February 2023 - wlug - list.wlug.org.nz

List Of IPTV Resources
by Lawrence D'Oliveiro 22 Sep '24

22 Sep '24

This user <https://github.com/iptv-org> just popped up in my GitHub feed. One repo <https://github.com/iptv-org/iptv> claims to be a list of links to over 8000 streaming TV channels from nations all over the world, while the other is a list of tools*, providers and other resources. Do be aware it’s a bit of a mixed bag: yes, there are legitimate channels (no encryption so far that I have noticed), but also some dubious-looking links. *Oddly, FFmpeg and youtube-dl aren’t in the list.

2 5

Enabling Case-Insensitive Filenames On Linux
by Lawrence D'Oliveiro 06 Feb '24

06 Feb '24

The ext4 filesystem has had the “casefold” option for a while now <https://lwn.net/Articles/784041/>. This allows you to specify, when you initialize a new filesystem, that you want file/directory names to be treated as case-insensitive. At the same time, you have to specify that the filenames are to be interpreted as UTF-8 encoding; normally the kernel doesn’t care, it only singles out ASCII slash and NUL bytes for special interpretation, and simply passes through any other byte values in the names. I was able to create such a filesystem, but I wasn’t able to mount it in my last-upgraded-just-a-few-days-ago Debian Unstable setup. When I try, it fails, and in the dmesg log I see Filesystem with casefold feature cannot be mounted without CONFIG_UNICODE Turns out the Debian 5.10 kernel has not been built with this CONFIG_UNICODE option enabled. However, this situation looks set to change shortly, according to <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985689>.

2 3

Weta Digital’s Technology Division Sold To US Firm
by Lawrence D'Oliveiro 30 Nov '23

30 Nov '23

Let me see if I understand this article <https://www.nzherald.co.nz/business/sir-peter-jackson-to-sell-weta-digital-…> correctly: the part of Weta Digital that used to develop the in-house 3D graphics/effects tools that they use in all those movies is being sold to US-based Unity Software. The part that is left will be called “WetaFX”, and will become a customer of Unity for the use of those tools, no longer doing its own development in-house. By the way, I’ve been looking at the Unity site <https://unity.com/>, and it looks like all their products are rentware (subscription-based).

1 1

Microsoft’s File-Tainting System ’Tain’t Working
by Lawrence D'Oliveiro 15 Mar '23

15 Mar '23

Microsoft has a clever-sounding system for trying to protect Windows users from downloading malicious files: it’s called “Mark-Of-The-Web”. What it means is that any file downloaded from an untrusted source is supposed to have a special flag set in its NTFS metadata indicating that the file is not to be trusted. So any attempt by the user to perform sensitive operations on that file (e.g. execute macros from it, run it as an executable) is supposed to trigger appropriate system warnings. If the file is a .zip archive, then this mark is supposed to be propagated to all files extracted from that archive. However, it turns out this mechanism can be bypassed (surprise, surprise) <https://www.theregister.com/2022/11/01/microsoft_motw_malware_flaw/>. How can this happen? The flaw lies in the mechanism used to tell Windows to trust downloaded files, by attaching an “Authenticode” signature to them. Files without such signatures are of course untrusted and will trigger the appropriate warnings. However, by attaching an invalid signature of a particular form, you can trigger an error response from the signature-checking process that is actually interpreted as “this file is OK” <https://blog.0patch.com/2022/10/free-micropatches-for-bypassing-motw.html>. What do you call it when an attempt to add mechanisms to make a system more secure actually increases the attack surface on that system? By the way, the referenced Twitter thread discussing this vulnerability <https://twitter.com/GossiTheDog/status/1579895038523609088> seems to be saying that no Mark-Of-The-Web propagation is done for files extracted from .iso disc images. And that Microsoft uses this form for distributing its own software (Visio was mentioned) precisely to avoid the hassle of going through vetting by third-party antimalware tools.

