August 2023 - wlug - list.wlug.org.nz

Bloomberg Terminals Still Exist
by Lawrence D'Oliveiro 27 Aug '23

27 Aug '23

Bloomberg still supplies special terminals for accessing the services it provides, and those services cost a pretty penny -- over $40,000 a year for each. And Kāinga Ora has seven of the things <https://www.nzherald.co.nz/nz/politics/kainga-ora-spends-more-than-300000-a…>. These things have a long history. A look at some older versions: <https://www.bloomberg.com/professional/blog/look-back-bloomberg-keyboard/>.

1 0

When A Certificate Authority Is Too Big To Fail
by Lawrence D'Oliveiro 26 Aug '23

26 Aug '23

Certificate authorities (CAs) have a crucial role in the chain of trust that binds the computing world together right now. So when it turns out that a rather large company (Symantec) has been issuing dodgy certificates for many years, the ramifications run uncomfortably wide. Google has been gradually winding down its trust of Symantec-issued over a multiyear period, because blocking them all at once would just be too painful for its users. It turns out some of these CAs are also used for signing applications for Windows. Microsoft finally got around to blocking the Symantec one within the last few days, only to abruptly reverse course and trust it again, because it caused serious trouble for too many Windows systems <https://arstechnica.com/security/2023/08/a-renegade-certificate-is-removed-…>. The applications concerned should have been updated to not depend on such a worthless CA. But it seems, ensuring Windows users update all their relevant apps can be a mountain just too high to climb.

1 0

Firefox Users May Import Chrome Extensions Now
by Peter Reutemann 25 Aug '23

25 Aug '23

'Mozilla has implemented the WebExtensions system in its browser, allowing Firefox users to import select extensions from other browsers like Chrome. gHacks reports: The feature, which is in testing at the moment, can be enabled by all users of the latest stable version of Firefox. 1. Load about:config in the browser's address bar. 2. Confirm that you will be careful to continue. 3. Search for browser.migrate.chrome.extensions.enabled. 4. Set the feature to True, which enables it. 5. Restart Firefox. Mozilla has integrated it into the browser's import functionality, which users may use on first run or at any time from the Settings page. To do so, select Menu > Settings > Import Data (button), or load about:preferences#general in the browser's address bar and activate the import data button on the page. Select Chrome from the list, expand the available import options and make sure extensions are checked. Imports are usually limited to some data, such as bookmarks or the browsing history. Firefox is the first major browser, maybe the first browser at all, that adds extensions to the list of supported imports. The feature is limited at the time to Google Chrome and select extensions. Even though Firefox and Chrome extensions use the same framework, WebExtensions, they are not compatible immediately. Firefox users who attempt to install extensions from Chrome's Web Store may notice that this is not working. Mozilla decided to create a list of extension pairs for extensions that are available on the Chrome Web Store and the Mozilla Add-ons Store. Instead of importing the Chrome extension directly, Firefox is installing the Firefox version of the extension from Mozilla's own extension store. ' -- source: https://news.slashdot.org/story/23/08/24/2233242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WinRAR Flaw Lets Hackers Run Programs When You Open RAR Archives
by Peter Reutemann 23 Aug '23

23 Aug '23

'A critical vulnerability (CVE-2023-40477) has been patched in WinRAR, enabling remote attackers to execute arbitrary code by luring victims into opening a specially crafted RAR file. The severity rating is only 7.8 though due to user deception being necessary. BleepingComputer reports: The vulnerability was discovered by researcher "goodbyeselene" of Zero Day Initiative, who reported the flaw to the vendor, RARLAB, on June 8th, 2023. "The specific flaw exists within the processing of recovery volumes," reads the security advisory released on ZDI's site. "The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer." RARLAB released WinRAR version 6.23 on August 2nd, 2023, effectively addressing CVE-2023-40477. Therefore, WinRAR users are strongly advised to apply the available security update immediately. Apart from the RAR4 recovery volumes processing code fix, version 6.23 addresses an issue with specially crafted archives leading to wrong file initiation, which is also considered a high-severity problem.' -- source: https://it.slashdot.org/story/23/08/18/2157249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Latest Android Runtime (ART) Update Led To Apps Starting 30% Faster
by Peter Reutemann 22 Aug '23

