March 2024 - wlug - list.wlug.org.nz

Mozilla Ends its Privacy-Friendly GPS-Style Location Service
by Peter Reutemann 18 Mar '24

18 Mar '24

'Mozilla Location Service offered "a free, open way to offer GPS-style location detection features" for developers on devices without GPS hardware, remembers the Linux blog OMG Ubuntu. It used signals like Wi-Fi access points and Bluetooth beacons "without any of the privacy implications most competing geolocation services have." But Friday they reported that Mozilla "has announced it is ending access to Mozilla Location Service (MLS), which provides accurate, privacy-respecting, and crowdsourced geolocation data." Developers and 3rd-party projects that use MLS to detect a users' location, such as the freedesktop.org location framework GeoClue, which is used by apps like GNOME Maps and Weather, have only a few months left to continue using the service... In late March, POST data submissions will return 403 responses. Finally, on June 12, all 3rd-party API keys will be removed and MLS data only accessible by Mozilla... MLS' accuracy has declined in recent years. Patent infringement claims in 2019 saw Mozilla reach a settlement to avoid litigation. As part of that settlement it was forced to make changes to MLS that impacted its ability to invest in (commercially exploit?) and improve the service. The article notes that GeoClue "already supports multiple location detection methods, including IP-based ones," so it should continue operating. "But the sad reality is that there just aren't a lot of free, open, privacy-friendly, accurate, and (rather importantly for a framework built in to Linux desktops) reliable alternatives to Mozilla Location Services, which has built up a colossal 'signal map' from which to pinpoint locations." "We are grateful for the contributions of the community to MLS to both the code and the dataset," a Mozilla senior engineering manager said in a statement.' -- source: https://tech.slashdot.org/story/24/03/17/2150221/mozilla-ends-its-privacy-f… I wasn't even aware that Mozilla was offering such a service... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

1986 Presentation On Setting A Computer’s Clock Correctly
by Lawrence D'Oliveiro 18 Mar '24

18 Mar '24

One of the recent additions to the Bitsavers vintage computing collection is this presentation from 1986 <http://bitsavers.trailing-edge.com/pdf/ibm/share/SHARE67_Presentation_on_Se…> at a session of SHARE (one of the IBM user groups), on how to ensure your computer’s time is set correctly. Remember, this was before NTP. But there was already a worldwide network of atomic clocks, keeping synchronization with each other, and there were shortwave stations, like WWV in Boulder, Colorado, that would broadcast pips once per second, synchronized to the atomic clock network. And there were even consumer-level gadgets, like the one mentioned in the article from Heath, that would automatically decode those broadcasts and output a time code a computer could read. The article has some nice background info. Like did you know there can be up to a 1-second discrepancy between GMT and UTC? (Actually I think from other sources the limit might be more like 0.9 seconds.) IBM’s mainframe OS developers were perceptive enough to realize that it can be useful to have the computer keep time in GMT, and maintain an offset for calculating local time. Particular site admins could of course have the choice of using local time for the system time, and setting the offset to zero. Changing the offset for daylight saving could be a fraught procedure, though. The level of confusion it could cause for running applications was such that it was safer to do a reboot. One little item I don’t recall coming across before, another of those NASA programming screwups: One of the famous programming mistakes of all time was by the programmer who thought the earth revolved on its axis once every 24 hours and used that fact to calculate landing sites for the Mercury space flights. Our first astronauts spent a lot more time in the water than they should have because of that.

1 0

Free/Libre 'GnuCOBOL' Compiler Reaches Maturity, Can Compete with Proprietary Offerings
by Peter Reutemann 18 Mar '24

18 Mar '24

'After 20 years of development, the open source GnuCOBOL "has reached an industrial maturity and can compete with proprietary offers in all environments," said OCamlPro founder and GnuCOBOL contributor Fabrice Le Fessant, in a FOSDEM talk about the technology. GnuCOBOL turns COBOL source code into executable applications. It is very cross-platform, running Linux, BSD, many proprietary Unixes, macOS, and Windows, even Android. And the latest version, v.32, is being used in many commercial settings... Sobisch noted that the GnuCOBOL is seeing a lot of commercial deployments, such as for banking back-end apps, many of which are being migrated from Micro Focus, with users reporting performance improvements as a result. The French DGFIP federal agency moved from a GCOS mainframe to GnuCOBOL, with the help of Le Fessant's firm. Originally called OpenCOBOL, the project was started in 2002 and renamed GnuCOBOL in 2013. In the past three years, it has received attention from 13 contributors with 460 commits. Most Linux package managers have a copy of GnuCOBOL for the program for downloading... It can compile to C code (C89+), making it extremely portable, from mainframes to Raspberry Pi's, Sobisch said... Also new is SuperBOL, a development studio for GnuCOBOL developed by Le Fessant's OCamlPro. It runs as a VSCode Extension and features a full COBOL processor (written in OCaml). ' -- source: https://developers.slashdot.org/story/24/03/17/1810257 Anything COBOL related takes time, I guess... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Raspberry Pi OS Is Now Powered by Linux 6.6 LTS, Improves Raspberry Pi 5 Support
by Peter Reutemann 15 Mar '24

