Planet GNOME

This year, I got to attend GUADEC for the first time ever. For those unfamiliar, GUADEC is a conference usually held in Europe to let GNOME contributors and users from all over the globe to meet up, give talks, hack and get to know each other.

Day 1 §

After a lot of very stressful travelling from the UK to Madrid then to A Coruña (the city where GUADEC is being hosted this year), I finally made it to my hotel on the day of the event, and I got to meet a lot of GNOME contributors at breakfast. This included Allan Day, the current president of the GNOME Foundation, who I found out at the event also lived in the north of England, just a couple of hours from me (potential GNOME Northern UK meet up someday? :D)

Once I arrived at the conference, we had a small introduction talk before the main talks of the day began around 10:20am. The talks today were on a huge variety of cool topics, with some of my highlights of the day being:

• Jakub Steiner’s and Matthias Clasen’s talks about SVG in GTK - Jakub’s talk showed off the new ways these capabilities can be used to build prettier UIs. Matthias’s talk later was about the more technical side of GtkSvg and a few demos. I am very interested in integrating the new SVG capabilities into my own apps.

• A talk about the progress and future plans of Papers, GNOME’s PDF reader and editor, from Markus Göllnitz, Malika Asman and Lucas Baudin (who unfortunately was not able to attend this year). I liked hearing about the accessibility and PDF editing improvements Papers has received/will receive soon. I also want to extend another congratulations to Malika, who has been working on Papers as a Google Summer of Code intern, and now has landed a job at Igalia!

• Sergey Bugaev presenting how he ported a legacy Win32 app used at his day job to modern GTK4 and Flatpak. It was impressive to see how quickly he managed to pull it off, and the new custom GTK widgets that were required, including a very nice alternative to GtkTextView using Scintilla.

Outside the scheduled talks, I also had a lot of great conversations with the other attendees that day. This included discussions about the GNOME core app most dear to my heart, GNOME Calendar - including with Philipp Sauberzweig, our designer and now STF fellow about the design of Calendar, and also Federico Mena Quintero about how I could effectively write strong tests in Calendar, perhaps by rearchitecting some parts of Calendar to use the unidirectional data flow paradigm. I wish more Calendar folks could have attended this year!

I also gave a lightning talk during the community update section at the end of the day! My talk was about the state of the engagement team during the community updates page. I was very nervous for my first talk to all my peers, and unfortunately we forgot to shout out Maria Majadas as a member of the engagement team (sorry again Maria!). On the positive side, a lot of attendees were interested in what our team is doing to help promote our community’s contributions, and did reach out to me during the conference to ask me questions about the engagement team! You can watch my lightning talk here.

To end the first day, some of us got together to have dinner at a nice local Indian restaurant, and enjoy the seaside nearby.

Photo of around 10 GNOME community members sat down eating dinner at a local Indian restaurant, including me second on the left c:

Photo of a small beach at sun set in A Coruña.

Day 2 §

The second day started with me unfortunately missing the first few talks in the morning - I got whisked away by Wim Taymans and Jonas Ådahl to discuss Pipewire and XDG Desktop Portals, and how the two could operate together to provide secure access to audio devices on Linux. I can’t say much for the time being, but I have been hacking on those two modules recently for some paid work I received and I was honored to get to speak to two people who have been in this domain for much longer than me, and very thankful they answered my many questions and gave me lots of advice for my specific area of work on Pipewire/Portals!

I also got to hack on Calendar more with Philipp, including showing off my work on creating a mobile adaptive event details dialog, and Philipp working on improving the look of the event widgets. I had plenty of design feedback to takeaway to work on at home. There is always much to do in Calendar, which is what pulls me to it!

For the talks I did attend on the second day, the highlights included:

• Internationalisation in GNOME by Guillaume Bernard - I am excited to see the internationalisation team grow in GNOME and provide better documentation for us developers! I especially appreciated and 100% agreed with his remark at the start of the talk:

We think of accessibility as just a screen reader for the blind and captions for the deaf - when it is also about making sure software is accessible to those who don’t speak English.

• A demo of the future release of GTK4 Boxes from Felipe Borges - it worked flawlessly, and looks so much better than the decaying GTK3 version, good job Felipe! It was also very funny to see a bunch of Linux evangelists clap at seeing Windows 11 being installed! XD

• Interns Updates Talks - I liked seeing the progress our awesome GSoC interns were up to, and I was lucky to speak to the two interns that could attend in person later at GUADEC. I think one day it could be nice if I mentored someone, it does seem to do a lot of good for the community!

