June 2020 - wlug - list.wlug.org.nz

GitHub, Android, Python, Go: More Software Adopts Race-Neutral Terminology
by Peter Reutemann 15 Jun '20

15 Jun '20

'The terms 'allowlist' and 'blocklist' describe their purpose, while the other words use metaphors to describe their purpose," reads a change description on the source code for Android -- from over a year ago. 9to5Mac calls it "a shortened version of Google's (internal-only) explanation" for terminology changes which are now becoming more widespread. And Thursday GitHub's CEO said they were also "already working on" renaming the default branches of code from "master" to a more neutral term like "main," reports ZDNet: GitHub lending its backing to this movement effectively ensures the term will be removed across millions of projects, and effectively legitimizes the effort to clean up software terminology that started this month. But, in reality, these efforts started years ago, in 2014, when the Drupal project first moved in to replace "master/slave" terminology with "primary/replica." Drupal's move was followed by the Python programming language, Chromium (the open source browser project at the base of Chrome), Microsoft's Roslyn .NET compiler, and the PostgreSQL and Redis database systems... The PHPUnit library and the Curl file download utility have stated their intention to replace blacklist/whitelist with neutral alternatives. Similarly, the OpenZFS file storage manager has also replaced its master/slave terms used for describing relations between storage environments with suitable replacements. Gabriel Csapo, a software engineer at LinkedIn, said on Twitter this week that he's also in the process of filing requests to update many of Microsoft's internal libraries. A recent change description for the Go programming language says "There's been plenty of discussion on the usage of these terms in tech. I'm not trying to have yet another debate." It's clear that there are people who are hurt by them and who are made to feel unwelcome by their use due not to technical reasons but to their historical and social context. That's simply enough reason to replace them. Anyway, allowlist and blocklist are more self-explanatory than whitelist and blacklist, so this change has negative cost. That change was merged on June 9th -- but 9to5Mac reports it's just one of many places these changes are happening. "The Chrome team is beginning to eliminate even subtle forms of racism by moving away from terms like 'blacklist' and 'whitelist.' Google's Android team is now implementing a similar effort to replace the words 'blacklist' and 'whitelist.'" And ZDNet reports more open source projects are working on changing the name of their default Git repo from "master" to alternatives like main, default, primary, root, or another, including the OpenSSL encryption software library, automation software Ansible, Microsoft's PowerShell scripting language, the P5.js JavaScript library, and many others.' -- source: https://developers.slashdot.org/story/20/06/14/1722223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bypassing DRM On Your Fridge
by Lawrence D'Oliveiro 14 Jun '20

14 Jun '20

Certain refrigerators made by General Electric in the US <https://www.theregister.com/2020/06/13/ge_refrigerator_drm_keeps_turning/> have an RFID chip in their water filters to ensure that you only replace them with genuine GE parts. People have figured out how to hack this so cheaper third-party replacement filters will work, and now there is a website explaining the procedure. Quote: The GE website suggests that a water filter is a good idea to avoid exposure to unfiltered water and sediment, inadvertently offering a sad commentary on public water infrastructure and government funding priorities. I wonder how the lead levels are in the Flint, Michigan water supply these days ...

1 0

OpenZFS Removed Offensive Terminology From Its Code
by Peter Reutemann 13 Jun '20

13 Jun '20

'On Wednesday evening, ZFS founding developer Matthew Ahrens submitted what should have been a simple, non-controversial pull request to the OpenZFS project: wherever possible without causing technical issues, the patch removed references to "slaves" and replaced them with "dependents." This patch in question doesn't change the way the code functions -- it simply changes variable names in a way that brings them in conformance with Linux upstream device-mapper terminology, in 48 total lines of code (42 removed and 48 added; with one comment block expanded slightly to be more descriptive). But this being the Internet, unfortunately, outraged naysayers descended on the pull request, and the comments were quickly closed to non-contributors. I first became aware of this as the moderator of the r/zfs subreddit where the overflow spilled once comments on the PR itself were no longer possible. "The horrible effects of human slavery continue to impact society," writes Ahrens in his pull request. "The casual use of the term 'slave' in computer software is an unnecessary reference to a painful human experience." Ahrens' pull request has been reviewed by fellow lead developers Brian Behlendorf and Ryan Moeller and merged into the OpenZFS project repository.' -- source: https://developers.slashdot.org/story/20/06/12/0543254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Internet Archive Kills Its Free Digital Library Over Copyright Concerns
by Peter Reutemann 13 Jun '20

