Following last week's .zed format reverse-engineered specification, Lo c Dachary contributed a POC extractor!
It's available at http://www.dachary.org/loic/zed/, it can list non-encrypted metadata without password, and extract files with password (or .pem file).
Leveraging on python-olefile and pycrypto, only 500 lines of code (test cases excluded) are enough to implement it

Following last week's .zed format reverse-engineered specification, Lo c Dachary contributed a POC extractor!
It's available at http://www.dachary.org/loic/zed/, it can list non-encrypted metadata without password, and extract files with password (or .pem file).
Leveraging on python-olefile and pycrypto, only 500 lines of code (test cases excluded) are enough to implement it

It s been a long time I wanted to blog about my recent work on the Openstack packaging. I finally can find a bit of time to do it. For those who don t know yet Openstack, it s a fairly recent (less than 3 years) cloud computing suite, which is becoming quite huge. If you plan on deploying a private cloud, you should definitively have a look into it. When the Openstack project started, I immediately was interested. I started packaging the Cactus release (that is, the 3rd version of Openstack), created the Alioth group (at the exact moment when Alioth was migrated to new hardware which added some fun so lucky I was!), and began to work on the Debian version (Openstack used to be an Ubuntu only project). After some success in integrating some Debian specific patches into the Ubuntu packages, I left it a bit aside, and skipped completely the Diablo release (which was never uploaded in Debian). Then, I worked a bit on the Essex release before the freeze of Wheezy last June, together with other DDs (big up to Julien, Loic, Ghe, Sileth!). I (re-)started serious packaging work for Openstack just right after Folsom (eg: version 2012.2) was released early last October. I literally worked days and nights on it, in order to provide more automation so that it could become more easy to install. Indeed, it used to be very complicated and painful, with lots of manual tasks to perform on the shell. It s hopefully a lot easier now, with most of the manual boring shell work replaced by debconf and scripts. But I m sure there s more that can be done still. After 4 months of effort, I finally pressed the red button and uploaded everything at once to Debian Experimental since Openstack Essex (version 2012.1) is in Wheezy, I can t of course upload to SID unless Wheezy is out -. This represent 32 sources packages in total (some of them are already uploaded and approved by the FTP masters: sorry to give you so much more work guys ), and 104 binary packages (and counting ). So this isn t exactly small And I already have some fixes for what s currently waiting in the NEW queue: CVE fixes, missing build-depends which we ve found using the Jenkins server of eNovance who sponsors the packaging work, etc. I probably will post again here to announce when Folsom is completely approved by the FTP masters and reaches Debian experimental. In the mean while, it s available on GPLHost non-official repositories (see the howto linked bellow). If you would like to test the latest Openstack release (called Folsom, or 2012.2, if you are following well ), you can read the quite verbose howto I wrote here: https://wiki.debian.org/OpenStackHowto/Folsom If you do test it (don t be afraid, it s not that hard ), I will be very happy to hear from you, and receive any feedback / critics you may have. Note that I would strongly recommend to use the Folsom release, rather than what is currently in Wheezy, for many reasons which would be too long to list in this blog post (let me still drop a few reasons here: less bugs, more automations and it s more easy to install). Now, Openstack is a constantly evolving software, with so many companies and developers involved. I don t think my work on this beast will ever be finished. But it doesn t mater, as it s been quite some fun, and I will enjoy to do more. The next release of Openstack is schedule for next April (they release at the same time as Ubuntu). I hope to be able to join the Portland summit, and see all the persons I have worked with over IRC and mailing list. This time, I hope to be able to release Openstack packages at the same time as the upstream source code is released (Debian packages have historically been lagging a few months behind). The pre-version is by the way already in Alioth. Last, a (private) message for our famous cheese-master: please wait until everything leaves the NEW queue before bugging everyone with translations. We probably should have a serious talk about how to make it less redundant, easier to translate, and probably find a way to avoid duplication of messages across all packages.

Just posted to d-d-a, here is the monthly report about my DPL activities.

