May 2019 - wlug - list.wlug.org.nz

Does Open Source Have a 'Working For Free' Problem?
by Peter Reutemann 05 May '19

05 May '19

'"Let's abandon the notion that open source is exclusively charity," writes Havoc Pennington, a free software engineer (and former Red Hat engineer) who's now a co-founder of Tidelift: Look around. We do have a problem, and it's time we do something about it.... The lack of compensation isn't just bad for individual developers -- it also creates social problems, by amplifying existing privilege.... The narrative around open source is that it's completely OK -- even an expectation -- that we're all doing this for fun and exposure; and that giant companies should get huge publicity credit for throwing peanuts-to-them donations at a small subset of open source projects. There's nothing wrong with doing stuff for fun and exposure, or making donations, as an option. It becomes a problem when the free work is expected and the donations are seen as enough... What would open source be like if we had a professional class of independent maintainers, constantly improving the code we all rely on? The essay suggests some things consider, including asking people to pay for: * Support requests * Security audits/hardening and extremely good test coverage * Supporting old releases * License-metadata-annotation practices that are helpful for big companies trying to audit the code they use, but sort of a pain in the ass and nobody cares other than these big companies. "Right now many users expect, and demand, that all of this will be free. As an industry, perhaps we should push back harder on that expectation. It's OK to set some boundaries..." "Of course this relates to what we do at Tidelift -- the company came out of discussions about this problem, among others... In our day-to-day right now we're specifically striving to give subscribers a way to pay maintainers of their application dependencies for additional value, through the Tidelift Subscription. But we hope to see many more efforts and discussions in this area.... [I]n between a virtual tip jar and $100 million in funding, there's a vast solution space to explore."' -- source: https://news.slashdot.org/story/19/04/28/0459236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Hard Drive Reliability At Backblaze
by Lawrence D'Oliveiro 05 May '19

05 May '19

This article <https://www.theregister.co.uk/2019/05/03/backblaze_drive_reliability_stats/> on the latest disk reliability report from backup business Backblaze led me to following up some interesting links. In this older item <https://www.theregister.co.uk/2014/02/17/backblaze_how_not_to_evaluate_disk…>, they were criticized for making misleading claims about consumer-grade drives being more reliable than enterprise-grade ones. But I do think it is clear that the difference between them is not worth the cost. One important point I got from the latter is “replacing one drive takes about 15 minutes of work”. That quote ends with “Moral of the story: design for failure and buy the cheapest components you can”. Which seems the logical thing to do anyway. That sentence is followed by a smiley, but as far as I’m concerned, who needs the smiley? I also like this article <https://www.backblaze.com/blog/hard-drive-smart-stats/> from their blog, where they go into which SMART statistics are worth looking at. The one that stands out is counter 187, uncorrectable read errors. If that goes above zero, then the disk is bad and should be replaced.

1 0

Security Lapse Exposed a Chinese Smart City Surveillance System
by Peter Reutemann 04 May '19

04 May '19

'Smart cities are designed to make life easier for their residents: better traffic management by clearing routes, making sure the public transport is running on time and having cameras keeping a watchful eye from above. But what happens when that data leaks? One such database was open for weeks for anyone to look inside. Security researcher John Wethington found a smart city database accessible from a web browser without a password. He passed details of the database to TechCrunch in an effort to get the data secured. The database was an Elasticsearch database, storing gigabytes of data -- including facial recognition scans on hundreds of people over several months. The data was hosted by Chinese tech giant Alibaba. The customer, which Alibaba did not name, tapped into the tech giant's artificial intelligence-powered cloud platform, known as City Brain. "This is a database project created by a customer and hosted on the Alibaba Cloud platform," said an Alibaba spokesperson. "Customers are always advised to protect their data by setting a secure password." "We have already informed the customer about this incident so they can immediately address the issue. As a public cloud provider, we do not have the right to access the content in the customer database," the spokesperson added. The database was pulled offline shortly after TechCrunch reached out to Alibaba. But while Alibaba may not have visibility into the system, we did.' -- source: https://yro.slashdot.org/story/19/05/04/0235239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After Seven Years, The Gnu Project Releases GNU Guix 1.0.0
by Peter Reutemann 04 May '19