13 Jun '20

'The Internet Archive's National Emergency Library is finished. The non-profit repository for digital preservation, which began offering millions of e-books for free to address the closure of libraries during the pandemic, buckled under a joint lawsuit filed by major publishers including Penguin Random House and HarperCollins. From a report: Publishers said lending out books without compensation was "mass copyright infringement." The digital library will close next week. The archive of books was initially invite-only and only allowed a given file to be downloaded a limited number of times at once, with each rental limited to 14 days. But then the pandemic hit and libraries closed, so the Internet Archive responded by making all the books accessible to everyone, with no limits.' -- source: https://news.slashdot.org/story/20/06/12/1411237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New FreeBSD Code of Conduct
by Peter Reutemann 13 Jun '20

13 Jun '20

'FreeBSD has has adopted a new LLVM-derived code of conduct. The code of conduct requires users to: be friendly and patient, be welcoming, be considerate, be respectful, be careful in the words that you choose and be kind to others, when we disagree, try to understand why. This isn't an exhaustive list of things that you can't do. Rather, take it in the spirit in which it's intended - a guide to make it easier to communicate and participate in the community. This code of conduct applies to all spaces managed by the FreeBSD project. This includes online chat, mailing lists, bug trackers, FreeBSD events such as the developer meetings and socials, and any other forums created by the project that the community uses for communication. It applies to all of your communication and conduct in these spaces, including emails, chats, things you say, slides, videos, posters, signs, or even t-shirts you display in these spaces. In addition, violations of this code outside these spaces may, in rare cases, affect a person's ability to participate within them, when the conduct amounts to an egregious violation of this code.' -- source: https://developers.slashdot.org/story/20/06/12/1430203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Releases Important Ubuntu Kernel Security Updates, Patch Now
by Peter Reutemann 12 Jun '20

12 Jun '20

'Canonical already released the other day a new version of the intel-microcode firmware to mitigate the latest Intel vulnerabilities, but now it also published new versions of the Linux kernel for all supported Ubuntu releases, including Ubuntu 20.04 LTS, Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. Apart from mitigating the Intel SRBDS/CrossTalk vulnerability (CVE-2020-0543), the new Linux kernel security updates fix race conditions (CVE-2020-12114) discovered by Piotr Krysiuk in the file system implementation, which lets a local attacker cause a denial of service (system crash).' -- source: https://www.linuxtoday.com/security/canonical-releases-important-ubuntu-ker… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hands on with Android 11 Beta 1—A new media player and suggested apps
by Peter Reutemann 12 Jun '20

12 Jun '20

'Android 11's first "beta" release is finally out after numerous delays. The beta release works on the Pixel 2, 3, 3a, and 4, and enrolling for the beta OTA at google.com/android/beta. is super easy. Previously, the Android beta has launched simultaneously on plenty of third-party devices, but that's not the case this year. So far, OnePlus has also shipped the beta, and that's about it. Google says that more devices are coming "in the coming weeks." The Android 11 Beta has gone through a wild ride. First, it was supposed to debut at the Shoreline Amphitheater for Google I/O in May 12, but the physical event was canceled due to the coronavirus outbreak. Then it was supposed to debut in an online version of Google I/O, but that was canceled, too, as everyone was still trying to deal with the logistics problems the new shelter-in-place requirements. With no release in May, a surprise fourth preview release of Android 11 was created, and the Beta was delayed until June 3, when Google would hold an online event for "The Android 11 Beta Launch Show." The online Android 11 launch show was delayed, too, due to the ongoing nationwide protests against police brutality and the death of George Floyd. In its latest blog post, Google says the online launch show is also canceled entirely, and, surprise, the company is pressing the launch button now with zero fanfare. Not since Google canceled the launch of the Nexus 4 due to Hurricane Sandy in 2012 has a Google launch been such a hot, hot mess. With the Android 11 Beta finally go for launch, we're still seeing a bit of a mini I/O, even though every event is canceled. Google posted two blog posts, lots of documentation, and 12 videos covering new aspects of Android 11. The company is also planning "11 weeks of Android," a series that will see new developer talks posted each week. So far, the lack of fanfare seems appropriate for Android 11, which seems like a smaller release than we've gotten in previous years. This beta only has two new standout features we can point to.' -- source: https://arstechnica.com/gadgets/2020/06/hands-on-with-android-11-beta-1-a-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

