October 2024 - wlug - list.wlug.org.nz

Weta Digital’s Technology Division Sold To US Firm
by Lawrence D'Oliveiro 01 Aug '25

01 Aug '25

Let me see if I understand this article <https://www.nzherald.co.nz/business/sir-peter-jackson-to-sell-weta-digital-…> correctly: the part of Weta Digital that used to develop the in-house 3D graphics/effects tools that they use in all those movies is being sold to US-based Unity Software. The part that is left will be called “WetaFX”, and will become a customer of Unity for the use of those tools, no longer doing its own development in-house. By the way, I’ve been looking at the Unity site <https://unity.com/>, and it looks like all their products are rentware (subscription-based).

1 2

New systemd update will bring Windows’ infamous Blue Screen of Death to Linux
by Peter Reutemann 18 Nov '24

18 Nov '24

'Windows' infamous "Blue Screen of Death" is a bit of a punchline. People have made a hobby of spotting them out in the wild, and in some circles, they remain a byword for the supposed flakiness and instability of PCs. To this day, networked PCs in macOS are represented by beige CRT monitors displaying a BSOD. But the BSOD is supposed to be a diagnostic tool, an informational screen that technicians can use to begin homing in on the problem that caused the crash in the first place; that old Windows' BSOD error codes were often so broad and vague as to be useless doesn't make the idea a bad one. Today, version 255 of the Linux systemd project honors that original intent by adding a systemd-bsod component that generates a full-screen display of some error messages when a Linux system crashes. The systemd-bsod component is currently listed as "experimental" and "subject to change." But the functionality is simple: any logged error message that reaches the LOG_EMERG level will be displayed full-screen to allow people to take a photo or write it down. Phoronix reports that, as with BSODs in modern Windows, the Linux version will also generate a QR code to make it easier to look up information on your phone.' -- source: https://arstechnica.com/gadgets/2023/12/linux-distros-are-about-to-get-a-ki… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Local Privilege Escalation Vulnerability Affecting X.Org Server For 18 Years
by Peter Reutemann 30 Oct '24

30 Oct '24

'Phoronix's Michael Larabel reports: CVE-2024-9632 was made public today as the latest security vulnerability affecting the X.Org Server. The CVE-2024-9632 security issue has been present in the codebase now for 18 years and can lead to local privilege escalation. Introduced in the X.Org Server 1.1.1 release back in 2006, CVE-2024-9632 affects the X.Org Server as well as XWayland too. By providing a modified bitmap to the X.Org Server, a heap-based buffer overflow privilege escalation can occur. This security issue is within _XkbSetCompatMap() and stems from not updating the heap size properly and can lead to local privilege escalation if the server is run as root or as a remote code execution with X11 over SSH.' -- source: https://it.slashdot.org/story/24/10/29/2029233 Cheers, Peter

1 0

Debian's "secret" sauce
by Peter Reutemann 29 Oct '24

29 Oct '24

'While Debian's "sauce" is not actually all that secret, it is not particularly well-known either, Samuel Henrique said at the start of his DebConf24 talk. There is a lot of software-engineering effort that has been put in place by the distribution in order to create and maintain its releases, but ""loads of people are not aware"" of it. That may be due to the fact that all of that is not really documented anywhere in a central location that he can just point someone to. Recognizing that is what led him to give the talk; hopefully it will be a ""first step toward"" helping solve the problem. Henrique said that he is a Brazilian and has been a Debian Developer since 2018. He mostly works in the security tools packaging team, but also maintains some packages outside of that team, including curl and rsync. In addition, he mentors Debian newcomers, mostly on packaging tasks. He works on the Amazon Linux security team. He noted that his web site contains links to the slides from the talk; a WebM video is also available. [Update: A YouTube video with subtitles in English and Portuguese is also available.]' -- source: https://lwn.net/Articles/990177/ Cheers, Peter

