September 29, 2023 • Curated by Felix

Update on what happened across the GNOME project in the week from September 22 to September 29.

martymichal announces

The long awaited port of GNOME System Monitor to GTK 4 has finally arrived! The porting effort focused on keeping the UI as close to the original but still minor enhancements can be seen. The port comes early in the new development cycle which gives us the opportunity to find possible bugs and make use of the new stylish widgetry in GTK 4 and libadwaita.

See the original merge request.

Webfont Kit Generator

Create @font-face kits easily.

Rafael Mardojai CM reports

Webfont Kit Generator 1.1.0 has been released and is available on Flathub.

It features some design improvements. It has been updated to the GNOME 45 style and the font options are now a utility panel instead of a separate view.

The application is in maintenance mode, but this release brings some small additions. Its Google Fonts importer now allows the use of v1 CSS API urls, meaning that if you have an old url, you can import it without going back to Google Fonts. Base64 support has also been added, so you can now embed the fonts in the generated CSS file.

As always, this update also includes minor bug fixes.

Warp

Fast and secure file transfer.

Fina reports

Warp 0.6 has been released. It features a redesigned code view and an update to the latest GNOME 45 style and widgets. Now your file transfers will look even better!

Test social media cards locally.

Rafael Mardojai CM says

Share Preview 0.4.0 is out and available on Flathub, it adds two new services to the preview, Discourse, the self-hosted forum/discussion platform, and LinkedIn.

It also adds the ability to open multiple instances of the application, along with some minor cosmetic improvements.

Eyedropper

Pick and format colors.

FineFindus says

I’ve released Eyedropper version 1.0.0. This is the biggest release for Eyedropper yet, here are some of the major features, including those from the last beta release

• Visual feedback when entering a color format
• Support for entering all formats
• Ability to search for colors in the activity overview
• Choice of file format when exporting palettes
• Export palettes for LibreOffice
• Updated design
• Show only unique colors (thanks @gregorni)
• Fixed bugs (and probably added new ones)

Ear Tag

Edit audio file tags.

knuxify says

Ear Tag 0.5.0 has been released! This release introduces three main improvements:

• The cover art button has been expanded to allow for changing both the front and back covers. It also now has an option to remove cover art from the file.
• The “Identify Selected Files” dialog has been re-worked, and now pulls data from MusicBrainz based on present tags, not just AcoustID fingerprints. It also attempts to find the correct release for a track instead of selecting the first best one.
• The UI now uses the new libadwaita 1.4 widgets, and thus adapts to the new application style.

You can get the latest version on Flathub.

Commit

An editor that helps you write better Git and Mercurial commit messages.

Sonny reports

Commit 4.1 is available on Flathub. This release brings spell check back thanks to libspelling.

Time games of over-the-board chess.

Clara Hobbs (she/they) says

Chess Clock version 0.6.0 was released, bringing adaptivity refinements and alert sounds.

• Thanks to Mariko Ueno, we now have alert sounds when a player’s timer runs low. These can be muted if desired via the menu.
• The window adapts better to portrait aspect ratios and large screen sizes, enabling improved tablet support.

By the time of publishing, the release should be available over on Flathub.

Apostrophe

A distraction free Markdown editor.

Manu announces

Some weeks ago I resumed the ongoing port to GTK4 of Apostrophe. While doing so I took a little detour and implemented a full fledged toolbar. It allows to format text and input common markdown elements. It is context aware, so for example clicking the “checklist button” will toggle a checklist item if the cursor is in one! Next week I’ll be improving the security of the app and sanding any rough edges there are still left

Your browser doesn't support embedded videos, but don't worry, you can download it and watch it with your favorite video player!

xjuan announces

Cambalache 0.16.0 released!

