A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday.

Only servers with HTTP/2 enabled are affected, according to Red Hat, which ships the server as part of Red Hat Enterprise Linux.

An attacker who can reach the server needs no authentication to exploit the flaw and could take full control of the server process, the Linux vendor says. It rates the flaw 9.8 out of 10 on the CVSS scale.

The vendor's assessment, published yesterday, also says "public research has demonstrated a reliable exploit" against a server in its default configuration with mod_http2 enabled. It does not name or link that research. Security company Wiz said later that day that no exploit was available and that no exploitation in the wild had been reported.

HTTP/2 runs only where the Protocols directive turns it on, as the module documentation explains. The directive uses h2 for HTTP/2 over TLS and h2c for HTTP/2 over plain TCP. It can be set for the whole server or for a single virtual host, so admins should check the server-wide setting and every virtual host.

Standalone builds of the module, released on GitHub as mod_h2, are affected from version 2.0.8 through 2.0.42.

Admins who run the Apache HTTP Server project's own releases should move to version 2.4.71, the fixed release named in its security advisory. That release also fixes a crash in mod_md, rated important, and a one-byte overwrite of stack memory in mod_vhost_alias, rated low.

The distributions in the table below ship their own builds of the server, with their own package version numbers. On Red Hat Enterprise Linux 9, for example, the fix ships as mod_http2-2.0.26-7.el9_9.1.

Red Hat shipped fixes for Red Hat Enterprise Linux 9 and 10 yesterday and rates the flaw Important on those releases rather than Critical. Their mod_http2 packages give each HTTP/2 stream its own memory allocator, which makes an attack much harder, according to the vendor's severity assessment. Red Hat Enterprise Linux 8 and earlier do not contain the vulnerable code.

The Debian rows come from Debian's security tracker, and the Amazon row from the Amazon Linux tracker. Ubuntu's CVE tracker had no page for the flaw when The Hacker News checked it today.

The Apache HTTP Server advisory offers no workaround. In its vulnerability analysis, Wiz advises admins who cannot update yet to remove h2 and h2c from the Protocols directive, leaving Protocols http/1.1.

The standalone mod_h2 project has published no fixed release so far. Its release list on GitHub ends at 2.0.42, the last affected version, and its repository has been read-only since it was archived on June 9. The Protocols change above also applies to servers that use those builds.

The flaw was reported on October 26 by Anthropic's OSS Scanner, a free scanning service for open-source projects that uses the company's AI models. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported it last week.

An earlier HTTP/2 flaw, CVE-2026-23918, was fixed in version 2.4.67, released on May 4. Servers updated to that release, or to any later one up to 2.4.70, still run a version that the new flaw affects.

cross-posted from: https://lemmy.ml/post/55238685

no baked-in trackers/analytics, No VC backing, Big Tech parent, or crypto schemes. aggressive ad/tracker blocking, fingerprinting resistance, working YouTube ad blocking, extension support, smooth Android + Linux use.

What's your daily driver under these constraints, and what tradeoff did you accept?

I've seen quite a few launchers on F-Droid, but I really fail to see what their advantages over the stock one are. I mean, what can be meaningfully different about arranging apps in a grid? But I guess the existence of so many options goes to show I just don't get the gist of it.

So what launchers actually provide some interesting features that make it worth switching to them?

cross-posted from: https://reddthat.com/post/76492244

Degoogle setup part 3

Previous part: https://vger.to/lemmy.world/post/54095201

(Changelog at the bottom)

Universal prefernces:

1. Lightweight
2. FOSS
3. Resource-effeciency
4. No or human-checked vibecoding

Nice-to-have but non-garenteed features:

1. Eco-friendly (by using the money for environmental purposes DIRECTLY)
2. Decentralized
3. Complete independence from original service. Use frontend or client if possible
4. Self-hostable
5. Offline-capable
6. Not hosted on Github (eww Microslop product)
7. Hardware sustainability

Avoiding alternative software developers (or companies/cooperations):

• Proton
• Mullvad
• Tuta
• Mozzila
• Signal
• FUTO

De-Boogle

Boogle Search:

1. SearxNG
2. Marginalia
3. YaCy

Boogle Chrome:

1. FREE Browser (Obscure)
2. Librewolf
3. Tor Browser

Boogle Mail:

• Service provider - Custom domain, Thundermail
• Client:

1. FairEmail
2. TutaNota
3. Thunderbird

Boogle Maps:

• Modified PWA - Gmaps WV
• Map data - OpenStreetMaps
• Public transportation data - Transitious
• Navigation client - CoMaps

Boogle Gemini:

1. Duck.ai
2. Ollama

Boogle Play:

• Repo:

1. F-Droid
2. IzzyOnDroid
3. Obtainium

• Client - Aurora Store
• Client for repos:

1. Droid-ify
2. ObtainX

YouTube:

• Platform:

