November 2023 - wlug - list.wlug.org.nz

In a First, Cryptographic Keys Protecting SSH Connections Stolen in New Attack
by Peter Reutemann 15 Nov '23

15 Nov '23

'For the first time, researchers have demonstrated that a large portion of cryptographic keys used to protect data in computer-to-server SSH traffic are vulnerable to complete compromise when naturally occurring computational errors occur while the connection is being established. ArsTechnica: Underscoring the importance of their discovery, the researchers used their findings to calculate the private portion of almost 200 unique SSH keys they observed in public Internet scans taken over the past seven years. The researchers suspect keys used in IPsec connections could suffer the same fate. SSH is the cryptographic protocol used in secure shell connections that allows computers to remotely access servers, usually in security-sensitive enterprise environments. IPsec is a protocol used by virtual private networks that route traffic through an encrypted tunnel. The vulnerability occurs when there are errors during the signature generation that takes place when a client and server are establishing a connection. It affects only keys using the RSA cryptographic algorithm, which the researchers found in roughly a third of the SSH signatures they examined. That translates to roughly 1 billion signatures out of the 3.2 billion signatures examined. Of the roughly 1 billion RSA signatures, about one in a million exposed the private key of the host. While the percentage is infinitesimally small, the finding is nonetheless surprising for several reasons -- most notably because most SSH software in use has deployed a countermeasure for decades that checks for signature faults before sending a signature over the Internet. Another reason for the surprise is that until now, researchers believed that signature faults exposed only RSA keys used in the TLS -- or Transport Layer Security -- protocol encrypting Web and email connections. They believed SSH traffic was immune from such attacks because passive attackers -- meaning adversaries simply observing traffic as it goes by -- couldn't see some of the necessary information when the errors happened.' -- source: https://it.slashdot.org/story/23/11/13/1446217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Asahi: Not Just A Distro
by Lawrence D'Oliveiro 14 Nov '23

14 Nov '23

The Ubuntu Summit that recently took place had discussions about running Ubuntu on ARM and RISC-V processors <https://www.theregister.com/2023/11/13/ubuntu_for_arm64_laptops/>. One interesting thing in that article is that the Asahi project, which was getting Linux running on Apple’s ARM-based machines, is no longer confined to Arch Linux. It is now also working with Ubuntu, with the help of a developer from, of all things, the OpenBSD project. And there are other alternatives, including Fedora and Debian. Also interesting to read how Apple makes the little speakers in its laptops sound better than they should, by carefully driving them beyond what would normally be considered their “safe” power limits, based on the frequency characteristics of the signal at any moment. This technique has been recreated in an open-source program called “speakersafetyd”.

1 0

I Wonder If This Is A WordPress Thing ...
by Lawrence D'Oliveiro 14 Nov '23

14 Nov '23

You may not notice it, but a remarkable number of sites are built on WordPress. Seems the ability to customize the layout of such sites is limitless. But I think one of the clues that WordPress lies underneath is sometimes you see image URLs that look like MHMA5269-copy-1698399489.jpg?resize=770,513&quality=80 I think this is characteristic of some image-manipulation plugin that resizes the image for embedding in the page. In this case, I tried the part from the “?” onwards, and ended up with a much larger and higher-quality image file.

1 0

Why Chrome Enabled WebAssembly Garbage Collection (WasmGC) By Default
by Peter Reutemann 13 Nov '23

13 Nov '23

'In Chrome, JavaScript (and WebAssembly) code are both executed by Google's open source V8 engine — which already has garbage-collecting capabilities. "This means developers making use of, for example, PHP compiled to Wasm, end up shipping a garbage collector implementation of the ported language (PHP) to the browser that already has a garbage collector," writes Google developer advocate Thomas Steiner, "which is as wasteful as it sounds." "This is where WasmGC comes in." WebAssembly Garbage Collection (or WasmGC) is a proposal of the WebAssembly Community Group [which] adds struct and array heap types, which means support for non-linear memory allocation... In simplified terms, this means that with WasmGC, porting a programming language to WebAssembly means the programming language's garbage collector no longer needs to be part of the port, but instead the existing garbage collector can be used. Sometime on Halloween, Steiner wrote that in Chrome, WebAssembly garbage collection is now enabled by default. But then he explored what this means for high-level programming languages (with their own built-in garbage collection) being compiled into WebAssembly: To verify the real-world impact of this improvement, Chrome's Wasm team has compiled versions of the Fannkuch benchmark (which allocates data structures as it works) from C, Rust, and Java. The C and Rust binaries could be anywhere from 6.1 K to 9.6 K depending on the various compiler flags, while the Java version is much smaller at only 2.3 K! C and Rust do not include a garbage collector, but they do still bundle malloc/free to manage memory, and the reason Java is smaller here is because it doesn't need to bundle any memory management code at all. This is just one specific example, but it shows that WasmGC binaries have the potential of being very small, and this is even before any significant work on optimizing for size. The blog post includes two examples of WasmGC-ported programming languages in action: - "One of the first programming languages that has been ported to Wasm thanks to WasmGC is Kotlin in the form of Kotlin/Wasm." - "The Dart and Flutter teams at Google are also preparing support for WasmGC. The Dart-to-Wasm compilation work is almost complete, and the team is working on tooling support for delivering Flutter web applications compiled to WebAssembly."' -- source: https://developers.slashdot.org/story/23/11/12/0456220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

