- wlug - list.wlug.org.nz

What Happens If You Connect Windows XP To the Internet In 2024?
by Peter Reutemann 29 Jul '24

29 Jul '24

'Long-time Slashdot reader sandbagger writes: Have you ever wondered if it's true you can instantly get malware? In this video, a person connects an XP instance directly to the internet with no firewall to see just how fast it gets compromised by malware, rootkits, malicious services and new user accounts. The answer — fast! Malwarebytes eventually finds eight different viruses/Trojan horses -- and a DNS changer. (One IP address leads back to the Russian federation.) It's fun to watch -- within just a few hours a new Windows user has even added themself. And for good measure, he also opens up Internet Explorer... - Windows XP -- very insecure, they conclude at the end of the video. Very easy for random software from the internet to get more privileges than you, and it is very hard to solve that. - Also, just out of curiosity I tried this on Windows 7. And even with all of the same settings, nothing happened. I let it run for 10 hours. So it seems like this may be a problem in historical Windows.' -- source: https://tech.slashdot.org/story/24/07/28/2137216 Cheers, Peter

1 0

Secure Boot is completely broken on 200+ models from 5 big device makers
by Peter Reutemann 26 Jul '24

26 Jul '24

'On Thursday, researchers from security firm Binarly revealed that Secure Boot is completely compromised on more than 200 device models sold by Acer, Dell, Gigabyte, Intel, and Supermicro. The cause: a cryptographic key underpinning Secure Boot on those models that was compromised in 2022. In a public GitHub repository committed in December of that year, someone working for multiple US-based device manufacturers published what’s known as a platform key, the cryptographic key that forms the root-of-trust anchor between the hardware device and the firmware that runs on it. The repository was located at https://github.com/raywu-aaeon/Ryzen2000_4000.git, and it's not clear when it was taken down. The repository included the private portion of the platform key in encrypted form. The encrypted file, however, was protected by a four-character password, a decision that made it trivial for Binarly, and anyone else with even a passing curiosity, to crack the passcode and retrieve the corresponding plain text. The disclosure of the key went largely unnoticed until January 2023, when Binarly researchers found it while investigating a supply-chain incident. Now that the leak has come to light, security experts say it effectively torpedoes the security assurances offered by Secure Boot. “It’s a big problem,” said Martin Smolár, a malware analyst specializing in rootkits who reviewed the Binarly research and spoke to me about it. “It’s basically an unlimited Secure Boot bypass for these devices that use this platform key. So until device manufacturers or OEMs provide firmware updates, anyone can basically… execute any malware or untrusted code during system boot. Of course, privileged access is required, but that’s not a problem in many cases.”' -- source: https://arstechnica.com/security/2024/07/secure-boot-is-completely-compromi… Cheers, Peter

2 1

distrobox
by Peter Reutemann 26 Jul '24

26 Jul '24

Just came across distrobox, which seems a useful extension to container managers like docker/podman/lilipod, allowing you to run other distros in your shell: 'Use any Linux distribution inside your terminal. Enable both backward and forward compatibility with software and freedom to use whatever distribution you’re more comfortable with. Distrobox uses podman, docker or lilipod to create containers using the Linux distribution of your choice. The created container will be tightly integrated with the host, allowing sharing of the HOME directory of the user, external storage, external USB devices and graphical apps (X11/Wayland), and audio.' -- source: https://distrobox.it/ That should be especially useful for people working in environments where they are forced to use a specific host OS. As long as they have one of the supported container managers available, they can easily switch! Cheers, Peter

1 0

Anyone can Access Deleted and Private Repository Data on GitHub
by Peter Reutemann 26 Jul '24

26 Jul '24

'You can access data from deleted forks, deleted repositories and even private repositories on GitHub. And it is available forever. This is known by GitHub, and intentionally designed that way. This is such an enormous attack vector for all organizations that use GitHub that we’re introducing a new term: Cross Fork Object Reference (CFOR). A CFOR vulnerability occurs when one repository fork can access sensitive data from another fork (including data from private and deleted forks). Similar to an Insecure Direct Object Reference, in CFOR users supply commit hashes to directly access commit data that otherwise would not be visible to them. ' -- source: https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo… Interesting read! Cheers, Peter

1 0

Run0 vs Sudo: What’s the Difference?
by Peter Reutemann 25 Jul '24

25 Jul '24

'Run0 is a new privilege escalation program for Systemd-based Linux systems. Similar to sudo, it allows you to run commands as a root user and access your machine’s internals. In this article, we compare Run0 vs Sudo to help you determine the right privilege escalation tool for you.' -- source: https://www.maketecheasier.com/run0-vs-sudo-whats-the-difference/ Honestly, I only came across Run0 the other day. I still remember the days of using "su" to get stuff done, long before sudo. Is anyone using Run0? What are your experiences? Cheers, Peter

1 0

It Never Rains But It Pours
by Lawrence D'Oliveiro 24 Jul '24

24 Jul '24

Instructive to read this notice <https://rimuhosting.com/maintenance.jsp?server_maint_oid=5241959612&sn_oid=…> about progress in fixing an issue in the Dallas co-lo centre for Rimu hosting. As a customer, I wasn’t affected (though I could have been), and I have no complaints with the way this was handled--it was great that they kept customers like me apprised of developments like this. The interesting part is how a single initial failure can lead to a cascade of other failures. From the description, the original problem was a breakdown of a transformer feeding power from the grid. To allow it to be repaired, the power was switched to a backup generator. The generator then shut down with a belt problem. So power went to UPS batteries. These ran flat before the generator could be brought back to operation. So various parts of the facility were left without power. After power was restored, it was discovered that some (network?) switches had failed to come up. So a bunch of physical boxes holding customers’ VMs had to be physically moved to a different location where they could get connectivity again. From that point, the disruption was (mostly) over as far as customers were concerned, though there was obviously still work to be done to get the infrastructure back to its normal state. I think that a lot of theoretical statistical modelling of the odds of system failures tends to assume that failures of individual components will be independent of each other. Yet time and time again in the real world, we discover that this is not the case.

1 0

Switzerland Now Requires All Government Software To Be Open Source
by Peter Reutemann 24 Jul '24

24 Jul '24

'Switzerland has enacted the "Federal Law on the Use of Electronic Means for the Fulfillment of Government Tasks" (EMBAG), mandating open-source software (OSS) in the public sector to enhance transparency, security, and efficiency. "This new law requires all public bodies to disclose the source code of software developed by or for them unless third-party rights or security concerns prevent it," writes ZDNet's Steven Vaughan-Nichols. "This 'public money, public code' approach aims to enhance government operations' transparency, security, and efficiency." From the report: Making this move wasn't easy. It began in 2011 when the Swiss Federal Supreme Court published its court application, Open Justitia, under an OSS license. The proprietary legal software company Weblaw wasn't happy about this. There were heated political and legal fights for more than a decade. Finally, the EMBAG was passed in 2023. Now, the law not only allows the release of OSS by the Swiss government or its contractors, but also requires the code to be released under an open-source license "unless the rights of third parties or security-related reasons would exclude or restrict this." Professor Dr. Matthias Sturmer, head of the Institute for Public Sector Transformation at the Bern University of Applied Sciences, led the fight for this law. He hailed it as "a great opportunity for government, the IT industry, and society." Sturmer believes everyone will benefit from this regulation, as it reduces vendor lock-in for the public sector, allows companies to expand their digital business solutions, and potentially leads to reduced IT costs and improved services for taxpayers. In addition to mandating OSS, the EMBAG also requires the release of non-personal and non-security-sensitive government data as Open Government Data (OGD). This dual "open by default" approach marks a significant paradigm shift towards greater openness and practical reuse of software and data. Implementing the EMBAG is expected to serve as a model for other countries considering similar measures. It aims to promote digital sovereignty and encourage innovation and collaboration within the public sector. The Swiss Federal Statistical Office (BFS) is leading the law's implementation, but the organizational and financial aspects of the OSS releases still need to be clarified. ' -- source: https://news.slashdot.org/story/24/07/23/2025220 Cheers, Peter

1 0

Linux Mint 22 “Wilma” Is Now Available for Download, Here’s What’s New
by Peter Reutemann 24 Jul '24

24 Jul '24

'Linux Mint 22 is now available for download as the latest stable release of this popular Ubuntu-based operating system for the masses featuring the Cinnamon, Xfce, and MATE desktop environments. Dubbed “Wilma”, Linux Mint 22 is based on the Ubuntu 24.04 LTS (Noble Numbat) operating system series and uses the Linux 6.8 kernel. It will receive security updates until 2029 and new kernel versions as they’re available upstream in the Ubuntu 24.04 LTS repositories. The flagship edition features the latest Cinnamon 6.2 desktop environment while the Xfce and MATE editions ship with the Xfce 4.18 and MATE 1.26 desktop environments. The Wayland session in the Cinnamon edition is still in an experimental state and Linux Mint 22 Cinnamon will default to X11. Linux Mint 22 comes with PipeWire as the default sound server, support for the new Debian DEB822 format, GTK4 support for themes, improved HiDPI support during boot, better language support, artwork improvements, and FAT32 in File System Transposition mode support for the ISO images. Software-wise, Linux Mint 22 features the Mozilla Thunderbird email client as a native DEB package, a new GNOME Online Accounts GTK independent XApp to support the Online Accounts functionality, and a new Web App called Matrix, which is preinstalled by default and connects you to the Matrix chat network. Furthermore, it features JXL (JPEG-XL) image support in the Pix image viewer, a confirmation dialog pop-up when deleting a snapshot in the Timeshift backup tool, the ability to configure the default position of newly created notes in the Sticky note-taking app, and support for the Xed text editor to duplicate selected text. It also disables unverified Flatpak apps by default in the Software Manager app, which received some welcome changes like improved multi-threading, a new preferences page, and a banner slideshow. In addition, Software Manager now loads faster than before and the main window appears instantly. On top of that, Linux Mint 22 comes with a new package called xapp-thumbnailer-gimp that provides a thumbnailer for GIMP (.xcf) files and an updated xfce4-xapp-status-plugin tray applet that lets you configure icon sizes for full-color and symbolic icons.' -- source: https://9to5linux.com/linux-mint-22-wilma-is-now-available-for-download-her… Cheers, Peter

1 0

Apache Software Foundation is Retiring its Feather Logo
by Peter Reutemann 23 Jul '24

23 Jul '24

'The Apache Software Foundation (ASF) has announced plans to evolve its corporate logo and brand system to better represent its "community over code" ethos and promote inclusivity. Why? Because the ASF took seriously concerns raised by Natives in Tech and other members of the open-source community regarding the appropriateness of using Indigenous imagery. So, the ASF will retire its iconic feather logo, which has been a central part of the foundation's identity since 1999. The organization acknowledges that, as a non-Indigenous entity, it is inappropriate to continue using Indigenous themes or language in its branding. The group also realizes that the logo has been very popular for almost 30 years, but they feel this is the right thing to do. This comes after ASF changed the name of its flagship event to Community Over Code from ApacheCon. The ASF's Marketing and publicity team, along with a Branding Steering Committee composed of ASF Members, is collaborating with branding and design vendors to develop a new logo. This new visual identity will embody the Foundation's history of providing software for the public good while reflecting its global contributor base. The decision to update the brand extends beyond the logo. Changes also apply to ASF open-source projects that currently use Indigenous imagery. It will not--I and the ASF repeat--not change the Apache License or any released software. ' -- source: https://opensourcewatch.beehiiv.com/p/apache-software-foundation-retiring-f… Cheers, Peter

1 0

Imperfect, Linux-powered, DIY smart TV is the embodiment of ad fatigue
by Peter Reutemann 23 Jul '24

23 Jul '24

'Smart TV owners have been subjected to a growing amount of ads and tracking. Ad fatigue, only worsened by a trend that sees streaming providers trying to force customers into subscriptions with commercials, is understandable. We’re at the point where someone would rather use a broken laptop dangling off a TV than be subjected to the watchful eye of the TV's native operating system. Earlier this month, as spotted by Tom’s Hardware, a blogger named Carl Riis, who says he’s a software engineer, shared his DIY project, a Linux-based “smart TV.” Riis’ project doesn’t stand out because it’s the most unique, clever, or clean. In fact, if you’re the type of person willing to pay a lot for TVs with strong aesthetic appeal, like TVs that can look like artwork or appear transparent, you’ll be put off by the EarlGreyTV. The system uses an old Lenovo laptop that has a broken keyboard and is attached to a TV by a string. As Riis wrote: “This may look a little insane, but it has been a great way to keep things neat while retaining access to the laptop."' -- source: https://arstechnica.com/gadgets/2024/07/broken-linux-laptop-makes-for-a-fin… Cheers, Peter

1 0

Microsoft: Linux Is the Top Operating System on Azure Today
by Peter Reutemann 23 Jul '24

23 Jul '24

'Azure used to be a cloud platform dedicated to Windows. Now, it's the most widely used operating system on Microsoft Azure. The New Stack's Joab Jackson writes: These days, Microsoft expends considerable effort that Linux runs as smoothly as possible on Azure, according to a talk given earlier this year at the Linux Foundation Open Source Summit given by two Microsoft Azure Linux Platforms Group program managers, Jack Aboutboul, and Krum Kashan. "Linux is the #1 operating system in Azure today," Aboutoul said. And all must be supported in a way that Microsoft users have come to expects. Hence, the need for the Microsoft's Linux Platforms Group, which provides support Linux to both the internal customers and to Azure customers. These days, the duo of engineers explained, Microsoft knows about as much as anyone about how to operate Linux at hyperscale. [...] As of today, there are hundreds of Azure and Azure-based services running on Linux, including the Azure Kubernetes Service (AKS), OpenAI, HDInsight, and many of the other database services. "A lot of the infrastructure powering everything else is running on Linux," Aboutoul said. "They're different flavors of Linux running all over the place," Aboutoul said. To run these services, Microsoft maintains its own kernel, Azure Linux, and in 2023 the company released its own version of Linux, Azure Linux. But Azure Linux is just a small portion of all the other flavors of Linux running on Azure, all of which Microsoft must work with to support. Overall, there are about 20,000 third-party Software as a Service (SaaS) packages in the Azure marketplace that rely on some Linux distribution. And when things go wrong, it is the Azure service engineers who get the help tickets. The company keeps a set of endorsed Linux distributions, which include Red Hat Enterprise Linux, Debian, Flatcar, Suse, Canonical, and Oracle Linux and CentOS (as managed by OpenLogic, not Red Hat). [...] Overall, the company gets about 1,000 images a month from these endorsed partners alone. Many of the distributions have multiple images (Suse has a regular one, and another one for high-performance computing, for instance). ' -- source: https://linux.slashdot.org/story/24/07/22/2157209 Cheers, Peter

1 0

Nvidia Will Fully Transition To Open-Source GPU Kernel Modules With R560 Drivers
by Peter Reutemann 19 Jul '24

19 Jul '24

'Nvidia is ready to fully transition to open-source Linux GPU kernel drivers, starting with the R555 series and planning a complete shift with the R560 series. The open-source kernel modules will only be available for select newer GPUs, while older architectures like Maxwell, Pascal, and Volta must continue using proprietary drivers. TechSpot reports: According to Nvidia, the open-source GPU kernel modules have helped deliver "equivalent or better" application performance compared to its proprietary kernels. The company has also added new features like Heterogeneous Memory Management (HMM) support, confidential computing, and the coherent memory architectures of the Grace platform to its open-source kernels. [...] For compatible GPUs, the default version of the driver installed by all methods is switching from proprietary to open-source. However, users will have the ability to manually select the closed-source modules if they are still available for their platform. Unfortunately, the open-source kernel modules are not available for GPUs from the older Maxwell, Pascal, and Volta architectures, meaning people still running a GTX 980 or GTX 1080 will have to continue using Nvidia's proprietary drivers. For mixed deployments with older and newer GPUs in the same system, Nvidia recommends continuing to use the proprietary driver for full compatibility. "Nvidia has moved most of its proprietary functions into a proprietary, closed-source firmware blob," adds Ars Technica's Kevin Purdy. "The parts of Nvidia's GPUs that interact with the broader Linux system are open, but the user-space drivers and firmware are none of your or the OSS community's business." ' -- source: https://news.slashdot.org/story/24/07/18/2050235 Reminds me a bit of the Brother Linux drivers that I've used in the past: open-source scripts around binary, closed-source blobs... Cheers, Peter

1 0

SUSE Requests openSUSE to Rebrand
by Peter Reutemann 18 Jul '24

18 Jul '24

'Believe it or not, an unexpected conflict has arisen in the openSUSE community with its long-time supporter and namesake, the SUSE company. At the heart of this tension lies a quiet request that has stirred not-so-quiet ripples across the open source landscape: SUSE has formally asked openSUSE to discontinue using its brand name. Richard Brown, a key figure within the openSUSE project, shared insights into the discussions that have unfolded behind closed doors. Despite SUSE’s request’s calm and respectful tone, the implications of not meeting it could be far-reaching, threatening the symbiotic relationship that has benefited both entities over the years. Let’s face it: SUSE has been more than just a namesake for openSUSE; it has actively provided resources and support far beyond what it would ordinarily need for its business operations. This generosity has fostered a thriving openSUSE project that has excelled under SUSE’s goodwill and informal support, including contributions made by SUSE employees on company time. However, the recent request for a branding separation has overshadowed this partnership. If openSUSE does not handle this request with the sensitivity and cooperation it demands, the project risks not just a reduction in support from SUSE but a potential shift in priorities away from it. The “Factory first” policy, a cornerstone of the engineering synergy between SUSE and openSUSE, could also be scrutinized, emphasizing the gravity of the current situation.' -- source: https://linuxiac.com/suse-requests-opensuse-to-rebrand/ Cheers, Peter

2 1

What Is Code?
by Lawrence D'Oliveiro 11 Jul '24

11 Jul '24

Apologies if you already know about this essay, but I just discovered it today: <https://www.bloomberg.com/graphics/2015-paul-ford-what-is-code/>. It’s long. It’s breezy, entertaining, and manages to convey some actual content. Great for recommending to friends or family members who ask what software development is all about.

1 0

Debian Curl Now Supports HTTP3: What You Need To Know
by Peter Reutemann 09 Jul '24

09 Jul '24

'Good news for Debian users! HTTP3 arrives in Debian Curl. Yes, starting with curl 8.0.0-2, Debian users can now utilize HTTP3. This marks a significant upgrade in the capabilities of curl, enhancing its performance and efficiency in handling web communications. This new feature can be easily tested using the --http3-only flag.' -- source: https://ostechnix.com/debian-curl-supports-http3/ Cheers, Peter

2 1

No more boot loader: Please use the kernel instead
by Peter Reutemann 09 Jul '24

09 Jul '24

'We are working on a new scheme to replace the GRUB bootloader with a fast, secure, Linux-based, user-space solution: nmbl (for no more boot loader). Most people are familiar with GRUB, a powerful, flexible, fully-featured bootloader that is used on multiple architectures (x86_64, aarch64, ppc64le OpenFirmware). Although GRUB is quite versatile and capable, its features create complexity that is difficult to maintain, and that both duplicate and lag behind the Linux kernel while also creating numerous security holes. On the other hand, the Linux kernel, which has a large developer base, benefits from fast feature development, quick responses to vulnerabilities and greater overall scrutiny. We (Red Hat boot loader engineering) will present our solution to this problem, which is to use the Linux kernel as its own bootloader. Loaded by the EFI stub on UEFI, and packed into a unified kernel image (UKI), the kernel, initramfs, and kernel command line, contain everything they need to reach the final boot target. All necessary drivers, filesystem support, and networking are already built in and code duplication is avoided. We will showcase the work done so far, and ask you for your feedback and use cases.' -- source: https://pretalx.com/devconf-cz-2024/talk/W3AVCT/ -- video: https://www.youtube.com/watch?v=ywrSDLp926M Cheers, Peter

1 0

FreeBSD Contributor Mocks Gloomy Predictions for the Open Source Movement
by Peter Reutemann 08 Jul '24

08 Jul '24

'In Communications of the ACM,/em>, long-time FreeBSD contributor Poul-Henning Kamp mocks the idea that the free and open-source software has "come apart" and "will end in tears and regret." Economists and others focused on money — like my bank — have had a lot of trouble figuring out the free and open source software (FOSS) phenomenon, and eventually they seem to have reached the conclusion that it just makes no sense. So, they go with the flow. Recently, very serious people in the FOSS movement have started to write long and thoughtful opinion pieces about how it has all come apart and will end in tears and regret. Allow me to disagree... What follows is a humorous history of how the Open Source movement bested a series of ill-conceived marketing failures starting after the "utterly bad" 1980s when IBM had an "unimaginably huge monopoly" — and an era of vendor lock-in from companies trying to be the next IBM: Out of that utter market failure came Minix, (Net/Free/Open)BSD, and Linux, at a median year of approximately 1991. I can absolutely guarantee that if we had been able to buy a reasonably priced and solid Unix for our 32-bit PCs — no strings attached — nobody would be running FreeBSD or Linux today, except possibly as an obscure hobby. Bill Gates would also have had a lot less of our money... The essay moves on to when "that dot-com thing happened, fueled by the availability of FOSS operating systems, which did a much better job than any operating system you could buy — not just for the price, but in absolute terms of performance on any given piece of hardware. Thus, out of utter market failure, the FOSS movement was born." And ultimately, the essay ends with our present day, and the phenomenon of companies that "make a business out of FOSS or derivatives thereof..." The "F" in FOSS was never silent. In retrospect, it seems clear that open source was not so much the goal itself as a means to an end, which is freedom: freedom to fix broken things, freedom from people who thought they could clutch the source code tightly and wield our ignorance of it as a weapon to force us all to pay for and run Windows Vista. But the FOSS movement has won what it wanted, and no matter how much oldsters dream about their glorious days as young revolutionaries, it is not coming back; the frustrations and anger of IT in 2024 are entirely different from those of 1991. One very big difference is that more people have realized that source code is a liability rather than an asset. For some, that realization came creeping along the path from young teenage FOSS activists in the late 1990s to CIOs of BigCorp today. For most of us, I expect, it was the increasingly crushing workload of maintaining legacy code bases...' -- source: https://news.slashdot.org/story/24/07/07/0243241 Cheers, Peter

1 0

“RegreSSHion” vulnerability in OpenSSH gives attackers root on Linux
by Peter Reutemann 03 Jul '24

03 Jul '24

'Researchers have warned of a critical vulnerability affecting the OpenSSH networking utility that can be exploited to give attackers complete control of Linux and Unix servers with no authentication required. The vulnerability, tracked as CVE-2024-6387, allows unauthenticated remote code execution with root system rights on Linux systems that are based on glibc, an open source implementation of the C standard library. The vulnerability is the result of a code regression introduced in 2020 that reintroduced CVE-2006-5051, a vulnerability that was fixed in 2006. With thousands, if not millions, of vulnerable servers populating the Internet, this latest vulnerability could pose a significant risk. [...] The vulnerability affects the following: - OpenSSH versions earlier than 4.4p1 are vulnerable to this signal handler race condition unless they are patched for CVE-2006-5051 and CVE-2008-4109. - Versions from 4.4p1 up to, but not including, 8.5p1 are not vulnerable due to a transformative patch for CVE-2006-5051, which made a previously unsafe function secure. - The vulnerability resurfaces in versions from 8.5p1 up to, but not including, 9.8p1 due to the accidental removal of a critical component in a function.' -- source: https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-opens… OpenSSH 9.8 was released July 1st: https://www.openssh.com/ Cheers, Peter

1 0

Made Move To Wayland
by Lawrence D'Oliveiro 01 Jul '24

01 Jul '24

I’d been running Wayland OK on my laptop for some months now, but I held off putting it on my main machine for one reason: when I logged into a Wayland session, Emacs would not recognize my Compose key (which I have set to Caps Lock). Today I finally figured out I have to install the “emacs-pgtk” package instead of “emacs-gtk”; the former is built with a version of GTK that works with Wayland. And yes, my Compose key works again. Still have to get used to slightly different input behaviour: previously, once I hit Compose, nothing would appear until I finished the whole key sequence. Now it echoes each keystroke immediately as I type it, in place, overwriting the previous echo (starting with an underline for the Compose key itself), then when I have typed the last key, it overwrites the echo area with the final character.

2 6

From Jupyter To JupyterLab
by Lawrence D'Oliveiro 28 Jun '24

28 Jun '24

I’ve been using Jupyter <https://jupyter.org/> as a convenient basis for “scratchpad” programming (not just in Python, but also some other languages) for a while now. I had heard about this next-generation “JupyterLab” thing they were working on, but always held off trying it out. Then I did my usual monthly upgrade of Debian Unstable on my main machine a few days ago, and this time my Jupyter installation broke. So I updated my wrapper scripts for building Jupyter from source, to check out more recent versions of all the necessary components. Got the build done, started it up, and ... it seems my Jupyter has turned into JupyterLab. Yup, it has a new interface now. The file-manager display no longer seems to open things with a single click; that now only selects items, and you then have to perform an action (like open a notebook) from a right-click menu. And there is no “open in new tab/window” menu item; creating a new tab always happens when opening a notebook, while opening a subfolder always replaces the current tab contents. I used to be able to middle-click on a folder to open it in a new tab, but that option is now gone. There is an option in the right-click menu to “Copy Shareable Link”. When you do this on a notebook or folder and paste the result into the address bar, it opens the item in what I can only call “lab” mode. The window now has three panes, with the middle one an editor-type display, for viewing/editing notebook contents and other document content. The left-hand pane can show various things, selected by clicking one of the icons in its leftmost margin: it can show folder contents, or the table of contents of the current notebook, or a summary of open notebooks, running processes etc. And in the right-hand pane, there are various kinds of “tools” (for debugging, inspection etc) that only seem to appear when viewing notebook content. Ah, discovered how to control the visibility of this “tool” pane: it has two icons for selecting the two different categories of this it can display. But if you click the icon for the section that is already showing, the whole pane shrinks down to a narrow strip just showing the icons. Click again to expand the pane, of course. Further ah, same thing happens with the left-hand pane: click the icon for the section that’s already showing, and that pane too shrinks down. Hiding both the left- and right-hand panes brings you almost back to the old-style minimal-frills notebook/document display, except it only takes a click to bring one of those extras back. The middle pane has its own tab system, to let you have multiple documents open at once. You can drag its internal tabs around to tile them vertically or horizontally. And you can just drag a document to here from the folder display on the left to open it. Click on the document tab header, and that item opens in a separate browser window/tab. If nothing is open here it defaults to showing a “Launcher” tab, with icons for creating notebooks, opening terminal sessions, and creating other document types. The “lab” mode is activated by having an extra “/lab” part in the URL; if you remove this, it reverts to the old-style view of a single folder or notebook. Another thing that has changed is the way notebooks are saved. Previously, there was a menu option to “save and checkpoint” (with no option to do a manual save without checkpointing). And I found that if you tried to close the view of a modified notebook, it would ask to confirm you wanted to close the tab/window, but regardless of which you selected, the notebook would still be saved back to the file. Now that confirm-close trick no longer does saving; you have to explicitly select Save from the File menu, or hit CTRL/S. Checkpointing might still happen automatically as part of autosaving; I can’t find a menu option for explicitly creating a checkpoint, only for restoring from one. So anyway, a lot of intriguing new stuff in there to discover. If you like experimenting with code (as I do), Jupyter can be a great way to do it.

