November 2022 - wlug - list.wlug.org.nz

The Linux Kernel Has Been Forcing Different Behavior For Processes Starting With 'X'
by Peter Reutemann 09 Nov '22

09 Nov '22

'"An ugly hack within the Linux kernel that has been in mainline for over three years has been called out," writes Phoronix's Michael Larabel. "Due to a buggy X.Org Server / xf86-video-modesetting DDX, the Linux kernel has been imposing different behavior on whether a process starts with 'X' and in turn disable the atomic mode-setting support." Linux security researcher and WireGuard creator, Jason Donenfeld, discovered the 'ugly code' within the kernel and commented on it via the kernel mailing list. "The commit to this kernel with the 'X' first character check was made back in September 2019," notes Larabel. "The 'good' news is that since then on user-space side back in 2019 the xf86-video-modesetting code went ahead and disabled atomic support by default. So technically if running an updated X.Org stack within the past three years, this kernel hack isn't necessary anymore since user-space is just then avoiding the atomic API."' -- source: https://linux.slashdot.org/story/22/11/08/2211244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE: Stopping The Windows/Super Key From Popping Up The App Menu
by Lawrence D'Oliveiro 07 Nov '22

07 Nov '22

I thought I had this disabled before, but KDE Plasma has this feature where you just need to press and release the Super key (or “Windows” key, if your keyboard has the proprietary logo on it), and the application menu will appear. It seems there is no GUI setting to disable this, but you can turn it off according to this <https://superuser.com/questions/1156130/kde-disable-super-l-windows-key-key…>. First, make the described edit to your KWin config file, in ~/.config/kwinrc, which you can do conveniently with kwriteconfig5 --file kwinrc --group ModifierOnlyShortcuts --key Meta "" Then either log out your GUI session and log in again, or try just restarting your window manager with kwin_x11 --replace & in some convenient terminal window. The writeup above doesn’t mention putting the “&” on the end, so KWin remains attached to that terminal session, which means you can’t use it for anything else ...

1 0

Outlawing Dark Patterns
by Lawrence D'Oliveiro 05 Nov '22

05 Nov '22

“Dark patterns” is a term coined to describe user interfaces designed to manipulate people into giving up time, money or personal data that they didn’t intend to. A common example is the obstacle course you often have to go through to cancel a subscription to something online. Another example is the use of countdown timers to rush buyers into hasty decisions. They may not be out-and-out deceptive, but they do come close. Now, the US states of California and Washington are looking to pass laws to restrict this practice. <https://arstechnica.com/tech-policy/2021/01/lawmakers-take-aim-at-insidious…>

2 2

New Hampshire Set To Pilot Voting Machines That Use Open-Source Software
by Peter Reutemann 04 Nov '22

04 Nov '22

'According to The Record, New Hampshire will pilot a new kind of voting machine that will use open-source software to tally the votes. The Record reports: The software that runs voting machines is typically distributed in a kind of black box -- like a car with its hood sealed shut. Because the election industry in the U.S. is dominated by three companies -- Dominion, Election Systems & Software and Hart InterCivic -- the software that runs their machines is private. The companies consider it their intellectual property and that has given rise to a roster of unfounded conspiracy theories about elections and their fairness. New Hampshire's experiment with open-source software is meant to address exactly that. The software by its very design allows you to pop the hood, modify the code, make suggestions for how to make it better, and work with other people to make it run more smoothly. The thinking is, if voting machines run on software anyone can audit and run, it is less likely to give rise to allegations of vote rigging. The effort to make voting machines more transparent is the work of a group called VotingWorks. [...] On November 8, VotingWorks machines will be used in a real election in real time. New Hampshire is the second state to use the open-source machines after Mississippi first did so in 2019. Some 3,000 voters will run their paper ballots through the new machines, and then, to ensure nothing went awry, those same votes will be hand counted in a public session in Concord, N.H. Anyone who cares to will be able to see if the new machines recorded the votes correctly. The idea is to make clear there is nothing to hide. If someone is worried that a voting machine is programmed to flip a vote to their opponent, they can simply hire a computer expert to examine it and see, in real time. ' -- source: https://politics.slashdot.org/story/22/11/03/2155238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

