May 2020 - wlug - list.wlug.org.nz

Should Maintainers of Open Source Projects Be Paid?
by Peter Reutemann 01 Jun '20

01 Jun '20

'Matt Asay, a former COO of Canonical now working at AWS, writes "Over the last few weeks I've interviewed a range of open source project maintainers, most of which don't directly get paid for supporting their projects... Is this a bad thing?" It's not completely clear. Linux Foundation executive Chris Aniszczyk has been an outspoken opponent of open source "tip jars" that seek to sustain projects with donations. "These [open source developers] should be encouraged to start businesses or your business should hire them directly," he argues. But many such developers don't want a 9-to-5 corporate job, preferring the independence of contract work. Open source sustainability, in other words, is messy. Most open source project maintainers with whom I've spoken got started because it was a "fun" way to spend their free time. They had a variety of personal "itches" they needed to scratch. Exactly none started coding because they were hoping to get paid for that work. In fact, in some cases, it was specifically to create space from their employer that they started the project. For Datasette founder Simon Willison, for example, he "wanted a creative outlet." That is, a project that he got to have complete control over. In some ways, he said, it was perhaps "a way of blowing off steam," but really it was a place where he could express his creativity without a corporate overlord steering that creativity. See the problem...? Aniszczyk reasonably suggests that the most sustainable source of funding is a paycheck, but that's precisely what many of these developers don't want. Or, at least, they don't want a paycheck that comes with restrictions on their ability to code freely... [O]pen source sustainability will never have one, meta answer for all of open source. It's always a project-by-project analysis and, really, a founder-by-founder (or community-by-community) decision. ' -- source: https://news.slashdot.org/story/20/05/31/0138252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ardour 6.0 Is Out
by Lawrence D'Oliveiro 29 May '20

29 May '20

Most of us are happy with Audacity for our audio-editing needs, but if you need full on pro-quality audio production, Ardour is it <https://www.theregister.co.uk/2020/05/28/ardour_6_release/>. I did try running it briefly once, but like Blender, you really need an introductory tutorial or two to make at least some initial sense of it all--you cannot just dive in blindly and expect to figure it out by messing around.

2 1

Microsoft Announces The Official “Windows Package Manager”
by Lawrence D'Oliveiro 29 May '20

29 May '20

<https://www.theregister.co.uk/2020/05/20/microsoft_announces_official_windo…>: Among the best features of Linux is the availability of package managers, such as Debian's Apt, that can install, remove and manage dependencies for applications from the command line. It is not perfect – dependency version issues or broken configuration files can be a problem – but most of the time it makes it easy to get what you want, and is scriptable. Many users would like Windows to be equally convenient to use. Only it’s not quite there yet: More seriously, the current preview is limited to installation; it does not even have a remove option for packages. It does not auto-update packages or even have any mechanism to update them, and there is no specific dependency management. On the to-do list are features including uninstall, update, and Store app support. Hence the filing of a bug report pointing out that “All it does is downloading installers (which are not packages) and executing them (which is not management)”.

1 1

A $350 “anti-5G” device is just a 128MB USB stick, teardown finds
by Peter Reutemann 29 May '20

29 May '20

'Believers of 5G conspiracy theories have apparently been buying a $350 anti-5G USB key that—not surprisingly—appears to just be a regular USB stick with only 128MB of storage. As noted by the BBC today, the "5GBioShield" USB stick "was recommended by a member of Glastonbury Town Council's 5G Advisory Committee, which has called for an inquiry into 5G." The company that sells 5GBioShield claims it "is the result of the most advanced technology currently available for balancing and prevention of the devastating effects caused by non-natural electric waves, particularly (but not limited to) 5G, for all biological life forms." The product's website charges £283 for a single 5GBioShield, which converts to nearly $350. That's what it costs to get "protection for your home and family, thanks to the wearable holographic nano-layer catalyser, which can be worn or placed near to a smartphone or any other electrical, radiation or EMF emitting device." "The 5GBioShield makes it possible, thanks to a uniquely applied process of quantum nano-layer technology, to balance the imbalanced electric oscillations arising from all electric fog induced by all devices such as: laptops, cordless phones, wlan, tablets, etc.," the company says, adding that the USB stick "brings balance into the field at the atomic and cellular level restoring balanced effects to all harmful (ionized and non-ionized) radiation." The USB stick apparently doesn't need to be plugged in to anything to work its magic. "It is always ON and working—that's why we used quantum nano-layer technology," the company says in an FAQ. But the device allegedly produces a wider field of protection when it is plugged in. To answer the question of whether the stick needs to be "charged regularly," the FAQ says, "No—the input charge only expands the field effect from 4m radius to 20m + radius when plugged into an USB wall charger or a computer." Fortunately, you can use 5GBioShield without disabling your Wi-Fi. The USB key doesn't block Wi-Fi signals, the company says. Instead, the product "transmutes" the signals and "harmonizes all harmful frequencies into life affirming frequencies."' -- source: https://arstechnica.com/tech-policy/2020/05/5g-conspiracy-theorists-sell-35… Oh dear... Techno-babble to scam the uneducated always seems to work... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Using Curl to make REST API requests
by Peter Reutemann 29 May '20

