426
427
 
 
428
 
 

There's a lot of age checking / age assurance bills going around right now, and System76 have entered the fight in Colorado to help open source.

I've recently written about the one in California, with Ubuntu and Fedora developers commenting on the situation, and how more US states are looking at doing it or already have it coming in. System76 are now throwing their hat in the ring, going directly to the source and starting the fight back.

429
 
 

Voiden is an offline-first, git-native API tool built on Markdown Voiden is an API client we have been building that takes a different approach from most existing tools.

It didn’t start with the idea of “building a better Postman”.

A bit of background. Over time, API tooling has become heavyweight: cloud dependencies for local work, forced accounts, proprietary formats, and workflows that break the moment you are offline. On top of that, time wasted on fixing API specs that don't match the code, docs in separate random tools, tests also separate and an overall governance mess. Not to mention collaboration.

So we asked a simple question: What if an API tool respected how developers already work?

That led to a few core ideas:

  • Offline-first , no accounts, no telemetry
  • Git as the source of truth.
  • Plain text files: specs, tests, and documentation live together in Markdown
  • A programmable interface instead of static forms: requests are composed from reusable blocks (endpoints, headers, auth, params, bodies, etc.) that you can structure the way you want
  • Plugin system for extending functionality rather than bloating the core with new features Some of our core plugins include gRPC,GraphQL,WebSockets,etc..

We have just also updated our docs to welcome community plugins, so teams can extend the tool for their own workflows or integrations. https://docs.voiden.md/docs/plugins/build-a-plugin

We opensourced Voiden because extensibility without openness just shifts the bottleneck. If (API) workflows should be transparent, the tools should be too.

Welcome to try out and share feedback- happy to chat with everyone.

Strong opinions are encouraged. :)

Github : https://github.com/VoidenHQ/voiden

Download here : https://voiden.md/download

430
 
 

On March 5, 2026, a threat actor exploited a classic "Pwn Request" vulnerability in the CI workflow of kubernetes-el/kubernetes-el, a popular Emacs package for managing Kubernetes clusters. The attacker stole the repository's GITHUB_TOKEN (with full write permissions), exfiltrated CI/CD secrets, defaced the repository, and injected destructive code.

The package has since been removed from MELPA (a popular third-party Emacs package repository) and blocked from updating on the Emacsmirror, affecting users who depend on it for Kubernetes management within Emacs.

431
 
 

cross-posted from: https://piefed.social/c/selfhosted/p/1860178/truenas-build-system-going-closed-source

Readme updated today: > > This repository is no longer actively maintained. > > The TrueNAS build system previously hosted here has been moved to an internal infrastructure. This transition was necessary to meet new security requirements, including support for Secure Boot and related platform integrity features that require tighter control over the build and signing pipeline. > > No further updates, pull requests, or issues will be accepted. Existing content is preserved here for historical reference only. > > https://github.com/truenas/scale-build > > Wondering if this is just the first step towards doing a minio in the future.

432
 
 

cross-posted from: https://lemmings.world/post/42484977

Pay securely with an Android smartphone, completely without Google services: This is the plan being developed by the newly founded industry consortium led by the German Volla Systeme GmbH. It is an open-source alternative to Google Play Integrity. This proprietary interface decides on Android smartphones with Google Play services whether banking, government, or wallet apps are allowed to run on a smartphone.

433
434
435
 
 

One of the things I discovered (or better said, something I suspected but had the chance to verify) while working on open-sourcing a tool (and API client tool): there is a big (mostly justified) trust deficiency out there .

I could feel it immediately in every discussion: always that little question in the back of people’s minds:

"Will this project "stay true", or will it change the rules on me later?"

We have seen this pattern repeatedly: Terraform > OpenTofu, Redis > Valkey, Elastic > OpenSearch....

I understand this: it’s becoming hard not to become a little cynical. In some ways, SaaS starts to feel better only because its more honest and at least the incentives and motivations are explicit from day one.

But why does this happen?

One answer is simple: bad intentions, that yeah, they do exist some times. But then this might be an oversimplification.

One aspect that is not often talked about: Many of the most durable open-source tools and frameworks (VS Code, React, Kubernetes, and Backstage among others) were built by companies where the tool itself was NOT the primary revenue engine. Their core business lived elsewhere.

This means that these tools could function as ecosystem infrastructure rather than direct monetization vehicles. They could stay open because they weren’t carrying payroll, sales targets, and investor expectations on their own.

In contrast, when an open-source project becomes the business, the incentives start to shift. The tool now has to "fund" teams, meet SLAs, satisfy investors, and deliver predictable growth.

Over time, that pressure often leads to open-core models, licensing changes, community forks, and growing tension between "community" and "enterprise."

So yeah, the intentions might have not been alway bad....but the economics have spoken...

The "open source first, monetize later" strategy feels super risky.

Once adoption takes off and the tool becomes central to a company’s survival, teams are forced into trade-offs that often erode trust and fragment communities.

My opinion is that Open Source thrives most easily when it IS NOT carrying the full weight of corporate survival.

When it is, preserving its original spirit becomes much harder.

If we want healthier developer ecosystems, we need to be more honest from the start. This means to either build an open-source project as genuine long-term infrastructure and commit to keeping it open, or build a commercial product with a clear monetization model from day one.

