Remix.run Logo
ktpsns 2 days ago

An audacity fork. Reason for forking described at https://tenacityaudio.org/docs/_content/Introduction_and_Mot... . Their own summary:

> at the primary reasons were attempts at adding telemetry and a new desktop privacy policy [by the new audacity maintainers]

Previously discussed at https://news.ycombinator.com/item?id=34835200

forgotpwd16 2 days ago | parent | next [-]

So, 4 years since the initial forks and 2 years since the Audacium merge, how Tenacity (basically Tenacity&Saucedacity&Audacium) compares to Audacity?

LeoWattenberg 2 days ago | parent | next [-]

After its inception, Tenacity unfortunately tackled an irrelevant, yet opinionated part of development first: The build system, together with any internal variables saying "audacity" getting replaced with "tenacity". As such, a lot of the work that's gone into it don't manifest to users, and merging any upstream changes takes needlessly long. As a result of this, Tenacity fell behind upstream a lot, being stuck somewhere around Audacity 3.1 while Audacity already was around 3.7. Last month, mercifully, Tenacity got rebased onto Audacity 3.7: https://codeberg.org/tenacityteam/tenacity/pulls/527 (a +261299 -395037 diff!)

As far as user-facing changes go, it's some new themes, a different compressor, keeping features visible which upstream has hidden by default, MKA support without FFmpeg, as well as support for some more niche systems (Haiku, BSD). All of this is in some stages of ongoing; Tenacity 1.4 alpha 1 got released a few weeks ago, and while that does include the rebase, it hasn't ported back all of the changes which were made before the rebase.

Noteworthy: Most of the development is being contributed by one person, Avery King.

As of right now, I'd recommend Audacity 3.7.x over Tenacity, as Audacity 3.x has been in maintenance mode pretty much since 3.6, while Tenacity is currently finding its footing again. Disabling update checking is easy enough anyway.

In the future though, it appears that Tenacity is going to keep alive legacy Audacity for legacy systems while Audacity 4 is on the way of adding more DAW features and dropping support for older systems. Definitely a worthwhile role to inherit.

(disclaimer: I was a designer for Audacity)

PaulDavisThe1st 2 days ago | parent | next [-]

The things that are happening to Audacity 4 have made me ponder doing the opposite: taking Ardour and stripping it down to make an audio file editor ...

LeoWattenberg a day ago | parent [-]

A waveeditor inside a DAW is very helpful anyway; it's the place where you can chop up source files to become loops, and where you can throw in stretch markers to conform fluctuating tempo in the source to your beat. And once you have that going, there's very little in the way of having a template which only shows you that.

In Audacity, our goal is to keep it extremely approachable for beginners, so for us the idea of having one view of a clip in context of the project and a different view in which you only see the clip is something we'd rather not do. A wave editor window or panel separate from the main project timeline is however the industry standard, and as such it might be exactly the sort of feature which would be very at home in Ardour.

PaulDavisThe1st a day ago | parent [-]

> A wave editor window or panel separate from the main project timeline is however the industry standard, and as such it might be exactly the sort of feature which would be very at home in Ardour.

Already landing in Ardour 9. However, at present, since our editing is always non-destructive, you can't do much there other than move start/end markers. We'll likely be doing more work on variable realtime time stretching in the march towards v10, and that will likely be accessible from both the main timeline and dedicated editors (but we'll see).

And yeah, Ardour's current goal is much more focused on being a powerful tool for people who do this stuff a lot, but there are a variety of arguments that support the idea that we need to do something/more to support beginners. We'll see about that too.

gpers0n a day ago | parent | prev [-]

Hello! Indeed, I'm most the one pushing all this forward, and I keep planning to do this because I find it fun! I will take breaks occasionally, but I can assure anyone that I'll still be around. I have plenty of ideas regarding it too.

I do want to mention the build system part though: indeed, there are trade offs of Tenacity's build system vs Audacity's build system. However, on Windows (and hopefully Mac soon), it does allow us to ship newer versions of our dependencies, such as wxWidgets, which means we can do some neat little things. For example, the latest development nightly version of Tenacity (which you can download at https://tenacityaudio.org/nightly) supports Windows dark mode simply because wxWidgets now has support for it. Alas, it's an undocumented features on Windows that can break at any time, but for now, it works, and it's a nice little thing to have. It will especially help when we implement dynamic theming support (which I have figured out how to adapt to light/dark mode changes via wxWidgets). Of course, merging upstream changes can be very long, but we can also work around that. (Sometimes, we are the upstream too, especially with libmad and libid3tag ;). Either way, I find one benefit of it is allowing us to easily use newer dependencies that enable us to use newer features, and while this doesn't matter a whole lot on systems like Linux, *BSD, Haiku, etc., it does help with systems like Windows and (hopefully soon) macOS. (Currently, you can install Tenacity via MacPorts).

Also, I wouldn't necessarily say that work on the build system lead to us falling behind in development necessarily. I'd say that was due to the hiatus we had. Unfortunately, maintainer burnout can happen, and it doesn't help that Tenacity's start had a bit of its own controversy either with naming. At this point, that seems to be mostly behind us. From what I've seen anyways, I don't see many people mention it at all, but I could be wrong.

