Kamis, 07 Mei 2026

Yazi is the Terminal-based File Manager I Didn't Know I Needed

There are two kinds of Linux users. Those who live in the comfort of GUI and those who live in the adventurous world of terminal.

I am neither of the two.

I prefer the comfort of GUI and I jump into the terminal when required or when I am in the mood to explore something.

This article is the result of one such adventure where I tried a file manager in the terminal.

Yes! A file explorer in the terminal. If you are surprised, let me tell you that there are several terminal-based file managers available since forever.

Instead of the usual ls and cd commands combination, you browse and intercat the files in a slightly more comfortable way with these tools.

I explored one such file explorer called Yazi and it impressed me enough to cover it here on It's FOSS.

I even made a video on it. You may watch the video or read the article, whichever you prefer.

What is Yazi, again?

Yazi is a terminal-based file manager packed with features. The first time I used it, I honestly wondered why I hadn’t started earlier. For those curious, it’s written in Rust. I am not sure if you'll love it or hate it for that 😉

0:00
/0:32

Yazi File Manager

Here’s what stands out in Yazi:

  • Full asynchronous support; CPU tasks are spread across multiple threads
  • Built-in support for multiple image protocols
  • Built-in code highlighting and image encoding
  • Scrollable previews
  • Powerful file search and manipulation tools

I'll show my experience with Yazi and its features that I explored. Honestly, if you spend plenty of time in the terminal, you won't even feel the need of opening the graphical file manager like Nautilus or Nemo.

But first, let's see how to install it first.

Installing Yazi on Linux

Yazi is available in the official repositories of Arch Linux, Void Linux, OpenSUSE Tumbleweed, and more.

On Arch Linux, install it along with dependencies and tools that will make the full use of Yazi:

sudo pacman -S yazi ffmpeg 7zip jq poppler fd ripgrep fzf zoxide resvg imagemagick

Ubuntu users can install the Snap version:

sudo snap install yazi --classic

If your distribution doesn’t provide Yazi in its repositories, use the official binary release.

Don't forget to install additional packages that give Yazi all those powerful features.

sudo apt install ffmpeg 7zip jq poppler-utils fd-find ripgrep fzf zoxide imagemagick

After that, you can download the official binary, give it execute permission, and run it.

🚧
Since this is a terminal tool, you should be comfortable using the terminal and commands. I won't explain each step or command in detail; I presume you would already know these things.

Post install setup

After installing Yazi, add a small wrapper script so you can cd into the directory you were browsing when quitting Yazi.

Open your ~/.bashrc or ~/.zshrc and add:

function y() {
	local tmp="$(mktemp -t "yazi-cwd.XXXXXX")" cwd
	command yazi "$@" --cwd-file="$tmp"
	IFS= read -r -d '' cwd < "$tmp"
	[ "$cwd" != "$PWD" ] && [ -d "$cwd" ] && builtin cd -- "$cwd"
	rm -f -- "$tmp"
}

Save the file and restart your shell. Now you can launch Yazi just by typing y.

Features that make Yazi cool

Let’s look at the features that make Yazi stand out.

The cd magic

In the previous section, we added a wrapper function so you can open Yazi with y. But here’s the interesting part.

When you’re inside Yazi, navigate to any directory and press q. You’ll quit Yazi and automatically cd into that directory in your terminal.

0:00
/0:16

Entering directories in terminal while using Yazi file manager.

Don’t want to change directories? Press Q instead. You’ll exit Yazi and stay in the original directory.

Get image and file previews

If you installed the required dependencies, Yazi can preview most file types in a dedicated pane on the right side. It even provides proper syntax highlighting for code files.

If your terminal supports image protocols, such as Kitty or Ghostty, you can preview images directly in the sidebar.

0:00
/0:09

A small clip showing image preview in Yazi

You can also preview the contents of tar and zip archives without extracting them.

Below is a small screenshot showing the Yazi file manager previewing contents of an archive file. It shows what are the files residing inside an archive file like tar or zip.

This is a small screenshot showing the Yazi file manager previewing contents of an archive file. It shows what are the files residing inside an archive file like tar or zip.
Archive Preview

Previewing a text file? Press J (Shift + j) to scroll down. Press K (Shift + k) to scroll up.

