0:00 Hey everyone and welcome back to the Linux and open source news show. I'm back to my shaved head self and this week we've got the free software foundation weighing in on the office suite debacle taking a very clear stance on the matter. We finally have some good news for age verification and more entities making their positions known on the matter. And we have some unfortunate drama around Modzilla and Debian, which we have to talk about, even though there's really nothing to talk about, but if I don't, people will ask me why. And we also have this message from our sponsor. This video is sponsored by Squarespace. They are your all-in-one platform to create, publish, and manage your own website. They have really super easy tools to create your online presence, whether you know how to code
0:45 or not. So, they have what they call their blueprint system, which lets you pick from a variety of templates that are pre-built and will suit any type of website, whether you're looking for a simple blog, an online store, a video platform, whatever. All these templates are also optimized to give you solid SEO. And they even have a bunch of SEO tools that you need to make sure that your website doesn't end up in the last page of Google search results. On top of that, to go further, Squarespace has their own design engine to create your own pages. You can just drag and drop elements where you want them and you can change the colors, the fonts, and just tweak the template however you want. Or you can automate all of this. And once you have something you like, you can add extra features like creating your own online shop with a payment system that
1:30 handles credit cards, PayPal, Apple Pay, and more. You can even design your own logo from Squarespace and book your own domain name. So check out squarespace.com/theinxperiment or just click the link in the description and you'll get 10% off your first website or domain purchase. So something that I missed last week, but the free software foundation weighed in on the Only Office versus Euro Office fork debate. Only Office asked the recent fork called Euro Office to stop forking their software, basically arguing that this fork broke the licensing terms that they added on top of the AGPL. Those terms were deemed unapplicable by Euro office because they did restrict the freedoms that you get with the AGPL. That is the license only office says that they use and the free
2:17 software foundation seems to agree with Euro office. They said that you can absolutely take the AGPL and add additional terms to that. But these terms cannot go against what the license grants you itself. So these terms cannot restrict the fundamental freedoms that the license grants you to redistribute and modify the software. They also say that modifying the license would just make it not the AGPL anymore. And so the project shouldn't say they are licensed under the AGPL if they use a modified license. The free software foundation said that looking at only offices repo they saw that the software is made public under the AGPL but that their added terms on top of that for example retaining the original logo and branding. This is not something that is compatible with the AGPL. And
3:03 technically, if you license your project under the AGPL, anyone can just decide to remove the additional terms that add additional restrictions on top of those because those are not basically legal. The FSF says that only office should clarify the situation to very clearly relic under the AGPL only and that users who use the existing codebase are fully allowed to use it without any additional restrictions. So basically what they're saying is that only office says that they use the AGPL. So you have to use it as the AGPL. All the additional terms are non enforcable. You are free to fork to modify and to tweak the software. Maybe lawyers will get involved to debate that. But the free software foundation is at the origin of these licenses. So if there's someone who knows how they're supposed to work, pretty sure that's them. So yeah, this
3:50 basically settles it. I don't think only office now has a leg to stand on to try and avoid their project being forked. And I think that's for the better. Now, we finally have some good news about age verification. Carl Richel, the CEO of System 76, who are the makers of Pop OS, has apparently talked to Colorado representatives to add an exemption for open-source software and Linux distros to their age verification bill. He apparently even received an updated version of that bill that carves out that exemption, specifically excluding all the open source operating systems and apps as well as code repos like GitHub and containers as well. Carl apparently has testified on Thursday to defend these exemptions. He asked for some stories about how open source helped kids to do cool things, which obviously should help defend the fact
4:37 that open source should not be included in these bills. Because if you limit uh what kids can do on open source systems, you also limiting their creativity. Apparently, the Californiaifornian bill could also be amended to exclude open- source systems, which would be very good. Now, of course, there are still the US federal bill to contend with. This might supersede anything that is decided statewise, but this hasn't been voted yet when the California bill is already voted and the Colorado bill is pretty much on the fast track for being voted. So at least granting that exemption maybe opens the door for the federal bill to also grant that exemption. That would be good. Now we need to do the same thing in the EU as well. On top of that, Alma Linux also commented on age verification saying that they do not like even the version that California tries to implement which
