March 2021 - wlug - list.wlug.org.nz

OpenSSL fixes high-severity flaw that allows hackers to crash servers
by Peter Reutemann 26 Mar '21

26 Mar '21

'On Thursday, OpenSSL maintainers disclosed and patched a vulnerability that causes servers to crash when they receive a maliciously crafted request from an unauthenticated end user. CVE-2021-3449, as the denial-of-server vulnerability is tracked, is the result of a null pointer dereference bug. Cryptographic engineer Filippo Valsorda, said on Twitter that the flaw could probably have been discovered earlier than now. “Anyway, sounds like you can crash most OpenSSL servers on the Internet today,” he added.' -- source: https://arstechnica.com/gadgets/2021/03/openssl-fixes-high-severity-flaw-th… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds On Where Rust Will Fit Into Linux
by Peter Reutemann 25 Mar '21

25 Mar '21

'ZDNet article, written by Steven J. Vaughan-Nichols: Linux is the poster-child for the C language. But times change. The Rust language has been slowly gathering support for use as a system language in Linux. For example, at the 2020 Linux Plumbers Conference, developers gave serious thought to using the Rust language for new Linux inline code. So, where is it today? I asked Linux's creator, Linus Torvalds, and the Linux stable kernel maintainer Greg Kroah-Hartman for their thoughts. [...] What does Torvalds make of all this? He's in "the 'wait and see' camp -- I'm interested in the project, but I think it's driven by people who are very excited about Rust, and I want to see how it actually then ends up working in practice." "Personally," Torvalds is "in no way "pushing" for Rust, [but] I'm open to it considering the promised advantages and avoiding some safety pitfalls, but I also know that sometimes promises don't pan out." Torvalds thinks "Rust's primary first target seems to be drivers, simply because that's where you find just a lot of different possible targets, and you have these individual parts of the kernel that are fairly small and independent. That may not be a very interesting target to some people, but it's the obvious one." Another point is taking on drivers first for "any initial trials to drivers is simply the architecture side," said Torvalds. "Lots of drivers are only relevant on a couple of target architectures, so the whole issue with Rust code not being supported on some architectures is less of an issue." Kroah-Hartman agrees that "drivers are probably the first place for an attempt like this as they are the 'end leafs' of the tree of dependencies in the kernel source. They depend on core kernel functionality, but nothing depends on them." Torvalds knows some people don't like the idea of Rust in userspace at all. "People complain[ing] about "Rustification" in userspace isn't a great sign for any future kernel use, but hey, we'll see. The kernel is different from userspace projects -- more difficult in some respects (we use a lot of very odd header files that pushes the boundary of what can be called "C"), but easier in many other respects (mainly in the sense that the kernel is fairly self-contained, and then doesn't rely on other projects for the final binary)." From where Kroah-Hartman sits, "it will all come down to how well the interaction between the kernel core structures and lifetime rules that are written in C can be mapped into Rust structures and lifetime rules for drivers in Rust to be able to use them properly. That's going to take a lot of careful work by the developers wanting to hook this all up and I wish them the best of luck."' -- source: https://linux.slashdot.org/story/21/03/24/2115238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME 40 Released
by Peter Reutemann 25 Mar '21

25 Mar '21

'The GNOME 40 desktop update has been released with a bunch of new improvements. Phoronix summarizes the major changes: GNOME 40 is out with the GTK4 toolkit in tow, many improvements and alterations to the GNOME Shell including major changes to the dash and workspaces, Mutter has continued refining its Wayland support, Mutter also added a native headless back-end for testing, atomic mode-setting is now supported, input handling is now done in a separate thread, and a wide variety of other improvements. And, yes, there is also the big shift in GNOME's versioning practices moving forward while still sticking to the same six month release regiment. ' -- source: https://tech.slashdot.org/story/21/03/24/1957215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Free software advocates seek removal of Richard Stallman and entire FSF board
by Peter Reutemann 24 Mar '21

