June 2025 - wlug - list.wlug.org.nz

Actively exploited vulnerability gives extraordinary control over server fleets
by Peter Reutemann 21 Jul '25

21 Jul '25

'Hackers are exploiting a maximum-severity vulnerability that has the potential to give them complete control over thousands of servers, many of which handle mission-critical tasks inside data centers, the US Cybersecurity and Infrastructure Security Agency is warning. The vulnerability, carrying a severity rating of 10 out of a possible 10, resides in the AMI MegaRAC, a widely used firmware package that allows large fleets of servers to be remotely accessed and managed even when power is unavailable or the operating system isn't functioning. These motherboard-attached microcontrollers, known as baseboard management controllers (BMCs), give extraordinary control over servers inside data centers. Administrators use BMCs to reinstall operating systems, install or modify apps, and make configuration changes to large numbers of servers without physically being on premises and, in many cases, without the servers being turned on. Successful compromise of a single BMC can be used to pivot into internal networks and compromise all other BMCs. CVE-2024-54085, as the vulnerability is tracked, allows for authentication bypasses by making a simple web request to a vulnerable BMC device over HTTP. The vulnerability was discovered by security firm Eclypsium and disclosed in March. The disclosure included proof-of-concept exploit code allowing a remote attacker to create an admin account without providing any authentication. At the time of the disclosure, there were no known reports of the vulnerability being actively exploited. On Wednesday, CISA added CVE-2024-54085 to its list of vulnerabilities known to be exploited in the wild. The notice provided no further details.' -- source: https://arstechnica.com/security/2025/06/active-exploitation-of-ami-managem… Cheers, Peter

4 6

PNG Spec, 3rd Edition, Is Out
by Lawrence D'Oliveiro 27 Jun '25

27 Jun '25

There is has been a major update to the specification for the PNG (“Portable Network Graphics”) file-format spec <https://www.programmax.net/articles/png-is-back/>, 20 years on from the previous edition. New features include support for high-dynamic-range colour gamuts, using a new metadata entry type that is much more compact than a full embedded ICC colour profile, and the official acceptance of the APNG format for animating a sequence of images within a single PNG file.

1 0

Blender 5.0 Introducing HDR Support On Linux With Vulkan + Wayland
by Peter Reutemann 27 Jun '25

27 Jun '25

'Michael Larabel writes via Phoronix: The upcoming Blender 5.0 3D modeling software application is introducing High Dynamic Range (HDR) display support on Linux when making use of Wayland -- no X11 support for HDR -- and Vulkan graphics accelerator. HDR support for Blender 5.0 on Linux is currently considered experimental. Enabling the HDR support on Linux for the Blender creator software requires having a High Dynamic Range display (of course) and be running on a Wayland desktop, enabling Vulkan API acceleration rather than OpenGL, and enabling the feature currently deemed experimental. ' -- source: https://linux.slashdot.org/story/25/06/26/2035245 Cheers, Peter

2 1

Lyon Abandons Microsoft Office To Strengthen 'Digital Sovereignty'
by Peter Reutemann 26 Jun '25

26 Jun '25

'The City of Lyon will replace Microsoft's office suite with free office software, including OnlyOffice for office work and Linux and PostgreSQL for systems and databases. The city aims to "no longer be dependent on American software solutions and acquire true digital sovereignty," according to an official statement. ' -- source: https://slashdot.org/story/25/06/25/1757229 Great to see that the digital sovereignty movement gaining momentum, if only down-under as well... Cheers, Peter

1 0

Mozilla Formally Discontinues Its DeepSpeech Project
by Peter Reutemann 26 Jun '25

26 Jun '25

'One of the interesting projects engaged in by Mozilla that directly wasn't related to their web browser efforts was DeepSpeech, an embedded/offline speech-to-text engine. To not much surprise given the lack of activity in recent years, last week they finally and formally discontinued the open-source project. Mozilla DeepSpeech was a promising speech-to-text engine with great performance for real-time communication even when running on Raspberry Pi SBCs and other low-power systems.' -- source: https://tech.slashdot.org/story/25/06/25/1851201 It's hard to compete with other publicly available models like OpenAI's whisper, which are really, really good. Cheers, Peter

1 0

Games Run Faster On SteamOS Than Windows 11, Ars Testing Finds
by Peter Reutemann 26 Jun '25

