- wlug - list.wlug.org.nz

vim and files from gvfs mounted file systems
by Peter Reutemann 19 Dec '24

19 Dec '24

Hi everyone Since upgrading to Linux Mint 22 Wilma and vim 9.1.x, I noticed an issue with vim when editing remote files (eg mounted via sftp through caja): saving the file would fail. Not ideal... Looks like there is an issue with gvfs mounted file systems: https://github.com/vim/vim/issues/5309 https://github.com/vim/vim/issues/5237#issuecomment-1366262853 Disabling the creation of backup files avoids the issue: :set backupcopy=no Or, if you want to automate it based on path, you can place the following in your .vimrc: autocmd BufRead,BufNewFile /run/user/* set backupcopy=no Cheers, Peter

1 0

TP-Link faces possible US ban as hijacked routers fuel Chinese attacks
by Peter Reutemann 19 Dec '24

19 Dec '24

'US government authorities are reportedly investigating whether to ban TP-Link wireless routers, which have been targeted in some high-profile attacks linked to the Chinese government. TP-Link, which was founded in China in 1996 and said it relocated its headquarters to the US in October this year, has racked up significant market share in US homes and businesses. US authorities are investigating whether TP-Link "poses a national-security risk and are considering banning the devices," The Wall Street Journal reported today. The WSJ notes that TP-Link is "the top choice on Amazon.com, and powers Internet communications for the Defense Department and other federal government agencies."' -- source: https://arstechnica.com/tech-policy/2024/12/report-us-considers-banning-tp-… Maybe time to flash your TP-Link router with something like OpenWRT? https://openwrt.org/toh/start Cheers, Peter

1 0

Australia Moves To Drop Some Cryptography By 2030
by Peter Reutemann 19 Dec '24

19 Dec '24

'Australia's chief cyber security agency has decided local orgs should stop using the tech that forms the current cryptographic foundation of the internet by the year 2030 -- years before other nations plan to do so -- over fears that advances in quantum computing could render it insecure. The Land Down Under's plans emerged last week when the Australian Signals Directorate (ASD) published guidance for High Assurance Cryptographic Equipment (HACE) -- devices that send and/or receive sensitive information -- that calls for disallowing the cryptographic algorithms SHA-256, RSA, ECDSA and ECDH, among others, by the end of this decade. Bill Buchanan, professor in the School of Computing at Edinburgh Napier University, wrote a blog post in which he expressed shock that the ASD aims to move so quickly. "Basically, these four methods are used for virtually every web connection that we create, and where ECDH is used for the key exchange, ECDSA or RSA is used to authenticate the remote server, and SHA-256 is used for the integrity of the data sent," he wrote. "The removal of SHA-256 definitely goes against current recommendations."' -- source: https://it.slashdot.org/story/24/12/18/173242 Cheers, Peter

1 0

Xfce 4.20 Desktop Environment Released with Experimental Wayland Support
by Peter Reutemann 17 Dec '24

17 Dec '24

'Two years after the release of Xfce 4.18, Xfce 4.20 is here as another major update to this light and fast desktop environment for GNU/Linux distributions. Xfce 4.20 is packed with lots of new features and improvements like experimental support for Wayland with support for the Labwc and Wayfire compositors, improved support for HiDPI displays, and libxfce4windowing as a new abstraction library to present windowing concepts in a windowing-system-independent manner. Wayland sessions of Xfce can be started with the startxfce4 --wayland command. However, you should keep in mind that several Xfce components don’t run at all on Wayland, including the Xfwm4 window manager, Xfdashboard, Xfce4-screensaver, Xfce4-windowck-plugin, and Xfce4-xkb-plugin. “So far Xfce does not feature a compositor which supports Wayland. If you want to run Xfce in Wayland, Labwc and Wayfire will give you the best results,” said the Xfce development team. “Plans are underway to add Wayland support to Xfwm4 while preserving its existing X11 functionality. However, such a restructurization will be a major effort and we cannot tell yet when/if it will be done, so please don’t hold your breath waiting for it.”' -- source: https://9to5linux.com/xfce-4-20-desktop-environment-released-with-experimen… Cheers, Peter

