December 2014 - wlug - list.wlug.org.nz

The Case Against "Non-Commercial" Restrictions
by Lawrence D'Oliveiro 21 Dec '14

21 Dec '14

The Creative Commons <http://creativecommons.org/> family of copyright licences has become very popular for artworks, documentation and all kinds of creative works generally. But there are different kinds of Creative Commons (CC) licences, with additional qualifications, namely “BY” (attribution required, i.e. give credit to the creators), “SA” (sharealike or “copyleft”, i.e. if you redistribute, do it on the same terms it was given to you), “NC” (non-commercial use only) and “ND” (no derivatives--i.e. modified versions--allowed), and certain combinations thereof. These qualifications divide the CC licences into two categories: Free and non-Free. The non-Free CC licences are those including NC or ND or both, while the Free ones are the rest: * CC0 -- effectively public domain * CC-BY -- distribution with attribution required * CC-BY-SA -- sharealike distribution with attribution If you want to promote sharing and contribute to Free Culture, stick to these three licences. In particular, here <http://freedomdefined.org/Licenses/NC> is a detailed discussion of the NC restriction, and why it is such a bad idea. Most people who stick an NC licence on their work think in terms of preventing big commercial outfits from “ripping them off”. However, this licensing restriction may not achieve what you think it does, particularly since it is often unclear what constitutes “commercial” use anyway.

1 0

Does Anybody Like GNU Info?
by Lawrence D'Oliveiro 21 Dec '14

21 Dec '14

Anybody who has looked at Linux documentation on the command line would know about man pages, and quite likely about GNU info as well. The GNU project invented the “info” system as a (supposedly) superior replacement for man pages, but for some reason it never became that popular. I personally find it quite annoying to use, and it’s clear I’m not the only one. The GNU info system requires documentation to be written in Texinfo format, from which it can be generated in other formats displayable with the info command as well as other means. Now at least one GNU project, namely Emacs <http://lwn.net/Articles/625072/>, is contemplating moving away from maintaining its documentation in Texinfo format. The suggestion is to use AsciiDoc instead. This is one of a raft of newer, simpler markup formats that are designed so that even the source can be read and understood by ordinary humans, since the appearance of many of the markup sequences already gives some indication of their function in the layout. You may also have heard of Markdown (GitHub uses a flavour of this) and reStructedText (understood by Docutils/Sphinx, the standard toolset for Python documentation)--these are variations on the same idea. The LWN article has an error in it, though: the AsciiDoc package itself is not constrained to only generating HTML, it can output (shudder) DocBook SGML as well. And then there is another piece of software called Pandoc, which can convert between a whole range of different formats, including AsciiDoc.

1 0

Critical Git Security Vulnerability Announced
by Peter Reutemann 19 Dec '14

19 Dec '14

'Github has announced a security vulnerability and has encourage users to update their Git clients as soon as possible. The blog post reads in part: "A critical Git security vulnerability has been announced today, affecting all versions of the official Git client and all related software that interacts with Git repositories, including GitHub for Windows and GitHub for Mac. Because this is a client-side only vulnerability, github.com and GitHub Enterprise are not directly affected. The vulnerability concerns Git and Git-compatible clients that access Git repositories in a case-insensitive or case-normalizing filesystem. An attacker can craft a malicious Git tree that will cause Git to overwrite its own .git/config file when cloning or checking out a repository, leading to arbitrary command execution in the client machine. Git clients running on OS X (HFS+) or any version of Microsoft Windows (NTFS, FAT) are exploitable through this vulnerability. Linux clients are not affected if they run in a case-sensitive filesystem....Updated versions of GitHub for Windows and GitHub for Mac are available for immediate download, and both contain the security fix on the Desktop application itself and on the bundled version of the Git command-line client."' -- source: http://it.slashdot.org/story/14/12/18/2346238 Cheers, Petere -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Grinch Vulnerability Could Put a Hole In Your Linux Stocking
by Peter Reutemann 18 Dec '14

18 Dec '14

"In a blog post Tuesday, security service provider Alert Logic warned of a Linux vulnerability, named grinch after the well-known Dr. Seuss character, that could provide attackers with unfettered root access. The fundamental flaw resides in the Linux authorization system, which can inadvertently allow privilege escalation, granting a user full administrative access. Alert Logic warned that Grinch could be as severe as the Shellshock flaw that roiled the Internet in September." -- source: http://linux.slashdot.org/story/14/12/18/2022245 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Manufacturer's Backdoor Found On Popular Chinese Android Smartphone
by Peter Reutemann 17 Dec '14

