- wlug - list.wlug.org.nz

Android 16 Is Here
by Peter Reutemann 11 Jun '25

11 Jun '25

'Today, we're bringing you Android 16, rolling out first to supported Pixel devices with more phone brands to come later this year. This is the earliest Android has launched a major release in the last few years, which ensures you get the latest updates as soon as possible on your devices. Android 16 lays the foundation for our new Material 3 Expressive design, with features that make Android more accessible and easy to use.' -- source: https://mobile.slashdot.org/story/25/06/10/2021249 Cheers, Peter

1 0

RIP Bill Atkinson
by Lawrence D'Oliveiro 08 Jun '25

08 Jun '25

This article <https://daringfireball.net/linked/2025/06/07/bill-atkinson-rip> reports the death of legendary Apple Macintosh pioneer Bill Atkinson, at the age of 74, from cancer. Atkinson is known for, among other things, the “QuickDraw” graphics engine, which was at the core of how those early Macintoshes could manage graphics drawing at interactive speeds, on a processor running at a nominal 8MHz clock speed, with no hardware acceleration. He also created the MacPaint application, to show off the artistic capabilities of the Macintosh -- and its ease of use. There is a video somewhere of Atkinson’s 2-year-old daughter using MacPaint, her tiny fist barely big enough to cover the mouse, otherwise being quite comfortable figuring out the drawing tools. And later, he created HyperCard, which was one of those forays into “end-user programming” which was perhaps more successful than most. Atkinson is named on Apple’s patent for the “region” structure, which was a compact way of representing arbitrary regions of pixels, which might have holes in them or even consist of entirely disjoint pieces. These structures were heavily used in QuickDraw for clipping graphics drawing (particularly for dealing with overlapping windows), though they could be rendered as graphics objects in their own right. Apple’s patent meant that nobody else could use that structure. For example, X11 had to use a less efficient way of representing pixel regions. The patent did finally expire around 2004, I think it was.

1 0

KDE Targets Windows 10 'Exiles' Claiming 'Your Computer is Toast'
by Peter Reutemann 05 Jun '25

05 Jun '25

'Linux desktop darling KDE is weighing in on the controversy around the impending demise of Windows 10 support with a lurid "KDE for Windows 10 Exiles" campaign. KDE's alarming "Exiles" page opens with the text "Your computer is toast" followed by a warning that Microsoft wants to turn computers running Windows 10 into junk from October 14. "It may seem like it continues to work after that date for a bit, but when Microsoft stops support for Windows 10, your perfectly good computer will be officially obsolete." Beneath a picture of a pile of tech junk, including a rotary telephone and some floppy drives, KDE proclaims: "Windows 10 will degrade as more and more bugs come to light. With nobody to correct them, you risk being hacked. Your data, identity, and control over your device could be stolen."' -- source: https://tech.slashdot.org/story/25/06/04/186206 The exiles page: https://kde.org/for/w10-exiles/ Cheers, Peter

1 0

Meta and Yandex Are De-Anonymizing Android Users' Web Browsing Identifiers
by Peter Reutemann 04 Jun '25

04 Jun '25

'"It appears as though Meta (aka: Facebook's parent company) and Yandex have found a way to sidestep the Android Sandbox," writes Slashdot reader TheWho79. Researchers disclose the novel tracking method in a report: We found that native Android apps -- including Facebook, Instagram, and several Yandex apps including Maps and Browser -- silently listen on fixed local ports for tracking purposes. These native Android apps receive browsers' metadata, cookies and commands from the Meta Pixel and Yandex Metrica scripts embedded on thousands of web sites. These JavaScripts load on users' mobile browsers and silently connect with native apps running on the same device through localhost sockets. As native apps access programmatically device identifiers like the Android Advertising ID (AAID) or handle user identities as in the case of Meta apps, this method effectively allows these organizations to link mobile browsing sessions and web cookies to user identities, hence de-anonymizing users' visiting sites embedding their scripts. This web-to-app ID sharing method bypasses typical privacy protections such as clearing cookies, Incognito Mode and Android's permission controls. Worse, it opens the door for potentially malicious apps eavesdropping on users' web activity. While there are subtle differences in the way Meta and Yandex bridge web and mobile contexts and identifiers, both of them essentially misuse the unvetted access to localhost sockets. The Android OS allows any installed app with the INTERNET permission to open a listening socket on the loopback interface (127.0.0.1). Browsers running on the same device also access this interface without user consent or platform mediation. This allows JavaScript embedded on web pages to communicate with native Android apps and share identifiers and browsing habits, bridging ephemeral web identifiers to long-lived mobile app IDs using standard Web APIs. This technique circumvents privacy protections like Incognito Mode, cookie deletion, and Android's permission model, with Meta Pixel and Yandex Metrica scripts silently communicating with apps across over 6 million websites combined. Following public disclosure, Meta ceased using this method on June 3, 2025. Browser vendors like Chrome, Brave, Firefox, and DuckDuckGo have implemented or are developing mitigations, but a full resolution may require OS-level changes and stricter enforcement of platform policies to prevent further abuse.' -- source: https://yro.slashdot.org/story/25/06/03/205251 Cheers, Peter

1 0

Beware of the Browser-in-the-Middle Attack: What It Is and How to Protect Yourself
by Peter Reutemann 04 Jun '25

04 Jun '25

'A new security threat called the browser-in-the-middle (BITM) attack has recently been uncovered, exposing users—especially those using Apple’s Safari browser—to potential exploits that could compromise their privacy and security. Reports from BleepingComputer and GBHackers highlight how attackers can take advantage of browser fullscreen features to trick users into revealing sensitive information. [...] A browser-in-the-middle attack is a phishing-like technique that leverages the browser’s fullscreen mode to impersonate legitimate websites or system dialogs. By forcing the browser to enter fullscreen mode, attackers can overlay fake login screens, pop-ups, or security warnings that look authentic but actually capture user input such as passwords, credit card numbers, or other personal data. Unlike traditional man-in-the-middle attacks that intercept communications, BITM attacks manipulate the user interface itself to create convincing illusions. Because fullscreen mode hides browser UI elements like the address bar or tabs, users may be unaware they are interacting with a fraudulent page. According to the reports, Safari’s fullscreen API is particularly vulnerable to BITM attacks. Attackers can use JavaScript to force fullscreen without user consent or notification and then display spoofed content that mimics trusted websites or system alerts. This makes Safari users a prime target, although the risk isn’t limited to this browser alone.' -- source: https://cyptd.com/beware-of-the-browser-in-the-middle-attack-what-it-is-and… Cheers, Peter

1 0

OpenSnitch: The Must-Have Application Firewall for Linux
by Peter Reutemann 29 May '25

29 May '25

'When it comes to protecting your Linux system from unwanted network connections, having a good firewall is essential. While most Linux users rely on traditional firewalls like iptables, firewalls, or ufw, these usually work at the network level and don’t give detailed control over which applications can connect to the internet. This is where OpenSnitch comes in, a GNU/Linux application firewall designed to give you control over your outgoing connections on a per-application basis. In this article, we will explore what OpenSnitch is, how it helps secure your Linux machine, and guide you through simple installation and usage steps.' -- source: https://www.tecmint.com/opensnitch-linux-application-firewall/ Cheers, Peter

1 0

Thousands of Asus routers are being hit with stealthy, persistent backdoors
by Peter Reutemann 29 May '25

29 May '25

'Thousands of home and small office routers manufactured by Asus are being infected with a stealthy backdoor that can survive reboots and firmware updates in an attack by a nation-state or another well-resourced threat actor, researchers said. The unknown attackers gain access to the devices by exploiting now-patched vulnerabilities, some of which have never been tracked through the internationally recognized CVE system. After gaining unauthorized administrative control of the devices, the threat actor installs a public encryption key for access to the device through SSH. From then on, anyone with the private key can automatically log in to the device with administrative system rights.' -- source: https://arstechnica.com/security/2025/05/thousands-of-asus-routers-are-bein… Cheers, Peter

1 0

SUSE Is Giving YaST the Dodo Bird Treatment
by Peter Reutemann 26 May '25

26 May '25

'An important piece of Linux history is set to go the way of the passenger pigeon or dodo bird later this year, when SUSE and openSUSE put YaST out to pasture. Widely regarded as a package manager, it’s actually more of a Swiss Army knife configuration tool that can be used to install software, configure hardware, set up networks and servers, and more. Exactly what it can do might be determined by the year in which you’re using it, as its feature set and role within the SUSE ecosystem have changed over the years. Although not very well known outside SUSE circles these days, from its first appearance in 1995 until SUSE was purchased by Novell in 2004, YaST was one of the reasons why SUSE was considered one of the crown jewels of Linux.' -- source: https://fossforce.com/2025/05/suse-is-giving-yast-the-dodo-bird-treatment/ When I was using SuSE back in the day, YaST was really great for newbies to do admin stuff Later on, I switched to webmin (https://github.com/webmin/webmin) as it was not restricted to a particular distro. Cheers, Peter

2 1

“Microsoft has simply given us no other option,” Signal says as it blocks Windows Recall
by Peter Reutemann 22 May '25

22 May '25

'Signal Messenger is warning the users of its Windows Desktop version that the privacy of their messages is under threat by Recall, the AI tool rolling out in Windows 11 that will screenshot, index, and store almost everything a user does every three seconds. Effective immediately, Signal for Windows will by default block the ability of Windows to screenshot the app. Signal users who want to disable the block—for instance to preserve a conversation for their records or make use of accessibility features for sight-impaired users—will have to change settings inside their desktop version to enable screenshots. [...] With no API for blocking Recall in the Windows Desktop version, Signal is instead invoking an API Microsoft provides for protecting copyrighted material. App developers can turn on the DRM setting to prevent Windows from taking screenshots of copyrighted content displayed in the app. Signal is now repurposing the API to add an extra layer of privacy.' -- source: https://arstechnica.com/security/2025/05/signal-resorts-to-weird-trick-to-b… Who would have thought that DRM can be useful... :-) Cheers, Peter

1 0

Hackers Now Testing ‘ClickFix’ Attacks on Linux Systems
by Peter Reutemann 22 May '25

22 May '25

'Security researchers have recently uncovered a new type of cyberattack targeting Linux systems — a technique dubbed “ClickFix.” Originally known for its impact on Windows environments, ClickFix is now being adapted and tested by threat actors against Linux platforms, signaling an expansion in both scope and sophistication. ClickFix is a novel post-exploitation tactic that allows attackers to interact with graphical desktop environments through simulated clicks and UI manipulations. By abusing legitimate tools like xdotool, attackers can automate interactions with graphical interfaces — such as clicking confirmation dialogs, accepting permissions, or launching malicious scripts — even on hardened systems. This type of attack can bypass traditional security mechanisms by operating at the user interface level, making it especially dangerous in environments where users assume GUI-based interactions are secure.' -- source: https://cyptd.com/hackers-now-testing-clickfix-attacks-on-linux-systems/ Cheers, Peter

1 0

Mobile Browsers That Stick Their Noses Into Your Business
by Peter Reutemann 22 May '25

22 May '25

'Some figures hit my desk this morning about mobile browsers and the data they collect that I found interesting enough to want to pass on. Some of this won’t surprise anybody, such as the fact that Chrome is the most data-hungry mobile browser app. What might come as a surprise to many, is that Chrome is the only browser that collects financial information, such as payment methods, card numbers, and bank account details. It also collects contacts from a phone’s address book. The figures came from Surfshark, the cybersecurity folks with an eponymous VPN, which took a look at the 10 browsers it identified as the most popular. Topping the list was Chrome, which presents a somewhat mind-boggling list of privacy intrusions that includes everything from contacts and financial information to data on location, browsing and search history, content — such as photos, videos, audio recordings, uploaded files, and other stuff — usage data, identifiers — device ID, user ID, or IP address — as well as even more data that’s not identified by the study.' -- source: https://fossforce.com/2025/05/mobile-browsers-that-stick-their-noses-into-y… One thing that I wasn't aware of under Android, you will have a unique Ad ID: Settings > Privacy > Ads > Opt out of ad personalization Cheers, Peter

1 0

KDE Is Getting a Native Virtual Machine Manager Called 'Karton'
by Peter Reutemann 21 May '25

21 May '25

'A new virtual machine manager called Karton is being developed specifically for the KDE Plasma desktop, aiming to offer a seamless, Qt-native alternative to GNOME-centric tools like GNOME Boxes. Spearheaded by University of Waterloo student Derek Lin as part of Google Summer of Code 2025, Karton uses libvirt and Qt Quick to build a user-friendly, fully integrated VM experience, with features like a custom SPICE viewer, snapshot support, and a mobile-friendly UI expected by September 2025. Neowin reports: To feel right at home in KDE, Karton is being built with Qt Quick and Kirigami. It uses the libvirt API to handle virtual machines and could eventually work across different platforms. Right now, development is focused on getting the core parts in place. Lin is working on a new domain installer that ditches direct virt-install calls in favor of libosinfo, which helps detect OS images and generate the right libvirt XML for setting up virtual machines more precisely. He's still refining device configuration and working on broader hypervisor support. Another key part of the work is building a custom SPICE viewer using Qt Quick from scratch: If you're curious, here's the list of specific deliverables Lin included in his GSoC proposal, though he notes the proposal itself is a bit outdated [...]. For those interested in the timeline, Lin's GSoC proposal says the official GSoC coding starts June 2, 2025. The goal is to have a working app ready by the midterm evaluation around July 14, 2025, with the final submission due September 1, 2025. ' -- source: https://tech.slashdot.org/story/25/05/20/2223215 Cheers, Peter

1 0

Microsoft Open Sources Windows Subsystem for Linux
by Peter Reutemann 20 May '25

20 May '25

'Windows Subsystem for Linux (WSL) is now open source, Microsoft said Monday. The tool, which allows developers to run Linux distributions directly in Windows, is available for download, modification, and contribution. "We want Windows to be a great dev box," said Pavan Davuluri, corporate VP at Microsoft. "Having great WSL performance and capabilities" allows developers "to live in the Windows-native experience and take advantage of all they need in Linux." First launched in 2016 with an emulated Linux kernel, WSL switched to using the actual Linux kernel in 2019 with WSL 2, improving compatibility. The system has since gained support for GPUs, graphical applications, and systemd. Microsoft significantly refactored core Windows components to make WSL a standalone system before open sourcing it.' -- source: https://news.slashdot.org/story/25/05/19/1654225 Cheers, Peter

1 0

Final Bookworm-Based Raspberry Pi OS Released Ahead of Debian Trixie
by Peter Reutemann 20 May '25

20 May '25

'The Raspberry Pi Foundation has just released a new version of Raspberry Pi OS, their recommended, freely distributed operating system for all Raspberry Pi devices. Still based on Debian 12 ”Bookworm,” this build is likely the last one in this series before Debian 13 “Trixie” arrives later this summer.' -- source: https://linuxiac.com/final-bookworm-based-raspberry-pi-os-released-ahead-of… Cheers, Peter

1 0

Raspberry Pi Connect Goes Stable
by Peter Reutemann 19 May '25

19 May '25

'After just twelve months of public testing, Raspberry Pi Connect—the company’s browser-based remote-access service—officially graduated from beta with the release of version 2.5. According to Raspberry Pi engineer Chris Lowder, the platform’s install base has already topped 100,000 registered boards. Earlier iterations of the software relied on frequent polling: each Pi woke up at regular intervals to ask Raspberry Pi’s servers whether anyone wanted to connect. That design was easy on the cloud side—traffic remained predictable—but it quietly chewed through users’ data plans and power budgets. Version 2.5 replaces that pattern with a single, persistent HTTP connection. Now, when a user presses “Connect” in the web dashboard, the server broadcasts a wake-up event to the board, initiating the handshake on demand instead of on a schedule. Beyond wake-ups, every Connect client has been sending status heartbeats to keep the dashboard in sync. The new release debounces that chatter, dropping superfluous packets and compressing each remaining heartbeat by roughly 50 percent.' -- source: https://linuxiac.com/raspberry-pi-connect-goes-stable/ Anyone got any experience with this that they'd like to share? Cheers, Peter

1 0

Spies hack high-value mail servers using an exploit from yesteryear
by Peter Reutemann 16 May '25

16 May '25

'Threat actors, likely supported by the Russian government, hacked multiple high-value mail servers around the world by exploiting XSS vulnerabilities, a class of bug that was among the most commonly exploited in decades past. XSS is short for cross-site scripting. Vulnerabilities result from programming errors found in webserver software that, when exploited, allow attackers to execute malicious code in the browsers of people visiting an affected website. XSS first got attention in 2005, with the creation of the Samy Worm, which knocked MySpace out of commission when it added more than one million MySpace friends to a user named Samy. XSS exploits abounded for the next decade and have gradually fizzled more recently, although this class of attacks continues now. On Thursday, security firm ESET reported that Sednit, a Kremlin-backed hacking group also tracked as APT28, Fancy Bear, Forest Blizzard, and Sofacy—gained access to high-value email accounts by exploiting XSS vulnerabilities in mail server software from four different makers. Those packages are: Roundcube, MDaemon, Horde, and Zimbra.' -- source: https://arstechnica.com/security/2025/05/spies-hack-high-value-mail-servers… Cheers, Peter

1 0

Google Restores File Permissions For Nexcloud
by Peter Reutemann 16 May '25

16 May '25

'Nextcloud has been in an ongoing battle with Google over the tech giant revoking the All Files permission from the Nextcloud Android App, which prevents users from managing their files on their server. After a blog post and several tech sites reported on the issue, "Google reached out to us [Nexcloud] and offered to restore the permission, which will give users back the functionality that was lost." Nextcloud is working on an app update and hopes to have it pushed out within a week.' -- source: https://tech.slashdot.org/story/25/05/15/208221 Cheers, Peter

2 1

You Can Now Upgrade Ubuntu 24.10 to Ubuntu 25.04, Here’s How
by Peter Reutemann 15 May '25

15 May '25

'After almost a month of waiting, Ubuntu 24.10 (Oracular Oriole) users can finally upgrade their installations to the latest Ubuntu 25.04 (Plucky Puffin) release. Here’s a step-by-step tutorial with screenshots on how to perform the upgrade! Ubuntu 24.10 was released on October 10th, 2024, and will be supported for a couple more months, until July 2025. Since this isn’t an LTS (Long Term Support) release, users might want to consider upgrading to Ubuntu 25.04 as soon as possible. Compared to Ubuntu 24.10, the Ubuntu 25.04 release ships with a newer kernel for better hardware support, namely Linux 6.14, the Mesa 25 graphics stack series for a better gaming experience, the latest GNOME 48 desktop environment, as well as some of the most recent GNU/Linux technologies.' -- source: https://9to5linux.com/you-can-now-upgrade-ubuntu-24-10-to-ubuntu-25-04-here… Cheers, Peter

1 0

Introducing oniux: Kernel-level Tor isolation for any Linux app
by Peter Reutemann 15 May '25

15 May '25

'When launching privacy-critical apps and services, developers want to make sure that every packet really only goes through Tor. One mistyped proxy setting–or a single system-call outside the SOCKS wrapper–and your data is suddenly on the line. That's why today, we are excited to introduce oniux: a small command-line utility providing Tor network isolation for third-party applications using Linux namespaces. Built on Arti, and onionmasq, oniux drop-ships any Linux program into its own network namespace to route it through Tor and strips away the potential for data leaks. If your work, activism, or research demands rock-solid traffic isolation, oniux delivers it.' -- source: https://blog.torproject.org/introducing-oniux-tor-isolation-using-linux-nam… Cheers, Peter

1 0

European Vulnerability Database (EUVD)
by Peter Reutemann 14 May '25

14 May '25

Talking about vulnerabilities... 'The European Vulnerability Database (EUVD) is now fully operational, offering a streamlined platform to monitor critical and actively exploited security flaws amid the US struggles with budget cuts, delayed disclosures, and confusion around the future of its own tracking systems https://euvd.enisa.europa.eu/' -- source: https://mastodon.social/@nixCraft/114501509209870711 Cheers, Peter

1 0

Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations)
by Peter Reutemann 14 May '25

14 May '25

'In July 2024, the upstream Screen maintainer asked us [2] if we could have a look at the current Screen code base. We treated this request with lower priority, since we already had a cursory look at Screen a few years earlier, without finding any problems. When we actually found time to look into it again, we were surprised to find a local root exploit in the Screen 5.0.0 major version update affecting distributions that ship it as setuid-root (Arch Linux and NetBSD). We also found a number of additional, less severe issues that partly also affect older Screen versions still found in the majority of distributions.' -- source: https://www.openwall.com/lists/oss-security/2025/05/12/1 Cheers, Peter

1 0

FreeBSD Wants to Know a Few Things
by Peter Reutemann 14 May '25

14 May '25

'The FreeBSD Core Team and the FreeBSD Foundation have a few questions it would like to ask its users. What this means is that it’s survey time at FreeBSD… again. In other words, 2024’s user survey turns out not to have been the one-off we thought it was, and the FreeBSD Community Survey is looking like it’s going to become an annual event. This year’s survey was announced on Friday will run through May 7. Taking it won’t take much time — 15 minutes the organization says on its website — and the information gleaned from the results will be key for keeping the project on track. The foundation says that last year’s survey was used to help it determine the project’s priorities — which can change from year to year — as well as a guide for its development efforts and community engagement strategies for the upcoming year and beyond. The surveys are helpful for identifying user needs, assessing satisfaction levels, and highlighting areas requiring improvement, such as hardware support, documentation, and contribution processes.' -- source: https://fossforce.com/2025/04/freebsd-wants-to-know-a-few-things/ Link to survey in the referenced article. Anybody on the mailing list using a BSD variant currently? Cheers, Peter

1 0

Redis returns to open source with AGPLv3 license but not everyone is happy
by Peter Reutemann 14 May '25

14 May '25

'Over the last few years, companies like Redis, Elastic, MongoDB, and HashiCorp have abandoned their open-source license roots and switched to proprietary models. However, there is one significant problem with this attempt to squeeze more money from their formerly open-source programs: it doesn't work. Redis, the widely used in-memory key-value database, appears to have figured this out. Last year, Redis dumped its three-clause Berkeley Software Distribution (BSD) license and replaced it with the read-only Redis Source Available License (RSALv2) and Server Side Public License (SSPLv1). Now, Redis has officially returned to an open-source license, announcing that Redis 8 will be available under the open-source GNU Affero General Public License version 3 (AGPLv3). Last year's change was intended to prevent large cloud providers from offering Redis as a managed service without contributing to the project, a challenge many open-source companies face in the cloud era. However, the move ticked off developers. The result was a fork, Valkey, backed by the Linux Foundation and major cloud vendors. Valkey has proven to be very popular. Indeed, Amazon Web Services (AWS), Google, Ericsson, and Oracle have all adopted Valkey. [...] The new AGPLv3 option, effective with the recently released Redis 8, represents a significant shift. AGPLv3 is an Open Source Initiative (OSI)-approved, copyleft license that requires any modifications or derivative works to be released under the same terms, and crucially, mandates that source code be made available to users who interact with the software over a network. This network clause is meant to close the so-called "Software as a Service (SaaS) loophole," ensuring that cloud providers who offer Redis as a service must either open-source their changes or negotiate a commercial license with Redis Inc.' -- source: https://www.zdnet.com/article/redis-returns-to-open-source-with-agplv3-lice… Cheers, Peter

1 0

Nextcloud Cries Foul Over Google Play Store App Rejection
by Peter Reutemann 14 May '25

14 May '25

'Nextcloud has accused Google of sabotaging its Android Files app by revoking the "All files access" permission, which the company says cripples functionality for its 824,000 users and forces reliance on limited alternatives like SAF and MediaStore. The Register reports: Nextcloud's Android Files app is a file synchronization tool that, according to the company, has long had permission to read and write all file types. "Nextcloud has had this feature since its inception in 2016," it said, "and we never heard about any security concerns from Google about it." That changed in 2024, when someone or something at Google's Play Store decided to revoke the permission, effectively crippling the application. Nextcloud was instructed to use "a more privacy-aware replacement." According to Nextcloud, "SAF cannot be used, as it is for sharing/exposing our files to other apps ... MediaStore API cannot be used as it does not allow access to other files, but only media files." Attempts to raise the issue with Google resulted in little more than copy-and-pasted sections of the developer guide. "Despite multiple appeals from our side and sharing additional background, Google is not considering reinstating upload for all files," Nextcloud said. The issue seems to stem from the Play Store. While a fully functional version is available on F-Droid, the Play Store edition is subject to Google's imposed limitations. Regarding the All files access permission, Google's developer documentation states: "If you target Android 11 and declare All files access, it can affect your ability to publish and update your app on Google Play." Nextcloud is clearly aggrieved by the change, as are its users. "This might look like a small technical detail but it is clearly part of a pattern of actions to fight the competition," it said. "What we are experiencing is a piece of the script from the big tech playbook." [...] Are there nefarious actors at play here, an automated process that auto-rejects apps with elevated access requirements, or is it just simple incompetence? "Either way," Nextcloud said, "it results in companies like ours just giving up, reducing functionality just to avoid getting kicked out of their app store." "The issue is that small companies -- like ours -- have pretty much no recourse," it added. Nextcloud went on to criticize oversight processes as slow-moving, with fines that sound hefty but amount to little more than a slap on the wrist. "Big Tech is scared that small players like Nextcloud will disrupt them, like they once disrupted other companies. So they try to shut the door."' -- source: https://tech.slashdot.org/story/25/05/13/2045258 Cheers, Peter

1 0

openSUSE Removes Deepin Desktop Over Security Policy Violations
by Peter Reutemann 09 May '25

09 May '25

'In recent development, the openSUSE project has decided to remove the Deepin Desktop Environment (DDE), well-known for its polished visuals and user-friendly experience, from its repositories, citing substantial packaging policy violations. According to disclosures from the openSUSE security team, a troubling workaround was discovered in the DDE packaging. Specifically, the Deepin community packager introduced a “license agreement” dialog within the deepin-feature-enable package, effectively circumventing standard security review processes required by openSUSE. Ordinarily, components such as D-Bus system service configurations and Polkit policies must undergo stringent review by the SUSE security team before being whitelisted for inclusion in openSUSE distributions. In this case, however, the discovered “license agreement” allowed users to bypass these security checks, installing components flagged by the security team as potentially unsafe simply by accepting the license.' -- source: https://linuxiac.com/opensuse-removes-deepin-desktop-over-security-policy-v… Cheers, Peter

1 0

Linux Drops Support For 486 and Early Pentium Processors
by Peter Reutemann 09 May '25

09 May '25

'ZDNet reports: RIP, 486 processor. You've had a long run since Intel released you back in 1989. While Microsoft stopped supporting you with the release of Windows XP in 2001, Linux kept you alive and well for another 20+ years. But all good things must come to an end, and with the forthcoming release of the Linux 6.15 kernel, the 486 and the first Pentium processors will be sunsetted. Why? Linus Torvalds wrote recently on the Linux Kernel Mailing List (LKML), "I really get the feeling that it's time to leave i486 support behind. There's zero real reason for anybody to waste one second of development effort on this kind of issue." Senior Linux kernel developer Ingo Molnar put Torvalds' remark into context, writing, "In the x86 architecture, we have various complicated hardware emulation facilities on x86-32 to support ancient 32-bit CPUs that very very few people are using with modern kernels. This compatibility glue is sometimes even causing problems that people spend time to resolve, which time could be spent on other things." "This will be the first time Linux has dropped support for a major chip family since 2012, when Linux stopped supporting the 386 family," notes ZDNet's Steven Vaughan-Nichols. "Moving forward, the minimum supported x86 CPU will now be the original Pentium (P5) or newer, requiring the presence of the Time Stamp Counter (TSC) and the CMPXCHG8B (CX8) instruction. These features are absent in the older 486 and early 586 processors, such as the IDT WinChip and AMD Elan families." That said, you can continue running Linux on Pentium CPUs, but you'll have to "run museum kernels," as Torvalds pointed out in 2022 when he first floated the idea of ending support for 486.' -- source: https://hardware.slashdot.org/story/25/05/08/1927245 Cheers, Peter

1 0

Android Maintainer of Linux Distro AnduinOS Revealed to Be Microsoft Employee
by Peter Reutemann 09 May '25

09 May '25

'After gaining attention from Neowin and DistroWatch last week, the sole maintainer behind AnduinOS 1.3 -- a Linux distribution styled to resemble Windows 11 -- decided to reveal himself. He turns out to be Anduin Xue, a Microsoft software engineer, who has been working on the project as a personal, non-commercial endeavor built on Ubuntu. Neowin reports: As a Software Engineer 2 at Microsoft (he doesn't work on Windows), Anduin Xue says he's financially stable and sees no need to commercialize AnduinOS. Explaining the financial aspects of the project, he said: "Many have asked why I don't accept donations, how I profit, and if I plan to commercialize AnduinOS. Truthfully, I haven't thoroughly considered these issues. It's not my main job, and I don't plan to rely on it for a living. Each month, I dedicate only a few hours to maintaining it. Perhaps in the future, I might consider providing enterprise solutions based on AnduinOS, but I won't compromise its original simplicity. It has always been about providing myself with a comfortably themed Ubuntu." In our coverage of the AnduinOS 1.3 release last week, one commenter pointed out that the distro is from China. For some, this will raise issues, but Anduin Xue addressed this in his blog post, too, saying that the source code is available to the public. For this reason, he told lacing the operating system with backdoors for the Chinese government would be "irrational and easily exposed." For those worried that the distribution may be abandoned, Anduin Xue said that he intends to continue supporting it and may even maintain it full-time if sponsorship or corporate cooperation emerges.' -- source: https://linux.slashdot.org/story/25/05/08/1912204 Cheers, Peter

1 0

New GNOME Executive Director Named
by Peter Reutemann 08 May '25

08 May '25

'Phoronix's Michael Larabel reports: Last July it was announced Holly Million was stepping down as the GNOME Foundation's Exeuctive Director after less than a year at the helm. Richard Littauer took over as interim Executive Director while this week a new GNOME Foundation Executive Director was hired. GNOME's new Executive Director is Steven Deobald. Steven Deobald is a Canadian free software advocate and has been a GNOME user since 2002. As the GNOME Foundation Executive Director, Steven wants to focus on transparency and to better ensure financial stability of the GNOME Foundation. ' -- source: https://tech.slashdot.org/story/25/05/07/200259 Cheers, Peter

1 0

Memory-Safe Sudo To Become the Default In Ubuntu
by Peter Reutemann 07 May '25

07 May '25

'Blog post from the Trifecta Tech Foundation, a nonprofit organization that creates secure, open source building blocks for infrastructure software. The foundation is also the developer behind Sudo-rs. From the report: Ubuntu 25.10 is set to adopt sudo-rs by default. Sudo-rs is a memory-safe reimplementation of the widely-used sudo utility, written in the Rust programming language. This move is part of a broader effort by Canonical to improve the resilience and maintainability of core system components. [...] The decision to adopt sudo-rs is in line with Canonical's commitment to Carefully But Purposefully increase the resilience of critical system software, by adopting Rust. Rust is a programming language with strong memory safety guarantees that eliminates many of the vulnerabilities that have historically plagued traditional C-based software. Sudo-rs is part of the Trifecta Tech Foundation's Privilege Boundary initiative, which aims to handle privilege escalation with memory-safe alternatives. ' -- source: https://news.slashdot.org/story/25/05/06/213254 Cheers, Peter