---

Dear project members,
last bits of the past DPL term and first bits of the current term, all in one. Here is a report of what has happened in DPL land last April. Highlight: call for DPL helpers Before the report, though, let me point out that your friendly neighborhood DPL could use some help. As discussed during campaign, there are some intrinsic transparency and scalability limits in the DPL institution, when run by a single person. Before trying something new to fix that, I'd like to give a last try to an old "tactic": calling for help. If you're considering running for DPL or if you're simply interested in the job the DPL does and willing to help with that, please let me know. Ideally, if I find a group of people I'm happy to work with, I'd like to set up periodic IRC meetings with all "DPL helpers" to publicly discuss items in the DPL agenda and share the work-load. Ongoing discussions A big topic of last month has been the proposal by Francesca Ciceri to publish a diversity statement for the Debian Project. After a lively discussion on -project, we reached consensus on a text, and I've been happy to help with that. To finalize statement publication we now need to vote on it with a GR. I've helped drafting a corresponding GR proposal that has already been posted to -vote by Francesca. A final one, looking for seconds, will be posted there soon. Wrapping up March discussions on a revenue sharing agreement with DuckDuckGo, I've announced my intention to finalize the agreement and have done so shortly thereafter. The Iceweasel maintainer has deployed the corresponding search engine query string and other web browser maintainers could do the same, if they want to. In April I've also spent some time to move forward the long running conflict on Python maintenance, reported to the tech-ctte more than 2 years ago. With the help of people on the -python mailing list, I've now submitted to the tech-ctte an up to date list of potential maintenance teams. I hope the tech-ctte now have all the information needed to come to a decision. Speaking of which, I'm also discussing with tech-ctte members the possibility of having periodic ctte meetings; the idea is to ensure that outstanding issues are periodically reassessed, improving the reliability of tech-ctte decision times. I've also discussed at length with members of the pkg-multimedia-maintainers team the relationships with the unofficial debian-multimedia.org (d-m.o) repository, that have been a cause of tension for Debian multimedia users and maintainers for quite some time. On behalf of the team and of the Project I've now reached out to the d-m.o maintainer, hoping to come to some sort of amicable agreement on which packages belong where. Hardware replacement As anticipated in last report, I've started approving hardware purchases to implement the yearly hardware replacement plan prepared by DSA. During April I've approved requests to buy servers to replace the machines running the bugs-master, bugs-mirror, and UDD services. The total expected expenditure is about 15'000 USD. Communication I've delivered my classic Debian "18^W 19 years" talk at UNIVPM, a polytechnic university in center Italy; slides are available. I've then been contacted by people from the European Synchrotoron in Grenoble who, beside having recently migrated their infrastructure to Debian, are looking into organizing a workshop on Debian usage for large science facilities. I've been happy to help out providing a list of potential topics and speakers for the event. Also as anticipated last month, the Debian Project has been present at the OpenStack summit. Loic Dachary has represented Debian at the event and provided a nice report about his experience there. Speaking of which, I've also coordinated a news release about the availability of cloud technologies in Wheezy, taking the chance to point out the relationships between what Debian stands for and the ability to deploy your own private cloud. Sprints April has been a rather calm month on the sprint front, with the notable exception of the I18n team who is organizing a sprint for June in Paris. Miscellanea

• Google Summer of Code (GSoC) has now started and for Debian is already quite a success. Wrt last year we doubled the number of student applications and we jumped from 9 to 15 approved projects. More details about Debian in GSoC have been posted by Ana. I encourage all of you to take the chance of GSoC to bond with students and show them how nice is the Debian community to work with: that's the prime trait we need to exhibit to make sure we'll always have enough volunteers to run the Debian Project.
• The one month notice before opening up LDAP dnsZoneEntry has expired and the field has now been opened by DSA. Practically, this means that the full listing of *.debian.net entries can now be queried publicly via LDAP. If anyone would be so kind to provide a script that does so and produce a nice looking HTML index, we can now publish it somewhere and replace the perennially out of date wiki index

Thanks for reading thus far,
HDH! (Happy Debian Hacking)

---

PS the boring day-to-day activity log for April is available at master:/srv/leader/news/bits-from-the-DPL.txt.201204

Released a few hours ago, here is the monthly report of DPL activities for February 2012.