Day 3 §

The day started with the Annual General Meeting talk from a variety of GNOME Foundation members - despite some of the turbulence in the past, the Foundation seems to be in a strong position now to deal with the community’s needs. This includes increasing the number of user donations to the Foundation (to support initiatives like the GNOME Fellowship, and travel sponsorships) - especially around Christmas, the season of giving! It was also interesting to hear plans of moving Flathub away from Github to other forges, among many other exciting things the Foundation plans to do or has done in the past year. While I don’t always agree with the Foundation’s decisions and views, I am very happy to see it is in very good hands with Allan as the president and the new crop of board members - a massive thank you for everyone keeping this show running, you are all awesome!

Photo of Allan Day presenting the monthly donation statistics to the GNOME Foundation for fiscal year 2026.

The AGM was followed up by two talks about GNOME Shell. The first was a general talk on the state of GNOME Shell/Mutter from the core maintainers (including a very happy crowd at the removal of X11!). The second talk by Ivan Molodetskikh was about profiling GNOME Shell with Tracy, and a demo of how to use Tracy in our own C or Rust applications. I followed up with Ivan afterward for advice on using Tracy with Python - the good news it seems possible since Tracy has its own bindings for native Python code, or I could reuse the same strategy to profile PyGObject that he used to profile GNOME Shell’s interaction between the JS UI and the various C libraries it uses.

Photo of Ivan Molodetskikh presenting Tracy's timeline UI at his GUADEC talk

After the talks ended, we all went to have the traditional GUADEC dinner to celebrate the end of the core event. After nearly managing to lose my phone on the bus to the city center and having to take a very impronto sprint to the next bus station to retrieve it, we had a very nice dinner to close off the main part of GUADEC, including a drink of traditional Queimada at the end of dinner - it had a unique taste for an alcoholic drink, and I am glad to have gotten the chance to try it, but it might take some time for my nose hairs to recover from how strong it smelled!

Two pots of Queimada during the phase of burning the alcohol, while someone recites a incantation in the background.

Day 4 §

Day 4 marked the first day of the GUADEC Bird Of a Feathers (BOFs), a series of meetings/workshops for people with a common interest, usually without a focused agenda. I got to attend quite a few on Day 4 and got a lot productive done:

• GNOME Settings - Settings is the other core app besides Calendar I have submitted quite a few patches too, so it was nice to not only meet one of the maintainers, Felipe Borges, in person for the first time, but also a lot of new faces interested in Settings, even a few that ended up submitting patches to Settings afterwards!

  As a group, we discussed Settings AI policy, which was definitely a hard conversation as someone very much against LLMs in general, and what we should do with the CODEOWNERS.md file in Settings, to assign maintainership of specific parts of Settings to people who contribute the most to that specific part. We also showcased many of the cool new features landing for 51/52, including my own sound panel changes for improving the stream rows on mobile for 51 and a microphone test dialog for 52! I also got some helpful feedback for the sound panel while I was there.

• GNOME Mobile - The main issue on the GNOME front seems to be with upstreaming Jonas Dreßler (and others) patches to make GNOME Shell work better on mobile. There was quite a lot of back and forth between the Shell maintainers and Mobile Shell people about what to do with accepting large patch sets to Shell/Mutter when there are only 1-2 maintainers on each upstream project.

  There was a lot discussed, so I won’t try and fully recap here, and will invite you to read the notes for the BOF here. One thing I would like to highlight is a suggestion I made to help ease the burden on the core Shell/Mutter maintainers, by assigning new small merge requests with a “Newcomers can review” label, to encourage new contributors to also become reviewers, like we have done with some success in GNOME Calendar. The GNOME Shell maintainers seemed warm to that idea, so hopefully that idea pans out well :)

After the day was done, some of us went to go watch the World Cup finals in the middle of Plaza de María Pita - I have to admit, while I did not care much about the World Cup coming in, the atmosphere was truly breathtaking when Spain started winning the game, and I had an absolute blast celebrating with everyone who came to watch! I also definitely enjoyed seeing Argentina lose after crushing my home country earlier in the World Cup!

A group of around 10 GNOME foundation members (including me giving a very cheesy smile in the back c:) in middle of Plaza de María Pita, holding a Spanish flag celebrating Spain winning the world cup in a very large crowd.

Day 5 §

After managing to sober up after last night, I attended the Engagement BOF. It was nice seeing so many people of so many backgrounds attend and contribute ideas, feedback and actionable plans to our engagement team. This ranged from how we can onboard more people comfortable drafting posts, or sending their own for us to boost, to translating GNOME’s output to reach a wider audience (thanks Guillaume for bringing many of our internationalisation issues to our attention!), to how we can help the Linux “press” with covering GNOME news. The notes for the Engagement BOF meeting, as well as the notes for all our previous meetings, can be found here

Between the BOFs in the last two days, I also got my first GNOME Shell merge request over the finish line with help of the Shell/Mutter people at GUADEC! Linking back to the GNOME Mobile Shell discussion the previous day, I would also love to start to review Shell patches, so if you need help getting something reviewed, please do ping me in the GNOME Shell Matrix room and I can try to give it a look!

