p2pchat: looking for experienced devs to help build an offline messenger for the protests in india

We're working on p2pchat, an open-source phone-to-phone messaging app for keeping people in contact when mobile internet is cut off.

There are mass protests led by the youth that are happening now in India, and internet shutdowns are already part of the response. Mobile internet was suspended around Jantar Mantar in Delhi on 2 October as people gathered to protest. Internet Society's shutdown record documents it. Losing connectivity makes it harder to find people, coordinate and share information at the time you need to.

That's why we used "vibecoding" to get a prototype together quickly. We started from an existing open-source Bluetooth messaging app and used AI-assisted coding to build on it. We wanted people to have actual code to inspect and test while these protests are happening. Now we need experienced human developers to review the code and help with the parts that handle people's messages and identities.

The current prototype uses Bluetooth Low Energy for nearby messaging. with relay explicitly enabled, a phone can carry encrypted packets and pass them to another phone it encounters later. That's the idea behind messages hopping between devices. delivery still depends on phones meeting, and reliable background operation needs physical-device testing.

There are private chats, group messaging, forums/channels and public broadcast screens. the encryption construction is custom and unaudited. Tor isn't implemented yet. public broadcasts are public, including to hostile participants.

We need help with:

• reviewing the existing E2EE, identity verification, key storage and forward-secrecy limits, and deciding what should be replaced with a maintained, reviewed protocol.
• implementing native Tor transport for internet messaging, with peer onion addresses bound to verified contacts and protection against connections accidentally bypassing Tor.
• auditing relay hopping: consent, duplicate handling, expiry, storage limits, malicious packets and what forwarding behaviour reveals about users. we also need real Android/iOS background and multi-phone tests.
• reviewing and implementing the sensitive parts of forums and public broadcasts: sender authentication, impersonation, spam and abuse handling, and keeping private messages out of public internet gateways.

This is pre-alpha and has not had an independent security audit. please don't rely on it for sensitive protest communications yet. The urgency is why we're asking for help now; the prototype still needs that review before anyone should trust it in the field.

repo: lindisboy/p2pchat

If you've worked on secure messaging, Tor or mobile networking, a focused review of one part of the code would help. The repo has the threat model and implementation notes, including known limits and unfinished work. Please follow the security policy when reporting vulnerabilities.

To understand the seriousness and the urgency and forgive the "AI slop" approach, please do read up and follow what is happening in India. There are sickening scenes unfolding as fascistic state forces violently crack down on the youth and middle class led protests for the resignation of the Chief Election Commissioner of India, though many especially the lawyers are even calling for legal action including improsenment against the entire far right BJP/RSS government and many of the police force that is unleashing terrible police brutality. Even then, the determination of the people is not relenting and protests will continue to grow. Please follow these pages for more updates

https://www.instagram.com/onlytheoreticallyhot https://www.instagram.com/harshdelhise https://www.instagram.com/kahaniistaan https://www.instagram.com/vibhugroverr https://www.instagram.com/cockroachjantaparty https://www.instagram.com/neowsibora https://www.instagram.com/meghnads/ https://www.instagram.com/watchthestate/

For more information surrounding the specific government policies that triggered this unrest: https://youngpoliticalworkers.substack.com/p/vote-chori-sir-and-current-outburst

This is an urgent call for help! I am reaching out to this community because I do not wish to have many eyes on this beyond the people who can really understand why this is needed. Though many of us are working towards a socialist revolution in line with what Indian revolutionary Bhagat Singh talks about in his important final letter before being martyred - "To Young Political Workers" (https://www.marxists.org/archive/bhagat-singh/1931/02/02.htm) - we are also forming a United front against the fascist BJP government.

I understand there are many communists and socialists here and I believe we can come together and work towards something meaningful, which maybe even if its not necessary in this wave of protests, could be of paramount importance in the future.

Lastly... NOTE: I want to caution that there have been multiple instances of the "BJP IT Cell" and pro-government people doxxing the identities of people who provide tools and support for the protests. Something like this leaking could also become a big media controversy on how these protesters get "foreign support". So this post will be removed soon (especially once helpful volunteers are found) for safety purposes to prevent Indian state actors from discovering who is working on this project.

We require all the guidance and support we can get! Even if you cannot support on the tech side of things, we would greatly appreciate material monetary support towards building a revolution in India!

