January 2024 - wlug - list.wlug.org.nz

Linux Devices Are Under Attack By a Never-Before-Seen Worm
by Peter Reutemann 11 Jan '24

11 Jan '24

'Previously unknown self-replicating malware has been infecting Linux devices worldwide, installing cryptomining malware using unusual concealment methods. The worm is a customized version of Mirai botnet malware, which takes control of Linux-based internet-connected devices to infect others. Mirai first emerged in 2016, delivering record-setting distributed denial-of-service attacks by compromising vulnerable devices. Once compromised, the worm self-replicates by scanning for and guessing credentials of additional vulnerable devices. While traditionally used for DDoS attacks, this latest variant focuses on covert cryptomining. ArsTechnica adds: On Wednesday, researchers from network security and reliability firm Akamai revealed that a previously unknown Mirai-based network they dubbed NoaBot has been targeting Linux devices since at least last January. Instead of targeting weak telnet passwords, the NoaBot targets weak passwords connecting SSH connections. Another twist: Rather than performing DDoSes, the new botnet installs cryptocurrency mining software, which allows the attackers to generate digital coins using victims' computing resources, electricity, and bandwidth. The cryptominer is a modified version of XMRig, another piece of open source malware. More recently, NoaBot has been used to also deliver P2PInfect, a separate worm researchers from Palo Alto Networks revealed last July. Akamai has been monitoring NoaBot for the past 12 months in a honeypot that mimics real Linux devices to track various attacks circulating in the wild. To date, attacks have originated from 849 distinct IP addresses, almost all of which are likely hosting a device that's already infected. The following figure tracks the number of attacks delivered to the honeypot over the past year.' -- source: https://linux.slashdot.org/story/24/01/10/1727219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel 4.14 Reaches End of Life After More Than Six Years of Maintenance
by Peter Reutemann 11 Jan '24

11 Jan '24

'Originally released on November 12th, 2017, the long-term supported (LTS) Linux 4.14 kernel series has now reached its end of supported life after being maintained for more than six years. Renowned kernel developer Greg Kroah-Hartman announced today on the Linux kernel mailing list the release of Linux 4.14.336 as what appears to be the last maintenance update to the long-term supported Linux 4.14 kernel series, which is now marked as EOL (End of Life) on the kernel.org website. "This is the LAST 4.14.y kernel to be released. It is now officially end-of-life. Do NOT use this kernel version anymore, please move to a newer one, as shown on the kernel.org releases page," said Greg Kroah-Hartman. "If you are stuck at this version due to a vendor requiring it, go get support from that vendor for this obsolete kernel tree, as that is what you are paying them for."' -- source: https://linux.slashdot.org/story/24/01/10/1729216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Computer Says You Are A Thief
by Lawrence D'Oliveiro 10 Jan '24

10 Jan '24

Been hearing about this on and off for a few years, but it seems things have come to a head with the airing of a four-part documentary series about the massive scandal of the “Horizon” financial software used by the British Post Office <https://www.aljazeera.com/news/2024/1/9/the-great-british-post-office-scand…>. Basically, the buggy software was reporting incorrect transaction amounts, and these reports were believed over the protestations of the branch managers, leading to several hundred of the latter being prosecuted and convicted of theft and false accounting. In desperation at not being believed, some of them tried to plug the holes with their own money. Some even committed suicide. It took twenty years from the introduction of the system before a court ruled that the fault lay with the software, not with so many innocent people. (Why was the software considered to be above reproach for so long?) Even now, only a small proportion of the false convictions have been overturned. The Post Office CEO at the time has bowed to pressure and returned her CBE award. The software is still in use.

1 0

speed camera with RPi - NZ edition
by Peter Reutemann 10 Jan '24

10 Jan '24

Hi everyone Just stumbled across this news item in one of the reviews for the Raspberry Pi 4 on PBTech's website: https://www.stuff.co.nz/national/119894942/diy-speed-camera-nabs-hoons-near… And, would you believe it, the article even linked the source code: https://github.com/gregtinkers/carspeed.py Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical wants better Snap support outside Ubuntu, based on latest hires
by Peter Reutemann 10 Jan '24