Day 6 §

The last day in Spain was spent relaxing and celebrating with the people who were left - no crazy hacking or talks, just spending the day out with a small pack of other GUADEC attendees, visiting the Torre de Hércule, the oldest lighthouse in the world, walking on the nearby rock beaches, then having lunch at a very nice vegan Mexican restaurant in the city. We also manage to spot a familiar logo on the way to lunch!

Philipp, myself, Guillaume, Charles and Tau in front of a building with a very sandy foot that looks rather similar to the GNOME Logo!

We had a goodbye dinner with the same group I walked the city with, and some others, at a very nice Japanese restaurant near downtown, which while very tasty, we definitely should have listened closer to Maria’s spice warning about the food!

It was very difficult having to say my final goodbyes to everyone I had meet at GUADEC, as I prepared to leave for the UK the next day when I got back to the hotel.

Conclusion + Kudos §

Going to GUADEC this year was a massive privilege and I could not be more thankful to have gone. I cherish every friendship I made, all the people whose work I admired online I finally got to meet in person, and the hundreds of amazing conversation I had with all the people from all backgrounds to learn more about my peers. It was a very good reminder that while working on software from my bedroom in the UK can feel somewhat daunting and lonely, GNOME is all about the amazing people building it too, and behind the software and heated online debates, we have so many amazing developers, designers, translators, hackers, product and infrastructure managers, leaders and users making it all possible!

A huge thank you to the GNOME Foundation for sponsoring my travel to GUADEC - without the funding, I would not have been able to make it to this awesome event and meet my amazing peers in GNOME. Another massive thank you to all the volunteers who helped organize and manage GUADEC, you all rock! If you would like to help ensure the Foundation can continue doing the awesome work it can to organize these events, I ask you make a donation to support the foundation.

I also want to give another massive shout out to our engagement team, especially Maria Majadas, Cassidy James and Victoria Niedzielsk for helping me create frequent and tailored posts on social media to keep the community updated on GUADEC. Y’all helped get the GNOME community hyped about all the cool things happening at GUADEC!

See you all next year, all sooner hopefully!

It’s been nearly ten years since I posted my recipe for installing Ubuntu on a Hetzner machine. I needed to do that once again and the old instructions work pretty well! Let me post what I used this time around for completeness sake.

 

