Notices by Ludovic Courtès (civodul@toot.aquilenet.fr)

Retraction of an article published in 2000 that concluded that “under present and expected conditions of use, Roundup herbicide does not pose a health risk to humans”:
https://www.sciencedirect.com/science/article/pii/S0273230099913715

“The article's conclusions regarding the carcinogenicity of glyphosate are solely based on unpublished studies from Monsanto […]”

And it took 25 years to get here.

#OpenScience

The 🐑 #Shepherd 1.0.9 is out and it comes with fewer 🐛!
👉 https://codeberg.org/shepherd/shepherd/src/tag/v1.0.9/NEWS

#Guile 3.0.11 is out! 🎉
https://www.gnu.org/software/guile/news/gnu-guile-3011-released.html

With code contributions from 35 people, mostly bug fixes but also nice new libraries!

“Complex end-to-end tests using #Guix G-expressions” (Sept. 2025)
https://systemreboot.net/post/complex-end-to-end-tests-using-guix-g-expressions.html

Nice post by Arun Isaac showing how to put G-expressions to good use to compose a complex pipeline, in this case illustrated with #bioinformatics.

For the first time in many years, I have less than 10 unread emails. 🎉

When I moved to #mu4e seven months ago, I was at 20,000!
https://toot.aquilenet.fr/@civodul/114313643178812888

Modesty aside, I think I’ve come up with the cutest possible description of remote procedure call interface of the the #Guix & #Nix build daemon:
https://codeberg.org/guix/guix/pulls/4495/commits/055d146e9fcfe712bdc16defee1d7704168ff5ab#L54

HRW on the forced displacement of 32,000 people in the West Bank in early 2025, a crime against humanity:
https://www.hrw.org/news/2025/11/20/west-bank-israel-emptying-refugee-camps-a-crime-against-humanity

@apteryx @ekaitz_zarraga Awesome work indeed! Compiler artist *and* drawer!

Je viens de réaliser qu’en anglais le même mot peut vouloir dire « tiroir » ou « dessinateurice ». C’est fou.

In the Guix daemon, a rather mature C++ code base (based on Nix’s), the security issues we had over the past decade never had to do with memory safety, but all had to do with access rights, race conditions, and generally speaking ambient authority and confused deputy problems.

Write that in Rust (or in Scheme!) and you still have to deal with these issues.

Which, to be explicit, is not to say that one shouldn’t write in a memory-safe language like Rust or Scheme. :-)

It’s not trivial for a rewrite to be as “secure” as its decade-old original version, whether or not that original version is in C.

Amazing how “memory-unsafe languages are the cause of many vulnerabilities” translated into “memory-safe languages lead to invulnerable software” in the minds of many.

For a tool like ‘sudo’, I’m not surprised that the intricacies of POSIX and the semantic complexity of its configuration are more of a problem than dangling pointers.

A fellow hacker, knowing my passion for Rust⸮, shared these ‘sudo-rs’ vulnerabilities:
https://github.com/trifectatechfoundation/sudo-rs/security

Last week I fixed a memory leak in Fibers and a new contributor fixed another one in the Shepherd.

Version 1.0.9 of the 🐑 Shepherd is going to be the least leaky of all, I tell you! 🚿

#Guix has already raised half of its annual budget 👇
https://guix.gnu.org/blog/2025/update-on-the-guix-fundraising/

This is great but the journey’s not over!

If you can, if you care about #Guix (or #Nix!), about #FreeSoftware and independent projects, consider donating. 🤲
https://guix.gnu.org/donate/

@khinsen Other than that, I sympathize with the sentiment of @soupglasses: it seems to be a corporate-backed project, solving the security problems of companies in a spirit quite different from that of the #bootstrapping work that enables it.

It is good that companies understand the value of this work, but disappointing that they’re (again) freeriding on volunteer work and sweeping its empowerment message under the carpet.

@khinsen It is another way to build “full-source bootstrap” similar to what @janneke et al. did in #Guix and what @stikonas et al. did with live-bootstrap.

Technically, it reuses stage0, M2-Planet, Mes/MesCC, and kaem as developed by these fine people:
https://stagex.tools/packages/bootstrap/stage0/

I suspect the dependency graph is close if not identical to that of live-bootstrap (the one of Guix has more Scheme in it :-) among other things).

Folks starting to realize that “open source” does, indeed, “miss the point” (to paraphrase rms), and that copyleft exists for a reason:
https://paragraph.com/@holonic-horizons/the-stallman-paradox-how-web3-became-the-ultimate-open-source-theater

Good news! If you can, now is *still* a good time to donate for #Guix! 👇
https://guix.gnu.org/en/blog/2025/fundraising-campaign-to-sustain-gnu-guix/

The 🐑 #Shepherd 1.0.8 is out, more 🐛 out of the way!
👉 https://codeberg.org/shepherd/shepherd/src/tag/v1.0.8/NEWS