LWN: Comments on "Exploring LibreOffice 7.0"

MD?

Wol — Sun, 30 Aug 2020 19:19:09 +0000

> Idk why is that, but it's something I both seen myself and heard from other people.

Two reasons:

"If it compiles and looks like it runs, ship it" for commercial software

Peer review by people who have no responsibility to/for you, and every incentive to catch bad code before it causes THEM grief, for FLOSS.

Cheers,
Wol

MD?

nybble41 — Sun, 30 Aug 2020 08:22:29 +0000

> Medicinae Doctor? Medical Director? Medical Doctor? Muscular Dystrophy? Maryland? … unless you're a medical worker, this abbreviation is clearly not the one people would know.

A glance at Wikipedia's disambiguation page for MD[1] suggests the title "Managing Director"[2], which seems like the most logical fit under the circumstance. Also known as a chief executive officer or CEO.

[1] https://en.wikipedia.org/wiki/MD
[2] https://en.wikipedia.org/wiki/Managing_director

MD?

Hi-Angel — Sat, 29 Aug 2020 20:23:32 +0000

> all these seniors

Well, I stand corrected, not "all", rather "most".

MD?

Hi-Angel — Sat, 29 Aug 2020 20:15:14 +0000

> I'm the MD

Medicinae Doctor? Medical Director? Medical Doctor? Muscular Dystrophy? Maryland?

*sigh* I love abbreviations myself, but it may become confusing when you use something less known. The above is the suggestions Google give me if I query it for "md job abbreviation", so unless you're a medical worker, this abbreviation is clearly not the one people would know.

> There are bugs in all software but LO is capable of rendering all ... ALL ... YES FUCKING ALL ... of my company docs.
>
> Anyone care to tell me I'm wrong (and why)?

Nice to hear that! In terms of speculation, I hear that programmers working in closed corporate environments tend to have lower quality standards and worse skills than ones working on FOSS, so that might be the problem. Idk why is that, but it's something I both seen myself and heard from other people. It always strikes as odd that all these seniors are not even close as good as pretty much everybody you usually meet while contributing in various FOSS projects.

Exploring LibreOffice 7.0

jem — Wed, 26 Aug 2020 18:18:29 +0000

In some parts of the world it would be useful to be able to create legally binding signatures. For this PGP won't do, you will need to use your ID card.

Exploring LibreOffice 7.0

gfernandes — Wed, 26 Aug 2020 15:25:07 +0000

Really? Tons?

Come now. Let's be realistic. There's only one *practical* way to do encryption in a decentralised way - asymmetric encryption. Which is basically PGP/GPG *and* the Signal protocol. Yes Signal is asymmetric encryption. Not really miles away from PGP, although more user friendly. But then, your laptop typically doesn't have a SIM card to set up using the Signal protocol, or someone would've done it by now.

HTTPS? Seriously? And where would you get your certificates from? Let's Encrypt?

While it seems like a trivial problem to solve, it's actually very hard to be secure and user friendly at the same time.

C'est la vie.

Exploring LibreOffice 7.0

Lennie — Tue, 25 Aug 2020 12:13:18 +0000

And supposedly you can't use Encrypted SNI in China:

https://www.zdnet.com/article/china-is-now-blocking-all-e...

I think the article is probably wrong/misleading based on other reports I've seen: TLS1.3 supposedly works, but Encrypted SNI doesn't.

Encrypted SNI is the experimental variant uses by through th Cloudflare/Firefox collaboration:

https://blog.cloudflare.com/encrypted-sni/

Exploring LibreOffice 7.0

ceplm — Tue, 25 Aug 2020 10:46:37 +0000

Go ahead and let us know about the viable alternative for personal certificates (not the site-wide ones).

Exploring LibreOffice 7.0

tialaramex — Sat, 22 Aug 2020 02:26:08 +0000

Of the things you listed:

TLS 1.3 is finished, published, widely used.

ESNI is a potential new feature addition which has anyway been obsoleted by ECH (Encrypted Client Hello) and the latter remains under development. So yes you can't have ECH today, but, GPG doesn't offer anything like this, if you hide the envelope of SMTP email it's undeliverable, even if the true identity of the intended recipient remains securely PGP encrypted somewhere.

DoH and all of DPRIVE are completed and actively in use.