New release targeting GNOME SDK 45 with all the new goodies in Gtk and Adwaita 1.4

Read more at https://blogs.gnome.org/xjuan/2023/09/28/cambalache-0-16-0-released/

dabrain34 reports

GstPipelineStudio version 0.3.4 is out ! Draw your own pipeline for GStreamer

This is an important bug fix release for first adopters, here is the release notes and the binaries:

https://dabrain34.pages.freedesktop.org/GstPipelineStudio/

An update is also available on flathub https://flathub.org/apps/org.freedesktop.dabrain34.GstPipelineStudio

Rafael Mardojai CM reports

My little application Diccionario de la Lengua, which is used to look up words in the Spanish dictionary, has received a small cosmetic update to follow the new GNOME 45 look and feel. It also now has a permanent history sidebar if the window is wide enough.

Get it from Flathub.

Emmanuele Bassi announces

For the people interested in high quality 2D rendering, I am proud to announce the first stable release of the Cairo 2D rendering library after 5 years of development. With the work of 77 committers, the 1.18 stable release introduces new API and features such as:

• support for COLR fonts
• support for the DWrite backend on Windows
• performance improvements on macOS
• dithering options for image surfaces
• a whole new build system, using Meson, for increased portability and speed on top of many, many build, documentation, and bug fixes. You can get the new release on the Cairo website.

Hari Rana (TheEvilSkeleton) reports

Upscaler 1.2.0 is available on Flathub!

We’ve put a lot of effort to improve stability and compliance with the GNOME interface guidelines. We’ve also made the following changes/additions:

• New icon • Add drag & drop support • New keyboard shortcuts • Add labels for assistive technologies • Improve support for high contrast • Port to newer widgets • Ellipsize text when file names are too long • Add WebP support • Transpose image (useful for photos taken by smartphones) • New translations • Add Vulkan checker

0xMRTT [envs.net] says

This week Bavarder 1.0 was released! It’s featuring a completely new UI with a multi-chat mode which works on desktop and mobile thanks to the new Libadwaita widgets. It’s now possible to use local models, export conversations, change bot and user name, markdown support and more! Thanks to everyone who helped for making it possible!

Check out the website for more and a full changelog!

Ticket Booth

Keep track of your favorite shows.

Alessandro Iepure says

Say hello to Ticket Booth! Never again lose track of your favorite movies and TV shows. It leverages the power of TMDB’s API to serve you the latest information in a beautiful interface. It also features a fully offline mode if you prefer to handcraft your library without relying on a third-party service. Check it out on Flathub.

Snoop

Snoop through your files.

Philipp says

Snoop initially released!

Snoop is a gui tool to search through your files. It also offers a Nautilus extension to directly start it from a folder and search in it.

It is available as a flatpak on flathub.

If you want to use the Nautilus extension with the flatpak, you have to manually get it from the repo and install it in a Nautilus extension folder, see the readme.

Parabolic

Download web video and audio.

Nick says

Parabolic V2023.9.1 is here! This release includes many features and bug fixes that make the subtitle experience a lot better in Parabolic :)

Here’s the changelog:

• Added an option to disable embedding subtitles in a file and instead download them in a separate file
• Added the ability to specify ““all”” in the subtitle languages list to download all available languages
• Fixed an issue where empty subtitles were sometimes embedded
• Fixed an issue where arte.tv links were not validating thanks to a yt-dlp update
• If embedding subtitles fails, Parabolic will automatically save them to separate files instead
• Improved Parabolic’s display of progress in taskbar (dock)
• Updated translations (Thanks everyone on Weblate!)

Login Manager Settings

Customize your login screen.

Mazhar Hussain says

I released GDM Settings v4.beta0. This release brings

• New UI style
• GNOME 45 support
• Background image adjustment option
• Support for high contrast mode in GDM
• Application Window is dragable from anywhere now
• New graphical error message (replaces an unhelpful error printed on the terminal)

Since this is a beta release,

• Expect bugs and if you do encounter any bug, please report it.
• It is not yet available on the regular (stable) Flathub repo. You can install it from Flathub beta repo.

Flatseal

A graphical utility to review and modify permissions of Flatpak applications.

Martín Abente Lahaye reports

I am happy to announce the release of Flatseal 2.1.0. This new release comes with refined visuals, improved performance, support for a new permission, quality of life additions, and fixes.