Thank you

I've been running OpenAltFinder for almost 16 months now, and received quite a bit of positive feedback. The directory has also grown substantially. Over the last few months I've been receiving more and more submissions that were AI-assisted/vibe-coded.

Personally I'm a bit skeptical (both quality wise, and longevity wise), but I also want to give everyone a chance to showcase what they've build. I had already added an "AI-assisted" label, but right now the majority of submissions include that label.

To counter this, I decided to build an AI-free version of it over at: https://noai.openaltfinder.com/, inspired by duckduckgo.

I built an open-source directory of 3,300+ AI agent tools across 32 categories (frameworks, coding agents, MCP servers, memory systems, RAG, evals...), all ranked by GitHub stars. A bot rescans trending sources every 5 hours, checks new repos against a quality bar (1,000+ stars, actively maintained), and prunes dead links automatically. Site: https://tayyabimam1.github.io/awesome-ai-agent-stack/ Repo: https://github.com/tayyabimam1/awesome-ai-agent-stack Free forever, open source. Feedback welcome!

A self-hostable offline audio transcription app. State-of-the-art AI models, running entirely on your machine.

17 Contibutors including Mr. Gipity Claud

https://github.com/rishikanthc/scriberr

NOTES FROM DEVELOPER

Apologies for the radio silence.. I did find a new job, but had to move across the country for it. So between multiple moves, settling down into the new job and just recuperating from all the stress and anxiety I went through during the process made me want to take some time off.. So I was taking it easy, spending time with my family and didn't really have a lot of free time nor the mindset to work on my personal projects.. That said, things are good now and boredom has been creeping up and I have been itching to get back into my personal projects.. I still need to setup my self-hosting server which I have been procrastinating for a while now xD

TLDR the project isn't abandoned. I'll be starting development again this week :) Look like a lot of advancements and developments have happened in this domain in the past few months and I could actually use your input and thoughts on something. Please check #485 and please do drop your thoughts and comments. I would like to get the communities input on this one to decide next steps. Also, thanks for all the love and support ! Y'all are awesome.

Why I built this

The inspiration for Scriberr was born out of privacy paranoia and not wanting to pay for subscription. About a year ago, I purchased a Plaud Note for recording voice memos. I loved the device itself; the form factor, microphone quality, and workflow were excellent.

However, transcription was done on their cloud servers. As someone who is paranoid about privacy I wasn't comfortable with uploading my recordings to a third party provider. Moreover I was hit with subscription costs: $100 a year for 20 hours of transcription per month, or $240 a year for unlimited access. As an avid self-hoster with a background in ML and AI, it felt wrong to pay such a premium for a service I knew I could engineer myself.

I decided to build Scriberr to bridge that gap, creating a powerful, private, and free alternative for everyone.

Hey, total noob here. I've been free of Windows and using Mint for a whooping 2 days. It's been great. I work on text docs 7 hours a day. Libre Office didn't mesh with Mint, and I'm using OnlyOffice. It's perfect for my needs. BUT.

Back on Word, I had Autocorrect customized with shortcuts for phrases I use a lot. It's a feature I absolutely need. I can't find it in OnlyOffice. For maths, yes. For text, nothing.
There must be a plugin, a script (not sure what scripts are, tbh), something.

I'm not talking about autocomplete (I don't want it to list words I might be typing, I want it to insert "Hello world" as soon as I type "hh" or whatever.)

Please?

Brandon Thomas, developer of ArtCraft, a suite of open-source creative tools meant to replicate Adobe applications for free, has now announced apps to replace Microsoft Office tools such as Excel, PowerPoint, and Word, respectively, named GridCraft, DeckCraft, and WordCraft, that are created with Claude. Thomas has shared his new clones to ArtCraft GitHub, making them free for all to download.

Not everything mentioned is actually open source, but a decent amount is.

The Document Foundation, the non-profit steering the development of LibreOffice, has unveiled a new logo.

The change means that, for the first time since its inception in 2010, TDF no longer shares the same logotype and wordmark as LibreOffice.

“The Document Foundation” is now the sole wordmark, written in a different font, Inter, and a refreshed set of brand colours complement it.

Unveiling the design, TDF’s Italo Vignoli made the case for a decoupling of the two brands, noting “the foundation speaks as an institution, not as a software project” whose work “extends well beyond the product” that it’s known for, i.e. LibreOffice.