shred --size=1M /dev/sda* /dev/sdb* cat > postinstall.sh <<EOF mkdir -p /home/{muelli,teythoon,russell,vollkorn,mms} echo "termcapinfo xterm* ti@:te@" | tee -a /etc/screenrc sed "s/UMASK[[:space:]]\+022/UMASK 027/" -i /etc/login.defs echo "blacklist floppy" | tee /etc/modprobe.d/blacklist-floppy.conf apt-get update apt-get install -y cryptsetup apt-get install -y dropbear-initramfs cryptsetup-initramfs cat /root/.ssh/authorized_keys > /etc/dropbear-initramfs/authorized_keys ## For some weird reason, Hetzner puts swap space in the RAID. mdadm --remove /dev/md0 mdadm --stop /dev/md0 mkswap /dev/sda1 mkswap /dev/sdb1 apt install -y podman virtinst uvtool-libvirt libvirt-daemon-system-systemd libvirt-daemon-driver-qemu libnss-libvirt libvirt-clients qemu-kvm blkid -o export /dev/md3 | grep UUID= mount /dev/md3 /mnt btrfs subvolume snapshot -r /mnt/ /mnt/@root-initial-snapshot-ro mkdir /tmp/disk mount /dev/md2 /tmp/disk btrfs send /mnt/@root-initial-snapshot-ro | btrfs receive -v /tmp/disk/ umount /mnt/ EOF chmod a+x postinstall.sh installimage -a -n newhost -r yes -l 1 -p swap:swap:32G,/boot:ext3:1G,/mnt/disk:btrfs:64G,/:btrfs:all -K /root/.ssh/robot_user_keys -t yes -s en -x ./postinstall.sh -i /root/.oldroot/nfs/install/../images/Ubuntu-2604-resolute-amd64-base.tar.zst echo -n "Better provide the passphrase interactively or change later with cryptsetup luksChangeKey /dev/md3" | cryptsetup luksFormat /dev/md3 - echo -n "Better provide the passphrase interactively or change later with cryptsetup luksChangeKey /dev/md3" | cryptsetup luksOpen /dev/md3 cryptedmd3 - mkfs.btrfs /dev/mapper/cryptedmd3 mount /dev/mapper/cryptedmd3 /mnt/ mkdir /tmp/disk mount /dev/md2 /tmp/disk btrfs send /tmp/disk/@root-initial-snapshot-ro | btrfs receive -v /mnt/ btrfs subvolume snapshot /mnt/@root-initial-snapshot-ro /mnt/@ btrfs subvolume create /mnt/@home btrfs subvolume create /mnt/@var btrfs subvolume create /mnt/@images btrfs subvolume create /mnt/@userfoo btrfs subvolume create /mnt/@userbar btrfs subvolume create /mnt/@mails blkid -o export /dev/mapper/cryptedmd3 | grep UUID= # The following deletes the root partition, which used to be on the unencrypted drive. sed -i 's,.* / .*,,' /mnt/@/etc/fstab sed -i 's,.* swap .*,,' /mnt/@/etc/fstab echo /dev/sda1 none swap sw 0 0 | tee -a /mnt/@/etc/fstab echo /dev/sdb1 none swap sw 0 0 | tee -a /mnt/@/etc/fstab echo /dev/mapper/cryptedmd3 / btrfs defaults,subvol=@,noatime,compress=lzo 0 0 | tee -a /mnt/@/etc/fstab echo /dev/mapper/cryptedmd3 /home btrfs defaults,subvol=@home,compress=lzo,relatime,nodiratime 0 0 | tee -a /mnt/@/etc/fstab echo /dev/mapper/cryptedmd3 /home/userfoo btrfs defaults,subvol=@userfoo,compress=lzo,relatime,nodiratime 0 0 | tee -a /mnt/@/etc/fstab echo /dev/mapper/cryptedmd3 /home/uesrbar btrfs defaults,subvol=@userbar,compress=lzo,relatime,nodiratime 0 0 | tee -a /mnt/@/etc/fstab umount /mnt/ mount /dev/mapper/cryptedmd3 -osubvol=@ /mnt/ mount /dev/md1 /mnt/boot chroot-prepare /mnt/; chroot /mnt passwd echo cryptedmd3 $(blkid -o export /dev/md3 | grep UUID=) none luks | tee -a /etc/crypttab echo swap /dev/sda1 /dev/urandom swap,cipher=aes-cbc-essiv:sha256 | tee -a /etc/crypttab echo swap /dev/sdb1 /dev/urandom swap,cipher=aes-cbc-essiv:sha256 | tee -a /etc/crypttab cp /root/.ssh/authorized_keys /etc/dropbear/initramfs/ update-initramfs -u -k all update-grub2 sed -i s,ENABLED=1,ENABLED=0,g /etc/default/motd-news exit umount -l /mnt mount /dev/mapper/cryptedmd3 /mnt/ btrfs subvolume snapshot -r /mnt/@ /mnt/@root-after-install umount -l /mnt

Then, for unlocking, you can do something like

cat ~/.ssh/boot_key | ssh -o UserKnownHostsFile=~/.ssh/newhost.known -i ~/.ssh/id_newhost_boot root@yourip  "cat - >/lib/cryptsetup/passfifo"

 

I found Tang and Clevis for automatic decryption during boot. That’s a pretty neat approach and I was surprised to find that even old Ubuntus ship the package.

AI entered software development at full speed this year, and it is significantly impacting open-source projects as well. In this article, I discuss several trends I have recently observed in open source in connection with AI, and how these trends are changing the world of open-source software.

This article was originally published on my Czech blog, but it received such an overhelming response that I decided to translate it into English and publish it here as well.

Project Inflation

One of the trends that AI brings in general is an explosion of content. Search results are filled with generated websites, and social networks are inundated with generated images and videos. Source code is no exception. Today, GitHub is drowning in an ever-increasing number of repositories.

However, it is not as if a larger number of high-quality projects are being created. On the contrary, these are projects where you have no idea whether you can rely on them or not. In the past, if you stumbled upon a more extensive project with thousands of lines of code, there was a certain assumption that if someone went to the trouble of creating something like that, they would have some knowledge of the problem, a personal connection to their creation, and some willingness to maintain it going forward.

You can no longer rely on this at all. Today, you can generate a project with several thousand lines of code in a matter of moments. It could be complete nonsense or even something dangerous; it could be something functional that someone generated for their own immediate needs and posted to GitHub, but with no interest in turning it into an open-source project. Because a repository with code doesn’t make an open-source project. The difference between a piece of code on GitHub and an open-source project is that an open-source project solves problems and use cases for its users, not just the author’s one-off need. And most authors of such quick-and-dirty code simply aren’t interested in doing that.