Read all the details here.

glerro announces

Transmission Daemon Indicator NG is updated for Gnome Shell 45

Mateus R. Costa announces

Default Workspace has been updated to work with GNOME 45. This gnome-shell extension allows you to choose a specific workspace to automatically switch to as soon as you login. This is particularly useful if you have a workflow where you use fixed workspaces and don’t use the first workspace as the main one.

Just Perfection says

Thanks to Aryan Kaushik, extensions.gnome.org now supports liberapay and opencollective in donations key.

Tobias Bernard reports

To celebrate the release of GNOME 45 we had a hackfest and release party last week!

Some hightlights:

• Lots of productive discussions for how we can get GNOME OS (and image-based OSes more generally) to the next level
• We discussed in detail how we could do local-first sync in GNOME, and made a tentative plan for first prototypes
• Adrian and Jonas resurrected the transparent panel branch
• Julian looked into fixing default avatars
• Various discussions about improving developer experience
• Lots of work on apps, including Evince, Railway, and Dino
• There was cake! 🎂

More details in this blog post: https://blogs.gnome.org/tbernard/2023/09/26/gnome-45-release-party-hackfest

See you next week, and be sure to stop by #thisweek:gnome.org with updates on your own projects!

The World Flying Disc Federation (“WFDF”) is hosting its inaugural World Wheelchair Ultimate Championships.  The event is being held at the Bella Italia Efa Village in Lignano Sabbiadoro from 29-30 September 2023 and four teams are participating with two teams from Italy, one team from Germany, and an “international” team with its core group from Japan.

“Today history was made with the first international Wheelchair Ultimate Games ever, with Germany securing the first win ever in an international event in the discipline against Italy Blue by a score of 9-7. The innovation of a WFDF International team proved to be a fantastic concept with Team WFDF INT coming out with a convincing victory over Italy White 10-4,“ said WFDF Secretary General and Parasport Commission chair Volker Bernardi. “Each team will play two more matches tomorrow in this round robin format, finishing up with semifinals and finals rounds in tomorrow’s packed schedule. We are looking forward to crowning the first WFDF WWUC champion tomorrow.”

“As a first test of the Wheelchair Ultimate discipline, WFDF has clearly demonstrated the competitive potential to our members,“ added WFDF President Robert “Nob” Rauch. “We are looking forward to the next edition in 2025 already, where we expect a minimum of eight countries to participate after this tremendous start in Italy. Our thanks go to the Local Organizing Committee led by Salvatore Comis, the head of the Flying Disc section of our Italian member NF FIGeST, to CONI, the Italian Paralympic Committee and the Italian Sport For all Federation for all their organizational support, and especially tothe athletes from Italy, Germany and Japan for their enthusiasm and commitment.”

UPDATED August 2023: Hardening PostgreSQL has become ever more important. Security is king these days and people want to know how to make PostgreSQL safe. Some of us might still remember what happened to MongoDB in recent years and we certainly want to avoid similar security problems in the PostgreSQL world. What happened to MongoDB is actually stunning: Thousands of databases were held ransom because of poor default security settings – it was an absolute nightmare and greatly damaged the reputation of not just MongoDB but the entire industry. PostgreSQL people do everything they can to avoid a repeat performance of that in our ecosystem.

The hashtag #ransomware is not what you want to see when somebody is talking about your company. To help you avoid the most common pitfalls, we have compiled a “best of PostgreSQL security problems” list:

12 Best Practices to Improve PostgreSQL Security

PostgreSQL is running as a server process and people want to connect to the database. The question is: Where are those connections coming from? The listen_addresses setting which can be found in postgresql.conf controls those bind addresses.

In other words: If listen_addresses is set to ‘*’, PostgreSQL will listen on all network devices, consider those connections and move on to the next stage, which evaluates the content of pg_hba.conf.

Listening on all devices is a problem, because a bad actor could easily spam you with authentication requests – disaster is then just one pg_hba.conf entry away.

Recommendation to avoid listening on all devices:

• In case only local connections are needed:
  • Set listen_addresses = ‘localhost’
• In case remote connections are needed:
  • Set listen_addresses = ‘localhost, <IP of network device>’

If you don’t listen at all, you are definitely more secure. PostgreSQL will not even have to reject your connection if you are already limiting network access.

