HayadSont

A video by SavvyNik that covers some of the highlights from the following recently published scientific article - Wolves in the Repository: A Software Engineering Analysis of the XZ Utils Supply Chain Attack

A video by SavvyNik that covers some of the highlights from the following recently published scientific article - Wolves in the Repository: A Software Engineering Analysis of the XZ Utils Supply Chain Attack

Fellow open-source enthusiasts,

We all have that mental backlog of promising projects — those distros, tools, and systems we keep tabs on but haven't yet deployed. Perhaps you're waiting for that mythical free weekend, lacking a spare/compatible device or just holding out until that one killer feature drops.

FWIW, my 'someday' list includes:

Operating Systems/Distros:

• Gentoo – Source-based meta-distribution driven by Portage and USE-flags for near-granular control; binary packages also available if you'd rather skip marathon compile sessions.
• Guix System – GNU's functional, declarative distro built with Guile Scheme.
• MocaccinoOS – Image-based, container-built distro that originated from Gentoo/Sabayon but now uses the Luet package manager and OTA-like updates.
• NixOS – Declarative Linux distribution using the Nix package language.
• Qubes OS – Security-focused OS that uses Xen virtualization to compartmentalize your digital life into isolated environments with a unified desktop.
• Spectrum – In-development security-oriented OS built on Nixpkgs using KVM-based microVMs for compartmentalization.

Desktop Environments/Window Managers:

• COSMIC - System76's comprehensive Wayland-native desktop environment written in Rust.
• Hyprland – Dynamic tiling Wayland compositor with scriptable layouts and impressive animations.

System Security/Firmware:

• coreboot – Open source alternative to proprietary BIOS/UEFI firmware (though recent x86 still needs vendor blobs such as FSP/AGESA).
• Heads – coreboot + Linux payload providing TPM-measured, tamper-evident boot for select laptops.
• nix-mineral - NixOS module for convenient system hardening.
• TrenchBoot – Framework for dynamic root-of-trust (DRTM) launches via Intel TXT, AMD SKINIT, or SEV-ES.

Applications/Tools:

• Android Translation Layer - Run Android apps natively on Linux (still in early development).
• Emacs – The self-extensible Lisp machine masquerading as a text editor; someday I'll embrace the config rabbit hole.
• Olive – FOSS non-linear video editor in alpha.
• systemd-sysext – Overlay read-only /usr and /opt (or /etc via confext) with extra images; extensions auto-activate at boot or can be merged/unmerged/refreshed live with a single command. Handy for immutable distros, though it’s additive-only and not a full package manager.

What open-source projects are you admiring from afar? Time to compare notes!

Fellow open-source enthusiasts,

We all have that mental backlog of promising projects — those distros, tools, and systems we keep tabs on but haven't yet deployed. Perhaps you're waiting for that mythical free weekend, lacking a spare/compatible device or just holding out until that one killer feature drops.

FWIW, my 'someday' list includes:

Operating Systems/Distros:

• Gentoo – Source-based meta-distribution driven by Portage and USE-flags for near-granular control; binary packages also available if you'd rather skip marathon compile sessions.
• Guix System – GNU's functional, declarative distro built with Guile Scheme.
• MocaccinoOS – Image-based, container-built distro that originated from Gentoo/Sabayon but now uses the Luet package manager and OTA-like updates.
• NixOS – Declarative Linux distribution using the Nix package language.
• Qubes OS – Security-focused OS that uses Xen virtualization to compartmentalize your digital life into isolated environments with a unified desktop.
• Spectrum – In-development security-oriented OS built on Nixpkgs using KVM-based microVMs for compartmentalization.

Desktop Environments/Window Managers:

• COSMIC - System76's comprehensive Wayland-native desktop environment written in Rust.
• Hyprland – Dynamic tiling Wayland compositor with scriptable layouts and impressive animations.

System Security/Firmware:

• coreboot – Open source alternative to proprietary BIOS/UEFI firmware (though recent x86 still needs vendor blobs such as FSP/AGESA).
• Heads – coreboot + Linux payload providing TPM-measured, tamper-evident boot for select laptops.
• nix-mineral - NixOS module for convenient system hardening.
• TrenchBoot – Framework for dynamic root-of-trust (DRTM) launches via Intel TXT, AMD SKINIT, or SEV-ES.

Applications/Tools:

• Android Translation Layer - Run Android apps natively on Linux (still in early development).
• Emacs – The self-extensible Lisp machine masquerading as a text editor; someday I'll embrace the config rabbit hole.
• Olive – FOSS non-linear video editor in alpha.
• systemd-sysext – Overlay read-only /usr and /opt (or /etc via confext) with extra images; extensions auto-activate at boot or can be merged/unmerged/refreshed live with a single command. Handy for immutable distros, though it’s additive-only and not a full package manager.

What open-source projects are you admiring from afar? Time to compare notes!

While this is an especially great development for the Fedora Atomic aficionados among us, I wouldn't be surprised if we'll be hearing a lot more from sysexts as (yet another) avenue for installing software, particularly on other atomic/immutable distros. The concept itself isn't new - Flatcar has been utilizing this approach for some time (and has been a significant influence on this Fedora initiative).

The gist would be that it basically allows installing software natively without the traditional rpm-ostree layering method. This approach eliminates both the lengthy installation times and reboot requirements typically associated with that process. Though, it doesn't seem to completely replace the conventional method as it comes with certain limitations (as per the developer):

They can not be used to:

• install another kernel
• install kernel modules
• make changes to the initrd
• make changes to /etc
• add udev rules

For those wondering what is actually envisioned to be installed using this method, the software that's already available may shed some light 😉.

