- wlug - list.wlug.org.nz

First Look at Serpent OS: Minimal GNOME Desktop and Rust-Based Package Manager
by Peter Reutemann 02 Aug '24

02 Aug '24

'The wait is finally over and Ikey Doherty’s long-anticipated Serpent OS distribution has an ISO image that people can download and test on bare metal hardware or virtual machines to see what the fuss is all about. Four years ago I broke news that Ikey Doherty is making a new distro called Serpent Linux (it was later changed to Serpent OS) aiming to provide the Linux community with a truly modern distribution for people who want to just use Linux. The name of the distribution is inspired by the Serpent game created by Ikey Doherty. At that time, Serpent OS was supposed to ship with the KDE Plasma desktop environment by default, but things have changed and GNOME was chosen as the default for the initial release. The first pre-alpha ISO image includes the older GNOME 45.3 release, but I’m sure the final release will use a more recent version. Serpent OS offers a minimal GNOME desktop experience with only a handful of apps pre-installed, such as the Mozilla Firefox web browser, GNOME Console terminal emulator, GNOME Text Editor text editing app, Zed code editor, GNOME’s Loupe image viewer, and GNOME Extensions. However, Serpent OS supports Flatpak apps if you need to install the apps you need, but Flatpak support is not installed by default in this pre-alpha release.' -- source: https://9to5linux.com/first-look-at-serpent-os-minimal-gnome-desktop-and-ru… Cheers, Peter

1 0

“In the future, computers may weigh no more than 1.5 tonnes.”
by Lawrence D'Oliveiro 01 Aug '24

01 Aug '24

Nice collection of vintage computer pics/clips, along with some pithy quotes from the times (1945-1990). Which ones can you identify without looking at the captions? <https://www.docubyte.com/projects/guide-to-computing/>

1 0

The Unintended Consequences Linux’s Wayland Adoption Will Have on BSD
by Peter Reutemann 31 Jul '24

31 Jul '24

'Like most people who use Linux as their daily driver, I’ve been pleased lately to see that Wayland is finally getting some serious traction and is on its way to being the default display server for most mainstream Linux distributions. It’s been a long trip from the days when we first heard that X was on its way out and that Wayland was on its way in — 15 years as a matter of fact — so the better performance, more svelte code base, enhanced security, and all of the other advantages that Wayland brings to the table being just about here for some of us, and already here for others, is indeed good news. But before we pop the cork on the champagne bottles and start the celebrations, perhaps we should consider that this good news for Linux might not be good news for those running BSD or one of the Unixes, which is something that normally would never occur to me to think about since I’ve never tried to use BSD. The only reason I’m thinking about it now is because this weekend I ran across a post by Chris Siebenmann, a Unix systems administrator at the University of Toronto’s CS Labs. Being a Unix guy by day (and I suspect a BSD guy by night), he’s all on what Wayland on Linux means to BSD/Unix stuck on X, and he’s been thinking about what Linux’s move to Wayland is going to mean for desktop BSDs and Unixes. “Once upon a time, the future of Unix desktops looked fairly straightforward,” he wrote. “Everyone ran on X, so the major threat to cross-Unix portability in major desktops was the use of Linux only APIs, which became especially D-Bus and systemd related things. Unix desktops that were less attached to tight integration with the Linux environment would probably stay easily available on FreeBSD, OpenBSD, and so on.” The main thing I got from that is that for a long time, the BSDs have benefited somewhat from Linux. In this case, because both operating systems use X, it was relatively easy (“relatively” probably being the key word here) to port most popular “Linux” desktop environments to BSD. The trouble is, according to Siebenmann, those days might be coming to an end.' -- source: https://fossforce.com/2024/07/the-unintended-consequences-linuxs-wayland-ad… Cheers, Peter

2 1

LZ4 Compression Algorithm Gets Multi-Threaded Update
by Peter Reutemann 29 Jul '24

29 Jul '24

'Slashdot reader Seven Spirals brings news about the lossless compression algorithm LZ4: The already wonderful performance of the LZ4 compressor just got better with multi-threaded additions to it's codebase. In many cases, LZ4 can compress data faster than it can be written to disk giving this particular compressor some very special applications. The Linux kernel as well as filesystems like ZFS use LZ4 compression extensively. This makes LZ4 more comparable to the Zstd compression algorithm, which has had multi-threaded performance for a while, but cannot match the LZ4 compressor for speed, though it has some direct LZ4. >From Linuxiac.com: - On Windows 11, using an Intel 7840HS CPU, compression time has improved from 13.4 seconds to just 1.8 seconds — a 7.4 times speed increase. - macOS users with the M1 Pro chip will see a reduction from 16.6 seconds to 2.55 seconds, a 6.5 times faster performance. - For Linux users on an i7-9700k, the compression time has been reduced from 16.2 seconds to 3.05 seconds, achieving a 5.4 times speed boost... The release supports lesser-known architectures such as LoongArch, RISC-V, and others, ensuring LZ4's portability across various platforms. ' -- source: https://hardware.slashdot.org/story/24/07/28/0057247 Cheers, Peter

1 0

What Happens If You Connect Windows XP To the Internet In 2024?
by Peter Reutemann 29 Jul '24