This is clearly visible in projects like MeshCore, for instance. There are dozens of forks of everything imaginable. Missing a feature in the official MeshCore firmware? You just fork it, vibe-code the missing piece, and dump it on GitHub as MeshCore-UltimateEdition. The problem is that it was created with minimal effort, the author usually has no relationship to it, gets bored after a month, and it becomes abandonware before it even has a chance to age.

About ten years ago, people started saying that the concept of Linux repositories had run its course. In the 2000s, they were practically the only source of Linux software. If a project didn’t make it into distribution repositories, it had a problem. But then the number of open-source projects grew at such a rate that distributions couldn’t keep up. Users had to start getting their software elsewhere, and software authors learned to do without distributions. Just a few years ago, the “everything I need, I find in Debian” approach seemed definitively dead.

However, it is possible that curated software sources – like Linux distribution repositories – will make a comeback. The open-source software world is becoming so chaotic that users will once again start appreciating sources containing curated software that someone has vetted for them and that they can rely on six months down the road.

Review Overwhelm

Another trend that AI has triggered in open source is ‘review overwhelm’. Previously, writing code acted as a natural filter because it required a non-trivial amount of effort and time investment. That is now gone, making code creation fast and easy. But someone still has to review this code before it goes into serious production. The review processes that worked in open-source projects for years are now at their capacity limits.

In GNOME 50, support for Google Drive was removed because nobody had been maintaining it for a long time. Users were naturally unhappy about it, and eventually, one user stepped up, re-added the support, and submitted it upstream to the gvfs project.

A colleague responsible for maintaining that project lamented that it was a change involving 4,000 lines of code. Even though it seems to work at a basic level, it was clearly generated using AI. He will still have to go through it line by line to verify that it actually works as intended and meets the code quality standards required to commit to maintaining it long-term.

Most of the effort has thus shifted from code creation to code review, which is typical for AI. The problem in open source, however, is that developers experienced enough to review and merge code were already a bottleneck before AI. Now, the problem has deepened significantly. And in the example above, my colleague can count himself lucky that the contributor is responsive and has shown long-term interest in the issue.

Today, that is more of a rare exception. Common contributions consist of someone wildly vibe-coding something without any deeper interest or understanding of the subject, and throwing it over the wall to the maintainers.

I have a fairly recent experience with this in Meshy. Someone submitted a pull request with 9,000 lines of changed code, which was supposed to add support for macOS. I spent an hour one evening doing a very quick review, and even during that short time, I ran into numerous issues: the code was blatantly AI-generated, several thousand lines were just completely useless replacements of single quotes with double quotes, parts of the code unrelated to the problem were modified, and it overwrote all the changes I had made in the main branch over the last few weeks.

The author never responded to my comments and I never heard from him again. My takeaway was that even that one hour was too big of a time investment for contributions like that, and next time I will reject them much faster.

Some projects are responding to this situation by tightening basic contribution requirements. For example, Flathub’s decision to reject AI-generated apps caused quite a stir. Many people criticized it as shooting themselves in the foot, but you have to look at their reality.

Flathub currently hosts several thousand apps, with more added every day. Only three people handle the reviews. Although their review process is highly automated, they do it very thoroughly, and a lot of manual input is still required. It’s clear their goal isn’t just to spot the worst slop, but to maintain a relatively high standard of code hygiene. In the last six months, I submitted two apps to Flathub, and the review process ultimately contributed to improving the quality of the apps themselves.

However, this has now clashed with the reality of people submitting completely vibe-coded apps without a shred of personal effort. The ticket template for requesting inclusion asks a few questions, including a requirement to upload a short video showing how the app works. It really isn’t demanding, and anyone can put it together in 15 minutes. Yet even that is too much effort for creators of AI slop.

Instead of fulfilling these minimal requirements, some labeled it an attack on Linux’s freedom and immediately vibe-coded an alternative to Flathub that was supposed to be open to everyone. Unsurprisingly, it barely lasted a month.

Not only do open-source maintainers lack the capacity to satisfy this demand for code review, but they are also losing the motivation to do it. Often, it would be faster for them to write the feature themselves, but the review process was historically how they cultivated new long-term contributors and potential successors. When someone sends you a vibe-coded contribution that cost them zero effort and which they likely don’t even understand, how do you expect to mentor them into a contributor who will help the project in the long run?

Open-source software was never just about the end result; it was also about the process – where contributors build a relationship with the project and grow into someone who will eventually pass that on to others. This stands in sharp contrast to the world of AI, where it’s all about the result. As fast as possible, with as little effort as possible.