1. PeerTube
2. Odysee

• Frontend - Invidious
• Frontend instance:

1. materialio.us
2. ytchocolatemoo.com
3. Self-hosted

• Client:

1. FreeTube
2. PlasmaTube

Boogle messages:

2. Fossify Messager
3. NovaDial

Boogle My Files:

1. Fossify File Manager

VirusTotal

1. Veto
2. Hypatia

Android - GrapeheneOS

Android Auto - Phone stand for car

De-Microslop

Windows:

1. CachyOS
2. Linux Mint

Office (or "Microslop Copilot 365"):

1. MA Office
2. LibreOffice
3. OnlyOffice

De-Meta

Facebook and instagram:

• Platform - Mastodon
• Client for platform - Smither

WhatsApp - SimpleX Chat

De-ByteDance:

TikTok - Loops

CapCut:

1. LibreCuts
2. Kdenlive
3. Shotcut

Hypic (photo editor):

1. Pocket Paint
2. Pinta
3. Inkscape
4. GIMP

Gaming

• Minecraft:

1. Luanti + Mineclonia
2. Cubys

• Universe Sandbox - Cosmogon

• Space Engine - Celestia

• Territorial.io - OpenFront

• Tetris - Block Drop

• Wordle - Code Word

• Friday Night Funkin - Etterna

• Geoguessr - GeoGuessLite

General internet:

Domain name system:

1. Adguard DNS
2. NextDNS
3. Quad9

Network tunnels:

1. Manual Wireguard VPN tunnel
2. Manual OpenVPN tunnel
3. Tor Network

Proxy:

1. HTTPS Proxy
2. SOCKS5 Proxy
3. Orbot

(not really related for De-googling or opensource but mpreso for de-bloating) File types and codecs (wheneber possible):

.png/.JPEG:

1. .webp
2. jxl

.exc:

1. .ods

.mp4:

1. .webm
2. .VP9

.mp3:

1. .OPUS
2. .m4a

Other:

Reddit:

• Platform - Lemmy
• Platform instance - reddthat.com
• Platform client - Voyager
• Frontend - Redlib
• Frontend instance:

1. saferreddit.com
2. self-hosted

SearxNG search rssult sources:

1. DuckDuckGo
2. Brave
3. Qwant
4. StartPage
5. Ecosia
6. Mojeek
7. GOOD

Github:

• Repo:

1. Gitlab
2. Codeberg

• Frontend - Gothub (no chosen instance yet)
• Client - Octolab (Gitlab-only)

New additions:

1. Privacy Flip
2. Shizuku
3. Canta
4. EnforceDoze
5. SaverTuner
6. Wine
7. Virtual Box
8. Librefind
9. sustysubs.net
10. Yagni Launcher
11. LTE Cleaner
12. SquirrelDisk

Main sources of help:

1. YouTube videos and comments
2. Lemmy comments and posts
3. Reddit comments and posts
4. sustysubs.net
5. Librefind
6. Possibly PeerTube in the future

Useless reccomendations for me:

• Termux

On the sidelines of comsideration:

• WizeStream (NewPipe fork)
• Flow (YouTube client)
• Skylib (Bluesky frontend, unlikely to actaully use)
• YT-dlp

Could use reccomendations for:

• Linux file manager
• Linux non-cloud-based photo gallery
• Linux malware scanner
• Long-term Linux distro if I find my beginner-friendly distros a bit pale in the future

Remaining questions:

• If you tested or use QubesOS, how's the experience?
• Do you use a non-Linux-based FOSS operating system (like ReactOS)? If so, how's the experience?
• If you used SailfishOS, PostMarketOS (or NuraOS) alongside GrapheneOS in your lufe, how's the experience?
• Any alternatives I missed?
• Any other software categories I missed?
• Any other new additions that I missed?

Changelog (NOT TOO IMPORTANT):

(Somewhat) Important changes

• Added "No or human-checked vibecoding" to Universal preferences
• Added "Not hosted on Github" and "Hardware sustainability" to "Nice-to-have but non garanteed features"
• Added note to "Eco-friendly" (Nice-to-have but non-garanteed featueres)
• Added "Signal" to "Avoiding alternative software developers"
• Replaced "Posteo" with "TutaNota" in Email clients
• Added "Public transportation data" with "Transitious" as the service
• Added "Odysee" as a new altermative platform to YouTube
• Replaced "Nobara" with "Linux Mint" as an alternative to Windows
• Added "Shotcut" as an alternative to CapCut
• Replaced "Galaxy Engine" with "Cosmogon" as an alternative to Universe Sandbox
• Added "Geoguessr" with "GeoguessLite" as the alternative
• Added "reddthat.com" as Lemmy instance
• Added "Voyager" as Lemmy client
• Added "SearxNG search results sources" with DuckDuckGo, Brave, Startpage, Qwant, Ecosia, Mojeek and GOOD
• Added "Octolab" as Gitlab client
• Added "Squirreldisk" as a new addition
• Added "Main sources of help" with YouTube, Lemmy, Reddit, sustysubs.net, Librefind, and PeerTube
• Added "YT-dlp" on the sidelines of consideration
• Added "Linux malware scanner" to "Could use reccomendations for
• Asked about the SailfishOS and PostmarketOS (or NuraOS) experience

Changes you might notbcare about:

• Added changelog
• Added link to the previous part
• Added thumnail
• Updated format

Hey folks!

