• As part of my duties of being on the board of directors of the Open Source Initiative, I attended its monthly meeting and participated in various licensing and other related discussions occurring on the internet. Unfortunately, I could not attend the parallel meeting for Software in the Public Interest this month.

• After a rather turbulent 2020, I was very grateful to have been chosen in OpenUK's 2021 honours as one of the 100 top influencers in the UK's open technology community, which recognises contributions to open source software, open data and open hardware. Congratulations to all of the other open source heroes and heroines who were also listed am looking forward to an exciting year together.

• Categorised a huge number of packages and issues in the Reproducible Builds "notes" repository.
• Drafted, published and publicised our monthly report and attended a number of IRC meetings.
• In Debian:
  • Kept isdebianreproducibleyet.com up to date. [...]
  • Submitted the following patches to fix reproducibility-related toolchain issues within Debian:
  • I also submitted a number of patches to fix specific reproducibility issues including apertium-anaphora & davs2, as well as a number of issues found during reproducibility testing. For example, I discovered that node-tap-parser's manual pages contained errors instead of documentation (#980293).
• disorderfs is our FUSE-based filesystem that deliberately introduces non-determinism into system calls to reliably flush out reproducibility issues. This month, I updated our benchmarking tools to call use a tool that will call stat(2) repeatedly. [...]

• Updated the main Reproducible Builds website and documentation with many changes, including adding a missing image [...] and to ignore commits that start with, for example, '2020 12' when generating commit listings [...].
• strip-nondeterminism is our tool to remove specific non-deterministic results from a completed build. This month, I ensured that the tool did not process unwritable files and printing a warning in this case (#980356) as well as a number of codebase improvements such as reflowing logic to make future changes easier. [...]

• New features:
  • Save sys.argv in our top-level temporary directory, in case it helps debug why temporary directories might not get cleaned up. [...]
  • Collapse the --acl and --xattr arguments into --extended-filesystem-attributes to cover all of these extended attributes, defaulting the new option to false (ie. to not check these expensive external calls). [...][...]
• Bug fixes:
  • Explicitly remove our top-level temporary directory. (#981123)
  • Adjust the fuzzy matching threshold to ensure that we show more differences. [...][...]
  • Use magic.Magic() over the now-deprecated magic.open() compatibility interface. [...]
• Output improvements:
  • Show the 'fuzziness' amount in percentage terms, not out of the rather-arbitrary '400'. [...]
  • Improve help text for the --exclude-directory-metadata argument. [...]
  • Wrap our external call to cmp(1) with a missing profiling point. [...]
  • Truncate jsondiff differences at 512 bytes, in case they consume the entire page. [...]
  • Improve the logging around fuzzy matching. [...]
• Codebase improvements:
  • Clarify in a comment that __del__ is not always called in Python, so temporary directories are not necessarily removed the moment they go out of scope. [...]
  • Print the free space in our temporary directory when we create it, not from within diffoscope.main. [...]
  • Tidy the diffoscope.comparators.utils.fuzzy module. [...]
  • Add a note regarding the special ordering of test_all_tools_are_listed within that module. [...]

• python-django:
  • 3.1.5-1 New upstream bugfix release.
  • 3.2~alpha1-1 New upstream 3.2 alpha release & misc packaging updates.
• redis:
  • 6.0.9-2 (to unstable) Enable systemd Type=notify support. (#977852lllllllllll)
  • 6.0.9-3 (to unstable) Allow /etc/redis to be rewritten and also removed upon purge. (#981000)
  • 6.0.9-4 (to unstable) Send systemd readiness notification when we are ready to accept connections in order to fix replicaof support. Thanks to Guillem Jover for the report and patch. (#981226)
  • 6.2~rc2-1 (to experimental) New upstream release.
  • 6.2~rc2-2 (to experimental) Allow /etc/redis to be rewritten and also removed upon purge. (#981000)

• Investigated and triaged: cairo (CVE-2020-35492), firefox-esr (CVE-2020-16044), jackson-databind (CVE-2020-36179 CVE-2020-36189), nvidia-graphics-drivers (CVE-2021-1052, CVE-2021-1053 & CVE-2021-1056)), opensmtpd (CVE-2020-35680 & CVE-2020-35679), php7.0 (CVE-2020-7071)), python-autobahn (CVE-2020-35678) & tlslite-ng (CVE-2020-26263.
• Frontdesk duties, responding to user/developer questions, reviewing others' packages, participating in mailing list discussions, attending a monthly meeting, etc.
• Issued DLA 2515-1 for csync2. The cluster synchronization tool did not correctly check for the return value from GnuTLS security routines; it neglected to repeatedly call this function as required by the design of the API.
• Issued DLA 2516-1 for gssproxy to fix a privilege separation issue that arose from failing to unlock a shared resource.
• Issued DLA 2517-1 and ELA 342-1 for the Dovecot to fix two issues. The first was an issue where an attacker could cause the IMAP server to discover filesystem directory structures and even access other users' emails using a specially crafted command (CVE-2020-24386). The second was an issue where a malicious sender could crash Dovecot by sending messages with more than 10,000 (!) attachments (CVE-2020-25275).
• It was discovered that there was an in issue in the command-line tool for the Pacemaker High Availability stack. Local attackers were able to execute commands via shell code injection to the crm history command-line tool, potentially allowing escalation of privileges. DLA 2533-1 was issued to address this.