1 0

Open Document Format Turns 20
by Peter Reutemann 07 May '25

07 May '25

' The Open Document Format reached its 20th anniversary on May 1, marking two decades since OASIS approved the XML-based standard originally developed by Sun Microsystems from StarOffice code. Even as the format has seen adoption by several governments including the UK, India, and Brazil, plus organizations like NATO, Microsoft Office's proprietary formats remain the de facto standard. Microsoft countered ODF by developing Office Open XML, eventually getting it standardized through Ecma International. "ODF is much more than a technical specification: it is a symbol of freedom of choice, support for interoperability and protection of users from the commercial strategies of Big Tech," said Eliane Domingos, Chair of the Document Foundation, which oversees LibreOffice -- a fork created after Oracle acquired Sun.' -- source: https://it.slashdot.org/story/25/05/06/0050212 Cheers, Peter

2 1

Fedora 43 to Remove GNOME X11 Support
by Peter Reutemann 07 May '25

07 May '25

'X11 is singing its swan song. While some Linux distributions still rely on it, the major players are steadily moving toward replacing it with Wayland or even dropping X11 support entirely. Now, Fedora is also making clear moves in that direction. That said, yesterday, Neal Gompa made a new proposal to remove every GNOME X11 package from the distribution’s repositories. If the Fedora Engineering and Steering Committee (FESCo) accepts the “Wayland-only GNOME” change for Fedora Linux 43 (scheduled for release in late October or early November), users who still log in to “GNOME on Xorg” will be transparently switched to the default GNOME Wayland session. For GNOME developers, X11 has been on extended life support for quite a while. Upstream maintainers finished addressing the last user-experience blockers with GNOME 48 and plan to disable X11 at compile time in GNOME 49, with complete removal slated for GNOME 50.' -- source: https://linuxiac.com/fedora-43-to-remove-gnome-x11-support/ Cheers, Peter

1 0

Microsoft Makes Fedora an Official Windows Subsystem for Linux (WSL) Distribution
by Peter Reutemann 07 May '25

07 May '25

'Fedora Linux is now officially available as a Windows Subsystem for Linux (WSL) distribution! That's right, folks, following prior testing, you can now run Fedora 42 natively inside Windows using WSL. As someone who considers Fedora to be my favorite Linux distribution, this is a pretty exciting development. Installing it is simple enough. Just open up a terminal and type wsl --install FedoraLinux-42 to get started. After that, launch it with wsl -d FedoraLinux-42 and set your username. No password is required by default, and you'll automatically be part of the wheel group, meaning you can use sudo right out of the gate.' -- source: https://linux.slashdot.org/story/25/05/06/1652215 Cheers, Peter

1 0

Hundreds of E-Commerce Sites Hacked In Supply-Chain Attack
by Peter Reutemann 06 May '25

06 May '25

'Ars Technica reports: Hundreds of e-commerce sites, at least one owned by a large multinational company, were backdoored by malware that executes malicious code inside the browsers of visitors, where it can steal payment card information and other sensitive data, security researchers said Monday. The infections are the result of a supply-chain attack that compromised at least three software providers with malware that remained dormant for six years and became active only in the last few weeks. At least 500 e-commerce sites that rely on the backdoored software were infected, and it's possible that the true number is double that, researchers from security firm Sansec said. Among the compromised customers was a $40 billion multinational company, which Sansec didn't name. In an email Monday, a Sansec representative said that "global remediation [on the infected customers] remains limited." "Since the backdoor allows uploading and executing arbitrary PHP code, the attackers have full remote code execution (RCE) and can do essentially anything they want," the representative wrote. "In nearly all Adobe Commerce/Magento breaches we observe, the backdoor is then used to inject skimming software that runs in the user's browser and steals payment information (Magecart)." The three software suppliers identified by Sansec were Tigren, Magesolution (MGS), and Meetanshi. All three supply software that's based on Magento, an open source e-commerce platform used by thousands of online stores. A software version sold by a fourth provider named Weltpixel has been infected with similar code on some of its customers' stores, but Sansec so far has been unable to confirm whether it was the stores or Weltpixel that were hacked. Adobe has owned Megento since 2018.' -- source: https://it.slashdot.org/story/25/05/05/2034207/hundreds-of-e-commerce-sites… Cheers, Peter

1 0

Happy Birthday To Steve Jobs’ Screed Against Flash
by Lawrence D'Oliveiro 30 Apr '25

30 Apr '25

It was 15 years ago to day that Apple boss Steve Jobs published a blog post railing against Adobe Flash <https://www.theverge.com/apple/657934/happy-birthday-to-steve-jobs-screed-a…>, particularly about how it impinged on Apple’s control over its own platform: If developers grow dependent on third party development libraries and tools, they can only take advantage of platform enhancements if and when the third party chooses to adopt the new features. We cannot be at the mercy of a third party deciding if and when they will make our enhancements available to our developers. In hindsight, we all know now about the problems with lack of open standards, security and battery life. But as always, at the time, there were those who played down these problems and who assumed that, because Flash was so prevalent, it would remain so into the future. There’s a lesson in there, about history repeating itself ...

1 0

Ubuntu 25.04 “Plucky Puffin” Is Now Available for Download, This Is What’s New
by Peter Reutemann 30 Apr '25

30 Apr '25

'Canonical published today the Ubuntu 25.04 (Plucky Puffin) release, the latest stable version of their popular GNU/Linux distribution, featuring up-to-date components and new features. Powered by the latest and greatest Linux 6.14 kernel series for top-notch hardware support, Ubuntu 25.04 features the GNOME 48 desktop environment with the usual enhancements and look that Ubuntu users are used to, specifically the dynamic triple buffering feature for an extra boost on low-end systems. Some exciting changes in Ubuntu 25.04 include an official generic ARM64 (AArch64) desktop ISO targeting virtual machines, ACPI + EFI platforms, and Snapdragon-based WoA devices, as well as initial hardware enablement for the Snapdragon X Elite platform is now included in the Ubuntu Desktop ISO image. The Ubuntu Desktop installer has been updated with support for local file paths for autoinstall import, a new option to replace an existing Ubuntu installation, dual boot improvements with a focus on BitLocker-protected Windows systems, allowing users to install Ubuntu alongside existing BitLocker partitions. Ubuntu 25.04 also brings some networking enhancements as Netplan received support for wpa-psk-sha256 Wi-Fi connections, support for configuring routing policy on the NetworkManager backend, and support for a new functionality in systemd-networkd-wait-online to wait for DNS servers to be configured and reachable before considering an interface to be online. Other than that, the xdg-terminal-exec package is now installed by default for easier access to the default terminal using the Ctrl+Alt+T keyboard shortcut, Papers has been added as the default document viewer instead of Evince, and BeaconDB-powered geolocation services are now enabled by default on new installations. Among other noteworthy changes, the AppArmor package now includes many new profiles for apps to improve sandboxing and mitigate the impact of any exploit in confined apps, the JPEG XL image format is now supported by default, and NVIDIA Dynamic Boost is now enabled by default on supported laptops with NVIDIA GPUs. It also brings full support for Intel Core Ultra Xe2 integrated Intel Arc graphics and Intel Arc B580 and B570 “Battlemage” discrete GPUs, improved GPU and CPU ray tracing rendering performance in apps with Intel Embree support, full hardware accelerated video encoding of AVC, JPEG, HEVC, and AV1 on “Battlemage” devices, new CCS optimization in Intel Compute Runtime, and debugging support for Intel Xe GPUs.' -- source: https://9to5linux.com/ubuntu-25-04-plucky-puffin-is-now-available-for-downl… Cheers, Peter

1 0

OpenBSD 7.7 Released
by Peter Reutemann 30 Apr '25

30 Apr '25

'OpenBSD quietly released the new version (7.7) of its "secure by default" operating system. This is the 58th release. Changes include improved hardware and VMM support, along with many kernel improvements. This release brings several specific improvements, including performance boosts on ARM64, Arm SVE support, AMD SEV virtualization enhancements, better low-memory handling on i386, and improved suspend/hibernate and SMP performance. It also updates graphics drivers with support for AMD Ryzen IA 300, Radeon RX 9070, and Intel Arrow Lake, along with expanded hardware support for MediaTek SoCs.' -- source: https://bsd.slashdot.org/story/25/04/29/0456227 Cheers, Peter

1 0

Firefox Finally Delivers Tab Groups Feature
by Peter Reutemann 30 Apr '25

30 Apr '25

'Firefox has launched its long-awaited tab groups feature, responding to the most upvoted request in Mozilla Connect's three-year history. The feature allows users to organize tabs by name or color through a drag-and-drop interface. Mozilla is now developing an AI-powered "smart tab groups" feature that automatically suggests organization based on open tabs. Unlike competitors, the company said, Firefox processes this data locally, keeping tab information on the user's device rather than sending it to cloud servers.' -- source: https://news.slashdot.org/story/25/04/29/1853259 Cheers, Peter

1 0

CVE Foundation Emerges From Stealth to Rescue CVE Program
by Peter Reutemann 28 Apr '25

28 Apr '25

'I’m guessing that Trump and Musk are behind this, and that this is just another essential thing the government does that they’re trying to break into pieces. The good news is that in this case not only was there a last minute reprieve, but some people saw it coming and made plans to keep things going in case the rug still eventually gets pulled out. If this was the work of the dynamic duo of Pennsylvania Avenue, what they were busy trying to break was the Common Vulnerabilities and Exposures program — better known as CVE — which keeps track of security vulnerabilities found in software so that it can get fixed, hopefully before the bad guys develop a way to exploit the bug. The story started on Tuesday when MITRE — a nonprofit that among other things operates federally funded research and development centers that support various federal government agencies, including the CVE program — sent a letter to CVE board members, telling them that funding for CVE and other related programs was set to expire on Wednesday. As you might imagine, when that news hit the internet, it got social networks buzzing. [...] Then on Wednesday morning, at about the time that tech oriented websites and tech-focused users on social sites were at peak craziness over this withdrawal of funding, a monkey wrench was thrown into the machinery by a news release from the CVE Foundation, an organization that nobody — at least not anybody that I know — has heard anything about until now. “The CVE Foundation has been formally established to ensure the long-term viability, stability, and independence of the Common Vulnerabilities and Exposures Program, a critical pillar of the global cybersecurity infrastructure for 25 years,” the release opened, under the heading: “CVE Foundation Launched to Secure the Future of the CVE Program.' -- source: https://fossforce.com/2025/04/cve-foundation-emerges-from-stealth-to-rescue… Cheers, Peter

1 0

Lenovo May Be Avoiding the 'Windows Tax' By Offering Cheaper Laptops With Pre-Installed Linux
by Peter Reutemann 28 Apr '25

28 Apr '25

'"The U.S. and Canadian websites for Lenovo offered U.S. $140 and CAD $211 off on the same ThinkPad X1 Carbon model when choosing any one of the Linux-based alternatives," reports It's FOSS News: This was brought to my attention thanks to a Reddit post... Others then chimed in, saying that Lenovo has been doing this since at least 2020 and that the big price difference shows how ridiculous Windows' pricing is... Not all models from their laptop lineup, like ThinkPad, Yoga, Legion, LOQ, etc., feature an option to get Linux pre-installed during the checkout process. Luckily, there is an easy way to filter through the numerous laptops. Just go to the laptops section (U.S.) on the Lenovo website and turn on the "Operating System" filter under the Filter by specs sidebar menu. The article end with an embedded YouTube video showing a VCR playing a videotape of a 1999 local TV news report... about the legendary "Windows Refund Day" protests.' -- source: https://linux.slashdot.org/story/25/04/27/0127203 Cheers, Peter

2 1

Linus Torvalds Expresses His Hatred For Case-Insensitive File-Systems
by Peter Reutemann 28 Apr '25

28 Apr '25

'Some patches for Linux 6.15-rc4 (updating the kernel driver for the Bcachefs file system) triggered some "straight-to-the-point wisdom" from Linus Torvalds about case-insensitive filesystems, reports Phoronix. Bcachefs developer Kent Overstreet started the conversation, explaining how some buggy patches for their case-insensitive file and folder support were upstreamed into the Bcachefs kernel driver nearly two years ago: When I was discussing with the developer who did the implementation, I noted that fstests should already have tests. However, it seems I neglected to tell him to make sure the tests actually run... It is _not_ enough to simply rely on the automated tests. You have to have eyes on what your code is doing. Overstreet added "There's a story behind the case insensitive directory fixes, and lessons to be learned." To which Torvalds replied.... "No." "The only lesson to be learned is that filesystem people never learn." Torvalds: Case-insensitive names are horribly wrong, and you shouldn't have done them at all. The problem wasn't the lack of testing, the problem was implementing it in the first place. The problem is then compounded by "trying to do it right", and in the process doing it horrible wrong indeed, because "right" doesn't exist, but trying to will make random bytes have very magical meaning. And btw, the tests are all completely broken anyway. Last I saw, they didn't actually test for all the really interesting cases — the ones that cause security issues in user land. Security issues like "user space checked that the filename didn't match some security-sensitive pattern". And then the shit-for-brains filesystem ends up matching that pattern *anyway*, because the people who do case insensitivity *INVARIABLY* do things like ignore non-printing characters, so now "case insensitive" also means "insensitive to other things too".... Dammit. Case sensitivity is a BUG. The fact that filesystem people *still* think it's a feature, I cannot understand. It's like they revere the old FAT filesystem _so_ much that they have to recreate it — badly. And this led to a very lively back-and-forth discussion.' -- source: https://linux.slashdot.org/story/25/04/27/0547245 Cheers, Peter

1 0

'Linux Mint Debian Edition 7' Gets OEM Support
by Peter Reutemann 15 Apr '25

15 Apr '25

'Linux Mint Debian Edition 7 "will come with full support for OEM installations," according to their monthly newsletter, so Linux Mint "can be pre-installed on computers which are sold throughout the World. It's a very important feature and it's one of the very few remaining things which wasn't supported by Linux Mint Debian Edition." Slashdot reader BrianFagioli speculates that "this could be a sign of something much bigger." OEM installs are typically reserved for operating systems meant to ship on hardware. It's how companies preload Linux on laptops without setting a username, password, or timezone... Mint has supported this for years — but only in its Ubuntu-based version. So why is this feature suddenly coming to Linux Mint Debian Edition, which the team has repeatedly described as a contingency? In other words, if the Debian variant is merely a plan B, why make it ready for OEMs? Their blog post goes on to speculate about possible explanations (like the hypothetical possibility of dissatisfaction with Snap packages or Canonical's decisions around telemetry and packaging).' -- source: https://linux.slashdot.org/story/25/04/12/0518218 Cheers, Peter

2 1

The EFF's 'Certbot' Now Supports Six-Day Certs
by Peter Reutemann 15 Apr '25

15 Apr '25

'10 years ago "certificate authorities normally issued certificate lifetimes lasting a year or more," remembers a new blog post Thursday by the EFF's engineering director. So in 2015 when the free cert authority Let's Encrypt first started issuing 90-day TLS certificates for websites, "it was considered a bold move, that helped push the ecosystem towards shorter certificate life times." And then this January Let's Encrypt announced new six-day certificates... This week saw a related announcement from the EFF engineering director. More than 31 million web sites maintain their HTTPS certificates using the EFF's Certbot tool (which automatically fetches free HTTPS certificates forever) — and Certbot is now supporting Let's Encrypt's six-day certificates. (It's accomplished through ACME profiles with dynamic renewal at 1/3rd of lifetime left or 1/2 of lifetime left, if the lifetime is shorter than 10 days): There is debate on how short these lifetimes should be, but with ACME profiles you can have the default or "classic" Let's Encrypt experience (90 days) or start actively using other profile types through Certbot with the --preferred-profile and --required-profile flags. For six day certificates, you can choose the "shortlived" profile. Why shorter lifetimes are better (according to the EFF's engineering director): - If a certificate's private key is compromised, that compromise can't last as long. - With shorter life spans for the certificates, automation is encouraged. Which facilitates robust security of web servers. - Certificate revocation is historically flaky. Lifetimes 10 days and under prevent the need to invoke the revocation process and deal with continued usage of a compromised key.' -- source: https://it.slashdot.org/story/25/04/14/0356212 Cheers, Peter

1 0

Adobe Gets Bullied Off Bluesky
by Lawrence D'Oliveiro 12 Apr '25

12 Apr '25

Adobe creates a couple of accounts on the Bluesky social network, only to meet a storm of opprobrium, bile, and just plain animosity <https://futurism.com/adobe-bullied-bluesky>. The fact that the company is able to get people to keep paying it more and more money, even as they hate its guts, is quite an achievement. It must take some pretty extensive (and expensive) marketing campaigns.

1 0

Microsoft is About To Launch Recall For Real This Time
by Peter Reutemann 11 Apr '25

11 Apr '25

'Microsoft is starting to gradually roll out a preview of Recall, its feature that captures screenshots of what you do on a Copilot Plus PC to find again later, to Windows Insiders. From a report: This new rollout could indicate that Microsoft is finally getting close to launching Recall more widely. Microsoft originally intended to launch Recall alongside Copilot Plus PCs last June, but the feature was delayed following concerns raised by security experts. The company then planned to launch it in October, but that got pushed as well so that the company could deliver "a secure and trusted experience."' -- source: https://it.slashdot.org/story/25/04/11/0143227 I guess, it's time to turn off video chat with Windows users, unless you would want to be recorded - accidentally or not... I wonder whether they claim "fair use" to include data from their worldwide user base in their model training data. Copyright infringements seem to be fine if you're big like MS or OpenAI, the rest of us can get sued. Cheers, Peter

1 0

slowroads.io
by Lawrence D'Oliveiro 09 Apr '25

09 Apr '25

Found this website which does ... nothing, really. No points to win, no money to pay, no prize, no goal, just drive ... on and on ... with various choices of vehicle and terrain (including some off-Earth). Seems a paid version is being promised for Steam, but in the meantime ... just enjoy your sophisticated Web browser generating absolutely pointless real-time 3D graphics.

1 0

Ubuntu 25.04 “Plucky Puffin” Enters Public Beta Testing with Linux 6.14, GNOME 48
by Peter Reutemann 09 Apr '25

09 Apr '25

'Canonical released today the beta version of the upcoming Ubuntu 25.04 (Plucky Puffin) release for public beta testing, so it’s time to take a look at what to expect from the final release. Powered by the recently released Linux 6.14 kernel and featuring the latest and greatest GNOME 48 desktop environment, Ubuntu 25.04 (codename Plucky Puffin) promises many goodies like the triple buffering feature from Ubuntu, Papers as the default document viewer replacing Evince, and BeaconDB-powered geolocation services. The Ununtu Desktop installer received a new option to replace an existing Ubuntu installation and improvements to dual boot user experience with a focus on BitLocker-protected Windows systems. Users can now install Ubuntu alongside existing BitLocker partitions if enough unallocated space and dual boot support is now available for encrypted installations and other advanced scenarios. Netplan received support for wpa-psk-sha256 Wi-Fi connections, support for configuring routing-policy on the NetworkManager backend, and support for a new functionality in systemd-networkd-wait-online to wait for DNS servers to be configured and reachable before considering an interface to be online.' -- source: https://9to5linux.com/ubuntu-25-04-plucky-puffin-enters-public-beta-testing… Cheers, Peter

1 0

Akamai becomes the official distributor of the Linux kernel
by Peter Reutemann 09 Apr '25

09 Apr '25

Open Source watch reports: 'When I was a young--well, younger anyway--squirt, I ftped my Linux kernel code from Ted T’so, one of the first Linux kernel developers, personal PC, tsx-11.mit.edu. I was glad to do it! Before T'so set up his repository, you had to download the files from Linus Toravalds' machine in Helsinki, Finland, which was s l o w. Mind you, at the time, I recall I downloaded it at a "blazing" fast 64 Kilobits per second (Kbps) over an ISDN line. Hey, it was great in its day. Things have gotten orders of magnitude faster since those days! Now, Akamai, the well-known content delivery network (CDN) and cloud company, has announced a multi-year partnership with the Linux Kernel Organization. This collaboration aims to provide critical infrastructure support for the development and distribution of the Linux kernel, ensuring uninterrupted access for its global network of developers. Akamai will leverage its infrastructure to support kernel.org, the primary platform for Linux kernel source code distribution. This partnership is crucial for maintaining Linux security and performance.' -- source: https://opensourcewatch.beehiiv.com/p/akamai-becomes-the-official-distribut… Cheers, Peter

1 0

20 Years Of Git
by Lawrence D'Oliveiro 08 Apr '25

08 Apr '25

The Git version control system for software development is now 20 years old <https://www.tomshardware.com/software/git-turns-20-as-we-celebrate-decades-…>.

1 0

Comparison Of Python Asyncio-Supporting Web Frameworks
by Lawrence D'Oliveiro 08 Apr '25

08 Apr '25

Trying to decide whether Quart or Starlette was the better bet for a higher-level web framework, I came across this comparison, from just a few years ago, of those two and some other possibilities at different levels <https://www.laac.dev/blog/should-you-use-asyncio-next-python-web-applicatio…>. As far as I can tell, it’s only slightly out of date: the Stripe issue they link to shows that that now includes async support for its Python API.

1 0

The Rise Of “Frankenstein” Laptops In New Delhi’s Repair Markets
by Lawrence D'Oliveiro 08 Apr '25

08 Apr '25

India has long had a, shall we say, “informal engineering” culture, where backstreet operators put together improvised machinery of various kinds from whatever parts are available. Now this extends to assembling working laptops out of the parts of broken ones <https://www.theverge.com/tech/639126/india-frankenstein-laptops>. This allows Indians on low incomes (which is much of the country) an alternative to unaffordable new-built machines. There is a downside to these operations, and that is the health risks from exposure to toxic materials. Seems the Indian Government is becoming aware that it can be helpful to these homegrown industries if it passed some good right-to-repair laws, as is happening in many Western countries. One question that isn’t answered in the article is: what OS are these recycled/refurbished machines running? I can’t imagine that Microsoft would offer Windows licences for them at anything resembling OEM prices. And I don’t think the company would accept that there is such a thing as a “secondhand” Windows licence.

1 0

Open-Source Tool Designed To Throttle PC and Server Performance Based On Electricity Pricing
by Peter Reutemann 04 Apr '25

04 Apr '25

'Robotics and machine learning engineer Naveen Kul developed WattWise, a lightweight open-source CLI tool that monitors power usage via smart plugs and throttles system performance based on electricity pricing and peak hours. Tom's Hardware reports: The simple program, called WattWise, came about when Naveen built a dual-socket EPYC workstation with plans to add four GPUs. It's a power-intensive setup, so he wanted a way to monitor its power consumption using a Kasa smart plug. The enthusiast has released the monitoring portion of the project to the public now, but the portion that manages clocks and power will be released later. Unfortunately, the Kasa Smart app and the Home Assistant dashboard was inconvenient and couldn't do everything he desired. He already had a terminal window running monitoring tools like htop, nvtop, and nload, and decided to take matters into his own hands rather than dealing with yet another app. Naveen built a terminal-based UI that shows power consumption data through Home Assistant and the TP-Link integration. The app monitors real-time power use, showing wattage and current, as well as providing historical consumption charts. More importantly, it is designed to automatically throttle CPU and GPU performance. Naveen's power provider uses Time-of-Use (ToU) pricing, so using a lot of power during peak hours can cost significantly more. The workstation can draw as much as 1400 watts at full load, but by reducing the CPU frequency from 3.7 GHz to 1.5 GHz, he's able to reduce consumption by about 225 watts. (No mention is made of GPU throttling, which could potentially allow for even higher power savings with a quad-GPU setup.) Results will vary based on the hardware being used, naturally, and servers can pull far more power than a typical desktop -- even one designed and used for gaming. WattWise optimizes the system's clock speed based on the current system load, power consumption as reported by the smart plug, and the time -- with the latter factoring in peak pricing. From there, it uses a Proportional-Integral (PI) controller to manage the power and adapts system parameters based on the three variables.' -- source: https://hardware.slashdot.org/story/25/04/03/0110212 -- blog: https://www.naveen.ing/cli-for-smartplugs/ -- github: https://github.com/naveenkul/WattWise Cheers, Peter

1 0

EndeavourOS Mercury Neo Launches with KDE Plasma 6.3, NVIDIA 570, and Mesa 25
by Peter Reutemann 02 Apr '25

02 Apr '25

'The EndeavourOS team announced today the release and general availability of EndeavourOS Mercury Neo as a maintenance update to the EndeavourOS Mercury release addressing various issues and updating core components. EndeavourOS Mercury landed on February 10th, 2025, powered by Linux kernel 6.13 and featuring the KDE Plasma 6.2.5 desktop environment on both the live environment and the offline installation option. EndeavourOS Mercury Neo is here to bump the kernel to Linux 6.13.7 and the live session to KDE Plasma 6.3.3. In addition, this release improves the installation to automatically create a 2GB EFI partition instead of a 1GB partition when choosing systemd in the auto-install option. According to the devs, this change will give users more space and freedom to install multiple kernels and other desirable options. EndeavourOS Mercury Neo also removes the obsolete NVIDIA options from the NVIDIA boot menu, fixes the Arch Linux mirror ranking bug, and removes the xwaylandvideobridge package from the installation script since it was removed upstream. Moreover, it updates the NVIDIA graphics driver to version 570.124.04, the Mesa graphics stack to version 25.0.1, the Calamares graphical installer to version 25.02.2.1-2, the Mozilla Firefox web browser to version 136.0.2, and the XOrg Server display server to version 21.1.16. EndeavourOS Mercury Neo is available for download right now from the official website. Since EndeavourOS follows a rolling-release model where you install once and receive updates forever, existing users need only to update their installations by running the sudo pacman -Syu command in the Terminal app.' -- source: https://9to5linux.com/endeavouros-mercury-neo-launches-with-kde-plasma-6-3-… Cheers, Peter

1 0

Linux Kernel Might Get Smarter Reboots
by Peter Reutemann 01 Apr '25

01 Apr '25

'Something interesting recently emerged on the Linux kernel front—a new patch series titled “Live Update Orchestrator,” authored by Google’s engineer Pasha Tatashin and built on top of an earlier set of patches commonly referred to as the KHO v5 patch series. It aims to enable smooth kernel updates—referred to as “Live Update”—so that certain devices remain fully operational during the transition from an old kernel to a new one. Essentially, the innovative Live Update Orchestrator (LUO) subsystem intends to minimize system downtime by preserving device states across a reboot, particularly benefiting dynamic cloud environments where even minor disruptions can be unwelcome. According to the developers, this approach uses a state-machine mechanism to orchestrate the transition. The LUO subsystem tracks progress through several states—“normal,” “prepared,” and “updated”—and ties them together through callback APIs. These callbacks allow other kernel subsystems (e.g., KVM, IOMMU, interrupts, the new dev_liveupdate device layer, and memory management) to integrate seamlessly into the live update workflow.' -- source: https://linuxiac.com/linux-kernel-might-get-smarter-reboots/ Cheers, Peter

1 0

Google makes Android development private, will continue open source releases
by Peter Reutemann 27 Mar '25

27 Mar '25

'Google is planning a major change to the way it develops new versions of the Android operating system. Since the beginning, large swaths of the software have been developed in public-facing channels, but that will no longer be the case. This does not mean Android is shedding its open source roots, but the process won't be as transparent. Google has confirmed to Android Authority that all Android development work going forward will take place in Google's internal branch. This is a shift from the way Google has worked on Android in the past, which featured frequent updates to the public AOSP branch. Anyone can access AOSP, but the internal branches are only available to Google and companies with a Google Mobile Services (GMS) license, like Samsung, Motorola, and others. According to the company, it is making this change to simplify things, building on a recent change to trunk-based development. As Google works on both public and private branches of Android, the two fall out of sync with respect to features and API support. This forces Google to tediously merge the branches for every release. By focusing on the internal branch, Google claims it can streamline releases and make life easier for everyone. When new versions of Android are done, Google says it will continue to publish the source code in AOSP as always. Supposedly, this will allow developers to focus on supporting their apps without keeping track of pending changes to the platform in AOSP. Licensed OEMs, meanwhile, can just focus on the lively internal branch as they work on devices that can take a year or more to launch.' -- source: https://arstechnica.com/gadgets/2025/03/google-makes-android-development-pr… Cheers, Peter

1 0

Linux Kernel 6.14 Is a Big Leap Forward In Performance, Windows Compatibility
by Peter Reutemann 27 Mar '25

27 Mar '25

'A report from ZDNet, written by Steven Vaughan-Nichols: Despite the minor delay, Linux 6.14 arrives packed with cutting-edge features and improvements to power upcoming Linux distributions, such as the forthcoming Ubuntu 25.04 and Fedora 42. The big news for desktop users is the improved NTSYNC driver, especially those who like to play Windows games or run Windows programs on Linux. This driver is designed to emulate Windows NT synchronization primitives. What that feature means for you and me is that it will significantly improve the performance of Windows programs running on Wine and Steam Play. [...] Gamers always want the best possible graphics performance, so they'll also be happy to see that Linux now supports recently launched AMD RDNA 4 graphics cards. This approach includes support for the AMD Radeon RX 9070 XT and RX 9070 graphics cards. Combine this support with the recently improved open-source RADV driver and AMD gamers should see the best speed yet on their gaming rigs. Of course, the release is not just for gamers. Linux 6.14 also includes several AMD and Intel processor enhancements. These boosts focus on power management, thermal control, and compute performance optimizations. These updates are expected to improve overall system efficiency and performance. This release also comes with the AMDXDNA driver, which provides official support for AMD's neural processing units based on the XDNA architecture. This integration enables efficient execution of AI workloads, such as convolutional neural networks and large language models, directly on supported AMD hardware. While Rust has faced some difficulties in recent months in Linux, more Rust programming language abstractions have been integrated into the kernel, laying the groundwork for future drivers written in Rust. [...] Besides drivers, Miguel Ojeda, Rust for Linux's lead developer, said recently that the introduction of the macro for smart pointers with Rust 1.84: derive(CoercePointee) is an "important milestone on the way to building a kernel that only uses stable Rust functions." This approach will also make integrating C and Rust code easier. We're getting much closer to Rust being grafted into Linux's tree. In addition, Linux 6.14 supports Qualcomm's latest Snapdragon 8 Elite mobile processor, enhancing performance and stability for devices powered by this chipset. That support means you can expect to see much faster Android-based smartphones later this year. This release includes a patch for the so-called GhostWrite vulnerability, which can be used to root some RISC-V processors. This fix will block such attacks. Additionally, Linux 6.14 includes improvements for the copy-on-write Btrfs file system/logical volume manager. These primarily read-balancing methods offer flexibility for different RAID hardware configurations and workloads. Additionally, support for uncached buffered I/O optimizes memory usage on systems with fast storage devices.' -- source: https://linux.slashdot.org/story/25/03/26/2110211 Cheers, Peter