5:24 is age attestation, not actual age verification. They said that they will wait and see how things play out. Although since they are based on Red Hat Enterprise Linux, they will likely end up following whatever Red Hat does in the end. In my opinion, Alma Linux says that the law does little to accomplish its goal and that they're looking at whether they will need to comply with it at all or not. Specifically looking at the courts and how their upstreams handle things, meaning Red Hat, they say they will keep the community informed on their decision when one is reached. And of course, we are still running straight for that divide between community dros that don't really try to sell you the DRO as a product, whether pre-installed on hardware or as an actual buyable thing, and the dros that are commercial offerings that either sell you access to
6:10 the DRO, to licenses, or to pre-installed hardware with that DRO. The commercial ones will very likely have to comply if they want to keep selling their stuff. and the community ones might really have a chance to dodge all that at least if they are not based in a location where those age verification laws apply. Of course, there might also be the usual exemptions which we just talked about. So, we're going to see that divide and we'll have to see where the community decides to go probably towards the dros that don't do age verification. Then on the same matter, Proton CEO Andy Yen warned about age verification too this week, saying that this is still being proposed in country after country and that this will lead to the end of anonymity online. He said that we cannot afford to get these laws wrong. He says that third party age
6:55 verification companies simply cannot be trusted to handle this sensitive data. He points out to the recent breach in the third party company that handled age verification for Discord where a bunch of records were leaked. He also says that what is happening isn't really politicians waking up to all of this. It's just that big tech social networks are trying to shift the blame for not regulating their platforms enough. They're being accused of letting kids seize things that they shouldn't. And instead of implementing verification on their own, they're shifting the blame to other systems, specifically operating systems to avoid having to do any of the work. Yen says that giving big tech, any big tech company, the power to track and block users is a slippery slope. And he seems to have the same reasoning as I do, saying that this effort should go
7:40 into making parental controls better and that it should be parents handling this stuff, not governments or big tech companies. He also said that if we absolutely all agree on age verification, which we don't, then it must be private by design. It should run locally. It should discard all potential face scans and IDs instead of uploading them to any server. All of that should be fully anonymized and fully encrypted. He concludes by saying that the easiest way to avoid this data being stolen is to never store it at all. And I couldn't agree more on this. This should not exist. This shouldn't be a thing. These laws should not be there. It's up to social networks and platforms to implement potential blocks or potential checks. It shouldn't be mandatory for any operating system at all. And if as
8:26 democracies, our political systems inch towards making that mandatory, then it should absolutely not be sent to any server. It should all be local and private. This is sensitive information. Would just be better if we forgot all about this and stop making that crap. Let's not pretend that parents weren't able to educate their children on the safety of various other things in their homes. They probably can also educate their kids on the internet, social media, and all of that stuff. Now, let's talk about some unfortunate, let's call them controversies. First, we've got Modzilla's new mascot kit, which is a source of said controversy because they dared use the they them pronouns to describe that virtual cartoon fox, which I will remind you is a absolutely normal English way to describe anything,
9:12 whether it would be male, female, non-gendered, or anything. It's a regular way of doing it in English. They didn't specifically say that they wanted their fox to be either gendered or non-gendered or whatever. But of course, when you use normal pronouns in English these day, some people seem to assume a lot from that. And of course, this led to Mozilla getting the usual slew of criticism leading some users publicly uninstalling the browser and whatever else. Of course, other people had more realistic takes saying, "Who cares which is the right approach for this?" And if people had cared to dig deeper, they would have found a branding guideline that places he, she, they, them, it as pronouns around Kit's name, which clearly seems to indicate Mosilla doesn't care about this at all. And I mean, I totally understand. We live in a world where there are absolutely no