iproute2 Docs
by Lawrence D'Oliveiro 04 Nov '22

04 Nov '22

The “ip” command, aka the “iproute2” suite, offers a huge amount of functionality for managing the Linux network stack. The initial man page, “man ip”, gives an overview, and (at least on my current system) ends with references to more: SEE ALSO ip-address(8), ip-addrlabel(8), ip-ioam(8), ip-l2tp(8), ip-link(8), ip-maddress(8), ip-monitor(8), ip-mptcp(8), ip-mroute(8), ip-neighbour(8), ip-netns(8), ip-ntable(8), ip-route(8), ip-rule(8), ip-stats(8) ip-tcp_metrics(8), ip-token(8), ip-tunnel(8), ip-vrf(8), ip-xfrm(8) IP Command reference ip-cref.ps That “ip-cref.ps” file doesn’t seem to be included in any Debian packages I can see. However, when I look in the /usr/share/man/man8 directory, I find a few more man pages not mentioned in the above list: ip-nexthop.8.gz ip-fou.8.gz ip-macsec.8.gz ip-gue.8.gz (symlink to ip-fou.8.gz) ip-netconf.8.gz ip-sr.8.gz That “ip fou”/“ip gue” command lets you tunnel arbitrary IP protocols over a pair of UDP ports. The home page for online docs is at <https://wiki.linuxfoundation.org/networking/iproute2>. Among the links is this nice step-by-step intro to doing some useful things with it <https://lartc.org/howto/lartc.iproute2.html>.

1 0

The Godot Game Engine Now Has Its Own Foundation
by Peter Reutemann 04 Nov '22

04 Nov '22

'The Godot Engine now has its own foundation to continue funding themselves. Previously, they teamed up with the Software Freedom Conservancy to handle fiscal sponsorship duties. Phoronix reports: The Godot engine developers and Software Freedom Conservancy mutually agreed to move the open-source game engine project to its own foundation. The Godot Foundation has been setup in the Netherlands as its own organization modeled after the policies of the SFC. The Godot Foundation is to help this game engine achieve its next level of growth and project a stronger image for the project. "We have just started the process of moving to the Foundation," writes Godot Engine lead developer, Juan Linietsky, in a blog post. "For now all of Godot's funding and contractors are still managed by the SFC. The SFC will gradually reduce its work for Godot and the new foundation will slowly ramp up. Stay tuned for announcements in the future as we finalize the Foundation's organizational structure and officially begin operations." More details can be found via the Godot Engine blog.' -- source: https://news.slashdot.org/story/22/11/02/2045240 Anyone keen to showcase this engine at one of our meetings? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Ad For GIMP.org Served Info-Stealing Malware Via Lookalike
by Peter Reutemann 03 Nov '22

03 Nov '22

'A report from BleepingComputer, written by Ax Sharma: Searching for 'GIMP' on Google as recently as last week would show visitors an ad for 'GIMP.org,' the official website of the well known graphics editor, GNU Image Manipulation Program. This ad would appear to be legitimate as it'd state 'GIMP.org' as the destination domain. But clicking on it drove visitors to a lookalike phishing website that provided them with a 700 MB executable disguised as GIMP which, in reality, was malware. Reddit user ZachIngram04 earlier shared the development stating that the ad previously took users to a Dropbox URL to serve malware, but was soon "replaced with an even more malicious one" which employed a fake replica website 'gilimp.org' to serve malware. BleepingCompuer observed another domain 'gimp.monster' related to this campaign. To pass off the trojanized executable as GIMP in a believable manner to the user, the threat actor artificially inflated the malware, that is otherwise under 5 MB in size, to 700 MB by a simple technique known as binary padding. It still isn't clear if this instance was a slip up caused by a potential bug in Google Ad Manager that allowed malvertising.' -- source: https://tech.slashdot.org/story/22/11/02/1944255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mastodon Gained 70,000 Users After Musk's Twitter Takeover
by Peter Reutemann 03 Nov '22

