding of messages in such a way that only intended recipients can understand them, is one of the main tools to guarantee the security of our information. It is recognised as necessary for the digital economy and for the protection of fundamental rights, such as privacy and free speech.
Tuta is not the only company worried about such a development. Signal, the end-to-end encrypted messaging app, has very recently stated that they will refuse to operate in any country which requires backdoors on their encryption. This means that Signal might soon be unreachable for anyone living in France, but also Sweden and the UK, who are passing similar laws.
However, this is just article 8(a) of the bill. Though this amendment constituted what prompted Tuta to speak out, they mention that the whole "war on drugs" law is full of worrying changes.
To do this, they quote a website called La Quadrature du Net. They seem to be an organization that "promotes and depends fundamental freedoms in the digital world", placing itself as quite left-wing and opposing, as an example, AI.
According to them, the "Narcotrafic" law would also allow for "remote activation of connected objects"; they say,
This law provides for a new escalation in surveillance by continuing the legalization of spyware (such as NSO-Pegasus or Paragon). It thus authorizes the police to remotely activate the microphones and cameras of fixed and mobile connected devices, such as computers or telephones, to spy on people.
The law also "significantly strengthens the organized crime regime"; the scope of the offenses covered by this regime has "steadily over the years, affecting more people and situations". They claim that, in the past, the organized crime regime was used to pursue an activist fighting against the construction of administrative detention centers, but I found it hard to verify this claim.
They also claim that it would expand the use of "black boxes" to analyze the data of all our communications and exchanges and that it would tighten up their policy of censoring content on the Internet by extending it to publications related to the use and sale of drugs.
Even though I was able to track down the specific changes that prompted the initial Tuta post, going through all 24 of the bill's articles to find the specific changes that La Quadrature du Net is talking about is beyond my skills; as such, I am quite disappointed that they did not bother to make any specific link to the bill's text, which would've allowed us to more easily verify their claims.
As a result, please take all of La Quadrature du Net's words with a grain of salt; however, the requirement of adding a backdoor to all end-to-end encrypted communication is indeed a reality, and a worrying one.
The bill was approved in the Senate with a large majority, including both the left and the right-wing votes. However, it still has to be approved in the National Assembly, and they can still amend it. Thus, Tuta and La Quadrature recommend calling your Assembly representatives if you live in France to let them know that you won't vote for them if they vote for this law.
I briefly mentioned this already, but it's worth noting that this law does not just fall from a coconut tree: similar attacks towards end-to-end encryption are ongoing in the UK and Sweden. Quoting bleepingcomputer.com,
Last week, Apple decided to pull its iCloud end-to-end encryption feature, Advanced Data Protection (ADP), from the UK following a secret order from the government demanding the creation of a backdoor to access user data. A similar law proposed in Sweden is poised to grant law enforcement agencies access to users' message history from apps like Signal. However, Signal's President Meredith Whittaker said in a recent interview that this law would force them to pull their service out of the country.
Mozilla has better lawyers than PR
Two days ago, Mozilla introduced new terms of use and an updated privacy notice for Firefox.
This is the reaction. What the general public took out of the new terms is, well, we should probably switch to another browser.
I spent yesterday reading tweets and private messages all saying something to the tune of: goodbye Firefox!
But is there any truth to this? Well, let's dive in.
Firstly, the facts. Mozilla announced a new set of Terms of Use, which we had not had before, and an updated Privacy Notice. Let's start with the former.
The controversial paragraph is the following, and I'm going to read it in its entirety:
You give Mozilla all rights necessary to operate Firefox, including processing data as we describe in the Firefox Privacy Notice, as well as acting on your behalf to help you navigate the internet. When you upload or input information through Firefox, you hereby grant us a nonexclusive, royalty-free, worldwide license to use that information to help you navigate, experience, and interact with online content as you indicate with your use of Firefox.
There are a few other problematic sections. A few paragraph below, Mozilla warns that they can now "suspend or end anyone's access to Firefox at any time for any reason", though I'd love to see them try.
Finally, your use of Firefox now must follow a newly-created "Acceptable Use Policy". These include bans of most illegal activities (pirating, theft, violating copyrights, violating any person's privacy, harming children, and more):
However, you also cannot "Upload, download, transmit, display, or grant access to content that includes graphic depictions of sexuality or violence", i.e., you are no longer allowed to watch, upload, or distribute pornography or anything that depicts violence.
The rest of the Terms of Use is what you would expect: a few indemnification clauses, software is provided as is, yadda yadda.
Now, onto the Privacy Policy. This document is quite detailed and - I believe - understandable.
Firstly, there's a list of all data collected to make the Firefox browser work. This includes the browser settings, the password manager, customization options, and such. Your browser history is also kept locally (e.g., for autocompletion purposes), as well as web form data (so you don't have to re-write everything if the browser closes), and so on.
There are a few advertisement clauses. If you search for location-related keywords and you have Sponsored Suggestions turned on, then you will be served advertisements related to that keyword, though they'll never link it directly to you as an individual. Firefox New Tab might also show advertising, and some technical and interaction data (how you interact with the ad) is collected and shared with partners on a de-identified or aggregated basis.
There are also a few sections regarding that data that you might want to share with Mozilla to help them improve their browser, such as how fast pages load for you and how many ads you see – all of this is, again, de-identified or aggregated (and you can opt out).
Nothing else catches my eye, though you might want to go check the webpage yourself.
Finally, Mozilla also updated its FAQ page to remove all mentions of Firefox not selling your data. In all places where this was mentioned, it's not anymore.
Even worse, the entire question "Does Firefox sell your data?" (to which the answer was, "no obv") was also removed.
I believe that's all. Of course, this paints a very bleak picture for Mozilla; some of us are left wondering why all of these changes are taking place, while others don't care and are jumping ship already.
So, let's play a game. Let's try to build the best possible defense for Mozilla and see if it's solid. If it's not, that's a pretty big issue. Let's start with the "nonexclusive, royalty-free, worldwide license" to your data. According to Mozilla,
We need a license to allow us to make some of the basic functionality of Firefox possible. Without it, we couldn’t use information typed into Firefox, for example. It does NOT give us ownership of your data or a right to use it for anything other than what is described in the Privacy Notice.
Brodie here dutifully points out that, no, the TOS does not give them ownership of your data, but it does grant them a license to it. However, this does not change the fact that they're still bound to their Privacy Notice, which did not allow for data usage aside from, well, operating the browser.
Indeed, I'd like to stress that the license is "to use that information to help you navigate, experience and interact with online content as you indicate with your use of Firefox".
The CEO of Epic Games and creator of Unreal Engine, Tim Sweeney, similarly defends Mozilla on this specific point:
The license says that when you type stuff, the program can use the stuff you typed to do the thing you asked it to do. This is what programs ordinarily do, but nowadays lawyers tend to advise companies to say it explicitly.
I don't hold particular sympathy towards him, but I believe he knows more than me about what the lawyers are up to these days.
Many claimed that other browsers work just fine without this legal wording, but that's simply false.
Google grants itself a worldwide, non-exclusive, royalty-free license to "host, reproduce, distribute, communicate, and use your content" and "modify and create derivative works" for the "limited purpose" of "operating and improving the services".
The same applies to Edge: Microsoft grants itself a "worldwide and royalty-free intellectual property license to use Your Content, for example, to make copies of, retain, transmit, reformat, display, and distribute via communication tools Your Content on the Services".
Outliers here are Safari, Brave, and Opera, which do not seem to currently have this mentioned.
Other software have similar sentences, though; as an example, you're also giving Microsoft a full license to everything you write with Word, if you use that kind of software.
Let's assume that's why the sentence was there. But why ban pornography?
The key here is that the Acceptable Use Policy starts with: "You may not use any of Mozilla’s services to".
In the Terms of Service, the word "services" is defined as: Mozilla VPN, Firefox Relay, Firefox Monitor, Firefox Note, Firefox sync and Pocket. This does not seem to include Firefox.
Thus, what the Acceptable Use Policy is likely asking to do is avoiding anything illegal (or pornographic) when using their VPN, and maybe when saving articles to Pocket.
Out of curiosity, I checked whether NordVPN, one of the most well-known VPN companies, also has the terms. They do, disallowing any illegal content, but also "threatening, stalking, harming or harassing others, or promoting bigotry or discrimination".
So maybe this can be clarified as a VPN-type of thing that does not apply to Firefox, since it's not a service. But this still does not explain why on earth they would remove the "we won't sell your data" from their FAQ page.
Well, Mozilla did some damage control by adding a new question, phrased as "It seems like every company on the web is buying and selling my data. You’re probably no different.".
This is not a question, but the answer is nonetheless very interesting:
Mozilla doesn’t sell data about you (in the way that most people think about “selling data“), and we don’t buy data about you. Since we strive for transparency, and the LEGAL definition of “sale of data“ is extremely broad in some places, we’ve had to step back from making the definitive statements you know and love.
A few people here are speculating that the deal with Google might be at fault: since they receive money to use Google out of the box, which in turn collects your data, that might be considered "selling your data" in some jurisdictions.
That concludes the best defense of Mozilla I could put up. I would classify it as decent but not particularly compelling.
A criticism I would like to immediately bring up, regardless of whether Mozilla is correct or not, is just how badly all of this was communicated. I'm not sure if they tried to hide these changes - like removing the "we won't sell your data" question - in the hope we wouldn't notice. Because if you knew we were going to notice, why wouldn't you immediately have an explanation ready to go? Why wait to explain yourself?
And, even if I'm right in the distinction between services and the Firefox product, meaning I'm still allowed to watch porn… why is it so badly worded? The terms of service specifically talk about Firefox, and then there's a link to this list. Anyone would assume that it applies to what you do with the browser. Why not write more clearly?
However, there are more direct flaws in my argument, too.
Firstly, many users are pointing out that if I download the Firefox browser (and I operate it), therefore not necessarily using any of Mozilla services, I shouldn't need an agreement with Mozilla at all; why would then I license them my data?
This might have some explanation, such as Firefox using Mozilla's DNS, but it's getting into legalese speculation enough that I don't feel confident in weighing in.
Ultimately, everything relies on the Privacy Policy, as it's all as solid as that document is. Is it solid? Please tell me it's solid.
Let's start with data that Mozilla shares with "partners, service providers, suppliers and contractors". If they "sell your information", it's to them.
These partners, according to the webpage, are their search partners, such as Google, advertising partners, and a few related to Mozilla services you don't have to use (such as AI chatbots).
To provide search functionality and advertising, the following types of data are collected: technical data, location, language preference, settings data, unique identifiers, system performance data, interaction data, and search data.
Technical data is defined to be only about the hardware you are accessing the service from, the device type, operating system, IP address, and ISP.
The location only refers to your country code or city, and it does not include your precise location.
Interaction data only refers to how you engage with their services ("how many tabs you have open or what you've clicked on, click counts, impression data, attribution data, number of searches performed, time on page, ad click").
Search data is what you search for.
This should be everything that Mozilla can share with partners, and according to them, it only does so in a de-identified or aggregated way.
Then, there are authorities, such as governments. If there's a valid legal process ongoing, Mozilla might have to disclose personal data to that government in response to a Notice to law enforcement.
What kind of data? Any.
Examples of legal processes that would make Mozilla share personal data are Emergency Requests, Court Orders, National Security Requests, Pen Register Orders, Search Warrants, Subpoenas, and Wiretap Orders.
Of course, this is not exactly a great look, but I don't think Mozilla could've done anything differently here. The safety net does not come from relying on the fact that Mozilla won't share your data with governments if asked, but rather from the fact that you don't need to use Mozilla services in the first place, so that your data is kept on-device and secure, plus you can build Firefox yourself so that you can trust it fully.
So, to recap: to the best of my knowledge, no, Firefox/Mozilla can not use your data however they want, and I still consider it to be a very privacy-aware option. You also can still watch pornography - I think - just not when using their VPN. And they still don't sell your data, they just have the Google agreement they've always had. I don't think there's a reason to panic.
But there's a reason to worry. What a mess: this felt like a very rushed move. I want to give the benefit of the doubt that they asked for a legal review of their previous documents, and the legal team replied with: Hey, change all of this immediately, because we've discovered flaws that might get us in court now that we're aware of them.
Because if not, if they had time to prepare this announcement and think it through… what are they doing!?
This OS runs in your browser
This is Puter, and it's an implementation of a full desktop within a browser.
You might not be sold on this idea yet.
Though I'll go through this in more detail later on, I will immediately: this includes a file manager, a picture editing application, a simple IDE, a camera, a recorder, a PDF reader, a web browser, and more. It's at worst a useless but impressive product, and - at best - something that's actually useful.
Before we fully dive into this desktop's capabilities, let's start with the basics. How can this be useful if we lose all of our data as soon as we close the browser?
Well, there's no such worry. You can very quickly create an account (which only requires an email, a password and nothing else, not even to click on a confirmation link).
This will make your data persistent throughout sessions, and even devices: just by opening my phone and logging in, I could find all of my pictures and customizations already applied.
Even better, if you don't want to copy over your information, Puter provides a QR code that you can scan from your phone – and voilà, you'll be logged in on any other device, instantly.
By creating an account, you get 100MB of storage out of the box (and 20 AI Chat Completion, which – thanks, but I won't be needing those).
You can get another GB of storage by inviting a friend to make an account, and you can also buy additional storage, starting at 100GB at $10 a month. So, yes, this OS does come with optional subscriptions out of the box – we already have something that most Linux distributions lack out of the box.
Ah, and of course, the website is open source on their github; the developer even publishes videos on how the infrastructure works, though I would not even dream of understanding anything about that. I only know that it's made entirely in Node, which (I think) is a terrible crime against humanity!
Since it's open source, you can also self-host it if you want, which - I can only guess - will allow you to use your local storage directly instead of relying on the cloud. You could wonder if that runs without an internet connection, but - as we will see - even if it could, you wouldn't want to.
But why? What can you do with this? Well, there are a few nice features to talk about.
Firstly, you can quickly create and publish websites. If you open the File Manager, right-click on any folder, and select "publish as website", you will be given a random subdomain puter.site that will point to that specific folder.
You can add a index.html file to change the look of the webpage and allow users to download files within; it updates pretty much instantly.
Okay, that looks fancy, but would you be able to do anything productive on the OS itself?
Puter comes with an App Center out of the box, which includes a lot of applications. Though each app has a download button, it merely adds the link to the app to your launcher: all apps are this sort-of-webpages, so you can just click "open" and they will open, which feels a bit like magic.
These seem to be re-embedding of other webpages within Puter, which does make sense – though, there's no visible performance overhead and they all behave quite well. Context menus and UI elements are extremely inconsistent, but that's understandable.
One thing I would like to see here is some additional transparency on each of these applications. Who made them? Who embedded them? Can I find them on their own website?
You're allowed to publish as many apps as you want in Puter, though they are reviewed, and you will even receive money every time they are opened. I have to say, I'm impressed here – though, this makes my "more transparency, please" request even more pressing.
In the store, we can find a barebone video editor. Though, it's not that barebone – it allows you to cut away parts of a video, yes, but also crop it, rotate it and flip it, apply various filters to it, change brightness/contrast/saturation/…, annotate the video (with lines, arrows, text, …), resize it, and more. I'm not going to switch to this as my video editing device, but still, it's more than what I was expecting.
There's a Puter Automation application that allows building, well, automations using a drag-and-drop blocks interface. It's barebone (again) but not something I expected to find at all; of course, in this day and age, it's called the "Puter AI Automation" and the default block is an AI one.
There is a Puter Blogger application that will create a blog within puter.site. It doesn't exactly feel nice to use, but it does allow to publish markdown posts – and, who knows, it might improve significantly over time.
There's even a "Subdomain Registrar" application that allows you to check for the availability (and to reserve) of puter.site subdomains. As an example, I have just registered the website librenews.puter.site, though I'm not sure what I'll do with it.
Design-wise, one available application is "Polotno" (which, again, you could also access independently as a website). It allows to create even somewhat complex designs, though these third party website embedding won't really save anything on your Puter file manager, which - in my opinion - renders them at least somewhat pointless.
However, the data is associated to your Puter account, meaning that it should also survive when switching from a device to a different one. That's at least something!
There's also Photopea, to edit RAW images. I love that "Open From Computer" will open the Puter file manager, and not my computers', but somehow Photopea won't accept my Fujifilm raw images, which is sad.
I could go on, but you can kind-of guess what the rest of the app center is: full of applications, mostly well-integrated third-party web apps embedded into Puter, covering a wide range of scoper, from musing making, to book-writing, expense tracker, and so on.
Oh, and I almost forgot: you can customize things a bit. Sorry, as a KDE developer, I just had to mention that. You can change the background (obviously), but also the UI colors and their transparency:
You can also hide/show a clock on the bottom-right corner of the screen, and choose whether you want the menubar to be part of the application or embedded in the desktop top panel. All of these settings update instantaneously.
Puter also includes notification support, though I have yet to see an application using one. Again, I would say that the greatest weakness of this OS is the fact that so many applications are just third party websites embedded in Puter, and won't follow Puter's API.
Of course, this still hardly beats your own OS right now. All of these applications could be accessed just as well as websites, and tools like Nextcloud could provide the same level of sync between devices that Puter offers.
Though, one thing that I'm looking forward is this promise by the Puter developer. They are working to include an emulation application that will virtualize Linux applications on the web, and allow you to interact with them. If that works, it means that Puter will also allow you to run Linux apps – though, I'd expect a significant performance overhead. All of that, by the way, would still run locally on your device.
Now, I have to say that the developer is a bit too obsessed with integrating AI everywhere (he recently posted an image with the title "Cloud OS -> AI OS?! 🤯" on his subreddit, which I hope was a meme).
However, one proof of concept he has shared looks pretty cool: by having a standard API that's exposed to a language model, you can use natural language to perform even complex actions on Puter; as an example, you can just ask to organize files and folders on your desktop.
There's also work ongoing for thing such as a command line interface to interact with puter; this program allows you to log-in to your account, upload or download files, and more. Ideally, this would mean that you could keep a local folder in sync with a Puter one, which would finally start to make sense to me.
It would mean that I could use Puter as a Nextcloud alternative, but where I have an entire OS in the browser, which integrates with lots of other web applications, to see and do light work on my data from any device but still with the same interface, whilst still keeping serious business on my local machine.
Though, that's still far from reality. Maybe one day? For now, I'll stick to Nextcloud.
Matrix and FreeDesktop are calling for help
Let's start with some brief context.
The Matrix Foundation is a community interest company founded in early 2019 that acts as a neutral custodian of the Matrix decentralized communication system.
This is distinct from Element, a for-profit company that builds "flagship products and services" built with Matrix. Element was set up by the creators of Matrix, and has been developing most of Matrix infrastructure for the last eight/nine years, and they sponsored the Foundation for a while too.
Just over a year ago, Element forked Synapse and Dendrite, two Matrix home servers, changed the license from Apache to AGPL v3, and continued development on them themselves, to speed up work. The Foundation, which retained the old Synapse and Dendrite, had announced that they did not have the resources needed to continue development on their own.
On top of that, the Foundation also explained at the same time that they had to abandon some project they had been working on:
We’ve had no choice but pause development on the majority of the core team’s next-generation Matrix projects. We had high hopes of being able to secure dedicated funding for Third Room, but the interested parties did not come through, and the team has now disbanded. Meanwhile, P2P Matrix and Low Bandwidth Matrix is on hiatus until there’s dedicated funding - and Account Portability work is also temporarily paused in favour of commercial Element work.
This follows directly from the previous year "distress signals" that the Foundation gave; to quote their 2022 holiday update:
On the other hand, only a handful of these initiatives have resulted in funding reaching the core Matrix team. This is directly putting core Matrix development at risk. We are witnessing a classic tragedy of the commons. We’ve released all the foundational code of Matrix as permissively-licensed open source and got it to the point that anyone can successfully run it at scale themselves. The network is expanding exponentially. But in return, it transpires that the vast majority of these commercial deployments fail to contribute financially to the Matrix Foundation.
And, even worse,
This is completely unsustainable, and Element is now literally unable to fund the entirety of the Matrix Foundation on behalf of everyone else - and has had to lay off some of the folks working on the core team as a result.
Both in their 2022 and 2023 blogposts, they asked individuals and companies alike to donate and sponsor the project so that they could resume longer-term projects, though it seems like these words have not had the impact the Foundation was hoping for.
We're now in early 2025, and the Matrix Foundation has published an article titled "We're at a crossroads".
They explain that the Foundation, previously entirely funded by Element, now has half of its budget covered by its funding members. Namely, these are: Element (obviously!), Automattic, and Futurewei, plus the ones that you see on your screen as Silver members.
However, as they mention, having half the budget covered by them means that half of the budget isn't, and they are burning through their reserves. What's the deadline? We're given one.