1 0

Superfile: A Modern Terminal File Manager for Linux and macOS
by Peter Reutemann 20 Jun '24

20 Jun '24

'Superfile is a modern terminal file manager that recently caught my attention; it’s not only easy to use but is very user-friendly compared to its alternatives, such as Ranger, MC, or nnn. It allows you to create files and directories, view (process, metadata, clipboard), provide a navigation pane, create multiple panels to work in two separate directories, support plugins, offer a variety of themes, and much more. The project is new, so there have been active updates every week, allowing you to see new features quickly. I’ve also been using it for a few days, and honestly, one key factor in using DE in Linux for me was its easy-to-use file manager, but with Superfile, there’s no need for that now.' -- source: https://linuxtldr.com/installing-superfile/ I've used mc in the past, being familiar with norton commander, but I might give Superfile a go in the future. Cheers, Peter

1 0

systemd-tmpfiles, deleting /home
by Peter Reutemann 19 Jun '24

19 Jun '24

Saw this on my mastodon feed: 'TIL (thankfully second hand) that running "systemd-tmpfiles --purge" will delete /home in systemd 256 [1]. Apparently if you think linux is mainly for running cloud services, this seems reasonable to you. Or something. [1] tested with systemd-tmpfiles --dry-run --purge on debian. I guess it _could_ be a Debian addition, but I'm guessing not.' -- source: https://mathstodon.xyz/@bremner/112615591101488528 Anyone keen on giving it a go??? :-) Cheers, Peter

2 1

DietPi Released a New Version 9.5
by Peter Reutemann 19 Jun '24

19 Jun '24

Just saw these release notes come across my feed: https://dietpi.com/docs/releases/v9_5/ Since I'd never heard of DiePi before: 'DietPi is a highly optimised & minimal Debian-based Linux distribution. DietPi is extremely lightweight at its core, and also extremely easy to install and use. Setting up a single board computer (SBC) or even a computer, for both regular or server use, takes time and skill. DietPi provides an easy way to install and run favourite software you choose.' -- source: https://dietpi.com/docs/ And it supports a range of boards: https://dietpi.com/docs/hardware/ RPis, Odroid, Pine64, Radxa, Sparky, ASUS Tinker board, NanoPi, Orange Pi Cheers, Peter

1 0

KDE Plasma 6.1 Released
by Peter Reutemann 19 Jun '24

19 Jun '24

'"The KDE community announced the latest release of their popular desktop environment: Plasma 6.1," writes longtime Slashdot reader jrepin. From the announcement: While Plasma 6.0 was all about getting the migration to the underlying Qt 6 frameworks correct, Plasma 6.1 is where developers start implementing the features that will take you desktop to a new level. In this release, you will find features that go far beyond subtle changes to themes and tweaks to animations (although there is plenty of those too). Among some of the new features in this release you will find improved remote desktop support with a new built-in server, overhauled and streamlined desktop edit mode, restoration of open applications from the previous session on Wayland, synchronization of keyboard LED colors with the desktop accent color, making mouse cursor bigger and easier to find by shaking it, edge barriers (a sticky area for mouse cursor near the edges between screens), explicit sync support eliminates flickering and glitches for NVidia graphics card users on Wayland, and triple buffering support for smoother animations and screen rendering.' -- source: https://tech.slashdot.org/story/24/06/18/2050203 Cheers, Peter

1 0

High-severity vulnerabilities affect a wide range of Asus router models
by Peter Reutemann 18 Jun '24

18 Jun '24

'Hardware manufacturer Asus has released updates patching multiple critical vulnerabilities that allow hackers to remotely take control of a range of router models with no authentication or interaction required of end users. The most critical vulnerability, tracked as CVE-2024-3080 is an authentication bypass flaw that can allow remote attackers to log into a device without authentication. The vulnerability, according to the Taiwan Computer Emergency Response Team / Coordination Center (TWCERT/CC), carries a severity rating of 9.8 out of 10. [...] A second vulnerability tracked as CVE-2024-3079 affects the same router models. It stems from a buffer overflow flaw and allows remote hackers who have already obtained administrative access to an affected router to execute commands. TWCERT/CC is warning of a third vulnerability affecting various Asus router models. It’s tracked as CVE-2024-3912 and can allow remote hackers to execute commands with no user authentication required.' -- source: https://arstechnica.com/security/2024/06/high-severity-vulnerabilities-affe… The article lists affected routers and links to their respective bios/firmware pages. Cheers, Peter

1 0

The Ladybird browser project
by Peter Reutemann 17 Jun '24

17 Jun '24

Just stumbled across a browser project on my mastodon feed that I hadn't heard of before: Ladybird Browser -- source: https://tech.lgbt/@nina_kali_nina/111932702661268627 -- project page: https://ladybird.dev/ -- code: https://github.com/LadybirdBrowser/ladybird Anybody ever tried that? Cheers, Peter

1 0

Ransomware attackers quickly weaponize PHP vulnerability with 9.8 severity rating
by Peter Reutemann 17 Jun '24

17 Jun '24

'Ransomware criminals have quickly weaponized an easy-to-exploit vulnerability in the PHP programming language that executes malicious code on web servers, security researchers said. As of Thursday, Internet scans performed by security firm Censys had detected 1,000 servers infected by a ransomware strain known as TellYouThePass, down from 1,800 detected on Monday. The servers, primarily located in China, no longer display their usual content; instead, many list the site’s file directory, which shows all files have been given a .locked extension, indicating they have been encrypted. An accompanying ransom note demands roughly $6,500 in exchange for the decryption key. The vulnerability, tracked as CVE-2024-4577 and carrying a severity rating of 9.8 out of 10, stems from errors in the way PHP converts Unicode characters into ASCII. A feature built into Windows known as Best Fit allows attackers to use a technique known as argument injection to convert user-supplied input into characters that pass malicious commands to the main PHP application. Exploits allow attackers to bypass CVE-2012-1823, a critical code execution vulnerability patched in PHP in 2012. CVE-2024-4577 affects PHP only when it runs in a mode known as CGI, in which a web server parses HTTP requests and passes them to a PHP script for processing. Even when PHP isn’t set to CGI mode, however, the vulnerability may still be exploitable when PHP executables such as php.exe and php-cgi.exe are in directories that are accessible by the web server. This configuration is extremely rare, with the exception of the XAMPP platform, which uses it by default. An additional requirement appears to be that the Windows locale—used to personalize the OS to the local language of the user—must be set to either Chinese or Japanese.' -- source: https://arstechnica.com/security/2024/06/thousands-of-servers-infected-with… Cheers, Peter

2 1

Raspberry Pi is Now a Public Company
by Peter Reutemann 12 Jun '24

12 Jun '24

'Who would have thought that Raspberry Pi, the maker of the tiny, cheap, single-board computers, would become a public company? Yet, this is exactly what's happening: Raspberry Pi priced its IPO on the London Stock Exchange on Tuesday morning at $3.56 per share, valuing it at $689 million. Shortly after that, the company's shares jumped a nice 32% to $4.70. It means that Raspberry Pi could end up raising more than $200 million during its IPO process. Raspberry Pi has sold 60 million units since its inception. In 2023 alone, Raspberry Pi generated $266 million in revenue and $66 million in gross profit. Raspberry Pi Ltd, the public company, is the commercial subsidiary of the Raspberry Pi Foundation. The Foundation says it wants to make it easier for people to learn coding through a low-cost, programmable computer. It also remains the main shareholder of Raspberry Pi Ltd.' -- source: https://tech.slashdot.org/story/24/06/11/144251 Cheers, Peter

1 0

One-Line Patch For Intel Meteor Lake Yields Up To 72% Better Performance
by Peter Reutemann 11 Jun '24

11 Jun '24

'Michael Larabel reports via Phoronix: Covered last week on Phoronix was a new patch from Intel that with tuning to the P-State CPU frequency scaling driver was showing big wins for Intel Core Ultra "Meteor Lake" performance and power efficiency. I was curious with the Intel claims posted for a couple benchmarks and thus over the weekend set out to run many Intel Meteor Lake benchmarks on this one-line kernel patch... The results are great for boosting the Linux performance of Intel Core ultra laptops with as much as 72% better performance. [...] When looking at the CPU power consumption overall, for the wide variety of workloads tested it was just a slight uptick in power use and thus overall leading to slightly better power efficiency too. See all the data here. So this is quite a nice one-line Linux kernel patch for Meteor Lake and will hopefully be mainlined to the Linux kernel for Linux 6.11 if not squeezing it in as a "fix" for the current Linux 6.10 cycle. It's just too bad though that it took six months after launch for this tuned EPP value to be determined. Fresh benchmarks between Intel Core Ultra and AMD Ryzen on the latest Linux software will be coming up soon on Phoronix.' -- source: https://hardware.slashdot.org/story/24/06/10/2031256 Cheers, Peter

1 0

Nasty Linux Bug, CVE-2024-1086, is on the loose
by Peter Reutemann 05 Jun '24

05 Jun '24

'A few months back, CVE-2024-1086, a nasty use-after-free vulnerability in the Linux kernel's netfilter, was revealed. With a Common Vulnerability Scoring System (CVSS) score of 7.8, this bug, with the foundation for most Linux network firewall and Network Address Translation (NAT) programs, was a nasty little security hole. With it, Netfliter's table component could be exploited to achieve local privilege escalation. Worse still, you didn't need to be terribly clever to use it, so a local attacker could escalate privileges from a regular user to root in no time flat. Adding insult to injury, this vulnerability was present in pretty much all the major Linux distributions, including Debian, Fedora, Red Hat, and Ubuntu. In short, pretty much any Linux distribution using any kernel version between 5.14 and 6.6.14 could be hacked. Ouch! But, the fix has been in place since January 2024, when the flaw was patched. So, if we've been good little system administrators, we shouldn't have anything to worry about, right? Right!? Wrong. The US Cybersecurity and Infrastructure Security Agency (CISA) has flagged it and added it to the Known Exploited Vulnerabilities (KEV) catalog. It turns out that it's being actively exploited in the wild.' -- source: https://opensourcewatch.beehiiv.com/p/nasty-linux-bug-cve20241086-loose Cheers, Peter

1 0

The Raspberry Pi 5 Gets an AI Upgrade
by Peter Reutemann 05 Jun '24

05 Jun '24

'Today, Raspberry Pi introduced a new kit that adds AI functionality to the Raspberry Pi 5. ZDNet reports: The Raspberry Pi AI kit combines an M.2-format Hailo 8L AI accelerator with the Raspberry Pi M.2 HAT+ to create a powerful yet power-efficient solution. The Hailo-8L NPU (Neural Processing Unit) chip, capable of 13 trillion operations per second (TOPS), is built into an M.2 2242 form factor module that attaches to the M.2 HAT+. When connected to a Raspberry Pi 5 board running the latest Raspberry Pi OS, the NPU is automatically available for AI computing tasks. The AI module also has direct access to the Raspberry Pi's camera software stack and works with both first-party and third-party cameras. The NPU allows the Raspberry Pi 5 to perform AI tasks such as object and facial recognition, human pose analysis, and more. Using an NPU frees up the Raspberry Pi 5's CPU, allowing it to focus on other tasks, making your projects more efficient and powerful. The Raspberry Pi AI kit is also compatible with the Raspberry Pi Active Cooler, ensuring optimal performance without overheating. Additionally, you can purchase a clear protective layer to prevent damage to the board, giving you peace of mind while working on your projects. The AI kit is priced at $70. It's available from Raspberry Pi Approved Resellers, including PiHut, PiShop.us, and CanaKit. ' -- source: https://hardware.slashdot.org/story/24/06/04/2037238 Cheers, Peter

1 0

CentOS 7’s Final Countdown: 30 Days Left Until Support Ends
by Peter Reutemann 04 Jun '24

04 Jun '24

'In just 30 days, we’ll witness the end of an era for Linux with the cessation of support for CentOS 7—the last supported version of this once-dominant server operating system still receiving updates. Let’s take a quick look back at its journey. Ten years ago, on July 7, 2014, CentOS 7 was released as a fully compatible fork of Red Hat Enterprise Linux 7. Since its initial CentOS 2 version in 2004, the distribution has become extremely popular, establishing itself as the go-to server operating system over the last decade. After nine minor version updates, the latest being CentOS 7.9, in November 2020, Red Hat made a significant announcement. It marked the end of CentOS as a server operating system and transitioned it to CentOS Stream—a rolling release distro and upstream public development branch for Red Hat Enterprise Linux (RHEL). To complicate things further, CentOS 8, expected to receive updates until 2029, was prematurely retired at the end of December 2021. This leaves only CentOS 7 as the only version to complete its entire maintenance period, which ends in just 30 days on June 30, 2024. So, consider this as a final reminder if you’re still using CentOS 7 and haven’t yet migrated your system. Time is running out, and here are some alternative options to switch to a RHEL-compatible and supported replacement.' -- source: https://linuxiac.com/centos-7-has-30-days-left-until-support-ends/ Cheers, Peter

1 0

Fun With The du Command
by Lawrence D'Oliveiro 29 May '24

29 May '24

Looking at the space taken up by my copy of the Blender source code: ldo(a)theon:projects> du -ks blender 1444272 blender Most of that is in the commit history: ldo(a)theon:projects> du -ks blender/.git 1139640 blender/.git So how much isn’t? ldo(a)theon:projects> du -ks blender/.git blender 1139640 blender/.git 304632 blender Do you see what happened there? If you specify a directory, and then its containing directory on the same command, du will subtract the usage of the former from the latter. This gives you an easy way of determining the space taken up by a directory, not including particular subdirectories. This can be broken down even more: ldo(a)theon:projects> du -ks blender/.git blender/extern blender/intern blender/source blender 1139640 blender/.git 40536 blender/extern 15712 blender/intern 105188 blender/source 143196 blender Here, “extern” is various open-source libraries from other sources, that have been copied into the Blender source tree, while “intern” is code that originated from Blender itself, that has been organized into its own libraries. And as you can see, there is still a whole bunch left in other subdirectories. Does this work recursively? ldo(a)theon:projects> du -ks blender/.git blender/intern/cycles blender/intern blender 1139640 blender/.git 8880 blender/intern/cycles 6832 blender/intern 288920 blender Yes it does. Here we can see that the Cycles renderer makes up a bit over half the contents of “intern”.

1 0

datamash - basic numeric, textual and statistical operations
by Peter Reutemann 28 May '24

28 May '24

Hi everyone I quite often need to do some quick and dirty statistical calculations on the command-line and I typically use cat and sed to extract the data that I need from text files. In the past, I've then switched to LibreOffice Calc for some basic statistics like mean/stdev. Today, I finally spent a bit more time having a look around what else I can use directly on the command-line and came across the following that fits the bill perfectly: datamash - https://www.gnu.org/software/datamash/ With that tool, I can finally apply a single command-line to textual output for generating a quick mean/stdev: ... | datamash mean 1 sstdev 1 --header-out mean(field-1) sstdev(field-1) 577.62815533981 128.99238940453 Cheers, Peter

2 1

Memory Sealing 'mseal' System Call Merged For Linux 6.10
by Peter Reutemann 27 May '24

27 May '24

'"Merged this Friday evening into the Linux 6.10 kernel is the new mseal() system call for memory sealing," reports Phoronix: The mseal system call was led by Jeff Xu of Google's Chrome team. The goal with memory sealing is to also protect the memory mapping itself against modification. The new mseal Linux documentation explains: "Modern CPUs support memory permissions such as RW and NX bits. The memory permission feature improves security stance on memory corruption bugs, i.e. the attacker can't just write to arbitrary memory and point the code to it, the memory has to be marked with X bit, or else an exception will happen. Memory sealing additionally protects the mapping itself against modifications. This is useful to mitigate memory corruption issues where a corrupted pointer is passed to a memory management system... Memory sealing can automatically be applied by the runtime loader to seal .text and .rodata pages and applications can additionally seal security-critical data at runtime. A similar feature already exists in the XNU kernel with the VM_FLAGS_PERMANENT flag and on OpenBSD with the mimmutable syscall." The mseal system call is designed to be used by the likes of the GNU C Library "glibc" while loading ELF executables to seal non-writable memory segments or by the Google Chrome web browser and other browsers for protecting security sensitive data structures.' -- source: https://linux.slashdot.org/story/24/05/26/2117251 Cheers, Peter

1 0

Ubuntu 24.04 Now Runs on the Nintendo Switch (Unofficially)
by Peter Reutemann 27 May '24

27 May '24

'"The fact it's possible at all is a credit to the ingenuity of the open-source community," writes the blog OMG Ubuntu: Switchroot is an open-source project that allows Android and Linux-based distros like Ubuntu to run on the Nintendo Switch — absolutely not something Nintendo approves of much less supports, endorses, or encourages, etc! I covered the loophole that made this possible back in 2018. Back then the NVIDIA Tegra X1-powered Nintendo Switch was still new and Linux support for much of the console's internal hardware in a formative state (a polite way to say 'not everything worked'). But as the popularity of Nintendo's handheld console ballooned (to understate it) so the 'alternative OS' Switch scene grew, and before long Linux support for Switch hardware was in full bloom... A number of Linux for Switchroot (L4S) distributions have since been released, designated as Linux for Tegra (L4T) builds. As these can boot from a microSD card it's even possible to dualboot the Switch OS with Linux, which is neat! Recently, a fresh set of L4T Ubuntu images were released based on the newest Ubuntu 24.04 LTS release. These builds work on all Switch versions, from the OG (exploit-friendly) unit through to newer, patched models (where a modchip is required)... I'm told all of the Nintendo Switch internal hardware now works under Linux, including Wi-Fi, Bluetooth, sleep mode, accelerated graphics, the official dock... Everything, basically. And despite being a 7 year old ARM device the performance is said to remain decent. "Upstream snafus have delayed the release of builds with GNOME Shell..."' -- source: https://games.slashdot.org/story/24/05/26/035202 Cheers, Peter

1 0

Disabling Google Search (Mis)Features
by Lawrence D'Oliveiro 26 May '24

26 May '24

This article <https://arstechnica.com/gadgets/2024/05/google-searchs-udm14-trick-lets-you…> explains how you can add an option to a Google search URL to turn off the new AI functionality. Another option lets you specify that you want a verbatim search on what you typed, rather than a “fuzzy” search. It also describes how you can configure your browser for more convenient invocation of these options.

1 0

Sovereign Tech Fund Backs FFmpeg Project with a €157K Infusion
by Peter Reutemann 24 May '24

24 May '24

'Sovereign Tech Fund, a funding pot supported financially by the German Federal Ministry for Economic Affairs and Climate Action, has once again shown itself to be one of Open Source’s great friends and supporters. After providing €1 million in financial support to GNOME at the end of last year and investing more than €200K in the GStreamer project earlier this year, the company is continuing its support for multimedia projects by funding FFmpeg. In light of this, last week, FFmpeg announced its first governmental sponsorship, Germany’s Sovereign Tech Fund, which has stepped forward to support the maintenance and sustainability of FFmpeg, a cornerstone software in the multimedia industry, by investing €157K in the project.' -- source: https://linuxiac.com/sovereign-tech-fund-backs-ffmpeg-project/ Cheers, Peter

2 1

RISC-V Now Supports Rust In the Linux Kernel
by Peter Reutemann 24 May '24

24 May '24

'Michael Larabel reports via Phoronix: The latest RISC-V port updates have been merged for the in-development Linux 6.10 kernel. Most notable with today's RISC-V merge to Linux 6.10 is now supporting the Rust programming language within the Linux kernel. RISC-V joins the likes of x86_64, LoongArch, and ARM64 already supporting the use of the in-kernel Rust language support. The use of Rust within the mainline Linux kernel is still rather limited with just a few basic drivers so far and a lot of infrastructure work taking place, but there are a number of new drivers and other subsystem support on the horizon. RISC-V now supporting Rust within the Linux kernel will become more important moving forward. The RISC-V updates for Linux 6.10 also add byte/half-word compare-and-exchange, support for Zihintpause within hwprobe, a PR_RISCV_SET_ICACHE_FLUSH_CTX prctl(), and support for lockless lockrefs. More details on these RISC-V updates for Linux 6.10 via this Git merge. ' -- source: https://linux.slashdot.org/story/24/05/22/2337254 Cheers, Peter

1 0

A Root-Server at the Internet's Core Lost Touch With Its Peers. We Still Don't Know Why.
by Peter Reutemann 24 May '24

24 May '24

'A server maintained by Cogent Communications, one of the 13 root servers crucial to the Internet's domain name system, fell out of sync with its peers for over four days due to an unexplained glitch. This issue, which could have caused worldwide stability and security problems, was resolved on Wednesday. The root servers store cryptographic keys necessary for authenticating intermediate servers under the DNSSEC mechanism. Inconsistencies in these keys across the 13 servers could lead to an increased risk of attacks such as DNS cache poisoning. Engineers postponed planned updates to the .gov and .int domain name servers' DNSSEC to use ECDSA cryptographic keys until the situation stabilized. Cogent stated that it became aware of the issue on Tuesday and resolved it within 25 hours. ArsTechnica, which has a great writeup about the incident, adds: Initially, some people speculated that the depeering of Tata Communications, the c-root site outage, and the update errors to the c-root itself were all connected somehow. Given the vagueness of the statement, the relation of those events still isn't entirely clear.' -- source: https://it.slashdot.org/story/24/05/23/1745246 Cheers, Peter

1 0

Mozilla Says It's Concerned About Windows Recall
by Peter Reutemann 23 May '24

23 May '24

'Microsoft's Windows Recall feature is attracting controversy before even venturing out of preview. From a report: The principle is simple. Windows takes a snapshot of a user's active screen every few seconds and dumps it to disk. The user can then scroll through the snapshots and, when something is selected, the user is given options to interact with the content. Mozilla's Chief Product Officer, Steve Teixeira, told The Register: "Mozilla is concerned about Windows Recall. From a browser perspective, some data should be saved, and some shouldn't. Recall stores not just browser history, but also data that users type into the browser with only very coarse control over what gets stored. While the data is stored in encrypted format, this stored data represents a new vector of attack for cybercriminals and a new privacy worry for shared computers. "Microsoft is also once again playing gatekeeper and picking which browsers get to win and lose on Windows -- favoring, of course, Microsoft Edge. Microsoft's Edge allows users to block specific websites and private browsing activity from being seen by Recall. Other Chromium-based browsers can filter out private browsing activity but lose the ability to block sensitive websites (such as financial sites) from Recall. "Right now, there's no documentation on how a non-Chromium based, third-party browser, such as Firefox, can protect user privacy from Recall. Microsoft did not engage our cooperation on Recall, but we would have loved for that to be the case, which would have enabled us to partner on giving users true agency over their privacy, regardless of the browser they choose."' -- source: https://tech.slashdot.org/story/24/05/22/1939244 Cheers, Peter

1 0

Linux 6.10 Honors One Last Request By Hans Reiser
by Peter Reutemann 22 May '24

22 May '24

'Phoronix: ReiserFS lead developer and convicted murderer Hans Reiser a few months back wrote letters to be made public apologizing for his social mistakes and other commentary. In his written communications he also made a last request for ReiserFS in the Linux kernel: "Assuming that the decision is to remove [ReiserFS] V3 from the kernel, I have just one request: that for one last release the README be edited to add Mikhail Gilula, Konstantin Shvachko, and Anatoly Pinchuk to the credits, and to delete anything in there I might have said about why they were not credited. It is time to let go." Hans credits his improved social and communication skills learned in prison among other details shared in the public letters. Per the indirect request by Hans Reiser, SUSE's Jan Kara has now altered the ReiserFS README file with the changes going in today to the Linux 6.10 kernel. The negative language was removed and instead acknowledging their contributions.' -- source: https://linux.slashdot.org/story/24/05/21/217228 Cheers, Peter

1 0

New Windows AI feature records everything you’ve done on your PC
by Peter Reutemann 22 May '24

22 May '24

'At a Build conference event on Monday, Microsoft revealed a new AI-powered feature called "Recall" for Copilot+ PCs that will allow Windows 11 users to search and retrieve their past activities on their PC. To make it work, Recall records everything users do on their PC, including activities in apps, communications in live meetings, and websites visited for research. Despite encryption and local storage, the new feature raises privacy concerns for certain Windows users. "Recall uses Copilot+ PC advanced processing capabilities to take images of your active screen every few seconds," Microsoft says on its website. "The snapshots are encrypted and saved on your PC’s hard drive. You can use Recall to locate the content you have viewed on your PC using search or on a timeline bar that allows you to scroll through your snapshots." By performing a Recall action, users can access a snapshot from a specific time period, providing context for the event or moment they are searching for. It also allows users to search through teleconference meetings they've participated in and videos watched using an AI-powered feature that transcribes and translates speech. At first glance, the Recall feature seems like it may set the stage for potential gross violations of user privacy. Despite reassurances from Microsoft, that impression persists for second and third glances as well. For example, someone with access to your Windows account could potentially use Recall to see everything you've been doing recently on your PC, which might extend beyond the embarrassing implications of pornography viewing and actually threaten the lives of journalists or perceived enemies of the state. Despite the privacy concerns, Microsoft says that the Recall index remains local and private on-device, encrypted in a way that is linked to a particular user's account. "Recall screenshots are only linked to a specific user profile and Recall does not share them with other users, make them available for Microsoft to view, or use them for targeting advertisements. Screenshots are only available to the person whose profile was used to sign in to the device," Microsoft says. Users can pause, stop, or delete captured content and can exclude specific apps or websites. Recall won't take snapshots of InPrivate web browsing sessions in Microsoft Edge or DRM-protected content. However, Recall won't actively hide sensitive information like passwords and financial account numbers that appear on-screen.' -- source: https://arstechnica.com/gadgets/2024/05/microsofts-new-recall-feature-will-… Talking about intrusive OS... I wonder whether there will be an ad-supported, cheap version of Windows in the future where the user can't turn Recall off, giving Microsoft a large pool of free training data... Cheers, Peter

2 1

Ubuntu 24.10 to Default to Wayland for NVIDIA Users
by Peter Reutemann 20 May '24

20 May '24

'OMG Ubuntu: Ubuntu first switched to using Wayland as its default display server in 2017 before reverting the following year. It tried again in 2021 and has stuck with it since. But while Wayland is what most of us now log into after installing Ubuntu, anyone doing so on a PC or laptop with an NVIDIA graphics card present instead logs into an Xorg/X11 session. This is because NVIDIA's proprietary graphics drivers (which many, especially gamers, opt for to get the best performance, access to full hardware capabilities, etc) have not supported Wayland as well as as they could've. Past tense as, thankfully, things have changed in the past few years. NVIDIA's warmed up to Wayland (partly as it has no choice given that Wayland is now standard and a 'maybe one day' solution, and partly because it wants to: opportunities/benefits/security). With the NVIDIA + Wayland sitch' now in a better state than before — but not perfect — Canonical's engineers say they feel confident enough in the experience to make the Ubuntu Wayland session default for NVIDIA graphics card users in Ubuntu 24.10.' -- source: https://news.slashdot.org/story/24/05/20/013218 Cheers, Peter

1 0

Linux Foundation Announces Launch of 'High Performance Software Foundation'
by Peter Reutemann 20 May '24

20 May '24

'This week the nonprofit Linux Foundation announced the launch of the High Performance Software Foundation, which "aims to build, promote, and advance a portable core software stack for high performance computing" (or HPC) by "increasing adoption, lowering barriers to contribution, and supporting development efforts." It promises initiatives focused on "continuously built, turnkey software stacks," as well as other initiatives including architecture support and performance regression testing. Its first open source technical projects are: - Spack: the HPC package manager. - Kokkos: a performance-portable programming model for writing modern C++ applications in a hardware-agnostic way. - Viskores (formerly VTK-m): a toolkit of scientific visualization algorithms for accelerator architectures. - HPCToolkit: performance measurement and analysis tools for computers ranging from desktop systems to GPU-accelerated supercomputers. - Apptainer: Formerly known as Singularity, Apptainer is a Linux Foundation project providing a high performance, full featured HPC and computing optimized container subsystem. - E4S: a curated, hardened distribution of scientific software packages. As use of HPC becomes ubiquitous in scientific computing and digital engineering, and AI use cases multiply, more and more data centers deploy GPUs and other compute accelerators. The High Performance Software Foundation will provide a neutral space for pivotal projects in the high performance computing ecosystem, enabling industry, academia, and government entities to collaborate on the scientific software. The High Performance Software Foundation benefits from strong support across the HPC landscape, including Premier Members Amazon Web Services (AWS), Hewlett Packard Enterprise, Lawrence Livermore National Laboratory, and Sandia National Laboratories; General Members AMD, Argonne National Laboratory, Intel, Kitware, Los Alamos National Laboratory, NVIDIA, and Oak Ridge National Laboratory; and Associate Members University of Maryland, University of Oregon, and Centre for Development of Advanced Computing. In a statement, an AMD vice president said that by joining "we are using our collective hardware and software expertise to help develop a portable, open-source software stack for high-performance computing across industry, academia, and government." And an AWS executive said the high-performance computing community "has a long history of innovation being driven by open source projects. AWS is thrilled to join the High Performance Software Foundation to build on this work. In particular, AWS has been deeply involved in contributing upstream to Spack, and we're looking forward to working with the HPSF to sustain and accelerate the growth of key HPC projects so everyone can benefit." The new foundation will "set up a technical advisory committee to manage working groups tackling a variety of HPC topics," according to the announcement, following a governance model based on the Cloud Native Computing Foundation.' -- source: https://tech.slashdot.org/story/24/05/19/2234254 Cheers, Peter

1 0

Why a 'Frozen' Distribution Linux Kernel Isn't the Safest Choice for Security
by Peter Reutemann 20 May '24

20 May '24

'Jeremy Allison — Sam (Slashdot reader #8,157) is a Distinguished Engineer at Rocky Linux creator CIQ. This week he published a blog post responding to promises of Linux distros "carefully selecting only the most polished and pristine open source patches from the raw upstream open source Linux kernel in order to create the secure distribution kernel you depend on in your business." But do carefully curated software patches (applied to a known "frozen" Linux kernel) really bring greater security? "After a lot of hard work and data analysis by my CIQ kernel engineering colleagues Ronnie Sahlberg and Jonathan Maple, we finally have an answer to this question. It's no." The data shows that "frozen" vendor Linux kernels, created by branching off a release point and then using a team of engineers to select specific patches to back-port to that branch, are buggier than the upstream "stable" Linux kernel created by Greg Kroah-Hartman. How can this be? If you want the full details the link to the white paper is here. But the results of the analysis couldn't be clearer. - A "frozen" vendor kernel is an insecure kernel. A vendor kernel released later in the release schedule is doubly so. - The number of known bugs in a "frozen" vendor kernel grows over time. The growth in the number of bugs even accelerates over time. - There are too many open bugs in these kernels for it to be feasible to analyze or even classify them.... [T]hinking that you're making a more secure choice by using a "frozen" vendor kernel isn't a luxury we can still afford to believe. As Greg Kroah-Hartman explicitly said in his talk "Demystifying the Linux Kernel Security Process": "If you are not using the latest stable / longterm kernel, your system is insecure." CIQ describes its report as "a count of all the known bugs from an upstream kernel that were introduced, but never fixed in RHEL 8." For the most recent RHEL 8 kernels, at the time of writing, these counts are: RHEL 8.6 : 5034 RHEL 8.7 : 4767 RHEL 8.8 : 4594 In RHEL 8.8 we have a total of 4594 known bugs with fixes that exist upstream, but for which known fixes have not been back-ported to RHEL 8.8. The situation is worse for RHEL 8.6 and RHEL 8.7 as they cut off back-porting earlier than RHEL 8.8 but of course that did not prevent new bugs from being discovered and fixed upstream.... This whitepaper is not meant as a criticism of the engineers working at any Linux vendors who are dedicated to producing high quality work in their products on behalf of their customers. This problem is extremely difficult to solve. We know this is an open secret amongst many in the industry and would like to put concrete numbers describing the problem to encourage discussion. Our hope is for Linux vendors and the community as a whole to rally behind the kernel.org stable kernels as the best long term supported solution. As engineers, we would prefer this to allow us to spend more time fixing customer specific bugs and submitting feature improvements upstream, rather than the endless grind of backporting upstream changes into vendor kernels, a practice which can introduce more bugs than it fixes. ZDNet calls it "an open secret in the Linux community." It's not enough to use a long-term support release. You must use the most up-to-date release to be as secure as possible. Unfortunately, almost no one does that. Nevertheless, as Google Linux kernel engineer Kees Cook explained, "So what is a vendor to do? The answer is simple: if painful: Continuously update to the latest kernel release, either major or stable." Why? As Kroah-Hartman explained, "Any bug has the potential of being a security issue at the kernel level...." Although [CIQ's] programmers examined RHEL 8.8 specifically, this is a general problem. They would have found the same results if they had examined SUSE, Ubuntu, or Debian Linux. Rolling-release Linux distros such as Arch, Gentoo, and OpenSUSE Tumbleweed constantly release the latest updates, but they're not used in businesses.' -- source: https://linux.slashdot.org/story/24/05/19/0030248 Cheers, Peter

1 0

Google patches its fifth zero-day vulnerability of the year in Chrome
by Peter Reutemann 13 May '24

13 May '24

'Google has updated its Chrome browser to patch a high-severity zero-day vulnerability that allows attackers to execute malicious code on end user devices. The fix marks the fifth time this year the company has updated the browser to protect users from an existing malicious exploit. The vulnerability, tracked as CVE-2024-4671, is a “use after free,” a class of bug that occurs in C-based programming languages. In these languages, developers must allocate memory space needed to run certain applications or operations. They do this by using “pointers” that store the memory addresses where the required data will reside. Because this space is finite, memory locations should be deallocated once the application or operation no longer needs it. Use-after-free bugs occur when the app or process fails to clear the pointer after freeing the memory location. In some cases, the pointer to the freed memory is used again and points to a new memory location storing malicious shellcode planted by an attacker’s exploit, a condition that will result in the execution of this code. On Thursday, Google said an anonymous source notified it of the vulnerability. The vulnerability carries a severity rating of 8.8 out of 10. In response, Google said, it would be releasing versions 124.0.6367.201/.202 for macOS and Windows and 124.0.6367.201 for Linux in subsequent days. “Google is aware that an exploit for CVE-2024-4671 exists in the wild,” the company said.' -- source: https://arstechnica.com/security/2024/05/google-patches-its-fifth-zero-day-… Cheers, Peter

1 0

AMD Core Performance Boost For Linux Getting Per-CPU Core Controls
by Peter Reutemann 13 May '24

13 May '24

'Phoronix: For the past several months AMD Linux engineers have been working on AMD Core Performance Boost support for their P-State CPU frequency scaling driver. The ninth iteration of these patches were posted on Monday and besides the global enabling/disabling support for Core Performance Boost, it's now possible to selectively toggle the feature on a per-CPU core basis... The new interface is under /sys/devices/system/cpu/cpuX/cpufreq/amd_pstate_boost_cpb for each CPU core. Thus users can tune whether particular CPU cores are boosted above the base frequency.' -- source: https://linux.slashdot.org/story/24/05/11/229219 Cheers, Peter

1 0

Linux Kernel 6.9 Officially Released
by Peter Reutemann 13 May '24

13 May '24

'"6.9 is now out," Linus Torvalds posted on the Linux kernel mailing list, "and last week has looked quite stable (and the whole release has felt pretty normal)." Phoronix writes that Linux 6.9 "has a number of exciting features and improvements for those habitually updating to the newest version." And Slashdot reader prisoninmate shared this report from 9to5Linux: Highlights of Linux kernel 6.9 include Rust support on AArch64 (ARM64) architectures, support for the Intel FRED (Flexible Return and Event Delivery) mechanism for improved low-level event delivery, support for AMD SNP (Secure Nested Paging) guests, and a new dm-vdo (virtual data optimizer) target in device mapper for inline deduplication, compression, zero-block elimination, and thin provisioning. Linux kernel 6.9 also supports the Named Address Spaces feature in GCC (GNU Compiler Collection) that allows the compiler to better optimize per-CPU data access, adds initial support for FUSE passthrough to allow the kernel to serve files from a user-space FUSE server directly, adds support for the Energy Model to be updated dynamically at run time, and introduces a new LPA2 mode for ARM 64-bit processors... Linux kernel 6.9 will be a short-lived branch supported for only a couple of months. It will be succeeded by Linux kernel 6.10, whose merge window has now been officially opened by Linus Torvalds. Linux kernel 6.10 is expected to be released in mid or late September 2024. "Rust language has been updated to version 1.76.0 in Linux 6.9," according to the article. And Linus Torvalds shared one more details on the Linux kernel mailing list. "I now have a more powerful arm64 machine (thanks to Ampere), so the last week I've been doing almost as many arm64 builds as I have x86-64, and that should obviously continue during the upcoming merge window too."' -- source: https://linux.slashdot.org/story/24/05/12/2212235 Cheers, Peter

