October 2022 - wlug - list.wlug.org.nz

Google Announces KataOS
by Peter Reutemann 19 Oct '22

19 Oct '22

'Last Friday, Google announced the release of KataOS, a security-minded operating system focused on embedded devices running ambient machine learning workloads. As Phoronix notes, it uses the Rust programming language and is "built atop the seL4 microkernel as its foundatin." From Google's Open-Source Blog: As the foundation for this new operating system, we chose seL4 as the microkernel because it puts security front and center; it is mathematically proven secure, with guaranteed confidentiality, integrity, and availability. Through the seL4 CAmkES framework, we're also able to provide statically-defined and analyzable system components. KataOS provides a verifiably-secure platform that protects the user's privacy because it is logically impossible for applications to breach the kernel's hardware security protections and the system components are verifiably secure. KataOS is also implemented almost entirely in Rust, which provides a strong starting point for software security, since it eliminates entire classes of bugs, such as off-by-one errors and buffer overflows. The current GitHub release includes most of the KataOS core pieces, including the frameworks we use for Rust (such as the sel4-sys crate, which provides seL4 syscall APIs), an alternate rootserver written in Rust (needed for dynamic system-wide memory management), and the kernel modifications to seL4 that can reclaim the memory used by the rootserver. KataOS code is being worked on via GitHub under the AmbiML umbrella.' -- source: https://tech.slashdot.org/story/22/10/17/2256206 Someone keen to demo this at one of our next meetings? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linus Torvalds To Kernel Devs: Grow Up and Stop Pulling All-Nighters Just Before Deadline
by Peter Reutemann 19 Oct '22

19 Oct '22

'Linux kernel boss Linus Torvalds has released the first release candidate for version 6.1 of the project and added an appeal for developers to make his life easier by adding code earlier in the development cycle. The Register reports: "Let me just say that after I got my machine sorted out and caught up with the merge window, I was somewhat frustrated with various late pull requests. I've mentioned this before, but it's _really_ quite annoying to get quite a few pull requests in the last few days of the merge window." He then offered further guidance on how kernel devs can do it right. "Yes, the merge window is two weeks, but that's very much to allow me time to look things over, not 'two weeks to hurriedly put together a branch that you send Linus on Friday of the second week'," he wrote. "The whole 'do an all-nighter to get the paper in the day before the deadline' is something that should have gone out the window after high school. Not for kernel development." His next line was: "You know who you are." "Anyway, it's not the first time I've said this, I doubt it will be the last. But maybe more people could take it to heart, ok?" he added, before concluding his post with a slightly non-traditional call for testers to visit Linux's git tree because "The merge window may not be the biggest ever, but it's certainly big enough that the shortlog is much too big to post, and below is just my usual merge log." "For all the gory details, please refer to the git tree."' -- source: https://linux.slashdot.org/story/22/10/17/220230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu's New Terminal 'Ad' is Angering Users
by Peter Reutemann 19 Oct '22

19 Oct '22

'Joey Sneddon, reporting at OMG! Ubuntu: In September I tweeted a screenshot of something unexpected that has started to show up in the terminal when I ran system updates. It didn't enrage me at the time (and it kinda still doesn't) but I did find it a little ... Off. Now, if you're suitably tuned-in to the Linux newswire and/or an avid attendee of social media you'll probably heard about the drama in question. If you haven't, then allow me to... Yes, the furore is over an "ad" for Ubuntu Pro, Canonical's revamped support offering that replaces/augments Ubuntu Advantage (which has been around for many years) that appears in the terminal when managing system updates. Other people are calling it an "ad" (hence quote marks). I prefer the term plug (which, it turns out, some people aren't familiar with; it means to mention something in order to promote it). For although this sentence is technically advertising something, in this case Ubuntu Pro, the offering itself is free for regular users (on up-to five devices). Thus, it's not like this is an "ad" that generates Canonical revenue. It's more akin to a public service announcement to raise awareness.' -- source: https://news.slashdot.org/story/22/10/18/1847203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Xv6 Open-Source Teaching OS
by Lawrence D'Oliveiro 17 Oct '22

