The End of F-Droid? Red Hat Hacked, New Linux Kernel  ## Metadata - Author: [[Linux & Open Source News]] - Full Title: The End of F-Droid? Red Hat Hacked, New Linux Kernel - Category: #podcasts - URL: https://share.snipd.com/episode/721a1a00-2a98-46fd-b964-1f9e28b1e27b ## Document Notes ## Highlights - **Sideloading Rules Threaten F‑Droid** - Google’s new sideloading registration effectively blocks uncertified apps on many devices by requiring developer registration and app ID listing. - Nick warns this change could force F-Droid to either register apps itself or drastically change its model, risking its existence. Transcript: Nick They're basically saying that the new Google developer registration process will likely kill the open source app store entirely. If you haven't followed, Google will now mandate that developers register onto a specific platform when they want to publish an application that users would sideload onto their Android Devices. If you're not on that list as a developer, if your app ID hasn't been added onto that platform, certified Android devices will just refuse to install this application, even if all the Settings that you turned on as a user should let you install it. Evdroid says that Google will require first a fee for said registration, you will also need to agree to a specific dev agreement, which might end up limiting what applications can actually Do, and developers will also have to submit a government ID and list all the unique application IDs that they'd like to register with their developer account. The problem is, FDroid can't really tell developers that they need to register with Google in order to be able to publish on FDroid. That's the opposite of FDroid's goal, which is, here is a platform that is not really controlled by a centralized entity, so they can't really force developers to submit their apps Onto Google first. But the only other solution would be to take ownership of all the application IDs that are submitted into FDroid and to register all of those app ideas under FDroid's developer account. But that would basically mean FDroid takes over all the publishing rights from the original developers and potentially also all the risks and problems associated with being that Publisher. The end result is that FDroid would probably end or at least have to drastically mutate into else if those changes really go into action. Now, FDroid proposes that competent authorities look into what Google is starting to build here because it really looks like malicious compliance. They're being told, hey, you really need to accept any form of external app store straight from the Play Store you need to make sideloading really easier for everyone and they're saying Okay we're gonna do that but in our own way and their own way is actually more limiting than the currently existing one it would suck to lose fdroid i don't think alternative roms would Be affected because this would only affect certified Android devices, which I don't think you have to be to use Lineage or Graphene OS or stuff like that. ([Time 0:02:18](https://share.snipd.com/snip/c4c592be-f713-410f-92a9-01672a15db8d)) - **Red Hat GitLab Breach Exposes Customer Data** - Attackers stole large amounts of internal Red Hat GitLab data, including customer records and potential credentials. - Nick notes that breaches are a matter of when, not if, and impact depends on what was exposed and how it can be decrypted. Transcript: Nick Now, one of Red Hat's GitLab instances was breached this week by an extortion group called the Crimson Collective, which sounds either like a World of Warcraft guild or maybe a Star Wars faction from the sequels. They claim to have grabbed more than 500 gigs of data from Red Hat, from 28,000 internal repos, internal repos as in it's not the usual open source code that you can find. This seems to include some customer records which could have some information about their whole networks, their platforms, their servers, which just places customer security at Risk. These records can even contain authentication tokens, database accesses and logins, so it's obviously really bad. Red Hat confirmed the incident, but apparently this happened two weeks ago already, and the hackers, since they didn't really get any response to their extortion demands, they published A list of everything they accessed and grabbed, which includes records from Bank of America, from T-Mobile, from AT&T, Walmart, Costco, and also the US House of Representatives and Some US Navy organizations as well. These are only the US-related stuff that I could find, but there might be other stuff that is not linked to the US specifically. Apparently, the extortion demands were left without answer from Red Hat, and the company has removed all access that hackers used to reach this data, they isolated the GitLab instance And they contacted the authorities. They say that they added some hardening measures to prevent further access as well and they're contacting all impacted customers to share what could have been exposed with them. Let's be totally fair, whether you're a big or a small company, you are never really safe from those kinds of attacks. ([Time 