The question is rather how you weigh a life without sugar against a life with cancer?
Or, more precisely, a life with limited sugar against a life with a chance of cancer.

It's not government control though, it's people forcing the judicial branch (DSA) to help individual user to have some control over their online life against IT companies. Some IT companies have budgets larger than some small European nations. European users have rights when companies do their advertisement business in Europe. This is giving individuals more options, not less. What's the alternative? Give up and let foreign companies do whatever they want with no recourse?

As far as I know, the GNOME project has been the only Linux graphical shell that actually performs systematic studies of the user experience, and based on this, changes the interface. Testing how users are able to figure out a system is crucial, especially watching people (without helping them) who have never worked with Linux before.

This is a very different axis to most Linux developers building UIs based on what they feel like, which is most of what we read about on slashdot.
This is a very different axis to experienced users who have an emotional reaction when things change, which is where most of the software building energy goes.

GNOME indeed has a very nice interface design guide (likely originally inspired by Apple, but they evolved themselves), that you can consider for your own non-GNOME projects.

I like GNOME's systematic approach, and great to see that Germany is putting money to these efforts.

He came to my apartment the other day to upgrade my Linux. So he didn't visit your machine? How did you offend him?

We have duplicated code into a new language and removed all synergy effects by sharing a code base with the rest of the community. Hurray! /s

Maybe one day we can have bi-directional LLM-based translators that allow features and bug fixes to perculate back and forth forks ...

Where do the lists created by fail2ban and reaction ultimately go? I understand that these are local, but would it make sense to make a karma server where people can look up whether an IP is likely untrustworthy? Such a karma list may help prioritize traffic and help ISPs/providers identify that they are infected.

With the number of available and vulnerable IoT devices and the number of motivated hacker groups supercharged with LLMs, shouldn't a lot of company and government secrets get revealed these days? Perhaps news organisations have a bottleneck being underfunded to go through leaked material?

This is good long-term, but what fraction of routers, smartphones, IOT devices, cameras, cluster servers, ... really get patched? Would be interesting to see among Linux devices a survival curve or market share of Linux v3, v4, v5. No one (except maybe intelligence agencies) has that data though.

We can bet that black hats iterate through all accessible devices and try to gain access. They might patch flaws to avoid others getting in, but will keep a backdoor for themselves. So it will be extremely hard to tell. We do not have something like brickerbot to turn unpatched devices noticeable.

The moral of the story is that it is easier and easier for police and intelligence services to quickly get meaningful information out of hard disks, including passwords and files in a personal workflow / storage structure (or lack of structure). LLMs might piece this together and be targeted. Security analysts would be faster and ignore noise better, but what is shown here might scale to millions of citizens.

The response of "User-Agent is not authentication" is a strawman response to "Unofficial clients should not use our servers". They used it as identification of clients, not authentication. Would the developers be happier if they had used an API key for the web interaction, but package that fixed API key into the app? Would that be "authentication" and thus better to them? It's the same effect, and the open source clone would copy it too.

Same discussion as 30 years ago with open source clones of messaging apps such as ICQ. The open source client pretends, on those days through reverse engineering, to be the official client. Ultimately, it was okay then, because it was beneficial for the operators to have a larger network of users who can talk to each other. Does this dynamic apply here?

If hammering is an issue, randomly drop with 429 95% of requests. Then as an alternative, allow people to buy an API key for 1000 downloads costing 1€.

Then patient individuals can always download for free. Big companies / CI / AI will want to pay or make their own mirror.

Rebecca Watson is a quite famous skeptic, and a former co-host of the Skeptics Guide to the Universe podcast. Since Dawkins is also in these circles, not too crazy to bring her up.

The class of bugs for PipeFail can be prevented in principle with X^W, which is implemented in PaX, Exec Shield, and some SELinux configs.

Is any distribution that comes with these in the default installation protected against these exploits? If not, what is missing in terms of mitigation protections against this class of bugs?

Either you get faster and faster at it, or 2026 is the year we work on pen and paper until the storm is over...

W^X? As implemented in PaX, Exec Shield, SELinux. Which all Linux distros have and no Linux user ever uninstalls or disables. Or something.