9:58 other problems to worry about. Everything is absolutely fine. So, it is completely reasonable to get offended by a cartoon mascot being described in normal English terms. totally reasonable reaction to have. I think now the other potential controversy is the election of the new Debian project lead. Sui Chandran is now elected as the project leader for Debian and she takes over from Andrea Stiller. This was of course the result of a vote from Debian developers. She was the sole nominee for the role apparently totaling 289 votes which is more than the majority needed which would have been 170 votes uh judging from the number of people who voted. The Debian project lead is mostly a role of public representation, mostly coordinating efforts and proposing project level changes that are then
10:45 voted on by the community. Sui Chandran has been involved with Debian for a while as a maintainer and a developer. She said that her main motivation for running was to keep diversity issues in focus, which obviously will annoy someone somewhere because when you start talking about representation and diversity, some people start losing their marbles. She will be the project lead until the next election next year. And of course, you can expect some very weird takes and reactions to that as well because the bad trigger words have been mentioned around this election and this person. But the fact of the matter is she was elected by the community of people who actually work on Debian. Uh so you kind of have to respect that. They're the ones doing the job. They are the ones who call the shots. Anyway, I don't want to talk about any of this anymore. Please feel free to absolutely
11:31 not leave any comments about those topics. I just mentioned them because if I didn't, people would have asked me to. Let's move on to actual news. So, 26.04 was released yesterday. I made a full video about it on the channel. But if you don't care enough about Ubuntu to watch that video, here is the TLDDR. It's Wayland only on Gnome and also on KD for Kubuntu. This flavor went ahead and removed X11 before KD officially decided to ditch it too. The package for X11 can still be installed for Kubuntu, not for Gnome, but it's not maintained anymore, so don't expect any support. Apart from that, Ubuntu added pseudo Rust to replace the regular pseudo. Plus, you will now see asterisks when you type your password in the terminal. They revamped folder icons and the Gnome shell theme, although it is not that
12:17 different from the previous one. At least folder icons will follow your accent color entirely. Now, they also moved to Showtime as the default media player and to resources for the system monitor. Both are really good choices. The security center now lets you configure encryption related settings including changing your encryption passphrase and it now contains the Ubuntu pro subscription options because the graphical repo management tool that they used to do is not pre-installed anymore. It's still in the repos but Ubuntu will not maintain it which is a shame in my opinion because it is absolutely mandatory to have a graphical repo editor on any Linux distro except dros that don't have repos. Telemetry seems to have been put as an opt in instead of opt out and uses a new tool called Ubuntu insights. Ubuntu now enables optimized packages for AMD 64v3
13:05 if your PC supports it. The difference with the previous versions being that it seems to be enabled by default. Older PCs still get the nonoptimized version of these packages and they are not left behind. The app center now handles individual Debian packages too and lets you install them and uninstall them from the app list. Although that did not work in my testing. Of course, you get all the changes from Gnome 50 as well. Much better performance in the Gnome shell, especially for Nvidia GPUs. The document viewer now handling light editing of PDFs and manual annotations. Calendar getting a ton of updates for performance and accessibility. The screen reader getting huge changes to make it way more usable on Gnome and Wayland. Parental controls are a thing that Gum 50 introduced, but they are not here in Ubuntu by default. You can install them installing the malcontent-geue
13:52 package if you want. There also some big improvements to how remote desktops are handled in Gome as well including full support for headless sessions. It's a solid release. You will have to double check a bunch of scripts if you usually have those uh stuff related to pseudo because the blast implementation might have some differences. Stuff related to init because they moved to Draut. stuff related to removable media which is now mounted in another directory than the one I think it's in / run/media instead of being just in / media. Double check that in a VM maybe to make sure that stuff that you rely upon still works. Apart from that for desktop users if you're coming from 25.10 really solid update if you're coming from 24.04 absolutely upgrade unless any of the changes will break your workflow. The main one for desktop users might be way
14:37 support maybe that's not for you but that's where everyone is going now. Still on Ubuntu, they've published a blog post detailing the move to the Rust core utilities and to pseudo Rust and the state of these tools and they apparently commissioned various security audits which uncovered 73 CVEes and 40 additional issues in these utilities which is not nothing. Now fortunately those issues have been addressed and resolved in their vast majority uh before they got shipped to most users in 26.04 04 because yeah, you can't ship an LTS without all those security patches in. That would be stupid. As a result of these audits, they still ship RM, CP, and move as GNU tools, not as their Rust equivalents because there are some remaining issues on those. Ubuntu plans to completely shift to all Rust core