2. Using “trust” in pg_hba.conf

After dealing with listen_addresses (= bind addresses), PostgreSQL is going to process pg_hba.conf to figure out if a connection is actually allowed or not. The main question which arises is: What can possibly go wrong when talking about pg_hba.conf? Well, there are some things which are worth mentioning.

What we frequently see is that people use “trust” to ensure that people can connect to PostgreSQL without a password. Using trust is basically the worst thing you can do if you are working on hardening PostgreSQL. For local connections, “peer” might be a valid choice – trust is certainly not.

Recommendation concerning “trust” in PostgreSQL:

• Do not use trust (especially not for remote connections) if you are hardening PostgreSQL.
• Use scram-sha-256 and SSL instead
• Avoid entries that allow connections from everywhere (netmask 0.0.0.0/0) if possible. Instead, restrict access to those hosts and subnets that really need access.
• Don’t create pg_hba.conf entries that allow connections to all databases or for all users. Be specific.
• Add documentation to every line in the file, so that you know why that access is needed, who requested it and whom to contact in case of need. Otherwise, you have little chance to clean up and remove entries that are no longer needed. Moreover, if a password needs to be changed, you know whom to contact.

3. Getting rid of md5 passwords in PostgreSQL

For many years md5 was the method of choice to do password authentication in PostgreSQL. However, the days of md5 are long gone. You can even download ready-made files containing the most frequently used hashes from the internet, and crack passwords even faster.

In other words: Forget about md5 and move to stronger hashes. If you want to find out how to migrate from md5 to scram-sha-256 make sure you check out our post “From MD5 to scram-sha-256 in PostgreSQL”.

Recommendation concerning md5 in PostgreSQL:

• Move md5 to scram-sha-256

4. Handle PUBLIC permissions on schemas and databases

In PostgreSQL there is a thing called PUBLIC. It is basically the database equivalent of “UNIX world”. As you will see, in PG versions prior to version 15, it may cause some issues – which can, however, be avoided. For the most recent information about schema PUBLIC since PostgreSQL version 15, see this blog.

Here’s what typically happens when you unknowingly use schema PUBLIC (prior to v15):

postgres=# CREATE USER joe;
CREATE ROLE
postgres=# \c postgres joe
You are now connected to database "postgres" as user "joe".
postgres=> SELECT current_user;
 current_user
--------------
 joe
(1 row)

We have created a user and logged in as joe. What we see here is that joe is not allowed to create a new database, which is exactly what we expect. BUT: joe is allowed to connect to some other database we have not even heard of so far. Fortunately, joe is not allowed to read any objects in this database:

postgres=> CREATE DATABASE joedb;
ERROR: permission denied to create database
postgres=> \c demo
You are now connected to database "demo" as user "joe".
demo=> SELECT * FROM t_demo;
ERROR: permission denied for table t_demo

However, joe is allowed to create tables by default (public schema) which is certainly not a good idea:

demo=> CREATE TABLE bad_idea (id int);
CREATE TABLE

Now, we have identified two key problems:

• joe is allowed to connect to other databases
• joe is allowed to spam the public schema

This is worse than it looks at first glance. Experience shows that most of the privilege escalation attack vectors discovered in PostgreSQL over the years work by creating malicious objects in a database.

So, here’s how to fix it – revoke privileges on schema PUBLIC:

demo=# REVOKE ALL ON DATABASE demo FROM public;
REVOKE
demo=# REVOKE ALL ON SCHEMA public FROM public;
REVOKE

Now that we have done that, we can reconnect to the demo database as “joe”. In psql one can do that using the \c command. If you are using a graphical user interface, change your database connection and log in as user joe:

demo=# \c demo joe
FATAL: permission denied for database "demo"
DETAIL: User does not have CONNECT privilege.
Previous connection kept

First, we have revoked permission from PUBLIC to make sure that the database connection is not possible anymore. Then we have fixed permissions on the public schema. As you can see, the connection is no longer possible.

