Python Refuses $1.5M Grant, Unity's Second Demise, AUR DDos  ## Metadata - Author: [[Linux & Open Source News]] - Full Title: Python Refuses $1.5M Grant, Unity's Second Demise, AUR DDos - Category: #podcasts - URL: https://share.snipd.com/episode/66596f8f-a49f-46d9-bd0f-7b0eb2e332be ## Document Notes ## Highlights - **Funding With Strings Can Undermine Mission** - The Python Foundation refused $1.5M because the grant forbade DEI programs and allowed clawbacks for perceived violations. - They prioritized their mission to support a diverse international community over risky, conditional funding. Transcript: Nick Okay, so let's start with Python, and this one is probably going to earn me a bunch of angry comments, because Python refused a 1.5 million US dollar grant from an organism that is funded By the US government. You might wonder why a small organization like the Python Foundation would turn down that big amount of money, because their annual budget is around five million dollars, they only Hire 14 people, and the reason is because the US government attached a bunch of strings to that grant. They're required that the Python Foundation would not operate or stop any programs that advance diversity, equity, and inclusion, or what people in the US call DEI. They would be required to not implement any of those policies on the project funded by the grant, but also at the entire foundation level. Now, this grant would have served to help with lessening the risks of supply chain attacks, with creating an automated review process for PI PI packages and other things of that ilk, So obviously important work. The problem is there's not just the DEI issue. If the US government or the funding organism didn't like something the Python Foundation did during the time where that money was being spent, they could first take back what was left Of the money, but they could also ask for what they spent back, meaning the foundation would potentially have had to reimburse them in full at some point if the US government decided They didn't like how they handled something. Python deemed this unacceptable. They also point out that they have a commitment in their mission statement to grow and support a diverse and international community, and that they aren't willing to compromise on That mission statement. They're disappointed in having to turn down the money but the uncertainties around this grant are just too strong as they say. The language around those is very broad and these restrictions are new and untested by other projects so it's too risky and they don't want to be the test case for such a program. Now accepting this grant under these conditions would frankly be absolute Imagine you're doing the work, you spend the money, everything is done, and a year after that this funding Organism knocks on your door and says, hey, at that point you hired someone that is transgender, that is DEI, give us back 1.5 million dollars. On an operating budget of 5 million, this would basically bankrupt the Python Foundation. This would be entirely unacceptable. Imagine if in your business, the client had the right to take back everything that they paid you just because they did not like one of your employees. This would be absolute nonsense, and obviously no one would accept these terms, so props on the Python Foundation for refusing it. ([Time 0:01:48](https://share.snipd.com/snip/ec5c7c6d-ab2f-4309-9dfe-1c0e8590f5f7)) - **Recruiting Experience Shows Bias Exists** - Nick recounts recruiting in France and encountering shocking bias against women and minorities from managers. - He credits DEI programs for preventing companies from becoming exclusively homogenous workplaces. Transcript: Nick And on DEI, I did a lot of recruitment in France, where we have those same policies as well, and the things I heard my bosses, or certain of my bosses at the time, were just horrendous against Women, certain religions, certain skin colors. Without those programs, I would have worked at pure pure white, pure heterosexual companies, and nobody else would ever have been hired. This is a real societal problem. Thinking that companies will just hire the best qualified person without any other bias is insane. It's delusional. This is not the world we live in. Now, sure, sometimes maybe DEI policies are badly implemented. Sometimes maybe someone gets hired that isn't the most qualified for the job. But you know what? Sometimes even without taking DEI into account, you also hire the wrong person for the job. ([Time 0:04:31](https://share.snipd.com/snip/976145f4-0053-4942-bef9-ba6b3dfed0a8)) - **Revived Desktop Faces Sustainability Crunch** - Ubuntu Unity missed the 25.10 release due to too many bugs and a lack of developer time and expertise. - The project risks a second demise unless new contributors with coding skills step in to sustain it. Transcript: Nick After the efforts to revive Unity, the desktop environment that culminated in the release of a few versions of Ubuntu Unity, it seems like the project just is not getting enough traction. Ubuntu 25.10 with Unity, the Unity flavor, was