September 2024 - wlug - list.wlug.org.nz

New systemd update will bring Windows’ infamous Blue Screen of Death to Linux
by Peter Reutemann 18 Nov '24

18 Nov '24

'Windows' infamous "Blue Screen of Death" is a bit of a punchline. People have made a hobby of spotting them out in the wild, and in some circles, they remain a byword for the supposed flakiness and instability of PCs. To this day, networked PCs in macOS are represented by beige CRT monitors displaying a BSOD. But the BSOD is supposed to be a diagnostic tool, an informational screen that technicians can use to begin homing in on the problem that caused the crash in the first place; that old Windows' BSOD error codes were often so broad and vague as to be useless doesn't make the idea a bad one. Today, version 255 of the Linux systemd project honors that original intent by adding a systemd-bsod component that generates a full-screen display of some error messages when a Linux system crashes. The systemd-bsod component is currently listed as "experimental" and "subject to change." But the functionality is simple: any logged error message that reaches the LOG_EMERG level will be displayed full-screen to allow people to take a photo or write it down. Phoronix reports that, as with BSODs in modern Windows, the Linux version will also generate a QR code to make it easier to look up information on your phone.' -- source: https://arstechnica.com/gadgets/2023/12/linux-distros-are-about-to-get-a-ki… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Juice TV Hiccup
by Lawrence D'Oliveiro 15 Oct '24

15 Oct '24

Currently when I switch to FreeView Channel 200, it shows a frozen image with the text “Cinegy” and “Demo Version” on it. Searching for that name takes me to a site that talks about “software defined television”. Either their product licence has expired, or they never had one in the first place ...

2 3

Critical Unauthenticated RCE Flaw Impacts All GNU/Linux Systems
by Peter Reutemann 27 Sep '24

27 Sep '24

'"Looks like there's a storm brewing, and it's not good news," writes ancient Slashdot reader jd. "Whether or not the bugs are classically security defects or not, this is extremely bad PR for the Linux and Open Source community. It's not clear from the article whether this affects other Open Source projects, such as FreeBSD." From a report: A critical unauthenticated Remote Code Execution (RCE) vulnerability has been discovered, impacting all GNU/Linux systems. As per agreements with developers, the flaw, which has existed for over a decade, will be fully disclosed in less than two weeks. Despite the severity of the issue, no Common Vulnerabilities and Exposures (CVE) identifiers have been assigned yet, although experts suggest there should be at least three to six. Leading Linux distributors such as Canonical and RedHat have confirmed the flaw's severity, rating it 9.9 out of 10. This indicates the potential for catastrophic damage if exploited. However, despite this acknowledgment, no working fix is still available. Developers remain embroiled in debates over whether some aspects of the vulnerability impact security.' -- source: https://it.slashdot.org/story/24/09/25/2150210 Cheers, Peter

4 4

Tor Project Merges With Tails
by Peter Reutemann 27 Sep '24

27 Sep '24

'The Tor Project: Today the Tor Project, a global non-profit developing tools for online privacy and anonymity, and Tails, a portable operating system that uses Tor to protect users from digital surveillance, have joined forces and merged operations. Incorporating Tails into the Tor Project's structure allows for easier collaboration, better sustainability, reduced overhead, and expanded training and outreach programs to counter a larger number of digital threats. In short, coming together will strengthen both organizations' ability to protect people worldwide from surveillance and censorship. Countering the threat of global mass surveillance and censorship to a free Internet, Tor and Tails provide essential tools to help people around the world stay safe online. By joining forces, these two privacy advocates will pool their resources to focus on what matters most: ensuring that activists, journalists, other at-risk and everyday users will have access to improved digital security tools. In late 2023, Tails approached the Tor Project with the idea of merging operations. Tails had outgrown its existing structure. Rather than expanding Tails's operational capacity on their own and putting more stress on Tails workers, merging with the Tor Project, with its larger and established operational framework, offered a solution. By joining forces, the Tails team can now focus on their core mission of maintaining and improving Tails OS, exploring more and complementary use cases while benefiting from the larger organizational structure of The Tor Project. This solution is a natural outcome of the Tor Project and Tails' shared history of collaboration and solidarity. 15 years ago, Tails' first release was announced on a Tor mailing list, Tor and Tails developers have been collaborating closely since 2015, and more recently Tails has been a sub-grantee of Tor. For Tails, it felt obvious that if they were to approach a bigger organization with the possibility of merging, it would be the Tor Project.' -- source: https://yro.slashdot.org/story/24/09/26/1431201 Cheers, Peter

1 0

NIST proposes barring some of the most nonsensical password rules
by Peter Reutemann 26 Sep '24

26 Sep '24

'The National Institute of Standards and Technology (NIST), the federal body that sets technology standards for governmental agencies, standards organizations, and private companies, has proposed barring some of the most vexing and nonsensical password requirements. Chief among them: mandatory resets, required or restricted use of certain characters, and the use of security questions. Choosing strong passwords and storing them safely is one of the most challenging parts of a good cybersecurity regimen. More challenging still is complying with password rules imposed by employers, federal agencies, and providers of online services. Frequently, the rules—ostensibly to enhance security hygiene—actually undermine it. And yet, the nameless rulemakers impose the requirements anyway. [...] 1. Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length. 2. Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters. 3. Verifiers and CSPs SHOULD accept all printing ASCII [RFC20] characters and the space character in passwords. 4. Verifiers and CSPs SHOULD accept Unicode [ISO/ISC 10646] characters in passwords. Each Unicode code point SHALL be counted as a single character when evaluating password length. 5. Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords. 6. Verifiers and CSPs SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator. 7. Verifiers and CSPs SHALL NOT permit the subscriber to store a hint that is accessible to an unauthenticated claimant. 8. Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., “What was the name of your first pet?”) or security questions when choosing passwords. 9. Verifiers SHALL verify the entire submitted password (i.e., not truncate it).' -- source: https://arstechnica.com/security/2024/09/nist-proposes-barring-some-of-the-… Cheers, Peter