Declining Motivation to Publish Code

In the 1990s, Francis Fukuyama declared democracy and liberal economics to be the ultimate victors in the arrangement of the world order. Today, as democracy erodes globally and the existing economic order crumbles, that looks like a prematurely bold statement to say the least. Similarly, just a few years ago, impressed by the developments of the last few decades, some hailed open source as the ultimate winner among software development models. Are we about to face a sobering reality check similar to Fukuyama’s thesis?

Lately, I’ve been observing a subtle, yet present trend of stepping back from open-source development. One argument against open development I hear concerns the aforementioned review overload. For some projects, the costs associated with being overwhelmed by AI slop can outweigh the benefits of useful community contributions. They might still publish the source code for transparency’s sake, but they transform from an open-development project into an open-source, closed-development project. And those who don’t care as much about transparency may close off the source code entirely.

Another argument against making source code public is the fear of license circumvention. Today’s LLMs train on source code regardless of its license and can then easily generate a similar solution that you can publish under whatever license you choose.

This isn’t an issue for permissive licenses, as the author has already accepted that anyone can do practically whatever they want with the code. However, AI poses a direct threat to copyleft licenses like the GNU GPL. Authors usually choose these to ensure their work remains open forever and that anyone who uses it shares their improvements back with the community. If an LLM trains on a project you’ve worked on for years and then generates a very similar solution published under a proprietary license, it effectively bypasses this principle.

Take MeshCore again as an example: the protocol itself and the firmware are open-source, but the clients are closed. Recently, it came to light in the community that a core team member secretly applied for the MeshCore trademark and started vibe-coding his own closed-source solutions based on the available code. MeshCore founder Scott Powell cited this as something that reaffirmed his decision to keep the client source code private. Specifically, he wrote:

So, I see open source, in the age of AI, as offering up your blood, sweat and tears for others to rip-off, but in innumerable ways.

We may disagree with Powell’s perspective, but it represents a legitimate stance that I see more and more often around me. I see lifelong open-source advocates – people who used to publish every last helper script because they wanted to share – who now keep those things to themselves, offering them to others only upon request. They have reasons similar to Powell’s.

Open source also grew out of the need to share. Writing code was hard; maintaining it was even harder. Why should everyone implement the same thing independently? Let’s join forces in an open-source project, write a shared library, and everyone can benefit from the results. The infrastructure powering the Internet today was built on this foundation. But AI is suppressing this need.

For instance, I encounter opinions that WordPress is dead because “I can just easily generate my own CMS.” In my view, that severely underestimates what an open-source project actually provides. It is so much more than just writing code, and this strategy of swapping a dependency on an open-source project for a dependency on an LLM might not pay off in the long run.

Nevertheless, the reliance on shared open-source components has indeed decreased to some extent. AI might not replace everything, but why depend on a large external library when you don’t even need 10% of its functionality, if AI can quickly rip off that 10% for you after learning from the original library? And once you have your own implementation, why would you contribute improvements back to a shared open-source project?

The final argument against publishing source code that I’ve been hearing lately is security. Granted, I’ve heard this argument throughout the two decades I’ve been involved in open source, but it has never been this loud. For years, critics have claimed that open source is insecure because it allows attackers to study the code and hunt for vulnerabilities. In response, open-source advocates argue that security through obscurity is not real security and that open-source software is safer because “given enough eyeballs, all bugs are shallow.”

Today, however, open-source projects are literally flooded with security vulnerability reports generated by AI. The volume is so unprecedented that it is genuinely easy to fall into the trap of believing closed code is safer. It’s interesting to note that while news headlines cover how many bugs AI has found, they rarely mention how many security bugs AI has fixed. Fixing them still requires a deep understanding of the codebase and is still done by human programmers. And just like reviewing pull requests, it is overwhelming their capacity.

In this case, though, I believe it’s just a temporary trend. Open-source projects will eventually wade through these security reports, the general security of maintained open-source software will improve, and the ecosystem will benefit in the end. As for the other trends mentioned in this article, it’s hard to say. I’m not quite as unconditionally optimistic there.

• Tech. planning call, sync with Caolan, lunch with J. Pleased to be mentioned in the Irish Parliament - go Ireland!
• Really pleased to see Collabora Online 26.04 released for customer use: the foundation of another year of development and improvement. Thanks to our partners for supporting our press release, and for our customers and partners for funding much of the awesome team that create a slew of fun new features alongside the community.

Putting on my Planet GNOME editor hat for a quick PSA!