---

Howdy, dear Project Members,
here's another round of updates about what has happened in DPL land, this time during February 2012. Highlights Quit a bit of highlights for this month:

• The first item is not pleasant but important. Early February I've submitted to the attention of the Technical Committee the upload of multi-arch enabled dpkg to the archive. The Technical Committee quickly reached a decision. Shortly afterwards an upload to experimental has happened and discussions on -devel ensued. Please help out with testing.
• Thanks to IBM and OSUOSL we have some new fairly capable (virtual) machines for powerpc* ports. See the announcement for more info. In particular, please note the call for powerpc64 porters. If you're interested in contributing to such a port, please get in touch with DSA.
• Google Summer of Code project is up again. As usual, it is a good chance to get some work done and, more importantly, to let students who are passionate about Free Software discover Debian. I've delegated the task of GSoC admins --- thanks Ana, Gergely, and Sukhbir! A call for project proposals has already been sent out; there isn't much time left, so please hurry up and drop your ideas to the wiki page and contact the soc-coordination mailing list.
• A couple of important discussions have been going on on -project. The first is the old "trademark vs DFSG" discussion. I've posted there results from legal advice that I've sought on the matter, based on your suggestions. Then, I've posted a proposal on how to deal with trademarks issues in the archive.
• The second discussion is about Debian affiliation with OSI. We've been approached by OSI about that, as I've summarized on -project. Helped by the feedback received, I've decided to go ahead with affiliation and I'm now discussing with OSI representative the next steps.
• The long running work on software patent issues in the archive has been concluded publishing a policy on the matter. We now have a contact point and legal advice with whom we can discuss specific issues if/when they arise; hopefully that would help us to discriminate actual issues in the archive (if any) from the vast amount of FUD in the area.

Talks, interviews, and the like

• Following up Debian related talks at FOSDEM, I've been interviewed, together with Lars Wirzenius and Wookey, for The Register.
• I've took part at a FOSDEM panel session on comparing the organization of local user groups, ambassadors, and the like. We've mostly to learn from others in this area, but I've took the change to summarize what we currently have in a slide deck.

Sprints Plenty of sprints related news!

• DSA and the Groupware team will be holding sprints later on in March, while DAM / FrontDesk are having one right now co-located with the BSP in Moenchengladbach
• the video team sent out a report for their sprint back in November
• debbugs (AKA bugs.debian.org) hackers are organizing a sprint to get people interested in contributing to the code base up to speed. If you're, drop a line in the thread

It would be amazing to have an average of one sprint per month for 2012, and we're on good track for it. If you want to help, organize one for your team as documented on the wiki. Legal stuff

• Thanks to SPI, we've established contacts with the owners of debian.eu, domain we believe we legitimately own. As a first step they've set up HTTP redirection from debian.eu to debian.org (instead of a computer hardware shop, as it was before) and we're now discussing actual transfer of domain ownership to a Debian Trusted Organization.
• We've contacted the Japanese trademark office to transfer the "debian" trademark there to SPI. Thanks to the previous owners (all Debian developers or contributors) for agreeing to the move. Now "only" a nasty pile of paperwork remains to be done.

Appointments In addition to the GSoC admins delegation (see above), I've agreed with former secretary Kurt Roeckx to reappoint him as a secretary for another year. Many thanks, Kurt! Miscellaneous

• We have been invited to attend the OpenStack summit in April and have a presence there, free of charge. Loic Dachary, active member of the OpenStack packaging team in Debian, has agreed to go and represent Debian there. Thanks a lot to Stefano Maffulli for the invitation and to Loic for his availability!
• We are in the process of joining as a project, instead of relying on individual maintainers as in the past the ISC forum to get access to embargoed vulnerability information for important pieces of software such as BIND and DHCP. They've kindly offered us membership free of charge. I've submitted a draft of the membership agreement to SPI and I'm waiting for their decision.
• Steady progress on the front of periodic budget reports, thanks to the work of Martin Michlmayr. We've discussed at length during FOSDEM and agreed on procedures to query the state of Debian finances that work for both auditors and the DPL. Martin has also set up a shared ledger repository and already checked in into it a lot of money transactions for the past few years not from all trusted organizations yet, though. Have faith, we'll get there

Happy Debian hacking.

---

PS as usual, the boring day-to-day activity log is available at master:/srv/leader/news/bits-from-the-DPL.*

Not for the first time, I ve seen the suggestion in the echo chamber that Mono packages should be moved from Debian into the non-free repository, which is not formally part of Debian. The reason, as it so often is, is patents specifically this time, the searing risk posed to Debian and its users that Mono s packaging does not (and technically could not without forking from upstream) provide base class libraries which implement only the content of ECMA-335 4th Edition. As I understand it, this implies three things about the suggestion/demand: firstly, that the individual in question believes that Mono end users are at risk from patent litigation from Microsoft Corp because Mono s implementation of Microsoft.NET beyond the content of ECMA 334/335 infringes on Microsoft patents; secondly, that the Microsoft Community Promise which promises not to assert legal claims over third party implementations of ECMA-335 4th Edition (and ECMA-334 4th Edition which defines the C# language) would render a pure ECMA-only runtime safe if it existed (which it does not); thirdly that without the protection offered by the Microsoft Community Promise, the source code licenses of Mono are irrelevant the patent risk renders the software non-Free. It appears, unfortunately, that the community of Free Software Advocates don t actually understand what Free Software actually IS. That explains an awful lot, but should surprise nobody. So here s a lesson on what, exactly, is being advocated for. The Free Software Foundation defines four Software Freedoms these are the minimum criteria required for something to be considered Free Software by the FSF:

