Today, the openSUSE project released version 25 of its Agama web-based installer for Tumbleweed, Slowroll, and MicroOS distributions with a web-based terminal, an option to exit the installer, and enhanced port selection.

While openSUSE continues to work on adopting Agama as the default installer for Tumbleweed, they updated the web-based installer with a web-based terminal so you can access the shell without leaving the browser, as well as an option to exit the installation at any time before the installation starts if you change your mind.

“It is important to note that the option is only available before the installation starts: cancelling while Agama is already applying changes to the system could leave it in an unpredictable and potentially unbootable state, so the exit option disappears as soon as the installation is underway,” said the openSUSE project.

Agama 25 also enhances bond port selection by using a searchable multi-select field list that you can filter as you type, while still allowing users to write a name by hand for a device that is not present in the system yet. It also brings AutoYaST-related code into Agama’s own codebase.

Last but not least, this release polishes the OpenAPI specification and JSON schemas with stable URLs. According to the devs, having them published this way is useful well beyond Agama itself, allowing other tools to generate clients, validate requests, or simply let people browse the API without digging through the source code.

For more details, check out the release notes. To use the Agama 25 installer for installing openSUSE Tumbleweed, MicroOS, or Slowroll, you must download the Agama live ISO image, create a bootable medium on a flash drive, and boot from it. Meanwhile, the standard live ISOs for Tumbleweed and Slowroll still use the old YaST installer.

LF Research is the Linux Foundation's research arm. It was set up in 2021 and publishes studies on how open source is built and used, drawing on surveys and project data.

Its latest report, Navigating Open Source Software Development in the Generative AI Era, surveyed 234 contributors and maintainers on how generative AI is affecting the way open source gets made.

The survey estimates that about 25% of incoming pull requests are low-quality AI slop, with the estimate climbing to 31% on larger projects.

Red Hat sponsored the report, with additional contributions from OpenSSF, LF AI & Data, and Futurewei.

The findings

Large projects, the ones with more than 50 contributors, are affected the most.

Among their maintainers, 69% report more incoming contributions, against 59% across all maintainers, and 64% say reviews now take longer. Burnout is their top concern at 63%, narrowly ahead of contribution quality at 60%.

You will also find that policies have not caught up to the AI-assisted coding and vulnerability reporting trend.

Of the 119 respondents who answered the question, 35% said their project has a formal policy permitting AI use. Another 32% have none and no plans for one, 23% plan to write one, and 10% ban AI contributions outright.

You might remember that some projects, like LLVM, allow AI-generated code with conditions. Separately, 26% of projects have no way of verifying AI-assisted contributions at all.

The report calls on contributors to give effort to written policies, disclosure of AI use, and testing and documentation.

Interestingly, AI does seem to save developers' time. Respondents estimate that code authoring takes 52% less time on average, while on more complex tasks, 21% said the work took longer with AI.

Most maintainers (71%) say AI makes it easier for newcomers to start contributing. Just over half (53%) say it has not improved community trust, while only 13% say it has.

Some caveats do apply.

Respondents were recruited through Linux Foundation newsletters and social channels, plus partner channels that include Red Hat. As for the 25% slop figure, it is an estimate from 111 respondents, not a measured count.

That sounds fair, but disclosure is mostly left to individual choice right now, and a quarter of projects have no way to check anything. It only works if the people sending slop make an effort to do it.

And as we have already seen time and again, the ones sending slop rarely bother.

Has anyone used or installed Endless OS?

I came across it while looking for educational distros, but it looks like an interesting distro in general - Debian-based, FOSS ethos, immutable, and offline focussed.

Interested to hear what people here think about it.

Viele Creator:innen sind klar für die Demokratie. Gleichzeitig geht von den Plattformen die sie nutzen, eine massive Gefahr für die freiheitlich demokratische Grundordnung aus. Das Video zeigt Wege aus diesem Dilemma.

Weitere Infos inkl. Quellen unter dilemma.uber.space/

cross-posted from: discuss.online/post/47154614

Wow, this is so awesome! You learn real skills, starting at the transistor level. Add the coding and run real applications: chess, doom, minecraft clones, java, etc. GIthub repos

TINY-32 is a full 32-bit RISC-V computer made of 93,338 transistors. It passes the official RISC-V test suite and runs real DOOM at full speed.  Fully open source.

- NES simulator in C
- Tiny Logic Doom

Μια ιδιαίτερα ανησυχητική εικόνα για την ποιότητα του αέρα στις ελληνικές πόλεις καταγράφει η επικαιροποιημένη ευρωπαϊκή κατάταξη του Ευρωπαϊκού Οργανισμού Περιβάλλοντος (EEA).

Και οι 14 ελληνικές πόλεις που περιλαμβάνονται στην αξιολόγηση βρίσκονται στο χειρότερο 30% μεταξύ 761 ευρωπαϊκών πόλεων ως προς τον εκτιμώμενο κίνδυνο θνησιμότητας που συνδέεται με τη μακροχρόνια έκθεση στην ατμοσφαιρική ρύπανση.