15:23 utilities in 26.10 with all the relevant issues fixed. They thank the community and the developers of these core utils for their contribution and of course asked for additional help from people who are using the tools daily to potentially report more issues and bugs and incompatibilities. I'll agree with one of my patrons here. I'm not necessarily the biggest fan of rewriting stuff that already exists and works where the efforts could just have been dedicated to making them better and fix the potential problems. But in the end, you have to respect the fact that Ubuntu decided to move to something and didn't just wing it. They actually commissioned some security audits to make sure that the main reason for replacing these tools was security and so they wanted to fix the potential security issues in the new tools as well. Makes sense. Now, we
16:09 might not have the Steam machine yet, but we have another console-like project popping up. This new one is called the Plleix. It's a small console that runs Planix OS, which is an Archbased distribution. It runs a Ryzen 5600, 16 gigs of RAM, and a Radian GPU. Apparently, it's a 9060 XT with 16 gigs of VRAM. It uses an SSD, of course. It has all the ports you'd expect from a PC. You've got Ethernet, display port, HDMI, a USBA 3 and two, and also USBC. It will cost quite a bit of money, though €1,179. And it comes with an 8bit D Ultimate 2 controller, which just looks like a Nintendo Switch Pro controller, but with the button layout from the Xbox. They say it's 15 times more powerful than the leading handheld PC console on the
16:55 market. I would assume they're talking about the Steam Deck here. It is upgradeable and apparently it stays relatively quiet and cool. They say it runs 65° C hot when playing Cyberpunk at 4K while being, as they say at least, whisper quiet. I'm probably not going to buy this cuz I'm waiting for the Steam machine specifically, but it is cool to see more Linux-based devices shipping to more people. This is not going to be a huge project. It's being built by batchers and they will reflect the increments in costs of parts onto the cost of the device. It's not a fixed cost. They will adapt it to the current market. So, it might go up, it might go down. In the end, it's probably not going to be massively sold at millions of units. But it is interesting to see more Linux devices like this. And Linux is absolutely a very capable gaming
17:42 operating system. Makes sense to focus on that. Ammozilla and Firefox's love story with AI continues as they talked more about their smart window feature which is basically just an AI browsing page. The feature is out or at least you can join a wait list to maybe try it out. The way it works is first Mozzilla doesn't keep any transcripts or logs of what you typed or what you got as a response. They don't use these conversations to train any model that they would own or to sell any data which is the bare minimum you would expect. They do process response times and token usage and other technical info, but apparently there is no personal info handled at all. Second, they do store what they call memories, which I assume are the transcripts of the conversations, but these are stored on
18:27 device and they plan to use those to make the experience of using this AI tool a bit more efficient. They say they don't store any sensitive data that is unique to the user, that you can see what is being remembered, and that you can turn that off as well. In use, this is basically just an assistant in a web page. It helps you do article summaries and stuff like that instead of showing you the contents of web pages. You have three models to choose from. Fast for quicker answers. Flexible, which is the default, and personal with more tailored answers, presumably using these memories that are stored on device. The feature is optional, of course. You can open it from a small button in the toolbar. I would expect you also will be able to remove that button from the toolbar. Apparently, their fast model relies on Gemini. Their flexible model relies on Quen from Alibaba and their personalized
19:14 option relies on Chad GPT. Mozilla says the conversations aren't stored by these models specifically, but I do not trust any of these companies to respect that and I wouldn't be surprised if we learned in like 5 years that actually they did store it, but it was a bug. Hey, it is another AI feature for Firefox that I will never use because AI is unfit for the purpose of web search. It's just terrible at it. It sucks. It's unreliable. Don't use it. People will use it anyway. Who cares? And still on Firefox and AI, it looks like Modzilla has been using Anthropic's Mythos model. The model presumably too good and scary to let everyone use it. They used it to detect vulnerabilities and found 271 vulnerabilities through that model, which is quite insane. These are potential bugs that have been there for a while and went unnoticed by all the