04 May '19

'LWN.net: Version 1.0.0 of the GNU Guix package manager has been released. "This 1.0 release is a major milestone for Guix. It represents 7 years of hard work with more than 40,000 commits by 260 people, 19 releases, and an equally amazing amount of work on documentation, translation, artwork, web design, mentoring, outreach, and many other activities that together have made it a thriving project." See this blog entry for more information. >From the announcement: Whether you're a software developer, a user, or a free software enthusiast, we hope GNU Guix will provide you with the tools to deploy and manage software with confidence and ease, qualities that are not usually associated with software deployment... GNU Guix is a transactional package manager and an advanced distribution of the GNU system that respects user freedom. Guix can be used on top of any system running the kernel Linux, or it can be used as a standalone operating system distribution for i686, x86_64, ARMv7, and AArch64 machines.' -- source: https://news.slashdot.org/story/19/05/03/2326215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo Proposes 'Do-Not-Track Act of 2019'
by Peter Reutemann 04 May '19

04 May '19

'"When you turn on the setting in your browser that says 'Do Not Track', you probably expect to no longer be tracked on most websites you visit. Right? Well, you would be wrong," explains DuckDuckGo's blog. Their recent study found "a quarter of people have turned on this setting" -- representing hundreds of millions of web surfers -- and that most of them were unaware that in fact, "no law requires websites to respect your Do Not Track signals, and the vast majority of sites, including most all of the big tech companies, sadly choose to simply ignore them." Now they've written draft legislation -- "the Do-Not-Track Act of 2019" -- to "serve as a starting point" for legislators to close this loophole. SearchEngineLand reports: If the act picks up steam and passes into law, sites would be required to cease certain user tracking methods, which means less data available to inform marketing and advertising campaigns. The impact could also cascade into platforms that leverage consumer data, possibly making them less effective. For example, one of the advantages of advertising on a platform like Google or Facebook is the ability to target audiences. If a user enables DNT, the ads displayed to them when browsing those websites won't be informed by their external browsing history... This proposal is quite far from being signed into law, but the technology is already built into Chrome, Firefox, Opera, Edge and Internet Explorer. With the adoption of GDPR just a year behind us and presidential candidate Elizabeth Warren's proposed legislation to regulate "big tech companies" drawing more attention to digital privacy issues in Washington, the Do-Not-Track Act could be a realistic outcome. DuckDuckGo says they're announcing their draft legislation because "It is extremely rare to have such an exciting legislative opportunity like this, where the hardest work -- coordinated mainstream technical implementation and widespread consumer adoption -- is already done.... "We hope the Do-Not-Track Act of 2019 serves as a useful guide to start thinking seriously about this amazing legislative opportunity."' -- source: https://yro.slashdot.org/story/19/05/03/2316223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Don’t Try To Claim That Public Wi-Fi Is “Inherently Insecure”
by Lawrence D'Oliveiro 04 May '19

04 May '19

NordVPN has been told off by the UK Advertising Standards Authority about its misleading claims on the security of public wi-fi <https://www.theregister.co.uk/2019/05/01/nordvpn_tv_ad_rapped_advertising_s…>: Justifying its claims, NordVPN told the ASA that HTTPS encryption of webpages "did not mean the site was legitimate, nor was it any proof that the site had been security-hardened against intrusion from hackers". Yes, HTTPS encryption *is* supposed to mean that the site is legitimate. As for whether the site is security-hardened, it’s going to be just as insecure whether you access it via a VPN or not, isn’t it?

