20 Years FSFE: Interview with Reinhard Müller

Reinhard Müller claims that his T-shirt folding capabilities are legendary. Without denying this fact, anyone who has worked with Reinhard on behalf of the FSFE can confirm that his dedication to Free Software and the FSFE is legendary as well. Reinhard joined the FSFE as a volunteer in its first year and met in person with the volunteers behind the FSFE's very first booth at FOSDEM in 2002. In the years following, Reinhard held many different positions inside the FSFE community. Reinhard became a founding member of the Austria country team, joined the FSFE's General Assembly as an official member and even helped to run the organisation for several years as Financial Officer and part of the FSFE's Executive Council. In all these positions Reinhard helped shape the organisation of the FSFE and still does, so much that many people are surprised when they hear that Reinhard is a volunteer and not a paid staffer of the FSFE.

Security: Patches, Reproducible Builds, Hijacking of Perl's Site

• Security updates for Friday

  Security updates have been issued by Fedora (389-ds-base, dogtag-pki, dpdk, freeipa, isync, openvswitch, pki-core, and screen), Mageia (bind, chromium-browser-stable, gnome-autoar, jasper, openldap, openssl and compat-openssl10, screen, webkit2, and xpdf), Oracle (grub2), Red Hat (java-1.7.1-ibm, java-1.8.0-ibm, nodejs:10, and nodejs:12), SUSE (freeradius-server), and Ubuntu (wpa).

• Reproducible Builds: Reproducible Builds in February 2021

  Welcome to the report from the Reproducible Builds project for February 2021. In our monthly reports, we try to outline the most important things that have happened in the world of reproducible builds. If you are interested in contributing to the project, though, please visit our Contribute page on our website. [...] A few days earlier, Eric Brewer, Rob Pike, Abhishek Arya, Anne Bertucio and Kim Lewandowski wrote a post on the Google Security Blog proposing an industry-wide framework they call “Know, Prevent, Fix” which aims to improve how the industry might think about vulnerabilities in open source software, including “Consensus on metadata and identity standards” and — more relevant to the Reproducible Builds project — “Increased transparency and review for critical software”...

• The Hijacking of Perl.com

  For a week we lost control of the Perl.com domain. Now that the incident has died down, we can explain some of what happened and how we handled it. This incident only affected the domain ownership of Perl.com and there was no other compromise of community resources. This website was still there, but DNS was handing out different IP numbers. First, this wasn’t an issue of not renewing the domain. That would have been a better situation for us because there’s a grace period. Second, to be very clear, I’m just an editor for the website that uses the Perl.com domain. This means that I’m not actually the “injured party” in legal terms. Tom Christiansen is the domain registrant, and should legal matters progress, there’s no reason for me, nor anyone else, to know all of the details. However, I’ve talked to many of the people involved in the process.

QBittorrent Support For BitTorrent 2.0 Is Looking Good

BitTorrent 2.0, defined in BEP52 all the way back in January 2008, is a big upgrade to the existing BitTorrent protocol. It uses SHA-256 instead of the now very insecure SHA-1 hash algorithm, it has a much more efficient directory structure in the .torrent files and the pieces of files within a torrent are represented by merkle hash trees. One potentially fun advantage of the new .torrent file format is that individual files within a .torrent get their own hash. That could be used to participate in two or more public swarms if two or more torrents happen to contain the same file(s). There is no code for such a cross-leaching feature as of today, but is in theory quite possible. BitTorrent clients have been very slow to implement the new BitTorrent 2.0 protocol. libtorrent-rasterbar 2.0, released in October 2020, was the first widely used BitTorrent library to full support it and all its features. The popular qBittorrent client, available for macOS newer than High Sierra, Windows 7+ and Linux, is built on the libtorrent-rasterbar library. The latest stable v4.3.3 release from January 2021 uses libtorrent-rasterbar 1.2.