Christophe Schockaert r3vlibre@identi.ca

It's release time! A new version of my Pump.io client for desktop systems just came out of the oven.

The most noticeable changes since v1.3.4, as illustrated in the screenshot, are:

• Items highlighted due to filtering rules will show the reason for highlighting. As visible on the left side of the screenshot, that post was highlighted due to it matching the words “Pump.io” and “Security” in the post contents or title, which I had configured as a filtering rule previously.
• After downloading an attachment, a button will appear, to open the file using the default program from the user’s desktop environment. So if a post has audio attached, after saving it, an “Open” button will appear (right side of the screenshot), and clicking it will open the file with Amarok, Qmmp, VLC, or whatever your default audio player is =)
• Added buttons to rotate images in the image viewer. Also via keyboard, with Ctrl+Left and Ctrl+Right, and via context menu. This is mostly for the case of images uploaded upside down, or not taken in the right direction for whatever reason. (Lower part of the screenshot)
• Some windows that used to block input (modal) to the rest of the program until they were closed, such as posts opened from the Meanwhile feed, will be independent now. You can keep them around for as long as you like, until you close the program.

Also, building Dianara with Qt 5 is officially supported now (that’s how I’ve been using it for a while). Note that your system will need a Qt 5 build of the QOAuth library, which most GNU/linux distributions don’t provide yet. Mageia 6 does, and so does openSUSE (in a separate repository). This required some changes in the buildsystem. Hopefully it will still build successfully for everyone. If it doesn’t, your QOAuth might be missing a feature file (.prf).

If your system’s language is German, you’ll also have an updated German translation, thanks to Mightyscoopa, who got the translation up to date again!

Full blog announcement: jancoding.wordpress.com/2016/10/09/dianara-v1-3-5-released/

Yes, 5.2. No, not RHEL 5.2... bare "Red Hat Linux 5.2", from 1999.

The first CD of GNU/linux I ever had, and also, the first one I installed, on a 486 machine.

Installing it now on a QEmu machine... =)

http://xkcd.com/627/

Following up from last week's update (well, plus a few days)... a lot has happened.

In Pubstrate:

• Session stuff was put to use. Logins/logout now work.
• I wrote a configuration subsystem. You can now configure the application, and have the configuration validate against a spec. The configuration files are written in scheme, but pleasantly, there's a command line script which will generate a default config for you, with some infrastructure so that it will be a nice little wizard asking you questions later.
• Backported some stuff from Guile 2.1/2.2 so that if you're still using Guile 2.0, you can still redirect from relative links. (This was originally against the HTTP 1.1 spec, but in a revised version, it was relaxed.)
• Command line interface now supports multiple subcommands, used for config bootstrapping stuff mentioned above.
• Much, much refactoring.
• Wrote a full widget/form rendering library, a-la Python's WTForms, but without all the mutation.
• Added page to authorize clients.
• User outbox now renders as AS2 on a GET.
• Various improvements and bugfixes.

So 5 days ago, I hit the point where I needed to have a decent client to be testing things with. Prior to this I had just been using the guile REPL to do some crappy posting. I realized I wasn't capturing the experience of any kind of real use though, and I needed to demo a real client, so I started building one.

I really fought with myself over what I should build it in. Weighing the options, I initially decided a Pumpa-like interface in GTK2 would be the most generally demonstratable, and would allow me to leverage the Guile bindings I had already written. So I started writing that, but soon ran into problems... I spent about 4 hours trying to get GTK box packing to cooperate on the most trivial things and realized I wasn't having any fun. I was feeling depressed and full of doubt.

I kind of felt like, maybe an emacs client would be most fun for me. But that would mean reimplementing nearly all of the activitystreams handling code from Guile into Emacs Lisp. So I decided to take an evening to see if I could do it. Well, within a few hours I had nearly everything ported, and by the next day I had a generic methods written! I also made a mockup that felt compelling for an emacs interface, and was able to make use of that look... within a short period I had a working experimental rendering function, and shortly after that I managed to render another entry, this one borrowed from @rhiaro's blog (which exposes an AS2 version).

So, emacs client it is! I've been forging forward, and as of right now I can connect emacs to my localhost instance of Pubstrate and pull down and render my outbox. Horray!

I still need to be able to post things though. For the moment, I am thinking of taking the (hilarious?) route of being able to author content in org-mode (which will be rendered to HTML before being posted to the server).

In the meanwhile, I am also trying to wrap up all the ActivityPub issues I can, though I've been more focused on the software.

I feel like things are coming together, but I'm very afraid that even if I put in all my energy, I won't get things far along fast enough. I'm very stressed out because of this. I know some of you have said "it isn't worth your mental health", but maybe some deadlines, if they are important enough, are. Nonetheless my mental health is admittedly very poor right now... and my physical health isn't doing so great being in crunchtime either. If I step back and look at my productivity, it seems very good on its own. In put in context of a ticking clock, it feels like not enough.

Not long left till TPAC. Wish me luck.

