- wlug - list.wlug.org.nz

I Have No Luck With Keyboards ...
by Lawrence D'Oliveiro 01 May '24

01 May '24

Yesterday I decided that my heavily-used clicky mechanical keyboard (a Das Keyboard 4) had accumulated far too much grime, and it was time to take the risk of cleaning it. In the past, every time I’ve tried cleaning a keyboard, it has never worked right afterwards. I’m a software guy, not a hardware guy. I found the keys quite easy to pry off. A light amount of leverage with a small screwdriver was helpful when space was tight, but once I’d cleared sufficient room around a key, I could pull it off just with my fingers. Even the wider keys were not hard. I found some warnings online against removing these, because of the trickiness of their extra stabilization mechanisms. But these were actually quite simple: a steel spring with its ends poked through two tiny brackets (removable, but best left in place) at each end of the key. It took a bit of pressure with the screwdriver to bend one end of the spring far enough to take it out of the hole, but it snapped immediately back to its original shape after I had taken the key out, so I saw no problem putting things back afterwards. The space bar was even simpler: just two additional support posts at the ends, in addition to the usual post (common to all the keys) that held the actual switch in the middle. After I had got all the keys off, the grime on the keyboard itself was a wonder to behold (I’ll spare you the details). I tried to use a bunched-up corner of a wet cloth, and even a vacuum cleaner with the smallest nozzle (again heeding warnings online against compressed air), and I was able to remove maybe half the accumulation of deposits, not much more. I figured that was good enough. Of course, in the process, I likely got some water into two slots that were exposed after I removed the keys. There was a recommendation online to leave things to dry for at least 6 hours. Call me impatient; I left it for just 5. Afterwards, I plugged it in, without the key caps, and tried a few keys, and was gratified to find they still worked. After that, I put back all the keys, now nice and clean and dry. Even the ones with those extra springs went back with only a slight amount of fiddling to re-engage with those brackets on the keys. And afterwards, the keyboard still worked. I left it plugged in, and went to do something else. Half an hour later, I came back to my computer ... and the keyboard was dead. Not a single response from any key. Put it back in the heater cupboard and left it overnight. No change this morning: still dead. So I feel very sad. I thought I had broken my keyboard jinx. But it’s currently zero for three. I have some other keyboards, of course, including a colourful oddity I bought from Dick Smith (whose layout leaves out the right-hand super/windows key), and a Kensington “washable” (dare I risk it?), with the pipe/backslash key in a different position. But I had grown accustomed to the volume control knob and other niceties of the Das Keyboard. Looking back through my records, I was surprised to discover I had bought it about ten years ago, from Mighty Ape. So I suppose it’s had a good run. But it seems nobody in NZ sells the things any more. So currently I mourn, and I also look for alternatives ...

3 3

T2 Linux 24.5 Released
by Peter Reutemann 30 Apr '24

30 Apr '24

'A major T2 Linux milestone has been released, shipping with full support for 25 CPU architectures and several C libraries, as well as restored support for Intel IA-64 Itanium. Additionally, many vintage X.org DDX drivers were fixed and tested to work again, as well as complete support for the latest KDE 6 and GNOME 46. T2 is known for its sophisticated cross compile support and support for nearly all existing CPU architectures: Alpha, Arc, ARM(64), Avr32, HPPA(64), IA64, M68k, MIPS(64), Nios2, PowerPC(64)(le), RISCV(64), s390x, SPARC(64), and SuperH x86(64). T2 is an increasingly popular choice for embedded systems and virtualization. It also still supports the Sony PS3, Sgi, Sun and HP workstations, as well as the latest ARM64 and RISCV64 architectures. The release contains a total of 5,140 changesets, including approximately 5,314 package updates, 564 issues fixed, 317 packages or features added and 163 removed, and around 53 improvements. Usually most packages are up-to-date, including Linux 6.8, GCC 13, LLVM/Clang 18, as well as the latest version of X.org, Mesa, Firefox, Rust, KDE 6 and GNOME 46! More information, source and binary distribution are open source and free at T2 SDE.' -- source: https://news.slashdot.org/story/24/04/29/2325210/ To be honest, haven't heard of that distro before, but sounds interesting. Cheers, Peter