Either the situation changes by the end of March 2025, one month from now, or they will have to cut costs again. This time, they will be shutting down all remaining bridges hosted by the Foundation, and abandon their development.
They ask for $100k by then; however, this would only extend their runway by one additional month, which would give them time to work on "landing grants and new members". Last year, their revenue was $561k and expenses were $1.2M, a $639k deficit. This year they are expecting roughly the same deficit. As you can see, the $100k would only make a dent in the yearly budget – and yet, it's still a somewhat ambitious goal to reach in a short timeframe.
Talking about organizations and companies, they are asking for people to join a membership, which starts at just $2k/year and then scale up to $500k/year (only Element pays that much, right now).
I currently only count 11 entities in their membership list, which makes me think that they have not managed to find new ones yet. I have to admit I'm quite tempted to make LibreNews join with a Silver membership, but this channel also has a negative cash flow right now, so maybe that's not such a great idea.
However, the Foundation is also asking for individual donations to support the project. These are either Donorbox, Patreon, or LiberaPay donations, and we can publicly see how many they received.
On Donorbox, they have a $100k goal and have received 72% of it, though it's not clear in what period they achieved this.
Between Patreon and LiberaPay combined they receive a total of $26k yearly, something I would classify as "not much, honestly".
What's next for Matrix if they do manage to raise the funds that they need? Well, they want to resume the longer-term project that they've shut down over time, but the first area to see increased funding will be the Trust and Safety team. That's the current biggest expense, but they are still under-resourced: they are under a lot of pressure to deliver protocol improvements, better tooling for server admins, and more.
In the hope that I've now convinced you to help them out if you can, I'll now switch my focus to the situation around FreeDesktop. First, some context.
Freedesktop is not a company or an organization, but rather it's a project that aims to define various standards that should be respected between desktop environments and such.
It's been around since 24 years ago, which - by the way - is more than what I've been around, and it was founded by Pennington, a GNOME developer working for RedHat.
They now provide hosting for a variety of cross-desktop projects: from Wayland to Mesa 3D, Poppler, the X.Org server, …
…, D-Bus, libinput, PulseAudio, PipeWire, systemd, and many more.
Freedesktop does accept donations and sponsors, though the project has "no corporate backing or funding stream". To do so, they are part of the X.Org Foundation, but they're driven forward by volunteers only.
However, they recently had some significant issues concerning hosting. Their GitLab "burns through around 50TB of bandwidth per month", and though it was previously running on Google Cloud free credits, they ran out of them in 2020 and sought some other sponsor.
They found one: Equinix. They are "the largest global data center and colocation provider for enterprise network and cloud computing".
They hosted freedesktop.org's GitLab completely for free since 2020, but now they have decided to shut down the Equinix Metal team, which was hosting freedesktop. They have done so on somewhat short notice, meaning that freedesktop is now pressed to find a new home, and quickly so.
How much money are we talking about here? Well, the expenses on Equinix are $288k a year, but less expensive servers could probably bring that down to around $120k-180k.
Some further math brought that potentially down to $48k a year using Hetzner, even assuming no sponsorship from them.
After much discussion, Daniel Store announced that, and I quote,
We've made what we think is a good decision on hosting and network. We're just in the final stages of getting this fully arranged now, and are looking forward to announcing it - with a more concrete timeline - in hopefully the next couple of weeks.
Now, both the tentative date they want to transition by and what they have chosen as the host are publicly available on their GitLab. However, the issue specifically asks to "not advertise this a lot", so I think I'll just shut up and let you search for this information if you really really want it.
Now, I briefly mentioned earlier that this channel has a negative cash flow, but there are a few more words that are relevant to this story.
When building the LibreNews website, where you can find this video in article format, I needed some help, and blahaj.land reached out. They are not only hosting the website but also helped me build it. So, I think they deserve some of my money and a shoutout, so let me tell you what they do.
They offer all-in-one free services, from Nextcloud, to Git forge, to Matrix chat, secure file sharing, a well-federated fediverse instance, and much more.
They support multiple upload methods (like SFTP, private dashboard, Git integrations) so that hosting is as simple as possible regardless of the website you're running; and, their premium features are priced at just 1 euro a month (which includes custom domains, extra storage, and automated DNS management).
They are currently looking for contributors, so if you are a tech enthusiast you can go ahead and give them a hand build all of this – this isn't some random company, it's a community of very passion-driven individuals, I can safely attest that.
And, finally, they've just opened registration, so you can go ahead and create an account, all links in video description. They've helped me a lot to make the website, so they definitely deserve some love. Go give it to them.
Anyhow, freedesktop is in a bit of a better situation compared to the Matrix Foundation. However, do let me say a few words: I don't think it was by chance that we had two major open-source projects threaten to shut down unless given more resources, all in the same month.
I believe that this should probably prompt us to reflect on the bigger fundraising situation within the FOSS world. The open-source projects that are thriving seem to be those that are made to be for-profit, such as Nextcloud, and only few non-profits manage to raise enough to foster operations.
In the past few weeks, here at LibreNews, we've both covered individual project funding through donation campaigns, bringing KDE and Kdenlive as examples, and the idea of allowing payment to buy FOSS applications on Flathub. This article is another piece in the puzzle of the relationship between open-source and, well, capitalism.
Luca Bramè
Niccolò Venerandi
LibreNews Weekly Digest #2
Hi,
You can now select whether you want weekly or daily e-mails, or neither. (The setting does not have any effect right now, you get weekly regardless, but we're working on it!). By default, you're all subscribed to weekly, but you can change that from your account.
Anyhow, this week saw me investigating a couple of somewhat important stories; namely, the R4L/Martin Hector drama, and the OBS/Fedora drama:
Niccolò Venerandi
Niccolò Venerandi
I'm quite proud of both articles, which took many hours to research and write. On Friday we saw a few developments of both stories, and my original idea (COSMIC reaction video) had to be delayed, so I decided to do an unscripted update video.
Generally speaking, this is not how I want to deal with story updates over time. I however need to go step-by-step, and other things are taking priority right now.
Finally, I got around to writing and publishing about my experience with MALIBAL. I wanted to give this a light-hearted mood, but it also seems clear to me that the owner might be experiencing some mental health issues and, after writing, I wish I had been more careful with the topic.
Niccolò Venerandi
Finally, Luca also wrote an article this week, and it's about Flathub donations and maintainer burnout. You can find it here:
Luca Bramè
Members-only content
I can officially say that the first piece of members-only content will be published next week, and it should be somewhat exciting. If you currently donate on Patreon you will have access to it as soon as it's published. If you donate elsewhere, ping me up with your email here and proof of donation, I'll also give you access.
Thanks for subscribing! This website is still in heavy work in progress, and there's much more to come, but I'm very excited to see it growing. See you next week!
Why OBS and Bottles got in a fight with Fedora
Let's start with Bottles, and then ease to OBS.
Bottles is an application that allows you to run Windows software.
It relies on Wine, thus the name, and it makes it easy to create environments with specific Windows prefixes, settings, and dependencies. It lets you select various components to run those applications and comes with an integrated package Windows manager.
Many people bring the project forward, two of them - which you will often see in this story - are Hani Rana, a.k.a. theEvilSkeleton, and Mirko.
Now, Bottles does not have a set release schedule; on top of that, its dependencies change really fast, sometimes they are even custom-made, and a reliable environment is necessary to triage any issues that might arise.
Due to these reasons, packaging Bottles has been a somewhat complex and time-consuming task; and, due to not enough developer time around it, the Fedora RPM package of Bottles quickly fell out of date.
This led users to continue reporting already-addressed bugs to Bottles developers; and, on top of that, the packaging - according to Rana - was done incorrectly, introducing some bugs of its own. According to them, these bugs account for the majority of reports to Bottles developers.
This causes many issues for Bottles developers; not only do they have to deal with an increased bug-triaging workload, but their brand is damaged by these issues. As a direct example, The Linux Cast wanted to do a video about the application, but - due to an RPM packaging issue - he was unable to even start the application.
Oh, and this is not relevant to the story, but Rana points out that "In the example I provided above, we were really lucky for being aware of it, only because we were pinged".
And that's me! I pinged them! I'm in this story, too!
Oh, and let me quickly mention that if you prefer reading over listening, this entire video is also available as an article at thelibre.news; link in the video description. But if you prefer the video, keep watching.
Anyhow, as a result of all of these issues with packaging, the Bottles team asked Fedora to remove the RPM package, so that Bottles would only be shipped via flatpak. This would also improve security, as Wine can introduce some vulnerabilities that are addressed by Flatpak's sandboxing.
Though the Fedora people maintaining this project initially agreed to retire the package, they had a change of mind and decided to make sure it was not outdated for the next major release, and then to start looking for other maintainers for the package.
The Fedora team here is trying to say: "we know how to deal with irregular release schedules and changing dependencies; we saw interest in this package, so we'd like to keep working on it".
According to Fabio, from the Fedora side, the reason that the Bottles package was out of that is that one of Bottle's dependencies, orjson, could cause some segfaults, and they were trying to push a fix to the project. To quote him,
Again, Bottles developers might not care, but this is the reason why linux distributions exist. Because *we need to care* about these nitty-gritty low-level things to *make things work*, even if upstream developers don't (or cannot).
However, Bottle developers quickly asked Bottles not to be shipped as a Fedora package; understandably, they had lost trust that Fedora could keep up with the quickly changing requirements of the project and preferred the stability that Flatpaks was giving them.
Another point that they raised is that the Fedora maintainer for the package was sort of asking the developers to work with them, to some extent, to make sure the package was done properly. This was not something Bottles developers had the time or interest to do.
However, it seems like these requests did not stop Fedora from still intending to ship the Bottles package:
As a result, Mirko decided to retire the AUR package as well, and make sure to disable support links for unofficially distributed Bottles version, along with a warning and request to use the official one. On top of that, he says that "in the event of the removal of these controls or falsification of the product's identity, we will consider implementing restrictions on Bottles repositories for unofficial packages".
Personally, I felt like the Fedora person here missed the mark of the comment by replying with, and I quote,
The above sounds to me like it's one step short of moving to a restrictive none FOSS license. But, seeing that most of you are involved in open source in some way or another, I'm sure you are aware that doing so would close the doors for your audience.
That was the end of the story; Bottles developers did end up feeling highly frustrated and disappointed in their experience with Fedora packaging. However, there are a couple of other examples to bring up concerning this, but they require some additional context.
You're probably aware of flatpaks and their sandboxing benefits. I believe most people associate them with Flathub, where most flatpaks are distributed.
To get an application on Flathub you have to respect many guidelines, with the goal of "ensuring that the applications hosted on Flathub are safe to use and integrate well in the desktop experience.".
On top of that, some Flathub applications are verified, which means that the official developers (or authorized third party) claimed ownership of that specific flatpak. This tells you that you're downloading an application as it the developers meant it to be.
Though Fedora offers both Flathub and RPM packages, they also maintain their own flatpak remote, called - unsurprisingly - Fedora Flatpaks. Though it was meant to be used on Fedora, it can also be used on other distributions.
Now, would it shock you to discover that the announcement that I've just shown you comes directly from Hari Rana, the Bottles developer? The Open Source world is a small place, I guess.
Fedora Flatpaks has a few differences from Flathub. Firstly, they do not allow for any proprietary application to be shipped there; all flatpaks are fully open source.
Secondly, Flathub does not impose any kind of limitation on which source the flatpak re-uses to be shipped; this means that sometimes it's a deb package, sometimes an appimage, or a snap package, or an archive… Fedora Flatpaks all consistently re-use RPM packages.
According to Matt, the Fedora Project Leader, Flathub rules are quite lax and there's not much of a review, without checking that it was built with good practices. Fedora Flatpaks are instead built with their secure pipeline so that the user can have more trust that the package is going to be what it says it is. By the way, he says this in a 40 minute interview with Brodie Robertson, which I would suggest that you go check out.
As a result of all of this, according to Neal Gompa, a few distros are considering to use Fedora Flatpaks over Flathub.
However, this new system also has its own issues; namely, sometimes applications are shipped with more bugs compared to upstream.
Take Fractal as an example. Recently, a missing dependency issue went completely unnoticed; as a result, the Fedora Flatpak version lost the ability to see images.
As a developer points out,
The upstream Flatpak on Flathub was properly tested by the developers, and included all the components needed for correct functionality. During the period when this broken Flatpak was available, a number of people came to the Fractal matrix channel looking for help. The response given to them was almost universally "The Fedora Flatpak is broken, switch to Flathub and report a bug to Fedora".
This is not an isolated example. Fedora codec policies also mean that Kdenlive and media players will not be able to edit or play media, without a clear indication on why this is happening in the first place.
A similar situation was happening with OBS, the program that I'm using right now to record this video.
The Fedora Flatpak version of OBS is shipped with multiple issues: missing hardware acceleration, crashes on X11, VLC plugin not working out of the box, and they also included third-party plugins out-of-the-box.
On top of that, due to either technical or legal reasons, that package also lacked a Twitch/YouTube panel.
The above issues (and many others, such as this one) were regularly reported to OBS directly, which often had to close them and point out that the Fedora Flatpak version of their program was unofficial.
Over time, the usage Fedora Flatpaks raised some concerns. As an example, one developer - Jordan Petridis - decided to propose GNOME Software to always use the verified Flathub application over any non-verified one. In practice, this would mean that if an application is shipped to Flathub by the developers themselves, then Software would always install that one, instead of using other remotes such as Fedora Flatpaks. This change was eventually accepted and merged.
Another discussion that's still ongoing is the ability to set a default remote to download applications from. Right now you can only select it on a per-application basis, and there's no UI way to say: hey, I always want to download from Flathub instead of Fedora Flatpaks.
Oh, by the way, KDE Discover does have this functionality out of the box. This does not matter, but I just had to point this out. I'm a KDE developer if you didn't know.
Oh, and since I drifted off topic anyway, let me mention that this video is not sponsored by anyone, and yet it took time and money in equipment and contractors to make it. You can help support this channel via a donation on Patreon, Liberapay, Ko-Fi, and Paypal. Anyhow, back to the topic.
The discussion did not just happen over GNOME, but an issue was opened in Fedora too, asking to "Deprioritize or remove Fedora Flatpaks, and prioritize Flathub in GNOME Software", due to "quality issues when using Fedora's flatpak apps".
One of the people who disagreed with this proposal was Yakoov Selkowitz, also the maintainer of the OBS Fedora flatpak. According to him,
Many of these complaints would apply equally to the RPMs. I see this as no different than the Bottles fiasco from earlier. If software is FOSS then by definition we must have the right to redistribute it as we please, and upstreams cannot restrict that and remain FOSS. As such, I don't think we should need to entertain any such "requests" by upstream to not distribute "their" software in whichever form it may be. (Personally, I take a very dim view on such "requests".)
Which, by the way, is why I started this story by talking about Bottles: I believe you should now start to see a pattern emerging. Another interesting quote from his message is:
Based on what I've seen in discussions along these lines, what we have is a new era in which upstreams now believe that, thanks to Flathub etc., they don't need distributions anymore for their software to reach users, no longer see the value in distributions, and simply wish to cut out the "middleman" entirely. However, that does not give them the right or power to do so.
The discussion continued for pages and pages; just a couple of weeks ago, developer Michael Catanzaro said that, after a long discussion during a Workstation Working Group meeting, there was some level of agreement that "Fedora Flatpaks are generally the worst software source for users to install" and that "Good Flathub should be preferred over Fedora Flatpaks".
During all of this, four weeks ago, Joel Bethke from the OBS project created an issue to ask the Fedora OSB flatpak to be either removed, or to make it clear that it is a third-party package. Given the issues presented above, this can only seem like a reasonable request.
Discussion about this was happening in the other thread I mentioned, but it was more general. Around the same time, Georges Stavracas also raised the issue, saying that overriding the only official version of OBS with a Fedora-specific flatpak was unacceptable.
However, in all of this, all the issues of the OBS Fedora flatpak were being reported to OBS, not Fedora, which meant that Yaakov was completely unaware of the issues; thus, he just asked for those issues to be raised to Fedora, a request that Stavracas deemed absurd.
Eventually, when told that Fedora does have the right to redistribute OBS, Stavracas asked for a rebrand to make sure it was clear that the project was unofficial. Overall, this came out to be yet another bad experience with Fedora packaging.
As a final bit of context, during the conversation on whether to deprioritize Fedora Flatpaks in favor of Flathub, it was pointed out that OBS was currently relying on a EOL (End Of Life) version of Qt, the graphical toolkit to display the interface due to regressions with more modern Qt versions.
My understanding is that Fedora Flatpak maintainers decided that this was unacceptable, and decided to ship OBS with a more recent Qt version; one one hand, I can understand the choice to avoid End Of Life runtimes; on the other hand, you're intentionally shipping something that was deemed too broken to work by OBS developers.
As a result, Michael Catanzaro pointed out that allowing this to happen was terrible maintainership on OBS side, and showed that Fedora Flatpaks did have an added value compared to Flathub (since it used a more up-to-date Qt version).
The words "terrible maintainership", plus Bethke's request to remove the OBS flatpak getting completely ignored, prompted OBS to take stronger measures. They thus threatened Fedora with legal action if they kept using their branding for the unofficial flatpak, asking for a response within 7 business days.
It's worth noting that the very first like that this comment got was by Hari Rana, who had been previously disappointed by Fedora handling of upstream "remove us" requests.
Immediately Neal Gompa, the maintainer of the RPM package of OBS, reached out to the project to try to do damage control.
He created an issue to remove the obs-studio flatpak from the registry, immediately. This raised some discussion on how exactly to do that: if you just remove it, it will still stay on the users computers, and the only result is that their version will slowly go unmaintained until they delete and re-install the application. However, this discussion was finally taking place.
The option to rebrand the flatpak to avoid using any of OBS branding was also briefly considered, but ultimately none of this ended up being necessary.
As another way to immediately address the situation, Yakoov marked the OBS flatpak as End Of Life, within hours of OBS's request.
Nonetheless, a great amount of discussion was raised in the thread. Hari Rana pointed out that previous response on these issues were "shallow and completely inconsiderate of our point of view", and specifically mentioned Yakoov's "unwillingness to cooperate until the trademark enforcement occurred".
Bethke agreed with Hari, mentioning a "lack of willingness to work with upstream".
Yakoov decided to apologize for the lack of responses in the initial thread and offered to have a direct talk with Bethke. This seemed to have worked, as he then retracted his request to remove the flatpak immediately and said that he felt like now he could work with Fedora to tackle the issues presented in the Fedora OBS flatpak. He said, and I quote,
The discussion was positive and they are actively working to resolve those issues as well, which should hopefully only affect a small number of users.
Thus, I can only praise the good damage control of the Fedora project here, especially - I think - by Neal, but also Yakoov and others. Of course, it would've been better to avoid this conflict altogether.
This does not solve the broader issue by any means, though. The Fedora Flatpaks still exist, discussion about them is still active, and it's not yet clear when users should be directed towards them, and when they should use Flathub instead. Matt, the Fedora Project Leader, has stressed that Fedora cares a lot about good collaboration with upstream projects, and I can believe that these were just a few exceptions where the discussion got heated; however, I'm still not fully comfortable with a Fedora maintainer saying that upstream does not have the right to ask Fedora not to re-package their application. I don't like that.
This Linux laptop maker called me a Zombie
Two years ago I was contacted by a company called MALIBAL.
They were interested in a sponsorship, where I would simply put their link in the video description and get money for it.
I did a quick background check, and they seemed like a proper Linux hardware manufacturing company. I said I'd be happy to shout them out in the videos too, and we agreed on a price.
Initially, things seemed to be going pretty well. They did decide that my demographic wasn't that appealing to them and that they would thus sponsor one video per week, which is reasonable.
However, I made a mistake. I changed my publishing schedule last minute, which meant switching the description sponsorship from one video to another; what I did not notice is that towards the end of the video that I chose to be sponsored, I said, "This video is not sponsored." Big mistake on my side.
MALIBAL did notice. This is the sort of mistake that I can quickly fix through the YouTube video editor, but they preferred to directly end our partnership without enough context for me to realize the mistake. They also told me to bill for the GNOME video as usual.
One month later, as agreed, I billed them for the video. I still had no idea about the mistake. They replied with, and I quote,
You have a lot of nerve sending me this invoice considering you literally say in the video that it's NOT sponsored. What a crackhead. Did you really think you were getting away with that? KDE is the trash bin of the Linux world. There is no wonder that's what you like [sic]
Woah. I decided to explain the mistake due to the change of schedule, and that I could've fixed it in the YouTube editor; but, I also pointed out that this sort of language was unacceptable.
They replied with the simple sentence "You're a zombie who is dead and empty inside. You don't even exist".
And that was it. I no longer did any sponsorship with MALIBAL, and I thought that was going to be the end of it.
