- wlug - list.wlug.org.nz

Amazon's Roomba Deal Is Really About Mapping Your Home
by Peter Reutemann 09 Aug '22

09 Aug '22

'Bloomberg: Amazon.com hasn't just bought a maker of robot vacuum cleaners. It's acquired a mapping company. To be more precise: a company that can make maps of your home. The company announced a $1.7 billion deal on Friday for iRobot, the maker of the Roomba vacuum cleaner. And yes, Amazon will make money from selling those gadgets. But the real value resides in those robots' ability to map your house. As ever with Amazon, it's all about the data. A smart home, you see, isn't actually terribly smart. It only knows that your Philips Hue lightbulbs and connected television are in your sitting room because you've told it as much. It certainly doesn't know where exactly the devices are within that room. The more it knows about a given space, the more tightly it can choreograph the way they interact with you. The smart home is clearly a priority for Amazon. Its Echo smart speakers still outsell those from rivals Apple and Google, with an estimated 9.9 million units sold in the three months through March, according to the analysis firm Strategy Analytics. It's complemented that with a $1 billion deal for the video doorbell-maker Ring in 2018, and the wi-fi company Eero a year later. But you still can't readily buy the Astro, Amazon's household robot that was revealed with some fanfare last year, is still only available in limited quantities. That, too, seemed at least partly an effort to map the inside of your property, a task that will now fall to iRobot. The Bedford, Mass.-based company's most recent products include a technology it calls Smart Maps, though customers can opt out of sharing the data. Amazon said in a statement that protecting customer data is "incredibly important." Slightly more terrifying, the maps also represent a wealth of data for marketers. The size of your house is a pretty good proxy for your wealth. A floor covered in toys means you likely have kids. A household without much furniture is a household to which you can try to sell more furniture. This is all useful intel for a company such as Amazon which, you may have noticed, is in the business of selling stuff.' -- source: https://slashdot.org/story/22/08/08/2039234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism's 'Librem 5 USA' Smartphone Achieves Major New Shipping Milestone
by Peter Reutemann 08 Aug '22

08 Aug '22

'Purism posted an announcement Thursday about their privacy-focused "Librem 5 USA" smartphones. "New orders placed today will ship within our standard 10-business-day window." The Librem 5 USA now joins the Librem Mini and Librem 14 as a post-Just In Time product, one where instead of relying on Just In Time supply chains to manufacture a product just as we need it, we have invested in maintaining much larger inventories so that we can better absorb future supply chain issues that may come our way. For anyone who is new to the product, the Librem 5 USA is our premium phone that shares the same hardware design and features as our mass-produced Librem 5, but with electronics we make in the USA using a separate electronics supply chain that sources from US suppliers whenever possible. This results in a tighter, more secure supply chain for the Librem 5 USA. The Librem 5 USA uses the same PureOS as our other computers and so it runs the same desktop Linux applications you might be used to, just on a small screen. PureOS on the Librem 5 USA demonstrates real convergence, where the device becomes more than just a phone, it becomes a full-featured pocket-sized computer that can act like a desktop when connected to a monitor, keyboard and mouse, or even a laptop (or tablet!) when connected to a laptop docking station. All of your files and all of your software remains the same and follows you where you go. Applications just morph from the smaller screen to the larger screen when docked, just like connecting a external monitor to a laptop. Everyone who has backed the Librem 5 and Librem 5 USA projects hasn't just supported the production of the hardware itself, they have also supported a massive, multi-year software development effort to bring the traditional Linux desktop to a phone form-factor. Projects such as Phosh (the GUI), Phoc (the Compositor), Squeekboard (the Keyboard), Calls (for calling), Chats (for texting and messaging), and libhandy/libadwaita (libraries to make GTK applications adaptive) all required massive investment and many of these projects have already been moved to the GNOME infrastructure to better share our effort with a larger community. We are delighted to see that many other mobile projects have recognized the quality of our efforts and adopted our software into their own projects.... The Librem 5 USA was designed for longevity and because we support right to repair, we also offer a number of spare parts in our shop, including replacement modems so you can make sure you support all the cellular bands in a particular continent, replacement batteries for when you ultimately wear out your existing battery, and plenty of other spare parts that haven't had sufficient demand to post formally on our shop (yet). If you need a spare part that isn't yet on the shop, just ask.' -- source: https://linux.slashdot.org/story/22/08/07/0528255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Development Suddenly Resumes on Linux Distro CutefishOS
by Peter Reutemann 08 Aug '22

