|
|
Subscribe / Log in / New account

Exploring LibreOffice 7.0

By John Coggeshall
August 19, 2020

The Document Foundation (TDF) has announced the release of LibreOffice 7.0. This major release is a significant upgrade from version 6.4.6, focusing on interoperability with Microsoft Office, general performance, and support for OpenDocument Format (ODF) version 1.3. A complete list of new features and bug fixes can be found in the release notes.

When talking about the latest LibreOffice release, one must also talk about ODF, the default format for LibreOffice documents. ODF version 1.3, which was approved as an OASIS Committee specification back in December 2019, offers several improvements to the format that LibreOffice can now take advantage of. For the security concerned, document encryption using OpenPGP (PGP) is a welcome addition. Further, while LibreOffice has supported digital signatures in past releases via SSL/TLS certificates, PGP keys can now be used to sign documents in LibreOffice 7.0. The notes on ODF in the release clarify the compatibility between LibreOffice versions:

Recent versions of LibreOffice should have no issues consuming "ODF 1.3 Extended" files. The only known exception is OpenPGP/GPG encrypted ODF 1.3 documents, which can be imported only since LibreOffice 6.4.5. If compatibility with old and no longer maintained ODF consumers (such as OpenOffice.org, Apache OpenOffice or LibreOffice 3.x) is required, and conformance to the ODF standard is no concern, the version "ODF 1.2 Extended (compatibility mode)" continues to be available.

To put these latest features to a test, two systems were used: Ubuntu 20.04 and macOS 10.15.5. In this experiment, a document was created in LibreOffice Writer on the Ubuntu machine, which was then opened on the macOS machine to verify the cryptography. For all tests, my LWN PGP key was used.

Initially, the most complicated aspect of getting digital signatures and encryption via PGP working was importing the keys themselves. LibreOffice relies on what it calls the "certificate manager" of the operating system, and each system offers unique challenges. In this case, there is an outstanding bug in LibreOffice from 2018 (version 6.0.2.1) for macOS that made things unnecessarily difficult. In Ubuntu, importing my keys via gpg required logging out in order for them to be accessible by Seahorse (bug report).

Using the available PGP keys in LibreOffice 7.0 to sign or encrypt documents is straightforward. Adding a digital signature to a document is a matter of choosing "Digital Signatures" from the menu (bringing up a list of current signers of the document), then clicking "Sign Document" to add another. Signing a document automatically saves it, and any further modification invalidates the signatures. An example of an ODT document signed by me is available for download, and below is a screenshot of that document:

[PGP Signed Documents in LibreOffice 7.0]

To encrypt an ODT document using PGP is even more straightforward; checking the "Encrypt with GPG key" box when using "Save As" brings up an interface to select the key. Attempting to open an encrypted document without having the private key available causes LibreOffice to oddly prompt for a decryption password (one would hope that no password exists); with the private key available, the document is decrypted transparently.

The LibreOffice 7.0 release includes considerable improvements for interoperability with the Microsoft Office software suite as well. For Microsoft Word, LibreOffice now supports saving in the native 2013/2016/2019 Microsoft Word MS-DOCX formats instead of the previous limitation of only the 2007 compatibility mode format. Compatibility mode was never an ideal solution for interoperability with Microsoft Word, as Microsoft itself has acknowledged: "this mode is intended to ensure users of different versions of Microsoft Office can continue working together and documents created with older versions of Office won't look any different when they're opened in future versions of Office." TDF further explained the move by saying: "this mainly benefits Word users - where documents can use more features and Word's bug fixes since DOCX 1.0 can be applied." The release notes go on to acknowledge that this change adversely impacts users working with Microsoft Word 2010, and encourages those users to switch to LibreOffice.

For LibreOffice Calc, a number of improvements are included in the release. Two new functions for generating non-volatile (generated once per cell) random numbers RAND.NV() and RANDBETWEEN.NV() were added. For functions that allow the use of regular expressions, Calc now correctly handles case-insensitivity flags. The notes on this issue indicate that the "the default case-sensitivity of the functions is not changed [...] the sensitivity only changes after first (?-i) in the regular expression." In another Microsoft Office compatibility improvement, exporting spreadsheets to Microsoft Excel with sheet names with that are more than 31 characters is now supported.