However, if we perform a quick research on the user experience with MALIBAL, we discover that this type of reaction is pretty common.
One user said that when he tried to cancel the order due to slow shipping, they replied with "Don't ever place an order with us again or it will be canceled", and soon after: "Good one, zombie. You don't even exist. Back into the abyss you go".
Another user received the reply "It's the response a phantom, zombie like you deserves. You don't exist. You're not a person. You are here to simply suck life out of the human. If you weren't dead and empty inside you would feel shame for what you have done".
These are just a few examples. Reddit is full of this kind of support replies after the slightest pushback from the clients.
Even people who claim to have worked with MALIBAL professionally state that they had to "decline their business" as they were "too difficult to work with", eventually being called zombies as well.
This is just the tip of the iceberg in terms of the general weirdness of MALIBAL.
Firstly, they issued a response to this whole "zombie" accusation by trying to say it did not happen (but it did, it happened to me too), and saying that the official name of the accusation is "Zombiegate".
To distance themselves from it, they listed all of Apple's scandals, and then claimed that what happened with them is not that bad compared to it.
I absolutely love their closing statement here:
Our commitment? To tirelessly support our customers—zombie, ghost, or otherwise—while maintaining a level of integrity befitting the smallest scandal possible. After all, the abyss awaits us all… but here at MALIBAL, we’ll send you there with a smile. 🙂
I can't help but laugh to think that the person replying to the emails with insults is the very same person that approved this text.
As another example, due to a discussion about coreboot that I will later focus on, they have decided to ban the entire country of Germany from their services. They banned … Germany, due to the actions of a single person there. Oh, and they also banned Austria and Liechtenstein, because they're also Germany. Somehow.
They also don't ship to California due to regulations impacting small businesses there.
They also don't ship to Colorado due to the actions of Jeremy Soller.
They also don't ship to Maryland due to the actions of Matt DeVillier.
They also don't ship to Poland due to the actions of Piotr Król.
They also refuse to ship anything made by AMD due to, again, Matt DeViller.
Or - I just can't stop now - in their terms and conditions, it specifically says that you cannot use Chrome to access their website, nor can you use GMail to create an account in it, nor can you use a Pixel Phone to access it, nor use the Android operating system to view it, or any other products including Google Search. You literally cannot use Google Search to open their website, according to their terms and conditions. What!? If you are found to use any of these technologies, your account will be terminated without notice.
Oh, and, by the way, the same applies to Apple. You can't access the website through Safari, an iPhone or any MacBook, or register using Apple Mail.
Oh, and, by the way, the same applies to Reddit users. If you use Reddit frequently, you are prohibited from using this website. They also have half a page just to explain exactly what they mean by "active Reddit user".
They have quite a track record of doing all of this. Back in 2017, they were already in business and they were allegedly censoring negativity on notebookreview forums and banned users who had good warranties after they made negative comments.
More recently, they managed to get into the Linux news circle by publishing an article called "Don’t Support the Coreboot Project".
What happened? Well, they wanted their machines to support Coreboot, so they contacted 9elements to ask for coreboot-supported boards. When they learned that they were priced between 50k and 100k, they decided to instead develop them themselves. However, they did not have the necessary skills to do so, which made them come back to 9elements to ask them for help.
Now, Christian does not speak English natively, and he did apologize for the sometimes broken language and typos in his emails after this article was published. It however seems like most of the conflict stems from the fact that MALIBAL thought their code was pretty much ready and only required a little bit of debugging, whereas 9elements thought that there was much work to be done still.
Christian offered to work to support coreboot on the laptops by taking a commission for each laptop sold, something MALIBAL saw as borderline stealing. Then, when they were assigned a developer called Max to work on the project, MALIBAL complained that he was not experienced enough.
MALIBAL was also asking for updates to what it seems like an unreasonable pace. You can see it in their own article, as they point out that "several more days passed without any updates". This was also later confirmed by 9elements.
They started accusing Max of not working at an actual full time rate but only a few hours, and they asked for another developer to be working on the project. Mind you, by now, there was still no contract with 9elements and MALIBAL had not paid them anything.
Eventually, Christian got fed up and decided to end the collaboration. They sent back to MALIBAL the test hardware they were given, and they did not charge them for anything.
MALIBAL then tried to collaborate with a second contractor company, 3mdeb. However, they were annoyed by the fact that 3mdeb offered a lower price if MALIBAL had used a Dasharo-braded coreboot instead of an unbranded one.
Frustrated, MALIBAL completely ignored their quote (which was 33k for Dasharo coreboot, and 66k for unbranded), and asked to pay $150 an hour with daily updates.
I do admire how 3mdeb managed to stay professional in their reply, where they pretty much said "we don't do per-hour contracting, we've sent you the quotes, that's what we're asking, and you can't just make up your own price".
As a very mature response to these two experiences, MALIBAL contacted the Coreboot project and asked to please remove 9elements and 3mdeb from the list of official contractors. Coreboot obviously refused, but Matt DeViller - from the Coreboot leadership team - told them he would try to help port Coreboot to their laptop.
Now, I just have to read you the quote of their article about Matt, because it's pure poetry.
Matt DeVillier is the type of person who will suck your will to live out of you and leave you for dead. Nice guy. He embodies every trait you would never want in someone you hire for a job. He’s unprofessional, unreliable, untrustworthy, irresponsible, and incompetent. And, of course, he’s one of these types who will bludgeon you with all of these virtuous qualities, and if at any point you dare say a word in protest, he’ll try to turn things around and act like you did something wrong by calling you toxic. No, we’re not toxic, Matt. You just really honestly truly suck.
What did Matt do to deserve this? Well, the day after receiving MALIBAL test hardware - still without being paid anything, mind you - he was assigned a high priority project for AMD and warned MALIBAL that he could only start working a couple months from now.
During this wait, Matt started buying the tools needed to work on this project. However, he bought one from China, which MALIBAL seems to consider a mistake in itself. He then decided to source one from the US.
Then, he pointed out that his unit had a damaged UART connector. This is also something MALIBAL blames on him.
They continued to put pressure onto him, asking for almost-daily updates, until Matt decided he was no longer interested in working with MALIBAL.
Since Matt claimed to have done nothing wrong, MALIBAL offered to let a neutral third party decide to arbitrate the matter – which I truly don't understand. Are they trying to get a moral high ground through some weird litigation process? They did not even pay the guy.
The article is full of extremely aggressive sentences, like "This is the type of gaslighting you would only expect from a sociopath" and, also poetry,
[Maximally bad] is where you do such a horrible job that it’s impossible to have done any worse. Not impossible for a person to have done worse; impossible for anyone or anything to have done worse: a person, a monkey, a rock, etc.
MALIBAL concludes this whole piece by saying that they think that it's possible to finish the project is barely 40 hours. They are unable to do it because they don't seem to have the skills to, but still, 40 hours.
Finally, MALIBAL wants us to know that during these exchanges, they've tried their best not to offend anyone and get along as much as possible. As an example, they did not anyone "a monkey", nor have they implied that they were one. Thanks, MALIBAL.
Now, most parties involved did briefly reply to this article. Matt stated:
FWIW, none of the entities listed ever charged or were paid by Malibal for any work done. Evaluation of the state of their existing work and what they wanted done was done as a courtesy, and any further work was declined by the consultant(s). No contracts were ever signed, no statements of work produced.
9elements also published a blogpost, which includes the following quote:
Throughout the engagement, we encountered communication challenges, including frequent status update requests and a misalignment between expectations and technical realities. The initial firmware required considerable work before it could be tested on hardware, which understandably caused some delays. Unfortunately, during this period, the tone of communication from MALIBAL became less constructive.
Now, I would love to know more about who's behind MALIBAL, and what's happening within the - probably, single-person - company. However, I have not found any information about that; if you have any, please feel free to contact me.
I do fear that, by publishing this piece, I might get the entire country of Italy banned from them. But I believe it's a risk worth taking.
Why the Asahi Linux lead developer resigned
Let's take a step back.
I decided to begin this story in 2019, during the Linux Security Summit.
Developers Alex Gaynor and Geoffrey Thomas decided to hold a talk called Writing Linux Kernel Modules in Safe Rust. In it, they made the case for adopting Rust in the Linux kernel. According to them, that would improve security, as two-thirds of vulnerabilities were due to memory-safety issues.
A few months later, in June 2020, Linus expressed interest in this option during an interview with The Register. He said, and I quote,
[The kernel team is looking at] having interfaces to do those, for example, in Rust... I'm convinced it's going to happen. It might not be Rust. But it is going to happen that we will have different models for writing these kinds of things, and C won't be the only one.
Then, in August 2020, the Linux Plumbers Conference was held (virtually). The event's most attended session was about open questions on accepting Rust upstream in the Linux kernel. It featured both Thomas and Gaynor, but also Rust language team co-leader Josh Triplett and many others.
Finally, the Rust for Linux - or, in short, r4l - project was announced on the Linux mailing list. The goal is not to rewrite the entire kernel in Rust, but to allow new code to be added over time.
A few months later, Apple announced that they would be switching away from Intel x86 processors. I was quite shocked at the announcement, and the reviews quickly showed that we were dealing with a very well-performing device with a great battery life. Of course, there was no chance to run Linux out of the box on these.
In November 2020, Linus was asked what he thought of this new kind of device in the Real World Technologies forum. He replied,
I'd absolutely love to have one, if it just ran Linux... [...] And I don't have the time to tinker with it, or the inclination to fight companies that don't want to help.
Someone else picked up the challenge – Hector Martin. He was part of the Team Twiizers (later called fail0verflow), which allowed him to run unofficial applications on the Nintendo Wii. In 2016 he also ported Linux to the PlayStation 4, just after being sued for hacking the PlayStation 3.
However, he burned out. A major factor were users; quote,
Most people using our software just wanted to play pirated games (something we did not support, condone, or directly enable). We kept playing a cat and mouse game with the manufacturer to keep the platform open, only to see our efforts primarily used by people who just wanted to steal other people’s work, and very loudly felt entitled to it.
When Apple released the M1, he thought that could be a much more interesting challenge – there would be no entitled users who want to pirate software, plus no necessity for a jailbreak either.
He thus announced the Asahi Linux project, asking for funds to get it started. The name, by the way, comes from the Japanese name for McIntosh apple.
He started a Patreon with a 4k€ monthly donations goal, which was reached within days, and surpassed too. He now had both the money and the determination to bring Linux to M1 Macbooks.
When deciding what language to use to write drivers with, the project bet on the newly-announced Rust for Linux initiative and decided to go with that. According to Hector,
Rust is the entire reason our GPU driver was able to succeed in the time it did. We have two more Rust drivers in our downstream tree now, and a third one on track to be rewritten from C to Rust, because Rust is simply much better suited to the unique challenges we face, and the C driver is becoming unmaintainable.
Of course, this meant tying the long-term success of Asahi to the r4l project, at least to some extent.
In the short term, this bet paid off. In a couple of years, they were able to have great support for the M1 MacBook Air, and Linux 5.19 was even released by Linus from an M2 MacBook Air running Asahi.
Even better, during the Open Source Summit of 2022, Torvalds was interviewed by Steven Vaughan-Nichols of ZDNet. In the interview, Linus said that he would like the first signs of Rust infrastructure to be merged in Linux 6.0 and that he was cautiously optimistic about this goal.
Indeed, Linus was a bit too optimistic here. The merge request containing initial Rust support in the kernel was only merged in 6.1, and overall the r4l project was not advancing at the pace that Torvalds was expecting, or hoping, to see.
Indeed, during the 2024 Maintainers Summit (a 30 people invite-only event), Linus said that
nothing depends on Rust in the kernel now, and nothing will for some time yet. What is important is to make forward progress, so developers should "steam right ahead" and not worry about these problems for now.
Here's another important quote from Jonathan Corbet's report of the event:
Linus Torvalds admonished the group that he did not want to talk about every subsystem supporting Rust at this time; getting support into some of them is sufficient for now. When Airlie asked what would happen when some subsystem blocks progress, Torvalds answered "that's my job".
This is important, as Linus is directly taking some level of responsibility on this topic. Hector Martin was not part of the Maintainers Summit, but he did send an email to Linus to say he was available to talk, given his experience with using Rust in a high-profile downstream kernel. However, Torvalds never replied.
In a 2024 interview by the very same Steven Vaughan-Nichols, Linus expressed disappointment that the introduction of Rust was not going faster.
I was expecting updates to be faster, but part of the problem is that old-time kernel developers are used to C and don't know Rust. They're not exactly excited about having to learn a new language that is, in some respects, very different. So there's been some pushback on Rust.
This is an issue for the Asahi project, which relies on r4l to work. It's not the only one, though; Martin also started having issues with entitled users again.
According to him, users would repeat over and over the same questions and criticisms of the project: When is Thunderbolt coming? What about external monitors via USB-C? Battery life sucks compared to MacOS! …and so on.
If I may very quickly share a personal opinion in this otherwise somewhat objective piece, I would like to say that I've had the same issues before. I've implemented some features and received criticism for certain decisions behind them, or bugs that they caused; I've also received pushback when I instead chose not to implement this or that. This used to drag me down quite a bit, and it did have some impact on my mental health; I'm now starting to believe that it's part of what I do, and the feeling of being surrounded by entitled users is more a matter of how we community-driven developers approach our job rather than the world around us. But that's just my opinion.
Back to Martin, he also noticed that donations were decreasing month after month; the more features he implemented, the fewer donations he received. He interpreted this as a decreasing interest in Asahi.
Also, a lot of development time was spent rebasing Asahi Linux changes on top of the latest versions of the kernel. He tried to upstream code, but he found the experience to be "incredibly frustrating".
All of this was on top of some personal issues that he encountered in 2024, and which he prefers not to share publicly.
All of this gets us to this merge request, which aims to "add dma coherent allocator abstraction", in Rust. Now, I wish I could tell you what that means, but I haven't the slightest clue. The important part is that this was written in Rust (or at least uses Rust to some extent).
The patch was rejected by maintainer Hellwig, with the single sentence "No rust code in kernel/dma, please".
To be fair, Danilo, who had proposed the patch, did try to argue why the usage of Rust was justified here, and he did say he was willing to take care of the Rust abstraction that it needed to work.
Hellwig again replied with something along the lines of "don't force me to deal with Rust", to which Daniel replied with "We're not asking you to, we're doing an abstraction as you asked us"; Hellwig did not further reply, which Daniel interpreted as green lights from him. Other developers also pitched in saying that the level of abstraction seemed reasonable.
A couple of weeks later, Hellwig again replied by blocking the patch, and specifically saying that Danilo was trying to "spread this cancer to the core subsystem", where "cancer" refers to using multiple languages in the same codebase.
And, a few emails later, he explained that he opposed crosslanguage codebases (and, thus, the r4l project as a whole) so much that he would "do everything [he] can do to stop this". This seems to be a good example of the maintainer issues that Linus was talking about.
As you might've noticed, this entire thread went on without Hector Martin pitching in. However, as mentioned, the Asahi project relies on r4l, and this patch was needed for two of the three drivers they developed.
Martin expressed his frustration on Mastodon, pointing out that the "I will do everything I can do to stop this" can be interpreted as an attempt to sabotage the r4l project as a whole, and that he considers the usage of the word "cancer" to refer to r4l a Code of Conduct violation.
Now, he was deeply criticized for this post, and he has deleted it since then. However, I would like to defend him here. Hellwig words seem to be extremely hostile towards the r4l project, which has existed for years now with the explicit support of Torvalds. Though I might not agree with the wording Martin chose, or the Code of Conduct accusation, I believe the frustration is fully understandable, and ranting on his personal social media account is normal here. I don't take issue with this specific choice of his.
And, to be clear, he also sent a more detailed reply to the mailing list. He also added Linus to the thread – a fair action, I think, given how he has some responsibility over this development. He also suggested to Rust folks to "not waste your time on drama like this".
Now, this is not the first time Hector Martin has vented on Mastodon about the pushback from certain developers to the r4l project; as an example, here's another post that is pretty, uh, strong:
In the patch list thread, a few developers argued that this sort of attitude is toxic too. To quote them,
To back up Sima here, we don't need grandstanding, brigading, playing to the crowd, streamer drama creation or any of that in discussions around this. [...] Being toxic on the right side of an argument is still toxic.
And, finally, as a response to these last few messages, Martin replied with a exhausted message, explaining all of his frustration with the current processes in the kernel. He complains about outdated tooling, nitpicking, unnecessary delays, bikeshedding, and more.
This is where Torvalds stepped in, but he did not say a word about the patch itself and only commented on this last vent by Martin. To quote him,
How about you accept the fact that maybe the problem is you. You think you know better. But the current process works. [...] The social media brigading just makes me not want to have anything at all to do with your approach.
I feel like this accusation is somewhat unfair. Hector Martin did not organize any kind of brigading, which is when a community purposefully targets another space to damage it, flood it, or otherwise change its working. This did not take place at all: Hector Martin shared his frustration on social media, which I believe to be an understandable reaction. Linux news sites picked up on the accusation and some buzz arose, but nothing was organized, nor was the patch mailing list hijacked. Linus is pretty much saying, if you have a problem with how we do things, you are not allowed to vent about it on social media, otherwise I don't want to have anything at all to do with your approach.
Evidently, this last exchange raised some thoughts in Martin, who - given all of the context that I've given you, and not just this discussion specifically - decided he was no longer willing to give up his free time and hobbies to work on Asahi. He stepped down to seek better mental health, which is something I respect.
He has closed his Patreon and OpenCollective and asked his GitHub sponsors to unsubscribe from him.
However, the Asahi Linux project won't die off. A team of seven people - including, by the way, Neal Gompa, hi Neal! - will continue his work, focusing on upstreaming changes, implementing DP alt mode, sparse images, and getting internal microphones working.
You can donate to the Asahi Linux project directly, as they have now set up their own OpenCollective account that is independent of Martin. They say,
Our community will miss him. Still, with your support, the project has a bright future to come.
Before I go, did you know that this video took hours to make and yet it is not sponsored? I also have to pay servers, equipment, and collaborators – which renders this channel a net negative on my finances, right now. You can help me change that by donating on Patreon, Liberapay, Ko-Fi or PayPal – links in the video description.
But, you can also subscribe to or become a member of thelibre.news, the website which contains all of these videos but in an article format. There will soon be some extra content over there, I'm working on it.
LibreNews Weekly Digest #1
Hi,
I have decided to send you a weekly digest instead of emailing you for each article we publish (i.e., once a day). There will soon be a setting to customize whether you want weekly or daily emails (or none at all), but you'll have to bear with me for now.
I would also like to apologize for a broken email I sent earlier this week. I have now learned how to preview emails before sending them. Won't happen again!
So, what were we up to this week?
Niccolò Venerandi
The most popular post by all was my brief experience with Linux on the Duet 5. Though I love the device, I have not yet managed to install Linux on the internal drive, and I'm still daily driving it via USB stick. I've also been contacted by an Ultramarine developer who will send me an image to try out. Sounds like there's still fun to be had there.
Niccolò Venerandi
A close contender for first place this week! I decided to talk a bit about what Union and Plasma Next are (i.e. "the future of KDE design and theming"). Props go to Arjen and Andy for the projects. I've been contacted by the latter to maybe do some KDE design collab; could be interesting!
Luca Bramè
A great article by Luca. He claimed the first spot last week, but this time around I did manage to beat him. He was under a bit of pressure due to exams, but he should be back next week with an update on GNOME 48 and an article about the monetization of applications in Flathub.
Niccolò Venerandi
Whops, this one didn't do that well! Really, I just wanted a very simple article on fundraising of both Kdenlive and Plasma, though it ended up being quite video-editor-heavy.
There's one article less than usual since I also had an exam on Friday, so I decided to take a bit of a break. Do expect full content for the week ahead.
Members-only content
One day, this section will have some extra content for LibreNews members, i.e. those donating to the channel. Though, I'm still working on setting things up here.
If you are a patron and you subscribe here with the same email as Patreon, you will automatically be added as a member here too. I'm working on a script to automate that, so fear not if it has not happened yet. There's nothing to see anyway, yet.
That was everything for last week. See you in a few days!
The Kdenlive Fundraiser
Just a few years ago, Kdenlive - KDE's video editing program - launched a fundraiser.
It wasn't just any fundraiser – but rather, one where the explained it detail exactly why they needed the money, and what they were going to do with them.
Very quickly, they promised to bring nested timelines, better effects workflow, performance boosts, and much more. The community clearly reacted well to this announcement, and the project has managed to achieve its goal of 15 thousand euros.
They had also set some stretch goals for 20k and 25k targets; In total, the managed to raise 23 thousand euros from 677 donations; of those, around a grand had to go to platform and processing fees, whereas 20% was given to the KDE eV to cover infrastructure; this leaves the grand sum of 17 thousands euros just for Kdenlive.