0:00
/0:19

A small clip showing file preview scroll in Yazi file manager.

Switch to directories by searching for it

Changing directories in Yazi becomes fast once you know the right key combination.

Press g followed by space. A small launcher will appear. Enter an absolute or relative path; your choice.

As you type, Yazi suggests matching directories.

0:00
/0:29

A small clip showing entering into directories in Yazi file manager.

Yazi supports two search methods; one using fd and another using ripgrep.

Press s to search files by name. This uses fd, a modern alternative to the traditional find command.

0:00
/0:23

A small clip showing the working of fd search.

To search by file content, press S. This uses ripgrep, a modern replacement for grep command.

You can cancel a search anytime with Ctrl+s.

0:00
/0:18

A small clip showing the working of ripgrep search in Yazi file manager.

Bulk rename files with a breeze

Renaming multiple files doesn’t get easier than this.

First, select files using the Space key. A selected file stays selected even if you change directories. You can select files from anywhere in your system.

Once done, press r. Yazi will open all selected filenames in your default terminal text editor $EDITOR.

Edit the names as needed. Just be careful not to alter directory paths if you selected files across different folders.

When you’re done, save and exit. In Vim, that’s :wq.

That’s it. All selected files are renamed instantly.

A small clip showing renaming files in Yazi file manager.

The fuzzy search and zoxide

Yazi includes a fuzzy search mode powered by fzf.

In a directory with many files and can’t remember the exact name? Press z. Start typing something close to the filename and Yazi will narrow it down.

A small clip showing the working of fzf search in Yazi file manager.

If you use zoxide instead of the traditional cd command, you’ll like this even more. Press Z to jump to directories tracked by zoxide. Just make sure zoxide is properly set up first.

A multi tabbed interface

Yazi supports tabs. Press t to open a new tab.

Each tab gets a number. Switch between them using the associated number keys.

A small clip showing creating and switching tabs.

To close a tab, press Ctrl+C.

It has more to offer

These are just some of the features I found most useful. Since Yazi is a file manager, it naturally supports standard operations like copy, paste, and path handling.

It also includes a visual mode for file selection and an interactive file open menu similar to an “Open With” context menu.

Feeling lost among keybindings? Press F1 for a full in-app help view. Once you find what you need, press ESC to return.o

Do you find it useful?

I’ve been slowly building a full TUI workflow; Helix as my editor, Glow to preview Markdown, and now Yazi fills the last missing piece as my file manager.

I don’t expect to move away from a GUI setup this much, but Yazi makes that thought achievable. It fits naturally into the way I work.

If you like exploring TUI tools, give it a try and see if this is something you would like to use on a regular basis. Do share your experience in the comments.



from It's FOSS https://ift.tt/cnvKMR6
via IFTTT

After Days of DDoS, Now Ubuntu's Twitter Account Seems to be Compromised

It seems like Ubuntu cannot catch a break.

Their entire web infrastructure was under continued DDoS attack for 5 days. Which seemed to be over now. But the misery is not.

A few hours ago, there was a (now deleted) tweet from Ubuntu's official Twitter account. It announced the availability of Ubuntu's newest AI agent.

At first glance, it looked legit until you dug deeper.

Ubuntu's official Twitter account was compromised

A csreenshot of the compromised tweet | Courtesy Cyber Kendra
By the time I could take screenshots, the tweet was deleted. Thankfully, good folks at Cyber Kendra had covered it.

The tweet looks legit, right? At least it plays with the human psyche.

It talks about AI, which relates to Ubuntu's recent AI move. This could trick many people who might believe that this is a legit next step in the AI direction.

It was mentioned to be built on Solana and the account was also tagged. Solana is a legit open-source blockchain platform for digital transactions and decentralized applications (read crypto payments).

This is why the next line mentions buzzwords like Blockchain and decentralized. Blockchain also relates to crypto so this was more like a build up for crypto that would come later.

The so-called agent is called Numbat and the main image shows the Numbat animal with orange as its primary color. "Numbat" is also part of Ubuntu 24.04 codename Noble Numbat.

And then the displayed URL is ai-ubuntu.com which is similar to ai.ubuntu.com although ai subdomain doesn't exist on Ubuntu but it is enough to trick unsuspecting people.