0:05:05](https://share.snipd.com/snip/8a0846fa-7eb7-43e8-9d63-cceadead7f1f)) - **Kernel 6.17 Brings Hardware And FS Gains** - Linux kernel 6.17 adds hardware support, filesystem zero-write acceleration, and performance boosts for XFS and Btrfs. - The kernel introduces smart MUX for AMD hybrid GPUs and unified mitigations for CPU vulnerabilities. Transcript: Nick Now, this week, the kernel 6.17 was released as well. It seems like a refinement and hardware support kind of update this time around but there are some big performance improvements as well. First there's enablement for the Intel Xe3 graphics that are starting to crop up in Intel powered laptops. There is proper webcam support for Lunar Lake laptops and more importantly smart MUX support for AMD hybrid GPUs meaning that technically those systems with an AMD GPU and an integrated GPU as well should be able to automatically switch to the discrete GPU when running intensive apps or workloads. I was pretty sure that this already existed, but apparently not. There's also support for the Legion Go S, plus some big changes to file systems. First, the kernel can now write zeros without any I.O. Operation on SSDs that support the required features, meaning blanking a drive will be much faster now, and there are also improvements to reduce the wear on those SSDs if you blank Them in this way to extend their lifespan. X4 also received sizable performance improvements when you're copying large numbers of files or when you're creating databases. BetterFS has an experimental feature to improve performance as well. Apple Silicon support also gained support for rebooting M1 and M2 Max instead of just shutting them down, which is always nice. And there's also improved security handling of all CPU vulnerabilities like Spectre or Meltdown with a unified option to enable or disable those mitigations. Called initial proxy support which as far as I understand it should give a resource allocation boost to the current task being run when there's a high priority task waiting for more Resources. So basically you have a task that needs to be completed because there's a high priority task running right behind it and so the kernel will just boost the currently running task so it Can finish faster and so the high priority run can start faster as well. This should reduce slowdowns in desktop applications, but it's probably a nice performance boost for a lot of use cases. And obviously, there are the usual improvements to existing drivers, newer drivers, better performance in all subsystems. ([Time 0:07:27](https://share.snipd.com/snip/191d8035-0ea5-40ff-9c54-f68add86994e)) - **Leap 16 Makes Big Usability Changes** - openSUSE Leap 16 changes include a new Agama installer, parallel package downloads, and SE Linux by default. - Nick warns missing latest desktops, disabled 32-bit support by default, and major tooling changes may deter some users. Transcript: Nick Now OpenSUSE LEAP16 was released this week. It's a major release that for once changes a lot of stuff for leap users. Now obviously the goal is to have a stable distro so it runs the kernel 6.12 LTS but it also replaces their older installer with the new Agama installer which is a lot simpler to understand But retains most if not all of the power of the previous one. Sousa always had a pretty huge installer with every single feature that you'd ever want. The new one seems to continue that trend with a much nicer UI. The package manager now handles parallel downloads for faster installs and updates, and there's a new migration tool to help Leap 15 users move to 16 or move to a rolling release instead Like Tumbleweed or Slowroll. You don't get quite all the latest desktops, Gnome is stuck to 48. 49 was released way too close to the end release date of Leap 16. You don't get Plasma 6.5 and you won't get it. You get 6.4 instead. 32-bit support is also entirely disabled by default on Leap 16. You will need to enable it manually if you want to run 32-bit apps like for example Steam and some games. SE Linux also replaces AppArmor by default but AppArmor is still available if you want it and Yast has been replaced by Merlin at least for the package manager slash way to install system Packages. The rest of Yast was stated to be replaced by Cockpit but apparently that's not the case yet in Leap 16. It will definitely be a big change for OpenSUSE users, and probably some users will just not want to move to that one, because those are some big changes. The loss of 32-bit that you need to re-enable, and even with that, apparently, there are still some issues in terms of the packages, the replacement of all the tools by newer ones. Generally, people in the Linux community don't like when you replace a tool and change its UI. It really needs to have at least 100% of the feature set. If even one feature is lost in the betterment of the UI, generally it is a problem. So we'll see if people receive a Leap 16 well or not. Personally, I think it looks like an interesting one. ([Time 0:09:57](https://share.snipd.com/snip/229a3789-4c15-4153-b7a3-f9afad95807e)) - **Plasma 6.5 Beta Polishes UX And Wayland** - KDE Plasma 6.5 beta adds visual refinements, accessibility