Imagine modified version of this game having local AI voice recognition and you would have to give instructions to the air traffic over "radio" using callsigns and everything. Just like the real tower.
World would be in a better place if GIMP hadn't ever existed, the existence of GIMP is part of why we don't have an actual viable alternative. Constant claims of "good enough", 20+ years to implement adjustment layers after dismissing their value for many years a team that doesn't really care at all about it.
If GIMP had never existed maybe the Blender team or someone else who actually has passion for the problem would have made the Linux image editor and we'd be in such a better place.
Krita, not GIMP, has been the FOSS flagship 2D bitmap editor for many years, the way Blender is for 3D. Can't remember when I last used GIMP for anything.
I share the sentiment, a lot of open source alternatives can't decide whether they want to be a replacement, a professional tool, a beginner user-friendly tool or just a playground for software devs. GIMP is awkwardly in the middle and has been stuck for a long time, it never met expectations, but became the default answer to any questions involving photoshop alternatives.
I think the challenge is that there are so many expectations. From reading and responding to issue reports, it seems like a group of people expect us to be Photoshop and another group expects us to be MS Paint - and making one group happy (non-destructive editing, for instance) annoys the other group. :)
GIMP is meets a lot of people's needs though (though we can always do that better). I'm in the process of transcribing interviews by GIMP's maintainer from professional artists who use GIMP and other free/libre software in their workflows, and it's really interesting to see what they're able to do.
> it seems like a group of people expect us to be Photoshop and another group expects us to be MS Paint - and making one group happy (non-destructive editing, for instance) annoys the other group
This feels like it would behoove the project to pick a lane and tell the users which one of these it is supposed to be. You have a worse experience for all by trying to keep both camps happy, and also ceding one of these verticals would open up mindshare for another open-source project to step in and cover that instead
We do - we state exactly what GIMP is and what we aim for. That doesn't stop people from having their own conceptions.
The "more like MS Paint" group tends to be longtime users who often prefer the destructive editing approach of GIMP 2. We try to respect people who currently use the software, while also trying to implement new features as intended on the roadmap.
Given the number of great open source art programs today, I don't think we're keeping anyone from doing anything. :)
> We do - we state exactly what GIMP is and what we aim for
Respectfully, I just re-read the gimp.org homepage, about page, and FAQ. The only relevant passage I found is the FAQ where it states that GIMP is not trying to be a photoshop replacement (but that people regularly misinterpret it as such).
The first section after the recent news on the home pages says "High Quality Photo Manipulation: GIMP provides the tools needed for high quality image manipulation. From retouching to restoring to creative composites, the only limit is your imagination."
That seems clear enough to me about our focus, though one thing I've learned since I've started contributing is that whatever you think is clear enough, probably isn't!
(Hopefully that doesn't come across as sarcastic - I mean it sincerely. I've helped out with writing news posts and been amazed at seeing how people interpret sections I thought were perfectly clear. It's been a learning experience!)
For what it's worth, there's been a lot of turnover in developers in the last 20 years. I've read some comments on older issue reports, and it made me understand why people think GIMP developers are abrasive (even though that hasn't been my experience with the current developers)
I'll say that I got a lot of encouragement and help when I started working on non-destructive editing - there was definitely no one on the team dismissing it (except for some users, oddly enough)
> World would be in a better place if GIMP hadn't ever existed, the existence of GIMP is part of why we don't have an actual viable alternative.
Wow, that's a wild statement. I think you might be right. Though GIMP was responsible for GTK, which is now a critical part of most linux systems. I wonder where we'd be if not for GTK? Qt everywhere maybe?
There's good reason why people are annoyed with GIMP/GIMP developers.
For example, I used to use GIMP and became quite expert at it and would often swap between it and Photoshop. That changed when GIMP's developers removed the Fade feature (similar functionality as in Photoshop). The result is that they turned a perfectly functional program into a clunky mess that was ergonomically horrible to use. Using it was now like going from a modern auto gearbox back to a clunky manual.
Their rationale was that fading was better done by layers and such. Technically that's likely so (depending on what one's doing) but for the rest of us who were happy with the Photoshop-like Fade GIMP suddenly became useless.
GIMP's developers are more interested in some strange notion of technical purity than providing good ergonomic software that ordinary users can use. In short, GIMP's just a play toy for them, benefitting the opensource world isn't on their horizon.
Sure, as GIMP's developers they have the right to fuck up their software, what they don't have the right to do is fuck up bona fide users who've spent a large investment in learning the product by essentially making the product unusable.
Keep away from GIMP, as others have said there are much better alternatives now available.
Hi! I dug through issue report archives to try and learn more about Fade. From what I understand (https://gitlab.gnome.org/GNOME/gimp/-/work_items/3558#note_7...), it seems like it was reimplemented as "Blending Modes" directly in the filters themselves.
If you're willing to test, is that comment correct - do the blending modes for filters work for you like Fade use to? If not, I'd be interested in learning more about what is lacking in the current version. Thanks!