not released because there were too many bugs in there and Mike Adamietz, one of the lead developers, called for help on the Ubuntu discourse. They just do not have enough time and skill expertise to make progress on this desktop. He says that the bugs in 25.10 were just too big to release an ISO. These bugs will also apply to an upgrade, which is why they haven't released it either. And he says that Unity is currently broken and needs to be fixed. The problem is the person doing most of the coding, called Rudra, he's at university. He just doesn't really have time to focus on that anymore, which is normal. At some points, your priorities have to shift, but the remaining members of the team just do not have the coding expertise to handle all of that work. So they're currently looking for solutions. ([Time 0:05:38](https://share.snipd.com/snip/2a88b535-b6f5-473d-a8bf-808663e864f0)) - **Mitigate DDoS But Communicate Trade-Offs** - Deploy DDoS protections but expect operational trade-offs like blocking AUR pushes over SSH. - Communicate transparently about attacks to reduce user uncertainty and operational disruption. Transcript: Nick But this week, the AUR once again came under attack. It's the usual distributed denial of service stuff. The Arch team this time has deployed DDoS protections, which are mitigating the issue, but it also blocked all pushes for the AUR. So no updates and no new apps and packages are coming into the AUR for now, because this protection system doesn't handle SSH connections on port 22, which is what is used to push software To the AUR. Now the repo is accessible, users can download stuff from it, the Arch team is unfortunately not sharing anything about who might be responsible for these attacks, and it's starting To become a recurrent thing these days, and it's pretty worrying for Arch users. Now at the time I'm recording this, things still seem affected, but maybe by the time you're watching it, things will have been solved. ([Time 0:07:43](https://share.snipd.com/snip/41a75931-4c46-4ea4-861f-61edd7624066)) - **Release Timing Eases Desktop Workload** - System76 plans Pop!_OS 24.04 with Cosmic on December 11 and will align future releases with Ubuntu LTS cycles. - Using an older LTS base reduces migration work, letting them focus on the Cosmic desktop itself. Transcript: Nick Now, we do have a release date for the Cosmic Desktop. It should arrive before the end of the year, at least according to Carl Ritchell, System76's founder and CEO. He said on Twitter that the release date is planned for December 11th with Pop !OS 24.04 LTS, which I will maintain is a dumb name for a distro releasing in December of 2025. He also says that after that, starting with Pop !OS 26.04, releases will align with the regular Ubuntu LTS cycle. They're aiming for weeks after the Ubuntu release for theirs and at that point the naming scheme will make sense again. It looked like the beta for Cosmic was pretty stable and pretty complete in my personal tests so that's not super surprising but of course Cosmic has a solid history of delays so maybe They won't hit that release date. We'll have to wait and see. Now I didn't make a video about the beta because I just didn't find that many new things compared to the final alphas that I tested so I'm gonna wait for the final release to make a dedicated Video on Pop !OS and Cosmic. The good thing is they're using an old LTS base so so they probably don't have that much to do with it, apart from maybe replacing the kernel and the Mesa or NVIDIA drivers in their own repos. So they only have to focus really on the Cosmic desktop itself, which is better than focusing on the base and on the desktop. ([Time 0:09:01](https://share.snipd.com/snip/a75c939d-e427-4f56-85bf-d24b5fdf5184)) - **Force Extension Data Transparency** - Require extensions to declare data collection in manifest.json and show it during install to increase transparency. - Block extensions that misrepresent or omit data practices to protect users and privacy. Transcript: Nick A nice step forward for browser extensions, Firefox will now require that all new extensions disclose their data collection practices. This will begin in early November, and developers will then be required to list what they collect in their manifest.json file. That's the file that lists what the extension does, the various APIs it uses, and now also the data they collect. So starting November the 3rd, they'll have a new key in there affectionately named browser-specific settings.gecko data collection permissions, and they have to use that to declare All that they collect. Only new extensions are required to do this for now, but all existing extensions will also have to do so in the first half of 2026, and this information will be listed in the pop-up that Appears when you install an extension to your browser and in the permissions and data section of Firefox's extensions page. Extensions that don't collect anything will also have to declare that in the same field, meaning the user can actually see what they will give away in exchange for