17 Oct '22

You may know that the MINIX operating system, the inspiration for Linux, was created for teaching purposes (namely, Andrew Tanenbaum’s “Operating Systems” textbook). In the same vein, Xv6 is a newer teaching OS from MIT <https://pdos.csail.mit.edu/6.828/2022/xv6.html>, for use in an undergraduate operating systems course. Originally it was implemented on x86, but now it has moved to RISC-V. The inspiration for Xv6 was the old 6th Edition Unix from Bell Labs from 1975, back when it only ran on DEC PDP-11 processors. This OS version was the subject of the famous “Lions book” <https://en.wikipedia.org/wiki/A_Commentary_on_the_UNIX_Operating_System>, circulation of which was supposed to be restricted to those with licences to the Unix source code. And then with the 7th Edition, AT&T even forbade classroom use of this source code. Nevertheless, the book still spread via, shall we say, samizdat ... The Xv6 GitHub area is here <https://github.com/mit-pdos>.

1 0

Pine64 Announces 'Sub-$10, Linux-Capable' SBC - the Ox64
by Peter Reutemann 17 Oct '22

17 Oct '22

'Pine64 has announced a new "sub $10 Linux capable single board computer" called the Ox64. Liliputing says the tiny SBC "looks a lot like a Raspberry Pi Pico. But while Raspberry Pi's tiny board is powered by an RP2040 microcontroller, the Ox64 has a dual-core RISC-V processor, 64MB of embedded RAM, and support for up to 128Mb of flash storage plus a microSD card for additional storage." It's expected to support RTOS and Linux and blurs the lines between a microcontroller and a (very low power) single-board PC. It's expected to go on sale in November with prices starting at $6 for an RTOS-ready version of the board and $8 for a Linux-compatible model. As spotted by CNX Software earlier this month, the board is designed to be a small, inexpensive single-board computer with a RISC-V processor that's aimed at developers. Pine64's October update also reveals that their Star64 and QuartzPro64 single-board computers "now boot Linux (and run it well too already!)"' -- source: https://news.slashdot.org/story/22/10/15/2314226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bad DIMM on Linus Torvalds' Desktop System Moves Kernel Merges to His Laptop
by Peter Reutemann 17 Oct '22

17 Oct '22

'When a kernel developer asked Linus Torvalds if he'd missed a Git pull, Torvalds "revealed the request was still in his queue as 'I'm doing merges (very slowly) on my laptop, while waiting for new ECC memory DIMMs to arrive,'" reports The Register: Torvalds needs the DIMMs because over the last few days he experienced what he described as "some instability on my main desktop... with random memory corruption in user space resulting in my allmodconfig builds randomly failing with internal compiler errors etc." The Linux boss's first thought was that a new kernel bug had caused the problem — which isn't good but sometimes happens. His instinct was wrong. "It was literally a DIMM going bad in my machine randomly after 2.5 years of it being perfectly stable," he wrote. "Go figure. Verified first by booting an old kernel, and then with memtest86+ overnight." Torvalds appears to have been tracking delivery of the new DIMMs as he reported replacement memory was "out for delivery" and predicted it should arrive later on Sunday evening.... His post also mentions that his main PC was set up for error correction code memory (ECC memory), but "during the early days of COVID when there wasn't any ECC memory available at any sane prices. And then I never got around to fixing it, until I had to detect errors the hard way." "I absolutely *detest* the crazy industry politics and bad vendors that have made ECC memory so 'special'," he added.' -- source: https://linux.slashdot.org/story/22/10/15/2334251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel 6.0 Released for the AmigaOne X1000/X5000 PowerPC-Based AmigaOS Computers
by Peter Reutemann 17 Oct '22