• Signal forces you to use the Google Play store and Google Services: This isn't true any more. You can download the apk directly on a phone without any Google services and it works great. The app will alert you to new versions. Don't get me wrong: the Signal network still depends on Google services. And, we should be avoiding corporate technology and building our own infrastructure. However, in practice, Signal is an alternative to Whatsapp and Telegram - which not only use the same corporate services but are proprietary technology that is fully owned by powerful tech giants. Signal is still a non-profit organization with a vastly different mission.
• Signal's approach to privacy isn't perfect (the most common variation on this theme is that a state actor could monitor your outgoing communications and the incoming communications of the person you are communicating with and prove that you are communicating with each other). This criticism missed what makes Signal so important. The beauty of Signal is that it addresses the "woops!" moment most privacy activists had when Snowden's data trove become public: it provides mass privacy to stop mass surveillance. Prior to 2013, most tech/privacy activists were focused on the "targeted" individual approach to privacy, working hard to make sure our tools were as absolutely perfect as possible for the tiny percentage of people who know they are under surveillance. Very little effort went into getting them adopted on a mass scale. Criticizing Signal for not providing perfect privacy misses that fact that these things often are trade offs. This trade-off also applies to the first point - dependency on Google services makes installation far easier for suporting millions of people.

• Signal is a centralized app: this criticism often includes examples of Moxie (Signal's founder) refusing and actively discouraging attempts by others to write software that interacts with Signal. Signal is free software, which is a major improvement over most corporate technology. But since it's entirely controlled by one entity, it can be shutdown in a heart beat. And, if Signal changes direction, we cannot easily take the work we have all invested in learning signal and create our own version that reflects our values. This problem is in contrast to federated systems like email - where anyone can run their own email server and apply their own policies. If one email serveer is shutdown, you can move to another. I agree with this critique, but I think it's nuanced because of the trade offs. Having full control over the entire network and all the software provides a level of reliability and consistency that would not be possible with a federated protocol. And, we already have three different, fully viable federated chat protocols (see above). I'd rather have Signal be Signal and invest our energy on a federated chat system via the existing, well-developed alternatives. This opinion is tactical - and could change at any moment. I think there will come a time when we are going to tell the world to move from Signal to the best available federated protocol. But I'm not convinced we have a robust enough federated chat infrastructure to support that move.
• Signal forces you to use your phone number as an identifier: You can't get a Signal account without a phone number. And you generally can't get a phone number without revealing some aspect of your identity. That makes staying anoymous very difficult. There are reports of a new Signal feature making it possible to avoid revealing your phone number when communicating with others, but you would still need a phone number to get an account because a SMS or phone call confirmation is required.
• Signal isn't getting ahead of the curve on abuse: There's an interesting piece informed by former Signal staff people about the management's resistance to getting ahead of the curve when it comes to abuse. How would signal respond to reports of harrassment? What would signal do if it recognized facsists movements organizing on its platform? Any mass platform that is not planning for abuse is going to be in big trouble very soon.

Makefile:583: arch/amd64/Makefile: No such file or directory
make: *** No rule to make target 'arch/amd64/Makefile'.  Stop.

Makefile:583: arch/amd64/Makefile: No such file or directory
make: *** No rule to make target 'arch/amd64/Makefile'.  Stop.

1. Your worth is your productivity.
2. You cannot trust your own feelings and limits.
3. There is always more you could be doing.

• Subway bread is not bread, Irish court rules
• Dutch officials seize ham sandwiches from British drivers

• Scientists rename human genes to stop Microsoft Excel from misreading them as dates

• Orange line (top10)
• Green line (top10)
• Blue line
• Yellow line
• Global Top 10

• The subway map displayed on this page, the original dataset and my modified dataset are licenced under CCO 1.0: they are in the public domain.
• The R code I wrote is licensed under the GPLv3+. Feel free to reuse it and write something nice about how the pandemic impacted the STM. I've made small changes to the 2019 version, but it's mostly the same thing.

How our for-profit company became a nonprofit, to better tackle the digital divide. Originally posted on the Endless OS Foundation blog.