functionality. Extensions that don't disclose what they collect or are reported by users for misrepresenting this collection will be blocked from the entire developer portal. ([Time 0:10:44](https://share.snipd.com/snip/493bd823-fc57-4891-8e4f-6227b4467403)) - **Architecture Variants Yield Small Gains** - Ubuntu now offers amd64v3 (x86-64v3) package variants optimized for modern CPUs, covering ~2,000 packages initially. - Most packages yield about 1% performance gain, so benefits are small but cumulative for modern hardware. Transcript: Nick It's just going to be more helpful and it puts a few restrictions on developers to make sure that they don't do anything too shady after many months maybe even more than a year of deliberation And tests ubuntu finally moved forward with architecture specific package variants starting with ubuntu 25.10 you can now get x86-64v3 packages, which are optimized and compiled Specifically for modern Intel and AMD hardware that supports more recent instructions. They had to make changes to dpkg, apt, and launchpad as well, which is the place where they built those packages, and they can now serve different versions of the packages, depending On what your hardware actually supports. Only 2,000 packages are covered for now, that's most of the main Ubuntu repo, but they hope to be able to build all the packages in the Ubuntu repos for this architecture variant 426.04 LTS. Now, do not expect this to transform the performance of your entire system. Most packages will give you about 1% better performance than the non-optimized ones, some of them bringing better performance, of course. You can actually upgrade your current 25.10 systems to move to this variant. The Ubuntu discourse post that I linked in the description has all the details. Now, for a 1% performance improvement, I'm not sure that all the work and the resources being consumed by this are really worth it. ([Time 0:12:11](https://share.snipd.com/snip/28df30a4-8f5f-45cc-8f57-38367786a0fc)) - **Frozen Images Reduce System Fragility** - KDE Linux avoids package-based systems because in-place upgrades accumulate cruft and fragment platform assumptions. - They prefer a frozen system image plus Flatpak to ensure a consistent, reproducible platform for apps. Transcript: Nick Linux team explained why they don't want to do a package-based system for their distribution. While they say they love package management and the convenience it brings, they also say that it deteriorates over time. As a system gets updated and upgraded in place, things are added or removed and you're left with plenty of crap lying around. You could have orphaned packages or even you could have uninstalled important stuff without even knowing it. They also said that it makes DOS into a whole landscape of different systems that you can't really target as a platform. You don't know what each computer has installed or not, so you have to make assumptions or build a bunch of conditions depending on what the user is running and has installed. They conclude by saying that it is a barrier to high quality levels because yes, everything is fixable with a few tweaks, but also you won't remember those tweaks if you reinstall and Not everyone is able to understand those fixes or to apply them. They still cite a bunch of really good, solid and stable distros that use package management like Fedora KDE or Arch Linux, but they say they opted for a frozen system based on Arch packages So they're building just one platform. Everyone has the same system image, the platform is that image plus Flatpak. And they're also critical about Flatpak, saying that it's opinionated, that it's restrictive and it can't handle system elements, like for example, Snap could. They also say that apps are not on FlatHub or in Flatpak remotes as well, and they run around that by including Snap and supporting app images or distro containers as well. Now, it feels like a fair blog post and explanation. They're basically explaining why they made that decision without dismissing all the other options. They acknowledge the limitations and the problems with this decision. ([Time 0:14:06](https://share.snipd.com/snip/cd825975-14b4-404a-be96-e0c3fc762eb7)) - **Privacy-Respecting Rich Address Suggestions** - Firefox will show richer address-bar suggestions using encrypted queries via oblivious HTTPS to preserve privacy. - Mozilla separates query text from IPs so relays can't link identities to query contents. Transcript: Nick Now Mozilla is preparing another improvement to Firefox, this time to the address bar recommendations, the little drop down that pops down when you start searching for something. These are currently pretty much useless on Firefox, apart from showing you some elements of your browsing history. The search recommendation part of that drop-down are just not that interesting to me. They just take you to a search results page and honestly by the time I look at what they're offering, tap the down arrow and then enter, I would have just completed what I was typing and Hit enter. It just doesn't save any time. What they're trying