Recommendations concerning schema PUBLIC (PRIOR to PG v15):

• Remove PUBLIC from your database permissions
• Remove PUBLIC from your public-schema permissions

It may also be a good idea to revoke the TEMP privilege on databases from all users that do not need it. Some privilege escalation attacks work just as well with temporary objects. Also, make sure that you properly test your setup to ensure that no leaks are left open.

Again, as of v15 schema PUBLIC has changed… see this blog for details.

5. Avoid ALTER USER … SET PASSWORD …

Changing a password in PostgreSQL is easy. Most people use ALTER USER … SET PASSWORD to do that. However, there is a problem: This SQL statement ends up in your database log in PLAIN text which is of course a major issue.

Recommendation:

• Use your trusted PostgreSQL client’s facilities for changing passwords rather than ALTER ROLE. For example, psql has \password and pgAdmin has a “change password” dialog.

This recommendation may seem absurd. However, there is some reasoning behind it. To change the password, there is protocol support which bypasses the problem of plain text passwords in the log. By doing things visually – and not via plain SQL – most GUIs will fix the problem for you.

Hint: CYBERTEC PostgreSQL Enterprise Edition (PGEE) even prohibits ALTER USER … SET PASSWORD explicitly to avoid the risk passwords in the log stream.

6. Make use of ALTER DEFAULT PRIVILEGES

Suppose you are running an application. Your database contains 200 tables. Permissions are set perfectly for countless users. Let us assume that we want to update this application so DDLs are executed to make the change. But what if somebody makes a mistake? What if permissions are not set properly? Small problems will start accumulating.

The solution to this problem is ALTER DEFAULT PRIVILEGES:

ALTER DEFAULT PRIVILEGES
Description: define default access privileges
Syntax:
ALTER DEFAULT PRIVILEGES
      [ FOR { ROLE | USER } target_role [, ...] ]
      [ IN SCHEMA schema_name [, ...] ]
      abbreviated_grant_or_revoke
where abbreviated_grant_or_revoke is one of:
GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }
     [, ...] | ALL [ PRIVILEGES ] }
     ON TABLES
     TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]
…

The idea is to define default permissions long before objects are created. Whenever you create a database object, default privileges will automatically kick in and fix things for you. PostgreSQL will greatly simplify your hardening process in this case by automatically setting permissions on new objects.

7. Make use of SSL

SSL is one of the most important topics in the realm of PostgreSQL security. If you want to harden your PostgreSQL database, there is no way around SSL.

PostgreSQL provides various levels of SSL, and allows you to encrypt connections between client and server. In general, we recommend using at least TLS 1.2 to ensure a high enough level of security.

If you want to learn more about SSL, and figure out how to set it up, please check out our page about that.

8. Write SECURITY DEFINER functions safely

Stored procedures and server side functions in general can be a major security concern. There are two ways in PostgreSQL to execute a function:

• Execute a function as “who you are”
• Execute a function as the author of the code

By default, a function is executed as the current user. In other words: If you are currently user joe the function will run as joe. However, sometimes it can be useful to run code as the author of the function and thus with different security settings. That way, you can let a user with low privileges perform certain actions that need elevated privileges in a controlled fashion. The way to do that is to use the SECURITY DEFINER option when creating the function.

But powerful tools are also dangerous, so you have to define those functions carefully. Read our article about SECURITY DEFINER functions for details.

9. Avoid SQL injection in database functions

SQL injection is not only a problem on the application (client) side, it can affect procedural code in the database just as well. If you want to avoid SQL injection, we recommend you continue reading and learn more. Consider this silly function:

CREATE FUNCTION tally(table_name text) RETURNS bigint
LANGUAGE plpgsql AS
$$
  DECLARE
      result   bigint;
  BEGIN
      EXECUTE 'SELECT count(*) FROM ' || table_name
      INTO result;
      RETURN result;
END;
$$;

Now, any attacker who has control over the argument supplied to the function can launch a denial-of-service attack:

SELECT tally('generate_series(1, 100000000000000000000)');

Or they could find out how much money is on your account:

SELECT tally('generate_series(1, 1000000) 
UNION 
SELECT amount::bigint FROM account WHERE name = ''loser''');

Use the usual security precautions:

• Use dynamic SQL only where necessary.
• Use string data types for parameters only where necessary.
• Always use format() to construct SQL query strings.

