It’s not a fine standard. Microsoft filed it with the express goal of preventing ODF from becoming the prevailing document standard, not with the goal of documenting OOXML. It’s intentionally obfuscated and kept different from MS Office. It’s not a standard it’s a red herring.
The former.
Evil billionaires are more of a 2020’s thing.
Euro-Office and OnlyOffice don’t “only support” OOXML. Where did you get that idea?
From the fact ODF “support” is an awkward import/export function. It’s not a first class format.
The code is open so where do you suppose all this supposed spyware is hiding?
On their live service. They don’t publish the spyware with the code they choose to open, obviously. 😃
Here’s the AUR recipe (PKGBUILD file) for a random package:
https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=nautilus-git
This is a standard format for the recipe. It’s Bash code used to define variables and functions.
You’ll notice there’s no place to sneak in a Python script. There is some brief Bash code in the functions but any major stuff would stand out immediately. So would an command that fetches a malware zip from a weird URL.
Meanwhile, if you add node or python to the dependencies, and then run a command that installs a perfectly legit npm or pip module, nobody would bat an eye. It’s impossible to figure out that among the many upstream dependencies of that module there might be one that was subverted to discreetly run malware.
AUR is a very bad idea tbh and should not be used by the faint of heart. It makes it entirely too easy to pull this kind of crap.
AUR “packages” are just a recipe file that runs some commands that sources packages from somewhere else and builds them then puts them in the format required by the AUR package manager.
Normally it’s a source tarball downloaded directly from the project’s Git repo. But it can also fetch and install a binary package (for closed source software). Or it can install Node modules, or Python modules etc.
Point is, you can’t inject a script directly in AUR itself. You could add the malicious code directly to the recipe file but it would be obvious. You could also download a zip with the malware directly, but it would also be obvious.
So what they do is add the malware to modules published on another platform, and they’re downloaded indirectly, as a dependency of the Nth grade.
It’s very hard to detect, you can’t really notice this kind of attack with a glance at the recipe.
Because the NPM is a complete mess and it’s super easy to exploit for supply-chain attacks by sneaking malware into one of the billion dependencies required by most popular packages.
OnlyOffice is not related to OpenOffice. OnlyOffice is developed by Ascensio System which has labored to obscure their Russian backing.
Whereas StarOffice/OpenOffice/LibreOffice is a product officially developed by Sun, then donated to the Apache Foundation, then forked as LibreOffice governed by The Document Foundation.
https://en.wikipedia.org/wiki/OpenOffice.org#Forks_and_derivative_software
I got several jobs through it. It’s good place for its core goal, which is to be found and to look for posted openings.
All the other crap is pointless: posts, discussions, trivia, games etc.
The identity verification is a mixed bag.
It’s mostly pointless in the EU because each country has a government body that tracks each ongoing employment contract for the purpose of tax, insurance, credit, work laws, regulations etc. So you really cannot misrepresent yourself.
But there are shenanigans like fake profiles made by bots, or someone putting up a profile pretending to be someone else who may or may not be already on LinkedIn etc. Not sure how you can weed those out without some sort of identity check.
There are however better ways to go about it. For example the EU countries have been (slowly) coming up with benign forms of identity checks.
My country has an online identity platform ran by the government directly, where citizens can enroll voluntarily and use it to perform federated login to other government platforms, and can also see and approve what personal details are shared with those platforms when they do. It’s a completely voluntary alternative to the good ol’ way of making a different account with every government website. (I’m still floored they had the insight to make something so nice.)
So anyway it hasn’t been opened to commercial entities but I could see it be safely used in the future to confirm to a company like LinkedIn that you are indeed a live citizen and nothing else. Just a live API “yes” response with a hash of the citizen ID number; no pics, no data to store.
I really don’t get this latest series if tantrums from LibreOffice/The Document Foundation. They are attacking every other up-and-coming open source document project.
They are not. They are pointing out how innefectual the Euro-Office setup is in the context of EU Digital Sovereignty. If the EU wants to free its document stack from dependencies it makes no sense that they’d pick a product that only supports OOXML, which is fully controlled by Microsoft. (And riddled with Russian spyware, but that’s the icing on the cake.)
And speaking of OOXML, let’s get some things straight:
It is an open standard since 2006.
It has never been truly open. It was demonstrated back in 2006 and time and time again that Microsoft doesn’t publish the full spec and that they obfuscate what they do publish. It is impossible to fully support what comes out of the latest MS Office in an open manner.
It is a recognized ISO standard, just like ODF. (ISO/IEC 29500)
Yes, because back in 2006 Microsoft asked their vendors in all ISO-voting countries to join the ISO committees and vote in favor of OOXML. A practice which the ISO was completely unprepared for, but also did absolutely nothing to correct.
ISO/IEC 29500 is a joke and choosing to enforce as an EU-wide standard is a joke.
LibreOffice also supports OOXML and allows users to set it as default.
Which is why LibreOffice, or a similar product that supports both OOXML and ODF should have been chosen.
It is already the de-facto standard
That has to be taken into account for migration but it doesn’t mean we have to keep being tied to Microsoft.
All hardware is the same, I’m trying to upgrade from a Ryzen 3100 so everything should be compatible. Both old and new CPU have a 65W TDP.
I’m on Manjaro, everything is up to date, kernel is 6.12.17.
Memory runs at 2133 MHz, same as for the other CPU. I usually don’t tweak BIOS much if at all from the default settings, just change the boot drive and stuff like “don’t show full logo at startup”.
I’ve add some voltage readings in the post and answered some other posts here.
Ironically, if Graphene would succeed, it would lead to a system that’s every bit as locked down as a manufacturer’s Android. GrapheneOS would also not allow you to have root etc.
IMO Graphene wants a place at the big player table. They’re not in it for user freedoms.
HTTPS is privacy in transit. It has no say into what’s being downloaded.