Category: Technology

One of the comments on the announcement of LibreOffice 26.8 was a simple question: “So, no AI is now a feature?”

LibreOffice does not reject artificial intelligence out of hand, but an office suite used by tens of millions of people – in schools, hospitals, public bodies, law firms and thousands of other organisations – will not add a feature to its default configuration until that feature can be delivered under the conditions defined by the project in accordance with its principles.

User-controlled execution. The user must be able to choose where inference takes place: on the local computer, on an infrastructure directly controlled by the user, or on a service chosen independently by the user. A default setting that silently redirects to a single provider is not a choice.

No content may leave the computer without authorisation. The content of documents is a user’s asset and, in many implementations, is also legally protected material: medical records, case files, tender documents and student data. Transmission must be the result of a user’s decision and not behaviour carried out in the background by the application.

No telemetry of any kind. LibreOffice does not collect usage data, and this must also apply to AI features.

No dependence on a single provider. An integration that only works with a single company’s API is a lock-in mechanism, regardless of how it is described in the release notes. Interfaces should be open and implementable by multiple backends.

No compromises on format. Generated content must be in ODF format, just like any other content, and must retain its structure, styles and semantics. An assistant that generates documents in a proprietary format perpetuates content lock-in.

Entirely optional. It must be installable, removable, and absent from the user interface for those who do not wish to use it, including administrators deploying the software across thousands of workstations who, due to company policy, do not authorise its use.

Where we stand today

In light of this list, there is no integration that meets all the requirements and that could be deployed, enabled by default, and supported throughout the entire lifecycle of a release. This is an assessment of the current state of the technology and the solutions based on it, and not a judgement on the value of the sector.

In the meantime, users who wish to use AI features can install one of the available extensions, which can be found either on the LibreOffice extensions website or distributed independently. Most connect to a locally running model via Ollama, LM Studio or another OpenAI-compatible endpoint, which means the document never leaves the computer.

These are third-party extensions at various stages of maturity, developed and maintained by their respective authors rather than by The Document Foundation. Users and administrators should assess them as they would any third-party component, checking whether a cloud endpoint is configured and what the provider does with the data it receives. The extension mechanism offers AI functionality to those who want it, without any consequences for all other users.

Why our motivations are different

The reason our position differs from that of the dominant suites has almost nothing to do with the technology.

For a company that sells subscriptions, an AI assistant justifies a price increase and strengthens the case for keeping all documents within its own infrastructure. The functionality and the business model reinforce each other, so integration is not only attractive but almost mandatory.

The Document Foundation is a not-for-profit organisation. There are no subscription tiers to protect, no upsells, no data to monetise. This does not make us wiser than others, but it means we can take the time needed to decide whether something is genuinely useful for our users, as we are not driven by quarterly results.

What lies ahead

The criteria we have listed do not amount to a definitive rejection. The AI sector is evolving rapidly; on-premises inference is becoming manageable on standard hardware; and open models are improving much faster than most of us had anticipated. Should an approach emerge that meets all the conditions, we will evaluate it very carefully.

Until then, there will be no AI of any kind in the default installation; extensions will be available for those who wish to integrate AI features, and we will closely monitor where the technology is actually heading.

On 30 July 2026, the United States Cybersecurity and Infrastructure Security Agency published Open Source Software: Security Principles and Practices, a 31-page guidance document for federal civilian agencies. It is available at no cost and marked TLP:CLEAR, meaning it may be shared without restriction.

The document is addressed to US federal agencies, and it fulfils obligations under two executive orders on federal cybersecurity. It covers four areas: using open source solutions, contributing to open source projects, producing open source software, and evaluating open source artificial intelligence models. The observations below concern the first three.

Its analytical content is not jurisdiction-specific, and public administrations elsewhere — including in Europe — will find that it articulates, in the vocabulary of risk management, several positions that the open source community has been arguing for two decades.

What the guidance actually says

The central claim is more precise than the headlines suggest. CISA does not assert that open source software is more secure than proprietary software. It states that OSS is “no more or less risky than other software,” and locates the difference elsewhere: with open source, an organisation can assess code quality and security directly, rather than relying solely on vendor assurances.

This is a claim about verifiability, not about defect rates. It is also the more defensible claim, and the more consequential one for procurement. An agency evaluating proprietary software is evaluating a vendor’s statement about its own product. An agency evaluating open source software is evaluating the product.