• The freedom to run the program, for any purpose (freedom 0).
• The freedom to study how the program works, and change it to make it do what you wish (freedom 1). Access to the source code is a precondition for this.
• The freedom to redistribute copies so you can help your neighbor (freedom 2).
• The freedom to distribute copies of your modified versions to others (freedom 3). By doing this you can give the whole community a chance to benefit from your changes. Access to the source code is a precondition for this.

Other groups have their own variants on these, but those are really just clarifications on the FSF definition - for example, the Debian Free Software Guidelines mostly line up, but have some additional clauses such as clause 4 which allows software to be considered Free if source code may be redistributed without modifications, as long as patches may be shipped alongside. These four freedoms are offered to you by the software s copyright holders only, and apply regardless of their choice of license any Free license, from a lengthy legal tome like the MPL to the completely-Free WTFPL, will offer you these four basic freedoms as a minimum, and any additional clauses in their licenses cannot seek to restrict these freedoms. These four freedoms represent the beginning, and end, of whether a piece of software is Free or not. Software does not need to be developed in the open, in a community-responsive way, in order to qualify as Free projects such as Google s Android, which are developed under a throw a final release over the wall, bugs and all, and expect people to thank you for it model, are still free, even if contribution is difficult. Actually, on a related note, software does not need to solicit upstream contribution of any kind in order to qualify as Free as long as you personally can redistribute the code with changes, then that s enough. Software does not need to serve a fully or even partially legal purpose in order to qualify as Free the favoured tool for causing distributed denial of service attacks, Low Orbit Ion Cannon, is Free Software, even though realistically it serves no legal purpose. DeCSS, the code initially used to allow DVD media to play on Linux (by breaking the CSS encryption mechanism) is Free Software. Software does not need to be useful or tasteful in order to qualify as Free the Last Measure Operating System, a minimalist OS primarily designed to loudly display the famous shock site images from goatse and related, is Free Software. Even in somewhat less clear-cut cases of taste, your personal opinion of software has no bearing on whether it is Free Software, as long as the four freedoms are guaranteed by the author(s). Software does not need to have only Free dependencies to qualify as Free Software it is entirely permissible to write software which relies upon a non-Free framework or library, and release your code under a Free license. It is the downstream recipient s problem to provide the dependencies, including their choice to craft a Free replacement for any non-Free code you make use of. Debian has a special repository called contrib, where Free software which only works with non-Free data, lives for example, Free game engines which require the insertion of proprietary game data in order to operate. You could write Free addons for expensive proprietary software such as Matlab, and as long as your code is Free, your responsibilities are met. Software does not need to avoid patents software, algorithmic, or otherwise in order to qualify as Free. The Freetype font library was still entirely Free Software when Apple were slinging threats around regarding font hinting data. FFmpeg, the Swiss Army knife of media codec libraries, is Free Software regardless of the number of codec patents it breaks. Software does not need any third party approval to be Free Software the rights of Free Software can only be offered by the copyright holders, and the opinion of third parties is an irrelevance as to whether software is Free. The GPL d clone of Blizzard Entertainment s Battle.net servers, bnetd, is Free Software, regardless of legal takedown notices. Third parties cannot influence whether or not a piece of software is Free. They can influence tangentially related topics, such as whether the software can be legally used, but that s the limit. And even within a given piece of software, where copyright is shared by contributors, the author of one component has no say on other components. And you can t make code which is already released as Free, suddenly un-Free you can, if you hold all the copyrights, close up future versions, but your existing code remains Free forever. Reasonably, you can opt to avoid using a piece of software because you have requirements beyond it merely being Free Software Cdrtools has been avoided in Debian for a long time due to the upstream author s legal threats and rambling but that is a side issue as to the question of whether or not the software is Free. Patents are simply not involved in the question of whether or not something is Free Software, except for one narrow case: where Free Software is released by somebody who also holds related patents, and uses a license such as Ms-PL or Apache 2.0 or GPLv3 which requires them to also release those patents to those using/distributing the software. Outside that narrow situation, patents do not relate to the question of whether something is Free Software even if a company releases some source code under a license like BSD then demands patent fees from end users. So, on to the original topic of Mono. Every piece of Mono s source code is released by its authors under a license which guarantees the FSF s Four Freedoms. Whether or not you find Mono useful or tasteful does not affect that Free status. Whether or not Mono infringes upon any laws or patents does not affect that Free status. That Mono contains some libraries whose upstream author is Microsoft does not give Microsoft even the remotest claim to a single line of code outside the code they wrote and even then, it wouldn t be an issue, since the licenses they use are Free. In fact, both the licenses used in the Microsoft portions of the source base make patent grants to all users, in addition to guaranteeing the FSF s Four Freedoms and any license contamination would decrease, not increase, any risk of legal attack from Microsoft. There s even plenty of Microsoft code available for re-use at a lower level than the currently re-used libraries: The Microsoft.NET Micro Framework (for use on embedded platforms direct to the metal) is under the Free Software Apache 2.0 license, and would provide access to some of Microsoft s runtime and class library code, complete with a patent grant, if it were desired. Please try to keep your thought processes straight. If you want to argue that you re all for Free Software, please remember that there s plenty of Free Software you might not approve of and don t claim to be a Free Software advocate then use bogus arguments to claim that Free Software is not Free. Free Software includes LMOS and LOIC and Mono, whether you like it or not.