Mind that it was not a single tweet; it was a thread (a series of nested tweets) and the replies were closed. So even if someone discovered the scam, they wouldn't have been able to alert others in the replies.

So, fake AI branding, Ubuntu's Numbat name, Solana tags, blockchain buzzwords, and a near-identical URL to quietly build false trust and thus guiding unsuspecting users step by step into a crypto scam before they realize the deception.

The next step of deception came when the link was clicked.

The crypto trap

Like most of the briefly compromised accounts, this tweet also tried to lure people into a crypto scam. It was not evident immediately unless you clicked on the given URL. And boy that URL looks like a typical Canonical webpage.

Fake Ubuntu AI agent webpage
The phishing page looks identical to a typical Ubuntu web page

It is not impossible to get fooled by the clever webpage if you are not paying attention. Your guards would have been down because you clicked a link shared by official Ubuntu account.

The rest of the page had links to actual Ubuntu project and thus making it look even more legit.

It was only when you clicked the "Check eligibility" or "Explore Ubuntu AI" buttons, the deception was evident. It asked you to add your crypto wallet.

Fake Ubuntu AI website asking to add crypto wallet
Fake Ubuntu AI website asking to add crypto wallet

Why would you do that? Because just before the buttons, there is a text that says:

Early ecosystem participants may qualify for future $UM allocations. Snapshot approaching.

This compromised tweet just adds to the pile of misery Canonical had been suffering of late and it didn't happen in isolation.

The DDoS attack that crumbled Canonical's web assets

In case you didn't know, Ubuntu was suffering from a large scale DDoS attack. Ubuntu's websites went down for about five days last week but they seem to be back now.

Starting April 30, Canonical's web services faced what the company described as a "sustained, cross-border" attack. The ubuntu.com website, Snap store, Launchpad, and several other Canonical-owned services went offline or became unreliable.

The attack lasted until around May 5, when services were gradually restored. At the time of writing this, Canonical's official status page shows everything fully operational. Let's hope it stays that way.

Note that DDoS attacks make a website unavailable by flooding the server with traffic. It didn't compromise the servers. So, your Ubuntu installation, package updates (APT repositories are mirrored across the world and kept working), ISO downloads, and the Ubuntu operating system itself was not impacted. Your system was never at risk. Although, if you had trouble running snap install commands or pulling from a PPA last week, you now know why.

Canonical has not released a detailed post-incident report yet. A Pro-Iran hacker group called 313 reportedly claimed responsibility, but this has not been confirmed by Canonical.

Are both incidents are connected?

The hacker group 313 has announced that they have ended the DDoS attacks. They have not mentioned anything about compromised tweet.

Telegram messages announcing the end of Ubuntu DDoS attack
Telegram messages announcing the end of Ubuntu DDoS attack | Courtesy Brian Lunduke

Now, ai-ubuntu.com was registered with a Hong Kong based registrar, but that doesn't mean the attackers were based in Hong Kong.

Whois data for the ai-ubuntu.com website
Whois data for the scam ai-ubuntu.com website

One thing to note here is that many organizations as well as individual accounts often use third-party tools to manage and schedule their tweets. It is also possible that the compromise came from such a third-party Twitter tool. This could also be a human slip up and their social media manager's account might have compromised.

It is really up to Canonical to investigate and find out the root cause. We can only make guesses.



from It's FOSS https://ift.tt/6JhfOuK
via IFTTT

Rabu, 06 Mei 2026

LibreOffice Questions Whether Euro-Office is Truly Sovereign

Before we dive into the topic at hand, you should know that Euro-Office is a new European productivity project by Nextcloud and IONOS, which was forked from ONLYOFFICE.

It is a self-hosted, web-based office suite built for organizations and governments that want collaborative document editing on their own infrastructure. A big part of it is to move away from an office suite with ties to Russia, which has triggered concerns over digital sovereignty.

Following that, The Document Foundation (TDF), the nonprofit behind LibreOffice, had put forward a question, asking what document format this suite would use as its native format.

They have received no reply and have put out a thank-you post to ODF contributors while taking a dig at Euro-Office's silence.