17 Dec '14

"A popular Android smartphone sold primarily in China and Taiwan but also available worldwide, contains a backdoor from the manufacturer that is being used to push pop-up advertisements and install apps without users' consent. The Coolpad devices, however, are ripe for much more malicious abuse, researchers at Palo Alto Networks said today, especially after the discovery of a vulnerability in the backend management interface that exposed the backdoor's control system. Ryan Olson, intelligence director at Palo Alto, said the CoolReaper backdoor not only connects to a number of command and control servers, but is also capable of downloading, installing and activating any Android application without the user's permission. It also sends phony over-the-air updates to devices that instead install applications without notifying the user. The backdoor can also be used to dial phone numbers, send SMS and MMS messages, and upload device and usage information to Coolpad." -- source: http://it.slashdot.org/story/14/12/17/1815250 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Python Moving To Git
by Lawrence D'Oliveiro 16 Dec '14

16 Dec '14

About 5½ years ago, the decision was made <http://lwn.net/Articles/326201/> to use Mercurial as the preferred version-control system (VCS) for Python development. It was already clear at the time that there was a strong preference among developers for Git instead of Mercurial. And since that time, the dominance of Git has only grown. It appears that Mercurial is still the official VCS for at least the CPython core, but the Python project already has a GitHub area <https://github.com/python> which includes a “Semi-official read-only mirror of the CPython Mercurial repository”. I would suspect that a lot of their contributors are already doing their work in Git, and communicating with the upstream Mercurial repo using an addon like git-remote-hg, which makes it look just like a native Git repo. Now there is a plan to migrate at least some supporting repositories <http://lwn.net/Articles/624101/> <http://lwn.net/Articles/623905/> officially to Git, and also use GitHub to host these instead of at python.org. These stats from the PEP are quite interesting: The Open Hub (Previously Ohloh) statistics ... show that currently 37% of the repositories Open Hub is indexing is using git which is second only to SVN (which has 48%) while Mercurial has just 2% of the indexed repositories (beating only bazaar which has 1%). In addit[i]on to the Open Hub statistics a look at the top 100 projects on PyPI (ordered by total download counts) shows us that within the Python space itself there is a majority of projects using git: === ========= ========== ====== === ==== Git Mercurial Subversion Bazaar CVS None === ========= ========== ====== === ==== 62 22 7 4 1 1 === ========= ========== ====== === ==== Interesting that Subversion (aka SVN, an older, centralized, much less flexible version-control system) manages to handily beat Mercurial in non-Python-specific projects...

1 0

Raspberry Pi In Space
by Peter Reutemann 14 Dec '14

14 Dec '14

"When British astronaut Tim Peake heads off to the International Space Station in November 2015 he will be accompanied on his 6-month mission by two augmented Rapsberry Pis, aka Astro Pis. The Astro Pi board is a Raspberry Pi HAT and provides gyroscope, accelerometer and magnetometer and sensors for temperature, barometric pressure and humidity. It also has a real time clock, LED display and some push buttons — it sounds like the sort of addon that we could do with down here on earth as well! It will also be equipped with both camera module and an infra-red camera. UK school pupils are being challenged to write Rapberry Pi apps or experiments to run in space. During his mission Tim Peake will deploy the Astro Pis, upload the winning code whilst in orbit, set them running, collect the data generated and then download it to be distributed to the winning teams." -- source: http://build.slashdot.org/story/14/12/14/1827252 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Linux Mint 17.1 review—less change is good change
by Peter Reutemann 10 Dec '14

10 Dec '14

"This marks the first time Linux Mint has not used the newest version of Ubuntu for a release. But if you paid attention to the curious approach of Linux Mint 17.0, you'll know that was the plan all along. These days, Mint will not be changing its Ubuntu base again until the next LTS release—Ubuntu 16.04—arrives in 2016. And at first glance, it might seem like a bad thing. After all, Mint is missing out on whatever new stuff is in Ubuntu 14.10 (in this case it's not much, but 15.04 will have plenty of changes)." -- source: http://goo.gl/zaWPTV Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

$35 Quad-core Hacker SBC Offers Raspberry Pi-like Size and I/O
by Peter Reutemann 10 Dec '14