An 8-year journey to a nonprofit On the 1st of April 2020, our for-profit Endless Mobile officially became a nonprofit as the Endless OS Foundation. Our launch as a nonprofit just as the global pandemic took hold was, predictably, hardly noticed, but for us the timing was incredible: as the world collectively asked What can we do to help others in need? , we framed our mission statement and launched our .org with the same very important question in mind. Endless always had a social impact mission at its heart, and the challenges related to students, families, and communities falling further into the digital divide during COVID-19 brought new urgency and purpose to our team s decision to officially step in the social welfare space.

On April 1st 2020, our for-profit Endless Mobile officially became a nonprofit as the Endless OS Foundation, focused on the #DigitalDivide.

Our updated status was a long time coming: we began our transformation to a nonprofit organization in late 2019 with the realization that the true charter and passions of our team would be greatly accelerated without the constraints of for-profit goals, investors and sales strategies standing in the way of our mission of digital access and equity for all. But for 8 years we made a go of it commercially, headquartered in Silicon Valley and framing ourselves as a tech startup with access to the venture capital and partnerships on our doorstep. We believed that a successful commercial channel would be the most efficient way to scale the impact of bringing computer devices and access to communities in need. We still believe this we ve just learned through our experience that we don t have the funding to enter the computer and OS marketplace head-on. With the social impact goal first, and the hope of any revenue a secondary goal, we have had many successes in those 8 years bridging the digital divide throughout the world, from Brazil, to Kenya, and the USA. We ve learned a huge amount which will go on to inform our strategy as a nonprofit.

Endless always had a social impact mission at its heart. COVID-19 brought new urgency and purpose to our team s decision to officially step in the social welfare space.

Our unique perspective One thing we learned as a for-profit is that the OS and technology we ve built has some unique properties which are hugely impactful as a working solution to digital equity barriers. And our experience deploying in the field around the world for 8 years has left us uniquely informed via many iterations and incremental improvements.

With this knowledge in-hand, we ve been refining our strategy throughout 2020 and now starting to focus on what it really means to become an effective nonprofit and make that impact. In many ways it is liberating to abandon the goals and constraints of being a for-profit entity, and in other ways it s been a challenging journey for me and the team to adjust our way of thinking and let these for-profit notions and models go. Previously we exclusively built and sold a product that defined our success; and any impact we achieved was a secondary consequence of that success and seen through that lens. Now our success is defined purely in terms of social impact, and through our actions, those positive impacts can be made with or without our product . That means that we may develop and introduce technology to solve a problem, but it is equally as valid to find another organization s existing offering and design a way to increase that positive impact and scale.

We develop technology to solve access equity issues, but it s equally as valid to find another organization s offering and partner in a way that increases their positive impact.

The analogy to Free and Open Source Software is very strong while Endless has always used and contributed to a wide variety of FOSS projects, we ve also had a tension where we ve been trying to hold some pieces back and capture value such as our own application or content ecosystem, our own hardware platform necessarily making us competitors to other organisations even though they were hoping to achieve the same things as us. As a nonprofit we can let these ideas go and just pick the best partners and technologies to help the people we re trying to reach.

Digital equity 4 barriers we need to overcome In future, our decisions around which projects to build or engage with will revolve around 4 barriers to digital equity, and how our Endless OS, Endless projects, or our partners offerings can help to solve them. We define these 4 equity barriers as: barriers to devices, barriers to connectivity, barriers to literacy in terms of your ability to use the technology, and barriers to engagement in terms of whether using the system is rewarding and worthwhile.

We define the 4 digital equity barriers we exist to impact as:
1. barriers to devices
2. barriers to connectivity
3. barriers to literacy
4. barriers to engagement

It doesn t matter who makes the solutions that break these barriers; what matters is how we assist in enabling people to use technology to gain access to the education and opportunities these barriers block. Our goal therefore is to simply ensure that solutions exist building them ourselves and with partners such as the FOSS community and other nonprofits proving them with real-world deployments, and sharing our results as widely as possible to allow for better adoption globally. If we define our goal purely in terms of whether people are using Endless OS, we are effectively restricting the reach and scale of our solutions to the audience we can reach directly with Endless OS downloads, installs and propagation. Conversely, partnerships that scale impact are a win-win-win for us, our partners, and the communities we all serve. Engineering impact Our Endless engineering roots and capabilities feed our unique ability to build and deploy all of our solutions, and the practical experience of deploying them gives us evidence and credibility as we advocate for their use. Either activity would be weaker without the other.

Our engineering roots and capabilities feed our unique ability to build and deploy digital divide solutions.