The post may be a bit long. Please bear with me.

I am the developer of BentoPDF. It's a privacy first PDF toolkit that runs in your browser. I also have been working on making the best open source PDF compression engine, Hyper Compress, which is the what the post is about.

Why Hyper?

If you've ever needed to shrink a PDF you've almost certainly used Ghostscript. Even though it's great, but it rebuilds the whole document from scratch, so it can leave visual artefacts behind, and in our tests on 2,104 real PDFs it broke about 3% of files and made a quarter of them bigger.

Benchmark against open source tools

Hyper helps solve this issue. It is a high fidelity, monotonic compression engine. On those same 2,104 PDFs it beat Ghostscript, MuPDF and qpdf on size at every level, without making a single file bigger, and thus providing predictable outcome all while producing a conformant PDF.

Benchmark against commercial SDKs

For the new release I also ran a comparison against the commercial SDKs companies pay for. Hyper was tested against PDF Tools, Apryse and Nutrient on 1,000 real PDFs from public sources. The table shows size saved, with page quality after the @ (SSIMULACRA2, where 100 means identical to the original):

| Engine | Lossless | 200 dpi | 150 dpi | 72 dpi | |

|

|

|

|

| | Hyper | 18.0% @ 99.5 | 61.0% @ 89.8 | 70.2% @ 86.4 | 79.9% @ 67.9 | | PDF Tools | N/A | 55.1% @ 86.7 | 64.7% @ 82.9 | 75.6% @ 72.2 | | Apryse | N/A | 41.8% @ 88.4 | 55.6% @ 85.8 | 74.6% @ 73.4 | | Nutrient | N/A | 55.2% @ 87.8 | 61.5% @ 82.8 | 72.0% @ 70.8 |

Hyper made the smallest files at every level, and it's the only one with a lossless mode. Across its 4,000 runs it never failed and never made a file bigger. The others made between 5 and 120 files bigger, and Apryse and Nutrient failed on a few. At 72 dpi they keep a bit more quality, because they compress less.

But please Don't take my word for it. The list of PDFs with checksums, every per file result and the scripts are all in bench/sdk-comparison, so you can run it yourself.

It's available in CLI, Node SDK, C API, Docker, and can also run in your browser via WASM.

If you wanna quickly try it out: https://hyper.bentopdf.com/

It runs on your own browser via WASM, so nothing is uploaded.

I'd like to get more people testing it, especially with PDFs I haven't encountered myself. So if you work with PDFs regularly, I'd love for you to throw some difficult files at it and try and break it.

Any feedback and bug report is welcome and appreciated.

Thanks for reading and have a great day.

The FreeBSD Project published its Q3'2026 status report on Tuesday that outlines a number of development initiatives to ongoing work around an AI policy for this BSD operating system.

FreeBSD polled their developers on the usage of AI and LLMs as a hot topic for the quarter. An overwhelming 88% want the FreeBSD Project to adopt an AI policy. 35% of those polled want AI-assisted code to be disclosed while 22% felt it should be treated just like any other code contribution and only 16% want AI generated code to be rejected outright. 65% of the respondents were in favor of AI-generated documentation with human review.

FreeBSD has established an AI working group to work on drafting an AI policy. Final reports are expected in Q4.

FreeBSD developers have also had to spend a lot of time preparing for the EU's Cyber Resilience Act (CRA) such as around Software Bill of Materials (SBOM) support.

FreeBSD has also seen work on a GUI for the Bhyve hypervisor written in Freepascal/Lazarus. This Bhyvemgr GUI is coming along well to help in managing of Bhyve VMs:

https://www.phoronix.net/image.php?id=2026&image=bhyvemgr_med

Meanwhile on the web management/UI side, Sylve continues looking quite slick as a unified system management platform for FreeBSD from the web browser. Adding in the past quarter were new storage options, data center / cluster features, and more.

https://www.phoronix.net/image.php?id=2026&image=sylve_med

FreeBSD also continues seeing work to enhance desktop installations of the operating system and more polishing of the desktop experience. Related have also been more suspend/resume and audio stack improvements.

Some other FreeBSD happenings include improving zoned storage support, debugging enhancements, a variety of scheduler improvements, and enhancing the bootloader.

More details on these FreeBSD improvements made during Q3 can be found via FreeBSD.org.

