- wlug - list.wlug.org.nz

Tails 7.0 Anonymous Linux OS Officially Released, Based on Debian 13 “Trixie”
by Peter Reutemann 07 Oct '25

07 Oct '25

'Tails 7.0 is out today as a major update to this portable Linux OS based on the Debian GNU/Linux operating system that protects users against surveillance and censorship. Highlights of Tails 7.0 include a Debian 13 “Trixie” base and a kernel from the long-term supported Linux 6.12 LTS series from the upstream Debian release, the latest GNOME 48 desktop environment by default featuring GNOME Console as default terminal emulator and GNOME Loupe as default image viewer. The Tails devs note the fact that the Root Terminal was broken when replacing GNOME Terminal with GNOME Console, so they renamed Root Terminal to Root Console. They also removed the Kleopatra app from the Favorites menu, so now users will have to start Kleopatra from Apps > Accessories. Moreover, they removed the obsolete Network Connection option from the Welcome Screen, the Places menu, and some packages from the live ISO image, including unar, aircrack-ng, and sq. Tails 7.0 ships with many updated components, including Tor 0.4.8.17, Tor Browser 14.5.7, Mozilla Thunderbird 128.14 ESR, OnionShare 2.6.3, Kleopatra 24.12, KeePassXC 2.7.10, GIMP 3.0.4, Inkscape 1.4, Audacity 3.7.3, and Electrum 4.5.8. For Inkscape, Tails now skips the onboarding. This release also fixes various issues, including an issue with selecting the correct keyboard for certain languages. Check out the release notes for more details about the changes included in Tails 7.0, which is available for download right now from the official website as ISO and USB images for 64-bit systems.' -- source: https://9to5linux.com/tails-7-0-anonymous-linux-os-released-based-on-debian… Cheers, Peter

1 0

Redis Warns of Critical Flaw Impacting Thousands of Instances
by Peter Reutemann 07 Oct '25

07 Oct '25

'BleepingComputer reports: The Redis security team has released patches for a maximum severity vulnerability that could allow attackers to gain remote code execution on thousands of vulnerable instances. Redis (short for Remote Dictionary Server) is an open-source data structure store used in approximately 75% of cloud environments, functioning like a database, cache, and message broker, and storing data in RAM for ultra-fast access. The security flaw (tracked as CVE-2025-49844) is caused by a 13-year-old use-after-free weakness found in the Redis source code and can be exploited by authenticated threat actors using a specially crafted Lua script (a feature enabled by default). Successful exploitation enables them to escape the Lua sandbox, trigger a use-after-free, establish a reverse shell for persistent access, and achieve remote code execution on the targeted Redis hosts. After compromising a Redis host, attackers can steal credentials, deploy malware or cryptocurrency mining tools, extract sensitive data from Redis, move laterally to other systems within the victim's network, or use stolen information to gain access to other cloud services. "This grants an attacker full access to the host system, enabling them to exfiltrate, wipe, or encrypt sensitive data, hijack resources, and facilitate lateral movement within cloud environments," said Wiz researchers, who reported the security issue at Pwn2Own Berlin in May 2025 and dubbed it RediShell. While successful exploitation requires attackers first to gain authenticated access to a Redis instance, Wiz found around 330,000 Redis instances exposed online, with at least 60,000 of them not requiring authentication. Redis and Wiz urged admins to patch their instances immediately by applying security updates released on Friday, "prioritizing those that are exposed to the internet." To further secure their Redis instances against remote attacks, admins can also enable authentication, disable Lua scripting and other unnecessary commands, launch Redis using a non-root user account, enable Redis logging and monitoring, limit access to authorized networks only, and implement network-level access controls using firewalls and Virtual Private Clouds (VPCs).' -- source: https://it.slashdot.org/story/25/10/06/222222 Cheers, Peter

1 0

Systemd 258 Drops cgroup v1, Raises Kernel Baseline to 5.4
by Peter Reutemann 06 Oct '25

06 Oct '25

'Systemd, a widely adopted system and service manager for Linux, has released its latest iteration, v258, which introduces significant changes that administrators should be aware of. Probably the headline change is that support for cgroup v1—the so-called “legacy” and “hybrid” hierarchies—has been removed. From now on, only cgroup v2 is mounted during boot and inside systemd-nspawn containers. Another notable move is the bump in the minimum kernel requirement. The baseline is now Linux 5.4, first released back in 2019, with 5.7 listed as the recommended version. That means older distributions or kernels simply won’t be able to run systemd 258. Security changes are also in play. By default, tty/pts device nodes now get mode 0600 instead of the old 0620, which effectively means “mesg n” is the new normal. On the crypto side, OpenSSL has become the only supported backend for systemd-resolved and systemd-importd, dropping support for both GnuTLS and libgcrypt. Session handling has been reworked, too. systemd-logind now assigns system jobs like cron tasks or FTP sessions to new “light” classes by default. That way, they won’t spin up a full per-user service manager unless explicitly configured. PAM sessions tied to normal users remain unchanged. Admins maintaining old setups should also take note: support for System V–style init scripts is officially deprecated and scheduled for removal in systemd 259. The same goes for the legacy /run/lock/ directory, and for iptables support in networkd and nspawn, which will rely solely on nftables from the next release.' -- source: https://linuxiac.com/systemd-258-drops-cgroup-v1-raises-kernel-baseline-to-… Cheers, Peter