1 0

Discovering the Joys of E-Books with Calibre
by Ben Cottrell 29 Oct '24

29 Oct '24

I was lucky to come across a collection of Cybersecurity E-Books on Humble Bundle, spending around 40 NZD to receive 21 books. After paying for and downloading the books, the PDF’s weren’t named tidily, so I decided to use Calibre to organize my collection. Calibre categorized the books under author subdirectories and named them by title nicely. It couldn’t open the PDF’s itself, it does a good job cataloguing. Do you have any favourite tools or scripts for managing E-Books? Please let me know 😊 Cheers, Ben

2 1

Raspberry Pi OS’s yearslong switch from X Window to Wayland is now official
by Peter Reutemann 29 Oct '24

29 Oct '24

'There have been times when it seemed like X Window System would be with us forever, even though it's more than 40 years old, and the last true version was issued in 2012. But with great effort, some organizations and operating systems have moved on. Raspberry Pi has now joined the forward momentum, with its latest release of Raspberry Pi OS swapping in Wayland—and it's hoping the change is hardly noticeable. You might want to wait a moment before upgrading, though. Simon Long wrote on Raspberry Pi's blog that the organization started thinking about switching to Wayland about 10 years ago, though it was "nowhere near ready to use" back then. Over the last few years, the Pi team has done some things to prep a real switch: - Used mutter as an X window manager in 2021's Bullseye release because it could also be used as a Wayland compositor - Switched from mutter to wayfire in 2023's Bookworm release and made Wayland the default for Raspberry Pi 4 and 5 - Switched one last time to labwc, which better fit Raspberry Pi's graphics hardware than wayfire Because labwc is built on wlroots, a modular system that allows for building a Wayland compositor without whole-cloth reinvention, it was easier to adapt to Raspberry Pi's needs. After efforts throughout 2024, the team is ready to call it the year of Wayland on Raspberry Pi desktops. "After much optimisation for our hardware, we have reached the point where labwc desktops run just as fast as X on older Raspberry Pi models," Long wrote. "Today, we make the switch with our latest desktop image: Raspberry Pi Desktop now runs Wayland by default across all models."' -- source: https://arstechnica.com/gadgets/2024/10/raspberry-pi-oss-years-long-switch-… Cheers, Peter

1 0

AI Scams In The Knitting And Crochet World
by Lawrence D'Oliveiro 26 Oct '24

26 Oct '24

I suppose if you spend much time in online software support forums, you’ve come across the newbie who asked an AI to generate some code for them, and then asks for help to figure out why it didn’t work. But did you know that knitting and crochet patterns are like computer code, too? And that people are using AI to generate those? And that the same problems of quality control are afflicting them? Unlike computer software, where once you track down the bug, you can usually fix just that one line and run the code again, a flaw in a knitting or crochet pattern can require you to throw away hours of work, unpicking your way back to the point where the flaw was introduced, before you can fix it and continue from that point again. And food recipes are becoming infested with AI rubbish as well. Here you might be tricked into following some interesting-looking recipe, perhaps quite complicated, only to end up with an inedible, revolting mess, and money wasted on all the ingredients, as well as time wasted doing the work. <https://www.zdnet.com/article/ai-scams-have-infiltrated-the-knitting-and-cr…>

1 0

ISC DHCP Server Replaced By Kea
by Lawrence D'Oliveiro 19 Oct '24

19 Oct '24

I just discovered that the DHCP server I’ve been using at home <https://arstechnica.com/information-technology/2024/10/finally-upgrading-fr…> officially reached EOL two years ago, and has been replaced by a new package, rewritten from the ground up, called Kea. Seems the old code base was just getting too convoluted and creaky and too hard to maintain. Of course there are tools to assist the migration to the new way of doing things.