20:01 humans who looked at the code. Mozzilla touted this as a huge victory for security in open source projects because they said that usually you can only fight attackers to a draw. You're playing catchup. You're playing the holes as they're being discovered and used. But that with these AI tools, you will basically be able to beat the attackers by finding things before they're actually published and before they find them, which doesn't seem to acknowledge the fact that if an open source project decides not to use those tools, then the attackers will have access to the same tools to find vulnerabilities, which instantly makes every open source project kind of forced to use AI tools to analyze their code, and that is not going to remain free for a very long time. Mozzilla also said that they didn't find a bug that could not have been noticed by an elite security researcher as they call it, which they find encouraging for their
20:47 codebase because it means AI models aren't discovering entirely new ways of breaking your code. Uh, which yes, it is a bit reassuring. They said mythos is every bit as capable as a human, vastly outpacing the usual fuzzing tools because it does apply reasoning to how something could be exploited. And while I think AI is despicable and highly unethical, this might be the one use case where it actually makes sense, like detecting bugs, this frees time for people to actually focus on developing the stuff they want and then run an AI model to detect if there are holes in their code and then fix those holes before they are being made public in the published version of the code. The only problem is at some point you will be forced to use those tools to detect the bugs because if you don't attackers will
21:32 use those tools to detect the bugs that you missed and your thing will be absolutely vulnerable from every single site possible. So you will have to pay money to AI companies that they made by using your own code to train their model without so you're basically paying for them accessing your work. That's fantastic. And to conclude, Valve has taken some steps to make the developer experience easier for game devs, specifically at least for game devs who are interested in the Steam Deck. There's an option in the settings for Steam users to send anonymous data on how their games run. And Valve will now use that data from Steam Deck users to give developers some of that info. Still anonymously, of course. Valve will give developers the average frame rate of their game on Steam Deck over the past
22:18 30 days. It's averaged from the data of all deck users that actually played the game and accepted to share this data, which might help developers know if maybe an update recently broke something or made things worse. They will also get variance data for each date, so they can see if the frame rate really fluctuates between users or if it is steady for all players. Valve will also share data on whether users validated the verified rating or not if they confirmed that this rating was valid, including the reason why players felt the game was not worthy of the verified labels. These reasons include stability, uh, input problems performance legibility or others. This will be shared with developers for the playable label as well in the future, so developers can know if their game has specific issues
23:03 that they could potentially fix. This is very useful data to give to a developer that is already interested in the Steam Deck because it means they will be able to notice if they broke support for it, if their game is actually suffering from a specific bottleneck or problem that makes it not verified but just playable or actually not playable because there's actually something really bad going on, but Valve just labeled it playable too quickly. This is interesting for developers who don't care about the Steam Deck. It gives them maybe one more incentive to take a look at how the Steam Deck plays their game, but it's probably not going to transform their approach to that device. Still good information. I don't think there's going to be a lot of reports on this cuz it is optional information sharing only from Steam Deck users and only game per game.
23:48 So, you're probably not getting millions of reports for every title out there, but it's still going to be useful data for at least relatively sizable games that are played by plenty of people. And speaking of playing games, if you want to do so on Linux, do check out our sponsor, Tuxedo Computers. So, Tuxedo makes hardware that ships with Linux pre-installed. They're based in Germany, but they ship to most countries in the world. And they have a big wide range of devices, whether what you need is a laptop, a desktop, a super high-end workstation, a gaming related PC or something quite affordable. They have something for every budget and every need. They also let you choose a bunch of the internals of each computer. You also can pick between a large variety of keyboard layouts. You can have no logo on the lid or your own image laser
24:35 engraved. You decide. I only use Tuxedo computers to do everything and they're really fantastic. They've been a supporter of the channel for a long long while now. I can only recommend them as usual. The link is down in the description. Anyway, this will conclude today's episode. I hope you enjoyed listening to it and or watching it. As usual, you know where all the YouTube buttons are. You can click on them. You have all the links that I use to write this show down in the description uh also. And of course, you have links to support the channel if you want to do so as well. Thank you all for watching and I guess you'll see me in the next one. Bye.
25:21 Oh, hey.