1 0

Fedora Asahi Remix 40 is another big step forward for Linux on Apple Silicon Mac
by Peter Reutemann 10 May '24

10 May '24

'Asahi Linux, the project that aims to bring desktop Linux to Apple hardware with Apple silicon—the M series of chips—is out with Fedora Asahi Remix 40. More hardware features of Apple devices are supported, the Fedora Linux 40-based distro ships with KDE's new Plasma 6 desktop, and untold numbers of bugs are squashed, to be replaced with reams more. Fedora Asahi Remix is a "fully integrated distro," according to the Asahi team, and you can "expect a solid and high-quality experience without any unwanted surprises." It supports all the M1 and M2 devices in the MacBook, Mac Mini, Mac Studio, and iMac lines. It's OpenGL 4.6 and OpenGL ES 3.2 certified, and comes with "the best Linux laptop audio you've ever heard." So, should you install it on your Mac? Keep scrolling down Asahi's release page and check the "Device support" section. Still missing from most M-series Apple devices are support for Thunderbolt and USB4, built-in microphones, and Touch ID, as well as USB-C display support. Speakers are not supported on the iMac. And HDMI audio is in rough shape, being able to "break audio on the system completely." Still, for someone using an Apple laptop primarily as a portable device, or simply connecting to a monitor with less modern all-in-one cables, there is a desktop awaiting. Installing it is a single cURL command.' -- source: https://arstechnica.com/gadgets/2024/05/fedora-asahi-remix-40-is-another-bi… Cheers, Peter

1 0

Raspberry Pis get a built-in remote access tool: Raspberry Pi Connect
by Peter Reutemann 08 May '24

08 May '24

'One Raspberry Pi often leads to another. Soon enough, you're running out of spots in your free RealVNC account for your tiny boards and "real" computers. Even if you go the hardened route of SSH or an X connection, you have to keep track of where they all are. All of this is not the easiest thing to tackle if you're new to single-board computers or just eager to get started. Enter Raspberry Pi Connect, a new built-in way to access a Rasbperry Pi from nearly anywhere you can open a browser, whether to control yourself or provide remote assistance. On a Raspberry Pi 4, 5, or Pi 400 kit, you install Pi connect with a single terminal line, reboot the Pi, and then click a new tray icon to connect the Pi to a Raspberry Pi ID (and then enable two-factor authentication, of course). >From then on, visiting connect.raspberrypi.com gives you an encrypted connection to your desktop. It's a direct connection if possible, and if not, it runs through relay servers in London, encrypting it with DTLS and keeping only the metadata needed for the service to work. The Pi will show a notification in its tray that somebody has connected, and you can manage screen sharing from there. The Pi's docs site has a lot more on the particulars. Connect works only on 64-bit systems running the Bookworm version of Pi OS with a Wayland window server. Connect was created partly due to Pi's transition to Wayland from X, which offered its own remote desktop option. According to the Pi firm, the service runs on a peer-to-peer WebRTC connection, similar to that of Zoom, Slack, Teams, and other video-sharing services. The whole service is in beta at the moment, and the company says it's not quite sure how much traffic to expect through its relay servers.' -- source: https://arstechnica.com/gadgets/2024/05/raspberry-pis-get-a-built-in-remote… Cheers, Peter

1 0

Novel attack against virtually all VPN apps neuters their entire purpose
by Peter Reutemann 07 May '24

07 May '24

'Researchers have devised an attack against nearly all virtual private network applications that forces them to send and receive some or all traffic outside of the encrypted tunnel designed to protect it from snooping or tampering. TunnelVision, as the researchers have named their attack, largely negates the entire purpose and selling point of VPNs, which is to encapsulate incoming and outgoing Internet traffic in an encrypted tunnel and to cloak the user’s IP address. The researchers believe it affects all VPN applications when they’re connected to a hostile network and that there are no ways to prevent such attacks except when the user's VPN runs on Linux or Android. They also said their attack technique may have been possible since 2002 and may already have been discovered and used in the wild since then. The effect of TunnelVision is “the victim's traffic is now decloaked and being routed through the attacker directly,” a video demonstration explained. “The attacker can read, drop or modify the leaked traffic and the victim maintains their connection to both the VPN and the Internet.” The attack works by manipulating the DHCP server that allocates IP addresses to devices trying to connect to the local network. A setting known as option 121 allows the DHCP server to override default routing rules that send VPN traffic through a local IP address that initiates the encrypted tunnel. By using option 121 to route VPN traffic through the DHCP server, the attack diverts the data to the DHCP server itself.' -- source: https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all… Cheers, Peter

1 0

Kernel Modules Are Now Compressed
by Lawrence D'Oliveiro 06 May '24

06 May '24

Not sure if this is mentioned in any release notes anywhere, but the .ko files (loadable kernel modules) that would live in /lib/modules/«kernel version»/ are now .ko.xz files. Looks like this happened starting with the 6.6 kernel. I discovered this a few minutes ago, while trying to count how many .ko files came with my 6.7.9 Debian kernel, with find /lib/modules/$(uname -r) -name \*.ko | wc -l and was surprised to see that the answer was 0. A suitably adjusted command find /lib/modules/$(uname -r) -name \*.ko\* | wc -l returns 4165

1 0

Yet Another New systemd Feature
by Lawrence D'Oliveiro 06 May '24

06 May '24

Lennart Poettering wants to get rid of sudo now, and replace it with a new systemd feature called “run0” <https://itwire.com/business-it-news/open-source/poettering-announces-tool-i…>. It is hard to write code that runs setuid, and sudo has had quite a few security vulnerabilities over the years. So Poettering’s idea is to replace the setuid executable with another use of the existing PolicyKit system. Interesting that Poettering thinks we should get rid of the whole idea of setuid altogether. AT&T actually got a patent on the concept, back in the early days of Unix. Other OSes had the concept of privileged code, but what made setuid different is that any user can set this mode on any executable they create, and when other users run this executable (if they are allowed to), they temporarily get the permissions of the owning user. On Linux, this concept was always constrained a bit: I think it only works on compiled machine-code executables, not on interpreted scripts.

1 0

Maximum-Severity GitLab Flaw Allowing Account Hijacking Under Active Exploitation
by Peter Reutemann 03 May '24

03 May '24

'Dan Goodin reports via Ars Technica: A maximum severity vulnerability that allows hackers to hijack GitLab accounts with no user interaction required is now under active exploitation, federal government officials warned as data showed that thousands of users had yet to install a patch released in January. A change GitLab implemented in May 2023 made it possible for users to initiate password changes through links sent to secondary email addresses. The move was designed to permit resets when users didn't have access to the email address used to establish the account. In January, GitLab disclosed that the feature allowed attackers to send reset emails to accounts they controlled and from there click on the embedded link and take over the account. While exploits required no user interaction, hijackings worked only against accounts that weren't configured to use multi-factor authentication. Even with MFA, accounts remained vulnerable to password resets. The vulnerability, tracked as CVE-2023-7028, carries a severity rating of 10 out of a possible 10. The vulnerability, classified as an improper access control flaw, could pose a grave threat. GitLab software typically has access to multiple development environments belonging to users. With the ability to access them and surreptitiously introduce changes, attackers could sabotage projects or plant backdoors that could infect anyone using software built in the compromised environment. An example of a similar supply chain attack is the one that hit SolarWinds in 2021, infecting more than 18,000 of its customers. Other recent examples of supply chain attacks are here, here, and here. These sorts of attacks are powerful. By hacking a single, carefully selected target, attackers gain the means to infect thousands of downstream users, often without requiring them to take any action at all. According to Internet scans performed by security organization Shadowserver, more than 2,100 IP addresses showed they were hosting one or more vulnerable GitLab instances. In order to protect your system, you should enable MFA and install the latest patch. "GitLab users should also remember that patching does nothing to secure systems that have already been breached through exploits," notes Goodin.' -- source: https://it.slashdot.org/story/24/05/02/1934220 Cheers, Peter -- My Open Source Blog - http://open.fracpete.org

2 1

Bat is a Modern Drop-in Replacement for Cat Command on Linux
by Peter Reutemann 01 May '24

01 May '24

'The bat is a modern command-line program written in the Rust programming language, and I can confidently say it’s a great drop-in replacement for our beloved cat command. If you’re wondering why I’m hyping this so much and what it has to offer you that makes it worth replacing the cat with, then do check out its features below. Bat really has some cool features to offer, which are mentioned below. - Supports syntax highlighting for a large number of programming and markup languages. - Detect and display Git changes. - Pipe output to its own pager (e.g., “less“) if the output is too large for one screen. - Display non-printable characters such as spaces, tabs, line breaks, etc. - Offer multiple themes that can be easily configured using flags or environments. - A user-friendly command-line interface that, of course, inherits all the functionality of the “cat” command.' -- source: https://linuxtldr.com/installing-bat/ Cheers, Peter

2 1

I Have No Luck With Keyboards ...
by Lawrence D'Oliveiro 01 May '24

01 May '24

Yesterday I decided that my heavily-used clicky mechanical keyboard (a Das Keyboard 4) had accumulated far too much grime, and it was time to take the risk of cleaning it. In the past, every time I’ve tried cleaning a keyboard, it has never worked right afterwards. I’m a software guy, not a hardware guy. I found the keys quite easy to pry off. A light amount of leverage with a small screwdriver was helpful when space was tight, but once I’d cleared sufficient room around a key, I could pull it off just with my fingers. Even the wider keys were not hard. I found some warnings online against removing these, because of the trickiness of their extra stabilization mechanisms. But these were actually quite simple: a steel spring with its ends poked through two tiny brackets (removable, but best left in place) at each end of the key. It took a bit of pressure with the screwdriver to bend one end of the spring far enough to take it out of the hole, but it snapped immediately back to its original shape after I had taken the key out, so I saw no problem putting things back afterwards. The space bar was even simpler: just two additional support posts at the ends, in addition to the usual post (common to all the keys) that held the actual switch in the middle. After I had got all the keys off, the grime on the keyboard itself was a wonder to behold (I’ll spare you the details). I tried to use a bunched-up corner of a wet cloth, and even a vacuum cleaner with the smallest nozzle (again heeding warnings online against compressed air), and I was able to remove maybe half the accumulation of deposits, not much more. I figured that was good enough. Of course, in the process, I likely got some water into two slots that were exposed after I removed the keys. There was a recommendation online to leave things to dry for at least 6 hours. Call me impatient; I left it for just 5. Afterwards, I plugged it in, without the key caps, and tried a few keys, and was gratified to find they still worked. After that, I put back all the keys, now nice and clean and dry. Even the ones with those extra springs went back with only a slight amount of fiddling to re-engage with those brackets on the keys. And afterwards, the keyboard still worked. I left it plugged in, and went to do something else. Half an hour later, I came back to my computer ... and the keyboard was dead. Not a single response from any key. Put it back in the heater cupboard and left it overnight. No change this morning: still dead. So I feel very sad. I thought I had broken my keyboard jinx. But it’s currently zero for three. I have some other keyboards, of course, including a colourful oddity I bought from Dick Smith (whose layout leaves out the right-hand super/windows key), and a Kensington “washable” (dare I risk it?), with the pipe/backslash key in a different position. But I had grown accustomed to the volume control knob and other niceties of the Das Keyboard. Looking back through my records, I was surprised to discover I had bought it about ten years ago, from Mighty Ape. So I suppose it’s had a good run. But it seems nobody in NZ sells the things any more. So currently I mourn, and I also look for alternatives ...

3 3

T2 Linux 24.5 Released
by Peter Reutemann 30 Apr '24

30 Apr '24

'A major T2 Linux milestone has been released, shipping with full support for 25 CPU architectures and several C libraries, as well as restored support for Intel IA-64 Itanium. Additionally, many vintage X.org DDX drivers were fixed and tested to work again, as well as complete support for the latest KDE 6 and GNOME 46. T2 is known for its sophisticated cross compile support and support for nearly all existing CPU architectures: Alpha, Arc, ARM(64), Avr32, HPPA(64), IA64, M68k, MIPS(64), Nios2, PowerPC(64)(le), RISCV(64), s390x, SPARC(64), and SuperH x86(64). T2 is an increasingly popular choice for embedded systems and virtualization. It also still supports the Sony PS3, Sgi, Sun and HP workstations, as well as the latest ARM64 and RISCV64 architectures. The release contains a total of 5,140 changesets, including approximately 5,314 package updates, 564 issues fixed, 317 packages or features added and 163 removed, and around 53 improvements. Usually most packages are up-to-date, including Linux 6.8, GCC 13, LLVM/Clang 18, as well as the latest version of X.org, Mesa, Firefox, Rust, KDE 6 and GNOME 46! More information, source and binary distribution are open source and free at T2 SDE.' -- source: https://news.slashdot.org/story/24/04/29/2325210/ To be honest, haven't heard of that distro before, but sounds interesting. Cheers, Peter

2 3

Hackers try to exploit WordPress plugin vulnerability that’s as severe as it gets
by Peter Reutemann 29 Apr '24

29 Apr '24

'Hackers are assailing websites using a prominent WordPress plugin with millions of attempts to exploit a high-severity vulnerability that allows complete takeover, researchers said. The vulnerability resides in WordPress Automatic, a plugin with more than 38,000 paying customers. Websites running the WordPress content management system use it to incorporate content from other sites. Researchers from security firm Patchstack disclosed last month that WP Automatic versions 3.92.0 and below had a vulnerability with a severity rating of 9.9 out of a possible 10. The plugin developer, ValvePress, silently published a patch, which is available in versions 3.92.1 and beyond. Researchers have classified the flaw, tracked as CVE-2024-27956, as a SQL injection, a class of vulnerability that stems from a failure by a web application to query backend databases properly. SQL syntax uses apostrophes to indicate the beginning and end of a data string. By entering strings with specially positioned apostrophes into vulnerable website fields, attackers can execute code that performs various sensitive actions, including returning confidential data, giving administrative system privileges, or subverting how the web app works.' -- source: https://arstechnica.com/security/2024/04/hackers-make-millions-of-attempts-… Cheers, Peter

2 1

Alternative To Microsoft Access
by Lawrence D'Oliveiro 27 Apr '24

27 Apr '24

If anybody asks about an alternative to Microsoft Access, I think SQLite used in combination with LibreOffice will give you a lot of functionality, including comprehensive SQL support and scalability to much larger databases. Of course you can use other backends, like MariaDB/MySQL, as well. SQLite just makes it easy to have an actual database file that you can copy/move about the place, without having to do database dumps/restores. If you don’t need multiuser support, it is very convenient. I notice that libreoffice-base is now a separate package under Debian (and I suppose its derivatives as well), no longer included in the “base” (heh) LibreOffice package. Make sure to install this, along with libsqliteodbc. Now, say you have an existing SQLite3 database that you want to access from LibreOffice. Suppose it is in the file /home/ldo/hack/lo_try/test.db. In order for databases to be accessible via ODBC, they need to have entries in your ~/.odbc.ini file. This is just a text file, in the good old .ini tradition. The format for entries is very simple, e.g.: [test-db] Description=Test database for LibreOffice Base Driver=SQLite3 Database=/home/ldo/hack/lo_try/test.db Now, when you launch the LibreOffice Base database wizard, you have options to “create a new database”, “open an existing database file”, or “connect to an existing database”. Choose that last one “connect to an existing database”. The popup menu shows the available back-end drivers: choose “ODBC”. Now, when you click “Next”, there should be a text field with a “Browse...” button; clicking this should show the names of entries in your ~/.odbc.ini file, e.g. “test-db” if you used the name in my example above. Select this, and click “Finish”. Next you will be prompted for a name to save the “database file”. This is just the LibreOffice Base document that contains the settings for connecting to the actual database: LibreOffice doesn’t know or care where the database back-end keeps the actual data. After having named the LibreOffice database file, you should see the main LibreOffice Base window. In the lower half, under “Tables”, you should see a list of the tables from the database file. You can double-click a table name to see a quick list of all its records. That’s as far as I’ve got. I see a “Design View”, “Form Wizards”, and “Report Wizards”, and all kinds of other fun stuff. Should be great for building simple database applications, with a minimum of programming.

1 0

Ubuntu 24.04 LTS 'Noble Numbat' Officially Released
by Peter Reutemann 26 Apr '24

26 Apr '24

'9to5Linux: Canonical released today Ubuntu 24.04 LTS (Noble Numbat) as the latest version of its popular Linux-based operating system featuring some of the latest GNU/Linux technologies and Open Source software. Powered by Linux kernel 6.8, Ubuntu 24.04 LTS features the latest GNOME 46 desktop environment, an all-new graphical firmware update tool called Firmware Updater, Netplan 1.0 for state-of-the-art network management, updated Ubuntu font, support for the deb822 format for software sources, increased vm.max_map_count for better gaming, and Mozilla Thunderbird as a Snap by default. It also comes with an updated Flutter-based graphical desktop installer that's now capable of updating itself and features a bunch of changes like support for accessibility features, guided (unencrypted) ZFS installations, a new option to import auto-install configurations for templated custom provisioning, as well as new default installation options, such as Default selection (previously Minimal) and Extended selection (previously Normal)."' -- source: https://news.slashdot.org/story/24/04/25/2036234 Cheers, Peter

1 0

Fedora Linux 40 Officially Released
by Peter Reutemann 24 Apr '24

24 Apr '24

'Fedora Linux 40 distribution has been officially released -- powered by the latest Linux 6.8 kernel series, and featuring the GNOME 46 and KDE Plasma 6 desktop environments, reports 9to5Linux: "Powered by the latest and greatest Linux 6.8 kernel series, the Fedora Linux 40 release ships with the GNOME 46 desktop environment for the flagship Fedora Workstation edition and the KDE Plasma 6 desktop environment for the Fedora KDE Spin, which defaults to the Wayland session as the X11 session was completely removed." "Fedora Linux 40 also includes some interesting package management changes, such as dropping Delta RPMs and disabling support in the default configuration of DNF / DNF5. It also changes the DNF behavior to no longer download filelists by default. However, this release doesn't ship with the long-awaited DNF5 package manager. For AMD GPUs, Fedora Linux 40 ships with AMD ROCm 6.0 as the latest release of AMD's software optimized for AI and HPC workload performance, which enables support for the newest flagship AMD Instinct MI300A and MI300X datacenter GPUs."' -- source: https://linux.slashdot.org/story/24/04/23/1452255 Cheers, Peter

1 0

Ex WH Cyber Policy Director: Microsoft Is A Threat To US National Security
by Lawrence D'Oliveiro 23 Apr '24

23 Apr '24

Microsoft has become so dominant a supplier to the US Government that it cannot be effectively called to account on its repeated security lapses <https://www.theregister.com/2024/04/21/microsoft_national_security_risk/>. Even something as basic as event logging (which would have helped track exposure to things like the SolarWinds breach) was an extra-cost service that Microsoft customers had to pay for. Microsoft is squeezing a lot of profit out of those customers, and it feels no need to let up.

1 0

Ubuntu 24.04 Yields a 20% Performance Advantage Over Windows 11 On Ryzen 7 Framework Laptop
by Peter Reutemann 19 Apr '24

19 Apr '24

'Michael Larabel reports via Phoronix: With the Framework 16 laptop one of the performance pieces I've been meaning to carry out has been seeing out Linux performs against Microsoft Windows 11 for this AMD Ryzen 7 7840HS powered modular/upgradeable laptop. Recently getting around to it in my benchmarking queue, I also compared the performance of Ubuntu 23.10 to the near final Ubuntu 24.04 LTS on this laptop up against a fully-updated Microsoft Windows 11 installation. The Framework 16 review unit as a reminder was configured with the 8-core / 16-thread AMD Ryzen 7 7840HS Zen 4 SoC with Radeon RX 7700S graphics, a 512GB SN810 NVMe SSD, MediaTek MT7922 WiFi, and a 2560 x 1600 display. In the few months of testing out the Framework 16 predominantly under Linux it's been working out very well. With also having a Windows 11 partition as shipped by Framework, after updating that install it made for an interesting comparison against the Ubuntu 23.10 and Ubuntu 24.04 performance. The same Framework 16 AMD laptop was used throughout all of the testing for looking at the out-of-the-box performance across Microsoft Windows 11, Ubuntu 23.10, and the near-final state of Ubuntu 24.04. [...] Out of 101 benchmarks carried out on all three operating systems with the Framework 16 laptop, Ubuntu 24.04 was the fastest in 67% of those tests, the prior Ubuntu 23.10 led in 22% (typically with slim margins to 24.04), and then Microsoft Windows 11 was the front-runner just 10% of the time... If taking the geomean of all 101 benchmark results, Ubuntu 23.10 was 16% faster than Microsoft Windows 11 while Ubuntu 24.04 enhanced the Ubuntu Linux performance by 3% to yield a 20% advantage over Windows 11 on this AMD Ryzen 7 7840HS laptop. Ubuntu 24.04 is looking very good in the performance department and will see its stable release next week. ' -- source: https://hardware.slashdot.org/story/24/04/18/2321230 Cheers, Peter

1 0

FFmpeg 7.0 “Dijkstra”: Best New Features
by Peter Reutemann 19 Apr '24

19 Apr '24

'One of the major updates in FFmpeg 7.0 is the parallel execution of operations for unpacking/packing media containers, decoding, encoding, and applying filters using the ffmpeg command line utility. This feature allows for the simultaneous execution of multiple tasks, resulting in a significant improvement in performance and efficiency, particularly when working with large-scale multimedia projects. Another notable addition is the support for encoding and decoding video in MPEG-5 format (EVC – Essential Video Coding) using the external library libxevd. This new format provides high efficiency transmission and storage of all screen resolutions, supports video with an extended dynamic range (HDR), and panoramic video in 360-degree mode. In addition, FFmpeg 7.0 has added unpackers and packers of media containers (demuxer/muxer) for the QOA (Quite OK Audio) format, which is used for transmitting audio with loss of quality. QOA decoding is claimed to be three times faster than Ogg-Vorbis while achieving higher quality and compression levels compared to ADPCM. The new version also includes unpackers and packers of media containers (demuxer/muxer) for the IAMF (Immersive Audio Model and Format) format, which defines a container for distributing surround sound. The format provides for the transmission of additional information necessary for the operation of sound stage reconstruction and sound mixing algorithms, and takes into account the propagation of sound signals in three-dimensional space to recreate sound as close to natural as possible. An experimental decoder for the VVC (Versatile Video Coding) format, also known as the H.266 video compression standard, has been added in FFmpeg 7.0. This new format provides high efficiency transmission and storage of all screen resolutions, supports video with an extended dynamic range (HDR), and panoramic video in 360-degree mode. The ffplay utility has added support for hardware acceleration of decoding using the Vulkan and libplacebo APIs, and the ability to use API D3D12VA (Direct 3D 12 Video Encoding) for hardware acceleration of decoding of H264, HEVC, VP9, AV1, MPEG-2 and VC1 formats has been implemented. [...] Remember: This version is NOT backward compatible. That means, many CLI options and API are removed which are long deprecated. So use caution before upgrading to version 7.0.' -- source: https://www.debugpoint.com/ffmpeg-7-0-features/ Cheers, Peter -- My Open Source Blog - http://open.fracpete.org

1 0

High Priority PuTTY Vulnerability Threatens Server Access Security
by Peter Reutemann 19 Apr '24

19 Apr '24

'A critical security vulnerability in PuTTY, a very popular software for secure terminal access to remote servers, has been discovered. This vulnerability could put the private keys of many users at risk. Cataloged as CVE-2024-31497, the vulnerability affects PuTTY version numbers between 0.68 and 0.80. So, if you have been using PuTTY during this time, it is important to be aware of what this means for your data security. Fabian Bäumer and Marcus Brinkmann of the Ruhr University Bochum found the vulnerability. It concerns how PuTTY forms signatures from the ECDSA private keys on the NIST P521 curve. The vulnerability with PuTTY is that it creates a component of the signature called ‘nonce’ during the generation process. This randomly generated number can be used once in a cryptographic communication, thus ensuring that old communications cannot be reused in replay attacks. However, PuTTY used a deterministic method to generate nonces due to the lack of a high-quality random number generator in early Windows systems. This deterministic method was biased for the P521 curve, which made the private key recovery possible. Simply put, an attacker who gets hold of multiple signed messages can potentially recover your private key due to a specific bias in the signature creation process. This would allow them to forge signatures and access any servers where you’ve used this key.' -- source: https://linuxiac.com/high-priority-putty-vulnerability-found/ Cheers, Peter -- My Open Source Blog - http://open.fracpete.org

1 0

Packages With “t64” On The Ends Of Their Names
by Lawrence D'Oliveiro 15 Apr '24

15 Apr '24

Lately, in Debian Unstable, I have noticed package names starting to appear with “t64” on the ends. No doubt this will percolate through to Debian derivatives as well. I wondered what this was about, and found this forum thread <https://www.antixforum.com/forums/topic/t64-at-the-end-of-a-package-title/>. This has to do with the “year-2038” problem, which should only affect 32-bit systems anyway. But it seems some people are sufficiently concerned about this to ensure that their code will build with a 64-bit size for time_t (the POSIX type for holding the number of seconds since 1st January 1970), even on 32-bit systems. This is controlled at build time by setting the _TIME_BITS symbol to the value 64. There is a file /usr/include/features-time64.h (present if you have the libc6-dev package installed) that does the necessary setup of other time-related API calls based on this. On 64-bit systems (which is what most of us would be running by now), there would be absolutely no difference in the code with this setting. So the change in package name is I think only to maintain compatibility with 32-bit architectures.

1 0

“Highly capable” hackers root corporate networks by exploiting firewall 0-day
by Peter Reutemann 15 Apr '24

15 Apr '24

'Highly capable hackers are rooting multiple corporate networks by exploiting a maximum-severity zero-day vulnerability in a firewall product from Palo Alto Networks, researchers said Friday. The vulnerability, which has been under active exploitation for at least two weeks now, allows the hackers with no authentication to execute malicious code with root privileges, the highest possible level of system access, researchers said. The extent of the compromise, along with the ease of exploitation, has earned the CVE-2024-3400 vulnerability the maximum severity rating of 10.0. The ongoing attacks are the latest in a rash of attacks aimed at firewalls, VPNs, and file-transfer appliances, which are popular targets because of their wealth of vulnerabilities and direct pipeline into the most sensitive parts of a network.' -- source: https://arstechnica.com/security/2024/04/highly-capable-hackers-root-corpor… Cheers, Peter

1 0

APT Interface 'Revamped' For Ubuntu 24.10 and Debian Trixie with Colors and Columns
by Peter Reutemann 15 Apr '24

15 Apr '24

'Ubuntu 24.10 [expected this October] and Debian GNU/Linux 13 "Trixie" [expected June-July 2025] "will feature a refined APT command-line interface," reports 9to5Linux: APT developer and Canonical engineer Julian Andres Klode took to LinkedIn to present the revamped APT interface powered by the upcoming APT 3.0 package manager that looks to give users a more concise and well-laid-out command-line output when updating, installing, or removing packages via the terminal emulator. The new APT 3.0 UI brings a columnar display that will make it easier for users to quickly scan for a package name, support for colors (red for removals and green for other changes), which makes it easier to quickly distinguish commands at a glance, and smoother install progress bars using Unicode blocks. In addition, the new APT 3.0 command-line interface will be less verbose and offer more padding to make it easier to separate sections and extract the relevant information for you. "Bleeding-edge users and Linux enthusiasts who want to try this right now can check out Debian Unstable..."' -- source: https://linux.slashdot.org/story/24/04/14/052258 Cheers, Peter

1 0

Canonical Says Qualcomm Has Joined Ubuntu's 'Silicon Partner' Program
by Peter Reutemann 15 Apr '24

15 Apr '24

'Intel, Nvidia, AMD, and Arm are among Canonical's "silicon partners," a program that "ensures maximum Ubuntu compatibility and long-term support with certified hardware," according to Web Pro News. And now Qualcomm is set to be Canonical's next silicon partner, "giving Qualcomm access to optimized versions of Ubuntu for its processors." Companies looking to use Ubuntu on Qualcomm chips will benefit from an OS that provides 10 years of support and security updates. The collaboration is expected to be a boon for AI, edge computing, and IoT applications. "The combination of Qualcomm Technologies' processors with the popularity of Ubuntu among AI and IoT developers is a game changer for the industry," commented Dev Singh, Vice President, Business Development and Head of Building, Enterprise & Industrial Automation, Qualcomm Technologies, Inc... "Optimised Ubuntu and Ubuntu Core images will be available for Qualcomm SoCs," according to the announcement, "enabling enterprises to meet their regulatory, compliance and security demands for AI at the edge and the broader IoT market with a secure operating system that is supported for 10 years." Qualcomm Technologies chose to partner with Canonical to create an optimised Ubuntu for Qualcomm IoT chipsets, giving developers an easy path to create safe, compliant, security-focused, and high-performing applications for multiple industries including industrial, robotics and edge automation... Developers and enterprises can benefit from the Ubuntu Certified Hardware program, which features a growing list of certified ODM boards and devices based on Qualcomm SoCs. These certified devices deliver an optimised Ubuntu experience out-of-the-box, enabling developers to focus on developing applications and bringing products to market.' -- source: https://news.slashdot.org/story/24/04/14/1652246 Cheers, Peter

1 0

New Spectre V2 Attack Impacts Linux Systems On Intel CPUs
by Peter Reutemann 14 Apr '24

14 Apr '24

'BleepingComputer reports: Researchers have demonstrated the "first native Spectre v2 exploit" for a new speculative execution side-channel flaw that impacts Linux systems running on many modern Intel processors. Spectre V2 is a new variant of the original Spectre attack discovered by a team of researchers at the VUSec group from VU Amsterdam. The researchers also released a tool that uses symbolic execution to identify exploitable code segments within the Linux kernel to help with mitigation. The new finding underscores the challenges in balancing performance optimization with security, which makes addressing fundamental CPU flaws complicated even six years after the discovery of the original Spectre.... As the CERT Coordination Center (CERT/CC) disclosed yesterday, the new flaw, tracked as CVE-2024-2201, allows unauthenticated attackers to read arbitrary memory data by leveraging speculative execution, bypassing present security mechanisms designed to isolate privilege levels. "An unauthenticated attacker can exploit this vulnerability to leak privileged memory from the CPU by speculatively jumping to a chosen gadget," reads the CERT/CC announcement. "Current research shows that existing mitigation techniques of disabling privileged eBPF and enabling (Fine)IBT are insufficient in stopping BHI exploitation against the kernel/hypervisor." ' -- source: https://linux.slashdot.org/story/24/04/13/1911230 Cheers, Peter

1 0

In a First, AlmaLinux Patches a Security Hole That Remains Unpatched in Upstream RHEL
by Peter Reutemann 10 Apr '24

10 Apr '24

'AlmaLinux, a three year old Linux distribution that started life as a clone of Red Hat Enterprise Linux, on Tuesday announced that it had created a patch to fix CVE-2024-1086, a security vulnerability that Red Hat evidently doesn’t think is important enough to patch in RHEL right away. “Though this was flagged as something to be fixed in Red Hat Enterprise Linux, Red Hat has only rated this as a moderate impact,” benny Vasquez, chairperson at the AlmaLinux Foundation explained in an article on the distro’s website on Tuesday. “Our users have asked us to patch this more quickly, and as such, we have opted to include patches ourselves. We released this kernel patch to the testing repo last weekend and plan to push it to production on Wednesday, April 3rd.” Since Vasquez’s post a production ready version of the fix was made available through the distro’s repositories, and Red Hat has re-evaluated the threat from its end and raised the severity level from “moderate” to “important.” There is still no sign of a patch from Red Hat, however, although the company has posted several methods for mitigating the threat. “This flaw is trivially exploitable on most RHEL-equivalent systems,” Vasquez said. “There are many proof-of-concept posts available now, including one from our Infrastructure team lead, Jonathan Wright (Dealing with CVE-2024-1086). In multi-user scenarios, this flaw is especially problematic.”' -- source: https://fossforce.com/2024/04/in-a-first-almalinux-patches-a-security-hole-… Cheers, Peter

1 0

EndeavourOS Bids Farewell to ARM Branch
by Peter Reutemann 10 Apr '24

10 Apr '24

'In a heartfelt announcement today, Bryan Poerwo, founder and project leader of EndeavourOS, marked the end of its ARM product branch. This project has been part of the EndeavourOS journey since its inception from the remnants of Antergos in 2019. The initiative, which began with the help of a passionate community member known as Pudge, later a leading figure of the EndeavourOS ARM team, aimed to extend the reach of EndeavourOS to ARM devices such as the ODROID N2, ODROID XU4, and Raspberry Pi 4. Over nearly five years, EndeavourOS ARM flourished, witnessing additions like support for the PineBook Pro and Raspberry Pi 5 and implementing a Calamares install option alongside the original scripts. However, the journey was challenging. The rapid advancement of Linux and desktop environments on x86_64 devices contrasted sharply with the slower pace of development in the ARM landscape, presenting a series of obstacles that tested the resolve of the project’s pioneers. The widening gap between ARM and x86_64 architectures, reduced external support, and personal transitions in hardware preferences led to a heartfelt decision to conclude the EndeavourOS ARM project. But not all is lost. As the project ends, the community remains hopeful, inviting anyone willing to carry the torch forward. The project’s GitHub repository continues to be available, serving as a foundation for future endeavors in the ARM Linux space.' -- source: https://linuxiac.com/endeavouros-bids-farewell-to-arm-branch/ Cheers, Peter

1 0

TrueNAS Moving From FreeBSD To Debian
by Lawrence D'Oliveiro 09 Apr '24

09 Apr '24

TrueNAS, makers of a turnkey system installation designed for NAS servers, announced close to a month ago that they were changing the emphasis in their product development from “TrueNAS CORE” (which is FreeBSD-based) to “TrueNAS SCALE” (which is Linux-based, specifically Debian-based) <https://www.theregister.com/2024/03/18/truenas_abandons_freebsd/>. This article <https://blocksandfiles.com/2024/04/08/ixsystems-no-one-is-getting-marooned/> gives some more background on the move: Kris Moore, SVP for engineering, told us: “Upstream has shifted. So first of all, ZFS, that’s kind of the heart and soul of TrueNAS and was for FreeNAS as well. Most of that [development] work takes place on Linux these days; features testing, all that happens on Linux. FreeBSD is the thing you port to and you’re done. So that momentum has moved.” ... “We had a huge chunk of our engineering staff spending time improving FreeBSD as opposed to working on features and functionalities. What’s happened now with the transition to having a Debian basis, the people I used to have 90 percent of their time working on FreeBSD, they’re working on ZFS features now … That’s what I want to see; value add for everybody versus sitting around, implementing something Linux had a years ago.” The irony in that is, ZFS was deliberately released by Sun (now Oracle) under a licence that is designed to be incompatible with the GPL that covers the Linux kernel. If you want to argue otherwise, consider that Oracle still refuses to include ZFS with its own Linux distro, preferring to offer you btrfs instead. Of course, you could also view that as a sign of a lack of confidence in its own home-grown filesystem ...