When trusting a project with such a large(-ish) sum of donations, it's fair to expect that project to have some level of transparency over what exactly is happening, and how that money is being spent.
Indeed, we've seen frequent blog posts about the latest developments, spring recaps, and even in-depth articles on certain bug fixes from the websites of the developers themselves.
Now, the Kdenlive project is sharing its final fundraising report, covering everything that was done purely thanks to that donation boost. I would really love to tell you about it since it's a great example of how we can effectively "monetize" a free and open-source project with the ultimate goal of helping it grow over time.
Firstly, timeline nesting. In the documentation of Kdenlive they're actually called "sequences", and they are timelines that can be rendered independently, but they're all part of the same project and they share the same settings.
Sequences act like clips, too: you can open a sequence and play it in the clip monitor, or drag and drop it into a difference sequence. This way, if you edit Sequence 2 - in its own timeline, and rendering it independently - those changes will update live in Sequence 1 as well.
You can create a new sequence from the menu, and once you do that, a tabbed view will appear just above the timeline. This will also unveil a new button to create even more timeline sequences.
There are various goodies here and there; as an example, if you double click a Sequence clip in a specific point, Kdenlive will display the timeline of that sequence, exactly in the point that you've double-clicked.
And, you can even duplicate them, just like that!
Even better, you can have some sort of re-usable sequence, where you copypaste just that sequence between projects instead of having to each time copy all the elements that you want to re-use.
You could also create multiple versions of the same video by editing one time, and duplicating that sequence, and working on the duplicated one; then, you can independently render each. Previously, this was only possible by creating multiple Kdenlive projects for each variation.
New, the Kdenlive developers do admit that this feature was rushed a bit on release and that it caused "annoying instabilities that are now solved"; they recommend to only use it from the just-released 24.12.2 version.
Next up we have various goodies in effects management, just like promised.
We now can edit multiple effects at the same time. If add an effect to a group of clips, you will see the number of clips it affects, and you will be able to edit the parameters for all clips at the same time.
We also now have various different easing modes. If you've ever tried to do some basic animation work in Kdenlive, you know that it only used to support discrete, linear, and "smooth" easing curves, none of which was particularly pleasing to the eye, in my opinion. We can now select a whole lot of them: Cubic, Exponential, Circular, Elastic, and Bounce – all available in both In and Out versions. I love to see that.
The Transform effect now has a monitor grid that you can enable/disable, and if you do have it on, then the clip will automatically snap to it. This allows you to very quickly align different clips down to the pixel.
On top of that, if you wanted to move a clip around, you used to have to select it from the timeline first, and only then you could drag and drop it in the monitor overlay. Now, you can just click the clip you want to move on the monitor, and the handles will appear!
The interface itself was redesigned too with - and I quote - "clearer organization of keyframeable and non-keyframeable parameters, improved layout consistency, more compact and clean".
Each effect also now has a help button that will open the documentation regarding that effect specifically. This one is a small change, but I love too see it.
That was all for effects. However, there are still a few goodies here and there, before I start talking a bit more about fundraising.
Firstly, performance boosts. The Spacer tool is now pretty much instantaneous (I can confirm that this option was previously quite slow). Audio and video rendering is slightly faster, though no numbers there. Better hardware encoders support, and optimized some parts of the timeline qml code to handle out-of-view items.
On top of that, there's been a complete re-work of how Audio Waveforms work. The new system is three times faster - which is amazing - and much more reliable. The resulting waveform is also much more accurate. The reference that you see comes from Audacity, which is a bit of a reference implementation in these kinds of things; the improvement of the new visualization is pretty clear, and this does help editing a lot: I often find myself looking for specific bumps in waveforms to know where to cut a clip.
The new waveform generation was merged for the next major release of Kdenlive, which is 25.04.
If you're also willing to stick with this project until later this year, when 25.08 will be out, then you'll also get the OpenTimelineIO integration that Darby Jonhston is working on. This will allow importing and exporting of project files to this open standard. He's managed to already implement the export/import of a timeline with multiple tracks and clips and support for markers and guides; we're now only waiting for support for transitions.
The team is also working on improving their QA efforts; they have implemented a way to automatically check for rendering regression, and now this should run automatically to make sure that each release is, I quote, "more stable". Yay!
Finally, the Kdenlive project gives us a roadmap of features that they plan to support soon. In the short term, they want to implement a "graph editor for easing modes", which will be part of the Summer of Kode initiative. Then, there are advanced trimming tools, keyframes per parameters, markers with a time span, and link sequences from multiple project files together. All of these sound like great features to have.
Glancing very quickly at the further future, we see the above-mentioned OpenTimelineIO integration, but also "AI effect integration", 10/12bit color support, project templates, remote collaboration editing (which I would love, by the way, I share kdenlive files over Nextcloud to have a similar experience). And, one day - hopefully - we'll also get RAw footage support, OpenColorIO, OpenFX, a Python AYI, Node-based compositing and effects, and so on. These last features understandably would take a lot of time and effort.
We now get to the you part of the video.
Sure, the Kdenlive fundraiser concluded two years ago, but you can still donate to the Kdenlive project and your money will be used to continue these efforts; in my humble opinion, Kdenlive already is the best open source video editing software, and with your help, we can push it to be a viable option in more and more commercial contexts as well.
Now, if you're not that interesting into video editors -- did you just watch me talk about them for, like, ten minutes? And you don't care about them?
But still, even if, the whole KDE organization is currently looking for donations to keep all the projects running and growing. As one way to try to raise more donations, the team has launched a very noteworthy campaign just last December:
they have decided to simply … ask for donations in a Plasma notification exactly one for a year. And, if you press "No thanks", the notification will never appear again, ever. We thought this was a pretty reasonable way to ask for money for a project that you're enjoying.
This worked out incredibly well.
If we only go look at the donations for the year 2024, you can see that this simple notification has increased donations from an average of 5k€/month to 110 thousand euros in just December. And these are just PayPal donations – even more were done through other means, such as Donorbox.
The KDE eV does have contractors working on improving KDE software, and this end-of-the-year boost is a great help to make sure it's able to both pay all of them and still offer to cover travel expenses to developers when attending sprints and conferences.
My New Favorite Linux Laptop
Hi, and welcome back to the never-ending journey of finding Niccolò's perfect laptop. Sadly, I have not found it yet. But I have something that gets close to show you.
This is the Lenovo Duet 5. It's out of stock, so don't rush to buy it, but you can get one for a few hundred bucks on eBay. I have mentioned this device previously on this channel, but I have some new updates.
Let's talk software. This thing ships with ChromeOS out of the box, which is a dealbreaker. I could not use it for actual productivity tasks, or work. Which is why I would only ever bring it out to watch movies and maybe write some stories. That's it.
However, I was contacted on Telegram by a user called Jules Berre (I'm sorry if that's not how it's pronounced) who explained that I could run native Linux on the Duet, and he assured me that it would run very well and with almost everything working out of the box. Needless to say, knowing how these things go, I did not believe him. I was wrong.
The first step was to enter developer mode, which you can do from the bootloader. This is quite easy, but it does trigger a complete factory reset – that's fine by us since we'll replace ChromeOS with Linux anyway.
Then, I downloaded the PostmarketOS image for my device, codenamed Trogdor. This was the hardest step in the whole process, as the download kept failing due to connectivity issues, and I had to repeat it multiple times.
But when I finally had a correct checksum on the image, I flashed a USB stick, connected it to the Duet, selected "boot from external drive", and - voilà - Plasma 6 was running before my eyes. And immediately I was like, no way. And the Duet was like, way.
I started running my checklist of what worked on what didn't, out of the box. Touchscreen, keyboard, and touchpad – including touchpad gestures? Check.
Okay, but what about stylus support? Check. Mmh, pen pressure levels? Check. I could just open Xournal and start writing without missing a beat. Even better, the palm rejection worked much better compared to ChromeOS, rendering this an actually good device for notetaking on the go.
Next up, is connectivity. Wi-Fi? Check. Bluetooth? Check. All systems go.
Okay, but what about the tablet mode support and such? Most devices fail here. Well, not this one: not only touchscreen work out of the box, but when detaching the keyboard the tablet will immediately enter tablet mode - meaning that all the icons become bigger and easier to click - and autorotation also just works.
For some reason, this shipped without any touchscreen gesture out of the box, but as soon as I set one up in settings, I could also access the Overview and drag and drop windows around in the blink of an eye. Switching desktops with three fingers also works.
Finally, for tablet mode, the virtual keyboard does come pre-installed, but it's disabled out of the box. I'm not sure why. As soon as you enable it, it works perfectly, and you can toggle it on/off in the System Tray. Check, check, check.
I feel like these messages are pretty representative of the emotion I was going through: I was just, like, woah, this actually works? I can't believe it! And Jules is like, dude, I told you.
Battery life is also fantastic. Though this is a used device, and I'm always keeping it a full brightness, and I was even running various tasks in the background, the battery applet would regularly show a 10 to 12-hour estimated lifespan. I will have to do some testing to see how that translates in real life, but it already sounds great.
Also, if you close it, it goes to sleep. I had not used this device for four days before writing this review - look, I was busy - and it has only lost about 25% charge since Sunday. Which is roughly 6% a day, or a battery drain of 0.25% an hour. Out of the box. If this does not sound exciting, my main device drains 25% in a few hours. It has a terrible battery, but still, that's impressive.
This is where I started noticing a few issues. Firstly: the webcam is not supported. If you know anything about making Linux run on these ARM devices, you are aware that this applies to almost any device, as sad as it might be.
Secondly, no audio output is recognized. I've been told that this is supposed to work, so it might be just my setup that's broken. But still, I'm trying to evaluate this laptop out of the box, and I can't play audio. (But headphones work just fine).
Oh, and the volume rockers on the device work out of the box too. That's a nice detail that you can't rely on. The power button also does put the device on standby, and you can wake it up pretty quickly.
Finally, it seems like libinput is misconfigured a bit, and I can only trigger four-finger gestures sometimes. Other times, it starts scrolling instead. This is not amazing, but it could probably be fixed too.
But, apart from these few issues - the only one of which that can't be solved is the webcam - this is a perfectly working device that I could use to run any Linux application, take notes with the pen, compile KDE to do development, write articles, yadda yadda.
But would I want to do those things? How's the device? It does come with 8Gb of RAM, which is not plenty but good enough for me, and a Snapdragon™ 7c Gen 2 plus a Qualcomm Adreno as the GPU. This is probably the only weak spot of this machine: it's overall a bit laggy here and there and it won't perform power-intensive tasks very well.
According to CPU Monkey, my main device has roughly a five time better single multi-core performance and three times higher score in Geekbench. To be clear, this does not render the Duet unusable by any means, it's just not a very fast laptop.
However, it does pack a few punches here and there. Firstly, it has a gorgeous - and I mean gorgeous - 13inch FHD OLED display. It's bright, the bezels are very slim, it's a joy to use and to watch content with.
My biggest ever regret was to accidentally scratch the display on the top-left corner. I'm so annoyed by this that I'm quite tempted to just go ahead and buy an entirely new Duet 5 since they're very cheap anyway. Like, look at here. Aaaah.
Another upside is that it's quite thin, small, and lightweight. It only weighs 700g, and is 7mm thick, which is less than my phone. When you use it as a tablet, it feels like it's meant to be a tablet; my Minisforum is always a bit too big to use comfortably and has some excessive bezels. Not a fan.
The device does not come with a pen holder, but you can easily print one with any 3D printer, and that works pretty well. Finally, and this is my biggest design criticism, the keyboard is good but it lays flat on the table. I would highly prefer for it to magnetically attach under the screen to stay at a given angle.
So, what's missing? Why am I not using this as my main and only device, webcam and performance aside?
Well, what I did not mention is that so far I'm using everything in a live session from the USB. It's nice, and it works, but apparently, I did mess up a step of the installation process; it looks like ChromeOS wanted to do some system upgrades when I tried to install PostmarketOS on the device. Now, when I try to boot from internal storage, I get a message "Your device is being updated", but it can't update, so that fails, and throws me back at the bootloader. Sad. I'm working on it.
If you consider that this is something you can get for a few hundred bucks, depending on where you live, it's honestly a steal. I'm seriously happy that I have bought this device, and - as soon as I fix the booting problem - I can't wait to use it to do research, write articles, and do some development on the go.
Lately, I quite dislike my main Minisforum v3, so this is definitively my favorite Linux laptop(-ish) right now.
The Future of KDE Styling and Design
I hadn't talked about this yet, but there has been work going on behind the scenes to completely revamp the KDE theming system.
In this article I will cover how this new amazing setup works, and it does already work(-ish), plus what the future of KDE styles and themes could look like; but first, this will mean nothing to you if I don't tell you why is this even necessary, what's wrong with our current setup.
Our current setup is sort of a mess.
The Issue
Firstly, we have Plasma Styles. These only apply to Plasma, your shell, and everything else completely ignores it.
They are implemented via SVG files, which have benefits and drawbacks. Mostly drawbacks. Sure, they might be very easy to make, lots of people know how to use SVG, but they are very hard to maintain, they not very fast - because you have to render out entire images - and there's no easy way to expose configuration options.
Which is why you will see the SVGs to be full of these little colorful blocks that are not actually displayed anywhere, but the parser checks whether they exist or not to know whether to turn on and off a certain flag. It's a bit hacky and overall I don't like it.
Fair enough. But this is purely for Plasma. What about other themes?
Well, next up we have Application Styles. They are directly used by all QtWidget applications, which is the type of UI toolkit used by apps such as Dolphin and Gwenview. As you can see in the screenshot, there's no download button.
That's because Application Styles are written in C++ and have to be compiled to be used. The only way to get them is either by, well, compiling them yourself, or if they're shipped in your preferred package manager. On top of that, they're extremely, extremely difficult to make. There are a few third party projects out there who try to branch off Breeze, but starting from scratch is not something you can just do.
Which is why a lot of unixporn users use something called Kvantum.
Kvantum is an Application Style which - to put it very simply - converts a SVG file to a style. Basically, it draws an SVG on the screen. You're again missing out on performance by choosing this, but it does make it much, much easier to create custom Application styles.
But then we have QtQuick Control styles. Many KDE applications, like Discover, are not written in QtWidgets, but in QML, a markup language that has its own style. (Of course it has).
To repeat: Application Styles, which are actually called QStyles, apply on QWidget applications; whereas QtQuick Control styles apply to QML applications.
Well, in order to simplify this whole thing, KDE developed a QtQuick Control style called "Desktop", which uses - bear with me - the QStyle to draw the QtQuick Control style; basically, it uses the same stile that QWidget applications use, but it applies it to QML applications.
This way, if you select "MS Windows 9x" as your Application Style, all of your KDE applications will use it, regardless of whether they are QtQuick or QWidget ones.
But this is also hack-ish. It does not work very well; a lot of the UI of QML applications still does not really follow the QtQuick style at all. This is especially noticeable if you use Kvantum; you will really notice how QML apps stick out in a bad way.
But there's worse (yes, there is). If you decide to switch to Plasma Mobile, you'll find out that mobile applications do not follow the QStyle, but they have their own QtQuick style, written by scratch, and ends up being inconsistent with the other themes.
Why did we do this? Well - hear me out - the QStyle is software rendered, whereas QtQuick supports hardware acceleration, meaning the former won't be as performant on a mobile phone.
So, this is the situation. We have three different type of styles (Plasma, QtWidgets, QtQuick), the third of which is inherited by the second one, and the first two are made in completely different ways, and they don't talk to each other…
But wait, there's worse. There's actually a fifth implementation of the Breeze style, and that's the Breeze theme for GTK. This last one is a GTK theme which tries to resemble Breeze as much as possible, and it's sort of going unmaintained.
So, if anybody wanted to create a new KDE theme, it would probably take a good year of development to write it from scratch. Which is not ideal.
It's also an issue for us KDE developers. It means implementing new style changes multiple times over, and if we want to change something in the Application Style then we need to wait years - yes, years - until someone with a deep knowledge of how they work has some time to work on that.
Union
Luckily, Arjen has the solution, and it's called Union.
The core idea is to have an abstraction over the types of style inputs and outputs. I could give Union a SVG theme, or maybe a CSS theme, or maybe a QML theme, or more; all of those input types would then be converted to the same abstract theme type. Union will then implement various theme outputs, such as QtWidgets and QtQuick, which would just read that abstract theme to know what to draw.
So, potentially you could write QtQuick theme using SVG, or a QtWidget one using CSS, or any other combination that you'd like. Any input can be converted to any output.
Of course, you wouldn't have the full range of SVG options, or CSS options; it would still be a subset of the functionalities of those markup languages, the subset that we can actually translate to the middle abstract layer.
So how do we do this?
And by "we", right now I mean Arjen, but it's soon going to be a more collaborative thing.
He decided to start off with just one input and just one output, understandably. He chose for SVG files to be used as inputs - since we have a lot of Plasma Themes already - and QtQuick to be used as outputs - since it's used by Plasma and many KDE applications.
Union currently does not implement the full QtQuick Style, but it does style most of the basic controls, which allows application to run using it already.
And here we have it. This is Discover styled using the current state of Union. It does not look exciting, but do remember that it uses a completely new theme engine to display … all of this. It is exciting.
The intermediate layer is made of a bunch of "Style Rules", which are created by the input layer (currently, only SVG). They're "which properties do apply to this element", they have a selector which determines the elements that the style rule is applied to. This is quite similar to CSS: you could have a style rule that says "my text should be red", and a selector that says "any focused button".
Oh and – as a Plasma developer, this would also solve my issue of the annoying SVG hint items, since the SVG input layer also accepts a YAML file that actually defines which element is used for which control and, most likely, we can also define things like flags and margins using that same file.
So, what's next?
The current goal, according to Arjen, is to finish up the SVG-to-QtQuick workflow so that we can actually start using Union just for Plasmashell, deprecating the current Plasma Theme implementation; to the user, this should mean that nothing changes at all, but we would start getting real-word usage of Union.
Once we do have real world usage of Union, work could start to implement a QStyle that uses it, which - due to QStyle complexity - is going to be a tough task to handle.
And then, one day it would be nice to have a CSS input, but there's a significant issue; to quote Arjen, "there's no good CSS parser on the internet". What we need here is one that is available as a C++ library and that returns a parsed tree of what's in the CSS file.
If this works, more outputs could slowly roll out; the GTK Breeze theme, which is currently a bunch of manually written CSS, could become just another Union output that we could use.
Even better, this would make it much easier for KDE designer to improve and maybe create new themes; which brings me to another major topic, which is an initiative - driven forward by Anditosan - called Plasma Next.
Plasma Next
Firstly, credit where it's due, you should all go watch Andy's youtube channel, which has frequent updates on his work to improve the KDE Design System. A lot of information on this section was taken from him, and links are in the video description, so go give him some love.
Andy is trying to completely revamp the KDE Design System, which does not necessarily mean a complete redesign of Breeze, but rather a new way to handle its design. He has formed a team and the name of this effort is Plasma Next.
Firstly, there's the question on what to use to do KDE design. So far, we've never had an agreed-upon preferred platform; some of us were doing mockups in Inkscape, but the real designers were just using Figma, which has its own issues… like being proprietary.
The free and open source alternative to Figma is called Penpot. We, the KDE Visual Design team, did watch this new tool be announced and grow, and we were sort-of waiting for it to be good enough for us to use. Penpot very kindly reached out to us, and asked what they could do to help us switch to them.
The design system should have icons, colors, typography, and re-usable assets of the common KDE components, all with the same consistent Breeze branding on them. Currently, Penpot does not support all of the features required for those elements (apparently, icons were already a bit of an issue), but the team has acknowledged that, and they are trying to work to improve those aspects.
Even better, according to Andy, Penpot has provided the Plasma Next team with free training on how to use the tool, and they've joined the Next chat to help out where they can, which is amazing; we really have to thank them for their effort here.
So far, the team has managed to port colors, shadows, typography, and blurs.
Until then, there's a lot of work undergoing to revamp KDE icons over Figma. There's a whole new set of 24px set, new weather icons, and more. There's now work to revamp the 16px icons as well to match the new 24px ones too.
You can see that they're turning out really pretty, with nice rounded borders and a Breeze feel. Of course, since these are drawn at 16px, they won't look this good on an actual screen, but still. Pretty good.
And, as I mentioned above, in the past months a consistent set of Plasma colors was created, along with some standard shadows and blurs to use on any element. Apparently there's some sort of token mechanism to categorize the various colors, but really you should just read Andy's blogpost about it if you want to get technical.
Of course, this is not something that has an immediate payoff, and the same applies to Union. But it's great to see that we, as KDE, but not me specifically, other people, are able to address those long-term tasks that will make the project best-in-class over its design department.
Will Google have to divest Chrome?
