April 2025 - wlug - list.wlug.org.nz

CVE Foundation Emerges From Stealth to Rescue CVE Program
by Peter Reutemann 28 Apr '25

28 Apr '25

'I’m guessing that Trump and Musk are behind this, and that this is just another essential thing the government does that they’re trying to break into pieces. The good news is that in this case not only was there a last minute reprieve, but some people saw it coming and made plans to keep things going in case the rug still eventually gets pulled out. If this was the work of the dynamic duo of Pennsylvania Avenue, what they were busy trying to break was the Common Vulnerabilities and Exposures program — better known as CVE — which keeps track of security vulnerabilities found in software so that it can get fixed, hopefully before the bad guys develop a way to exploit the bug. The story started on Tuesday when MITRE — a nonprofit that among other things operates federally funded research and development centers that support various federal government agencies, including the CVE program — sent a letter to CVE board members, telling them that funding for CVE and other related programs was set to expire on Wednesday. As you might imagine, when that news hit the internet, it got social networks buzzing. [...] Then on Wednesday morning, at about the time that tech oriented websites and tech-focused users on social sites were at peak craziness over this withdrawal of funding, a monkey wrench was thrown into the machinery by a news release from the CVE Foundation, an organization that nobody — at least not anybody that I know — has heard anything about until now. “The CVE Foundation has been formally established to ensure the long-term viability, stability, and independence of the Common Vulnerabilities and Exposures Program, a critical pillar of the global cybersecurity infrastructure for 25 years,” the release opened, under the heading: “CVE Foundation Launched to Secure the Future of the CVE Program.' -- source: https://fossforce.com/2025/04/cve-foundation-emerges-from-stealth-to-rescue… Cheers, Peter

1 0

Lenovo May Be Avoiding the 'Windows Tax' By Offering Cheaper Laptops With Pre-Installed Linux
by Peter Reutemann 28 Apr '25

28 Apr '25

'"The U.S. and Canadian websites for Lenovo offered U.S. $140 and CAD $211 off on the same ThinkPad X1 Carbon model when choosing any one of the Linux-based alternatives," reports It's FOSS News: This was brought to my attention thanks to a Reddit post... Others then chimed in, saying that Lenovo has been doing this since at least 2020 and that the big price difference shows how ridiculous Windows' pricing is... Not all models from their laptop lineup, like ThinkPad, Yoga, Legion, LOQ, etc., feature an option to get Linux pre-installed during the checkout process. Luckily, there is an easy way to filter through the numerous laptops. Just go to the laptops section (U.S.) on the Lenovo website and turn on the "Operating System" filter under the Filter by specs sidebar menu. The article end with an embedded YouTube video showing a VCR playing a videotape of a 1999 local TV news report... about the legendary "Windows Refund Day" protests.' -- source: https://linux.slashdot.org/story/25/04/27/0127203 Cheers, Peter

2 1

Linus Torvalds Expresses His Hatred For Case-Insensitive File-Systems
by Peter Reutemann 28 Apr '25

28 Apr '25

'Some patches for Linux 6.15-rc4 (updating the kernel driver for the Bcachefs file system) triggered some "straight-to-the-point wisdom" from Linus Torvalds about case-insensitive filesystems, reports Phoronix. Bcachefs developer Kent Overstreet started the conversation, explaining how some buggy patches for their case-insensitive file and folder support were upstreamed into the Bcachefs kernel driver nearly two years ago: When I was discussing with the developer who did the implementation, I noted that fstests should already have tests. However, it seems I neglected to tell him to make sure the tests actually run... It is _not_ enough to simply rely on the automated tests. You have to have eyes on what your code is doing. Overstreet added "There's a story behind the case insensitive directory fixes, and lessons to be learned." To which Torvalds replied.... "No." "The only lesson to be learned is that filesystem people never learn." Torvalds: Case-insensitive names are horribly wrong, and you shouldn't have done them at all. The problem wasn't the lack of testing, the problem was implementing it in the first place. The problem is then compounded by "trying to do it right", and in the process doing it horrible wrong indeed, because "right" doesn't exist, but trying to will make random bytes have very magical meaning. And btw, the tests are all completely broken anyway. Last I saw, they didn't actually test for all the really interesting cases — the ones that cause security issues in user land. Security issues like "user space checked that the filename didn't match some security-sensitive pattern". And then the shit-for-brains filesystem ends up matching that pattern *anyway*, because the people who do case insensitivity *INVARIABLY* do things like ignore non-printing characters, so now "case insensitive" also means "insensitive to other things too".... Dammit. Case sensitivity is a BUG. The fact that filesystem people *still* think it's a feature, I cannot understand. It's like they revere the old FAT filesystem _so_ much that they have to recreate it — badly. And this led to a very lively back-and-forth discussion.' -- source: https://linux.slashdot.org/story/25/04/27/0547245 Cheers, Peter