Design breakout

URA Design, a Berlin-based design agency whose former clients include Mozilla and the Tor Project, handled the redesign. Its founder also worked on Ubuntu’s desktop installer in the past. Trivia: Canonical went the other way during its last brand revamp, incorporating the Ubuntu logo in to the Canonical wordmark, replacing its old, separate logo of two nested purple circles.

Carving out a visual identity of its own feels somewhat overdue.

Besides LibreOffice, TDF also contributes to the Open Document Format (ODF) standard and advocates for document interoperability and digital sovereignty with public organisations, educational institutions and governments.

The change only affects the branding of foundation. LibreOffice’s branding, logo, etc are unchanged.

The new brand assets are available to download if you fancy having a nosey. TDF says it will begin to use its new logo, fonts and colour scheme across its official websites, social media accounts, documents etc in the coming months.

Let’s Encrypt, the free and open certificate authority widely used to secure websites with HTTPS, announced it will shorten the default validity period of its TLS certificates from 90 days to 64 days, starting February 10, 2027.

All certificates issued or renewed from that date will have a 64-day lifespan unless users explicitly select one of the shorter options already available: 45 or six days.

Existing certificates will remain valid until their expiration dates. Let’s Encrypt expects the final 90-day certificate to expire on May 11, 2027. The organization also confirmed no valid certificates will be revoked during the transition.

To help administrators prepare, Let’s Encrypt will introduce 64-day certificates in its staging environment on October 14, 2026, allowing users to test their renewal setups before the change reaches production.

The move is part of a broader effort to improve web security by reducing how long compromised or incorrectly issued certificates remain usable. Simply put, shorter certificate lifetimes mean attackers have less time to exploit a stolen private key.

Of course, shorter validity periods also mean certificates must be renewed more frequently. For website administrators already using automated renewal tools, this should require little or no intervention.

In particular, Let’s Encrypt says users whose ACME clients support ACME Renewal Info should be ready for the transition. ARI allows the certificate authority to inform clients when certificates should be renewed, rather than relying on fixed schedules.

However, administrators using cron jobs or scripts with hardcoded renewal intervals should review their configurations. Instead of renewing a certificate a fixed number of days before expiration, Let’s Encrypt recommends scheduling renewals after approximately two-thirds of its validity period has passed.

The organization suggests checking scripts and configuration files for hardcoded values like 83, 80, or 60 days, which may no longer work reliably with shorter-lived certificates.

Another upcoming change concerns domain validation. Let’s Encrypt will reduce the period during which a previously completed domain authorization can be reused from 30 days to 10 days. In 2028, that period will shrink further to just seven hours.

The goal is to align with upcoming industry requirements and simplify how the certificate authority handles previously validated domains. Most users won’t need to make adjustments unless their ACME clients depend on reusing earlier authorizations.

Importantly, the transition won’t change Let’s Encrypt’s existing rate limits, ACME endpoints, or certificate issuance chains.

Looking further ahead, the organization plans to reduce the default certificate lifetime again, this time to 45 days in 2028. That makes the upcoming 64-day limit an intermediate step rather than the final destination.

For more information, see Let’s Encrypt’s official announcement.

I really hate that the options are limited and not that good even the paid ones I don't care if it's ai slop whatever i just want a good open source video editing software without ads if it exists

Cloudflare has acquired Deno, the open-source JavaScript and TypeScript runtime created by Node.js founder Ryan Dahl. However, the acquisition comes with a major change: Deno’s core team will stop developing the runtime in 2027, after one final year of maintenance and security updates.

The announcement confirms the entire Deno team is joining Cloudflare to work on its Workers platform and related technologies. Instead of developing Deno as a separate runtime, the developers will focus on making Cloudflare’s application platform easier to run, including on privately operated infrastructure.

Built using Rust, the V8 JavaScript engine, and Tokio, Deno offers built-in TypeScript support, a security model that restricts access to system resources by default, and integrated tools for testing, formatting, and managing dependencies. Now, however, its original developers are taking a different direction.

According to Dahl, the team will support the Deno runtime for another year with monthly releases containing bug fixes and security updates. After that period, ending in October 2027, the team will cease development work on the runtime.