QUIC is a new IETF protocol, over which HTTP/3 might run, but that doesn't mean you can't use HTTP/2 today, and millions of people do.

Magic Wormhole is mostly the observation that you can do secure file transport for humans with easy to use primitives plus a PAKE. If you haven't seen a PAKE before that's pretty interesting, but the rest is nothing at all new, it's embarrassing other systems weren't already this easy. It does rest heavily on the _human_ though. PAKEs statistically lose a determined fraction of the time against an active adversary. A human will get sick of the Magic Wormhole not working after at most a handful of tries, but if you let an infinitely patient machine use one obviously a machine will cheerfully do billions attempts and eventually leak the file to a determined and similarly automatic adversary.

Crypto fundamentals

tialaramex — Sat, 22 Aug 2020 02:10:29 +0000

> The crypto fundamentals are sound and apparently seem to be secure against nation-state attackers

I am not able to squint at this in a way that makes it seem true, except that maybe you can say something like "Look we support AES" which is bit like pointing out that your bankrupt island republic has secure air defences because it owns a paved runway suitable for F35As, though it doesn't own any F35As.

Things like EFail demonstrate that GnuPG doesn't do (certainly didn't do) Full Recognition Before Processing which means you can't trust the state you're seeing as it might be an intermediary state before, perhaps, the system later says "Oh, that stuff you were looking at? I've actually now realised it was bogus. Sorry". I *think* LibreOffice avoids this but I'm not sure. EFail demonstrates it for several quite independent EMail programs using GnuPG (and S/MIME).

The Web of Trust absolutely must be considered one of these "crypto fundamentals" for PGP and yet it's not workable and so far as I can see you don't have a replacement.

Exploring LibreOffice 7.0

NYKevin — Fri, 21 Aug 2020 23:16:03 +0000

HTTPS might not technically be "done," but that doesn't matter because:

- Users are actually using it.
- Webmasters are actually using it.
- Neither the user nor the webmaster needs to know anything at all about how the cryptography works (although the webmaster does need to follow simple instructions for how to configure their software to use the right set of cipher suites).
- While it may be undergoing further changes, there are multiple widely-deployed implementations of both clients and servers, and all of these implementations are capable of talking to one another with minimal or no difficulty.
- The changes that are happening are almost universally backwards-compatible with older implementations. Even today, you can run netcat google.com 80, type "HEAD / HTTP/1.0" followed by two newlines, and get a reasonable response. (Yes, this is HTTP and not HTTPS. But it's the same story on the HTTPS side, that's just harder to demo.)

Exploring LibreOffice 7.0

LtWorf — Fri, 21 Aug 2020 13:52:58 +0000

> For secure messaging, use Signal.

Ah, a centralised non federated protocol that disallows modified clients and that has no real desktop client.

Some people prefer to use regular computers as opposed to crippled computers.

Exploring LibreOffice 7.0

emorrp1 — Fri, 21 Aug 2020 13:18:16 +0000

Thank you for reminding me of the alternatives. I wouldn't say https is really an end state, there seems to be a lot of tweaking around the edges still ongoing, like 1.3, esni, doh, quic. Signal = lib(meg)olm in the messaging case, 100% agreed there and I don't know much about magic-wormhole, will have to look into it.

> isn't about the crypto at all, it's about usability of the model

Yes, I thought that's we were actually talking about usability, but I just included it to be clear about why I think there might be a lot of online pushes to avoid GPG, without not actually broken.

Exploring LibreOffice 7.0

Sesse — Fri, 21 Aug 2020 09:53:39 +0000

There are tons of high-profile replacements! It's just that there's no one-size-fits-all, because the GPG model isn't all that useful. (Note that this isn't about the crypto at all, it's about usability of the model.)

For talking to something centralized, use HTTPS. For secure messaging, use Signal. For sending files, use magic-wormhole. For backups, supposedly use tarsnap, except tarsnap is expensive if you have too much data.

Exploring LibreOffice 7.0

emorrp1 — Thu, 20 Aug 2020 12:55:22 +0000

There's a lot of FUD around PGP online, but I know of no serious high profile replacement. The crypto fundamentals are sound and apparently seem to be secure against nation-state attackers. As always it's mostly key management which is a little trickier, however in the last 5 years there's been massive progress on that front that you can make use of right now!