Both paths are valid. Trying to blur the two is what repeatedly leads to broken trust (with developers), frustrated contributors, and fragmented communities.

The takeaway? I guess it is that we just need to be upfront:

If your project is commercial lets be upfront. If it’s truly open, lets commit to it.

Anything in between makes people hesitate to believe and that’s how communities start to fracture.

what do you think? what makes you trust an open-source project long term, and what are the red flags that make you cautious?

436
 
 

The OpenWrt project has announced the release of OpenWrt 25.12, a free and open-source Linux-based operating system primarily used for embedded devices, most notably residential gateways and routers, as the first stable version in the new 25.12 series.

The main highlight is the switch from the opkg package manager to APK (Alpine Package Keeper). Since the OpenWrt opkg fork is no longer maintained, the project has adopted APK as the default package manager. While most package names remain the same, command-line syntax has changed. The project provides an official opkg-to-apk cheat sheet to assist users with the transition.

437
 
 

The newest open-source concern around AI that is seeing a lot of interest this weekend is when large language models / AI code generators may rewrite large parts of a codebase and then the "developers" claiming an alternative license incompatible with the original source license. This became a real concern this week with a popular Python project experiencing an AI-driven code rewrite and now published under an alternative license that its original author does not agree with and incompatible with the original code.

Chardet as a Python character encoding detector with its v7.0 release last week was a "ground-up, MIT-licensed rewrite of chardet." This rewrite was largely driven via AI/LLM and claims to be up to 41x faster and offer an array of new features. But with this AI-driven rewrite, the license shifted from the LGPL to MIT.

438
 
 

digiKam 9.0 has been officially released today as a massive update for this open-source, free, and cross-platform professional-grade photo management software for GNU/Linux, macOS, and Windows.

Highlights of digiKam 9.0 include a dedicated Qt 6 port for a more modern UI/UX experience across all supported platforms, along with a redesigned Welcome page in a more modern style, as well as completely revamped GUIs of the File Copy and File Transfer dialogs for better usability.

Color label names are now customizable in the Labels tab, regular expression wildcard support has been added for ignored directories settings, support for a customizable date format was added to display everywhere in the application, and a “Date Format” modifier was added to the Advanced Rename feature.

439
440
 
 
441
submitted 4 months ago* (last edited 4 months ago) by to c/opensource@programming.dev
 
 

Can mozilla just stop doing whatever they are doing?

I personally do not use firefox (i use qutebrowser), but if it were not for some other things, firefox (or librewolf) would be my favorite browser. This does not directly affect me but this still seems so dumb.

for more context as to why this is not that good of an idea as it may seem - please look at curl project and barrage of false security reports made. and curl is a cli project which just handles many protocols, and does not practically do any processing. firefox and any modern browser is basically a operating system and even a hardware (in forms of wasm allowing you to run arbitrary assembly written in systems programming language).

If firefox pays for it, they would loose lots of money, and if anthropicdoes it for free, they get clout (for supporting open projects), and without doing something that productive, they just put more strain on firefox devs to handle with false positive reports.

I am not a time traveller, so can not tell how this will go, but it does not seem that good

442
443
444
 
 

Our team are building an open-source IP/SIP intercom + video surveillance platform (GPLv3).

Core ideas

No vendor lock-in: designed to work with SIP intercoms and CCTV that expose an open API.

Modular setup: you can start small (a private house) and scale up to apartment buildings / residential complexes / districts / even a city.

What you can build

  • IP/SIP intercom for entrances, gates, barriers
  • Video surveillance (live + archive) with modern server-side + admin panel (we also maintain a built-in free media server (based on ffmpeg) for mobile live + archive access: Simple-DVR)
  • Mobile apps for residents (iOS/Android)
  • Desktop web client for security/concierge teams
  • Ticketing & field service workflows (task tracking + planning + PWA for technicians)
  • Optional face recognition + license plate recognition (FALPRS)
  • Integrations with billing/CRM/payments and external systems

Localization

The project is currently localized for English, Russian, Kazakh, Uzbek, Bulgarian, Arabic, Armenian. If you’d like to help, we’d love contributions for new languages (translations, terminology review, UI copy improvements, etc.).

Repositories

Who this might be useful for

  • ISPs / telecom operators
  • property management companies
  • intercom installation & service teams
  • building owners who want an open source self-hosted platform

Invitation

You’re welcome to use this project for free to build your own ideas/products/solutions — and if you like it, I’d love to invite you to contribute (issues, PRs, docs, localization, testing with new SIP intercoms/cameras, integrations, packaging/deployment improvements, etc.).

If you’re interested, I’d really appreciate:

  • feedback on the architecture and docs
  • suggestions on what hardware models we should prioritize next
  • contributors/users who want to try it in their environment

Thanks! 🙌

Write up by @sbca68@lemmy.world

445
446
PCjs Machines (www.pcjs.org)
447
448
 
 

From the WeeklyOSM Newsletter, I thought it deserved its own post

449
 
 

for those not familiar with Mark Pilgrim, he is/was a prolific author, blogger, and hacker who abruptly disappeared from the internet in 2011.

HN comments

450
view more: ‹ prev next ›