- wlug - list.wlug.org.nz

FFmpeg 7.0 “Dijkstra”: Best New Features
by Peter Reutemann 19 Apr '24

19 Apr '24

'One of the major updates in FFmpeg 7.0 is the parallel execution of operations for unpacking/packing media containers, decoding, encoding, and applying filters using the ffmpeg command line utility. This feature allows for the simultaneous execution of multiple tasks, resulting in a significant improvement in performance and efficiency, particularly when working with large-scale multimedia projects. Another notable addition is the support for encoding and decoding video in MPEG-5 format (EVC – Essential Video Coding) using the external library libxevd. This new format provides high efficiency transmission and storage of all screen resolutions, supports video with an extended dynamic range (HDR), and panoramic video in 360-degree mode. In addition, FFmpeg 7.0 has added unpackers and packers of media containers (demuxer/muxer) for the QOA (Quite OK Audio) format, which is used for transmitting audio with loss of quality. QOA decoding is claimed to be three times faster than Ogg-Vorbis while achieving higher quality and compression levels compared to ADPCM. The new version also includes unpackers and packers of media containers (demuxer/muxer) for the IAMF (Immersive Audio Model and Format) format, which defines a container for distributing surround sound. The format provides for the transmission of additional information necessary for the operation of sound stage reconstruction and sound mixing algorithms, and takes into account the propagation of sound signals in three-dimensional space to recreate sound as close to natural as possible. An experimental decoder for the VVC (Versatile Video Coding) format, also known as the H.266 video compression standard, has been added in FFmpeg 7.0. This new format provides high efficiency transmission and storage of all screen resolutions, supports video with an extended dynamic range (HDR), and panoramic video in 360-degree mode. The ffplay utility has added support for hardware acceleration of decoding using the Vulkan and libplacebo APIs, and the ability to use API D3D12VA (Direct 3D 12 Video Encoding) for hardware acceleration of decoding of H264, HEVC, VP9, AV1, MPEG-2 and VC1 formats has been implemented. [...] Remember: This version is NOT backward compatible. That means, many CLI options and API are removed which are long deprecated. So use caution before upgrading to version 7.0.' -- source: https://www.debugpoint.com/ffmpeg-7-0-features/ Cheers, Peter -- My Open Source Blog - http://open.fracpete.org

1 0

High Priority PuTTY Vulnerability Threatens Server Access Security
by Peter Reutemann 19 Apr '24

19 Apr '24

'A critical security vulnerability in PuTTY, a very popular software for secure terminal access to remote servers, has been discovered. This vulnerability could put the private keys of many users at risk. Cataloged as CVE-2024-31497, the vulnerability affects PuTTY version numbers between 0.68 and 0.80. So, if you have been using PuTTY during this time, it is important to be aware of what this means for your data security. Fabian Bäumer and Marcus Brinkmann of the Ruhr University Bochum found the vulnerability. It concerns how PuTTY forms signatures from the ECDSA private keys on the NIST P521 curve. The vulnerability with PuTTY is that it creates a component of the signature called ‘nonce’ during the generation process. This randomly generated number can be used once in a cryptographic communication, thus ensuring that old communications cannot be reused in replay attacks. However, PuTTY used a deterministic method to generate nonces due to the lack of a high-quality random number generator in early Windows systems. This deterministic method was biased for the P521 curve, which made the private key recovery possible. Simply put, an attacker who gets hold of multiple signed messages can potentially recover your private key due to a specific bias in the signature creation process. This would allow them to forge signatures and access any servers where you’ve used this key.' -- source: https://linuxiac.com/high-priority-putty-vulnerability-found/ Cheers, Peter -- My Open Source Blog - http://open.fracpete.org

1 0

Packages With “t64” On The Ends Of Their Names
by Lawrence D'Oliveiro 15 Apr '24

15 Apr '24

Lately, in Debian Unstable, I have noticed package names starting to appear with “t64” on the ends. No doubt this will percolate through to Debian derivatives as well. I wondered what this was about, and found this forum thread <https://www.antixforum.com/forums/topic/t64-at-the-end-of-a-package-title/>. This has to do with the “year-2038” problem, which should only affect 32-bit systems anyway. But it seems some people are sufficiently concerned about this to ensure that their code will build with a 64-bit size for time_t (the POSIX type for holding the number of seconds since 1st January 1970), even on 32-bit systems. This is controlled at build time by setting the _TIME_BITS symbol to the value 64. There is a file /usr/include/features-time64.h (present if you have the libc6-dev package installed) that does the necessary setup of other time-related API calls based on this. On 64-bit systems (which is what most of us would be running by now), there would be absolutely no difference in the code with this setting. So the change in package name is I think only to maintain compatibility with 32-bit architectures.

