Hackers have compromised dozens of popular open source packages in an ongoing supply-chain attack

This is very nasty!

My impression is that law enforcement is doing to little about hackers given all the bad news of all kinds of hacking incidents/crimes (stealing software, deleting data, extortion etc. etc.) in recent times!

"... On Tuesday, cybersecurity firms StepSecurity and SafeDep warned of the latest wave of supply-chain attacks, which aim to compromise developers of popular open source projects and use that access to plant malicious updates that are pushed to users downstream. 

According to SafeDep, hackers took over the account of one developer and released over 630 malicious versions across 317 packages in about 20 minutes. The goal of the attack is to steal credentials for various services, including password managers, as a way to steal data and continue spreading the malware. 

Among the packages that the hackers compromised is Antv, a library made by Alibaba. In some cases, the hackers published malicious updates on GitHub, according to JFrog Security. ..."

Hackers have compromised dozens of popular open source packages in an ongoing supply-chain attack | TechCrunch "Hackers have compromised dozens of popular open source packages in an ongoing supply-chain attack"

Microsoft finally open sources DOS 1.0 OS (first released 1981) - and it's so much more than the code

Good news! Yes, I remember the DOS operating system, the predecessor of Windows. I used it way back then on my IBM PC, which was a gift of my late mother Irma Bingel.

"Before "Micro Soft" became Microsoft, Bill Gates wrote BASIC interpreters. Microsoft's first shipping operating system was a Unix distro called Xenix.

Then, in 1980, Microsoft got its shot at the big time: IBM needed an operating system for its planned IBM PC and asked Gates if he could deliver one. You betcha! The rest is history. ..."

Microsoft finally open sources DOS 1.0 - and it's so much more than the code | ZDNET "Want a blast from the past? Microsoft just open-sourced its very first operating system, offering a rare insight into the PC's earliest days."

Linux Foundation Announces the Formation of the Agentic AI Foundation (AAIF)

Good news! Linux is an excellent open and free operating system that has evolved and improved for decades!

"With founding contributions from Anthropic, Block, and OpenAI, the AAIF unites cutting-edge technology and open source governance to shape the future of open and accessible AI

Summary

• The Linux Foundation announced the formation of the Agentic AI Foundation (AAIF) with founding contributions of leading technical projects including Anthropic’s Model Context Protocol (MCP), Block’s goose, and OpenAI’s AGENTS.md.
• The AAIF provides a neutral, open foundation to ensure agentic AI evolves transparently and collaboratively.
• MCP is the universal standard protocol for connecting AI models to tools, data and applications; goose is an open source, local-first AI agent framework that combines language models, extensible tools, and standardized MCP-based integration; AGENTS.md is a simple, universal standard that gives AI coding agents a consistent source of project-specific guidance needed to operate reliably across different repositories and toolchains.
• Platinum members include Amazon Web Services, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI.

...

 The Linux Foundation, the nonprofit organization enabling mass innovation through open source, today announced the formation of the Agentic AI Foundation (AAIF), and founding contributions of three leading projects driving innovation in open source AI; Anthropic’s Model Context Protocol (MCP), Block’s goose, and OpenAI’s AGENTS.md."

Linux Foundation Announces the Formation of the Agentic AI Foundation (AAIF), Anchored by New Project Contributions Including Model Context Protocol (MCP), goose and AGENTS.md – Agentic AI Foundation (AAIF)

Credits: Data Points newsletter

Austria military just ditched Microsoft Office for open-source LibreOffice

Good news!

"... key takeaways

• Austria's military has switched from Microsoft Office to LibreOffice.
• The move was all about digital sovereignty, not cost savings.
• Other governments are moving away from Microsoft to protect their citizens' privacy.

..."

This European military just ditched Microsoft for open-source LibreOffice - here's why | ZDNET "It's not about the cost savings, either. Many government organizations are replacing Microsoft software for a more important reason."

Why Denmark is dumping Microsoft Office and Windows for LibreOffice and Linux to achieve digital sovereignty

Bad news for Microsoft!

"Denmark's Minister of Digitalization, Caroline Stage [Olsen], has announced that the Danish government will start moving away from Microsoft Office to LibreOffice. Why? It's not because open-source is better, although I would argue that it is, but because Denmark wants to claim "digital sovereignty." ... in the European Union, digital sovereignty is a big deal and getting bigger. ..."

Why Denmark is dumping Microsoft Office and Windows for LibreOffice and Linux | ZDNET "Before the Danish government announced its move, Denmark's largest cities, Copenhagen and Aarhus, had already announced plans to phase out Microsoft software and cloud services. Here's why"

Caroline Stage Olsen (age 34) was appointed as the Minister for Digital Affairs 29th of August 2024. She is a member of Moderaterne.

Switzerland now requires all government software to be open source

Food for thought!