1 0

5 Stand-Out LibreOffice Features That Make It My Go-To Office Suite
by Lawrence D'Oliveiro 17 Oct '24

17 Oct '24

From <https://www.zdnet.com/home-and-office/work-life/5-stand-out-libreoffice-fea…>: Customizable GUI: For example, when writing a novel, I want the sidebar always readily available because I need quick access to formatting options. If I'm working on a more traditional document, I might go with the tabbed UI. For spreadsheets, I want the simplest UI that I can use, such as the contextual single UI. LibreOffice makes this possible, with the ability to switch between a standard toolbar, tabbed, single toolbar, sidebar, tabbed compact, groupedbar compact, and contextual single. You can even make changes to different tools, which allows you to have one UI for Writer, one for Calc, and one for Presents. Customizable styles: What I like about this feature is that it allows me to get very granular with the styles, even to the point where I can define what style comes next, how drop caps are handled, transparency, borders, indents & spacing, text flow, font, position, highlights, much more. No AI: (what more needs to be said?) Microsoft Office compatibility: For a while, I was writing everything in Google Docs; that is, until one of my editors complained of incompatibility issues (even when exporting to the .docx format with Docs). Once I switched from Google Docs to LibreOffice (for my fiction writing), those issues all went away. Document export: LibreOffice document export allows you to export your Writer documents to XHTML, PDF, EPUB, MediaWiki, Writer Indexing Export XML, JPEG, Writer Layout XML, PNG, and WEBP. You can also save as ODF, ODF Template, Flat XML, Unified Office Format, Word 2010-365, Word 2007, Word 2007 Template, Word 2003 XML, Rich Text, Word 97-2003, and other types. If there's a format you need, more than likely LibreOffice can export it. ... I can also ask what version of MS Office a collaborator is using and make sure to export it to the most compatible version. Because, you know, even Microsoft Office cannot manage 100% compatibility with Microsoft Office ...

1 0

Resetting USB Controllers After Error
by Lawrence D'Oliveiro 16 Oct '24

16 Oct '24

I was doing my semi-regular backup of some core essential files onto USB sticks today, and hit an error writing to one of the sticks (I replaced it with a spare). However, the error left the USB on my main machine in a strange state: it still thought the bad USB stick was present on the bus, even though it had been removed. And also my USB audio interface stopped working (though thankfully not my mouse or keyboard). I found the “usbreset” utility program. Trying to reset the nonexistent device of course returned an error that it did not exist. It listed three USB hubs, and I thought if I reset the one that the stick had been connected to, that might work. I was able to reset two of the hubs, but it hung on the third one (very likely the source of the problem). And the problem remained unfixed. I thought I was going to have to reboot my machine. Then, after hunting around online, I found this little shell script <https://unix.stackexchange.com/questions/704341/how-to-reset-usb-controllers>, which finds all your USB controller interfaces and tells them to “unbind”, and then “rebind”, all devices attached to each. And that worked! I have my 5.1 USB audio working again! Of course, I can’t guarantee it’ll work for you, if you hit a similar problem, but I figure, how could it hurt to try? ;)

1 0

Juice TV Hiccup
by Lawrence D'Oliveiro 15 Oct '24

15 Oct '24

Currently when I switch to FreeView Channel 200, it shows a frozen image with the text “Cinegy” and “Demo Version” on it. Searching for that name takes me to a site that talks about “software defined television”. Either their product licence has expired, or they never had one in the first place ...

2 3

BBS Pioneer Ward Christensen Has Died
by Lawrence D'Oliveiro 15 Oct '24

15 Oct '24

Ward Christensen, co-inventor of the first computer-based Bulletin Board System, and creator of XMODEM, the first file-transfer protocol designed to work over noisy phone lines (both in the late 1970s), has passed away at the age of 78. He never made a big deal out of his pioneering achievements, and always kept a modest profile in his personal life. <https://arstechnica.com/gadgets/2024/10/ward-christensen-bbs-inventor-and-a…>