1 0

“Highly capable” hackers root corporate networks by exploiting firewall 0-day
by Peter Reutemann 15 Apr '24

15 Apr '24

'Highly capable hackers are rooting multiple corporate networks by exploiting a maximum-severity zero-day vulnerability in a firewall product from Palo Alto Networks, researchers said Friday. The vulnerability, which has been under active exploitation for at least two weeks now, allows the hackers with no authentication to execute malicious code with root privileges, the highest possible level of system access, researchers said. The extent of the compromise, along with the ease of exploitation, has earned the CVE-2024-3400 vulnerability the maximum severity rating of 10.0. The ongoing attacks are the latest in a rash of attacks aimed at firewalls, VPNs, and file-transfer appliances, which are popular targets because of their wealth of vulnerabilities and direct pipeline into the most sensitive parts of a network.' -- source: https://arstechnica.com/security/2024/04/highly-capable-hackers-root-corpor… Cheers, Peter

1 0

APT Interface 'Revamped' For Ubuntu 24.10 and Debian Trixie with Colors and Columns
by Peter Reutemann 15 Apr '24

15 Apr '24

'Ubuntu 24.10 [expected this October] and Debian GNU/Linux 13 "Trixie" [expected June-July 2025] "will feature a refined APT command-line interface," reports 9to5Linux: APT developer and Canonical engineer Julian Andres Klode took to LinkedIn to present the revamped APT interface powered by the upcoming APT 3.0 package manager that looks to give users a more concise and well-laid-out command-line output when updating, installing, or removing packages via the terminal emulator. The new APT 3.0 UI brings a columnar display that will make it easier for users to quickly scan for a package name, support for colors (red for removals and green for other changes), which makes it easier to quickly distinguish commands at a glance, and smoother install progress bars using Unicode blocks. In addition, the new APT 3.0 command-line interface will be less verbose and offer more padding to make it easier to separate sections and extract the relevant information for you. "Bleeding-edge users and Linux enthusiasts who want to try this right now can check out Debian Unstable..."' -- source: https://linux.slashdot.org/story/24/04/14/052258 Cheers, Peter

1 0

Canonical Says Qualcomm Has Joined Ubuntu's 'Silicon Partner' Program
by Peter Reutemann 15 Apr '24

15 Apr '24

'Intel, Nvidia, AMD, and Arm are among Canonical's "silicon partners," a program that "ensures maximum Ubuntu compatibility and long-term support with certified hardware," according to Web Pro News. And now Qualcomm is set to be Canonical's next silicon partner, "giving Qualcomm access to optimized versions of Ubuntu for its processors." Companies looking to use Ubuntu on Qualcomm chips will benefit from an OS that provides 10 years of support and security updates. The collaboration is expected to be a boon for AI, edge computing, and IoT applications. "The combination of Qualcomm Technologies' processors with the popularity of Ubuntu among AI and IoT developers is a game changer for the industry," commented Dev Singh, Vice President, Business Development and Head of Building, Enterprise & Industrial Automation, Qualcomm Technologies, Inc... "Optimised Ubuntu and Ubuntu Core images will be available for Qualcomm SoCs," according to the announcement, "enabling enterprises to meet their regulatory, compliance and security demands for AI at the edge and the broader IoT market with a secure operating system that is supported for 10 years." Qualcomm Technologies chose to partner with Canonical to create an optimised Ubuntu for Qualcomm IoT chipsets, giving developers an easy path to create safe, compliant, security-focused, and high-performing applications for multiple industries including industrial, robotics and edge automation... Developers and enterprises can benefit from the Ubuntu Certified Hardware program, which features a growing list of certified ODM boards and devices based on Qualcomm SoCs. These certified devices deliver an optimised Ubuntu experience out-of-the-box, enabling developers to focus on developing applications and bringing products to market.' -- source: https://news.slashdot.org/story/24/04/14/1652246 Cheers, Peter

1 0

New Spectre V2 Attack Impacts Linux Systems On Intel CPUs
by Peter Reutemann 14 Apr '24

14 Apr '24

'BleepingComputer reports: Researchers have demonstrated the "first native Spectre v2 exploit" for a new speculative execution side-channel flaw that impacts Linux systems running on many modern Intel processors. Spectre V2 is a new variant of the original Spectre attack discovered by a team of researchers at the VUSec group from VU Amsterdam. The researchers also released a tool that uses symbolic execution to identify exploitable code segments within the Linux kernel to help with mitigation. The new finding underscores the challenges in balancing performance optimization with security, which makes addressing fundamental CPU flaws complicated even six years after the discovery of the original Spectre.... As the CERT Coordination Center (CERT/CC) disclosed yesterday, the new flaw, tracked as CVE-2024-2201, allows unauthenticated attackers to read arbitrary memory data by leveraging speculative execution, bypassing present security mechanisms designed to isolate privilege levels. "An unauthenticated attacker can exploit this vulnerability to leak privileged memory from the CPU by speculatively jumping to a chosen gadget," reads the CERT/CC announcement. "Current research shows that existing mitigation techniques of disabling privileged eBPF and enabling (Fine)IBT are insufficient in stopping BHI exploitation against the kernel/hypervisor." ' -- source: https://linux.slashdot.org/story/24/04/13/1911230 Cheers, Peter