Planet GNOME is a convenient aggregator for personal blogs by members of our community. While all content must follow our Code of Conduct, the views expressed in these posts are solely those of the individual authors.

They don’t represent or reflect the opinions of the GNOME Project as an entity or community.

To help highlight this, we’ve added a “Voices of the community” tagline to the website header. It links directly to our “Add feed” section, which also emphasizes that Planet collects the latest posts from personal blogs.

Enjoy the personal insights and variety of perspectives!

When Felipe first emailed us about the GUADEC 2026 travel grant, we were thrilled to learn that we were going to have the opportunity to attend the conference in person.

This was my first GUADEC, and it was a pleasure to meet the GNOME community and put faces to names. The conference was held in A Coruña, Spain, which turned out to be an amazing city with great food, friendly people, and beautiful views along the coast.

Community

The first thing I would like to mention was how patient and open the community was to both my fiancée Laureen and me. We knew going into the conference that we were much more junior than many of the developers attending, but everyone was incredibly approachable.

I received a great deal of help debugging issues in my local development environment, as well as guidance on some of the more difficult parts of my GSoC project.

Talks

The talks were very informative and I took way too many notes to include them all here without turning this into a novel. That said, I wanted to write a short summary of a couple of talks that I found interesting:

Varlink for System Components

Sebastian Wick gave a talk about modernizing the system component stack. His proposed idea for allowing more memory safety and zero cost abstractions was to write components in Rust, however this introduces the issue of introspection. For asynchronous functionality, Tokio and Glib both have main loops, and moving data between the loops can introduce a lot of overhead. GObject bindings can also make Rust's memory safety essentially moot.

Sebastian spoke about potentially not using GObject in some cases, and instead exposing more functionality over IPC using Varlink. Varlink is language agnostic, and services could be consumed from many languages without requiring GObject bindings. This process also would be very simple, allowing signals to occur as JSON strings that are easily observable. This would require some new crates to replace Glib functionality, and some more complicated functionality like file thrashing and sftp could be particularly difficult.

It is early, the ecosystem is still being built, but Sebastian argued that usage patterns will evolve and getting involved now will help shape the future of GNOME and Rust.

Using GTK in C++ with Peel

Sergey Bugaev hosted a workshop on using GTK from C++ with Peel. Peel is a library that allows you to use GTK in C++ to make GTK applications and widgets. Sergey made a simple widget that can draw using stylus input, and he walked us through the process of creating a simple application using Peel. The workshop was very informative.

I really regret not coding his example myself, I wish a recording of the lecture had been taken. That said, his repo can be found at https://gitlab.gnome.org/bugaevc/peel and his readme has instructions for usage and a basic code example.

Debugging with Tracy

Ivan Molodetskikh gave a talk that seemed really handy to me about using Tracy to profile performance for Mutter, GNOME shell, and applications. I had never heard of Tracy before this talk, however the capabilities seemed very handy. Tracy visualizes "zones" on a timeline, allowing you to see exactly where execution time is being spent across threads. The Tracy zones must nest correctly, where parent zones cannot end before their child zones. It can also show where threads are waiting. This allows for a very clear visualization of where time is being spent in the application, and can help identify bottlenecks or bugs.

The major downside to Tracy is that it requires a lot of setup, and the application must be compiled with the Tracy client library. Ivan gave a fairly in-depth breakdown of how to add Tracy profiling to an application, and I will go back to the recording of his talk to actually implement it in the future.

Technical Take Aways for My Project

• Sergey Bugaev helped me get the GIR generation for my C API working correctly. We also improved the FFI by exposing PitiviTimelineRuler directly in the public header rather than accepting a generic GtkWidget* and performing a runtime type check. This makes the API more type-safe and simplifies the Rust implementation. The GIR generation currently works after calling gtk::init() from pitivi_timeline_ruler_get_type(), but Sergey pointed out that this approach will likely fail in CI because the generated scanner shouldn't require GTK to be initialized this way. I'm still trying to build a solid mental model of how GIR generation and introspection work, so if anyone has experience with bindings, I'd love to hear your thoughts.

• Federico also spent some time reviewing my project with me. He suggested refactoring PitiviTimelineRuler so all of the mutable drawing state lives inside a single RefCell rather than several individual ones, I think the result would look something like this:

#[derive(Default)] struct DrawingState { cache: BTreeMap<...>, font: Option<...>, handler_id: Option<...>, } #[derive(Properties)] #[properties(wrapper_type = super::MyWidget)] pub struct MyWidget { #[property(get, set)] zoom_level: Cell<u64>, state: RefCell<DrawingState>, } Thanks to GNOME Foundation

I want to give a special thanks to the GNOME Foundation for granting us the travel grant to attend GUADEC 2026. It was a wonderful experience and I look forward to attending future conferences in person!