08 Aug '22

'Last month fans were worried about CuteFish OS, with its domain timing out, emails going unanswered, and a Twitter feed that hadn't posted anything since March. But "now it looks like the original development team behind CuteFishOS is coming back to life," according to this report from The New Stack — with a Reddit user planning a fork now saying that's been put on hold, since "I'd be duplicating work for no reason." Last Sunday — on July 31st — CuteFish's official repository on GitHub was updated with a new announcement in its profile. "Your Favorite CutefishOS are back now!" [sic] It also promised "New website in the works (coming soon)." and pointed to a new URL. You can see the changes happening right before your eyes. That website's domain — OpenFish.org — was registered just ten days ago, on Thursday, July 28th — and it's still a work in progress. On Thursday afternoon it was pointing to a non-English-language page hosted on the Pakistani cloud platform QCloud — but by Thursday night it was showing a testing page for a NGNIX HTTP server running Red Hat Enterprise Linux. And there's now also a new README file in CuteFish's GitHub repository listing five items as "progressing." The first item is "official website preparation," but other items include collating the previous pull requests and issues, "fix the existing problem," and eventually adding new features. The sole contributor to the repository appears to be a Chinese coder going under the name of Biukang. "We are preparing for the restart of CutefishOS," says Biukang's GitHub profile now. But the article still hails last month's discussion of a fork as "a chance to see open source communities mobilizing into action just to fill a perceived void."' -- source: https://linux.slashdot.org/story/22/08/06/0019243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DreamWorks Animation To Release Renderer As Open-Source Software
by Peter Reutemann 07 Aug '22

07 Aug '22

'With annual CG confab SIGGRAPH slated to start Monday in Vancouver, DreamWorks Animation announced its intent to release its proprietary renderer, MoonRay, as open-source software later this year. Hollywood Reporter reports: MoonRay has been used on feature films such as How to Train Your Dragon: The Hidden World, Croods: A New Age, The Bad Guys and upcoming Puss in Boots: The Last Wish. MoonRay uses DreamWorks' distributed computation framework, Arras, also to be included in the open-source code base. "We are thrilled to share with the industry over 10 years of innovation and development on MoonRay's vectorized, threaded, parallel, and distributed code base," said Andrew Pearce, DWA's vp of global technology. "The appetite for rendering at scale grows each year, and MoonRay is set to meet that need. We expect to see the code base grow stronger with community involvement as DreamWorks continues to demonstrate our commitment to open source."' -- source: https://news.slashdot.org/story/22/08/05/229228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After Backlash, GitLab U-Turns on Deleting Dormant Projects
by Peter Reutemann 07 Aug '22

07 Aug '22

'"GitLab has reversed its decision to automatically delete projects that are inactive for more than a year and belong to its free-tier users," reports the Register. Thursday GitLab tweeted: "We discussed internally what to do with inactive repositories. We reached a decision to move unused repos to object storage. Once implemented, they will still be accessible but take a bit longer to access after a long period of inactivity." But the Register says they've seen internal documents from "well-placed sources" showing that GitLab had originally "hoped the move would save it up to $1 million a year and help make its SaaS business sustainable." And the company had spent a long time preparing for such a move: Documents we have seen gave staff notice of an internal meeting scheduled for August 9. The agenda for the meeting lays out the plan to delete dormant code repositories... Other internal documents seen by The Register mention the possible use of object storage to archive projects but express concerns that doing so would increase GitLab's costs by creating a need for multiple redundant backups. We have also seen internal discussions confirming the automation code to delete inactive projects was completed by the end of July, and was ready to roll out after months of debate and development work. One of our sources told us [Thursday] that it was online pressure, led by The Register's reporting, that forced a dramatic rethink at the GitHub rival. Word of the deletion policy as a money-saving exercise sparked fury on Twitter and Reddit. On GitLab's Twitter feed Thursday, someone raised an interesting point about GitLab's new promise to move inactive repos into object storage. "Wait, does 'inactive' mean repositories that have no new commits? Or only those without new commits AND without read access by cloning / fetching?" And GitLab's CEO/co-founder Sid Sijbrandij replied, "We're not sure yet. Probably all write operations would keep a project active, creating an issue, a merge request, pushing changes to a branch, etc. We might also keep it active as long as people are doing read operations such as cloning, forking, etc." Friday Sijbrandij tweeted this status update: "Archived projects is a user activated state that signals intent. We're not sure yet but very likely the storage type used is orthogonal to that. Our current plan for object storage would keep the repos visible to everyone."' -- source: https://developers.slashdot.org/story/22/08/06/0417218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo Browser's Stricter Privacy Protection Will Also Apply To Microsoft Scripts Now
by Peter Reutemann 06 Aug '22