17 Oct '22

'Hyperion Entertainment is pleased to announce the immediate availability of a very substantial and comprehensive update of the Software Development Kit (SDK) for AmigaOS 4.1 54.16. Also Linux: Kernel 6.0 for AmigaOne X1000/X5000 has been released and the biggest Amiga event of the year will be held upcoming weekend in Mönchengladbach, Germany: the Amiga37 event.' -- source: https://linux.slashdot.org/story/22/10/15/2124215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Office Rebranding
by Lawrence D'Oliveiro 14 Oct '22

14 Oct '22

I suppose you’ve heard by now that “Microsoft Office” is losing the “Office” part of the name, and becoming “Microsoft 365”. Accompanying this rebranding is a new set of logos <https://arstechnica.com/gadgets/2022/10/rip-to-microsoft-office-henceforth-…>. One thing I notice about them is the gradient shading, shadows and general faux-3D look. Does this mark an end to the “flat” design fad that seems to have become so popular over the last decade? Or does this only apply to the logo branding, not to onscreen icons, UI etc? (In which case, I wonder how their design gurus feel about such a disconnect between those different aspects of the same product.) Of course, I ask this as someone who never stopped being a fan of 3D style ...

1 0

Android Leaks Some Traffic Even When 'Always-On VPN' Is Enabled
by Peter Reutemann 13 Oct '22

13 Oct '22

'Mullvad VPN has discovered that Android leaks traffic every time the device connects to a WiFi network, even if the "Block connections without VPN," or "Always-on VPN," features is enabled. BleepingComputer reports: The data being leaked outside VPN tunnels includes source IP addresses, DNS lookups, HTTPS traffic, and likely also NTP traffic. This behavior is built into the Android operating system and is a design choice. However, Android users likely didn't know this until now due to the inaccurate description of the "VPN Lockdown" features in Android's documentation. Mullvad discovered the issue during a security audit that hasn't been published yet, issuing a warning yesterday to raise awareness on the matter and apply additional pressure on Google. Android offers a setting under "Network & Internet" to block network connections unless you're using a VPN. This feature is designed to prevent accidental leaks of the user's actual IP address if the VPN connection is interrupted or drops suddenly. Unfortunately, this feature is undercut by the need to accommodate special cases like identifying captive portals (like hotel WiFi) that must be checked before the user can log in or when using split-tunnel features. This is why Android is configured to leak some data upon connecting to a new WiFi network, regardless of whether you enabled the "Block connections without VPN" setting. Mullvad reported the issue to Google, requesting the addition of an option to disable connectivity checks. "This is a feature request for adding the option to disable connectivity checks while "Block connections without VPN" (from now on lockdown) is enabled for a VPN app," explains Mullvad in a feature request on Google's Issue Tracker. "This option should be added as the current VPN lockdown behavior is to leaks connectivity check traffic (see this issue for incorrect documentation) which is not expected and might impact user privacy." In response to Mullvad's request, a Google engineer said this is the intended functionality and that it would not be fixed for the following reasons: - Many VPNs actually rely on the results of these connectivity checks to function, - The checks are neither the only nor the riskiest exemptions from VPN connections, - The privacy impact is minimal, if not insignificant, because the leaked information is already available from the L2 connection. Mullvad countered these points and the case remains open.' -- source: https://tech.slashdot.org/story/22/10/12/2057246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Wi-Fi Spy Drones Snooped On Financial Services Firm
by Lawrence D'Oliveiro 13 Oct '22

13 Oct '22

Some security experts predicted this possibility years ago, and now we are seeing it for real <https://www.theregister.com/2022/10/12/drone-roof-attack/>: drones being used to attack network security. The company’s security team twigged to something odd going on when a user (or at least a device answering to their MAC address) seemed to be in two places at once: at home some distance away, and yet also at the premises, on a wi-fi network. Using a Fluke wi-fi meter, they traced the signal and found, not one, but two drones parked on the roof of the building. One had a “Wi-Fi Pineapple” penetration-testing device (which you can buy for USD120), while the other was carrying a range of kit, including a Raspberry Pi and a mini laptop. Seemed the attackers took advantage of a temporary lapse in security, due to some facilities reorganizations at the company, to trick a user into entering their credentials on a fake login page.

1 0