Planet GNOME

Hello,

I started this blog 22 years ago now (I don’t recommend going back to the start), and for the last 5 years I wrote a monthly “status update” post, aiming to mainly write about interesting stuff I might have done in the world of open source software, which I hoped in turn would motivate me to do more interesting stuff in open source software.

The world changed a lot in that time. If I started now this would probably be a podcast with 16 listeners, instead of being a WordPress blog with 16 subscribers.

I’ve spent a lot of time this year reading and thinking about the impact of large language models on the tech industry and open source. Its interesting because this feels like the moment, whether we like it or not, hacker culture goes mainstream. This week the world’s major news outlets had to figure out what PHP is.

That the BBC’s cyber correspondent didn’t know PHP existed has caused some joking and debate online.

24 years ago I was figuring out what PHP is. Jonathan Atkinson, who I met in a forum that was nominally about writing video games in QBASIC, asked me to make a wiki in PHP. So I did.

All I knew about wikis was that, it’s like a regular website except anyone can edit it. I named the project: Wiki! Here’s a quote from the README:

How do I install it?It's best run in its own directory. Create it one. You'll also want a directory for nodes,or you could keep them in the base wiki dir. Either way, the nodes directory has to bechmod'ed to 777.

You might raise your eyebrows at that comment if you aren’t yourself a teenage hacker discovering web development.

Wiki! did have a login system, and the passwords were even stored as MD5 hashes rather than plain text, as I heard that was good practice. In hindsight, an attacker who knew how to set the HTTP Cookie header could impersonate anyone, like this: Cookie: wikiticket=admin.

Here is a snippet of the file edit.php. Note that $node and $title are inputs you can set via a POST request, or even via URL parameters like edit.php?title="/etc/passwd":

$t=$title;if ($node) { // Write new data // $file=fopen($nodedir.$t.".wiki", "w+"); $node=stripslashes(ereg_replace("(\r\n|\n|\r)","<br>", $node)); // Linebreak to <br> fputs($file, $node."\n");

Even if you just learned what PHP is today, you might see that this is not an entirely secure design.

Anyway, at the time I was proud of my work, and I needed somewhere to host it. So, as you would in 2002, I registered the name “wiki” on sourceforge.net and uploaded the project code.

Sourceforge, for those who haven’t yet reached middle age, was the 2000’s equivalent of Github. It allowed projects to have their own website, as long as they included the Sourceforge logo somewhere, and the website could use PHP. Perfect, I thought, the project’s website will be a wiki!

Looking back now through archive.org, I can see this code actually ran in public for many years.

Here it is around launch day in 2002: https://web.archive.org/web/20021012080349/http://wiki.sourceforge.net/wiki

I have a local copy from around this time, which includes indexjon.wiki:

Sam, there are some serious bugs in this wiki. I keep on getting 'document contains no data' errors; get me on AIM. Welcome to grove.swoo.net. You may or may not be interested in the [weblog]. JonathanA - 29/8/02 - 11:36 am JonathanA - 29/8/02 - 07:36 am

Those bugs went unfixed forever, and six months later, the front page text had been replaced with two poems, one in Italian and one in Russian: https://web.archive.org/web/20030420205758/http://wiki.sourceforge.net

One is “Non chiederci la parola che squadri da ogni lato” by Eugenio Montale, written in 1923, and presumably posted by a fan. Does anyone know what it’s about? A machine translation suggests it might discuss “the crisis of certainty faced by contemporary man”. The other is “Anecdote for Fathers” by William Wordsworth, in Russian via an unnamed translator.

Let’s just sit with that for a moment. Imagine what happens in 2026 if a trivially exploitable PHP website hosted by a US corporation goes online: it’ll be mining bitcoin, serving pornography and drowning in racist and antisemitic spam, probably all within the same day.

In 2003, over the course of six months, my naive implementation of a wiki was gifted with… two rather thoughtful poems.

Fast forward another year. I was about to turn 18 years old, was studying for A levels and mostly concerned with hanging out in the park drinking cheap cider and learning to play the guitar. I was certainly not thinking about this rather flawed chunk of PHP code that I’d written two years earlier, but via the magic of archive.org we can see that various people were genuinely trying to use it as a wiki: https://web.archive.org/web/20041121113508/http://wiki.sourceforge.net

In hindsight, perhaps it attracted so much attention because I’d literally taken the subdomain: http://wiki.sourceforge.net/, unintentionally boosting the SEO reach quite a bit. The site was still active right up until 2007.