Just one hour ago - at the time of writing this, at least - news broke that China has announced retaliation against President Trump's imposed tariffs by launching an antitrust investigation on Google. The exact quote of the China government - according to, uh, Google Translate - is
Because Google was suspected of violating the Anti-Monopoly Law of the People's Republic of China, the State Administration for Market Regulation launched an investigation into Google in accordance with the law.
Indeed, investigating Google for antitrust lately seems like stealing candies from a child. In 2018, the European Union fined them about 5 billion dollars, the largest antitrust fine ever issued, though Google has decided to appeal that decision. According to the European Commission, the violations were that Google required manufacturers to pre-install Google Search and Chrome, prevented them from running competing operating systems based on the Android Open Source Project, and gave financial incentives to those who would only preinstall Google Search on their devices.
The year after that, the EU issued another 2 billion dollars fine due to "abusive practices in online advertising". Again, Google appealed the decision. This time around, the reasoning is that Google required partners to exclusively use AdSense, display a minimum amount of Google ads above any competitor's, and more.
As you very well know, Google has issued some changes to address these fines. As an example, in 2019 they said they would ask users for their preferred browser of choice upon first setup, to further comply with EU's decision. However, the biggest antitrust headache that Google is going through - the one we're focusing on today - is related to the US itself.
In September 2023, a trial began between the United States and Google concerning monopolies. Google, who probably wanted to avoid as much attention as possible, managed to obtain that this trial would be held behind closed doors, claiming that trade secrets could be released to the public, otherwise. However, we do know that the ruling of this trial states:
After having carefully considered and weighed the witness testimony and evidence, the court reaches the following conclusion: Google is a monopolist, and it has acted as one to maintain its monopoly.
According to the judge, Amit Mehta, Google has violated section 2 of the Sherman Act. The DOJ's proposed solution is to divest them of their browser, Chrome. Additionally, they also left the door open to potentially force them to sell the Android operating system as well.
Let's go step by step, and see what the DOJ wants to achieve.
Yes, divesting Chrome is one of their strongest suggestions, and the idea is to separate the most popular browser from the most popular search engine, to make sure that Google does not use the former as a gatekeeping platform to funnel users into their search.
Google would also have to part ways with Chromium, the Open Source base upon which Chrome is built. Keep in mind that this project is meant to be a bit more community-driven, though - as I'll mention later - the vast majority of work done on it is by Google. It's not entirely clear who would drive the project forward if they had to stop working on it.
Generally speaking, Google would have to avoid offering Google Search as the out-of-the-box tool on any of its devices, something somewhat similar to what the Digital Markets Act proposes - if you don't know what that is, I have an entire video about it, by the way.
Another significant proposal from the DOJ is to publish Google Search rankings and query data to competitors. This would allow them to very quickly increase in quality, allowing for much more of a fair fight between them -- that is, if you consider "fair" to force Google to publish that data at all.
Finally, there would be a ban on having search deals with browsers to make sure that they use Google Search; again, you can see the patterns that are building up. This suggestion would be particularly significant for the Open Source world, as you will see later. All of this was an extreme summary of the proposals, but you can read more about them in the linked The Verge's article.
The reaction to this proposal, on Google's side, was pretty strong. They released an article titled: "DOJ’s staggering proposal would hurt consumers and America’s global technological leadership", and the language that they use is extremely telling. I have to read you an extract:
As just one example, DOJ’s proposal would literally require us to install not one but two separate choice screens before you could access Google Search on a Pixel phone you bought.
I don't know if you fully grasp the gravity of the situation. Two entire choice screens. Two. I'll keep reading.
And the design of those choice screens would have to be approved by the Technical Committee. And that’s just a small part of it. We wish we were making this up.
This extreme proposal would:Endanger the security and privacy of millions of Americans, and undermine the quality of products people love, by forcing the sale of Chrome and potentially Android.Hurt innovative services, like Mozilla’s Firefox, whose businesses depend on charging Google for Search placement.Deliberately hobble people’s ability to access Google Search.
Yadda yadda. It is worth noting that Google must be very well aware of the risk of being considered a browser monopoly, especially since they pay around half a billion dollars to Mozilla to, formally, make sure that it uses Google search under the hood, but, informally, to try to escape from monopolistic accusations. Though, that didn't work.
Note that this sentence could also indirectly hurt Mozilla. Another part of the DOJ proposal was to stop this funding, since it technically was - is - a financial incentive to a competitor to keep using Google's search engine. As a result, Mozilla could be losing its main source of income here. Just a few weeks later, the Mozilla Foundation laid off 30% of its staff, by the way.
This is why it should not come as a shock to you that Mozilla is trying to help out Google. They don't want the DOJ remedies to go through. They have published a lengthy article, titled "Proposed contractual remedies in United States v. Google threaten vital role of independent browsers", where they point out that the revenue of "critical browser competitors" would be jeopardized. I do admire this article because it tries hard to frame this whole discussion to be about the freedom of choice of the user, saying that Google Search is only a default because it's the best search engine out there... but it's about money. They don't want to lose 80% of their revenue, understandably.
Google has the same deal with Apple as well; they pay them 20 billion dollars to make sure that they use Google Search out of the box. This deal would also have to be rescinded if the DOJ proposal would be accepted.
Though, to be clear - differently from what is sometimes reported - these are suggestions of the DOJ to the court made after Google was found guilty, so the exact measures that will be imposed to the company are not yet decided. This is a central point: it is now in the best interest of Google to put them in the shiniest possible light, to try their best to avoid something as drastic as losing their browser.
On the 20th of December, Google published a follow-up blog post called "Our remedies proposal in DOJ’s search distribution case". Similarly to how the DOJ suggested their remedies - such as divesting Chrome - Google is doing the same. Their proposals are the following:
Firstly, they think browsers should have the freedom to make deals with search engines. They point out that Mozilla relies entirely on that deal, and that browsers have found Google's to be the best search engine out there anyway.
However, they will now offer more flexibility in those agreements. It would allow for different search engine defaults on different devices, and the ability to switch to a different one every 12 months. Browser-wise, that's it. I'm not sure whether this is enough to avoid the monopoly accusations.
Android-wise, they will provide more flexibility to manufacturers in preloading multiple search engines. Again, that's it. That said, they claim that
we believe that [these changes] fully address the Court’s findings, and do so without putting Americans’ privacy and security at risk or harming America’s global technology leadership.
Please note how the two products that were suggested to be divested, Chrome and Android, are both open source-ish. To be exact, Google maintains the Chromium and Android Open Source Project, which are fully open source, but then it takes those, changes them, and ships them as proprietary software; the Android that you get on a Pixel nowadays hardly looks like the AOSP project, and the latter - by itself - is almost unusable; Linux Tech Tips made a video about this topic, recently.
Thus, what Google would love to happen is for more folks to join the Chromium and AOSP project, but especially Chromium. Throughout the years, they have been the source of roughly 94% of all the commits made to the project, and they are the de-facto owners of the project.
If they managed to make Chromium just a bit more independent, with possibly more companies contributing to it, though still retaining its control, that could help them tremendously in their antitrust cases. And, since the stakes are really high here - Google is an advertisement company, and Chrome is core piece of that business - they have a lot of money to invest in this project.
Enter the Linux Foundation.
On the 22nd of January, they announced the "Supporters of Chromium-Based Browsers". The goal is, and I quote,
fund open development and enhance projects within the Chromium ecosystem, ensuring broad support and sustainability for open source contributions that will drive technological advancement.
I have to say, it's pretty funny to see the Linux Foundation say that they want to work to "expand adoption" of Chromium-based browsers. "Expand adoption"? Of the most common web technology out there, by far?
It's worth noting, though, that the Linux Foundation also hosts and, I believe, funds the development of Servo. The project, previously worked on by Mozilla, aim to implement a new and independent browser engine; so, they do seem to be doing genuinely good work on that side; assuming that this new Friends of Chromium Fanclub won't change their efforts on Servo.
Anyhow, the Supporters of Chromium-Based Browsers is supported by Google - obviously - Meta, Microsoft, and Opera. It "will provide a neutral space where industry leaders, academia, developers, and the broader open source community can work together", and it "follows an open governance model".
So, will this be enough? When will we know which remedies will be taken, and whether the court will divest Chrome? That will be decided by a two-week trial in April, and it seems pretty clear that Google is trying its best to get to that trial in the best possible position. That said, there's a very big factor that we have not considered so far, and it goes by the name of Trump. As you probably know, if you did not live under a rock, the administration over the US has changed since this story began, and it is somewhat unclear how the new one will handle antitrust regulations. Quoting the Jacobin,
GOP presidents have in recent decades typically embraced extreme free-market ideologies that see antitrust regulation as baleful government interference in the economy. But it should be remembered that most of the present cases against big online platforms like Google, Facebook, and Amazon actually originated in Donald Trump’s first term.
Ultimately, given Trump's apparent interest in making Big Tech submit to him, the change in administration could be good news for Chrome; it certainly increases the chances that this ends in nothing done. I'm not exactly sure whether I would even want the US to divest Chrome, to be honest.
Anyhow – I believe that is everything I had to tell you. See you tomorrow, then!
Behind Mozilla's Finances
I would like to take a moment to discuss Mozilla's money management. I have seen countless articles criticizing it, and possibly with merit, so let's dive in.
Firstly, what we call "Mozilla" is three (or more) different entities.
The topmost is the Mozilla Foundation, a non-profit American organization founded in Mountain View, California.
It has a board of directors composed of ten people, the chair of which is Mitchell Baker.
Whereas the executive director is Mark Surman.
The foundation's current movement is described as having three phases. The first one is called "Fuel the Movement", active since 2016: the goal is to rally citizens on issues like trustworthy AI, privacy, and digital rights; support activists and leaders shaping the future of our online lives, and shape the agenda for open source research and internet health.
Since 2019 there has been a focus on Phase II: "Focusing on Trustworthy AI". They seem to have produced various documents on how "Trustworthy AI" should be implemented, in a way that's respectful to the user.
And, finally, since 2021+ we also have a third strategy phase, called "transparency, bias and data". Again, there's a focus on AI: how can we make AI decisions transparent, mitigate bias in AI, and so on.
You may notice a surprising lack in mentions of Firefox, or Thunderbird. Indeed, the management of these two products is delegated to two for-profit subsidiaries, called Mozilla Corporation and MZLA Technologies Corporation respectively. Then, we have a venture capital arm, and a subsidiary specifically about it. There are even more, such as Mozilla China, but those are less interesting to us.
All other videos and articles I've seen on this matter usually conflate the Foundation and its subsidiaries into the same entity. I don't think this is particularly effective, even to understand how money is managed. I have thus decided to split up the video and talk about each entity separately.
Part 1: the Mozilla Foundation
Mozilla's financial statements are audited and published as a single entity, i.e., "Mozilla and its subsidiaries", which makes it difficult to distinguish the revenue from the three entities. Though, we do have some information about the Foundation specifically thanks to their 990 form, which refers to the 2023 year. So let's dive in.
One thing we discover is that the total number of employees of the Foundation is 66 people. Also, they estimate to have 10.000 volunteers. I'm not sure how they came up with the number, but sure.
The total revenue is 64 million dollars, mostly thanks to investment income - well, back in 2023 we had a bit higher interest rates than now - and "program service revenue", though contributions (such as donations) and grants still are around 10% of all income.
Expenses were just 39 million, mostly due to "Other expenses" (frustratingly vague), and "Salaries", which makes sense overall. That leaves us with a Renvenue less expenses value of 24 million dollars for 2023. Finally, the total assets currently owned by the Foundation amount to 124 million dollars.
Funnily enough, the "Other income" section is explained on page 8 to be … "other income". Yeah, no shit.
Finally, the Foundation pays the paycheck of Mark Surman, president and executive director, which amounts to 600k dollars yearly, before taxes. Other Foundation paychecks are listed, but this is the highest one.
This amounts to a total of three million dollars. They also pay almost two million to "Mauve Corporate System", which is an Employer of Record company: that is, they employ people on your behalf to make bureaucracy easier, instead of having to create subsidiaries for each country you want to have employees within.
Other two million dollars are spent in contracting on multiple companies. Mission North offers consultations regarding communication in the AI space, Russel Reynolds "help CEOs and boards solve their leadership challenges", Tourchbox is a non-profit digital agency that offers UX and development services, and Pacific is about audio and production.
Then, the Mozilla Foundation has given grants to various organizations. We're talking about grants for "integrating responsible computing and ethics", "support for African school on internet governance", "building and adding features to zeno" (a machine learning project), "closing the AI education gap initiative", "computing ethics", "feminist tech ecosystem", "2023 women's convention", "exposure of surveillance systems in schools", and so on. Grants are usually between 50 and 100 thousand dollars, and they are given to entities that range from universities to non-profits, such as "Lesbians who tech & allies", "the hearth genome", "whose knowledge", and so on.
This is the sort of stuff that will get you under the scrutiny of right-wing folks, but personally, I'm a big fan of, well, helping people and using money to make the world better and fairer for all of us. Finally, the Mozilla Foundation also receives money from its subsidiaries, though not directly.
The 35 million dollars mentioned in the investment income were mostly actually dividends from the Mozilla Corporation, which also pays 18 mils for trademark license agreements. The Foundation also received a gift, grand or capital from Mozilla Ventures, an impact venture fund that's also a subsidiary, of 24 million; 10 million more were given for the same reason by MZL.AI, the AI subsidiary.
This was 2023. It's worth noting that the governance of the Foundation seems to be somewhat changing in recent times. In early 2024, the executive director was announced to be Nabiha Syed, previously CEO of The Markup.
According to Tech Crunch, she sent an email to all employees on October 30th, 2024 announcing that the teams behind advocacy and global programs were laid off, which resulted in a 30% decrease in headcount. Some quick math tells us that this means a twenty-people reduction. Brandon Borrman, the chief of the Foundation's communication, claimed that "the advocacy is still a central tenet of Mozilla Foundation's work and will be embedded in all the other functional areas", though what that means exactly will probably only be clear over time.
In December 2024, the Foundation published its annual report, including the financial audits I've mentioned, plus some talking points from Mark Surman (the director) and others. As he states, "Mozilla is in the mids of reinventing itself, and reinvention is messy".
And, in the next paragraph: Mozilla stands for putting people and communities in control of how technology shows up in their lives. In 1998, that means taking the web ina better direction. In 2024, it means doing the same for AI and making sure that open source wins again in the AI era.
About the "economics of Mozilla", Surman says that the main focus of the Foundation is diversifying income. As we will see later, the vast majority of the money coming to Mozilla and subsidiaries comes from Google and amounts to almost 500M dollars, whereas donations "only" sum up to 14 million. If I had to guess, Mozilla itself isn't too excited to be that reliant on a single company, especially since the US Department of Justice as asked courts to prohibit Google from making search partnerships; this would result in a complete loss of income in the Mozilla Corporation.
It's worth noting that nowhere in these articles - that I could find, at least - is inclusivity or diversification of communities even mentioned. It seems to me like they do want to appear as a more neutral actor, rejecting the left-leaning image they had been associated with.
Nabiha Syed, the executive director, has also written an article, where the main points are: strategic operations, communications, development - although there's no mention of specific projects - products and programs, community and campaigns.
Overall, it should now be clear to you both the brand that Mozilla is trying to build - which is somewhat more detached from Firefox than one might expect - and how it's managing its money too. Apart from the criticism that could be raised for their 2023 inclusivity grants (I'm fine with that, I just know that some other people won't be), I would say the organization is taking somewhat reasonable steps. If the responsibility of Firefox and Thunderbird development is delegated to subsidiaries, which I haven't even touched for now, and which are directed by different people, then your job - as a non-profit foundation - becomes much more vague; you have to give values, you have to give a direction, you have to support the bureaucratic side of things, and so on. However, this only really works if those for-profit subsidiaries take the responsibility that they are given. Which raises the question: how is the Mozilla Corporation doing?
The Mozilla Corporation
Please note that I have not found a way to talk about the finances of the Mozilla Corporation, specifically. They don't have their own report, so I will analyze the "Mozilla and subsidiaries" financial report and sort-of assume that "most" of what is going on is happening in the Corporation. Other subsidiaries will get their own sections.
So, Mozilla total assets sum up to around a billion and a half dollars - again, this is data from the 2023 financial year. They are mostly distributed in various investments, as we'll see later.
The total revenue is 653M dollars, and it increased since last year. Most of it - just shy of half a billion - comes from royalties, which includes the deal with Google to have their search engine be the default on Firefox. We don't know if other royalty incomes add up to it, but we can safely assume that the deal is "almost everything" of that section. Subscription and advertising revenue is 64M dollars; this includes their VPN subscription and Pocket. Interest from invested income is 71M, and contributions were 12M dollars in 2023; if you recall, 9M of that was to the Mozilla Foundation, and the remaining 3M probably originates from other subsidiaries, meaning - and this is a major point - that the Mozilla Corporation does not run on donations -- at all, almost. It's the Mozilla Foundation and other subsidiaries that do so; but not the Corporation.
Let's see expenses then. These were just under half a billion dollars, again, half of which was spent on software development (of everything, from Firefox to Thunderbird to anything else). The remaining expenditures are General and administrative, Branding and marketing, Other program services, and a few mils on Fundraising too, in this order.
This should be somewhat reassuring: 60% of all expenses are on actual software development, and the remaining 40% is general expenses, administrative, branding, and marketing. However, remember that this includes the Foundation figures, and they don't do any development, so within the Corporation, software development expenses are probably higher than that. Say it's 70% development - 30% administration and marketing? That sort of balance does make sense to me.
We also have a breakdown of the costs for each section in subsections. We don't learn much from it, though we can see that almost all money in management and general goes into employee salaries, as you would expect. They have around 750 employees, a bit less than now, given how they fired people since then.
One last thing I want to talk about in the expenses section is the paycheck of the CEO. In 2023, that role was held by Mitchell Baker, who you might remember from the beginning of the video, since she's also the chair of the Mozilla Foundation. For context – she is one of the founders of Mozilla; she started as a lawyer in Netscape in 1994, and helped launch the Foundation in 2003.
However, she stepped down on the 8th of February, 2024 to be replaced by Laura Chambers, acting as interim CEO.
We are not aware of what the salary of Chambers is - again, all the financial data comes from the year 2023 - but we can look into Baker's.
In that year, she had been paid 6.3M dollars; the entirety of that sum was paid by the Corporation, not the Foundation, which is a subtle difference -- but it does mean that she was paid by Google's money rather than our donations, if we want to say it like that. It's a bit less than 1% of the company's revenue.
Her paycheck was the subject of much controversy, especially because it increased significantly over time. In 2018 it was two and a half million dollars, in 2020 it raised to more than three million, in 2021 it was 5 million, and then it reached 7 million in 2022.
So, is this fair? Is she stealing money from us? Or, well, from Google? I'm going to say something unpopular here –
as much as I might not be a fan of today's capitalistic world if you are a company with a half a billion dollar revenue per year, you kind of gotta play the game, and that means having a CEO that is highly skilled and able to manage sort of revenue. Which is costly, but it's an important investment, and - as long as what she pays "makes sense", as in, it's the industry standard - then it's fine by me. But is it? Is she being overpaid for her role, or is that a normal paycheck for a CEO?
This is not an easy question to answer. Taking some data from the Heidrick & Struggles 2023 private equity-backed CEO compensation survey, we see that revenue for companies bigger than 500M dollars is, on average 737k dollars, plus a 687k dollars cash bonus. However, most CEOs are also given part of the shares of the company, and we see that the average long-term equity compensation is 13M dollars. We can even consider the averages in the 251M-500M range, to avoid outliers, but the data does not change significantly.
Note that the Mozilla Corporation does not have stocks. Thus, the entirely of Baker's paycheck is cash and does not include long-term equity compensation. It makes sense then to include to balance that out with a larger cash base compensation, which makes the 6M dollars figure … reasonable? Or, at least, not completely insane.
Overall, I'm somewhat satisfied with Mozilla's Corporation expenditure report -- as much as you can be satisfied with being almost fully funded by a competing product, and the Department of Justice wants to kill that revenue stream. Yeah.
MZLA Technologies Corporation
Let's now talk about MZLA Technologies Corporations.
Since 2020, this subsidiary has been the home of Thunderbird; this helped the project to try to monetize or sustain itself, at times where the parent Foundation was somewhat struggling to do so.
I believe that the MZLA Technologies Corporation - or, just, Thunderbird - should be taken as a reference implementation on how to do Open Source. In 2021 they managed to receive two and a half million dollars in donations, and in 2022 that number skyrocketed to six and a half million.
All of this was done whilst being extremely in touch with the community, publishing frequent blogposts about the development of Thunderbird, dev digest, community office hours, contributor highlights, and more.
Not to mention, they managed to effectively use that money in a complete redesign of the Thunderbird interface that brought it back from 199something to something that actually feels up to date.
And, they managed to collaborate with the K9 mobile mail application developers to merge their products and announce Thunderbird on Android, again sharing a very modern design.