1 0

Developer Loads Steam On a $100 ARM Single Board Computer
by Peter Reutemann 24 Mar '25

24 Mar '25

'"There's no shortage of videos showing Steam running on expensive ARM single-board computers with discrete GPUs," writes Slashdot reader VennStone. "So I thought it would be worthwhile to make a guide for doing it on (relatively) inexpensive RK3588-powered single-board computers, using Box86/64 and Armbian." The guides I came across were out of date, had a bunch of extra steps thrown in, or were outright incorrect... Up first, we need to add the Box86 and Box64 ARM repositories [along with dependencies, ARMHF architecture, and the Mesa graphics driver]... The guide closes with a multi-line script and advice to "Just close your eyes and run this. It's not pretty, but it will download the Steam Debian package, extract the needed bits, and set up a launch script." (And then the final step is sudo reboot now.) "At this point, all you have to do is open a terminal, type 'steam', and tap Enter. You'll have about five minutes to wait... Check out the video to see how some of the tested games perform." At 720p, performance is all over the place, but the games I tested typically managed to stay above 30 FPS. This is better than I was expecting from a four-year-old SOC emulating x86 titles under ARM. Is this a practical way to play your Steam games? Nope, not even a little bit. For now, this is merely an exercise in ludicrous neatness. Things might get a wee bit better, considering Collabora is working on upstream support for RK3588 and Valve is up to something ARM-related, but ya know, "Valve Time"... "You might be tempted to enable Steam Play for your Windows games, but don't waste your time. I mean, you can try, but it ain't gonna work."' -- source: https://games.slashdot.org/story/25/03/23/1922228 Cheers, Peter

2 1

Rebooting A Retro PDP-11 Workstation - and Its Classic 'Venix' UNIX
by Peter Reutemann 24 Mar '25

24 Mar '25

'This week the "Old Vintage Computing Research" blog published a 21,000-word exploration of the DEC PDP-11, the 16-bit minicomputer sold by Digital Equipment Corporation. Slashdot reader AndrewZX calls the blog post "an excellent deep dive" into the machine's history and capabilities "and the classic Venix UNIX that it ran." The blogger still owns a working 1984 DEC Professional 380, "a tank of a machine, a reasonably powerful workstation, and the most practical PDP-adjacent thing you can actually slap on a (large) desk." But more importantly, "It runs PRO/VENIX, the only official DEC Unix option for the Pros." In that specific market it was almost certainly the earliest such licensed Unix (in 1983) and primarily competed against XENIX, Microsoft's dominant "small Unix," which first emerged for XT-class systems as SCO XENIX in 1984. You'd wonder how rogue processes could be prevented from stomping on each other in such systems when neither the Intel 8086/8088 nor the IBM PC nor the PC/XT had a memory management unit, and the answer was not to try and just hope for the best. It was for this reason that IBM's own Unix variant PC/IX, developed by Interactive Systems Corporation under contract as their intended AT&T killer, was multitasking but single-user since in such an architecture there could be no meaningful security guarantees... One of Venix's interesting little idiosyncrasies, seen in all three Pro versions, was the SUPER> prompt when you've logged on as root (there is also a MAINT> prompt when you're single-user... Although Bill Gates had been their biggest nemesis early on, most of the little Unices that flourished in the 1980s and early 90s met their collective demise at the hands of another man: Linus Torvalds. The proliferation of free Unix alternatives like Linux on commodity PC hardware caused the bottom to fall out of the commercial Unix market. The blogger even found a 1989 log for the computer's one and only guest login session — which seems to consist entirely of someone named tom trying to exit vi. But the most touching part of the article comes when the author discovers a file named /thankyou that they're certain didn't come with the original Venix. It's an ASCII drawing of a smiling face, under the words "THANK YOU FOR RESCUING ME". "It's among the last files created on the system before it came into my possession..." It's all a fun look back to a time when advances in semiconductor density meant microcomputers could do nearly as much as the more expensive minicomputers (while taking up less space) — leaving corporations pondering the new world that was coming: As far back as 1974, an internal skunkworks unit had presented management with two small systems prototypes described as a PDP-8 in a VT50 terminal and a portable PDP-11 chassis. Engineers were intrigued but sales staff felt these smaller versions would cut into their traditional product lines, and [DEC president Ken] Olsen duly cancelled the project, famously observing no one would want a computer in their home.' -- source: https://tech.slashdot.org/story/25/03/22/1927247 Cheers, Peter

2 1

Raspberry Pi Announces New Tool for Customized Software Images
by Peter Reutemann 24 Mar '25

24 Mar '25

'"For developers and organisations that require a custom software image, a flexible and transparent build system is essential," according to an announcement Friday at Raspberry Pi.com. "[T]o support these customers, we have created rpi-image-gen, a powerful new tool designed to put you in complete control of your Raspberry Pi images." If you're building an embedded system or an industrial controller, you'll need complete control over the software resident on the device, and home users may wish to build their own OS and have it pre-configured exactly the way they want... rpi-image-gen is an alternative to pi-gen, which is the tool we use to create and deploy the Raspberry Pi OS distribution. rpi-image-gen... offers a very granular level of control over file system construction and software image creation... [B]eing able to help reduce software build time, provide guaranteed ownership of support, and reuse standard methodologies to ensure authenticity of software were all of paramount importance, and among the reasons why we created a new home-grown build tool for Raspberry Pi devices... There is a small number of examples in the tree which demonstrate different use cases of rpi-image-gen [including the lightweight image slim and webkiosk for booting into browser kiosk mode]. All create bootable disk images and serve to illustrate how one might use rpi-image-gen to create a bespoke image for a particular purpose. The number of examples will grow over time and we welcome suggestions for new ones... Visit the rpi-image-gen GitHub repository to get started. There, you'll find documentation and examples to guide you through creating custom Raspberry Pi images. Some technical details from the announcement. - "Similar to pi-gen, rpi-image-gen leverages the power, reliability, and trust of installing a Debian Linux system for the device. However, unlike pi-gen, rpi-image-gen introduces some new concepts [profiles, image layouts, and config] which serve to dictate the build footprint and installation." - The tool also lets you exclude from your package "things that would otherwise be installed as part of the profile." - The tool's GitHub repository notes that it also allows you output your software bill of materials (SBOM) "to list the exact set of packages that were used to create the image." And it can even generate a list of CVEs identified from the SBOM to "give consumers of your image confidence that your image does not contain any known vulnerabilities."' -- source: https://build.slashdot.org/story/25/03/23/0012253 Cheers, Peter

1 0

GIMP 3.0 Released
by Peter Reutemann 18 Mar '25

18 Mar '25

'GIMP 3.0 has been released after over a decade of development. Highlights include a refined GTK3 interface with scroll wheel tab navigation, a new splash screen, improved HiDPI icon support, enhanced color management, a stable public API, and support for more file formats. 9to5Linux reports: GIMP 3.0 also brings improvements to non-destructive editing by introducing an optional "Merge Filters" checkbox at the bottom of NDE filters that merges down the filter immediately after it's committed, along with non-destructive filters on layer groups and the implementation of storing version of filters in GIMP's XCF project files. Among other noteworthy changes, the GEGL and babl components have been updated with new features and many improvements, such as Inner Glow, Bevel, and GEGL Styles filters, some plugins saw small enhancements, and it's now possible to export images with different settings while leaving the original image unchanged. There's also a new PDB call that allows Script-Fu writers to use labels to specify filter properties, a brand new named-argument syntax, support for loading 16-bits-per-channel LAB PSD files, support for loading DDS images with BC7 support, early-binding CMYK support, and support for PSB and JPEG-XL image formats. On top of that, GIMP 3.0 introduces new auto-expanding layer boundary and snapping options, an updated search pop-up to show the menu path for all entries while making individual filters searchable, a revamped alignment tool, and support for "layer sets," replacing the older concept of linked layers. ' -- source: https://tech.slashdot.org/story/25/03/17/1948219 Cheers, Peter

1 0

Wine Releases Framework Mono 6.14
by Peter Reutemann 11 Mar '25

11 Mar '25

'Today marks the release of Framework Mono 6.14, the first major Mono release in five years and the first under WineHQ's stewardship. This update includes long-awaited improvements such as native macOS ARM64 support, enhancements to System.Windows.Forms for X11, better COM interface support, and various stability fixes. Phoronix reports: In addition to the native macOS ARM64 support and System.Windows.Forms improvements for X11, some of the other Mono 6.14 improvements carried out over the past half-decade include improved support for generated COM interfaces, many warning fixes, addressing common cases where processes would hang on exit, and more. As for the "Framework Mono" name rather than just Mono, the release announcement explains: "Framework Mono is the project previously hosted at https://github.com/mono/mono, which was then simply called Mono. I have made this change to distinguish it from 'monovm' and 'Wine Mono', which are different projects. Framework Mono is a cross-platform runtime compatible with .NET Framework." ' -- source: https://tech.slashdot.org/story/25/03/10/2055237 Cheers, Peter

1 0

Emacs 30.1 Released: New Features, Installation, and Usage Guide
by Peter Reutemann 07 Mar '25

07 Mar '25

'GNU Emacs is one of the oldest text editors. It was created by Richard Stallman, the founder of the Free Software movement and GNU project. He is also the creator of the GNU C compiler and Debugger. Emacs is a versatile and highly configurable text editor with hundreds of keybindings and commands. With numerous configuration settings, it’s arguably one of the text editors with a steep learning curve, so most developers, system administrators, and regular Linux users prefer Nano or Vim editors. Despite the complexity of learning the ins and outs of Emacs, it’s not entirely hostile to beginners, and with the right learning strategy and guidance, you’ll be comfortable in no time. In this guide, we will hold your hand and walk you through the Emacs editor. By the end of this guide, you will have a decent amount of knowledge to get started with using the Emacs editor.' -- source: https://www.linuxtoday.com/blog/emacs-30-1-released-new-features-installati… Cheers, Peter

2 1

Phrase Of The Week: “Vegetative Electron Microscopy”
by Lawrence D'Oliveiro 05 Mar '25

05 Mar '25

Amusing summary <https://www.computerworld.com/article/3836728/you-thought-genai-hallucinati…> of research into how bad AIs can get in some of the rubbish results they produce. We knew they could lose their hold on reality and start making things up, but did you know they could also cheat, and tell lies about that cheating when confronted with it? For example, when given charge of doing share trades, and told not to (illegally) take advantage of insider information, they might do so anyway, and then simply deny it when challenged. Oh, and the phrase “vegetative electron microscopy” is complete nonsense; it originated when an AI was processing multicolumn text, and saw words next to each other which were in separate columns, not part of the same sentence at all, and ran them together anyway. From there, the phrase somehow spread to other publications ...

1 0

Blender - Oscar win for Flow
by Peter Reutemann 03 Mar '25

03 Mar '25

'Making Flow – Interview with director Gints Zilbalodis Flow, the animated feature film following the mystical journey of a dark grey cat and his companions, is the manifestation of Blender’s mission, where a small, independent team with a limited budget is able to create a story that moves audiences worldwide, and achieve recognition with over 60 awards, including a Golden Globe for Best Animation and two Oscar nominations. In this interview, Gints Zilbalodis, writer and director (and more!) of the film, shares how Blender was instrumental in the creation of the film.' -- sources: https://www.blender.org/user-stories/making-flow-an-interview-with-director… https://www.reuters.com/lifestyle/flow-wins-best-animated-feature-film-osca… Cheers, Peter

2 1

Mozilla Revises Firefox's Terms of Use, Clarifies That They Don't Own Your Data
by Peter Reutemann 03 Mar '25

03 Mar '25

'"We need a license to allow us to make some of the basic functionality of Firefox possible," Mozilla explained Wednesday in a clarification a recent Terms of Use update. "Without it, we couldn't use information typed into Firefox, for example. It does NOT give us ownership of your data or a right to use it for anything other than what is described in the Privacy Notice." But Friday they went further, and revised those new Terms of Use "to more clearly reflect the limited scope of how Mozilla interacts with user data," according to a Mozilla blog post. More details from the Verge: The particular language that drew criticism was: "When you upload or input information through Firefox, you hereby grant us a nonexclusive, royalty-free, worldwide license to use that information to help you navigate, experience, and interact with online content as you indicate with your use of Firefox." That language has been removed. Now, the language in the terms says: "You give Mozilla the rights necessary to operate Firefox. This includes processing your data as we describe in the Firefox Privacy Notice. It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox. This does not give Mozilla any ownership in that content...." Friday's post additionally provides some context about why the company has "stepped away from making blanket claims that 'We never sell your data.'" Mozilla says that "in some places, the LEGAL definition of 'sale of data' is broad and evolving," and that "the competing interpretations of do-not-sell requirements does leave many businesses uncertain about their exact obligations and whether or not they're considered to be 'selling data.'" Mozilla says that "there are a number of places where we collect and share some data with our partners" so that Firefox can be "commercially viable," but it adds that it spells those out in its privacy notice and works to strip data of potentially identifying information or share it in aggregate.' -- source: https://news.slashdot.org/story/25/03/01/2111254 Cheers, Peter

1 0

Steam Deck & PC Gaming
by Lawrence D'Oliveiro 26 Feb '25

26 Feb '25

PC gaming is still a bigger business than consoles, according to <https://arstechnica.com/gaming/2025/01/way-more-game-makers-are-working-on-…>. And the Linux-powered Steam Deck has been pioneering the new handheld segment of the PC gaming market. But figures on Steam Deck sales are hard to come by. Here <https://newsletter.gamediscover.co/p/steam-deck-everything-you-were-afraid> is an attempt to tease out, from the available hints, how popular the product actually is. That article is over a year old by now, but it estimates that there were 3-4 million Steam Decks sold by that point. I think we can safely say another million or more in units has been added to that since then. One concrete figure from the Steam Hardware Survey <https://store.steampowered.com/hwsurvey/Steam-Hardware-Software-Survey-Welc…> is that about 2.3% of all Steam users are on Linux. This looks like 0.7% specifically on the Steam Deck, so other Linux would be about 1.6%. Another linked survey reports that over half of Steam Deck users run other game emulation systems (e.g. PlayStation 2, Game Boy, GameCube) on their Decks.

1 1

Pi-hole 6 Is Here: Now Faster, Smarter, and More Secu
by Peter Reutemann 25 Feb '25

25 Feb '25

'The much-anticipated Pi-hole 6, a network-wide ad blocker that acts as a DNS sinkhole to block advertisements, trackers, and malicious domains at the network level, has been officially released, now featuring an embedded web server and a new REST API directly integrated into the pihole-FTL binary. This eliminates the need for Lighttpd and PHP, reducing the installation footprint and boosting overall performance. Moreover, the new API introduces server-side pagination for the query log, ensuring a faster and more responsive user experience. Next, advanced filtering gets a boost by introducing support for subscribed allowlists, also known as “Antigravity.” These allowlists work similarly to traditional blocklists but allow domains rather than denying them, giving users more nuanced control over what content gets filtered. Additionally, configuration management has been made more user-friendly by consolidating multiple settings files into a single, richly commented TOML file located at “/etc/pihole/pihole.toml.” Whether you prefer direct file editing, command line tweaks, API usage, or environment variables—Pi-hole 6 has you covered. It’s also worth noting that the user interface has received a complete overhaul. With settings now divided into Basic and Expert modes, users can tailor their experience based on their comfort level.' -- source: https://linuxiac.com/pi-hole-6-is-here-now-faster-smarter-and-more-secure/ Cheers, Peter

2 1

Greg Kroah-Hartman Supports Rust in the Kernel
by Peter Reutemann 24 Feb '25

24 Feb '25

'Report from Phoronix: Linux's second-in-command Greg Kroah-Hartman has also been a big proponent of Rust kernel code. He's crafted another Linux kernel mailing list post [Wednesdsay] outlining the benefits of Rust and encouraging new kernel code/drivers to be in Rust rather than C. Greg KH makes the case that the majority of the kernel bugs are due to "stupid little corner cases in C that are totally gone in Rust." "As someone who has seen almost EVERY kernel bugfix and security issue for the past 15+ years... and who sees EVERY kernel CVE issued, I think I can speak on this topic," Kroah-Hartman began. Here's some excerpts from his remarks. Citing corner cases like overwrites of memory, error path cleanups, use-after-free mistakes and forgetting to check error values, Kroah-Hartman says he's "all for... making these types of problems impossible to hit." That's why I'm wanting to see Rust get into the kernel, these types of issues just go away, allowing developers and maintainers more time to focus on the REAL bugs that happen (i.e. logic issues, race conditions, etc.)... [F]or new code / drivers, writing them in Rust where these types of bugs just can't happen (or happen much much less) is a win for all of us, why wouldn't we do this...? Rust isn't a "silver bullet" that will solve all of our problems, but it sure will help in a huge number of places, so for new stuff going forward, why wouldn't we want that...? Yes, mixed language codebases are rough, and hard to maintain, but we are kernel developers dammit, we've been maintaining and strengthening Linux for longer than anyone ever thought was going to be possible. We've turned our development model into a well-oiled engineering marvel creating something that no one else has ever been able to accomplish. Adding another language really shouldn't be a problem, we've handled much worse things in the past and we shouldn't give up now on wanting to ensure that our project succeeds for the next 20+ years. We've got to keep pushing forward when confronted with new good ideas, and embrace the people offering to join us in actually doing the work to help make sure that we all succeed together. Kroah-Hartman emphasized later that "a huge majority of the stupid things we do in C just don't happen in the same code implemented in Rust (i.e. memory leaks, error path cleanups, return value checking, etc.) " The complete thread contains over 140 messages — including Linus Torvalds' observation that " #pragma is complete garbage and should never be used."' -- source:https://linux.slashdot.org/story/25/02/22/0543255 Cheers, Peter

1 0

Brave Now Lets You Inject Custom JavaScript To Tweak Websites
by Peter Reutemann 11 Feb '25

11 Feb '25

'Brave Browser version 1.75 introduces "custom scriptlets," a new feature that allows advanced users to inject their own JavaScript into websites for enhanced customization, privacy, and usability. The feature is similar to the TamperMonkey and GreaseMonkey browser extensions, notes BleepingComputer. From the report: "Starting with desktop version 1.75, advanced Brave users will be able to write and inject their own scriptlets into a page, allowing for better control over their browsing experience," explained Brave in the announcement. Brave says that the feature was initially created to debug the browser's adblock feature but felt it was too valuable not to share with users. Brave's custom scriptlets feature can be used to modify webpages for a wide variety of privacy, security, and usability purposes. For privacy-related changes, users write scripts that block JavaScript-based trackers, randomize fingerprinting APIs, and substitute Google Analytics scripts with a dummy version. In terms of customization and accessibility, the scriptlets could be used for hiding sidebars, pop-ups, floating ads, or annoying widgets, force dark mode even on sites that don't support it, expand content areas, force infinite scrolling, adjust text colors and font size, and auto-expand hidden content. For performance and usability, the scriptlets can block video autoplay, lazy-load images, auto-fill forms with predefined data, enable custom keyboard shortcuts, bypass right-click restrictions, and automatically click confirmation dialogs. The possible actions achievable by injected JavaScript snippets are virtually endless. However, caution is advised, as running untrusted custom scriptlets may cause issues or even introduce some risk.' -- source: https://tech.slashdot.org/story/25/02/10/2348258 Cheers, Peter

1 0

This Keyboard Has A “SMOL” Key
by Lawrence D'Oliveiro 11 Feb '25

11 Feb '25

The review claims this is the “world’s largest keyboard”. <https://www.tomshardware.com/peripherals/keyboards/im-typing-this-on-the-wo…>. It is supposedly inspired by the legendary “Space Cadet” keyboard from the 1980s <https://www.deviantart.com/default-cube/art/Space-Cadet-Keyboard-650629356>, and is certainly a wonder to behold. Yet with all the modifiers it does provide (look, they found room for *two* “Meta” keys, both on the right-hand side!), they somehow decided to omit any CTRL keys. Note on modifiers: “Meta” is commonly a synonym for “Alt”, while the “Super” key is usually mapped to the one with the Windows logo on it, for those still stuck in the Microsoft world. The “Hyper” moodifier has no equivalent on a conventional keyboard. These are all names well-established from the days of high-powered workstations running Unix or doing AI work with Lisp. But what the heck is the “SMOL” key supposed to do?

1 0

Tails 6.12 Rolls Out, Sealing Critical Security Gaps
by Peter Reutemann 11 Feb '25

11 Feb '25

'The Tails project announced the release of its privacy-focused Linux distro, Tails 6.12, featuring vital security patches alongside an array of functional updates. According to the development team, several vulnerabilities were discovered during an external security audit by Radically Open Security. In light of this, perhaps the most noteworthy highlights in Tails 6.12 are the fixes preventing attackers from monitoring Tor circuits and altering Persistent Storage settings. Here are some more details about it. Tor Circuit Monitoring Prevention In earlier versions (up to Tails 6.11), vulnerabilities within Onion Circuits and the Tor Browser wrapper could have allowed a hostile actor—who had already hijacked a running application—to monitor or modify Tor connections, potentially revealing user identities. The Tails developers emphasize that there is no indication these flaws were exploited in the wild. Persistent Storage Security Enhancements Another fix addresses a loophole that, if exploited, could have allowed attackers with existing control of an application to change Persistent Storage settings. This patch ensures that user data in the Persistent Storage remains more securely locked down even in the unlikely event of a breach.' -- source: https://linuxiac.com/tails-6-12-rolls-out-sealing-critical-security-gaps/ Cheers, Peter

1 0

OpenWrt 24.10 Brings Kernel 6.6 and Initial WiFi 7 Support
by Peter Reutemann 11 Feb '25

11 Feb '25

'OpenWrt, a free and open-source Linux-based operating system primarily used for embedded devices, most notably residential gateways and routers, has just announced the first stable release of its 24.10 series. Most notable among the changes is the jump from Linux kernel 5.15 to 6.6 LTS, which promises better hardware support and long-term viability. Additionally, TLS 1.3 support is now standard in the default images, bolstering security capabilities for systems relying on encrypted connections. Another noteworthy improvement is the activation of POSIX Access Control Lists and file system security attributes on devices with larger flash memory sizes. Moreover, kernel support for Multipath TCP has been enabled on devices with greater storage capacity. Regarding wireless networking, OpenWrt 24.10 further refines WiFi6 (802.11ax) and adds initial, although still limited, support for WiFi7 (802.11be). Of course, each new release also expands device coverage, with OpenWrt 24.10 now supporting over 1,970 devices, adding compatibility for more than 100 new models compared to the previous release. And completely expected, their own OpenWrt One is now among them.' -- source: https://linuxiac.com/openwrt-24-10-brings-kernel-6-6-and-initial-wifi-7-sup… Cheers, Peter

1 0

How To Make Any AMD Zen CPU Always Generate 4 As a Random Number
by Peter Reutemann 10 Feb '25

10 Feb '25

'Google security researchers have discovered a way to bypass AMD's security, enabling them to load unofficial microcode into its processors and modify the silicon's behaviour at will. To demonstrate this, they created a microcode patch that forces the chips to always return 4 when asked for a random number. Beyond simply allowing Google and others to customize AMD chips for both beneficial and potentially malicious purposes, this capability also undermines AMD's secure encrypted virtualization and root-of-trust security mechanisms.' -- source: https://it.slashdot.org/story/25/02/09/2021244 Cheers, Peter

3 2

Red Hat Plans to Add AI to Fedora and GNOME
by Peter Reutemann 05 Feb '25

05 Feb '25

'In his post about the future of Fedora Workstation, Christian F.K. Schaller discusses how the Red Hat team plans to integrate AI with IBM's open-source Granite engine to enhance developer tools, such as IDEs, and create an AI-powered Code Assistant. He says the team is also working on streamlining AI acceleration in Toolbx and ensuring Fedora users have access to tools like RamaLama. From the post: One big item on our list for the year is looking at ways Fedora Workstation can make use of artificial intelligence. Thanks to IBMs Granite effort we know have an AI engine that is available under proper open source licensing terms and which can be extended for many different usecases. Also the IBM Granite team has an aggressive plan for releasing updated versions of Granite, incorporating new features of special interest to developers, like making Granite a great engine to power IDEs and similar tools. We been brainstorming various ideas in the team for how we can make use of AI to provide improved or new features to users of GNOME and Fedora Workstation. This includes making sure Fedora Workstation users have access to great tools like RamaLama, that we make sure setting up accelerated AI inside Toolbx is simple, that we offer a good Code Assistant based on Granite and that we come up with other cool integration points. "I'm still not sure how I feel about this approach," writes designer/developer and blogger, Bradley Taunt. "While IBM Granite is an open source model, I still don't enjoy so much artificial 'intelligence' creeping into core OS development. This also isn't something optional on the end-users side, like a desktop feature or package. This sounds like it's going to be built directly into the core system." "Red Hat has been pushing hard towards AI and my main concern is having this influence other operating system dev teams. Luckily things seems AI-free in BSD land. For now, at least." ' -- source: https://linux.slashdot.org/story/25/02/04/2047240 Cheers, Peter

1 0

Framework Laptop’s RISC-V board for open source diehards is available for $199
by Peter Reutemann 05 Feb '25

05 Feb '25

'We've covered the Framework Laptop 13 primarily as a consumer Windows laptop, reviewing versions with multiple Intel and AMD processors. But the system's modular nature makes it possible to expand it beyond Windows PC hardware, as we've seen with experiments like the (now-discontinued) Chromebook Edition of the laptop. Today Framework is expanding to something even more experimental: a DeepComputing RISC-V Mainboard targeted primarily at developers. RISC-V is a fully open source and royalty-free instruction set, making it possible for anyone to adopt and use it without having to license it (unlike x86, which is a maze of cross-licensed Intel and AMD technologies that other companies can't really buy into; or Arm, which is licensed by the company of the same name). First announced in June 2024, the board is available to order today for $199. The board is designed to fit in a Framework Laptop 13 chassis, which means that people who would prefer a desktop can also put it into the $39 Cooler Master Mainboard Case that Framework offers. Made in concert with DeepComputing, the board uses a StarFive JH7110 processor with four 1.5 GHz SiFive U74 CPU cores. The board can officially run either Ubuntu 24.04 LTS or Fedora 41, with tech support provided by DeepComputing.' -- source: https://arstechnica.com/gadgets/2025/02/framework-laptop-expands-beyond-x86… Cheers, Peter

1 0

procfs -- Too Much Info
by Lawrence D'Oliveiro 04 Feb '25

04 Feb '25

What used to be a single proc(5) man page, documenting the contents of the /proc file system, has now been broken out into over a hundred separate pages. You can find them with man -s5 -k proc | grep ^proc

1 0

Popular Linux orgs Freedesktop and Alpine Linux are scrambling for new web hosting
by Peter Reutemann 04 Feb '25

04 Feb '25

'In what is becoming a sadly regular occurrence, two popular free software projects, X.org/Freedesktop.org and Alpine Linux, need to rally some of their millions of users so that they can continue operating. Both services have largely depended on free server resources provided by Equinix (formerly Packet.net) and its Metal division for the past few years. Equinix announced recently that it was sunsetting its bare-metal sales and services, or renting out physically distinct single computers rather than virtualized and shared hardware. As reported by the Phronix blog, both free software organizations have until the end of April to find and fund new hosting, with some fairly demanding bandwidth and development needs. An issue ticket on Freedesktop.org's GitLab repository provides the story and the nitty-gritty needs of that project. Both the X.org foundation (home of the 40-year-old window system) and Freedesktop.org (a shared base of specifications and technology for free software desktops, including Wayland and many more) used Equinix's donated space. Equinix Metal "were very kind and generous with us and even if it's a shame we have to move out on a short notice, all things come to an end," writes Benjamin Tissoires, admin for the project, on the issue page. Tissoires lays out the project's needs—more than 400GB of database storage and close to 100TB of storage data—and a wishlist for new hosting.' -- source: https://arstechnica.com/gadgets/2025/02/popular-linux-orgs-freedesktop-and-… Cheers, Peter

1 0

Mozilla Adapts 'Fakespot' Into an AI-Detecting Firefox Add-on
by Peter Reutemann 03 Feb '25

03 Feb '25

'OMG Ubuntu reports: Want to find out if the text you're reading online was written by an real human or spat out by a large language model trying to sound like one? Mozilla's Fakespot Deepfake Detector Firefox add-on may help give you an indication. Similar to online AI detector tools, the add-on can analyse text (of 32 words or more) to identify patterns, traits, and tells common in AI generated or manipulated text. It uses Mozilla's proprietary ApolloDFT engine and a set of open-source detection models. But unlike some tools, Mozilla's Fakespot Deepfake Detector browser extension is free to use, does not require a signup, nor an app download. "After installing the extension, it is simple to highlight any text online and request an instant analysis. Our Detector will tell you right away if the words are likely to be written by a human or if they show AI patterns," Mozilla says. Fakespot, acquired by Mozilla in 2023, is best known for its fake product review detection tool which grades user-submitted reviews left on online shopping sites. Mozilla is now expanding the use of Fakespot's AI tech to cover other kinds of online content. At present, Mozilla's Fakespot Deepfake Detector only works with highlighted text on websites but the company says it image and video analysis is planned for the future. The Fakespot web site will also analyze the reviews on any product-listing pages if you paste in its URL.' -- source: https://news.slashdot.org/story/25/02/02/2156241 Cheers, Peter

1 0

Facebook Flagging Linux Discussions as “Cybersecurity Threats”
by Lawrence D'Oliveiro 03 Feb '25

03 Feb '25

Facebook is blocking posts and users that mention Linux, according to this report <https://www.tomshardware.com/software/linux/facebook-flags-linux-topics-as-…>. Distrowatch seems to have been the first to notice this, saying that many of its readers have reported trouble with Facebook. But the trouble is not confined to them. And when the site tried to report the issue, its complaint was firmly rejected, and the writer’s account was also locked. And yes, if you were wondering, doesn’t Facebook itself rely heavily on Linux? It does indeed: Facebook's overzealous ban on some Linux topics in the name of Community Standards and its protection of its users from threats come with a large ladle full of irony. "Facebook runs much of its infrastructure on Linux," DistroWatch points out, "and often posts job ads looking for Linux developers." My most charitable interpretation of this is some kind of over-reliance on automated AI-based procedures has got a bit out of hand ...

2 1

Build-Your-Own Open-Source Laptop
by Lawrence D'Oliveiro 28 Jan '25

28 Jan '25

Looking further back at the Tom’s Hardware articles, I found this one <https://www.tomshardware.com/laptops/student-builds-open-source-laptop-in-6…> about a senior high-school student’s project to build his own laptop from off-the-shelf parts. Its core is a Raspberry-Pi competitor, it has a 4K display, and can manage 7 hours of battery life. The entire effort took six months. And the result doesn’t look too shabby, either.