1 0

MIT License text becomes viral “sad girl” piano ballad generated by AI
by Peter Reutemann 09 Apr '24

09 Apr '24

'We've come a long way since primitive AI music generators in 2022. Today, AI tools like Suno.ai allow any series of words to become song lyrics, including inside jokes (as you'll see below). On Wednesday, prompt engineer Riley Goodside tweeted an AI-generated song created with the prompt "sad girl with piano performs the text of the MIT License," and it began to circulate widely in the AI community online.' -- source: https://arstechnica.com/information-technology/2024/04/mit-license-text-bec… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

German state gov. ditching Windows for Linux, 30K workers migrating
by Peter Reutemann 08 Apr '24

08 Apr '24

''Schleswig-Holstein, one of Germany’s 16 states, on Wednesday confirmed plans to move tens of thousands of systems from Microsoft Windows to Linux. The announcement follows previously established plans to migrate the state government off Microsoft Office in favor of open source LibreOffice. As spotted by The Document Foundation, the government has apparently finished its pilot run of LibreOffice and is now announcing plans to expand to more open source offerings. In 2021, the state government announced plans to move 25,000 computers to LibreOffice by 2026. At the time, Schleswig-Holstein said it had already been testing LibreOffice for two years. -- source: https://arstechnica.com/information-technology/2024/04/german-state-gov-dit… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenBSD 7.5 Released
by Peter Reutemann 08 Apr '24

08 Apr '24

'Slashdot reader Mononymous writes: The latest release of OpenBSD, the FOSS Unix-like operating system focused on correctness and security over features and performance, has been released. This version includes newer driver support, performance improvements, stability fixes, and lots of package updates. One highlight is a complete port of KDE Plasma 5. You can view the announcement and get the bits at OpenBSD.org. Phoronix reports that with OpenBSD 7.5 "there is a number of improvements for ARM (AArch64) hardware, never-ending kernel optimizations and other tuning work, countless package updates, and other adjustments to this popular BSD platform."' -- source: https://tech.slashdot.org/story/24/04/06/0519207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tip For Repairing Ancient Linux Installations
by Lawrence D'Oliveiro 02 Apr '24

02 Apr '24

Here’s the scenario: there is a malfunctioning server running a really ancient Linux installation (e.g. 2.6.x-series kernel). You boot up with a reasonably recent copy of SystemRescue, mount the machine’s filesystem, try to chroot into it and run a shell ... and it segfaults. Seems there has been a subtle incompatible change in Linux kernel behaviour since those times, to do with the disabling of something called the “vsyscall” mechanism (which is specific to 64-bit x86-based machines, I understand). This was supposed to be a way to speed up certain commonly-executed system calls (I think getting the system time was one of them) by allowing direct transfers to certain entry points with fixed memory addresses for invoking them. It was later decided this was a bad idea (I think for security reasons). The mechanism has not been completely removed (yet), but nowadays it is disabled by default. To get around this, you need to boot SystemRescue with a change to the kernel command-line parameters, adding this item vsyscall=emulate After you get to a shell, you can confirm that this setting is in effect by checking the /proc/self/maps file (the memory mappings for your own process). At the bottom, there should be an entry with “[vdso]” in it, and below that another line with “[vsyscall]”. The presence of the latter line indicates that vsyscall emulation is in effect. This is not present when I check a process on my own machine, for example. Linus is legendary for being a stickler for never, ever breaking backward compatibility for userland. So the reasons for turning this off must have been pretty compelling, for him to agree to it. But the compromise is, it’s still there to be enabled if you really, really need it. There’s a bit more technical info here <https://0xax.gitbooks.io/linux-insides/content/SysCall/linux-syscall-3.html>, if you are interested. By the way, the above page is part of a book beginning here <https://0xax.gitbooks.io/linux-insides/content/>, about the insides of the Linux kernel. The whole book seems to be accessible from that link, but if you step up a level, the site doesn’t seem to have any idea about the existence of that book.

3 4

Uncle Sam’s Had It Up To Here With “Unforgivable” SQL Injection Flaws
by Lawrence D'Oliveiro 27 Mar '24

27 Mar '24

We all know SQL injection attacks are an ongoing problem <https://www.theregister.com/2024/03/26/fbi_cisa_sql_injection/>. What interested me about this article is this part: Software vendors have been advised to use parameterized queries with prepared statements to mitigate SQL injection vulnerabilities. According to the authorities, these allow user-input data to be separated from SQL queries and "better embody a secure by design approach" compared to input sanitization techniques. These are deployed by some vendors, but were branded "brittle" by CISA and the FBI. They said they're also difficult to deploy on a large scale and are more easily bypassed. Funny, that. Every time I post examples of how I dynamically construct SQL query strings with proper quoting of user input, I get yelled at and told to use “parameterized queries” and “prepared statements”, or even an ORM. Yet here we have the security experts saying that that is not a good solution, just like I thought all along.

1 0

Mozilla’s privacy service drops a provider with ties to people-search sites
by Peter Reutemann 26 Mar '24

26 Mar '24

'Mozilla's Monitor Plus, a service launched by the privacy-minded tech firm in February, notes on its pitch page that there is "a $240 billion industry of data brokers selling your private information for profit" and that its offering can "take back your privacy." Mozilla's most recent move to protect privacy has been to cut out one of the key providers of Monitor Plus' people-search protections, Onerep. That comes after reporting from security reporter Brian Krebs, who uncovered Onerep CEO and founder Dimitri Shelest as the founder of "dozens of people-search services since 2010," including one, Nuwber, that still sells the very kind of "background reports" that Monitor Plus seeks to curb. Shelest told Krebs in a statement (PDF) that he did have an ownership stake in Nuwber, but that Nuwber has "zero cross-over or information-sharing with Onerep" and that he no longer operates any other people-search sites. Shelest admitted the bad look but said that his experience with people search gave Onerep "the best tech and team in the space." Brandon Borrman, vice president of communications at Mozilla, said in a statement that while "customer data was never at risk, the outside financial interests and activities of Onerep’s CEO do not align with our values." Mozilla is "working now to solidify a transition plan," Borrman said. A Mozilla spokesperson confirmed to Ars today that Mozilla is continuing to offer Monitor Plus, suggesting no pause in subscriptions, at least for the moment.' -- source: https://arstechnica.com/gadgets/2024/03/mozillas-privacy-service-drops-a-pr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

decrypting PDFs
by Peter Reutemann 22 Mar '24

22 Mar '24

Hi everyone I've long had a problem with being unable to open some PDFs that could be either viewed on Windows or on Google Drive. For some reason, some PDFs appear to be encrypted (but not requiring a password??). Today, I found an approach that allows me to access these files also on my Linux machine using pdftk. pdftk allows you to decrypt PDFs by supplying a password (https://www.ubuntumint.com/remove-password-from-pdf-on-linux/) pdftk <protected>.pdf input_pw <password> output <new>.pdf However, the following seemed to work on these weird PDF files, without having to supply a password: pdftk <protected>.pdf output <new>.pdf And now my PDF viewers (okular, xreader, etc) no longer complain that they can't open the file. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Formula 1 Chief Appalled to Find Team Using Excel to Manage 20,000 Car Parts
by Lawrence D'Oliveiro 21 Mar '24

21 Mar '24

<https://arstechnica.com/cars/2024/03/formula-1-chief-appalled-to-find-team-…>: The Williams car build workbook, with roughly 20,000 individual parts, was "a joke," Vowles recently told The Race. "Impossible to navigate and impossible to update." This colossal Excel file lacked information on how much each of those parts cost and the time it took to produce them, along with whether the parts were already on order. ... Banks cited Tim Worstall's 2013 contention that Excel could be "the most dangerous software on the planet." Back then, international investment bankers were found manually copying and pasting Excel between Excel sheets to do their work, and it raised alarm.

1 0

Database-Based Operating System 'DBOS' Does Things Linux Can't
by Peter Reutemann 19 Mar '24

19 Mar '24

'Databricks CTO Matei Zaharia "said that Databricks had to keep track of scheduling a million things," remembers adjunct MIT professor Michael Stonebraker. " He said that this can't be done with traditional operating system scheduling, and so this was done out of a Postgres database. And then he started to whine that Postgres was too slow, and I told him we can do better than that...." This resulted in DBOS — short for "database operating system" — which they teamed up to build with teams Stanford and MIT, according to The Next Platform: They founded a company to commercialize the idea in April 2023 and secured $8.5 million initial seed funding to start building the real DBOS. Engine Ventures and Construct Capital led the funding, along with Sinewave and GutBrain Ventures... "The state that the operating system has to keep track of — memory, files, messages, and so on — is approximately linear to the resources you have got," says Stonebraker. "So without me saying another word, keeping track of operating system state is a database problem not addressed by current operating system schedulers. Moreover, OLTP [Online Transaction Processing] database performance has gone up dramatically, and that is why we thought instead of running the database system in user space on top of the operating system, why don't we invert our thinking 180 degrees and run the operating system on top of the database, with all of the operating services are coded in SQL...?" For now, DBOS can give the same kind of performance as that full blown Linux operating system, and thanks to the distributed database underpinnings of its kernel, it can do things that a Linux kernel just cannot do... One is provide reliable execution, which means that if a program running atop DBOS is ever interrupted, it starts where it left off and does not have to redo its work from some arbitrary earlier point and does not crash and have to start from the beginning. And because every little bit of the state of the operating system — and therefore the applications that run atop it — is preserved, you can go backwards in time in the system and restart the operating system if it experiences some sort of anomaly, such as a bad piece of application software running or a hack attack. You can use this "time travel" feature, as Stonebraker calls it, to reproduce what are called heisenbugs — ones that are very hard to reproduce precisely because there is no shared state in the distributed Linux and Kubernetes environment and that are increasingly prevalent in a world of microservices. The other benefit of the DBOS is that it presents a smaller attack surface for hackers, which boosts security, and that you analyze the metrics of the operating system in place since they are already in a NoSQL database that can be queried rather than aggregating a bunch of log files from up and down the software stack to try to figure out what is going on... There is also a custom tier for DBOS, which we presume costs money, that can use other databases and datastores for user application data, stores more than three days of log data, can have multiple users per account, that adds email and Slack support with DBOS techies, and that is available on other clouds as well as AWS. The operating system kernel/scheduler "is itself largely a database," with services written in TypeScript, according to the article. The first iteration used the FoundationDB distributed key-value store for its scheduling core (open sourced by Apple in 2018), according to the article — "a blazingly fast NoSQL database... Stonebraker says there is no reason to believe that DBOS can't scale across 1 million cores or more and support Java, Python, and other application languages as they are needed by customers..." And the article speculates they could take things even further. "There is no reason why DBOS cannot complete the circle and not only have a database as an operating system kernel, but also have a relational database as the file system for applications."' -- source: https://developers.slashdot.org/story/24/03/18/0038232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Ends its Privacy-Friendly GPS-Style Location Service
by Peter Reutemann 18 Mar '24

18 Mar '24

'Mozilla Location Service offered "a free, open way to offer GPS-style location detection features" for developers on devices without GPS hardware, remembers the Linux blog OMG Ubuntu. It used signals like Wi-Fi access points and Bluetooth beacons "without any of the privacy implications most competing geolocation services have." But Friday they reported that Mozilla "has announced it is ending access to Mozilla Location Service (MLS), which provides accurate, privacy-respecting, and crowdsourced geolocation data." Developers and 3rd-party projects that use MLS to detect a users' location, such as the freedesktop.org location framework GeoClue, which is used by apps like GNOME Maps and Weather, have only a few months left to continue using the service... In late March, POST data submissions will return 403 responses. Finally, on June 12, all 3rd-party API keys will be removed and MLS data only accessible by Mozilla... MLS' accuracy has declined in recent years. Patent infringement claims in 2019 saw Mozilla reach a settlement to avoid litigation. As part of that settlement it was forced to make changes to MLS that impacted its ability to invest in (commercially exploit?) and improve the service. The article notes that GeoClue "already supports multiple location detection methods, including IP-based ones," so it should continue operating. "But the sad reality is that there just aren't a lot of free, open, privacy-friendly, accurate, and (rather importantly for a framework built in to Linux desktops) reliable alternatives to Mozilla Location Services, which has built up a colossal 'signal map' from which to pinpoint locations." "We are grateful for the contributions of the community to MLS to both the code and the dataset," a Mozilla senior engineering manager said in a statement.' -- source: https://tech.slashdot.org/story/24/03/17/2150221/mozilla-ends-its-privacy-f… I wasn't even aware that Mozilla was offering such a service... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

1986 Presentation On Setting A Computer’s Clock Correctly
by Lawrence D'Oliveiro 18 Mar '24

18 Mar '24

One of the recent additions to the Bitsavers vintage computing collection is this presentation from 1986 <http://bitsavers.trailing-edge.com/pdf/ibm/share/SHARE67_Presentation_on_Se…> at a session of SHARE (one of the IBM user groups), on how to ensure your computer’s time is set correctly. Remember, this was before NTP. But there was already a worldwide network of atomic clocks, keeping synchronization with each other, and there were shortwave stations, like WWV in Boulder, Colorado, that would broadcast pips once per second, synchronized to the atomic clock network. And there were even consumer-level gadgets, like the one mentioned in the article from Heath, that would automatically decode those broadcasts and output a time code a computer could read. The article has some nice background info. Like did you know there can be up to a 1-second discrepancy between GMT and UTC? (Actually I think from other sources the limit might be more like 0.9 seconds.) IBM’s mainframe OS developers were perceptive enough to realize that it can be useful to have the computer keep time in GMT, and maintain an offset for calculating local time. Particular site admins could of course have the choice of using local time for the system time, and setting the offset to zero. Changing the offset for daylight saving could be a fraught procedure, though. The level of confusion it could cause for running applications was such that it was safer to do a reboot. One little item I don’t recall coming across before, another of those NASA programming screwups: One of the famous programming mistakes of all time was by the programmer who thought the earth revolved on its axis once every 24 hours and used that fact to calculate landing sites for the Mercury space flights. Our first astronauts spent a lot more time in the water than they should have because of that.

1 0

Free/Libre 'GnuCOBOL' Compiler Reaches Maturity, Can Compete with Proprietary Offerings
by Peter Reutemann 18 Mar '24

18 Mar '24

'After 20 years of development, the open source GnuCOBOL "has reached an industrial maturity and can compete with proprietary offers in all environments," said OCamlPro founder and GnuCOBOL contributor Fabrice Le Fessant, in a FOSDEM talk about the technology. GnuCOBOL turns COBOL source code into executable applications. It is very cross-platform, running Linux, BSD, many proprietary Unixes, macOS, and Windows, even Android. And the latest version, v.32, is being used in many commercial settings... Sobisch noted that the GnuCOBOL is seeing a lot of commercial deployments, such as for banking back-end apps, many of which are being migrated from Micro Focus, with users reporting performance improvements as a result. The French DGFIP federal agency moved from a GCOS mainframe to GnuCOBOL, with the help of Le Fessant's firm. Originally called OpenCOBOL, the project was started in 2002 and renamed GnuCOBOL in 2013. In the past three years, it has received attention from 13 contributors with 460 commits. Most Linux package managers have a copy of GnuCOBOL for the program for downloading... It can compile to C code (C89+), making it extremely portable, from mainframes to Raspberry Pi's, Sobisch said... Also new is SuperBOL, a development studio for GnuCOBOL developed by Le Fessant's OCamlPro. It runs as a VSCode Extension and features a full COBOL processor (written in OCaml). ' -- source: https://developers.slashdot.org/story/24/03/17/1810257 Anything COBOL related takes time, I guess... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Raspberry Pi OS Is Now Powered by Linux 6.6 LTS, Improves Raspberry Pi 5 Support
by Peter Reutemann 15 Mar '24

15 Mar '24

'The Raspberry Pi Foundation released today a new build of their Debian-based Raspberry Pi OS operating for the Raspberry Pi single-board computers adding a new kernel from the Linux 6.6 long-term supported series, updated components, and various improvements. While still based on the latest Debian GNU/Linux 12 “Bookworm” operating system series, Raspberry Pi OS is now powered by the Linux 6.6 LTS kernel series, which is a major upgrade from Linux kernel 6.1 LTS used in previous releases. This update also includes the latest Chromium 122 and Mozilla Firefox 123 web browsers. The new Raspberry Pi OS release offers better support for the latest Raspberry Pi 5 SBC by improving the handling of the power button. In addition, it also adds new settings for headless resolution to the Screen Configuration, while removing the setting of headless resolution for Wayland from Raspberry Pi Configuration.' -- source: https://9to5linux.com/raspberry-pi-os-is-now-powered-by-linux-6-6-lts-impro… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Never-before-seen Linux malware gets installed using 1-day exploits
by Peter Reutemann 12 Mar '24

12 Mar '24

'Researchers have unearthed Linux malware that circulated in the wild for at least two years before being identified as a credential stealer that’s installed by the exploitation of recently patched vulnerabilities. The newly identified malware is a Linux variant of NerbianRAT, a remote access Trojan first described in 2022 by researchers at security firm Proofpoint. Last Friday, Checkpoint Research revealed that the Linux version has existed since at least the same year, when it was uploaded to the VirusTotal malware identification site. Checkpoint went on to conclude that Magnet Goblin—the name the security firm uses to track the financially motivated threat actor using the malware—has installed it by exploiting “1-days,” which are recently patched vulnerabilities. Attackers in this scenario reverse engineer security updates, or copy associated proof-of-concept exploits, for use against devices that have yet to install the patches. Checkpoint also identified MiniNerbian, a smaller version of NerbianRAT for Linux that’s used to backdoor servers running the Magento ecommerce server, primarily for use as command and control servers that devices infected by NerbianRAT connect to. Researchers elsewhere have reported encountering servers that appear to have been compromised with MiniNerbian, but Checkpoint Research appears to have been the first to identify the underlying binary.' -- source: https://arstechnica.com/security/2024/03/never-before-seen-linux-malware-ge… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.9 Will Be the First To Top 10 Million Git Objects
by Peter Reutemann 12 Mar '24

12 Mar '24

'Linus Torvalds has released version 6.8 of the Linux Kernel. "So it took a bit longer for the commit counts to come down this release than I tend to prefer," Torvalds wrote on the Linx kernel mailing list on Sunday, "but a lot of that seemed to be about various selftest updates (networking in particular) rather than any actual real sign of problems." "And the last two weeks have been pretty quiet, so I feel there's no real reason to delay 6.8." So he delivered it, ending his own speculation that this cut of the kernel might need an eighth release candidate. Torvalds found time to note what he described as "a bit of random git numerology" as when work ended on this version of the kernel the git repository used to track it contained 9.996 million objects." "This is the last mainline kernel to have less than ten million git objects," Torvalds wrote. "Of course, there is absolutely nothing special about it apart from a nice round number. Git doesn't care," he added. Fair enough -- especially as noted that other trees, such as linux-next, have well and truly passed ten million objects.' -- source: https://linux.slashdot.org/story/24/03/11/1620223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Do Scientists Take Backups?
by Lawrence D'Oliveiro 11 Mar '24

11 Mar '24

Martin Eve, who works at Crossref, which manages the DOI system which tries to offer permanent online links to scientific publications and other digital documents, decided to do a survey of those links, to see how many of them would still actually resolve. The results were less than reassuring <https://arstechnica.com/science/2024/03/study-finds-that-we-could-lose-scie…>. If/when a publisher goes bankrupt, what happens to their online archives? Do researchers who submit papers keep backup copies of their papers?

3 6

It’s A Raspberry Pi!
by Lawrence D'Oliveiro 08 Mar '24

08 Mar '24

Was anybody watching Channel 200 (Juice TV) a minute ago? There was a lovely Linux text screen with a shell prompt saying the machine name was “pberrypi”.

1 1

“We Had To Educate Oracle About Our Contract”
by Lawrence D'Oliveiro 08 Mar '24

08 Mar '24

Slightly chilling words to hear, don’t you think? Corporations that do volume deals with proprietary suppliers like Oracle and SAP have to agree to allow periodic audits by the vendor to ensure they are complying with the licence terms. Vendors have been known to try to pull a fast one during these audits. This customer <https://www.theregister.com/2024/03/06/oracle_audits/> mentions that Oracle, in particular, had a tendency to assume the software was licensed under their current terms, when in fact the contract was agreed under quite different, older terms. Hence the need to keep “educating” (i.e. reminding) the vendor about what the correct criteria were.

1 0

Fedora Workstation 41 To No Longer Install GNOME X.Org Session By Default
by Peter Reutemann 08 Mar '24

08 Mar '24

'Michael Larabel writes via Phoronix: Fedora Workstation has long defaulted to using GNOME's Wayland session by default, but it has continued to install the GNOME X.Org session for fallback purposes or those opting to use it instead. But for the Fedora Workstation 41 release later in the year, there is a newly-approved plan to no longer have that GNOME X.Org session installed by default. Recently there was a Fedora Workstation ticket opened to no longer install the GNOME X.Org session by default. This is just about whether the X.Org session is pre-installed but would continue to live in the repository for those wanting to explicitly install it. The Fedora Workstation working group decided to go ahead with this change for the Fedora 41 cycle, not the upcoming Fedora 40 release. So pending any obstacles by FESCo, which is unlikely. Fedora Workstation 41 will not be installing the GNOME X.Org session by default. Long live Wayland.' -- source: https://news.slashdot.org/story/24/03/07/2157258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to Run Android Applications on Ubuntu with Waydroid
by Peter Reutemann 06 Mar '24

06 Mar '24

'Waydroid is an excellent tool that lets you access Android apps like native applications on your Linux machine, following a container-based philosophy similar to the Android subsystem in Windows and capable of booting the full Android system. It has access to Linux namespaces (user, pid, uts, net, mount, ipc), and within the container, Android has direct access to the system hardware. Currently, the provided Android OS will be based on Lineage OS 21 (Android 11), so certain discontinued apps might not work.' -- source: https://ubuntushell.com/install-waydroid/ The article has step-by-step instructions. Looks like an interesting tool! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Opus 1.5 Gets a Serious Machine Learning Upgrade
by Peter Reutemann 05 Mar '24

05 Mar '24

'Longtime Slashdot reader jmv writes: After more than two years of work, Opus 1.5 is out. It brings many new features that can improve quality and the general audio experience through machine learning, while maintaining fully-compatibility with previous releases. See this release page demonstrating all the new features, including: - Significant improvement to packet loss robustness using Deep Redundancy (DRED) - Improved packet loss concealment through Deep PLC - Low-bitrate speech quality enhancement down to 6 kb/s wideband - Improved x86 (AVX2) and Arm (Neon) optimizations - Support for 4th and 5th order ambisonics' -- source: https://news.slashdot.org/story/24/03/04/2126211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Passes 4% Desktop Market Share
by Peter Reutemann 05 Mar '24

05 Mar '24

'"Linux gained from 3% to 4% in 8 months," writes longtime Slashdot reader bobdevine. Linuxiac reports: According to the latest data from StatCounter, a leading web traffic analysis tool, Linux's market share has reached 4.03%. At first glance, the number might seem modest, but it represents a significant leap. Let's break it down. It took Linux 30 years to secure a 3% share of desktop operating systems, a milestone reached last June. Impressively, the open-source operating system has surged by an additional 1% in the last eight months.' -- source: https://linux.slashdot.org/story/24/03/04/2159239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

French Court Issues Damages Award For Violation of GPL
by Peter Reutemann 04 Mar '24

04 Mar '24

'Some news from "Copyleft Currents", the blog of open-source/IP lawyer Heather Meeker: On February 14, 2024, the Court of Appeal of Paris issued an order stating that Orange, a major French telecom provider, had infringed the copyight of Entr'Ouvert's Lasso software and violated the GPL. They ordered Orange to pay €500,000 in compensatory damages and €150,000 for moral damages. This case has been ongoing for many years. Entr'ouvert is the publisher of Lasso, a reference library for the Security Assertion Markup Language (SAML) protocol, an open standard for identity providers to authenticate users and pass authentication tokens to online services. This is the open protocol that enables single sign-on (SSO). The Lasso product is dual licensed by Entr'Ouvert under GPL or commercial licenses. In 2005, Orange won a contract with the French Agency for the Development of Electronic Administration to develop parts of the service-public.fr portal, which allows users to interact online with the government for administrative procedures. Orange used the Lasso software in the solution, but did not pass on the rights to its modifications free of charge under GPL, or make the source code to its modifications available. Entr'Ouvert sued Orange in 2010, and the case wended its way through the courts, turning on, among other things, issues of proof of Entr'Ouvert 's copyright interest in the software, and whether the case properly sounded in breach of contract or copyright infringement... The compensatory damages were based on both lost profits of the plaintiff and disgorgement of profits of Orange. Moral damages compensate the plaintiff for harm to reputation or other non-monetary injury.' -- source: https://news.slashdot.org/story/24/03/03/030200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rentware Comes To Hardware
by Lawrence D'Oliveiro 01 Mar '24

01 Mar '24

You already have companies like Adobe and Autodesk making their software subscription-only, so you have to keep paying to use it; now HP is bringing the same idea to its printers <https://arstechnica.com/gadgets/2024/02/hp-wants-you-to-pay-up-to-36-month-…>. You pay a monthly fee (inclusive of ink as well as printer rental), and you get to print a certain number of pages each month. This will require an always-on Internet connection, so HP can monitor your printer. This will allow them to collect information, not just on ink levels, but on what kind of printing you are doing, even the applications you are using. How would you like to “never own a printer again”? (Their tag line.) I suppose you should be grateful they aren’t requiring you to buy their paper as well. At least, not yet ...