I can’t find it now, but I do remember receiving an email at some point from sourceforge.net noting that they’d taken down the wiki! website after discovering it was a major security risk. And at some point they must have (quite reasonably) reclaimed the project name as well, since http://sourceforge.net/projects/wiki no longer exists. It will always live on in my heart, though, and for the moment at: https://web.archive.org/web/20021014172056/http://sourceforge.net/projects/wiki/

The world has changed significantly since I was a teenage hacker. Some of what I learned in those days is completely obsolete, such as the QBASIC programming language and VGA graphics. I am a world expert in these irrelevant topics.

Other stuff that I picked up in the early 2000s has become the foundation of my career as an operating systems developer: C programming, Linux distributions and an gradual induction into open source desktop world via Planet GNOME. And good old PHP, of course. Who knew that, a quarter way through the 21st century, PHP would be front page news?

Age 18, I didn’t tell anyone in the real world that I’d written a wiki because it’d be the first time they’d heard the word “wiki”. The word evoked exotic and mysterious feelings of Hawaii in 2002. Now it universally evokes Wikipedia. People are learning about password hygiene and PHP. The arrival of AI on the scene, to me, fits into this bigger picture that began in the last century: we, the Computer People, are becoming Mainstream.

As of today, Flathub Discourse is read-only. Existing threads stay available, but it is no longer possible to start new topics or reply.

We opened the forum back in 2020 as a place for asynchronous communication that isn't GitHub issues or IRC. Realistically, it never took off, becoming another issue tracker to keep an eye on. A forum where people post and wait for an answer that never comes is worse than no forum at all.

Here's where to go instead:

• Help with packaging and submissions: the Flathub Matrix channel, or the Flatpak channel for questions about Flatpak itself.
• Problems with an app: the issue tracker of its repository, linked as "Manifest" on the app's Flathub page. Issues with Flathub itself go to flathub/flathub.
• App requests: Flathub doesn't take them. Ask the app's developers to submit it, or do it yourself.
• Runtime announcements: runtime projects such as freedesktop-sdk are welcome to post them on this blog.

Thanks to everyone who answered questions there over the years.

Time for a new Crosswords release! This is a good one. This past cycle features two major changes: the game got a major visual overhaul, and the Acrostic Editor is no longer in Beta.

This release is dedicated to Luciana. She contributed the adorable artwork for libipuz, and is a budding cruciverbalist. She’s currently having a bit of a tough go of it healthwise, so please join me in sending her good wishes. We’re all rooting for you!

New Game Layout

The game mode got a complete rework this cycle. We moved the Across /Down labels into the header, and added independent header bars for each column. This work was designed by “gnoman”, who did a fabulous initial mockup, and then provided a lot of additional feedback as we iterated through possibilities. The end result looks so much better than before, and is orders of magnitude better than anything I dreamed of when I started this project.

Initial mockup from “gnoman”

Every aspect of the game looks better, especially single-column mode. That now has a bottom drawer for the clues. Take a look at how it resizes:

https://blogs.gnome.org/jrb/files/2026/10/Screencast-From-2026-10-19-16-36-11.webm

I had to heavily adjust the reflow animation to deal with the updated appearance. For better or worse, this layout cannot be done with stock GTK/libadwaita containers and needs a complex custom layout widget. It’s a pain to edit, but it also means that we control every stage of the animation process. We handle things from reparenting buttons to panel changes.  The direction switching even cross-fades between the label and the toggle instead of snapping. It’s a small thing, but it makes the whole animation silky smooth.

“Gnoman” also contributed animated SVGs for the “How to Play” dialog. Florian migrated us to the new GTK SVG animation framework, and we’ve ended up with an even slicker, charming intro screen.

Acrostic Editor Is No Longer Beta

A few years ago, Tanmay added acrostic support to the game. This puzzle type was fun-looking! But since we didn’t have a ready source of them, he started working on editor so we could write our own. He got something basic working but it wasn’t reliably usable. The problem was the grid autofill feature: it was just too slow. It worked by doing a DFS through the possible anagrams with a random answer shape. Sometimes it found results, most of the time it did not.

This cycle, I went back to try and fix it and now have something usable. As sometimes is the case, the trick to get it working turned out to be really simple: We just had to try a new random shape after 30K iterations or so. It was a small change to the code — just a counter. But we ended up with something that could find grids with regularity.

Once that started working I went back and fixed up the rest of the workflow. The Quote/Source entries are now instant apply and you can manually edit entries in the list. There’s an info panel that gives acrostic stats and an overlay pane to mark progress. It looks a lot better — and works! I’ve used it to create three acrostics already and have more coming. Take a look:

https://blogs.gnome.org/jrb/files/2026/10/Screencast-From-2026-10-19-18-14-20.webm New Generic Widgets

As part of working on the Acrostic Editor, I wrote some new widgets. These are not crosswords-specific, and are written so that people can cut-and-paste them into their app (if it’s GPLv3 compatible). They’re targeted for internal use but maybe would be useful for others.