2 3

Hackers try to exploit WordPress plugin vulnerability that’s as severe as it gets
by Peter Reutemann 29 Apr '24

29 Apr '24

'Hackers are assailing websites using a prominent WordPress plugin with millions of attempts to exploit a high-severity vulnerability that allows complete takeover, researchers said. The vulnerability resides in WordPress Automatic, a plugin with more than 38,000 paying customers. Websites running the WordPress content management system use it to incorporate content from other sites. Researchers from security firm Patchstack disclosed last month that WP Automatic versions 3.92.0 and below had a vulnerability with a severity rating of 9.9 out of a possible 10. The plugin developer, ValvePress, silently published a patch, which is available in versions 3.92.1 and beyond. Researchers have classified the flaw, tracked as CVE-2024-27956, as a SQL injection, a class of vulnerability that stems from a failure by a web application to query backend databases properly. SQL syntax uses apostrophes to indicate the beginning and end of a data string. By entering strings with specially positioned apostrophes into vulnerable website fields, attackers can execute code that performs various sensitive actions, including returning confidential data, giving administrative system privileges, or subverting how the web app works.' -- source: https://arstechnica.com/security/2024/04/hackers-make-millions-of-attempts-… Cheers, Peter

2 1

Alternative To Microsoft Access
by Lawrence D'Oliveiro 27 Apr '24

27 Apr '24

If anybody asks about an alternative to Microsoft Access, I think SQLite used in combination with LibreOffice will give you a lot of functionality, including comprehensive SQL support and scalability to much larger databases. Of course you can use other backends, like MariaDB/MySQL, as well. SQLite just makes it easy to have an actual database file that you can copy/move about the place, without having to do database dumps/restores. If you don’t need multiuser support, it is very convenient. I notice that libreoffice-base is now a separate package under Debian (and I suppose its derivatives as well), no longer included in the “base” (heh) LibreOffice package. Make sure to install this, along with libsqliteodbc. Now, say you have an existing SQLite3 database that you want to access from LibreOffice. Suppose it is in the file /home/ldo/hack/lo_try/test.db. In order for databases to be accessible via ODBC, they need to have entries in your ~/.odbc.ini file. This is just a text file, in the good old .ini tradition. The format for entries is very simple, e.g.: [test-db] Description=Test database for LibreOffice Base Driver=SQLite3 Database=/home/ldo/hack/lo_try/test.db Now, when you launch the LibreOffice Base database wizard, you have options to “create a new database”, “open an existing database file”, or “connect to an existing database”. Choose that last one “connect to an existing database”. The popup menu shows the available back-end drivers: choose “ODBC”. Now, when you click “Next”, there should be a text field with a “Browse...” button; clicking this should show the names of entries in your ~/.odbc.ini file, e.g. “test-db” if you used the name in my example above. Select this, and click “Finish”. Next you will be prompted for a name to save the “database file”. This is just the LibreOffice Base document that contains the settings for connecting to the actual database: LibreOffice doesn’t know or care where the database back-end keeps the actual data. After having named the LibreOffice database file, you should see the main LibreOffice Base window. In the lower half, under “Tables”, you should see a list of the tables from the database file. You can double-click a table name to see a quick list of all its records. That’s as far as I’ve got. I see a “Design View”, “Form Wizards”, and “Report Wizards”, and all kinds of other fun stuff. Should be great for building simple database applications, with a minimum of programming.