Python macros to automate tasks will no longer be able to use CPython 2.7; the project has upgraded to CPython 3 exclusively. This change may cause problems for some macros; users should expect to address any scripting compatibility breaks between Python 2.7 and 3 when upgrading LibreOffice.

With LibreOffice 7.0 released, the community is looking ahead to the 7.1 release. The wiki for TDF provides the release notes for 7.1, updated as new features and bug fixes are addressed. The two notable improvements listed are an experimental Outline mode for LibreOffice Writer and the ability to add visible signatures to existing PDF files in the LibreOffice Draw application. Writer's Outline mode facilitates making document outlines by providing a way to "fold all text from the current heading to next heading".

Readers who are interested in trying out or upgrading to version 7.0 can download binaries for Linux, macOS, and Windows platforms. The project also provides Flatpak, Snap, and AppImage builds. To get started with LibreOffice, extensive documentation of the project is available. As stated in the announcement, TDF "does not provide any technical support for users"; community support exists on the project's mailing lists and the Ask LibreOffice web site.

A major thrust of the LibreOffice 7.0 release appears to be directed toward making it more compatible with (and more viable as a replacement to) Microsoft Office. With Microsoft shifting its attention to online offerings (Microsoft 365), TDF appears to realize that the idea of being forced into paying an eternal subscription fee for an office-productivity suite of software isn't ideal for anyone but Microsoft. After all, some users may not want to depend on an entirely online office-productivity suite. It is likely TDF hopes to attract those users who need or want their productivity software installed locally.

For those users looking for an open-source online-office solution, TDF is also working on LibreOffice Online concurrently with the offline version. LibreOffice Online is currently "suitable for home users", but TDF "is keen to avoid situations where an unsuitable version is deployed at scale". To underscore this position, LibreOffice Online displays a prominent "not supported" warning if more than ten concurrent documents and/or more than 20 concurrent connections are active.

For readers unfamiliar with the specifics of the project, LibreOffice is primarily released under Mozilla Public License v2. Its community consists of a wide range of corporate and individual contributors; the announcement for 7.0 stated: "74% of commits are from developers employed by companies sitting in the Advisory Board, such as Collabora, Red Hat, and CIB, plus several other organizations, and 26% are from individual volunteers." The project regularly announces security advisories and appears to fix serious vulnerabilities promptly.

LibreOffice 7.0 is a major improvement in a number of key ways, and LibreOffice Online will likely continue to mature into a scalable solution. For current 6.4 users, the project will continue support for "some months of back-ported fixes." In all, thanks to the work of TDF, free Microsoft Office compatible alternatives (online and offline) continue to make significant progress.



to post comments

Exploring LibreOffice 7.0

Posted Aug 19, 2020 23:38 UTC (Wed) by gerdesj (subscriber, #5446) [Link] (4 responses)

"TDF appears to realize that the idea of being forced into paying an eternal subscription fee for an office-productivity suite of software isn't ideal for anyone but Microsoft"

I own a company that is a MS Silver grade thingie. I'm the MD and I have two other partners and 20 odd employees. I'm not averse to being paid for flogging stuff but I do have standards.

The sad old meme of it must be "word" and MS Word at that is a bit sad. Whenever a new version of LO comes up on LWN or el Reg and surely so many more places then the bots ... errrr ... employees come out in defence.

There are bugs in all software but LO is capable of rendering all ... ALL ... YES FUCKING ALL ... of my company docs.

Anyone care to tell me I'm wrong (and why)?

lol laterz luvs

Jon

MD?

Posted Aug 29, 2020 20:15 UTC (Sat) by Hi-Angel (guest, #110915) [Link] (3 responses)

> I'm the MD

Medicinae Doctor? Medical Director? Medical Doctor? Muscular Dystrophy? Maryland?

*sigh* I love abbreviations myself, but it may become confusing when you use something less known. The above is the suggestions Google give me if I query it for "md job abbreviation", so unless you're a medical worker, this abbreviation is clearly not the one people would know.

> There are bugs in all software but LO is capable of rendering all ... ALL ... YES FUCKING ALL ... of my company docs.
>
> Anyone care to tell me I'm wrong (and why)?

