oss articles — cronfeed.work

Open Source Jul. 26, 2026

HarfBuzz at 20: the small shaping call behind readable text

An annotated viewing of Behdad Esfahbod's HarfBuzz at 20 follows the path from Unicode buffers to positioned glyphs, shows how tests and adoption turned behavior into an interoperability target, and reads HarfRust as a compatibility program rather than a line-for-line rewrite.

Linux Mint's hacked ISO made the download page part of the release

Rockbox keeps old music players useful one exact port at a time

NVDA lets you hear the interface your HTML actually shipped

BlueROV2 is four control layers sharing one tether

All articles

HarfBuzz at 20: the small shaping call behind readable text

OpenMRS is a clinical grammar before it is a hospital app

coreboot crosses the no-RAM gap one stage at a time

An iptables migration succeeds before the rules get shorter

Apache’s release vote turns trust into a procedure

Rich Hickey's simplest architecture test: what did you braid together?

GitLab's 2017 database loss turned a staging snapshot into the recovery plan

OpenTitan makes the root of trust an inspectable build artifact

Open ground stations have three lanes: TinyGS, SatNOGS, and UniClOGS

Nmap preserves uncertainty instead of hiding it

A postmarketOS migration starts with the hardware row, not the download button

Vim’s most useful command is noticing the edit you keep repeating

Sourceware's independence now has a committee, a budget, and a legal home

MAME keeps old machines testable after the cabinets go dark

Gentoo's GitHub mirror was compromised. Its source of truth was not.

Who owns a NetBSD problem? The answer is written down.

Open MCT composes mission control without owning the telemetry

OpenPrinting moves Linux printing from driver packages to discoverable services

sccache starts paying off when cache misses become evidence

HOT Tasking Manager can lock a tile. It cannot erase the seams.

Thunderbird made user donations part of the maintenance stack

PHP’s backdoor commits bypassed gitolite through a second push path

OctoPrint gives a 3D printer a control room, not a new brain

FarmBot is an open garden stack, not a robot planter

FFmpeg can govern a patch. The harder test is governing paid maintenance

git-annex separates the file tree from the cargo

Archivematica makes preservation a chain of evidence, not a backup

Apptainer preserves the image, not Docker’s runtime contract

The ‘hypocrite commits’ never landed. The trust failure did.

strace turns ‘it failed’ into a kernel conversation

NixOS made authority explicit; trust is still the hard dependency

Inside VideoLAN's multimedia commons: VLC, libVLC, codecs, and disc libraries

When Debian's OpenSSL entropy bug made private keys enumerable

OpenTripPlanner compiles the timetable before it finds the route

Trino is a federation boundary, not a warehouse escape hatch

Tor Browser makes privacy a bundle, not a private tab

Zephyr makes firmware a board contract, not a vendor SDK

Fedora Atomic Desktops make the laptop a deployment target

Dask in production is a graph boundary, not a magic cluster

TeX is governed by a frozen core, not by neglect

OpenBLAS makes linear algebra a dispatch problem, not a library checkbox

Qwik makes hydration a serialization problem, not a startup tax

Tesseract turns OCR into a pipeline, not an API spell

WordPress is a governed plugin economy, not just a CMS

Bzlmod is a module-graph migration, not a flag flip

Rspack is a webpack exit ramp, not a Rust stunt

Pandoc is an AST boundary, not a magic file converter

OpenSSL's strongest signal is the support clock, not the crypto headline

GIMP is an image pipeline now, not just a toolbox

F-Droid is an app-distribution trust boundary, not just an Android store

KubeVirt makes the VM a Kubernetes object, not a side cluster

Flink's checkpointing is a state contract, not a save button

Lua works because the host application stays in charge

Docker Compose works when the YAML stays the local contract

Mesa is the userspace graphics boundary, not a driver pile

ODK works because the survey is the protocol boundary

Matomo makes analytics a custody decision, not a dashboard choice

FreeCAD 1.x works when model stability becomes the migration plan

mold makes linking part of the feedback budget

Ruby's performance work still serves a human API

Firecracker made serverless isolation a microVM contract

MicroK8s makes Kubernetes small by drawing a package boundary

CPAN's strongest governance signal is the index, not nostalgia

OpenFlexure makes the microscope a printable instrument stack

OpenZiti turns zero trust into an overlay you have to operate

OpenCV 5 makes computer vision migration a runtime choice, not a header swap

GNU Radio turns radio work into flowgraphs before it reaches the antenna

OBS Studio is a live pipeline, not a record button

ROS 2 is a robot graph before it is a robotics toolkit

PipeWire makes Linux media a graph, not a pile of sound servers

marimo makes notebook state a dependency graph, not a memory game

Read the Docs makes documentation a service boundary, not a publish button

Buck2 is a build daemon before it is a faster Buck

OpenProject works when project management becomes a permission model

Yazi makes the terminal file manager a preview engine