1 0

'Paying People To Work on Open Source is Good Actually'
by Peter Reutemann 01 Mar '24

01 Mar '24

'Jacob Kaplan-Moss, one of the lead developers of Django, writes in a long post that he says has come from a place of frustration: [...] Instead, every time a maintainer finds a way to get paid, people show up to criticize and complain. Non-OSI licenses "don"t count" as open source. Someone employed by Microsoft is "beholden to corporate interests" and not to be trusted. Patreon is "asking for handouts." Raising money through GitHub sponsors is "supporting Microsoft's rent-seeking." VC funding means we're being set up for a "rug pull" or "enshitification." Open Core is "bait and switch." None of this is hypothetical; each of these examples are actual things I've seen said about maintainers who take money for their work. One maintainer even told me he got criticized for selling t-shirts! Look. There are absolutely problems with every tactic we have to support maintainers. It's true that VC investment comes with strings attached that often lead to problems down the line. It sucks that Patreon or GitHub (and Stripe) take a cut of sponsor money. The additional restrictions imposed by PolyForm or the BSL really do go against the Freedom 0 ideal. I myself am often frustrated by discovering that some key feature I want out of an open core tool is only available to paid licensees. But you can criticize these systems while still supporting and celebrating the maintainers! Yell at A16Z all you like, I don't care. (Neither do they.) But yelling at a maintainer because they took money from a VC is directing that anger in the wrong direction. The structural and societal problems that make all these different funding models problematic aren't the fault of the people trying to make a living doing open source. It's like yelling at someone for shopping at Dollar General when it's the only store they have access to. Dollar General's predatory business model absolutely sucks, as do the governmental policies that lead to food deserts, but none of that is on the shoulders of the person who needs milk and doesn't have alternatives.' -- source: https://news.slashdot.org/story/24/02/29/0746221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

HDMI Forum Rejects Open-Source HDMI 2.1 Driver Support Sought By AMD
by Peter Reutemann 01 Mar '24

01 Mar '24

'Michael Larabel, reporting at Phoronix: One of the limitations of AMD's open-source Linux graphics driver has been the inability to implement HDMI 2.1+ functionality on the basis of legal requirements by the HDMI Forum. AMD engineers had been working to come up with a solution in conjunction with the HDMI Forum for being able to provide HDMI 2.1+ capabilities with their open-source Linux kernel driver, but it looks like those efforts for now have concluded and failed. For three years there has been a bug report around 4K(a)120Hz being unavailable via HDMI 2.1 on the AMD Linux driver. Similarly, there have been bug reports like 5K @ 240Hz not possible either with the AMD graphics driver on Linux. As covered back in 2021, the HDMI Forum closing public specification access is hurting open-source support. AMD as well as the X.Org Foundation have been engaged with the HDMI Forum to try to come up with a solution to be able to provide open-source implementations of the now-private HDMI specs. AMD Linux engineers have spent months working with their legal team and evaluating all HDMI features to determine if/how they can be exposed in their open-source driver. AMD had code working internally and then the past few months were waiting on approval from the HDMI Forum. Sadly, the HDMI Forum has turned down AMD's request for open-source driver support.' -- source: https://it.slashdot.org/story/24/02/29/076217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cloudflare Makes Pingora Rust Framework Open-Source
by Peter Reutemann 29 Feb '24

29 Feb '24

'Michael Larabel reports via Phoronix: Back in 2022 Cloudflare announced they were ditching Nginx for an in-house, Rust-written software called Pingora. Today Cloudflare is open-sourcing the Pingora framework. Cloudflare announced today that they have open-sourced Pingora under an Apache 2.0 license. Pingora is a Rust async multi-threaded framework for building programmable network services. Pingora has long been used internally within Cloudflare and is capable of sustaining a lot of traffic while now Pingora is being open-sourced for helping to build infrastructure outside of Cloudflare.' -- source: https://news.slashdot.org/story/24/02/28/2352248 -- github: https://github.com/cloudflare/pingora Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 6 Released
by Peter Reutemann 29 Feb '24

29 Feb '24

'"Today, the KDE Community is announcing a new major release of Plasma 6.0 and Gear 24.02," writes longtime Slashdot reader jrepin. "The new version brings new windows and desktop overview effects, improved color management, a cleaner theme, better overall performance, and much more." From the announcement: KDE Plasma is a modern, feature-rich desktop environment for Linux-based operating systems. Known for its sleek design, customizable interface, and extensive set of applications, it is also open source, devoid of ads, and makes protecting your privacy and personal data a priority. With Plasma 6, the technology stack has undergone two major upgrades: a transition to the latest version of the application framework, Qt 6, and a migration to the modern Linux graphics platform, Wayland. We will continue providing support for the legacy X11 session for users who prefer to stick with it for now. [...] KDE Gear 24.02 brings many applications to Qt 6. In addition to the changes in Breeze, many applications adopted a more frameless look for their interface.' -- source: https://tech.slashdot.org/story/24/02/28/2137237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub besieged by millions of malicious repositories in ongoing attack
by Peter Reutemann 29 Feb '24

29 Feb '24

'GitHub is struggling to contain an ongoing attack that’s flooding the site with millions of code repositories. These repositories contain obfuscated malware that steals passwords and cryptocurrency from developer devices, researchers said. The malicious repositories are clones of legitimate ones, making them hard to distinguish to the casual eye. An unknown party has automated a process that forks legitimate repositories, meaning the source code is copied so developers can use it in an independent project that builds on the original one. The result is millions of forks with names identical to the original one that add a payload that’s wrapped under seven layers of obfuscation. To make matters worse, some people, unaware of the malice of these imitators, are forking the forks, which adds to the flood.' -- source: https://arstechnica.com/security/2024/02/github-besieged-by-millions-of-mal… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Open Documentation Academy' Offers On-Ramp To OSS
by Peter Reutemann 28 Feb '24

28 Feb '24

'"Documentation authors at Canonical have launched the Open Documentation Academy to offer an easy way to get started contributing to open-source projects," writes longtime Slashdot reader tykev. From the blog post: Open and inclusive collaboration, and the sharing of ideas, remains the best way to develop software (and to do many other things!), but we also recognise that this "getting involved" step can be difficult. Where do you start? Who do you ask? What needs to be done? We all very much want to help people become open source contributors by building an on-ramp process. It may take some time, and we will need to adapt, but this is exactly why we've started our Open Documentation Academy. To help you get involved, the Open Documentation Academy provides a curated list of documentation tasks. Choose one, let us know, and get started. Tasks include testing and fixing tutorials, updating the outdated, restructuring large documents, and anything else you may want to suggest. Our list is growing, and a big part of the Documentation Academy will be ensuring there's always a wide range of tasks available, across as many projects and technologies as possible. And of course, we're here to help. We'll guide you through your first contributions, provide advice on approaches, and help you build your confidence. ' -- source: https://news.slashdot.org/story/24/02/28/0024205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tumblr and Wordpress Are Preparing To Sell User Data To OpenAI and Midjourney, Report Says
by Peter Reutemann 28 Feb '24

28 Feb '24

'Tumblr and Wordpress are preparing to sell user data to Midjourney and OpenAI, 404Media reported Tuesday, citing a source with internal knowledge about the deals and internal documents. From the report: The exact types of data from each platform going to each company are not spelled out in documentation we've reviewed, but internal communications reviewed by 404 Media make clear that deals between Automattic, the platforms' parent company, and OpenAI and Midjourney are imminent. The internal documentation details a messy and controversial process within Tumblr itself. One internal post made by Cyle Gage, a product manager at Tumblr, states that a query made to prepare data for OpenAI and Midjourney compiled a huge number of user posts that it wasn't supposed to. It is not clear from Gage's post whether this data has already been sent to OpenAI and Midjourney, or whether Gage was detailing a process for scrubbing the data before it was to be sent. ' -- source: https://news.slashdot.org/story/24/02/27/191230 Now's the time to move from hosted to self-hosted Wordpress instances, I guess... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

US Government Demands Memory-Safe Programming Languages
by Lawrence D'Oliveiro 28 Feb '24

28 Feb '24

The US Office of the National Cyber Director has put out a report on “a path towards secure and measurable software” <https://devclass.com/2024/02/27/white-house-demands-memory-safe-programming…>. It talks a lot about memory safety, including hardware techniques such as the old “capabilities” idea being resurrected in the CHERI project. And the Rust Foundation has chimed in with some comments about use of their language which is specifically designed to enforce memory safety. But a group of C++ fans has counterclaimed that memory safety is only “a very small part of security”, and that “C++ benefits from having a formal specification, a fully-specified memory model, and an active community of users and implementers”, and that education can improve the quality of code written in C and C++. It also tries to imply that Rust is somehow less desirable because it lacks a formal specification.

1 0

Is Windows 64-Bit Yet?
by Lawrence D'Oliveiro 27 Feb '24

27 Feb '24

Given that 64-bit Windows has been shipping for so long, you would think most Windows software, particularly Microsoft’s own software, would have made the transition from 32-bit long ago. After all, on a typical 64-bit Linux system, everything is 64-bit, and has been that way since the early days. So I was mildly surprised to discover that Visual Studio only became 64-bit in November 2021. And today I am even more surprised to discover that the change broke its own Windows Forms framework, and a fix is still not available to this day <https://devclass.com/2024/02/26/microsoft-struggles-to-address-fallout-from…>.

1 0

The State Of IoT
by Lawrence D'Oliveiro 23 Feb '24

23 Feb '24

This backflip from Microsoft <https://www.theregister.com/2024/02/21/microsoft_azure_iot_central/> retracting an earlier announcement that seemingly undermined a major part of its “Internet-of-Things” efforts seems to do little to clear the confusion. I found this part of the report quite revealing: The insider also pointed out that vendors struggle to produce value for organizations developing and deploying IoT applications. While the industry underestimated the scale of the challenge in connecting thousands of sensors, each of which could generate 86,400 values per day, it also failed to form a commercial model that worked for everyone. Vendors were focused only on owning the platform and were reluctant to build applications on anyone else's, creating a stalemate, the insider said. Meanwhile, the “maker” movement continues on its merry way, building its applications and toolkits on (and for) open-source platforms like the Raspberry Pi and Arduino, while completely failing to spend billions of dollars on proprietary products. And the proprietary companies can do nothing but search desperately for some lever that will give them that valuable vendor lock-in, but all they can achieve is wrestle each other to a stalemate. Me, I consider that a win-win situation. ;)

1 0

Linux Becomes a CVE Numbering Authority (Like Curl and Python). Is This a Turning Point?
by Peter Reutemann 19 Feb '24

19 Feb '24

'From a blog post by Greg Kroah-Hartman: As was recently announced, the Linux kernel project has been accepted as a CVE Numbering Authority (CNA) for vulnerabilities found in Linux. This is a trend, of more open source projects taking over the haphazard assignments of CVEs against their project by becoming a CNA so that no other group can assign CVEs without their involvment. Here's the curl project doing much the same thing for the same reasons. I'd like to point out the great work that the Python project has done in supporting this effort, and the OpenSSF project also encouraging it and providing documentation and help for open source projects to accomplish this. I'd also like to thank the cve.org group and board as they all made the application process very smooth for us and provided loads of help in making this all possible. As many of you all know, I have talked a lot about CVEs in the past, and yes, I think the system overall is broken in many ways, but this change is a way for us to take more responsibility for this, and hopefully make the process better over time. It's also work that it looks like all open source projects might be mandated to do with the recent rules and laws being enacted in different parts of the world, so having this in place with the kernel will allow us to notify all sorts of different CNA-like organizations if needed in the future. Kroah-Hartman links to his post on the kernel mailing list for "more details about how this is all going to work for the kernel." [D]ue to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team are overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team... No CVEs will be assigned for unfixed security issues in the Linux kernel, assignment will only happen after a fix is available as it can be properly tracked that way by the git commit id of the original fix. No CVEs will be assigned for any issue found in a version of the kernel that is not currently being actively supported by the Stable/LTS kernel team. alanw (Slashdot reader #1,822) worries this could overwhelm the CVE infrastructure, pointing to an ongoing discussion at LWN.net. But reached for a comment, Greg Kroah-Hartman thinks there's been a misunderstanding. He told Slashdot that the CVE group "explicitly asked for this as part of our application... so if they are comfortable with it, why is no one else?"' -- source: https://linux.slashdot.org/story/24/02/17/1811258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nginx core developer quits project in security dispute, starts “freenginx” fork
by Peter Reutemann 16 Feb '24

16 Feb '24

'A core developer of Nginx, currently the world's most popular web server, has quit the project, stating that he no longer sees it as "a free and open source project… for the public good." His fork, freenginx, is "going to be run by developers, and not corporate entities," writes Maxim Dounin, and will be "free from arbitrary corporate actions." Dounin is one of the earliest and still most active coders on the open source Nginx project and one of the first employees of Nginx, Inc., a company created in 2011 to commercially support the steadily growing web server. Nginx is now used on roughly one-third of the world's web servers, ahead of Apache. Nginx Inc. was acquired by Seattle-based networking firm F5 in 2019. Later that year, two of Nginx's leaders, Maxim Konovalov and Igor Sysoev, were detained and interrogated in their homes by armed Russian state agents. Sysoev's former employer, Internet firm Rambler, claimed that it owned the rights to Nginx's source code, as it was developed during Sysoev's tenure at Rambler (where Dounin also worked). While the criminal charges and rights do not appear to have materialized, the implications of a Russian company's intrusion into a popular open source piece of the web's infrastructure caused some alarm. Sysoev left F5 and the Nginx project in early 2022. Later that year, due to the Russian invasion of Ukraine, F5 discontinued all operations in Russia. Some Nginx developers still in Russia formed Angie, developed in large part to support Nginx users in Russia. Dounin technically stopped working for F5 at that point, too, but maintained his role in Nginx "as a volunteer," according to Dounin's mailing list post. Dounin writes in his announcement that "new non-technical management" at F5 "recently decided that they know better how to run open source projects. In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers' position." While it was "quite understandable," given their ownership, Dounin wrote that it means he was "no longer able to control which changes are made in nginx," hence his departure and fork.' -- source: https://arstechnica.com/information-technology/2024/02/nginx-key-developer-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Asahi Linux Project's OpenGL Support On Apple Silicon Officially Surpasses Apple's
by Peter Reutemann 16 Feb '24

16 Feb '24

'Andrew Cunningham reports via Ars Technica: For around three years now, the team of independent developers behind the Asahi Linux project has worked to support Linux on Apple Silicon Macs, despite Apple's total lack of involvement. Over the years, the project has gone from a "highly unstable experiment" to a "surprisingly functional and usable desktop operating system." Even Linus Torvalds has used it to run Linux on Apple's hardware. The team has been steadily improving its open source, standards-conformant GPU driver for the M1 and M2 since releasing them in December 2022, and today, the team crossed an important symbolic milestone: The Asahi driver's support for the OpenGL and OpenGL ES graphics have officially passed what Apple offers in macOS. The team's latest graphics driver fully conforms with OpenGL version 4.6 and OpenGL ES version 3.2, the most recent version of either API. Apple's support in macOS tops out at OpenGL 4.1, announced in July 2010. Developer Alyssa Rosenzweig wrote a detailed blog post that announced the new driver, which had to pass "over 100,000 tests" to be deemed officially conformant. The team achieved this milestone despite the fact that Apple's GPUs don't support some features that would have made implementing these APIs more straightforward. "Regrettably, the M1 doesn't map well to any graphics standard newer than OpenGL ES 3.1," writes Rosenzweig. "While Vulkan makes some of these features optional, the missing features are required to layer DirectX and OpenGL on top. No existing solution on M1 gets past the OpenGL 4.1 feature set... Without hardware support, new features need new tricks. Geometry shaders, tessellation, and transform feedback become compute shaders. Cull distance becomes a transformed interpolated value. Clip control becomes a vertex shader epilogue. The list goes on." Now that the Asahi GPU driver supports the latest OpenGL and OpenGL ES standards -- released in 2017 and 2015, respectively -- the work turns to supporting the low-overhead Vulkan API on Apple's hardware. Vulkan support in macOS is limited to translation layers like MoltenVK, which translates Vulkan API calls to Metal ones that the hardware and OS can understand. [...] Rosenzweig's blog post didn't give any specific updates on Vulkan except to say that the team was "well on the road" to supporting it. In addition to supporting native Linux apps, supporting more graphics APIs in Asahi will allow the operating system to take better advantage of software like Valve's Proton, which already has a few games written for x86-based Windows PCs running on Arm-based Apple hardware. ' -- source: https://linux.slashdot.org/story/24/02/15/021216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Maker Mozilla Is Cutting 60 Jobs After Naming New CEO
by Peter Reutemann 14 Feb '24

14 Feb '24

'Less than a week after naming Laura Chambers as interim CEO, Firefox's maker Mozilla said it is cutting about 60 jobs, or 5% of its workforce. The cuts are primarily in the product development organization. Bloomberg reports: "We're scaling back investment in some product areas in order to focus on areas that we feel have the greatest chance of success," Mozilla said in a statement. "We intend to re-prioritize resources against products like Firefox Mobile, where there's a significant opportunity to grow and establish a better model for the industry." Mozilla last cut a significant number of jobs four years ago at the height of the Covid-19 pandemic. The not-for-profit company, which competes with Alphabet Inc.'s Google Chrome, Apple Inc.'s Safari and Microsoft Corp.'s Edge, has been grappling with sliding market share of its Firefox web browser in recent years. So far in 2024, the tech sector has cut 32,000 jobs. ' -- source: https://news.slashdot.org/story/24/02/13/2137254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HPC Wiki
by Lawrence D'Oliveiro 14 Feb '24

14 Feb '24

Recently discovered this site <https://hpc-wiki.info/hpc/HPC_Wiki>, which gives some useful introductory info to those wanting to learn how to program a supercomputer (or just curious about the process). For example, here <https://hpc-wiki.info/hpc/MPI> is an intro to one parallelization architecture, called MPI, and here <https://hpc-wiki.info/hpc/OpenMP> is an intro to another one, called OpenMP. Note the examples are given in C and Fortran, and both rely heavily on preprocessors/compiler plugins in order to generate the right code. Yes, Fortran is still in heavy use, it seems. And if you learned your Fortran before the 1990s (as I did), you may not even recognize it as the same language.

1 0

'Damn Small Linux' is Back - But Bigger
by Peter Reutemann 13 Feb '24

13 Feb '24

'Back in 2006 Slashdot reported on a 50-megabyte "micro" distro called Damn Small Linux. (And in 2012 we wrote that it "rose from the dead" with a new release candidate.) Now Damn Small Linux has been reborn again, according to its developer's web site: Creating the original DSL, a versatile 50MB distribution, was a lot of fun and one of the things I am most proud of as a personal accomplishment. However, as a concept, it was in the right place at the right time, and the computer industry has changed a lot since then. While it would be possible to make a bootable Xwindows 50MB distribution today, it would be missing many drivers and have only a handful of very rudimentary applications. People would find such a distribution a fun toy or something to build upon, but it would not be usable for the average computer user out of the gate.... The new goal of DSL is to pack as much usable desktop distribution into an image small enough to fit on a single CD, or a hard limit of 700MB. This project is meant to service older computers and have them continue to be useful far into the future. Such a notion sits well with my values. I think of this project as my way of keeping otherwise usable hardware out of landfills. As with most things in the GNU/Linux community, this project continues to stand on the shoulders of giants. I am just one guy without a CS degree, so for now, this project is based on antiX 23 i386... a fantastic distribution that I think shares much of the same spirit as the original DSL project. AntiX shares pedigree with MEPIS and also leans heavily on the geniuses at Debian. The blog It's FOSS News describes it as "a unique experience in a sea of Debian-based and Fedora-based distros." It is offered with two window managers, Fluxbox and JWM, with apt being fully enabled by default for easy package installations... At the time of writing, only the Alpha ISOs were made available on the official downloads page. It is only a matter of time before we get a stable release.' -- source: https://linux.slashdot.org/story/24/02/11/2049252 I actually used DSL back in the day... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Mozilla's Abandoned Web Engine 'Servo' is Rebooting in 2024
by Peter Reutemann 12 Feb '24

12 Feb '24

'Remember "Servo," Mozilla's "next-generation browser engine," focused on performance and robustness? "The developers of Servo are starting 2024 by going all in..." reports It's FOSS News, citing a social media post from FOSDEM. "[T]he Servo Project team were there showing off the work done so far." If you were not familiar, Servo is an experimental browser engine that leverages the power of Rust to provide a memory-safe and modular experience that is highly adaptable. After Mozilla created Servo back in 2012 as a research project, it saw its share of ups and downs over the years, with it making a comeback in 2023; thanks to a fresh approach by the developers on how Servo should move forward. Even though there are plenty of open source Chrome alternatives, with this, there's a chance that we will get some really cool options based on Servo that just might give Blink and Gecko a run for the money! Just a few months back, in September 2023, after The Servo Project officially joined Linux Foundation Europe, the existing contributors from Igalia stepped up their game by taking over the project maintenance. To complement that, at Open Source Summit Europe last year, Manuel Rego from Igalia shared some really useful insights when he presented. He showcased stuff like the WebGL support, cross-platform support including mobile support for Android and Linux, among other things. They have experimented with Servo for embedded applications use-cases (like running it on Raspberry Pi), and have plans to make advances on it. As far as I can see, it looks like, Servo is faster for Raspberry Pi compared to Chromium. You can explore more such demos on Servo's demo webpage. 2024's roadmap includes "Initial Android support, that will see Servo being made to build on modern Android versions," according to the article, "with the developers publishing nightly APKs on the official website some time in the future." One fun fact? "Even though Mozilla dropped the experimental project, Firefox still utilizes some servo components in the browser" Another FOSDOM update from social media: "Thunderbird is also embracing Rust."' -- source: https://news.slashdot.org/story/24/02/11/2024233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ANZ Bank Tries GitHub Copilot, Likes What It Sees
by Lawrence D'Oliveiro 11 Feb '24

11 Feb '24

ANZ Bank tried a study with its in-house Python programmers <https://www.theregister.com/2024/02/10/anz_bank_github_copilot/>, and found "The group that had access to GitHub Copilot was able to complete their tasks 42.36 percent faster than the control group participants," the report says. "...The code produced by Copilot participants contained fewer code smells and bugs on average, meaning it would be more maintainable and less likely to break in production." In terms of code security, they didn’t find that Copilot helped, but neither did it make things worse. But then, these were relatively simple programming exercises. The report also cites another study which found that AI assistance is leading to lower code quality.

1 0

Mozilla Names New CEO as It Pivots To Data Privacy
by Peter Reutemann 09 Feb '24

09 Feb '24

'Mozilla, which manages the open-source Firefox browser, announced today that Mitchell Baker is stepping down as CEO to focus on AI and internet safety as chair of the nonprofit foundation. Laura Chambers, a Mozilla board member and entrepreneur with experience at Airbnb, PayPal, and eBay, will step in as interim CEO to run operations until a permanent replacement is found. Fortune: Baker, a Silicon Valley pioneer who co-founded the Mozilla Project, says it was her decision to step down as CEO, adding that the move is motivated by a sense of urgency over the current state of the internet and public trust. "We want to offer an alternative for people to have better products," says Baker, who wants to draw more attention to policies, products and processes to challenge business models built on fueling outrage. "What are the connections between this global malaise and how humans are engaging with each other and technology?" Chambers says she plans to focus on building out new products that address growing privacy concerns while actively looking for a full-time CEO. Prior to being recruited to the Mozilla board three years ago, Chambers says she was feeling "pretty disillusioned" about society because of the influence of money in politics and the growing power of the tech giants. "I was confused about what to do and this felt like a genuine way to make an impact." Chambers says she won't be seeking a permanent CEO role because she plans to move back to Australia later this year for family reasons. "I think this is an example of Mozilla doing the right role modelling in how to manage a succession," says Chambers. ' -- source: https://news.slashdot.org/story/24/02/08/1511234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Critical Vulnerability Affecting Most Linux Distros Allows For Bootkits
by Peter Reutemann 08 Feb '24

08 Feb '24

'Linux developers are in the process of patching a high-severity vulnerability that, in certain cases, allows the installation of malware that runs at the firmware level, giving infections access to the deepest parts of a device where they're hard to detect or remove. ArsTechnica: The vulnerability resides in shim, which in the context of Linux is a small component that runs in the firmware early in the boot process before the operating system has started. More specifically, the shim accompanying virtually all Linux distributions plays a crucial role in secure boot, a protection built into most modern computing devices to ensure every link in the boot process comes from a verified, trusted supplier. Successful exploitation of the vulnerability allows attackers to neutralize this mechanism by executing malicious firmware at the earliest stages of the boot process before the Unified Extensible Firmware Interface firmware has loaded and handed off control to the operating system. The vulnerability, tracked as CVE-2023-40547, is what's known as a buffer overflow, a coding bug that allows attackers to execute code of their choice. It resides in a part of the shim that processes booting up from a central server on a network using the same HTTP that the the web is based on. Attackers can exploit the code-execution vulnerability in various scenarios, virtually all following some form of successful compromise of either the targeted device or the server or network the device boots from. "An attacker would need to be able to coerce a system into booting from HTTP if it's not already doing so, and either be in a position to run the HTTP server in question or MITM traffic to it," Matthew Garrett, a security developer and one of the original shim authors, wrote in an online interview. "An attacker (physically present or who has already compromised root on the system) could use this to subvert secure boot (add a new boot entry to a server they control, compromise shim, execute arbitrary code)."' -- source: https://linux.slashdot.org/story/24/02/07/1749248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Overzealous Spam Filters
by Lawrence D'Oliveiro 07 Feb '24

07 Feb '24

Two recent news items about important messages being lost in the recipients’ spam filters. Some months ago, the Banking Ombudsman sent out a warning about investment scams to various financial institutions, but the ANZ never saw theirs <https://www.nzherald.co.nz/nz/anz-misses-investment-scam-warning-from-banki…>. One scam victim believes that her case might have been caught sooner if the bank had taken suitable notice of such a warning. And a US-based team wanted to join Formula 1, but it seems they never got the invitation to meet in person to discuss their application, because it got classed as spam <https://arstechnica.com/cars/2024/02/a-spam-folder-may-have-foiled-andretti…>. And so their application was rejected. But then, in this case you’d think more than one attempt would have been made to get in touch. In both cases, the sender address would have been something unusual, not the kind of thing you or I might see in our in-box (in one case, the Banking Ombudsman, in the other case, the Formula 1 rights body). If we got such a message, it would be wise to score it as being more likely to be some sort of scam. But for organizations that work in those areas that are more likely to engage in such communications, it would make sense to customize their spam filters in the opposite direction, don’t you think?

2 2

Enabling Case-Insensitive Filenames On Linux
by Lawrence D'Oliveiro 06 Feb '24

06 Feb '24

The ext4 filesystem has had the “casefold” option for a while now <https://lwn.net/Articles/784041/>. This allows you to specify, when you initialize a new filesystem, that you want file/directory names to be treated as case-insensitive. At the same time, you have to specify that the filenames are to be interpreted as UTF-8 encoding; normally the kernel doesn’t care, it only singles out ASCII slash and NUL bytes for special interpretation, and simply passes through any other byte values in the names. I was able to create such a filesystem, but I wasn’t able to mount it in my last-upgraded-just-a-few-days-ago Debian Unstable setup. When I try, it fails, and in the dmesg log I see Filesystem with casefold feature cannot be mounted without CONFIG_UNICODE Turns out the Debian 5.10 kernel has not been built with this CONFIG_UNICODE option enabled. However, this situation looks set to change shortly, according to <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985689>.

2 3

browsh
by Peter Reutemann 06 Feb '24

06 Feb '24

Hi everyone Just came across browsh: 'A fully interactive, real-time, and modern text-based browser rendered to TTYs and browsers' https://github.com/browsh-org/browsh Seems like a cool way of browsing in the shell. I've used lynx in the past for that. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a Microsoft Update Broke VS Code Editor on Ubuntu
by Peter Reutemann 05 Feb '24

05 Feb '24

'Microsoft's Visual Studio Code editor now includes a voice command that launches GitHub Copilot Chat just by saying "Hey Code." But one Linux blog notes that the editor has suddenly stopped supporting Ubuntu 18.04 LTS — "a move causing issues for scores of developers." VS Code 1.86 (aka the 'January 2024' update) saw Microsoft bump the minimum build requirements for the text editor's popular remote dev tools to â¥glibc 2.28 — but Ubuntu 18.04 LTS uses glibc 2.27, ergo they no longer work. While Ubuntu 18.04 is supported by Canonical until 2028 (through ESM) a major glibc upgrade is unlikely. Thus, this "breaking change" is truly breaking workflows... It seems affected developers were caught off-guard as this (rather impactful) change was not signposted before, during, or after the VS Code update (which is installed automatically for most, and the update was pushed out to Ubuntu 18.04 machines). Indeed, most only discovered this issue after update was installed, they tried to connect to a remote server, and discovered it failed. The resulting error message does mention deprecation and links to an FAQ on the VS Code website with workarounds (i.e. downgrade). But as one developer politely put it.... "It could have checked the libc versions and refused the update. Now, many people are screwed in the middle of their work." The article points out an upgrade to Ubuntu 20.04 LTS will address the problem. On GitHub a Microsoft engineer posted additional options from VS Code's documentation: If you are unable to upgrade your Linux distribution, the recommended alternative is to use our web client. If you would like to use the desktop version, then you can download the VS Code release 1.85. Depending on your platform, make sure to disable updates to stay on that version. Microsoft then locked the thread on GitHub as "too heated" and limited conversation to just collaborators. In a related thread someone suggested installing VS Code's Flatpak, which was still on version 1.85 — and then disabling updates. But soon Microsoft had locked that thread as well as "too heated," again limiting conversation to collaborators.' -- source: https://linux.slashdot.org/story/24/02/04/0116229 When you can't take criticism for a balls-up, lock the discussion thread! Hmm... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LibreOffice 24.2 Delivers Advanced Features and Global Accessibility
by Peter Reutemann 02 Feb '24

02 Feb '24

'The Document Foundation has officially launched LibreOffice 24.2, which is now available for download for Windows, macOS, and Linux platforms. This release introduces a new calendar-based version numbering system (YY.M). Here’s what it’s all about. The latest major release of the well-known office suite was 7.6. However, this is set to change with the introduction of 24.2, as the version numbering will now follow a “year.month” pattern, similar to that used by Ubuntu releases, for example. This change aims to simplify version identification for end users, making it more intuitive to understand.' -- source: https://linuxiac.com/libreoffice-24-2-delivers-advanced-features-and-global… ...and here I was, thinking that I missed a truckload of releases. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Microsoft Stole My Chrome Tabs, and It Wants Yours, Too'
by Peter Reutemann 31 Jan '24

31 Jan '24

'Tom Warren, writing for The Verge: Last week, I turned on my PC, installed a Windows update, and rebooted to find Microsoft Edge automatically open with the Chrome tabs I was working on before the update. I don't use Microsoft Edge regularly, and I have Google Chrome set as my default browser. Bleary-eyed at 9AM, it took me a moment to realize that Microsoft Edge had simply taken over where I'd left off in Chrome. I never imported my data into Microsoft Edge, nor did I confirm whether I wanted to import my tabs. But here was Edge automatically opening after a Windows update with all the Chrome tabs I'd been working on. I didn't even realize I was using Edge at first, and I was confused why all my tabs were suddenly logged out. After the shock wore off, I looked to make sure I hadn't accidentally allowed this behavior. I found a setting in Microsoft Edge that imports data from Google Chrome on each launch. "Always have access to your recent browsing data each time you browse on Microsoft Edge," reads Microsoft's description of the feature in Edge. This setting was disabled, and I had never been asked to turn it on. So I went to install the same Windows update on a laptop, which actually resulted in it failing and my having to do a system restore. Once the system restore was complete, the same thing happened. Edge opened automatically with all of my Chrome tabs. I haven't been able to replicate the behavior on other PCs, but a number of X users replied to my post about this saying they have experienced the same thing in the past.' -- source: https://it.slashdot.org/story/24/01/30/1824233 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Is Planning a London IPO, But Its CEO Expects 'No Change' In Focus
by Peter Reutemann 31 Jan '24

31 Jan '24

'Ars Technica: The business arm of Raspberry Pi is preparing to make an initial public offering (IPO) in London. CEO Eben Upton tells Ars that should the IPO happen, it will let Raspberry Pi's not-for-profit side expand by "at least a factor of 2X." And while it's "an understandable thing" that Raspberry Pi enthusiasts could be concerned, "while I'm involved in running the thing, I don't expect people to see any change in how we do things." CEO Eben Upton confirmed in an interview with Bloomberg News that Raspberry Pi had appointed bankers at London firms Peel Hunt and Jefferies to prepare for "when the IPO market reopens." Raspberry previously raised money from Sony and semiconductor and software design firm ARM, and it sought public investment. Upton denied or didn't quite deny IPO rumors in 2021, and Bloomberg reported Raspberry Pi was considering an IPO in early 2022. After ARM took a minority stake in the company in November 2023, Raspberry Pi was valued at roughly 400 million pounds, or just over $500 million. Given the company's gradual recovery from pandemic supply chain shortages, and the success of the Raspberry Pi 5 launch, the company's IPO will likely jump above that level, even with a listing in the UK rather than the more typical US IPO. Upton told The Register that "the business is in a much better place than it was last time we looked at it [an IPO]. We partly stopped because the markets got bad. And we partly stopped because our business became unpredictable." "It's a good thing, in that people care about us," Upton said in response to concerned hobbyists and tech enthusiasts. "What Raspberry Pi [builds] are the products we want to buy, and then we sell them to people like us," Upton said. "Certainly, while I'm involved in it, I can't imagine an environment in which the hobbyists are not going to be incredibly important." The IPO is "about the foundation," Upton said, with that charitable arm selling some of its majority stake in the business entity to raise funds and expand. "We've not cooked up some new way for a not-for-profit to do an IPO, no," he noted. [He told Ars that Raspberry Pi's business arm has had both strategic and private investors in its history, along with a majority shareholder in its Foundation (which in 2016 owned 75 percent of shares), and that he doesn't see changes to what Pi has built. He also noted that the foundation was previously funded by dividends from the business side.] "We do this transaction, and the proceeds of that transaction allow the foundation to train teachers, run clubs, expand programs, and ... do those things at, at least, a factor of 2X. That's what I'm most excited about." Upton said there would be "no change" to the kinds of products Pi makes, and that makers are "culturally important to us." [...] "If people think that an IPO means we're going to ... push prices up, push the margins up, push down the feature sets, the only answer we can give is, watch us. Keep watching," he said. "Let's look at it in 15, 20 years' time."' -- source: https://hardware.slashdot.org/story/24/01/30/2212232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux On Mars: The Final Chapter
by Lawrence D'Oliveiro 30 Jan '24

30 Jan '24

You may have heard that the “Ingenuity” helicopter, which has been flying on Mars for the last three years, came a cropper and broke one of its rotor blades a couple of weeks ago. Not bad for a project that was really put together as an afterthought, a proof of concept that was planned to maybe last 30 days and make five flights at most. Here <https://arstechnica.com/space/2024/01/now-that-weve-flown-on-mars-what-come…> is a description of some more details of how it was put together, within stringent limits on both mass and money. Apparently, a radiation-hardened RAD750 computer, which is normally used for such space missions, costs a quarter of a million USD. And would have weighed too much anyway. So they used a cheap, lightweight Qualcomm chip instead, state of the art for smartphones of just a few years ago. And massively more powerful. And of course they ran off-the-shelf open-source software on it <https://www.jpl.nasa.gov/news/meet-the-open-source-software-powering-nasas-…>, <https://www.theverge.com/2021/2/19/22291324/linux-perseverance-mars-curiosi…>, <https://spectrum.ieee.org/nasa-designed-perseverance-helicopter-rover-fly-a…>. Flying a chopper on Mars isn’t easy: the rotor tips on Ingenuity were moving at Mach 0.65 (on Mars, Mach 1.0, the speed of sound, is about 240m/s). A future chopper is planned to push this to Mach 0.95. You might say they were cutting corners on this design, which made it inherently more risky. But if the lower costs and simpler development can lead to shorter lead times, and hence more missions, maybe a higher failure rate would be worth it.