1 0

Linux 6.14 Brings Some Systems Faster Suspend and Resume
by Peter Reutemann 28 Jan '25

28 Jan '25

'Amid the ongoing Linux 6.14 kernel development cycle, Phoronix spotted a pull request for ACPI updates which "will allow for faster suspend and resume cycles on some systems." Wikipedia defines ACPI as "an open standard that operating systems can use to discover and configure computer hardware components" for things like power management and putting unused hardware components to sleep. Phoronix reports: The ACPI change worth highlighting for Linux 6.14 is switching from msleep() to usleep_range() within the acpi_os_sleep() call in the kernel. This reduces spurious sleep time due to timer inaccuracy. Linux ACPI/PM maintainer Rafael Wysocki of Intel who authored this change noted that it could "spectacularly" reduce the duration of system suspend and resume transitions on some systems... Rafael explained in the patch making the sleep change: "The extra delay added by msleep() to the sleep time value passed to it can be significant, roughly between 1.5 ns on systems with HZ = 1000 and as much as 15 ms on systems with HZ = 100, which is hardly acceptable, at least for small sleep time values." One 2022 bug report complained a Dell XPS 13 using Thunderbolt took "a full 8 seconds to suspend and a full 8 seconds to resume even though no physical devices are connected." In November an Intel engineer posted on the kernel mailing list that the fix gave a Dell XPS 13 a 42% improvement in kernel resume time (from 1943ms to 1127ms).' -- source: https://linux.slashdot.org/story/25/01/25/2343225 Cheers, Peter

2 1

Could New Linux Code Cut Data Center Energy Use By 30%?
by Peter Reutemann 26 Jan '25

26 Jan '25

'Two computer scientists at the University of Waterloo in Canada believe changing 30 lines of code in Linux "could cut energy use at some data centers by up to 30 percent," according to the site Data Centre Dynamics. It's the code that processes packets of network traffic, and Linux "is the most widely used OS for data center servers," according to the article: The team tested their solution's effectiveness and submitted it to Linux for consideration, and the code was published this month as part of Linux's newest kernel, release version 6.13. "All these big companies — Amazon, Google, Meta — use Linux in some capacity, but they're very picky about how they decide to use it," said Martin Karsten [professor of Computer Science in the Waterloo's Math Faculty]. "If they choose to 'switch on' our method in their data centers, it could save gigawatt hours of energy worldwide. Almost every single service request that happens on the Internet could be positively affected by this." The University of Waterloo is building a green computer server room as part of its new mathematics building, and Karsten believes sustainability research must be a priority for computer scientists. "We all have a part to play in building a greener future," he said. The Linux Foundation, which oversees the development of the Linux OS, is a founder member of the Green Software Foundation, an organization set up to look at ways of developing "green software" — code that reduces energy consumption. Karsten "teamed up with Joe Damato, distinguished engineer at Fastly" to develop the 30 lines of code, according to an announcement from the university. "The Linux kernel code addition developed by Karsten and Damato was based on research published in ACM SIGMETRICS Performance Evaluation Review" (by Karsten and grad student Peter Cai). Their paper "reviews the performance characteristics of network stack processing for communication-heavy server applications," devising an "indirect methodology" to "identify and quantify the direct and indirect costs of asynchronous hardware interrupt requests (IRQ) as a major source of overhead... "Based on these findings, a small modification of a vanilla Linux system is devised that improves the efficiency and performance of traditional kernel-based networking significantly, resulting in up to 45% increased throughput..."' -- source: https://hardware.slashdot.org/story/25/01/25/2111225 Cheers, Peter

1 0

kiwix
by Peter Reutemann 23 Jan '25

23 Jan '25

Hi there Just stumbled across kiwix, an offline reader for things like Mediawiki (incl Wikipedia) and other books: https://kiwix.org/en/applications/ The library: https://library.kiwix.org/#lang=eng -- source: https://infosec.exchange/@Em0nM4stodon/113872764752277451 Cheers, Peter

2 1

Wine 10.0 brings Arm Windows apps to Linux, still is not an emulator
by Peter Reutemann 23 Jan '25

23 Jan '25

'The open source Wine project—sometimes stylized WINE, for Wine Is Not an Emulator—has become an important tool for companies and individuals who want to make Windows apps and games run on operating systems like Linux or even macOS. The CrossOver software for Mac and Windows, Apple's Game Porting Toolkit, and the Proton project that powers Valve's SteamOS and the Steam Deck are all rooted in Wine, and the attention and resources put into the project in recent years have dramatically improved its compatibility and usefulness. Yesterday, the Wine project announced the stable release of version 10.0, the next major version of the compatibility layer that is not an emulator. The headliner for this release is support for ARM64EC, the application binary interface (ABI) used for Arm apps in Windows 11, but the release notes say that the release contains "over 6,000 individual changes" produced over "a year of development effort." ARM64EC allows developers to mix Arm and x86-compatible code—if you're making an Arm-native version of your app, you can still allow the use of more obscure x86-based plugins or add-ons without having to port everything over at once. Wine 10.0 also supports ARM64X, a different type of application binary file that allows ARM64EC code to be mixed with older, pre-Windows 11 ARM64 code. Wine's ARM64EC support does have one limitation that will keep it from working on some prominent Arm Linux distributions, at least by default: the release notes say it "requires the system page size to be 4K, since that is what the Windows ABI specifies." Several prominent Linux-on-Arm distributions default to a 16K page size because it can improve performance—when page sizes are smaller, you need more of them, and managing a higher number of pages can introduce extra CPU overhead.' -- source: https://arstechnica.com/gadgets/2025/01/wine-10-0-released-adding-linux-com… Cheers, Peter

1 0

TuxCare Stops Microsoft From Killing .NET 6.0
by Peter Reutemann 17 Jan '25

17 Jan '25

'TuxCare today announced that it’s added Microsoft’s .NET 6.0 to the roster of open-source platforms its supporting through its Endless Lifecycle Support program. This means that organizations that wish to continue using the platform, which reached end of life on Nov 12, 2024 and no longer receives updates, can continue to safely do so. TuxCare’s service will supply security patches for any vulnerabilities that arise in the software, just as it continues to patch long dead Linux distros. In times past, continuing to keep expired software in production was considered to be bad policy. These days, however, it’s becoming more common for sysadmins and DevOps teams to rely on services like TuxCare rather than go through the often frustrating and always time consuming and costly ordeal of upgrading, a process that often breaks essential secondary components which then have to be upgraded or fixed. When FOSS Force spoke with Joao Correia, a technical evangelist for both TuxCare and its parent company CloudLinux, he was quick to point out that supporting a product from Microsoft is something new, not only for TuxCare but for any of the companies that offer aftermarket support for expired open-source projects. “That’s somewhat of a departure in that we are now touching on proprietary Microsoft space which we hadn’t touched before,” he said. “At the same time, it’s an open-source project, and we have lots of experience with those types of projects and maintaining them.”' -- source: https://fossforce.com/2025/01/tuxcare-stops-microsoft-from-killing-net-6-0/ Cheers, Peter

1 0

Ubuntu 24.04 LTS Now Works on the HiFive Premier P550 RISC-V Development Board
by Peter Reutemann 14 Jan '25

14 Jan '25

'Canonical, the company behind the popular Ubuntu Linux distribution, announced today that they’ve partnered with SiFive and ESWIN Computing to enable Ubuntu 24.04 LTS on the HiFive Premier P550 RISC-V development board. The HiFive Premier P550 is a RISC-V single-board computer powered by the ESWIN EIC7700X SoC with a SiFive Quad-Core P550 64-bit RISC-V processor running at 1.4 GHz and an integrated Imagination AXM-8-256 GPU supporting hardware accelerated video encoding up to 8K@25fps, hardware accelerated video decoding up to 8K@50fps, and hardware accelerated AI NPU with ~20 TOPS. The RISC-V board also features up to 32GB Samsung/Micron LPDDR5 RAM, 128GB Samsung eMMC storage, two 10/100/1000 Ethernet RJ45 connectors, a single Ethernet RJ45 connector for remote board management using dedicated MCU, an M.2 Key E connector for Wi-Fi / Bluetooth module, an HDMI 2.0 connector, a SATA 3 connector (6Gb/s), a JTAG Header, a microSD card connector, three fan headers, five USB 3 ports, and PCIe expansion slots. And the best thing for those who want to buy this 64-bit RISC-V development board for their projects is that it comes pre-installed with the Ubuntu 24.04 LTS (Noble Numbat) operating system featuring the long-term supported and optimized Linux 6.6 LTS kernel series, which will receive updates until December 2026.' -- source: https://9to5linux.com/ubuntu-24-04-lts-now-works-on-the-hifive-premier-p550… Cheers, Peter

1 0

Debian 12.9 “Bookworm” Arrives with 72 Bug Fixes and 38 Security Updates
by Peter Reutemann 14 Jan '25

14 Jan '25

'Today, the Debian Project announced the release and general availability of Debian 12.9 as the eighth ISO update to the latest Debian GNU/Linux 12 “Bookworm” operating system series. Coming a little over two months after Debian 12.8 and powered the Linux 6.1 LTS series, Debian 12.9 is the eighth point release of Debian Bookworm. Yes, eighth, because Debian 12.3 was never released due to an issue in the EXT4 file system leading to data corruption so it doesn’t count. As with previous updates, Debian 12.9 is here to provide updated installation media to those who want to deploy the latest Debian Bookworm operating system on new hardware and they had issues with previous Debian 12 versions or don’t want to download hundreds of updates from the repositories after the installation. In numbers, this new release includes a total of 72 bug fixes for miscellaneous packages and 38 security updates. Details about these security and miscellaneous bug fixes can be found on the release announcement page.' -- source: https://9to5linux.com/debian-12-9-bookworm-arrives-with-72-bug-fixes-and-38… -- release: https://www.debian.org/News/2025/20250111 Cheers, Peter

1 0

Mastodon’s founder cedes control, refuses to become next Musk or Zuckerberg
by Peter Reutemann 14 Jan '25

14 Jan '25

'Mastodon announced Monday that it's shifting its structure over the next six months to become wholly owned by a European nonprofit organization—"affirming the intent that Mastodon should not be owned or controlled by a single individual." This takes control of the social network away from its previous "ultimate decision-maker," Eugen Rochko. As founder, Rochko initially took the reins to ensure the decentralized platform would never be for sale and "would be free of the control of a single wealthy individual." His grand vision remains to leave Mastodon users in control of the social network, making their own decisions about what content is allowed or what appears in their timelines. The news comes after leaders of other social networks, like Mark Zuckerberg and Elon Musk, have sparked backlash over sudden changes to popular apps like Facebook, Instagram, and X (formerly Twitter). For years, Musk has drawn criticism for changing Twitter's hate speech policies through his X rebranding. And more recently, Zuckerberg this month defended Meta's decision to relax hate speech policies (permitting women to be called "property" and gay people to be called "mentally ill") by calling bans on such speech "out of touch with mainstream discourse." Mastodon is hoping to provide an alternative social network for users who are potentially frustrated with their lack of control over their timelines and content on other networks. But to achieve the "envisioned independence" for all users, Mastodon's structure needed to "evolve," the blog said, "as the community grew" to about 1.5 million monthly active users in 2023. Remaining headquartered in Europe primarily, Mastodon's day-to-day operations will be managed by the new European not-for-profit entity, "establishing a new legal home for Mastodon." The user experience on Mastodon won't be affected much by the transition to a nonprofit owner, Mastodon said. But "changes are definitely in the pipeline."' -- source: https://arstechnica.com/tech-policy/2025/01/mastodon-becomes-nonprofit-to-m… Cheers, Peter

1 0

Pilet: A Modular, Portable Mini-Computer Powered by Raspberry Pi
by Peter Reutemann 13 Jan '25

13 Jan '25

'Pilet is a retro-futuristic mini-computer that runs on the latest Raspberry Pi 5. It’s built to be fully modifiable, both in hardware and software, so you can escape the limitations of closed systems like iOS or Android. Pilet works with various Linux distributions and is compatible with Raspberry Pi OS out of the box. The team is also developing Pilet OS, a custom-optimized operating system for Pilet. Key Features of Pilet Here are some of Pilet's key features: - Raspberry Pi 5 Power: Pilet is powered by the Raspberry Pi 5, which offers a performance boost and supports advanced features like PCIe and NVMe storage. - Long Battery Life: With a 7-hour battery life, you can take your projects anywhere without being tied to a desk. - Open Source: Pilet is fully open source. After launch, the team will release schematics, PCB files, CAD files, and source code, so you can tweak and modify both the hardware and software. - Modular Design: Pilet’s modular design lets you add your own modules, like cameras, sensors, or even LTE connectivity. The team is also working on modules like NVMe and LTE. - VESA compatibility: Makes it easier and more secure to mount Pilet anywhere. - Active+passive cooling: A metal back combined with a fan keeps the Raspberry Pi 5 cool and running smoothly. - AI module support: Supports the Hailo-8L module, delivering 13 TOPS of processing power. - Rear stand: Allows users to position Pilet at any angle. - Custom battery management: Ensures stable performance even under demanding applications. - Simple and Practical: Pilet follows the KISS (Keep It Simple, Stupid) principle. It’s easy to use, with no extra drivers or complicated setups. All components are 3D-printable and customizable. Technical Specifications - Supported SBC: Raspberry Pi 5 - Power Source: 3.7V Lithium Polymer/Lithium-Ion Batteries, 5V USB-C - Screen: 5-inch or 7-inch IPS touchscreen - I/O: MicroHDMI (2x), USB 3.0 (2x), USB 2.0 (2x), Programmable GPIO - Network: Wi-Fi, LAN, Bluetooth 5.0, LTE (via module) - Storage: SD card, NVMe SSD (via module) - Dimensions: 175mm x 125mm x 28mm' -- source: https://ostechnix.com/pilet-modular-portable-mini-computer-powered-by-raspb… Looks funky! :-) Cheers, Peter

1 0

German router maker is latest company to inadvertently clarify the LGPL license
by Peter Reutemann 13 Jan '25

13 Jan '25

'The GNU General Public License (GPL) and its "Lesser" version (LGPL) are widely known and used. Still, every so often, a networking hardware maker has to get sued to make sure everyone knows how it works. The latest such router company to face legal repercussions is AVM, the Berlin-based maker of the most popular home networking products in Germany. Sebastian Steck, a German software developer, bought an AVM Fritz!Box 4020 (PDF) and, being a certain type, requested the source code that had been used to generate certain versions of the firmware on it. According to Steck's complaint (translated to English and provided in PDF by the Software Freedom Conservancy, or SFC), he needed this code to recompile a networking library and add some logging to "determine which programs on the Fritz!Box establish connections to servers on the Internet and which data they send." But Steck was also concerned about AVM's adherence to GPL 2.0 and LGPL 2.1 licenses, under which its FRITZ!OS and various libraries were licensed. The SFC states that it provided a grant to Steck to pursue the matter. AVM provided source code, but it was incomplete, as "the scripts for compilation and installation were missing," according to Steck's complaint. This included makefiles and details on environment variables, like "KERNEL_LAYOUT," necessary for compilation. Steck notified AVM, AVM did not respond, and Steck sought legal assistance, ultimately including the SFC. Months later, according to the SFC, AVM provided all the relevant source code and scripts, but the suit continued. AVM ultimately paid Steck's attorney fee. The case proved, once again, that not only are source code requirements real, but the LGPL also demands freedom, despite its "Lesser" name, and that source code needs to be useful in making real changes to firmware—in German courts, at least. "The favorable result of this lawsuit exemplifies the power of copyleft—granting users the freedom to modify, repair, and secure the software on their own devices," the SFC said in a press release. "Companies like AVM receive these immense benefits themselves. This lawsuit reminded AVM that downstream users must receive those very same rights under copyleft."' -- source: https://arstechnica.com/gadgets/2025/01/suing-wi-fi-router-makers-remains-a… Cheers, Peter

1 0

Linux Foundation bands together Chromium browser makers in a “neutral space”
by Peter Reutemann 10 Jan '25

10 Jan '25

'Supporters of Chromium-Based Browsers sounds like a very niche local meetup, one with hats and T-shirts that barely fit the name. But it's really a "neutral space" for funding and support, corralling together some big names with a stake in the future of Chrome's open source roots, Chromium. The Linux Foundation, a nonprofit started in 2000 that has grown to support a broader range of open source projects, spurred the initiative. In a press release, the Foundation states that the project will allow "industry leaders, academia, developers, and the broader open source community" to work on Chromium, with "much-needed funding and development support for open development of projects." A few names you don't often see together are already on board: Google, Meta, Microsoft, and Opera. Krystian Kolondra, executive vice president of browsers at Opera, stated in a release that "as one of the major browsers contributing to the Chromium project," Opera would "look forward to collaborating with members of the project to foster this growth and keep building innovative and compelling products for all users." How will this work? Kind of how Chromium has been working already. The group will have an open governance model, according to the Foundation, based on other Foundation initiatives based on "transparency, inclusivity, and community-driven development." The Linux Foundation's structure supports Kubernetes, Node.js, RISC-V, ONAP, and, of course, Linux, in such a manner. A Technical Advisory Committee will ensure the work done in the group "meets the needs of the wider Chromium community." Otherwise, the Chromium projects will keep to their existing governance structures.' -- source: https://arstechnica.com/gadgets/2025/01/google-meta-microsoft-and-opera-agr… Cheers, Peter

1 0

Red Hat In-Vehicle Linux Gets Closer to Go With New Certification
by Peter Reutemann 09 Jan '25

09 Jan '25

'There was good news on Monday for the futures of Linux in general and Red Hat in particular in the automotive sector. Less than six months after Red Hat announced that the Linux math library — a fundamental component of Red Hat In-Vehicle Operating System — achieved ISO 26262 ASIL-B functional safety certification, it’s announced the achievement of functional safety certification of mixed criticality. All of this may sound like mumbo jumbo, which it is a bit, but it’s important mumbo jumbo as far as Red Hat’s efforts to build a turnkey open-source solution for software defined automobiles are concerned. And no matter how convoluted it sounds, this is not only good for Red Hat; it’s good for Linux. The keyword phrase in Red Hat’s announcement is “mixed criticality,” which basically means that Red Had has certified that its in-vehicle OS can safely execute several applications of different criticality –in this case safety-critical and non-safety critical — on the same system-on-chip running a single operating system.' -- source: https://fossforce.com/2025/01/red-hat-in-vehicle-linux-gets-closer-to-go-wi… Cheers, Peter

1 0

"Make The Terminal More Enjoyable with These Linux Terminal Tools"
by Peter Reutemann 07 Jan '25

07 Jan '25

The following tools are mentioned in the article linked below: - tldr - btop - mc - zoxide - ripgrep - tmux - fzf - bat -- source: https://www.maketecheasier.com/linux-terminal-tools/ I'm quite liking btop and I've mc in the past when having only console access and requiring a two-panel file-manager. Cheers, Peter

2 1

Here’s the Most Popular Databases for 2024
by Peter Reutemann 07 Jan '25

07 Jan '25

'The DB-Engines ranking of the most popular database management systems for January 2025 is now available. It features data from the past 12 months’ popularity trends for 423 databases, thus highlighting the platforms that dominated the data management scene over the past 2024. From traditional relational databases to modern NoSQL solutions, the list provides clear insights into trends in the tech sector, particularly in data storage and processing. Here’s a quick look at who came out on top and who fell short. Unsurprisingly, Oracle holds the top spot as the leading database, dominating the enterprise sector for many years. MySQL, Microsoft SQL Server, PostgreSQL, and MongoDB complete the top five. Among them, MongoDB stands out as the sole NoSQL database in the group, while the other four represent the leading stars of the RDBMS segment.' -- source: https://linuxiac.com/most-popular-databases-for-2024/ Cheers, Peter

2 1

Time to check if you ran any of these 33 malicious Chrome extensions
by Peter Reutemann 07 Jan '25

07 Jan '25

'As many of us celebrated the year-end holidays, a small group of researchers worked overtime tracking a startling discovery: At least 33 browser extensions hosted in Google’s Chrome Web Store, some for as long as 18 months, were surreptitiously siphoning sensitive data from roughly 2.6 million devices. The compromises came to light with the discovery by data loss prevention service Cyberhaven that a Chrome extension used by 400,000 of its customers had been updated with code that stole their sensitive data.' -- source: https://arstechnica.com/security/2025/01/dozens-of-backdoored-chrome-extens… Cheers, Peter

1 0

Setting Application Menu Shortcut
by Lawrence D'Oliveiro 24 Dec '24

24 Dec '24

So after my last Debian Unstable upgrade, I am now running KDE Plasma 6 as my desktop. KDE Plasma, by default, brings up its application menu if you press and release what it calls the “Meta” (more commonly “Super” or “Windows”) modifier key. I have this disabled because I use Meta/Super instead of Alt as the modifier key for moving windows around; and I did that switch to avoid interfering with the use of the Alt-click function in Blender. Previously, I did this change to Meta/Super behaviour by editing a config file called ~/.config/kwinrc. But now, this has been unified with the rest of the system settings, and can be controlled through the same interface <https://www.lorenzobettini.it/2024/06/modifier-only-shortcuts-in-kde-plasma…> (excuse the ads).

1 0

Home Assistant's New Voice Assistant Answers To 'Hey Jarvis'
by Peter Reutemann 20 Dec '24

20 Dec '24

'Home Assistant (not to be confused with the Google Assistant on Google Home) has launched the Voice Preview Edition (Voice PE), its first dedicated voice assistant hardware for $59. The device offers a privacy-focused, locally controlled solution that supports over 50 languages and integrates seamlessly with the open-source smart home platform. As The Verge notes, Voice PE supports the wake words "Hey Jarvis" right out of the box. From the report: The Voice PE is a small white box, about the size of your palm, with dual microphones and an audio processor. An internal speaker lets you hear the assistant, but you can also connect a speaker to it via a 3.5 mm headphone jack for better-quality media playback. A colored LED ring on top of the Voice PE indicates when the assistant is listening. It surrounds a rotary dial and a physical button, which is used for setup and to talk to the voice assistant without using the wake word. The button can also be customized to do whatever you want (because this is Home Assistant). A physical mute switch is on the side, and the device is powered by USB-C (charger and cable not included). There's also a Grove port where you can add sensors and other accessories. For those who don't like the idea of always-listening microphones in their home from companies such as Amazon and Google, but who still want the convenience of controlling their home with their voice, the potential here is huge. But it may be a while until Voice PE is ready to replace your Echo or Nest smart speaker. [...] if you want more features, Voice PE can connect to supported AI models, such as ChatGPT or Gemini, to fully replace Assist or use it as a fallback for commands it doesn't understand. But for many smart home users, there will be plenty of value in a simple, inexpensive device that lets you turn your lights on and off, start a timer, and execute other useful commands with your voice without relying on an internet connection. ' -- source: https://yro.slashdot.org/story/24/12/19/231255 Cheers, Peter

1 0

vim and files from gvfs mounted file systems
by Peter Reutemann 19 Dec '24

19 Dec '24

Hi everyone Since upgrading to Linux Mint 22 Wilma and vim 9.1.x, I noticed an issue with vim when editing remote files (eg mounted via sftp through caja): saving the file would fail. Not ideal... Looks like there is an issue with gvfs mounted file systems: https://github.com/vim/vim/issues/5309 https://github.com/vim/vim/issues/5237#issuecomment-1366262853 Disabling the creation of backup files avoids the issue: :set backupcopy=no Or, if you want to automate it based on path, you can place the following in your .vimrc: autocmd BufRead,BufNewFile /run/user/* set backupcopy=no Cheers, Peter

1 0

TP-Link faces possible US ban as hijacked routers fuel Chinese attacks
by Peter Reutemann 19 Dec '24

19 Dec '24

'US government authorities are reportedly investigating whether to ban TP-Link wireless routers, which have been targeted in some high-profile attacks linked to the Chinese government. TP-Link, which was founded in China in 1996 and said it relocated its headquarters to the US in October this year, has racked up significant market share in US homes and businesses. US authorities are investigating whether TP-Link "poses a national-security risk and are considering banning the devices," The Wall Street Journal reported today. The WSJ notes that TP-Link is "the top choice on Amazon.com, and powers Internet communications for the Defense Department and other federal government agencies."' -- source: https://arstechnica.com/tech-policy/2024/12/report-us-considers-banning-tp-… Maybe time to flash your TP-Link router with something like OpenWRT? https://openwrt.org/toh/start Cheers, Peter

1 0

Australia Moves To Drop Some Cryptography By 2030
by Peter Reutemann 19 Dec '24

19 Dec '24

'Australia's chief cyber security agency has decided local orgs should stop using the tech that forms the current cryptographic foundation of the internet by the year 2030 -- years before other nations plan to do so -- over fears that advances in quantum computing could render it insecure. The Land Down Under's plans emerged last week when the Australian Signals Directorate (ASD) published guidance for High Assurance Cryptographic Equipment (HACE) -- devices that send and/or receive sensitive information -- that calls for disallowing the cryptographic algorithms SHA-256, RSA, ECDSA and ECDH, among others, by the end of this decade. Bill Buchanan, professor in the School of Computing at Edinburgh Napier University, wrote a blog post in which he expressed shock that the ASD aims to move so quickly. "Basically, these four methods are used for virtually every web connection that we create, and where ECDH is used for the key exchange, ECDSA or RSA is used to authenticate the remote server, and SHA-256 is used for the integrity of the data sent," he wrote. "The removal of SHA-256 definitely goes against current recommendations."' -- source: https://it.slashdot.org/story/24/12/18/173242 Cheers, Peter

1 0

Xfce 4.20 Desktop Environment Released with Experimental Wayland Support
by Peter Reutemann 17 Dec '24

17 Dec '24

'Two years after the release of Xfce 4.18, Xfce 4.20 is here as another major update to this light and fast desktop environment for GNU/Linux distributions. Xfce 4.20 is packed with lots of new features and improvements like experimental support for Wayland with support for the Labwc and Wayfire compositors, improved support for HiDPI displays, and libxfce4windowing as a new abstraction library to present windowing concepts in a windowing-system-independent manner. Wayland sessions of Xfce can be started with the startxfce4 --wayland command. However, you should keep in mind that several Xfce components don’t run at all on Wayland, including the Xfwm4 window manager, Xfdashboard, Xfce4-screensaver, Xfce4-windowck-plugin, and Xfce4-xkb-plugin. “So far Xfce does not feature a compositor which supports Wayland. If you want to run Xfce in Wayland, Labwc and Wayfire will give you the best results,” said the Xfce development team. “Plans are underway to add Wayland support to Xfwm4 while preserving its existing X11 functionality. However, such a restructurization will be a major effort and we cannot tell yet when/if it will be done, so please don’t hold your breath waiting for it.”' -- source: https://9to5linux.com/xfce-4-20-desktop-environment-released-with-experimen… Cheers, Peter

1 0

How to Share Your Linux Terminal Over the Web Using Ttyd
by Peter Reutemann 16 Dec '24

16 Dec '24

Looks like an interesting project: 'Ttyd is a simple tool that allows you to share a Linux terminal over a web browser. It’s cross-platform and uses the libuv and WebGL2 Javascript APIs for performance and real-time connection between the browser and Linux terminal. The SSL support is offered by OpenSSL. It supports multiple clients at once, allowing multiple clients to connect to the same Linux terminal from different browsers (or tabs). No additional package is required on the client-side, only the correct web address is needed. You can use this tool for remote system administration, troubleshooting, assisting a friend with any specific task, debugging or recovering a process, and much more.' -- source: https://linuxtldr.com/installing-ttyd/ Cheers, Peter

3 2

Let's Encrypt Announces New-Certificate-Every-6-Days Offering
by Peter Reutemann 16 Dec '24

16 Dec '24

'The non-profit, free certificate authority Let's Encrypt shared some news from their executive director as they approach their 10th anniversary in 2025: Internally things have changed dramatically from what they looked like ten years ago, but outwardly our service hasn't changed much since launch. That's because the vision we had for how best to do our job remains as powerful today as it ever was: free 90-day TLS certificates via an automated API. Pretty much as many as you need. More than 500,000,000 websites benefit from this offering today, and the vast majority of the web is encrypted. Our longstanding offering won't fundamentally change next year, but we are going to introduce a new offering that's a big shift from anything we've done before — short-lived certificates. Specifically, certificates with a lifetime of six days. This is a big upgrade for the security of the TLS ecosystem because it minimizes exposure time during a key compromise event. Because we've done so much to encourage automation over the past decade, most of our subscribers aren't going to have to do much in order to switch to shorter lived certificates. We, on the other hand, are going to have to think about the possibility that we will need to issue 20x as many certificates as we do now. It's not inconceivable that at some point in our next decade we may need to be prepared to issue 100,000,000 certificates per day. That sounds sort of nuts to me today, but issuing 5,000,000 certificates per day would have sounded crazy to me ten years ago... It was hard to build Let's Encrypt. It was difficult to scale it to serve half a billion websites... Charitable contributions from people like you and organizations around the world make this stuff possible. Since 2015, tens of thousands of people have donated. They've made a case for corporate sponsorship, given through their Donor-Advised Funds, or set up recurring donations, sometimes to give $3 a month. That's all added up to millions of dollars that we've used to change the Internet for nearly everyone using it.' -- source: https://it.slashdot.org/story/24/12/15/0059216 Cheers, Peter

1 0

Banan OS: A Fully Functional Unix-like OS Built From Scratch In C++
by Peter Reutemann 16 Dec '24

16 Dec '24

'A student has built an entire operating system from scratch in C++. Yes, you read that right! Meet Banan OS, a hobbyist operating system for x86_64 and i686 architectures, written entirely in C++ by an university student Oskari Alaranta. The project is fully independent, with all code written exclusively by Alaranta, except for any ported software.' -- source: https://ostechnix.com/banan-os-a-fully-functional-linux-os-built-from-scrat… Cheers, Peter

1 0

Raspberry Pi 500 Brings All-in-One PC Power to Your Desk for Just $90
by Peter Reutemann 13 Dec '24

13 Dec '24

'Just in time for the holiday season, Raspberry Pi has launched two highly anticipated products that promise to revolutionize compact computing. Enter the Raspberry Pi 500 and the official Raspberry Pi Monitor, designed to provide a sleek and complete desktop experience at an exceptionally affordable price. Raspberry Pi’s mission has always been clear: to provide affordable, programmable personal computers to people worldwide. Over the years, this vision has expanded as the company has grown into one of the leading manufacturers of industrial and embedded computers. For example, products like the $15 Raspberry Pi Zero 2 W and the flagship Raspberry Pi 5 have demonstrated the company’s ability to cater to both cost-conscious and performance-driven audiences. Let’s also not forget that just two weeks ago, the company announced another exciting product, the Raspberry Pi Compute Module 5, specifically designed for embedded applications. And now, building on the success of the Raspberry Pi 400, the newly launched Raspberry Pi 500 takes compact computing to the next level. Combining the high-performance Raspberry Pi 5 platform with an all-in-one form factor, this device offers exceptional power and versatility: - Processor: 2.4GHz quad-core 64-bit Arm Cortex-A76 - Memory: 8GB LPDDR4X-4267 SDRAM - Graphics: VideoCore VII GPU, supporting OpenGL ES 3.1 and Vulkan 1.3 - Display Outputs: Dual 4Kp60 HDMI - Connectivity: Dual-band 802.11ac Wi-Fi, Bluetooth 5.0, and Gigabit Ethernet - Ports: 2 USB 3.0, 1 USB 2.0 - GPIO Connector: Horizontal 40-pin Raspberry Pi GPIO' -- source: https://linuxiac.com/raspberry-pi-500-announced/ Cheers, Peter

