Planet Guix

Pay for Software That Respects You

I consider myself a pretty chill and calm person, I can endure and tolerate quite a lot, but I become furious when a program spits in my face with what I didn't ask for, take me for a dumbass or exploit legacy vulnurabilities of my brain. Annoying notification, algorithmic feeds and recommendations, unasked advices and tutorials, stolen out of my pocket data and attention. If I observe such behaviors from a person, I will politely ask them to fuck off at very least. I wouldn't tolerate it from a human, and I definitely won't let it slide from a program.

‘guix substitute’ and ‘guix pull’ Vulnerabilities

Several security issues (CVE IDs pending) have been identified in guix substitute , a helper utility invoked by guix-daemon , which enable a variety of harmful activities including remote privilege escalation to the build daemon user , remote store corruption , and potentially local disclosure of sensitive files accessible to the build daemon user. All systems are affected, whether or not guix-daemon is running with root privileges; the harm that can be done when guix-daemon runs without root privileges is more limited. You are strongly advised to upgrade your daemon now (see…

One year with Codeberg

A year ago, Guix migrated to Codeberg for source code hosting, issue tracking, and pull requests. This is a significant change for a project with more than 400 people contributing code each year, after more than decade hosting code at Savannah and dealing with bug reports and patches by email, tracked by a Debbugs instance . This article discusses the process that led to this change and lists some takeaways, a year later. The non-obvious choice For years before, the question of our choice of source code hosting and collaboration tools would regularly come up. However, with…