1 0

'Linux Mint Debian Edition 7' Gets OEM Support
by Peter Reutemann 15 Apr '25

15 Apr '25

'Linux Mint Debian Edition 7 "will come with full support for OEM installations," according to their monthly newsletter, so Linux Mint "can be pre-installed on computers which are sold throughout the World. It's a very important feature and it's one of the very few remaining things which wasn't supported by Linux Mint Debian Edition." Slashdot reader BrianFagioli speculates that "this could be a sign of something much bigger." OEM installs are typically reserved for operating systems meant to ship on hardware. It's how companies preload Linux on laptops without setting a username, password, or timezone... Mint has supported this for years — but only in its Ubuntu-based version. So why is this feature suddenly coming to Linux Mint Debian Edition, which the team has repeatedly described as a contingency? In other words, if the Debian variant is merely a plan B, why make it ready for OEMs? Their blog post goes on to speculate about possible explanations (like the hypothetical possibility of dissatisfaction with Snap packages or Canonical's decisions around telemetry and packaging).' -- source: https://linux.slashdot.org/story/25/04/12/0518218 Cheers, Peter

2 1

The EFF's 'Certbot' Now Supports Six-Day Certs
by Peter Reutemann 15 Apr '25

15 Apr '25

'10 years ago "certificate authorities normally issued certificate lifetimes lasting a year or more," remembers a new blog post Thursday by the EFF's engineering director. So in 2015 when the free cert authority Let's Encrypt first started issuing 90-day TLS certificates for websites, "it was considered a bold move, that helped push the ecosystem towards shorter certificate life times." And then this January Let's Encrypt announced new six-day certificates... This week saw a related announcement from the EFF engineering director. More than 31 million web sites maintain their HTTPS certificates using the EFF's Certbot tool (which automatically fetches free HTTPS certificates forever) — and Certbot is now supporting Let's Encrypt's six-day certificates. (It's accomplished through ACME profiles with dynamic renewal at 1/3rd of lifetime left or 1/2 of lifetime left, if the lifetime is shorter than 10 days): There is debate on how short these lifetimes should be, but with ACME profiles you can have the default or "classic" Let's Encrypt experience (90 days) or start actively using other profile types through Certbot with the --preferred-profile and --required-profile flags. For six day certificates, you can choose the "shortlived" profile. Why shorter lifetimes are better (according to the EFF's engineering director): - If a certificate's private key is compromised, that compromise can't last as long. - With shorter life spans for the certificates, automation is encouraged. Which facilitates robust security of web servers. - Certificate revocation is historically flaky. Lifetimes 10 days and under prevent the need to invoke the revocation process and deal with continued usage of a compromised key.' -- source: https://it.slashdot.org/story/25/04/14/0356212 Cheers, Peter

1 0

Adobe Gets Bullied Off Bluesky
by Lawrence D'Oliveiro 12 Apr '25

12 Apr '25

Adobe creates a couple of accounts on the Bluesky social network, only to meet a storm of opprobrium, bile, and just plain animosity <https://futurism.com/adobe-bullied-bluesky>. The fact that the company is able to get people to keep paying it more and more money, even as they hate its guts, is quite an achievement. It must take some pretty extensive (and expensive) marketing campaigns.

