September 2024 - wlug - list.wlug.org.nz

As Companies Try 'Open Source Rug Pull', Open Source Foundations Considered Helpful
by Peter Reutemann 22 Sep '24

22 Sep '24

'"In the era of the open source rug pull, the role of open source foundations is more important than ever," argues the co-founder of the developer-focused industry analyst firm RedMonk: The "rug pull" here refers to companies that have used open source as a distribution mechanism, building a community and user base, before changing the license to be restricted, rather than truly open source. "This is capitalism, yo. We've got shareholders to satisfy. It's time to relicense that software, move to a Business Source license." [...] Where open source used to be a sustainable commitment, today too often it feels like a short term tactic. Commercial open source isn't what it used to be. Which means that open source foundations, which provide ongoing governance and intellectual property management for open source projects, are in an interesting position, in some cases becoming more adversarial than they historically have been with vendors.... [T]he Apache Software Foundation (ASF) has done a great job of fostering sustainable, commercial, open source for decades now, most notably in the data infrastructure space — think Hadoop, Spark, Kafka, Flink etc. ["[C]ommercial open source would almost certainly never have achieved critical mass and continued success without foundations in the mix," the article notes later. "The ASF was founded in 1999, and underpinned the adoption of open source middleware in the enterprise..."] One premise behind the Cloud Native Computing Foundation (CNCF) is that user organisations can within reason trust it to stand behind the projects it incubates and manages. While not an explicit commitment, adopters generally, and enterprises specifically, have seen the CNCF imprimatur as one that they can rely on. In the era of the open source rug pull this kind of promise becomes even more important.... Sid Sijbrandij, CEO of GitLab has argued that open source companies should commit to an Open Charter as a mechanism to protect users from open source rug pulls. "Open source software isn't useful if people can't rely on the project remaining open source. Adopting Open Charter offers open source users predictability amidst the growing licensing switch trend." With a CNCF project, though, the need for this kind of charter becomes less important, because the code is by design not single source, but has a diverse set of contributors. Which is to say that open source foundations can make rug pulls a lot less likely than adoption of open source technology built by a single company. Relying on benevolent dictators is generally pretty risky. And recently the benevolent dictators have seemed... less benevolent. In conclusion, "Open Source Foundations Considered Helpful," according to the post's title. It does argue that "Any company is within its rights to relicense its software, but it can certainly be problematic from a community and project health perspective. "Which is exactly why open source foundations are more important than ever."' -- source: https://news.slashdot.org/story/24/09/21/0530234 Cheers, Peter

1 0

List Of IPTV Resources
by Lawrence D'Oliveiro 22 Sep '24

22 Sep '24

This user <https://github.com/iptv-org> just popped up in my GitHub feed. One repo <https://github.com/iptv-org/iptv> claims to be a list of links to over 8000 streaming TV channels from nations all over the world, while the other is a list of tools*, providers and other resources. Do be aware it’s a bit of a mixed bag: yes, there are legitimate channels (no encryption so far that I have noticed), but also some dubious-looking links. *Oddly, FFmpeg and youtube-dl aren’t in the list.

2 5

Trying Out IPv6
by Lawrence D'Oliveiro 19 Sep '24

19 Sep '24

My new ISP supports IPv6, and I’ve been doing a few tentative tests with it. I actually disabled the DHCPv6 support in my router, and manually configured an address in the ISP-delegated range into my main machine, just for testing. And now I’ve discovered that my other Linux machines have picked up addresses in the delegated range as well, all by themselves! Turns out this is through a mechanism called “SLAAC” (“Stateless Address Autoconfiguration”). My main worry was that, since IPv6 allows direct connections without needing NAT, that internal machines with IPv6 addresses would be directly visible on the Internet. But checking with an external IPv6 ping site seems to show this is not the case: my router is blocking incoming attempts to access nodes on IPv6 addresses by default. The router responds to pings on its own IPv6 address from the public Internet, of course; but other allocated addresses in the range do not respond. Here is a site <https://test-ipv6.com/> I found to test your IPv6 connectivity. It also gives details of the tests it runs, and a handy list of some random places you can access via IPv6.

1 0

Real-Time Linux Is Now Mainstream
by Lawrence D'Oliveiro 19 Sep '24

19 Sep '24

The PREEMPT_RT patches (aka “Real-Time Linux”) originated as a set of out-of-tree mods to the Linux kernel about 20 years ago. Bit by bit, over time, various parts of them have been incorporated into the mainline code. Some of these patches have found uses in, shall we say, more mainstream application areas. And beginning with kernel version 6.12, the last of those out-of-tree patches have been merged, and the out-of-tree PREEMPT_RT patchset is no more. This article <https://www.zdnet.com/article/20-years-later-real-time-linux-makes-it-to-th…> by long-time Linux fan Steven J Vaughan-Nichols, gives some background. Including the fact that musicians have been using Linux for audio work for decades, because Linux with the real-time patches was the cheapest way of recording pro-quality audio, much cheaper than buying “real” pro audio gear.