Following the release of the Mozilla Firefox 160 web browser today, Mozilla also released the Mozilla Thunderbird 160 open-source email, chat, address book, news, and calendar client for all supported platforms.

Mozilla Thunderbird 160 adds support for the Ctrl+A keyboard shortcut for selecting all filters in the Message Filters dialog, improves OAuth sign-in windows to explain when blocked cookies may prevent sign-in, and updates Office 365 account setup to no longer automatically offer EWS configuration.

Thunderbird 160 fixes numerous bugs, starting with a crash that could occur when opening a window, a crash caused by message database updates, and a freeze of new mail notifications when processing some sender addresses.

IMAP retention settings no longer delete newer messages instead of older ones, folders no longer disappear after a restart on servers using compression, and namespace root folders are no longer missing or given incorrect permissions.

Undo is no longer disabled after deleting messages, dragging multiple selected folders now moves all of them, renaming or moving folders no longer removes them from saved searches, and Thunderbird now warns before repairing folders with offline message storage.

POP3 and news messages with LF line endings are no longer parsed incorrectly, Edit as New Message now works for some news messages, and empty message filter conditions no longer cause incorrect matches. The News Reader and Feed Reader also got various improvements.

On the interface side, Mozilla Thunderbird 160 improves the macOS Dock badge to no longer omit unread counts with multiple accounts, improves the Windows system tray icon to update when new mail arrives, brings back the option to create a mailing list, and updates toolbar defaults to no longer close the customization dialog.

Composing sees fixes too, with the spelling dictionary menu no longer empty in the Subject field, tabbing from the Subject field now moving focus to the message body instead of the header divider, and replies to saved messages no longer blocked despite a valid Reply-To address.

On top of all that, account setup got better as Exchange autodiscovery no longer fails when redirected to another email address, Graph account setup now works for tenants without a SharePoint license, and address book setup no longer returns to mail setup when no mail account exists.

Address books and CardDAV also see fixes, with filter conditions now matching messages that have missing addresses, website fields no longer prefixing non-HTTP links with HTTPS, and CardDAV contacts with multiline street addresses no longer appearing empty.

Also, CardDAV contacts are now saved in a format supported by more servers, and photos saved in vCard 3.0 contacts now appear correctly in other clients. Lastly, Delete Event is no longer enabled for read-only calendars in the Today Pane, and attendance options now appear for all recurring event series.

Furthermore, the task list no longer stops updating after toolbar customization, and CalDAV reminders can be dismissed and snoozed again. Some webcal calendar subscriptions are no longer incorrectly blocked, and invalid ICS calendar files are no longer overwritten when events are changed.

Check out the release notes for more details about the changes included in Mozilla Thunderbird 160, which is available for download right now from the official website as binaries for Linux, macOS, and Windows systems. Linux users can also install Thunderbird from their distro’s repositories or from Flathub.

ODC Explorer: a web directory you browse locally over IPFS. No search engine, no gateways, no trackers.

Search engines see every query you type, rank results for their own reasons, and know who asked. I've been building ODC Explorer as an alternative: a desktop client for the Open Domain Catalog, a directory of websites organised like a library and read straight from IPFS.

What it is

The Open Domain Catalog files websites under call numbers, like books on shelves: 1 Reference › 15 Search Engines, 3 Entertainment › 30 Gaming › 300 Web, and so on. You browse the shelves instead of typing queries. The whole catalog is stored as content-addressed blocks on IPFS and published under a single signed IPNS name.

ODC Explorer runs on your own machine. It's a small local web app with its own embedded IPFS peer, written in pure Python.

What it does for your privacy

• No queries to log. There's no search box sending what you're looking for to anyone. You browse a catalog, and the browsing happens on your machine.
• No middleman server. It talks to the IPFS network directly. There's no HTTP gateway, no API backend and no account.
• No third-party requests from the page. No CDNs, no web fonts, no analytics, no cookies. Every page is sent with Content-Security-Policy: default-src 'self', so the browser can't load anything from elsewhere even by mistake.
• No referrers. Links to listed sites open only when you click them, in a new tab, with no referrer.
• Local by default. The web interface listens on 127.0.0.1 only.
• Settings stay in your browser. Your theme, the 18+ switch (adult content is hidden by default) and whether you've seen the donation prompt live in localStorage, never on a server.
• Tamper-evident content. Every block is checked against its content hash and against the catalog spec, and the catalog root is signed. Nobody in the middle can quietly change what you see.

What it does NOT protect you from (please read)

I'd rather be upfront about this than have you find out later:

• IPFS is a peer-to-peer network, not an anonymity network. Peers you fetch from can see your IP address and which blocks you request, and blocks map to catalog categories.
• Your node shares what it reads, publicly. To keep the catalog online, every reader serves the blocks it has fetched and announces them on the IPFS DHT. That means your IP is publicly listed as a provider of the blocks you've read, which can reveal that you use ODC and roughly which shelves you've browsed.
• DNS. To join the network it looks up the standard IPFS bootstrap hostnames through your system resolver, and falls back to public resolvers (1.1.1.1 and 8.8.8.8) if yours fails.
• Router port mapping. It asks your router (UPnP/NAT-PMP) to open a port so other readers can reach you.

