- wlug - list.wlug.org.nz

Germany to Fund Open Source Software Maintainers Through New Fellowship Program
by Peter Reutemann 07 Aug '24

07 Aug '24

'If you’re of the ilk to complain about governments giving money away and what that means for taxpayers, the Germans — or at least their government — are doing this because it will be good for the economy, meaning they think it’ll make folks better able to pay their taxes rather just empty their pockets for the taxman. This is also why they’ve already spending a substantial amount of money to help fund over 40 FOSS projects. “Open source infrastructure is the backbone of our digital world – and the work of the people who maintain it is essential to ensuring the security and availability of this global resource,” Mirko Swillus wrote in a blog that was published on Thursday. “They lead project development, review changes, manage community interactions, and tackle security issues.” Swillus is program manager at Sovereign Tech Fund, and the blog was to announce fund’s new Fellowship for Maintainers program. “With this new fellowship program, we’re directly investing in the people behind the code by paying maintainers of critical open source components for their work,” he wrote.' -- source: https://fossforce.com/2024/08/germany-to-fund-open-source-software-maintain… Cheers, Peter

1 0

How to replace Windows with Linux Mint on your PC
by Peter Reutemann 05 Aug '24

05 Aug '24

'Are you sick of Windows fouling up? Do you want to try something different? Then, it's time to try the best Linux desktop, Linux Mint 22. I've used more operating systems than you can shake a stick at. I cut my teeth on IBM 360/OS in the 1970s. Since then, I've used every Apple and Microsoft operating system you've heard of, and many you've never known, such as A/UX and Microsoft Xenix. I've also used well over 100 different Unix and Linux distributions. So, when I say Linux Mint 22 -- the latest long-term support (LTS) version of Linux Mint -- is not just the best Linux desktop, but the best desktop, it means something. - Materials needed: Windows PC, internet connection, and a DVD-RW or USB stick with 3GB or more storage - Estimated time: 2 hours - Estimated cost: $5' -- source: https://www.zdnet.com/article/how-to-replace-windows-with-linux-mint-on-you… With the continuing enshittification [1] of Windows, maybe a good time to get folks moved to a less intrusive operating system... Cheers, Peter [1] https://en.wikipedia.org/wiki/Enshittification

1 0

First Look at Serpent OS: Minimal GNOME Desktop and Rust-Based Package Manager
by Peter Reutemann 02 Aug '24

02 Aug '24

'The wait is finally over and Ikey Doherty’s long-anticipated Serpent OS distribution has an ISO image that people can download and test on bare metal hardware or virtual machines to see what the fuss is all about. Four years ago I broke news that Ikey Doherty is making a new distro called Serpent Linux (it was later changed to Serpent OS) aiming to provide the Linux community with a truly modern distribution for people who want to just use Linux. The name of the distribution is inspired by the Serpent game created by Ikey Doherty. At that time, Serpent OS was supposed to ship with the KDE Plasma desktop environment by default, but things have changed and GNOME was chosen as the default for the initial release. The first pre-alpha ISO image includes the older GNOME 45.3 release, but I’m sure the final release will use a more recent version. Serpent OS offers a minimal GNOME desktop experience with only a handful of apps pre-installed, such as the Mozilla Firefox web browser, GNOME Console terminal emulator, GNOME Text Editor text editing app, Zed code editor, GNOME’s Loupe image viewer, and GNOME Extensions. However, Serpent OS supports Flatpak apps if you need to install the apps you need, but Flatpak support is not installed by default in this pre-alpha release.' -- source: https://9to5linux.com/first-look-at-serpent-os-minimal-gnome-desktop-and-ru… Cheers, Peter

1 0

“In the future, computers may weigh no more than 1.5 tonnes.”
by Lawrence D'Oliveiro 01 Aug '24

01 Aug '24

Nice collection of vintage computer pics/clips, along with some pithy quotes from the times (1945-1990). Which ones can you identify without looking at the captions? <https://www.docubyte.com/projects/guide-to-computing/>

1 0

The Unintended Consequences Linux’s Wayland Adoption Will Have on BSD
by Peter Reutemann 31 Jul '24

31 Jul '24

'Like most people who use Linux as their daily driver, I’ve been pleased lately to see that Wayland is finally getting some serious traction and is on its way to being the default display server for most mainstream Linux distributions. It’s been a long trip from the days when we first heard that X was on its way out and that Wayland was on its way in — 15 years as a matter of fact — so the better performance, more svelte code base, enhanced security, and all of the other advantages that Wayland brings to the table being just about here for some of us, and already here for others, is indeed good news. But before we pop the cork on the champagne bottles and start the celebrations, perhaps we should consider that this good news for Linux might not be good news for those running BSD or one of the Unixes, which is something that normally would never occur to me to think about since I’ve never tried to use BSD. The only reason I’m thinking about it now is because this weekend I ran across a post by Chris Siebenmann, a Unix systems administrator at the University of Toronto’s CS Labs. Being a Unix guy by day (and I suspect a BSD guy by night), he’s all on what Wayland on Linux means to BSD/Unix stuck on X, and he’s been thinking about what Linux’s move to Wayland is going to mean for desktop BSDs and Unixes. “Once upon a time, the future of Unix desktops looked fairly straightforward,” he wrote. “Everyone ran on X, so the major threat to cross-Unix portability in major desktops was the use of Linux only APIs, which became especially D-Bus and systemd related things. Unix desktops that were less attached to tight integration with the Linux environment would probably stay easily available on FreeBSD, OpenBSD, and so on.” The main thing I got from that is that for a long time, the BSDs have benefited somewhat from Linux. In this case, because both operating systems use X, it was relatively easy (“relatively” probably being the key word here) to port most popular “Linux” desktop environments to BSD. The trouble is, according to Siebenmann, those days might be coming to an end.' -- source: https://fossforce.com/2024/07/the-unintended-consequences-linuxs-wayland-ad… Cheers, Peter