2 1

OpenSSH 9.9 Features Enhanced Quantum-Resistant Algorithms
by Peter Reutemann 26 Sep '24

26 Sep '24

'The OpenSSH project announced the release of OpenSSH 9.9, now available for download on its official mirrors. This new version introduces significant features, including support for hybrid post-quantum key exchange using a formally verified ML-KEM implementation, improved controls for managing unwanted connections, faster NTRUPrime key exchange code, and more.' -- source: https://linuxiac.com/openssh-9-9-released/ Cheers, Peter

1 0

Kubuntu Focus Ir14 Gen 2 review: Using Linux instead of messing with it
by Peter Reutemann 25 Sep '24

25 Sep '24

'There are lots of laptops—maybe all of them—on which you can run a Linux desktop. There are a few vendors that offer laptops with extensive Linux compatibility. And then there are a select few that specialize in Linux laptops, support them, and even customize them. Kubuntu Focus is one of the select few. It sent me one of its laptops to test the Ir14 Gen 2, which runs, of course, Kubuntu, the KDE desktop variant of Ubuntu. The “Focus” in the company name comes from what it is hoping to provide: a device on which you can just do your work without worrying about what’s happening deeper in your system. Go ahead and sudo apt update, says the Focus team; we’ve got you. I used the Ir14 Gen 2 for Ars Technica work and my personal needs for at least two weeks. Setting the system up with Focus’ guided wizard, installing apps from its store, and refusing to touch any of the deeper system files, I achieved something pretty remarkable: no unexpected behaviors on a Linux laptop. Had anything gone wrong, I could reasonably lean back on the system’s rollbacks, which I used a couple of times with no problem. Is this what it could be like? Does using Linux on the desktop not have to involve compiling from source, searching for that one relevant forum comment related to a problem, wondering where the fault lies along the chain from kernel to desktop to repository to me? Maybe. Can you surrender a bit of your upgrade and tinkering curiosity in exchange for knowing that things will work when they get to you? It might be trickier than you think. A Kubuntu Focus Ir14 Gen 2 laptop includes these things: - A laptop made by Carbon Systems, which supplies a lot of fleet and enterprise systems, and happens to make them relatively upgrade and repair-friendly - A stock Kubuntu 24.04 LTS system with a Plasma desktop, with Focus’ integrations built in - A few software tools from Focus, including power profiles and rollback The Focus is not meant to let you do whatever you want but to keep doing what you do. Researchers, developers, and jet propulsion labs are some of Focus’ customers. Focus tests everything that will arrive on official update channels to the device. When kernel updates appear in the upstream, Focus makes sure everything on the device works with it, while also contributing back to Ubuntu, Kubuntu, KDE, and the kernel itself. You don’t get interim releases. You don’t get staff in the forums helping you with running Arch or Fedora. There’s no custom desktop environment or windowing system (“We felt building a separate distribution and ecosystem is the last thing anyone needed,” the company writes). Focus chose reliability for daily-driver devices running Linux. It can, in other words, save you from yourself, if you’re a lot like me. Besides testing, Focus also makes a bunch of tweaks to the system before shipping: some keyboard shortcuts, screen scaling and console font alterations, automatic power profiles on plug and unplug, and the like. Focus has also written up almost every corner of your system you want help on; you can check it out on its site.' -- source: https://arstechnica.com/gadgets/2024/09/kubuntu-focus-ir14-gen-2-review-usi… Cheers, Peter

1 0

Linux boots in 4.76 days on the Intel 4004
by Peter Reutemann 24 Sep '24

24 Sep '24

'Hardware hacker Dmitry Grinberg recently achieved what might sound impossible: booting Linux on the Intel 4004, the world's first commercial microprocessor. With just 2,300 transistors and an original clock speed of 740 kHz, the 1971 CPU is incredibly primitive by modern standards. And it's slow—it takes about 4.76 days for the Linux kernel to boot. Initially designed for a Japanese calculator called the Busicom 141-PF, the 4-bit 4004 found limited use in commercial products of the 1970s before being superseded by more powerful Intel chips, such as the 8008 and 8080 that powered early personal computers—and then the 8086 and 8088 that launched the IBM PC era. If you're skeptical that this feat is possible with a raw 4004, you're right: The 4004 itself is far too limited to run Linux directly. Instead, Grinberg created a solution that is equally impressive: an emulator that runs on the 4004 and emulates a MIPS R3000 processor—the architecture used in the DECstation 2100 workstation that Linux was originally ported to. This emulator, along with minimal hardware emulation, allows a stripped-down Debian Linux to boot to a command prompt.' -- source: https://arstechnica.com/gadgets/2024/09/hacker-boots-linux-on-intels-first-… Cheers, Peter

1 0

Zen Browser: a New Firefox-based Alternative to Chromium Browsers
by Peter Reutemann 24 Sep '24

