September 2020 - wlug - list.wlug.org.nz

AWS Introduces a Rust Language-Oriented Linux for Containers
by Peter Reutemann 06 Sep '20

06 Sep '20

'ZDNet reports: An anonymous reader shares this enthusiastic report from ZDNet: Earlier this year, Linus Torvalds approved of adding drivers and other components in Rust to Linux.* Last week, at the virtual Linux Plumbers Conference, developers gave serious thought to using the Rust language for new Linux inline code. ["Nothing firm has been determined yet," reported Phoronix, "but it's a topic that is still being discussed."] And, now Amazon Web Services (AWS) has announced that its just-released Bottlerocket Linux for containers is largely written in Rust. Mozilla may have cut back on Rust's funding, but with Linux embracing Rust, after almost 30-years of nothing but C, Rust's future is assured. Rust was chosen because it lends itself more easily to writing secure software. Samartha Chandrashekar, an AWS Product Manager, said it "helps ensure thread safety and prevent memory-related errors, such as buffer overflows that can lead to security vulnerabilities." Many other developers agree with Chandrashekar. Bottlerocket also improved its security by using Device-mapper's verity target. This is a Linux kernel feature that provides integrity checking to help prevent attackers from overwriting core system software or other rootkit type attacks. It also includes the extended Berkeley Packet Filter (eBPF), In Linux, eBPF is used for safe and efficient kernel function monitoring. * Linus's exact words were "people are actively looking at, especially doing drivers and things that are not very central to the kernel itself, and having interfaces to do those, for example, in Rust. People have been looking at that for years now. I'm convinced it's going to happen one day." The article also reminds readers that AWS's Bottlerocket "is also designed to be quick and easy to maintain... by including the bare essentials needed to run containers..." "Besides its standard open-source elements, such as the Linux kernel and containerd container runtime, Bottlerocket's own code is licensed under your choice of either the Apache 2.0 or the MIT license."' -- source: https://linux.slashdot.org/story/20/09/04/2342226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Spotting Security Vulns By Monitoring The Linux Kernel Mailing List
by Lawrence D'Oliveiro 05 Sep '20

05 Sep '20

This research <https://www.theregister.com/2020/09/04/linux_kernel_flaws/> shows that it is possible to get clues about security vulnerabilities in the Linux kernel simply by looking for patches published with lower than usual discussion about their purpose. In some cases they were able to spot these up to nearly 6 months in advance of their being publicly disclosed. Not all such patches are to address security issues. With itself raises other troubling questions. And of course, mailing lists for other open-source projects can be just as fruitful sources of similar information.

2 1

Is It Plugged In?
by Lawrence D'Oliveiro 05 Sep '20

05 Sep '20

A standard question with phone- or online-based troubleshooting is to ask the user if the misbehaving gear in question is actually plugged in. Sometimes they take the implication less than kindly. But here <https://forums.theregister.com/forum/all/2020/09/04/on_call/#c_4102668> is a wonderfully tactful way to phrase the question: If it was obvious from the phone call that the power wasn't on, she would tell the user that they'd had problems with a batch [of] power cables and ask them to check the serial number on the wall plug. After a minute she usually got a sheepish reply that the problem seemed to have gone away....

1 0

nload - network throughput monitor
by Peter Reutemann 05 Sep '20

05 Sep '20

Hi there When being logged into servers remotely, pulling large docker images can take quite a while. On my desktop, I find the network traffic monitor in my taskbar rather handy to check throughput and whether a large transfer across the network has finished. However, I've always wanted to have an alternative for the console. Well, the other week I came across one that suits me: nload - Real time network traffic monitor for the text console https://github.com/rolandriegel/nload Available from Arch/Debian/Ubuntu repos (package "nload"). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Lenovo Releases First Fedora Linux ThinkPad Laptop
by Peter Reutemann 04 Sep '20