Nice to hear that! In terms of speculation, I hear that programmers working in closed corporate environments tend to have lower quality standards and worse skills than ones working on FOSS, so that might be the problem. Idk why is that, but it's something I both seen myself and heard from other people. It always strikes as odd that all these seniors are not even close as good as pretty much everybody you usually meet while contributing in various FOSS projects.

MD?

Posted Aug 29, 2020 20:23 UTC (Sat) by Hi-Angel (guest, #110915) [Link]

> all these seniors

Well, I stand corrected, not "all", rather "most".

MD?

Posted Aug 30, 2020 8:22 UTC (Sun) by nybble41 (subscriber, #55106) [Link]

> Medicinae Doctor? Medical Director? Medical Doctor? Muscular Dystrophy? Maryland? … unless you're a medical worker, this abbreviation is clearly not the one people would know.

A glance at Wikipedia's disambiguation page for MD[1] suggests the title "Managing Director"[2], which seems like the most logical fit under the circumstance. Also known as a chief executive officer or CEO.

[1] https://en.wikipedia.org/wiki/MD
[2] https://en.wikipedia.org/wiki/Managing_director

MD?

Posted Aug 30, 2020 19:19 UTC (Sun) by Wol (subscriber, #4433) [Link]

> Idk why is that, but it's something I both seen myself and heard from other people.

Two reasons:

"If it compiles and looks like it runs, ship it" for commercial software

Peer review by people who have no responsibility to/for you, and every incentive to catch bad code before it causes THEM grief, for FLOSS.

Cheers,
Wol

Bad example :(

Posted Aug 20, 2020 6:15 UTC (Thu) by zdzichu (guest, #17118) [Link] (4 responses)

As for being an impressive example, the attached screenshot tells very different story.
One could think the text editor would be good at displaying text. Yet the kerning is all wrong and looks really bad:
– in "example", the space between "p" and "l" is way too big
– dash in "open-source" is off-center, moved to the right
– "software" has weird blank between "w" and "a"
– "This" has "h" too much to the left, it overlaps with "T" and leaves too much space before "i"
– "e" in document is too much to the left
– "g" in "signed" to much to the left, too
– and so on...

Bad example :(

Posted Aug 20, 2020 7:33 UTC (Thu) by andrewsh (subscriber, #71043) [Link]

Why do you think it’s not because of 1) bad font, 2) bad fontconfig settings?

Bad example :(

Posted Aug 20, 2020 7:37 UTC (Thu) by pgdx (guest, #119243) [Link]

Excellent observations!

I tried in my installed LibreOffice 6.4.5.2 on Ubuntu 20.04. Same OS, same font.

That had none of the problems you point out, so either there's been a regression, or something else is funky. However,
* the "e" in "document" appears to be too much to the _right_ in my example, and
* the "g" in "signed" seems also to be opposite from 7.0?

https://imgur.com/a/RzmxsK0

Bad example :(

Posted Aug 20, 2020 11:25 UTC (Thu) by jschrod (subscriber, #1646) [Link] (1 responses)

A "text editor" doesn't do kerning by itself, it uses the kerning information from fonts.

Thus, it's quite obvious that either your font or your font setup is broken. Nothing any system can do against that.

Bad example :(

Posted Aug 20, 2020 11:31 UTC (Thu) by intelfx (subscriber, #130118) [Link]

> A "text editor" doesn't do kerning by itself, it uses the kerning information from fonts.

Not necessarily true.

> Thus, it's quite obvious that either your font or your font setup is broken. Nothing any system can do against that.

Bad kerning is a known problem in LibreOffice: https://bugs.documentfoundation.org/show_bug.cgi?id=103322

One feature

Posted Aug 20, 2020 6:33 UTC (Thu) by ncm (guest, #165) [Link] (2 responses)

There is only one new feature I would like to see in any future LibreOffice.

It has a choice to save documents in an all-ASCII encoding. This output, with one exception, differs from the previous version of a document proportionally to the amount changed, making it *almost* interopersble with Git.

The one exception making it not is that each line starts with a random-looking number that is different from the number seen on the corresponding line when the doc was read in.