15 Mar '24

'The Raspberry Pi Foundation released today a new build of their Debian-based Raspberry Pi OS operating for the Raspberry Pi single-board computers adding a new kernel from the Linux 6.6 long-term supported series, updated components, and various improvements. While still based on the latest Debian GNU/Linux 12 “Bookworm” operating system series, Raspberry Pi OS is now powered by the Linux 6.6 LTS kernel series, which is a major upgrade from Linux kernel 6.1 LTS used in previous releases. This update also includes the latest Chromium 122 and Mozilla Firefox 123 web browsers. The new Raspberry Pi OS release offers better support for the latest Raspberry Pi 5 SBC by improving the handling of the power button. In addition, it also adds new settings for headless resolution to the Screen Configuration, while removing the setting of headless resolution for Wayland from Raspberry Pi Configuration.' -- source: https://9to5linux.com/raspberry-pi-os-is-now-powered-by-linux-6-6-lts-impro… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Never-before-seen Linux malware gets installed using 1-day exploits
by Peter Reutemann 12 Mar '24

12 Mar '24

'Researchers have unearthed Linux malware that circulated in the wild for at least two years before being identified as a credential stealer that’s installed by the exploitation of recently patched vulnerabilities. The newly identified malware is a Linux variant of NerbianRAT, a remote access Trojan first described in 2022 by researchers at security firm Proofpoint. Last Friday, Checkpoint Research revealed that the Linux version has existed since at least the same year, when it was uploaded to the VirusTotal malware identification site. Checkpoint went on to conclude that Magnet Goblin—the name the security firm uses to track the financially motivated threat actor using the malware—has installed it by exploiting “1-days,” which are recently patched vulnerabilities. Attackers in this scenario reverse engineer security updates, or copy associated proof-of-concept exploits, for use against devices that have yet to install the patches. Checkpoint also identified MiniNerbian, a smaller version of NerbianRAT for Linux that’s used to backdoor servers running the Magento ecommerce server, primarily for use as command and control servers that devices infected by NerbianRAT connect to. Researchers elsewhere have reported encountering servers that appear to have been compromised with MiniNerbian, but Checkpoint Research appears to have been the first to identify the underlying binary.' -- source: https://arstechnica.com/security/2024/03/never-before-seen-linux-malware-ge… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.9 Will Be the First To Top 10 Million Git Objects
by Peter Reutemann 12 Mar '24

12 Mar '24

'Linus Torvalds has released version 6.8 of the Linux Kernel. "So it took a bit longer for the commit counts to come down this release than I tend to prefer," Torvalds wrote on the Linx kernel mailing list on Sunday, "but a lot of that seemed to be about various selftest updates (networking in particular) rather than any actual real sign of problems." "And the last two weeks have been pretty quiet, so I feel there's no real reason to delay 6.8." So he delivered it, ending his own speculation that this cut of the kernel might need an eighth release candidate. Torvalds found time to note what he described as "a bit of random git numerology" as when work ended on this version of the kernel the git repository used to track it contained 9.996 million objects." "This is the last mainline kernel to have less than ten million git objects," Torvalds wrote. "Of course, there is absolutely nothing special about it apart from a nice round number. Git doesn't care," he added. Fair enough -- especially as noted that other trees, such as linux-next, have well and truly passed ten million objects.' -- source: https://linux.slashdot.org/story/24/03/11/1620223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Do Scientists Take Backups?
by Lawrence D'Oliveiro 11 Mar '24

11 Mar '24

Martin Eve, who works at Crossref, which manages the DOI system which tries to offer permanent online links to scientific publications and other digital documents, decided to do a survey of those links, to see how many of them would still actually resolve. The results were less than reassuring <https://arstechnica.com/science/2024/03/study-finds-that-we-could-lose-scie…>. If/when a publisher goes bankrupt, what happens to their online archives? Do researchers who submit papers keep backup copies of their papers?

3 6

It’s A Raspberry Pi!
by Lawrence D'Oliveiro 08 Mar '24

08 Mar '24

Was anybody watching Channel 200 (Juice TV) a minute ago? There was a lovely Linux text screen with a shell prompt saying the machine name was “pberrypi”.

1 1

“We Had To Educate Oracle About Our Contract”
by Lawrence D'Oliveiro 08 Mar '24

08 Mar '24

Slightly chilling words to hear, don’t you think? Corporations that do volume deals with proprietary suppliers like Oracle and SAP have to agree to allow periodic audits by the vendor to ensure they are complying with the licence terms. Vendors have been known to try to pull a fast one during these audits. This customer <https://www.theregister.com/2024/03/06/oracle_audits/> mentions that Oracle, in particular, had a tendency to assume the software was licensed under their current terms, when in fact the contract was agreed under quite different, older terms. Hence the need to keep “educating” (i.e. reminding) the vendor about what the correct criteria were.

1 0

Fedora Workstation 41 To No Longer Install GNOME X.Org Session By Default
by Peter Reutemann 08 Mar '24

08 Mar '24

'Michael Larabel writes via Phoronix: Fedora Workstation has long defaulted to using GNOME's Wayland session by default, but it has continued to install the GNOME X.Org session for fallback purposes or those opting to use it instead. But for the Fedora Workstation 41 release later in the year, there is a newly-approved plan to no longer have that GNOME X.Org session installed by default. Recently there was a Fedora Workstation ticket opened to no longer install the GNOME X.Org session by default. This is just about whether the X.Org session is pre-installed but would continue to live in the repository for those wanting to explicitly install it. The Fedora Workstation working group decided to go ahead with this change for the Fedora 41 cycle, not the upcoming Fedora 40 release. So pending any obstacles by FESCo, which is unlikely. Fedora Workstation 41 will not be installing the GNOME X.Org session by default. Long live Wayland.' -- source: https://news.slashdot.org/story/24/03/07/2157258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0