FOSS Force

Cropped using GIMP 3.2.4. Gadzooks! I’d completely forgotten what a time suck that figuring out how to use an app used to be. Tuesday morning I ran across a short article on LWN about Gimp — the open source Linux app that tried for years to be as good as Adobe’s Photoshop, until it finally tried to just be better than itself (at which point it probably became better than Photoshop, in a way).

This is kind of a commercial. Or partly a fundraising announcement for FOSS Force, as well as a way for you to take some Linux and Kubernetes courses and get certifications at a greatly reduced price. In other words, you can help keep us paying our bills so we can continue to keep you informed about Free Software, Linux, and open source, and at the same time, save a bunch of money upping your career path with substantial discounts on Linux Foundation courses and certifications.

It’s been about a month since my last check-in, so it’s been a while. Right after that last check-in a personal emergency put a lot of our activity on hold, which included putting our freelancers on hold, which turned out to be prolonged due to fundraising issues. In spite of this, our coverage did not suffer, mainly because the only writer we have left (raising my hand here) has been working overtime to make sure our readers get the coverage they’ve come to expect.

AUR to Arch: ‘Houston, We’ve Got a Problem…We’re Under Attack Again’: Just hours after Arch sounded the all‑clear on a massive AUR malware purge, a new, stealthier campaign is slipping malicious code back into user packages. AUR Registrations Blocked Amid Ongoing Malware Mess Arch has evidently stopped new AUR registrations for the time being while maintainers scrub malware and users debate how to harden the popular community repository.

When The Document Foundation was announced sixteen years ago, some people found the name a little flat. It didn’t sparkle. It named an object — the document — rather than a product, a movement, or an aspiration. Today, that same name is worth a second look, because it turns out to have pointed at exactly the place the digital sovereignty debate would eventually arrive. To see why, it helps to ask a simple question: when you are locked into a piece of software, where does the lock actually live?

They’re going to use AI to get the bugs out at FreeBSD. On Monday, the FreeBSD Foundation announced that it’s launched the AI-assisted Vulnerability Discovery Project, a six-month effort that’s tasked with reducing the number of exploitable vulnerabilities in FreeBSD’s source code.

We’ve been telling you since Friday about an ongoing saga at Arch Linux over malware packages showing up in AUR, a user software repository that’s pretty much unique to Arch. Since the repo contains mostly user-contributed software packages, it’s been collectively considered to be a security event waiting to happen. The oracle was right. Although things seem to be quieting down a bit — we’ve heard no new reports of newly discovered poisoned packages since early Sunday — there is news to report.

The Gnome Foundation has announced the first participants in the new Fellowship program it announced in March. Although Gnome continues to struggle with funding, it’s been able to afford a new fellowship program to put money in the pockets of some volunteer coders without having to rob Peter to pay Pauline. They’ve been able to do this through some special donations earmarked specifically for the new program it’s calling the Gnome Foundation Fellowship program.

Yesterday morning at about 10:30 EDT I told you that AUR’s malware attack had ended, that more than 1,500 packages containing malware had been found and removed, and that the accounts of the folks who submitted the package had been deleted. If memory serves, I think I said something like, “It’s safe to go back in the water.” Guess what? The sharks have returned. It’s time to get out of the water.

Yesterday we told you about Arch Linux’s AUR repository being infested with hundreds of malware-infected packages. At the time, more than 400 packages had already been removed (along with committers’ accounts) after being found to contain malware. Arch users were being advised to not download and install packages from AUR until the situation was resolved.