The guidance draws the corollary explicitly. Among the benefits it lists for federal agencies is reduced vendor lock-in: open standards and modifiable code, CISA writes, protect agencies from “proprietary dependency traps.” A national cybersecurity authority has placed lock-in inside a security document rather than a competition-policy one. That is a meaningful shift in where this argument is permitted to live.

The C4 Framework

The most practically useful part of the guidance is Appendix A, which sets out the C4 Framework for assessing whether an open source project is trustworthy. Its premise is that, because contributors may be pseudonymous and are bound by no delivery obligation, trustworthiness cannot be assessed from who produced the software. It must be assessed from how the software was produced — which open source development makes visible in a way that closed development does not.

C4 groups the evidence into four categories:

• Codebase — commit recency, known vulnerabilities, dependency currency.
• Community — number of maintainers, institutional structure, whether the project sits within a foundation.
• Conduct — whether there is a vulnerability disclosure policy, whether code review is required, whether maintainers merge their own commits, the licence, the code of conduct.
• Configuration — whether defaults are secure, and what hardening the software supports.

The framework is applied in five steps: identify measurable criteria, determine risk tolerance and weight the criteria, collect observations (with automated tooling where available), evaluate against each criterion, and compare the result to the tolerance.

We would encourage public administrations to apply this framework to LibreOffice. Every category can be answered from public evidence: a continuous commit history since 2010, a published security policy and disclosure process, mandatory peer review, an OSI-approved licence, a documented code of conduct, and a governance structure — The Document Foundation, a German Stiftung with an elected Board of Directors — that is a matter of public record rather than of assertion.

We would encourage administrations to apply the same framework to every candidate solution, including proprietary ones, and to note which questions can be answered and which cannot.

Contributing, and the support question

The guidance also addresses a question that public administrations regularly raise about open source adoption: who is responsible for fixes. CISA’s answer is that no single entity is obliged to provide them, and that agencies should therefore plan accordingly — assigning internal staff, contracting third parties, or both — while following two principles in dealing with upstream projects: collaborate rather than demand, and push fixes upstream.

This is a fair description of how the LibreOffice ecosystem works. Support, long-term maintenance, and custom development are provided by certified developers and certified migration professionals, whose contributions return to the shared codebase and benefit every other deployment. The guidance is right that this requires organisations to plan for it. It is also right that the resulting improvements are shared rather than captured.

CISA further notes that where a project becomes unmaintained, an organisation may as a last resort take over a fork. This option has no equivalent in proprietary software, where end of support arrives on the supplier’s schedule and offers no remedy at all.

A note on scope

The document does not name any product. CISA states explicitly that it does not endorse commercial entities, products, or services, and nothing in the guidance should be read as an assessment of any particular software. What it provides is a set of criteria. The observation that LibreOffice satisfies them is ours, and rests on evidence that anyone may check.

Open Source Software: Security Principles and Practices is available from CISA: https://www.cisa.gov/resources-tools/resources/open-source-software-security-principles-and-practices

CISA’s announcement: https://www.cisa.gov/news-events/news/cisa-guide-helps-federal-agencies-securely-and-effectively-use-open-source-software

LibreOffice extensions are optional, third-party addons for the suite, that add extra functionality. Bora Yarkın has been working on a new extension for LibreOffice Impress, so let’s hear from him about it…

Tell us about it!

The extension lets you control a LibreOffice Impress presentation from your phone or any other device with a modern web browser.

When you start the remote, LibreOffice displays a QR code. Scan it with your phone and the presentation starts from the first slide. The phone interface then shows the current slide, presenter notes, elapsed time and navigation controls.

I tried to make the process as simple as possible: no separate mobile application and no manual pairing codes.

The remote can be opened from the Slide Show menu in LibreOffice’s top application menu bar—the menu alongside File, Edit, View and the other main menus.

This should not be confused with the Slide Show tab inside LibreOffice’s Tabbed user interface. LibreOffice’s UNO extension API does not currently let me add commands to that built-in tab. When using the Tabbed interface, the remote commands are therefore available under the Extensions tab instead.

The extension currently provides several connection modes:

• Local network: The phone connects directly to the computer running LibreOffice through its local IPv4 address. This is the main mode and the one I have tested most thoroughly.
• Direct IPv6: Works similarly, but uses an IPv6 connection. It is still marked experimental because my home internet connection is currently the only IPv6 network I can properly test with.
• Relay server: A small Python service that can be hosted on Linux or Windows. It is useful when the phone and computer are on different networks or when direct connections are blocked by carrier-grade NAT, firewalls or other network restrictions. It also supports multiple connections, so an organisation can host one relay server on its own infrastructure.
• LocalTunnel: An experimental fallback that creates an outbound connection through the LocalTunnel service. I consider this a last-resort option when the other connection methods are unavailable.