to change here is to show more information. For example, typing a flight number would show you the actual details of said flight straight in the drop-down. Or they would show site recommendations that match a fuzzy URL that you're not completely remembering. Or they could show the main picture, address, and rating, and the open-closed status of a business you're looking for. They could even recommend the best-rated business for a specific query. The issue with this system previously seemed to be privacy. They did not want to send your search queries to Mozilla directly, but they've now built the architecture needed for this. They're encrypting the query with oblivious HTTPS, which basically means that the IP will be visible to a relay operated by Fastly, but that relay cannot see the text of your query. That text is only shown to Mozilla, but they don't get the IP address, so no one can connect the two. They will start with the US at first, and if it works well, they'll expand to other regions in the world, but it seems nice. It's going to make these things a bit more useful. It doesn't seem like it's being operated by AI either, which I like, and it seems to be privacy respecting. ([Time 0:16:12](https://share.snipd.com/snip/b5077c1a-d1e2-4d38-b2fe-e64d39204e6a)) - **Fedora Shows Next-Gen Desktop Trends** - Fedora 43 ships GNOME 49, moves GNOME to Wayland-only, and updates various under-the-hood systems. - Fedora acts as an advanced showcase for Linux desktop trends that other distros will follow. Transcript: Nick Now of course this week Fedora 43 was released, updating not only the original GNOME edition, but also the KDE one, the atomic variants like Silverblue, the various spins based on other Desktop environments. You can thus expect GNOME 49 and all of its improvements that we covered at length on this channel, I'm not going to go back on that. They also are moving to Wayland only for GNOME, they're replacing the video player with Showtime, they have a new emoji font as well on Fedora that should render better on screen, and Plenty of changes under the hood like compressed init RAM disks, a bigger boot partition, and more. The KDE edition of Fedora KDE is on Plasma 6.4 right now, not 6.5 because it was released too close to the release date of Fedora 43. I've been told they could upgrade it to 6.5, so we'll see. And Fedora is always a very nice distro. I remember when I started using Linux in 2006, people just shied away from it because it was considered way less stable than something like Ubuntu. It was just not as compatible with many computers because it had a very strict policy on firmware and drivers, which it still has, but options to install those are now way easier than Back in the day. It has progressed quite a bit. ([Time 0:18:20](https://share.snipd.com/snip/e136c15c-f070-4ae1-a7b3-ff8fe7e19540)) - **Render Loop Bug Crashes Chromium Browsers** - A Blink rendering bug lets web pages update properties repeatedly to crash Chromium-based browsers within seconds. - The flaw causes crashes and massive RAM use but doesn't leak data; Google had not patched it promptly after disclosure. Transcript: Nick I think it's cool. Now there is a big critical vulnerability in Chromium and thus in all Chromium based browsers so about 90% of the entire browser market share worldwide. This flaw is more specifically in Blink, the rendering engine used by Chromium, and it causes all Chromium-based browsers to crash in 15 to 60 seconds. The rendering engine doesn't pose any limits to how many times a page can update some properties, for example, the title. And so you can change it millions of times each second, which will destroy the main thread of Chromium and crash the entire browser. On Windows with Edge it seems that it can even crash the entire device, sucking up to 18 gigs of RAM in one tab when used on Microsoft Edge. This bug was disclosed at the end of August to the Chromium team but they did not patch it or even respond to the researcher who found it. The issue will not lead to data theft, to ransomware, or computer infection, but it can seriously disturb a number of devices that would be directed to a specific web page. You could potentially crash an entire network of PCs by, for example, infecting the default homepage of an entire company's web browsers, especially on Windows where the system seems To lock up entirely. And since Chromium browsers tend to restore browsing sessions by default, just restarting the browser might lead to the same outcome until you clear out some config files. Firefox and Safari aren't affected by this issue, of course. Now it's not a huge security problem, but it could definitely make a lot of companies, businesses, or governments lose a lot of time by just crashing their browsers repeatedly by just Infecting some web pages that they go to. It's not going to steal some data, but it's still a big issue and it's weird that Google hasn't addressed it yet. ([Time 0:19:56](https://share.snipd.com/snip/0b2ba8e6-f1a8-4ea4-8e9c-8df3ab6cba60)) - **Linux Gaming Compatibility Is Strong** - ProtonDB indicates