Bug reports have been on file for more than ten years requesting this be fixed. (The first probably mentions Subversion instead of Git.) They don't even need to change the format--just remember the numbers, and write the same ones out!

There are various clumsy/impractical "workarounds" published, for this bug, that normal people cannot use.

(It would, by the way, be helpful for inspecting diffs if punctuation produced a a line break in the text-formatted output; but first things first.)

One feature

Posted Aug 20, 2020 9:43 UTC (Thu) by pgdx (guest, #119243) [Link] (1 responses)

Inspired by your comment I wrote a macro in my LibreOffice that I called ToMarkdown which calls pandoc and writes the file to a .md file. I don't know why, though.

Anyway, then I created a button in the toolbar that calls this macro, so after I save a document now, I can press the ToMarkdown button, and I get pandoc's markdown version of the document.

It doesn't solve your problem, but it was quite cute, because now I can even get a LaTeX typeset PDF from my documents with one click.

REM  *****  BASIC  *****

Sub ToMarkdown
    inname = MID(ThisComponent.getLocation(), 8)
    outname = MID(inname, 1, LEN(inname)-4) & ".md"
    params = inname & " -o " & outname
    Shell("/usr/bin/pandoc", 6, params, true)
    MsgBox "Saved to markdown file " & outname
End Sub

Yes, it's not elegant, and you could/should replace LEN-4 with SEARCH for . to make it work with extensions longer or shorter than 3, but I didn't bother.

One feature

Posted Aug 20, 2020 10:56 UTC (Thu) by pgdx (guest, #119243) [Link]

To complete the previous post, to get the PDF (with opening Evince), I used the following macro:
REM  *****  BASIC  *****

Sub ToLatex
    inname = MID(ThisComponent.getLocation(), 8)
    outname = MID(inname, 1, LEN(inname)-4) & ".pdf"
    params = inname & " -o " & outname
    Shell("/usr/bin/pandoc", 6, params, true)
    Shell("/usr/bin/evince", 1, outname, false)
End Sub
which I have also bound to a button in the toolbar ...

My minor annoyances with collaboration features in LibreOffice 6.x

Posted Aug 20, 2020 8:38 UTC (Thu) by jnareb (subscriber, #46500) [Link]

I hope that they would get to fixing collaboration features in LibreOffice. They are in some ways subpar to what Microsoft Office provides.

* Comments on the margin of document in LibreOffice Writer have too little space reserved for them (too small width), and this is not configurable. As far as I know it is not possible to change the default font of comments, though happily you are able to change fonts in all comments at once. Also, comments are laid out to avoid overlapping, which in some ways is superior to MS Word - but if there is not enough space each comment gets a scrollbar, instead of each comment showing only a summary and expanding on click like in MS Word, which for me is more useful

* The ability to merge divergent versions of documents in LibreOffice Writer seems more limited than what is available in MS Word, though that might be the case of being overly cautious in the documentation describing this feature. I had to use only MS Word version, and it works fine, with a option to store merged document in either of merged files or in new document.

Exploring LibreOffice 7.0

Posted Aug 20, 2020 9:41 UTC (Thu) by Sesse (subscriber, #53779) [Link] (12 responses)

The elephant in the room: GnuPG? In 2020? I thought we had already established that the model simply wasn't tenable for most users; way too hard to use correctly. I had hoped for a discussion of this…

Exploring LibreOffice 7.0

Posted Aug 20, 2020 10:28 UTC (Thu) by dsommers (subscriber, #55274) [Link]

While PGP sure has it's challenges in usability and using it correctly for the common users, it is still the de-facto decentralized encryption method which is widely used. I don't know if it is more used than S/MIME, but S/MIME also has an infrastructure challenge and isn't necessarily easier to use.

ProtonMail builds on PGP, keybase.io does the same. Both of them does an attempt to make encryption more user friendly.

But that said, having an encrypted or digitally signed document doesn't give you anything unless you can validate the signer and the signature. You need some kind of trust chain which can be validated, and a way to verify the validation. What is widely available today is PGP as well as S/MIME. S/MIME depends on a CA issuing user certificates which can be validated against that CA. PGP builds on the web-of-trust model, where each user needs to ensure the public keys they receive have been verified properly.

