June 2021 - wlug - list.wlug.org.nz

Google Releases Dependency-Mapping Tool
by Lawrence D'Oliveiro 04 Jun '21

04 Jun '21

Report <https://www.theregister.com/2021/06/04/google_open_source_insights/> on a new service from Google where it examines millions of online source-code project repositories, and maps out their dependencies, letting you see information like licensing and security vulnerabilities. Because a vulnerability in a package you depend on could become a vulnerability in your code.

1 0

How Facebook Architects Around Silent Data Corruption
by Lawrence D'Oliveiro 04 Jun '21

04 Jun '21

Seems like Facebook’s computation facilities have become so massive that it is starting to see intermittent errors in places you wouldn’t expect <https://www.nextplatform.com/2021/03/01/facebook-architects-around-silent-d…>: Engineers found that many of the cascading errors are the result of CPUs in production but not always due to the “soft errors” of radiation or synthetic fault injection. Rather, they find these can happen randomly on CPUs in repeatable ways. Although ECC is useful, this is focused on problems in SRAM but other elements are susceptible. The Facebook engineering team that reported on these problems finds that CPU silent data corruptions are actually orders of magnitude higher than soft-errors due to a lack of error correction in other blocks. The article mentions examples like a computation of 2×3 sometimes returning an answer other than 6, or a file size intermittently (and incorrectly) being computed as zero, leading to the file data not being copied. Such occurrences may be extremely rare, but when you are doing things on the scale that Facebook does, they start to become all too common. Facebook has published a paper (linked in the report) on their research into the problem. They have worked out some techniques to try to mitigate these issues, but of course they come at a cost.

1 1

The Collective Code Construction Contract
by Lawrence D'Oliveiro 04 Jun '21

04 Jun '21

Came across this interesting document <https://rfc.zeromq.org/spec/42/> referenced from another project I was browsing. It is a set of guidelines for how Free Software projects should be managed. Some choice extracts: The project SHALL use the git distributed revision control system. The project SHALL use a share-alike license such as the MPLv2, or a GPLv3 variant thereof (GPL, LGPL, AGPL). All contributions to the project source code (“patches”) SHALL use the same license as the project. All patches are owned by their authors. There SHALL NOT be any copyright assignment process. Some specifics of how to use, and not to use, Git: The project SHALL have one branch (“master”) that always holds the latest in-progress version and SHOULD always build. The project SHALL NOT use topic branches for any reason. Personal forks MAY use topic branches. To make a stable release a Maintainer shall tag the repository. Stable releases SHALL always be released from the repository master. Actually that last one seems a bit questionable. For example, Blender does not structure its repos that way. Each stable release has its own branch, which may continue to accumulate bug fixes for as long as it is under support, while main development of the next version continues on the master branch. Plus there guidelines for handling people-management issues, of course: Administrators SHOULD block or ban “bad actors” who cause stress and pain to others in the project. This should be done after public discussion, with a chance for all parties to speak. A bad actor is someone who repeatedly ignores the rules and culture of the project, who is needlessly argumentative or hostile, or who is offensive, and who is unable to self-correct their behavior when asked to do so by others.

1 0

Google is Making it Harder for Android Apps To Track You Once You've Opted Out
by Peter Reutemann 04 Jun '21

04 Jun '21

'It's going to get harder for Android apps to track users who've opted out of receiving personalized ads, the Financial Times reports, after Google announced changes to how it'll handle the unique device identifiers that allow marketers to track them between apps. From a report: Starting later this year, Google is cutting off access to these "Advertising IDs" after a user opts out, and will show developers a "string of zeros" in its place. The news was announced in an email to Play Store developers, and Google has also updated its support page for Advertising IDs with the announcement. Google told developers the changes will "provide users with more control over their data, and help bolster security and privacy," the Financial Times reports. The change comes a few short months after Apple overhauled how advertising IDs work on iOS in an apparent attempt to compete with the new policy. ' -- source: https://yro.slashdot.org/story/21/06/03/140255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft’s Package Manager Quality Issue
by Lawrence D'Oliveiro 03 Jun '21

03 Jun '21

Microsoft has officially launched “Winget”, aka the Windows Package Manager <https://www.theregister.com/2021/06/02/microsoft_introduces_moderation_for_…>. Unfortunately, it’s run into a bit of a snag: anybody can submit packages to be included in the repo willy-nilly, leading to problems like duplicates, bad links and other misbehaviour. “What is wrong with this picture?” as they say: Look at any of the common Linux distros, and you will see that every package has an official maintainer who will take responsibility for its quality, handling of bug reports, updating from upstream and so on. Nobody can simply submit a package to be included and then forget about it. There is a proper QA system.