24 Sep '24

'First released on July 11th, the Firefox-based Zen browser is "taking a different approach to the user interface," according to the blog It's FOSS. The Register says the project "reminds us strongly of Arc, a radical Chromium-based web browser... to modernize the standard web browser UI by revising some fundamental assumptions." [Arc] removes the URL bar from front and center, gets rid of the simple flat list of tabs, and so on. Zen is trying to do some similar things, but in a slightly more moderate way — and it's doing it on the basis of Mozilla's Firefox codebase... Instead of the tired old horizontal tab bar you'll see in both Firefox and Chrome, Zen implements its own tab bar... By default, this tab bar is narrow and just shows page icons — but there are some extra controls at the bottom of the sidebar, one of which expands the sidebar to show page titles too. For us, it worked better than Vivaldi's fancier sidebar. The article concludes it's "a new effort to modernize web browsing by bringing tiling, workspaces, and so on — and it's blissfully free of Google code." One Reddit comment swooned over Zen's "extraordinary" implementation of a distraction-free "Compact Mode" (hiding things like the sidebar and top bar). And It's Foss described it as a "tranquil," browser, "written using CSS, C++, JavaScript, and a few other programming languages, with a community of over 30 people contributing to it." The layout of the interface felt quite clean to me; there were handy buttons on the top to control the webpage, manage extensions, and a menu with additional options... The split-view functionality allows you to open up two different tabs on the same screen, allowing for easy multitasking when working across different webpages... I split two tabs, but in my testing, I could split over 10+ tabs... If you have a larger monitor, then you are in for a treat... The Zen Sidebar feature... can run web apps alongside any open tabs. This can be helpful in situations where you need to quickly access a service like a note-taking app, Wikipedia, Telegram, and others. On the customization side of things, you will find that Zen Browser supports everything that Firefox does, be it the settings, adding new extensions/themes/plugins, etc. The Register points out it's easy to give it a try. "Being based on Firefox means that as well as running existing extensions, it can connect to Mozilla's Sync service and pick up not just your bookmarks, but also your tabs from other instances." And beyond all that, "There's just something satisfying about switching browsers every now and again..." argues the tech site Pocket-Lint: Zen Browser's vertical tabs layout is superb and feels much better than anything available in standard Firefox. [Firefox recently offered vertical tabs and a new sidebar experience in Nightly/Firefox Labs 131.] The tab bar can be set to automatically hide and show up whenever you hover near it, and it also contains quick access buttons to bookmarks, settings, and browsing history. The tab bar also contains a profile switcher... One of the greatest parts of the Zen Browser is the community that has popped up around it. At its heart, Zen Browser is a community-driven project... Zen Browser themes are aesthetic and functional tweaks to the UI. While there aren't a ton available right now, the ones that are show a lot of promise for the browser's future... I've personally gotten great use out of the Super URL Bar theme, which makes your URL bar expand and become the focus of your screen while typing in it... There's a lot you can do to make Zen Browser feel nearly exactly like what you want it to feel like. The "Business Standard calls it "an open-source alternative to Chromium-based browsers," adding "Where Zen truly shines is it offers a range of customisation, tab management, and workspace management..." Their theme store offers a range of options, including modifications to the bookmark toolbar, a floating URL bar, private mode theming, and removal of browser padding. In addition to these, users can also choose from custom colour schemes and built-in theming options... The Sidebar is another neat feature which allows you to open tabs in a smaller, smartphone-sized window. You can view websites in mobile layout by using this panel. It's "focused on being always at the latest version of Firefox," according to its official site, noting that Firefox is known for its security features. But then, "We also have additional security features like https only built into Zen Browser to help keep you safe online." And it also promises automated Releases "to ensure security." It's FOSS adds that you can get Zen Browser for Linux, Windows, and macOS from its official website (adding "They also offer it on the Flathub store for further accessibility on Linux.") And its source code is available on GitHub.' -- source: https://news.slashdot.org/story/24/09/23/0353206 Cheers, Peter

1 0

As Companies Try 'Open Source Rug Pull', Open Source Foundations Considered Helpful
by Peter Reutemann 22 Sep '24

22 Sep '24

'"In the era of the open source rug pull, the role of open source foundations is more important than ever," argues the co-founder of the developer-focused industry analyst firm RedMonk: The "rug pull" here refers to companies that have used open source as a distribution mechanism, building a community and user base, before changing the license to be restricted, rather than truly open source. "This is capitalism, yo. We've got shareholders to satisfy. It's time to relicense that software, move to a Business Source license." [...] Where open source used to be a sustainable commitment, today too often it feels like a short term tactic. Commercial open source isn't what it used to be. Which means that open source foundations, which provide ongoing governance and intellectual property management for open source projects, are in an interesting position, in some cases becoming more adversarial than they historically have been with vendors.... [T]he Apache Software Foundation (ASF) has done a great job of fostering sustainable, commercial, open source for decades now, most notably in the data infrastructure space — think Hadoop, Spark, Kafka, Flink etc. ["[C]ommercial open source would almost certainly never have achieved critical mass and continued success without foundations in the mix," the article notes later. "The ASF was founded in 1999, and underpinned the adoption of open source middleware in the enterprise..."] One premise behind the Cloud Native Computing Foundation (CNCF) is that user organisations can within reason trust it to stand behind the projects it incubates and manages. While not an explicit commitment, adopters generally, and enterprises specifically, have seen the CNCF imprimatur as one that they can rely on. In the era of the open source rug pull this kind of promise becomes even more important.... Sid Sijbrandij, CEO of GitLab has argued that open source companies should commit to an Open Charter as a mechanism to protect users from open source rug pulls. "Open source software isn't useful if people can't rely on the project remaining open source. Adopting Open Charter offers open source users predictability amidst the growing licensing switch trend." With a CNCF project, though, the need for this kind of charter becomes less important, because the code is by design not single source, but has a diverse set of contributors. Which is to say that open source foundations can make rug pulls a lot less likely than adoption of open source technology built by a single company. Relying on benevolent dictators is generally pretty risky. And recently the benevolent dictators have seemed... less benevolent. In conclusion, "Open Source Foundations Considered Helpful," according to the post's title. It does argue that "Any company is within its rights to relicense its software, but it can certainly be problematic from a community and project health perspective. "Which is exactly why open source foundations are more important than ever."' -- source: https://news.slashdot.org/story/24/09/21/0530234 Cheers, Peter

