July 2024 - wlug - list.wlug.org.nz

Debian Curl Now Supports HTTP3: What You Need To Know
by Peter Reutemann 09 Jul '24

09 Jul '24

'Good news for Debian users! HTTP3 arrives in Debian Curl. Yes, starting with curl 8.0.0-2, Debian users can now utilize HTTP3. This marks a significant upgrade in the capabilities of curl, enhancing its performance and efficiency in handling web communications. This new feature can be easily tested using the --http3-only flag.' -- source: https://ostechnix.com/debian-curl-supports-http3/ Cheers, Peter

2 1

No more boot loader: Please use the kernel instead
by Peter Reutemann 09 Jul '24

09 Jul '24

'We are working on a new scheme to replace the GRUB bootloader with a fast, secure, Linux-based, user-space solution: nmbl (for no more boot loader). Most people are familiar with GRUB, a powerful, flexible, fully-featured bootloader that is used on multiple architectures (x86_64, aarch64, ppc64le OpenFirmware). Although GRUB is quite versatile and capable, its features create complexity that is difficult to maintain, and that both duplicate and lag behind the Linux kernel while also creating numerous security holes. On the other hand, the Linux kernel, which has a large developer base, benefits from fast feature development, quick responses to vulnerabilities and greater overall scrutiny. We (Red Hat boot loader engineering) will present our solution to this problem, which is to use the Linux kernel as its own bootloader. Loaded by the EFI stub on UEFI, and packed into a unified kernel image (UKI), the kernel, initramfs, and kernel command line, contain everything they need to reach the final boot target. All necessary drivers, filesystem support, and networking are already built in and code duplication is avoided. We will showcase the work done so far, and ask you for your feedback and use cases.' -- source: https://pretalx.com/devconf-cz-2024/talk/W3AVCT/ -- video: https://www.youtube.com/watch?v=ywrSDLp926M Cheers, Peter

1 0

FreeBSD Contributor Mocks Gloomy Predictions for the Open Source Movement
by Peter Reutemann 08 Jul '24

08 Jul '24

'In Communications of the ACM,/em>, long-time FreeBSD contributor Poul-Henning Kamp mocks the idea that the free and open-source software has "come apart" and "will end in tears and regret." Economists and others focused on money — like my bank — have had a lot of trouble figuring out the free and open source software (FOSS) phenomenon, and eventually they seem to have reached the conclusion that it just makes no sense. So, they go with the flow. Recently, very serious people in the FOSS movement have started to write long and thoughtful opinion pieces about how it has all come apart and will end in tears and regret. Allow me to disagree... What follows is a humorous history of how the Open Source movement bested a series of ill-conceived marketing failures starting after the "utterly bad" 1980s when IBM had an "unimaginably huge monopoly" — and an era of vendor lock-in from companies trying to be the next IBM: Out of that utter market failure came Minix, (Net/Free/Open)BSD, and Linux, at a median year of approximately 1991. I can absolutely guarantee that if we had been able to buy a reasonably priced and solid Unix for our 32-bit PCs — no strings attached — nobody would be running FreeBSD or Linux today, except possibly as an obscure hobby. Bill Gates would also have had a lot less of our money... The essay moves on to when "that dot-com thing happened, fueled by the availability of FOSS operating systems, which did a much better job than any operating system you could buy — not just for the price, but in absolute terms of performance on any given piece of hardware. Thus, out of utter market failure, the FOSS movement was born." And ultimately, the essay ends with our present day, and the phenomenon of companies that "make a business out of FOSS or derivatives thereof..." The "F" in FOSS was never silent. In retrospect, it seems clear that open source was not so much the goal itself as a means to an end, which is freedom: freedom to fix broken things, freedom from people who thought they could clutch the source code tightly and wield our ignorance of it as a weapon to force us all to pay for and run Windows Vista. But the FOSS movement has won what it wanted, and no matter how much oldsters dream about their glorious days as young revolutionaries, it is not coming back; the frustrations and anger of IT in 2024 are entirely different from those of 1991. One very big difference is that more people have realized that source code is a liability rather than an asset. For some, that realization came creeping along the path from young teenage FOSS activists in the late 1990s to CIOs of BigCorp today. For most of us, I expect, it was the increasingly crushing workload of maintaining legacy code bases...' -- source: https://news.slashdot.org/story/24/07/07/0243241 Cheers, Peter

1 0

“RegreSSHion” vulnerability in OpenSSH gives attackers root on Linux
by Peter Reutemann 03 Jul '24

03 Jul '24

'Researchers have warned of a critical vulnerability affecting the OpenSSH networking utility that can be exploited to give attackers complete control of Linux and Unix servers with no authentication required. The vulnerability, tracked as CVE-2024-6387, allows unauthenticated remote code execution with root system rights on Linux systems that are based on glibc, an open source implementation of the C standard library. The vulnerability is the result of a code regression introduced in 2020 that reintroduced CVE-2006-5051, a vulnerability that was fixed in 2006. With thousands, if not millions, of vulnerable servers populating the Internet, this latest vulnerability could pose a significant risk. [...] The vulnerability affects the following: - OpenSSH versions earlier than 4.4p1 are vulnerable to this signal handler race condition unless they are patched for CVE-2006-5051 and CVE-2008-4109. - Versions from 4.4p1 up to, but not including, 8.5p1 are not vulnerable due to a transformative patch for CVE-2006-5051, which made a previously unsafe function secure. - The vulnerability resurfaces in versions from 8.5p1 up to, but not including, 9.8p1 due to the accidental removal of a critical component in a function.' -- source: https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-opens… OpenSSH 9.8 was released July 1st: https://www.openssh.com/ Cheers, Peter

1 0

Made Move To Wayland
by Lawrence D'Oliveiro 01 Jul '24

01 Jul '24

I’d been running Wayland OK on my laptop for some months now, but I held off putting it on my main machine for one reason: when I logged into a Wayland session, Emacs would not recognize my Compose key (which I have set to Caps Lock). Today I finally figured out I have to install the “emacs-pgtk” package instead of “emacs-gtk”; the former is built with a version of GTK that works with Wayland. And yes, my Compose key works again. Still have to get used to slightly different input behaviour: previously, once I hit Compose, nothing would appear until I finished the whole key sequence. Now it echoes each keystroke immediately as I type it, in place, overwriting the previous echo (starting with an underline for the Compose key itself), then when I have typed the last key, it overwrites the echo area with the final character.

2 6