2 2

Putin Signs Law To Create an Independent Russian Internet
by Peter Reutemann 02 May '19

02 May '19

'Russia is one step closer to creating its own, independent internet -- at least legally speaking. Russian President Vladimir Putin has signed into law new measures that would enable the creation of a national network, able to operate separately from the rest of the world, according to documents posted on a government portal this week. >From a report: For now, the network remains largely theoretical though, with few practical details disclosed. In concept, the new law aims to protect Russia from foreign online restrictions by creating what the Kremlin calls a "sustainable, secure and fully functioning" local internet. The legislation takes effect in November, state news agency RIA-Novosti reported. According to a summary from RIA-Novosti, the law calls for the creation of a monitoring and a management center supervised by Roskomnadzor, Russia's telecoms agency. The state agency will be charged with ensuring the availability of communication services in Russia in extraordinary situations. During such situations, it would also be empowered to cut off external traffic exchange, creating a purely Russian web' -- source: https://tech.slashdot.org/story/19/05/02/1535237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Says It Will Ban Firefox Add-ons With Obfuscated Code
by Peter Reutemann 02 May '19

02 May '19

'As Mozilla continues to try to make it safer than ever to use Firefox, the organization has updated its Add-on Policy so that any updates that include obfuscated code are explicitly banned. Mozilla has also set out in plain terms its blocking process for add-ons and extensions. While there is nothing surprising here, the clarification should mean that there are fewer causes for disputes when an add-on is blocklisted. The updated Add-on policy comes into force on June 10, so add-on developers have a little more than a month to take note of the changes and comply. Mozilla says that the move is designed to help it better deal with malicious extensions. Mozilla also plans to be more aggressive towards taking down extensions that break its policies, with a heavy focus on security issues. ZDNet adds: [...] Starting with June 10, Mozilla's team will also be more aggressive in blocking and disabling Firefox add-ons in users' browsers that are found to be violating one of the company's policies."We will continue to block extensions for intentionally violating our policies, critical security vulnerabilities, and will also act on extensions compromising user privacy or circumventing user consent or control," Nieman said.' -- source: https://news.slashdot.org/story/19/05/02/1653228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hamster Time Tracker on Ubuntu 18.04/Bionic
by Peter Reutemann 02 May '19

02 May '19

Hi everyone I've been using the Hamster Time Tracking applet (https://github.com/projecthamster/hamster) for many years, keeping track of my time spent on commercial projects. However, this project is undergoing a major refactoring and is no longer available available from the Ubuntu repositories. Sadly, a fact that I discovered after upgrading my Laptop from Linux Mint 18.2 to 19.1. Using instructions from a github comment (https://github.com/projecthamster/hamster/issues/356#issuecomment-385093502) I was able to get it installed and working on my Ubuntu 18.04 (which underpins Linux Mint 19.1), using packages from 17.10: Install some dependencies first: sudo apt-get install python-gnome2 python-gconf python-pyorbit liborbit2 libidl-2-0 Download the following libraries - python-wnck_2.32.0+dfsg-4_amd64.deb http://mirrors.edge.kernel.org/ubuntu/pool/universe/g/gnome-python-desktop/… - hamster-applet_2.91.3+git20120514.b9fec3e1-1ubuntu2_all.deb https://launchpadlibrarian.net/202355025/hamster-applet_2.91.3+git20120514.… Install the downloaded debian packages: sudo dpkg -i python-wnck_2.32.0+dfsg-4_amd64.deb hamster-applet_2.91.3+git20120514.b9fec3e1-1ubuntu2_all.deb Since this was a fresh install, I had to copy my old Hamster database across. The database is located in: $USER/.local/share/hamster-applet/hamster.db And we're back in business! :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Blender Developers Find Old Linux Drivers Are Better Maintained Than Windows
by Peter Reutemann 01 May '19

01 May '19

'To not a lot of surprise compared to the world of proprietary graphics drivers on Windows where once the support is retired the driver releases stop, old open-source Linux OpenGL drivers are found to be better maintained. From a report: Blender developers working on shipping Blender 2.80 this July as the big update to this open-source 3D modeling software today rolled out the Linux GPU requirements for this next release. The requirements themselves aren't too surprising and cover NVIDIA GPUs released in the last ten years, AMD GCN for best support, and Intel Haswell graphics or newer. In the case of NVIDIA graphics they tend to do a good job maintaining their legacy driver branches. With the AMD Radeon and Intel graphics, Blender developers acknowledge older hardware may work better on Linux. ' -- source: https://tech.slashdot.org/story/19/05/01/191257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0