24 Mar '21

'Richard Stallman's return to the Free Software Foundation's board of directors has drawn condemnation from many people in the free software community. An open letter signed by hundreds of people today called for Stallman to be removed again and for the FSF's entire board to resign. The open letter said: "Richard M. Stallman, frequently known as RMS, has been a dangerous force in the free software community for a long time. He has shown himself to be misogynist, ableist, and transphobic, among other serious accusations of impropriety. These sorts of beliefs have no place in the free software, digital rights, and tech communities. With his recent reinstatement to the Board of Directors of the Free Software Foundation, we call for the entire Board of the FSF to step down and for RMS to be removed from all leadership positions." Letter signers include Neil McGovern, GNOME Foundation executive director and former Debian Project Leader; Deb Nicholson, general manager of the Open Source Initiative; Matthew Garrett, a former member of the FSF board of directors; seven of the eight members of the X.org Foundation board of directors; Elana Hashman of the Debian Technical Committee, Open Source Initiative, and Kubernetes project; Molly de Blanc of the Debian Project and GNOME Foundation; and more than 300 others. That number has been rising quickly today: the open letter contains instructions for signing it.' -- source: https://arstechnica.com/tech-policy/2021/03/free-software-advocates-seek-re… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WiMAX Is Dead
by Lawrence D'Oliveiro 23 Mar '21

23 Mar '21

Linux hardware guru Greg Kroah-Hartman is inching closer to dumping all support for WiMAX from the Linux kernel <https://www.theregister.com/2021/03/22/wimax_linux/>. If you’ve never heard of it, you’re not missing anything. I remember reading about it in the earliest days of wireless networking: while Wi-Fi (IEEE 802.11) was about wireless connectivity with mobile endpoints, WiMAX (IEEE 802.16) was designed for connecting between fixed stations. Clearly Wi-Fi can also be used with the latter, though maybe there were some obscure technical reasons why WiMAX was a better fit in the stationary situation. In the early days of Wi-Fi, creative users found ways to transmit it over long distances using high-gain antennas constructed from such low-tech components as Pringles cans. I suspect that Wi-Fi gear, being such a big seller to consumers, was always much cheaper than WiMAX, which is why the latter was never able to gain a foothold.

1 0

Mozilla Firefox Tweaks Referrer Policy To Shore Up User Privacy
by Peter Reutemann 23 Mar '21

23 Mar '21

'Mozilla Firefox will soon include a revised Referrer Policy to tighten up queries and better protect user information. From a report: Firefox 87, due to ship on March 23, will cut back on path and query string information from referrer headers "to prevent sites from accidentally leaking sensitive user data." In a blog post on Monday, developer Dimi Lee and security infrastructure engineering manager Christoph Kerschbaumer said the latest browser version will include a "stricter, more privacy-preserving default Referrer Policy." Browsers send HTTP Referrer headers to websites to indicate which location has 'referred' a user to a website server. Full URLs of referring documents are often sent in the HTTP Referrer header with other subresource requests, and while this may contain innocent information used for purposes including analytics, private user data may also be included. Referrer policies aim to protect this data, but if no policy is set by a website, this often defaults to "no-referrer-when-downgrade," an element that Firefox says does trim down the referrer when navigating to a less secure resource, but still "sends the full URL including path and query information of the originating document as the referrer."' -- source: https://tech.slashdot.org/story/21/03/22/1959256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman Says He Has Returned To the Free Software Foundation Board of Directors and Doesn't Intend To Resign Again
by Peter Reutemann 23 Mar '21

23 Mar '21

'Richard M Stallman, founder and former president of the Free Software Foundation (FSF), announced at the organisation's LibrePlanet virtual event that he has rejoined the board and does not intend to resign again. From a report: Stallman spoke at the event yesterday on the subject of unjust computing -- covering locked-down operating systems, non-free client software, user-restricting app stores, and more. Before the talk he stated: "I have an announcement to make. I'm now on the Free Software Foundation Board of Directors once again. We were working on a video to announce this with, but that turned out to be difficult, we didn't have experience doing that sort of thing so it didn't get finished but here is the announcement. Some of you will be happy at this, and some might be disappointed, but who knows? In any case, that's how it is, and I'm not planning to resign a second time." Stallman resigned both as president and FSF board member in September 2019, saying: "I am doing this due to pressure on the Foundation and me over a series of misunderstandings and mischaracterizations of what I have said." This followed remarks he made concerning MIT professor Marvin Minsky, who died in 2016, and his association with sex offender Jeffrey Epstein. Stallman's resignation was welcomed at the time by some prominent free software advocates including GNOME executive director Neil McGovern and FSF sister organisation FSF Europe.' -- source: https://news.slashdot.org/story/21/03/22/1557250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rust Takes 'Tentative First Step' Toward Linux Kernel
by Peter Reutemann 21 Mar '21