roughly 90% of Windows games now run on Linux, with many rated gold or platinum. - Anti-cheat and networking remain the main blockers for the small share of borked games. Transcript: Nick First, Windows games on Linux have never been better supported. Judging from the ratings on ProtonDB, which yes, those are user submitted and sometimes they're a bit higher than they should, people can be over-enthusiastic there, it seems like About 90% of Windows games on Steam now run on Linux. The games with a borked rating, meaning they just don't run at all, are now about 10%. The rest are very few bronze-rated games that really don't run very well and require you to do some manual tweaks. There's also about 20% of games rated silver that run but aren't perfect, and two-thirds of gold and platinum games, which are pretty much perfect. Platinum rated games, they're about 50% of the entire total. Among most games that are borked, as in they don't run at all, a lot of them, it's just due to anti-cheat reasons as well, which means the game actually runs, it's just that the server doesn't Let you connect to it. Now that's pretty neat, Linux is a very viable platform for gaming these days as showcased by the Steam Deck, SteamOS and other devices coming with SteamOS pre-installed. Now of course the focus should probably be on trying to bring those silver and bronze rated games, even the gold ones, to a more platinum status to make sure that they can all run with just One click, one install, nothing to add, nothing to configure, because that's the best experience you can provide users. For the borked games, you would have to solve the entire anti-cheat issue, which is going to be a lot more work than just bringing all the games that run kind of bad, running them at a very Much more consistent level on Linux. ([Time 0:21:52](https://share.snipd.com/snip/1e9fe0b6-a279-43e1-8a1e-23375095730d)) - **Linux Performs Better On Handheld Tests** - Tests on the ROG Xbox Ally showed Linux (Bazite) outperforming Windows by large margins in several games. - Nick notes Linux's leaner system design yields better performance and faster suspend/resume on handhelds. Transcript: Nick This thing was supposed to bring a new full screen handheld interface and some specific Windows optimizations to make the thing run more smoothly, but it still looks like Linux wins On this device, and by a sizable margin. A YouTuber called CyberDopamine conducted a bunch of tests. I have no idea if they are a trustworthy source or not, but they were picked up by various websites, so I would say probably they are. Bazite was installed on this handheld in those tests, and it yielded about 32% more fps in kingdom come deliverance 2 and even at lower wattages it's still six percent better performance On linux hogwarts legacy got 24 more fps on bazite and apparently these frame rates are much more stable on linux as well and the general experience of using the device was also better On BuzzEye because, for example, waking up and putting the device to sleep is faster on Linux. On Windows, it seems to take 40 seconds to go to sleep and 15 seconds to wake up, when on Linux, it's kind of instant. We all know that on a technical level, Linux is just a better platform for handhelds than Windows. ([Time 0:24:00](https://share.snipd.com/snip/e34dd946-0430-47a6-8bf7-31540527962e)) - **Verification Ratings Can Be Misleading** - Steam Deck verification can be gamed by splitting problematic multiplayer into DLC, masking compatibility issues. - Nick warns this practice could mislead buyers and urges Valve to prevent it to protect users. Transcript: Nick And we'll conclude on a little annoyance on the Steam Deck. Ghost of Tsushima is now Steam Deck verified, at least the director's cut of it is, which might sound good, but it only reached that rating because they split off the multiplayer mode As a DLC, a multiplayer mode that uses the PlayStation overlay, which currently doesn't work with Proton, and thus made the rating worse. But by splitting off this multiplayer mode, they can now say that the main game is verified except DLC don't have their own ratings so people might buy the game and think it runs fine and Then download the multiplayer mode and realize it doesn't work and that the game was indeed not verified and kind of broken in some parts of it and that really sucks now for Ghost of Tsushima I don't think that's a big deal. This is really a single player title. I completed it 100% on PS5 and I didn't even notice it had a multiplayer mode. So either it is a recent edition or a version specific for the director's cut or I completely missed it in the game. That's not a game I would ever want to play multiplayer anyway for. A single player driven experience. But for other games, imagine Call of Duty splitting off the multiplayer mode as DLC. They could say the game is verified on the Steam Deck because the campaign works, and then when you try to go multiplayer, then nope, nothing, nothing happens, and you're done. ([Time 0:25:44](https://share.snipd.com/snip/772d679e-7fc5-4852-b2e0-f737595c131d))