July 2021 - wlug - list.wlug.org.nz

PlasticArm is a 32-bit bendable processor
by Peter Reutemann 22 Jul '21

22 Jul '21

'Wearable electronics, like watches and fitness trackers, represent the next logical step in computing. They've sparked an interest in the development of flexible electronics, which could expand the category to include products like clothing and backpacks. Flexible electronics run into a problem, however: Our processing hardware is anything but flexible. Most efforts to deal with that limitation have involved splitting up processors into a collection of smaller units, linking them with flexible wiring, and then embedding all the components in a flexible polymer. To an extent, the process is a throwback to the early days of computing, when a floating-point unit might reside on a separate chip. But a group within the semiconductor company Arm has now managed to implement one of the company's smaller embedded designs using flexible silicon. The design works and executes all the instructions you'd expect from it, but it also illustrates the compromises we have to make to produce truly flexible electronics.' -- source: https://arstechnica.com/science/2021/07/researchers-build-a-bendable-arm-pr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Audacity’s new owner is in another fight with the open source community
by Peter Reutemann 21 Jul '21

21 Jul '21

'Muse Group—owner of the popular audio-editing app Audacity—is in hot water with the open source community again. This time, the controversy isn't over Audacity—it's about MuseScore, an open source application which allows musicians to create, share, and download musical scores (especially, but not only, in the form of sheet music). The MuseScore app itself is licensed GPLv3, which gives developers the right to fork its source and modify it. One such developer, Wenzheng Tang ("Xmader" on GitHub) went considerably further than modifying the app—he also created separate apps designed to bypass MuseScore Pro subscription fees. After thoroughly reviewing the public comments made by both sides at GitHub, Ars spoke at length with Muse Group's Head of Strategy Daniel Ray—known on GitHub by the moniker "workedintheory"—to get to the bottom of the controversy.' -- source: https://arstechnica.com/gadgets/2021/07/audacitys-new-owner-is-in-another-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Nasty Linux Systemd Security Bug Revealed
by Peter Reutemann 21 Jul '21

21 Jul '21

'Qualys has discovered a new systemd security bug that enables any unprivileged user to cause a denial of service via a kernel panic. Slashdot reader inode_buddha shares the news via ZDNet's Steven J. Vaughan-Nichols: As Bharat Jogi, Qualys's senior manager of Vulnerabilities and Signatures, wrote, "Given the breadth of the attack surface for this vulnerability, Qualys recommends users apply patches for this vulnerability immediately." You can say that again. Systemd is used in almost all modern Linux distributions. This particular security hole arrived in the systemd code in April 2015. It works by enabling attackers to misuse the alloca() function in a way that would result in memory corruption. This, in turn, allows a hacker to crash systemd and hence the entire operating system. Practically speaking, this can be done by a local attacker mounting a filesystem on a very long path. This causes too much memory space to be used in the systemd stack, which results in a system crash. That's the bad news. The good news is that Red Hat Product Security and systemd's developers have immediately patched the hole. ' -- source: https://it.slashdot.org/story/21/07/20/211230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Experimental Rust Support Patches Submitted to Linux Kernel Mailing List
by Peter Reutemann 21 Jul '21

21 Jul '21

'"The Rust for Linux project, sponsored by Google, has advanced..." reported the Register earlier this week: A new set of patches submitted to the Linux kernel mailing list summarizes the progress of the project to enable Rust to be used alongside C for implementing the Linux kernel. The progress is significant. - ARM and RISC-V architectures are now supported, thanks to work on rustc_codgen_gcc, which is a GCC codegen for rustc. This means that rustc does the initial compilation of Rust code but GCC (the GNU Compiler Collection) does the backend compilation, enabling support for the architectures that GCC supports... - Overall, "the Rust support is still to be considered experimental. However, as noted back in April, support is good enough that kernel developers can start working on the Rust abstractions for subsystems and write drivers and other modules," continued project leader Miguel Ojeda, a computer scientist at CERN in Geneva, Switzerland, now working full time on Rust for Linux... There is substantial support for the project across the industry. Google said in April "we feel that Rust is now ready to join C as a practical language for implementing the kernel" and that it would reduce the number of potential bugs and security vulnerabilities. Google is sponsoring Ojeda to work full time on the project for a year, via the ISRG (Internet Security Research Group), which said last month that it is part of "efforts to move the internet's critical software infrastructure to memory safe code," under the project name Prossimo. The ISRG is also the nonprofit organisation behind Let's Encrypt free security certificates. Ojeda also mentioned that Microsoft's Linux Systems Group is contributing and hopes to submit "select Hyper-V drivers written in Rust." Arm is promising assistance with Rust for Linux on ARM-based systems. IBM has contributed Rust kernel support for its PowerPC processor. More detail is promised at the forthcoming Linux Plumber's Conference in September. In the meantime, the project is on GitHub here. "In addition, we would like to announce that we are organizing a new conference that focuses on Rust and the Linux kernel..." Ojeda posted. "Details will be announced soon." And for context, the Register adds: Linus Torvalds has said on several occasions that he welcomes the possibility of using Rust alongside C for kernel development, and told IT Wire in April that it is "getting to the point where maybe it might be mergeable for 5.14 or something like that."' -- source: https://linux.slashdot.org/story/21/07/10/0447253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

MicroG Project
by Lawrence D'Oliveiro 21 Jul '21

21 Jul '21

Came across this <https://microg.org/>, which is an open-source reimplementation of much of Google’s proprietary Play Services for Android. Their repos are on GitHub <https://github.com/microg>. They’ve been getting some funding from the German Federal Ministry of Education and Research.