1 0

List Of IPTV Resources
by Lawrence D'Oliveiro 22 Sep '24

22 Sep '24

This user <https://github.com/iptv-org> just popped up in my GitHub feed. One repo <https://github.com/iptv-org/iptv> claims to be a list of links to over 8000 streaming TV channels from nations all over the world, while the other is a list of tools*, providers and other resources. Do be aware it’s a bit of a mixed bag: yes, there are legitimate channels (no encryption so far that I have noticed), but also some dubious-looking links. *Oddly, FFmpeg and youtube-dl aren’t in the list.

2 5

Trying Out IPv6
by Lawrence D'Oliveiro 19 Sep '24

19 Sep '24

My new ISP supports IPv6, and I’ve been doing a few tentative tests with it. I actually disabled the DHCPv6 support in my router, and manually configured an address in the ISP-delegated range into my main machine, just for testing. And now I’ve discovered that my other Linux machines have picked up addresses in the delegated range as well, all by themselves! Turns out this is through a mechanism called “SLAAC” (“Stateless Address Autoconfiguration”). My main worry was that, since IPv6 allows direct connections without needing NAT, that internal machines with IPv6 addresses would be directly visible on the Internet. But checking with an external IPv6 ping site seems to show this is not the case: my router is blocking incoming attempts to access nodes on IPv6 addresses by default. The router responds to pings on its own IPv6 address from the public Internet, of course; but other allocated addresses in the range do not respond. Here is a site <https://test-ipv6.com/> I found to test your IPv6 connectivity. It also gives details of the tests it runs, and a handy list of some random places you can access via IPv6.

1 0

Real-Time Linux Is Now Mainstream
by Lawrence D'Oliveiro 19 Sep '24

19 Sep '24

The PREEMPT_RT patches (aka “Real-Time Linux”) originated as a set of out-of-tree mods to the Linux kernel about 20 years ago. Bit by bit, over time, various parts of them have been incorporated into the mainline code. Some of these patches have found uses in, shall we say, more mainstream application areas. And beginning with kernel version 6.12, the last of those out-of-tree patches have been merged, and the out-of-tree PREEMPT_RT patchset is no more. This article <https://www.zdnet.com/article/20-years-later-real-time-linux-makes-it-to-th…> by long-time Linux fan Steven J Vaughan-Nichols, gives some background. Including the fact that musicians have been using Linux for audio work for decades, because Linux with the real-time patches was the cheapest way of recording pro-quality audio, much cheaper than buying “real” pro audio gear.

1 0

Use oathtool Linux command line for 2 step verification (2FA)
by Peter Reutemann 18 Sep '24

18 Sep '24

Hi everyone With 2FA now being commonplace, I've mainly relied on Google's Authenticator or the MS equivalent. However, today I came across this tutorial on how to use the oathtool CLI tool to achieve the same: https://www.cyberciti.biz/faq/use-oathtool-linux-command-line-for-2-step-ve… Originally, I came across the tutorial on my Mastodon feed: https://mastodon.social/@nixCraft/113154210830716246 Cheers, Peter

1 0

Is Your Windows Licence Legal?
by Lawrence D'Oliveiro 18 Sep '24

18 Sep '24

How do you know your Windows-running PC is running a legitimately-licensed copy of Windows? It seems you can’t: <https://www.zdnet.com/article/is-your-windows-license-legal-should-you-even…>. The article says “You almost certainly have a valid Windows license if you acquired it in ...” and goes on to list the usual ways that users obtain their copies. But note that “almost”: there is nothing you end up with -- no document or artifact or anything else -- that definitively says your copy of Windows is genuine. The final decision always goes back to Microsoft: if they decide not to sue you, then your copy is probably legit.