1 0

No More CLA For GCC
by Lawrence D'Oliveiro 03 Jun '21

03 Jun '21

The Free Software Foundation has long been one of those outfits that has refused to accept (significant) source contributions without the author signing a “Contributor Licence Agreement”. It’s not enough to release the code under the same licence as the project, you must also hand over the entire copyright to them. This is supposedly because they have received legal advice that it makes it easier to defend against copyright infringements if they own all the code. Quite a few other projects don’t agree <https://lwn.net/Articles/592503/>. For example, the Linux kernel project does not demand CLAs, only a “Certificate of Origin” (affirming that you have the right to contribute the code). And now the GNU Compiler Collection is joining them. <https://www.theregister.com/2021/06/02/gcc_fsf_code_copyright/>

2 2

Alibaba's Huge Browser Business Is Harvesting The 'Private' Web Activity Of Millions Of Android And iPhone Users
by Peter Reutemann 03 Jun '21

03 Jun '21

'Security researcher Gabi Cirlig's findings, verified for Forbes by two other independent researchers, reveal that on both Android and iOS versions of UC Browser, every website a user visits, regardless of whether they're in incognito mode or not, is sent to servers owned by UCWeb. From a report: Cirlig said IP addresses -- which could be used to get a user's rough location down to the town or neighborhood of the user -- were also being sent to Alibaba-controlled servers. Those servers were registered in China and carried the .cn Chinese domain name extension, but were hosted in the U.S. An ID number is also assigned to each user, meaning their activity across different websites could effectively be monitored by the Chinese company, though it's not currently clear just what Alibaba and its subsidiary are doing with the data. "This could easily fingerprint users and tie them back to their real personas," Cirlig wrote in a blog post handed to Forbes ahead of publication on Tuesday. Cirlig was able to uncover the problem by reverse engineering some encrypted data he spotted being sent back to Beijing. Once the key had been cracked, he was able to see that every time he visited a website, it was being encrypted and transmitted back to the Alibaba company. On Apple's iOS, he didn't even need to reverse engineer the encryption because there effectively was none on the device (though it was encrypted when in transit). "This kind of tracking is done on purpose without any regard for user privacy," Cirlig told Forbes. When compared to Google's own Chrome browser, for instance, it does not transfer user web browsing habits when in incognito. Cirlig said he'd looked at other major browsers and found none did the same as UC Browser. ' -- source: https://yro.slashdot.org/story/21/06/02/185213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome's Top Web App Advocate Resigns
by Peter Reutemann 03 Jun '21

03 Jun '21

'Google is losing one of its strongest champions of the web. Alex Russell, who has led the Fugu project to make web apps as powerful as those running on Google's Android or Apple's iOS software, is leaving the company on Wednesday. From a report: Russell announced his departure on Twitter. He's not quitting in anger or being pushed out. But after 12 years at Google pushing his vision for a more powerful web, "I need some time off," he said in an interview. Russell has been an outspoken advocate for the web, using Chrome's dominant position to help test and introduce new abilities that let programmers build interactive apps on the web, not just relatively static websites. Project Fugu embodies this effort, as does the broader progressive web app, or PWA, movement that lets you install and launch web apps more like those that run natively on smartphones and PCs.' -- source: https://tech.slashdot.org/story/21/06/02/1931236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huawei's HarmonyOS Arrives With iPad-Inspired Tablet UI, Apparent Android Base
by Peter Reutemann 03 Jun '21

03 Jun '21

'Two years into its ban from the US Government and, in turn, access to the Play Store on its Android-powered devices, Huawei is unveiling HarmonyOS. The platform is an alternative to Android that powers TVs, smartphones, tablets, and smartwatches. 9to5Google reports: Announced at an event today, Huawei is positioning HarmonyOS as an operating system that can handle just about everything, from the smartphone in your pocket to IoT devices such as "power sockets and lamps." The company says the goal of the platform is to have one set of code that can be used across virtually any device, saying that it is not aware of "any other operating system in the world" that can cover such a wide range of devices. Leaning into this ability, Huawei developed a "Control Panel," which gives users the ability to connect multiple devices together, with the example of using the "music widget" to throw audio playback to nearby speakers or TVs. A "Super Device" widget shows icons for other nearby devices and enables a quick and easy pairing mode. On smartphones, the HarmonyOS homescreen can use a swipe-up gesture on apps developed for the platform to see a widget pulling information from that app. Those widgets, apparently, can also be used across devices because of the shared codebase Huawei says HarmonyOS offers. The homescreen can also intelligently add apps to a folder based on the category. Interestingly, Huawei says HarmonyOS devices will also be able to move running apps from one device to another, which is really neat and unique. Moving apps between devices apparently also works between watches and TVs, with a workout app being used on both simultaneously given as an example. A video calling app was also shown moving between devices. Huawei says that performance of HarmonyOS is "superior" to Android with EMUI, specifically calling out long-term use. While there are certainly new elements in HarmonyOS, it appears to be a "fork" of Android. The Verge spent time with the HarmonyOS-powered MatePad Pro and described the act of installing Android APKs as "though I was using an Android device." Visually, there are also a tremendous number of similarities between HarmonyOS and Android, though there are some distinct elements of Apple's iPad OS in the platform's tablet-optimized homescreen, seen below as Evan Blass posted to Twitter. Android Authority further described HarmonyOS as "ultimately a spin on Android 10" with a "slight rebrand." TechRadar said the software was "clearly" based on Android. These findings from the media appear to back up a previous report from ArsTechnica, which showed the developer preview as basically a clone of EMUI-skinned Android. ' -- source: https://tech.slashdot.org/story/21/06/02/2114259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

China Cracking Down On Cryptomining
by Lawrence D'Oliveiro 02 Jun '21

02 Jun '21

This article <https://www.aljazeera.com/economy/2021/5/24/china-crackdown-forces-crypto-m…> reports on how many large cryptomining operators are moving out of China in the wake of the Government’s actions against them. But the main reason I’m posting this link is because of that picture. That’s what it looks like inside a cryptomining farm. Look at those power cables, like ships’ hawsers. It’s even more impressive at full resolution.

1 1