Remote desktop without using x protocols
by David Nicholls 10 Nov '23

10 Nov '23

I have noticed a number of distros are starting to drop support for x11. This becomes annoying if you are wanting to remote into a Linux box (itth a GUI) RDP style prior to logging in as all the documented solutions that don't require a cloud, docker or server seem to need xrdp, xvnc or similar x based solution installed. Can anyone point me to a cross platform project that does not require x11? -- Cheers... David Nicholls

2 2

Canonical Reveals More Details About Ubuntu Core Desktop
by Peter Reutemann 09 Nov '23

09 Nov '23

'Next April a new LTS Ubuntu arrives, and alongside it will be a whole new immutable desktop edition. At this year's Ubuntu conference in Riga, Latvia, Canonical revealed more details about its forthcoming immutable desktop distro. From a report: Core Desktop is not the next version of Ubuntu itself. Ordinary desktop and server Ubuntu aren't going anywhere, and the next release, numbered 24.04 and codenamed Noble Numbat as we mentioned last month, will be the default and come with all the usual editions and flavors. Nor is this a whole new product: it is a graphical desktop edition of the existing Ubuntu Core distro, as we examined on its release in June last year, a couple of months after 22.04. Ubuntu Core is Canonical's Internet of Things (IoT) distro, intended to be embedded on edge devices, such as digital signs and smart displays. It is an immutable distro, meaning that the root filesystem is read-only and there's no conventional package manager. Rather than being a basis for customization, like a conventional Linux, the idea is that immutable distros are rolled out and updated more like a phone or tablet OS: there's a single fixed and heavily tested OS image, and it's deployed onto the devices out in the field without modification. Updates are monolithic: a whole fresh image is pushed out, and all the OS components are upgraded in a single operation to the same combination. That isn't unique. Most of the major Linux vendors have immutable offerings, and The Reg has looked at several over the years, including MicroOS, the basis of SUSE's next-gen enterprise OS ALP. As well as the well-known ChromeOS, another immutable desktop is the educational distro Endless OS. [...] Canonical believes it has some unique new angles. Core Desktop is constructed as additional layers on top of the existing Ubuntu Core distro, and like Core, it's entirely built with a single packaging system: Ubuntu's Snap. While Snap remains controversial, it does have some compelling advantages over both SUSE and Red Hat's tooling. SUSE's transactional_update tool, while simpler than its rivals in implementation, requires a snapshot-capable filesystem, meaning that its immutable distros must use Btrfs. While it has many admirers, the number and the contents of the orange and red cells in the feature tables here in its own documentation reflect the FOSS desk's serious reservations about Btrfs.' -- source: https://news.slashdot.org/story/23/11/08/1957249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Abandons Mercurial
by Lawrence D'Oliveiro 08 Nov '23

08 Nov '23

Up to now, Mozilla has been supporting the use of both Git and Mercurial DVCSes by its contributors <https://devclass.com/2023/11/07/mozilla-will-move-firefox-development-from-…>. But no more: it is giving up on Mercurial, and making things exclusively Git-based. Furthermore, it is moving to use GitHub for hosting its repos. I can remember the discussion over which distributed VCS they should switch to about a decade ago, back when I was new to Git myself. Even then, the momentum was clearly on the side of Git. However, the Mozilla crew wanted something that would work well on Windows, not just on Linux, and back then the process-heavy execution model of Git gave poor performance on Windows. Hence they went for Mercurial. Presumably that objection no longer applies; suitable compromises have been made in the architecture of Git to cater for the platform that thinks 26 drive letters ought to be enough for anybody. (I can’t remember what Mozilla were using before that; probably Subversion.) Using GitHub, on the other hand, seems in some ways like a step backwards for distributed development. Linus Torvalds famously pilloried their lame pull-request system <https://github.com/torvalds/linux/pull/17#issuecomment-5654674>, which just happens to be the one feature of your GitHub repos that you cannot turn off.

2 2

Android 14’s storage disaster gets patched, but your data might be gone
by Peter Reutemann 08 Nov '23