If your threat model includes your ISP or network observers knowing you use it, this isn't the tool for that, at least not yet.

Try it

Linux, Python 3.9+, Flask:

git clone https://github.com/ki4jgt/ODC-Explorer.git
cd ODC-Explorer
./install.sh

Or run it from source with ./run.sh --open.

It's early. The catalog is young and the spec is a draft (v0.1), and I've only tested on Linux. but I'm spending most of my nights adding, shifting, updating and ranking sites captured by my web crawler (respects robots.txt and sends a hit to each domain name only once every 30 seconds).

There are adult categories

I'd especially like to hear from privacy folks: which of the caveats above matter most to you?

Repo: https://github.com/ki4jgt/ODC-Explorer

Mozilla has been experimenting a lot with Firefox lately, and a good chunk of that effort has gone into AI. The sidebar can house a chatbot of your choice, and Smart Window has an assistant that lets you pick the AI model.

Luckily, they have stopped tunnel-visioning into AI, and the UX side of the browser has seen some big upgrades.

Containers keep work, shopping, and personal browsing separate; Split View shows two pages side by side in one window; and Vertical Tabs move your tab list into the sidebar.

I believe that these upgrades have made Firefox a much more compelling option when compared to other popular web browsers.

Of course they are not stopping there. Mini Window is the latest addition to that list, which builds on the work done in Picture-in-Picture, the floating video player.

This feature is still being developed. Don't rely on it for any important browsing sessions. Firefox Mini Window

Using Mini Window on Linux with Firefox 160 feels like a beta from the start. It needs a regular browser window with a tab open to work because a standalone mini window is not possible yet.

It comes in two modes. Move full tab sends the whole page into a small window that floats above your other windows, and Move selection lets you draw a box around the part of a page you want and sends only that.

Either way, the moved tab is not available in the main window until you send it back.

A full tab mini window looks like a tiny browser window. The top bar has the page address along with reload, back, forward, send back, and close buttons. Pages adapt to the smaller size as well.

During testing, websites like ours, Wikipedia, and Associated Press were successfully switching to their compact layout.

A selection mini window is more compact and shows just the chosen area under the page address, with a reload button and the same close and send back buttons.

Both kinds can be dragged around and resized. Selection mini windows have some rough edges because they can appear too small and refuse to resize well.

They are still handy for research sessions where you need to check small bits of information without opening more tabs and cluttering the desktop.

Try it Out

Before you get started using Mini Window, you first have to ensure that you are on Firefox 160 or later. To do that, go into the hamburger menu and open "Help and Report." Here, click on "About Firefox" and take note of the version shown in the dialog that opens up.

If you find that an older build of Firefox is installed, then get the latest release from the official website or the official FTP mirror.

Next, you just have to start a normal browsing session with multiple tabs and follow any one of these three approaches to get started:

Add the Mini Window icon to the toolbar.
Right-click a tab and go into "Move Tab."
Right-click the page content and choose Move Section to "Mini Window."

For the toolbar method, right-click the toolbar and open "Customize Toolbar." Find the Mini Window icon in the list and drag it onto the toolbar, then hit "Done." After that, the feature is just one click away on any page.

Firefox 160 released today with some new features.

A new “Mini Window” option lets you move a tab or select a portion of a web page to an always-on-top window, so you can keep an eye on it while browsing. The feature is in beta and Mozilla invite feedback on it.

Mozilla say the feature is “useful when you’re multitasking and need to keep a few sources of information in view at once” – think Picture-in-Picture mode, but to see sections or entire web pages, basically.

Using it is easy. You can right click a tab, mouse into the Move Tab menu and choose Move to Mini Window to punt an entire page to a dedicated floating, resizable and compact window with address bar and navigation buttons that auto-hide.

Or customise the toolbar and add the Mini Window icon. Pressing this on a page gives you the choice of sharing the whole tab or just a portion.

You can also “PiP” part of a page using right-click > Move Section to Mini Window. This prompts you to draw out the section you want to pop out, and then do so.

Picture-in-Picture mode also gets a boost in this update. PiP windows now have a button to adjust playback speed, from 0.25x to 2.0x, depending on the source. The speed button only shows if the player window is large enough to have the button on show, though.

And if you regularly copy words to your clipboard with the intent to search, Firefox’s address bar context menu now reads “Paste and Search” for plain text, with “Paste and Go” reserved for URLs only.