GIMP is very good if you never touch photoshop. It seems using photoshop for any significant amount of time ties you to that software, much like how using emacs for any amount of time ties you to emacs
Unicorn is more like a fork of Qemu than something that depends on it. So what they're saying here is, they reimplemented the Unicorn feature-set (which dramatically diverges from the Qemu feature-set) from scratch based on a newer Qemu branch.
7+ hours into this and still no mention on archlinux.org webpage nor on aur.archlinux.org. Why??? AUR should have been blocked until user takes action to prove he knows about this.
Eg. change AUR API URL slightly so yay/yaourt users need to look up what is going on. New API should have infrastructure for informing users and making sure they've read the message before proceeding. Especially when they're not even sure that all malware was found.
Also there should be database of revoked/compromised AUR commits and there should be mechanism to warn user if they had it installed.
There are lots of things on AUR that I absolutely won't install, and I don't really think spamming the mailing list with all of them is the best policy.
And while I don't exactly hate the idea of warning users who installed a malicious package... it turns out that's not a particularly feasible thing to implement, because AUR doesn't have the kind of install tracking that's present in the commercial tools... ex - how exactly are they supposed to know who installed a package? AUR is basically just a phonebook of package locations, and they don't require any login/auth info.
No it shouldn't. You don't break everyone's workflow just because some people refuse to take basic security advise seriously.
> New API should have infrastructure for informing users and making sure they've read the message before proceeding.
How would that even work? AUR packages are just git repos, everything that AUR helpers are doing or not doing is not under the control of the arch maintainers.
Are you seriously asking how would sharing short text notes over internet work?
If you need to be 100% git-centric, you can have git repo for messages. Client will then remember last commit displayed to user and refuse to continue unless latest message was displayed.
BTW some AUR clients displayed ArchLinux RSS feed before... Too sad the issue is not even mentioned in the RSS feed...
There's no shortage in ideas of how to make the AUR easier to moderate. A "quarantine button", an invite system, a request system for adoption similiar to how orphan requests work, code review attestations similiar to cargo-crev, pacing controls similiar to those in discourse.
There is a shortage however of people skilled enough to implement them (with available time to do so).
What we also don't have a shortage of is angry people in comment sections.
People have all right to be angry if basic responsible adult things like "quarantine the server spreading large amounts of malware" do not happen within the reasonable timespan that passed.
Not even a news. A hint. Nothing. Radio silence.
___
There is a house. It is currently on fire (since over 24h).
So far, people have talked about how, conceptually, house fires are bad.
You can still enter the house just fine.
People saying "hey what about locking the door to not trap more people in it" are being shunned for the crime of breaking someones workflow.
The owner of said house is nowhere to be seen.
Passerbys stating "oh my god that house is on fire! get water!" are either ignored or reminded that there is no problem and they should move along.
___
Idk man. I don't think any of this is real.
And I don't even use arch, lol. And after this thing exposed the institutional rot, neither should you or really anyone.
Unless you like ending up locked inside a house fire. I guess they provide warmth in the cold harsh reality of the 2026 internet.
The server actually hosting the rootkit executable is npmjs.com, run by a for-profit company, and they still take about 24h to act on our reports, while reported AUR packages have been processed in about 1-2h by people that work unrelated dayjobs on top of this, to self-subsidize their open source work.
Sorry you're displeased with us not writing blogposts faster on top of all this. The situation is already exhausting enough without people like you.
Look, man, I understand all that, but pulling the plug is something that takes at most 90s. Let's say 300s to add the "Warning: There is an attack. We're working on it. Systems are down for now" box
After that, you have all the time in the world to prioritize dayjobs etc.
It's not about dropping everything and fixing the root cause. It's just about taking stuff offline so that the immediate danger is mitigated.
That is not too much to ask.
It's not "people like me" having weird opinions there.
Shut it down. Then fix whenever there is time to do so.
___
But hey. Finally a statement from someone with some amount of position in the org I guess?
I wouldn't want to be in your shoes for sure, but that's beside the point. Nothing here is unreasonable other than the ostrich-style incident response lack-of-process.
And I don't mean stupid corporate process. I mean "common sense adults are in the room" process. Throw waterbucket at burning server reflex.
___
I mean I can see that your userbase absolutely sucks and could imagine that one would be scared of getting roasted for "interrupting their workflow", but this is not the way.
Their workflow is irrelevant.
As said, I'm all here for maintainer empathy, but only after the fire is put out first.
___
Anyway, "institutional rot" is not an insult but a diagnosis. I'd love to be proven wrong on that, but I don't see it.
And trust me, I do know first hand how thankless this non-job is and what hell one goes through.
I have skin in the game. I just don't have a horse in the arch race.
"Hey, let's take down all of npm, because there's a package that installs something malicious, and some people may install it without reviewing it first. The thousands of other people relying on this service can wait."
Do you not realize how crazy of an request that is?
You do realize that the people relying on the service also get served wormable malware, right?
The service is already disrupted.
It is not that a disruption could be _avoided_. The discussion makes no sense.
___
Hell, even if I would be completely wrong in that assessment (not sure how, but let's assume that's the case)
You can still put up a banner. "Hey, FYI: We're under attack".