Earlier today I sent an announcement to the r-packages list. It describes CRANberries, two simple RSS feeds that summarize both 'new' and 'updated' packages at CRAN, the archive network for R. I cooked this up rather quickly using a few lines of R, a small SQLite db backend and the old Blosxom blog engine. A tip of the hat to Barry Rowlingson who almost immediately suggested to use the lol format instead. The hope is that this proves helpful for keeping tabs on the amazing growth of CRAN (which is now at over one thousand packages) as well as the number of updates to existing packages. The feed(s) can be consumed standalone, or via the brand new Planet R aggregator that Elijah announced today too.

Sound Juicer "Nikki's Growing A Patch Out In The Backyard" 2.19.0 is out. Tarballs are available on burtonini.com, or from the GNOME FTP servers. This is the first release in the 2.19.x development series, after I failed to do anything useful in 2.17.x...

• Attempt to repair brain-dead FreeDB encoding (Ka-Hing Cheung)
• Fix memory leaks in musicbrainz object (Cristian Persch)
• Follow the preferred sound device (Bastien Nocera)
• Use xdg-user-dirs (BN)
• Use gst_element_make_from_uri instead of hardcoding cdparanoia (James Livingstone)
• Display a better message after extracting (Adam Petaccia)
• Fix detection of FreeDB albums (David Mandelberg)
• Accessibility fixes (Rich Burridge, Patrick Wade)
• Don't crash if libnautilus-burn doens't know of a device (Pascal Terjan)
• Initialise threading earlier
• Convert strerror() output to UTF-8 for display (PT)
• Remove "Application" category from desktop file
• Fix srcdir!=builddir builds (Loic Minier)
• Internal refactor of extractor and metadata objects

Welcome to this 7th issue of the DeFuBu contest, the monthly championship of the funniest bug reported to the Debian BTS. The challengers

• Loic Minier with #407127 (evolution: Dates before 1970 not supported, e.g. for birthdays) and #408989 (epiphany-browser: bugzilla.gnome.org inaccessible)
• Sune Vuorela with #407849 (script for /usr/bin/preloadkde) and #409310 (kmines: Can cheat the timer)
• Josh Triplett with #404915 (iceweasel: Icon resembles booger)
• Jeroen van Wolffelaar with #408424 (apache2: "It works!")
• Florent Bayle with #408524 (If I play piano while my computer starts up, /dev/dsp disappears !)
• Christian Perrier with #408482 (xserver-xorg: please map French Canadian (cf) to Canada (ca) layout)
• Frans Pop with #409018 (base: /etc/ld.so.nohwcap missing)

How the vote has been done Four Debian related people voted for these bugs, Emmanuel Bouthenot, Mohammed Adn ne Trojette, Julien Louis and Jade Alglave. Full ranking Bugs