improvements, and new Wayland protocols to reduce GPU/power use. - Nick highlights features like rounded corners, clipboard starring, and app permission pages as notable changes. Transcript: Nick The final release is still planned for the 21st of this month. Important changes include rounded corners on all windows, even at the bottom, with the usual KDE small radius. You'll be able to disable that I'm sure. There's also day and night switching for global themes and wallpapers so you can have your light mode during the day and your dark mode when the sun is out. The clipboard can now star items to save them for later use. KRunner can now find global shortcuts and has fuzzy matching for apps so they're a bit easier to find using KRunner. Drawing tablets are now better supported, including configuration of the dials and the touch rings. Accessibility-wise, when you use the zoom effect, you will now properly zoom onto the text entry point, if one has been selected. There are visual cues for sound events, there are visual elements to reduce the flickering on the desktop, and there's a new grayscale mode in the color blindness filters section of The accessibility settings. Plasma can also now display printer ink levels, it lets you install drivers through Discover directly, and it has a new permissions page for each app, which lets you manage a bunch of Permissions, not just for flatpacks, but also for every other regular app. You also get the usual Wayland improvements with the Overlay Planes protocol being supported. This should apparently reduce GPU and power usage when you're running stuff full screen. There's also the Picture-in protocol being supported and the Pointer Warp protocol as well. A ton of good stuff in there. ([Time 0:12:19](https://share.snipd.com/snip/435c8445-6dfe-4bb5-9934-ba743b1c2f09)) - **Artix Drops GNOME Over systemd Dependency** - Artix Linux dropped GNOME because the desktop increasingly depends on systemd, which Artix avoids. - Nick notes Artix will keep GNOME apps but not the GNOME session, reflecting tensions between desktop environments and init choices. Transcript: Nick And Artix is such a distro. They announced they were dropping all GNOME-based desktops because they are now, according to them at least, impossible to launch on a non-Systemd distro. They say that they have no interest and no time to write a new code path for running that GNOME session without SystemD and with compatibility with other systems, so they are ditching It entirely. They will keep packaging GNOME apps because these can still run fine, but the desktop itself won't be there. They will still keep older versions of GNOME in the repos, but as they say, things change quickly, these packages will likely soon no longer work properly and will be removed at that Point. Artix still offers KDE, XFCE, Cinnamon, Mate, LXDE, LXCute. I would assume Tiling Window Managers are available too. ([Time 0:14:14](https://share.snipd.com/snip/8370ff68-06eb-41df-93fc-859fcca35de8)) - **Require Human Review And AI Opt‑In** - Fedora’s draft AI policy requires human review for AI-generated code and disclosure when AI played a major role. - Nick suggests requiring opt-in for all AI features, not only those that send data off-device, to protect privacy and ethics. Transcript: Nick What it boils down to is contributors can submit AI-generated code to any Fedora repo, but they remain responsible for it. Human review is still 100% needed before submitting anything to a Fedora project, and if AI was used for a big part of that code, it should be indicated and noted by the person who submitted The code. You should let people know that this is mostly AI generated. AI also cannot be used to make a final decision on whether new code or fixes are accepted or not. People get the final say. They're also forbidding the use of AI to evaluate funding requests, to rank those requests, to evaluate code of conduct cases or proposals for conferences. Again, they really want to emphasize that humans make the decisions in the end. You can use AI to filter spam, to automate note-taking and the like, but the end decision on something that matters, it's still human-made. All AI-powered features that would be added to Fedora should also be opt-in according to this policy as long as they send data outside of the user's device meaning that local-only AI Tools will not require an opt-in if we follow this policy. The proposal also emphasizes that AI is a good tool to help with text-to with transcription, with translations to other languages, with accessibility features, and the like. They also conclude the policy by saying that license obligations must always be respected. No matter the use case for AI, you need to ensure that you have the right to submit that code and that it doesn't infringe on anyone's license or attribution. Now, this proposal still needs to be voted on, but I think it's mostly fine. ([Time 0:16:00](https://share.snipd.com/snip/6623fc27-db77-4c26-9d03-c312988d429d)) - **NVIDIA Shares NDA Docs To Help NVK** - NVIDIA provided NDA documentation to Red Hat developers to aid NVK Vulkan driver development, signaling warmer relations. - Nick