A full-resolution album of these photos is available under CC BY 4.0 for anyone in the GNOME community to reuse. https://www.flickr.com/photos/204880226@N08/albums/72177720334807665/

• Up early, sync with Stephan, Pranam, Laser, all-hands call, snatched lunch, Collabora quarterly mgmt meeting.
• Published the next strip: An interview with Maurice: digging into organizations
• Pleased to see FLOSS Weekly Episode 879: Collabora published - great to chat with Jonathan.
• More quarterly management meeting until late. Poked at a potential child setup thread delay in COOL at the same time. J. cleared shed and garage in the evening for final sealing coat.

Due to the increase in AI-generated security vulnerability reports, it is time for some changes in how GNOME manages vulnerability reports.

These policy changes intentionally do not distinguish between reports that contain AI-generated content and those that do not. Following the same rules for all vulnerability reports is simpler than having two different ways of doing things. Reporters rarely disclose AI use, and it’s nice to not have to guess whether the issue report is AI-generated or not; it’s normally obvious, but not always. Also, vulnerability reports that are not discovered by AI are becoming increasingly rare. Non-AI reports are now moderately unusual, so it really doesn’t make sense to optimize for them.

Reduced Disclosure Deadline

Traditionally, I have applied a 90 day disclosure deadline to all security issues reported to GNOME Security. 90 days is an industry standard timeline, but it doesn’t work particularly well for GNOME. In practice, almost all GNOME maintainers handle vulnerability reports in one of two ways:

• The project maintainer fixes the issue quickly, typically within 1-3 weeks after it is reported.
• The project maintainer does not fix the issue at all. The issue report eventually reaches the 90-day disclosure deadline, at which point I unset confidentiality.

The 90-day deadline is intended to allow project contributors time to fix the issue before it becomes public, but in practice, maintainers do not actually make use of most of this time. I disclose the issue report and request a CVE when it is fixed or when the disclosure deadline is reached, whichever comes first. Once a CVE is assigned, contributors who are not regular project maintainers will sometimes attempt to fix it. Accordingly, keeping the issue reports confidential for 90 days only introduces a delay that is not useful.

Some other projects, notably the Linux kernel, have implemented an immediate full disclosure policy for issue reports that seem to be AI-generated, on the basis that a vulnerability that can be discovered by AI is presumably already known to attackers. But this policy seems pretty extreme, and is certainly unkind to maintainers who might feel pressured to urgently fix the issue. Immediate disclosure would not work well for GNOME.

Instead, I will switch to a 30 day disclosure deadline for issues reported on August 1, 2026 or later. This seems like a good compromise. The shorter deadline would probably work better for GNOME even if not for the increase in AI-generated issue reports.

Procedure for Projects that Prohibit AI-Generated Content

If a project prohibits issue reports that contain AI-generated content, I will no longer forward security issues reported to GNOME Security to the project’s issue tracker, since the overwhelming majority of vulnerability reports contain AI-generated content and would violate the project’s policy. Instead, I will immediately close the issue report in the GNOME Security issue tracker, then ping the project maintainers to let them know about the existence of the report. If you prefer to receive vulnerability reports in your project’s issue tracker, then please change your project’s AI policy to make an exception for vulnerability reports.

Unfortunately, GNOME maintainers don’t have access to confidential issues in this issue tracker, and GitLab does not allow CCing individual developers on confidential issue reports. I had been planning to adopt immediate disclosure for these issues only, but perhaps we should instead expand the permissions to allow all GNOME developers to see the issue tracker. Opinions welcome.

Moving On

I have been managing GNOME security issue tracking since November 2020. (Thank you to Red Hat for supporting this work.) Security tracking is largely a secretarial duty: I keep track of issues when they are reported and when they are closed, disclose them when the deadline is reached, and request CVEs when appropriate. It is not a huge amount of work, but I am getting tired of it, so it’s time for a change. I will discontinue tracking newly-reported security issues on November 1, 2026. During November, I will focus only on tracking issues reported prior to November 1. By December 1, all disclosure deadlines for that set of issues will have been reached, and I will be done.

Currently nobody else is tracking GNOME security issues. If you are an experienced GNOME community member and you are interested in taking over this work, let me know and I will help you get started. (Security tracking is not a good task for newcomers.)

This may also be an opportunity to improve our tracking infrastructure. I use a wiki page, but this is fairly primitive and requires considerable manual upkeep. It’s easy to forget to update the page when an issue report is closed, for example. Ideally, we would replace the wiki with a proper web app that dynamically updates based on the actual state of the issue.