Importantly, this doesn’t mean Deno itself will disappear. The project will remain open source, and other developers are welcome to continue maintaining and improving it. Whether the community will take over its development remains to be seen.

The acquisition also affects Deno’s commercial services. Deno Deploy, the company’s serverless application hosting platform, will operate for another six months before shutting down around April 2027. Paying customers will receive assistance migrating their applications to Cloudflare Workers.

Moreover, JSR, the JavaScript and TypeScript package registry developed by the Deno team, will continue operating, with its infrastructure moving to Cloudflare. The team has also committed to maintaining rusty_v8, the Rust bindings for Google’s V8 JavaScript engine, with plans to integrate the project into Cloudflare’s workerd runtime.

So, why is Cloudflare interested in Deno if the runtime itself is being phased out of active development by its creators?

The answer lies primarily in celld, a project developed by Dahl to simplify running distributed applications across multiple servers. It builds on the Cloudflare Workers programming model and Durable Objects, which combine application logic with persistent data storage.

Cloudflare provides an open-source runtime called workerd, which powers its Workers platform. Running the same infrastructure independently has limitations, especially when applications need to distribute data and workloads across multiple machines.

This is where celld comes in. The project was designed to make that kind of distributed infrastructure easier to deploy and operate without relying on Cloudflare’s own network.

Cloudflare now plans to combine the work behind celld and workerd, with Ryan Dahl and Deno co-founder Bert Belder leading the effort. The goal is to make self-hosting Workers and Durable Objects an officially supported option, allowing developers to run applications using the same programming model on Cloudflare’s network or their own servers.

For Cloudflare, this could make its development platform more attractive to organizations that prefer to control their infrastructure rather than depend entirely on a cloud provider. The company says more announcements about the combined work are planned in the coming months.

For existing Deno users, the immediate concern is the runtime’s future. The departure of the original development team raises questions about long-term support, compatibility, and future releases. Unless new maintainers step forward, Deno could remain functional without substantial improvements.

For additional details, visit Deno’s official announcement and Cloudflare’s announcement.

Kovid Goyal released Calibre 9.16 today as a new stable update to this open-source, free, and cross-platform e-book management software for GNU/Linux, macOS, and Windows systems.

Coming three weeks after Calibre 9.15, the Calibre 9.16 release is a hefty one, bringing support for high-quality Kokoro voices to the Read Aloud feature, which sound much more natural than the Piper voices, especially for English, and support for downloading news from websites that block automated access by using the Camoufox headless browser.

Calibre 9.16 also adds support for right-to-left text and better handling of multi-column pages to the PDF Input feature, adds support for reading images in the AVIF format, and adds a new option to the tag browser to let you sort hierarchical tags that have only children but no actual books as folders before all other tags at their level.

The Edit Book feature was improved in this release to allow skipping of problems of a particular type, indicate what ToC (Table of Contents) entries, if any, are in the file being currently edited, and update CSS selectors when automatically fixing invalid IDs.

On the other hand, the E-book viewer received a new option to display the immediate parent ToC section in headers or footers, and support for specifying margins in metric units when printing to PDF. Moreover, the E-book viewer now lets e-books store up to 1MB of data persistently, updates the “Pages from paper edition” value faster, and correctly handles dark mode theme color overrides.

EPUB 3 to EPUB 3 conversions were also improved to preserve IDs on navigation elements so links to them continue to work, while the Book list now respects horizontal alignment settings for all icon-only column types, and the Cover grid is no longer being rendered too small in some specific cases.

Calibre 9.16 also improves the PDF Output feature by fixing an issue with trailing content at the end of individual HTML files being lost when the files use multi-column layout and a regression in the Calibre 9.x series that caused conversion of some e-books with vertical writing to fail.

On top of that, Calibre 9.16 adds the ability to search rules across the Tag mapper and HTML/CSS transform rules, support for removing individual entries from the search history dropdown, support for resetting the main window layout, and support for exporting and importing saved games in the “Create your own Adventure” feature.

Kobo support has been improved as well with the addition of newer firmware, the DOCX Output now supports clickable images inside links and preserves non-breaking spaces, and various operations are now faster when dealing with large libraries, such as startup, deleting many books, sorting by series, searching and refreshing the Tag browser.