26 Jun '25

'A report from Ars Technica: Nearly a decade ago, Ars testing found that Valve's "Steam Machines"-era version of SteamOS performed significantly worse than Windows when SteamOS's Linux game ports were tested on the same hardware as their Windows counterparts. Today, though, Ars testing on the Lenovo Legion Go S finds recent games generally run at higher frame rates on SteamOS 3.7 than on Windows 11. [...] As you can see in the included charts, SteamOS showed noticeable frame rate improvements in four of the five games tested. Only Borderlands 3 showed comparable performance across both operating systems, with Windows eking out ever-so-slightly higher frame rates in that game's benchmarks. For the other four tested games, the stock Lenovo Windows drivers were sometimes significantly worse than those included with SteamOS. When playing Returnal at "High" graphics presets and 1920x1200 resolution, for instance, changing from Lenovo's Windows drivers to SteamOS meant the difference between a hard-to-take 18 FPS average and a downright decent 33 FPS average. Sideloading the updated Asus drivers showed a noticeable improvement in Windows performance across all tested games and even brought Homeworld 3's "Low" graphics benchmark test to practical parity with SteamOS. In all other cases, though, even these updated drivers resulted in benchmark frame rates anywhere from 8 percent to 36 percent lower than those same benchmarks on SteamOS. These results might seem a bit counterintuitive, considering that games running on SteamOS must go through a Proton translation layer for every native Windows instruction in a game's code. But Valve has put in consistent work over the years to make Proton as efficient and cross-compatible as possible; not to mention its continued work on Linux's Mesa graphics drivers seems to be paying dividends for SteamOS graphics performance. Running SteamOS also means eliminating a lot of operating system overhead that the more generalist Windows uses by default. Microsoft seems aware of this issue for gamers and has recently announced that the upcoming "Xbox Experience for Handheld" will "minimize background activity and defer non-essential tasks" to allow for "more [and] higher framerates" in games.' -- source: https://games.slashdot.org/story/25/06/25/2034243 Cheers, Peter

1 0

Ubuntu To Disable Intel Graphics Security Mitigations To Boost GPU Performance By Up To 20%
by Peter Reutemann 24 Jun '25

24 Jun '25

'Disabling Intel graphics security mitigations in GPU compute stacks for OpenCL and Level Zero can yield a performance boost of up to 20%, prompting Ubuntu's Canonical and Intel to disable these mitigations in future Ubuntu packages. Phoronix's Michael Larabel reports: Intel does allow building their GPU compute stack without these mitigations by using the "NEO_DISABLE_MITIGATIONS" build option and that is what Canonical is looking to set now for Ubuntu packages to avoid the significant performance impact. This work will likely all be addressed in time for Ubuntu 25.10. This NEO_DISABLE_MITIGATIONS option is just for compiling the Intel Compute Runtime stack and doesn't impact the Linux kernel security mitigations or else outside of Intel's "NEO" GPU compute stack. Both Intel and Canonical are in agreement with this move and it turns out that even Intel's GitHub binary packages for their Compute Runtime for OpenCL and Level Zero ship with the mitigations disabled due to the performance impact. This Ubuntu Launchpad bug report for the Intel Compute Runtime notes some of the key takeaways. There is also this PPA where Ubuntu developers are currently testing their Compute Runtime builds with NEO_DISABLE_MITIGATIONS enabled for disabling the mitigations.' -- source: https://news.slashdot.org/story/25/06/23/2046259 Cheers, Peter

1 0

WebVM
by Peter Reutemann 24 Jun '25

24 Jun '25

Just came across this project on my Mastodon feed: 'WebVM is a server-less virtual environment running fully client-side in HTML5/WebAssembly. It's designed to be Linux ABI-compatible. It runs an unmodified Debian distribution including many native development toolchains. WebVM is powered by the CheerpX virtualization engine, and enables safe, sandboxed client-side execution of x86 binaries on any browser. CheerpX includes an x86-to-WebAssembly JIT compiler, a virtual block-based file system, and a Linux syscall emulator.' -- github: https://github.com/leaningtech/webvm -- mastodon: https://mastodon.social/@nixCraft/114735683692335386 Cheers, Peter

1 0

How The Grateful Dead Built The Internet
by Lawrence D'Oliveiro 23 Jun '25

23 Jun '25

Here’s an interesting piece, from the BBC of all places, about the role that a hippie band that started in the 1960s went on to play in the culture of the early Internet <https://www.bbc.com/future/article/20250618-how-the-grateful-dead-shaped-so…>. Not only were their stage shows technology-heavy, but they somehow managed to attract a major following among technologists of all kinds. Among the other members of that milieu was Steward Brand, creator of the Whole Earth Catalog, a resource for those looking for tools to help them live a simpler life, less dominated by faceless corporates and promoting more intimate, personal power. Quote from the introduction: “We are as gods and might as well get used to it.” Brand went on to co-found the WELL, aka the “Whole Earth ’Lectronic Link”, which started out as a BBS with users connecting via dialup lines, before becoming an Internet-connected service -- one of the earliest examples, if not *the* earliest example, of “social media”, if you will. John Perry Barlow, one of the lyricists for the Grateful Dead, got heavily involved in the WELL and then went on to found the Electronic Frontier Foundation, dedicated to the preservation of free speech and other civil rights in the online world.

2 1

OpenPGP Versus GnuPG
by Lawrence D'Oliveiro 23 Jun '25

23 Jun '25

It seems the developers of GnuPG are starting to diverge from the OpenPGP standard, and go their own, incompatible way. I got notes about this from the last few upgrades of my Debian Unstable systems, and so searching about online led me (yet again) to the ever-dependable ArchLinux Wiki <https://wiki.archlinux.org/title/GnuPG>, which has a section on “OpenPGP compatibility”, with links to more details about the schism. So the Debian folks seem reluctant to go along with this, and they’re not the only ones.

2 1