06 Aug '22

'After a revelation in May that DuckDuckGo's (DDG) privacy-focused web browser allows Microsoft tracking scripts on third-party websites, the company now says it will start blocking those too. From a report: DuckDuckGo's browser had third-party tracker loading protection by default that already blocked scripts embedded on websites from Facebook, Google, and others, but until now Microsoft's scripts from the Bing and LinkedIn domains (but not its third-party cookies) had a pass. A security researcher named Zach Edwards pointed out the exclusion that he apparently uncovered while auditing the browser's privacy claims, and noted it is especially curious because Microsoft is the partner that delivers ads in DDG's search engine (while promising not to use that data to create a monitored profile of users to target ads, instead relying on context to decide which ones it should show). DuckDuckGo CEO Gabe Weinberg said at the time that the reason for it was a search syndication agreement with Microsoft, and that more updates on third-party tracker preventions were coming. A backlash ensued, with some seizing on DuckDuckGo's own words that "tracking is tracking," a phrase the company used against Google's cookie-replacing "privacy sandbox" ad technology. Now Weinberg writes in a blog post, "I've heard from a number of users and understand that we didn't meet their expectations around one of our browser's web tracking protections." DuckDuckGo is vowing to be more transparent about what trackers its browser and extensions are protecting users from, making its tracker blocklists available and offering users more information on how its tracking protections with a new help page.' -- source: https://yro.slashdot.org/story/22/08/05/173203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mint 20: disappearing window decorations (MATE)
by Peter Reutemann 05 Aug '22

05 Aug '22

Hi everyone Since a few weeks, I've been getting these random events where all my window decorations are disappearing and I basically have to restart my X session. This happens under Linux Mint 20, MATE edition. Looking through systemd journals, I noticed core dumps and I ran the following command to just list core dumps: sudo coredumpctl list I noticed that "/usr/bin/marco" (the MATE window manager) was causing some of the crashes. After a bit of duckduckgoing, I came across some posts on the Mint forums that mention a bug in marco 1.24, which apparently got fixed in 1.24.1: https://forums.linuxmint.com/viewtopic.php?t=354845 And I'm running indeed that version of the window manager ("dpkg -l | grep marco"): 1.24.0-1ubuntu1 One suggestion was to switch from "marco+compositing" to "metacity+compositing", which I'm trialing now (Control Center -> Desktop settings -> Windows -> Window manager). Maybe this will help other people experiencing this issue... :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

GitLab Plans To Delete Dormant Projects in Free Accounts
by Peter Reutemann 05 Aug '22