The compatible relay-server package is bundled with the extension. It can be downloaded or extracted directly from the Remote Settings window by selecting “Get Relay Server”. The package includes the required documentation and setup instructions.

To install the extension, download the .oxt file from the LibreOffice Extensions website or GitHub and open it with LibreOffice. It can also be installed manually through Tools > Extensions. After installation, restart LibreOffice if requested.

The extension includes translations for more than 100 languages and automatically follows LibreOffice’s interface language. English and Turkish are the two languages I have personally checked. Many of the other translations were created with ChatGPT, so I cannot guarantee their quality and would be very grateful for corrections from native speakers.

Why did you create it, and what was the process like?

The original inspiration came from Apple Keynote.

When Keynote is installed on both a Mac and an iPhone, the phone can be used to control the presentation while also displaying presenter notes. That feature completely changed the way I give presentations.

Over time, my slides became more professional and less text-heavy. Instead of putting everything on the slide, I started using the presenter notes almost like a teleprompter, with the text I actually planned to say. This helped move the audience’s attention away from reading the screen and back towards me.

That workflow worked perfectly for a long time, but I never really liked Keynote itself. I could not get used to its interface, and Apple’s decision to introduce paid features was the final reason for me to start looking for an alternative.

There were already several possible solutions, but none of them really worked for me.

LibreOffice previously had its own Impress Remote mobile application, but it has not been maintained for a long time and is no longer practical on many current devices and systems.

Browser-based presentation platforms can offer remote-control features, but I did not want my main presentation workflow to depend on an online service. They also do not offer the same flexibility as a full desktop office suite.

Microsoft Office was another possible option, but I am not a fan of Microsoft’s current direction, particularly the increasing integration of Copilot throughout its products.

OnlyOffice Desktop Editors is a good alternative and I used it for a while, but I encountered several bugs and eventually needed features it did not provide.

That brought me to LibreOffice, which I now find more useful and capable than the other office suites I tried. The only thing missing was the remote-presenter experience I had become dependent on with Keynote.

So I decided to build it myself.

I work mainly in IT and I am familiar with programming, but I would not describe myself as an advanced software developer. Before starting this project, I knew almost nothing about LibreOffice’s UNO API.

I began with ChatGPT. I defined the architecture, features, user interface and constraints myself—including requirements such as localisation being mandatory—and used AI to help me understand UNO and implement the code. The result turned out much better than I expected.

The extension was originally only a personal project. The first version was very basic; the web interface did not even have a back button. I had no intention of publishing it. Once it started working reliably, however, I realised that other LibreOffice users might want the same experience. I decided to take the project more seriously and turn it into a complete extension rather than something that only worked on my own computer.

That meant adding a more polished phone interface, connection settings, QR-code generation, IPv6 support, the relay server, LocalTunnel support, localisation, documentation, error handling and packaging.

Publishing it on the LibreOffice Extensions website was much easier than I expected. I created an account, created the project page, entered the information, uploaded the package and submitted it. After roughly a day of review, the extension was available publicly.

How can people help with testing and further development?

The source code and issue tracker are available on GitHub. The repository includes templates for bug reports, feature requests and pull requests.

My main development and testing setup is macOS with an iPhone. I have also tested the extension on Windows and Linux, but those tests were performed under less-than-ideal conditions, including virtual machines, Remote Desktop sessions and a headless Windows Server installation.

Because of that, testing on real Windows and Linux desktop systems would be especially useful.

The areas where community help would be most valuable are:

• Testing different LibreOffice versions
• Testing Windows, Linux and different macOS versions
• Testing Android devices and different mobile browsers
• Testing IPv6 connections between genuinely separate networks
• Testing the relay server in real-world and organisational environments
• Testing unusual firewall, VPN, NAT and carrier network configurations
• Reviewing and correcting translations
• Improving the documentation
• Reporting bugs and suggesting features
• Contributing fixes through pull requests

The local IPv4 mode has been tested extensively across different local networks, internet providers and VPN configurations. The IPv6, relay-server and LocalTunnel modes need broader community testing before I would consider them fully proven.

When reporting a connection problem, including the operating system, LibreOffice version, browser, phone type, selected connection mode and basic network configuration would help enormously.

The project started because I wanted this functionality for myself. Now I would like to make it reliable enough that other LibreOffice users and organisations can confidently use it for their own presentations.