1 0

Microsoft is About To Launch Recall For Real This Time
by Peter Reutemann 11 Apr '25

11 Apr '25

'Microsoft is starting to gradually roll out a preview of Recall, its feature that captures screenshots of what you do on a Copilot Plus PC to find again later, to Windows Insiders. From a report: This new rollout could indicate that Microsoft is finally getting close to launching Recall more widely. Microsoft originally intended to launch Recall alongside Copilot Plus PCs last June, but the feature was delayed following concerns raised by security experts. The company then planned to launch it in October, but that got pushed as well so that the company could deliver "a secure and trusted experience."' -- source: https://it.slashdot.org/story/25/04/11/0143227 I guess, it's time to turn off video chat with Windows users, unless you would want to be recorded - accidentally or not... I wonder whether they claim "fair use" to include data from their worldwide user base in their model training data. Copyright infringements seem to be fine if you're big like MS or OpenAI, the rest of us can get sued. Cheers, Peter

1 0

slowroads.io
by Lawrence D'Oliveiro 09 Apr '25

09 Apr '25

Found this website which does ... nothing, really. No points to win, no money to pay, no prize, no goal, just drive ... on and on ... with various choices of vehicle and terrain (including some off-Earth). Seems a paid version is being promised for Steam, but in the meantime ... just enjoy your sophisticated Web browser generating absolutely pointless real-time 3D graphics.

1 0

Ubuntu 25.04 “Plucky Puffin” Enters Public Beta Testing with Linux 6.14, GNOME 48
by Peter Reutemann 09 Apr '25

09 Apr '25

'Canonical released today the beta version of the upcoming Ubuntu 25.04 (Plucky Puffin) release for public beta testing, so it’s time to take a look at what to expect from the final release. Powered by the recently released Linux 6.14 kernel and featuring the latest and greatest GNOME 48 desktop environment, Ubuntu 25.04 (codename Plucky Puffin) promises many goodies like the triple buffering feature from Ubuntu, Papers as the default document viewer replacing Evince, and BeaconDB-powered geolocation services. The Ununtu Desktop installer received a new option to replace an existing Ubuntu installation and improvements to dual boot user experience with a focus on BitLocker-protected Windows systems. Users can now install Ubuntu alongside existing BitLocker partitions if enough unallocated space and dual boot support is now available for encrypted installations and other advanced scenarios. Netplan received support for wpa-psk-sha256 Wi-Fi connections, support for configuring routing-policy on the NetworkManager backend, and support for a new functionality in systemd-networkd-wait-online to wait for DNS servers to be configured and reachable before considering an interface to be online.' -- source: https://9to5linux.com/ubuntu-25-04-plucky-puffin-enters-public-beta-testing… Cheers, Peter

1 0

Akamai becomes the official distributor of the Linux kernel
by Peter Reutemann 09 Apr '25

09 Apr '25

Open Source watch reports: 'When I was a young--well, younger anyway--squirt, I ftped my Linux kernel code from Ted T’so, one of the first Linux kernel developers, personal PC, tsx-11.mit.edu. I was glad to do it! Before T'so set up his repository, you had to download the files from Linus Toravalds' machine in Helsinki, Finland, which was s l o w. Mind you, at the time, I recall I downloaded it at a "blazing" fast 64 Kilobits per second (Kbps) over an ISDN line. Hey, it was great in its day. Things have gotten orders of magnitude faster since those days! Now, Akamai, the well-known content delivery network (CDN) and cloud company, has announced a multi-year partnership with the Linux Kernel Organization. This collaboration aims to provide critical infrastructure support for the development and distribution of the Linux kernel, ensuring uninterrupted access for its global network of developers. Akamai will leverage its infrastructure to support kernel.org, the primary platform for Linux kernel source code distribution. This partnership is crucial for maintaining Linux security and performance.' -- source: https://opensourcewatch.beehiiv.com/p/akamai-becomes-the-official-distribut… Cheers, Peter

1 0