June 2022 - wlug - list.wlug.org.nz

Linus Torvalds Is Cautiously Optimistic About Bringing Rust Into Linux Kernel's Next Release
by Peter Reutemann 29 Jun '22

29 Jun '22

'ZDNet: For over three decades, Linux has been written in the C programming language. Indeed, Linux is C's most outstanding accomplishment. But the last few years have seen a growing momentum to make the Rust programming language Linux's second Linux language. At the recent Open Source Summit in Austin, Texas, Linux creator Linus Torvald said he could see Rust making it into the Linux kernel as soon as the next major release. "I'd like to see the Rust infrastructure merging to be started in the next release, but we'll see." Linux said after the summit. "I won't force it, and it's not like it's going to be doing anything really meaningful at that point -- it would basically be the starting point. So, no promises." Now, you may ask: "Why are they adding Rust at all?" Rust lends itself more easily to writing secure software. Samartha Chandrashekar, an AWS product manager, said it "helps ensure thread safety and prevent memory-related errors, such as buffer overflows that can lead to security vulnerabilities." Many other developers agree with Chandrashekar. Torvalds also agrees and likes that Rust is more memory-safe. "There are real technical reasons like memory safety and why Rust is good to get in the kernel." Mind you, no one is going to be rewriting the entire 30 or so million lines of the Linux kernel into Rust. As Linux developer Nelson Elhage said in his summary of the 2020 Linux Plumber's meeting on Rust in Linux: "They're not proposing a rewrite of the Linux kernel into Rust; they are focused only on moving toward a world where new code may be written in Rust." The three areas of potential concern for Rust support are making use of the existing APIs in the kernel, architecture support, and dealing with application binary interface (ABI) compatibility between Rust and C.' -- source: https://linux.slashdot.org/story/22/06/28/0448235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Releases Firefox 102
by Peter Reutemann 29 Jun '22

29 Jun '22

'Today, Mozilla released Firefox 102. New features include: * Tired of too many windows crowding your screen? You can now disable automatic opening of the download panel every time a new download starts. Read more. * Firefox now mitigates query parameter tracking when navigating sites in ETP strict mode. * Subtitles and captions for Picture-in-Picture (PiP) are now available at HBO Max, Funimation, Dailymotion, Tubi, Disney+ Hotstar, and SonyLIV. This allows you to view video in a small window pinned to a corner of the screen while navigating between apps or browsing content on the main screen. But do not get fooled, the most important feature is that this release is an ESR, this is super-important of a host of reasons: * Firefox ESR is the basis for KaiOS (an evolution of BootToGecko), an OS for Semi-Smart Phones very popular in India (100milion+), SE Asia + Africa (~60Milion), so, whatever made the cut in 102 will define the base capabilities for KaiOS for the next year. * Firefox ESR is the basis for Thunderbird, so, if you use Thunderbird or a derivative, whatever made the cut in 102 will underpin Thunderbird for the next year. * Many popular Linux distros (like Debian or Kali) use Firefox ESR as the default browser. * Many companies and organizations use Firefox ESR as their default browser, and many SW development companies certify Firefox ESR as an alowed browser for their SW. So, 102 is a very important release, becuase it brings a year of advances to ESR.' -- source: https://news.slashdot.org/story/22/06/28/198214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a Turkish Municipal District Switched to GNU/Linux
by Peter Reutemann 28 Jun '22