Other changes in Firefox 160:

Drag history entries from the sidebar to the tab strip to open them

Saving pages as PDF makes MathLab content screen-reader friendly

Block websites from asking to handle mailto, etc links

Matroska (MKV) support (with FLAC, MP3 or PCM audio)

WebGL content on macOS now uses Metal graphics API

Smart Window’s Organise Tabs is now available in French

Real-time speech-to-text via SpeechRecognition Web Speech API

Fixes improves visual contrast between domain name and the rest of the address bar, resolve minor text selection and cursor placement quirks using touch-input and nixes some small freezes affecting sign-in on intranet sites with NTLM or Kerberos.

Plus, as ever, a fresh crop of security fixes.

Get Firefox 160

Firefox 160 is free, open-source software. You can download the new release from the Mozilla FTP server or wait for the links to the same builds to appear on the Firefox website from 10 November, 2026.

Existing user? You’ll be updated to the latest version when running the app on Windows, macOS and Linux (binary builds), or via the app store or package repository you originally installed it from.

On Ubuntu? You’ll get an automatic, background update from the Snap Store.

Summary

The office suite market is large, profitable and growing, and this attracts new entrants: low-cost clones, open-core products and, more recently, suites built largely with artificial intelligence. Most of them compete on price and on native support for OOXML, a format whose evolution remains in practice under Microsoft’s control.

When features can be reproduced cheaply, what distinguishes a suite is who governs the document format and the software, and therefore who controls the content. This is the question of digital sovereignty, and its outcome will depend partly on political decisions, and partly on software features.

The 1980s and 1990s

The office suite sector emerged in the 1980s and developed in the 1990s, when Microsoft Office established itself as the leading product, with a market share of over 90% according to Microsoft unofficial statements at their events.

Some may remember the main competitors: Lotus SmartSuite, WordPerfect Office and StarOffice, the ancestor of OpenOffice and LibreOffice. Fewer will recall Anywhere Office, Ability Office, Pro PC Suite 2001 and ThinkFree Office. Ability Office still exists, and ThinkFree Office is now called Hancom Office.

By the end of the century Microsoft Office dominated the sector, while all other products had a barely noticeable market share or had disappeared altogether.

The sector has always been lucrative: the products meet a universal need, while development and sales costs are low relative to volumes, so margins are potentially extremely high. For this reason all the major software vendors tried to enter the market, and the first clones emerged, competing solely on price.

Market presence, however, was just one of the factors contributing to success. Other factors were bundling with the Windows operating system, lock-in through document formats and pricing.

The two decades between 2000 and 2020

Sun Microsystems, which had acquired StarOffice, released its source code in 2000, and OpenOffice.org 1.0 followed in 2002: the first FOSS suite to reach a mass audience. Version 1.0 offered only a glimpse of the suite’s potential, and version 1.1 was usable but still limited. Only version 2.0, released in 2005, made OpenOffice a genuine competitor to the market leader.

For several years the rivalry between the proprietary suite and the FOSS suite played out on two fronts: large migration projects and document formats.

At the time, migrations seemed to signal an irreversible trend, but this proved an illusion. Microsoft deployed all its commercial muscles and started to talk to politicians. Since 2012, the company has been one of the biggest spenders on lobbying in Brussels (based on data from Corporate Europe Observatory and Lobby Facts).

The battle over file formats was most prominent between 2006, when ODF was standardised by ISO/IEC, and 2008, when the proprietary OOXML format was standardised through a process we have already described in a previous blog post and will not revisit here.

In 2010, following Oracle’s acquisition of Sun, the community created The Document Foundation and LibreOffice. In 2011, Oracle was effectively forced to donate the OpenOffice.org source code to the Apache Software Foundation in order to honour a contract – due to expire in 2014 – that IBM had signed with Sun Microsystems, and which allowed it to use the OpenOffice.org source code whilst disregarding the open-source licence.

The format battle then faded into the background, as IBM decided to abandon the ODF advocacy project at OASIS to use the money to fund the development of Apache OpenOffice and fight the growth of LibreOffice. It resurfaced in 2024 with the concept of digital sovereignty and the announcement of several large scale migrations to open source software, such as the German province of Schleswig-Holstein and the Austrian Army.

Between 2010 and 2020 the sector also evolved with the arrival of cloud-based suites, which started a new battle for market share between Microsoft and Google. Given the sector’s renewed growth, a new generation of clones emerged: programs that are almost always limited in functionality, copy the market leader and compete on licence cost.

Some of these clones, in order to disguise their commercial operation, release a basic version under an open-source licence, often modified so as to prevent forking. Such a licence no longer meets the Open Source Definition, and the product is in practice freeware, while the full-featured version is sold separately (the “open core” model).

Naturally, these programs support the OOXML format natively, because they aim at a low-cost replacement, not at migration, that is, a paradigm shift that would give users full control over the software and its content.