1 0

If I Buy Something, Do I Own It?
by Lawrence D'Oliveiro 12 Oct '24

12 Oct '24

For some reason, it was never considered deceptive for shops to advertise themselves as “selling” CDs and tapes and videocassettes and DVDs and video games; if you bothered to ask, you discovered that what you were buying was a “licence” to use the product, not ownership of the product as such. Well, that’s changing, at least in some places. The US state of California has now decreed that not mentioning this distinction between “licence” and “ownership” constitutes false advertising, so vendors had better make it clear <https://arstechnica.com/gaming/2024/10/steam-now-reminds-you-that-it-really…>. In case customers get upset at discovering something they should have realized before, the article ends with the reassuring words: So long as Steam lasts forever, however, this new language should not be that alarming.

1 0

Thousands of Linux systems infected by stealthy malware since 2021
by Peter Reutemann 04 Oct '24

04 Oct '24

'Thousands of machines running Linux have been infected by a malware strain that’s notable for its stealth, the number of misconfigurations it can exploit, and the breadth of malicious activities it can perform, researchers reported Thursday. The malware has been circulating since at least 2021. It gets installed by exploiting more than 20,000 common misconfigurations, a capability that may make millions of machines connected to the Internet potential targets, researchers from Aqua Security said. It can also exploit CVE-2023-33426, a vulnerability with a severity rating of 10 out of 10 that was patched last year in Apache RocketMQ, a messaging and streaming platform that’s found on many Linux machines. Perfctl storm The researchers are calling the malware Perfctl, the name of a malicious component that surreptitiously mines cryptocurrency. The unknown developers of the malware gave the process a name that combines the perf Linux monitoring tool and ctl, an abbreviation commonly used with command line tools. A signature characteristic of Perfctl is its use of process and file names that are identical or similar to those commonly found in Linux environments. The naming convention is one of the many ways the malware attempts to escape notice of infected users. Perfctl further cloaks itself using a host of other tricks. One is that it installs many of its components as rootkits, a special class of malware that hides its presence from the operating system and administrative tools. Other stealth mechanisms include: - Stopping activities that are easy to detect when a new user logs in - Using a Unix socket over TOR for external communications - Deleting its installation binary after execution and running as a background service thereafter - Manipulating the Linux process pcap_loop through a technique known as hooking to prevent admin tools from recording the malicious traffic - Suppressing mesg errors to avoid any visible warnings during execution. The malware is designed to ensure persistence, meaning the ability to remain on the infected machine after reboots or attempts to delete core components. Two such techniques are (1) modifying the ~/.profile script, which sets up the environment during user login so the malware loads ahead of legitimate workloads expected to run on the server and (2) copying itself from memory to multiple disk locations. The hooking of pcap_loop can also provide persistence by allowing malicious activities to continue even after primary payloads are detected and removed. Besides running using the machine resources to mine cryptocurrency, Perfctl also turns the machine into a profit-making proxy that paying customers use to relay their Internet traffic. Aqua Security researchers have also observed the malware serving as a backdoor to install other families of malware.' -- source: https://arstechnica.com/security/2024/10/persistent-stealthy-linux-malware-… Cheers, Peter

1 0

Mozilla Thunderbird Lands On Android With New Beta Release
by Peter Reutemann 02 Oct '24