Finally cut el-get out of my .emacs'ing, and down to only 3 packages using emacs' package interface... everything else I'm pulling out of Guix. Great!

Get it here!

Here's a Pubstrate screenshot, showing items in a feed. (It includes a little bit of a sappy micro-love-note. I was demo'ing to Morgan, sorry!) But the cool part is...

Here's a screenshot of soci-el, the emacs ActivityPub client I've been writing. The neat thing is that you see that on the right side, the *soci-compose* buffers I composed the messages from (yes, it's using org-mode, yes I'm using comments to hackily handle the "headers" section). These were then sent across the wire using the ActivityPub protocol. On the left side you can see my outbox rendered, also pulled down through the ActivityPub API.

Fun!

« La nouvelle version de l'éditeur multi-fonctions Emacs est sortie le 17 septembre 2016. La nouveauté la plus voyante est l'intégration de Xwidget, qui permet d'intégrer des widgets X directement, et ainsi ouvrir un navigateur web basé sur webkit dans Emacs et, pourquoi pas, de regarder des vidéos YouTube. » http://linuxfr.org/news/gnu-emacs-v25-1-regarder-youtube-dans-emacs

L’emprunt
https://www.youtube.com/watch?v=r8So2NZ-3TM

Eh oui ! Dans une économie basée sur la monnaie dette, l’être humain n’est pas libre de se consacrer pleinement à la création de valeurs de son choix.

Pour qu’un être humain puisse se consacrer à la création de valeurs dans l’économie, il doit avoir de la monnaie.
Monnaie, qu’il “supplie” au banquier qu’on la lui prête pour la réalisation de son projet.
Cette monnaie lui sera prêtée a condition que le projet soit rentable et que l’emprunteur ait de quoi rembourser en cas d’échec.

Que dis-je ? Les banquiers ne prêtent pas de monnaie. Ils prêtent des nombres préalablement créés sans efforts.

Pourquoi ont-ils ce privilège de création monétaire ? Ça sent pas l’arnaque ça ? Pourquoi ne pourrions-nous pas créer de la monnaie à notre tour ?

Si l’être humain souhaite se libérer de la religion de la monnaie asservissante, il peux participer à la création d’une monnaie libre dans laquelle chaque être humain est créateur de monnaie à parts égales.

via https://diasp.eu/posts/4640680 

Read online: https://www.gnupg.org/blog/20160922-gnupg-this-summer.html

As usual, Werner has made a cornucopia of contributions. He improved --quick-addkey and --quick-gen-key, he changed gpg-agent and dirmngr to exit if their sockets disappear, he added an assuan logging monitor, he implemented new export and import filters, he did some work on g13, he added /run/user/UID/gnupg sockets, he introduced an option (--recipient-file) to work directly with keys stored in a file, and he made a number of improvements to GPGME including adding TOFU support.

The filtering changes allow controlling what packets are imported or exported. For instance, if you want to only keep a single user id when exporting a key, you could use:

gpg --no-options --import-options import-export \

--import-filter keep-uid='mbox = joe at example.org' \

--import < full-key.pub > key-with-one-uid.pub

More information about this feature is available in his note to the GnuPG mailing list or gpg's documentation.

The --recipient-file option is an oft-requested feature, which allows working with keys without importing them.

Werner also fixed a critical bug in the way the mixer in the random number generator stirred the pool. Specifically, the bug allowed an attacker who obtains 580 bytes from the standard random number generator (RNG) to trivially predict the next 20 bytes of output. Fortuitously, this bug does not affect the default generation of keys (more details).

Justus continued to improve our new test suite for GnuPG. The improvements included not only fixes to the new scheme-based driver, but also a bunch of new tests. A couple of the changes included bug fixes to TinySCHEME. Unfortunately, the upstream developers don't appear to be interested in the fixes.

Most of Justus' time recently has been focused not on the test suite, but on improving the Python bindings for GPGME. This work was started by Ben McGinnes, who contributed an initial port of the PyME bindings to Python 3. Justus finished this port, restored Python 2 compatibility, and added more pythonic interfaces (e.g., making everything work with objects implementing the buffer protocol like byte strings). The low-level interface has, however, been retained and existing applications should continue to work (if not, this is a bug, please file a bug report). He also ported the GPGME test suite to the Python bindings. This uncovered a number of latent bugs in the bindings, which he fixed. From our perspective, these are now the official Python bindings for GPGME: we've added them to the GPGME repository, and we will continue to maintain them in the foreseeable future. Nevertheless, to be more compatible with Python developers' work flow, we are also packaging pyme3 for pypi, which means that the bindings can be installed using pip install pyme3. More information is available in Justus' blog post.

Justus also set up a Jenkins host for continuous integration. In addition to running make check for each commit under several configurations, it also runs the checks with various sanitizers enabled. This has already prevented a number of minor bugs from making it into releases.