Last but not least, Calibre 9.16 fixes saving and restoring of layouts when the alternate book list visualisations is currently active, adds support for clearing FB2 metadata, such as series, comments, etc., when they are cleared in the app, and hardens the Content server, while improving support for older web browsers when using the book details page in the Mobile view.

New news sources have been added in Calibre 9.16, including World Socialist, Poetry Magazine, The Believer, and Respekt, while the Reuters, Heise, The New York Times, The Economist, The Atlantic, La Jornada, Naked Capitalism, and The Saturday Paper news sources have been improved.

Check out the release notes for more details about the changes included in Calibre 9.16, which you can download right now from the official website as binaries for 64-bit and ARM64 Linux systems, as well as binaries for macOS and Windows systems. You can also install Calibre as a Flatpak app from Flathub.

I built Airvia because I wanted my Android phone to play on my HomePod, and nothing free actually spoke real AirPlay 2.

Airvia captures your phone's audio output — Spotify, YouTube Music, podcasts, radio, almost any app — and streams it to your speakers:

• Real AirPlay 2 (transient HAP pairing, encrypted channels, buffered ALAC), confirmed playing on a real HomePod — plus AirPlay 1/RAOP fallback, DLNA/Sonos, and Chromecast
• Multi-speaker casting with a separate volume slider per speaker, and your phone's hardware volume buttons control the speaker while casting
• Per-app capture if you only want certain apps cast
• 5-band EQ + preamp, now-playing metadata with artwork, sleep timer
• Android 10+, no root, no account, no ads, no trial limits

Honest limits: apps can opt out of audio capture and DRM output is never captured, and AirPlay's buffer means a second or two of delay — great for music and podcasts, not for lip-syncing video.

It's free and open source (MIT). APK and source are on GitHub — feedback and bug reports welcome, especially from anyone with receivers I don't own.

Built by me, an independent developer — I designed it, decided every feature, and tested everything on my own devices. It’s built on top of open-source projects.

Today I'm using Alltrails and also Trailforks to find hiking and mtb trails. However, I'm also trying to replace as many proprietary apps and services with open source alternatives. So, what is the best open source alternatives to Alltrails and Trailforks?

I have seen Wanderer which looks like what I'm looking for, but perhaps there are other alternatives with more users/trails or something else that makes it better?
Endurain is, as I understand it, for self-hosting which is nice but I also want to see trails that other people have uploaded in order to be inspired and find good trails when I visit a new place.

Are there any other sites I should consider?

Even if it works despite being AI slop that's been developed in a mere 4 days (?) and somehow has all these contributors, I'm not sure I agree with the idea.

It's cool that they went with Rust for it, but I would have much preferred if all that effort went towards improving GIMP and existing open formats.

If it works then I guess it's the same end result at the end of the day, but it would suck if GIMP doesn't end up being the one to put a nail on Photoshop's coffin after all these years of serious development by humans.

Edit: I already see the kneejerk dislikes coming, I'm just interested in starting a conversation about the idea of it, I also dislike the fact that it's AI slop as I already implied. I'd appreciate joining the conversation instead of dislike bombing with no argument.

Microsoft has released LiteBox 0.1, the first version of its open-source, Rust-based Library OS designed to isolate applications from the underlying operating system, reducing access to host resources and limiting security risks.

Unlike a traditional operating system such as Linux or Windows, Library OS does not run independently or provide a complete environment for users. Instead, it implements operating system functionality as a library that applications use within a controlled execution environment.

In LiteBox’s case, the goal is to provide applications only the interfaces they need while minimizing interaction with the host operating system. This reduces the attack surface, meaning fewer ways for malicious or compromised software to interact with the underlying system.

LiteBox uses a modular architecture built around two interfaces: North and South. The North interface provides operating system functionality to applications through a Rust API inspired by the nix and rustix libraries. The South interface connects LiteBox to the underlying execution platform.

By separating these components, developers can combine different application interfaces with different platforms without redesigning the entire system.

Microsoft says LiteBox is intended to work in both kernel-mode and user-mode environments, allowing it to support several application isolation scenarios.

For Linux users, a relevant use case is sandboxing Linux applications directly on Linux. Another is running unmodified Linux programs on Windows, although LiteBox is not intended to replace WSL as a general-purpose Linux environment.

Beyond these scenarios, the project also targets more specialized security environments, including AMD SEV-SNP, which provides hardware-backed memory protection for virtual machines, and OP-TEE, an open-source trusted execution environment.