1 0

Ubuntu 24.04 LTS 'Noble Numbat' Officially Released
by Peter Reutemann 26 Apr '24

26 Apr '24

'9to5Linux: Canonical released today Ubuntu 24.04 LTS (Noble Numbat) as the latest version of its popular Linux-based operating system featuring some of the latest GNU/Linux technologies and Open Source software. Powered by Linux kernel 6.8, Ubuntu 24.04 LTS features the latest GNOME 46 desktop environment, an all-new graphical firmware update tool called Firmware Updater, Netplan 1.0 for state-of-the-art network management, updated Ubuntu font, support for the deb822 format for software sources, increased vm.max_map_count for better gaming, and Mozilla Thunderbird as a Snap by default. It also comes with an updated Flutter-based graphical desktop installer that's now capable of updating itself and features a bunch of changes like support for accessibility features, guided (unencrypted) ZFS installations, a new option to import auto-install configurations for templated custom provisioning, as well as new default installation options, such as Default selection (previously Minimal) and Extended selection (previously Normal)."' -- source: https://news.slashdot.org/story/24/04/25/2036234 Cheers, Peter

1 0

Fedora Linux 40 Officially Released
by Peter Reutemann 24 Apr '24

24 Apr '24

'Fedora Linux 40 distribution has been officially released -- powered by the latest Linux 6.8 kernel series, and featuring the GNOME 46 and KDE Plasma 6 desktop environments, reports 9to5Linux: "Powered by the latest and greatest Linux 6.8 kernel series, the Fedora Linux 40 release ships with the GNOME 46 desktop environment for the flagship Fedora Workstation edition and the KDE Plasma 6 desktop environment for the Fedora KDE Spin, which defaults to the Wayland session as the X11 session was completely removed." "Fedora Linux 40 also includes some interesting package management changes, such as dropping Delta RPMs and disabling support in the default configuration of DNF / DNF5. It also changes the DNF behavior to no longer download filelists by default. However, this release doesn't ship with the long-awaited DNF5 package manager. For AMD GPUs, Fedora Linux 40 ships with AMD ROCm 6.0 as the latest release of AMD's software optimized for AI and HPC workload performance, which enables support for the newest flagship AMD Instinct MI300A and MI300X datacenter GPUs."' -- source: https://linux.slashdot.org/story/24/04/23/1452255 Cheers, Peter

1 0

Ex WH Cyber Policy Director: Microsoft Is A Threat To US National Security
by Lawrence D'Oliveiro 23 Apr '24

23 Apr '24

Microsoft has become so dominant a supplier to the US Government that it cannot be effectively called to account on its repeated security lapses <https://www.theregister.com/2024/04/21/microsoft_national_security_risk/>. Even something as basic as event logging (which would have helped track exposure to things like the SolarWinds breach) was an extra-cost service that Microsoft customers had to pay for. Microsoft is squeezing a lot of profit out of those customers, and it feels no need to let up.

1 0

Ubuntu 24.04 Yields a 20% Performance Advantage Over Windows 11 On Ryzen 7 Framework Laptop
by Peter Reutemann 19 Apr '24

19 Apr '24

'Michael Larabel reports via Phoronix: With the Framework 16 laptop one of the performance pieces I've been meaning to carry out has been seeing out Linux performs against Microsoft Windows 11 for this AMD Ryzen 7 7840HS powered modular/upgradeable laptop. Recently getting around to it in my benchmarking queue, I also compared the performance of Ubuntu 23.10 to the near final Ubuntu 24.04 LTS on this laptop up against a fully-updated Microsoft Windows 11 installation. The Framework 16 review unit as a reminder was configured with the 8-core / 16-thread AMD Ryzen 7 7840HS Zen 4 SoC with Radeon RX 7700S graphics, a 512GB SN810 NVMe SSD, MediaTek MT7922 WiFi, and a 2560 x 1600 display. In the few months of testing out the Framework 16 predominantly under Linux it's been working out very well. With also having a Windows 11 partition as shipped by Framework, after updating that install it made for an interesting comparison against the Ubuntu 23.10 and Ubuntu 24.04 performance. The same Framework 16 AMD laptop was used throughout all of the testing for looking at the out-of-the-box performance across Microsoft Windows 11, Ubuntu 23.10, and the near-final state of Ubuntu 24.04. [...] Out of 101 benchmarks carried out on all three operating systems with the Framework 16 laptop, Ubuntu 24.04 was the fastest in 67% of those tests, the prior Ubuntu 23.10 led in 22% (typically with slim margins to 24.04), and then Microsoft Windows 11 was the front-runner just 10% of the time... If taking the geomean of all 101 benchmark results, Ubuntu 23.10 was 16% faster than Microsoft Windows 11 while Ubuntu 24.04 enhanced the Ubuntu Linux performance by 3% to yield a 20% advantage over Windows 11 on this AMD Ryzen 7 7840HS laptop. Ubuntu 24.04 is looking very good in the performance department and will see its stable release next week. ' -- source: https://hardware.slashdot.org/story/24/04/18/2321230 Cheers, Peter