1 0

Remembering Unix Desktops - and What We Can Learn From Them
by Peter Reutemann 29 Jan '24

29 Jan '24

'"As important as its historically underhanded business dealings were for its success, Microsoft didn't have to cheat to win," argues a new article in the Register. "The Unix companies were doing a great job of killing themselves off." You see, while there were many attempts to create software development standards for Unix, they were too general to do much good — for example Portable Operating System Interface (POSIX) — or they became mired in the business consortium fights between the Open Systems Foundation and Unix International, which became known as the Unix wars. While the Unix companies were busy ripping each other to shreds, Microsoft was smiling all the way to the bank. The core problem was that the Unix companies couldn't settle on software standards. Independent Software Vendors (ISV) had to write applications for each Unix platform. Each of these had only a minute desktop market share. It simply made no business sense for programmers to write one version of an application for SCO OpenDesktop (also known as OpenDeathtrap), another for NeXTStep, and still another one for SunOS. Does that sound familiar? That kind of thing is still a problem for the Linux desktop, and it's why I'm a big fan of Linux containerized desktop applications, such as Red Hat's Flatpak and Canonical's Snap. By the time the two sides finally made peace by joining forces in The Open Group in 1996, it was too late. Unix was crowded out on the conventional desktop, and the workstation became pretty much a Sun Microsystems-only play. Linux's GPL license created an "enforced" consortia that allowed it to take over, according to the article — and with Linus Torvalds as Linux's single leader, "it avoided the old Unix trap of in-fighting... I've been to many Linux Plumbers meetings. There, I've seen him and the top Linux kernel developers work with each other without any drama. Today's Linux is a group effort... The Linux distributors and developers have learned their Unix history lessons. They've realized that it takes more than open source; it takes open standards and consensus to make a successful desktop operating system. And the article also points out that one of those early Unix desktops "is still alive, well, and running in about one in four desktops." That operating system, of course, is macOS X, the direct descendent of NeXT's NeXTSTEP. You could argue that macOS, based on the multi-threaded, multi-processing microkernel operating system Mach, BSD Unix, and the open source Darwin, is the most successful of all Unix operating systems. ' -- source: https://tech.slashdot.org/story/24/01/28/0241228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

I abandoned OpenLiteSpeed and went back to good ol’ Nginx
by Peter Reutemann 29 Jan '24

29 Jan '24

'Since 2017, in what spare time I have (ha!), I help my colleague Eric Berger host his Houston-area weather forecasting site, Space City Weather. It’s an interesting hosting challenge—on a typical day, SCW does maybe 20,000–30,000 page views to 10,000–15,000 unique visitors, which is a relatively easy load to handle with minimal work. But when severe weather events happen—especially in the summer, when hurricanes lurk in the Gulf of Mexico—the site’s traffic can spike to more than a million page views in 12 hours. That level of traffic requires a bit more prep to handle. For a very long time, I ran SCW on a backend stack made up of HAProxy for SSL termination, Varnish Cache for on-box caching, and Nginx for the actual web server application—all fronted by Cloudflare to absorb the majority of the load. (I wrote about this setup at length on Ars a few years ago for folks who want some more in-depth details.) This stack was fully battle-tested and ready to devour whatever traffic we threw at it, but it was also annoyingly complex, with multiple cache layers to contend with, and that complexity made troubleshooting issues more difficult than I would have liked. So during some winter downtime two years ago, I took the opportunity to jettison some complexity and reduce the hosting stack down to a single monolithic web server application: OpenLiteSpeed.' -- source: https://arstechnica.com/gadgets/2024/01/i-abandoned-openlitespeed-and-went-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unix Pioneer Ken Thompson Has Abandoned Apple For Linux
by Lawrence D'Oliveiro 28 Jan '24

28 Jan '24

Something I didn’t hear about, which happened earlier last year <https://forums.freebsd.org/threads/unix-pioneer-ken-thompson-announces-hes-…>. Ken Thompson, one of the original Bell Labs crew that created Unix, now 80 years old, was asked what OS he uses, and he replied: I have, for most of my life — because I was sort of born into it — run Apple. Now recently, meaning within the last five years, I've become more and more depressed, and what Apple is doing to something that should allow you to work is just atrocious. But they are taking a lot of space and time to do it, so it's okay. And I have come, within the last month or two, to say, even though I've invested, you know, a zillion years in Apple — I'm throwing it away. And I'm going to Linux. To Raspbian in particular.

1 0

OpenWrt, now 20 years old, is crafting its own future-proof reference hardware
by Peter Reutemann 24 Jan '24

24 Jan '24

'OpenWrt, the open source firmware that sprang from Linksys' use of open source code in its iconic WRT54G router and subsequent release of its work, is 20 years old this year. To keep the project going, lead developers have proposed creating a "fully upstream supported hardware design," one that would prevent the need for handling "binary blobs" in modern router hardware and let DIY router enthusiasts forge their own path. OpenWRT project members, 13 of which signed off on this hardware, are keeping the "OpenWrt One" simple, while including "some nice features we believe all OpenWrt supported platforms should have," including "almost unbrickable" low-level firmware, an on-board real-time clock with a battery backup, and USB-PD power. The price should be under $100 and the schematics and code publicly available. But OpenWrt will not be producing or selling these boards, "for a ton of reasons." The group is looking to the Banana Pi makers to distribute a fitting device, with every device producing a donation to the Software Freedom Conservancy earmarked for OpenWrt. That money could then be used for hosting expenses, or "maybe an OpenWrt summit."' -- source: https://arstechnica.com/gadgets/2024/01/openwrt-now-20-years-old-is-craftin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Easy Relative Symbolic Links
by Lawrence D'Oliveiro 23 Jan '24

23 Jan '24

You probably know about the “ln” command to create a new link to an existing file. You probably know about “ln -s” to create a symbolic link. But did you know about “ln -rs” to easily create relative symbolic links? Relative links are often preferable to absolute ones, because that way they stay valid if the whole containing directory tree is moved to a different location (e.g. as the result of a bind mount). But typing the right number of “../” prefixes can get quite fiddly. And if you want to rely on autocomplete to help, you have to change directory to the destination where the symlink is to be created. Instead, a simpler way is to use “ln -rs”, then use autocomplete from wherever you are to get to the right source file/directory, and the ln command will automatically convert the resulting path, whatever it might be (either absolute or relative to your current working directory) to a suitable relative one based on the destination for the link. <https://manpages.debian.org/ln.1.en.html>

1 1

HP Says The Quiet Part Out Loud
by Lawrence D'Oliveiro 23 Jan '24

23 Jan '24

You’d think, if you were buying a printer, you were the one making the investment, and expecting an outcome of suitable print quality (and quantity) in return. But not, it seems, if you buy an HP printer. Company boss Enrique Lores has made it quite clear <https://www.theregister.com/2024/01/19/hps_ceo_spells_it_out/>: "Every time a customer buys a printer, it's an investment for us. We are investing in that customer, and if that customer doesn't print enough or doesn't use our supplies, it's a bad investment." If you think this is some offhand remark, taken out of context or something, how about this statement from December, by their CFO of the time: "We absolutely see when you move a customer from that pure transactional model ... whether it's Instant Ink, plus adding on that paper, we sort of see a 20 percent uplift on the value of that customer because you're locking that person, committing to a longer-term relationship." In short, they are going to squeeze you for as much ink revenue as they can. Third-party ink cartridges are obviously a threat to this business model, that must be exterminated. I wonder, if they could figure out how to make you get the paper from them as well, they wouldn’t do that ... oh wait ... she already mentioned paper ...

2 2

Timezone Data Changes
by Lawrence D'Oliveiro 23 Jan '24

23 Jan '24

The maintainers of the timezone database (tzdata) have been cleaning up some things lately. Namely, removing all the alias names that are not of the common IANA «region»/«city» form, but refer to specific countries, from the core package. NZ’s two timezones, “NZ” and “NZ-CHAT” were among these special cases. Also the ones beginning “US/” for the various timezones in the USA. <https://tracker.debian.org/news/1451157/accepted-tzdata-2023c-8-source-into…> <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040997> <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056908> These latter names are still available if you install the “tzdata-legacy” package. So you need to have that installed if you want to continue setting “TZ=NZ”. Either that, or learn to start saying “TZ=Pacific/Auckland” instead.

1 0

All This AI Stuff Costs A Lot Of Money
by Lawrence D'Oliveiro 21 Jan '24

21 Jan '24

According to this article <https://arstechnica.com/gadgets/2024/01/alexa-is-in-trouble-paid-for-alexa-…> (based on anonymous sources), Amazon is on a struggle to make money out of its Alexa service, particularly a new, “Generative-AI”-based version coming out at some non-yet-publicly-disclosed point. I was flabbergasted at this: Amazon has to do something to turn Alexa into a viable revenue source. In late 2022, Insider reported that Alexa was on track to lose Amazon $10 billion that year. The following months were filled with numerous layoffs at Amazon ... $10 billion!? I wonder how much of that is *not* the electricity bills for running all the servers ...

1 0

Rust-Written Linux Scheduler Continues Showing Promising Results For Gaming
by Peter Reutemann 21 Jan '24

21 Jan '24

'"A Canonical engineer has been experimenting with implementing a Linux scheduler within the Rust programming language..." Phoronix reported Monday, "that works via sched_ext for implementing a scheduler using eBPF that can be loaded during run-time." The project was started "just for fun" over Christmas, according to a post on X by Canonical-based Linux kernel engineer Andrea Righi, adding "I'm pretty shocked to see that it doesn't just work, but it can even outperform the default Linux scheduler (EEVDF) with certain workloads (i.e., gaming)." Phoronix notes the a YouTube video accompanying the tweet shows "a game with the scx_rustland scheduler outperforming the default Linux kernel scheduler while running a parallel kernel build in the background." "For sure the build takes longer," Righi acknowledged in a later post. "This scheduler doesn't magically makes everything run faster, it simply prioritizes more the interactive workloads vs CPU-intensive background jobs." Righi followed up by adding "And the whole point of this demo was to prove that, despite the overhead of running a scheduler in user-space, we can still achieve interesting performance, while having the advantages of being in user-space (ease of experimentation/testing, reboot-less updates, etc.)" Wednesday Righi added some improvements, posting that "Only 19 lines of code (comments included) for ~2x performance improvement on SMT isn't bad... and I spent my lunch break playing Counter Strike 2 to test this patch..." And work seems to be continuing, judging by a fresh post from Righi on Thursday. "I fixed virtme-ng to run inside Docker and used it to create a github CI workflow for sched-ext that clones the latest kernel, builds it and runs multiple VMs to test all the scx schedulers. And it does that in only ~20min. I'm pretty happy about virtme-ng now."' -- source: https://developers.slashdot.org/story/24/01/20/0716232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Network Time Man's Time Has Ended
by Lawrence D'Oliveiro 20 Jan '24

20 Jan '24

Dave Mills, creator of NTP, the Network Time Protocol that keeps all our computer clocks synced to within hundredths of a second, has passed away at the age of 85 <https://arstechnica.com/gadgets/2024/01/inventor-of-ntp-protocol-that-keeps…>.

1 0

Just 10 lines of code can steal AI secrets from Apple, AMD, and Qualcomm GPUs
by Peter Reutemann 18 Jan '24

18 Jan '24

'As more companies ramp up development of artificial intelligence systems, they are increasingly turning to graphics processing unit (GPU) chips for the computing power they need to run large language models (LLMs) and to crunch data quickly at massive scale. Between video game processing and AI, demand for GPUs has never been higher, and chipmakers are rushing to bolster supply. In new findings released today, though, researchers are highlighting a vulnerability in multiple brands and models of mainstream GPUs—including Apple, Qualcomm, and AMD chips—that could allow an attacker to steal large quantities of data from a GPU’s memory. The silicon industry has spent years refining the security of central processing units, or CPUs, so they don’t leak data in memory even when they are built to optimize for speed. However, since GPUs were designed for raw graphics processing power, they haven’t been architected to the same degree with data privacy as a priority. As generative AI and other machine learning applications expand the uses of these chips, though, researchers from New York-based security firm Trail of Bits say that vulnerabilities in GPUs are an increasingly urgent concern. “There is a broader security concern about these GPUs not being as secure as they should be and leaking a significant amount of data,” Heidy Khlaaf, Trail of Bits’ engineering director for AI and machine learning assurance, tells WIRED. “We’re looking at anywhere from 5 megabytes to 180 megabytes. In the CPU world, even a bit is too much to reveal.” To exploit the vulnerability, which the researchers call LeftoverLocals, attackers would need to already have established some amount of operating system access on a target’s device. Modern computers and servers are specifically designed to silo data so multiple users can share the same processing resources without being able to access each others’ data. But a LeftoverLocals attack breaks down these walls. Exploiting the vulnerability would allow a hacker to exfiltrate data they shouldn’t be able to access from the local memory of vulnerable GPUs, exposing whatever data happens to be there for the taking, which could include queries and responses generated by LLMs as well as the weights driving the response.' -- source: https://arstechnica.com/security/2024/01/new-attack-steals-ai-secrets-from-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Generating PDF Files From man Pages
by Lawrence D'Oliveiro 17 Jan '24

17 Jan '24

I’ve been writing documentation for some of my published scripts in the form of man pages. The troff/groff markup is not hard to get to grips with--the man pages for the relevant tools have a lot of useful info. And it’s easy to view the results without any special installation step, since the man(1) command includes the “-l” option to treat its argument as a file name. But if the topic name has any slashes in it, such treatment is automatic without even needing this option. Thus, in my project source directory, I can type something as simple as man ./render-batch.1 to view the man page I wrote for the “render-batch” command. Conversion to PDF is easy, too, using the underlying groff command that man itself uses to format the page, just specifying a different output “device” (i.e. format), e.g. groff -man -Tpdf «troff-file» >«output-file» Or, if I don’t want to save the output PDF file, but just pipe it straight to a viewer like Okular, this works: groff -man -Tpdf «troff-file» | okular - This is particularly useful, for example, for debugging the difference between dashes and hyphens. You are supposed to use “\-” for the hyphen-minus character (as used to prefix command-line options, for example), while hyphens in regular text should be written as “-”. The two look the same in a normal man-page view, but they get rendered differently in PDF files. However, I found that groff does not correctly render various Unicode UTF-8 characters when generating PDF output. For example, I like to use curly quotes “”. These look OK in regular man output, but get turned into junk in PDF output. After some searching online, it appears this is a known limitation of groff, because it uses various 8-bit byte codes internally for its own purposes, precluding their use as part of UTF-8 encoding. But there is a tool called “preconv” that can convert various encodings into a more groff-friendly text representation. For example preconv -e utf-8 «troff-file» | groff -man -Tpdf | okular - Since my locale is set to a UTF-8 one by default, I don’t even need the “-e” option: preconv «troff-file» | groff -man -Tpdf | okular - Or, if you want to save the output: preconv «troff-file» | groff -man -Tpdf >«output-file» Going back to the example filename I used before, these translate to something like preconv render-batch.1 | groff -man -Tpdf | okular - preconv render-batch.1 | groff -man -Tpdf >render-batch.pdf Another variation is to use preconv «troff-file» | groff -man -Tpdf | { okular - & } This spawns the Okular part of the pipeline in the background, so it comes back to the shell prompt immediately that starts running. This is convenient with a GUI tool like Okular, because I can run other commands while continuing to view the output PDF file. So how is it that groff is capable of handling these characters just fine when invoked via man? That I haven’t figured out yet ...

1 2

Chrome Updates Incognito Warning To Admit Google Tracks Users In 'Private' Mode
by Peter Reutemann 17 Jan '24

17 Jan '24

'Ars Technica: Google is updating the warning on Chrome's Incognito mode to make it clear that Google and websites run by other companies can still collect your data in the web browser's semi-private mode. The change is being made as Google prepares to settle a class-action lawsuit that accuses the firm of privacy violations related to Chrome's Incognito mode. The expanded warning was recently added to Chrome Canary, a nightly build for developers. The warning appears to directly address one of the lawsuit's complaints, that the Incognito mode's warning doesn't make it clear that Google collects data from users of the private mode. Many tech-savvy people already know that while private modes in web browsers prevent some data from being stored on your device, they don't prevent tracking by websites or Internet service providers. But many other people may not understand exactly what Incognito mode does, so the more specific warning could help educate users. The new warning seen in Chrome Canary when you open an incognito window says: "You've gone Incognito. Others who use this device won't see your activity, so you can browse more privately. This won't change how data is collected by websites you visit and the services they use, including Google." The wording could be interpreted to refer to Google websites and third-party websites, including third-party websites that rely on Google ad services. The new warning was not yet in the developer, beta, and stable branches of Chrome as of today. It also wasn't in Chromium. The change to Canary was previously reported by MSPowerUser. Incognito mode in the stable version of Chrome still says: "You've gone Incognito. Now you can browse privately, and other people who use this device won't see your activity." Among other changes, the Canary warning replaces "browse privately" with "browse more privately." The stable and Canary warnings both say that your browsing activity might still be visible to "websites you visit," "your employer or school," or "your Internet service provider." But only the Canary warning currently includes the caveat that Incognito mode "won't change how data is collected by websites you visit and the services they use, including Google." The old and new warnings both say that Incognito mode prevents Chrome from saving your browsing history, cookies and site data, and information entered in forms, but that "downloads, bookmarks and reading list items will be saved." Both warnings link to this page, which provides more detail on Incognito mode.' -- source: https://yro.slashdot.org/story/24/01/16/2110250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wine 9.0 Released
by Peter Reutemann 17 Jan '24

17 Jan '24

'Version 9.0 of Wine, the free and open-source compatibility layer that lets you run Windows apps on Unix-like operating systems, has been released. "Highlights of Wine 9.0 include an experimental Wayland graphics driver with features like basic window management, support for multiple monitors, high-DPI scaling, relative motion events, as well as Vulkan support," reports 9to5Linux. From the report: The Vulkan driver has been updated to support Vulkan 1.3.272 and later, the PostScript driver has been reimplemented to work from Windows-format spool files and avoid any direct calls from the Unix side, and there's now a dark theme option on WinRT theming that can be enabled in WineCfg. Wine 9.0 also adds support for many more instructions to Direct3D 10 effects, implements the Windows Media Video (WMV) decoder DirectX Media Object (DMO), implements the DirectShow Audio Capture and DirectShow MPEG-1 Video Decoder filters, and adds support for video and system streams, as well as audio streams to the DirectShow MPEG-1 Stream Splitter filter. Desktop integration has been improved in this release to allow users to close the desktop window in full-screen desktop mode by using the "Exit desktop" entry in the Start menu, as well as support for export URL/URI protocol associations as URL handlers to the Linux desktop. Audio support has been enhanced in Wine 9.0 with the implementation of several DirectMusic modules, DLS1 and DLS2 sound font loading, support for the SF2 format for compatibility with Linux standard MIDI sound fonts, Doppler shift support in DirectSound, Indeo IV50 Video for Windows decoder, and MIDI playback in dmsynth. Among other noteworthy changes, Wine 9.0 brings loader support for ARM64X and ARM64EC modules, along with the ability to run existing Windows binaries on ARM64 systems and initial support for building Wine for the ARM64EC architecture. There's also a new 32-bit x86 emulation interface, a new WoW64 mode that supports running of 32-bit apps on recent macOS versions that don't support 32-bit Unix processes, support for DirectInput action maps to improve compatibility with many old video games that map controller inputs to in-game actions, as well as Windows 10 as the default Windows version for new prefixes. Last but not least, the kernel has been updated to support address space layout randomization (ASLR) for modern PE binaries, better memory allocation performance through the Low Fragmentation Heap (LFH) implementation, and support memory placeholders in the virtual memory allocator to allow apps to reserve virtual space. Wine 9.0 also adds support for smart cards, adds support for Diffie-Hellman keys in BCrypt, implements the Negotiate security package, adds support for network interface change notifications, and fixes many bugs. For a full list of changes, check out the release notes. You can download Wine 9.0 from WineHQ.' -- source: https://tech.slashdot.org/story/24/01/16/2253237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Is No Longer Bringing the Full Chrome Browser To Fuchsia
by Peter Reutemann 16 Jan '24

16 Jan '24

'Google has formally discontinued its efforts to bring the full Chrome browser experience to its Fuchsia operating system. 9to5Google reports: In 2021, we reported that the Chromium team had begun an effort to get the full Chrome/Chromium browser running on Google's in-house Fuchsia operating system. Months later, in early 2022, we were even able to record a video of the progress, demonstrating that Chromium (the open-source-only variant of Chrome) could work relatively well on a Fuchsia-powered device. This was far from the first time that the Chromium project had been involved with Fuchsia. Google's full lineup of Nest Hub smart displays is currently powered by Fuchsia under the hood, and those displays have limited web browsing capabilities through an embedded version of the browser. In contrast to that minimal experience, Google was seemingly working to bring the full might of Chrome to Fuchsia. To observers, this was yet another signal that Google intended for Fuchsia to grow beyond the smart home and serve as a full desktop operating system. After all, what good is a laptop or desktop without a web browser? Fans of the Fuchsia project have anticipated its eventual expansion to desktop since Fuchsia was first shown to run on Google's Pixelbook hardware. However, in the intervening time -- a period that also saw significant layoffs in the Fuchsia division -- it seems that Google has since shifted Fuchsia in a different direction. The clearest evidence of that move comes from a Chromium code change (and related bug tracker post) published last month declaring that the "Chrome browser on fuchsia won't be maintained."' -- source: https://tech.slashdot.org/story/24/01/15/2350230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Mint 21.3: Its First Official Release with Wayland Support
by Peter Reutemann 15 Jan '24

15 Jan '24

'Linux Mint 21.3 is now available to download, reports the blog OMG Obuntu. It's the first version to offer Wayland support in its Cinnamon desktop: Following a successful bout of bug-busting in last month's beta release, Mint devs have gone ahead and rubber-stamped a stable release. Thus, you can reasonably expect to not encounter any major issues when installing or using it... [I]t's based on Ubuntu 22.04 LTS and continues to use the Linux 5.15 kernel by default, but newer kernels are available to install within the OS... In my own testing I find Cinnamon's Wayland support to be well-rounded. It's not perfect but I didn't hit any major snafus that prevented me from working (though admittedly I did only attempt 'basic' tasks like web browsing, playing music, and adding applets). However, Cinnamon's Wayland support is in an early state, is not enabled by default, and Linux Mint devs expect it won't be good enough for everyone until the 23.x series (due 2026) at the earliest. Still, try it out yourself and see if it works for you. Select the 'Cinnamon on Wayland (Experimental)' session from the login screen session selector, and then login as normal... Additionally, the latest version of Mozilla Firefox is pre-installed (as a deb, not a Snap) Among the new features are a whole new category of desktop add-ons — "Actions" — which upgrade the right-clicking context menu. (So for .iso files there's two new choices: "Verify" or "Make bootable USB stick".) The article says there's also "a raft of smaller refinements," plus "a bevvy of buffs and embellishments" for Linux Mint's homegrown apps. Any Linux Mint users reading Slashdot? Share your thoughts or experiences in the comments...' -- source: https://linux.slashdot.org/story/24/01/14/1830255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub: With Great Power Comes Great Responsibility ... For Both Good And Evil
by Lawrence D'Oliveiro 13 Jan '24

13 Jan '24

Seems GitHub has become a popular place to host malware in a form that is difficult to shut down <https://www.theregister.com/2024/01/12/github_malware_popularity/>. One thing I was surprised to learn from that article is that, as far as China is concerned, GitHub has apparently grown too big to block <https://www.npr.org/2019/04/10/709490855/github-has-become-a-haven-for-chin…>. Which means it becomes a sort-of-safe haven for activity which might be seen as politically subversive (such as demanding your rights to limited working hours as supposedly guaranteed under the law). Of course, that report was from nearly five years ago, and things could have changed since then. But the 996.icu repo referenced in there still exists, and still shows signs of activity as of a few months ago.

1 0

“I’m Sorry Dave, I’m Afraid I Can’t Do That” -- Or Not
by Lawrence D'Oliveiro 13 Jan '24

13 Jan '24

There has been a flood of products with very odd descriptions on Amazon lately <https://arstechnica.com/ai/2024/01/lazy-use-of-ai-leads-to-amazon-products-…>. For example, “I’m sorry but I cannot fulfill this request it goes against OpenAI use policy—Black”. Also available in other colours, and similar in sizes like 10mm×3m. And unique features like “Regrettably, the information you’re searching for is not available — we strive to maintain the highest standards of integrity and will not compromise the authenticity and accuracy of our product descriptions”. And who wouldn’t want to buy after hearing “Our [product] can be used for a variety of tasks, such [task 1], [task 2], and [task 3]]”? Are you thinking “I gotta get me some of that”?

1 0

X11 Conservancy Project
by Lawrence D'Oliveiro 13 Jan '24

13 Jan '24

Here’s a website <https://x11cp.org/> dedicated to trying to keep alive GUI programs dating from the early days of X11. I think they’re also trying to ensure that the code can still be built and run. This is the second time I’ve come across Codeberg, which offers an open-source-based hosting facility for Git repositories.

1 0

Why More PC Gaming Handhelds Should Ditch Windows For SteamOS
by Lawrence D'Oliveiro 12 Jan '24

12 Jan '24

The success of the Steam Deck is encouraging at least one third-party vendor to bring out its own gaming handheld that will be running the Linux-based SteamOS instead of Microsoft Windows <https://arstechnica.com/gaming/2024/01/why-more-pc-gaming-handhelds-should-…>. While compatibility with the overwhelming majority of Windows-only games still leaves something to be desired, the usability of the platform is already a definite selling point: While Proton does come with at least some performance overhead, a variety of Steam Deck benchmarks show games running under SteamOS tend to perform comparably (or sometimes better) than those running under Windows on the handheld. That's also a huge change from the Steam Machines era, when Ars' testing showed that many SteamOS games ran significantly worse than their Windows counterparts on the same desktop hardware. The Windows platform is just plain unsuited to a handheld gaming device: Our review of the ROG Ally highlights just how annoying it can be to have to fiddle with Windows settings on a touchscreen running "an awkwardly scaled" version of the OS. Though Microsoft has not been sitting still: And while Microsoft has experimented with a handheld-friendly version of Windows meant for portable gaming devices, nothing public has yet come of the effort. But unless it launches a much more concerted effort than it has managed to date, there’s a chance Windows may lose its undisputed dominance in the last major market where it has one: PC gaming.

1 0

Biggest Linux Kernel Release Ever Welcomes bcachefs File System, Jettisons Itanium
by Peter Reutemann 12 Jan '24

12 Jan '24

'Linux kernel 6.7 has been released, including support for the new next-gen copy-on-write (COW) bcachefs file system. The Register reports: Linus Torvalds announced the release on Sunday, noting that it is "one of the largest kernel releases we've ever had." Among the bigger and more visible changes are a whole new file system, along with fresh functionality for several existing ones; improved graphics support for several vendors' hardware; and the removal of an entire CPU architecture. [...] The single biggest feature of 6.7 is the new bcachefs file system, which we examined in March 2022. As this is the first release of Linux to include the new file system, it definitely would be premature to trust any important data to it yet, but this is a welcome change. The executive summary is that bcachefs is a next-generation file system that, like Btrfs and ZFS, provides COW functionality. COW enables the almost instant creation of "snapshots" of all or part of a drive or volume, which enables the OS to make disk operations transactional: In other words, to provide an "undo" function for complex sets of disk write operations. Having a COW file system on Linux isn't new. The existing next-gen file system in the kernel, Btrfs, also supports COW snapshots. The version in 6.7 sees several refinements. It inherits a feature implemented for Steam OS: Two Btrfs file systems with the same ID can be mounted simultaneously, for failover scenarios. It also has improved quota support and a new raid_stripe_tree that improves handling of arrays of dissimilar drives. Btrfs remains somewhat controversial. Red Hat banished it from RHEL years ago (although Oracle Linux still offers it) but SUSE's distros depend heavily upon it. It will be interesting to see how quickly SUSE's Snapper tool gains support for bcachefs: This new COW contender may reveal unquestioned assumptions built into the code. Since Snapper is also used in several non-SUSE distros, including Spiral Linux, Garuda, and siduction, they're tied to Btrfs as well. The other widely used FOSS next-gen file system, OpenZFS, also supports COW, but licensing conflicts prevent ZFS being fully integrated into the Linux kernel. So although multiple distros (such as NixOS, Proxmox, TrueNAS Scale, Ubuntu, and Void Linux) support ZFS, it must remain separate and distinct. This results in limitations, such as the ZFS Advanced Read Cache being separate from Linux's page cache. Bcachefs is all-GPL and doesn't suffer from such limitations. It aims to supply the important features of ZFS, such as integrated volume management, while being as fast as ext4 or XFS, and also surpass Btrfs in both performance and, crucially, reliability. ' -- source: https://linux.slashdot.org/story/24/01/11/2021234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Devices Are Under Attack By a Never-Before-Seen Worm
by Peter Reutemann 11 Jan '24

11 Jan '24

'Previously unknown self-replicating malware has been infecting Linux devices worldwide, installing cryptomining malware using unusual concealment methods. The worm is a customized version of Mirai botnet malware, which takes control of Linux-based internet-connected devices to infect others. Mirai first emerged in 2016, delivering record-setting distributed denial-of-service attacks by compromising vulnerable devices. Once compromised, the worm self-replicates by scanning for and guessing credentials of additional vulnerable devices. While traditionally used for DDoS attacks, this latest variant focuses on covert cryptomining. ArsTechnica adds: On Wednesday, researchers from network security and reliability firm Akamai revealed that a previously unknown Mirai-based network they dubbed NoaBot has been targeting Linux devices since at least last January. Instead of targeting weak telnet passwords, the NoaBot targets weak passwords connecting SSH connections. Another twist: Rather than performing DDoSes, the new botnet installs cryptocurrency mining software, which allows the attackers to generate digital coins using victims' computing resources, electricity, and bandwidth. The cryptominer is a modified version of XMRig, another piece of open source malware. More recently, NoaBot has been used to also deliver P2PInfect, a separate worm researchers from Palo Alto Networks revealed last July. Akamai has been monitoring NoaBot for the past 12 months in a honeypot that mimics real Linux devices to track various attacks circulating in the wild. To date, attacks have originated from 849 distinct IP addresses, almost all of which are likely hosting a device that's already infected. The following figure tracks the number of attacks delivered to the honeypot over the past year.' -- source: https://linux.slashdot.org/story/24/01/10/1727219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel 4.14 Reaches End of Life After More Than Six Years of Maintenance
by Peter Reutemann 11 Jan '24

11 Jan '24

'Originally released on November 12th, 2017, the long-term supported (LTS) Linux 4.14 kernel series has now reached its end of supported life after being maintained for more than six years. Renowned kernel developer Greg Kroah-Hartman announced today on the Linux kernel mailing list the release of Linux 4.14.336 as what appears to be the last maintenance update to the long-term supported Linux 4.14 kernel series, which is now marked as EOL (End of Life) on the kernel.org website. "This is the LAST 4.14.y kernel to be released. It is now officially end-of-life. Do NOT use this kernel version anymore, please move to a newer one, as shown on the kernel.org releases page," said Greg Kroah-Hartman. "If you are stuck at this version due to a vendor requiring it, go get support from that vendor for this obsolete kernel tree, as that is what you are paying them for."' -- source: https://linux.slashdot.org/story/24/01/10/1729216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Computer Says You Are A Thief
by Lawrence D'Oliveiro 10 Jan '24

10 Jan '24

Been hearing about this on and off for a few years, but it seems things have come to a head with the airing of a four-part documentary series about the massive scandal of the “Horizon” financial software used by the British Post Office <https://www.aljazeera.com/news/2024/1/9/the-great-british-post-office-scand…>. Basically, the buggy software was reporting incorrect transaction amounts, and these reports were believed over the protestations of the branch managers, leading to several hundred of the latter being prosecuted and convicted of theft and false accounting. In desperation at not being believed, some of them tried to plug the holes with their own money. Some even committed suicide. It took twenty years from the introduction of the system before a court ruled that the fault lay with the software, not with so many innocent people. (Why was the software considered to be above reproach for so long?) Even now, only a small proportion of the false convictions have been overturned. The Post Office CEO at the time has bowed to pressure and returned her CBE award. The software is still in use.