1 1

Quote Of The Week
by Lawrence D'Oliveiro 28 Feb '23

28 Feb '23

>From a reader comment to an article <https://www.theregister.com/2023/02/27/microsoft_ai_gpt3_data/> wherein Microsoft suggests that, since these machine-learning models are so good at generating fake and even nonsensical responses, why not use them to deliberately generate fictional sample data for testing purposes: For decades, we've written hundreds of sci-fi stories where you have an evil out-of-control AI, and that AI is hyperintelligent but can only reason along strict logical lines, and is ultimately defeated by exploiting its lack of imagination. And then, suddenly, it turns out that the AIs we can actually make have way too much imagination, and are utterly incapable of logical thought. I find this hilarious.

1 0

Who Writes Linux and Open Source Software?
by Peter Reutemann 28 Feb '23

28 Feb '23

'From an opinion piece in the Register: Aiven, an open source cloud data platform company, recently analyzed who's doing what with GitHub open source code projects. They found that the top open source contributors were all companies — Amazon Web Services, Intel, Red Hat, Google, and Microsoft.... Aiven looked at three metrics within the GitHub archives. These were the number of contributors, repositories (projects) contributed to, and the number of commits made by the contributors. These were calculated using Google Big Query analysis of PushEvents on public GitHub data. The company found that Microsoft and Google were neck-and-neck for the top spot. Red Hat is in third place, followed by Intel, then AWS, just ahead of IBM.... Red Hat is following closely behind and is currently contributing more commits than Google, with 125,012 in Q4 2022 compared to Google's 94,961. Microsoft is ahead of both, with 128,247 commits. However, regarding contributed staff working on projects, Google is leading the way with 5,757 compared to Microsoft's 5,513 and Red Hat's 3,656.... Heikki Nousiainen, Aiven CTO and co-founder, commented: "An unexpected result of our research was seeing Amazon overtake IBM to become the fifth biggest contributor." They "came late to the open source party, but they're now doubling down on its open source commitments and realizing the benefits that come with contributing to the open source projects its customers use." So, yes, open source certainly started with individual contributors, but today, and for many years before, it's company employees that are really making the code.... Aiven is far from the only one to have noticed that companies are now open source's economic engine. Jonathan Corbet, editor-in-chief of Linux Weekly News (LWN), found in his most recent analysis of Long Term Support Linux Kernel releases from 5.16 to 6.1 that a mere 7.5 percent of the kernel development, as measured by lines changed, came from individual developers. No, the real leaders were, in order: AMD; Intel; Google; Linaro, the main Arm Linux development organization; Meta; and Red Hat. The article also includes this thought-provoking quote from Aiven CTO's. "Innovation is at the heart of the open source community, but without a strong commitment from companies, the whole system will struggle. "We can see that companies are recognizing their role and supporting all who use open source."' -- source: https://news.slashdot.org/story/23/02/26/1950212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Emacs: Comparing Two Regions From Two Files
by Lawrence D'Oliveiro 28 Feb '23

28 Feb '23

So I was compiling some useful database-related routines that I have used in various places (with MySQL and SQLite so far) over the years into a set of common modules, so that I could easily find the latest and best-tested versions of them for future projects. Then I came to a routine with two versions of a few dozen lines each, and I was trying to figure out a way of doing a diff on them without writing them out to temporary files. I have an Emacs command called “make-command-buffer”, which I can use for example to create a buffer for entering and executing shell commands, and collecting their output. It was easy enough to copy and paste both routines into the buffer, but now how do I put them both into one diff command? There is a shell feature called “here-docs”, which lets you include the standard-input data for a command directly following the command: «cmd» <<«marker» ... data ... «marker» where the «marker» is some word that does not occur in the data. But I want to have two of these, like this: diff -u <<EOD1 <<EOD2 ... version 1 ... EOD1 ... version 2 ... EOD2 You can do something like that in Perl, but it doesn’t work in the shell. Hunting around on line reminded me why: because you can only have one standard input. But in the Bash man page, there is a syntax for redirecting arbitary file descriptors, letting you have any number of heredocs. So, combining this with the ability to give a command a file name that corresponds to an already-open file descriptor, I finally got this to work: diff -u /dev/fd/8 /dev/fd/9 8<<EOD1 9<<EOD2 ... version 1 ... EOD1 ... version 2 ... EOD2