29 Jul '24

'Long-time Slashdot reader sandbagger writes: Have you ever wondered if it's true you can instantly get malware? In this video, a person connects an XP instance directly to the internet with no firewall to see just how fast it gets compromised by malware, rootkits, malicious services and new user accounts. The answer — fast! Malwarebytes eventually finds eight different viruses/Trojan horses -- and a DNS changer. (One IP address leads back to the Russian federation.) It's fun to watch -- within just a few hours a new Windows user has even added themself. And for good measure, he also opens up Internet Explorer... - Windows XP -- very insecure, they conclude at the end of the video. Very easy for random software from the internet to get more privileges than you, and it is very hard to solve that. - Also, just out of curiosity I tried this on Windows 7. And even with all of the same settings, nothing happened. I let it run for 10 hours. So it seems like this may be a problem in historical Windows.' -- source: https://tech.slashdot.org/story/24/07/28/2137216 Cheers, Peter

1 0

Secure Boot is completely broken on 200+ models from 5 big device makers
by Peter Reutemann 26 Jul '24

26 Jul '24

'On Thursday, researchers from security firm Binarly revealed that Secure Boot is completely compromised on more than 200 device models sold by Acer, Dell, Gigabyte, Intel, and Supermicro. The cause: a cryptographic key underpinning Secure Boot on those models that was compromised in 2022. In a public GitHub repository committed in December of that year, someone working for multiple US-based device manufacturers published what’s known as a platform key, the cryptographic key that forms the root-of-trust anchor between the hardware device and the firmware that runs on it. The repository was located at https://github.com/raywu-aaeon/Ryzen2000_4000.git, and it's not clear when it was taken down. The repository included the private portion of the platform key in encrypted form. The encrypted file, however, was protected by a four-character password, a decision that made it trivial for Binarly, and anyone else with even a passing curiosity, to crack the passcode and retrieve the corresponding plain text. The disclosure of the key went largely unnoticed until January 2023, when Binarly researchers found it while investigating a supply-chain incident. Now that the leak has come to light, security experts say it effectively torpedoes the security assurances offered by Secure Boot. “It’s a big problem,” said Martin Smolár, a malware analyst specializing in rootkits who reviewed the Binarly research and spoke to me about it. “It’s basically an unlimited Secure Boot bypass for these devices that use this platform key. So until device manufacturers or OEMs provide firmware updates, anyone can basically… execute any malware or untrusted code during system boot. Of course, privileged access is required, but that’s not a problem in many cases.”' -- source: https://arstechnica.com/security/2024/07/secure-boot-is-completely-compromi… Cheers, Peter

2 1

distrobox
by Peter Reutemann 26 Jul '24

26 Jul '24

Just came across distrobox, which seems a useful extension to container managers like docker/podman/lilipod, allowing you to run other distros in your shell: 'Use any Linux distribution inside your terminal. Enable both backward and forward compatibility with software and freedom to use whatever distribution you’re more comfortable with. Distrobox uses podman, docker or lilipod to create containers using the Linux distribution of your choice. The created container will be tightly integrated with the host, allowing sharing of the HOME directory of the user, external storage, external USB devices and graphical apps (X11/Wayland), and audio.' -- source: https://distrobox.it/ That should be especially useful for people working in environments where they are forced to use a specific host OS. As long as they have one of the supported container managers available, they can easily switch! Cheers, Peter

1 0

Anyone can Access Deleted and Private Repository Data on GitHub
by Peter Reutemann 26 Jul '24

26 Jul '24

'You can access data from deleted forks, deleted repositories and even private repositories on GitHub. And it is available forever. This is known by GitHub, and intentionally designed that way. This is such an enormous attack vector for all organizations that use GitHub that we’re introducing a new term: Cross Fork Object Reference (CFOR). A CFOR vulnerability occurs when one repository fork can access sensitive data from another fork (including data from private and deleted forks). Similar to an Insecure Direct Object Reference, in CFOR users supply commit hashes to directly access commit data that otherwise would not be visible to them. ' -- source: https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo… Interesting read! Cheers, Peter

1 0

Run0 vs Sudo: What’s the Difference?
by Peter Reutemann 25 Jul '24

25 Jul '24

'Run0 is a new privilege escalation program for Systemd-based Linux systems. Similar to sudo, it allows you to run commands as a root user and access your machine’s internals. In this article, we compare Run0 vs Sudo to help you determine the right privilege escalation tool for you.' -- source: https://www.maketecheasier.com/run0-vs-sudo-whats-the-difference/ Honestly, I only came across Run0 the other day. I still remember the days of using "su" to get stuff done, long before sudo. Is anyone using Run0? What are your experiences? Cheers, Peter

1 0

It Never Rains But It Pours
by Lawrence D'Oliveiro 24 Jul '24

24 Jul '24

Instructive to read this notice <https://rimuhosting.com/maintenance.jsp?server_maint_oid=5241959612&sn_oid=…> about progress in fixing an issue in the Dallas co-lo centre for Rimu hosting. As a customer, I wasn’t affected (though I could have been), and I have no complaints with the way this was handled--it was great that they kept customers like me apprised of developments like this. The interesting part is how a single initial failure can lead to a cascade of other failures. From the description, the original problem was a breakdown of a transformer feeding power from the grid. To allow it to be repaired, the power was switched to a backup generator. The generator then shut down with a belt problem. So power went to UPS batteries. These ran flat before the generator could be brought back to operation. So various parts of the facility were left without power. After power was restored, it was discovered that some (network?) switches had failed to come up. So a bunch of physical boxes holding customers’ VMs had to be physically moved to a different location where they could get connectivity again. From that point, the disruption was (mostly) over as far as customers were concerned, though there was obviously still work to be done to get the infrastructure back to its normal state. I think that a lot of theoretical statistical modelling of the odds of system failures tends to assume that failures of individual components will be independent of each other. Yet time and time again in the real world, we discover that this is not the case.

1 0