TDF isn't happy

Toward the end of March, TDF published an open letter to European citizens arguing that digital sovereignty is not as simple as switching office software vendors. Real sovereignty, TDF said, requires open document formats, open fonts, and continuity of expertise, none of which come automatically with a vendor switch.

Then came the issue of OOXML versus ODF. OOXML, the format used by Microsoft Office, is designed and controlled entirely by Microsoft. Any office suite that defaults to OOXML compatibility is still structurally dependent on decisions made in the U.S., regardless of where it is hosted.

ODF, the Open Document Format, is what TDF wants Euro-Office to commit to instead. It is an ISO standard, developed openly without a single company controlling it.

They also noted that Euro-Office's launch press release made no mention of ODF as a native format and asked publicly whether it would be the default for documents created and shared between European public bodies.

What does this mean?

Euro-Office's GitHub does list ODF formats alongside DOCX, PPTX, and XLSX, so it's not like they've excluded open formats entirely. But their FAQ frames the whole thing around "great MS compatibility," which is a problem.

Supporting a format and making it your native default are two different things. The distinction is relevant for any European institution that actually wants to break the dependency on Microsoft rather than just move it to a different server rack.

Whether Euro-Office addresses this directly or keeps quiet, TDF's question is now out there. And given that Germany has already mandated ODF by law, it's not a question that's going away anytime soon.



from It's FOSS https://ift.tt/ToxNmA7
via IFTTT

Selasa, 05 Mei 2026

Should You Be Worried About Copy Fail Linux Exploitation?

📋
TLDR:
- A 9-year-old bug was discovered recently.
- The vulnerability is already patched in the Linux kernel.
- Normal users could gain root access by running a small Python script.
- Not much of a bother for regular desktop Linux users who keep their systems updated.
- Could be problematic for cloud servers and containers if the kernel is not updated.

A logic flaw that sat quietly in the Linux kernel since 2017 has finally been found and disclosed. For a brief window, it let any unprivileged local user on a Linux system escalate to root with a script smaller than most config files.

The flaw is in a kernel subsystem that lets regular programs tap into built-in cryptographic functions. By feeding it file data in a specific way, an attacker can get the kernel to quietly overwrite 4 bytes of any file's in-memory copy.

The actual file on disk stays intact the whole time, so any tool checking file integrity will see nothing wrong. The exploit is just a 732-byte Python script that doesn't require any additional dependencies or compilation.

The vulnerability is tracked as CVE-2026-31431, goes by the name "Copy Fail," and was discovered by researchers at Theori using their AI security research tool, Xint Code.

The security researchers tested it on Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16, getting root on all four with the exact same script each time.

They had reported the issue to the Linux kernel security team on March 23, received acknowledgment the next day, and had a patch proposed and reviewed by March 25. The fix was committed to mainline on April 1, with the CVE assigned on April 22, and public disclosure following on April 29 (linked earlier).

Who needs to worry, and who doesn't?

this picture shows six categories with different risk ratings for various linux setups

According to the Copy Fail website hosted by Theori, the risk level varies quite a bit depending on how you run Linux.

At the top are multi-tenant Linux hosts, Kubernetes and container clusters, CI runners and build farms, and cloud SaaS environments running user-supplied code.

These all get a "High" risk rating. Containers and cloud workloads are especially exposed because the Linux page cache, the part of memory this exploit corrupts, is shared across the entire host, container boundaries included.

A compromised container can take down the whole node, and a bad pull request run on a shared CI runner could hand an attacker root on that machine.

Standard Linux servers where only the team running it has shell access get a "Medium" rating, whereas personal desktops and laptops are at the bottom with a "Lower" risk rating.

Copy Fail needs local code execution to work, so it won't get anyone in remotely by itself. If malware is already running on your machine, this could be used to escalate to root, but that's a bigger problem either way.

To fix this, patching the kernel is the way. Most major distros have updates out or on the way. If patching isn't immediately possible, Theori recommends blacklisting the algif_aead kernel module as a stopgap:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf

rmmod algif_aead 2>/dev/null

As of writing, Microsoft has noted that exploitation remained "limited and primarily observed in proof-of-concept testing," so there's no confirmed mass-scale campaign just yet.