You won't be surprised to learn that in 2023 their donations numbers rose again to eight and a half million dollars, from over 300,000 individual contributors.
Talking expenses, 70% of the money goes to paychecks - from developers to marketing people, whereas the rest goes to infrastructure, donation processing fees, general and administrative, and so on.
It seems to me like MZLA Technologies Corporation found a great way to be profitable and grow the product, and I love it for them. The whole team probably deserves a shoutout, but I'd particularly like to congratulate Jason Evangelho for is awesome work; he spent two years in Thunderbird, from 2022 to 2024 as the main promotion person, and I really saw him fully invested in the project.
Mozilla Ventures
Next up, is Mozilla Ventures.
This subsidiary was announced in late 2021; it started with 35M dollars to invest in companies that shared Mozilla's values of open and user-respectful technologies.
As an example, one of their last investments is "Germ Network", a private chat software where you have full ownership of what you decide to share -- I'd like to explain it better, but I didn't quite understand it.
Mozilla Ventures also heavily invested in trustworthy AI; as an example, their portfolio features Hugging Face, the company that tried to implement an opt-out way for artists not to have their art trained on -- a project that was doomed to fail in how it was implemented, sure, but still.
Again, Ventures does not publish its own financial data, but we do get something (very little) out of the Mozilla and subsidiaries report since it has its own section on investment.
On one hand, as you'd expect, Mozilla invests in government-issued securities, mutual funds, equities, and alternatives. This is the standard stuff -- which we're not particularly interested with, but we get it anyway.
However, there are also non-marketable investments. These "include direct and indirect investments into various early stage, high growth technology companies".
In 2022, the total Venture investments were 15.9M, whereas in 2023 that rose to 21.2M dollars. Thus, either not all of the starting 35M capital was invested, or there were some losses that are now starting to be balanced out. Though, admittedly, I have no clue whatsoever how any ventures work at all, so this is very speculative.
I'll merely point out that this number is extremely low compared to the one billion dollars invested in marketable investments, or compared to the amount of money they have at all. Currently, Ventures does not seem to me like one of the main Mozilla activities.
Mozilla.ai
The very last one I have to talk about is Mozilla. ai; I'll be quick -- I don't have much to say.
Mozilla.ai was announced in March of 2023, by Surman. Mozilla decided to make an initial 30M dollar investment in the company, which again is roughly 5% of their yearly income, and one-tenth of what they spend each year in software development, to put things into perspective.
It also seems to be a one-off expense; I don't know whether further money was sent to it, but I did not find any trace of that anywhere. The company is led by Moez Draief, who "has spent over a decade working on the practical applications of cutting-edge AI".
I have not found anything particularly interesting to say about this particular subsidiary; maybe it's just a bit too soon for anything significant to come out. I'll keep you updated in case anything happens, though.
Thanks everybody for following, and see you tomorrow.
KDE Plasma 6.3: Panel Cloning, TimeZone Pickers, and more!
The release of the next major version of KDE Plasma, 6.3, is currently scheduled to happen nine days from now.
The beta version was released to the public already, to make sure that people tried it and found any bugs that were missed by the Plasma QA. You can help out right now by trying it out, maybe in a virtualbox or something.
Anyhow, I think this is a good time as any to start talking about all the cool features that are included in this release. If that's fine with you, since this is my channel, I would like to start off with a few things that I managed to implement, being a KDE Plasma developer, as you know.
Panel Cloning
Let's start off with panel cloning. For the joy of many, you can now create a clone of a panel you have. The new panel will inherit all panel settings, applets, and the settings of the applets within.
The workflow is pretty simple: you get into panel settings, and then you press "Clone panel", and you select where to copy it to – that's all. This feature is simple enough that I don't know what else to say here.
A strong request from the community was to also implement some sort of panel mirroring, where two different panels - on different monitors - can use the same setting, and all changes to one of the two panels will automatically affect the other as well.
Though I do see the appeal in that, and many operating systems do implement such functionality, I have ultimately decided against it. My reasoning is that Plasma panels are so flexible and complex to handle that any mirroring feature would end up being very unstable. As an example, having the same panel on different monitors means that the panel will have a different length - monitors have different resolutions - which is going to affect how the panel is displayed. Maybe one panel will have enough space for a single row of the task manager, whereas the other one will require two. I currently don't think it's feasible to have a clean way to implement that.
Timezones
Then, there's timezones. This is not as exciting, but it actually took various months of development to correctly implement, so I'm pretty excited that it finally ships.
Previously, or timezone picker was just a list of all system timezones that you could scroll through. Not particularly exciting, I would say.
I have implemente a new timezone component that uses openstreetmap and timezone geo data to, you know, actually display all the timezones on a map. You can select any by just clicking on it, switch between them with ease,
and there's even a combobox so that you can still select it manually if you don't find your timezone on the map – maybe you just forgot where you live, it happens.
You can find this new selector in timezone settings, obviously, but it's actually a re-usable component; as an example, the very same UI is used in the digital clock applet when you go ahead and select the timezones to show the time of, in the applet.
Behind the scenes, there's also instruction to keep the timezone data updated, and even a script that automatically downloads that data and simplifies it enough to be used in the component. This last step is pretty important, since the raw data is, like, gigabytes.
Other
I've also spent a lot of time, sponsored by Valve - by the way - through Blue Systems, fixing and triaging bugs. One cool thing I've fixed is that, when panels switch between floating and not floating, there's now an animation for any applet that might be open at the same time, switching from floating, to attached to the panel. It's a nice touch, I think.
Still talking about animations - though this one landed in Plasma 6.4 - I've also re-worked the panel autohide settings so that all options now play an animation when you select them, as a static image wasn't very effective in explaining what each option did. In fact, I got confused myself at the meaning of "windows go below" during that merge request, and I had to be reminded of how it worked.
Finally, I added a button in the Widget Explorer, which is the sidebar with all the widgets, which allows you to remove all instances of a specific widget from anywhere. This is pretty nice if you've accidentally drag and dropped some thing around and you just want to get rid of all of them. A small feature, but nonetheless a quality of life improvement, I think.
It is now time to talk about everything else, but before I do that, do let me remind you of the sponsor of this video, which is nobody. In fact, if any, it's you. All the equipment that I use to record these videos was funded by your donations, and you can sponsor my video work through donations on patreon, liberapay, ko-fi, and other platforms.
But I will say that I'm currently launching a new website, currently under construction, called thelibre.news which will contain all of my videos in article format, plus some interview, plus some extra content; you can also subscribe over there, and I will also soon talk about the folks that host it and gave me some help setting it up. Cool stuff.
Anyhow, back to Plasma.
Settings
I've talked about the new Timezone setting page, but another that received a lot of love was the drawing tablet one. There are now three distinct tabs, "Display", "Pen" and "Pad".
"Display" allows you to select which area of the screen you want, well, displayed on your drawing tablet - if it has a screen at all. This comes with a very handy visualization that actually shows the mirroring extremely well, and I was particularly impressed with this page.
Pen has a graph for the pen pressure that you can edit, plus buttons to set specific actions for pen buttons, plus calibration. Plus, there's a help button that tells you how the pen pressure graph works, that is, you can actually customize it through drag and drop. Nice.
And, finally, Pad shows all the buttons available on the drawing tablet itself, and allows you also map those to specific actions. You can also decide to let the applications themselves handle the event instead of the system. And, if the drawing tablet does not feature any button, this section will not be displayed at all.
Finally, the battery settings will now display the cycle count of your battery, which is, well, useful information to have.
And, look at how pretty this is, the info center will also display all of GPUs with little indicators to tell you whether they are discrete or integrated.
Applets
Well, let's now start talking about improvements in the applets themselves.
One nice feature of the Printer applet is that now you can display all printer jobs directly in the applet, without having to open settings. Previously, you could only display the most recent one. And, all jobs have a "cancel" button too.
The notification applet also implemented a new ""isAddedDuringInhibition property under the hood that will make sure that if you receive a notification while you have do not disturb enabled, and then you disable it, that notification does not become immediately a popup. Previously disabling the DnD would mean receving a bunch of popups that were suppressed; now you can just see them in the applet, but they don't clutter your screen.
Finally, all applets on the desktop are now slightly blurry and transparent! I think this is a great look, and it's how things were meant to be. As a bit of a fun fact, I was actually tasked with implementing this, almost two years ago, but I never quite managed to fix it. But luckily, someone else did, I believe it was Marco?
The task manager applet will also now display much better playback information and UI on hover. If you have multiple instances of an application, the playback will only be displayed for the instance actually playing the audio, and you will have all the info from… whatever you're watching.
Window management
Let's now switch to window management stuff!
Firstly, hey, HDR is getting better and better on each release, thanks to the great work of Xaver. This time around, he has implemented HDR support for SDR screen, i.e., screens that don't support HDR. Apparently, how this works is that when a HDR content is displayed, the brightness goes to the max and pixel values for everything else is decreased in a way that keeps it constant, so that you only have that extra brightness on the content itself.
Moving on to tiling, you can now set shortcuts to move windows between tiles. That is, you can enter the tiling manager (through Meta and T), set up a certain amount of tiles around your screen, and then move the window between adjacent tiles by simply pressing a shortcut. So, if you have a very wide monitor where the default half-tiling doesn't really make sense, you can make your own tiling setup.
Even better, the tiling now remembers everything on a per-desktop basis, meaning that you can have different tiling setups on different desktops, or even monitors.
The zoom effect also got a nice feature: if you zoom really close to the screen, a pixel grid will appear. This might mean nothing to you, but to me, as a developer, it's awesome; it very often happens that I have to fix some single-pixel misalignments, and having a grid to rely on makes that much, much easier. I love it.
Let's now talk about a few more technical things that I don't have screenshots of.
One new feature is that, on Wayland, you can now start drag and drops from windows that are lower in the stack order, and that will not raise the window; this makes drag and drop significantly less annoying to deal with when you have multiple windows open.
Another noteworthy feature is that the handling of fractional scaling for window decorations was significantly improved, though I don't know exactly what that means, since it's a bit too technical for me. But hey, if you use fractional scaling, be happy.
You can also choose to have more accurate colors on your screen, though that comes at the expense of some system performance. Still, for artists, it might be a worthy tradeoff.
Other
Let's talk Discover, our favorite application about installing applications. A pretty significant imprevement is that there's now support for flatpak links. So, if you click on "install as a flatpak" somewhere, then Discover will automatically be opened with the page of that application. Yay.
Furthermore, when updating flatpaks, Discover will tell you about all the new permissions that an application might be requesting, allowing you to check that you are okay with giving the application more power over your system.
Safety-wise, applications now have a "verified" badge when they are packaged directly from the application developers themselves, or by a trusted third party.
Colorwise, Breeze Dark has been made a bit darker. I actually prefer Breeze Light myself, but I do hope that you will love this new more obscure design.
And, still design-wise, close buttons are also now consistent throughout the KDE interface, meaning that notifications lost their custom red icon to this prettier one.
And, finally, yes, there is a new wallpaper for Plasma 6.3.
And it looks like this. I think this is cool. By the way, work is ongoing to make sure that we also deliver ultra-wide versions of each wallpaper, on top of the light/dark variants, and desktop/phone ones that we currently implement. So, yeah, a lot of wallpapers.
Anyhow, I believe this was pretty much everything I had to tell you. Even though these last months I was heavily distracted by some personal life stuff going on, university and everything, it was lovely to see that even I can get surprised by the raw amount of new features in a new release of Plasma. I thought this was going to be a small release. It's not.
Everything about the GNOME finance situation
Today I'd like to tell a story of extraordinary journalistic malpractice. This morning, whilst going to University, I was sent a post called "Is the GNOME Foundation Going to Go Bankrupt in 1 Year? It looks that way" – which is one hell of a claim.
This video will not only explain what's going on over the GNOME side of things, but it will also cover how so-called Linux journalists can attempt to re-frame facts to spin up a toxic narrative.
Let's start with the news. Currently, both the GNOME foundation and the KDE eV are in extremely similar spots.
They have received very large amounts of money some years ago, but they are non-profits, meaning they have to use that money. As a result, both organizations grew their spending with the explicit goal of operating at a deficit, spending more money compared to what they receive. That's completely normal.
Let's get some numbers. In 2022, the deficit for the GNOME and KDE foundations were €296k and €100k respectively, and in 2021 it was €640k and just €20k for KDE, but that was an exception.
The challenge that both KDE and GNOME are facing right now is: now that have mostly burned out the large chunks of money that we received years ago, how can we reduce the deficit, maybe even go back to earning money, and preserve as much as our previous operations as possible?
Well, the first obvious answer is: we can do fundraising.
KDE has organized a very big fundraiser for the Plasma 6 release with the goal of extending the number of KDE memberships, people who donate to the organization every year. We started off with something like, 50, maybe 100 members… and now we have 1092. Which directly translates to €120 to 130k extra income, maybe even more than that. We've also considered hiring a fundraising manager, which would handle this kind of initiatives in the future.
GNOME did that. They knew they had to either raise more money or cut back on the spending, so they decided to hire somebody that had experience in, well, raising money.
And that would be Holly Millon, who joined GNOME just six months ago as Executive Director. She served as a consultant and executive director of many non-profits, she founded one (called Artists United), and previously served as Executive Director of the BioBricks Foundation. Again, this move was done by the GNOME foundation in the wider context of shifting from years of doing deficit thanks to previous big donations to something else.
Artists United is not longer operative since 2021, but we still can see an archived copy of the website and its social network accounts. It was indeed founded in 2017 by Holly, and just next year she was able to raise around €20k at the very beginning of a fundraising campaign that had a €50k goal. We can see all the activities and events organized by them. They exist.
BioBricks, the other company she's been Executive Director of, also existed, and it seems like she has done further work in the fundraising world. This quote is from the bio page in the BioBricks website:
In 1997, she secured funding for the Academy Award-winning film, A Story of Healing, and today she continues to raise money for an eclectic mix of independent films. As a director, Million created Changing Room, a dramatic film that had its television debut on PBS in 2005.
She was the producer and director of a bunch of other (admittedly, small) films, and has a Master of Arts from Stanford University and a Bachelor of Arts from Harvard University. It's pretty clear that she has experience with fundraising and managing non-profit organizations.
She, however, does not have knowledge of Linux or GNOME that we know of. I think the main focus of the GNOME hiring team was to find someone with great experience in fundraising and at managing non-profits, and that was valued more than knowing what GNOME does. Honestly? I can fully understand that decision.
We finally get to two days ago, when the GNOME board president - Robert McQueen - published an update from the board covering the finances, strategy, the future of the board organization, and so on. This contains many technical points, such as decision to elect two more people to the board in order to have 9 people instead of 7. (Volunteers, by the way – board members are not paid).
What raised most concern was the financial situation. McQueen shared that the GNOME Foundation has an internal policy that specifies a minimum amount of money to be kept in GNOME's bank account. The idea is that, if anything happens, if income goes down, we still have some money to pay everyone for at least a year. After three years of deficit from the Foundation they have hit that minimum amount, meaning that - from now on - they won't be able to spend any money that they didn't earn.
As a result, Holly has prepared a break-even budget to be approved from the Board in October. That budget will dictate the spending from the next fiscal year, and - again - it's break even, so that the GNOME foundation keeps above - or a little bit below - that minimum amount of money in the bank.
We can only speculate on how much that minimum amount is. We do know that towards the end of 2022 the GNOME project had declared to the IRS to have ~€854k in savings, and assuming that they've been spending money at the same rate as 2022 they should now have more than €404k. There's also €42k in receivables that should bring that up to €446k. This is purely an estimate and the actual number is most likely higher, since the McQueen talked about the Foundation already being more "careful with spending".
Even if that number was correct, however, we shouldn't be particularly surprised or worried, as the GNOME foundation has had this kind of money in the bank before, with even higher expenses and incomes compared to today. In 2011, a bit of time ago, they had roughly $350k in the bank.
Meanwhile, Holly has been preparing on a variety of fundraising activities that will be launched in the coming months. There will be a development fund to allow people to donate towards GNOME development, there's professional grant writers working to apply to government and private funding opportunities, further work with corporate sponsors, and so on. The goal here is to make sure that GNOME has to cut as little as possible from what they are currently doing: they have to break-even in the next budget, so they more money they have, the more they can keep up whatever they were doing before.
GNOME did recently receive a €1M grant from the Tech Sovereign Fund, but that came with a contract on how to exactly spend that money, and it's going to happen all in this fiscal year, so it won't have a significant impact on GNOME finances at all, we can see it as a bit of an extra that allow to hire people during this year to work on accessibility and more.
Most importantly, though, GNOME is not in any financial danger, there's no fear that it's going to go bankrupt, there's a clear plan ahead within the board, there's still money in the bank accounts, there's still the usual income, they knew that this was going to happen and that's why they hired somebody experienced in this kind of things.
This does not mean that we can or should "stop caring", or stop asking the GNOME foundation about more details on the financial situation, it's still a something which requires some careful handling… but no, the GNOME foundation is NOT going bankrupt in a year. Neither is KDE, which I think has roughly the same finances. Roughly.
And that was news. It was not particularly exciting, was it? But now we get to the fun part, because - come on - you just have to let me have some fun. I promised I would talk about journalistic malpractice – let's do it.
Firstly, this joke of a journalist begins the article by saying that the GNOME foundation has been "unusually silent about their operations – not publishing any public reports for closing in on 2 years now". Which sounds bad: why has GNOME stopped telling us about their financial situation?
Well, it's bullshit. How things work in the non-profit world - and I'm talking about GNOME, but I'm also talking about KDE - is that you spend some money during a certain year, and then you work on a full report of everything that happened during that year, and then you publish it. Usually, it takes quite a bit of time for the promotional team or the board to put together the report; KDE eV takes around six months, thus publishing it around July, and the GNOME foundation decided to always publish them during their annual conference, GUADEC, that also happens in July. This means that the data about 2022 expenditures was published in July 2023, and the data about 2023 will be published in July 2024. This is completely normal, it's what KDE does too, and it has always been like this since 2016. There's literally nothing weird going on. We just have to wait three more months and we'll get last year's data.
Then, this guy summarized the whole discussion about hitting the minimum amount of money in the bank in this simple statement: "GNOME has run out of money". Which is bullshit, again! Running out of money means … running out of money, whereas we can still easily estimate the GNOME foundation to still have around half a million euros in their savings.
The commentary about this whole this is so high-level that, after presenting the 2021 expenditure numbers, he says: "Notice how the expenses far exceed the revenue? Not good. boy howdy, is it deep into the negative". Sure. Let's just … forget about the fact that non-profits have a legal requirement to actively spend their revenue, and are required to do deficit if they have too much money.
And then, still in the same article, he tries to estimate the current money reserves of GNOME through IRS reports. However, he completely leaves out the amount of money that GNOME has in non-interest-bearing accounts, and only focuses on the savings and cash investments. The distinction is there because savings account still are interest-bearing accounts, meaning that the GNOME foundation is - rightfully - earning interest on that money. However, they also have €89k in non-interest-bearing accounts, such as in their checking account. And this is still not counting the €42k that GNOME has in total accounts receivable, which is the outstanding invoices that the GNOME foundation expects to be paid.
Due to all of these mistakes and oversights, this "Linux Journalist" comes up with a total estimated savings of €296k, which is way too low of an estimate.
And, finally, he justifies the title of his amateur blogpost: if the numbers he gave were correct (and they aren't), and if the GNOME foundation were to keep spending money at the same rate (and they won't), then they would run out of money in April 2025 – completely disregarding the fact that Holly has prepared a break-even budged.
But of course, he also start attacking Holly. He says that her only previous job was "Professional Shaman", completely disregarding all of her actual work experience that I've outlined earlier on. He says that GNOME is in "total silence" about future plans, even though McQueen's own post talks about changes in budget and the new fundraising events.
And, finally, all of this is blamed on politics, by showcasing one Twitter post from the GNOME VicePresident that simply said that "inclusion, sustainability and diversity" were the focus of one discussion with Holly. I don't even know what to say. The rest of the article is ramblings, attacks on the Linux Foundation, and further fear, uncertainty, and disorder.
Now, according to McQueen, Million has worked on a detailed five year strategic plan that will be shared by the Foundation over the coming weeks. This is good news, and I'm really looking forward to hearing it.
'till then, this was Nicco Loves Linux, and I still hate people who intentionally present made-up fact and numbers. See you soon!
Rise and Fall of Open Source Projects
Sometimes it's … worrying how easy it is for Open Source projects to fall. Even those that are apparently solid, with a stable income and lots of users. You probably heard of the Simple Mobile Tools suite: they provide applications with million of downloads, they were able to sponsor financially other Open Source projects, and just a few months ago they were publishing blogposts about how they would never sell your data.