suggests this collaboration could improve NVK progress and shift NVIDIA toward better community engagement. Transcript: Nick Now, the Linus Torvalds flipping off NVIDIA meme might be dead and buried because apparently NVIDIA has been supplying documents under NDAs to the NVK developers at Red Hat so they Can keep making solid progress on that open source user space driver. David Airely, one of the co-leads developers of AMD VLK, the Vulkan driver for AMD, now apparently working on NVK, he says that Nvidia gave a lot of information on their architecture To Red Hat and their developers, all under NDA. Of course, it's not like it's free public documentation, which would be much better, but it's still a first step. As the developer says, NVIDIA are getting friendlier, and if they keep enabling NVK to happen, then they will keep trying to improve NVK to beat the proprietary driver. Now, this might mark a change in how NVIDIA views their relationship with the community. AMD has a good, solid lead in terms of the open source drivers and the love the community bears them. NVIDIA is universally hated in the Linux ecosystem because they just don't support our platform very, very well. Having this community working on your drivers and supporting it, even if it's through documentation that is ND8, is a good step. And I think they are finally recognizing that having a community of developers helping you improve your drivers, fix them in a timely fashion, is not only good for your image, but it's Also good business because now companies can start buying your GPUs and think, hey, you know what, if we have a problem, we can actually fix it ourselves, which you absolutely cannot Do in the current configuration of NVIDIA drivers. So maybe this marks a change in their policy, I hope so. ([Time 0:18:36](https://share.snipd.com/snip/b51cfdcd-f39f-4be4-aeb3-bfa7ffc0070b)) - **Mint Revamps Menu And Wayland Input** - Linux Mint updated its main menu to show bookmarks, favorites, and system actions in a customizable sidebar. - Keyboard layout improvements enable Wayland sessions to use non-US layouts and better support IBUS input methods. Transcript: Nick This week, Linux Mint revealed their new main menu design. It is not a giant departure from the current menu that they have, but it now crams more stuff into a sidebar with your file manager bookmarks, with your favorite apps, recent elements, Your username and picture. The system management buttons for logging out, shutting down, rebooting and the like, they are now placed at the top right next to the search bar, which seems to be focused by default. Descriptions are now added underneath the app names in the app list and categories were made smaller and less prominent using symbolic icons, but you can still switch them to high color Icons if you prefer. You can also tweak the entire menu layout, you can hide certain elements you don't want, like the avatar, favorites, recent elements, or the entire sidebar, and you can move those categories To colored icons if you prefer. In short, it is a fully customizable menu that gives you more things by default, but lets you revert to a simpler menu style. Also changing how keyboard layouts and input methods are handled, with IBUS input methods now appearing next to keyboard layouts to simplify the configuration of things. The Keyboard Layout applet supports that change as well, and this also means that under the Wayland session, you can now use any keyboard layout, not just the US English layout, which Was a big problem for that experimental Wayland session. There's also a new on-screen keyboard that looks better and supports different layouts as well. Now, this is cool stuff. It will not revolutionize the life of any Mint user, at least the menu you want. It's a new applet. You can customize it. It's fine. But the keyboard layout changes might make it easier to just switch input methods. ([Time 0:20:28](https://share.snipd.com/snip/2629334c-3364-431d-bfb5-33b8166bca71)) - **NixOS Moderators Resign Over Governance** - NixOS moderation team resigned en masse citing steering committee interference and lack of clarity. - Nick argues transparency and archived moderation logs are necessary to prevent backroom decisions and community conflict. Transcript: Nick Unfortunately, after a nice period of calm, things are shaking up again with a bunch of moderators resigning, apparently almost the entire team. Their concern seems to be the interference from the steering committee that governs NixOS. This council seemingly overruled some of the moderation decisions and who got to be a moderator in the first place. The moderator team thinks the committee has acted outside of its scope and that this creates a big conflict of interest in the community. Basically, moderators seem to have some of their decisions dismissed or reversed without a clear process on how or why this was the case. Some decisions were stalled or subverted entirely, the steering committee apparently applied pressure to target specific community members and specific topics, and they threatened To act further if the moderation team did not follow their own views, the committee also apparently tried