• #408989 (epiphany-browser: bugzilla.gnome.org inaccessible) (28 points)
• #408524 (If I play piano while my computer starts up, /dev/dsp disappears !) (21 points)
• #407849 (script for /usr/bin/preloadkde) and #408424 (apache2: "It works!") (18 points)
• #407127 (evolution: Dates before 1970 not supported, e.g. for birthdays) (17 points)
• #404915 (iceweasel: Icon resembles booger) and #408482 (xserver-xorg: please map French Canadian (cf) to Canada (ca) layout) (11 points)
• #409310 (kmines: Can cheat the timer) (10 points)
• #409018 (base: /etc/ld.so.nohwcap missing) (10 points)

Challengers

• Loic Minier (45 points with 2 bugs)
• Florent Bayle with (21 points with 1 bug)
• Sune Vuorela (28 points with 2 bugs)
• Jeroen van Wolffelaar (18 points with 1 bug)
• Christian Perrier and Josh Triplett (11 points with 1 bug)
• Frans Pop (10 points with 1 bug)

The winners

• Bug: #408989 (epiphany-browser: bugzilla.gnome.org inaccessible)
• Challenger: Loic Minier
• Bug reporter: Tshepang Lekhonkhobe
• Voter: Emmanuel Bouthenot with two first bugs correct: #408524, #408989

Notes To participate, simply drop me an email with a bug number. About DeFuBu

Welcome to this 2nd issue of the DeFuBu contest, the monthly championship of the funniest bug reported to the Debian BTS. The challengers

• Julien Danjou with #360285 (ITP: libjoey -- forks itself and does several things at the same time), #102434 (gpm: reverse marking) and #178290 (grave problems when badly mixed with irda)
• Pierre Habouzit with #379912 (kodo: Incorrectly described as useless)
• Julien Goodwin with #318229 (XOrg package is controlled by a woman disrespectful of men (which make up the vast majority of debian developers))
• Frans Pop with #258723 (vim: replace $ shlibs:Depends] in debian/control)
• Daniel Burrows with #331210 (aptitude maintainer should do bug DB clean-up and/or bug merging)
• Andres Salomon with #236874 (xscreensaver: pacman screensaver plays game incorrectly)
• Loic Minier with #382014 (can't fly to girlfriend) and #375789 (gnome-osd: information leakage when screensaver is active)
• Florent Bayle with #381978 (debian-installer: etch d-i installs an antique mouse cursor)
• Julien Louis with #382181 (nmap is a clairvoyant)
• Cyril Lacoux with #373142 (apt-get install spamc on testing removes sarge kernel image)

How the vote has been done Five Debian related people voted for these bugs: Roland Mas, Alexis Sukrieh, Cl ment Stenac, kolter and Yves-Alexis Perez. Full ranking Bugs

• #360285 (ITP: libjoey -- forks itself and does several things at the same time) (52 points)
• #102434 (gpm: reverse marking) (44 points)
• #236874 (xscreensaver: pacman screensaver plays game incorrectly) (43 points)
• #258723 (vim: replace $ shlibs:Depends] in debian/control) (37 points)
• #331210 (aptitude maintainer should do bug DB clean-up and/or bug merging) (33 points)
• #382014 (can't fly to girlfriend) (31 points)
• #373142 (apt-get install spamc on testing removes sarge kernel image) (29 points)
• #379912 (kodo: Incorrectly described as useless) and #382181 (nmap is a clairvoyant) (26 points)
• #381978 (debian-installer: etch d-i installs an antique mouse cursor) (15 points)
• #318229 (XOrg package is controlled by a woman disrespectful of men (which make up the vast majority of debian developers)) (22 points)
• #178290 (grave problems when badly mixed with irda) and #375789 (gnome-osd: information leakage when screensaver is active) (13 points)

Challengers

• Julien Danjou (109 points)
• Loic Minier (44 points)
• Andres Salomon (43 points)
• Frans Pop (37 points)
• Daniel Burrows (33 points)
• Cyril Lacoux (29 points)
• Julien Louis and Pierre Habouzit (26 points)
• Julien Goodwin (22 points)
• Florent Bayle (15 points)

The winners

• Bug: #360285 (ITP: libjoey -- forks itself and does several things at the same time)
• Challenger: Julien Danjou
• Bug reporter: Alexander Wirt
• Voter: Roland Mas with the correct reverse ordered tierc : [1] #236874, [2] #102434 and [3] #360285.

Notes To participate, simply drop me an email with a bug number. About DeFuBu