10 Jan '24

'Snaps, the self-contained application packages that Ubuntu has long seen as a simpler app store and a potential solution to dependency hell, could be getting better support outside Ubuntu itself, based on one recent hire and potentially more. As spotted by the Phoronix blog, developer Zygmunt Krynicki, who worked at Ubuntu distributor Canonical from 2012 through 2020, posted Friday on Mastodon that he was "returning as a snap developer later this month." His main focus would be "cross-distribution support," Krynicki wrote, and "unlike in the past this will be my full time job. I'm very excited for what is ahead for snaps." He also noted, in a later reply, that he was "not coming back alone." Krynicki, reached Monday on Mastodon, noted that he was at a very early stage in his work. But he intended to look at the state of support across distributions, determine which long-term and short-term work to focus on, and "work on the internals and get things progressively better, even if that is not flashy." That means refactoring some of the code and, "if realistic, change some of the old ideas that I believe hold the project back," Krynicki wrote. The challenge will be finding ways to "experiment with new ideas in ways that allow controlled but more rapid progress," while maintaining stability. But all of that needs discussing with his team, when they're fully in place, Krynicki wrote. That team and their work would indicate that the Ubuntu makers have listened to perhaps the most common criticism of Snaps, whether perceptual, logistical, or both: that Snaps are an Ubuntu-focused phenomenon. Snap packages have difficulty working without AppArmor, a kernel extension that is a default in Ubuntu but not every other Linux distribution. Canonical also maintains the Snap Store. While other stores of Snaps are possible, some distributions and software packagers have turned instead to Flatpak, a similarly containerized system that doesn't have deep ties to any one distribution.' -- source: https://arstechnica.com/gadgets/2024/01/canonical-wants-better-snap-support… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Discusses Maintainers, AI, and Rust in the Kernel
by Peter Reutemann 08 Jan '24

08 Jan '24

'ZDNet reports that "At the Linux Foundation's Open Source Summit Japan, Linus Torvalds and his good friend Dirk Hohndel, the head of Verizon open source, talked about the current state of Linux: Speaking of maintainers, Hohndel brought up the question of "maintainer fatigue and how draining and stressful this role is...." Torvalds replied, "It's much easier to find developers; we have a lot of developers. Some people think that you have to be a superdeveloper who can do everything to be a maintainer, but that's not actually true...." Hohndel commented that the aging of the kernel community is a "double-edged sword." Torvalds agreed, but he noted that "one of the things I liked about the Rust side of the kernel, was that there was one maintainer who was clearly much younger than most of the maintainers. We can clearly see that certain areas in the kernel bring in more young people...." Hohndel and Torvalds also talked about the use of the Rust language in the Linux kernel. Torvalds said, "It's been growing, but we don't have any part of the kernel that really depends on Rust yet. To me, Rust was one of those things that made technical sense, but to me personally, even more important was that we need to not stagnate as a kernel and as developers." That said, Torvalds continued, "Rust has not really shown itself as the next great big thing. But I think during next year, we'll actually be starting to integrate drivers and some even major subsystems that are starting to use it actively. So it's one of those things that is going to take years before it's a big part of the kernel. But it's certainly shaping up to be one of those." Torvalds also said he enjoyed the fact that open source "has become the standard within the industry." But later Hohndel, calling AI "autocorrect on steroids," asked Torvalds if he thought he'd ever see submissions of LLM-written code. "I'm convinced it's gonna happen. And it may well be happening already, maybe on a smaller scale where people use it more to help write code." But, unlike many people, Torvalds isn't too worried about AI. "It's clearly something where automation has always helped people write code. This is not anything new at all...." But, "What about hallucinations?," asked Hohndel. Torvalds, who will never stop being a little snarky, said, "I see the bugs that happen without AI every day. So that's why I'm not so worried. I think we're doing just fine at making mistakes on our own." ' -- source: https://linux.slashdot.org/story/23/12/09/0644247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

How Does FreeBSD Compare to Linux on a Raspberry Pi?
by Peter Reutemann 08 Jan '24

08 Jan '24

'Klaus Zimmermann (a self-described "friendly hacker") recently posted a "State of the Distro" post, choosing his favorite distributions for things like portable installation from a USB drive (Alpine Linux) and for a desktop OS (Debian Linux or Devuan). But when it comes to a distro for the Raspberry Pi, (at least until the 4), Zimmerman argues that FreeBSD's performance is "unlike any other Linux distribution I've ever seen, even with cpupower activated and overclocking." Nope, no match — FreeBSD's performance on the Pi is still way better, even without overclocking. You can browse a modern web, have things scroll smoothly, watch videos and even play some 3D games like Quake with it! And if you overclock it a little (2GHz) you can even make it run that gargantua MS Teams. But what about all that lackluster driver support? WiFi drivers still on the 802.11g standard and all? Surely you can't be serious about it when Linux offers all that support out of the box, right? Wrong, actually. For starters, the drivers provided for the Pi's hardware are often half-assed proprietary blobs... I no longer think FreeBSD is really at fault if the driver support for the hardware is not helpful to begin with. Even drivers you find for Linux are shaky at best. So yes, I will keep using FreeBSD on the Pi. As a desktop. With USB WiFi and audio adapters for those services, because the existing hardware is sort of moot even otherwise. And with those USB adapters — and FreeBSD — the Pi works really well, truly desktop-like. I'd be curious to hear from Slashdot's readers about their own experiments with Linux (and FreeBSD) on a Raspberry Pi. Zimmerman's final winner, for the "Server" category, was Debian — though of his two servers, one is just an XMPP server set up on a Raspberry Pi. "I found that using Debian on the Pi is a real joy. Easy and simple to set up, familiar environment and all. So I'm keeping it. "This concept is about to be overshadowed, however, by my growing like of FreeBSD lately..."' -- source: https://linux.slashdot.org/story/24/01/07/0327229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ZDNet Calls Rhino Linux 'New Coolest Linux Distro'
by Peter Reutemann 08 Jan '24