1 0

DuckDuckGo Launches New Email Protection Service To Remove Trackers
by Peter Reutemann 21 Jul '21

21 Jul '21

'DuckDuckGo is launching a new email privacy service meant to stop ad companies from spying on your inbox. From a report: The company's new Email Protection feature gives users a free "@duck.com" email address, which will forward emails to your regular inbox after analyzing their contents for trackers and stripping any away. DuckDuckGo is also extending this feature with unique, disposable forwarding addresses, which can be generated easily in DuckDuckGo's mobile browser or through desktop browser extensions. The personal DuckDuckGo email is meant to be given out to friends and contacts you know, while the disposable addresses are better served when signing up for free trials, newsletters, or anywhere you suspect might sell your email address. If the email address is compromised, you can easily deactivate it. These tools are similar to anti-tracking features implemented by Apple in iOS 14 and iOS 15, but DuckDuckGo's approach integrates into iOS, Android, and all major web browsers. DuckDuckGo will also make it easier to spin up disposable email addresses on the fly, for newsletters or anywhere you might share your email.' -- source: https://yro.slashdot.org/story/21/07/20/1532258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

For years, a backdoor in popular KiwiSDR product gave root to project developer
by Peter Reutemann 20 Jul '21

20 Jul '21

'KiwiSDR is hardware that uses a software-defined radio to monitor transmissions in a local area and stream them over the Internet. A largely hobbyist base of users does all kinds of cool things with the playing-card-sized devices. For instance, a user in Manhattan could connect one to the Internet so that people in Madrid, Spain, or Sydney, Australia, could listen to AM radio broadcasts, CB radio conversations, or even watch lightning storms in Manhattan. On Wednesday, users learned that for years, their devices had been equipped with a backdoor that allowed the KiwiSDR creator—and possibly others—to log in to the devices with administrative system rights. The remote admin could then make configuration changes and access data not just for the KiwiSDR but in many cases to the Raspberry Pi, BeagleBone Black, or other computing devices the SDR hardware is connected to.' -- source: https://arstechnica.com/gadgets/2021/07/for-years-a-backdoor-in-popular-kiw… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers got past Windows Hello by tricking a webcam
by Peter Reutemann 20 Jul '21

20 Jul '21

'Biometric authentication is a key piece of the tech industry's plans to make the world password-less. But a new method for duping Microsoft's Windows Hello facial-recognition system shows that a little hardware fiddling can trick the system into unlocking when it shouldn't. Services like Apple's FaceID have made facial-recognition authentication more commonplace in recent years, with Windows Hello driving adoption even farther. Apple only lets you use FaceID with the cameras embedded in recent iPhones and iPads, and it's still not supported on Macs at all. But because Windows hardware is so diverse, Hello facial recognition works with an array of third-party webcams. Where some might see ease of adoption, though, researchers from the security firm CyberArk saw potential vulnerability. That's because you can't trust any old webcam to offer robust protections in how it collects and transmits data. Windows Hello facial recognition works only with webcams that have an infrared sensor in addition to the regular RGB sensor. But the system, it turns out, doesn't even look at RGB data. Which means that with one straight-on infrared image of a target's face and one black frame, the researchers found that they could unlock the victim's Windows Hello–protected device. By manipulating a USB webcam to deliver an attacker-chosen image, the researchers could trick Windows Hello into thinking the device owner’s face was present and unlocking.' -- source: https://arstechnica.com/information-technology/2021/07/hackers-got-past-win… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Case Against SQL
by Peter Reutemann 19 Jul '21

19 Jul '21

'Long-time Slashdot reader RoccamOccam shares "an interesting take on SQL and its issues from Jamie Brandon (who describes himself as an independent researcher who's built database engines, query planners, compilers, developer tools and interfaces). It's title? "Against SQL." The relational model is great... But SQL is the only widely-used implementation of the relational model, and it is: Inexpressive, Incompressible, Non-porous. This isn't just a matter of some constant programmer overhead, like SQL queries taking 20% longer to write. The fact that these issues exist in our dominant model for accessing data has dramatic downstream effects for the entire industry: - Complexity is a massive drag on quality and innovation in runtime and tooling - The need for an application layer with hand-written coordination between database and client renders useless most of the best features of relational databases The core message that I want people to take away is that there is potentially a huge amount of value to be unlocked by replacing SQL, and more generally in rethinking where and how we draw the lines between databases, query languages and programming languages... I'd like to finish with this quote from Michael Stonebraker, one of the most prominent figures in the history of relational databases: "My biggest complaint about System R is that the team never stopped to clean up SQL... All the annoying features of the language have endured to this day. SQL will be the COBOL of 2020..." It's been interesting to follow the discussion on Twitter, where the post's author tweeted screenshots of actual SQL code to illustrate various shortcomings. But he also notes that "The SQL spec (part 2 = 1732) pages is more than twice the length of the Javascript 2021 spec (879 pages), almost matches the C++ 2020 spec (1853) pages and contains 411 occurrences of 'implementation-defined', occurrences which include type inference and error propagation." His Twitter feed also includes a supportive retweet from Rust creator Graydon Hoare, and from a Tetrane developer who says "The Rust of SQL remains to be invented. I would like to see it come."' -- source: https://developers.slashdot.org/story/21/07/18/1844225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

meeting next Monday (July 26th)
by Peter Reutemann 19 Jul '21

19 Jul '21

Hi everyone We have a WLUG meeting coming up next Monday (July 26th): 'Looking for a replacement of Dropbox or Google Drive that respects your privacy? Then come to our meeting, as Glenn will show you how to install, run and use the open-source solution Nextcloud (https://nextcloud.com/) on a Raspberry Pi and check out the various clients that you can use with it.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861069/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0