February 2024 - wlug - list.wlug.org.nz

Tumblr and Wordpress Are Preparing To Sell User Data To OpenAI and Midjourney, Report Says
by Peter Reutemann 28 Feb '24

28 Feb '24

'Tumblr and Wordpress are preparing to sell user data to Midjourney and OpenAI, 404Media reported Tuesday, citing a source with internal knowledge about the deals and internal documents. From the report: The exact types of data from each platform going to each company are not spelled out in documentation we've reviewed, but internal communications reviewed by 404 Media make clear that deals between Automattic, the platforms' parent company, and OpenAI and Midjourney are imminent. The internal documentation details a messy and controversial process within Tumblr itself. One internal post made by Cyle Gage, a product manager at Tumblr, states that a query made to prepare data for OpenAI and Midjourney compiled a huge number of user posts that it wasn't supposed to. It is not clear from Gage's post whether this data has already been sent to OpenAI and Midjourney, or whether Gage was detailing a process for scrubbing the data before it was to be sent. ' -- source: https://news.slashdot.org/story/24/02/27/191230 Now's the time to move from hosted to self-hosted Wordpress instances, I guess... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

US Government Demands Memory-Safe Programming Languages
by Lawrence D'Oliveiro 28 Feb '24

28 Feb '24

The US Office of the National Cyber Director has put out a report on “a path towards secure and measurable software” <https://devclass.com/2024/02/27/white-house-demands-memory-safe-programming…>. It talks a lot about memory safety, including hardware techniques such as the old “capabilities” idea being resurrected in the CHERI project. And the Rust Foundation has chimed in with some comments about use of their language which is specifically designed to enforce memory safety. But a group of C++ fans has counterclaimed that memory safety is only “a very small part of security”, and that “C++ benefits from having a formal specification, a fully-specified memory model, and an active community of users and implementers”, and that education can improve the quality of code written in C and C++. It also tries to imply that Rust is somehow less desirable because it lacks a formal specification.

1 0

Is Windows 64-Bit Yet?
by Lawrence D'Oliveiro 27 Feb '24

27 Feb '24

Given that 64-bit Windows has been shipping for so long, you would think most Windows software, particularly Microsoft’s own software, would have made the transition from 32-bit long ago. After all, on a typical 64-bit Linux system, everything is 64-bit, and has been that way since the early days. So I was mildly surprised to discover that Visual Studio only became 64-bit in November 2021. And today I am even more surprised to discover that the change broke its own Windows Forms framework, and a fix is still not available to this day <https://devclass.com/2024/02/26/microsoft-struggles-to-address-fallout-from…>.

1 0

The State Of IoT
by Lawrence D'Oliveiro 23 Feb '24

23 Feb '24

This backflip from Microsoft <https://www.theregister.com/2024/02/21/microsoft_azure_iot_central/> retracting an earlier announcement that seemingly undermined a major part of its “Internet-of-Things” efforts seems to do little to clear the confusion. I found this part of the report quite revealing: The insider also pointed out that vendors struggle to produce value for organizations developing and deploying IoT applications. While the industry underestimated the scale of the challenge in connecting thousands of sensors, each of which could generate 86,400 values per day, it also failed to form a commercial model that worked for everyone. Vendors were focused only on owning the platform and were reluctant to build applications on anyone else's, creating a stalemate, the insider said. Meanwhile, the “maker” movement continues on its merry way, building its applications and toolkits on (and for) open-source platforms like the Raspberry Pi and Arduino, while completely failing to spend billions of dollars on proprietary products. And the proprietary companies can do nothing but search desperately for some lever that will give them that valuable vendor lock-in, but all they can achieve is wrestle each other to a stalemate. Me, I consider that a win-win situation. ;)

1 0

Linux Becomes a CVE Numbering Authority (Like Curl and Python). Is This a Turning Point?
by Peter Reutemann 19 Feb '24