For email, Autocrypt is the user-friendly solution. For trust, simply make sure to enable TOFU a la ssh. For key distribution use .well-known Web Key Directory. Of course the classic models of WoT and keyservers are still available and work in parallel for those that need them.

Bad example :(

intelfx — Thu, 20 Aug 2020 11:31:41 +0000

> A "text editor" doesn't do kerning by itself, it uses the kerning information from fonts.

Not necessarily true.

> Thus, it's quite obvious that either your font or your font setup is broken. Nothing any system can do against that.

Bad kerning is a known problem in LibreOffice: https://bugs.documentfoundation.org/show_bug.cgi?id=103322

Bad example :(

jschrod — Thu, 20 Aug 2020 11:25:18 +0000

A "text editor" doesn't do kerning by itself, it uses the kerning information from fonts.

Thus, it's quite obvious that either your font or your font setup is broken. Nothing any system can do against that.

One feature

pgdx — Thu, 20 Aug 2020 10:56:27 +0000

To complete the previous post, to get the PDF (with opening Evince), I used the following macro:

REM  *****  BASIC  *****

Sub ToLatex
    inname = MID(ThisComponent.getLocation(), 8)
    outname = MID(inname, 1, LEN(inname)-4) & ".pdf"
    params = inname & " -o " & outname
    Shell("/usr/bin/pandoc", 6, params, true)
    Shell("/usr/bin/evince", 1, outname, false)
End Sub

which I have also bound to a button in the toolbar ...

Exploring LibreOffice 7.0

dsommers — Thu, 20 Aug 2020 10:28:16 +0000

While PGP sure has it's challenges in usability and using it correctly for the common users, it is still the de-facto decentralized encryption method which is widely used. I don't know if it is more used than S/MIME, but S/MIME also has an infrastructure challenge and isn't necessarily easier to use.

ProtonMail builds on PGP, keybase.io does the same. Both of them does an attempt to make encryption more user friendly.

But that said, having an encrypted or digitally signed document doesn't give you anything unless you can validate the signer and the signature. You need some kind of trust chain which can be validated, and a way to verify the validation. What is widely available today is PGP as well as S/MIME. S/MIME depends on a CA issuing user certificates which can be validated against that CA. PGP builds on the web-of-trust model, where each user needs to ensure the public keys they receive have been verified properly.

The S/MIME concept is somewhat comparable to what is used for SSL/TLS services, but gettting a S/MIME certificate for your own usage isn't as easy and can in some cases be quite costly. PGP is and has always been free.

Someone will probably shout out "but blockchain!" ... and yes might give a provide a better alternative, but no solutions AFAIK are widely available in applications common users use to sign, encrypt and verify documents or data. And there' will be quite some job needed to verify that the blockchain implementation is secure enough and to get users to really use it. When it arrives and gets the blessings from crypto-experts and products begins to implement it, things may change. Until then, use what is available today.

I do welcome PGP to the mix in LibreOffice. It is at least something which works well for those who care enough to use it properly.

Next LibreOffice 7.1

edomaur — Thu, 20 Aug 2020 10:17:36 +0000

"The two notable improvements listed are an experimental Outline mode for LibreOffice Writer..."

I'm really happy to learn that in 7.1 we will finally get an Outline mode in Writer :-) This is something I am craving, each time I move from Word to almost any word processor. My brain is wired to work with bullet lists, outlines, and hierarchical organisations of text or code.

One feature

pgdx — Thu, 20 Aug 2020 09:43:59 +0000

Inspired by your comment I wrote a macro in my LibreOffice that I called ToMarkdown which calls pandoc and writes the file to a .md file. I don't know why, though.

Anyway, then I created a button in the toolbar that calls this macro, so after I save a document now, I can press the ToMarkdown button, and I get pandoc's markdown version of the document.

It doesn't solve your problem, but it was quite cute, because now I can even get a LaTeX typeset PDF from my documents with one click.

REM  *****  BASIC  *****

Sub ToMarkdown
    inname = MID(ThisComponent.getLocation(), 8)
    outname = MID(inname, 1, LEN(inname)-4) & ".md"
    params = inname & " -o " & outname
    Shell("/usr/bin/pandoc", 6, params, true)
    MsgBox "Saved to markdown file " & outname
End Sub

Yes, it's not elegant, and you could/should replace LEN-4 with SEARCH for . to make it work with extensions longer or shorter than 3, but I didn't bother.