1 0

Chrome Switching To NIST-Approved ML-KEM Quantum Encryption
by Peter Reutemann 18 Sep '24

18 Sep '24

'Google is updating the post-quantum cryptography in Chrome, replacing the experimental Kyber with the fully standardized Module Lattice Key Encapsulation Mechanism (ML-KEM) to enhance protection against quantum computing attacks. BleepingComputer reports: This change comes roughly five months after Google rolled out the post-quantum secure TLS key encapsulation system on Chrome stable for all users, which also caused some problems with TLS exchanges. The move from Kyber to ML-KEM though is not related to those early problems, that got resolved soon after manifesting. Rather, its a strategic choice to abandon an experimental system for a NIST-approved and fully standardized mechanism. ML-KEM was fully endorsed by the U.S. National Institute of Standards and Technology (NIST) in mid-August, with the agency publishing the complete technical specifications of the final version at the time. Google explains that despite the technical changes from Kyber to ML-KEM being minor, the two are essentially incompatible, so a switch had to be made. "The changes to the final version of ML-KEM make it incompatible with the previously deployed version of Kyber," explains Google. "As a result, the codepoint in TLS for hybrid post-quantum key exchange is changing from 0x6399 for Kyber768+X25519, to 0x11EC for ML-KEM768+X25519." ' -- source: https://it.slashdot.org/story/24/09/17/0455248 Cheers, Peter

1 0

Linus Torvalds Muses About Maintainer Gray Hairs, Next 'King of Linux'
by Peter Reutemann 17 Sep '24

17 Sep '24

'A report from ZDNet, written by Steven Vaughan-Nichols: In a candid keynote chat at the Linux Foundation's Open Source Summit Europe, Linux creator Linus Torvalds shared his thoughts on kernel development, the integration of Rust, and the future of open source. Dirk Hohndel, Verizon's Open Source Program Office head and Torvalds friend, moderated their conversation about the Linux ecosystem. Torvalds emphasized that kernel releases, like the recent 6.11 version, are intentionally not exciting. "For almost 15 years, we've had a very good regular cadence of releases," he explained. With releases every nine weeks, this regularity aims for timeliness and reliability rather than flashy new features. The Linux creator noted that while drivers still make up the bulk of changes, core kernel development continues to evolve. "I'm still surprised that we're doing very core development," Torvalds said, mentioning ongoing work in virtual file systems and memory management. [...] Shifting back to another contentious subject -- maintainer burnout and succession planning -- Hohndel observed that "maintainers are aging. Strangely, some of us have, you know, not quite as much or the right hair color anymore." (Torvalds interjected that "gray is the right color.") Hohndel continued, "So the question that I always ask myself: Is it about time to talk about there being a mini-Linus?" Torvalds turned the question around. True, the Linux maintainers are getting older and people do burn out and go away. "But that's kind of normal. What is not normal is that people actually stay around for decades. That's the unusual thing, and I think that's a good sign." At the same time, Torvalds admitted, it can be intimidating for a younger developer to join the Linux kernel team "when you see all these people who have been around for decades, but at the same time, we have many new developers. Some of those new developers come in, and three years later, they are top maintainers." Hohndel noted that "to be the king of Linux, the main maintainer, you have to have a lot of experience. And the backup right now is Greg KH (Greg Kroah-Hartman, maintainer of the stable Linux kernel), who is about the same age as we are and has even less hair." True, Torvalds responded, "But the thing is, Greg hasn't always been Greg. Before Greg, there's been Andrew {Morton) and Alan (Cox). After Greg, there will be Shannon and Steve. The real issue is you have to have a person or a group of people that the development community can trust, and part of trust is fundamentally about having been around for long enough that people know how you work, but long enough does not mean to be 30 years." Hohndel made one last comment: "What I'm trying to say is, you've been doing this for 33 years. I don't want to be morbid, but I think in 33 years, you may no longer be doing this?" Torvalds, making motions as though he was using a walker, replied, "I would love to still do this conference with you." The report notes the contention around the integration of Rust, highlighted by the recent departure of Rust for Linux maintainer Wedson Filho. Despite resistance from some devs who prefer C and are skeptical of Rust, Torvalds remains optimistic about Rust's future in the kernel. He said: "Rust is a very different thing, and there are a lot of people who are used to the C model. They don't like the differences, but that's OK. In the kernel itself, absolutely nobody understands everything. I don't. I rely heavily on maintainers of various subsystems. I think the same can be true of Rust and C. I think it's one of our strengths in the kernel that we can specialize. Clearly, some people just don't like the notion of Rust and having Rust encroach on their area. But we've only been doing Rust for a couple of years, so it's way too early to say Rust is a failure." Meanwhile, Torvalds confirmed that the long-anticipated real-time Linux (RTLinux) project will finally be integrated into the kernel with the upcoming release of Linux 6.12.' -- source: https://linux.slashdot.org/story/24/09/16/2047217 Cheers, Peter

1 0

Linux Kernel 6.11 is Out
by Peter Reutemann 17 Sep '24

17 Sep '24

'Linux creator Linus Torvalds has released version 6.11 of the open-source operating system kernel. The new release, while not considered major by Torvalds, introduces several notable improvements for AMD hardware users and Arch Linux developers. ZDNet: This latest version introduces several enhancements, particularly for AMD hardware users, while offering broader system improvements and new capabilities. These include: RDNA4 Graphics Support: The kernel now includes baseline support for AMD's upcoming RDNA4 graphics architecture. This early integration bodes well for future AMD GPU releases, ensuring Linux users have day-one support. Core Performance Boost: The AMD P-State driver now includes handling for AMD Core Performance Boost. This driver gives AMD Core users more granular control over turbo and boost frequency ranges. Fast Collaborative Processor Performance Control (CPPC) Support: Overclockers who want the most power possible from their computers will be happy with this improvement to the AMD P-State driver. This feature enhances power efficiency on recent Ryzen (Zen 4) mobile processors. This can improve performance by 2-6% without increasing power consumption. AES-GCM Crypto Performance: AMD and Intel CPUs benefit from significantly faster AES-GCM encryption and decryption processing, up to 160% faster than previous versions.' -- source: https://linux.slashdot.org/story/24/09/16/1928224 Cheers, Peter

1 0

Neofetch is over, but many screenshot system info tools stand ready
by Peter Reutemann 16 Sep '24

16 Sep '24

'Almost nobody truly needed Neofetch, but the people who did use it? They really liked it. Neofetch, run from a terminal, displayed key system information alongside an ASCII-art image of the operating system or distribution running on that system. You knew most of this data, but if you're taking a screenshot of your system, it looked cool and conveyed a lot of data in a small space. "The overall purpose of Neofetch is to be used in screen-shots of your system," wrote Neofetch's creator, Dylan Araps, on its Github repository. "Neofetch shows the information other people want to see." Neofetch did that, providing cool screenshots and proof-of-life images across nearly 150 OS versions until late April. The last update to the tool was made three years before that, and Araps' Github profile now contains a rather succinct coda: "Have taken up farming." Araps joins "going to a commune in Vermont" and "I now make furniture out of wood" in the pantheon of programmers who do not just leave the field, but flee into another realm entirely. As sometimes happens, the void was filled not by one decent replacement but many.' Alternatives from the article: - https://github.com/fastfetch-cli/fastfetch - https://github.com/ThatOneCalculator/NerdFetch - https://github.com/hykilpikonna/hyfetch - https://github.com/Macchina-CLI/macchina - https://github.com/Dr-Noob/cpufetch -- source: https://arstechnica.com/gadgets/2024/09/neofetch-is-over-but-many-screensho… Cheers, Peter

1 0

Ubuntu 22.04.5 LTS (Jammy Jellyfish) Is Now Available Powered by Linux Kernel 6.8
by Peter Reutemann 16 Sep '24

16 Sep '24

'Canonical released today Ubuntu 22.04.5 LTS as the fifth and last planned point release to the Ubuntu 22.04 LTS (Jammy Jellyfish) long-term supported operating system series bringing the latest security patches and updated components. Ubuntu 22.04.5 LTS is here six and a half months after Ubuntu 22.04.4 LTS as an up-to-date installation media designed for those of you who want to install Ubuntu 22.04 LTS (Jammy Jellyfish) on a new computer and don’t want to download hundreds of updated packages from the repositories after the installation. Apart from the security patches and updated packages that have been released during the past six months, the Ubuntu 22.04.5 LTS point release is powered by a newer kernel from the Ubuntu 24.04 LTS (Noble Numbat) operating system series, namely Linux kernel 6.8, to better support installations on newer hardware.' -- source: https://9to5linux.com/ubuntu-22-04-5-lts-jammy-jellyfish-is-now-available-p… Cheers, Peter

1 0

Haiku (Originally 'OpenBeOS') Releases Long Awaited R1/Beta5
by Peter Reutemann 16 Sep '24

16 Sep '24

'Haiku (the MIT-licensed operating system, inspired by BeOS) has released its fifth beta for Haiku R1. Some new features include improved UI color management, improved dark mode coloring, Tracker improvements, TUN/TAP support for VPN connections, TCP throughput improvements, performance optimizations, UFS2 (BSD's filesystem) read-only support, new FAT filesystem driver, improved hardware support, improved POSIX compliance, improved performance, and more. Slashdot has been covering the fate of the BeOS since 2000 (as well as the short-lived derivative project ZETA — and Haiku). And now "With a history of over two decades and previously known as OpenBeOS, today's Haiku is pushing forward..." writes the site NotebookCheck: Haiku is a spiritual successor to BeOS, with a focus on a clean and user-friendly design paired with low system requirements. The minimum system requirements are still an Intel Pentium II/AMD Athlon CPU or better, at least 384 MB RAM, an 800x600 screen, and at least 3GB storage. It works on both 32-bit and 64-bit x86 PCs, and the 32-bit version can run many unmodified BeOS applications. It might be the best desktop open-source operating system not based on Linux or Unix... It works well in a virtual machine like VirtualBox or UTM. ' -- source: https://news.slashdot.org/story/24/09/14/158240 Anybody ever tried running/using Haiku? Cheers, Peter

1 0

'Samba' Networking Protocol Project Gets Big Funding from the German Sovereign Tech Fund
by Peter Reutemann 16 Sep '24

16 Sep '24

'Samba is "a free software re-implementation of the SMB networking protocol," according to Wikipedia. And now the Samba project "has secured significant funding (€688,800.00) from the German Sovereign Tech Fund to advance the project," writes Jeremy Allison — Sam (who is Slashdot reader #8,157 — and also a long standing member of Samba's core team): The investment was successfully applied for by [information security service provider] SerNet. Over the next 18 months, Samba developers from SerNet will tackle 17 key development subprojects aimed at enhancing Samba's security, scalability, and functionality. The Sovereign Tech Fund is a German federal government funding program that supports the development, improvement, and maintenance of open digital infrastructure. Their goal is to sustainably strengthen the open source ecosystem. The project's focus is on areas like SMB3 Transparent Failover, SMB3 UNIX extensions, SMB-Direct, Performance and modern security protocols such as SMB over QUIC. These improvements are designed to ensure that Samba remains a robust and secure solution for organizations that rely on a sovereign IT infrastructure. Development work began as early as September the 1st and is expected to be completed by the end of February 2026 for all sub-projects. All development will be done in the open following the existing Samba development process. First gitlab CI pipelines have already been running and gitlab MRs will appear soon! Back in 2000, Jeremy Allison answered questions from Slashdot readers about Samba. Allison is now a board member at both the GNOME Foundation and the Software Freedom Conservancy, a distinguished engineer at Rocky Linux creator CIQ, and a long-time free software advocate.' -- source: https://news.slashdot.org/story/24/09/14/1726252 Cheers, Peter