1 0

speed camera with RPi - NZ edition
by Peter Reutemann 10 Jan '24

10 Jan '24

Hi everyone Just stumbled across this news item in one of the reviews for the Raspberry Pi 4 on PBTech's website: https://www.stuff.co.nz/national/119894942/diy-speed-camera-nabs-hoons-near… And, would you believe it, the article even linked the source code: https://github.com/gregtinkers/carspeed.py Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical wants better Snap support outside Ubuntu, based on latest hires
by Peter Reutemann 10 Jan '24

10 Jan '24

'Snaps, the self-contained application packages that Ubuntu has long seen as a simpler app store and a potential solution to dependency hell, could be getting better support outside Ubuntu itself, based on one recent hire and potentially more. As spotted by the Phoronix blog, developer Zygmunt Krynicki, who worked at Ubuntu distributor Canonical from 2012 through 2020, posted Friday on Mastodon that he was "returning as a snap developer later this month." His main focus would be "cross-distribution support," Krynicki wrote, and "unlike in the past this will be my full time job. I'm very excited for what is ahead for snaps." He also noted, in a later reply, that he was "not coming back alone." Krynicki, reached Monday on Mastodon, noted that he was at a very early stage in his work. But he intended to look at the state of support across distributions, determine which long-term and short-term work to focus on, and "work on the internals and get things progressively better, even if that is not flashy." That means refactoring some of the code and, "if realistic, change some of the old ideas that I believe hold the project back," Krynicki wrote. The challenge will be finding ways to "experiment with new ideas in ways that allow controlled but more rapid progress," while maintaining stability. But all of that needs discussing with his team, when they're fully in place, Krynicki wrote. That team and their work would indicate that the Ubuntu makers have listened to perhaps the most common criticism of Snaps, whether perceptual, logistical, or both: that Snaps are an Ubuntu-focused phenomenon. Snap packages have difficulty working without AppArmor, a kernel extension that is a default in Ubuntu but not every other Linux distribution. Canonical also maintains the Snap Store. While other stores of Snaps are possible, some distributions and software packagers have turned instead to Flatpak, a similarly containerized system that doesn't have deep ties to any one distribution.' -- source: https://arstechnica.com/gadgets/2024/01/canonical-wants-better-snap-support… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Discusses Maintainers, AI, and Rust in the Kernel
by Peter Reutemann 08 Jan '24

08 Jan '24

'ZDNet reports that "At the Linux Foundation's Open Source Summit Japan, Linus Torvalds and his good friend Dirk Hohndel, the head of Verizon open source, talked about the current state of Linux: Speaking of maintainers, Hohndel brought up the question of "maintainer fatigue and how draining and stressful this role is...." Torvalds replied, "It's much easier to find developers; we have a lot of developers. Some people think that you have to be a superdeveloper who can do everything to be a maintainer, but that's not actually true...." Hohndel commented that the aging of the kernel community is a "double-edged sword." Torvalds agreed, but he noted that "one of the things I liked about the Rust side of the kernel, was that there was one maintainer who was clearly much younger than most of the maintainers. We can clearly see that certain areas in the kernel bring in more young people...." Hohndel and Torvalds also talked about the use of the Rust language in the Linux kernel. Torvalds said, "It's been growing, but we don't have any part of the kernel that really depends on Rust yet. To me, Rust was one of those things that made technical sense, but to me personally, even more important was that we need to not stagnate as a kernel and as developers." That said, Torvalds continued, "Rust has not really shown itself as the next great big thing. But I think during next year, we'll actually be starting to integrate drivers and some even major subsystems that are starting to use it actively. So it's one of those things that is going to take years before it's a big part of the kernel. But it's certainly shaping up to be one of those." Torvalds also said he enjoyed the fact that open source "has become the standard within the industry." But later Hohndel, calling AI "autocorrect on steroids," asked Torvalds if he thought he'd ever see submissions of LLM-written code. "I'm convinced it's gonna happen. And it may well be happening already, maybe on a smaller scale where people use it more to help write code." But, unlike many people, Torvalds isn't too worried about AI. "It's clearly something where automation has always helped people write code. This is not anything new at all...." But, "What about hallucinations?," asked Hohndel. Torvalds, who will never stop being a little snarky, said, "I see the bugs that happen without AI every day. So that's why I'm not so worried. I think we're doing just fine at making mistakes on our own." ' -- source: https://linux.slashdot.org/story/23/12/09/0644247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

How Does FreeBSD Compare to Linux on a Raspberry Pi?
by Peter Reutemann 08 Jan '24

08 Jan '24

'Klaus Zimmermann (a self-described "friendly hacker") recently posted a "State of the Distro" post, choosing his favorite distributions for things like portable installation from a USB drive (Alpine Linux) and for a desktop OS (Debian Linux or Devuan). But when it comes to a distro for the Raspberry Pi, (at least until the 4), Zimmerman argues that FreeBSD's performance is "unlike any other Linux distribution I've ever seen, even with cpupower activated and overclocking." Nope, no match — FreeBSD's performance on the Pi is still way better, even without overclocking. You can browse a modern web, have things scroll smoothly, watch videos and even play some 3D games like Quake with it! And if you overclock it a little (2GHz) you can even make it run that gargantua MS Teams. But what about all that lackluster driver support? WiFi drivers still on the 802.11g standard and all? Surely you can't be serious about it when Linux offers all that support out of the box, right? Wrong, actually. For starters, the drivers provided for the Pi's hardware are often half-assed proprietary blobs... I no longer think FreeBSD is really at fault if the driver support for the hardware is not helpful to begin with. Even drivers you find for Linux are shaky at best. So yes, I will keep using FreeBSD on the Pi. As a desktop. With USB WiFi and audio adapters for those services, because the existing hardware is sort of moot even otherwise. And with those USB adapters — and FreeBSD — the Pi works really well, truly desktop-like. I'd be curious to hear from Slashdot's readers about their own experiments with Linux (and FreeBSD) on a Raspberry Pi. Zimmerman's final winner, for the "Server" category, was Debian — though of his two servers, one is just an XMPP server set up on a Raspberry Pi. "I found that using Debian on the Pi is a real joy. Easy and simple to set up, familiar environment and all. So I'm keeping it. "This concept is about to be overshadowed, however, by my growing like of FreeBSD lately..."' -- source: https://linux.slashdot.org/story/24/01/07/0327229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ZDNet Calls Rhino Linux 'New Coolest Linux Distro'
by Peter Reutemann 08 Jan '24

08 Jan '24

'If you're starting the new year with a new Linux distro, ZDNet just ran an enthusiastic profile of Rhino Linux, calling it "beautiful" with "one of the more useful command-line package managers on the market." Rhino uses a modern take on the highly efficient and customizable Xfce desktop (dubbed "Unicorn") to help make the interface immediately familiar to anyone who logs in. You'll find a dock on the left edge of the screen that contains launchers for common applications, access to the Application Grid (where you can find all of your installed software), and a handy Search Bar (Ulauncher) that allows you to quickly search for and launch any installed app (or even the app settings) you need... Thanks to myriad configuration options, Xfce can be a bit daunting. At the same time, the array of settings makes Xfce highly customizable, which is exactly what the Rhino developers did when they designed this desktop. For those who want a desktop that makes short work of accessing files, the Rhino developers have added a really nifty tool to the top bar. You'll find a listing of some folders you have in your Home directory (Files, Documents, Music, Pictures, Video). If you click on one of those entries, you'll see a list of the most recently accessed files within the directory. Click on the file you want to open with the default, associated application... Rhino opts for the Pacstall package manager over the traditional apt-get. That's not to say apt-get isn't on the system — it is. But with Rhino Linux, there's a much easier path to getting the software you want installed... [W]hen you first run the installed OS, you are greeted with a window that allows you to select what package managers you want to use. You can select from Snap, Flatpak, and AppImages (or all three). Next, the developers added a handy tool (rhino-pkg) that makes installing from the command line very simple. When the distro launched in August, 9to5Linux described it as "a unique distribution for Ubuntu fans who wanted a rolling-release system where they install once and receive updates forever." The theming looks gorgeous and it's provided by the Elementary Xfce Darker icon theme, Xubuntu's Greybird GTK theme, and Ubuntu's Yaru Dark WM theme. It also comes with some cool features, such as a dedicated and full-screen desktop switcher provided by Xfdashboard... ' -- source: https://news.slashdot.org/story/24/01/07/2036245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

RIP: Software Design Pioneer And Pascal Creator Niklaus Wirth
by Lawrence D'Oliveiro 06 Jan '24

06 Jan '24

Famed computer scientist Niklaus Wirth has passed away, just a few weeks before reaching his 90th birthday <https://www.theregister.com/2024/01/04/niklaus_wirth_obituary/>. He is known for being a champion of simplicity in programming language and system design. He had a falling out with the committee that was coming up with a successor to Algol-60 (itself a driver for many important language-implementation techniques), and so went off and created Pascal. And then a few more languages after that. In his criticism of the language, Algol-68, that the committee eventually came up with, I found this excerpt illuminating on the milieu of the time: I am discouraged! I thought I had recognized the short-comings of the commercially available languages; they provide no guidance to programming discipline, and lack a logically coherent structure. Algol 60 had provided an answer and a solution. Unfortunately, it lacked some features which many practitioners badly need. It was relatively easy to remedy some defects and some defaults of Algol 60. We had implemented such an extension of Algol; it contains the data types long real, complex, and character strings, along with one other major extension. But guess how many requests we received for this system. None! Nobody is interested in a new language, particuarly if it is not supported by the big manufacturers or has received the blessing of some standards committee. But I see no chances that either a big manufacturer or a committee will ever produce a language acceptable to our standards or clarity, simplicity, and rigor. Remember, this was published in November 1968. Notice the assumption that the only sort of language implementation that might be worth using is a “commercially-available” one, with the backing of a “big” company behind it. There was no thought that an implementation with source code freely available could ever be considered “commercial”, either in usage or quality. And on top of that, every OS was different; there was nothing like the near-universality of POSIX-type OSes we enjoy today. And some of the differences were downright--quirky, shall we say. So even if such a source code project were available, porting it to all the platforms in common use would likely have been a nightmare.

1 0

Since the Demise of Atom, 'Pulsar' Offers an Alternative Code Editor
by Peter Reutemann 01 Jan '24

01 Jan '24

'On December 15 GitHub declared end-of-life for its "hackable text editor" Atom. But Long-time Slashdot reader BrendaEM wants to remind everyone that after the announcement of Atom's sunset, "the community came together to keep Atom alive." First there was the longstanding fork Atom-Community. But "due to differences in long-term goals for the editor, a new version was born: Pulsar." >From the Pulsar web site: Pulsar [sometimes referred to as Pulsar-Edit] aims to not only reach feature parity with the original Atom, but to bring Pulsar into the 21st century by updating the underlying architecture, and supporting modern features. With many new features on the roadmap, once Pulsar is stable, it will be a true, Community-Based, Hackable, Text Editor. "Of course, the user interface is much of the same," writes the blog Its FOSS, and it's cross-platform (supporting Linux, macOS, and Windows). "The essentials seem to be there with the documentation, packages, and features like the ability to install packages from Git repositories..."' -- source: https://tech.slashdot.org/story/24/01/01/016215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a Cray-1 Supercomputer Compares to a Raspberry Pi
by Peter Reutemann 01 Jan '24

01 Jan '24

'Roy Longbottom worked for the U.K. covernment's Central Computer Agency from 1960 to 1993, and "from 1972 to 2022 I produced and ran computer benchmarking and stress testing programs..." Known as the official design authority for the Whetstone benchmark), Longbottom writes that "In 2019 (aged 84), I was recruited as a voluntary member of Raspberry Pi pre-release Alpha testing team." And this week — now at age 87 — Longbottom has created a web page titled "Cray 1 supercomputer performance comparisons with home computers, phones and tablets." And one statistic really captures the impact of our decades of technological progress. "In 1978, the Cray 1 supercomputer cost $7 Million, weighed 10,500 pounds and had a 115 kilowatt power supply. It was, by far, the fastest computer in the world. The Raspberry Pi costs around $70 (CPU board, case, power supply, SD card), weighs a few ounces, uses a 5 watt power supply and is more than 4.5 times faster than the Cray 1." ' -- source: https://tech.slashdot.org/story/23/12/31/0017205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Source-Based Gentoo Linux Goes Binary
by Peter Reutemann 01 Jan '24

01 Jan '24

'While Gentoo Linux is best-known as source-based Linux distribution, "our package manager, Portage, already for years also has support for binary packages," according to its web page. It notes that source- and binary-based package installations can be freely mixed. But now... To speed up working with slow hardware and for overall convenience, we're now also offering binary packages for download and direct installation! For most architectures, this is limited to the core system and weekly updates — not so for amd64 and arm64 however. There we've got a stunning >20 GByte of packages on our mirrors, from LibreOffice to KDE Plasma and from Gnome to Docker. Gentoo stable, updated daily. Enjoy! "We have a rather neat binary package guide on our Wiki that goes into much more detail..." the announcement points out. The packages are cryptographically signed with the same key as the stages.' -- source: https://linux.slashdot.org/story/23/12/30/1756208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Peppermint OS Builds Single-Site Browsers for Debian Systems
by Peter Reutemann 31 Dec '23

31 Dec '23

'They create a dedicated desktop icon for your favorite web-based application — a simplified browser that opens to that single URL. Yet while Linux usually offers the same functionality as other operating systems, "Peppermint OS's Ice and its successor Kumo are the only free software versions of Site-Specific Browsers available on Linux," according to Linux magazine. "Fortunately for those who want this functionality, Peppermint OS is a Debian derivative, and both can be installed on Debian and most other derivatives." Since SSBs first appeared in 2005, they have been available on both Windows and macOS. On Linux, however, the availability has come and gone. On Linux, Firefox once had an SSB mode, but it was discontinued in 2020 on the grounds that it had multiple bugs that were time-consuming to fix and there was "little to no perceived user benefit to the feature." Similarly, Chromium once had a basic SSB menu item, Create Application Shortcut, which no longer appears in recent versions. As for GNOME Web's (Epiphany's) Install Site as Web Application, while it still appears in the menu, it is no longer functional. Today, Linux users who want to try SSBs have no choices except Ice or Kumo. Neither Ice or Kumo appears in any repository except Peppermint OS's. But because Peppermint OS installs packages from Debian 12 ("bookworm"), either can be installed to Debian or a derivative... To install successfully, at least one of Firefox, Chrome, Chromium, or Vivaldi also must be installed... Because both Ice and Kumo are written in Python, they can be run on any desktop. The article concludes that Site-Specific Browsers might make more sense "on a network or in a business where their isolation provides another layer of security. Or perhaps the time for SSBs is past and there's a reason browsers have tried to implement them, and then discarded them."' -- source: https://linux.slashdot.org/story/23/12/30/0527205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox: scrollbar buttons gone
by Peter Reutemann 30 Dec '23

30 Dec '23

Hi everyone Call me old-fashioned, but I do like the arrow buttons on scrollbars. Especially on very long pages (eg OpenWRT's hardware table) where I want move the view port only a little bit... On my Linux 20.3 MATE, I managed to get them back by using these CSS settings: scrollbar { -GtkScrollbar-has-backward-stepper: true; -GtkScrollbar-has-forward-stepper: true; } In the following config file: ~/.config/gtk-3.0/gtk.css -- source: https://support.mozilla.org/en-US/questions/1420887 Also, if you don't like the thin overlay scrollbars, then set the following FF option ("about:config") to "false": widget.gtk.overlay-scrollbars.enabled Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Adventure (Latest Reboot Of An Ancient Classic)
by Lawrence D'Oliveiro 23 Dec '23

23 Dec '23

Just doing some random browsing on my system, and came across a Debian package called “open-adventure”. Finding my way to its home page at Eric Raymond’s site <http://www.catb.org/~esr/open-adventure/>, I discover that it is a project to modernize the source code for the original “ADVENT” game dating from 1976-1977, the one that originated the whole concept of text-based adventure games. The original code was written in Fortran; this one rewrites it all in clean, almost-idiomatic C (as opposed to automatically-translated GOTO-ridden C), and incorporates such innovations as using YAML as the source code for the maze format (translated to C structures at build time). It has been carefully regression-tested against the Fortran original(s) to ensure the gameplay is identical (and the few conscious deviations can be disabled if you want). The developers also kept in mind the possibility of porting the code further, to more modern languages like Python or Go. In the meantime, they have declared the project “finished” as of earlier this year, with all known bug reports closed and all compatibility tests passed.

1 0

LMDE
by john 21 Dec '23

21 Dec '23

After enduring a few minor health issues over the past months I have finally got round to installing Linux Mint Debian edition 5 Bullseye. I think due to the Cinnamon Desktop environment it is marginally slower than the Mate DE I was using with my Ubuntu Jammy Jellyfish distribution. I didn't find the minor difference to be any problem for me. I am well pleased with the performance, look and feel of it and have not (so far) found anything unpleasant or difficult. It appears to me to be well suited to a first time user or for someone migrating from Windows. Cheers John..

2 1

Fedora Asahi Remix Officially Released For Apple Silicon Macs
by Peter Reutemann 21 Dec '23

21 Dec '23

'9to5Linux: Announced in early August and initially planned for the end of the month, the Fedora Asahi Remix distribution is finally here for those who want to install the Fedora Linux operating system on their Apple Silicon Macs. Previously a remix of Arch Linux ARM, the Fedora Asahi Remix distribution is the result of a multi-year collaboration between the Asahi Linux project and the Fedora Project, enabling you to have a proper daily driver on your Apple Silicon Mac thanks to Fedora Linux's excellent 64-bit ARM support. The distro is based on the latest Fedora Linux 39 release and ships with the KDE Plasma 5.27 LTS desktop environment by default, using Wayland. This promises a smooth Linux desktop experience on Apple hardware similar to macOS. Fedora Asahi Remix also comes with XWayland for those who want to run X11 apps. In addition, it features non-conformant OpenGL 3.3 support including GPU-accelerated geometry shaders and transform feedback, PipeWire by default with WirePlumber, as well as the Calamares graphical installer. ' -- source: https://apple.slashdot.org/story/23/12/20/0357233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SSH protects the world’s most sensitive networks. It just got a lot weaker
by Peter Reutemann 20 Dec '23

20 Dec '23

'Named Terrapin, the new hack works only when an attacker has an active adversary-in-the middle position on the connection between the admins and the network they remotely connect to. Also known as a man-in-the-middle or MitM attack, this occurs when an attacker secretly positioned between two parties intercepts communications and assumes the identity of both the recipient and the sender. This provides the ability to both intercept and to alter communications. While this position can be difficult for an attacker to achieve, it’s one of the scenarios from which SSH was thought to have immunity. For Terrapin to be viable, the connection it interferes with also must be secured by either "ChaCha20-Poly1305" or "CBC with Encrypt-then-MAC," both of which are cipher modes added to the SSH protocol (in 2013 and 2012, respectively). A scan performed by the researchers found that 77 percent of SSH servers exposed to the Internet support at least one of the vulnerable encryption modes, while 57 percent of them list a vulnerable encryption mode as the preferred choice. At its core, Terrapin works by altering or corrupting information transmitted in the SSH data stream during the handshake—the earliest stage of a connection, when the two parties negotiate the encryption parameters they will use to establish a secure connection. The attack targets the BPP, short for Binary Packet Protocol, which is designed to ensure that adversaries with an active position can't add or drop messages exchanged during the handshake. Terrapin relies on prefix truncation, a class of attack that removes specific messages at the very beginning of a data stream.' -- source: https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-inte… This SUSE knowledge base entry lists some configuration changes that one can apply (section "Additional Information"): https://www.suse.com/de-de/support/kb/doc/?id=000021295 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox 121 Now Available With Wayland Enabled By Default
by Peter Reutemann 19 Dec '23

19 Dec '23

'Firefox 121 has arrived with Wayland support to be used by default on modern Linux desktops. Phoronix's Michael Larabel writes: Some Linux distributions and package builds have been using the native Wayland path for a while but now it's great to see the upstream builds make this default change as we get ready to embark on the 2024 Linux desktop. With my testing of Firefox 121 on Wayland, it's been working out well. X.Org/X11 support remains in place for those not using a Wayland-based desktop environment. Firefox 121 also adds Voice Control command support on macOS, adds an option to always force-underline links within websites, Firefox now includes a floating button to help in creation within PDFs, various CSS feature additions, and other developer enhancements. Firefox 121 also now supports tail call elimination in WebAssembly for enhancing support for functional languages. ' -- source: https://news.slashdot.org/story/23/12/18/2359227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Previews Linux-Powered Windows AI Studio
by Lawrence D'Oliveiro 18 Dec '23

18 Dec '23

Microsoft is offering a preview version of “Windows AI Studio”, which lets you run a fixed (for now) set of pre-trained models within Visual Studio Code on Windows. However, your Windows installation must also have Ubuntu installed under WSL2 for this to work <https://www.theregister.com/2023/12/14/windows_ai_studio_preview/>. Quote: There is, however, a certain ironic deliciousness in noting that Microsoft's local AI development on Windows requires Linux under the hood. Windows is still needed for the Visual Studio Code extension, but even that might change. Microsoft said: "We are currently planning for other platform support." When I first heard about WSL2, I predicted that Microsoft would, not from any conscious plan but simply from following the path of least resistance (and cost), start to rely on the Linux kernel more and more for important Windows functionality. I think this represents a step along that path.

1 0

Microsoft Division Will Not Use Microsoft’s Own Cloud
by Lawrence D'Oliveiro 15 Dec '23

15 Dec '23

LinkedIn (which is owned by Microsoft) has decided it will not be moving its datacentre operations onto Microsoft Azure after all <https://www.theregister.com/2023/12/14/linkedin_abandons_migration_to_micro…>. The plan was originally announced four years ago. Then last year they decided to back off a bit, and go for a “hybrid cloud” model. And now, the whole cloud part is gone. Seems they were not going for a refactor of their services to take advantage of cloud-native functionality, instead they were trying to “lift and shift” their existing software. This could be a reflection on the inflexibility of Azure, or on the difficulty of maintenance of that existing LinkedIn infrastructure. Either way, it does not exactly make Microsoft look good. Not to mention the four years it took to realize the whole project was a waste of time.

1 0

Proton Mail Finally Gets a Desktop App For Encrypted Email and Calendar
by Peter Reutemann 15 Dec '23

15 Dec '23

'The Verge: Proton has released a desktop version of its Proton Mail app that will give users full access to both Proton Mail and Proton Calendar and (eventually) the ability to view your emails offline. The desktop app is available in beta is optimized for both Windows and macOS, and encrypts sent emails end-to-end just like with the browser version, according to the Swiss company, while offline access to emails will be available "soon." [...] It's important to note that you'll still need internet access to both send and encrypt your emails on Proton. But the offline feature will let you view and draft emails while traveling, during a power outage, or any other situation where you don't have access to the internet. Proton is also bringing encrypted auto-forwarding to paid users, both on its desktop and browser versions, though the encryption for forwards will only apply when the forwarded emails go to other Proton users. The company says it has made improvements to Proton Calendar, too, including a fully searchable web version. Not everyone will be able to access Proton's desktop app right away. Proton is restricting access to its paid "Visionary" tier for legacy users at first (though the company is reopening subscriptions to that tier through January 3rd, 2024). The plan is to make the desktop app available to all users in early 2024. ' -- source: https://it.slashdot.org/story/23/12/14/1916258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Not Being Swayed to Write in Rust (Yet)
by Ben Cottrell 13 Dec '23

13 Dec '23

I've enjoyed learning how to make performant software, and I've been led to some fantastic toolkits for C++. Some of my favourites include Qt and Boost. Unfortunately, it seems like no amount of pointer container classes, design patterns or static checkers are going to make modern C++ any safer. I don't want to abandon the ship and shift to a garbage collected languages, although they do come in handy, especially Java, as I've used it with ANTLR for testing grammars. These frameworks seem to complement each other nicely, and some scripting in JavaScript is handy for wrangling data as well. I find Rust cumbersome, with regards to naming styles, and error handling. I like the conveniences of the package and toolchain management rolled with Rust, but they aren't enough to sway me from C++. I would like something like the borrow checker being available in C++, and say, MSVC or GCC having more user-friendly compiler error messages. Maybe C++ is too slow to adapt, and Rust will take its place, if comparable frameworks become more popular. Competition is good for innovation anyway. Regards, Ben

2 1

'Lenovo B41-30 80LF' Laptop. WiFi not werking. Hardware flt.
by B. Eagle Burt 13 Dec '23

13 Dec '23

I am currently running Devuan Linux OS. The cable/eth0 connection WAS UP & RUNNINNING UNTIL MY INCESSESSANT FIDDLING AROUND WITH Network Manager Screwed that up too ... :-(( I have tried ALL the various Commands/Options of 'nmcli' & found that the WiFi Hardware Device/wlan0 was missing. I have searched & searched Lenovo websites to no avail. I have also spoken with a Lenovo support (NZ) technician who did not exactly inspire confidence. It was his suggestion for me to contact the WLUG. I WAS going to purchase a WiFi Adapter (onboard) from Trademe, but he thought that a PCI MINI card would be too small for this model of Laptop. The Lenovo site does not have any WiFi Adapters for sale. A friend suggested that I purchase a USB WiFi Adapter, which I did - 'tp-link AC600 Nano Wireless USB Adapter' BUT I discovered that there is not a Linux driver for it yet... so THAT was a waste of $40-odd. Anyone with a cheap old PCI WiFi or USB WiFi Adapter Driver for Linux or Any advice welcomed. Thank you for your consideration of this, my first, WLUG List Post. 'b'ye! - B. Gilbert

2 1

Stealthy Linux rootkit found in the wild after going undetected for 2 years
by Peter Reutemann 11 Dec '23

11 Dec '23

'Stealthy and multifunctional Linux malware that has been infecting telecommunications companies went largely unnoticed for two years until being documented for the first time by researchers on Thursday. Researchers from security firm Group-IB have named the remote access trojan “Krasue,” after a nocturnal spirit depicted in Southeast Asian folklore “floating in mid-air, with no torso, just her intestines hanging from below her chin.” The researchers chose the name because evidence to date shows it almost exclusively targets victims in Thailand and “poses a severe risk to critical systems and sensitive data given that it is able to grant attackers remote access to the targeted network. According to the researchers: - Krasue is a Linux Remote Access Trojan that has been active since 20 and predominantly targets organizations in Thailand. - Group-IB can confirm that telecommunications companies were targeted by Krasue. - The malware contains several embedded rootkits to support different Linux kernel versions. - Krasue’s rootkit is drawn from public sources (3 open-source Linux Kernel Module rootkits), as is the case with many Linux rootkits. - The rootkit can hook the `kill()` syscall, network-related functions, and file listing operations in order to hide its activities and evade detection. - Notably, Krasue uses RTSP (Real-Time Streaming Protocol) messages to serve as a disguised “alive ping,” a tactic rarely seen in the wild. - This Linux malware, Group-IB researchers presume, is deployed during the later stages of an attack chain in order to maintain access to a victim host. - Krasue is likely to either be deployed as part of a botnet or sold by initial access brokers to other cybercriminals. - Group-IB researchers believe that Krasue was created by the same author as the XorDdos Linux Trojan, documented by Microsoft in a March 2022 blog post, or someone who had access to the latter’s source code.' -- source: https://arstechnica.com/security/2023/12/stealthy-linux-rootkit-found-in-th… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How AlmaLinux's Community Supported RHEL Binary Compatibility
by Peter Reutemann 10 Dec '23

10 Dec '23

'Linux magazine interviewed an AlmaLinux official about what happened after their distro pivoted to binary compatibility with Red Hat Enterprise Linux rather than being a downstream build: Linux Magazine: What prompted AlmaLinux to choose ABI over 1:1 compatibility with RHEL? benny Vasquez, chair of the AlmaLinux OS Foundation: The short answer is our users. Overwhelmingly, our users made it clear that they chose AlmaLinux for its ease of use, the security and stability that it provides, and the backing of a diverse group of sponsors. All of that together meant that we didn't need to lock ourselves into copying RHEL, and we could continue to provide what our users needed. Moreover, we needed to consider what our sponsors would be able to help us provide, and how we could best serve the downstream projects that now rely on AlmaLinux. The rippling effects of any decision that we make are beyond measure at this point, so we consider all aspects of our impact and then move forward with confidence and intention. LM: How did AlmaLinux's mission of improving the Linux ecosystem for everyone influence this decision? bV: We strongly believe that the soul of open source means working together, providing value where there is a gap, and helping each other solve problems. If we participate in an emotional reaction to a business's change, we will then be distracted and potentially hurt users and the Enterprise Linux ecosystem overall. By remaining focused on what is best (though not easiest), and adapting to the ecosystem as it is today, we will provide a better and more stable operating system. LM: What opportunities does the ABI route offer over 1:1 compatibility? bV: By liberating ourselves from the 1:1 promise, we have been able to do a few small things that have proven to be a good testing ground for what will come in the future. Specifically, we shipped a couple of smallish, but extremely important, security patches ahead of Red Hat, offering quicker security to the users of AlmaLinux... This also opens the door for other features and improvements that we could add back in or change, as our users need. We have already seen greater community involvement, especially around these ideas. LM: Does the ABI route pose any extra challenges? bV: The obvious one is that building from CentOS Stream sources takes more effort, but I think the more important challenge (and the one that will only be solved with consistency over time) is the one of proving that we will be able to deliver on the promise... We will continue on our goal of becoming the home for all users that need Enterprise Linux for free, but in the next year I expect that we will see an expansion in the number of kernels we support and see some new and exciting SIGs spun up around other features or use cases, as the community continues to standardize on how to achieve their goals collectively. Linux magazine notes that in August AlmaLinux added two new repositories, Testing and Synergy. "Testing, currently available for AlmaLinux 8 and 9, offers security updates before they are approved and implemented upstream. Synergy contains packages requested by community members that currently aren't available in RHEL or Extra Packages for Enterprise Linux (EPEL, a set of extra software packages maintained by the Fedora SIG that are not available in RHEL or CentOS Stream)." The article also points out that "On the upside, AlmaLinux can now include comments in their patches for greater transparency. Users will see where the patch comes from, which was not an option before." Vasquez tells the magazine, "I think folks will be seriously happy about what they find as we release the new versions, namely, the consistency, stability, and security that they've come to expect from us."' -- source: https://linux.slashdot.org/story/23/12/09/2121242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ext4 corruption bug in Linux kernel 6.1.64-1
by Eliot Blennerhassett 10 Dec '23

10 Dec '23

(I haven't read the details yet, but worth being cautious...) ext4 corruption bug in Linux kernel 6.1.64-1 that was in last night's debian point release Avoid booting into 6.1.64-1, if you have already done so the suggestion is to boot to a previous kernel, 6.1.55-1 or earlier debian 12.3 release has been delayed. Thanks to those who are working to update the kernel for the release! Bug report - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057843 "IMPORTANT: do NOT upgrade to new stable point release" on debian-user mailing list (Received via mastodon https://floss.social/@FLOX_advocate/111552470597771898) -- Eliot

1 0

openSUSE Wants A New Logo
by Lawrence D'Oliveiro 09 Dec '23

09 Dec '23

openSUSE is asking for submissions of new logos for the main project and its various offshoots. I must say the list of entrants so far <https://en.opensuse.org/Logocontest> is quite varied. Even the ones based on a (recognizable) gecko theme still manage to portray it in a remarkable number of ways.