08 Jan '24

'If you're starting the new year with a new Linux distro, ZDNet just ran an enthusiastic profile of Rhino Linux, calling it "beautiful" with "one of the more useful command-line package managers on the market." Rhino uses a modern take on the highly efficient and customizable Xfce desktop (dubbed "Unicorn") to help make the interface immediately familiar to anyone who logs in. You'll find a dock on the left edge of the screen that contains launchers for common applications, access to the Application Grid (where you can find all of your installed software), and a handy Search Bar (Ulauncher) that allows you to quickly search for and launch any installed app (or even the app settings) you need... Thanks to myriad configuration options, Xfce can be a bit daunting. At the same time, the array of settings makes Xfce highly customizable, which is exactly what the Rhino developers did when they designed this desktop. For those who want a desktop that makes short work of accessing files, the Rhino developers have added a really nifty tool to the top bar. You'll find a listing of some folders you have in your Home directory (Files, Documents, Music, Pictures, Video). If you click on one of those entries, you'll see a list of the most recently accessed files within the directory. Click on the file you want to open with the default, associated application... Rhino opts for the Pacstall package manager over the traditional apt-get. That's not to say apt-get isn't on the system — it is. But with Rhino Linux, there's a much easier path to getting the software you want installed... [W]hen you first run the installed OS, you are greeted with a window that allows you to select what package managers you want to use. You can select from Snap, Flatpak, and AppImages (or all three). Next, the developers added a handy tool (rhino-pkg) that makes installing from the command line very simple. When the distro launched in August, 9to5Linux described it as "a unique distribution for Ubuntu fans who wanted a rolling-release system where they install once and receive updates forever." The theming looks gorgeous and it's provided by the Elementary Xfce Darker icon theme, Xubuntu's Greybird GTK theme, and Ubuntu's Yaru Dark WM theme. It also comes with some cool features, such as a dedicated and full-screen desktop switcher provided by Xfdashboard... ' -- source: https://news.slashdot.org/story/24/01/07/2036245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

RIP: Software Design Pioneer And Pascal Creator Niklaus Wirth
by Lawrence D'Oliveiro 06 Jan '24

06 Jan '24

Famed computer scientist Niklaus Wirth has passed away, just a few weeks before reaching his 90th birthday <https://www.theregister.com/2024/01/04/niklaus_wirth_obituary/>. He is known for being a champion of simplicity in programming language and system design. He had a falling out with the committee that was coming up with a successor to Algol-60 (itself a driver for many important language-implementation techniques), and so went off and created Pascal. And then a few more languages after that. In his criticism of the language, Algol-68, that the committee eventually came up with, I found this excerpt illuminating on the milieu of the time: I am discouraged! I thought I had recognized the short-comings of the commercially available languages; they provide no guidance to programming discipline, and lack a logically coherent structure. Algol 60 had provided an answer and a solution. Unfortunately, it lacked some features which many practitioners badly need. It was relatively easy to remedy some defects and some defaults of Algol 60. We had implemented such an extension of Algol; it contains the data types long real, complex, and character strings, along with one other major extension. But guess how many requests we received for this system. None! Nobody is interested in a new language, particuarly if it is not supported by the big manufacturers or has received the blessing of some standards committee. But I see no chances that either a big manufacturer or a committee will ever produce a language acceptable to our standards or clarity, simplicity, and rigor. Remember, this was published in November 1968. Notice the assumption that the only sort of language implementation that might be worth using is a “commercially-available” one, with the backing of a “big” company behind it. There was no thought that an implementation with source code freely available could ever be considered “commercial”, either in usage or quality. And on top of that, every OS was different; there was nothing like the near-universality of POSIX-type OSes we enjoy today. And some of the differences were downright--quirky, shall we say. So even if such a source code project were available, porting it to all the platforms in common use would likely have been a nightmare.

1 0

Since the Demise of Atom, 'Pulsar' Offers an Alternative Code Editor
by Peter Reutemann 01 Jan '24

01 Jan '24

'On December 15 GitHub declared end-of-life for its "hackable text editor" Atom. But Long-time Slashdot reader BrendaEM wants to remind everyone that after the announcement of Atom's sunset, "the community came together to keep Atom alive." First there was the longstanding fork Atom-Community. But "due to differences in long-term goals for the editor, a new version was born: Pulsar." >From the Pulsar web site: Pulsar [sometimes referred to as Pulsar-Edit] aims to not only reach feature parity with the original Atom, but to bring Pulsar into the 21st century by updating the underlying architecture, and supporting modern features. With many new features on the roadmap, once Pulsar is stable, it will be a true, Community-Based, Hackable, Text Editor. "Of course, the user interface is much of the same," writes the blog Its FOSS, and it's cross-platform (supporting Linux, macOS, and Windows). "The essentials seem to be there with the documentation, packages, and features like the ability to install packages from Git repositories..."' -- source: https://tech.slashdot.org/story/24/01/01/016215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0