21 Mar '21

'In his This Week in Programming column, Mike Melanson writes: Rustaceans' dreams of Rust's inclusion in the Linux kernel are one tiny, ever so slight step closer to becoming a reality, with this week's "intentionally bare-bones" inclusion in Linux-next, the development branch of the Linux kernel... Curb your enthusiasm, however, as this remains a rather tentative first step of many necessary steps before Rust fully lands in the Linux kernel. A rather brief post on LWN.net summarizes where we are rather succinctly: Followers of the linux-next integration tree may have noticed a significant addition: initial support for writing device drivers in the Rust language. There is some documentation in Documentation/rust, while the code itself is in the rust top-level directory. Appearance in linux-next generally implies readiness for the upcoming merge window, but it is not clear if that is the case here; this code has not seen a lot of wider review yet. It is, regardless, an important step toward the ability to write drivers in a safer language. Indeed, Miguel Ojeda, a software developer and maintainer of the Rust for Linux project writes that the proposed inclusion "does not mean we will make it into mainline, of course, but it is a nice step to make things as smooth as possible," with some changes expected before any decision as to Rust's inclusion are made. For those of you less familiar with Rust, part of the appeal here comes with Rust's memory safety features, especially in comparison to C, which the Linux kernel is currently coded in. Part of the problem, however, is that Rust is compiled based on LLVM, as opposed to GCC, and subsequently supports fewer architectures. This is a problem we've seen play out recently, as the Python cryptography library has replaced some old C code with Rust, leading to a situation where certain architectures will not be supported. Presently, the proposal to include Rust in the Linux kernel limits this issue by saying that Rust would be used, at least initially, for writing drivers that, as noted in another LWN.net article on the topic, "would never be used on the more obscure architectures anyway."' -- source: https://linux.slashdot.org/story/21/03/20/0321230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism Says Unfair iOS Policies Forced it to Remove Its VPN Tunnel from IOS Store
by Peter Reutemann 21 Mar '21

21 Mar '21

'In 2019 Purism launched a suite of privacy-protecting, no-tracking apps and services named Librem One. And it included an encrypted, no-logging, virtual private network tunnel named Librem Tunnel. Unfortunately, "Recently we've been forced to remove Librem Tunnel from iOS due to their unfair policies," explains a post this week on Purism's blog: Apple's policy is that applications that make in-app purchases or offer subscriptions using Apple's payment platform pay Apple 30% of their revenue. The justification behind that fee is that companies are benefiting from all of the work Apple has put into its payments platform and so the fee helps them maintain that payments infrastructure while saving app developers from having to implement their own payment or subscription infrastructure... Recently our VPN endpoints have changed, which required us to update the Librem Tunnel application. Unfortunately our attempts to push an update were blocked, because Apple saw that the application was a VPN, which flagged it to check whether it was a subscription service (which VPNs frequently are). Even though Librem Tunnel is just part of the overall Librem One offering, because it's part of a subscription service, Apple is requiring us to add the ability to sign up and pay for Librem One subscriptions within the Librem Tunnel app before they will allow updated versions into the App Store. Why are they making that requirement even though we already have our own independent payment infrastructure? Because once that app allows in-app purchases, Apple can then automatically take their 30% cut. We do not accept these kinds of monopolistic practices, nor do we want to fund them through our own customers. Since Apple does not allow alternatives to the App Store on their platform, we have no choice but to remove Librem Tunnel from iOS, until such time Apple changes their policies either on their own, or through government intervention. For their existing users on iOS, "Because Librem Tunnel uses the standard, open, OpenVPN protocol, we have been working with customers to apply their OpenVPN configuration to a different iOS OpenVPN client."' -- source: https://apple.slashdot.org/story/21/03/20/0413228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Audacity 3.0 Released
by Lawrence D'Oliveiro 20 Mar '21

20 Mar '21

One thing that’s new <https://www.theregister.com/2021/03/19/audacity_3/> is the file format is now an SQLite database. This integrates everything, including audio data, into a single file, unlike the older .aup file format. Also I hadn’t heard of the “Nyquist” sound-processing system before. Its home page is here <http://www.cs.cmu.edu/~music/nyquist/>. Might be fair to say it’s the world’s most popular audio editor.

1 0