04 Sep '20

'Today, Lenovo has released a ThinkPad with Red Hat's community Linux, Fedora. ZDNet reports: First in this new Linux-friendly lineup is the X1 Carbon Gen 8. It will be followed by forthcoming versions of the ThinkPad P1 Gen2 and ThinkPad P53. While ThinkPads are usually meant for business users, Lenovo will be happy to sell the Fedora-powered X1 Carbon to home users as well. The new X1 Carbon runs Fedora Workstation 32. This cutting-edge Linux distribution uses the Linux Kernel 5.6. It includes WireGuard virtual private network (VPN) support and USB4 support. This Fedora version uses the new GNOME 3.36 for its default desktop. The system itself comes standard with a 10th Generation Intel Core 1.6Ghz i5-10210U CPU, with up to 4.20 GHz with Turbo Boost. This processor boasts 4 Cores, 8 Threads, and a 6 MB cache. It also comes with 8MBs of LPDDR3 RAM. Unfortunately, its memory is soldered in. While that reduces the manufacturing costs, Linux users tend to like to optimize their hardware and this restricts their ability to add RAM. You can upgrade it to 16MBs, of course, when you buy it for an additional $149. For storage, the X1 defaults to a 256GB SSD. You can push it up to a 1TB SSD. That upgrade will cost you $536. The X1 Carbon Gen 8 has a 14.0" Full High Definition (FHD) (1920 x 1080) screen. For practical purposes, this is as high-a-resolution as you want on a laptop. I've used laptops with Ultra High Definition (UHD), aka 4K, with 3840x2160 resolution, and I've found the text to be painfully small. This display is powered by an integrated Intel HD Graphics chipset. For networking, the X1 uses an Intel Wi-Fi 6 AX201 802.11AX with vPro (2 x 2) & Bluetooth 5.0 chipset. I've used other laptops with this wireless networking hardware and it tends to work extremely well. The entire default package has a base price of $2,145. For now, it's available for $1,287. If you want to order one, be ready for a wait. You can expect to wait three weeks before Lenovo ships it to you.' -- source: https://linux.slashdot.org/story/20/09/03/206205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ARM Co-Founder Hermann Hauser: 'It's In Nvidia's Interests To Destroy Arm'
by Peter Reutemann 04 Sep '20

04 Sep '20

'SoftBank is in advanced talks with US chip company Nvidia to sell Arm -- with a price in the region of 32 billion euros reportedly being thrown around. But Nvidia's purchase of the Cambridge-based chip designer would not only strike a blow to the UK's technological sovereignty, but would result in the destruction of Arm itself, Arm co-founder Hermann Hauser has claimed. Nvidia recently overtook Intel as the most valuable microprocessor company in the world, and its great wealth right now provides it a unique opportunity, says Hauser. "They are the semiconductor company that can buy Arm to destroy it -- and it is very much in its interest to destroy Arm because they [would] gain a lot more than the 40 billion that they pay for it," he claims. Hauser says the acquisition would allow Nvidia to swipe "the microprocessor crown from Intel", and become the chip supplier for 95 per cent of mobile phones, 90 per cent of embedded controllers for the internet of things, as well as taking the PC and data centre markets. Hauser says that an Arm acquisition is a means for Nvidia to become the dominant microprocessor company in the world, "at the same time as they can prevent their main competitors" from making use of further Arm developments. Instead, competitors would need to "scramble" to create their own architecture, handing Nvidia the edge. Up until now, Arm's business model is acting as the "Switzerland of the semiconductor industry" -- maintaining relations with many customers around the world. "Most of them of course, are competitors of Nvidia," says Hauser. Japanese technology investment firm SoftBank acquired Arm in 2016, but ensured the company's continued neutrality. ' -- source: https://slashdot.org/story/20/09/03/2019200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kiwis Get Poorer Netflix
by Lawrence D'Oliveiro 03 Sep '20

03 Sep '20

A comparison of Netflix services available in various regions <https://www.nzherald.co.nz/entertainment/news/article.cfm?c_id=1501119&obje…> shows NZ near the bottom in terms of quality and choice. The study concludes that Canada and the UK get the best service overall, though South Korea gets the best content-quality rating. Presumably this doesn’t apply to those using VPNs ...

1 0

Hackers are exploiting a critical flaw affecting >350,000 WordPress sites
by Peter Reutemann 03 Sep '20

03 Sep '20

'Hackers are actively exploiting a vulnerability that allows them to execute commands and malicious scripts on Websites running File Manager, a WordPress plugin with more than 700,000 active installations, researchers said on Tuesday. Word of the attacks came a few hours after the security flaw was patched. Attackers are using the exploit to upload files that contain webshells that are hidden in an image. From there, they have a convenient interface that allows them to run commands in plugins/wp-file-manager/lib/files/, the directory where the File Manager plugin resides. While that restriction prevents hackers from executing commands on files outside of the directory, hackers may be able to exact more damage by uploading scripts that can carry out actions on other parts of a vulnerable site. NinTechNet, a website security firm in Bangkok, Thailand, was among the first to report the in-the-wild attacks. The post said that a hacker was exploiting the vulnerability to upload a script titled hardfork.php and then using it to inject code into the WordPress scripts /wp-admin/admin-ajax.php and /wp-includes/user.php.' -- source: https://arstechnica.com/information-technology/2020/09/hackers-are-exploiti… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

YouTube More Popular Than TV In NZ
by Lawrence D'Oliveiro 01 Sep '20

01 Sep '20

The only local media company maintaining an “encouraging” market share is TVNZ, according to <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=123611…>. YouTube is the most popular “site, station or channel”, reaching 51% of Kiwis daily. Overall, it seems free-to-air TV has remained stable, while pay TV has fallen, leading to an overall decline in “linear TV”.

1 0