29 May '20

'An application program interface (API) is a set of definitions and protocols that allows software programs to communicate with each other. The term REST stands for representational state transfer. It is an architectural style that consists of a set of constraints to be used when creating web services. RESTful API is an API that follows the REST architecture. Typically REST APIs use the HTTP protocol for sending and retrieving data and JSON formatted responses. You can use the standard HTTP methods to create, view, update, or delete resources through the API. To test and interact with the RESTful APIs, you can use any library or tool that can make HTTP requests. API requests are made up of four different parts: - The endpoint. This is the URL that the client uses to communicate with the server. - The HTTP method. It tells the server what action the client wants to perform. The most common methods are GET POST PUT DELETE and PATCH - The headers. Used to pass additional information between the server and the client, such as authorization. - The body. The data sent to the server. In this article, we’re going to discuss how to use curl to interact with RESTful APIs. curl is a command-line utility for transferring data from or to a remote server. It is installed by default on macOS and most Linux distributions.' -- source: https://linuxize.com/post/curl-rest-api/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Raspberry Pi 4 model comes with a ton of RAM: 8GB
by Peter Reutemann 29 May '20

29 May '20

'Hot off the launch of an interchangeable camera system earlier this month, Raspberry Pi is introducing a new configuration of the Pi4: a model with a whopping 8GB of RAM. The new, highest-end config for the Pi 4 will run you $75. The 8GB version of the Raspberry Pi 4 has been long rumored, thanks to Raspberry Pi itself leaking the existence of an 8GB model. The blog post reveals that an 8GB model was always a possibility and says, "We were so enthusiastic about the idea that the non-existent product made its way into both the Beginner’s Guide and the compliance leaflet." The Raspberry Pi 4 launched last year with a faster SoC, more RAM, dual micro-HDMI, USB 3.0 support, and a USB-C charging port. In addition to the usual server and hobbyist uses, Raspberry Pi promoted performance on par with an "entry-level x86 PC" and dual-monitor desktop uses.' -- source: https://arstechnica.com/gadgets/2020/05/new-raspberry-pi-4-model-comes-with… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russian hackers are exploiting bug that gives control of US servers
by Peter Reutemann 29 May '20

29 May '20

'A Russian hacking group tied to power-grid attacks in Ukraine, the world’s most destructive data wiper worm, and other nefarious Kremlin operations is exploiting a vulnerability that allows it to take control of computers operated by the US government and its partners. In an advisory published on Thursday, the US National Security Agency said that the Sandworm group was actively exploiting a vulnerability in Exim, an open source mail transfer agent, or MTA, for Unix-based operating systems. Tracked as CVE-2019-10149, the critical bug makes it possible for an unauthenticated remote attacker to send specially crafted emails that execute commands with root privileges. With that, the attacker can install programs of their choosing, modify data, and create new accounts.' -- source: https://arstechnica.com/information-technology/2020/05/russian-hackers-are-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Digital Signage Moving To Linux?
by Lawrence D'Oliveiro 28 May '20

28 May '20

The Register regularly collects reports of computer-controlled public signage malfunctioning in an amusing way. In this latest instalment <https://www.theregister.co.uk/2020/05/27/bork/>, there is an interesting mention: The company went on to tell us that the units run Windows 10, but "we're about to upgrade all of our production machines to a custom Linux build to improve their stability and generally operate with more efficiency." One of the reader comments mentions a company called “Screenly”, which offers a product in both open-source and proprietary-paid forms.

1 0

meeting next month
by Peter Reutemann 28 May '20

28 May '20

Hi everyone Just got contacted by the timetabling people that look after the room bookings for WLUG (and also Python). No evening bookings are allowed till the campus fully operational again. At least the June meetings will be virtual ones again. Having said that, would you like to present something during June? Then please contact me (can be off-list). :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Choosing 2FA authenticator apps can be hard. Ars did it so you don’t have to
by Peter Reutemann 28 May '20

28 May '20

'Last year, Sergio Caltagirone found himself in a tough spot. While traveling, his phone broke and stopped working completely. With no access to his Google and Microsoft authenticator apps, he lost access to two-factor authentication when he needed it most—when he was logging in from IP addresses not recognized by the 30 to 40 sites he had enrolled. “I had a whole bunch of sites [that] I had to go through a massively long account restoration process because I lost my 2FA,” said Caltagirone, who is senior VP of threat intelligence at security firm Dragos. “Every time, I had to contact customer service. I had different levels of requirements I had to go through for them to effectively disable 2FA on my account. Some required address verification. [For others,] I had to send a last bill. The number of those I went through was just insane.” The experience shows the double-edged sword of multi-factor authentication. Requiring users to enter a password that’s pseudorandomly generated every 30 seconds makes account takeovers significantly harder, even when an attacker has phished or otherwise obtained the password. But in the event that second factor (in this case, the “something you have,” that is, the phone) isn’t available, that same protection can block legitimate users from logging in for unacceptably long periods of time. When Caltagirone relayed his experience last September, a quick survey of the available consumer and small-business authenticators left much to be desired. Only a few of them made it possible to back up the unique cryptographic seeds that each phone uses to generate a time-based one-time password, or TOTP. Websites—including Google, Github, Facebook, and hundreds of others that implement the Time-Based One-Time Password Algorithm standard—require the temporary password to log in users who opt in to 2FA. The result? When your device was stolen, lost, or stopped working, you had to go through the same painful and time-consuming account recoveries Caltagirone did. The lack of a backup and recovery mechanism meant the only viable way to hedge against a device loss or malfunction was to print, scan, or photograph each QR code or the underlying Web link (for instance, http://USERNAME(a)salesforce.com/?secret=LZZIKRWX736EH2IQ&issuer=Slack) it represented. That was time consuming. Even worse, it was cumbersome and insecure to store them, particularly when traveling.' -- source: https://arstechnica.com/information-technology/2020/05/choosing-2fa-authent… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1