1 0

In a First, AlmaLinux Patches a Security Hole That Remains Unpatched in Upstream RHEL
by Peter Reutemann 10 Apr '24

10 Apr '24

'AlmaLinux, a three year old Linux distribution that started life as a clone of Red Hat Enterprise Linux, on Tuesday announced that it had created a patch to fix CVE-2024-1086, a security vulnerability that Red Hat evidently doesn’t think is important enough to patch in RHEL right away. “Though this was flagged as something to be fixed in Red Hat Enterprise Linux, Red Hat has only rated this as a moderate impact,” benny Vasquez, chairperson at the AlmaLinux Foundation explained in an article on the distro’s website on Tuesday. “Our users have asked us to patch this more quickly, and as such, we have opted to include patches ourselves. We released this kernel patch to the testing repo last weekend and plan to push it to production on Wednesday, April 3rd.” Since Vasquez’s post a production ready version of the fix was made available through the distro’s repositories, and Red Hat has re-evaluated the threat from its end and raised the severity level from “moderate” to “important.” There is still no sign of a patch from Red Hat, however, although the company has posted several methods for mitigating the threat. “This flaw is trivially exploitable on most RHEL-equivalent systems,” Vasquez said. “There are many proof-of-concept posts available now, including one from our Infrastructure team lead, Jonathan Wright (Dealing with CVE-2024-1086). In multi-user scenarios, this flaw is especially problematic.”' -- source: https://fossforce.com/2024/04/in-a-first-almalinux-patches-a-security-hole-… Cheers, Peter

1 0

EndeavourOS Bids Farewell to ARM Branch
by Peter Reutemann 10 Apr '24

10 Apr '24

'In a heartfelt announcement today, Bryan Poerwo, founder and project leader of EndeavourOS, marked the end of its ARM product branch. This project has been part of the EndeavourOS journey since its inception from the remnants of Antergos in 2019. The initiative, which began with the help of a passionate community member known as Pudge, later a leading figure of the EndeavourOS ARM team, aimed to extend the reach of EndeavourOS to ARM devices such as the ODROID N2, ODROID XU4, and Raspberry Pi 4. Over nearly five years, EndeavourOS ARM flourished, witnessing additions like support for the PineBook Pro and Raspberry Pi 5 and implementing a Calamares install option alongside the original scripts. However, the journey was challenging. The rapid advancement of Linux and desktop environments on x86_64 devices contrasted sharply with the slower pace of development in the ARM landscape, presenting a series of obstacles that tested the resolve of the project’s pioneers. The widening gap between ARM and x86_64 architectures, reduced external support, and personal transitions in hardware preferences led to a heartfelt decision to conclude the EndeavourOS ARM project. But not all is lost. As the project ends, the community remains hopeful, inviting anyone willing to carry the torch forward. The project’s GitHub repository continues to be available, serving as a foundation for future endeavors in the ARM Linux space.' -- source: https://linuxiac.com/endeavouros-bids-farewell-to-arm-branch/ Cheers, Peter

1 0

TrueNAS Moving From FreeBSD To Debian
by Lawrence D'Oliveiro 09 Apr '24

09 Apr '24

TrueNAS, makers of a turnkey system installation designed for NAS servers, announced close to a month ago that they were changing the emphasis in their product development from “TrueNAS CORE” (which is FreeBSD-based) to “TrueNAS SCALE” (which is Linux-based, specifically Debian-based) <https://www.theregister.com/2024/03/18/truenas_abandons_freebsd/>. This article <https://blocksandfiles.com/2024/04/08/ixsystems-no-one-is-getting-marooned/> gives some more background on the move: Kris Moore, SVP for engineering, told us: “Upstream has shifted. So first of all, ZFS, that’s kind of the heart and soul of TrueNAS and was for FreeNAS as well. Most of that [development] work takes place on Linux these days; features testing, all that happens on Linux. FreeBSD is the thing you port to and you’re done. So that momentum has moved.” ... “We had a huge chunk of our engineering staff spending time improving FreeBSD as opposed to working on features and functionalities. What’s happened now with the transition to having a Debian basis, the people I used to have 90 percent of their time working on FreeBSD, they’re working on ZFS features now … That’s what I want to see; value add for everybody versus sitting around, implementing something Linux had a years ago.” The irony in that is, ZFS was deliberately released by Sun (now Oracle) under a licence that is designed to be incompatible with the GPL that covers the Linux kernel. If you want to argue otherwise, consider that Oracle still refuses to include ZFS with its own Linux distro, preferring to offer you btrfs instead. Of course, you could also view that as a sign of a lack of confidence in its own home-grown filesystem ...

1 0