The S/MIME concept is somewhat comparable to what is used for SSL/TLS services, but gettting a S/MIME certificate for your own usage isn't as easy and can in some cases be quite costly. PGP is and has always been free.

Someone will probably shout out "but blockchain!" ... and yes might give a provide a better alternative, but no solutions AFAIK are widely available in applications common users use to sign, encrypt and verify documents or data. And there' will be quite some job needed to verify that the blockchain implementation is secure enough and to get users to really use it. When it arrives and gets the blessings from crypto-experts and products begins to implement it, things may change. Until then, use what is available today.

I do welcome PGP to the mix in LibreOffice. It is at least something which works well for those who care enough to use it properly.

Exploring LibreOffice 7.0

Posted Aug 20, 2020 12:55 UTC (Thu) by emorrp1 (guest, #99512) [Link] (8 responses)

There's a lot of FUD around PGP online, but I know of no serious high profile replacement. The crypto fundamentals are sound and apparently seem to be secure against nation-state attackers. As always it's mostly key management which is a little trickier, however in the last 5 years there's been massive progress on that front that you can make use of right now!

For email, Autocrypt is the user-friendly solution. For trust, simply make sure to enable TOFU a la ssh. For key distribution use .well-known Web Key Directory. Of course the classic models of WoT and keyservers are still available and work in parallel for those that need them.

Exploring LibreOffice 7.0

Posted Aug 21, 2020 9:53 UTC (Fri) by Sesse (subscriber, #53779) [Link] (6 responses)

There are tons of high-profile replacements! It's just that there's no one-size-fits-all, because the GPG model isn't all that useful. (Note that this isn't about the crypto at all, it's about usability of the model.)

For talking to something centralized, use HTTPS. For secure messaging, use Signal. For sending files, use magic-wormhole. For backups, supposedly use tarsnap, except tarsnap is expensive if you have too much data.

Exploring LibreOffice 7.0

Posted Aug 21, 2020 13:18 UTC (Fri) by emorrp1 (guest, #99512) [Link] (3 responses)

Thank you for reminding me of the alternatives. I wouldn't say https is really an end state, there seems to be a lot of tweaking around the edges still ongoing, like 1.3, esni, doh, quic. Signal = lib(meg)olm in the messaging case, 100% agreed there and I don't know much about magic-wormhole, will have to look into it.

> isn't about the crypto at all, it's about usability of the model

Yes, I thought that's we were actually talking about usability, but I just included it to be clear about why I think there might be a lot of online pushes to avoid GPG, without not actually broken.

Exploring LibreOffice 7.0

Posted Aug 21, 2020 23:16 UTC (Fri) by NYKevin (subscriber, #129325) [Link]

HTTPS might not technically be "done," but that doesn't matter because:

- Users are actually using it.
- Webmasters are actually using it.
- Neither the user nor the webmaster needs to know anything at all about how the cryptography works (although the webmaster does need to follow simple instructions for how to configure their software to use the right set of cipher suites).
- While it may be undergoing further changes, there are multiple widely-deployed implementations of both clients and servers, and all of these implementations are capable of talking to one another with minimal or no difficulty.
- The changes that are happening are almost universally backwards-compatible with older implementations. Even today, you can run netcat google.com 80, type "HEAD / HTTP/1.0" followed by two newlines, and get a reasonable response. (Yes, this is HTTP and not HTTPS. But it's the same story on the HTTPS side, that's just harder to demo.)

Exploring LibreOffice 7.0

Posted Aug 22, 2020 2:26 UTC (Sat) by tialaramex (subscriber, #21167) [Link] (1 responses)

Of the things you listed:

TLS 1.3 is finished, published, widely used.

ESNI is a potential new feature addition which has anyway been obsoleted by ECH (Encrypted Client Hello) and the latter remains under development. So yes you can't have ECH today, but, GPG doesn't offer anything like this, if you hide the envelope of SMTP email it's undeliverable, even if the true identity of the intended recipient remains securely PGP encrypted somewhere.

DoH and all of DPRIVE are completed and actively in use.

QUIC is a new IETF protocol, over which HTTP/3 might run, but that doesn't mean you can't use HTTP/2 today, and millions of people do.