By digital sovereignty we mean the ability of a user or institution to control its documents and software: to open documents with any implementation, to fork the code, and to choose where data is hosted and who operates the service.

OOXML is formally an ISO standard, but its reference implementation remain with Microsoft. As long as this is the case, Microsoft retains control over the content: the user saves money, but sacrifices digital sovereignty.

The current situation

The reason for the renewed interest in the office suite market lies in the size of the market itself, which is worth tens of billions of dollars and therefore whets the appetite of software companies. Even a 1% market share is worth a very significant sum, sufficient to justify the investment.

As a reference point, we use public data from the “Office Productivity Software Market Report 2026” by Business Research Company, a US-based market analysis firm. The office productivity software market reached $50.73 billion in 2025 and is expected to grow to $81.83 billion by 2030, at a CAGR (compound annual growth rate) of 10.1%.

We add some figures relating to Microsoft and Google.

Microsoft 365 Commercial generated $102 billion in fiscal year 2026, an increase of 16%. Paid licences for Microsoft 365 Copilot exceeded 30 million by the end of June 2026, which on analyst estimates is about 6 to 7% of the paid commercial user base.

Google Workspace is estimated to have over 3 billion users and over 11 million paying customers. The user figure includes free Gmail accounts, so it is not comparable to Microsoft’s paid subscriptions. Technographic data from 6sense, another US-based market research firm, attributes 50.34% of the office productivity category to Google Workspace and 45.46% to Microsoft 365 (figures are based on corporate domains). Measured in corporate licences and revenue, Microsoft is clearly in the lead.

According to 6sense, 64% of organisations use both suites. This figure is only indicative, but it points to an increasingly widespread overlap between office suites, which is not limited to Microsoft 365 and Google Workspace. For LibreOffice, based on hands-on experience with large organizations, we estimate that 50% of users also use another office suite, depending on their needs.

We are therefore talking about a market of enormous economic value, and these figures refer almost exclusively to licences, not to the ecosystem. If we include value added consultancy services, which are a necessary component of every implementation in public bodies and companies, the total is likely to be significantly higher.

Analysts do not provide precise data on this, so we rely on a rough estimate based on experience: value-added services are worth about 25% of the value of licences. On the analysts’ forecast, the 2030 market would then be worth about $102 billion ($81.83 billion plus 25%). One percentage point of market share is therefore worth $1 billion a year to a commercial vendor.

This figure does not accrue to free software, but it explains the incentive for new entrants. It also explains the emergence of a new type of office suite: so-called “clones” developed largely with artificial intelligence. At present we remain extremely cautious about the use of artificial intelligence in software development, but we recognise that views differ, and we are monitoring the evolution of these applications closely.

The strategic consequence does not depend on that debate: if the cost of reproducing a feature set collapses, features stop being the main barrier to entry. What remains is the governance of the format and of the code, the strength of the community, and the long-term maintenance of the software.

A glimpse into the future of office suites

Over the last twenty years we have read contradictory forecasts: the total disappearance of the sector, or only of the desktop suite, and the opposite, a strong growth driven by announcements of new operating systems, software paradigms or hardware platforms.

One thing is certain: the office suite market has gone through periods of slight contraction, probably normal fluctuations, but overall it has grown, and in our opinion it will continue growing for the foreseeable future.

Today, the installed base consists of around 2 billion desktop and laptop computers, based on active devices reported by manufacturers, plus devices that nobody counts because they are second- or third-hand, found mainly in poorer countries that are overlooked by technology usage statistics.

The integration of AI assistants into the suites adds a further dimension. With more than 30 million paid Copilot seats, Microsoft has shown that there is a market for it.

Overall, this is an extremely interesting potential market, where there is room for all types of office suites, desktop and cloud-based, and for all development strategies. On the other hand, success is not just related to number of users as there are market dynamics which depend on political decisions that go beyond the value of the software itself.

However, the location where documents are processed – whether locally or in a provider’s cloud – and the ability of artificial intelligence tools to read and write in open formats remain issues linked to the question of sovereignty. We have already expressed our views on these matters in several blog posts: nothing should interfere with the user’s right to decide on their own content.

LibreOffice will continue to be a key player. Downloads and donations grew substantially in 2026 (as of 31 October, downloads +26% and donations +44 in term of numbers), which reflects a steady improvement in the quality of the software and in the reputation of the project.

The practical conclusion is that LibreOffice and ODF compete on a different axis from the clones: not feature parity at a lower price, but open governance of the format and of the code.

cross-posted from: https://lemmy.ml/post/55185832

Hi everyone,

I'm looking for recommendations on free (or freemium) AI assistants that meet these criteria:

✅ Strong capabilities – Can handle complex questions and research. ✅ Privacy-respecting – Doesn't train on user data, preferably E2E encrypted. ✅ Ethical stance – Not complicit in oppression or human rights violations (Palestine, sudan, uygur, etc). ✅ Not on BDS list – Companies that aren't supporting or profiting from occupation.