1 0

How to Share Your Linux Terminal Over the Web Using Ttyd
by Peter Reutemann 16 Dec '24

16 Dec '24

Looks like an interesting project: 'Ttyd is a simple tool that allows you to share a Linux terminal over a web browser. It’s cross-platform and uses the libuv and WebGL2 Javascript APIs for performance and real-time connection between the browser and Linux terminal. The SSL support is offered by OpenSSL. It supports multiple clients at once, allowing multiple clients to connect to the same Linux terminal from different browsers (or tabs). No additional package is required on the client-side, only the correct web address is needed. You can use this tool for remote system administration, troubleshooting, assisting a friend with any specific task, debugging or recovering a process, and much more.' -- source: https://linuxtldr.com/installing-ttyd/ Cheers, Peter

3 2

Let's Encrypt Announces New-Certificate-Every-6-Days Offering
by Peter Reutemann 16 Dec '24

16 Dec '24

'The non-profit, free certificate authority Let's Encrypt shared some news from their executive director as they approach their 10th anniversary in 2025: Internally things have changed dramatically from what they looked like ten years ago, but outwardly our service hasn't changed much since launch. That's because the vision we had for how best to do our job remains as powerful today as it ever was: free 90-day TLS certificates via an automated API. Pretty much as many as you need. More than 500,000,000 websites benefit from this offering today, and the vast majority of the web is encrypted. Our longstanding offering won't fundamentally change next year, but we are going to introduce a new offering that's a big shift from anything we've done before — short-lived certificates. Specifically, certificates with a lifetime of six days. This is a big upgrade for the security of the TLS ecosystem because it minimizes exposure time during a key compromise event. Because we've done so much to encourage automation over the past decade, most of our subscribers aren't going to have to do much in order to switch to shorter lived certificates. We, on the other hand, are going to have to think about the possibility that we will need to issue 20x as many certificates as we do now. It's not inconceivable that at some point in our next decade we may need to be prepared to issue 100,000,000 certificates per day. That sounds sort of nuts to me today, but issuing 5,000,000 certificates per day would have sounded crazy to me ten years ago... It was hard to build Let's Encrypt. It was difficult to scale it to serve half a billion websites... Charitable contributions from people like you and organizations around the world make this stuff possible. Since 2015, tens of thousands of people have donated. They've made a case for corporate sponsorship, given through their Donor-Advised Funds, or set up recurring donations, sometimes to give $3 a month. That's all added up to millions of dollars that we've used to change the Internet for nearly everyone using it.' -- source: https://it.slashdot.org/story/24/12/15/0059216 Cheers, Peter

1 0

Banan OS: A Fully Functional Unix-like OS Built From Scratch In C++
by Peter Reutemann 16 Dec '24

16 Dec '24

'A student has built an entire operating system from scratch in C++. Yes, you read that right! Meet Banan OS, a hobbyist operating system for x86_64 and i686 architectures, written entirely in C++ by an university student Oskari Alaranta. The project is fully independent, with all code written exclusively by Alaranta, except for any ported software.' -- source: https://ostechnix.com/banan-os-a-fully-functional-linux-os-built-from-scrat… Cheers, Peter

1 0

Raspberry Pi 500 Brings All-in-One PC Power to Your Desk for Just $90
by Peter Reutemann 13 Dec '24