10. Restrict superuser access as much as possible

It is always good if the number of people who have administrative access to a security critical system is as limited as possible. How far you want to go here depends on your security needs:

• Harden the database machine, so that nobody except database administrators can get shell access to the machine. Whoever has shell access as a PostgreSQL operating system user has full control over the database.
• Use personalized superuser accounts for the administrators, so that you can quickly revoke access to an administrator when needed.
• Use superusers only where really required. For example, you don’t need a superuser for replication connections, or to take a backup.
• Restrict access with superuser accounts in pg_hba.conf. Ideally, only local connections are allowed. If you don’t want that, restrict access to the personal system of the administrator.
• For very high security requirements, make sure that nobody knows the superuser password, but place it in a safe that can only be opened by at least two people. Change the password after every use.

In general, using superusers is dangerous.

Recommendation:

• Never, ever, run applications as a superuser
• Limit superusers as much as possible

11. Update your PostgreSQL database on a regular basis

Finally, it is important to update PostgreSQL on a regular basis. Keep in mind that most minor releases updates (eg. 13.0 -> 13.2, etc.) come with security-related updates which are vital to reducing the attack surface of your system. PostgreSQL security updates are available on a regular basis, and we recommend applying them as soon as possible.

12. Encrypting your entire server: PostgreSQL TDE

So far, you have learned how to encrypt the connection between client and server. However, sometimes it is necessary to encrypt the entire server including storage. PostgreSQL TDE does exactly that:

To find out more, check out our website about PostgreSQL TDE. We offer a fully encrypted stack to help you achieve maximum PostgreSQL security. TDE is available for free (Open Source).

Finally…

Materialized views are an important feature in most databases, including PostgreSQL. They can help to speed up large calculations – or at least to cache them.

If you want to make sure that your materialized views are up to date and if you want to read more about PostgreSQL right now, check out our blog about pg_timetable which shows you how to schedule jobs in PostgreSQL. Why is pg_timetable so useful? Our scheduler makes sure that identical jobs cannot overlap, but simply don’t execute again, in case the same job is already running. When you run long jobs, this is super important – especially if you want to use materialized views.  

In order to receive regular updates on important changes in PostgreSQL, subscribe to our newsletter, or follow us on Twitter, Facebook, or LinkedIn.

Retroflexion – So drehst Du den Spieß um!

Dieser Beitrag bietet Anregungen zur Selbsthilfe. Er ersetzt keine Psychotherapie.

Rückblick

In den Beiträgen über Depressionen #1und#2 habe ich

• mein wohltuend anderes Depressions-Modell vorgestellt. Du hast erfahren, wie Introjektion, Retroflexion und Deflexion zusammenhängen;

• den Vorgang der Introjektion genau erklärt und dir viele Beispiele über derartige verinnerlichte Regeln, Glaubenssätze, Verbote, Gebote, Werte oder Normen gegeben. Ich habe die wichtigsten Symptome der Depression aus der Perspektive der Introjektion beleuchtet.

• die Übersicht findest du hier » Wege aus der Depression

In diesem Teil erläutere ich, was sehr oft die Folge von unseren tief sitzenden Introjekten ist, nämlich das Zurückhalten und Gegen-Sich-Wenden von emotionalen und körperlichen Impulsen. Die Symptome der Depression werde ich in dieser Folge unter dem Blickwinkel Retroflexion untersuchen.

Was ist Retroflexion?

Definition

Retroflexion beschreibt ein scharfes Gegen-sich-selbst-Zurückbiegen. Wenn man Introjekte befolgen muss, ergibt sich zwangsläufig die Notwendigkeit, viele eigene Impulse, Gefühle, Bedürfnisse, Gedanken, verbale und körperliche Äußerungen, Verhaltensweisen zu kontrollieren. Wir müssen uns also im Griff haben, zurückhalten, disziplinieren, mäßigen.  

depressionpsychotherapieselbsthilfepsychotherapie-kritikretroflexion