22 Aug '23

'The latest update to the Android Runtime (ART) -- the "engine behind the Android operating system (OS)" -- has resulted in app startup time "improvements of up to 30% on some devices," says Google. 9to5Google reports: Behind the scenes, "ART is the same for all devices" and: "The ART APEX module is a complex piece of software with an order of magnitude more APIs than any other APEX module. It also backs a quarter of the developer APIs available in the Android SDK. In addition, ART has a compiler that aims to make the most of the underlying hardware by generating chipset-specific instructions, such as Arm SVE." The testing process for Android Runtime updates involves "compiling over 18 million APKs and running app compatibility tests, and startup, performance, and memory benchmarks on a variety of Android devices that replicate the diversity of our ecosystem as closely as possible." There's then a very gradual rollout process. Google also notes developer improvements with every update "like OpenJDK improvements and compiler optimizations that benefit both Java and Kotlin," with ART 13 resulting in the "fastest-ever adoption of a new OpenJDK [11] release on Android devices." ART 14 is rolling out "in the coming months" with "new compiler and runtime optimizations that improve performance while reducing code size," as well as OpenJDK 17.' -- source: https://slashdot.org/story/23/08/21/212202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AlmaLinux Leader Says Red Hat's Code Crackdown Isn't a Threat
by Peter Reutemann 21 Aug '23

21 Aug '23

'Yes, Red Hat Enterprise Linux changed its licensing last month — but how will that affect AlmaLinux? The chair of the nonprofit AlmaLinux OS Foundation, benny Vasquez, tells SiliconANGLE that "For typical users, there's very, very little difference. Overall, we're still exactly the same way we were, except for kernel updates." Updates may no longer be available the day a new version of RHEL comes out, but developers still have access to Red Hat's planned enhancements and bug fixes via CentOS Stream, a version of RHEL that Red Hat uses as essentially a test bed for new features that might later be incorporated into its flagship product. From a practical perspective, that's nearly as good as having access to the production source code, Vasquez said. "While there is a generally accepted understanding that not everything in CentOS Stream will end up in RHEL, that's not how it works in practice," she said. "I can't think of anything they have shipped in RHEL that wasn't in Stream first." That's still no guarantee, but the workarounds AlmaLinux has put in place over the past month should address all but the most outlier cases, Vasquez said. The strategy has shifted from bug-for-bug compatibility to being application binary interface-compatible... ABI compatibility doesn't guarantee that problems will never occur, but glitches should be rare and can usually be resolved by recompiling the source code. "It is sufficient for us to be ABI-compatible with RHEL," Vasquez said. "The most important thing is that this allows our community to feel stability." In fact, Red Hat's change of direction has been a blessing in disguise for AlmaLinux, she said... "We view this as a release from our bonds of being one-to-one." Patches can be applied without waiting for a cue from Red Hat and "we get to engage with our community in a completely new and exciting way." AlmaLinux has also seen a modest financial windfall from Red Hat's decision. "The outpouring of support has been pretty impressive," Vasquez said. "People have shown up for event staffing and website maintenance and infrastructure management and we've gotten more financial backing from corporations." Vasquez also told the site that "the number of everyday people throwing in $5 has more than quadrupled."' -- source: https://linux.slashdot.org/story/23/08/20/0247259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian Turns 30
by Peter Reutemann 18 Aug '23

18 Aug '23

'Debian blog: Over 30 years ago the late Ian Murdock wrote to the comp.os.linux.development newsgroup about the completion of a brand-new Linux release which he named "The Debian Linux Release." He built the release by hand, from scratch, so to speak. Ian laid out guidelines for how this new release would work, what approach the release would take regarding its size, manner of upgrades, installation procedures; and with great care of consideration for users without Internet connection. Unaware that he had sparked a movement in the fledgling F/OSS community, Ian worked on and continued to work on Debian. The release, now aided by volunteers from the newsgroup and around the world, grew and continues to grow as one of the largest and oldest FREE operating systems that still exist today. Debian at its core is comprised of Users, Contributors, Developers, and Sponsors, but most importantly, People. Ians drive and focus remains embedded in the core of Debian, it remains in all of our work, it remains in the minds and hands of the users of The Universal Operating System. The Debian Project is proud and happy to share our anniversary not exclusively unto ourselves, instead we share this moment with everyone, as we come together in celebration of a resounding community that works together, effects change, and continues to make a difference, not just in our work but around the world. Debian is present in cluster systems, datacenters, desktop computers, embedded systems, IoT devices, laptops, servers, it may possibly be powering the web server and device you are reading this article on, and it can also be found in Spacecraft.' -- source: https://linux.slashdot.org/story/23/08/17/136231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Farewell, Type-1 Fonts
by Lawrence D'Oliveiro 17 Aug '23