1 0

AMD’s trusted execution environment blown wide open by new BadRAM attack
by Peter Reutemann 11 Dec '24

11 Dec '24

'One of the oldest maxims in hacking is that once an attacker has physical access to a device, it’s game over for its security. The basis is sound. It doesn’t matter how locked down a phone, computer, or other machine is; if someone intent on hacking it gains the ability to physically manipulate it, the chances of success are all but guaranteed. In the age of cloud computing, this widely accepted principle is no longer universally true. Some of the world’s most sensitive information—health records, financial account information, sealed legal documents, and the like—now often resides on servers that receive day-to-day maintenance from unknown administrators working in cloud centers thousands of miles from the companies responsible for safeguarding it. In response, chipmakers have begun baking protections into their silicon to provide assurances that even if a server has been physically tampered with or infected with malware, sensitive data funneled through virtual machines can’t be accessed without an encryption key that’s known only to the VM administrator. Under this scenario, admins inside the cloud provider, law enforcement agencies with a court warrant, and hackers who manage to compromise the server are out of luck. On Tuesday, an international team of researchers unveiled BadRAM, a proof-of-concept attack that completely undermines security assurances that chipmaker AMD makes to users of one of its most expensive and well-fortified microprocessor product lines. Starting with the AMD Epyc 7003 processor, a feature known as SEV-SNP—short for Secure Encrypted Virtualization and Secure Nested Paging—has provided the cryptographic means for certifying that a VM hasn’t been compromised by any sort of backdoor installed by someone with access to the physical machine running it. If a VM has been backdoored, the cryptographic attestation will fail and immediately alert the VM admin of the compromise. Or at least that’s how SEV-SNP is designed to work. BadRAM is an attack that a server admin can carry out in minutes, using either about $10 of hardware, or in some cases, software only, to cause DDR4 or DDR5 memory modules to misreport during bootup the amount of memory capacity they have. From then on, SEV-SNP will be permanently made to suppress the cryptographic hash attesting its integrity even when the VM has been badly compromised. “BadRAM completely undermines trust in AMD's latest Secure Encrypted Virtualization (SEV-SNP) technology, which is widely deployed by major cloud providers, including Amazon AWS, Google Cloud, and Microsoft Azure,” members of the research team wrote in an email. “BadRAM for the first time studies the security risks of bad RAM—rogue memory modules that deliberately provide false information to the processor during startup. We show how BadRAM attackers can fake critical remote attestation reports and insert undetectable backdoors into _any_ SEV-protected VM.”' -- source: https://arstechnica.com/information-technology/2024/12/new-badram-attack-ne… Cheers, Peter

1 0

Linux Mint Dethrones MX Linux As the Most Popular Distro On DistroWatch
by Peter Reutemann 11 Dec '24

11 Dec '24

'Linux Mint has reclaimed its position as the top-ranked Linux distribution on DistroWatch, dethroning MX Linux. The latest page hit rankings, which reflect the popularity of distributions among DistroWatch users, place Linux Mint in first place with 2,412 hits per day. MX Linux, previously the reigning champ, now sits in second with 2,280 hits.' -- source: https://linux.slashdot.org/story/24/12/10/1754230 Cheers, Peter

1 0

Linux Kernel 6.12 Confirmed As LTS, Will Be Supported For 'Multiple Years'
by Peter Reutemann 10 Dec '24

10 Dec '24

'Renowned Linux kernel developer Greg Kroah-Hartman announced Thursday that the Linux 6.12 kernel series has been officially marked as LTS (Long Term Support) on the kernel.org website with a predicted life expectancy of at least two years. Linux kernel 6.12 was released on November 17th, 2024, and introduces new features like real-time "PREEMPT_RT" support, a new scheduler called sched_ext, and DRM panic messages as QR codes, as well as numerous new and updated drivers for better hardware support... Linux kernel 6.12 joins the many other long-term support kernel branches, namely Linux 6.6 LTS, Linux 6.1 LTS, Linux 5.15 LTS, Linux 5.10 LTS, and Linux 5.4 LTS. Apart from the latter, the rest of them, including Linux kernel 6.12, will be officially supported until the end of December 2026. Hopefully, Linux kernel 6.12 will be supported for more than two years as the kernel maintainers usually aim for four years of support for a new LTS kernel, especially if there's demand from hardware manufacturers and other companies that aim to use a long-term supported kernel in their devices. ' -- source: https://linux.slashdot.org/story/24/12/09/0125219 Cheers, Peter

1 0

migration of wlug list
by Peter Reutemann 06 Dec '24

06 Dec '24

Hi everyone Thanks to Elliot Hathaway from TechnologyWise working hard behind the scenes, we now have an alternative mailman instance to keep our wlug mailing list going forward. As a reminder, the university server will be shut down next week Friday, December 13th. Thanks to Daniel Lawson, a former WLUG president, and now owner of the wlug.org.nz domain, the list will be a sub-domain under the wlug.org.nz domain. What is next? On Monday, December 9th, we will do a final migration of members and archives from the current mailman instance to the new one. Once that is done, you will receive an invitation to subscribe to the new list. If you want to continue using the list, then please accept it. This might also be a good opportunity to revisit your password and replace it with a strong one (passwords won't be migrated!). I will then make a final post on the old mailing list that the migration has finished with a link to the new one (just in case your invitation ended up in spam). After that, the old mailing list will be disabled, i.e., members removed and no longer accepting new member sign-ups. Have a good weekend! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://profiles.waikato.ac.nz/peter.reutemann http://www.data-mining.co.nz/

1 0

Linux Making Inroads In PC Gaming
by Lawrence D'Oliveiro 06 Dec '24

06 Dec '24

You’d think that PC gaming was the last nearly unassailable bastion in the Windows world, where potential users who were willing to consider Linux would be few and far between. Reinforcing this idea, Valve tried to bring out its Linux-based “SteamOS” a few years ago, and failed. But then, the Steam Deck pioneered a new market segment, namely PC gaming in a handheld form factor. And here, Valve has found success with Linux -- to the point where the Windows-based competitors look overpriced and underperforming -- in short, just plain clunky. This in spite of the natural advantage of Windows in offering better compatibility with games specifically written for Windows. Now we hear that Valve is having another try at offering SteamOS for third-party hardware <https://arstechnica.com/gaming/2024/12/the-return-of-steam-machines-valve-r…>. The article suggests, and I strongly suspect it is so, that this is to allow those competitors to the Steam Deck to offer a better OS than Windows on their products. Some of them have already made noises to this effect. The Steam Deck is already so far ahead of its Windows-based competitors, that offering serious competition to the Steam Deck will only leave Windows further behind in the lurch -- further cementing the dominance of Linux in this new market segment.

1 0

testing the new list
by Peter Reutemann 05 Dec '24

05 Dec '24

blah blah blah -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://profiles.waikato.ac.nz/peter.reutemann http://www.data-mining.co.nz/

3 2

Trying Out Bluesky
by Lawrence D'Oliveiro 04 Dec '24

04 Dec '24

Just signed up at Bluesky <https://bsky.app/> earlier this morning. Did some searches for stuff on Python, Blender, Linux, NZ etc. Already got into reasonably civil discussions with a bunch of people on related topics, and got some likes on my comments. Feels a lot like Twitter from, say, a decade ago. No doubt there are topics with much greater traffic than those I’ve mentioned. Possibly even some loonies and other questionable content, if you look hard enough. This seems to be a Fediverse-type system, connected via open-source protocols/software. I think there are people running their own servers, it’s not all on bluesky.social.

1 0

OpenStreetMap Migrates To Debian 12 For Enhanced Performance
by Peter Reutemann 04 Dec '24

04 Dec '24

'OpenStreetMap (OSM), the collaborative project to create a free and open map of the world, has migrated its servers to Debian 12 (Bookworm) after 18 years on Ubuntu. This transition brings with it a number of benefits, including improved speed and closer ties with the Debian community. Why the Switch? The decision to migrate was driven by a number of factors, with performance being a key consideration. OSM's infrastructure relies heavily on physical hardware, and the team encountered significant I/O performance issues with certain kernel versions on systems using NVMe storage. Debian 12 offered a solution by allowing the installation of backported kernels, effectively resolving these performance bottlenecks. Another motivating factor was the desire to align more closely with the maintainers of the software packages that OSM relies on. Debian boasts a strong reputation for package maintenance, and many Debian maintainers are deeply invested in the software they support, ensuring prompt attention to critical bugs. A Smooth Transition The migration process was facilitated by OSM's infrastructure management practices. Their server setup is largely code-driven, and rigorous testing is performed using tools like Test Kitchen and Inspec. By adding Debian as a test target platform, the team was able to identify and address any compatibility issues early on. The required code changes were relatively minor, primarily involving adjustments to package names and configuration filenames. The transition involved the following key steps: - Frontend Server Migration: OSM successfully migrated its frontend servers to Debian 12, resulting in a Ruby version upgrade from 3.0 to 3.1. This upgrade allowed for a corresponding upgrade to the Ruby on Rails framework used for the www.openstreetmap.org website. - Networking Management Shift: OSM transitioned from using netplan, the default network management tool in Ubuntu, to systemd-networkd, Debian's preferred tool. This change streamlined network management across both Ubuntu and Debian systems, ensuring consistency. - Custom Package Management: OSM adopted aptly to manage their own Debian package repository. This shift from Ubuntu's Personal Package Archives (PPA) was driven by the need to manage pre-release or custom patches of OSM software. A Shared Community The move to Debian also reflects the strong overlap between the OSM and Debian communities. Many OSM contributors are also active within the Debian ecosystem, fostering a shared understanding and collaborative spirit.' -- source: https://ostechnix.com/openstreetmap-migrates-to-debian-12-for-enhanced-perf… Cheers, Peter

2 1

Raspberry Pi Compute Module 5 Launches as a Modular Version of Raspberry Pi 5
by Peter Reutemann 02 Dec '24

02 Dec '24

'The Raspberry Pi Foundation announced today the general availability of Raspberry Pi Compute Module 5 as the fifth update to their Raspberry Pi CM (Compute Module) series. Designed as a modular version of the Raspberry Pi 5 single-board computer, the Raspberry Pi Compute Module 5 is powered by a 2.4GHz Quad-Core 64-bit ARM Cortex-A76 processor and it’s available with 2GB, 4GB, or 8GB of LPDDR4X-4267 SDRAM memory, as well as with 16GB, 32GB, or 64GB of MLC eMMC storage. Raspberry Pi CM 5 also comes with a powerful VideoCore VII graphics card supporting OpenGL ES 3.1 and Vulkan 1.3 standards, a 4Kp60 HEVC decoder, dual 4Kp60 HDMI display output, 2 × 4-lane MIPI camera/display transceivers, and 30 GPIOs supporting 1.8V or 3.3V operation. Connectivity-wise, the Raspberry Pi Compute Module 5 supports a PCIe 2.0 x1 interface for fast peripherals, two USB 3.0 interfaces for supporting simultaneous 5Gbps operation, Gigabit Ethernet with IEEE 1588 support, and optional dual-band 802.11ac Wi-Fi and Bluetooth 5.0. The Raspberry Pi CM5 IO board features a standard 40-pin GPIO connector, two full-size HDMI 2.0 connectors, two 4-lane MIPI DSI/CSI-2 FPC connectors, two USB 3.0 connectors, a Gigabit Ethernet jack with PoE+ support, an M.2 M-key PCIe socket, a microSD card socket, an RTC battery socket, and a 4-pin fan connector. Despite its small design, Raspberry Pi CM 5 also supports various peripherals, including UART, SPI, I2C, I2S, SDIO, and PWM. On top of that, Compute Module 5 is mechanically compatible with its predecessor, Raspberry Pi Compute Module 4, but provides additional stability with four M2.5 mounting holes at the corners of the board.' -- source: https://9to5linux.com/raspberry-pi-compute-module-5-launches-as-a-modular-v… Cheers, Peter

1 0

Code found online exploits LogoFAIL to install Bootkitty Linux backdoor
by Peter Reutemann 02 Dec '24

02 Dec '24

'Researchers have discovered malicious code circulating in the wild that hijacks the earliest stage boot process of Linux devices by exploiting a year-old firmware vulnerability when it remains unpatched on affected models. The critical vulnerability is one of a constellation of exploitable flaws discovered last year and given the name LogoFAIL. These exploits are able to override an industry-standard defense known as Secure Boot and execute malicious firmware early in the boot process. Until now, there were no public indications that LogoFAIL exploits were circulating in the wild. The discovery of code downloaded from an Internet-connected web server changes all that. While there are no indications the public exploit is actively being used, it is reliable and polished enough to be production-ready and could pose a threat in the real world in the coming weeks or months. Both the LogoFAIL vulnerabilities and the exploit found on-line were discovered by Binarly, a firm that helps customers identify and secure vulnerable firmware.' -- source: https://arstechnica.com/security/2024/11/code-found-online-exploits-logofai… Cheers, Peter

1 0

GIMP 3.0 - a Milestone For Open-Source Image Editing
by Peter Reutemann 30 Nov '24

30 Nov '24

'The long-awaited release of the GNU Image Manipulation Program (GIMP) 3.0 is on the way, marking the first major update since version 2.10 was released in April 2018. It now features a GTK 3 user interface and GIMP 3.0 introduces significant changes to the core platform and plugins. This release also brings performance and usability improvements, as well as more compatibility with Wayland and complex input sources. GIMP 3.0 is the first release to use GTK 3, a more modern foundation than the GTK 2 base of prior releases. GTK 4 has been available for a few years now, and is on the project's radar, but the plan was always to finish the GTK 3 work first. Moving to GTK 3 brings initial Wayland compatibility and HiDPI scaling. In addition, this allows for GIMP users to take advantage of multi-touch input, bringing pinch-to-zoom gestures to the program, and offering a better experience when working with complex peripherals, such as advanced drawing tablets. These features were not previously possible due to the limitations of GTK 2. A secondary result of the transition to GTK 3 is a refreshed user interface (UI), now with support for CSS themes included. In this release, four themes are available by default, including light, dark, and gray themes, along with a high-contrast theme for users with visual impairments. Additionally, this release has transitioned to using GTK's header bar component, typically used to combine an application's toolbar and title bar into one unit. To maintain familiarity with previous releases, however, GIMP 3.0 still supports the traditional menu interface.' -- source: https://tech.slashdot.org/story/24/11/29/134239/ Cheers, Peter

1 0

Both KDE and GNOME To Offer Official Distros
by Peter Reutemann 30 Nov '24

30 Nov '24

'KDE and GNOME have decided that because they're not big and complicated enough already, they might work better if they have their own custom distributions underneath. What's the worst that could happen? A talk from this year's KDE conference, Akademy 2024, looks like it's going to become real. The talk, by KDE developer Harald Sitter, was entitled An Operating System of Our Own, and the idea sounds simple enough: Sitter proposed an official KDE Linux distribution. Now the proposal is gathering steam and a plan is coming together for an official KDE Linux -- codenamed "Project Banana."' -- source: https://tech.slashdot.org/story/24/11/29/2055220 Cheers, Peter

1 0

file browser
by Peter Reutemann 26 Nov '24

26 Nov '24

Hi there Today, I decided to finally switch my default file browser to krusader: https://krusader.org/ For a number of years, I've been using double-commander: https://doublecmd.sourceforge.io/ Mostly, I was quite happy with double-commander, as it had my preferred two-panel approach for managing files (I frequently copy files between various directories around for testing models etc). The two-panel approach was something I came to appreciate back in the DOS days when using the Norton Commander. With Double-commander I could also have an arbitrary number of tabs within a panel. The function buttons at the bottom (rename/copy/view/terminal/etc) were also quite handy when using the mouse. And, very importantly, Double-commander is available for Windows as well. However, remote access via sftp was quite slow (viewing and copying files) and that's when I had to fall back on caja, as it had a much higher throughput. Compared to caja, krusader is much faster when listing remote files. Waiting around for caja to refresh a few thousand files was taking way too long (sometimes up to 30 seconds). That's what gave me the final push to make the switch (on my development machine). Double-commander will still be my go-to tool for Windows machines. Anyway, what is your preferred file browser? Cheers, Peter

2 1

g: An Elegant Alternative for the ls Command in Linux
by Peter Reutemann 25 Nov '24

25 Nov '24

Hi everyone Just came across this post: '“g” is a free and open-source cross-platform alternative to the ls command, offering more advanced features than any other alternative, such as what “exa” can provide. The developer named this tool “g” because it’s written in Go, and “g” is simply easy to remember. It offers various ways to customize output, multiple ways to layout the output, integrated support for Git, advanced sorting mechanisms, fuzzy path matching, and hyperlink support.' -- source: https://linuxtldr.com/g-alternative-of-the-ls-command/ Looks like an interesting alternative. :-) Cheers, Peter

1 0

Red Hat is Becoming an Official Microsoft 'Windows Subsystem for Linux' Distro
by Peter Reutemann 24 Nov '24

24 Nov '24

'You can use any Linux distribution inside of the Windows Subsystem for Linux" Microsoft recently reminded Windows users, "even if it is not available in the Microsoft Store, by importing it with a tar file." But being an official distro "makes it easier for Windows Subsystem for Linux users to install and discover it with actions like wsl --list --online and wsl --install," Microsoft pointed out this week. And "We're excited to announce that Red Hat will soon be delivering a Red Hat Enterprise Linux WSL distro image in the coming months..." Thank you to the Red Hat team as their feedback has been invaluable as we built out this new architecture, and we're looking forwards to the release...! Ron Pacheco, senior director, Red Hat Enterprise Linux Ecosystem, Red Hat says: "Developers have their preferred platforms for developing applications for multiple operating systems, and WSL is an important platform for many of them. Red Hat is committed to driving greater choice and flexibility for developers, which is why we're working closely with the Microsoft team to bring Red Hat Enterprise Linux, the largest commercially available open source Linux distribution, to all WSL users." Read Pacheco's own blog post here. But in addition Microsoft is also releasing "a new way to make WSL distros," they announced this week, "with a new architecture that backs how WSL distros are packaged and installed." Up until now, you could make a WSL distro by either creating an appx package and distributing it via the Microsoft Store, or by importing a .tar file with wsl -import. We wanted to improve this by making it possible to create a WSL distro without needing to write Windows code, and for users to more easily install their distros from a file or network share which is common in enterprise scenarios... With the tar based architecture, you can start with the same .tar file (which can be an exported Linux container!) and just edit it to add details to make it a WSL distro... These options will describe key distro attributes, like the name of the distro, its icon in Windows, and its out of box experience (OOBE) which is what happens when you run WSL for the first time. You'll notice that the oobe_command option points to a file which is a Linux executable, meaning you can set up your full experience just in Linux if you wish. ' -- source: https://tech.slashdot.org/story/24/11/23/0251245 Cheers, Peter

1 0

Ubuntu Linux Impacted By Decade-Old 'needrestart' Flaw That Gives Root
by Peter Reutemann 21 Nov '24

21 Nov '24

'Five local privilege escalation (LPE) vulnerabilities in the Linux utility "needrestart" -- widely used on Ubuntu to manage service updates -- allow attackers with local access to escalate privileges to root. The flaws were discovered by Qualys in needrestart version 0.8, and fixed in version 3.8. BleepingComputer reports: Complete information about the flaws was made available in a separate text file, but a summary can be found below: - CVE-2024-48990: Needrestart executes the Python interpreter with a PYTHONPATH environment variable extracted from running processes. If a local attacker controls this variable, they can execute arbitrary code as root during Python initialization by planting a malicious shared library. - CVE-2024-48992: The Ruby interpreter used by needrestart is vulnerable when processing an attacker-controlled RUBYLIB environment variable. This allows local attackers to execute arbitrary Ruby code as root by injecting malicious libraries into the process. - CVE-2024-48991: A race condition in needrestart allows a local attacker to replace the Python interpreter binary being validated with a malicious executable. By timing the replacement carefully, they can trick needrestart into running their code as root. - CVE-2024-10224: Perl's ScanDeps module, used by needrestart, improperly handles filenames provided by the attacker. An attacker can craft filenames resembling shell commands (e.g., command|) to execute arbitrary commands as root when the file is opened. - CVE-2024-11003: Needrestart's reliance on Perl's ScanDeps module exposes it to vulnerabilities in ScanDeps itself, where insecure use of eval() functions can lead to arbitrary code execution when processing attacker-controlled input. The report notes that attackers would need to have local access to the operation system through malware or a compromised account in order to exploit these flaws. "Apart from upgrading to version 3.8 or later, which includes patches for all the identified vulnerabilities, it is recommended to modify the needrestart.conf file to disable the interpreter scanning feature, which prevents the vulnerabilities from being exploited," adds BleepingComputer.' -- source: https://it.slashdot.org/story/24/11/21/0057206 Cheers, Peter

1 0

Linux Kernel 6.12 Has Been Released
by Peter Reutemann 18 Nov '24

18 Nov '24

'Slashdot unixbhaskar writes: Linus has released a fresh Linux kernel for public consumption. Please give it a try and report any glitches to the maintainers for improvement. Also, please do not forget to express your appreciation to those tireless folks who did all the hard work for you. The blog OMG Ubuntu calls it "one of the most biggest kernel releases for a while," joking that it's a "really real-time kernel." The headline feature in Linux 6.12 is mainline support for PREEMPT_RT. This patch set dramatically improves the performance of real-time applications by making kernel processes pre-emptible — effectively enabled proper real-time computing... Meanwhile, Linus Torvalds himself contributes a new method for user-space address masking designed to claw back some of the performance lost due to Spectre-v1 mitigations. You might have heard that kernel devs have been working to add QR error codes to Linux's kernel panic BSOD screen (as a waterfall of error text is often cut off and not easily copied for ad-hoc debugging). Well, Linux 6.12 adds support for those during Direct Rendering Manager panics... A slew of new RISC-V CPU ISA extensions are supported in Linux 6.12; hybrid CPU scaling in the Intel P-State driver lands ahead of upcoming Intel Core Ultra 2000 chips; and AMD P-State driver improves AMD Boost and AMD Preferred Core features. More coverage from the blog 9to5Linux highlights a new scheduler called sched_ext, Clang support (including LTO) for nolibc, support for NVIDIA's virtual command queue implementation for SMMUv3, and "an updated cpuidle tool that now displays the residency value of cpuidle states for a clearer and more detailed view of idle state information when using cpuidle-info." Linux kernel 6.12 also introduces SWIG bindings for libcpupower to make it easier for developers to write scripts that use and extend the functionality of libcpupower, support for translating normalized error addresses reported by an AMD memory controller into system physical addresses using a UEFI mechanism called platform runtime mechanism (PRM), as well as simplified loading of microcode patches on AMD Zen and newer CPUs by using the family, model, and stepping encoded in the patch revision number... Moreover, Linux 6.12 adds support for running as a protected guest on Android as well as perf and support for a bunch of new interconnect PMUs. It also adds the final conversions to the new Intel VFM CPU model matching macros, rewrites the PCM buffer allocation handling and locking optimizations, and improves the USB audio driver... ' -- source: https://linux.slashdot.org/story/24/11/18/0142252 Cheers, Peter

1 0

mailing list alternatives
by Peter Reutemann 18 Nov '24

18 Nov '24

Hi everyone Here is a list of all the potential options for having the WLUG mailing list continue in some form after the University of Waikato will shut down their mailman instance next month: 1. TechnologyWise would support us and host it at Catalyst (Wellington) Type: unspecified (since general hosting, could be mailman?) Comment: TW ran the BOP LUG that way 2. Linux Australia (https://lists.linux.org.au/mailman/listinfo) Type: mailman (open-source) Comment: not yet contacted whether they'd be open to it 3. Don Gould Type: unspecified (has FLOSS platform, so could be mailman) 4. NZOSS Type: discourse (open-source, at community.iridescent.nz) Comment: unlikely to migrate archives 5. Outlook Groups option Type: MS Outlook (proprietary) Comment: just email distribution, probably no archives In terms of WLUG list archives... I've experimented with hypermail (https://github.com/hypermail-project/hypermail) and was able to turn the 53MB mbox file containing all our posts from the last 25 years into 183MB of HTML. That way, we can at least ensure that the old content doesn't get lost completely. I also talked to Daniel Lawson, who's hosting the old WLUG website and wiki. Though he is not keen on managing mail (bit of a nightmare nowadays according to him), he'd be willing to host the HTML version of the archives. Please reply to this post with your preferred option(s) by Saturday night (e.g., "1" or "1 3 4"). On Sunday, I will then create a final tally (hopefully). Thanks again for your suggestions! Cheers, Peter

3 4

New systemd update will bring Windows’ infamous Blue Screen of Death to Linux
by Peter Reutemann 18 Nov '24

18 Nov '24

'Windows' infamous "Blue Screen of Death" is a bit of a punchline. People have made a hobby of spotting them out in the wild, and in some circles, they remain a byword for the supposed flakiness and instability of PCs. To this day, networked PCs in macOS are represented by beige CRT monitors displaying a BSOD. But the BSOD is supposed to be a diagnostic tool, an informational screen that technicians can use to begin homing in on the problem that caused the crash in the first place; that old Windows' BSOD error codes were often so broad and vague as to be useless doesn't make the idea a bad one. Today, version 255 of the Linux systemd project honors that original intent by adding a systemd-bsod component that generates a full-screen display of some error messages when a Linux system crashes. The systemd-bsod component is currently listed as "experimental" and "subject to change." But the functionality is simple: any logged error message that reaches the LOG_EMERG level will be displayed full-screen to allow people to take a photo or write it down. Phoronix reports that, as with BSODs in modern Windows, the Linux version will also generate a QR code to make it easier to look up information on your phone.' -- source: https://arstechnica.com/gadgets/2023/12/linux-distros-are-about-to-get-a-ki… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

European alternatives to US services
by Peter Reutemann 13 Nov '24

13 Nov '24

Hi everyone For people who are thinking of maybe switching US-based services, below is a list of European alternatives: https://european-alternatives.eu/ Came across this on Mastodon: https://mastodon.social/@sturmsucht/113470149047788406 Of course, the AlternativeTo site is always worth checking out as well: https://alternativeto.net/ Cheers, Peter

1 0

Debian 12.8 “Bookworm” Released with 68 Bug Fixes and 50 Security Updates
by Peter Reutemann 13 Nov '24

13 Nov '24

'The Debian Project announced today the release and general availability of Debian 12.8 as the seventh ISO update to the latest Debian GNU/Linux 12 “Bookworm” operating system series. Powered by a newer kernel in the Linux 6.1 LTS series, Debian 12.8 is here a little over two months after Debian 12.7 as the seventh point release of Debian Bookworm. Yes, seventh, because Debian 12.3 was never released due to an issue in the EXT4 file system leading to data corruption so it doesn’t count. Debian 12.8 provides those who want to deploy the latest Debian Bookworm operating system on new hardware an up-to-date installation media where they won’t have to download hundreds of updates from the repositories after the installation. In numbers, this new release includes a total of 68 bug fixes for miscellaneous packages and 50 security updates. Details about these security and miscellaneous bug fixes can be found on the release announcement page.' -- source: https://9to5linux.com/debian-12-8-bookworm-released-with-68-bug-fixes-and-5… Cheers, Peter

1 0

decommissioning of mailman server
by Peter Reutemann 11 Nov '24

11 Nov '24

Hi everyone Just received word from the university that, as part of their continuing move to proprietary Microsoft services, they are decommissioning their mailman server instance by December 13th and only university-related lists will be moved to an MS service. This, of course, will affect our WLUG mailing list. Any ideas where to go to? Google Groups*? Other free hosting sites for such a low-traffic list? Cheers, Peter * Not sure about import options (posts/members).

7 10

Re: B. Eagle Burt added you to the wlug_digest group
by Lawrence D'Oliveiro 10 Nov '24

10 Nov '24

Hosted at Microsoft? Oh, the irony. No, thank you.