That said, CISA, the US cybersecurity agency, has added Copy Fail to its Known Exploited Vulnerabilities (KEV) catalog, ordering US federal agencies to patch their Linux systems by May 15.

It also urged other organizations to treat it as a priority regardless of whether the federal deadline applies to them.


Suggested Read 📖: VS Code Was Adding Copilot as a Git Co-Author Without Telling Anyone



from It's FOSS https://ift.tt/9n8YOpW
via IFTTT

Go Away Microsoft! The Netherlands is Quietly Building Its Own GitHub Replacement

Back in November 2025, Jan Vlug, a software engineer who writes for the Dutch government's developer portal, put out a detailed blog recommending which Git forge the Netherlands should adopt for its governmental source code hosting needs.

His post came at a time when the Ministry of the Interior (BZK) was already setting up a dedicated Git instance, and the platform decision was still open.

Currently, the Dutch government's code is spread across GitHub and GitLab, neither of which is under government oversight.

GitHub got ruled out first because it's proprietary software, which directly conflicts with the government's own policy of preferring open source when options are equally suitable.

GitLab made it further in the evaluation but didn't survive it either. The issue was its open-core model, where the Community Edition is genuinely free software but the Enterprise Edition is not.

The solution

this cropped screenshot of the forgejo official website shows a bunch of text and buttons on the left, on the right is the project's squirrel mascot

Forgejo came out on top due to its fully free and open source nature. Licensed under GPLv3+ and governed by Codeberg e.V., a democratic nonprofit, it has no enterprise tier, proprietary upsell, or vendor lock-in problems.

On April 24, 2026, code.overheid.nl had its soft launch, with developer advocate Tom Ootes writing about it on developer.overheid.nl. He framed it as a collective project to build something together rather than ship something finished.

The platform is a self-hosted Forgejo instance, running on Dutch government infrastructure managed by SSC-ICT (DAWO). It's free for all government organizations and is built around the following goals.

Open source development with proper Git tooling, including pull requests, issue tracking, and code reviews; government-wide collaboration to reduce duplicate development across agencies; and sovereignty through full control over the hosting environment.

As mentioned earlier, this initiative is still in the pilot phase, with the rollout being kept deliberately gradual.

Not every government organization can sign up yet, and the idea is to build it alongside the developers who will actually use it, with early participants encouraged to file issues and open pull requests on the platform itself.

What's already in?

The platform is live and already hosts some content. The most notable presence is Kiesraad, the Dutch Electoral Council, which has pushed several election-related repositories including Abacus, the software used for vote counting and seat distribution, and e-KS, an electronic candidate nomination system.

The Ministry of the Interior (BZK) has the DAWO project (their digital autonomous workplace initiative) on there, along with a DigiD source code release published under a freedom of information ruling.

On the organization side, the list of who has joined since the April 24 soft launch is telling. Multiple national ministries are already on the platform: Finance, Foreign Affairs, Agriculture, and Interior.

Several major municipalities have also signed up, including The Hague, Utrecht, Leiden, and Arnhem. For a platform still in pilot with no formal launch announcement, that's a fairly significant roster.


Suggested Read 📖: France's Linux Move



from It's FOSS https://ift.tt/SbinL7f
via IFTTT

Typical Microsoft! Turns Out VS Code Was Adding Copilot as a Git Co-Author Without Telling Anyone

VS Code has been quietly appending a Co-authored-by: Copilot line to users' git commits, including ones written entirely without Copilot's involvement.

The culprit behind this, git.addAICoAuthor, is a feature that was introduced in VS Code 1.110 back in March. It is designed to tag commits with a Copilot co-author trailer when AI-generated code is involved, and it launched with off as the default.

So far good, right? 🙂

That changed in April, when Courtney Webster, a Product Manager at Microsoft, submitted a pull request that changed one thing, the default value of git.addAICoAuthor from off to all.

The PR was reviewed and merged by VS Code team member Dmitriy Vasyura on April 16, without a release note or any kind of user-facing notification.

a github screenshot that shows a merged pull request titled, "enabling ai co author by default"

The all setting is the broadest option available for git.addAICoAuthor, which added the Copilot trailer to every commit involving any AI interaction, including inline completions.

With the default flipped to all, anyone who had not manually configured the setting was suddenly getting Copilot credited in their git history.

