Stefano Zacchiroli

Full professor of computer science at Polytechnic Institute of Paris. Co-founder & CSO Software Heritage. Free Software activist. Previously: Debian leader, Open Source Initiative board.

Homepage: https://upsilon.cc/~zack/
Languages: en, fr, it

Last Notes

2026-09-11 06:28:34 GMT

In other paper news, our article on #uutils, with project maintainer @npub1q02…mk5c and @npub143c…93w0 will appear soon on #IEEESoftware: « #Rust #Coreutils: Rebuilding #Unix Foundations in a Modern Language ». In it we recount the project history and compare the #GNU and Rust coreutils implementations, under various angles.
An #openaccess preprint of the article is already available at https://arxiv.org/abs/2608.07135

2026-09-10 07:37:14 GMT

Our paper, with [@plumtrie](https://mastodon.social/@plumtrie ) and M. Marcozzi, on how CI can stop #backdoor injection in source code at commit (or release) time using fuzzing, is now available: https://arxiv.org/abs/2607.26719
It comes with real, working code that FOSS projects and #security auditors can adopt. The paper artifact shows how effective it is on real-world, historical backdoors.
« Not In My #Git Yard: Catching Backdoors at Commit and Release Time » to be presented at #ASE2026, later this year.

2026-09-08 16:17:09 GMT

- reply

però, per alleggerire: dobbiamo sapere da dove viene quello screenshot di una Debian 3.1 con hostname "latitanza"

2026-08-19 07:04:43 GMT

- reply

it totally does. I made this very same point in this LWN conversation https://lwn.net/Articles/1084404/ a couple of weeks ago where some people were claiming that Codeberg LLM ban will help with fighting scrapers (it will not).

2026-04-18 11:40:06 GMT

- reply

last time I checked, Mistral models were merely open weight, with no training dataset available nor training pipeline released as FOSS. Has that changed?

2025-08-15 17:39:58 GMT

- reply

so, to clarify, do you have evidence that the bots were solving Anubis challenges or not, i.e., it was due to the configuration issue? (I think it's inevitably going to happen if Anubis gets traction. I'm just curious if we're already there or not.) Thanks for your work and transparency on all this.

2025-07-28 09:53:09 GMT

I am recruiting a postdoctoral researcher to work at Polytechnic Institute of Paris for 30 months, in the fields of #SoftwareEngineering and #Cybersecurity The recruited person will work on leveraging @npub1xww…m4mx as a knowledge base to improve the state of the art of (binary) software composition analysis (SCA), to detect the presence and details of #OpenSource software shipped within IT products. See https://institutminestelecom.recruitee.com/l/en/o/post-doctorante-ou-post-doctorant-en-genie-logiciel-et-cybersecurite-cdd-de-30-mois-2-5 for details and application instructions. #getfedihired

2025-03-26 10:06:41 GMT

My team at Polytechnic Institute of Paris/Télécom #Paris school of engineering is looking for a research engineer to conduct development and empirical experiments in various fields, most notable #software #security and #SoftwareEngineering.
Programming skills in #Rust are particularly welcome, even though we are quite polyglots and would also welcome C/Java/OCaml developers 😉
3-year contract, on site in the south of Paris.
Full job description at: https://institutminestelecom.recruitee.com/l/en/o/ingenieure-ou-ingenieur-de-recherche-en-informatique
#getfedihired

2025-03-23 07:56:05 GMT

I find myself tempted by subscribing #AdBlock Premium to filter out cookie walls and the like. Can anyone confirm that even the premium part if actually free software? (I'm willing to pay for it if it is, much less so if not.) I also welcome direct experience reports from people who tried it, especially if based in the EU.

2025-02-28 17:46:57 GMT

Repeat after me: if #Firefox stops being maintained, #LibreWolf is not a viable long-term alternative (nor is any other Firefox-based web browser).

2025-02-19 15:19:13 GMT

I always conclude my bug reports to #opensource projects, or even my first followup message to a bug report filed by others, with a sentence like: "Thanks a lot for maintaining PROJECT, it's amazing!".
It's a little gesture, but it goes a long way.
When you use #freesofware made by others, remember that it is first of all a *gift* that they are giving to all humanity (and you among them), and only second a software product with defects and avenues for improvement.

2025-01-20 08:57:49 GMT

Here in France the #HelloQuitX initiative https://www.helloquitx.com/ to leave #Twitter/X—and join Mastodon or Bluesky as better options—has gathered a lot of attention: politicians are talking about it in prime time on major medias.
That's great!
My only nit with the initiative is that it is *not* encouraging to donate to the chosen Mastodon server (for people choosing that over Bluesky).
A better social media world also needs users to understand there is no free lunch for hosting costs.

2025-01-14 14:46:54 GMT

Very important work by @npub103f…kaf3 , which tries to ensure the right of recipients of #AGPL (but more generally: *GPLs) software to strip disguised "Further restriction" clauses in free/#opensource software: https://sfconservancy.org/news/2025/jan/13/neo4j-amicus/ . It is unfortunately something that happens quite often on the market (even here in France!), where such clauses are regularly used by vendors to turn standard #FOSS licenses into #badgeware ones.

2024-11-10 13:03:31 GMT

#peerreview is doing great: « As strongly requested by the reviewers, here we cite some references [[35], [36], [37], [38], [39], [40], [41], [42], [43], [44], [45], [46], [47]] although they are completely irrelevant to the present work. » from the last paragraph in the introduction of https://www.sciencedirect.com/science/article/pii/S0360319924043957
h/t @npub143c…93w0

2024-08-29 08:57:51 GMT

Great #student opportunity at #CERN: 1-year #internship to work with them and @npub1xww…m4mx to measure/map/visualize the contributions to #FOSS of CERN employees over time, using #SoftwareHeritage archive data. More information and call for applicants here: https://opensource.cern/sw-heritage-impact-opening
#getfedihired

2024-08-03 17:35:51 GMT

Just learned at #FOSSY24 (thanks to @npub1pqc…2h0n ) about the #OpenInfra policy for AI generated content: https://openinfra.dev/legal/ai-policy (v0.9.2 at the time of my writing). It's a very reasonable approach, rooted in the best-practices that mature FOSS projects have applied for a very long time for vetting code contributions.

2020-11-17 16:07:35 GMT

Street art in #Paris is weird these days.
#Debian #GNU/#Linux
https://6-28.mastodon.xyz/media_attachments/files/105/226/517/982/015/190/original/73a5723ed56c6083.jpg