to remove moderators without justification and to appoint new members to The team instead. This all resulted in first, the moderation team being stripped of its own role and second, the guidelines for who is moderated or banned from the community and for what reason, those Guidelines aren't clear to anyone now. So the moderators are asking for a more clearly defined structure to know what the purview of each part of the NixOS community is exactly, and who gets the final say on each matter. Now, among the comments on the public post from the moderation team, some people say that it's actually the moderation team that overreached, and that they are accountable to the steering Committee in the first place, because the steering committee is the only elected organ of NixOS. This person who answered, he's apparently a part of that steering committee. He also said that the moderation team operated on personal opinions, on interpersonal trade-offs and biases, instead of just following the code of conduct. I will admit, I have no idea what this really boils down to, who could be in the right or in the wrong, or if it's an equal parts responsibility problem. What it looks like is there's a code of conduct, some people apply it in a certain way, some people think it should be applied in another way, and so this creates problems. The real problem here doesn't seem to be who applies the code of conduct in which way, it seems to be the lack of transparency. Whoever is in charge of moderation should always make a very visible list of who has been moderated, for what, what they said, how this infringed on the code of conduct. Everything should be fully transparent and fully open. That's the only way those things can work. This doesn't seem to have been the case in the NixOS community. It looks like a lot of backroom talk between the moderation team, between the steering committee, with people trying to influence each other, instead of just being open and saying, Hey, we don't like you doing this in this way, so you need to change it, and people responding publicly as well. ([Time 0:22:31](https://share.snipd.com/snip/0e70f53c-4df1-4c18-9f1a-ad5225cdf925)) - **Debate Over Codes Of Conduct Intensifies** - Eric S. Raymond publicly argued against codes of conduct, favoring a single rule about contributor value versus annoyance. - Nick strongly disagrees and stresses codes of conduct must be transparent, logged, and applied with precedents to avoid abuse. Transcript: Nick And speaking of codes of conduct, one person really does not like them, and that's Eric S. Raymond, one of the early influencers on the entire open source movement, who wrote the little essay The Cathedral and the Bazaar that explains the differences in how you build software With an open source model versus a proprietary model. He recently became very vocal against codes of conduct, saying that they are not needed, that projects should refuse to adopt them, should even delete them if they already have one, Or replace them with a single rule, which would basically be, if you're too annoying compared to the value of what you contribute, then you're out. He also says that people who turn codes of conduct into weapons only create more conflict, and that these documents are, I quote, an infectious social insanity that causes drama, politics, And backbiting. And, well, that's certainly an opinion, one I fully disagree with. Let's be honest, we are in 2025 and this is applying to work that is being done on the internet. People, when they have a screen between them and the person they're talking to, are going to act like absolute weirdos. They're gonna say the most horrendous shit and this doesn't need to exist. That's why codes of conduct are here, to have clear guidelines on what you're allowed to do and what you're not allowed to do. Just like when you enter a club, an association, or whatever, you have statuses that you need to accept to join that event, that club, or whatever. It is an entirely 100% normal thing to have. The problem is, these tools sometimes misused or not applied properly. As we've seen with the NixOS problem, this needs to be fully transparent. Every decision that is motivated by the code of conduct needs to be logged, archived, and explained, saying this is what you said, this is why this goes against the code of conduct, and This is why you're being punished in this specific way, or banned, or blocked, or moderated, or whatever else. If you don't have that baseline, then your code of conduct will be taken out of context by many, many people. This is also why case law exists in any legal system. To have a reference, the law can be interpreted in many different ways, just like a code of conduct can. But with case law, or the archives of the moderation logs and the moderation team, you have prior knowledge of how certain things were ruled, and publicly, everyone can know, hey, this Is how they ruled previously, so it is unfair that I've been ruled harsher on this case. That's it. Super simple, very to understand. So in my opinion, Eric S. Raymond is just fully wrong here. ([Time 0:25:36](https://share.snipd.com/snip/36eb3872-cf94-4e8d-ba84-32c61eb3fbc7))