13 Dec '24

'Just in time for the holiday season, Raspberry Pi has launched two highly anticipated products that promise to revolutionize compact computing. Enter the Raspberry Pi 500 and the official Raspberry Pi Monitor, designed to provide a sleek and complete desktop experience at an exceptionally affordable price. Raspberry Pi’s mission has always been clear: to provide affordable, programmable personal computers to people worldwide. Over the years, this vision has expanded as the company has grown into one of the leading manufacturers of industrial and embedded computers. For example, products like the $15 Raspberry Pi Zero 2 W and the flagship Raspberry Pi 5 have demonstrated the company’s ability to cater to both cost-conscious and performance-driven audiences. Let’s also not forget that just two weeks ago, the company announced another exciting product, the Raspberry Pi Compute Module 5, specifically designed for embedded applications. And now, building on the success of the Raspberry Pi 400, the newly launched Raspberry Pi 500 takes compact computing to the next level. Combining the high-performance Raspberry Pi 5 platform with an all-in-one form factor, this device offers exceptional power and versatility: - Processor: 2.4GHz quad-core 64-bit Arm Cortex-A76 - Memory: 8GB LPDDR4X-4267 SDRAM - Graphics: VideoCore VII GPU, supporting OpenGL ES 3.1 and Vulkan 1.3 - Display Outputs: Dual 4Kp60 HDMI - Connectivity: Dual-band 802.11ac Wi-Fi, Bluetooth 5.0, and Gigabit Ethernet - Ports: 2 USB 3.0, 1 USB 2.0 - GPIO Connector: Horizontal 40-pin Raspberry Pi GPIO' -- source: https://linuxiac.com/raspberry-pi-500-announced/ Cheers, Peter

1 0

AMD’s trusted execution environment blown wide open by new BadRAM attack
by Peter Reutemann 11 Dec '24

11 Dec '24

'One of the oldest maxims in hacking is that once an attacker has physical access to a device, it’s game over for its security. The basis is sound. It doesn’t matter how locked down a phone, computer, or other machine is; if someone intent on hacking it gains the ability to physically manipulate it, the chances of success are all but guaranteed. In the age of cloud computing, this widely accepted principle is no longer universally true. Some of the world’s most sensitive information—health records, financial account information, sealed legal documents, and the like—now often resides on servers that receive day-to-day maintenance from unknown administrators working in cloud centers thousands of miles from the companies responsible for safeguarding it. In response, chipmakers have begun baking protections into their silicon to provide assurances that even if a server has been physically tampered with or infected with malware, sensitive data funneled through virtual machines can’t be accessed without an encryption key that’s known only to the VM administrator. Under this scenario, admins inside the cloud provider, law enforcement agencies with a court warrant, and hackers who manage to compromise the server are out of luck. On Tuesday, an international team of researchers unveiled BadRAM, a proof-of-concept attack that completely undermines security assurances that chipmaker AMD makes to users of one of its most expensive and well-fortified microprocessor product lines. Starting with the AMD Epyc 7003 processor, a feature known as SEV-SNP—short for Secure Encrypted Virtualization and Secure Nested Paging—has provided the cryptographic means for certifying that a VM hasn’t been compromised by any sort of backdoor installed by someone with access to the physical machine running it. If a VM has been backdoored, the cryptographic attestation will fail and immediately alert the VM admin of the compromise. Or at least that’s how SEV-SNP is designed to work. BadRAM is an attack that a server admin can carry out in minutes, using either about $10 of hardware, or in some cases, software only, to cause DDR4 or DDR5 memory modules to misreport during bootup the amount of memory capacity they have. From then on, SEV-SNP will be permanently made to suppress the cryptographic hash attesting its integrity even when the VM has been badly compromised. “BadRAM completely undermines trust in AMD's latest Secure Encrypted Virtualization (SEV-SNP) technology, which is widely deployed by major cloud providers, including Amazon AWS, Google Cloud, and Microsoft Azure,” members of the research team wrote in an email. “BadRAM for the first time studies the security risks of bad RAM—rogue memory modules that deliberately provide false information to the processor during startup. We show how BadRAM attackers can fake critical remote attestation reports and insert undetectable backdoors into _any_ SEV-protected VM.”' -- source: https://arstechnica.com/information-technology/2024/12/new-badram-attack-ne… Cheers, Peter

1 0

Linux Mint Dethrones MX Linux As the Most Popular Distro On DistroWatch
by Peter Reutemann 11 Dec '24

11 Dec '24

'Linux Mint has reclaimed its position as the top-ranked Linux distribution on DistroWatch, dethroning MX Linux. The latest page hit rankings, which reflect the popularity of distributions among DistroWatch users, place Linux Mint in first place with 2,412 hits per day. MX Linux, previously the reigning champ, now sits in second with 2,280 hits.' -- source: https://linux.slashdot.org/story/24/12/10/1754230 Cheers, Peter

1 0