17 Aug '23

Following the lead of other vendors, now Adobe itself is abandoning support for the venerable “Type 1” font format that it created <https://arstechnica.com/gadgets/2023/08/microsoft-adobe-and-others-have-dro…>. Back in the days when PostScript printers were new and wonderful things, the PostScript language was an open, published spec, but the high-quality font format that Adobe’s printers used was not. This format included a “secret sauce” in the form of “hints” to the rasterizer that smoothed out irregularities. Because if you took letter shapes expressed as scalable vector graphics and tried rendering them in a straight geometric fashion at typical text sizes on a black-and-white output device, even at as high as 300 dpi, there would be a noticeable roughness to the shapes. Nowadays the techniques for applying such hinting are no longer such a big secret. However, I take issue with this bit: ... it's possible that you created a document in 2022 that you simply won't be able to open in 2023. The change will also cause problems if you open and work with decades-old files with any kind of regularity; files that use Type 1 fonts will begin generating lots of "missing font" messages ... As far as I know, office-type and layout-type apps do not typically embed fonts in the document. Instead, they store font-matching information (family name, weight etc) that will be used to find the best available fonts when the document is next opened, perhaps on a different system. Remember, it is only the old font format that is being dropped; the same classic, professional-quality font designs that people have been using for years or decades will still be available, just in the newer formats. So a proper font match, if it is installed, can still be found. A self-contained document format like PDF does embed fonts (typically only in subset form), but that has its own internal font representation, so it should not be affected by the demise of Type-1. This part is true, though: You'll also either need to convert any specialized PostScript Type 1 font that you may have paid for in the past or pay for an equivalent OpenType alternative. This article <https://www.prepressure.com/fonts/basics/history> is a good potted history of font formats (the important ones, at any rate). By the way, I don’t think the open-source FreeType library is dropping support for Type-1 font rendering any time soon. It still handles Multiple Master fonts, which Adobe gave up on a long time ago.

1 1

Windows Server Forgets What Time It Is
by Lawrence D'Oliveiro 17 Aug '23

17 Aug '23

Seems that, some years ago, Microsoft added a “feature” to Windows Server, called “Secure Time Seeding”. This was supposed to offer alternative ways for a server machine to keep track of the correct time, in the event of failures in the more usual mechanisms. Unfortunately, this “feature” only seems to have introduced a new source of problems, where the server can suddenly throw its date and time setting off by as much as several months, often with unfortunate consequences for the applications running on it <https://arstechnica.com/security/2023/08/windows-feature-that-resets-system…>. At this stage, Microsoft is still in the “no comment” stage of (not) responding to this problem. Reports of issues go right back to the introduction of the feature, back in 2016. They may only be happening intermittently, but it seems to me this is still enough to damage what trust there may still be left in Microsoft’s product.

1 0

Firefox Finally Outperforming Google Chrome In SunSpider
by Peter Reutemann 16 Aug '23

16 Aug '23

'Michael Larabel writes via Phoronix: Mozilla developers are celebrating that they are now faster than Google Chrome with the SunSpider JavaScript benchmark, although that test has been superseded by the JetStream benchmark. Last week a new Firefox Nightly News was published that outlines that "We're now apparently beating Chrome on the SunSpider JavaScript benchmark!" The provided numbers now show Firefox easily beating Chrome in this decade-old JavaScript benchmark. The benchmarks come from AreWeFastYet.com. Meanwhile for the newer and more demanding JetStream 2.0 benchmark, Google Chrome continues to win easily over Firefox. ' -- source: https://news.slashdot.org/story/23/08/15/2015210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0