1 0

Use oathtool Linux command line for 2 step verification (2FA)
by Peter Reutemann 18 Sep '24

18 Sep '24

Hi everyone With 2FA now being commonplace, I've mainly relied on Google's Authenticator or the MS equivalent. However, today I came across this tutorial on how to use the oathtool CLI tool to achieve the same: https://www.cyberciti.biz/faq/use-oathtool-linux-command-line-for-2-step-ve… Originally, I came across the tutorial on my Mastodon feed: https://mastodon.social/@nixCraft/113154210830716246 Cheers, Peter

1 0

Is Your Windows Licence Legal?
by Lawrence D'Oliveiro 18 Sep '24

18 Sep '24

How do you know your Windows-running PC is running a legitimately-licensed copy of Windows? It seems you can’t: <https://www.zdnet.com/article/is-your-windows-license-legal-should-you-even…>. The article says “You almost certainly have a valid Windows license if you acquired it in ...” and goes on to list the usual ways that users obtain their copies. But note that “almost”: there is nothing you end up with -- no document or artifact or anything else -- that definitively says your copy of Windows is genuine. The final decision always goes back to Microsoft: if they decide not to sue you, then your copy is probably legit.

1 0

Chrome Switching To NIST-Approved ML-KEM Quantum Encryption
by Peter Reutemann 18 Sep '24

18 Sep '24

'Google is updating the post-quantum cryptography in Chrome, replacing the experimental Kyber with the fully standardized Module Lattice Key Encapsulation Mechanism (ML-KEM) to enhance protection against quantum computing attacks. BleepingComputer reports: This change comes roughly five months after Google rolled out the post-quantum secure TLS key encapsulation system on Chrome stable for all users, which also caused some problems with TLS exchanges. The move from Kyber to ML-KEM though is not related to those early problems, that got resolved soon after manifesting. Rather, its a strategic choice to abandon an experimental system for a NIST-approved and fully standardized mechanism. ML-KEM was fully endorsed by the U.S. National Institute of Standards and Technology (NIST) in mid-August, with the agency publishing the complete technical specifications of the final version at the time. Google explains that despite the technical changes from Kyber to ML-KEM being minor, the two are essentially incompatible, so a switch had to be made. "The changes to the final version of ML-KEM make it incompatible with the previously deployed version of Kyber," explains Google. "As a result, the codepoint in TLS for hybrid post-quantum key exchange is changing from 0x6399 for Kyber768+X25519, to 0x11EC for ML-KEM768+X25519." ' -- source: https://it.slashdot.org/story/24/09/17/0455248 Cheers, Peter

1 0

Linus Torvalds Muses About Maintainer Gray Hairs, Next 'King of Linux'
by Peter Reutemann 17 Sep '24