19 Feb '24

'From a blog post by Greg Kroah-Hartman: As was recently announced, the Linux kernel project has been accepted as a CVE Numbering Authority (CNA) for vulnerabilities found in Linux. This is a trend, of more open source projects taking over the haphazard assignments of CVEs against their project by becoming a CNA so that no other group can assign CVEs without their involvment. Here's the curl project doing much the same thing for the same reasons. I'd like to point out the great work that the Python project has done in supporting this effort, and the OpenSSF project also encouraging it and providing documentation and help for open source projects to accomplish this. I'd also like to thank the cve.org group and board as they all made the application process very smooth for us and provided loads of help in making this all possible. As many of you all know, I have talked a lot about CVEs in the past, and yes, I think the system overall is broken in many ways, but this change is a way for us to take more responsibility for this, and hopefully make the process better over time. It's also work that it looks like all open source projects might be mandated to do with the recent rules and laws being enacted in different parts of the world, so having this in place with the kernel will allow us to notify all sorts of different CNA-like organizations if needed in the future. Kroah-Hartman links to his post on the kernel mailing list for "more details about how this is all going to work for the kernel." [D]ue to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team are overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team... No CVEs will be assigned for unfixed security issues in the Linux kernel, assignment will only happen after a fix is available as it can be properly tracked that way by the git commit id of the original fix. No CVEs will be assigned for any issue found in a version of the kernel that is not currently being actively supported by the Stable/LTS kernel team. alanw (Slashdot reader #1,822) worries this could overwhelm the CVE infrastructure, pointing to an ongoing discussion at LWN.net. But reached for a comment, Greg Kroah-Hartman thinks there's been a misunderstanding. He told Slashdot that the CVE group "explicitly asked for this as part of our application... so if they are comfortable with it, why is no one else?"' -- source: https://linux.slashdot.org/story/24/02/17/1811258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nginx core developer quits project in security dispute, starts “freenginx” fork
by Peter Reutemann 16 Feb '24

16 Feb '24

'A core developer of Nginx, currently the world's most popular web server, has quit the project, stating that he no longer sees it as "a free and open source project… for the public good." His fork, freenginx, is "going to be run by developers, and not corporate entities," writes Maxim Dounin, and will be "free from arbitrary corporate actions." Dounin is one of the earliest and still most active coders on the open source Nginx project and one of the first employees of Nginx, Inc., a company created in 2011 to commercially support the steadily growing web server. Nginx is now used on roughly one-third of the world's web servers, ahead of Apache. Nginx Inc. was acquired by Seattle-based networking firm F5 in 2019. Later that year, two of Nginx's leaders, Maxim Konovalov and Igor Sysoev, were detained and interrogated in their homes by armed Russian state agents. Sysoev's former employer, Internet firm Rambler, claimed that it owned the rights to Nginx's source code, as it was developed during Sysoev's tenure at Rambler (where Dounin also worked). While the criminal charges and rights do not appear to have materialized, the implications of a Russian company's intrusion into a popular open source piece of the web's infrastructure caused some alarm. Sysoev left F5 and the Nginx project in early 2022. Later that year, due to the Russian invasion of Ukraine, F5 discontinued all operations in Russia. Some Nginx developers still in Russia formed Angie, developed in large part to support Nginx users in Russia. Dounin technically stopped working for F5 at that point, too, but maintained his role in Nginx "as a volunteer," according to Dounin's mailing list post. Dounin writes in his announcement that "new non-technical management" at F5 "recently decided that they know better how to run open source projects. In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers' position." While it was "quite understandable," given their ownership, Dounin wrote that it means he was "no longer able to control which changes are made in nginx," hence his departure and fork.' -- source: https://arstechnica.com/information-technology/2024/02/nginx-key-developer-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Asahi Linux Project's OpenGL Support On Apple Silicon Officially Surpasses Apple's
by Peter Reutemann 16 Feb '24

16 Feb '24

'Andrew Cunningham reports via Ars Technica: For around three years now, the team of independent developers behind the Asahi Linux project has worked to support Linux on Apple Silicon Macs, despite Apple's total lack of involvement. Over the years, the project has gone from a "highly unstable experiment" to a "surprisingly functional and usable desktop operating system." Even Linus Torvalds has used it to run Linux on Apple's hardware. The team has been steadily improving its open source, standards-conformant GPU driver for the M1 and M2 since releasing them in December 2022, and today, the team crossed an important symbolic milestone: The Asahi driver's support for the OpenGL and OpenGL ES graphics have officially passed what Apple offers in macOS. The team's latest graphics driver fully conforms with OpenGL version 4.6 and OpenGL ES version 3.2, the most recent version of either API. Apple's support in macOS tops out at OpenGL 4.1, announced in July 2010. Developer Alyssa Rosenzweig wrote a detailed blog post that announced the new driver, which had to pass "over 100,000 tests" to be deemed officially conformant. The team achieved this milestone despite the fact that Apple's GPUs don't support some features that would have made implementing these APIs more straightforward. "Regrettably, the M1 doesn't map well to any graphics standard newer than OpenGL ES 3.1," writes Rosenzweig. "While Vulkan makes some of these features optional, the missing features are required to layer DirectX and OpenGL on top. No existing solution on M1 gets past the OpenGL 4.1 feature set... Without hardware support, new features need new tricks. Geometry shaders, tessellation, and transform feedback become compute shaders. Cull distance becomes a transformed interpolated value. Clip control becomes a vertex shader epilogue. The list goes on." Now that the Asahi GPU driver supports the latest OpenGL and OpenGL ES standards -- released in 2017 and 2015, respectively -- the work turns to supporting the low-overhead Vulkan API on Apple's hardware. Vulkan support in macOS is limited to translation layers like MoltenVK, which translates Vulkan API calls to Metal ones that the hardware and OS can understand. [...] Rosenzweig's blog post didn't give any specific updates on Vulkan except to say that the team was "well on the road" to supporting it. In addition to supporting native Linux apps, supporting more graphics APIs in Asahi will allow the operating system to take better advantage of software like Valve's Proton, which already has a few games written for x86-based Windows PCs running on Arm-based Apple hardware. ' -- source: https://linux.slashdot.org/story/24/02/15/021216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Maker Mozilla Is Cutting 60 Jobs After Naming New CEO
by Peter Reutemann 14 Feb '24