Regarding the rebase, yes, not everything's been ported back. In fact, for 1.4 alpha 1, I actually intentionally left out one thing: our own themes. I decided I was done dealing with the theme system, so I decided I would go about rewriting it. I had this planned for several years at this point, and there was already some code to experiment with before the rebase. If not for user themes, then it's certainly for the maintenance part of it, as themes should be easier to work with afterwards. (If anyone is interested in what the new theme system would have to offer, then I'd be glad to discuss it! :D)

Finally, would it be appropriate to say we're going to keep legacy Audacity alive "for legacy systems"? Maybe the "legacy Audacity" part, but not "legacy systems". If anything, I think it's safe to say that Tenacity on Linux requires a distribution like Debian 12 or later (including its derivatives). Sure, Debian 12 might be a bit older at this point, but I wouldn't necessary call it "legacy" just yet right now. Do we aim to support older distributions as time goes along? As long as it's reasonable. The same goes with Windows and macOS. In fact, Tenacity requires macOS 10.15 and has for some time. I want to increase the minimum version some time later, at least to macOS 11 if not later, but I'll likely give (what I think should be) plenty of time before that happens.

I think time will have to tell where this all goes. After all, I think there's some purpose for Tenacity to exist considering we've already had over 3,000 downloads for the 64-bit Windows installer for 1.4 alpha 1 alone. It might not be much compared to Audacity, and I think it pales in comparison to Audacity's popularity. To me, however, even 3,000 downloads is quite a lot, and it means something to me. There's also someone looking to package Tenacity for FreeBSD, albeit it appears to be the 1.4 alpha 1 version (which I would prefer the latest stable version for clear reasons). Yes, it's, like you said, a "more niche" system, but it's interest nonetheless.

P.S. I welcome any contributions from any contributors, especially those packaging Tenacity. We don't require any CLA, just the Developer Certificate of Origin (the same one the Linux kernel uses), and neither do we use AI to review contributions ;)

engeljohnb 2 days ago | parent | prev [-]

I've been using both lately. Last I checked, Tenacity was missing some of Audacity's best new features such as real-time effects. Also, Tenacity crashes constantly, whereas Audacity only crashes a lot (on my Thinkpad running Fedora).

cookiengineer 2 days ago | parent | prev [-]

Well, technically the reason for the fork was the implanted backdoor that was executing a binary coming from Muse groups server, hidden as telemetry and an update check. It's not a well built backdoor and the code is easy to spot, as there's not a lot of other http related code in audacity itself.

edit: Check the au3/src/update/UpdateManager.cpp, they're still not hiding this better after all that happened, lol.

[1] https://github.com/audacity/audacity/blob/8d6e45a9756e700b7f...

swiftcoder 2 days ago | parent | next [-]

Can you point out the specific issue here? At a glance it looks like a fairly normal self-update patching process

Orygin 2 days ago | parent | prev | next [-]

I mean, you already are "executing a binary coming from Muse groups server" if you downloaded Audacity from their website. How is an auto update mechanism a backdoor? You have to accept a modal for it to run the downloaded binary.

I guess it could be improved by using and verifying signatures, but it seems pretty on point for a standard windows software auto update feature

gpers0n a day ago | parent | prev | next [-]

To be fair, I'm not sure if that's really an accurate description of it.

Either way, just wanted to say hi! :D

cookiengineer 10 hours ago | parent [-]

You are not the one who lost their loved ones over this, we are way past that point of assumed innocence.

There's a reason for why I am doing what I am doing.

gpers0n 3 hours ago | parent [-]

If it has truly escalated to that point, then I certainly cannot speak further. You are right in that I have been fortunate enough not to lose anyone over such a matter. I do feel sorry for your loss, however, because no one deserves to lose a loved one like that.

LeoWattenberg 2 days ago | parent | prev [-]

You are aware that VLC, LibreOffice and many other FOSS apps have an update checker?

cookiengineer 2 days ago | parent [-]

The problem is not the update check itself, but what the server in Moscow returns. That's the whole point and the reason of me mentioning it.

LeoWattenberg a day ago | parent | next [-]

There is no server in Moscow, and I don't think there ever was. Muse Group left their original office in Kaliningrad for Cyprus pretty much the second the war started, and at this point has no offices or employees left in Russia. The servers always have been bog-standard cloud things, so Cloudflare, DigitalOcean, aws via Netlify and such.

CamperBob2 2 days ago | parent | prev [-]

Not good to hear they're based in Moscow, but that ship has presumably already sailed and sunk if you're running the auto-update code in an existing Audacity installation.

What other concerns besides national origin exist with this code? Nothing seems to qualify as a "back door," certainly.

cookiengineer 2 days ago | parent [-]

Set the system language and timezone, the IP and originating ASN, to areas where APT28/APT29 is having active malware campaigns and see whether you'll receive a sample. Pretty simple.

The real question is whether they have changed their C2 behaviors since Valentine's day in 2023, and whether or not the AstraL1nvx botnet operator images are still available publicly.

LeoWattenberg a day ago | parent [-]

please provide any sort of source that Audacity is, or ever has been, distributing malware.

Orygin a day ago | parent | next [-]

He has none and has been trying to depict Audacity as a Russian malware vector for over a year now, but without providing any source.

cookiengineer a day ago | parent [-]

Technically it's been over 4 years

h4ck_th3_pl4n3t a day ago | parent [-]

Sneed

a day ago | parent | prev [-]
[deleted]