1 0

How to switch your Windows 10 PC to Linux Mint - for free
by Peter Reutemann 06 Oct '25

06 Oct '25

Maybe this article with step-by-step instructions might help some of the Windows user in your circle to switch to Linux... -- source: https://www.zdnet.com/article/how-to-switch-your-windows-10-pc-to-linux-min… Cheers, Peter

1 0

We Asked LibreOffice and Collabora: Why Aren’t They in Schools Instead of Word and Google Docs?
by Peter Reutemann 30 Sep '25

30 Sep '25

'Much free and open source software helps its users save money as possible — on both hardware and software — while protecting their privacy. It also often makes it easy for them to learn how it works — if they’re interested — and customize it in any way they want or need. With such features, FOSS should be the default choice in any educational environment, in these days when many schools face budget cuts, and switching to “free as in free beer” proprietary cloud applications like Microsoft Teams or Google Docs to save money has the consequence of actively preparing and educating pupils to be endless sources of data to be exploited for the likes of money and political control. That being true, how come so many schools and universities still accept — if not demand — that their students use only proprietary software and clouds? How come so many taxpayer dollars allocated for public education ends up being used to make the likes of Microsoft and Google even richer? Saving money can’t be the only answer — especially in the long term. [...] In my experience, besides ignorance and resistance to change, the main reasons why too many schools still don’t use LibreOffice and Collabora Online in 2025 are, in no particular order: - Money - Already established supply chains - Teacher overload - Isolation - Cloud computing - Improper formatting choices' -- source: https://fossforce.com/2025/09/we-asked-libreoffice-and-collabora-why-arent-… Cheers, Peter

1 0

Ubuntu 25.10 Switches to Dracut as Default Initramfs Tool
by Peter Reutemann 30 Sep '25

30 Sep '25

'The big news came from the Canonical camp. Ubuntu developers have officially approved a long-planned move affecting a fundamental system component: starting with Ubuntu 25.10 “Questing Quokka,” the distro will switch from initramfs-tools to Dracut as its default initramfs generation tool. For readers who aren’t too tech-savvy, I will immediately clarify that the initramfs is the temporary root filesystem the Linux kernel uses at boot. It contains the drivers and scripts needed to mount the actual system and get everything running. And just for reference, Ubuntu has relied on initramfs-tools for nearly two decades. Surprising to many or not, Dracut was originally developed in the Fedora/Red Hat ecosystem. What makes it stand out is that, instead of relying on big sets of custom shell scripts, it builds the initramfs image using small, reusable modules. This modular design makes it easier to maintain, more consistent across different Linux distros, and often faster to update.' -- source: https://linuxiac.com/ubuntu-25-10-switches-to-dracut-as-default-initramfs-t… Cheers, Peter

1 0

Meta Learned The Wrong Lesson From Frances Haugen
by Lawrence D'Oliveiro 12 Sep '25

12 Sep '25

Remember when Frances Haugen came forward in 2021 to reveal that Facebook/Meta knew it was causing harm to underage users, but didn’t seem keen to do anything about it <https://www.theverge.com/policy/775623/meta-whistleblowers-hearing-virtual-…>? The company did make changes as a result of that revelation, but they were the wrong kind of changes: instead of actually fixing the problem of underage harm, it decided to stop collecting the data that revealed that harm. It has restricted researchers’ access, and threatened the jobs of those who wanted to gather data on “forbidden” topics.

1 0

FFmpeg 8.0 “Huffman” Released with AV1 Vulkan Encoder, VVC VA-API Decoding
by Peter Reutemann 04 Sep '25

04 Sep '25

'FFmpeg 8.0 has been released today as a major update to this open-source multimedia framework that introduces numerous features, including new decoders, as well as various improvements. Dubbed “Huffman” and coming more than ten months after FFmpeg 7.1, the FFmpeg 8.0 release is here to enable TLS peer certificate verification by default, add an AV1 Vulkan encoder, introduce VP9 Vulkan and ProRes RAW Vulkan hardware-acceleration, and implement APV encoding support through a libopenapv wrapper. FFmpeg 8.0 also introduces animated JPEG XL encoding via the libjxl library, adds multitrack audio/video and modern codec support to FLV v2, adds VVC (Versatile Video Coding) support in Matroska (MKV), and adds VVC decoder support to all SCC (Screen Content Coding) content, including IBC (Inter Block Copy), Palette Mode, and ACT (Adaptive Color Transform). Several new filters are present in this release, including a Whisper filter, a pad_cuda filter, a Colordetect filter, and a vf_scale_d3d11 filter. New decoders are here as well, including a VVC VA-API decoder, a RealVideo 6.0 decoder, an ADPCM IMA Xbox decoder, a G.728 decoder, a Sanyo LD-ADPCM decoder, and a ProRes RAW decoder. On top of that, FFmpeg 8.0 brings libx265 alpha layer encoding, CENC AV1 support in the MP4 muxer, an APV decoder, along with APV raw bitstream muxing and demuxing support, an APV parser, APV support for MP4/ISOBMFF muxing and demuxing, as well as an OpenHarmony hardware decoder and encoder. Among other noteworthy changes, FFmpeg 8.0 drops support for OpenSSL 1.1.0 and previous versions, no longer disables GCC autovectorization on x86, ARM, and AArch64 (ARM64) architectures, sets the default prediction method for pngenc to PAETH, deprecates OpenMAX encoders, and drops yasm support in favor of nasm.' -- source: https://9to5linux.com/ffmpeg-8-0-huffman-released-with-av1-vulkan-encoder-v… The "Whisper filter" would be used for automatically generating sub-titles: https://www.phoronix.com/news/FFmpeg-Lands-Whisper I've used whisper before and it is quite impressive. Cheers, Peter

1 0

FreeBSD Project Isn't Ready To Let AI Commit Code Just Yet
by Peter Reutemann 04 Sep '25

04 Sep '25

'The latest status report from the FreeBSD Project says no thanks to code generated by LLM-based assistants. From a report: The FreeBSD Project's Status Report for the second quarter of 2025 contains updates from various sub-teams that are working on improving the FreeBSD OS, including separate sub-projects such as enabling FreeBSD apps to run on Linux, Chinese translation efforts, support for Solaris-style Extended Attributes, and for Apple's legacy HFS+ file system. The thing that stood out to us, though, was that the core team is working on what it terms a "Policy on generative AI created code and documentation." The relevant paragraph says: "Core is investigating setting up a policy for LLM/AI usage (including but not limited to generating code). The result will be added to the Contributors Guide in the doc repository. AI can be useful for translations (which seems faster than doing the work manually), explaining long/obscure documents, tracking down bugs, or helping to understand large code bases. We currently tend to not use it to generate code because of license concerns. The discussion continues at the core session at BSDCan 2025 developer summit, and core is still collecting feedback and working on the policy."' -- source: https://developers.slashdot.org/story/25/09/03/1649201 Cheers, Peter

1 0

Are AI Web Crawlers 'Destroying Websites' In Their Hunt for Training Data?
by Peter Reutemann 01 Sep '25

01 Sep '25

Hi everyone I thought this news item rather fitting when I saw it this morning, considering Daniel's experience with these AI bots hammering the wlug wiki: '"AI web crawlers are strip-mining the web in their perpetual hunt for ever more content to feed into their Large Language Model mills," argues Steven J. Vaughan-Nichols at the Register. And "when AI searchbots, with Meta (52% of AI searchbot traffic), Google (23%), and OpenAI (20%) leading the way, clobber websites with as much as 30 Terabits in a single surge, they're damaging even the largest companies' site performance..." How much traffic do they account for? According to Cloudflare, a major content delivery network (CDN) force, 30% of global web traffic now comes from bots. Leading the way and growing fast? AI bots... Anyone who runs a website, though, knows there's a huge, honking difference between the old-style crawlers and today's AI crawlers. The new ones are site killers. Fastly warns that they're causing "performance degradation, service disruption, and increased operational costs." Why? Because they're hammering websites with traffic spikes that can reach up to ten or even twenty times normal levels within minutes. Moreover, AI crawlers are much more aggressive than standard crawlers. As the InMotionhosting web hosting company notes, they also tend to disregard crawl delays or bandwidth-saving guidelines and extract full page text, and sometimes attempt to follow dynamic links or scripts. The result? If you're using a shared server for your website, as many small businesses do, even if your site isn't being shaken down for content, other sites on the same hardware with the same Internet pipe may be getting hit. This means your site's performance drops through the floor even if an AI crawler isn't raiding your website... AI crawlers don't direct users back to the original sources. They kick our sites around, return nothing, and we're left trying to decide how we're to make a living in the AI-driven web world. Yes, of course, we can try to fend them off with logins, paywalls, CAPTCHA challenges, and sophisticated anti-bot technologies. You know one thing AI is good at? It's getting around those walls. As for robots.txt files, the old-school way of blocking crawlers? Many — most? — AI crawlers simply ignore them... There are efforts afoot to supplement robots.txt with llms.txt files. This is a proposed standard to provide LLM-friendly content that LLMs can access without compromising the site's performance. Not everyone is thrilled with this approach, though, and it may yet come to nothing. In the meantime, to combat excessive crawling, some infrastructure providers, such as Cloudflare, now offer default bot-blocking services to block AI crawlers and provide mechanisms to deter AI companies from accessing their data. ' -- source: https://tech.slashdot.org/story/25/08/31/1820249 Cheers, Peter

1 0