And then… it happened. In just a week - or even less - the project fell. It crumbled on itself so hard that the applications are now trying to scam money out of users and are full with privacy-invading advertisement. You probably heard of this when it happened, but… have you? Like, the whole story? I thought I did but, there was more! So, let's start from the beginning.
Summary of SMT Timeline
This is Tibbi, short for Tibor Kaputa, which is prooobably not how you pronounce it. He's from Slovakia and has worked as a software developer for years, especially working on Android applications.
In 2016, however, he decided to fund a project called "Simple Mobile Tools". The idea is to have a suite that only uses the permissions that are actually required for the application to run; he says,
I’ve just checked my device and the crappy preinstalled custom Email client requires almost double the permissions than Gmail does.
He's also fed up with advertisement within Android applications. He makes a great point of many of them mostly hoping the user to click on them by mistake; he says, a file manager with ads between folders is just unacceptable and won't stay on my device for long.
So, let's actually make an ad-free suite that has the great user experience you'd expect: customizable widgets, a simple and to-the-point user experience that actually helps you out. Oh, and let's make all of them open-source and distributed through F-Droid. Great.
He very quickly published a large amount of basic applications. There's a Simple Gallery, Simple Clock, Draw, Music Player, Dialer, Voice Recorder, and so on. The project grows quickly, with 24 applications in 2017 totaling more than 60 Million downloads.
There's one major issue to tackle, though. If there's no ads whatsoever, how can the project even be economically sustainable?
Well, firstly, you can donate. There's Patreon, Paypal, bank transfers and even crypto. I can't know how much he made this way, but it does not seem to be enough to become a full-time developer. In 2022 the project had a little more than one hundred supporters, making just $220 per month. In 2023 that increased to 240 dollars. Not enough, and I'll guess from my own donations that bank transfers and paypal were roughly the same.
Tibbi thus decided to paywall some applications. However, he did so in a very thoughtful way, which I really appreciated. Firstly, there's a "Simple Thank You" application on the Play Store; it costs one buck and it unlocks all features from the entire suite. Even better, it's not one of those "one buck each month" subscription, it's actually a one-time payment to have all the features of the entire suite, forever. You could also ask for a refund at any time, and - according to its website - you'd get one, no questions asked.
Some other applications would also have a similarly priced pro version with some extra features. There's Simple Notes Pro, with the ability to customize colors and features, and Simple Gallery Pro, featuring the ability to edit the photos directly within the app. So far, the project has the most sensible price I've ever paid for in the Play Store.
Throughout the years, the project also focused on building a brand. If you go through all the available apps you can see how they're all the same shade of orange, with simple icons and always the most obvious name. Over time, more complex projects were also attempted: as an example, we have "Simple Launcher", which is … a launcher, with the ability to move apps around, add widgets, and so on.
I don't have any data about this -- but it sounds like the project was big enough and making enough income for Tibbi to actually contract some external developers to work on these projects. The other main contributor is Naveen Singh, who got involved in mid 2022. The guy even has a YouTube channel, so go give him some love!
The Mysterious Phone
Occasionally, the project would try to cash in its strong brand to attempt some particularly ambitions projects. As an example, did you know that they tried to release a phone? Obviously, it was marketed as the "Simple Phone". Its webpage is still up and running at the time of recording, though sadly the product is apparently sold out. The idea was to have a project that comes with the Simple Mobile Tools and nothing else. Even the operating system, based on Android, is called "SimpleOS" and is Google-free (but with microG pre-installed as a Google Play services alternative, which I think is great for the average user).
Now, an Android derivative OS is probably a project that's a bit more complex than the average Simple android app. According to the website, it is developed (or… should've been developed?) by the "Good Phone Foundation". Which I … had never heard of?
The foundation's GitHub page has a grand total of not a single commit since it was created, but they did create two repositories. Or, rather, they forked two projects and never actually did any work on them. They advertise a privacy-focused ROM called "Lunar Open Mobile Platform", which SimpleOS claims to be based on. What?
The only public information I could find is a now-deleted post which details all the Android components that might put your privacy at risk. As an example, whenever you turn on your phone, the device pings google services. Then there's DNS issues, where your Internet Service Provider might pass the network traffic to large corporations like Google. And then, of course, there's Google Play Services, System WebView, and more. For each one of these issues, Tibbi explains how they solved the issue: they replaced Play Services with microG, they made the phone check Internet on a safer URL, changed DNS, and more. All of this makes me think that SimpleOS very much was a thing.
What about the phone, though? Did people… buy it? Where is it? Why can't I find anything about it?
Firstly, as you may be aware of, building phones is somewhat hard. What Tibbi most likely decided to do is to buy some cheap Chinese-manufactured phone as-is and then installed a custom ROM and re-sold it at a higher price. Reddit user "GivingMeAProblems" - yes, I'm using "Reddit user" as a source - was actually able to trace the exact phone on Alibaba: it's this one! You can actually buy it, it starts from 3000 pieces at 135 bucks a piece. That's a 40k investment, reasonably low.
Aaand yet, I somehow doubt that there's 3000 simple phones around the world. Is there … any?
If the design looks familiar to you, you might be a Linux expert. Look at this other Linux-friendly phone: the Murena One. Reminds you of anything? Yeeah, looks like they both use the same exact phone model. So, huh, I guess you could buy this one and just … install SimpleOS on it? Oh, well, this one's out of stock as well, nevermind. As the same reddit user wisely say:
Companies like this can buy outdated components more cheaply than when they were current, put them together and sell them for a reasonable price. Someone else did most of the development when this tech was new, that is why it is on Android 11. I would think it pretty unlikely that this will ever see an OS upgrade, indeed they don't promise any, only 'software updates', so probably security patches.
Well, all of this pretty much killed any interest I had in the project, and I could not find a single person saying they actually paid for the phone, which makes me think that it wasn't particularly successful and eventually just … scrapped.
However - plot twist - it does exist. There's at least one unit that we know of. YouTube Tech Spurt actually made a review of the phone one year ago. There's still some weird thing - such as the description calling it "Simple Phone X2" -- why? This is literally the only webpage I could find with such a product name. We can finally get a look at SimpleOS, though. And, honestly? Looks interesting.
The description also mentions that the hardware is "very similar" to the Murena One (erm, yeah, very similar indeed). Before I move on from this whole project, let me say to Tech Spurt, who - unlike me - is actually a serious YouTuber and probably still has the unit in some drawer somewhere: ehm, hey cough Chris Barraclough cough can I have it? Could you … send it to me? Please? Worth a shot.
The Next Step?
Well, the whole Simple Phone thing now feels like a bit of a misstep now, but let's forget about that and focus on the future of the project. Just in December 2023 we got a pretty major announcement: the whole project was sold to ZipoApps, a company from Israel that specializes on buying applications to cough bring them to the next level, by unleashing their potential and elevating any mobile application. We know that they're serious in this goal because their entire website is one plain webpage filled with vague promises and stock images. Also, their webpage has a Steve Jobs quote.
Quality is much better than quantity.
Yeah.
Also, this is completely irrelevant, but they have a public address for their company, and it leads here. So, ehm, yeah, I actually think it gives some context in who might be running the company, money-wise.
The announcement was done … weirdly. The author of the applications in the Play Store changed to ZipoApps and the support email was changed to a ZipoApps one, but the developer said nothing publicly about any of this. Somebody opened a GitHub thread about it, and Naveen Singh replied with:
I can confirm it's true, but I don't have details on who, when, or where.
Which… Okay I guess. Finally, Tibbi replied with
ye, the sale is in process
And nothing else.
But still, this might be a great occasion for Simple Mobile Tools. A company with a strong know-how in developing Android applications could make wonders, and it might even allow to hire even more open-source developers to work on the project. However, it's still a for-profit company, and the current payment system - one buck for all the features as a one-time payment - might not be enough for them. Still, I think they should be careful in changing that too much, as the audience of this suite is, you know, privacy-first people.
They actually immediately changed the business model of Simple Tools. Firstly, they decided to introduce advertisement in all of the free applications. This is pretty bad already, as the whole idea behind Simple Mobile Tools was to, you know, not have ads. But maybe it's worth it, if it means better applications with more features? You can still pay to have an ad-free experience.
They also changed the payment, though. They decided to switch to a subscription model, so it's no longer a one-time fee. I'll make a comparison, look, I'm sure you'll find the new price to be reasonable. Previously, the price was €1 (one time). Now, the price is 825 dollars / year. Wait, that can't be right. Oh, wait, f***, it is. What? And this is just to have … editing options in the gallery app. You need to pay another $825 on top of that if you also want to customize the color of your notes. So, ehm, yeah, it's your average 1650 bucks/year subscription model, right? Reasonable.
Ok, so, who the f*** is ZipoApps. They have more than one hundred applications in their Google Play page, covering a very wide array of functionalities, from Whatsapp stickers to Guitar tuners and more. Okay, let's give a brief look at them. The guitar one. That one also has a subscription model, which feels crazy for something as simple as a … guitar tuner. The subscription is 1000 dollars every year. One thousand. However, don't worry, as ZipoApps is
sorry to hear that the price for the Premium subscription seems high to you. Please, note that the App on the Premium version opens up many exciting features and opportunities for you and it is definitely worth the
f*** you! You want me to pay more in a guitar tuner than in taxes! You want another example? Here's "AmongLock", which introduces a lockscreen with the same look as AmongUs. If you want a custom login text, HD wallpapers (frigging hd wallpapers) and no ads, you have to pay - guess how much - 825€. And, actually, this subscription screen has the same exact look and feel on every single one of their applications. They just … copypaste the code.
They have a Trustpilot account which, honestly, is terrifying. The overall score they get is 3 out of 5, which is okay, I guess. However, if you go through the whole thing, it becomes quite clear that it's full of either:
- 5 star ratings from people who claim they just sold their application to them
- 1 star ratings from desperate people asking for refunds and claiming they've been stolen money. It's unclear whether they do steal money as dozens of reviews suggest, or whether they just ask for a crazy high price and people subscribe without realizing.
They seem to be making an incredible amount of money out of this. According to Zoominfo, the company has a renvenue between one and five millior dollars per year with 26 customers; it seems like it was founded in 2020 by this "Oren A." guy who buys and re-sells digital products for a living. There might be other three co-founders, and all of them are from a company called "Rounds". One of them is even the Vice President. I highly suspect that ZipoApps is some sort of Rounds subsidiary, especially since they were both founded in the same year and their addresses are 10 minutes far. Rounds describe themselves as:
A transformative technology that turns mobile assets into businesses.
They do have at least one Senior Android Engineer, who thinks that the company is great because he gets to "work with a talented and motivated team" but "some times the work is boring and repetitive". Honestly, I'm shocked they have any software engineer at all!
You got the idea: it's a company that buys applications and pretty much hide all the interesting features behind some insane subscriptions, hoping to trick people into them. There's no way that anyboy could believe those prices are sane and, even worse, it's incredibly easy to know about all of this through a very quick google search. This means that either Tibbi knew this was going to happen and didn't care, or he didn't research the company he decided to sell his entire suite to. Neither option feels great. I tried to get in touch with him, and he confirmed that Simple Tools
sadly got some paywalls and maybe ads
Which is … an understatement, to say the least. Though, I have to admit, I can understand wanting to stop working on project and selling it for some cash; it was his project, and he has the right to do that. I'm particularly fine with what he did because, as we'll see later, we can still enjoy the applications as they were - without paying anything - and the development will nonetheless continue. There's one big question that we should address, though: why? But, you know what, there's one that's even more urgent: you can sell open-source projects? How!?
Selling Open Source Projects
Well, thing is, we don't know what type of contract Zipo Apps uses. We don't know what Tibbi actually sold to them. I mean, we know for sure he sold his Google Play store applications, as in, Zipo can now change those applications and will receive the renvenue from them; however, a project being GPL licensed does not really prevent you from selling a spot in the application store, so that's fine. Now, Zipo did change the applications - to add the payments - but they don't actually need to buy the code to do that, because … everything is open source. This is probably an exception for them, as every other application they've bought so far isn't. Most likely, they have some kind of standard contract where they buy everything, including the code. If that's the contact Tibbi signed, and we don't know, then there might be issues.
According to a very thoughtful estimate by Tibbi,
you should know that like 99% of the current code has been written by me and other paid devs, so no need to overreact the licensing thing…
which … sounds weird? I mean, you cannot sell something that you only own 99% of, for obvious reasons; and there are multiple areas of the project where that number drops significantly. Take translations: I don't have specific numbers, but you can see contributors who helped out through Weblate to translate the project, and even other developers having contributed to the project without any formal agreement with Tibbi. He doesn't have a right to sell anything that includes those contributions, which aren't his.
And, honestly, this might be an issue for ZipoApps as well. They now have bought a GPL project. As part of the license, they have to provide the source code everytime they release a new version of the application, otherwise they're not GPL compliant and might get sued. And they did release a new version, because, you know, they added the paywall thingy that asks for an insane amount of money. And of course they didn't release any source code for that (technically, maybe no one asked them, but come on, they're not going to do that anyway). Even worse, they cannot change the license on the project because that requires a formal agreement from all the past contributors, such as Mr-Bajas on GitHub, or Aga-C.
Even though we don't have the contract that Tibbi signed, we do have some … clues. When Tibbi was asked
Are you aware that anyone who contributed to your apps need to agree to a change of license?
He actually replied with:
not really, thats not how it works
Which… I mean, it's literally in the FAQ of the GNU project. If somebody else contributed to your project, you do not have ownership on that contributed code, and you can not change the license of something you don't own. This is part of the reason why some bigger projects backed by for-profit companies ask for you to sign a contributor license agreement before you contribute any code to the project; that agreements grants them the full ownership of what you contribute. This was not the case for Simple Mobile Tools.
Now, I don't actually expect a lawsuit to happen, even though both players, Tibbi and ZipoApps, seem somewhat unaware of how licensing and copyrights work in the open-source world. However, there is a tool that previous contributors might use to try to cause some problems: DMCA claims. This is a functionality offered by Google itself where you can report content that violates copyright laws. However, it has to be done by a previous contributor and it seems like no one has stepped up … yet.
But… why?
But… why? Is it a quick cash grab, or was the project not financially stable anyway? According to Tibbi, neither. The project was sustainable, but he did not really see any kind of growth opportunity ain the future, and he didn't like where Android was heading for the future, with developer experience getting worse and worse. We have some more details here:
I just dont like where Android is heading anymore. Android 14 is the worst version so far (Ive been around since Android 1.6), but the newly redesigned Dev console app is also just too bad now and it would take me a lot more extra time to maintain the apps, reviews etc. The general UX is getting worse for both users and devs for quite a few years now.
Initially, I wanted this segment to be all about how the open-source world doesn't have a way to make big projects financially sustainable. But really, this is not the case. Through simple recurring donations, like Patreon, and selling extra features for a one-time fee of 1 euro, it seems like the project was doing just fine; not only Tibbi was paying other developers to work on the project, but Simple Mobile Tools was actually a Gold Sponsor of Linux Mint, giving them $12,000 every year. We cannot know for sure, but it does not seem like the project had any financial issue.
We really just have to accept that Tibbi decided to work for years and years on an application suite that aimed for a platform that, over time, he kind-of stopped liking; he could've silently stepped back, and let the applications go unmaintained, but he preferred to get the most out of his work by selling everything. This hurts, especially when just a few months ago Tibbi was publishing articles such as "How much does your data cost? We know the price!", where he brags about turning down 42$ per user in tracking. I mean, listen to this:
However, we want to assure you that you are not at risk of anything similar with our Simple Mobile Tools apps. Instead, we bet on transparency and a fair approach to users.
This was three months before Tibbi decided to, somewhat carelessly, sell his userbase to a company that's only known for trying to deceive users into paying insane prices for basic functionalities. Ultimately, maintainers - even those who truly believe in privacy and open-source values - are still… people, and we can only trust them up to a certain extent.
Enter Fossify
So, what about now? Is the project going to die?
Absolutely not. Firstly, you can still use all of Simple Mobile Tools, without having to pay the extra fees, simply by downloading them from the privacy-respecting F-Droid store. They're still open source, and ZipoApps couldn't hide the old source code even if they wanted to.
Even better, do you remember the main other contributor to the suite? Naveen Singh? He took a bit of time to think, and then decided to fork Simple Mobile Tools to continue development himself, with the help of the wider community. His work is currently sponsored by some GitHub users, though probably it does not yield much money yet. Funnily enough, one of the sponsors is Tibbi himself. He also has a dedicated Patreon account which you can subscribe to, and he also uses PayPal and Liberapay.
The new name is Fossify. You can find all of the previous applications there, and they're currently working on releasing a new version. Some issues they had to deal with are somewhat fun - as an example, a new build of Fossify Gallery would tell the user that he is
using a fake version of the app. For your own safety download the original one from www.simplemobiletools.com
which was actually a safety feature to make sure that people didn't repackage Simple apps but with some extra trackers and uploaded the APKs somewhere. Also, stuff like app icons and such was technically not part of the GPL side of things so I think they had to change those.
We got a new release of the applications three weeks ago, at the time of recording, with APKs and everything. A few days ago they started to upload the new apps to the Play store, so you can actually go ahead and install them. If you do that, you literally save 850€/year in subscriptions, for the same exact features. Right now Fossify has less than 100 installs on their applications, but I'm certain those will grow over time.
Just, maybe, don't do a Fossify phone? Didn't work the first time, probably won't work the second one. :-)
Hyprland Banned from FreeDesktop: Why.
Hello, and welcome to yet another episode of: angry rants that will make me no friends whatsoever. Today we'll talk about the Hyprland's project and how the developer's account has been removed from the FreeDesktop gitlab instance and related IRC channels. The reason behind it is quite complex, and it requires going back a couple of years to have full context over this story.
But wait, you might say, what's the Hyprland's project? And, sure, I could tell you all about how it's a dynamic tiling Wayland compositor based on wlroots that has an explicit goal of having a neat design, but - firstly - I don't know anything about Wayland compositors and - secondly - it actually doesn't matter at all for this story, because the reason for the ban has to do more with the behavior of the lead developer, Vaxry, than anything else. So, let's take a step back.
On September of 2022, an user on Hyprland Discord changed their username to include their pronouns; this was done to have the same username as on Matrix, since Matrix did not have an "about" section for that.
They were quickly made fun of by some random user, got told that they shouldn't care about it and misgendered by a moderator within minutes; then, their username was changed (by a moderator) to replace they/them with who/cares (and the user couldn't change it back either); the whole thing was as unprofessional as could be. Generally speaking, back then the Discord community had very light moderation and allowed even hateful content.
One year later, September 2023, a user suggested to add a code of conduct to the project. The initial reaction from the Vaxry, the main developer, was… meh:
First of all, why would I pledge to uphold any values? Seems like just inconveniencing myself. I am not able to enforce that CoC, neither do I want to. I just write code. If I'd want to moderate, I'd spend 90% of the time reading kids arguing about bullshit instead of coding.
Generally speaking, we can see Vaxry very much not taking this suggestion seriously at all, even calling a mastodon post talking about the pronoun thing feces of a post. Eventually, Vaxry closed the issue as "offtopic".
As a result of all of this, developer Drew DeVault decided to privately contact Vaxry to talk about the above. Thus, Vaxry decided to run a poll on the Discord server, asking whether users felt they have experienced harassment in the community, and 40% answered they did.
Let me repeat that. 40% of the people who voted in the poll claimed they had been harassed within the Hyprland community. That's… something. Because of that, Vaxry has since then implemented new changes in moderation of the Discord channel, and it seems like the situation is better now. he says it's "way less of a toxic hell hole". I have checked the discussion multiple times over the past few months, and I can confirm it's okay, with multiple queer folks being able to be part of the community without issue. I still wouldn't recommend to join it though, especially because (a) it's still quite toxic, here's somebody saying that developer Lyude is "brain damaged",
and (b) this new change in moderation included a complete ban over the discussion of politics, and the inclusion of any lgbt or trans topic in that politics label; this means th;at if you start talking about lgbt, you might get banned for it. However, this rule is sparingly enforced, with many people being able to discuss it (even in a positive manner, which is great) without any moderation.
On top of that, Vaxry joined the podcast Tech Over Tea by Brodie Robertson. This is how he addressed the pronoun incident from a year erlier:
[A trans person] joined the Discord server and made a big deal out of theirpronouns [..] because they put their pronouns in their nickname and made a bigdeal out of them because people were referring to them as “he”, which, on the Internet, let’s be real, is the default. And so, one of the moderators changed the pronouns in their nickname to “who/cares”. […] That was very unprofessional but let’s be real, this isn’t like, calling someone the N-word or something.
Now, this is the worst apology you can say. First of all, they "didn't make a big deal out of their pronouns", they just … added them to their username, and just that was enough to be made fun of. Secondly, yes, being misgendered is a big deal and no, calling people "he" is not "the default on the internet", whatever that means. And, finally, and this is the most important part, saying "yeah, it was unprofessional, but it's not like I sad the N-word or something" is … not an apology? It's right there with "I'm sorry if you got offended".