Magic Wormhole is mostly the observation that you can do secure file transport for humans with easy to use primitives plus a PAKE. If you haven't seen a PAKE before that's pretty interesting, but the rest is nothing at all new, it's embarrassing other systems weren't already this easy. It does rest heavily on the _human_ though. PAKEs statistically lose a determined fraction of the time against an active adversary. A human will get sick of the Magic Wormhole not working after at most a handful of tries, but if you let an infinitely patient machine use one obviously a machine will cheerfully do billions attempts and eventually leak the file to a determined and similarly automatic adversary.

Exploring LibreOffice 7.0

Posted Aug 25, 2020 12:13 UTC (Tue) by Lennie (subscriber, #49641) [Link]

And supposedly you can't use Encrypted SNI in China:

https://www.zdnet.com/article/china-is-now-blocking-all-e...

I think the article is probably wrong/misleading based on other reports I've seen: TLS1.3 supposedly works, but Encrypted SNI doesn't.

Encrypted SNI is the experimental variant uses by through th Cloudflare/Firefox collaboration:

https://blog.cloudflare.com/encrypted-sni/

Exploring LibreOffice 7.0

Posted Aug 21, 2020 13:52 UTC (Fri) by LtWorf (subscriber, #124958) [Link]

> For secure messaging, use Signal.

Ah, a centralised non federated protocol that disallows modified clients and that has no real desktop client.

Some people prefer to use regular computers as opposed to crippled computers.

Exploring LibreOffice 7.0

Posted Aug 26, 2020 15:25 UTC (Wed) by gfernandes (subscriber, #119910) [Link]

Really? Tons?

Come now. Let's be realistic. There's only one *practical* way to do encryption in a decentralised way - asymmetric encryption. Which is basically PGP/GPG *and* the Signal protocol. Yes Signal is asymmetric encryption. Not really miles away from PGP, although more user friendly. But then, your laptop typically doesn't have a SIM card to set up using the Signal protocol, or someone would've done it by now.

HTTPS? Seriously? And where would you get your certificates from? Let's Encrypt?

While it seems like a trivial problem to solve, it's actually very hard to be secure and user friendly at the same time.

C'est la vie.

Crypto fundamentals

Posted Aug 22, 2020 2:10 UTC (Sat) by tialaramex (subscriber, #21167) [Link]

> The crypto fundamentals are sound and apparently seem to be secure against nation-state attackers

I am not able to squint at this in a way that makes it seem true, except that maybe you can say something like "Look we support AES" which is bit like pointing out that your bankrupt island republic has secure air defences because it owns a paved runway suitable for F35As, though it doesn't own any F35As.

Things like EFail demonstrate that GnuPG doesn't do (certainly didn't do) Full Recognition Before Processing which means you can't trust the state you're seeing as it might be an intermediary state before, perhaps, the system later says "Oh, that stuff you were looking at? I've actually now realised it was bogus. Sorry". I *think* LibreOffice avoids this but I'm not sure. EFail demonstrates it for several quite independent EMail programs using GnuPG (and S/MIME).

The Web of Trust absolutely must be considered one of these "crypto fundamentals" for PGP and yet it's not workable and so far as I can see you don't have a replacement.

Exploring LibreOffice 7.0

Posted Aug 25, 2020 10:46 UTC (Tue) by ceplm (subscriber, #41334) [Link] (1 responses)

Go ahead and let us know about the viable alternative for personal certificates (not the site-wide ones).

Exploring LibreOffice 7.0

Posted Aug 26, 2020 18:18 UTC (Wed) by jem (subscriber, #24231) [Link]

In some parts of the world it would be useful to be able to create legally binding signatures. For this PGP won't do, you will need to use your ID card.

Next LibreOffice 7.1

Posted Aug 20, 2020 10:17 UTC (Thu) by edomaur (subscriber, #14520) [Link]

"The two notable improvements listed are an experimental Outline mode for LibreOffice Writer..."

I'm really happy to learn that in 7.1 we will finally get an Outline mode in Writer :-) This is something I am craving, each time I move from Word to almost any word processor. My brain is wired to work with bullet lists, outlines, and hierarchical organisations of text or code.


Copyright © 2020, Eklektix, Inc.
This article may be redistributed under the terms of the Creative Commons CC BY-SA 4.0 license
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds