- wlug - list.wlug.org.nz

FreeBSD 14.3 Released
by Peter Reutemann 12 Jun '25

12 Jun '25

'Michael Larabel of Phoronix highlights the key updates in today's stable release of FreeBSD 14.3: FreeBSD 14.3 has back-ported a number of improvements from FreeBSD 15 back to the FreeBSD 14 series. Plus a number of routine package updates and other fixes. Some of the FreeBSD 14.3-RELEASE highlights include: - Updating the ZFS support against OpenZFS 2.2.7. - Merging of the Realtek RTW88 and RTW89 WiFi drivers based on the Linux 6.14 kernel code. - The LinuxKPI code has been improved to support crypto offload as well as the 802.11n and 802.11ac standards. - The Intel IX Ethernet driver has added support for the x550 1000BAS-BX SFP modules. - Thor2 PCI IDs added to the Broadcom NetXtreme "BNXT" driver along with support for 400G speed modules. - XZ 5.8.1, OpenSSH 9.9p2, OpenSSL 3.0.16, and many other package updates. - Syscons as the legacy system console driver is now considered deprecated. Syscons is not compatible with UEFI, lacks UTF-8 support, and is Giant-locked. ' -- source: https://bsd.slashdot.org/story/25/06/10/2146224 Cheers, Peter

2 1

Ubuntu Linux 25.10 Quietly Kills Off GNOME On Xorg As Wayland Takes Over
by Peter Reutemann 12 Jun '25

12 Jun '25

'Ubuntu 25.10, known as Questing Quokka, is taking a big turn under the hood. Canonical has dropped support for the GNOME desktop running on Xorg. Starting with this release, the default Ubuntu session now uses Wayland only. Yes, folks, there's no longer an option to log into GNOME on Xorg.' -- source: https://news.slashdot.org/story/25/06/10/181234 Cheers, Peter

1 0

New Linux Flaws Allow Password Hash Theft via Core Dumps in Ubuntu, RHEL, Fedora
by Peter Reutemann 12 Jun '25

12 Jun '25

'Two information disclosure flaws have been identified in apport and systemd-coredump, the core dump handlers in Ubuntu, Red Hat Enterprise Linux, and Fedora, according to the Qualys Threat Research Unit (TRU). Tracked as CVE-2025-5054 and CVE-2025-4598, both vulnerabilities are race condition bugs that could enable a local attacker to obtain access to access sensitive information. Tools like Apport and systemd-coredump are designed to handle crash reporting and core dumps in Linux systems. "These race conditions allow a local attacker to exploit a SUID program and gain read access to the resulting core dump," Saeed Abbasi, manager of product at Qualys TRU, said.' -- source: https://thehackernews.com/2025/05/new-linux-flaws-allow-password-hash.html Cheers, Peter

1 0

Wikipedia Pauses AI-Generated Summaries After Editor Backlash
by Peter Reutemann 12 Jun '25

12 Jun '25

'The Wikimedia Foundation halted an experiment that would have displayed AI-generated summaries atop Wikipedia articles after the platform's volunteer editor community delivered an overwhelmingly negative response to the proposal. The foundation announced the two-week mobile trial on June 2 and suspended it just one day later following dozens of critical comments from editors. The experiment, called "Simple Article Summaries," would have used Cohere's open-weight Aya model to generate simplified versions of complex Wikipedia articles. The AI-generated summaries would have appeared at the top of articles with a yellow "unverified" label, requiring users to click to expand and read them. Editors responded with comments including "very bad idea," "strongest possible oppose," and simply "Yuck."' -- source: https://news.slashdot.org/story/25/06/11/1732215 Cheers, Peter

1 0

Android 16 Is Here
by Peter Reutemann 11 Jun '25

11 Jun '25

'Today, we're bringing you Android 16, rolling out first to supported Pixel devices with more phone brands to come later this year. This is the earliest Android has launched a major release in the last few years, which ensures you get the latest updates as soon as possible on your devices. Android 16 lays the foundation for our new Material 3 Expressive design, with features that make Android more accessible and easy to use.' -- source: https://mobile.slashdot.org/story/25/06/10/2021249 Cheers, Peter

1 0

RIP Bill Atkinson
by Lawrence D'Oliveiro 08 Jun '25

08 Jun '25

This article <https://daringfireball.net/linked/2025/06/07/bill-atkinson-rip> reports the death of legendary Apple Macintosh pioneer Bill Atkinson, at the age of 74, from cancer. Atkinson is known for, among other things, the “QuickDraw” graphics engine, which was at the core of how those early Macintoshes could manage graphics drawing at interactive speeds, on a processor running at a nominal 8MHz clock speed, with no hardware acceleration. He also created the MacPaint application, to show off the artistic capabilities of the Macintosh -- and its ease of use. There is a video somewhere of Atkinson’s 2-year-old daughter using MacPaint, her tiny fist barely big enough to cover the mouse, otherwise being quite comfortable figuring out the drawing tools. And later, he created HyperCard, which was one of those forays into “end-user programming” which was perhaps more successful than most. Atkinson is named on Apple’s patent for the “region” structure, which was a compact way of representing arbitrary regions of pixels, which might have holes in them or even consist of entirely disjoint pieces. These structures were heavily used in QuickDraw for clipping graphics drawing (particularly for dealing with overlapping windows), though they could be rendered as graphics objects in their own right. Apple’s patent meant that nobody else could use that structure. For example, X11 had to use a less efficient way of representing pixel regions. The patent did finally expire around 2004, I think it was.

1 0

KDE Targets Windows 10 'Exiles' Claiming 'Your Computer is Toast'
by Peter Reutemann 05 Jun '25

05 Jun '25

'Linux desktop darling KDE is weighing in on the controversy around the impending demise of Windows 10 support with a lurid "KDE for Windows 10 Exiles" campaign. KDE's alarming "Exiles" page opens with the text "Your computer is toast" followed by a warning that Microsoft wants to turn computers running Windows 10 into junk from October 14. "It may seem like it continues to work after that date for a bit, but when Microsoft stops support for Windows 10, your perfectly good computer will be officially obsolete." Beneath a picture of a pile of tech junk, including a rotary telephone and some floppy drives, KDE proclaims: "Windows 10 will degrade as more and more bugs come to light. With nobody to correct them, you risk being hacked. Your data, identity, and control over your device could be stolen."' -- source: https://tech.slashdot.org/story/25/06/04/186206 The exiles page: https://kde.org/for/w10-exiles/ Cheers, Peter

1 0

Meta and Yandex Are De-Anonymizing Android Users' Web Browsing Identifiers
by Peter Reutemann 04 Jun '25

04 Jun '25

'"It appears as though Meta (aka: Facebook's parent company) and Yandex have found a way to sidestep the Android Sandbox," writes Slashdot reader TheWho79. Researchers disclose the novel tracking method in a report: We found that native Android apps -- including Facebook, Instagram, and several Yandex apps including Maps and Browser -- silently listen on fixed local ports for tracking purposes. These native Android apps receive browsers' metadata, cookies and commands from the Meta Pixel and Yandex Metrica scripts embedded on thousands of web sites. These JavaScripts load on users' mobile browsers and silently connect with native apps running on the same device through localhost sockets. As native apps access programmatically device identifiers like the Android Advertising ID (AAID) or handle user identities as in the case of Meta apps, this method effectively allows these organizations to link mobile browsing sessions and web cookies to user identities, hence de-anonymizing users' visiting sites embedding their scripts. This web-to-app ID sharing method bypasses typical privacy protections such as clearing cookies, Incognito Mode and Android's permission controls. Worse, it opens the door for potentially malicious apps eavesdropping on users' web activity. While there are subtle differences in the way Meta and Yandex bridge web and mobile contexts and identifiers, both of them essentially misuse the unvetted access to localhost sockets. The Android OS allows any installed app with the INTERNET permission to open a listening socket on the loopback interface (127.0.0.1). Browsers running on the same device also access this interface without user consent or platform mediation. This allows JavaScript embedded on web pages to communicate with native Android apps and share identifiers and browsing habits, bridging ephemeral web identifiers to long-lived mobile app IDs using standard Web APIs. This technique circumvents privacy protections like Incognito Mode, cookie deletion, and Android's permission model, with Meta Pixel and Yandex Metrica scripts silently communicating with apps across over 6 million websites combined. Following public disclosure, Meta ceased using this method on June 3, 2025. Browser vendors like Chrome, Brave, Firefox, and DuckDuckGo have implemented or are developing mitigations, but a full resolution may require OS-level changes and stricter enforcement of platform policies to prevent further abuse.' -- source: https://yro.slashdot.org/story/25/06/03/205251 Cheers, Peter

1 0

Beware of the Browser-in-the-Middle Attack: What It Is and How to Protect Yourself
by Peter Reutemann 04 Jun '25

04 Jun '25

'A new security threat called the browser-in-the-middle (BITM) attack has recently been uncovered, exposing users—especially those using Apple’s Safari browser—to potential exploits that could compromise their privacy and security. Reports from BleepingComputer and GBHackers highlight how attackers can take advantage of browser fullscreen features to trick users into revealing sensitive information. [...] A browser-in-the-middle attack is a phishing-like technique that leverages the browser’s fullscreen mode to impersonate legitimate websites or system dialogs. By forcing the browser to enter fullscreen mode, attackers can overlay fake login screens, pop-ups, or security warnings that look authentic but actually capture user input such as passwords, credit card numbers, or other personal data. Unlike traditional man-in-the-middle attacks that intercept communications, BITM attacks manipulate the user interface itself to create convincing illusions. Because fullscreen mode hides browser UI elements like the address bar or tabs, users may be unaware they are interacting with a fraudulent page. According to the reports, Safari’s fullscreen API is particularly vulnerable to BITM attacks. Attackers can use JavaScript to force fullscreen without user consent or notification and then display spoofed content that mimics trusted websites or system alerts. This makes Safari users a prime target, although the risk isn’t limited to this browser alone.' -- source: https://cyptd.com/beware-of-the-browser-in-the-middle-attack-what-it-is-and… Cheers, Peter

1 0

OpenSnitch: The Must-Have Application Firewall for Linux
by Peter Reutemann 29 May '25

29 May '25

'When it comes to protecting your Linux system from unwanted network connections, having a good firewall is essential. While most Linux users rely on traditional firewalls like iptables, firewalls, or ufw, these usually work at the network level and don’t give detailed control over which applications can connect to the internet. This is where OpenSnitch comes in, a GNU/Linux application firewall designed to give you control over your outgoing connections on a per-application basis. In this article, we will explore what OpenSnitch is, how it helps secure your Linux machine, and guide you through simple installation and usage steps.' -- source: https://www.tecmint.com/opensnitch-linux-application-firewall/ Cheers, Peter

1 0