28 Jun '22

'Today I learned Turkey's Scientific and Technological Research Council has a subsidiary developing a GNU/Linux distro called Pardus, "redesigned to be used in accordance with the practices and habits of users in Turkey." And this week the Free Software Foundation published a post from the proud project leader of Pardus, explaining exactly why open source was chosen in the district of Eyüpsultan (on the European side of Istanbul) and how they got it implemented: After the municipal elections held in 2014, the new administration realized (through internal financial analysis reports) that a large amount of money was being spent on licensing proprietary software. Looking to cut costs, management asked for a study to be carried out for solutions. As the Eyüpsultan municipality's IT department, we recommended to replace Microsoft Windows with Pardus GNU/Linux instead. We described our preference to transition to free software as "the desire to be independent from a company as well as the savings to be gained from cutting hefty license fees." Additionally, we spoke about how the four freedoms would improve things outside of the budget. For example, we told the administration that users, when using free software, can fully benefit from the rights they have over the programs running on their computers. We also informed everyone that, when the software they run is proprietary, it means that a company claims rights over the user, and that such a claim of ownership can place restrictions on users in how they may or may not use the software. We told them that this is unacceptable. Arguments such as these were among the deciding factors that influenced our transition to free software. The plan was presented to the municipal administration and widely accepted. The municipal administration approved the project, and in January, 2015, the Eyüpsultan municipality started using free software applications such as LibreOffice (e.g. Writer, Calc, Impress, etc.). Prior to the implementations, basic user training on LibreOffice software was provided to the personnel of the institution. Over time, users were gradually and steadily directed to free systems, and, notably, without receiving backlash from users.... Training was an important item in the transition to Pardus GNU/Linux. Besides an online support forum, they've also set up a live call center to answer questions. "I think we may be the only distribution that helps with issues via a call center." So how do they feel now about that transition, eight years later? Free software has many advantages, including flexibility, high performance, major cost savings from licensing fees, independence from any particular company, and compliance with interoperability standards. Therefore, the transition of Eyüpsultan municipality to free software has resulted in benefits that were both strategic and practical. We believe, in the near future, more organizations will need to understand the philosophy of free software and the opportunities that free software provides. The municipal budget has freed up money as a result of the moving from proprietary software to free software. The savings from the "proprietary software licenses" line of the budget was applied to the district in the form of new projects. The money goes now to, among other things, increasing the number of new parks and gardens, bicycle paths, and security cameras in the parks. Additionally, by increasing the number of classes we provide technical training, we started to provide classes in robotics and computation to young people. The Eyüpsultan municipality is now increasing the opportunities for students to further develop their personalities, abilities, goals, and self-discovery. It introduces young people to technology and encourages them to produce new technologies. One final effect of using free software? It encourages others to do the same: As a result of this brave decision, many of the Istanbul district municipalities have started working to switch or have already made the switch to the Pardus GNU/Linux operating system. Institutions in other cities of the country have also expressed growing interest by asking questions about the Pardus operating system and free software.' -- source: https://news.slashdot.org/story/22/06/27/0154233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ventoy - new bootable USB solution
by Peter Reutemann 27 Jun '22

27 Jun '22

Hi everyone This tool just came up during our WLUG meeting: ventoy 'Ventoy is an open source tool to create bootable USB drive for ISO/WIM/IMG/VHD(x)/EFI files. With ventoy, you don't need to format the disk over and over, you just need to copy the image files to the USB drive and boot it. You can copy many image files at a time and ventoy will give you a boot menu to select them. You can also browse ISO/WIM/IMG/VHD(x)/EFI files in local disk and boot them. x86 Legacy BIOS, IA32 UEFI, x86_64 UEFI, ARM64 UEFI and MIPS64EL UEFI are supported in the same way. Both MBR and GPT partition style are supported in the same way. Most type of OS supported(Windows/WinPE/Linux/Unix/ChromeOS/Vmware/Xen...) 900+ ISO files are tested (List). 90%+ distros in distrowatch.com supported (Details).' https://github.com/ventoy/ https://www.ventoy.net/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Linux Foundation Podcast: 'Untold Stories of Open Source'
by Peter Reutemann 27 Jun '22

27 Jun '22

'The nonprofit Linux Foundation pays Linus Torvalds' salary and supports many other open source projects. But they also launched a new podcast series this week covering "The Untold Stories of Open Source." "Each week we explore the people who are supporting Open Source projects, how they became involved with it, and the problems they faced along the way," explains the podcast's GitHub page (where you can put in a pull request to suggest future episodes or track the project's progress.) The podcast is available on its official web page, as well as on Spotify, Apple, Google, or "wherever you listen to your podcasts," according to an announcement from the Linux Foundation. An introductory page says the podcast will be "used to inform the Linux and Open Source communities as to the current state in development of open source initiatives and Linux Foundation Projects. It is vendor neutral, with no interviews of commercial product vendors or sales teams." Here's the first four episodes: - Balancing Priorities at the Cloud Native Computing Foundation, with Priyanka Sharma, general manager - A Life in Open Source, with Brian Behlendorf, general manager at Open Source Security Foundation - A New Model for Technical Training, with Clyde Seepersad, senior vice president of the Linux Foundation's training/certification project - The Business Side of Open Source, with Patrick Debois, "godfather of DevOps"' -- source: https://news.slashdot.org/story/22/06/25/0041218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TIL: Bracketed-Paste Mode
by Lawrence D'Oliveiro 26 Jun '22