Microsoft additionally lists Linux Virtualization-Based Security among the supported use cases.

The project is still under active development. According to its maintainers, APIs and interfaces may change as the architecture matures. Developers requiring long-term stability are advised to wait for a stable release or be prepared to adapt their implementations.

LiteBox is available under the MIT license, with its source code, development information, and contribution guidelines hosted on GitHub.

For more information, visit the official LiteBox GitHub repository.

Since 2022, Google's Open Source Software Vulnerability Reward Program (OSS VRP) has been the path for outside researchers to get paid for reporting security flaws in the company's open source code, including projects like Flutter, Angular, Go, and Fuchsia.

With an announcement on X, they have now decided to discontinue the product-facing side of it.

They are calling the change temporary, while supply chain reports remain open and anything submitted before October 1 stays unaffected. What's closed, what's not?

Product vulnerabilities are bugs in the projects themselves, like a failing HTML sanitizer, memory corruption issues in file format parsers, or insecure code examples in documentation.

The updated rules do not limit the change to a specific project tier, as they just won't be accepting any reports related to this.

Supply chain reports, on the other hand, cover vulnerabilities in how the software is built and shipped. Exposed package manager credentials used to publish build artifacts is one case the rules page lists. It remains unaffected by this change.

There's also an exception for some Google Cloud repositories. If a bug there affects a Cloud product, Google may still accept the report, but through its Cloud VRP.

Why did it come to this?

Back in March, a post on the Bug Hunters blog from Google engineers said AI-generated reports were flooding the program. Some were serving up hallucinated information, while others were flagging legit coding errors that had little to no impact on the security posture of the targeted project.

Google's first response was to raise the bar on memory corruption reports for its two top project tiers. Researchers had to either reproduce the bug through an existing OSS-Fuzz fuzz target or point to a patch that maintainers had already merged.

An update to the same post the following month went further. The standard and low-priority tiers, OT2 and OT3, stopped offering rewards or credit for product vulnerabilities and other security issues. The top supply chain reward for OT2 projects also fell to $3,133.70.

Supply chain reports still pay, from $500 on OT2 projects up to $31,337 on flagship ones.

As an alternative, Google points to the Patch Rewards Program, which pays between $100 and $15,000, though only for patches that have stayed in a project for a month without being reverted.

An open question

Google has not said when or in what form product vulnerability reports will return. Their announcement only promises an update in the first quarter of 2027 while they continue reworking that part of the program.

There's also a loose end. At the time of writing, the OSS VRP page still lists reward ranges for product vulnerabilities, up to $7,500. Though, as you saw earlier, the rules page for it has already been updated, so it shouldn't be long before this is addressed.

I remember that comaps was forked from organic maps due to some drama around organic maps, but I am out of the loop on what exactly happened. Can someone get me up to date?

The emulator behind amberfolio.org is AGPL-3.0. It emulates only what SSI's Gold Box games need (an 8086, EGA, the timer, the PC speaker and the Tandy sound chip) and runs the original Pool of Radiance unchanged: natively on Windows, macOS and Linux, built from source, or as WebAssembly in a browser.

Where the lines are:

• The emulator is open source; the website is not. Every page on the site that runs the emulator links to the exact source commit it was built from.
• No game is included. The repository holds only facts about the program (addresses, offsets, SHA-256s), with a content guard in CI. Players bring their own GOG or Steam copy, which never leaves their browser.
• Every enhancement switches off. The automap, the game's printed journal on its own screen and the rest are optional; with them all off, CI checks that a run ends in exactly the same machine state as a build without them. The site also reads the game's text to a screen reader, though not its pictures, so the game can't be played without sight through it.

It was built with heavy use of AI coding tools, and the whole history is public. Desktop browsers, iPhone, iPad and Android; a controller with the usual layout works, without remapping yet. Questions about the licensing split, or the code, are welcome.

Not affiliated with the rights holders of Pool of Radiance or the Gold Box games.

EU - Germany

Given that Pixelfed is designed as an Instagram alternative, it seems like it'd make more sense to just put the short-form videos on there.

on the web, I came across the ReveriePaint app, it's kind of like krita, only for mobile devices🤩 https://github.com/LanRhyme/ReveriePaint