02 Oct '24

'The popular open-source email client, Mozilla Thunderbird, has just launched a beta version of its Android app. This release, version 8.0b1, is available as a pre-release with a range of new features and improvements. Here are some notable features, improvements and bug fixes in Thunderbird for Android 8.0b1 (beta) version: 1. Thunderbird for Android Branding: This beta release introduces the official Thunderbird for Android branding, moving away from its previous identity as K-9 Mail. 2. Updated Design: Users will immediately notice the updated design language, with a Material 3 navigation drawer and a refreshed colour scheme.It's important to 3. Migration Made Easy: For those already using K-9 Mail or a previous Thunderbird for Android build, migrating settings to the new version is now a seamless process. 4. Under the Hood Improvements: This beta release incorporates the Glean SDK for improved data collection and analysis. Additionally, the groundwork for supporting financial contributions through Google Play subscriptions has been laid. 5. Enhanced Security and Privacy: When encrypting email subjects, the app now uses "[…]" for the outer subject, bolstering privacy. 6. Simplified Settings: The "Move/copy destination folders" and "Folders to search" settings have been removed for a cleaner user experience. 7. Focus on Stability and Performance: Significant refactoring has been done to critical areas such as the message list, accounts, and folders, improving maintainability and performance. Numerous bug fixes also address crashes and other issues. 8. Open Source and Community Driven: Thunderbird for Android remains committed to open-source development, welcoming contributions from the community. The project uses the Apache License, Version 2.0. 9. Known Issues: Be mindful that the settings import feature may display apps that don't yet support it, leading to unsuccessful imports.' -- source: https://ostechnix.com/thunderbird-lands-on-android-with-new-beta-release/ Cheers, Peter

1 0

Mozilla's massive lapse in judgement causes clash with uBlock Origin developer
by Peter Reutemann 02 Oct '24

02 Oct '24

'Software developers who publish their products on third-party stores face all kinds of problems sometimes. From rejected apps or extensions to removed products or unjustified claims about them. Raymond "gorhill" Hill, maker of the world's most popular content blocker uBlock Origin received two emails from Mozilla recently about his Firefox add-on uBlock Origin Lite. Good to know: uBlock Origin Lite is a Manifest V3-compatible version of the content blocker. It is less powerful, but since Google is disabling Manifest V2 support in Chrome, it is what will remain from uBlock Origin for Chromium-based browsers. Mozilla says that it has reviewed the extension and found violations. The following claims were made: - The extension is not asking for consent for data collecting. - The extension contains "minified, concatenated or otherwise machine-generated code". - There is no privacy policy. As a consequence, Mozilla disabled the extension on the Firefox Add-ons Store. Hill refuted all three claims that Mozilla made on the GitHub repository stating that the extension is not collecting any data, that there is no minified code in uBlock Origin Lite, and that there is a privacy policy. He admitted further that he does not "have the time or motivation to spend time on this nonsense" and won't react to the allegations made or appeal the decision.' -- source: https://www.ghacks.net/2024/10/01/mozillas-massive-lapse-in-judgement-cause… Cheers, Peter

1 0

I'm using Windows at the moment: what's keeping me back
by Ben Cottrell 01 Oct '24

01 Oct '24

Hi, I'm using Windows 11 on my Lenovo ThinkBook 16p Gen 2, with an NVIDIA GeForce RTX 3060, and an AMD Ryzen 5600H (with integrated Radeon graphics). In the past I've distro hopped, and here were my experiences. I've stuck with Windows because NVIDIA has still not fully committed to supporting the standards needed for Wayland. OpenSUSE Tumbleweed: The first distro that properly worked with UEFI secure booting, in terms of enrolling keys. NVIDIA's drivers would not be loaded by the kernel unless the keys were enrolled. Ubuntu: Good default GTK theme. Good beginner distro. Installing NVIDIA drivers is a little easier than OpenSUSE. NixOS: Cutting edge, and allowed me to run certain applications to run with GPU acceleration. Easy to rollback system wide changes, but I couldn't really grasp their config language. I'm not sure if the issue is down to an insufficient allocation of staff by NVIDIA, or if there's a conflict of interest with Microsoft. Cheers, Ben

1 0

How to display network traffic in the terminal?
by Peter Reutemann 01 Oct '24

01 Oct '24

Was just wondering that myself and came across the following askubuntu Q&A: https://askubuntu.com/questions/257263/how-to-display-network-traffic-in-th… Tools mentioned: bmon slurm tcptrack iftop nethogs speedometer iptraf Quite a few that I hadn't heard of. :-) Cheers, Peter

2 1