10 Dec '14

"Hardkernel has again set its sites on the Raspberry Pi with a new $35 Odroid-C1 hacker board that matches the RPI's board size and offers a mostly similar 40-pin expansion connector. Unlike the previous $30 Odroid-W that used the same Broadcom BCM2835 SoC as the Pi and was soon cancelled due to lack of BCM2835 SoC availability, the Odroid-C1 is based on a quad-core 1.5GHz Cortex-A5 based Amlogic S805 SoC, which integrates the Mali-400 GPU found on Allwinner's popular SoCs. Touted advantages over the similarly priced Raspberry Pi Model B+ include a substantially more powerful processor, double the RAM, an extra USB2.0 port that adds Device/OTG, and GbE rather than 10/100 Ethernet." -- source: http://hardware.slashdot.org/story/14/12/10/1334251 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Ubuntu Gets Container-Friendly "Snappy" Core
by Peter Reutemann 10 Dec '14

10 Dec '14

'Canonical just announced Ubuntu Core, which uses containers instead of packages. It's the biggest Ubuntu shakeup for 20 years, says Canonical's Mark Shuttleworth, and is based on a tiny core, which will run Docker and other container technology better, quicker and with greater security than other Linux distros. Delivered as alpha code today, it's going to become a supported product, designed to compete with both CoreOS and Red Hat Atomic, the two leading container-friendly Linux approaches. Shuttleworth says it came about because Canonical found it had solved the "cloud" problems (delivering and updating apps and keeping security) by accident — in its work on a mobile version of Ubuntu.' -- source: http://linux.slashdot.org/story/14/12/09/2225210 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Unity 8 Will Bring 'Pure' Linux Experience To Mobile Devices
by Peter Reutemann 09 Dec '14

09 Dec '14

'If you have tried the live images of Ubuntu Next you may worry that Canonical is trying to do a Windows 8 with Ubuntu. That's not true. There is no need to worry though: A great deal of work is happening at a deeper level that may not have yet surfaced. It will surface eventually, however. Will Cooke of Canonical clarifies: "We are trying to make it clear that Unity 8 desktop will look like the traditional desktop and will behave like a normal desktop. We are very aware that our users expect a normal desktop there." Unity 8 will offer the traditional desktop interface when it detects a desktop. The same OS will switch to a touch-based interface on touch-based devices such as tablets and smartphones.' -- source: http://linux.slashdot.org/story/14/12/09/1516240 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 1

Just-Announced X.Org Security Flaws Affect Code Dating Back To 1987
by Peter Reutemann 09 Dec '14

09 Dec '14

'Some of the worst X.Org security issues were just publicized in an X.Org security advisory. The vulnerabilities deal with protocol handling issues and led to 12 CVEs published and code dating back to 1987 is affected within X11. Fixes for the X Server are temporarily available via this Git repository.' -- source: http://it.slashdot.org/story/14/12/09/1747212 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Fedora 21 Released
by Peter Reutemann 09 Dec '14

09 Dec '14

'The Fedora Project has announced the release of Fedora 21. "As part of the Fedora.next initiative, Fedora 21 comes in three flavors: Cloud, Server, and Workstation. Cloud is now a top-level deliverable for Fedora 21, and includes images for use in private cloud environments like OpenStack, as well as AMIs for use on Amazon, and a new "Atomic" image streamlined for running Docker containers. The Fedora Server flavor is a common base platform that is meant to run featured application stacks, which are produced, tested, and distributed by the Server Working Group. The Fedora Workstation is a new take on desktop development from the Fedora community. Our goal is to pick the best components, and integrate and polish them. This work results in a more polished and targeted system than you've previously seen from the Fedora desktop." Here are screenshots for Fedora 21: GNOME, KDE, Xfce, LXDE, and MATE.' -- source: http://linux.slashdot.org/story/14/12/09/2059252 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Google Releases Android Studio 1.0, the First Stable Version of Its IDE
by Peter Reutemann 09 Dec '14

09 Dec '14

"After two years of development, Google today released Android Studio 1.0, the first stable version of its Integrated Development Environment (IDE) aimed solely at Android developers. You can download the tool right now for Windows, Mac, and Linux from the Android Developer site. Google first announced Android Studio, built on the popular IntelliJ IDEA Java IDE, at its I/O Developer conference in May 2013. The company's pitch was very simple: this is the official Android IDE." -- source: http://tech.slashdot.org/story/14/12/08/2129255 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 2

POODLE Flaw Returns, This Time Hitting TLS Protocol
by Peter Reutemann 09 Dec '14