26 Jun '22

I’ve been noticing one or two little quirks of the KDE Konsole terminal emulator lately. One is, when I copy and paste multiple lines of commands at once, they don’t get executed one by one, in fact they don’t get executed at all: I still have to press Enter afterwards to execute them. Another is, if I forget to type CTRL-SHIFT-V to do the paste, but do CTRL-V instead (the standard Unix control character which means “enter next character literally”), the pasted text gets prefixed with “«esc»[200~” and followed by a “~” character. If it wasn’t for that CTRL-V, that escape-sequence prefix would be interpreted by the terminal emulator. (Actually it turns out that ending “~” is actually part of the sequence “«esc»[201~”, which was being misinterpreted in that case because it did not follow a proper “«esc»[200~” sequence.) It turns out both of these behaviours are by design. That special escape sequence activates “bracketed-paste” mode <https://cirw.in/blog/bracketed-paste>. This is a safety feature to guard against malicious commands: it means the paste on its own is never enough to execute anything. So the user always gets a chance to see what has been pasted, before explicitly executing it. This behaviour is probably commonplace among other terminal emulators, as well.

3 3

Linux Kernel Signature Verification Code Adds FIPS Compliance
by Peter Reutemann 26 Jun '22

26 Jun '22

'Phoronix reports a new change was merged into the soon-to-be-released Linux 5.19 on Tuesday, making the kernel's signature verification code compliant with the Federal Information Processing Standards known as FIPS: FIPS are public standards via the National Institute of Standards and Technology used by U.S. government agencies and contractors in the areas of computer security and interoperability... Known-answer self-tests are required for FIPS compliance at startup/reboot, but the Linux kernel's signature verification code has been lacking such tests. The signature checking code is used for module signing, Kexec, and other functionality. With Linux 5.19 there will now be some basic self-tests at start. The tests will make their debut in Linux 5.19-rc4.' -- source: https://linux.slashdot.org/story/22/06/25/0118254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Happy Birthday X
by Lawrence D'Oliveiro 23 Jun '22

23 Jun '22

X Windows† turns 38 years old this week <https://www.theregister.com/2022/06/22/the_x_window_system_just/>. It originated from a previous GUI system called “W” (for “Window”, I guess) which ran on the “V” microkernel-based research OS. Nobody seems able to find any source code for these earlier projects. The first version of X (X1?) only ran on the DEC VAXstation 100. By about the version called X10, it was getting more portable to other workstation hardware. And of course X11 remains (with various revisions) with us to this day. However, it’s clear much of the development momentum has left the project, and gone to candidates for an all-new redesigned-from-the-ground-up successor, like Wayland. †Or the “X Window System”, if you prefer

1 0

The World Is Not Ready For Such Power ...
by Lawrence D'Oliveiro 23 Jun '22

23 Jun '22

... says Microsoft. Recognizing the potential <https://www.theregister.com/2022/06/21/microsoft_api_ai_algorithms/> for misuse of technologies that can glean information from publicly-available images, audio etc that the subjects of those online media might not expect (including the ability to forge their likenesses), the company has pledged to come up with restrictions on how developers outside the company can use these technologies. As for developers _inside_ the company? (...crickets...)

1 0

Most Top Websites Are Not Following Best Practices In Their Password Policies
by Lawrence D'Oliveiro 23 Jun '22

23 Jun '22

Report on a survey <https://freedom-to-tinker.com/2022/06/22/most-top-websites-are-not-followin…> on the sorts of password policies in force on various popular websites. Too many of them still have unnecessary restrictions like the characters you are allowed to use, or even imposing a maximum permitted length. There is a linked blog post from one of the developers at Discourse, which argues that rules of any kind should be avoided. Or nearly any kind: there is a case for a minimum-length requirement (but be careful how you count it -- are you just going by Unicode “code points”? Or worse still, are you requiring passwords to be ASCII-only?), and checks against leaked password lists, plus some kind of entropy test to rule out trivial things like “aaaaaaaaaa”. Beyond that, let the user enter what they like. Showing the user a password-strength meter next to their entry as they choose a password is considered part of best practice nowadays. But in their article, they show that Facebook’s password-strength meter, for example, seems to prefer certain weak passwords (with a wider character set) over more random, stronger ones (from a smaller character set). Maybe there are circumstances out of the hands of the sysadmins, and the blame lies elsewhere: the article closes with One idea for future research: directly engage with system administrators, in order to understand their mindset on password security. Perhaps password policy is meant to be security theater--giving users a sense of safety without actually improving security. Or maybe websites have shifted their attention to adopting other authentication technologies, like SMS-based multi-factor authentication (which also suffers from severe weaknesses, as we discovered in previous research on SIM swaps and number recycling). Perhaps websites have to deal with security audits from firms like Deloitte recommending outdated practices. Or maybe websites face other practical constraints that the information security community doesn’t know about.

1 0