Things got messier from there. Developers reported that the credit info (trailer) was appearing even with chat.disableAIFeatures set to true. The trailer is also appended after the commit finalizes, not appearing in VS Code's commit message editor beforehand, so there was no window to catch and remove it before it showed up in git history.

One developer replaced Copilot's generated commit message with one they wrote themselves, committed, and still found the Copilot co-author line sitting in their log.

But fret not, as the fix has been delivered.

The Fix

a small screenshot that shows an apology post by dmitriy vasyura who had enabled copilot attribution by default on vscode
Dmitriy's apology over on HackerNews.

Dmitriy, the VS Code team member who merged the original PR, came forward on Hacker News over the weekend under the username dmitriv, specifically to address the fallout.

Identifying himself as the person who approved the change, Dmitriy said that he was sorry for mistakenly turning on this feature by default without sufficient scrutiny.

Also clarifying the following before the conspiracy theories started emerging:

There was no ill intent by evil corporation, but rather a desire to support functionality that some customers expect of VS Code w.r.t. AI-generated code. As folks mentioned here - many similar tools do this as well.

The fix, now live on VS Code's GitHub repo as PR #313931, reverts git.addAICoAuthor back to off by default and corrects the detection issue that caused the trailer to appear even when Copilot was not in use.

You can expect this change to land with the upcoming VS Code 1.119 release.

Via: The Register



from It's FOSS https://ift.tt/q24DyJw
via IFTTT

Senin, 04 Mei 2026

A Free Open Source Mobile Dev Hackathon Is Coming to the Netherlands on May 16

OpenSource Science B.V., better known as OS-SCi, is a Netherlands-based institution that has a pretty specific focus. To train the next generation of developers exclusively on Free and Open Source Software (FOSS).

They run bachelor's programs, modular courses, and student projects with partners that include LPI, UBports, the Rust Foundation, and the Python Institute.

If the outfit still sounds unfamiliar, you are not alone. OS-SCi doesn't get a lot of coverage, even in FOSS circles. They are primarily education-focused, operating out of their Tilburg headquarters and working with universities to integrate open source into formal curricula.

They also run FOSSTech, a separate arm that delivers open source IT solutions to organizations. So it's not purely a school; there's a consultancy side to them too.

All that context matters, because OS-SCi is about to host something that might interest quite a few of you.

OS-SCi refers to this event interchangeably as "Lomiri Tech Meeting," "Lomiri CodeFest," and "Lomiri Hackathon" across their own websites. We use "Lomiri Tech Meeting" throughout this article.

As always, independently verify event details and the organizer before attending.

Lomiri Tech Meeting

cropped screenshot of the lomiri tech meeting registration page on os-sci's website

The Lomiri Tech Meeting is a two-day, free hackathon aimed at students who want to get hands-on with open source mobile development. The focus is building apps for Lomiri and Ubuntu Touch, the mobile OS maintained by UBports.

Two keynote speakers are confirmed. Mike Gabriel, the project leader behind Lomiri's user interface, will be speaking. So will Erik Mols, who will use the event to announce the Lomiri Bounty Program, a new initiative that would offer students real-world incentives to contribute to the Ubuntu Touch ecosystem.

Every student who attends will be given free copies of Lomiri App Development Level 1 and Level 2. These are from a three-volume series that covers the platform's foundational concepts along with advanced procedures.

Beyond the keynotes and books, the event is built around hands-on app development sessions guided by experts. The goal here seems to be that attendees leave having actually built something and not just sat through some presentations.

Event Details and Registration

The Lomiri Tech Meeting is open to students of all experience levels and will run from May 16 to 17, 2026, kicking off at 10:00 AM each day and wrapping up at 4:00 PM on the 17th.

The venue is OS-SCi's headquarters at Spoorlaan 400, Tilburg, Netherlands. You can find it on OpenStreetMap and Google Maps.

It sits very close to Tilburg's main train station (Station Tilburg), which makes it fairly straightforward to reach by rail. The building also appears to have some level of wheelchair accessibility, but I recommend confirming that directly with OS-SCi before making travel arrangements.

You can register for free on the official event page.



from It's FOSS https://ift.tt/4ubI2hv
via IFTTT