Upvote for photopea.com it’s crazy how much functionality it has, love that site.

the slight technical competency needed to navigate the fediverse might help keep low-quality users away and mitigate the “summer reddit” effect.

There's the answer I was looking for!

I watched a 3-hour Krita beginner's tutorial (can't remember the exact video but the narrator had a strong French accent) and he explained so many tricks and tips - hold down Ctrl to do this, hold down Shift to do another thing - that might not be intuitive from just poking around. But Krita really is the "built by artists, for artists" program once you have a keyboard & tablet config that fits one's personal workflow.

I would have if you hadn't already.

Though TBH if you're a mouse user gimp might actually be better... but practically noone doing serious graphics work is using a mouse. And it's not like in Blender where you might switch back and forth: Krita is tablet zen, make sure to read at least a bit of the manual.

You are reasoning with your own conclusion that in the context of the question about workflow efectivenes, acceptance by users, tool usefullness it does somehow matter much or in any way – was it the library created as an afterthought or a tool created as a try to use library, or both where born at the same time. :) Who cares. It demoes everything GTK has/had, it was/is clone of photohop idea and they lost it long long ago, as it is now much less efective in it's workflows. If it was otherwise, the industry standard would be Gimp, but it is just a gimmics of it.

P.S. I'm 100% linux user, my servers linux, my desktop linux, my phone android (ok, that is halfassed linux :) ), my tools and software used, if and then possible, all are opensource and/or free. And still, after many years beeing totaly in FOSS enviroment, I just can't deny the worfly earned pedestal to Photoshop in its area of expertise. That is not to say that Gimp is somehow bad, by me it's just a remote next, and it doesn't even try to run to the same direction :) and it is his choise.

Paint.NET is lovely, I used to use it a lot for simple image editing tasks, but it's windows-only and by no means a replacement for Photoshop.

There are risks with server security and threat of being hacked

[Citation Needed]. I'm a security professional (my day job involves auditing code). I had a look through the Lemmy source (I'm also a Rust developer) and didn't see anything there that would indicate any security issues. They made good architecture decisions (from a security perspective).

NOTES ABOUT LEMMY SECURITY:

User passwords are hashed with bcrypt which isn't quite as good a choice as argon2 but it's plenty good enough (waaaaay better than most server side stuff where developers who don't know any better end up using completely inappropriate algorithms like SHA-256 or worse stuff like MD5). They hard-coded the use of DEFAULT_COST which I think is a mistake but it's not a big deal (maybe I'll open a ticket to get that changed to a configurable parameter after typing this).

I have some minor nitpicks with the variable naming which can lead to confusion when auditing the code (from a security perspective). For example: form_with_encrypted_password.password_encrypted = password_hash; A hashed password is not the same thing as an "encrypted password". An "encrypted password" can be reversed if you have the key used to encrypt it. A hashed password cannot be reversed without spending enormous amounts of computing resources (and possibly thousands of years in the case of bcrypt at DEFAULT_COST). A trivial variable name refactoring could do wonders here (maybe I should submit a PR).

From an OWASP common vulnerabilities standpoint Lemmy is protected via the frameworks it was built upon. For example, Lemmy uses Diesel for Object Relational Mapping (ORM, aka "the database framework") which necessitates the use of its own syntax instead of making raw SQL calls. This makes it so that Lemmy can (in theory) work with many different database back-ends (whatever Diesel supports) but it also completely negates SQL injection attacks.

Lemmy doesn't allow (executable) JavaScript in posts/comments (via various means not the least of which is passing everything through a Markdown compiler) so cross-site scripting vulnerabilities are taken care of as well as Cross Site Request Forgery (CSRF).

Cookie security is handled via the jsonwebtoken crate which uses a randomly-generated secret to sign all the fields in the cookie. So if you tried to change something in the cookie Lemmy would detect that and throw it out the whole cookie (you'd have to re-login after messing with it). This takes care of the most common session/authentication management vulnerabilities and plays a role in protecting against CSRF as well.

Lemmy's code also validates every single API request very robustly. It not only verifies that any given incoming request is in the absolute correct format it also validates the timestamp in the user's cookie (it's a JWT thing).

Finally, Lemmy is built using a programming language that was engineered from the ground up to be secure (well, free from bugs related to memory management, race conditions, and unchecked bounds): Rust. The likelihood that there's a memory-related vulnerability in the code is exceptionally low and Lemmy has tests built into its own code that validate most functions (clone the repo and run cargo test to verify). It even has a built-in test to validate that tampered cookies/credentials will fail to authenticate (which is fantastic--good job devs!).

REFERENCES:

• Use of DEFAULT_COST: https://github.com/LemmyNet/lemmy/blob/050216eed97380c8c1682ba065cf5e62f0961934/crates/db_schema/src/impls/local_user.rs#L18C20-L18C32
• How actix-web stores cookies: https://docs.rs/actix-web/latest/actix_web/cookie/struct.Cookie.html
• jsonwebtoken EncodingKey: https://docs.rs/jsonwebtoken/8.3.0/jsonwebtoken/struct.EncodingKey.html