Η εικόνα γίνεται ακόμη πιο ανησυχητική όταν εξετάζονται οι επιμέρους θέσεις. Έξι ελληνικές πόλεις βρίσκονται στο χειρότερο 10% της ευρωπαϊκής κατάταξης, ενώ δέκα από τις 14 στο χειρότερο 20%.

Νομίζω αυτή είναι η έρευνα: Europe’s environment and climate: knowledge for resilience, prosperity and sustainability

Jeff Shrager !
bennuclimate.com/who-we-are
github.com/jeffshrager/Executa…
mitpress.mit.edu/9780262052481…
github.com/jeffshrager/IPL-V
explorecourses.stanford.edu/in…
Kent Pitman !
github.com/netsettler/netsettl…
netsettlement.blogspot.com/
en.wikipedia.org/wiki/Kent_Pit…
Ramin Honary !
tilde.town/~ramin_hal9001
codeberg.org/ramin_hal9001
Me
[]gamerplus.org/@screwlisp
screwlisp.small-web.org

Jeff is a lisp hacker who fucking loves reanimating ancient programs from their original source ! He led the team of that Eliza book that was big news a while ago.

Great episode.

Let's talk about freaky disappearances, places you can get disappeared in, and other strange things that go bump in the woods at night!

#TerrencePopp #Comedy #Redonkulas #GruntSpeak #TheLair

Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.

As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates. There are no reports of certificate transparency logs, which track the issuance of all browser-trusted certificates, showing the compromised keys being used maliciously. The threat remains far from over, however, because it will be hard and time-consuming to update other key parts of the Internet, such as Linux distributions and embedded and Internet of Things devices.

One word: bonkers

The eight intermediate certificates belong to India-based certificate authority eMudhra Limited. An informal advisory published to emudhra.we-have-a-problem.com over on Tuesday posted the message “We have a problem here – Wayne.” The words were digitally signed using the private key of one of the eMudhra certificates. With proof that the reporting party had control of the key, defenders scrambled because the same key could be used to sign unauthorized certificates that would be trusted by millions of servers worldwide.

“This will be a massive cleanup job, bigger than Heartbleed,” Filippo Valsorda, a cryptography engineer and a cryptography maintainer for the open source Go programming language, told Ars. “There will be a very, very long tail, IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools that shipped their own copy of the roots (which is common in some ecosystems, like Python). Also, Linux distributions are still rolling out updates, some of them are not ready yet, and then system administrators will need to apply them to a lot of machines.”

Heartbleed is the name of a critical vulnerability in the OpenSSL cryptography library. In 2014, it came under mass exploitation. Exploits let many unaffiliated hackers decrypt TLS-protected exchanges between parties. They also recovered private TLS certificate keys, session cookies, and passwords. The attacks compromised thousands of servers, some belonging to large companies and government agencies around the world.

Recovery required a long series of steps that took years. Steps included patching OpenSSL on all affected devices, reissuing millions of TLS keys, revoking old certificates, rotating passwords and session tokens and updating embedded devices and other forgotten systems—something that was extremely time- and resource-intensive, especially at Internet scale.

“Every time you need a lot of different people in different contexts to do something, it will take a long time,” Valsorda explained. “This time it’s worse because there’s more contexts, more people, and more heterogeneity.”

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

“That is extremely in the ‘this should not be possible’ category,” Valdorda said. “Maybe some horribly dangerous key generation interface has a ‘size’ parameter and they set it to 1 by mistake???”

Ben Cartwright-Cox, director of BGP.tools, said: “My guess is that it’s example code that accidentally leaked to production, but hard to know. But it’s bonkers that no one noticed.”

At this early stage, the most immediate threat appears to be for those using VPNs, especially in countries with governments likely to maliciously intercept traffic. There are likely many other cases for concern. End users largely have no recourse other than to hold off using many non-browser forms of TLS communication until they receive assurances updates are in place.

As noted, most browsers have already blocked the intermediate certificates. The exception appears to be Edge, which at the time this article went live was still connecting to 12 vulnerable hosts. In response to questions asking why and if the company has plans to do so, a Microsoft representative the company will be in touch if it has anything to “share.” Meanwhile, Signal, WhatsApp, Wireguard, and other apps that don’t rely on TLS for confidentiality aren’t affected. This page and the emudhra.we-have-a-problem.com site show apps known to be patched so far.

The incident is the latest to expose a fatal flaw in the TLS regimen. It’s only as strong as its weakest link, which in this case was eMudhra. Fortunately, transparency logs account for much of that failure, but this measure requires parties to actively monitor massive feeds and works only after unauthorized certificates have been issued. eMudhra representatives weren’t immediately available to answer questions.

One caveat: exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers. People with control of a local network—at a coffee shop, university, or other organization—face much less of a challenge.