1 0

Re: wlug Digest, Vol 401, Issue 4
by Ron Dean 09 Nov '24

09 Nov '24

I still like to read the digest very seldom have I posted anynthing On Sat, Nov 9, 2024 at 12:00 AM <wlug-request(a)list.waikato.ac.nz> wrote: > Send wlug mailing list submissions to > wlug(a)list.waikato.ac.nz > > To subscribe or unsubscribe via email, send a message with subject or > body 'help' to > wlug-request(a)list.waikato.ac.nz > > You can reach the person managing the list at > wlug-owner(a)list.waikato.ac.nz > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of wlug digest..." > > Today's Topics: > > 1. Re: decommissioning of mailman server (DL Neil) > 2. Re: decommissioning of mailman server (Peter Reutemann) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 8 Nov 2024 10:07:55 +1300 > From: DL Neil <NZLUG(a)etelligence.info> > Subject: [wlug] Re: decommissioning of mailman server > To: wlug(a)list.waikato.ac.nz > Message-ID: <a81bf0e4-072a-4013-9b49-66d1e9f0231e(a)etelligence.info> > Content-Type: text/plain; charset=UTF-8; format=flowed > > > -------- Original message -------- > > From: Peter Reutemann <fracpete(a)gmail.com>... > > continuing move to proprietary Microsoft services, they are > > decommissioning their mailman server instance by December 13th and > > only university-related lists will be moved to an MS service. This, of > > course, will affect our WLUG mailing list. > > Decommission: long overdue and not up-to-snuff with today's email-world! > > MSFTing: a continuing disappointment, as it's not a real improvement anyway > > > > Any ideas where to go to? Google Groups*? Other free hosting sites for > > such a low-traffic list? > > > Think it may be possible through NZOSS - will make enquiries and revert... > > > On 8/11/24 09:33, Don Gould wrote: > > Do you have a domain name for Wellington lug? > > Oops! > > > -- > Regards =dn > > > -- > Regards =dn > > > ------------------------------ > > Message: 2 > Date: Fri, 8 Nov 2024 10:45:27 +1300 > From: Peter Reutemann <fracpete(a)gmail.com> > Subject: [wlug] Re: decommissioning of mailman server > To: wlug List <wlug(a)list.waikato.ac.nz> > Message-ID: > <CAHoQ12JfoXKwy2qxKxMdoD-hU7SM= > 5Tsxgo6Ei1CSNY9DbXJ3Q(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > > Just received word from the university that, as part of their > > continuing move to proprietary Microsoft services, they are > > decommissioning their mailman server instance by December 13th and > > only university-related lists will be moved to an MS service. This, of > > course, will affect our WLUG mailing list. > > > > Any ideas where to go to? Google Groups*? Other free hosting sites for > > such a low-traffic list? > > Thanks for the great feedback so far everyone! > > Important factors for me would be: > - hosted in NZ > - free of charge (we no longer have a charity associated) > - mailman-based or at least support for importing mailman archives > > Please keep the suggestions coming. Early next week, I will compile a > list from the offered solutions and you can show your support for the > various options. > > Cheers, Peter > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > wlug mailing list -- wlug(a)list.waikato.ac.nz > To unsubscribe send an email to wlug-leave(a)list.waikato.ac.nz > > > ------------------------------ > > End of wlug Digest, Vol 401, Issue 4 > ************************************ > -- Ron Dean Unit 61 Village Gardens 16 Rototuna Road Hamilton 3210 New Zealand Home 64 7 8493904 Mob 02102259172

1 0

GIMP 3.0 Release Candidate Is Now Available for Public Testing
by Peter Reutemann 07 Nov '24

07 Nov '24

'The development team behind the popular GIMP open-source image editing software announced today the general availability of the Release Candidate (RC) milestone of the highly anticipated GIMP 3.0 release. Featuring a much-refined interface, GIMP 3.0 introduces massive improvements to color management, a stable public API to allow porting of plug-ins and scripts from the GIMP 2.10 series, support for loading layers from TIFF files saved in the Autodesk Sketchbook format, and support for 64 bits per pixel images for the BMP format. GIMP 3.0 also promises improvements to non-destructive editing by introducing an optional “Merge Filters” checkbox at the bottom of NDE filters that merges down the filter immediately after it’s committed, along with non-destructive filters on layer groups and the implementation of storing version of filters in GIMP’s XCF project files. “This will allow us to update filters in the future without impacting how older project files look when they’re opened. Additional work will be needed in GEGL to fully implement this feature, but that can be done after 3.0 without impacting existing project files,” said the devs. Among other noteworthy changes, the updated UI of GIMP 3.0 allows the use of the mouse scroll wheel to flip through different dockable dialogue tabs, GEGL and babl components have been updated with new features and many improvements, such as Inner Glow, Bevel, and GEGL Styles filters, and some plugins saw small enhancements. On top of all that, GIMP 3.0 also comes with a new logo, a new splash screen, improvements to the legacy icon theme to look great on HiDPI screens, and the ability to export images with different settings while leaving the original image unchanged.' -- source: https://9to5linux.com/gimp-3-0-release-candidate-is-now-available-for-publi… Cheers, Peter

1 0

Linux Mint and Framework Laptops Join Forces
by Peter Reutemann 07 Nov '24

07 Nov '24

'Linux Mint and Framework Laptops Join Forces The October 2024 edition of Linux Mint’s Monthly News brings exciting updates, including a significant announcement about collaboration with Framework Laptops, having potential to advance Mint’s compatibility with hardware designed with flexibility, repairability, and sustainability in mind. For those unfamiliar, unlike most traditional laptops, which are often difficult or impossible to repair or upgrade, Framework laptops are built to be user-friendly, making it easy to replace or upgrade components. This modular approach extends the laptop’s lifespan and promotes sustainability by reducing e-waste. According to Clement Lefebvre, the driving force behind the Linux Mint project, the team recently received Framework’s Laptop 13, and initial impressions are promising. But more importantly, this partnership could open new avenues for Linux Mint, allowing the development team to work with advanced components and technologies featured in Framework’s offerings that haven’t previously been on the project’s radar. Of course, this also means that if compatibility progresses smoothly, Linux Mint could confidently recommend Framework Laptops to its community without hesitation. As Lefebvre noted, the full review of the Laptop 13 will be available in next month’s update, but early sentiments are already positive. Apart from that, the Linux Mint team is currently working on integrating Night Light support into the Cinnamon desktop environment, thus aiming to reduce eye strain for its users. Furthermore, efforts are ongoing to migrate key Cinnamon dialogs to Clutter, enhancing functionality and design. This includes familiar dialogs like the one used to unlock keyrings or confirm display settings.' -- source: https://linuxiac.com/linux-mint-and-framework-laptops-join-forces/ Cheers, Peter

1 0

How to Use Syntax Highlighting in Nano Editor
by Peter Reutemann 07 Nov '24

07 Nov '24

I thought, the following tutorial on how to enable syntax highlighting in nano would be quite a useful one for people commonly using that editor: 'Nano is a simple and user-friendly command-line text editor for Linux, which is often used for basic text editing tasks, such as creating and editing configuration files, scripts, or simple documents. However, many users don’t know that Nano supports syntax highlighting, which can make editing code files easier by coloring different parts of the text (like keywords, variables, and comments) for better visibility. This guide will explain how to enable syntax highlighting in Nano to make your coding experience smoother and more efficient.' -- source: https://www.tecmint.com/nano-editor-syntax-highlighting/ Cheers, Peter

1 0

KDE’s New Distro: Btrfs-Based, Immutable Linux OS, with Flatpak and Snap
by Peter Reutemann 04 Nov '24

04 Nov '24

'Surprises never end. The KDE project is about to take a bold step by introducing its own Linux distribution. Here’s what it’s all about. Introduced at Akademy 2024, KDE Linux (codenamed “Project Banana”) is a brand-new, still-in-development initiative by the KDE devs to bring a seamless, user-friendly experience that merges KDE software’s reliability and rich interface with cutting-edge Linux technologies. Immediately, we want to clarify that this isn’t a rebranded version of the well-known KDE Neon developed by the KDE community. KDE Linux is an entirely new project with a completely different technical approach under the hood and ambitious goals for both developers and end users. The distro is designed to be a bulletproof, highly user-friendly operating system that showcases the best of KDE technology—a system that KDE can confidently recommend to casual users and hardware manufacturers. With an eye on simplicity, the OS will use Btrfs for its file system and introduce an image-based (immutable) approach, allowing users to easily switch between different OS versions, ensuring a secure, flexible experience without the stress of traditional system management. KDE Linux will feature rolling OS updates based on snapshot releases and employs systemd-boot with custom theming. All mutable data, such as user home directories and cache locations, is encrypted for enhanced security. Moreover, the architecture also includes an image-based A/B update mechanism with rollback capabilities and a recovery partition for added resilience. Users can benefit from an automatic backup system using Btrfs snapshots, which includes a user-friendly GUI similar to Apple’s Time Machine. Using Arch as a base, KDE Linux aims to attract a broad audience, including KDE developers, enthusiasts, and hardware vendors. It will include applications from Flatpak (and possibly Snap), helping to keep the core system and applications separate for greater stability.' -- source: https://linuxiac.com/kde-announced-its-kde-linux-distro/ Cheers, Peter

1 0

Local Privilege Escalation Vulnerability Affecting X.Org Server For 18 Years
by Peter Reutemann 30 Oct '24

30 Oct '24

'Phoronix's Michael Larabel reports: CVE-2024-9632 was made public today as the latest security vulnerability affecting the X.Org Server. The CVE-2024-9632 security issue has been present in the codebase now for 18 years and can lead to local privilege escalation. Introduced in the X.Org Server 1.1.1 release back in 2006, CVE-2024-9632 affects the X.Org Server as well as XWayland too. By providing a modified bitmap to the X.Org Server, a heap-based buffer overflow privilege escalation can occur. This security issue is within _XkbSetCompatMap() and stems from not updating the heap size properly and can lead to local privilege escalation if the server is run as root or as a remote code execution with X11 over SSH.' -- source: https://it.slashdot.org/story/24/10/29/2029233 Cheers, Peter

1 0

Debian's "secret" sauce
by Peter Reutemann 29 Oct '24

29 Oct '24

'While Debian's "sauce" is not actually all that secret, it is not particularly well-known either, Samuel Henrique said at the start of his DebConf24 talk. There is a lot of software-engineering effort that has been put in place by the distribution in order to create and maintain its releases, but ""loads of people are not aware"" of it. That may be due to the fact that all of that is not really documented anywhere in a central location that he can just point someone to. Recognizing that is what led him to give the talk; hopefully it will be a ""first step toward"" helping solve the problem. Henrique said that he is a Brazilian and has been a Debian Developer since 2018. He mostly works in the security tools packaging team, but also maintains some packages outside of that team, including curl and rsync. In addition, he mentors Debian newcomers, mostly on packaging tasks. He works on the Amazon Linux security team. He noted that his web site contains links to the slides from the talk; a WebM video is also available. [Update: A YouTube video with subtitles in English and Portuguese is also available.]' -- source: https://lwn.net/Articles/990177/ Cheers, Peter

1 0

Discovering the Joys of E-Books with Calibre
by Ben Cottrell 29 Oct '24

29 Oct '24

I was lucky to come across a collection of Cybersecurity E-Books on Humble Bundle, spending around 40 NZD to receive 21 books. After paying for and downloading the books, the PDF’s weren’t named tidily, so I decided to use Calibre to organize my collection. Calibre categorized the books under author subdirectories and named them by title nicely. It couldn’t open the PDF’s itself, it does a good job cataloguing. Do you have any favourite tools or scripts for managing E-Books? Please let me know 😊 Cheers, Ben

2 1

Raspberry Pi OS’s yearslong switch from X Window to Wayland is now official
by Peter Reutemann 29 Oct '24

29 Oct '24

'There have been times when it seemed like X Window System would be with us forever, even though it's more than 40 years old, and the last true version was issued in 2012. But with great effort, some organizations and operating systems have moved on. Raspberry Pi has now joined the forward momentum, with its latest release of Raspberry Pi OS swapping in Wayland—and it's hoping the change is hardly noticeable. You might want to wait a moment before upgrading, though. Simon Long wrote on Raspberry Pi's blog that the organization started thinking about switching to Wayland about 10 years ago, though it was "nowhere near ready to use" back then. Over the last few years, the Pi team has done some things to prep a real switch: - Used mutter as an X window manager in 2021's Bullseye release because it could also be used as a Wayland compositor - Switched from mutter to wayfire in 2023's Bookworm release and made Wayland the default for Raspberry Pi 4 and 5 - Switched one last time to labwc, which better fit Raspberry Pi's graphics hardware than wayfire Because labwc is built on wlroots, a modular system that allows for building a Wayland compositor without whole-cloth reinvention, it was easier to adapt to Raspberry Pi's needs. After efforts throughout 2024, the team is ready to call it the year of Wayland on Raspberry Pi desktops. "After much optimisation for our hardware, we have reached the point where labwc desktops run just as fast as X on older Raspberry Pi models," Long wrote. "Today, we make the switch with our latest desktop image: Raspberry Pi Desktop now runs Wayland by default across all models."' -- source: https://arstechnica.com/gadgets/2024/10/raspberry-pi-oss-years-long-switch-… Cheers, Peter

1 0

AI Scams In The Knitting And Crochet World
by Lawrence D'Oliveiro 26 Oct '24

26 Oct '24

I suppose if you spend much time in online software support forums, you’ve come across the newbie who asked an AI to generate some code for them, and then asks for help to figure out why it didn’t work. But did you know that knitting and crochet patterns are like computer code, too? And that people are using AI to generate those? And that the same problems of quality control are afflicting them? Unlike computer software, where once you track down the bug, you can usually fix just that one line and run the code again, a flaw in a knitting or crochet pattern can require you to throw away hours of work, unpicking your way back to the point where the flaw was introduced, before you can fix it and continue from that point again. And food recipes are becoming infested with AI rubbish as well. Here you might be tricked into following some interesting-looking recipe, perhaps quite complicated, only to end up with an inedible, revolting mess, and money wasted on all the ingredients, as well as time wasted doing the work. <https://www.zdnet.com/article/ai-scams-have-infiltrated-the-knitting-and-cr…>

1 0

ISC DHCP Server Replaced By Kea
by Lawrence D'Oliveiro 19 Oct '24

19 Oct '24

I just discovered that the DHCP server I’ve been using at home <https://arstechnica.com/information-technology/2024/10/finally-upgrading-fr…> officially reached EOL two years ago, and has been replaced by a new package, rewritten from the ground up, called Kea. Seems the old code base was just getting too convoluted and creaky and too hard to maintain. Of course there are tools to assist the migration to the new way of doing things.

1 0

5 Stand-Out LibreOffice Features That Make It My Go-To Office Suite
by Lawrence D'Oliveiro 17 Oct '24

17 Oct '24

From <https://www.zdnet.com/home-and-office/work-life/5-stand-out-libreoffice-fea…>: Customizable GUI: For example, when writing a novel, I want the sidebar always readily available because I need quick access to formatting options. If I'm working on a more traditional document, I might go with the tabbed UI. For spreadsheets, I want the simplest UI that I can use, such as the contextual single UI. LibreOffice makes this possible, with the ability to switch between a standard toolbar, tabbed, single toolbar, sidebar, tabbed compact, groupedbar compact, and contextual single. You can even make changes to different tools, which allows you to have one UI for Writer, one for Calc, and one for Presents. Customizable styles: What I like about this feature is that it allows me to get very granular with the styles, even to the point where I can define what style comes next, how drop caps are handled, transparency, borders, indents & spacing, text flow, font, position, highlights, much more. No AI: (what more needs to be said?) Microsoft Office compatibility: For a while, I was writing everything in Google Docs; that is, until one of my editors complained of incompatibility issues (even when exporting to the .docx format with Docs). Once I switched from Google Docs to LibreOffice (for my fiction writing), those issues all went away. Document export: LibreOffice document export allows you to export your Writer documents to XHTML, PDF, EPUB, MediaWiki, Writer Indexing Export XML, JPEG, Writer Layout XML, PNG, and WEBP. You can also save as ODF, ODF Template, Flat XML, Unified Office Format, Word 2010-365, Word 2007, Word 2007 Template, Word 2003 XML, Rich Text, Word 97-2003, and other types. If there's a format you need, more than likely LibreOffice can export it. ... I can also ask what version of MS Office a collaborator is using and make sure to export it to the most compatible version. Because, you know, even Microsoft Office cannot manage 100% compatibility with Microsoft Office ...

1 0

Resetting USB Controllers After Error
by Lawrence D'Oliveiro 16 Oct '24

16 Oct '24

I was doing my semi-regular backup of some core essential files onto USB sticks today, and hit an error writing to one of the sticks (I replaced it with a spare). However, the error left the USB on my main machine in a strange state: it still thought the bad USB stick was present on the bus, even though it had been removed. And also my USB audio interface stopped working (though thankfully not my mouse or keyboard). I found the “usbreset” utility program. Trying to reset the nonexistent device of course returned an error that it did not exist. It listed three USB hubs, and I thought if I reset the one that the stick had been connected to, that might work. I was able to reset two of the hubs, but it hung on the third one (very likely the source of the problem). And the problem remained unfixed. I thought I was going to have to reboot my machine. Then, after hunting around online, I found this little shell script <https://unix.stackexchange.com/questions/704341/how-to-reset-usb-controllers>, which finds all your USB controller interfaces and tells them to “unbind”, and then “rebind”, all devices attached to each. And that worked! I have my 5.1 USB audio working again! Of course, I can’t guarantee it’ll work for you, if you hit a similar problem, but I figure, how could it hurt to try? ;)

1 0

Juice TV Hiccup
by Lawrence D'Oliveiro 15 Oct '24

15 Oct '24

Currently when I switch to FreeView Channel 200, it shows a frozen image with the text “Cinegy” and “Demo Version” on it. Searching for that name takes me to a site that talks about “software defined television”. Either their product licence has expired, or they never had one in the first place ...

2 3

BBS Pioneer Ward Christensen Has Died
by Lawrence D'Oliveiro 15 Oct '24

15 Oct '24

Ward Christensen, co-inventor of the first computer-based Bulletin Board System, and creator of XMODEM, the first file-transfer protocol designed to work over noisy phone lines (both in the late 1970s), has passed away at the age of 78. He never made a big deal out of his pioneering achievements, and always kept a modest profile in his personal life. <https://arstechnica.com/gadgets/2024/10/ward-christensen-bbs-inventor-and-a…>

1 0

If I Buy Something, Do I Own It?
by Lawrence D'Oliveiro 12 Oct '24

12 Oct '24

For some reason, it was never considered deceptive for shops to advertise themselves as “selling” CDs and tapes and videocassettes and DVDs and video games; if you bothered to ask, you discovered that what you were buying was a “licence” to use the product, not ownership of the product as such. Well, that’s changing, at least in some places. The US state of California has now decreed that not mentioning this distinction between “licence” and “ownership” constitutes false advertising, so vendors had better make it clear <https://arstechnica.com/gaming/2024/10/steam-now-reminds-you-that-it-really…>. In case customers get upset at discovering something they should have realized before, the article ends with the reassuring words: So long as Steam lasts forever, however, this new language should not be that alarming.

1 0

Thousands of Linux systems infected by stealthy malware since 2021
by Peter Reutemann 04 Oct '24

04 Oct '24

'Thousands of machines running Linux have been infected by a malware strain that’s notable for its stealth, the number of misconfigurations it can exploit, and the breadth of malicious activities it can perform, researchers reported Thursday. The malware has been circulating since at least 2021. It gets installed by exploiting more than 20,000 common misconfigurations, a capability that may make millions of machines connected to the Internet potential targets, researchers from Aqua Security said. It can also exploit CVE-2023-33426, a vulnerability with a severity rating of 10 out of 10 that was patched last year in Apache RocketMQ, a messaging and streaming platform that’s found on many Linux machines. Perfctl storm The researchers are calling the malware Perfctl, the name of a malicious component that surreptitiously mines cryptocurrency. The unknown developers of the malware gave the process a name that combines the perf Linux monitoring tool and ctl, an abbreviation commonly used with command line tools. A signature characteristic of Perfctl is its use of process and file names that are identical or similar to those commonly found in Linux environments. The naming convention is one of the many ways the malware attempts to escape notice of infected users. Perfctl further cloaks itself using a host of other tricks. One is that it installs many of its components as rootkits, a special class of malware that hides its presence from the operating system and administrative tools. Other stealth mechanisms include: - Stopping activities that are easy to detect when a new user logs in - Using a Unix socket over TOR for external communications - Deleting its installation binary after execution and running as a background service thereafter - Manipulating the Linux process pcap_loop through a technique known as hooking to prevent admin tools from recording the malicious traffic - Suppressing mesg errors to avoid any visible warnings during execution. The malware is designed to ensure persistence, meaning the ability to remain on the infected machine after reboots or attempts to delete core components. Two such techniques are (1) modifying the ~/.profile script, which sets up the environment during user login so the malware loads ahead of legitimate workloads expected to run on the server and (2) copying itself from memory to multiple disk locations. The hooking of pcap_loop can also provide persistence by allowing malicious activities to continue even after primary payloads are detected and removed. Besides running using the machine resources to mine cryptocurrency, Perfctl also turns the machine into a profit-making proxy that paying customers use to relay their Internet traffic. Aqua Security researchers have also observed the malware serving as a backdoor to install other families of malware.' -- source: https://arstechnica.com/security/2024/10/persistent-stealthy-linux-malware-… Cheers, Peter

1 0

Mozilla Thunderbird Lands On Android With New Beta Release
by Peter Reutemann 02 Oct '24

02 Oct '24

'The popular open-source email client, Mozilla Thunderbird, has just launched a beta version of its Android app. This release, version 8.0b1, is available as a pre-release with a range of new features and improvements. Here are some notable features, improvements and bug fixes in Thunderbird for Android 8.0b1 (beta) version: 1. Thunderbird for Android Branding: This beta release introduces the official Thunderbird for Android branding, moving away from its previous identity as K-9 Mail. 2. Updated Design: Users will immediately notice the updated design language, with a Material 3 navigation drawer and a refreshed colour scheme.It's important to 3. Migration Made Easy: For those already using K-9 Mail or a previous Thunderbird for Android build, migrating settings to the new version is now a seamless process. 4. Under the Hood Improvements: This beta release incorporates the Glean SDK for improved data collection and analysis. Additionally, the groundwork for supporting financial contributions through Google Play subscriptions has been laid. 5. Enhanced Security and Privacy: When encrypting email subjects, the app now uses "[…]" for the outer subject, bolstering privacy. 6. Simplified Settings: The "Move/copy destination folders" and "Folders to search" settings have been removed for a cleaner user experience. 7. Focus on Stability and Performance: Significant refactoring has been done to critical areas such as the message list, accounts, and folders, improving maintainability and performance. Numerous bug fixes also address crashes and other issues. 8. Open Source and Community Driven: Thunderbird for Android remains committed to open-source development, welcoming contributions from the community. The project uses the Apache License, Version 2.0. 9. Known Issues: Be mindful that the settings import feature may display apps that don't yet support it, leading to unsuccessful imports.' -- source: https://ostechnix.com/thunderbird-lands-on-android-with-new-beta-release/ Cheers, Peter

1 0

Mozilla's massive lapse in judgement causes clash with uBlock Origin developer
by Peter Reutemann 02 Oct '24

02 Oct '24

'Software developers who publish their products on third-party stores face all kinds of problems sometimes. From rejected apps or extensions to removed products or unjustified claims about them. Raymond "gorhill" Hill, maker of the world's most popular content blocker uBlock Origin received two emails from Mozilla recently about his Firefox add-on uBlock Origin Lite. Good to know: uBlock Origin Lite is a Manifest V3-compatible version of the content blocker. It is less powerful, but since Google is disabling Manifest V2 support in Chrome, it is what will remain from uBlock Origin for Chromium-based browsers. Mozilla says that it has reviewed the extension and found violations. The following claims were made: - The extension is not asking for consent for data collecting. - The extension contains "minified, concatenated or otherwise machine-generated code". - There is no privacy policy. As a consequence, Mozilla disabled the extension on the Firefox Add-ons Store. Hill refuted all three claims that Mozilla made on the GitHub repository stating that the extension is not collecting any data, that there is no minified code in uBlock Origin Lite, and that there is a privacy policy. He admitted further that he does not "have the time or motivation to spend time on this nonsense" and won't react to the allegations made or appeal the decision.' -- source: https://www.ghacks.net/2024/10/01/mozillas-massive-lapse-in-judgement-cause… Cheers, Peter

1 0

I'm using Windows at the moment: what's keeping me back
by Ben Cottrell 01 Oct '24

01 Oct '24

Hi, I'm using Windows 11 on my Lenovo ThinkBook 16p Gen 2, with an NVIDIA GeForce RTX 3060, and an AMD Ryzen 5600H (with integrated Radeon graphics). In the past I've distro hopped, and here were my experiences. I've stuck with Windows because NVIDIA has still not fully committed to supporting the standards needed for Wayland. OpenSUSE Tumbleweed: The first distro that properly worked with UEFI secure booting, in terms of enrolling keys. NVIDIA's drivers would not be loaded by the kernel unless the keys were enrolled. Ubuntu: Good default GTK theme. Good beginner distro. Installing NVIDIA drivers is a little easier than OpenSUSE. NixOS: Cutting edge, and allowed me to run certain applications to run with GPU acceleration. Easy to rollback system wide changes, but I couldn't really grasp their config language. I'm not sure if the issue is down to an insufficient allocation of staff by NVIDIA, or if there's a conflict of interest with Microsoft. Cheers, Ben

1 0

How to display network traffic in the terminal?
by Peter Reutemann 01 Oct '24

01 Oct '24

Was just wondering that myself and came across the following askubuntu Q&A: https://askubuntu.com/questions/257263/how-to-display-network-traffic-in-th… Tools mentioned: bmon slurm tcptrack iftop nethogs speedometer iptraf Quite a few that I hadn't heard of. :-) Cheers, Peter

2 1

Critical Unauthenticated RCE Flaw Impacts All GNU/Linux Systems
by Peter Reutemann 27 Sep '24

27 Sep '24

'"Looks like there's a storm brewing, and it's not good news," writes ancient Slashdot reader jd. "Whether or not the bugs are classically security defects or not, this is extremely bad PR for the Linux and Open Source community. It's not clear from the article whether this affects other Open Source projects, such as FreeBSD." From a report: A critical unauthenticated Remote Code Execution (RCE) vulnerability has been discovered, impacting all GNU/Linux systems. As per agreements with developers, the flaw, which has existed for over a decade, will be fully disclosed in less than two weeks. Despite the severity of the issue, no Common Vulnerabilities and Exposures (CVE) identifiers have been assigned yet, although experts suggest there should be at least three to six. Leading Linux distributors such as Canonical and RedHat have confirmed the flaw's severity, rating it 9.9 out of 10. This indicates the potential for catastrophic damage if exploited. However, despite this acknowledgment, no working fix is still available. Developers remain embroiled in debates over whether some aspects of the vulnerability impact security.' -- source: https://it.slashdot.org/story/24/09/25/2150210 Cheers, Peter

4 4

Tor Project Merges With Tails
by Peter Reutemann 27 Sep '24

27 Sep '24

'The Tor Project: Today the Tor Project, a global non-profit developing tools for online privacy and anonymity, and Tails, a portable operating system that uses Tor to protect users from digital surveillance, have joined forces and merged operations. Incorporating Tails into the Tor Project's structure allows for easier collaboration, better sustainability, reduced overhead, and expanded training and outreach programs to counter a larger number of digital threats. In short, coming together will strengthen both organizations' ability to protect people worldwide from surveillance and censorship. Countering the threat of global mass surveillance and censorship to a free Internet, Tor and Tails provide essential tools to help people around the world stay safe online. By joining forces, these two privacy advocates will pool their resources to focus on what matters most: ensuring that activists, journalists, other at-risk and everyday users will have access to improved digital security tools. In late 2023, Tails approached the Tor Project with the idea of merging operations. Tails had outgrown its existing structure. Rather than expanding Tails's operational capacity on their own and putting more stress on Tails workers, merging with the Tor Project, with its larger and established operational framework, offered a solution. By joining forces, the Tails team can now focus on their core mission of maintaining and improving Tails OS, exploring more and complementary use cases while benefiting from the larger organizational structure of The Tor Project. This solution is a natural outcome of the Tor Project and Tails' shared history of collaboration and solidarity. 15 years ago, Tails' first release was announced on a Tor mailing list, Tor and Tails developers have been collaborating closely since 2015, and more recently Tails has been a sub-grantee of Tor. For Tails, it felt obvious that if they were to approach a bigger organization with the possibility of merging, it would be the Tor Project.' -- source: https://yro.slashdot.org/story/24/09/26/1431201 Cheers, Peter

1 0

NIST proposes barring some of the most nonsensical password rules
by Peter Reutemann 26 Sep '24

26 Sep '24

'The National Institute of Standards and Technology (NIST), the federal body that sets technology standards for governmental agencies, standards organizations, and private companies, has proposed barring some of the most vexing and nonsensical password requirements. Chief among them: mandatory resets, required or restricted use of certain characters, and the use of security questions. Choosing strong passwords and storing them safely is one of the most challenging parts of a good cybersecurity regimen. More challenging still is complying with password rules imposed by employers, federal agencies, and providers of online services. Frequently, the rules—ostensibly to enhance security hygiene—actually undermine it. And yet, the nameless rulemakers impose the requirements anyway. [...] 1. Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length. 2. Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters. 3. Verifiers and CSPs SHOULD accept all printing ASCII [RFC20] characters and the space character in passwords. 4. Verifiers and CSPs SHOULD accept Unicode [ISO/ISC 10646] characters in passwords. Each Unicode code point SHALL be counted as a single character when evaluating password length. 5. Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords. 6. Verifiers and CSPs SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator. 7. Verifiers and CSPs SHALL NOT permit the subscriber to store a hint that is accessible to an unauthenticated claimant. 8. Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., “What was the name of your first pet?”) or security questions when choosing passwords. 9. Verifiers SHALL verify the entire submitted password (i.e., not truncate it).' -- source: https://arstechnica.com/security/2024/09/nist-proposes-barring-some-of-the-… Cheers, Peter

2 1

OpenSSH 9.9 Features Enhanced Quantum-Resistant Algorithms
by Peter Reutemann 26 Sep '24

26 Sep '24

'The OpenSSH project announced the release of OpenSSH 9.9, now available for download on its official mirrors. This new version introduces significant features, including support for hybrid post-quantum key exchange using a formally verified ML-KEM implementation, improved controls for managing unwanted connections, faster NTRUPrime key exchange code, and more.' -- source: https://linuxiac.com/openssh-9-9-released/ Cheers, Peter

1 0

Kubuntu Focus Ir14 Gen 2 review: Using Linux instead of messing with it
by Peter Reutemann 25 Sep '24

25 Sep '24

'There are lots of laptops—maybe all of them—on which you can run a Linux desktop. There are a few vendors that offer laptops with extensive Linux compatibility. And then there are a select few that specialize in Linux laptops, support them, and even customize them. Kubuntu Focus is one of the select few. It sent me one of its laptops to test the Ir14 Gen 2, which runs, of course, Kubuntu, the KDE desktop variant of Ubuntu. The “Focus” in the company name comes from what it is hoping to provide: a device on which you can just do your work without worrying about what’s happening deeper in your system. Go ahead and sudo apt update, says the Focus team; we’ve got you. I used the Ir14 Gen 2 for Ars Technica work and my personal needs for at least two weeks. Setting the system up with Focus’ guided wizard, installing apps from its store, and refusing to touch any of the deeper system files, I achieved something pretty remarkable: no unexpected behaviors on a Linux laptop. Had anything gone wrong, I could reasonably lean back on the system’s rollbacks, which I used a couple of times with no problem. Is this what it could be like? Does using Linux on the desktop not have to involve compiling from source, searching for that one relevant forum comment related to a problem, wondering where the fault lies along the chain from kernel to desktop to repository to me? Maybe. Can you surrender a bit of your upgrade and tinkering curiosity in exchange for knowing that things will work when they get to you? It might be trickier than you think. A Kubuntu Focus Ir14 Gen 2 laptop includes these things: - A laptop made by Carbon Systems, which supplies a lot of fleet and enterprise systems, and happens to make them relatively upgrade and repair-friendly - A stock Kubuntu 24.04 LTS system with a Plasma desktop, with Focus’ integrations built in - A few software tools from Focus, including power profiles and rollback The Focus is not meant to let you do whatever you want but to keep doing what you do. Researchers, developers, and jet propulsion labs are some of Focus’ customers. Focus tests everything that will arrive on official update channels to the device. When kernel updates appear in the upstream, Focus makes sure everything on the device works with it, while also contributing back to Ubuntu, Kubuntu, KDE, and the kernel itself. You don’t get interim releases. You don’t get staff in the forums helping you with running Arch or Fedora. There’s no custom desktop environment or windowing system (“We felt building a separate distribution and ecosystem is the last thing anyone needed,” the company writes). Focus chose reliability for daily-driver devices running Linux. It can, in other words, save you from yourself, if you’re a lot like me. Besides testing, Focus also makes a bunch of tweaks to the system before shipping: some keyboard shortcuts, screen scaling and console font alterations, automatic power profiles on plug and unplug, and the like. Focus has also written up almost every corner of your system you want help on; you can check it out on its site.' -- source: https://arstechnica.com/gadgets/2024/09/kubuntu-focus-ir14-gen-2-review-usi… Cheers, Peter

1 0

Linux boots in 4.76 days on the Intel 4004
by Peter Reutemann 24 Sep '24

24 Sep '24

'Hardware hacker Dmitry Grinberg recently achieved what might sound impossible: booting Linux on the Intel 4004, the world's first commercial microprocessor. With just 2,300 transistors and an original clock speed of 740 kHz, the 1971 CPU is incredibly primitive by modern standards. And it's slow—it takes about 4.76 days for the Linux kernel to boot. Initially designed for a Japanese calculator called the Busicom 141-PF, the 4-bit 4004 found limited use in commercial products of the 1970s before being superseded by more powerful Intel chips, such as the 8008 and 8080 that powered early personal computers—and then the 8086 and 8088 that launched the IBM PC era. If you're skeptical that this feat is possible with a raw 4004, you're right: The 4004 itself is far too limited to run Linux directly. Instead, Grinberg created a solution that is equally impressive: an emulator that runs on the 4004 and emulates a MIPS R3000 processor—the architecture used in the DECstation 2100 workstation that Linux was originally ported to. This emulator, along with minimal hardware emulation, allows a stripped-down Debian Linux to boot to a command prompt.' -- source: https://arstechnica.com/gadgets/2024/09/hacker-boots-linux-on-intels-first-… Cheers, Peter