Overall, I think it's clear Vaxry doesn't really understand some key points about the trans community. He said it himself; he used to use a derogatory term for them, and more recently he said that he just didn't know that you weren't supposed to use that word because he doesn't keep up with the lgbt community or something. He also said - again, in 2022 - that "we all shit on the lgbt community here" along with other very dumb stuff. Again, he says that he has changed since then, and so has the moderation of the Discord channel.
His opinions haven't changed that much, though. He more recently published a blogpost minimizing this whole idea of harassment through messages:
I definitely am not a fan of how seemingly weak people online, especially teenagers, have become. Words are just words. Someone calling another person a "retard" shouldn't really be a big deal.
Ultimately, without a strong mentality, you will most likely not be very successful in life.
All of the above really started to become a common talk point around September of last year, when Drew DeVault published an article with the findings I mentioned. During the last few months, the story, and Vaxry's very weak apologies, have started circulating more and more. This brings us to the more recent events.
The Code of Conduct group of the FreeDesktop foundation most likely heard about all of the above and, after discussion, decided to send an email to Vaxry. The developer that was representing the group was Lyude Paul, though she made it clear that the email was from the entire group. They warned Vaxry that the past behavior goes against the code of conduct of the FreeDesktop project and that, if it were to continue, they would have to revoke Vaxry's access to the FreeDesktop infrastructure. She does say, however, that the recent moderation changes seem to have improved the situation.
The whole email very kind, in-depth and explains really well why it's important not to see that sort of behavior in the community, in the future.
Now, it's worth having a discussion about this "Code of Conduct" thing. The Code of Conduct of FreeDesktop can not dictate how people should behave in the Hyprland community, which has its own rules. FreeDesktop is not trying to regulate that, or to be an internet police. The email is very clear on this.
However, they are very much free to choose who to work with; if your actions have been violating their code of conducts, even if in the Hyprland community, they can choose to not collaborate with you. You will still be able to join the Hyprland community, which has its own rules.
The thing is, your actions define you, regardless of where you are. If you act in a rude and disrespectful manner, enabling or partecipating transphobic behavior, that's going to define you -- even in communities outside those where you took those actions. This is especially true if you're the leader of a pretty big project, thus having a lot of attention on you and extra responsabilities. It's fair for FreeDesktop to say, hey, if that behavior continues, then we don't really want to collaborate with you anymore, because we do not want to associate to such behaviors.
This applies to … pretty much any community of product. If I were to say something extremely offensive and tranphobic and discriminatory on my channel, thus publicly in front of thousant of people, that's going to define who I am. And I might lose my job to that, because maybe my job doesn't want to have employees like that. I might get throw out of KDE, because there's a code of conduct there too. I might even get removed from youtube, which has its own terms of services. I would still be able to say offensive and transphobic stuff on my own self-hosted space, my free speech isn't put at risk, but other projects and communities might not want to have anything to do with me. Welcome to episode one of how the world works.
Of course, Vaxry paints this in a completely different way. He talks about RedHat wanting to be "the internet police" and "applying the code of conduct outside their project" and that they are "threating him". (By the way, this has nothing to do with RedHat, except that Lyude used a RedHat.com email address). He closes off this section with:
I respect everyone's right to freedom and to moderate their community however they want. What I don't respect is people going outside of their communities and trying to enforce their own moderation rules onto others, especially when it's based on outdated information and hearsay, like we're seeing in this e-mail.
And, again, that's not what they're doing. It's actually well explained in the first email: you are the leader of a somewhat known project, you indulged in offensive behavior in the past, they're telling you that if you keep on doing that, then they don't want to collaborate with you anymore. You can still do that, you just loose access to FreeDesktop infrastructure. Because they don't want to work with you.
On top of that, I would like to remind everybody that, as much as Vaxry constantly tries to downplay the past issues and incidents, saying "outdated information and hearsay", we've seen multiple examples of discriminatory or insulting behavior in his community or from himself, and it's very much not hearsay as he has admitted the whole pronoun incident too before - yet again - downplaying it. And, sure, Lyude is at least months late compared to when the Drew DeVault article was out, which is when the change in moderation happened. But she even pointed this out by saying that the situation had improved, she just said: this happened in the past (and it did), please don't make it happen again.
I particularly love how a random HackerNews user under the name of akerl_ put it:
Seems pretty straightforward to me. The Freedesktop project isn't acting as "internet police". They're exercising control over their own community membership, and taking the behavior of participants in and outside their community as representative of whether they want to permit that participant.The banhammer is wielded by people who seemingly only wield it to silence people whom they disagree with.
If this is what it looks like to be silenced, it seems pretty loud.
After the original post, Lyude sent another email to inform that the language in that post was unacceptable and that Vaxry's account would be suspended from FreeDesktop infrastructure, which has happened.
She seems to be somewhat worried about receiving harassment as a result of publishing her emails and attributing it specifically to her, rather than the code of conduct team of FreeDesktop. Which is not completely unreasonable, if you recall that just today somebody has said that she's "brain damaged" on Vaxry's Discord without any repercussion so far.
Oh and, on top of that, she was misgender on Hyprland's discord - yet again - with no consenquences.
Finally, the emails from Vaxry include some of the dumbest talking points of the right-wing community, even if Vaxry himself is not a right-wing person. Such as:
As per Your own values, or at least the ones You preach, "diversity and inclusivity", so people with different beliefs should not be marginalized. Although, according to the leaked internal documents, it seems that only includes non-white, non-right-wing, non-religious people. Everyone else is not invited
This refers to the leaked documents by Lunduke and, hey, I've done a one hour long video about how Lunduke's content is very often misleading, straight up incorrect, and about how he's a far-right-wing person who holds conspiratory beliefs (such as vaccines are a hoax and climate change isn't happening). The specific "leak" in question is about an optional diversity training happening in RedHat about priviledge. Woo. It's very common, and very clueless, to say that by excluding those who discriminate against marginalized groups, you're actually not being inclusive towards poor white, right-wing, religious people. (Also, again, RedHat has nothing to do with this).
To make sure this whole thing makes sense, let me conclude by saying that Hyprland is a good, maybe even great, project lead by a clearly skilled developer. However, having great development skills does not mean that you're also knowledgeable about political issues and how to approach them, how to handle communities and respond to criticism, how to respectfully deal with others and so on. Personally, I think that Vaxry is currently learning about all of those, and there's clear improvement signs, such as the better moderation and learning more about trans issues and so on. At the same time, I kind-of understand that FreeDesktop might not want to be associated with him at the current time. I hope that can change in the future, and that Vaxry can get back to being able to use the FreeDesktop infrastructure.
The Story Behind the XZ Backdoor and KDE Unsafe Themes
So, I've been missing for a couple of weeks, and what do we have? Well, apparently, the biggest attack on linux I've ever seen and somebody's entire home folder got deleted after downloading a global theme. Complete and utter chaos. Great.
Let's start right away with the global theme thing, since it's closer to KDE and I know more of it. Firstly, how? Just… how could something like that happen?
Well, most themes on the KDE store are actually themes. Like, the colorscheme is just a file with a lot of colors, and the Plasma Theme is a folder with a lot of SVGs, and so on. However, some themes require to change the behavior of some components too: take the login animation theme; that one needs to be able to set a custom animation, and then there's the SDDM theme, to customize the log-in screen, which also might want to move things around a bit. All of that, which requires changes to the behavior of components, is usually implemented via QML files, which is a markup language that uses a JavaScript interpreter under the hood. Which runs code.
Of course, it's not just about themes. Widgets are another example of something that necessarily has to run code, the main different is that you know widgets can run code, but you don't really know that themes do too.
Finally, we have Global Themes. Most people think of those as a sort-of collection of different specific themes, like a Plasma themes and a colorscheme and a cursor theme, and so on. But really, they can be much more complex than than; KDE Plasma is extremely modular under the hood, and Global Themes are allowed to go use that modularity more than you would expect; you shouldn't be surprised if they were even able to replace your entire desktop with some custom component.
So, necessarily, they run code as well, mostly through QML. So, what happened? Well, it seems like some theme on the store had some javascript code to handle a temporary config folder; this folder would then be deleted, maybe after installation. The directory of this config folder is specified in a file in the theme, and everything was fine.
However, someone else decided to fork that theme and, accidentally, they did not set a new config directory. Thus, the code that handled the config directory said: hey, let's delete the config directory! Hey, according to our file, the config directory is set to nothing, so let's just delete the home folder! Yeah!
It's not the first time that such an mistake is made, even in reviewed packages from your distributions. Another important incident was the Steam client, which - again, through a badly guarded rm command - accidentally deleted all users data under certain circumstances.
The faulty Global Theme has been removed within hours, and it was a recent theme with very few installs. The KDE Store is up and running since something like ten years ago at least, and this is the first time something like this happens. Please note that: you can still absolutely safely download colorscheme, plasma themes, cursors themes and more – since those do not run code – and that, by simply checking for a few genuine reviews of a Global Theme, you can safely install those too. Still, this should not have happened. A discussion immediately begun on how to address this and make sure it never happens again.
Firstly, the warning message. Whenever you enter the store in KDE Plasma, there's a little message at the top that tells you: hey, all of this content comes from users like you, and it wasn't reviewed by your distro, so be careful!
It's pretty clear that this message can work for Plasma Themes, where a bad themes could make your desktop very ugly or even unusable. But Global Themes, running arbitrary code, that's not enough. KDE developers have immediately added a new property distinguishing the safe and unsafe store sections, and implemented a new warning message, much more noticeable, and much more clear about the fact that, yes, unreviewed code is being run.
Secondly, there's active efforts (by Marco, I think) in making sure that Global Themes won't be able to run arbitrary code. This would mean losing a lot of cool functionalities like SDDM themes and widgets, but you can still install those - extra carefully - by yourself, instead of part of the theme. This way, Global Themes would become a "safe" category on the store as well. The lockscreen is already out, and that was probably one of the most dangerous components, and more might be removed in the future.
Thirdly, when you click on "apply" after selecting a Global Themes, there's a dialog that actually asks you: hey, which components exactly would you like to apply? And you can choose. We would like to add a clear warning message telling you which components are safe to apply, and which ones currently run arbitrary code. The latter would probably be un-ticked by default, thus giving you the option to select them if you want, but still preserving a safe install out of the box.
Fourth, the KDE store dialog in KDE Plasma currently gives you all the content sorted by the most recent. This is cool, because you see different themes and widgets each time you open it, but also, probably we should display the themes and widgets with the most downloads or highest rating. This way, the themes you'd be likely to click are also the safest ones. By the way, here there's an entire discussion that could be had about how the store manages the ratings, but we don't have time for that right now.
Finally, there's the long-term big deal: can we actually review, manually, all of the content submitted to the KDE store? At least, the potentially dangerous one? This is a big question, and I would like to apologize, because I initially thought this was completely impossible and even strongly argued against it in Brodie Robertson's video about this. However, other KDE developers have the opinion that this is currently feasible. Let's see what it would take.
Firstly, it would still - I think - be impossible to review all current widgets and themes on the store. However, most of them are Plasma 5 widgets, and what we could do is to hide all widgets or themes and ask to re-submit them, with Plasma 6 as the goal platform, and we could start looking into the already-ported Plasma 6 items. We should expect something like two to four widgets or themes to be submitted every week, which sounds feasible to manually review. However, this would have to be done in collaboration to Pling, which is the service that actually manages the store, and due to the complexity of the idea (probably somebody would have to get paid to do it and … paid by whom?) it's more of a long-term goal right now.
This is as much in-depth as I can go with the time I get with this format; I hope I managed to convince you that some parts of the store are still safe to use, and that we KDE developers are taking this issue very seriously and actively working on steps to make sure it does not happen again.
Finally, let's get to AssBleed. Because, yes, that's the name that… somebody… gave to the backdoor that was introduced in the latest version of the xz compression package. And it's just… wow. I know you already know about it, but let's do a deep dive, because it's worth it.
Given that I'm less of an expert here, the following is mostly inspired by articles from: wired, boehs.org, tukaani.org, rheaeve.substack, and more. All sources will be linked in the video description as soon as the livestream ends.
Let's start at the beginning. "XZ" is a file format designed by developer Lasse Collin et al between two thousant and five to two thousant and eight. This is now a package used in pretty much any modern distribution to compress and uncompress archives; if you use macOS with homebrew, you also probably have that package. And yet, as it customary in the Open Source world, its development is severely underfunded and mostly driven by just Lasse Collin who, as we will see, seem to be occasionally overwhelmed by the work necessary to maintain it.
In this context, a developer (or, a group of developers) under the name of Jia Tan start contributing to the project. They had already done a pull requests to libarchive, and their late 2021 patches seem genuine. These patches are sent to the xz-devel mailing list, and Collin merges them in the project.
In April of 2022, Jia Tan sends another patch to the mailing list; yet again, this patch is valid and innocuous. After a few days, another user under the name of Jigar Kumar complains that the patch has not yet been merged. They do so in a quite aggressive tone:
Patches spend years on this mailing list. 5.2.0 release was 7 years ago. There is no reason to think anything is coming soon
In May, the patch by Jia hasn't still been merged; again, Kumar says:
Over 1 month and no closer to being merged. Not a suprise.
And, yet again, in June:
Is there any progress on this? Jia I see you have recent commits. Why can't you commit this yourself?
Another developer, under the name of Dennis Ens, sends an email to the same mailing list asking whether Java is supported. It is, but not actively so. Collin apologizes:
It's clear that my resources are too limited (thus the many emails waiting for replies) so something has to change in the long term.
Kumar also sends another email to this new thread, yet again aggressively pressuring Collin:
“Progress will not happen until there is new maintainer. XZ for C has sparse commit log too. Dennis you are better off waiting until new maintainer happens or fork yourself. Submitting patches here has no purpose these days. The current maintainer lost interest or doesn't care to maintain anymore. It is sad to see for a repo like this.
We finally get to a key email sent by Collin:
I haven't lost interest but my ability to care has been fairly limited mostly due to longterm mental health issues but also due to some other things. Recently I've worked off-list a bit with Jia Tan on XZ Utils and perhaps he will have a bigger role in the future, we'll see. It's also good to keep in mind that this is an unpaid hobby project.
The plot twist here is that we have reasons to believe that developers Jigar Kumar and Dennis Ens do not actually exist, but rather, they are new aliases for the same group behind Jia Tan. Their emails are never to be seen again in the internet, not even in data breaches, they all have similar style and - of course - none of them has reached out for comment to anyone after all of this happened.
Most likely, what we're seeing here is an example of social engineering attack. Collin is already overwhelmed, and the groups want to gain access to the project more quickly, so they started pressuring Lasse as much as possible, even bringing him to admit he has longterm mental health issues.
Anyhow, this works. After further aggressive emails, we get to this statement from Collie:
As I have hinted in earlier emails, Jia Tan may have a bigger role in the project in the future. He has been helping a lot off-list and is practically a co-maintainer already. :-) [...] In any case some change in maintainership is already in progress at least for XZ Utils
And, thus, in January of 2023 Jia Tan is able to merge commits on his own, indicating that he has gained trust from Collin.
Around March, Jia Tan commits the testing infrastructure that will be the key component in the backdoor later on. Interestingly enough, this part of the code does not seem to come from Jia Tan themselves; rather, it was made by a developer called Hans Jansen.
Except, of course, Hans Jansen's emails also has very little activity except for this change, and they only appear again to push for the compromised version of xz to be included in Debian. Thus, they are also most likely a fake alias for the same developer group.
In January of 2024, Jia Tan also moved the website of the xz project to a subdomain of tukaani.org, xz.tukaani.org; this has a DNS record that points to GitHub pages, to which Jia Tan has access. Thus, he can now change the website too.
Finally, in February, the attack begins.
Due to this project being, you know, a compress/decompress package, the testing directory often contains raw binary code to test with. According to the README (long before Jia Tan started contributing to the project), "Many of the files have been created by hand with a hex editor, thus there is no better "source code" than the files themselves". On the 23rd of February, Jia Tan introduces new binary files to use as tests, with names like "good-large_compressed.lzma" and so on. However, they contain a backdoor, which however does not do anything on its own.
The following day, he tags and builds a new version of the project, v5.6.0, and he publishes a tar package; however, this package actually contains one extra file that is not found in the source code of the project, build-to-hest.m4, which adds the backdoor when building a deb/rpm package. It's not yet completely understood what this backdoor does, but it seems like it would give external users complete control over the affected machine via ssh.
Jia Tan starts emailing Richard W.M. Jones, who works at RedHat, asking for Fedora 40 to include the compromised xz version. At the same time, Debian adds that package to its unstable branch.
Now, this is actually somewhat exciting, because this is the moment that Jia Tan has been working towards for years, literally. And yet, a couple of things happen that put the whole operation at risk.
Firstly, developer teknoraver sends a pull request to "stop linking libzlzma to libsystemd". This probably would've defeated the backdoor, which adds some extra pressure to Jia to get it merged before such a thing happens.
Over the RedHat side of things, they start seeing Valgrind errors in a liblzma's function that's the entry of the backdoor.
Developer Russ Cox puts it perfectly when he says: "the race is on to fix this before the Linux distributions dig too deeply". Even worse, the above mentioned libsystemd pull request is also merged: "another race is on, to get liblzma backdoor'ed before the distros break the approach entirely".
Jia Tan, on the 9th of March, commits a couple of things.
Firstly, they commit a fake fix to the Valgrind issue. The real issue is in the backdoor, but of course they cannot admit that, so they do this "fake" fix as a misdirection. [42] But, at the same time, they also update the backdoor files; they do this by updating the binary test files, saying that - and I quote -
The original files were generated with random local to my machine. To better reproduce these files in the future, a constant seed was used to recreate these files.
None of this is true; regardless, a new version of xz is immediately published, v5.6.1, which indeed fixes the RedHad Valgrind issue.
Hans Jansen, who had written the testing infrastructure, also comes back and files a Debian bug to ask for xz-utils to be updated to the latest version, 5.6.1. Other developers that seem just as fake as Jansen show up to support him, and a couple of days later Debian indeed updates the package.
On the following day, Jia Tan themselves file a bug to Ubuntu asking for the package to be updated to 5.6.1 too.
Finally, on the 28th, developer Andres Freund discovers the bug. He immediately notifies Debian and other distributions. Debian rolls back to xz 5.4.5, Arch Linux starts building xz from Git instead of relying on the tarball, and RedHad assigns in the Critical Vulnerability code of 2024-3094. [46] The following day, Andres Freund also publish his findings publicly.
Of course, there's currently great speculation over the exact identity of Jia Tan. Most qualified security experts seem to think that this could've only been done by a group of people, which of course raises some important question. (such as: who paid them to do this? We're talking about hiring a team of very experienced developers for years).
An important part of the speculation relies on analyizing the commit history of Jia Tan, especially the timezone and commit times.
Almost all commits by Jia Tan use Chinese timezone, +0800. However, some commits switch between UTC+02 and UTC+03, depending on Daylight Saving Time, which would indicate for Jia Tan to be working for Eastern Europe. If this were true, then the commit times would generally start from 9am and end in 6pm, which would correspond to a standard day job. On top of that, it seems like Jia Tan often worked during multiple Chinese festivities, but there are no commits from European festivities such as Christmas or New Years. However, the commits with those different timezones were merged by Collin, who is also on the UTC+02/03 timezone. It could be that Collin accidentally changed the timezone of the commit? Please note that other commits merged by Collin preserve the original +0800 timezone, so it's not so clear what the right option might be. According to a statement gave by Dave Aitel, former NSA hacker and founder of cybersecurity firm Immunity, to Wired:
The majority of the clues lead back to Russia, and specifically Russia's APT29 hacking group - widely believed to work for Russia's foreign intelligence agency.
Of course, it could absolutely be someone else - another group, most likely.
Yet again, I would like to thank Russ Cox, who has provided the most in-depth timeline, and which I've extensively used to write this section.
One key point that I'd like to make is: yes, we've been very lucky to have discovered this attack. This could've gone wrong. Many, rightfully, say: hey, surely, there must be lots of attacks like this that go unnoticed, if anybody can just start maintaining some understaffed project and, in a few years, just throw a backdoor in.
But let's remember that this was a very long term, very complex and very coordinates technical and social attack. Most likely, it required a lot of effort and resources, which not everybody has -- even organized groups. Nonetheless, it could be that other similar attack happened (or are currently underway) and we don't know about them. The world's unsafe!
Help us break even
We only run on donations. We have a goal of reaching 300 subscriptions, which would allow us to hire staff.
If you subscribe, you'll gain access to a few members-only pieces, though we aim to keep most of our content free for all.
no ads · no trackers · cancel whenever