News

‘Reclaim Expression’: An immersive installation that puts you at the center of the internet

by
‘Reclaim Expression’: An immersive installation that puts you at the center of the internet

Mozilla’s Reclaim the Internet event at the Alte Münze in Berlin, happening Oct. 12 to 16, features an immersive journey that invites people to act, build and choose to reimagine our digital future. The journey includes three art installations where visitors can explore how reclaiming the internet will help us take back expression, inspiration and […]

The post ‘Reclaim Expression’: An immersive installation that puts you at the center of the internet appeared first on The Mozilla Blog.

F-Droid maintains in Debian

by

Free software enables more efficient ways to run large scale software.
F-Droid can serve so many people with minimal resources because of this
super power. Instead of each project handling development and maintenance
of the whole thing, free software enables sharing development and
maintenance. This is why F-Droid is built on
Debian. That only works when projects that use
free software also contribute back. F-Droid works to ensure that as much of
our work as possible goes back upstream to the original projects. For
production code, we use the Debian packages. When we need to use a new
library, we make sure it is added to Debian and maintained there. We use
Debian Backports when we need some new
dependencies in the stable release.

To illustrate this in action, let’s take a look at some recent security
issues in one of our dependencies:
GitPython.
CVE-2022-24439,
CVE-2023-40267
and
CVE-2023-41040
are three vulnerabilities that affect mostly projects that feed untrusted
input in and process it with GitPython. GitPython usages that operate on
known inputs are not really affected. Since our build process accepts Git
repositories from thousands of developers, our code processes inputs from
thousands of people. There are layers of validation those inputs that
provide protection, but no validation is perfect. So we need to ensure that
each step is safe. So we patched the Debian packages that we use in
production. We built on Ubuntu LTS’s patched
package which was in
turn built from the patched
package made for
Debian LTS, as funded by Freexian. It is a
classic example of how free software makes fixing security issues much
easier.

We are of course not alone in this, many other projects are also built on
Debian. Recently, Tor
Project
outlined many key benefits of building off of Debian. What is clear is that
the effort that we put into Debian maintenance more than pays for itself by
reducing work and stress on our core contributors, especially those who are
running servers. Software supply-chain
attacks have become
common across a range of packaging systems. A well configured Debian server
has the strongest protection that exists for any server software
distribution system.

There is a similar trend in software that ships all its own dependencies,
like Android apps. There are a wide variety of bots that check that
projects are including the latest versions of libraries. This is common in
Android apps, since they have to include all of their own dependencies.
Android provides only the core libraries. When we base our systems on
Debian, then we only need to update the dependencies in Debian, and all the
of the projects automatically receive those updates. When combined with
Debian’s
unattended-upgrades, this
approach provides a very low effort way to keep software updated. Normally,
automatic updates without human review are a dangerous thing to do in
software. Silently installing new software provides a channel that can be
exploited by malicious actors. Debian’s free software requirement, stable
releases, reproducible builds, and strong package distribution channels make
it possible to enable unattended upgrades in a trustworthy way.

Mahadev Online Gaming App: महादेव ऑनलाईन गेमिंग ॲपमुळे बॉलिवूड हादरले, जाणून घ्या, संपूर्ण प्रकरण

by
महादेव ऑनलाईन गेमिंग ॲप प्रकरणातील गुंतागुंत आता अधिकच वाढते आहे. महादेव ऑनलाईन गेमिंग ॲपमुळे बॉलिवूड हादरले असून अनेक मोठमोठ्या कलाकारांची नावे या प्रकरणाशी जोडली जात आहेत, जाणून घ्या अधिक माहिती

Join us for the Moodle Academy webinar “What’s New in Moodle 4.3” on Thursday 19th October at 11:00 UTC

by
Join us for the Moodle Academy webinar “What’s New in Moodle 4.3” on Thursday 19th October at 11:00 UTC
by Sandra Matz.  

We invite you to register to join us for the free Moodle Academy webinar “What’s New in Moodle 4.3” on Thursday 19th October, at 11:00-12:00 UTC.

In this webinar you will learn about the new features of Moodle 4.3 for administrators and teachers.

This webinar is part of the course ‘What’s New in Moodle 4.3′. You have to be enrolled in the course to join the webinar.

Register at Moodle Academy.

Join us for the Moodle Academy webinar “What’s New in Moodle 4.3” on Thursday 19th October at 11:00 UTC

DrupalEasy: Debugging all the things with Xdebug, DDEV, PhpStorm, PhpUnit

by
DrupalEasy: Debugging all the things with Xdebug, DDEV, PhpStorm, PhpUnit

DrupalEasy: Debugging all the things with Xdebug, DDEV, PhpStorm, PhpUnitOver the past few years, we’ve published a couple of blog posts about setting up Xdebug for Drupal module development. But, like all things in tech, there’s always more to learn as tools and technology evolve.

The setup

I was recently working with one of our Professional (Drupal) Module Development students trying to determine why she wasn’t able to use Xdebug to debug a PhpUnit-based functional test. To be clear, the breakpoint wasn’t set in the actual test class, the breakpoint was set in some custom module code that was called by the test class.

In functional tests, Guzzle is used by PhpUnit to make calls like:

$this->drupalGet('')

So, in a way, there isn’t a direct PHP connection between test class and the code under test. It is in this circumstance that the breakpoint wasn’t working.

Xdebug was working fine for this student to debug other aspects of the same project – it just wasn’t hitting breakpoints during functional tests.

The solution

This was one of those instances that I had seen (and solved) previously, but to be honest, PhpStorm/Xdebug solutions have often involved numerous trips into the (extensive) PhpStorm settings area. By the time the problem is fixed, I was never 100% sure exactly which change I made had actually solved the problem. But, this time, I was more careful…

PhpStorm Xdebug settings page

Obviously, Xdebug must be enabled in DDEV, and PhpStorm’s almost-magical auto-configuration for Xdebug needs to have configured a new “Server” with proper path mappings (especially for the project root).

The PhpStorm configuration settings related to Xdebug that I now recommend are:

  • Set the “Max connections” value to 20 in the “PHP | Debug” configuration area (see image above).
  • Uncheck the “Force break at the first line when no path mapping is specified,” “Force break at first line when a script is outside the project” and “Ignore external connections through unregistered server configurations” checkboxes in the “PHP | Debug” configuration area (see image above.)
  • Set “Host” and “Name” in the “PHP | Servers” configuration are the same (and of the form name.ddev.site, where name is your site’s DDEV machine name) (see image below.)
  • When running functional tests, PhpStorm may request to see up a new server connection in “PHP | Servers” with the name “localhost.” Allow it and ensure the path mapping is correct.

With these settings, functional PhpUnit tests can be effectively debugged. 

PhpStorm