"Several European countries are betting on open-source software for their technology. In the United States, eh, not so much. In the latest news from across the Atlantic, Switzerland has taken a major step forward with its "Federal Law on the Use of Electronic Means for the Fulfillment of Governmental Tasks" (EMBAG). This groundbreaking legislation mandates using open-source software (OSS) in the public sector. ..."

Switzerland now requires all government software to be open source | ZDNET The United States remains reluctant to work with open source, but European countries are bolder.

Meet LLM360: The First Fully Open-Source and Transparent Large Language Models

Sounds good! Commendable!

From the abstract:

"The recent surge in open-source Large Language Models (LLMs), such as LLaMA, Falcon, and Mistral, provides diverse options for AI practitioners and researchers. However, most LLMs have only released partial artifacts, such as the final model weights or inference code, and technical reports increasingly limit their scope to high-level design choices and surface statistics. These choices hinder progress in the field by degrading transparency into the training of LLMs and forcing teams to rediscover many details in the training process. We present LLM360, an initiative to fully open-source LLMs, which advocates for all training code and data, model checkpoints, and intermediate results to be made available to the community. The goal of LLM360 is to support open and collaborative AI research by making the end-to-end LLM training process transparent and reproducible by everyone. As a first step of LLM360, we release two 7B parameter LLMs pre-trained from scratch, Amber and CrystalCoder, including their training code, data, intermediate checkpoints, and analyses (at this https URL). We are committed to continually pushing the boundaries of LLMs through this open-source effort. More large-scale and stronger models are underway and will be released in the future."

Meet LLM360: The First Fully Open-Source and Transparent Large Language Models (LLMs) - MarkTechPost

LLM360: Towards Fully Transparent Open-Source LLMs (open access; this is a technical report)

Meta’s Next AI Attack on OpenAI: Free Code-Generating Software

Code anything for free and without much effort! Happy coding! Paradise on earth (for software enthusiasts). 

Competition is good! More competition is better!

"Meta Platforms is preparing to launch software to help developers automatically generate programming code, a challenge to proprietary software from OpenAI, Google and others, according to two people with direct knowledge of the product. Meta’s code-generating artificial intelligence model, dubbed Code Llama, will be open-source and could launch as soon as next week, one of these people said. ..."

Meta’s Next AI Attack on OpenAI: Free Code-Generating Software — The Information

How censoring China’s open-source coders might backfire

I did not know that the Chinese communists created and allowed a Chinese Github to exist.

"On May 18, thousands of software developers in China woke up to find that their open-source code hosted on Gitee, a state-backed Chinese competitor to the international code repository platform GitHub, had been locked and hidden from public view.

Later that day, Gitee released a statement explaining that the locked code was being manually reviewed, as all open-source code would need to be before being published from then on. The company “didn’t have a choice,” it wrote. ... it is widely assumed that the Chinese government had imposed yet another bit of heavy-handed censorship.

For the open-source software community in China, which celebrates transparency and global collaboration, the move has come as a shock. Code was supposed to be apolitical. Ultimately, these developers fear, it could discourage people from contributing to open-source projects, and China’s software industry will suffer from the lack of collaboration. ...
GitHub, founded in 2008 and acquired by Microsoft in 2018, is the go-to platform developers around the world use to publish their code and then critique and learn from each other. This publicly available code—as opposed to the proprietary code created by companies or individuals—is referred to as open-source software. Of the 73 million people using GitHub as of 2021, 7.5 million are based in China, making them the largest group outside the United States. ..."

How censoring China’s open-source coders might backfire | MIT Technology Review Many suspect the Chinese state has forced Gitee, the Chinese competitor to GitHub, to censor open-source code in a move developers worry could obstruct innovation.

The problems with Elon Musk’s plan to open source the Twitter algorithm. Really!

These concerns are mostly laughable and baseless! Such or similar concerns have now been repeated again and again since Musk purchased Twitter. I suspect ulterior motives and dishonesty behind these criticisms.

I think, Elon Musk is right to open source Twitter source code. It is worth a try! Wait and see!

We have now decades of experience with open source software and they are mostly positive in many respects including security.

The problems with Elon Musk’s plan to open source the Twitter algorithm | MIT Technology Review It could introduce new security risks while doing little to boost transparency.

Automate checking for flaws in Python with Thoth

Recommendable! I did not read the whole, long article, but this seems to be the way to go to make Python more robust and secure.

Taking a bite out of the complexity of software development!

Automate checking for flaws in Python with Thoth | Opensource.com Project Thoth pulls together many open source tools to automate program builds with security checks as part of the resolution process.

Activists are targeting Russians with open-source "protestware"

Really bad news! This is dangerous and more than a double-edged sword!

A lot depends on reliable open source software!

"... Around two dozen open source software projects have been spotted adding code protesting the war. Most of the protestware simply displays anti-war, pro-Ukrainian messages when it is run but at least one project is believed to have had malicious code added which would wipe computers located in Russia and Belarus. ..."

