IanTwenty

Am I right that those smaller commits and branches are not in the public repo though? Some commits also mention they close issues but those issues also do not exist in the repo? E.g.

https://github.com/secninjaz/OctoLab/commit/796e859c7165b6d4543f1491e0dd5fde169d8d2d

…Closes #275, #277 and #278

What do these refer to?

It is streamed and recorded for years unless I am missing something. Last year was no different:

https://video.fosdem.org/

Z-wave…is there a zigbee equivalent?

The new local mode looks very handy for web dev also:

This feature allows you to register multiple mappings in order to load local files through custom https:// URLs.

https://firefox-source-docs.mozilla.org/devtools-user/local_mode/index.html

Astro Loop, roguelike shooter

https://f-droid.org/packages/com.astroloop.game

Surprisingly addictive

Is it possible to degoogle an android tv stick so that it’s as private as an apple tv?

https://keepass.info/help/v2/sync.html

https://github.com/Kunzisoft/KeePassDX/wiki/File-Manager-and-Sync#data-synchronization

I cannot find confirmation for keepassxc but they check for changes before saving (and I believe offer to merge) as confirmed in this non-issue:

https://github.com/keepassxreboot/keepassxc/issues/12690#issuecomment-3538942799

You could still get conflict files being created by the sync software and would need to watch and merge those manually. However you can mitigate that by saving on every change (this is the default I think) and synching as often as possible between devices.

Keepass (some clients anyway) helpfully merges changes to the underlying file if it changes whilst open so a simple sync of the file is enough.

For voyager it is an open issue

https://github.com/aeharding/voyager/discussions/465

Here it is again! 153 votes, double the nearest competitor:

https://community.home-assistant.io/t/wth-cant-i-control-what-other-users-can-access-rbac/1030886

Didn’t know this:

Shallow clones are awful. Run your own damn mirror if you’re going to do something nasty like that.

Shallow is the default/recommended in a lot of places though apparently:

Shallow wins the clone, every time, by 4-6x. Which is exactly why actions/checkout defaults to depth=1, why GitLab CI ships GIT_DEPTH=20, and why Vercel hard-codes --depth=2 with no way to change it.

https://bex.co/blog/2026/08/08/git-push-paas-shallow-vs-partial-clone-build-checkout

Separately, one source of the scraping:

welcome to the wonderful world of “proxy SDK monetization.” It’s big business, and your TV is probably doing it.

The link in the article is useful, https://spur.us/blog/smart-tv-apps-residential-proxy-sdks

Amazon makes it explicit: its Device and System Abuse Policy prohibits apps that facilitate proxy services for third parties. Roku has reportedly shut the door too: Lowpass, syndicated at The Verge, reported that Roku bars developers from using Bright SDK and similar proxy services, and that Roku apps using the SDK disappeared after the company was contacted.

LG and Samsung have not drawn an equivalent public line. That is the gap these apps are living in. The same business model that Amazon bans and Roku reportedly blocks is still showing up at scale on webOS and Tizen.

It concludes:

A TV app should not be able to quietly turn a living-room device into residential proxy infrastructure. Screensavers, games, clocks, and novelty apps can be boring, cheap, or ad-supported. If an app is going to monetize a household’s internet connection, the user should be clearly informed about what that means, how the connection will be used, and what risks and tradeoffs they are accepting.

We need to help everyone in the world block their TVs from doing this, this is such an abuse of trust.

They didn’t move fast enough on it and others began circulating it. So they had to play catch up, hence the need to react before they had a patch.

We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources. The security team has since started changing its processes, and that work continues, so that decisions can be made by majority and compromises are encouraged.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

I do not run Immich but their privacy policy states:

Locally Stored Data: Immich stores all your photos, albums, settings, and other metadata locally on your device. We do not have access to this data, nor do we transmit or store it on any of our servers.

https://immich.app/privacy-policy

Additionally in their docs I can find no mention of connecting to outside services. I do see references to downloading hugging face models.

https://docs.immich.app/features/facial-recognition#how-face-detection-works

Here’s the gist doing side-by-side comparison (from Fairscan author)

https://gist.github.com/pynicolas/e018ef84464a2cf7949fa453e41cfead#code-comparison

I didn’t check it all but it looks like their should be attribution for this to Fairscan, both publicly and in the repo.

Ente’s repository has a single license file at the root and not much else so their licensing seems pretty lightweight, maybe that’s all they needed so far.

REUSE makes it easier to attribute per file where neccessary:

https://reuse.readthedocs.io/en/stable/readme.html