2 1

LZ4 Compression Algorithm Gets Multi-Threaded Update
by Peter Reutemann 29 Jul '24

29 Jul '24

'Slashdot reader Seven Spirals brings news about the lossless compression algorithm LZ4: The already wonderful performance of the LZ4 compressor just got better with multi-threaded additions to it's codebase. In many cases, LZ4 can compress data faster than it can be written to disk giving this particular compressor some very special applications. The Linux kernel as well as filesystems like ZFS use LZ4 compression extensively. This makes LZ4 more comparable to the Zstd compression algorithm, which has had multi-threaded performance for a while, but cannot match the LZ4 compressor for speed, though it has some direct LZ4. >From Linuxiac.com: - On Windows 11, using an Intel 7840HS CPU, compression time has improved from 13.4 seconds to just 1.8 seconds — a 7.4 times speed increase. - macOS users with the M1 Pro chip will see a reduction from 16.6 seconds to 2.55 seconds, a 6.5 times faster performance. - For Linux users on an i7-9700k, the compression time has been reduced from 16.2 seconds to 3.05 seconds, achieving a 5.4 times speed boost... The release supports lesser-known architectures such as LoongArch, RISC-V, and others, ensuring LZ4's portability across various platforms. ' -- source: https://hardware.slashdot.org/story/24/07/28/0057247 Cheers, Peter

1 0

What Happens If You Connect Windows XP To the Internet In 2024?
by Peter Reutemann 29 Jul '24

29 Jul '24

'Long-time Slashdot reader sandbagger writes: Have you ever wondered if it's true you can instantly get malware? In this video, a person connects an XP instance directly to the internet with no firewall to see just how fast it gets compromised by malware, rootkits, malicious services and new user accounts. The answer — fast! Malwarebytes eventually finds eight different viruses/Trojan horses -- and a DNS changer. (One IP address leads back to the Russian federation.) It's fun to watch -- within just a few hours a new Windows user has even added themself. And for good measure, he also opens up Internet Explorer... - Windows XP -- very insecure, they conclude at the end of the video. Very easy for random software from the internet to get more privileges than you, and it is very hard to solve that. - Also, just out of curiosity I tried this on Windows 7. And even with all of the same settings, nothing happened. I let it run for 10 hours. So it seems like this may be a problem in historical Windows.' -- source: https://tech.slashdot.org/story/24/07/28/2137216 Cheers, Peter

1 0

Secure Boot is completely broken on 200+ models from 5 big device makers
by Peter Reutemann 26 Jul '24

26 Jul '24

'On Thursday, researchers from security firm Binarly revealed that Secure Boot is completely compromised on more than 200 device models sold by Acer, Dell, Gigabyte, Intel, and Supermicro. The cause: a cryptographic key underpinning Secure Boot on those models that was compromised in 2022. In a public GitHub repository committed in December of that year, someone working for multiple US-based device manufacturers published what’s known as a platform key, the cryptographic key that forms the root-of-trust anchor between the hardware device and the firmware that runs on it. The repository was located at https://github.com/raywu-aaeon/Ryzen2000_4000.git, and it's not clear when it was taken down. The repository included the private portion of the platform key in encrypted form. The encrypted file, however, was protected by a four-character password, a decision that made it trivial for Binarly, and anyone else with even a passing curiosity, to crack the passcode and retrieve the corresponding plain text. The disclosure of the key went largely unnoticed until January 2023, when Binarly researchers found it while investigating a supply-chain incident. Now that the leak has come to light, security experts say it effectively torpedoes the security assurances offered by Secure Boot. “It’s a big problem,” said Martin Smolár, a malware analyst specializing in rootkits who reviewed the Binarly research and spoke to me about it. “It’s basically an unlimited Secure Boot bypass for these devices that use this platform key. So until device manufacturers or OEMs provide firmware updates, anyone can basically… execute any malware or untrusted code during system boot. Of course, privileged access is required, but that’s not a problem in many cases.”' -- source: https://arstechnica.com/security/2024/07/secure-boot-is-completely-compromi… Cheers, Peter

2 1

distrobox
by Peter Reutemann 26 Jul '24

26 Jul '24

Just came across distrobox, which seems a useful extension to container managers like docker/podman/lilipod, allowing you to run other distros in your shell: 'Use any Linux distribution inside your terminal. Enable both backward and forward compatibility with software and freedom to use whatever distribution you’re more comfortable with. Distrobox uses podman, docker or lilipod to create containers using the Linux distribution of your choice. The created container will be tightly integrated with the host, allowing sharing of the HOME directory of the user, external storage, external USB devices and graphical apps (X11/Wayland), and audio.' -- source: https://distrobox.it/ That should be especially useful for people working in environments where they are forced to use a specific host OS. As long as they have one of the supported container managers available, they can easily switch! Cheers, Peter

1 0

Anyone can Access Deleted and Private Repository Data on GitHub
by Peter Reutemann 26 Jul '24

26 Jul '24

'You can access data from deleted forks, deleted repositories and even private repositories on GitHub. And it is available forever. This is known by GitHub, and intentionally designed that way. This is such an enormous attack vector for all organizations that use GitHub that we’re introducing a new term: Cross Fork Object Reference (CFOR). A CFOR vulnerability occurs when one repository fork can access sensitive data from another fork (including data from private and deleted forks). Similar to an Insecure Direct Object Reference, in CFOR users supply commit hashes to directly access commit data that otherwise would not be visible to them. ' -- source: https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo… Interesting read! Cheers, Peter

1 0