Free, Libre, and Open Source Software and Web Leftovers

posted by Roy Schestowitz on Oct 22, 2026

• Eric MacAdie ☛ I Updated My Emacs Number Package

  I made a few changes to my Emacs package that makes dealing with numbers in Eshell more convenient (Codeberg page here, blog post here). You are welcome to use it. I have no plans to put it on MELPA or the other package repositories. cosigner dewdrops altercation

  I switched from Elisp Repo Kit to Eldev. intric

• Frank Delporte ☛ Sheetmusic4J 0.0.5: LilyPond Import and Export · webtechie.be

  Sheetmusic4J is a Java(FX) library to render and interact with sheet music. After MusicXML, MIDI, ABC and Guitar Pro, version 0.0.5 adds another format: LilyPond.

• It's FOSS ☛ DankMaterialShell Becomes Dux Shell as Dank GNU/Linux Rebrands to Dux Labs

  The new name covers the shell, greeter, search, system monitor, calendar, and file manager, all released as part of DMS 2.0.

  Dank Linux, the Wayland desktop suite built around DankMaterialShell (DMS), has put out its final post on X under that name, bidding farewell to its old identity. Accompanying it is DMS 2.0, codenamed "Heisenberg," which reached GitHub just a few hours ago.

• Web Browsers/Web Servers/Feed Readers

  • Data Swamp ☛ Expose only share links of a private service with caddy

    In my self-hosted infrastructure, most services are only reachable through my VPN. But some of them have a feature to share something with people outside: Immich has share links for albums and photos, Nextcloud has share links for files and folders.

    My self-hosted infrastructure with Incus OS

    I wanted to add some extra security, but the people receiving a link should not have to install a VPN client or create an account, they must be able to click on it and see the content.

    The usual way to do this is to expose the whole service on the Internet, and then you have to trust the login page, the API and every route of the application. I found a simple pattern with the reverse proxy caddy that only lets in requests carrying a valid share link, and answers a 404 to everything else. The service itself is used to check if the link is valid.

  • Harry Roberts ☛ Web-Perf Wednesday 014 – Performance Budgets Need a Representative Worst

    Plenty has changed since last week, although the most useful development is a correction to some of my own long-standing advice. A single anomalous result can make a performance budget so generous that a serious regression still passes, so the better starting point is a representative worst such as P90 or P95. Elsewhere, Safari is blocking identity-resolution infrastructure, Chrome 156 can retry failed module loads, and DevTools can point directly to unused closure variables that are retaining memory.

  • James G ☛ Brainstorming the multi-lingual reading experience for Artemis

    To determine the language that corresponds with a post, I am using the “langdetect” Python package 2. There are likely ways to infer language deterministically (ActivityStreams has a “contentMap” value that contains as keys language codes that map to post content, e.g. “fr” would map to a post written in French).

    This feature is most useful when a title is also written in a language I don’t know. The tag gives me a clear visual indication that a post is in a different language before I start reading the title. This helps me while scanning my feed.

  • Chromium

    • Security Week ☛ Memory Bugs Account for Most of Chrome’s 353 New Security Fixes

      The update fixes 353 flaws, including 163 memory corruption and 125 use-after-free vulnerabilities.

• Productivity Software/LibreOffice/Calligra

  • Document Foundation ☛ 8 weeks, 9.4 million downloads

    The announcement of LibreOffice 26.8 had a noticeable positive effect on download figures, which have since exceeded one million per week, totalling 9.4 million downloads over eight weeks, from 24 August to 18 October.

• Education

  • APNIC ☛ Your most pressing questions about ASPA, answered

    APNIC deployed support for managing Resource Public Key Infrastructure (RPKI) Autonomous System Provider Authorization (ASPA) objects in June this year. Since then, ASPA adoption has grown steadily, with 538 ASPA objects currently published under APNIC’s RPKI trust anchor.

    On 30 September 2026, APNIC hosted a webinar for Members and the Internet community, ‘Understanding ASPA: The next step in routing security’ (recording available). As ASPA adoption grows, several common questions have emerged, particularly around the definition of a provider, the use of ASPA in Internet Exchange Point (IXP) environments, and the risks of signing and relying on ASPA records for Border Gateway Protocol (BGP) path validation.

  • APNIC ☛ Turning IPv6 tunnels into programmable delay lines for pulsing DoS

    In our recent USENIX Security 2026 paper, we present TED, a Pulsing Denial-of-Service (PDoS) technique that turns permissive tunnel hosts into programmable delay lines. Instead of relying on DNS, Network Time Protocol (NTP), Content Distribution Networks (CDNs), or other application-layer services, TED combines nested paths, EH delays, and packet scheduling to focus traffic sent over seconds into a narrower burst.

    This post covers the tunnel/EH interaction, measurements, controlled experiments, and practical mitigations.

  • Arcan ☛ Arcan Fall Hackathon Report

    With 2026 being busy squeezing out banger after banger of bad to terrible news, we somehow still managed to meet up in the fort for what was this time referred to as the “Hackspace at the end of the Universe”.