1 0

Zen Browser: a New Firefox-based Alternative to Chromium Browsers
by Peter Reutemann 24 Sep '24

24 Sep '24

'First released on July 11th, the Firefox-based Zen browser is "taking a different approach to the user interface," according to the blog It's FOSS. The Register says the project "reminds us strongly of Arc, a radical Chromium-based web browser... to modernize the standard web browser UI by revising some fundamental assumptions." [Arc] removes the URL bar from front and center, gets rid of the simple flat list of tabs, and so on. Zen is trying to do some similar things, but in a slightly more moderate way — and it's doing it on the basis of Mozilla's Firefox codebase... Instead of the tired old horizontal tab bar you'll see in both Firefox and Chrome, Zen implements its own tab bar... By default, this tab bar is narrow and just shows page icons — but there are some extra controls at the bottom of the sidebar, one of which expands the sidebar to show page titles too. For us, it worked better than Vivaldi's fancier sidebar. The article concludes it's "a new effort to modernize web browsing by bringing tiling, workspaces, and so on — and it's blissfully free of Google code." One Reddit comment swooned over Zen's "extraordinary" implementation of a distraction-free "Compact Mode" (hiding things like the sidebar and top bar). And It's Foss described it as a "tranquil," browser, "written using CSS, C++, JavaScript, and a few other programming languages, with a community of over 30 people contributing to it." The layout of the interface felt quite clean to me; there were handy buttons on the top to control the webpage, manage extensions, and a menu with additional options... The split-view functionality allows you to open up two different tabs on the same screen, allowing for easy multitasking when working across different webpages... I split two tabs, but in my testing, I could split over 10+ tabs... If you have a larger monitor, then you are in for a treat... The Zen Sidebar feature... can run web apps alongside any open tabs. This can be helpful in situations where you need to quickly access a service like a note-taking app, Wikipedia, Telegram, and others. On the customization side of things, you will find that Zen Browser supports everything that Firefox does, be it the settings, adding new extensions/themes/plugins, etc. The Register points out it's easy to give it a try. "Being based on Firefox means that as well as running existing extensions, it can connect to Mozilla's Sync service and pick up not just your bookmarks, but also your tabs from other instances." And beyond all that, "There's just something satisfying about switching browsers every now and again..." argues the tech site Pocket-Lint: Zen Browser's vertical tabs layout is superb and feels much better than anything available in standard Firefox. [Firefox recently offered vertical tabs and a new sidebar experience in Nightly/Firefox Labs 131.] The tab bar can be set to automatically hide and show up whenever you hover near it, and it also contains quick access buttons to bookmarks, settings, and browsing history. The tab bar also contains a profile switcher... One of the greatest parts of the Zen Browser is the community that has popped up around it. At its heart, Zen Browser is a community-driven project... Zen Browser themes are aesthetic and functional tweaks to the UI. While there aren't a ton available right now, the ones that are show a lot of promise for the browser's future... I've personally gotten great use out of the Super URL Bar theme, which makes your URL bar expand and become the focus of your screen while typing in it... There's a lot you can do to make Zen Browser feel nearly exactly like what you want it to feel like. The "Business Standard calls it "an open-source alternative to Chromium-based browsers," adding "Where Zen truly shines is it offers a range of customisation, tab management, and workspace management..." Their theme store offers a range of options, including modifications to the bookmark toolbar, a floating URL bar, private mode theming, and removal of browser padding. In addition to these, users can also choose from custom colour schemes and built-in theming options... The Sidebar is another neat feature which allows you to open tabs in a smaller, smartphone-sized window. You can view websites in mobile layout by using this panel. It's "focused on being always at the latest version of Firefox," according to its official site, noting that Firefox is known for its security features. But then, "We also have additional security features like https only built into Zen Browser to help keep you safe online." And it also promises automated Releases "to ensure security." It's FOSS adds that you can get Zen Browser for Linux, Windows, and macOS from its official website (adding "They also offer it on the Flathub store for further accessibility on Linux.") And its source code is available on GitHub.' -- source: https://news.slashdot.org/story/24/09/23/0353206 Cheers, Peter

1 0

As Companies Try 'Open Source Rug Pull', Open Source Foundations Considered Helpful
by Peter Reutemann 22 Sep '24

22 Sep '24

'"In the era of the open source rug pull, the role of open source foundations is more important than ever," argues the co-founder of the developer-focused industry analyst firm RedMonk: The "rug pull" here refers to companies that have used open source as a distribution mechanism, building a community and user base, before changing the license to be restricted, rather than truly open source. "This is capitalism, yo. We've got shareholders to satisfy. It's time to relicense that software, move to a Business Source license." [...] Where open source used to be a sustainable commitment, today too often it feels like a short term tactic. Commercial open source isn't what it used to be. Which means that open source foundations, which provide ongoing governance and intellectual property management for open source projects, are in an interesting position, in some cases becoming more adversarial than they historically have been with vendors.... [T]he Apache Software Foundation (ASF) has done a great job of fostering sustainable, commercial, open source for decades now, most notably in the data infrastructure space — think Hadoop, Spark, Kafka, Flink etc. ["[C]ommercial open source would almost certainly never have achieved critical mass and continued success without foundations in the mix," the article notes later. "The ASF was founded in 1999, and underpinned the adoption of open source middleware in the enterprise..."] One premise behind the Cloud Native Computing Foundation (CNCF) is that user organisations can within reason trust it to stand behind the projects it incubates and manages. While not an explicit commitment, adopters generally, and enterprises specifically, have seen the CNCF imprimatur as one that they can rely on. In the era of the open source rug pull this kind of promise becomes even more important.... Sid Sijbrandij, CEO of GitLab has argued that open source companies should commit to an Open Charter as a mechanism to protect users from open source rug pulls. "Open source software isn't useful if people can't rely on the project remaining open source. Adopting Open Charter offers open source users predictability amidst the growing licensing switch trend." With a CNCF project, though, the need for this kind of charter becomes less important, because the code is by design not single source, but has a diverse set of contributors. Which is to say that open source foundations can make rug pulls a lot less likely than adoption of open source technology built by a single company. Relying on benevolent dictators is generally pretty risky. And recently the benevolent dictators have seemed... less benevolent. In conclusion, "Open Source Foundations Considered Helpful," according to the post's title. It does argue that "Any company is within its rights to relicense its software, but it can certainly be problematic from a community and project health perspective. "Which is exactly why open source foundations are more important than ever."' -- source: https://news.slashdot.org/story/24/09/21/0530234 Cheers, Peter

1 0

List Of IPTV Resources
by Lawrence D'Oliveiro 22 Sep '24

22 Sep '24

This user <https://github.com/iptv-org> just popped up in my GitHub feed. One repo <https://github.com/iptv-org/iptv> claims to be a list of links to over 8000 streaming TV channels from nations all over the world, while the other is a list of tools*, providers and other resources. Do be aware it’s a bit of a mixed bag: yes, there are legitimate channels (no encryption so far that I have noticed), but also some dubious-looking links. *Oddly, FFmpeg and youtube-dl aren’t in the list.

2 5

Trying Out IPv6
by Lawrence D'Oliveiro 19 Sep '24

19 Sep '24

My new ISP supports IPv6, and I’ve been doing a few tentative tests with it. I actually disabled the DHCPv6 support in my router, and manually configured an address in the ISP-delegated range into my main machine, just for testing. And now I’ve discovered that my other Linux machines have picked up addresses in the delegated range as well, all by themselves! Turns out this is through a mechanism called “SLAAC” (“Stateless Address Autoconfiguration”). My main worry was that, since IPv6 allows direct connections without needing NAT, that internal machines with IPv6 addresses would be directly visible on the Internet. But checking with an external IPv6 ping site seems to show this is not the case: my router is blocking incoming attempts to access nodes on IPv6 addresses by default. The router responds to pings on its own IPv6 address from the public Internet, of course; but other allocated addresses in the range do not respond. Here is a site <https://test-ipv6.com/> I found to test your IPv6 connectivity. It also gives details of the tests it runs, and a handy list of some random places you can access via IPv6.

1 0

Real-Time Linux Is Now Mainstream
by Lawrence D'Oliveiro 19 Sep '24

19 Sep '24

The PREEMPT_RT patches (aka “Real-Time Linux”) originated as a set of out-of-tree mods to the Linux kernel about 20 years ago. Bit by bit, over time, various parts of them have been incorporated into the mainline code. Some of these patches have found uses in, shall we say, more mainstream application areas. And beginning with kernel version 6.12, the last of those out-of-tree patches have been merged, and the out-of-tree PREEMPT_RT patchset is no more. This article <https://www.zdnet.com/article/20-years-later-real-time-linux-makes-it-to-th…> by long-time Linux fan Steven J Vaughan-Nichols, gives some background. Including the fact that musicians have been using Linux for audio work for decades, because Linux with the real-time patches was the cheapest way of recording pro-quality audio, much cheaper than buying “real” pro audio gear.

1 0

Use oathtool Linux command line for 2 step verification (2FA)
by Peter Reutemann 18 Sep '24

18 Sep '24

Hi everyone With 2FA now being commonplace, I've mainly relied on Google's Authenticator or the MS equivalent. However, today I came across this tutorial on how to use the oathtool CLI tool to achieve the same: https://www.cyberciti.biz/faq/use-oathtool-linux-command-line-for-2-step-ve… Originally, I came across the tutorial on my Mastodon feed: https://mastodon.social/@nixCraft/113154210830716246 Cheers, Peter

1 0

Is Your Windows Licence Legal?
by Lawrence D'Oliveiro 18 Sep '24

18 Sep '24

How do you know your Windows-running PC is running a legitimately-licensed copy of Windows? It seems you can’t: <https://www.zdnet.com/article/is-your-windows-license-legal-should-you-even…>. The article says “You almost certainly have a valid Windows license if you acquired it in ...” and goes on to list the usual ways that users obtain their copies. But note that “almost”: there is nothing you end up with -- no document or artifact or anything else -- that definitively says your copy of Windows is genuine. The final decision always goes back to Microsoft: if they decide not to sue you, then your copy is probably legit.

1 0

Chrome Switching To NIST-Approved ML-KEM Quantum Encryption
by Peter Reutemann 18 Sep '24

18 Sep '24

'Google is updating the post-quantum cryptography in Chrome, replacing the experimental Kyber with the fully standardized Module Lattice Key Encapsulation Mechanism (ML-KEM) to enhance protection against quantum computing attacks. BleepingComputer reports: This change comes roughly five months after Google rolled out the post-quantum secure TLS key encapsulation system on Chrome stable for all users, which also caused some problems with TLS exchanges. The move from Kyber to ML-KEM though is not related to those early problems, that got resolved soon after manifesting. Rather, its a strategic choice to abandon an experimental system for a NIST-approved and fully standardized mechanism. ML-KEM was fully endorsed by the U.S. National Institute of Standards and Technology (NIST) in mid-August, with the agency publishing the complete technical specifications of the final version at the time. Google explains that despite the technical changes from Kyber to ML-KEM being minor, the two are essentially incompatible, so a switch had to be made. "The changes to the final version of ML-KEM make it incompatible with the previously deployed version of Kyber," explains Google. "As a result, the codepoint in TLS for hybrid post-quantum key exchange is changing from 0x6399 for Kyber768+X25519, to 0x11EC for ML-KEM768+X25519." ' -- source: https://it.slashdot.org/story/24/09/17/0455248 Cheers, Peter

1 0

Linus Torvalds Muses About Maintainer Gray Hairs, Next 'King of Linux'
by Peter Reutemann 17 Sep '24

17 Sep '24

'A report from ZDNet, written by Steven Vaughan-Nichols: In a candid keynote chat at the Linux Foundation's Open Source Summit Europe, Linux creator Linus Torvalds shared his thoughts on kernel development, the integration of Rust, and the future of open source. Dirk Hohndel, Verizon's Open Source Program Office head and Torvalds friend, moderated their conversation about the Linux ecosystem. Torvalds emphasized that kernel releases, like the recent 6.11 version, are intentionally not exciting. "For almost 15 years, we've had a very good regular cadence of releases," he explained. With releases every nine weeks, this regularity aims for timeliness and reliability rather than flashy new features. The Linux creator noted that while drivers still make up the bulk of changes, core kernel development continues to evolve. "I'm still surprised that we're doing very core development," Torvalds said, mentioning ongoing work in virtual file systems and memory management. [...] Shifting back to another contentious subject -- maintainer burnout and succession planning -- Hohndel observed that "maintainers are aging. Strangely, some of us have, you know, not quite as much or the right hair color anymore." (Torvalds interjected that "gray is the right color.") Hohndel continued, "So the question that I always ask myself: Is it about time to talk about there being a mini-Linus?" Torvalds turned the question around. True, the Linux maintainers are getting older and people do burn out and go away. "But that's kind of normal. What is not normal is that people actually stay around for decades. That's the unusual thing, and I think that's a good sign." At the same time, Torvalds admitted, it can be intimidating for a younger developer to join the Linux kernel team "when you see all these people who have been around for decades, but at the same time, we have many new developers. Some of those new developers come in, and three years later, they are top maintainers." Hohndel noted that "to be the king of Linux, the main maintainer, you have to have a lot of experience. And the backup right now is Greg KH (Greg Kroah-Hartman, maintainer of the stable Linux kernel), who is about the same age as we are and has even less hair." True, Torvalds responded, "But the thing is, Greg hasn't always been Greg. Before Greg, there's been Andrew {Morton) and Alan (Cox). After Greg, there will be Shannon and Steve. The real issue is you have to have a person or a group of people that the development community can trust, and part of trust is fundamentally about having been around for long enough that people know how you work, but long enough does not mean to be 30 years." Hohndel made one last comment: "What I'm trying to say is, you've been doing this for 33 years. I don't want to be morbid, but I think in 33 years, you may no longer be doing this?" Torvalds, making motions as though he was using a walker, replied, "I would love to still do this conference with you." The report notes the contention around the integration of Rust, highlighted by the recent departure of Rust for Linux maintainer Wedson Filho. Despite resistance from some devs who prefer C and are skeptical of Rust, Torvalds remains optimistic about Rust's future in the kernel. He said: "Rust is a very different thing, and there are a lot of people who are used to the C model. They don't like the differences, but that's OK. In the kernel itself, absolutely nobody understands everything. I don't. I rely heavily on maintainers of various subsystems. I think the same can be true of Rust and C. I think it's one of our strengths in the kernel that we can specialize. Clearly, some people just don't like the notion of Rust and having Rust encroach on their area. But we've only been doing Rust for a couple of years, so it's way too early to say Rust is a failure." Meanwhile, Torvalds confirmed that the long-anticipated real-time Linux (RTLinux) project will finally be integrated into the kernel with the upcoming release of Linux 6.12.' -- source: https://linux.slashdot.org/story/24/09/16/2047217 Cheers, Peter

1 0

Linux Kernel 6.11 is Out
by Peter Reutemann 17 Sep '24

17 Sep '24

'Linux creator Linus Torvalds has released version 6.11 of the open-source operating system kernel. The new release, while not considered major by Torvalds, introduces several notable improvements for AMD hardware users and Arch Linux developers. ZDNet: This latest version introduces several enhancements, particularly for AMD hardware users, while offering broader system improvements and new capabilities. These include: RDNA4 Graphics Support: The kernel now includes baseline support for AMD's upcoming RDNA4 graphics architecture. This early integration bodes well for future AMD GPU releases, ensuring Linux users have day-one support. Core Performance Boost: The AMD P-State driver now includes handling for AMD Core Performance Boost. This driver gives AMD Core users more granular control over turbo and boost frequency ranges. Fast Collaborative Processor Performance Control (CPPC) Support: Overclockers who want the most power possible from their computers will be happy with this improvement to the AMD P-State driver. This feature enhances power efficiency on recent Ryzen (Zen 4) mobile processors. This can improve performance by 2-6% without increasing power consumption. AES-GCM Crypto Performance: AMD and Intel CPUs benefit from significantly faster AES-GCM encryption and decryption processing, up to 160% faster than previous versions.' -- source: https://linux.slashdot.org/story/24/09/16/1928224 Cheers, Peter

1 0

Neofetch is over, but many screenshot system info tools stand ready
by Peter Reutemann 16 Sep '24

16 Sep '24

'Almost nobody truly needed Neofetch, but the people who did use it? They really liked it. Neofetch, run from a terminal, displayed key system information alongside an ASCII-art image of the operating system or distribution running on that system. You knew most of this data, but if you're taking a screenshot of your system, it looked cool and conveyed a lot of data in a small space. "The overall purpose of Neofetch is to be used in screen-shots of your system," wrote Neofetch's creator, Dylan Araps, on its Github repository. "Neofetch shows the information other people want to see." Neofetch did that, providing cool screenshots and proof-of-life images across nearly 150 OS versions until late April. The last update to the tool was made three years before that, and Araps' Github profile now contains a rather succinct coda: "Have taken up farming." Araps joins "going to a commune in Vermont" and "I now make furniture out of wood" in the pantheon of programmers who do not just leave the field, but flee into another realm entirely. As sometimes happens, the void was filled not by one decent replacement but many.' Alternatives from the article: - https://github.com/fastfetch-cli/fastfetch - https://github.com/ThatOneCalculator/NerdFetch - https://github.com/hykilpikonna/hyfetch - https://github.com/Macchina-CLI/macchina - https://github.com/Dr-Noob/cpufetch -- source: https://arstechnica.com/gadgets/2024/09/neofetch-is-over-but-many-screensho… Cheers, Peter

1 0

Ubuntu 22.04.5 LTS (Jammy Jellyfish) Is Now Available Powered by Linux Kernel 6.8
by Peter Reutemann 16 Sep '24

16 Sep '24

'Canonical released today Ubuntu 22.04.5 LTS as the fifth and last planned point release to the Ubuntu 22.04 LTS (Jammy Jellyfish) long-term supported operating system series bringing the latest security patches and updated components. Ubuntu 22.04.5 LTS is here six and a half months after Ubuntu 22.04.4 LTS as an up-to-date installation media designed for those of you who want to install Ubuntu 22.04 LTS (Jammy Jellyfish) on a new computer and don’t want to download hundreds of updated packages from the repositories after the installation. Apart from the security patches and updated packages that have been released during the past six months, the Ubuntu 22.04.5 LTS point release is powered by a newer kernel from the Ubuntu 24.04 LTS (Noble Numbat) operating system series, namely Linux kernel 6.8, to better support installations on newer hardware.' -- source: https://9to5linux.com/ubuntu-22-04-5-lts-jammy-jellyfish-is-now-available-p… Cheers, Peter

1 0

Haiku (Originally 'OpenBeOS') Releases Long Awaited R1/Beta5
by Peter Reutemann 16 Sep '24

16 Sep '24

'Haiku (the MIT-licensed operating system, inspired by BeOS) has released its fifth beta for Haiku R1. Some new features include improved UI color management, improved dark mode coloring, Tracker improvements, TUN/TAP support for VPN connections, TCP throughput improvements, performance optimizations, UFS2 (BSD's filesystem) read-only support, new FAT filesystem driver, improved hardware support, improved POSIX compliance, improved performance, and more. Slashdot has been covering the fate of the BeOS since 2000 (as well as the short-lived derivative project ZETA — and Haiku). And now "With a history of over two decades and previously known as OpenBeOS, today's Haiku is pushing forward..." writes the site NotebookCheck: Haiku is a spiritual successor to BeOS, with a focus on a clean and user-friendly design paired with low system requirements. The minimum system requirements are still an Intel Pentium II/AMD Athlon CPU or better, at least 384 MB RAM, an 800x600 screen, and at least 3GB storage. It works on both 32-bit and 64-bit x86 PCs, and the 32-bit version can run many unmodified BeOS applications. It might be the best desktop open-source operating system not based on Linux or Unix... It works well in a virtual machine like VirtualBox or UTM. ' -- source: https://news.slashdot.org/story/24/09/14/158240 Anybody ever tried running/using Haiku? Cheers, Peter

1 0

'Samba' Networking Protocol Project Gets Big Funding from the German Sovereign Tech Fund
by Peter Reutemann 16 Sep '24

16 Sep '24

'Samba is "a free software re-implementation of the SMB networking protocol," according to Wikipedia. And now the Samba project "has secured significant funding (€688,800.00) from the German Sovereign Tech Fund to advance the project," writes Jeremy Allison — Sam (who is Slashdot reader #8,157 — and also a long standing member of Samba's core team): The investment was successfully applied for by [information security service provider] SerNet. Over the next 18 months, Samba developers from SerNet will tackle 17 key development subprojects aimed at enhancing Samba's security, scalability, and functionality. The Sovereign Tech Fund is a German federal government funding program that supports the development, improvement, and maintenance of open digital infrastructure. Their goal is to sustainably strengthen the open source ecosystem. The project's focus is on areas like SMB3 Transparent Failover, SMB3 UNIX extensions, SMB-Direct, Performance and modern security protocols such as SMB over QUIC. These improvements are designed to ensure that Samba remains a robust and secure solution for organizations that rely on a sovereign IT infrastructure. Development work began as early as September the 1st and is expected to be completed by the end of February 2026 for all sub-projects. All development will be done in the open following the existing Samba development process. First gitlab CI pipelines have already been running and gitlab MRs will appear soon! Back in 2000, Jeremy Allison answered questions from Slashdot readers about Samba. Allison is now a board member at both the GNOME Foundation and the Software Freedom Conservancy, a distinguished engineer at Rocky Linux creator CIQ, and a long-time free software advocate.' -- source: https://news.slashdot.org/story/24/09/14/1726252 Cheers, Peter

1 0

copying random sample of files
by Peter Reutemann 12 Sep '24

12 Sep '24

Hi everyone I was just wondering how I can copy a random subset of files from one folder to another. And, of course, there bash utilities for that... ;-) I came across two solutions for copying 20 files from the current directory into DEST: - shuf cp `ls | shuf -n 20` DEST - sort (using random sort) ls | sort -R | tail -20 | while read file do cp $file DEST done source: https://stackoverflow.com/questions/414164/ Man pages: - shuf: https://www.man7.org/linux/man-pages/man1/shuf.1.html - sort: https://man7.org/linux/man-pages/man1/sort.1.html Cheers, Peter

3 3

Rogue WHOIS server gives researcher superpowers no one should ever have
by Peter Reutemann 12 Sep '24

12 Sep '24

'It’s not every day that a security researcher acquires the ability to generate counterfeit HTTPS certificates, track email activity, and the position to execute code of his choice on thousands of servers—all in a single blow that cost only $20 and a few minutes to land. But that’s exactly what happened recently to Benjamin Harris. Harris, the CEO and founder of security firm watchTowr, did all of this by registering the domain dotmobiregistry.net. The domain was once the official home of the authoritative WHOIS server for .mobi, a top-level domain used to indicate that a website is optimized for mobile devices. At some point—it’s not clear precisely when—this WHOIS server, which acts as the official directory for every domain ending in .mobi, was relocated, from whois.dotmobiregistry.net to whois.nic.mobi. While retreating to his Las Vegas hotel room during last month’s Black Hat security conference in Las Vegas, Harris noticed that the previous dotmobiregistry.net owners had allowed the domain to expire. He then scooped it up and set up his own .mobi WHOIS server there.' -- source: https://arstechnica.com/security/2024/09/rogue-whois-server-gives-researche… Cheers, Peter

1 0

Floorp browser
by Peter Reutemann 12 Sep '24

12 Sep '24

Hi everyone Just came across the Floorp browser, which is based on Firefox. Refreshing news, as most new browsers nowadays seem to be Chromium-based... 'Floorp, an amazing free and open-source browser backed by a Japanese company, has gained quite a bit of attention recently for offering data and privacy protection, including high customization options such as Vivaldi in relation to Chrome. The browser's performance was quite fascinating, as it was able to achieve 60% more speed compared to Firefox when tested with Speedometer and JetStream 2 benchmarking tools. If your current browser is Firefox and you love to tweak your browser, then I highly recommend you give it a try. The following is a list of data privacy and customization options offered by Floorp: - An option to enable strong fingerprints, disabling WebGL, and HTTPs for every site is available. - Open the link, image, and media in a new tab and immediately move to it. - Provide a vertical tab on the right side of the browser to quickly open certain sites or browser settings. - Built-in option to change between different user agents. - Offers a preset of 80 keyboard shortcuts for different browser actions. - It comes with Floorp Notes Sync, similar to Vivialdi, to keep your notes. - Integrated with Firefox sync to synchronize your browser bookmarks, cookies, logins, open tabs, etc.' -- source: https://ubuntushell.com/install-floorp/ -- project: https://floorp.app/ Cheers, Peter

1 2

SynthSaga -- A Good Use For AI
by Lawrence D'Oliveiro 09 Sep '24

09 Sep '24

Have a look at some of the stuff on this channel <https://www.youtube.com/@SynthSaga/videos> -- science-fiction-themed, steampunk, dieselpunk, alternative realities, whatever you want to call it. Mostly monochrome, but I still found several of them mind-blowing. Not sure if the audio was part of the same AI process, or if the artist (yes, I’d call them an artist) created that separately. Yeah, there are lots of glitches and bugs and hilariously impossible occlusions and the like. But that just adds to the hallucinatory feel. And each one is short, which leaves you wanting more. Wouldn’t you like to spend some time in a world like one of those? Just try to ignore the glitches in the matrix and go with the flow. ;)

1 0

3D Volumetric Voxel Display
by Lawrence D'Oliveiro 09 Sep '24

09 Sep '24

A guy from Weta Workshop has created a “volumetric voxel” display for showing 3D images, by spinning a regular 2D panel at a dizzyingly high speed (more than 300rpm). The images are fairly low-res: think 1980s pixelated graphics extended to the third dimension. <https://www.theverge.com/2024/9/6/24238004/doom-volumetric-voxel-display-an…> I hope it’s covered in some shield, not just to keep errant fingers (and other body parts away), but in case something ... um ... comes apart unexpectedly ...

1 0

Germany’s Sovereign Tech Fund Injects €686,400 into FreeBSD
by Peter Reutemann 04 Sep '24

04 Sep '24

'Sovereign Tech Fund, a funding pot supported financially by the German Federal Ministry for Economic Affairs and Climate Action and hosted by the German Federal Agency for Disruptive Innovation, has once again been one of Open Source’s great friends and supporters. After providing €1 million in financial support to GNOME at the end of last year and investing €203K in GStreamer and €157K in FFmpeg earlier this year, the company is now making another impressive donation to the open-source ecosystem. The FreeBSD Foundation has announced a €686,400 investment from STF to enhance the FreeBSD operating system’s infrastructure and security.' -- source: https://linuxiac.com/sovereign-tech-fund-injects-686400-into-freebsd/ Cheers, Peter

2 1

Elasticsearch Will Be Open Source Again as CTO Declares Changed Landscape
by Peter Reutemann 04 Sep '24

04 Sep '24

'Elastic, creator of popular search engine Elasticsearch and visualization tool Kibana, plans to introduce the AGPL open-source license alongside its existing licenses. The move comes three years after Elastic ditched the Apache 2.0 license, sparking controversy in the tech community. Founder Shay Banon says the change aims to clarify Elastic's market position following AWS's creation of OpenSearch, a fork of Elasticsearch. Despite initial friction, Banon claims Elastic's relationship with AWS has improved, citing growth in Elastic Cloud revenue and customer base.' -- source: https://news.slashdot.org/story/24/09/03/0511245 Cheers, Peter

1 0

YubiKeys Are Vulnerable To Cloning Attacks Thanks To Newly Discovered Side Channel
by Peter Reutemann 04 Sep '24

04 Sep '24

'The YubiKey 5, the most widely used hardware token for two-factor authentication based on the FIDO standard, contains a cryptographic flaw that makes the finger-size device vulnerable to cloning when an attacker gains brief physical access to it, researchers said Tuesday. ArsTechnica: The cryptographic flaw, known as a side channel, resides in a small microcontroller that's used in a vast number of other authentication devices, including smartcards used in banking, electronic passports, and the accessing of secure areas. While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven't tested other devices using the microcontroller, which is SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contain the same vulnerability. YubiKey-maker Yubico issued an advisory in coordination with a detailed disclosure report from NinjaLab, the security firm that reverse-engineered the YubiKey 5 series and devised the cloning attack. All YubiKeys running firmware prior to version 5.7 -- which was released in May and replaces the Infineon cryptolibrary with a custom one -- are vulnerable. Updating key firmware on the YubiKey isn't possible. That leaves all affected YubiKeys permanently vulnerable.' -- source: https://it.slashdot.org/story/24/09/03/1810216 Cheers, Peter

1 0

Microsoft Says Its Recall Uninstall Option in Windows 11 is Just a Bug
by Peter Reutemann 03 Sep '24

03 Sep '24

'While the latest update to Windows 11 makes it look like the upcoming Recall feature can be easily removed by users, Microsoft tells us it's just a bug and a fix is coming. Deskmodder spotted the change last week in the latest 24H2 version of Windows 11, with KB5041865 seemingly delivering the ability to uninstall Recall from the Windows Features section. "We are aware of an issue where Recall is incorrectly listed as an option under the 'Turn Windows features on or off' dialog in Control Panel," says Windows senior product manager Brandon LeBlanc in a statement to The Verge. "This will be fixed in an upcoming update."' -- source: https://it.slashdot.org/story/24/09/02/2241242 The only way to push a feature that users don't want: make it mandatory! I think, the technical term for this approach is "enshittification": https://en.wikipedia.org/wiki/Enshittification Cheers, Peter

1 0

Rust for Linux Maintainer Steps Down in Frustration With 'Nontechnical Nonsense'
by Peter Reutemann 03 Sep '24

03 Sep '24

'Efforts to add Rust code to the Linux kernel has suffered a setback as one of the maintainers of the Rust for Linux project has stepped down -- citing frustration with "nontechnical nonsense." The Register: Wedson Almeida Filho, a software engineer at Microsoft who has overseen the Rust for Linux project, announced his resignation in a message to the Linux kernel development mailing list. "I am retiring from the project," Filho declared. "After almost four years, I find myself lacking the energy and enthusiasm I once had to respond to some of the nontechnical nonsense, so it's best to leave it up to those who still have it in them." [...] Memory safety bugs are regularly cited as the major source of serious software vulnerabilities by organizations overseeing large projects written in C and C++. So in recent years there's been a concerted push from large developers like Microsoft and Google, and well as from government entities like the US Cybersecurity and Infrastructure Security Agency, to use memory-safe programming languages -- among them Rust. Discussions about adding Rust to Linux date back to 2020 and were realized in late 2022 with the release of Linux 6.1. "I truly believe the future of kernels is with memory-safe languages," Filho's note continued. "I am no visionary but if Linux doesn't internalize this, I'm afraid some other kernel will do to it what it did to Unix."' -- source: https://linux.slashdot.org/story/24/09/02/194205 Cheers, Peter

1 0

Public DNS Services
by Lawrence D'Oliveiro 02 Sep '24

02 Sep '24

So I finally got connected to fibre today, and I was pleased to discover that the ISP (https://simplybroadband.co.nz/) offers IPv6 as well. Is this common nowadays? We all know about the public DNS services offered by Google (8.8.8.8, 8.8.4.4) and Cloudflare (1.1.1.1, 1.0.0.1); did you know these addresses have names as well? And of course there are IPv6 addresses to go with the IPv4 ones. Try this command to find out all the related Google DNS services: host -a dns.google. (Yup, that’s “dns.google.”, no “.com” or anything else on the end.) That’s quite a breathtaking list of entries. For Cloudflare, try host one.one.one.one. Note that the “-a” option (“tell me everything”) doesn’t work with Cloudflare; quite a few online services are now imposing restrictions on these “all info” lookups, but clearly not Google, at least not on this domain: obviously they want it to remain easy for people to discover the services they’re offering.