Which AI tools have you found that respect both privacy AND human rights?

I'd really appreciate honest recommendations and experiences. Trying to find tools that align with my values without sacrificing functionality.

Thanks in advance! 🤝

I'm moving away from proprietary apps and want to find open-source games on Android that are genuinely good, not just time-killers or kids' titles.

My criteria:

• Modern feel and polished experience — something that feels like a real game, not a tech demo

• Made for adults: deep gameplay, challenge, real progression (any genre welcome — strategy, roguelike, RPG, racing, puzzle...)

I trust actual players over AI-generated lists, so: what open-source game on Android gave you the best experience, and why?

I've some questions about Ghidra released by NSA on Github. And research about it then saw a ycombinator thread for it. That answer was clever and funny.

As title marked, you really okay for just "open source" to trust it?

Can't escape AI slop projects from meat proxies man. Every single open source project smells like Claude Code recently. Sad times.

Grafana Labs has released Grafana 13.3, the latest update to its open-source observability and data visualization platform.

One of the most useful additions is cross-dashboard variables, which allow administrators to define a variable once and reuse it across multiple dashboards instead of keeping separate copies. They can be configured globally, making them available to every dashboard in an organization or restricted to dashboards within a specific folder.

The feature is currently in public preview across all Grafana editions. Self-hosted installations can enable it using the grafana.dashboardGlobalVariables feature toggle.

Grafana 13.3 also introduces the first phase of the platform’s largest visual refresh since Grafana 7. The updated interface includes redesigned dark and light themes, revised typography, softer borders, rounded corners, and new buttons, menus, and input controls.

Another addition is Notebooks, a new way to document and share investigations. Users can combine dashboard panels, queries from Explore, Grafana Assistant findings, and observations in a single editable document.

This makes it possible to preserve steps taken during troubleshooting, prepare incident reviews, and share findings with colleagues without relying on separate screenshots or documents. Notebooks can be saved, searched, edited, shared, and exported.

Grafana Assistant also gains dashboard planning capabilities. Instead of immediately generating a dashboard from a text prompt, the Assistant is able to first propose its structure, including panels, visualization types, variables, and layout. Users can review a read-only preview, request changes, and approve the final dashboard before it is created.

Additionally, the ability to undo changes made by Grafana Assistant is now generally available. A single undo action can revert modifications to multiple panels made during the same Assistant request.

On the visualization side, panel thresholds now support dashboard variables, allowing threshold values to be adjusted without manually editing individual panels. The Sort by transformation supports multiple sorting fields, while panel descriptions can be displayed as subtitles directly beneath panel titles.

Cross-filtering support has also been extended to Histogram, State timeline, and Status History visualizations. Meanwhile, panel-specific time settings and comparisons are now generally available, letting users compare different periods or override a panel’s time range without entering dashboard edit mode.

The Text visualization also receives a public preview update that allows query data to populate tables, cards, lists, and status summaries rather than limiting users to static content.

For alerting, Grafana 13.3 launches a public preview option to import existing Prometheus or Mimir Alertmanager configurations into Grafana Alerting. This includes notification routing and related settings, lessening the need to recreate them manually when migrating alert rules.

Finally, Grafana Cloud and Enterprise users gain generally available custom headers and footers for PDF reports, while administrators should review a role-management behavior change that allows authorized role managers to revoke permissions they do not personally hold.

For more information, see the release announcement and the Grafana 13.3 documentation.

I built this because I didn't want to upload contracts to iLovePDF to merge or redact them. Everything runs client-side: edit, sign, merge, split, compress, OCR (Tesseract), redact, PDF to Word. There's no backend, and the CSP only allows the page's own origin. Redaction re-renders pages so the text is actually gone. There's also a Docker image and an offline Windows app.

https://tools.nyxiontech.com/ https://github.com/jurecki007/nyxiontech-tools

Feedback welcome, especially on redaction edge cases.

The title is pretty self explanatory, but will opensource software become less and less safe compared to "big company software", as big companies gain access to more and more advanced AI to test for their vulnerabilities? Or even malicious actors gaining access to more advanced AI, able to break into opensource software made by a small team easier? Should a privacy oriented person then stay away from such software?

And, yes ... I'm tired of AI, AI, and more AI.

cross-posted from: https://leminal.space/post/41672675

Sable finally releases their iPhone app from the Testflight beta into the regular app store! Big news for iPhone people (or iPhone haters who have friends with iPhones). If you have an iPhone, how is the app?

I just tried pdf craft on fdroid and really liked it, but its on beta and only 2 versions released.

Is it going to be well maintained and become an alternative or just stay unstable ai dlop? It had more stars on github than some other pdf viewers.

Whats your take on that. I am excited to see some decent apps on linux. Especially for .appimage and launching instantly unlike photoshop.