In any case, note that this is FAR from its final form. The (relative) complexity currently involved in installing and updating software reflects this clearly; don't expect shiny wrappers that will make all of us blissfully ignorant of the underlying complexity right away 😜.

While this is an especially great development for the Fedora Atomic aficionados among us, I wouldn't be surprised if we'll be hearing a lot more from sysexts as (yet another) avenue for installing software, particularly on other atomic/immutable distros. The concept itself isn't new - Flatcar has been utilizing this approach for some time (and has been a significant influence on this Fedora initiative).

The gist would be that it basically allows installing software natively without the traditional rpm-ostree layering method. This approach eliminates both the lengthy installation times and reboot requirements typically associated with that process. Though, it doesn't seem to completely replace the conventional method as it comes with certain limitations (as per the developer):

They can not be used to:

• install another kernel
• install kernel modules
• make changes to the initrd
• make changes to /etc
• add udev rules

For those wondering what is actually envisioned to be installed using this method, the software that's already available may shed some light 😉.

In any case, note that this is FAR from its final form. The (relative) complexity currently involved in installing and updating software reflects this clearly; don't expect shiny wrappers that will make all of us blissfully ignorant of the underlying complexity right away 😜.

Look, I've only been a Linux user for a couple of years, but if there's one thing I've learned, it's that we're not afraid to tinker. Most of us came from Windows or macOS at some point, ditching the mainstream for better control, privacy, or just to escape the corporate BS. We're the people who choose the harder path when we think it's worth it.

Which is why I find it so damn interesting that atomic distros haven't caught on more. The landscape is incredibly diverse now - from gaming-focused Bazzite to the purely functional philosophy of Guix System. These distros couldn't be more different in their approaches, but they all share this core atomic DNA.

These systems offer some seriously compelling stuff - updates that either work 100% or roll back automatically, no more "oops I bricked my system" moments, better security through immutability, and way fewer update headaches.

So what gives? Why aren't more of us jumping on board? From my conversations and personal experience, I think it boils down to a few things:

Our current setups already work fine. Let's be honest - when you've spent years perfecting your Arch or Debian setup, the thought of learning a whole new paradigm feels exhausting. Why fix what isn't broken, right?

The learning curve seems steep. Yes, you can do pretty much everything on atomic distros that you can on traditional ones, but the how is different. Instead of apt install whatever and editing config files directly, you're suddenly dealing with containers, layering, or declarative configs. It's not necessarily harder, just... different.

The docs can be sparse. Traditional distros have decades of guides, forum posts, and StackExchange answers. Atomic systems? Not nearly as much. When something breaks at 2am, knowing there's a million Google results for your error message is comforting.

I've been thinking about this because Linux has overcome similar hurdles before. Remember when gaming on Linux was basically impossible? Now we have the Steam Deck running an immutable SteamOS (of all things!) and my non-Linux friends are buying them without even realizing they're using Linux. It just works.

So I'm genuinely curious - what's keeping YOU from switching to an atomic distro? Is it specific software you need? Concerns about customization? Just can't be bothered to learn new tricks?

Your answers might actually help developers focus on the right pain points. The atomic approach makes so much sense on paper that I'm convinced it's the future - we just need to figure out what's stopping people from making the jump today.

So what would it actually take to get you to switch? I'm all ears.

Look, I've only been a Linux user for a couple of years, but if there's one thing I've learned, it's that we're not afraid to tinker. Most of us came from Windows or macOS at some point, ditching the mainstream for better control, privacy, or just to escape the corporate BS. We're the people who choose the harder path when we think it's worth it.

Which is why I find it so damn interesting that atomic distros haven't caught on more. The landscape is incredibly diverse now - from gaming-focused Bazzite to the purely functional philosophy of Guix System. These distros couldn't be more different in their approaches, but they all share this core atomic DNA.

These systems offer some seriously compelling stuff - updates that either work 100% or roll back automatically, no more "oops I bricked my system" moments, better security through immutability, and way fewer update headaches.

So what gives? Why aren't more of us jumping on board? From my conversations and personal experience, I think it boils down to a few things:

Our current setups already work fine. Let's be honest - when you've spent years perfecting your Arch or Debian setup, the thought of learning a whole new paradigm feels exhausting. Why fix what isn't broken, right?

The learning curve seems steep. Yes, you can do pretty much everything on atomic distros that you can on traditional ones, but the how is different. Instead of apt install whatever and editing config files directly, you're suddenly dealing with containers, layering, or declarative configs. It's not necessarily harder, just... different.

The docs can be sparse. Traditional distros have decades of guides, forum posts, and StackExchange answers. Atomic systems? Not nearly as much. When something breaks at 2am, knowing there's a million Google results for your error message is comforting.

I've been thinking about this because Linux has overcome similar hurdles before. Remember when gaming on Linux was basically impossible? Now we have the Steam Deck running an immutable SteamOS (of all things!) and my non-Linux friends are buying them without even realizing they're using Linux. It just works.

So I'm genuinely curious - what's keeping YOU from switching to an atomic distro? Is it specific software you need? Concerns about customization? Just can't be bothered to learn new tricks?

Your answers might actually help developers focus on the right pain points. The atomic approach makes so much sense on paper that I'm convinced it's the future - we just need to figure out what's stopping people from making the jump today.

So what would it actually take to get you to switch? I'm all ears.