14 Feb '24

'Less than a week after naming Laura Chambers as interim CEO, Firefox's maker Mozilla said it is cutting about 60 jobs, or 5% of its workforce. The cuts are primarily in the product development organization. Bloomberg reports: "We're scaling back investment in some product areas in order to focus on areas that we feel have the greatest chance of success," Mozilla said in a statement. "We intend to re-prioritize resources against products like Firefox Mobile, where there's a significant opportunity to grow and establish a better model for the industry." Mozilla last cut a significant number of jobs four years ago at the height of the Covid-19 pandemic. The not-for-profit company, which competes with Alphabet Inc.'s Google Chrome, Apple Inc.'s Safari and Microsoft Corp.'s Edge, has been grappling with sliding market share of its Firefox web browser in recent years. So far in 2024, the tech sector has cut 32,000 jobs. ' -- source: https://news.slashdot.org/story/24/02/13/2137254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HPC Wiki
by Lawrence D'Oliveiro 14 Feb '24

14 Feb '24

Recently discovered this site <https://hpc-wiki.info/hpc/HPC_Wiki>, which gives some useful introductory info to those wanting to learn how to program a supercomputer (or just curious about the process). For example, here <https://hpc-wiki.info/hpc/MPI> is an intro to one parallelization architecture, called MPI, and here <https://hpc-wiki.info/hpc/OpenMP> is an intro to another one, called OpenMP. Note the examples are given in C and Fortran, and both rely heavily on preprocessors/compiler plugins in order to generate the right code. Yes, Fortran is still in heavy use, it seems. And if you learned your Fortran before the 1990s (as I did), you may not even recognize it as the same language.

1 0

'Damn Small Linux' is Back - But Bigger
by Peter Reutemann 13 Feb '24

13 Feb '24

'Back in 2006 Slashdot reported on a 50-megabyte "micro" distro called Damn Small Linux. (And in 2012 we wrote that it "rose from the dead" with a new release candidate.) Now Damn Small Linux has been reborn again, according to its developer's web site: Creating the original DSL, a versatile 50MB distribution, was a lot of fun and one of the things I am most proud of as a personal accomplishment. However, as a concept, it was in the right place at the right time, and the computer industry has changed a lot since then. While it would be possible to make a bootable Xwindows 50MB distribution today, it would be missing many drivers and have only a handful of very rudimentary applications. People would find such a distribution a fun toy or something to build upon, but it would not be usable for the average computer user out of the gate.... The new goal of DSL is to pack as much usable desktop distribution into an image small enough to fit on a single CD, or a hard limit of 700MB. This project is meant to service older computers and have them continue to be useful far into the future. Such a notion sits well with my values. I think of this project as my way of keeping otherwise usable hardware out of landfills. As with most things in the GNU/Linux community, this project continues to stand on the shoulders of giants. I am just one guy without a CS degree, so for now, this project is based on antiX 23 i386... a fantastic distribution that I think shares much of the same spirit as the original DSL project. AntiX shares pedigree with MEPIS and also leans heavily on the geniuses at Debian. The blog It's FOSS News describes it as "a unique experience in a sea of Debian-based and Fedora-based distros." It is offered with two window managers, Fluxbox and JWM, with apt being fully enabled by default for easy package installations... At the time of writing, only the Alpha ISOs were made available on the official downloads page. It is only a matter of time before we get a stable release.' -- source: https://linux.slashdot.org/story/24/02/11/2049252 I actually used DSL back in the day... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1