March 2018 - wlug - list.wlug.org.nz

Debian 9.4 Released
by Peter Reutemann 11 Mar '18

11 Mar '18

'The Debian project is pleased to announce the fourth update of its stable distribution Debian 9 (codename "stretch"). This point release mainly adds corrections for security issues, along with a few adjustments for serious problems... Please note that the point release does not constitute a new version of Debian 9 but only updates some of the packages included. There is no need to throw away old "stretch" media. After installation, packages can be upgraded to the current versions using an up-to-date Debian mirror. Phoronix adds that Debian 9.4 "has a new upstream Linux kernel release, various dependency fixes for some packages, an infinite loop fix in Glade, several CVE security fixes, a larger stack size for NTP, a new upstream release of their NVIDIA proprietary driver package, Python 3 dependency fixes, and other security fixes."' -- source: https://linux.slashdot.org/story/18/03/10/2120216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Developer McHardy Drops GPLv2 'Shake Down' Case
by Peter Reutemann 11 Mar '18

11 Mar '18

'Former Linux developer Patrick McHardy dropped his Gnu General Public License version 2 (GPLv2) violation case against Geniatech in a German court this week. ZDNet explains why some consider this a big "win": People who find violations typically turn to organizations such as the Free Software Foundation, Software Freedom Conservancy (SFC), and the Software Freedom Law Center to approach violators. These organizations then try to convince violating companies to mend their ways and honor their GPLv2 legal requirements. Only as a last resort do they take companies to court to force them into compliance with the GPLv2. Patrick McHardy, however, after talking with SFC, dropped out from this diplomatic approach and has gone on his own way. Specifically, McHardy has been accused of seeking his own financial gain by approaching numerous companies in German courts. Geniatech claimed McHardy has sued companies for Linux GPLv2 violations in over 38 cases. In one, he'd requested a contractual penalty of €1.8 million. The company also claimed McHardy had already received over €2 million from his actions... In July 2016, the Netfilter developers suspended him from the core team. They received numerous allegations that he had been shaking down companies. McHardy refused to discuss these issues with them, and he refused to sign off on the Principles of Community-Oriented GPL Enforcement. In October 2017, Greg Kroah-Hartman, Linux kernel maintainer for the stable branch, summed up the Linux kernel developers' position. Kroah-Hartman wrote: "McHardy has sought to enforce his copyright claims in secret and for large sums of money by threatening or engaging in litigation...." Had McHardy continued on his way, companies would have been more reluctant to use Linux code in their products for fear that a single, unprincipled developer could sue them and demand payment for his copyrighted contributions... McHardy now has to bear all legal costs for both sides of the case. In other words, when McHardy was faced with serious and costly opposition for the first time, he waved a white flag rather than face near certain defeat in the courts. ' -- source: https://linux.slashdot.org/story/18/03/10/2323242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Well, It Got Them To The Moon And Back ...
by Lawrence D'Oliveiro 10 Mar '18

10 Mar '18

... and only crashed twice‡. Source code <https://github.com/chrislgarry/Apollo-11/blob/master/Luminary099/LUNAR_LAND…>, and note the comments on lines 179 and 180: # TEMPORARY, I HOPE HOPE HOPE ‡The famous “1202 alarm” and “1201 alarm” incidents during the landing.

1 0

Microsoft Throttles On-Prem Tech Donation Scheme For Nonprofits
by Lawrence D'Oliveiro 09 Mar '18

09 Mar '18

Cloud services will be cheaper, but actually buying premium versions of products will cost more <http://www.theregister.co.uk/2018/03/09/microsoft_charity_donation_shakeup/>. Clearly pushing people towards the rental option. Which means, when the corporate largesse runs out, the charity is left with nothing. Kind of like what has happened at the Enderley Community Centre, with all their Adobe CC products: when the funding ran out, the software stopped being usable.

1 0

Hardcoded Password Found in Cisco Software
by Peter Reutemann 08 Mar '18

08 Mar '18

'Cisco released 22 security advisories yesterday, including two alerts for critical fixes, one of them for a hardcoded password that can give attackers full control over a vulnerable system. From a report: The hardcoded password issue affects Cisco's Prime Collaboration Provisioning (PCP), a software application that can be used for the remote installation and maintenance of other Cisco voice and video products. Cisco PCP is often installed on Linux servers. Cisco says that an attacker could exploit this vulnerability (CVE-2018-0141) by connecting to the affected system via Secure Shell (SSH) using the hardcoded password. The flaw can be exploited only by local attackers, and it also grants access to a low-privileged user account. In spite of this, Cisco has classified the issue as "critical." Although this vulnerability has a Common Vulnerability Scoring System (CVSS) Base score of 5.9, which is normally assigned a Security Impact Rating (SIR) of Medium, there are extenuating circumstances that allow an attacker to elevate privileges to root. For these reasons, the SIR has been set to Critical.' -- source: https://it.slashdot.org/story/18/03/08/145209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Disabling Super-Key App-Menu Shortcut In KDE
by Lawrence D'Oliveiro 07 Mar '18