1 1

Linux 6.12 To Optionally Display A QR Code During Kernel Panics
by Peter Reutemann 31 Aug '24

31 Aug '24

'A new feature has been submitted for inclusion in Linux 6.12, allowing the display of a QR code when a kernel panic occurs using the DRM Panic handler. This QR code can capture detailed error information that is often missed in traditional text-based panic messages, making it more user-friendly. The feature, written in Rust, is optional and can be enabled via a specific build switch. This implementation follows similar ideas from other operating systems and earlier discussions in the Linux community.' -- source: https://linux.slashdot.org/story/24/08/30/1856206 Cheers, Peter

1 0

Malware Infiltrates Pidgin Messenger's Official Plugin Repository
by Peter Reutemann 31 Aug '24

31 Aug '24

'The Pidgin messaging app removed the ScreenShareOTR plugin from its third-party plugin list after it was found to be used to install keyloggers, information stealers, and malware targeting corporate networks. BleepingComputer reports: The plugin was promoted as a screen-sharing tool for secure Off-The-Record (OTR) protocol and was available for both Windows and Linux versions of Pidgin. According to ESET, the malicious plugin was configured to infect unsuspecting users with DarkGate malware, a powerful malware threat actors use to breach networks since QBot's dismantling by the authorities. [...] Those who installed it are recommended to remove it immediately and perform a full system scan with an antivirus tool, as DarkGate may be lurking on their system. After publishing our story, Pidgin's maintainer and lead developer, Gary Kramlich, notified us on Mastodon to say that they do not keep track of how many times a plugin is installed. To prevent similar incidents from happening in the future, Pidgin announced that, from now on, it will only accept third-party plugins that have an OSI Approved Open Source License, allowing scrutiny into their code and internal functionality.' -- source: https://it.slashdot.org/story/24/08/30/2047211 Cheers, Peter

1 0

$50 2GB Raspberry Pi 5 comes with a lower price and a tweaked, cheaper CPU
by Peter Reutemann 30 Aug '24

30 Aug '24

'We're many months past the worst of the Raspberry Pi shortages, and the board is finally widely available at its suggested retail price at most sites without wait times or quantity limitations. One sign that the Pi Foundation is feeling more confident about the stock situation: the launch of a new 2GB configuration of the Raspberry Pi 5, available starting today for $50. That's $10 less than the 4GB configuration and $30 less than the 8GB version of the board. Raspberry Pi CEO Eben Upton writes that the 2GB version of the board includes a revised version of the Broadcom BCM2712C1 SoC that is slightly cheaper to manufacture. Upton says that the D0 stepping of the BCM2712C1 strips out some "dark silicon" built-in functionality that the Pi wasn't using but was still taking up space on the silicon die and increasing the cost of the chip. "From the perspective of a Raspberry Pi user, [the chip] is functionally identical to its predecessor: the same fast quad-core processor; the same multimedia capabilities; and the same PCI Express bus that has proven to be one of the most exciting features of the Raspberry Pi 5 platform," Upton writes. "However, it is cheaper to make, and so is available to us at somewhat lower cost. And this, combined with the savings from halving the memory capacity, has allowed us to take $10 out of the cost of the finished product." At $50, the price tag is still north of the baseline $35 price that the Pi started at for many years. The Pi 4 had a 1GB model for $35 when it launched, and there was a $35 2GB model available for a while in 2020, but widespread shortages and supply chain issues led to a "temporary" price increase in late 2021 that is, as of this writing, still in place. At least the 2GB Pi 5 is only $5 more expensive than the 2GB version of the Pi 4, which is still in stock for $45 at many retailers.' -- source: https://arstechnica.com/gadgets/2024/08/new-2gb-raspberry-pi-5-option-knock… Cheers, Peter

1 1

'Uncertainty' Drives LinkedIn To Migrate From CentOS To Azure Linux
by Peter Reutemann 30 Aug '24

30 Aug '24

'The Register's Liam Proven reports: Microsoft's in-house professional networking site is moving to Microsoft's in-house Linux. This could mean that big changes are coming for the former CBL-Mariner distro. Ievgen Priadka's post on the LinkedIn Engineering blog, titled Navigating the transition: adopting Azure Linux as LinkedIn's operating system, is the visible sign of what we suspect has been a massive internal engineering effort. It describes some of the changes needed to migrate what the post calls "most of our fleet" from the end-of-life CentOS 7 to Microsoft Azure Linux -- the distro that grew out of and replaced its previous internal distro, CBL-Mariner. This is an important stage in a long process. Microsoft acquired LinkedIn way back in 2016. Even so, as recently as the end of last year, we reported that a move to Azure had been abandoned, which came a few months after it laid off almost 700 LinkedIn staff -- the majority in R&D. The blog post is over 3,500 words long, so there's quite a lot to chew on -- and we're certain that this has been passed through and approved by numerous marketing and management people and scoured of any potentially embarrassing admissions. Some interesting nuggets remain, though. We enjoyed the modest comment that: "However, with the shift to CentOS Stream, users felt uncertain about the project's direction and the timeline for updates. This uncertainty created some concerns about the reliability and support of CentOS as an operating system." [...] There are some interesting technical details in the post too. It seems LinkedIn is running on XFS -- also the RHEL default file system, of course -- with the notable exception of Hadoop, and so the Azure Linux team had to add XFS support. Some CentOS and actual RHEL is still used in there somewhere. That fits perfectly with using any of the RHELatives. However, the post also mentions that the team developed a tool to aid with deploying via MaaS, which it explicitly defines as Metal as a Service. MaaS is a Canonical service, although it does support other distros -- so as well as CentOS, there may have been some Ubuntu in the LinkedIn stack as well. Some details hint at what we suspect were probably major deployment headaches. [...] Some of the other information covers things the teams did not do, which is equally informative. [...] ' -- source: https://linux.slashdot.org/story/24/08/28/2345255 Cheers, Peter

1 0

Microsoft Donates the Mono Project To Wine
by Peter Reutemann 28 Aug '24

28 Aug '24

'Microsoft has decided to donate the Mono Project to the developers of Wine, FOSS that allows Windows applications to run on Unix-like operating systems. "Mono is a software platform designed to allow developers to easily create cross platform applications," notes GameOnLinux's Liam Dawe. "It is an open source implementation of Microsoft's .NET Framework based on the ECMA standards for C# and the Common Language Runtime." "Wine already makes use of Mono and this move makes sense with Microsoft focusing on open-source .NET and other efforts," adds Phoronix's Michael Larabel. "Formally handing over control of the upstream Mono project to WineHQ is a nice move by Microsoft rather than just letting the upstream Mono die off or otherwise forked." Microsoft's Jeff Schwartz announced the move on the Mono website and in a GitHub post: The Mono Project (mono/mono) ('original mono') has been an important part of the .NET ecosystem since it was launched in 2001. Microsoft became the steward of the Mono Project when it acquired Xamarin in 2016. The last major release of the Mono Project was in July 2019, with minor patch releases since that time. The last patch release was February 2024. We are happy to announce that the WineHQ organization will be taking over as the stewards of the Mono Project upstream at wine-mono / Mono - GitLab ( winehq.org) Source code in existing mono/mono and other repos will remain available, although repos may be archived. Binaries will remain available for up to four years. Microsoft maintains a modern fork of Mono runtime in the dotnet/runtime repo and has been progressively moving workloads to that fork. That work is now complete, and we recommend that active Mono users and maintainers of Mono-based app frameworks migrate to .NET which includes work from this fork. We want to recognize that the Mono Project was the first .NET implementation on Android, iOS, Linux, and other operating systems. The Mono Project was a trailblazer for the .NET platform across many operating systems. It helped make cross-platform .NET a reality and enabled .NET in many new places and we appreciate the work of those who came before us. Thank you to all the Mono developers!' -- source: https://tech.slashdot.org/story/24/08/27/2043216 Cheers, Peter

1 0

OSMC Vero V
by Lawrence D'Oliveiro 28 Aug '24

28 Aug '24

Just thought I’d mention, I got one of these gadgets <https://osmc.tv/> (the latest “Vero V” model) delivered to my doorstep today. This is to replace a Western Digital “WDTV” media streamer that I got from Dick Smith over a decade ago, that I have been getting more annoyed with. The OSMC software is built on Kodi, with some extra stuff of their own. You should be able to download it and set up your own installation, I just decided to get one of their boxes preassembled and preinstalled. They’re based in the UK. That WDTV box was always fussy about the kinds of files it would play, and what codecs and what bit rates etc it could cope with. When I tried something like .flv files for example, it would play OK if I didn’t try going fast forward/reverse, otherwise it would get stuck. Certain kinds of files could screw it up so badly, the only way to recover was to turn it off and on again. This new box is built on a much more modern Linux base, so I expect its media support will be correspondingly improved. Already it has started playing a .webm file, which the old box wouldn’t even look at. If anybody is curious to know more, just ask. I see there is even an online “store” of addons I can install, for extra capabilities.

2 3

The Linux Kernel Gets 60 CVEs A Week
by Lawrence D'Oliveiro 23 Aug '24

23 Aug '24

The Linux kernel team gets 60 logged reports of security vulnerabilities each week, according to longtime developer Greg Kroah-Hartman. He ought to know; he is the point of first contact for such reports, according to <https://www.zdnet.com/article/the-linux-security-team-issues-60-cves-a-week…>. On the bright side, most of them will likely not affect you. The total kernel source tree is up to 38 million lines of code, and your typical OS installation uses only a small fraction of that. To quote GregKH: “Your phone, the most complex beast out there, uses about 4 million lines of code”. They don’t take their time about dealing with vulnerabilities, either: This crew doesn't take embargoes or use pre-announcements. Why not? Because they believe -- with reason -- all these approaches do is lead to information leaks. Instead, they aim to get fixes out to users as quickly as possible. Typically, this is done within a week of having a patch available. This approach ensures that users are promptly notified of security issues and can update their systems accordingly. Another GregKH quote: “If you're not using the latest stable/long-term kernel system, your system is insecure”. Which means, you need to do a kernel update just about every week. The thing is, Kroah-Hartman said, "We have proof this can be done. Debian runs over 80% of the world's servers and they're using stable kernel updates. Android, billions of devices out there, takes every stable kernel update on a couple months lag, but they're doing it and keeping their devices secure. There's nothing more complex than embedded into the system, and there's nothing more common and easy to use than a Debian server.

1 0

Litespeed Cache bug exposes millions of WordPress sites to takeover attacks
by Peter Reutemann 22 Aug '24

22 Aug '24

'A critical vulnerability in the LiteSpeed Cache WordPress plugin can let attackers take over millions of websites after creating rogue admin accounts. LiteSpeed Cache is open-source and the most popular WordPress site acceleration plugin, with over 5 million active installations and support for WooCommerce, bbPress, ClassicPress, and Yoast SEO. The unauthenticated privilege escalation vulnerability (CVE-2024-28000) was found in the plugin's user simulation feature and is caused by a weak hash check in LiteSpeed Cache up to and including version 6.3.0.1. Security researcher John Blackbourn submitted the flaw to Patchstack's bug bounty program on August 1. The LiteSpeed team developed a patch and shipped it with LiteSpeed Cache version 6.4, released on August 13. Successful exploitation enables any unauthenticated visitors to gain administrator-level access, which can be used to completely take over websites running vulnerable LiteSpeed Cache versions by installing malicious plugins, changing critical settings, redirecting traffic to malicious websites, distributing malware to visitors, or stealing user data.' -- source: https://www.bleepingcomputer.com/news/security/litespeed-cache-bug-exposes-… Cheers, Peter

1 0

“Something has gone seriously wrong,” dual-boot systems warn after Microsoft update
by Peter Reutemann 21 Aug '24

21 Aug '24

'Last Tuesday, loads of Linux users—many running packages released as early as this year—started reporting their devices were failing to boot. Instead, they received a cryptic error message that included the phrase: “Something has gone seriously wrong.” The cause: an update Microsoft issued as part of its monthly patch release. It was intended to close a 2-year-old vulnerability in GRUB, an open source boot loader used to start up many Linux devices. The vulnerability, with a severity rating of 8.6 out of 10, made it possible for hackers to bypass secure boot, the industry standard for ensuring that devices running Windows or other operating systems don’t load malicious firmware or software during the bootup process. CVE-2022-2601 was discovered in 2022, but for unclear reasons, Microsoft patched it only last Tuesday. Tuesday’s update left dual-boot devices—meaning those configured to run both Windows and Linux—no longer able to boot into the latter when Secure Boot was enforced. When users tried to load Linux, they received the message: “Verifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation.” Almost immediately support and discussion forums lit up with reports of the failure. “Note that Windows says this update won't apply to systems that dual-boot Windows and Linux,” one frustrated person wrote. “This obviously isn't true, and likely depends on your system configuration and the distribution being run. It appears to have made some linux efi shim bootloaders incompatible with microcrap efi bootloaders (that's why shifting from MS efi to 'other OS' in efi setup works). It appears that Mint has a shim version that MS SBAT doesn't recognize.” The reports indicate that multiple distributions, including Debian, Ubuntu, Linux Mint, Zorin OS, Puppy Linux, are all affected. Microsoft has yet to acknowledge the error publicly, explain how it wasn’t detected during testing, or provide technical guidance to those affected. Company representatives didn’t respond to an email seeking answers.' -- source: https://arstechnica.com/security/2024/08/a-patch-microsoft-spent-2-years-pr… Cheers, Peter

1 0

Check Linux / Unix configuration files for syntax errors
by Peter Reutemann 14 Aug '24

14 Aug '24

Just came across this post, which I thought quite handy: 'In Linux and UNIX system services are configured using various text files located in /etc/ or /usr/local/etc/ directory tree. A typical server system could have dozens of configuration files. You can check your configuration files for syntax errors without starting the server and validate all settings. In some cases, it is possible to check the sanity of specific data/config options and directories. Text files are easier to manage remotely. You can use ssh and a text editor. If there is an error in configuration, the server may not start. It may result in a disaster. This post explains how to quickly find out a syntax error for popular servers and test configuration file for syntax errors.' -- source: https://www.cyberciti.biz/tips/check-unix-linux-configuration-file-for-synt… Cheers, Peter

1 0

Almost unfixable “Sinkclose” bug affects hundreds of millions of AMD chips
by Peter Reutemann 12 Aug '24

12 Aug '24

'Security flaws in your computer's firmware, the deep-seated code that loads first when you turn the machine on and controls even how its operating system boots up, have long been a target for hackers looking for a stealthy foothold. But only rarely does that kind of vulnerability appear not in the firmware of any particular computer maker, but in the chips found across hundreds of millions of PCs and servers. Now security researchers have found one such flaw that has persisted in AMD processors for decades, and that would allow malware to burrow deep enough into a computer's memory that, in many cases, it may be easier to discard a machine than to disinfect it. At the Defcon hacker conference, Enrique Nissim and Krzysztof Okupski, researchers from the security firm IOActive, plan to present a vulnerability in AMD chips they're calling Sinkclose. The flaw would allow hackers to run their own code in one of the most privileged modes of an AMD processor, known as System Management Mode, designed to be reserved only for a specific, protected portion of its firmware. IOActive's researchers warn that it affects virtually all AMD chips dating back to 2006, or possibly even earlier.' -- source: https://arstechnica.com/security/2024/08/almost-unfixable-sinkclose-bug-aff… Cheers, Peter

1 0

Mozilla Wants You To Love Firefox Again
by Peter Reutemann 12 Aug '24

12 Aug '24

'Mozilla's interim CEO Laura Chambers "says the company is reinvesting in Firefox after letting it languish in recent years," reports Fast Company, "hoping to reestablish the browser as independent alternative to the likes of Google's Chrome and Apple's Safari. "But some of those investments, which also include forays into generative AI, may further upset the community that's been sticking with Firefox all these years..." Chambers acknowledges that Mozilla lost sight of Firefox in recent years as it chased opportunities outside the browser, such as VPN service and email masking. When she replaced Mitchell Baker as CEO in February, the company scaled back those other efforts and made Firefox a priority again. "Yes, Mozilla is refocusing on Firefox," she says. "Obviously, it's our core product, so it's an important piece of the business for us, but we think it's also really an important part of the internet." Some of that focus involves adding features that have become table-stakes in other browsers. In June, Mozilla added vertical tab support in Firefox's experimental branch, echoing a feature that Microsoft's Edge browser helped popularize three years ago. It's also working on tab grouping features and an easier way to switch between user profiles. Mozilla is even revisiting the concept of web apps, in which users can install websites as freestanding desktop applications. Mozilla abandoned work on Progressive Web Apps in Firefox a few years ago to the dismay of many power users, but now it's talking with community members about a potential path forward. "We haven't always prioritized those features as highly as we should have," Chambers says. "That's been a real shift that's been very felt in the community, that the things they're asking for . . . are really being prioritized and brought to life." Firefox was criticized for testing a more private alternative to tracking cookies which could make summaries of aggregated data available to advertisers. (Though it was only tested on a few sites, "Privacy-Preserving Attribution" was enabled by default.) But EFF staff technologist Lena Cohen tells Fast Company that approach was "much more privacy-preserving" than Google's proposal for a "Privacy Sandbox." And according to the article, "Mozilla's system only measures the success rate of ads — it doesn't help companies target those ads in the first place — and it's less susceptible to abuse due to limits on how much data is stored and which parties are allowed to access it." In June, Mozilla also announced its acquisition of Anonym, a startup led by former Meta executives that has its own privacy-focused ad measurement system. While Mozilla has no plans to integrate Anonym's tech in Firefox, the move led to even more anxiety about the kind of company Mozilla was becoming. The tension around Firefox stems in part from Mozilla's precarious financial position, which is heavily dependent on royalty payments from Google. In 2022, nearly 86% of Mozilla's revenue came from Google, which paid $510 million to be Firefox's default search engine. Its attempts to diversify, through VPN service and other subscriptions, haven't gained much traction. Chambers says that becoming less dependent on Google is "absolutely a priority," and acknowledges that building an ad-tech business is one way of doing that. Mozilla is hoping that emerging privacy regulations and wider adoption of anti-tracking tools in web browsers will increase demand for services like Anonym and for systems like Firefox's privacy-preserving ad measurements. Other revenue-generating ideas are forthcoming. Chambers says Mozilla plans to launch new products outside of Firefox under a "design sprint" model, aimed at quickly figuring out what works and what doesn't. It's also making forays into generative AI in Firefox, starting with a chatbot sidebar in the browser's experimental branch. Chambers "says to expect a bigger marketing push for Firefox in the United States soon, echoing a 'Challenge the default' ad campaign that was successful in Germany last summer. Mozilla's nonprofit ownership structure, and the idea that it's not beholden to corporate interests, figures heavily into those plans."' -- source: https://tech.slashdot.org/story/24/08/11/1635254 Cheers, Peter

1 0

Ubuntu Will Start Shipping With the Latest Upstream Linux Kernel - Even Release Candidates
by Peter Reutemann 12 Aug '24

12 Aug '24

'Here's a question from the blog OMG Ubuntu. "Ever get miffed reading about a major new Ubuntu release only to learn it doesn't come with the newest Linux kernel? "Well, that'll soon be a thing of the past." Canonical's announced a big shift in kernel selection process for future Ubuntu release, an "aggressive kernel version commitment policy" pivot that means it will ship the latest upstream kernel code in development at the time of a new Ubuntu release. Yes, even if that upstream kernel hasn't yet seen a formal stable release (and received the requisite newspaper-graphic-topped rundown on this blog). Which is a huge change. Currently, new Ubuntu releases include the most recent stable Linux kernel release at the time of the kernel freeze milestone in the Ubuntu development cycle. Here's the official announcement by Canonical's Brett Grandbois. "Ubuntu will now ship the absolute latest available version of the upstream Linux kernel at the specified Ubuntu release freeze date, even if upstream is still in Release Candidate status..." It is actually expected that Late Releases will be the exception rather than the norm and in most releases these guidelines will not be necessary as the upstream kernel will release with enough time for the Ubuntu kernel to stabilize. However, adopting a more aggressive kernel version commitment policy does require us to be prepared for a possible Late Release situation and therefore informing the community on what they can expect. ' -- source: https://news.slashdot.org/story/24/08/11/075217 Cheers, Peter

1 0

You can kick the alpha tires on System76’s Cosmic, a new Linux desktop
by Peter Reutemann 09 Aug '24

09 Aug '24

'System76 has released an alpha version of its Cosmic desktop environment for Linux and Unix-like systems. The Linux hardware firm isn't targeting only its customers with its GNOME replacement; it also hopes to get distro maintainers and app makers on board with its Rust-built, UX-focused desktop. While the Cosmic desktop will be built into the Linux vendor's Pop!_OS (which is also in the alpha ISO), it's also available to other systems, as you might expect. System76 provides drop-in instructions for Fedora and Arch Linux installs, among others. System76 says it is "excited to see COSMIC integration elevate Linux as a whole," along with what results "from making UX-building more accessible." By building Cosmic natively in the Rust language, System76 also intends to provide a more stable and memory-safe environment for apps. Cosmic shows deep attention to tiling, keyboard shortcuts, and panel and dock customization, as has been present on its Pop!_OS. I'm a bit of a boring side-by-side, single-workspace type; Gardiner Bryant on YouTube went deeper into the Cosmic alpha's tiling, panels, and GTK app acceptance. I found that getting Cosmic into a reasonable shape I could work from, and picking up its keyboard window shortcuts, was easier than with either KDE or GNOME. One thing System76 made clear in its push for Cosmic is its readiness for more deeply integrated themes. System76 offered a few examples in its press materials, and I must admit a fondness for its over-the-top examples. -- source: https://arstechnica.com/gadgets/2024/08/you-can-kick-the-alpha-tires-on-sys… Cheers, Peter

1 0

Chrome’s Manifest V3, and its changes for ad blocking, are coming real soon
by Peter Reutemann 07 Aug '24

07 Aug '24

'Google Chrome's long, long project to implement a new browser extension platform is seemingly going to happen, for real, after six years of cautious movement. One of the first ways people are seeing this is if they use uBlock Origin, a popular ad-blocking extension, as noted by Bleeping Computer. Recently, Chrome users have seen warnings pop up that "This extension may soon no longer be supported," with links asking the user to "Remove or replace it with similar extensions" from Chrome's Web Store. You might see a similar warning on some extensions if you head to Chrome's Extensions page (chrome://extensions). What's happening is Chrome preparing to make Manifest V3 required for extensions that want to run on its platform. First announced in 2018, the last word on Manifest V3 was that V2 extensions would start being nudged out in early June on the Beta, Dev, and Canary update channels. Users will be able to manually re-enable V2 extensions "for a short time," Google has said, "but over time, this toggle will go away as well." The shift for enterprise Chrome deployments is expected to be put off until June 2025. ' -- source: https://arstechnica.com/gadgets/2024/08/chromes-manifest-v3-and-its-changes… Cheers, Peter

1 0

Germany to Fund Open Source Software Maintainers Through New Fellowship Program
by Peter Reutemann 07 Aug '24

07 Aug '24

'If you’re of the ilk to complain about governments giving money away and what that means for taxpayers, the Germans — or at least their government — are doing this because it will be good for the economy, meaning they think it’ll make folks better able to pay their taxes rather just empty their pockets for the taxman. This is also why they’ve already spending a substantial amount of money to help fund over 40 FOSS projects. “Open source infrastructure is the backbone of our digital world – and the work of the people who maintain it is essential to ensuring the security and availability of this global resource,” Mirko Swillus wrote in a blog that was published on Thursday. “They lead project development, review changes, manage community interactions, and tackle security issues.” Swillus is program manager at Sovereign Tech Fund, and the blog was to announce fund’s new Fellowship for Maintainers program. “With this new fellowship program, we’re directly investing in the people behind the code by paying maintainers of critical open source components for their work,” he wrote.' -- source: https://fossforce.com/2024/08/germany-to-fund-open-source-software-maintain… Cheers, Peter

1 0

How to replace Windows with Linux Mint on your PC
by Peter Reutemann 05 Aug '24

05 Aug '24

'Are you sick of Windows fouling up? Do you want to try something different? Then, it's time to try the best Linux desktop, Linux Mint 22. I've used more operating systems than you can shake a stick at. I cut my teeth on IBM 360/OS in the 1970s. Since then, I've used every Apple and Microsoft operating system you've heard of, and many you've never known, such as A/UX and Microsoft Xenix. I've also used well over 100 different Unix and Linux distributions. So, when I say Linux Mint 22 -- the latest long-term support (LTS) version of Linux Mint -- is not just the best Linux desktop, but the best desktop, it means something. - Materials needed: Windows PC, internet connection, and a DVD-RW or USB stick with 3GB or more storage - Estimated time: 2 hours - Estimated cost: $5' -- source: https://www.zdnet.com/article/how-to-replace-windows-with-linux-mint-on-you… With the continuing enshittification [1] of Windows, maybe a good time to get folks moved to a less intrusive operating system... Cheers, Peter [1] https://en.wikipedia.org/wiki/Enshittification

1 0

First Look at Serpent OS: Minimal GNOME Desktop and Rust-Based Package Manager
by Peter Reutemann 02 Aug '24

02 Aug '24

'The wait is finally over and Ikey Doherty’s long-anticipated Serpent OS distribution has an ISO image that people can download and test on bare metal hardware or virtual machines to see what the fuss is all about. Four years ago I broke news that Ikey Doherty is making a new distro called Serpent Linux (it was later changed to Serpent OS) aiming to provide the Linux community with a truly modern distribution for people who want to just use Linux. The name of the distribution is inspired by the Serpent game created by Ikey Doherty. At that time, Serpent OS was supposed to ship with the KDE Plasma desktop environment by default, but things have changed and GNOME was chosen as the default for the initial release. The first pre-alpha ISO image includes the older GNOME 45.3 release, but I’m sure the final release will use a more recent version. Serpent OS offers a minimal GNOME desktop experience with only a handful of apps pre-installed, such as the Mozilla Firefox web browser, GNOME Console terminal emulator, GNOME Text Editor text editing app, Zed code editor, GNOME’s Loupe image viewer, and GNOME Extensions. However, Serpent OS supports Flatpak apps if you need to install the apps you need, but Flatpak support is not installed by default in this pre-alpha release.' -- source: https://9to5linux.com/first-look-at-serpent-os-minimal-gnome-desktop-and-ru… Cheers, Peter

1 0

“In the future, computers may weigh no more than 1.5 tonnes.”
by Lawrence D'Oliveiro 01 Aug '24

01 Aug '24

Nice collection of vintage computer pics/clips, along with some pithy quotes from the times (1945-1990). Which ones can you identify without looking at the captions? <https://www.docubyte.com/projects/guide-to-computing/>

1 0

The Unintended Consequences Linux’s Wayland Adoption Will Have on BSD
by Peter Reutemann 31 Jul '24

31 Jul '24

'Like most people who use Linux as their daily driver, I’ve been pleased lately to see that Wayland is finally getting some serious traction and is on its way to being the default display server for most mainstream Linux distributions. It’s been a long trip from the days when we first heard that X was on its way out and that Wayland was on its way in — 15 years as a matter of fact — so the better performance, more svelte code base, enhanced security, and all of the other advantages that Wayland brings to the table being just about here for some of us, and already here for others, is indeed good news. But before we pop the cork on the champagne bottles and start the celebrations, perhaps we should consider that this good news for Linux might not be good news for those running BSD or one of the Unixes, which is something that normally would never occur to me to think about since I’ve never tried to use BSD. The only reason I’m thinking about it now is because this weekend I ran across a post by Chris Siebenmann, a Unix systems administrator at the University of Toronto’s CS Labs. Being a Unix guy by day (and I suspect a BSD guy by night), he’s all on what Wayland on Linux means to BSD/Unix stuck on X, and he’s been thinking about what Linux’s move to Wayland is going to mean for desktop BSDs and Unixes. “Once upon a time, the future of Unix desktops looked fairly straightforward,” he wrote. “Everyone ran on X, so the major threat to cross-Unix portability in major desktops was the use of Linux only APIs, which became especially D-Bus and systemd related things. Unix desktops that were less attached to tight integration with the Linux environment would probably stay easily available on FreeBSD, OpenBSD, and so on.” The main thing I got from that is that for a long time, the BSDs have benefited somewhat from Linux. In this case, because both operating systems use X, it was relatively easy (“relatively” probably being the key word here) to port most popular “Linux” desktop environments to BSD. The trouble is, according to Siebenmann, those days might be coming to an end.' -- source: https://fossforce.com/2024/07/the-unintended-consequences-linuxs-wayland-ad… Cheers, Peter

2 1

LZ4 Compression Algorithm Gets Multi-Threaded Update
by Peter Reutemann 29 Jul '24

29 Jul '24

'Slashdot reader Seven Spirals brings news about the lossless compression algorithm LZ4: The already wonderful performance of the LZ4 compressor just got better with multi-threaded additions to it's codebase. In many cases, LZ4 can compress data faster than it can be written to disk giving this particular compressor some very special applications. The Linux kernel as well as filesystems like ZFS use LZ4 compression extensively. This makes LZ4 more comparable to the Zstd compression algorithm, which has had multi-threaded performance for a while, but cannot match the LZ4 compressor for speed, though it has some direct LZ4. >From Linuxiac.com: - On Windows 11, using an Intel 7840HS CPU, compression time has improved from 13.4 seconds to just 1.8 seconds — a 7.4 times speed increase. - macOS users with the M1 Pro chip will see a reduction from 16.6 seconds to 2.55 seconds, a 6.5 times faster performance. - For Linux users on an i7-9700k, the compression time has been reduced from 16.2 seconds to 3.05 seconds, achieving a 5.4 times speed boost... The release supports lesser-known architectures such as LoongArch, RISC-V, and others, ensuring LZ4's portability across various platforms. ' -- source: https://hardware.slashdot.org/story/24/07/28/0057247 Cheers, Peter

1 0