05 Aug '22

'GitLab plans to automatically delete projects if they've been inactive for a year and are owned by users of its free tier, The Register reported Thursday. From the report: The Register has learned that such projects account for up to a quarter of GitLab's hosting costs, and that the auto-deletion of projects could save the cloudy coding collaboration service up to $1 million a year. The policy has therefore been suggested to help GitLab's finances remain sustainable. People with knowledge of the situation, who requested anonymity as they are not authorized to discuss it with the media, told The Register the policy is scheduled to come into force in September 2022. GitLab is aware of the potential for angry opposition to the plan, and will therefore give users weeks or months of warning before deleting their work. A single comment, commit, or new issue posted to a project during a 12-month period will be sufficient to keep the project alive. The Register understands some in the wider GitLab community worry that the policy could see projects disappear before users have the chance to archive code on which they rely. As many open-source projects are widely used, it is feared that the decision could have considerable negative impact.' -- source: https://developers.slashdot.org/story/22/08/04/1919231 Ouch... I have a bunch of projects that haven't been touched for years, as they are plugins to stable APIs (and didn't require any fixes/updates). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Raspberry Pi 4 Expands 3D Potential With Vulkan Update
by Peter Reutemann 03 Aug '22

03 Aug '22

'The Raspberry Pi 4 has hit a major graphics milestone, adding support for a more modern Vulkan 3D APIa. Ars Technica reports: Raspberry Pi CEO Eben Upton announced the Pi 4's Vulkan 1.2 conformance on Monday. Support isn't available yet in downloadable Pi-friendly operating systems but should be coming soon. For most people using their Pi as a server, a DIY controller, or a light desktop, Vulkan 1.2 conformance won't be noticeable. Desktop graphics on the standard Raspberry Pi OS are powered by OpenGL, the older graphics API that Vulkan is meant to replace. There is one group that benefits, says Upton: games and other 3D Android applications. Android uses Vulkan as its low-overhead graphics API. As with most Raspberry Pi advancements, there could be unforeseen opportunities unleashed by this seemingly tiny change. Vulkan 1.2 support gives developers the same 3D-graphics interface (if not anywhere near the same power) as 2019 NVIDIA graphics cards, 2020 Intel chips with integrated graphics, and dozens of other devices. With a Vulkan 1.0 driver installed, developer Iago Toral was able in 2020 to get the original Quake trilogy mostly running on a Pi 4, with not-too-shabby frame rates. ' -- source: https://tech.slashdot.org/story/22/08/02/226200 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Gmail Attack Bypasses Passwords and 2FA To Read All Email
by Peter Reutemann 03 Aug '22

03 Aug '22

'Forbes: According to cyber security firm Volexity, the threat research team has found the North Korean 'SharpTongue' group, which appears to be part of, or related to, the Kimsuky advanced persistent threat group, deploying malware called SHARPEXT that doesn't need your Gmail login credentials at all. Instead, it "directly inspects and exfiltrates data" from a Gmail account as the victim browses it. This quickly evolving threat, Volexity says it is already on version 3.0 according to the malware's internal versioning, can steal email from both Gmail and AOL webmail accounts, and works across three browsers: Google Chrome, Microsoft Edge, and a South Korean client called Whale. The U.S. Cybersecurity & Infrastructure Security Agency, CISA, reports that Kimsuky has been operating since 2012, and is "most likely tasked by the North Korean regime with a global intelligence gathering mission." While CISA sees Kimsuky most often targeting individuals and organizations in South Korea, Japan, and the U. S., Volexity says that the SharpTongue group has frequently been seen targeting South Korea, the U. S. and Europe. The common denominator between them is that the victims often " work on topics involving North Korea, nuclear issues, weapons systems, and other matters of strategic interest to North Korea." The report says that SHARPEXT differs from previous browser extensions deployed by these hacking espionage groups in that it doesn't attempt to grab login credentials but bypasses the need for these and can grab email data as the user reads it. The good news is that your system needs to be compromised by some means before this malicious extension can be deployed. Unfortunately, we know all too well that system compromise is not as difficult as it should be. Once a system has been compromised by phishing, malware, unpatched vulnerabilities, whatever, the threat actors can install the extension using a malicious VB script that replaces the system preference files. Once that's done and the extension runs quietly in the background, it is tough to detect. The user logs in to their Gmail account from their normal browser on the expected system. The security researchers recommend "enabling and analyzing PowerShell ScriptBlock logging" to detect whether you've been targeted by this attack, reports Forbes. Additionally, they recommend reviewing installed extensions regularly, especially looking for ones you don't recognize or are not available from the Chrome Web Store.' -- source: https://it.slashdot.org/story/22/08/02/2041205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0