Andre has made a number of end-user facing contributions. The most notable is for users of Kleopatra, which now has new dialogs for File Encryption and Decryption / Verification. These greatly reduce the number of required interactions to perform these operations. He also worked on the new file type registration on Windows so that decrypting a file only requires a double click. Additionally, he has continued his work on the GnuPG plugin for Outlook, which should be released with gpg3win-3 this fall. The code is already in good form, and testers are encouraged to check it out together with the new Kleopatra (see Test version of Gpg4win-3.) Andre has also been working on improving KMail's gpg support. One of the focuses of this work has been adding TOFU support to the libraries used by KMail. Andre also merged the C++ and Qt bindings for GPGME from KDE into the official GPGME repository. This included a port of the C++ API to pure standard C++ without boost, and the removal of some KDE-Framework use in the Qt bindings so that the bindings now only require Qt 5 base. This should make working with gpg in a Qt application even more convenient. In particular, executing operations asynchronously is very easy. Finally, Andre fixed some CRL-related bugs in dirmngr.

Kai's recent work has focused on porting Mailpile to use GPGME rather than its own wrapper, which only works with GnuPG 1.4. Unfortunately, many projects decide to take a similar approach to Mailpile, and write their own code to interact with gpg. As a reminder, we strongly encourage all developers to not directly interact with gpg, but to use GPGME, which is not only more complete, but also has seen a lot of testing. We realize that GPGME's interface's are not always ideal, however, we are open to suggestions for improvements, and feature requests. Similarly, if you don't understand how to do what you want using GPGME, we encourage you to ask for help on the gnupg-devel mailing list.

Jussi Kivilinna has continued his work optimizing libgcrypt. In the recent past, most of his effort was spent on implementing assembly versions of various cryptographic functions for the ARMv8/AArch32 architecture.

Niibe worked on mitigating the recently published Flip Feng Shui exploit. Flip Feng Shui uses a cross-VM, row hammer-based exploit to change the trusted.gpg file, which is used by Debian's package manager apt to verify downloads, and apt's sources.list file, which determines where packages are downloaded from, in a controlled manner. This allows attackers to replace packages that are installed with their own versions. The fix is to make sure that gpgv always checks that self-signatures are valid.

Niibe also spent time improving GnuPG's smartcard support. This has primarily consisted of many small, but important improvements including smartcard support for ECC keys and various bug fixes. Further, Niibe investigated adding signature verification for ssh keys stored in the authorizedkeys file. This would allow detecting corrupted keys, which could happen via a Flip Feng Shui-type attack. Although there is some support for signature verification in ssh, Niibe discovered that this particular mode of operation is not yet supported by ssh-agent.

Finally, Niibe has released a new version of GnuK (1.2.1). GnuK is a fully free cryptographic token (hardware and software). Not only is GnuK based on free software, but the entire hardware specification is open, and the parts are relatively easy to buy and assemble. The GnuK token can be ordered from seeed or the FSF.

As usual, dkg contributed various clean ups and bug fixes. He contributed a patch to avoid publishing the GnuPG version by default, and another to improve --quick-revuid. He also provided a patch to reenable exporting secret keys without a passphrase, which was possible in gpg 1.4 and 2.0, but, due to various technicalities, was not possible in 2.1. dkg also started a discussion about having systemd manage gpg's daemons. This would ensure that GnuPG's daemons are stopped when the user logs out. He provided patches, but so far these changes have not yet been accepted.

Ben Kibbey made a number of contributions. Among his bug fixes and clean ups, he fixed the OpenIndiana (Solaris) builds.

I (Neal) returned from a several month sabbatical. My first order of business was to tie up some loose ends with the TOFU support in GnuPG. Among other things, I added several checks to reduce the number of gratuitous conflicts. In particular, if two keys have the same email address and are cross signed, then they are almost certainly controlled by the same person. In fact, this is a usual way of indicating key rotation. I also set the default policy to "good" for keys that the user has directly signed.

cartosm est un service web de mise à disposition d'iframe pour permettre l'intégration aisée de plan sur les sites web. cartosm utilise les données du projet OpenStreetMap en totale indépendance et n'a aucun lien direct avec le projet. Voir http://cartosm.eu/

On September 28, 2010, LibreOffice was announced

https://blog.documentfoundation.org/blog/2016/09/28/happy-6th-birthday-libreoffice/ 

Diaspora - Proposed Design Improvements

Renaud annonce "son plus bel album depuis Mistral Gagnant" et il envisage de remonter sur scène http://apr1.org/Gj hate de voir/écouter ça

Travail et numérique : le revenu de base dans les propositions du CNNum

▸ http://www.numerama.com/politique/137196-rapport-du-cnnum-sur-le-travail-et-le-numerique.html

Un rapport du Conseil national du numérique (CNNum) remis ce mercredi matin à la ministre du travail Myriam El Khomri préconise d’étudier la mise en place d’un revenu de base, ou revenu universel, versé à tous les habitants sans conditions. Une forme de redistribution des richesses financée, entre autres, par les gains de productivité permis par l’automatisation croissante du travail.

Comment j’ai dégooglisé mon smartphone et mon PC http://www.blogul.fr/blog/?p=504

via https://diasp.eu/posts/3854596