Activists are targeting Russians with open-source "protestware" | MIT Technology Review At least one open-source software project has had malicious code added which aimed to wipe computers located in Russia and Belarus.

Google's Allstar aims to fix vulnerabilities in open source projects

Given that I am almost exclusively relying on free, open source software for my daily work etc., I welcome this initiative!

Finally, let the hackers from Russia, China, North Korea, Iran etc. gnash their teeth! High time these many, dangerous open source software vulnerabilities are taken more seriously! 

How important is this news? "Security gaps increasingly plague large open source projects. The number of open source software vulnerabilities more than doubled in 2019 compared with 2018, according to RiskSense. The implications are far-reaching, considering that an estimated 91% of commercial applications contain outdated or abandoned open source components. ..." (VentureBeat Daily RoundUP newsletter 8/11/2021)

"GitHub [owned by Microsoft] and Google today announced the launch of Allstar, an app that provides automated continuous enforcement of security best practices for GitHub projects. Allstar, which was created by Google and the wider Open Source Security Foundation (OpenSSF), can check for security policy adherence, set enforcement actions, and enact those enforcements when triggered by a setting or file change in a repository. ..."

OpenSFF's Allstar aims to fix vulnerabilities in open source projects | VentureBeat

Ideological and political indoctrination by Node.js

Today, I looked into downloading the open source Node.js, a major Javascript runtime environment, for my current Google Apps Script programming tasks! To my horror, I was confronted with following ideological indoctrination (see roughly center of screenshot below)! Node.js is sponsored by many well known corporations! Among the Open JS Foundation (Node.JS is a project of this foundation) Platinum Members are Google, Microsoft, IBM ...

I blogged here about a Black Lives Matter retort!

An introduction to mutation testing in Python

Recommendable! Short and succinct!



An introduction to mutation testing in Python | Opensource.com

SciPy 1.0: fundamental algorithms for scientific computing in Python

Good news! SciPy 1.0 is officially released!

SciPy 1.0: fundamental algorithms for scientific computing in Python | Nature Methods: SciPy is an open-source scientific computing library for the Python programming language. Since its initial release in 2001, SciPy has become a de facto standard for leveraging scientific algorithms in Python, with over 600 unique code contributors, thousands of dependent packages, over 100,000 dependent repositories and millions of downloads per year. In this work, we provide an overview of the capabilities and development practices of SciPy 1.0 and highlight some recent technical developments. This Perspective describes the development and capabilities of SciPy 1.0, an open source scientific computing library for the Python programming language.

The KDE Monastery

Posted: 8/24/2019

If you think that monasteries in the Western world are kind of quaint and only exist on the periphery of Western societies, where few citizens aspire to become a monk, you might be in for a rude shock.

I have recently discovered a modern monastery, where young people flock to in droves. It is called the Linux based KDE international free software community (S1). E.g. the KDE Plasma Desktop is the default desktop environment on many Linux distributions.

Since I have been using one of KDE’s products very heavily on a daily basis, i.e. Okular (a PDF file viewer & annotator), I thought it would be a good idea to share bug/feature reports about this product with the KDE community.

In dealing with the KDE community, I found out that they care more about themselves and their well being than about the users of their products or the quality of their products. Some of the volunteers have a lazy, cloistered, cultish, arrogant prima donna like attitude and they respond like snowflakes. Volunteer outsiders (like me) trying to contribute are not treated very well unless they adhere to the rules of the monastery. When I addressed my concerns with the KDE community, an administrator quickly shunted me and disabled my account. 

I also tried to contact by email the German registered association behind the KDE community, i.e. the KDE e.V. a registered non-profit organization that represents the KDE Community in legal and financial matters, but they never bothered to respond.

Sources (S):

1. https://en.wikipedia.org/wiki/KDE
2. https://okular.kde.org/
3. https://ev.kde.org/

SoftMaker FreeOffice Annoyances

Posted: 9/21/2016 Updated: 9/25/2016

Update Of 9/25/2016

As of yesterday, I have received a product key from a staff (i.e. Martin Kutolla) of SoftMaker via Skype. As you can see from his comments below, he worked diligently and persistently to find a way to get  a product key to me. Thank you very much for all your efforts, Martin!

However, this episode is still perplexing to say the least. I had not mentioned in my original post that I had received three Advertisement e-mails (Subject line: “SoftMaker Office, easily cut out images”) from Softmaker in quick succession right after I downloaded their software, but their product key e-mails did not come through? Hmm! I also forgot to mention that none of their product key e-mails ended up in my spam folder.

Original Post

Last weekend, I downloaded SoftMaker FreeOffice three times and every time I provided my contact information so I would be able to receive the necessary product key. However, I never received a product key. I then followed up with two separate e-mails each time sent to two different public e-mail addresses listed on SoftMaker’s website, but no response at all.

This really stinks! What a lousy software and company!

What do you need a product key for a free software anyway? This makes absolutely no sense! It is absurd.