2 1

Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack
by Peter Reutemann 07 Dec '23

07 Dec '23

'Hundreds of Windows and Linux computer models from virtually all hardware makers are vulnerable to a new attack that executes malicious firmware early in the boot-up sequence, a feat that allows infections that are nearly impossible to detect or remove using current defense mechanisms. The attack—dubbed LogoFAIL by the researchers who devised it—is notable for the relative ease in carrying it out, the breadth of both consumer- and enterprise-grade models that are susceptible, and the high level of control it gains over them. In many cases, LogoFAIL can be remotely executed in post-exploit situations using techniques that can’t be spotted by traditional endpoint security products. And because exploits run during the earliest stages of the boot process, they are able to bypass a host of defenses, including the industry-wide Secure Boot, Intel’s Secure Boot, and similar protections from other companies that are devised to prevent so-called bootkit infections. LogoFAIL is a constellation of two dozen newly discovered vulnerabilities that have lurked for years, if not decades, in Unified Extensible Firmware Interfaces responsible for booting modern devices that run Windows or Linux. The vulnerabilities are the product of almost a year’s worth of work by Binarly, a firm that helps customers identify and secure vulnerable firmware. The vulnerabilities are the subject of a coordinated mass disclosure released Wednesday. The participating companies comprise nearly the entirety of the x64 and ARM CPU ecosystem, starting with UEFI suppliers AMI, Insyde, and Phoenix (sometimes still called IBVs or independent BIOS vendors); device manufacturers such as Lenovo, Dell, and HP; and the makers of the CPUs that go inside the devices, usually Intel, AMD or designers of ARM CPUs. The researchers unveiled the attack on Wednesday at the Black Hat Security Conference in London. The affected parties are releasing advisories that disclose which of their products are vulnerable and where to obtain security patches. Links to advisories and a list of vulnerability designations appears at the end of this article. [...] LogoFAIL vulnerabilities are tracked under the following designations: - CVE-2023-5058 - CVE-2023-39538 - CVE-2023-39539 - CVE-2023-40238' -- source: https://arstechnica.com/security/2023/12/just-about-every-windows-and-linux… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Ready, Fire! Aim.”
by Lawrence D'Oliveiro 07 Dec '23

07 Dec '23

NASA’s OSIRIS REx mission successfully returned a sample to Earth from the asteroid Bennu back in September, three years after it was collected. However, it could so easily have gone wrong, due to a little oopsie, according to <https://arstechnica.com/space/2023/12/nasas-asteroid-mission-struck-its-tar…>. What was supposed to happen was, at an altitude of 100,000 feet, the return capsule should have deployed its drogue chute. Then, five minutes later, the cord for this chute would be cut, allowing the main chute to unfurl, after the drogue had done its part in slowing down the capsule descent. Instead, due to a case of (literal) crossed wires, the signal sent at 100,000 feet triggered the cutting (intead of the deployment) of the drogue chute cord, while it was still packed inside the capsule. Then, at 9,000 feet, the release of the main chute caused the drogue chute to pop out first, and immediately fall away. Luckily, there was sufficient margin in the design of the main chute that it was able to cope with the higher descent speed, and bring the capsule down to a safe landing even with this complete failure of the drogue chute. And it was all down to insufficiently clear assembly instructions: "In the design plans for the system, the word 'main' was used inconsistently between the device that sends the electric signals, and the device that receives the signals," NASA said in a written statement. "On the signal side, 'main' meant the main parachute. In contrast, on the receiver side 'main' was used as a reference to a pyrotechnic that fires to release the parachute canister cover and deploy the drogue. "Engineers connected the two mains, causing the parachute deployment actions to occur out of order," NASA said. See, it’s not just software (and hardware) that needs debugging; documentation does, too.

1 0

Veteran Editors Notepad++ and Geany Hit Milestone Versions
by Peter Reutemann 07 Dec '23

07 Dec '23

'Liam Proven reports via The Register: One of the best FOSS text editors for Windows, Notepad++, is turning 20, while cross platform Geany just hit version 2.0 as it turns 18 years old. Notepad++'s version 8.6 is the twentieth anniversary release of one of the go-to FOSS text editors for Windows. [...] If you use an Arm-powered Windows machine, such as the ThinkPad X13S, there is now a native Arm64 version. It still supports x86-32 as well, and there are portable versions which work without being installed locally -- handy if you don't have admin rights. There is even a usefully recent version for Windows XP if you are still using that geriatric OS. This release adds multi-select, allowing you to manipulate multiple instances of the same text at once, which looks confusing but very powerful. It is a staple on all of the Reg FOSS desk's Windows partitions, thanks to its inclusion in the essential Windows post-install setup tool Ninite. Ninite will install -- and update -- a whole swath of FOSS and freeware tools for Windows, making setup of a new machine doable in just a couple of clicks. And if you keep the Ninite installer file around, you can re-run it later and it will update everything it installed first time around. Ninite does offer other programmers' editors, such as Eclipse and Microsoft Visual Studio Code -- but they are behemoths by comparison. VSCode is implemented as an Electron app, meaning that it's huge, embeds an entire copy of Chromium, and scoffs RAM like it's going out of fashion. Notepad++ is a native Win32 app, making it tiny and fast: the download is less than 5MB, one twentieth the size of VSCode. Sluggish, bloated editors are not just a problem on Windows. Gargantuan Electron apps are distressingly prevalent on Linux and macOS as well. This vulture is guilty of using some, and even recommending them -- because some of them can do things that nothing else can. That's not true in the case of plain text editors, though. You don't have to put up with apps that take a good fraction of a gigabyte for this. Geany is a good example. It straddles the line between a text editor and an IDE: it can manage multi-project files, automatically call out to compilers and suchlike, and parse their output to highlight errors. We last mentioned it nearly a decade ago but the project recently reached voting age -- at least for humans -- and after this milestone in maturity its developers called the latest release version 2.0. It has better support for dark mode, a new tree view in its sidebar, adds a bunch of new supported file types, and can detect if the user changes the type of a file and re-do its syntax highlighting to match. ' -- source: https://news.slashdot.org/story/23/12/06/2153200 Yes, Notepad++ and 7zip are usually the first things I install on Windows boxes, to get something more usable than the built-in tools. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Developers Trust AI-Written Code Too Much
by Lawrence D'Oliveiro 06 Dec '23

06 Dec '23

Some worrying results from a survey <https://devclass.com/2023/12/05/ai-assistants-write-insecure-code-that-huma…> of the increasing use of AI-generated program code. The survey references a study ... from late last year which looked at “how developers choose to interact with AI code assistants and the ways in which those interactions cause security mistakes,” though the study was limited to university students. There are some shocks here, including the willingness of the AI assistant to generate SQL “that built the query string via string concatenation,” a sure route to SQL injection vulnerabilities. And also a very common feature in code written by PHP developers. Perhaps that kind of code figured very prominently in the training sets for these AIs? Also note this: A key problem is that human intuition seems inclined to trust AI engines more than their known limitations merit. It is known that generative AI is not reliable; yet a lifetime of learning that computers are more logical than humans is hard to overcome. Surely this is just the stereotypical, simplistic Hollywood movie/TV view of computers? Can people in the real world be that dumb? Those of us with experience of computers realize that “more logical than humans” merely means “being able to follow longer logical inference chains than humans”. But if the assumptions the computer is starting from are wrong, the inferences it draws are going to be just as wrong: “Garbage In, Garbage Out” as the old saying goes. And bugs in the algorithms for following those inference chains (e.g. incorrect coding of calculation formulas) just make things worse.

1 0

Firefox On the Brink?
by Peter Reutemann 06 Dec '23

06 Dec '23

'An anonymous reader shares a report: A somewhat obscure guideline for developers of U.S. government websites may be about to accelerate the long, sad decline of Mozilla's Firefox browser. There already are plenty of large entities, both public and private, whose websites lack proper support for Firefox; and that will get only worse in the near future, because the 'fox's auburn paws are perilously close to the lip of the proverbial slippery slope. The U.S. Web Design System (USWDS) provides a comprehensive set of standards which guide those who build the U.S. government's many websites. Its documentation for developers borrows a "2% rule" from its British counterpart: "... we officially support any browser above 2% usage as observed by analytics.usa.gov." (Firefox's market share was 2.2%, per the traffic for the previous ninety days.) [...] "So what?" you may wonder. "That's just for web developers in the U.S. government. It doesn't affect any other web devs." Actually, it very well could. Here's how I envision the dominoes falling: 1. Once Firefox slips below the 2% threshold in the government's visitor analytics, USWDS tells government web devs they don't have to support Firefox anymore. 2. When that word gets out, it spreads quickly to not only the front-end dev community but also the corporate IT departments for whom some web devs work. Many corporations do a lot of business with the government and, thus, whatever the government does from an IT standpoint is going to influence what corporations do. 3. Corporations see this change as an opportunity to lower dev costs and delivery times, in that it provides an excuse to remove some testing (and, in rare cases, specific coding) from their development workflow.' -- source: https://news.slashdot.org/story/23/12/05/0745251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenZFS Fixes Data Corruption Issue
by Peter Reutemann 05 Dec '23

05 Dec '23

'A pull request has been merged to fix a data corruption issue in OpenZFS (the open-source implementation of the ZFS file system and volume manager). "OpenZFS 2.2.2 and 2.1.14 released with fix in place," reports a Thursday comment on GitHub. Earlier this week, jd (Slashdot reader #1,658) wrote: All versions of OpenZFS 2.2 suffer from a defect that can corrupt the data. Attempts to mitigate the bug have reduced the likelihood of it occurring, but so far nobody has been able to pinpoint what is going wrong or why. Phoronix reported on Monday: Over the US holiday weekend it became more clear that this OpenZFS data corruption bug isn't isolated to just the v2.2 release — older versions are also susceptible — and that v2.2.1 is still prone to possible data corruption. The good news at least is that data corruption in real-world scenarios is believed to be limited but with some scripting help the corruption can be reproduced. It's also now believed that the OpenZFS 2.2 block cloning feature just makes encountering the problem more likely. ' -- source: https://news.slashdot.org/story/23/12/03/0134224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

RHEL 10 Plans To Drop X.Org Server Except For XWayland
by Peter Reutemann 01 Dec '23

01 Dec '23

'"Red Hat is going to do away with the X.Org server and support Wayland and XWayland for apps that currently (or only) run on X11," writes Slashdot reader motang. Red Hat's Carlos Soriano Sanchez confirmed on the Red Hat blog: "The result of this evaluation is that, while there are still some gaps and applications that need some level of adaptation, we believe the Wayland infrastructure and ecosystem are in good shape, and that we're on a good path for the identified blockers to be resolved by the time RHEL 10 is out, planned to be released on the first half of 2025. With this, we've decided to remove Xorg server and other X servers (except Xwayland) from RHEL 10 and the following releases. Xwayland should be able to handle most X11 clients that won't immediately be ported to Wayland, and if needed, our customers will be able to stay on RHEL 9 for its full life cycle while resolving the specifics needed for transitioning to a Wayland ecosystem. It's important to note that "Xorg Server" and "X11" are not synonymous, X11 is a protocol that will continue to be supported through Xwayland, while the Xorg Server is one of the implementations of the X11 protocol. [...] This decision will allow us to focus our efforts starting from RHEL 10 solely on a modern stack and ecosystem. This means we will be able to tackle problems such as HDR, increased security, setups with mixed low and high density displays or very high density displays, better GPU/Display hot-plugging, better gestures and scrolling, and so on. We are confident that Wayland will provide a solid platform and we're excited to work with the community and all of our partners and customers on building the future for Linux." ' -- source: https://linux.slashdot.org/story/23/11/29/0559207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Don Hopkins Blog
by Lawrence D'Oliveiro 30 Nov '23

30 Nov '23

Following some random link (as you do) left me ending up at a collection of postings on Medium <https://donhopkins.medium.com/> by one Don Hopkins. His brief bio on that page starts “User interface flower child”, and his personal network includes such luminaries as Alan Kay and bright sparks at Sun Microsystems and elsewhere. (You can tell from those names that he’s been around a while.) Here <https://donhopkins.medium.com/alan-kay-on-should-web-browsers-have-stuck-to…> is an example of the kind of freewheeling discussion he and his mates get into, over the connections between web browsers, the PostScript printing language, Apple’s old HyperCard and AppleScript technologies, Xerox PARC, SimCity (!) and other fun stuff. Including some concepts that might have been, but never were.

1 0

ownCloud vulnerability with maximum 10 severity score comes under “mass” exploitation
by Peter Reutemann 30 Nov '23

30 Nov '23

'Security researchers are tracking what they say is the “mass exploitation” of a security vulnerability that makes it possible to take full control of servers running ownCloud, a widely used open source file-sharing server app. The vulnerability, which carries the maximum severity rating of 10, makes it possible to obtain passwords and cryptographic keys allowing administrative control of a vulnerable server by sending a simple Web request to a static URL, ownCloud officials warned last week. Within four days of the November 21 disclosure, researchers at security firm Greynoise said, they began observing “mass exploitation” in their honeypot servers, which masqueraded as vulnerable ownCloud servers to track attempts to exploit the vulnerability. The number of IP addresses sending the web requests has slowly risen since then. At the time this post went live on Ars, it had reached 13. “We're seeing hits to the specific endpoint that exposes sensitive information, which would be considered exploitation,” Glenn Thorpe, senior director of security research & detection engineering at Greynoise, said in an interview on Mastodon. “At the moment, we've seen 13 IPs that are hitting our unadvertised sensors, which indicates that they are pretty much spraying it across the internet to see what hits.” CVE-2023-49103 resides in versions 0.2.0 and 0.3.0 of graphapi, an app that runs in some ownCloud deployments, depending on the way they’re configured. A third-party code library used by the app provides a URL that, when accessed, reveals configuration details from the PHP-based environment. In last week’s disclosure, ownCloud officials said that in containerized configurations—such as those using the Docker virtualization tool—the URL can reveal data used to log in to the vulnerable server. The officials went on to warn that simply disabling the app in such cases wasn’t sufficient to lock down a vulnerable server.' -- source: https://arstechnica.com/security/2023/11/owncloud-vulnerability-with-a-maxi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FFmpeg 6.1 “Heaviside”
by Lawrence D'Oliveiro 29 Nov '23

29 Nov '23

Seems there is another numbered-version release of FFmpeg <https://www.theregister.com/2023/11/24/ffmpeg_6_1/>. I didn’t even notice: I did a fresh build a few days ago, and I fetch my upstream from <git://source.ffmpeg.org/ffmpeg>, and it appears that repo now actually points to <http://git.videolan.org/?p=ffmpeg.git>. And I just build whatever happens to be at the head of the master branch at the time. This FFmpeg version is named “Heaviside”, after Oliver Heaviside, a major figure in the whole 19th-century ferment over electromagnetic theory, Maxwell’s equations, the development of the associated mathematical techniques of vector analysis, quaternions and all that jazz. If you are interested, here <https://www.youtube.com/watch?v=M12CJIuX8D4> is an entertaining exposition on the very human figures involved in these developments, from a presenter who combines an enthusiasm for the subject with the patience to dig up a remarkable amount of detail (including personal foibles, naturally) about what went on. Why build FFmpeg yourself? Because then you can enable combinations of options that are not legally allowed in any prebuilt binary package. For example, you can have both “--enable-gpl” and “--enable-nonfree”, and end up with a build that is marked “unredistributable”. FFmpeg is both a set of command-line tools, and a set of libraries underlying them, that can also be built into other custom applications. For those intimidated by the truly breathtaking array of options in the command-line tools, there are GUI front-ends to make the functionality more approachable. I hear HandBrake is quite popular. Though I was disappointed to discover that, instead of being a simple GUI wrapper around the command-line tools, it builds its own application directly around the libraries. The downsides of this are that it limits the functionality it can make available, and also makes it harder to keep up with changes to that functionality.

1 1

Roll On The ARM-Based Supers
by Lawrence D'Oliveiro 29 Nov '23

29 Nov '23

Report on the status of ARM-based supercomputing <https://www.nextplatform.com/2023/11/28/hpc-pioneers-pave-the-way-for-a-flo…>. The Fugaku machine was top of the Top500 list from June 2020 to November 2021, which was a pretty decent run. That Fujitsu A64FX chip also powers other supers on the list. But now more entrants are on the way. In terms of user experience, the article reports quite a mixed bag. Some apps are yet to be tuned to wring maximum performance out of ARM hardware, while others build and run nicely without any drama at all. And of course, at some point we should see the first RISC-V machine(s) enter the list.

1 0

MyACC Offline After “Fraudulent Activity”
by Lawrence D'Oliveiro 29 Nov '23

29 Nov '23

ACC’s self-service web portal for accident victims has been temporarily taken down after “apparent fraudulent access” <https://www.nzherald.co.nz/business/myacc-offline-after-fraudulent-activity…>. Here’s hoping it’s not yet another mass compromise of user data ...

1 0

OpenZFS Data-Corruption Bug
by Lawrence D'Oliveiro 29 Nov '23

29 Nov '23

Seems OpenZFS has a problem which, under rare conditions, can turn parts of your data into rubbish <https://www.theregister.com/2023/11/27/openzfs_2_2_0_data_corruption/>. Initially it was thought this bug was introduced in version 2.2.0, but now there is some indication that it goes back much earlier. It certainly seems difficult to reproduce, and at least one commenter on the article is saying not to worry about it, it’s not going to affect most “traditional” users (whatever that means). It seems the issue does date back to after Oracle closed the source on the original ZFS project and made it proprietary again. Open-source ZFS has long been a controversial issue. Linus Torvalds is not impressed with its performance, for example <https://list.waikato.ac.nz/archives/list/wlug(a)list.waikato.ac.nz/thread/C…>. Also, many have said that the licence it uses, the CDDL, is deliberately designed to be incompatible with the GPL used by the Linux kernel and many other projects. Ubuntu seem to disagree, and are happy to include OpenZFS with their Linux distro. Interestingly, Oracle also offer a Linux distro. And they have never offered ZFS with that, even though there is clearly demand for such a feature. Some interpret this as a tacit admission that the licence _is_ indeed GPL-incompatible. Because if Oracle bundled CDDL-licensed software with that made available under the GPL, then under the terms of the latter, they also give permission to anybody else to do the same. The implication is, they don’t want to do that.

1 0

PHP 8.0 End of Life Is Today, November 26, 2023
by Peter Reutemann 27 Nov '23

27 Nov '23

'Slashdot reader sysadminafterdark writes: Released on November 26, 2020, PHP 8 brought many optimizations and powerful features to the language.Fast forward to today, and PHP 8 is getting the boot in favor of 8.1, 8.2, and 8.3 with 8.4 in development. This leaves some websites at risk of breaking and potential security issues. Hearing of this news, I upgraded my own blog and wrote an article on how to add the Remi repository and update. I run Enterprise Linux (The best distro out there) so if you are standing up new boxes, just keep in mind the PHP in the repo is deprecated.' -- source: https://developers.slashdot.org/story/23/11/26/1826247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

util-linux Collection
by Lawrence D'Oliveiro 26 Nov '23

26 Nov '23

I was looking at the source repository for the util-linux package <https://github.com/util-linux/util-linux>, and discovered that the collection of tools is larger than I thought. There are also a few items listed that aren’t (yet?) in the installed package on my Debian Unstable system. For example, I recently discovered that the “mount” command not only does mounting and unmounting of volumes, but without any options it will also output a list of all current mounts, and this can be done by nonprivileged users. But util-linux includes a more powerful command for this purpose called “findmnt”, which includes more elaborate options for obtaining information about mounted filesystems, including monitoring changes to them. In that repo, I also found “lsfd”, which is meant to be a replacement for “lsof” that takes advantage of newer capabilities specific to the Linux kernel. Also there is “lsns”, which displays information about namespaces. Firefox, in particular, seems to use a whole lot of these, presumably as part of its mechanisms for isolating its processes from each other. This is in addition to other useful ones like “lscpu”, “lspci” “lsusb”, “lsmem”, “lsblk”, “lslocks” and “lsirq”. Interesting that quite a few of these commands support JSON output format. If you don’t want to go this far, you can explicitly specify which columns are included in the output; this is recommended if you want to parse the output in scripts, instead of relying on the default output format not changing. And yes, I have seen some over-elaborate scripts that went to a whole lot of trouble to extract the information they needed from some command, instead of using options in the command to output that information directly.

1 0

Microsoft Windows And The “USB Cart Of Death”
by Lawrence D'Oliveiro 26 Nov '23

26 Nov '23

For all Microsoft’s efforts, it seems Windows and USB have never sat entirely easily together. Here <https://www.theregister.com/2023/11/25/windows_usb_cart_of_death/> is a story from the early days, of how QA people (remember when Microsoft had QA people?) would torment kernel developers by wheeling in a cart laden with USB devices, all daisy-chained together, plugging them in to the test machine, pulling the plug out again, and watching the resulting crash. "The goal," said Chen, "was to get it to the point where you could plug in the USB Cart of Death and unplug it anytime you wanted, and everything would still work... and I think they made it." Note that “I think”. I suppose things are better nowadays, somewhat. I remember when I was starting to learn Android development, I was bemused to discover that Windows required a special USB driver in order to allow live debugging on a connected Android device. This was not necessary on any other platform--their built-in USB support was quite sufficient. And wouldn’t you know it, that limitation still applies to current versions of Windows <https://developer.android.com/studio/run/win-usb>.

1 0

Microsoft’s “Project Silica”: Glass-Based Archival Storage
by Lawrence D'Oliveiro 24 Nov '23

24 Nov '23

A group at Microsoft is researching the potential of being able to store data in slabs of quartz glass, at densities comparable to hard drives or even higher <https://blocksandfiles.com/2023/11/22/microsoft-silica-glass-based-storage/>. The data is encoded optically in the glass, using femtosecond laser pulses. There can be hundreds of layers of data within a single block of glass. However, reading back the data involves processing scanned images of the glass layers through a “machine learning algorithm”. This can take some time. That means verification of a backup you just did is going to be just as slow.

1 0

Firefox 120 Ready With Global Privacy Control, WebAssembly GC On By Default
by Peter Reutemann 24 Nov '23

24 Nov '23

'Firefox 120 will be available tomorrow, bringing support for the Global Privacy Control "Sec-GPC" request header to indicate whether a user consents to a website or service selling or sharing their personal information with third parties. It's also enabling the WebAssembly GC extension by default, opening up new languages like Dart and Kotlin to run in the browser. Phoronix's Michael Larabel highlights some of the other features included in this release: - Ubuntu Linux users now have the ability to import data from Chromium when both are installed as Snap packages. - Picture-in-Picture mode now supports corner snapping on Windows and Linux. - Support for the light-dark() CSS color function that allows setting of colors for both light and dark without needing to use the prefers-color-scheme media feature. This allows conveniently specifying the preferred light color theme value followed by the dark color theme value. - CSS support for the lh and rlh line height units. ' -- source: https://news.slashdot.org/story/23/11/20/2132231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Ditching an IDE for hacking on Inkscape
by Ben Cottrell 23 Nov '23

23 Nov '23

I’ve acquainted myself with many IDE’s: Visual Studio, Qt Creator, CLion, and I’ve found it counter-productive to reconfigure projects and/or build environments within an IDE. Instead, I can use nvim, the MSYS MINGW x64 shell and environment (I use OpenSUSE Tumbleweed, but I have the misfortune of choosing an NVIDIA GPU, so, GNU/Windows is my mainstay). I don’t mind IDE’s if the project can be well defined within a ‘solution’ file, but even so, with Visual Studio, you may have to go through many config windows to pass the correct build flags. Other IDE’s like Qt Creator are pretty similar where you have to recreate config cache files for minor build setting changes. I feel better to forgo the latter in favour of text editors, like Notepad++ or NeoVim, even if you lose autocomplete and fancy highlighting and a nice GUI inspectors for piece-wise debugging. Building and hacking on Inkscape is going easier this way. Do you use an IDE often, or do you prefer using a special emacs setup or something similar, please share 😊 Cheers, Ben

2 1

Itanium Is Done--Stick A Fork In It
by Lawrence D'Oliveiro 22 Nov '23

22 Nov '23

Looks like Itanium support is finally well and truly being dropped from the Linux kernel <https://www.theregister.com/2023/11/21/saving_linux_on_itanium/>. I think Linus has done the right thing, by challenging the complainers to put their money where their mouth is: if they can take up the job of keeping patches up-to-date outside the mainline kernel for a year, he will look at bringing it back in again. But he doesn’t believe that will happen. I can remember in the early days of Itanium, an Intel executive said that Linux was the first OS they got going on the new architecture. And now it is the last one to abandon ship. (Microsoft gave up a long time ago.) What I find difficulty in believing is that anybody would have continued using such machines in business-essential roles, once it became clear they had no future. Every time this sort of thing comes up in a discussion, I ask: would you entrust mission-critical business functions to obsolete, unsupported hardware/software?

1 0

FreeBSD 14 Released
by Peter Reutemann 22 Nov '23

22 Nov '23

'FreeBSD 14 has been officially released. You can get it from FreeBSD.org, or via freebsd-update and source update methods for existing systems. Some highlights: - OpenSSH version 9.5p1 - OpenSSL version 3.0.12, a major upgrade from OpenSSL 1.1.1t in FreeBSD 13.2 - OpenZFS release 2.2 - The bhyve hypervisor now supports TPM and GPU passthrough This version will now create user home directories in /home by default, instead of the traditional /usr/home. More information on the release and changes can be found via the release announcement page. ' -- source: https://bsd.slashdot.org/story/23/11/21/0512225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can AI Be Used to Fine-Tune Linux Kernel Performance?
by Peter Reutemann 21 Nov '23

21 Nov '23

'ZDNet: At the Linux Plumbers Conference, the invite-only meeting for the top Linux kernel developers, ByteDance Linux Kernel Engineer Cong Wang, proposed that we use AI and machine learning to tune the Linux kernel for the maximum results for specific workloads... There are thousands of parameters. Even for a Linux expert, tuning them for optimal performance is a long, hard job. And, of course, different workloads require different tunings for different sets of Linux kernel parameters... What ByteDance is working on is a first attempt to automate the entire Linux kernel parameter tuning process with minimal engineering efforts. Specifically, ByteDance is working on tuning Linux memory management. ByteDance has found that with machine learning algorithms, such as Bayesian optimization, automated tuning could even beat most Linux kernel engineers. Why? Well, the idea, as Wang wryly put it, "is not to put Linux kernel engineers out of business." No, the goal is "to liberate human engineers from tuning performance for each individual workload. While making better decisions with historical data, which humans often struggle with. And, last, but never least, find better solutions than those we come up with using our current trial and error, heuristic methods. In short, ByteDance's system optimizes resource usage by making real-time adjustments to things like CPU frequency scaling and memory management.' -- source: https://linux.slashdot.org/story/23/11/20/0153201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Announces Intent to Form 'High Performance Software Foundation'
by Peter Reutemann 20 Nov '23

20 Nov '23

'This week the Linux Foundation "announced the intention to form the High Performance Software Foundation. "Through a series of technical projects, the High Performance Software Foundation aims to build, promote, and advance a portable software stack for high performance computing by increasing adoption, lowering barriers to contribution, and supporting development efforts." As use of high performance computing becomes ubiquitous in scientific computing and digital engineering, and AI use cases multiply, more and more data centers deploy GPUs and other compute accelerators. The High Performance Software Foundation intends to leverage investments made by the United States Department of Energy's Exascale Computing Project, the EuroHPC Joint Undertaking, and other international projects in accelerated high performance computing to exploit the performance of this diversifying set of architectures. As an umbrella project under the Linux Foundation, HPSF intends to provide a neutral space for pivotal projects in the high performance software ecosystem, enabling industry, academia, and government entities to collaborate together on the scientific software stack. The High Performance Software Foundation already benefits from strong support across the high performance computing landscape, including leading companies and organizations like Amazon Web Services, Argonne National Laboratory, CEA, CIQ, Hewlett Packard Enterprise, Intel, Kitware, Lawrence Berkeley National Laboratory, Lawrence Livermore National Laboratory, Los Alamos National Laboratory, NVIDIA, Oak Ridge National Laboratory, Sandia National Laboratory, and the University of Oregon. Its first open source technical projects include: - Spack: the high performance computing package manager - Kokkos: a performance-portable programming model for writing modern C++ applications in a hardware-agnostic way. - AMReX: a performance-portable software framework designed to accelerate solving partial differential equations on block-structured, adaptively refined meshes. - WarpX: a performance-portable Particle-in-Cell code with advanced algorithms that won the 2022 Gordon Bell Prize - Trilinos: a collection of reusable scientific software libraries, known in particular for linear, non-linear, and transient solvers, as well as optimization and uncertainty quantification. - Apptainer: a container system and image format specifically designed for secure high-performance computing. - VTK-m: a toolkit of scientific visualization algorithms for accelerator architectures. - HPCToolkit: performance measurement and analysis tools for computers ranging from laptops to the world's largest GPU-accelerated supercomputers. - E4S: the Extreme-scale Scientific Software Stack - Charliecloud: high performance computing-tailored, lightweight, fully unprivileged container implementation.' -- source: https://tech.slashdot.org/story/23/11/19/1920250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Governments turn to Open Source for sovereignty
by Peter Reutemann 20 Nov '23

20 Nov '23

Came across this news item on my Mastodon feed: 'The German government has launched a new Open Source software project called openDesk, which aims to reduce the country’s dependency on proprietary software vendors and support transparency and interoperability. openDesk is a collection of Open Source software modules that are important for day-to-day work in the public sector, such as text creation, file collaboration, project management, email, calendar and messaging. While the initial focus is on public administration in Germany, The source code is publicly available on a government-provided GitLab called openCoDE, making it available, free of charge, for use by other organizations, industries and geographical location. Discussions are taking place with other European countries; France and Austria in particular have already expressed interest. Commissioned by the German Federal Ministry of the Interior and Home Affairs (BMI), under the project leadership of a newly created Center for Digital Sovereignty, ZenDiS.' -- source: https://mastodon.social/@janvlug/111438616208935401 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Rust in Linux: Maturing with Support from Cisco, Samsung, Canonical
by Peter Reutemann 20 Nov '23

20 Nov '23

'ZDNet shares on update on "Rust in Linux: Where we are and where we're going next," citing a talk at the Linux Plumbers Conference in Richmond, Virginia by Linux/Rust developer Miguel Ojeda: In brief, Rust Linux is continuing to mature and is getting strong support from developers and vendors, such as Cisco, Samsung, and Canonical... Rust is taking the steps it needs to become — along with C — a fully-fledged member of the Linux language toolchain... That's not to say that we're ready to retire C for Rust just yet. In fact, that day is unlikely ever to come. But Rust is definitely on its way to becoming an important language for Linux development... As for the day-to-day work that's required to make Rust fully integrated with Linux, the "official" website of the initiative is now the self-explanatory Rust for Linux. This site is your one-stop source for all things Rust on Linux... However, the move forward has not been straightforward. Rust on Linux developers have discovered some problems along the way. For example, while deadlocks, when two or more threads are waiting on the other to finish, are safe in Rust, because they don't result in undefined behavior, they're not safe in the Linux kernel. The programmers are working on fixing this issue... A related issue is that there's growing interest in backporting Rust support into long-term support (LTS) versions of Linux, specifically 5.15 and 6.1. Some people are especially showing interest in the super LTS Linux 6.1 kernel. However, Linux doesn't generally allow backports into LTS Linuxes. So, if you really, really want fully featured Rust support in an older LTS kernel, you're going to need to pay for it in one way or the other. Another general rule that Rust developers have decided they're going to try to "break" is the rule against duplicate drivers. Usually, no one wants anyone wasting time reinventing the wheel, but some maintainers are open to the idea of experimenting with Rust, by starting simple with a driver they're already familiar with... These movements are small steps forward, but they're all critical for making Rust equal to C as a Linux programming language.' -- source: https://linux.slashdot.org/story/23/11/18/012228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0