09 Dec '14

"If you patched your sites against a serious SSL flaw discovered in October you will have to check them again. Researchers have discovered that the POODLE vulnerability also affects implementations of the newer TLS protocol. The POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability allows attackers who manage to intercept traffic between a user's browser and an HTTPS website to decrypt sensitive information, like the user's authentication cookies." -- source: http://it.slashdot.org/story/14/12/09/0423210 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Blockly Versus Scratch
by Lawrence D'Oliveiro 09 Dec '14

09 Dec '14

You may have heard of MIT Scratch <http://scratch.mit.edu/>, a visual programming language oriented to teaching children programming. Initially I was put off by the non-Free licence (you couldn’t redistribute modified code), but that seems to have gone now, and the source is available <https://github.com/LLK/Scratch_1.4> under completely Free licences, the core being GPLv2, plugins under an MIT licence, and support materials/samples under CC-BY-SA. Google has its own alternative along the same lines, but Web-based, called Blockly <https://code.google.com/p/blockly/>. And Barack Obama has successfully used it to become the first US president to write a computer program <http://www.engadget.com/2014/12/08/barack-obama-just-became-the-first-us-pr…>.

1 0

Linux 3.18 Released, Lockup Bug Still Present
by Peter Reutemann 08 Dec '14

08 Dec '14

"As anticipated, Linus Torvalds officially released Linux 3.18. The new version is now out there, though that nasty lockup issue has still yet to be resolved. Dave Jones is nearing the end of dissecting the issue, but since it also affects Linux 3.17 and not too many people seem to get hit by the lockups, Linus Torvalds decided to go ahead and do the 3.18 release on schedule. Linus was also concerned that dragging out the 3.18 release would then complicate the Linux 3.19 merge window due to the holidays later this month. Now the Linux 3.19 kernel merge window is open for two weeks of exciting changes." -- source: http://linux.slashdot.org/story/14/12/08/2020251 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Powerful, highly stealthy Linux trojan may have infected victims for years
by Peter Reutemann 08 Dec '14

08 Dec '14

"Researchers have uncovered an extremely stealthy trojan for Linux systems that attackers have been using to siphon sensitive data from governments and pharmaceutical companies around the world." -- source: http://goo.gl/JG2Jh3 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Fwd: [NZOSS-Openchat] LCA 2015 Keynote Session - Q&A with Linus Torvalds
by Peter Reutemann 08 Dec '14

08 Dec '14

Excuse the cross posting, but here is an amazing incentive to get to LCA 2015 in Auckland this year. - Way, way back in 2003, at LCA in Perth, there was a Q&A session with Linus Torvalds, Bdale Garbee and Andrew Tridgell. It’s time for a follow-up so at LCA 2015 in Auckland it’s going to happen! The Q&A session is scheduled for 09:00 am Friday, 16 January 2015 and will be moderated by Bdale Garbee with the assistance of Andrew Tridgell. Helsinki-born Linus, who simply calls himself a Software Engineer, was the principle force behind developing the Linux kernel. It all started from an initial usenet posting in August of 1991 and made what has proved to be a historic debut with the release of version 1.0 on March 14 1994. In June 2003 Linus started working for Open Source Development Labs. After merging with the Free Standards Group it became the Linux Foundation where Linus continues to work as the project’s coordinator and is Chief Architect of the Linux kernel. In 2005, after criticism for for his use and alleged advocacy of BitKeeper, proprietary software for version-control in the Linux kernel, Linus wrote a free-software replacement for BitKeeper called GIT which is now the most widely-adopted version-control system for software development. Linus is an accomplished diver and in 2011, frustrated with the lack of decent divelog software on Linux, he developed Subsurface (http://subsurface-divelog.org/) an Open Source divelog program that runs on Windows, Mac and Linux. We know that there are a number of beautiful diving spots not too far from Auckland... The LCA 2015 Auckland team would like to thank the Linux Foundation for their assistance in making this possible. -------------------------------------------- Steven Ellis - Technical Director OpenMedia Limited - The Home of myPVR email - steven(a)openmedia.co.nz _______________________________________________ Openchat mailing list Openchat(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/openchat -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

moving the mailing list - recap
by Peter Reutemann 02 Dec '14

02 Dec '14

Hi everyone >From what I can gather, the main reason for moving the mailing list (aggressive spam filtering), no longer seems to be an issue. Therefore, I think that we can end the discussion and leave things just as they are. Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 1