The more interesting of the two is XwdRichTextRow. It’s an alternative for AdwEntryRow that uses a GtkTextView instead of a GtkEntry. It has two features that the libadwaita widget doesn’t:

• An :n-rows property to set the number of visible rows. If set to 1, it matches the pixel extents of AdwEntryRow. But larger numbers will provide additional lines of editable space. A vertical scrollbar is provided once the row count gets large enough.
• Rich text editing. It supports bold, italic, strikethrough etc, and provides a convertor from pango markup to-and-from the widget. I wrote it in such a way that a markdown convertor could be written as well.

It’s not as comprehensive as AdwEntryRow yet: it doesn’t support prefix/suffix widgets, emojis, or an apply button, and there are probably a lot of bugs. It also will never support GtkEditable, due to the GtkTextBuffer underpinnings. But it may be useful and fill a niche that I, at least, have felt a void for a while.

https://blogs.gnome.org/jrb/files/2026/10/Screencast-From-2026-10-19-16-05-18.webm

I also wrote XwdInfoButton, which is basically a simple menu button that creates explanatory popovers. It should be used sparingly, but for a really complex app like the editor I think it can help demystify some sections. It takes a markdown string as its format.

Info Popover

Let me know if you have any interest in using these widgets.

Non-Distro Builds, And a Plea For Help

Crosswords has built on macOS for a while thanks to Vinny’s heroics, but nothing stopped us from breaking it. He’s fixed that: we now have a macOS arm64 CI job, building against Homebrew with Apple clang. Now macOS-specific errors can be caught at commit time.

Vinny also provided an MR for building bundles as part of the build process! I’d love to have bundles available to go with the flatpaks we create. However, I have neither a Mac to test on, nor the skills to evaluate this MR. I would deeply appreciate if anyone can help test and evaluate this!

Crosswords running on a Mac

Florian also did another build of Crosswords for Android and created another APK. It’s still pretty buggy, but it’s significantly better than the previous release. I think we can get it usable with a little more effort.

Android Build Other Features

A grab bag of the rest:

• The metadata tab now has rich text editing throughout and was reorganized into a vertical layout.
• The  Language and Country rows let you set the puzzle’s $LANG and Charset. A new layer warns about letters that aren’t in the alphabet. It was shockingly complex to write.

Rows for setting $LANG

• Word lists now show synonyms in clue definitions.

Definition and synonyms of “RAISE”

• The Editor preview window uses the real game widget.
• We enabled large text for printing. Toluwaleke did most of the work already a few releases back, it just needed a template.
• Added support for the Czech CH digraph, mirroring the existing Dutch IJ digraph.
• Laureen has been steadily working on a grid generator for vocab puzzles. None of it is visible yet — it’s all generator code — but it’s a solid basis for the next game type.
• I fixed a massive leak with all the PuzzleTasks. Turns out we weren’t freeing them at all due to a ref loop. Not a big deal with the normal autofill behavior, but once we started running it every keypress the leak grew fast.

Thanks!

This release, thanks to:

• Rosanna for tireless help with UI word-smithing and editing, as well as endless patience.
• “Gnoman” for the amazing design for the revamped play mode, the animated SVGs, and general design support.
• Tobias for design support and advice throughout the Circle process.
• Florian for the port to GTK4’s new SVG widget and other fixes.
• Vinny for macOS input method support and the macOS arm64 CI job, and in general amazing build gardening.
• Michel for build and license advice.
• Laureen for continued work on the vocab editor.
• Federico for general advice.
• Alice for general advice, and for fixing my issues with libadwaita.
• Eleanor, Sophia, Michael, and Rosanna for puzzle play-testing (coming soon!)

Peace

A few days ago systemd gained tools which allow you to monitor Varlink traffic. A new Varlink service (io.systemd.VarlinkMonitor) allows you to set up a ring buffer which will get filled with packets containing the traffic which matches the filters you provide. This provides the functionality that org.freedesktop.DBus.Monitoring provides for D-Bus. A new varlinkctl monitor verb allows you to use this feature in terminals and scripts. This provides the functionality that dbus-monitor provides for D-Bus and uses io.systemd.VarlinkMonitor under the hood. If you pass --json short to varlinkctl monitor, it produces JSON-seq which can be passed into jq --seq to further process the captured data.

I presented this in the broader context of observability with Varlink at All Systems Go. Slides and video of the talk are available online.

This is a good start, but I think we should add more tooling around it. Especially Bustle would be an interesting target because it would allow us to capture D-Bus and Varlink at the same time and get a global view of what is going on in our systems again.