17 Sep '24

'A report from ZDNet, written by Steven Vaughan-Nichols: In a candid keynote chat at the Linux Foundation's Open Source Summit Europe, Linux creator Linus Torvalds shared his thoughts on kernel development, the integration of Rust, and the future of open source. Dirk Hohndel, Verizon's Open Source Program Office head and Torvalds friend, moderated their conversation about the Linux ecosystem. Torvalds emphasized that kernel releases, like the recent 6.11 version, are intentionally not exciting. "For almost 15 years, we've had a very good regular cadence of releases," he explained. With releases every nine weeks, this regularity aims for timeliness and reliability rather than flashy new features. The Linux creator noted that while drivers still make up the bulk of changes, core kernel development continues to evolve. "I'm still surprised that we're doing very core development," Torvalds said, mentioning ongoing work in virtual file systems and memory management. [...] Shifting back to another contentious subject -- maintainer burnout and succession planning -- Hohndel observed that "maintainers are aging. Strangely, some of us have, you know, not quite as much or the right hair color anymore." (Torvalds interjected that "gray is the right color.") Hohndel continued, "So the question that I always ask myself: Is it about time to talk about there being a mini-Linus?" Torvalds turned the question around. True, the Linux maintainers are getting older and people do burn out and go away. "But that's kind of normal. What is not normal is that people actually stay around for decades. That's the unusual thing, and I think that's a good sign." At the same time, Torvalds admitted, it can be intimidating for a younger developer to join the Linux kernel team "when you see all these people who have been around for decades, but at the same time, we have many new developers. Some of those new developers come in, and three years later, they are top maintainers." Hohndel noted that "to be the king of Linux, the main maintainer, you have to have a lot of experience. And the backup right now is Greg KH (Greg Kroah-Hartman, maintainer of the stable Linux kernel), who is about the same age as we are and has even less hair." True, Torvalds responded, "But the thing is, Greg hasn't always been Greg. Before Greg, there's been Andrew {Morton) and Alan (Cox). After Greg, there will be Shannon and Steve. The real issue is you have to have a person or a group of people that the development community can trust, and part of trust is fundamentally about having been around for long enough that people know how you work, but long enough does not mean to be 30 years." Hohndel made one last comment: "What I'm trying to say is, you've been doing this for 33 years. I don't want to be morbid, but I think in 33 years, you may no longer be doing this?" Torvalds, making motions as though he was using a walker, replied, "I would love to still do this conference with you." The report notes the contention around the integration of Rust, highlighted by the recent departure of Rust for Linux maintainer Wedson Filho. Despite resistance from some devs who prefer C and are skeptical of Rust, Torvalds remains optimistic about Rust's future in the kernel. He said: "Rust is a very different thing, and there are a lot of people who are used to the C model. They don't like the differences, but that's OK. In the kernel itself, absolutely nobody understands everything. I don't. I rely heavily on maintainers of various subsystems. I think the same can be true of Rust and C. I think it's one of our strengths in the kernel that we can specialize. Clearly, some people just don't like the notion of Rust and having Rust encroach on their area. But we've only been doing Rust for a couple of years, so it's way too early to say Rust is a failure." Meanwhile, Torvalds confirmed that the long-anticipated real-time Linux (RTLinux) project will finally be integrated into the kernel with the upcoming release of Linux 6.12.' -- source: https://linux.slashdot.org/story/24/09/16/2047217 Cheers, Peter

1 0

Linux Kernel 6.11 is Out
by Peter Reutemann 17 Sep '24

17 Sep '24

'Linux creator Linus Torvalds has released version 6.11 of the open-source operating system kernel. The new release, while not considered major by Torvalds, introduces several notable improvements for AMD hardware users and Arch Linux developers. ZDNet: This latest version introduces several enhancements, particularly for AMD hardware users, while offering broader system improvements and new capabilities. These include: RDNA4 Graphics Support: The kernel now includes baseline support for AMD's upcoming RDNA4 graphics architecture. This early integration bodes well for future AMD GPU releases, ensuring Linux users have day-one support. Core Performance Boost: The AMD P-State driver now includes handling for AMD Core Performance Boost. This driver gives AMD Core users more granular control over turbo and boost frequency ranges. Fast Collaborative Processor Performance Control (CPPC) Support: Overclockers who want the most power possible from their computers will be happy with this improvement to the AMD P-State driver. This feature enhances power efficiency on recent Ryzen (Zen 4) mobile processors. This can improve performance by 2-6% without increasing power consumption. AES-GCM Crypto Performance: AMD and Intel CPUs benefit from significantly faster AES-GCM encryption and decryption processing, up to 160% faster than previous versions.' -- source: https://linux.slashdot.org/story/24/09/16/1928224 Cheers, Peter

1 0

Neofetch is over, but many screenshot system info tools stand ready
by Peter Reutemann 16 Sep '24

16 Sep '24

'Almost nobody truly needed Neofetch, but the people who did use it? They really liked it. Neofetch, run from a terminal, displayed key system information alongside an ASCII-art image of the operating system or distribution running on that system. You knew most of this data, but if you're taking a screenshot of your system, it looked cool and conveyed a lot of data in a small space. "The overall purpose of Neofetch is to be used in screen-shots of your system," wrote Neofetch's creator, Dylan Araps, on its Github repository. "Neofetch shows the information other people want to see." Neofetch did that, providing cool screenshots and proof-of-life images across nearly 150 OS versions until late April. The last update to the tool was made three years before that, and Araps' Github profile now contains a rather succinct coda: "Have taken up farming." Araps joins "going to a commune in Vermont" and "I now make furniture out of wood" in the pantheon of programmers who do not just leave the field, but flee into another realm entirely. As sometimes happens, the void was filled not by one decent replacement but many.' Alternatives from the article: - https://github.com/fastfetch-cli/fastfetch - https://github.com/ThatOneCalculator/NerdFetch - https://github.com/hykilpikonna/hyfetch - https://github.com/Macchina-CLI/macchina - https://github.com/Dr-Noob/cpufetch -- source: https://arstechnica.com/gadgets/2024/09/neofetch-is-over-but-many-screensho… Cheers, Peter

1 0