Exploring LibreOffice 7.0

Sesse — Thu, 20 Aug 2020 09:41:10 +0000

The elephant in the room: GnuPG? In 2020? I thought we had already established that the model simply wasn't tenable for most users; way too hard to use correctly. I had hoped for a discussion of this…

My minor annoyances with collaboration features in LibreOffice 6.x

jnareb — Thu, 20 Aug 2020 08:38:41 +0000

I hope that they would get to fixing collaboration features in LibreOffice. They are in some ways subpar to what Microsoft Office provides.

* Comments on the margin of document in LibreOffice Writer have too little space reserved for them (too small width), and this is not configurable. As far as I know it is not possible to change the default font of comments, though happily you are able to change fonts in all comments at once. Also, comments are laid out to avoid overlapping, which in some ways is superior to MS Word - but if there is not enough space each comment gets a scrollbar, instead of each comment showing only a summary and expanding on click like in MS Word, which for me is more useful

* The ability to merge divergent versions of documents in LibreOffice Writer seems more limited than what is available in MS Word, though that might be the case of being overly cautious in the documentation describing this feature. I had to use only MS Word version, and it works fine, with a option to store merged document in either of merged files or in new document.

Bad example :(

pgdx — Thu, 20 Aug 2020 07:37:54 +0000

Excellent observations!

I tried in my installed LibreOffice 6.4.5.2 on Ubuntu 20.04. Same OS, same font.

That had none of the problems you point out, so either there's been a regression, or something else is funky. However,
* the "e" in "document" appears to be too much to the _right_ in my example, and
* the "g" in "signed" seems also to be opposite from 7.0?

https://imgur.com/a/RzmxsK0

Bad example :(

andrewsh — Thu, 20 Aug 2020 07:33:53 +0000

Why do you think it’s not because of 1) bad font, 2) bad fontconfig settings?

One feature

ncm — Thu, 20 Aug 2020 06:33:37 +0000

There is only one new feature I would like to see in any future LibreOffice.

It has a choice to save documents in an all-ASCII encoding. This output, with one exception, differs from the previous version of a document proportionally to the amount changed, making it *almost* interopersble with Git.

The one exception making it not is that each line starts with a random-looking number that is different from the number seen on the corresponding line when the doc was read in.

Bug reports have been on file for more than ten years requesting this be fixed. (The first probably mentions Subversion instead of Git.) They don't even need to change the format--just remember the numbers, and write the same ones out!

There are various clumsy/impractical "workarounds" published, for this bug, that normal people cannot use.

(It would, by the way, be helpful for inspecting diffs if punctuation produced a a line break in the text-formatted output; but first things first.)

Bad example :(

zdzichu — Thu, 20 Aug 2020 06:15:42 +0000

As for being an impressive example, the attached screenshot tells very different story.
One could think the text editor would be good at displaying text. Yet the kerning is all wrong and looks really bad:
– in "example", the space between "p" and "l" is way too big
– dash in "open-source" is off-center, moved to the right
– "software" has weird blank between "w" and "a"
– "This" has "h" too much to the left, it overlaps with "T" and leaves too much space before "i"
– "e" in document is too much to the left
– "g" in "signed" to much to the left, too
– and so on...

Exploring LibreOffice 7.0

gerdesj — Wed, 19 Aug 2020 23:38:10 +0000

"TDF appears to realize that the idea of being forced into paying an eternal subscription fee for an office-productivity suite of software isn't ideal for anyone but Microsoft"

I own a company that is a MS Silver grade thingie. I'm the MD and I have two other partners and 20 odd employees. I'm not averse to being paid for flogging stuff but I do have standards.

The sad old meme of it must be "word" and MS Word at that is a bit sad. Whenever a new version of LO comes up on LWN or el Reg and surely so many more places then the bots ... errrr ... employees come out in defence.

There are bugs in all software but LO is capable of rendering all ... ALL ... YES FUCKING ALL ... of my company docs.

Anyone care to tell me I'm wrong (and why)?

lol laterz luvs

Jon