03 Nov '22

'"More than 70,000 users joined Mastodon on the day after Musk's Twitter takeover announcement," writes Slashdot reader votsalo. "Mastodon is a six-year-old decentralized social media platform that uses 'federated' servers." The Guardian's Wilfred Chan writes: I joined Mastodon this week, and it took a few hours just to master its new vocabulary. Some of it is a little silly-sounding: instead of tweets, you have "toots". Things get trickier after that. Mastodon is not a single website but a network of thousands of websites called "instances", also called servers. These servers are "federated", which means they are run by different entities but can still communicate with each other without needing to go through a central system. And the space they all exist in is called the "fediverse," which some savvy tooters call "the Fedi." When you sign up for Mastodon, the first thing you do is choose a server. There are general-purpose ones, such as mastodon.social, as well as ones aimed at interest groups, such as kpop.social or linuxrocks.online. There are also joke servers like dolphin.town, where the only thing users are allowed to post is the letter "e". The server becomes part of your username (for example, wilfred(a)kpop.social), and the toots you see on your feed are toots from your server-mates, rather than from the entire fediverse. But you're also free to toot at people from other servers and even "boost" their public toots on to your feed. That's how Mastodon creates a unified global experience without being controlled by one entity, said Eugen Rochko, Mastodon's Germany-based founder and lead developer. "The servers are service providers, like Hotmail and Gmail are for email. It doesn't mean that the different servers are isolated from each other, like old school forums," he said. "Having just one account allows you to follow and interact with anyone in this global decentralized social network." But Mastodon's model comes with its own risks. If the server you join disappears, you could lose everything, just like if your email provider shut down. A Mastodon server admin also has ultimate control over everything you do: if for some reason the owner of kpop.social doesn't like that I boosted a toot from dolphin.town, they could remove it or even "defederate" the server, which would block all dolphin toots from the k-pop server completely. A server admin could also snoop on my private toots if they wanted to -- or delete my account for any reason. While Mastadon's 70,000 jump in users sounds impressive, it's "still a drop in a bucket compared with Twitter's reported 450 million daily active users," says Chan. The decentralized software also remains difficult for many people to use. According to TechCrunch, Mastadon says it has "gained 123,562 new users as of October 27, 2022 and now has 528,607 active users on the network as of October 31, 2022."' -- source: https://tech.slashdot.org/story/22/11/02/1958241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backblaze: Buying Cheaper, Less Reliable Drives Can Be Worth It
by Lawrence D'Oliveiro 02 Nov '22

02 Nov '22

Backup company Backblaze has put out another juicy status report on the reliability of its massive collection of hard drives <https://blocksandfiles.com/2022/11/01/backblaze-disk-drives/>. This one has some interesting numbers on the cost of dealing with drive failures -- it seems the hardware cost of these to the company is zero, as the failed drives get sent back to the vendors for full credit or replacement. (I guess if you buy a few thousand units at a time, you get special deals like this.) Since the company is in the business of providing sufficient redundancy that the impact of a drive failure on data integrity is essentially zero, the main cost of a failure becomes the labour cost of putting in a new drive, which comes to $300. Looked at this way, looking at the table which compares three models of drive, with unit costs ranging from $225 up to $275, and corresponding annualized failure rates of 1.5% down to 0.5%, it turns out the cheaper, flakier drive is the better deal -- amortized over a five-year service lifetime, the increased labour cost of replacing failed drives is easily outweighed by the savings in buying the drives in the first place.

1 0

OpenSSL 3 patch, once Heartbleed-level “critical,” arrives as a lesser “high”
by Peter Reutemann 02 Nov '22

02 Nov '22

'An OpenSSL vulnerability once signaled as the first critical-level patch since the Internet-reshaping Heartbleed bug has just been patched. It ultimately arrived as a "high" security fix for a buffer overflow, one that affects all OpenSSL 3.x installations, but is unlikely to lead to remote code execution. OpenSSL version 3.0.7 was announced last week as a critical security fix release. The specific vulnerabilities (now CVE-2022-37786 and CVE-2022-3602) had been largely unknown until today, but analysts and businesses in the web security field hinted there could be notable problems and maintenance pain. Some Linux distributions, including Fedora, held up releases until the patch was available. Distribution giant Akamai noted before the patch that half of their monitored networks had at least one machine with a vulnerable OpenSSL 3.x instance, and among those networks, between 0.2 and 33 percent of machines were vulnerable. But the specific vulnerabilities—limited-circumstance, client-side overflows that are mitigated by the stack layout on most modern platforms—are now patched, and rated as "High." And with OpenSSL 1.1.1 still in its long-term support phase, OpenSSL 3.x is not nearly as widespread.' -- source: https://arstechnica.com/information-technology/2022/11/openssl-3-patch-once… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0