1 1

LastPass says employee’s home computer was hacked and corporate vault taken
by Peter Reutemann 28 Feb '23

28 Feb '23

'Already smarting from a breach that put partially encrypted login data into a threat actor’s hands, LastPass on Monday said that the same attacker hacked an employee’s home computer and obtained an unencrypted vault available to only a handful of company developers. Although an initial intrusion into LastPass ended on August 12, officials with the leading password manager said the threat actor “was actively engaged in a new series of reconnaissance, enumeration, and exfiltration activity” from August 12 to August 26. In the process, the unknown threat actor was able to steal valid credentials from a senior DevOps engineer and access the contents of a LastPass data vault. Among other things, the vault gave access to a shared cloud-storage environment that contained the encryption keys for customer vault backups stored in Amazon S3 buckets.' -- source: https://arstechnica.com/information-technology/2023/02/lastpass-hackers-inf… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Asahi Linux Disputes Report That Linux 6.2 Will Run on Apple M1 Chips
by Peter Reutemann 28 Feb '23

28 Feb '23

'Last week ZDNet reported Linux had added upstream support for the Apple M1 Pro, M1 Max, and M1 Ultra chips and then concluded that "newer Mac owners can look forward to running Linux on their M1-powered machines." Saturday Asahi Linux called ZDNet's story "misleading and borderline false," posting on Twitter that "You will not be able to run Ubuntu nor any other standard distro with 6.2 on any M1 Mac. Please don't get your hopes up." We are continuously upstreaming kernel features, and 6.2 notably adds device trees and basic boot support for M1 Pro/Max/Ultra machines. However, there is still a long road before upstream kernels are usable on laptops. There is no trackpad/keyboard support upstream yet. While you can boot an upstream 6.2 kernel on desktops (M1 Mac Mini, M1 Max/Ultra Mac Studio) and do useful things with it, that is only the case for 16K page size kernel builds. No generic ARM64 distro ships 16K kernels today, to our knowledge. Our goal is to upstream everything, but that doesn't mean distros instantly get Apple Silicon support. As with many other platforms, there is some integration work required. Distros need to package our userspace tooling and, at this time, offer 16K kernels. In the future, once 4K kernel builds are somewhat usable, you can expect zero-integration distros to somewhat work on these machines (i.e. some hardware will work, but not all, or only partially). This should be sufficient to add a third-party repo with the integration packages. But for out-of-the-box hardware support, distros will need to work with us to get everything right. We are already working with some, and we expect to announce official Apple Silicon support for a mainstream distro in the near future. Just not quite yet!' -- source: https://linux.slashdot.org/story/23/02/27/0457206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Nokia Launches DIY Repairable Budget Android Phone
by Peter Reutemann 28 Feb '23

28 Feb '23

'Guardian reports: Nokia has announced one of the first budget Android smartphones designed to be repaired at home allowing users to swap out the battery in under five minutes in partnership with iFixit. Launched before Mobile World Congress in Barcelona on Saturday, the Nokia G22 has a removable back and internal design that allows components to be easily unscrewed and swapped out including the battery, screen and charging port. Nokia phones manufacturer HMD Global will make "quick fix" repair guides and genuine parts available for five years via specialists iFixit, in addition to affordable professional repair options. "People value long-lasting, quality devices and they shouldn't have to compromise on price to get them. The new Nokia G22 is purposefully built with a repairable design so you can keep it even longer," said Adam Ferguson, head of product marketing for HMD Global. The G22 is partially made of recycled plastic and has a 6.53in screen, large-capacity battery, 50-megapixel camera and a fingerprint scanner. It runs Android 12 and will be supported for three years of monthly security updates and two major Android version upgrades.' -- source: https://mobile.slashdot.org/story/23/02/25/2046209 -- specs: https://www.nokia.com/phones/en_int/nokia-g-22/specs Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1