07 Mar '18

Another new “feature” that KDE has acquired in the last few months is that you just have to press and release the Super (aka “Windows”†) modifier key, and the application menu will appear. This annoys me because I frequently lean on modifier keys while thinking about whether to use them, then release them when I change my mind. And then this damn menu pops up. As is usual with KDE, turning this off is pretty easy, but in this case it’s a little counterintuitive. If you right-click on the app-menu icon in the taskbar, you can choose the “Application Launcher Settings” item in the menu that appears (the name might vary a little bit depending on which particular app menu widget you have installed). In the settings dialog that comes up, you will see two panes to choose from, “Appearance” and “Keyboard shortcuts”. Naturally you go to “Keyboard shortcuts”, only to see an entry showing Alt-F1 as the trigger keystroke. So where do you control the use of the Super key? Never fear. Remove this Alt-F1 setting, and the special behaviour of the Super key disappears as well. †No, it doesn’t have a Windows logo on my Das Keyboard Pro 4. It’s imprinted with some kind of indescribable wing-like symbol.

1 0

Ask Slashdot: Should We Worry Microsoft Will 'Embrace, Extend, and Extinguish' Linux?
by Peter Reutemann 07 Mar '18

07 Mar '18

'While there is no proof that anything nefarious is afoot, it does feel like maybe the Windows-maker is hijacking the Linux movement a bit by serving distros in its store. I hope there is no "embrace, extend, and extinguish" shenanigans going on. Just yesterday, we reported that Kali Linux was in the Microsoft Store for Windows 10. That was big news, but it was not particularly significant in the grand scheme, as Kali is not very well known. Today, there is some undeniably huge news -- Debian is joining SUSE, Ubuntu, and Kali in the Microsoft Store. Should the Linux community be worried? My concern lately is that Microsoft could eventually try to make the concept of running a Linux distro natively a thing of the past. Whether or not that is the company's intention is unknown. The Windows maker gives no reason to suspect evil plans, other than past negative comments about Linux and open source. For instance, former Microsoft CEO Steve Ballmer once called Linux "cancer" -- seriously.' -- source: https://tech.slashdot.org/story/18/03/07/159249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

British Military Spends More On Computers Than Weapons And Ammo
by Lawrence D'Oliveiro 07 Mar '18

07 Mar '18

From <http://www.theregister.co.uk/2018/03/07/mod_spends_more_computers_than_weap…>: Spending on weapons and ammunition for the Armed Forces totalled £1.15bn in fiscal year 2016/17, whereas the MoD spent £1.45bn on computer services in the same period. For the four prior years, spending on computers consistently outpaced that for arms and ammo, with half a billion more being spent on computers than weapons in 2015/16. ... Only shipbuilding and repairing, aircraft and spacecraft, and "technical and financial services" spending outpaced the MoD's expenditure on computers. Even construction, at £1.20bn, lagged behind it.

1 0

Google Launches First Android P Developer Preview
by Peter Reutemann 07 Mar '18

07 Mar '18

'Google today launched the first Android P developer preview, available for download now at developer.android.com. From a report: The preview includes an updated SDK with system images for the Pixel, Pixel XL, Pixel 2, Pixel 2 XL, and the official Android Emulator. Unlike last year, there is no emulator for testing Android Wear on Android P. [...] Today's preview includes the following new APIs and features (but you can expect much more; this is just the first preview, after all): Display cutout support; HDR VP9 Video, HEIF image compression, and Media APIs; HEIF (heic) images encoding has been added to the platform; multi-camera API; ImageDecoder for bitmaps and drawables; Improved messaging notifications; Data cost sensitivity in JobScheduler; indoor positioning with Wi-Fi RTT: Platform support for the IEEE 802.11mc WiFi protocol -- also known as WiFi Round-Trip-Time (RTT) -- lets you take advantage of indoor positioning in your apps.' -- source: https://tech.slashdot.org/story/18/03/07/1811201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Turning Off Software Update Notifications In KDE
by Lawrence D'Oliveiro 06 Mar '18

06 Mar '18

Seems the latest version of KDE includes an automatic notifier when there are system updates available. This is great for, shall we say, “normal” users. But I run Debian Unstable. Which means I will be nagged for more updates within a matter of hours after doing a system upgrade, and things will rapidly go downhill from there. So naturally I would rather turn these off completely. The obvious place to find this setting would be in the “Notifications” panel in the System Settings. Unfortunately, the “Event source:” menu lists about three dozen different sources of notification events, and it isn’t obvious (at least, it wasn’t to me) which one handles software updates. The answer is, it’s the one called “Discover”. You will see only one event in its list: “Updates Are Available”. Simply uncheck all the forms of notification for this event. Hmm, I wonder if this panel couldn’t do with a search box...?

1 0