UPnP flaw exposes millions of network devices to attacks over the Internet
by Peter Reutemann 12 Jun '20

12 Jun '20

'Millions of routers, printers, and other devices can be remotely commandeered by a new attack that exploits a security flaw in the Universal Plug and Play network protocol, a researcher said. CallStranger, as the exploit has been named, is most useful for forcing large numbers of devices to participate in distributed denial of service—or DDoS—attacks that overwhelm third-party targets with junk traffic. CallStranger can also be used to exfiltrate data inside networks even when they’re protected by data loss prevention tools that are designed to prevent such attacks. The exploit also allows attackers to scan internal ports that would otherwise be invisible because they’re not exposed to the Internet. Billions of routers and other so-called Internet-of-things devices are susceptible to CallStranger, Yunus Çadırcı, a Turkish researcher who discovered the vulnerability and wrote the proof-of-concept attack code that exploits it, wrote over the weekend. For the exploit to actually work, however, a vulnerable device must have UPnP, as the protocol is known, exposed on the Internet. That constraint means only a fraction of vulnerable devices are actually exploitable.' -- source: https://arstechnica.com/information-technology/2020/06/upnp-flaw-exposes-mi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux distro review: System76’s Ubuntu-based Pop!_OS
by Peter Reutemann 12 Jun '20

12 Jun '20

'The subject of today's Linux distro review is perhaps one of a kind—as far as we know, Pop!_OS is the first Linux distribution to be created and maintained by a hardware OEM manufacturer. At the very least, it's the first one anyone has taken seriously. That hardware manufacturer is System76, probably the world's best-known Linux-only laptop manufacturer. Some larger OEMs offer Linux as an alternative operating system on a few models—but System76 sells Linux systems, and only Linux systems. Until 2017, System76 sold its systems preinstalled with Ubuntu Linux. But Canonical left the company cold when it decided to stop development on its Unity desktop environment and move back to Gnome3—and, controversially, System76 decided that instead of merely adding its own private repository and a few packages to a stock Ubuntu install, it would create and manage its own Ubuntu-derived distribution. Crucially, the new distribution would not just be for System76 hardware. Although the company uses the new distro to simplify and retain more control over its hardware setup, it designed Pop!_OS to be a real distro suitable for use—and encouraged for use—on any Linux PC, whether purchased from System76 or not.' -- source: https://arstechnica.com/gadgets/2020/06/linux-distro-review-system76s-ubunt… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 Launches AMD Ryzen-Powered 'Serval WS' Portable Linux Workstation
by Peter Reutemann 12 Jun '20

12 Jun '20

'Linux computer maker/seller System76 has been offering AMD processors in its Thelio desktop computers, but believe it or not, the company has never offered an AMD-powered laptop -- until now, that is. From a report: You see, starting today, you can buy a "Serval WS" powered by AMD. No, System76 is not offering mobile Ryzen chips in this laptop, but instead, desktop-class processors. As you can expect, this 15-inch portable Linux workstation is quite chunky and heavy as a result. With that said, it is simply impossible to cram this much power into a thin and light notebook. "The Serval WS comes with either the 3rd Gen Ryzen 3600, 3700X, or 3900 CPU. The latter is equipped with 12 Cores and 24 Threads, making this laptop perfect for taking on heavy computational loads. Having this kind of desktop-caliber power in a laptop body helps if you need to run complex simulations at your desk or quickly render 3D scenes while on the road. AMD CPUs are also known for having the an extremely high price per performance, which means you get maximum bang-for-buck," says System76. The laptop starts at $1,300 -- and BetaNews has all the specs.' -- source: https://linux.slashdot.org/story/20/06/11/1634258 CHeers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0