Tag: qgis

At North Road, we are passionate supporters of all things spatial and open source. We love it when this gives us the chance to work with new and exciting technologies, and developing 3D functionality in QGIS is just that!

We are partnering again with our brilliant friends at Lutra Consulting to develop some really neat features focusing on reality capture technology, improved 3D visuals, and upgrading animation support. And there’s more! We also plan to add atmospheric scattering to create more realistic looking 3D scenes and make life easier by adding in scene presets, close various gaps in the identify tool and adding support for gamepads for easier navigation.

Our financial goal to make this happen is €85 000 (about AUD $137,460). If you want to make a contribution please fill in the pledge form before the campaign is set to finish on December 7, 2026. The features will appear in QGIS in 2027 (versions 4.6, 4.8 and 4.10).

Visit the Official crowdfunding campaign page for the QGIS 3D: Reality Capture, Animation & More to read about the detailed proposal and deliverables.

About the project team

We are once again collaborating with our friends at Lutra Consulting, who are leading and organising this effort. We have worked together on many previous campaigns and complement each other in each of our specialist areas. Each company is highly respected and have proven track records in open source GIS.

Together, we’ve put forward a team of outstanding quality and complementary skills:

• Lutra Consulting (based in the UK) has been contributing to QGIS for more than twenty years and are leading developers of the 3D support within QGIS
• North Road (based in Australia) are one of the top contributors to QGIS development and have been responsible for thousands of QGIS features, with a particular focus on beautiful cartographic and analytical capabilities

How this crowdfunding campaign works

If you are new to crowdfunding campaigns, we welcome you! Crowdfunding is a viable model when there are passionate users wanting to support development of features they see a need for. End users (or end-user organisations) pledge an amount they are willing to provide to the campaign, and if the goal is reached, that pledge becomes binding. If the target amount has not been reached then there will be no requirement to pay the pledged amount.

Here are the steps to pledge to the campaign:

1. You pledge the amount on the form – minimum €200 (~AUD$322) – see below “Why a minimum €200?”
2. On December 7th, if we have reached our goal of €85 000, your pledge becomes binding and we will send you a payment link.
3. Once you have paid, you will receive a receipt (and our thanks).
4. We will then start developing the features for inclusion into QGIS in 2027 (versions 4.6, 4.8 and 4.10).

Why a minimum €200?

Running a crowdfunding campaign is not just gloriously developing features – there is also a lot of administration and project management costs involved. We want to keep these costs down and devote as much of the funds as possible to the development work. Want to pledge less than €200? Reach out to your local QGIS User Group or your OSGeo Local Chapter group – they can help combine smaller community contributions to meet the minimum target together.

Timeline

The campaign to pledge funds is set to finish on December 7, 2026. Work will commence when the target for our crowdfunding campaign has been reached. We aim to deliver the promised features over QGIS releases in 2027 (versions 4.6, 4.8 and 4.10).

As part of our Security project for QGIS initiative, we identified a work package titled “Improve Memory Safety.”

Having worked on this topic over the last few months, here is a summary of the issues involved and what has been accomplished so far.

It’s not an easy thing to present this topic. I’ll try not to dive into too much technical details to focus instead on the broader objectives and implications.

Once upon a time, in the United States…

In November 2022, the NSA published a report on software security, in which it stated:

Microsoft and Google have each stated that software memory safety issues are behind around 70 percent of their vulnerabilities. Poor memory management can lead to technical issues as well, such as incorrect program results, degradation of the program’s performance over time, and program crashes.

In other words: 70% of software vulnerabilities stem from memory management issues.

NSA recommends that organizations use memory safe languages ​​when possible and bolster protection through code-hardening defenses such as compiler options, tool options, and operating system configurations.

The NSA recommends using “Memory Safe Languages” (MSLs) or “hardening” the code. QGIS consists of approximately 1.5 million lines of C++ code, a language not “memory safe” by default. I am therefore opting for the “harden the code” approach, rather than a rewrite which, I have to admit, would have had the “advantage” of keeping me employed until retirement.

What’s the problem?

C++ is not a “memory-safe” language by default, as it does not require the explicit management of the lifecycle of the memory segments it uses.

That sentence didn’t make any sense to you, don’t worry, it won’t hinder your understanding of what follows.

C++ developers are expected to be careful: they must ensure they don’t forget to deallocate memory that was previously allocated, while also avoiding deallocating the same memory multiple times, errors that can lead respectively to memory bloat or program crashes.

These memory management issues can be exploited by malicious actors to inject code into a program, potentially allowing them to steal passwords or gain unauthorized access.

A malicious actor

Work performed

Fortunately, C++ offers control structures known as smart pointers, which help manage the memory lifecycle. Using them helps prevent memory leaks and crashes, while also limiting the attack surface.

QGIS currently makes limited use of these. The goal, therefore, is to expand their adoption throughout the codebase and prevent the addition of any new code that fails to utilize them.

To achieve this, I developed a program that rewrites the code to incorporate smart pointers, followed by an extensive review process to ensure no new errors were introduced.

A QGIS contributor in the middle of reviewing a pull request

Why not use AI?

Nowadays, it’s hard to discuss any software engineering topic without bringing up AI (at least we don’t hear about blockchain anymore!), so I feel compelled to answer the question: “Could AI have been used for this task?”—or, to use the terminology favored by “tech-bros,” could it have been “AI-powered”?

The answer is YES. But also NO. For one thing, the QGIS project is still determining its policy regarding AI; for the time being, a moratorium is in place that prohibits its use within the QGIS core.

Furthermore, it would have required a more thorough review. My migration program is deterministic—when it makes a mistake, it always does so in the same way. The same cannot easily be said for a probabilistic machine.

So, does this mean we’re now “memory safe”?

Not quite. We’ve reached a significant milestone, but there’s still more to do. This work will continue over the coming months.

In parallel, I’ve also begun a related project, supported by a QGIS.org grant. The goal is to replace SIP_FACTORY annotations with unique pointers. Explaining the technical details of this, however, would likely scare off the few readers who have made it this far!

This initiative is part of a broader effort, as we believe that all security-related issues must be addressed simultaneously and with equal rigor. After all, what’s the point of installing a reinforced front door if you leave the garage door wide open?

To be continued…

We are committed to a process of continuous improvement—both for the QGIS codebase itself and for the workflows surrounding how the software is contributed to and distributed. It is worth noting that this initiative is not just about security; it also helps to reduce software crashes and memory footprint.

It requires financial support. If you would like to contribute, or if you have any other questions regarding QGIS, please do not hesitate to contact us at mailto:infos+qgis@oslandia.com.

You can stay informed by subscribing to our newsletter and following us on LinkedIn.