08 Nov '23

'It's the start of November, and that means a new Android security patch. Google claims this one is fixing a high-profile Android 14 storage bug that was locking some people out of their devices. The November Security Bulletin contains the usual pile of security fixes, while consumer-oriented Pixel patch notes list a few user-facing changes. The important line is "Fix for issue occasionally causing devices with multiple users enabled to show out of space or be in a reboot loop." A footnote points out that this is for the "Pixel 6, Pixel 6a, 6 Pro, 7, 7 Pro, 7a, Tablet, Fold, Pixel 8, Pixel 8 Pro." We're on about day 33 of the Android 14 storage bug. For devices with multiple users set up, there is some kind of storage issue that is locking users out of their device. Some are completely unusable, with the phone bootlooping constantly and never reaching the home screen. Others are able to boot up the device but don't have access to lock storage, which causes a huge amount of issues. Some users likened the bug to "ransomware," a type of malware that encrypts your local storage and then demands money for your data. One fix is to completely erase your device with a factory reset, but a lot of users don't want to do that. The earliest reports of this started just days after the October 4 launch date. Google usually rolls updates out slowly so it can pull them if issues like this pop up to minimize damage. That didn't happen here, though. Google failed to respond quickly to initial reports and just let the bug roll out to everyone. Some people even report being freshly hit with the bug just four days ago because Google 1) let the update roll out without stopping it and 2) can't patch its software quickly enough. The biggest issue tracker thread on this bug is up to 1,000-plus likes and 850 comments of people locked out of their devices, and it took two separate rounds of news coverage for Google to acknowledge the bug after about 20 days. Google promised a rescue patch, which is now arriving, though the company said only "some" data would be recoverable and that "this update may not enable data to be recovered for devices that are repeatedly rebooting." That seems to line up with what people are experiencing now that the OTA is out. People who can boot up report fixed devices, while bootloopers aren't getting anywhere. Some users are still in the support thread hoping for some kind of data recovery for bootlooping devices, but it doesn't seem like that is going to happen.' -- source: https://arstechnica.com/gadgets/2023/11/android-14-patches-ransomware-stora… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When Linux Spooked Microsoft: Remembering 1998's Leaked 'Halloween Documents'
by Peter Reutemann 06 Nov '23

06 Nov '23

't happened a quarter of a century ago. The New York Times wrote that "An internal memorandum reflecting the views of some of Microsoft's top executives and software development managers reveals deep concern about the threat of free software and proposes a number of strategies for competing against free programs that have recently been gaining in popularity." The memo warns that the quality of free software can meet or exceed that of commercial programs and describes it as a potentially serious threat to Microsoft. The document was sent anonymously last week to Eric Raymond, a key figure in a loosely knit group of software developers who collaboratively create and distribute free programs ranging from operating systems to Web browsers. Microsoft executives acknowledged that the document was authentic... In addition to acknowledging that free programs can compete with commercial software in terms of quality, the memorandum calls the free software movement a "long-term credible" threat and warns that employing a traditional Microsoft marketing strategy known as "FUD," an acronym for "fear, uncertainty and doubt," will not succeed against the developers of free software. The memorandum also voices concern that Linux is rapidly becoming the dominant version of Unix for computers powered by Intel microprocessors. The competitive issues, the note warns, go beyond the fact that the software is free. It is also part of the open-source software, or O.S.S., movement, which encourages widespread, rapid development efforts by making the source code — that is, the original lines of code written by programmers — readily available to anyone. This enables programmers the world over to continually write or suggest improvements or to warn of bugs that need to be fixed. The memorandum notes that open software presents a threat because of its ability to mobilize thousands of programmers. "The ability of the O.S.S. process to collect and harness the collective I.Q. of thousands of individuals across the Internet is simply amazing," the memo states. "More importantly, O.S.S. evangelization scales with the size of the Internet much faster than our own evangelization efforts appear to scale." Back in 1998, Slashdot's CmdrTaco covered the whole brouhaha — including this CNN article: A second internal Microsoft memo on the threat Linux poses to Windows NT calls the operating system "a best-of-breed Unix" and wonders aloud if the open-source operating system's momentum could be slowed in the courts. As with the first "Halloween Document," the memo — written by product manager Vinod Valloppillil and another Microsoft employee, Josh Cohen — was obtained by Linux developer Eric Raymond and posted on the Internet. In it, Cohen and Valloppillil, who also authored the first "Halloween Document," appear to suggest that Microsoft could slow the open-source development of Linux with legal battles. "The effect of patents and copyright in combating Linux remains to be investigated," the duo wrote. Microsoft's slogain in 1998 was "Where do you want to go today?" So Eric Raymond published the documents on his web site under the headline "Where will Microsoft try to drag you today? Do you really want to go there?" 25 years later, and it's all still up there and preserved for posterity on Raymond's web page — a collection of leaked Microsoft documents and related materials known collectively as "the Halloween documents." And Raymond made a point of thanking the writers of the documents, "for authoring such remarkable and effective testimonials to the excellence of Linux and open-source software in general."' -- source: https://linux.slashdot.org/story/23/11/05/046247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Update/upgrade
by john 03 Nov '23

03 Nov '23

For some time I have been receiving a message regarding missing firmware. I do have an onboard AMD GPU do I need to go hunting or am I suffering from fomo? W: Possible missing firmware /lib/firmware/amdgpu/ip_discovery.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/vega10_cap.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/sienna_cichlid_cap.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/navi12_cap.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/psp_13_0_10_ta.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/psp_13_0_10_sos.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/aldebaran_cap.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/aldebaran_sjt_mec2.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/aldebaran_sjt_mec.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_imu.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_rlc.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_mec.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_me.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_pfp.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_0_toc.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/sdma_6_0_3.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/sienna_cichlid_mes1.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/sienna_cichlid_mes.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/navi10_mes.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_mes1.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_mes_2.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_mes.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/smu_13_0_10.bin for module amdgpu Cheers John..

2 2