Our partners in various engineering communities will have already seen our change in approach. Particularly, with GNOME we are working hard to invest in upstream and reconcile the long-standing differences between our experience and GNOME. If successful, many more people can benefit from our work than just users of Endless OS. We re working with Learning Equality on Kolibri to build a better app experience for Linux desktop users and bring content publishers into our ecosystem for the first time, and we ve also taken our very own Hack, the immersive and fun destination for kids learning to code, released it for non-Endless systems on Flathub, and made it fully open-source.

What s next for our OS? What then is in store for the future of Endless OS, the place where we have invested so much time and planning through years of iterations? For the immediate future, we need the capacity to deploy everything we ve built all at once, to our partners. We built an OS that we feel is very unique and valuable, containing a number of world-firsts: first production OS shipped with OSTree, first Flatpak-only desktop, built-in support for updating OS and apps from USBs, while still providing a great deal of reliability and convenience for deployments in offline and educational-safe environments with great apps and content loaded on every system. However, we need to find a way to deliver this Linux-based experience in a more efficient way, and we d love to talk if you have ideas about how we can do this, perhaps as partners. Can the idea of Endless OS evolve to become a spec that is provided by different platforms in the future, maybe remixes of Debian, Fedora, openSUSE or Ubuntu? Build, Validate, Advocate Beyond the OS, the Endless OS Foundation has identified multiple programs to help underserved communities, and in each case we are adopting our build, validate, advocate strategy. This approach underpins all of our projects: can we build the technology (or assist in the making), will a community in-need validate it by adoption, and can we inspire others by telling the story and advocating for its wider use?

We are adopting a build, validate, advocate strategy.
1. build the technology (or assist in the making)
2. validate by community adoption
3. advocate for its wider use

As examples, we have just launched the Endless Key (link) as an offline solution for students during the COVID-19 at-home distance learning challenges. This project is also establishing a first-ever partnership of well-known online educational brands to reach an underserved offline audience with valuable learning resources. We are developing a pay-as-you-go platform and new partnerships that will allow families to own laptops via micro-payments that are built directly into the operating system, even if they cannot qualify for standard retail financing. And during the pandemic, we ve partnered with Teach For America to focus on very practical digital equity needs in the USA s urban and rural communities. One part of the world-wide digital divide solution We are one solution provider for the complex matrix of issues known collectively as the #DigitalDivide, and these issues will not disappear after the pandemic. Digital equity was an issue long before COVID-19, and we are not so naive to think it can be solved by any single institution, or by the time the pandemic recedes. It will take time and a coalition of partnerships to win. We are in for the long-haul and we are always looking for partners, especially now as we are finding our feet in the nonprofit world. We d love to hear from you, so please feel free to reach out to me I m ramcq on IRC, RocketChat, Twitter, LinkedIn or rob@endlessos.org.

usage: nspawn-runner [-h] [-v] [--debug]
                      chroot-create,chroot-login,prepare,run,cleanup,gitlab-config,toml 
                     ...
Manage systemd-nspawn machines for CI runs.
positional arguments:
   chroot-create,chroot-login,prepare,run,cleanup,gitlab-config,toml 
                        sub-command help
    chroot-create       create a chroot that serves as a base for ephemeral
                        machines
    chroot-login        enter the chroot to perform maintenance
    prepare             start an ephemeral system for a CI run
    run                 run a command inside a CI machine
    cleanup             cleanup a CI machine after it's run
    gitlab-config       configuration step for gitlab-runner
    toml                output the toml configuration for the custom runner
optional arguments:
  -h, --help            show this help message and exit
  -v, --verbose         verbose output
  --debug               verbose output

$ ./nspawn-runner toml buster
[[runners]]
  name="buster"
  url="TODO"
  token="TODO"
  executor = "custom"
  builds_dir = "/var/lib/nspawn-runner/.build"
  cache_dir = "/var/lib/nspawn-runner/.cache"
  [runners.custom_build_dir]
  [runners.cache]
    [runners.cache.s3]
    [runners.cache.gcs]
    [runners.cache.azure]
  [runners.custom]
    config_exec = "/home/enrico/ /nspawn-runner/nspawn-runner"
    config_args = ["gitlab-config"]
    config_exec_timeout = 200
    prepare_exec = "/home/enrico/ /nspawn-runner/nspawn-runner"
    prepare_args = ["prepare", "buster"]
    prepare_exec_timeout = 200
    run_exec = "/home/enrico/dev/nspawn-runner/nspawn-runner"
    run_args = ["run"]
    cleanup_exec = "/home/enrico/ /nspawn-runner/nspawn-runner"
    cleanup_args = ["cleanup"]
    cleanup_exec_timeout = 200
    graceful_kill_timeout = 200
    force_kill_timeout = 200

• updating the master chroot would disturb the running CI jobs that use it. Using nspawn's btrfs-specfic features would prevent this problem, and possibly simplify the implementation even more.
• New step! trivially implementing support for multiple OS images