If not right away, then at the very least the moment media reports on it. And if media reported wrong, the banner says "Don't worry people. Media got it wrong."
> You do realize that the people relying on the service also get served malware, right? The service is already disrupted.
Huh? No they don't. I'm not sure what part of the attack your misunderstood, but most people are going to be completely unaffected by this. None of the infrastructure or anything like that got compromised. I updated my AUR packages 2 hours ago, and didn't get served any malware.
Again, there's probably some kind of malware on npmjs at any given time. You don't just shutdown the entire server because of that, that's madness.
As said, I don't think discussing this makes sense, as our perceptions of reality seem to be fundamentally incompatible.
But regardless, let's try a different perspective: PR/Public perception
The moment multiple well-known media outlets start publishing a story stating that "stuff is happening", the situation changes.
At that point, regardless of how you personally feel about this, the narrative is "people are affected".
This forces your hand.
Which is not(!) to say that it would mean that you would have to accept what the media says. The media could be full of shit talking nonsense. *But* at that point, you need to either correct them, or do the correct action as per their narrative.
____
I don't think that PR/Public perception is the main relevant perspective here - in fact I'm just mentioning it, because all the much stronger much more technical arguments seem to be lost on you.
But there you go.
Your argument makes no sense, because "ackschually I'm unaffected" is just russian roulette survivorship bias, but even if it _would_ make sense, the system logic of the next outer layer cans that take.
____
Anyway. The fact that people (not just you, mind you) are so busy playing "well ackschually" while there is an active wormable attack going on is precisely why I said "institutional rot". Although, I think I need to correct that to "cultural rot".
Priorities are broken. The wrong metrics are being optimized here.
I would love to hear more about this from the actual Arch maintainers instead of random users with opinions, but.. not sure where that communication would be. I didn't find any. And I did go looking!
Why are you still misunderstanding when other replies already explained?
AUR has always been AT YOUR OWN RISK.
To use your analogy, the house is an underwater cave with a big scary sign warning you that you will die, you go in without training, and blame the cave for not being safe.
You seem confused about how the AUR works. There is no "client" like you're talking about that can show the user anything.
There are AUR helpers, but these are completely unaffiliated with arch and the people running the AUR. The canonical, recommended way of installing arch packages is cloning a git repo, reading through the sources and then building it with makepkg. There is no client there that could show the user anything.
how comes gitlab shows custom messages to my plain old git client then?
for example when you rename gitlab repository, or push to new branch, gitlab injects custom text that you can see. Eg. with new URL or where you can create merge request on web, etc...
Even people who do read the content of every AUR package they install could use a helpful heads up and some detail in the new threat they should be looking for.
If a package is compromised, I think most people would prefer their workflow be broken than risk installing that package.
Are you paying maintainers for that, or are you just blindly demanding things from a piece of software maintained by volunteers before saying iT'S sO uNprOfEsSiOnAL ?
I think a notice on the front page of the AUR would make sense here. IMHO, a blurb on the Arch homepage with a link to a notice on the AUR page would also help.
If you don't want to list all known effected packages, at least recommend the official position that anyone using a AUR package should be reading every file of every package they use.
IMO if numbers on Socket.dev can be trusted, then impact seems rather small (luckily). It also makes sense — I know some packages from the affected list, they're heavily outdated and their upstreams aren't maintained anymore.
Other than this — I don't know how many there are affected people in total, but AUR team probably has an exact number. I am also sure, they're doing their best to handle it accordingly to the impact.
It is a bit disappointing to not see any mention anywhere official.
I know its all volunteer work and extremely not fun at the moment, but it feels weird to not even have some sticky-no-reply on the AUR sub forum with a list of compromised packages. You have to instead try and scrape them up from around threads like here or reddit.
This, as a generality. There are plenty of multi-billion-dollar Wall Street firms doing algorithmic trading. Your prospects for being smarter or faster than them are very poor.
I've heard of this working in other kinds of markets, where if you can identify the traders who consistently beat the market, and you can emulate them with precise timing, then you can beat the market too.
These were before news reports that came out with the scoop before any press conference. How would you know that some big news scoop is going to drop? You'd have to jump on every futures drop.
> At 3:40 AM ET today, nearly 10,000 contracts worth of crude oil shorts were taken without any major news... At 4:50 AM ET, just 70 minutes later, Axios reported that the US is “close” to a “memorandum of understanding” to end the Iran War.
Depends on what your brokerage allows, see timestamps.
Civilization will be effected the same way anyway, why not make a buck of it? But you wouldn't be able to anyway because some quant's ml model would have already sucked every dollar out of the opportunity two milliseconds after the insider executed the trade
Psychopaths and sociopaths come from all types of backgrounds. One things for sure, they all tend to gravitate towards power and exploitation of people without remorse. C suite and founders are far from immune from this...
i don't think phones are THAT watertight... they're not tested for long term submersion. usualy they don't even guarantee waterproof rating for more than first two years or when there are signs of wear. should work with some non-conductive oil or fluorintert tho...
reply