1 0

copying random sample of files
by Peter Reutemann 12 Sep '24

12 Sep '24

Hi everyone I was just wondering how I can copy a random subset of files from one folder to another. And, of course, there bash utilities for that... ;-) I came across two solutions for copying 20 files from the current directory into DEST: - shuf cp `ls | shuf -n 20` DEST - sort (using random sort) ls | sort -R | tail -20 | while read file do cp $file DEST done source: https://stackoverflow.com/questions/414164/ Man pages: - shuf: https://www.man7.org/linux/man-pages/man1/shuf.1.html - sort: https://man7.org/linux/man-pages/man1/sort.1.html Cheers, Peter

3 3

Rogue WHOIS server gives researcher superpowers no one should ever have
by Peter Reutemann 12 Sep '24

12 Sep '24

'It’s not every day that a security researcher acquires the ability to generate counterfeit HTTPS certificates, track email activity, and the position to execute code of his choice on thousands of servers—all in a single blow that cost only $20 and a few minutes to land. But that’s exactly what happened recently to Benjamin Harris. Harris, the CEO and founder of security firm watchTowr, did all of this by registering the domain dotmobiregistry.net. The domain was once the official home of the authoritative WHOIS server for .mobi, a top-level domain used to indicate that a website is optimized for mobile devices. At some point—it’s not clear precisely when—this WHOIS server, which acts as the official directory for every domain ending in .mobi, was relocated, from whois.dotmobiregistry.net to whois.nic.mobi. While retreating to his Las Vegas hotel room during last month’s Black Hat security conference in Las Vegas, Harris noticed that the previous dotmobiregistry.net owners had allowed the domain to expire. He then scooped it up and set up his own .mobi WHOIS server there.' -- source: https://arstechnica.com/security/2024/09/rogue-whois-server-gives-researche… Cheers, Peter

1 0

Floorp browser
by Peter Reutemann 12 Sep '24

12 Sep '24

Hi everyone Just came across the Floorp browser, which is based on Firefox. Refreshing news, as most new browsers nowadays seem to be Chromium-based... 'Floorp, an amazing free and open-source browser backed by a Japanese company, has gained quite a bit of attention recently for offering data and privacy protection, including high customization options such as Vivaldi in relation to Chrome. The browser's performance was quite fascinating, as it was able to achieve 60% more speed compared to Firefox when tested with Speedometer and JetStream 2 benchmarking tools. If your current browser is Firefox and you love to tweak your browser, then I highly recommend you give it a try. The following is a list of data privacy and customization options offered by Floorp: - An option to enable strong fingerprints, disabling WebGL, and HTTPs for every site is available. - Open the link, image, and media in a new tab and immediately move to it. - Provide a vertical tab on the right side of the browser to quickly open certain sites or browser settings. - Built-in option to change between different user agents. - Offers a preset of 80 keyboard shortcuts for different browser actions. - It comes with Floorp Notes Sync, similar to Vivialdi, to keep your notes. - Integrated with Firefox sync to synchronize your browser bookmarks, cookies, logins, open tabs, etc.' -- source: https://ubuntushell.com/install-floorp/ -- project: https://floorp.app/ Cheers, Peter

1 2

SynthSaga -- A Good Use For AI
by Lawrence D'Oliveiro 09 Sep '24

09 Sep '24

Have a look at some of the stuff on this channel <https://www.youtube.com/@SynthSaga/videos> -- science-fiction-themed, steampunk, dieselpunk, alternative realities, whatever you want to call it. Mostly monochrome, but I still found several of them mind-blowing. Not sure if the audio was part of the same AI process, or if the artist (yes, I’d call them an artist) created that separately. Yeah, there are lots of glitches and bugs and hilariously impossible occlusions and the like. But that just adds to the hallucinatory feel. And each one is short, which leaves you wanting more. Wouldn’t you like to spend some time in a world like one of those? Just try to ignore the glitches in the matrix and go with the flow. ;)

1 0

3D Volumetric Voxel Display
by Lawrence D'Oliveiro 09 Sep '24

09 Sep '24

A guy from Weta Workshop has created a “volumetric voxel” display for showing 3D images, by spinning a regular 2D panel at a dizzyingly high speed (more than 300rpm). The images are fairly low-res: think 1980s pixelated graphics extended to the third dimension. <https://www.theverge.com/2024/9/6/24238004/doom-volumetric-voxel-display-an…> I hope it’s covered in some shield, not just to keep errant fingers (and other body parts away), but in case something ... um ... comes apart unexpectedly ...

1 0

Germany’s Sovereign Tech Fund Injects €686,400 into FreeBSD
by Peter Reutemann 04 Sep '24

04 Sep '24

'Sovereign Tech Fund, a funding pot supported financially by the German Federal Ministry for Economic Affairs and Climate Action and hosted by the German Federal Agency for Disruptive Innovation, has once again been one of Open Source’s great friends and supporters. After providing €1 million in financial support to GNOME at the end of last year and investing €203K in GStreamer and €157K in FFmpeg earlier this year, the company is now making another impressive donation to the open-source ecosystem. The FreeBSD Foundation has announced a €686,400 investment from STF to enhance the FreeBSD operating system’s infrastructure and security.' -- source: https://linuxiac.com/sovereign-tech-fund-injects-686400-into-freebsd/ Cheers, Peter

2 1

Elasticsearch Will Be Open Source Again as CTO Declares Changed Landscape
by Peter Reutemann 04 Sep '24

04 Sep '24

'Elastic, creator of popular search engine Elasticsearch and visualization tool Kibana, plans to introduce the AGPL open-source license alongside its existing licenses. The move comes three years after Elastic ditched the Apache 2.0 license, sparking controversy in the tech community. Founder Shay Banon says the change aims to clarify Elastic's market position following AWS's creation of OpenSearch, a fork of Elasticsearch. Despite initial friction, Banon claims Elastic's relationship with AWS has improved, citing growth in Elastic Cloud revenue and customer base.' -- source: https://news.slashdot.org/story/24/09/03/0511245 Cheers, Peter

1 0

YubiKeys Are Vulnerable To Cloning Attacks Thanks To Newly Discovered Side Channel
by Peter Reutemann 04 Sep '24

04 Sep '24

'The YubiKey 5, the most widely used hardware token for two-factor authentication based on the FIDO standard, contains a cryptographic flaw that makes the finger-size device vulnerable to cloning when an attacker gains brief physical access to it, researchers said Tuesday. ArsTechnica: The cryptographic flaw, known as a side channel, resides in a small microcontroller that's used in a vast number of other authentication devices, including smartcards used in banking, electronic passports, and the accessing of secure areas. While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven't tested other devices using the microcontroller, which is SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contain the same vulnerability. YubiKey-maker Yubico issued an advisory in coordination with a detailed disclosure report from NinjaLab, the security firm that reverse-engineered the YubiKey 5 series and devised the cloning attack. All YubiKeys running firmware prior to version 5.7 -- which was released in May and replaces the Infineon cryptolibrary with a custom one -- are vulnerable. Updating key firmware on the YubiKey isn't possible. That leaves all affected YubiKeys permanently vulnerable.' -- source: https://it.slashdot.org/story/24/09/03/1810216 Cheers, Peter

1 0

Microsoft Says Its Recall Uninstall Option in Windows 11 is Just a Bug
by Peter Reutemann 03 Sep '24

03 Sep '24

'While the latest update to Windows 11 makes it look like the upcoming Recall feature can be easily removed by users, Microsoft tells us it's just a bug and a fix is coming. Deskmodder spotted the change last week in the latest 24H2 version of Windows 11, with KB5041865 seemingly delivering the ability to uninstall Recall from the Windows Features section. "We are aware of an issue where Recall is incorrectly listed as an option under the 'Turn Windows features on or off' dialog in Control Panel," says Windows senior product manager Brandon LeBlanc in a statement to The Verge. "This will be fixed in an upcoming update."' -- source: https://it.slashdot.org/story/24/09/02/2241242 The only way to push a feature that users don't want: make it mandatory! I think, the technical term for this approach is "enshittification": https://en.wikipedia.org/wiki/Enshittification Cheers, Peter

1 0

Rust for Linux Maintainer Steps Down in Frustration With 'Nontechnical Nonsense'
by Peter Reutemann 03 Sep '24

03 Sep '24

'Efforts to add Rust code to the Linux kernel has suffered a setback as one of the maintainers of the Rust for Linux project has stepped down -- citing frustration with "nontechnical nonsense." The Register: Wedson Almeida Filho, a software engineer at Microsoft who has overseen the Rust for Linux project, announced his resignation in a message to the Linux kernel development mailing list. "I am retiring from the project," Filho declared. "After almost four years, I find myself lacking the energy and enthusiasm I once had to respond to some of the nontechnical nonsense, so it's best to leave it up to those who still have it in them." [...] Memory safety bugs are regularly cited as the major source of serious software vulnerabilities by organizations overseeing large projects written in C and C++. So in recent years there's been a concerted push from large developers like Microsoft and Google, and well as from government entities like the US Cybersecurity and Infrastructure Security Agency, to use memory-safe programming languages -- among them Rust. Discussions about adding Rust to Linux date back to 2020 and were realized in late 2022 with the release of Linux 6.1. "I truly believe the future of kernels is with memory-safe languages," Filho's note continued. "I am no visionary but if Linux doesn't internalize this, I'm afraid some other kernel will do to it what it did to Unix."' -- source: https://linux.slashdot.org/story/24/09/02/194205 Cheers, Peter

1 0

Public DNS Services
by Lawrence D'Oliveiro 02 Sep '24

02 Sep '24

So I finally got connected to fibre today, and I was pleased to discover that the ISP (https://simplybroadband.co.nz/) offers IPv6 as well. Is this common nowadays? We all know about the public DNS services offered by Google (8.8.8.8, 8.8.4.4) and Cloudflare (1.1.1.1, 1.0.0.1); did you know these addresses have names as well? And of course there are IPv6 addresses to go with the IPv4 ones. Try this command to find out all the related Google DNS services: host -a dns.google. (Yup, that’s “dns.google.”, no “.com” or anything else on the end.) That’s quite a breathtaking list of entries. For Cloudflare, try host one.one.one.one. Note that the “-a” option (“tell me everything”) doesn’t work with Cloudflare; quite a few online services are now imposing restrictions on these “all info” lookups, but clearly not Google, at least not on this domain: obviously they want it to remain easy for people to discover the services they’re offering.

1 1