1 0

FFmpeg 7.0 “Dijkstra”: Best New Features
by Peter Reutemann 19 Apr '24

19 Apr '24

'One of the major updates in FFmpeg 7.0 is the parallel execution of operations for unpacking/packing media containers, decoding, encoding, and applying filters using the ffmpeg command line utility. This feature allows for the simultaneous execution of multiple tasks, resulting in a significant improvement in performance and efficiency, particularly when working with large-scale multimedia projects. Another notable addition is the support for encoding and decoding video in MPEG-5 format (EVC – Essential Video Coding) using the external library libxevd. This new format provides high efficiency transmission and storage of all screen resolutions, supports video with an extended dynamic range (HDR), and panoramic video in 360-degree mode. In addition, FFmpeg 7.0 has added unpackers and packers of media containers (demuxer/muxer) for the QOA (Quite OK Audio) format, which is used for transmitting audio with loss of quality. QOA decoding is claimed to be three times faster than Ogg-Vorbis while achieving higher quality and compression levels compared to ADPCM. The new version also includes unpackers and packers of media containers (demuxer/muxer) for the IAMF (Immersive Audio Model and Format) format, which defines a container for distributing surround sound. The format provides for the transmission of additional information necessary for the operation of sound stage reconstruction and sound mixing algorithms, and takes into account the propagation of sound signals in three-dimensional space to recreate sound as close to natural as possible. An experimental decoder for the VVC (Versatile Video Coding) format, also known as the H.266 video compression standard, has been added in FFmpeg 7.0. This new format provides high efficiency transmission and storage of all screen resolutions, supports video with an extended dynamic range (HDR), and panoramic video in 360-degree mode. The ffplay utility has added support for hardware acceleration of decoding using the Vulkan and libplacebo APIs, and the ability to use API D3D12VA (Direct 3D 12 Video Encoding) for hardware acceleration of decoding of H264, HEVC, VP9, AV1, MPEG-2 and VC1 formats has been implemented. [...] Remember: This version is NOT backward compatible. That means, many CLI options and API are removed which are long deprecated. So use caution before upgrading to version 7.0.' -- source: https://www.debugpoint.com/ffmpeg-7-0-features/ Cheers, Peter -- My Open Source Blog - http://open.fracpete.org

1 0

High Priority PuTTY Vulnerability Threatens Server Access Security
by Peter Reutemann 19 Apr '24

19 Apr '24

'A critical security vulnerability in PuTTY, a very popular software for secure terminal access to remote servers, has been discovered. This vulnerability could put the private keys of many users at risk. Cataloged as CVE-2024-31497, the vulnerability affects PuTTY version numbers between 0.68 and 0.80. So, if you have been using PuTTY during this time, it is important to be aware of what this means for your data security. Fabian Bäumer and Marcus Brinkmann of the Ruhr University Bochum found the vulnerability. It concerns how PuTTY forms signatures from the ECDSA private keys on the NIST P521 curve. The vulnerability with PuTTY is that it creates a component of the signature called ‘nonce’ during the generation process. This randomly generated number can be used once in a cryptographic communication, thus ensuring that old communications cannot be reused in replay attacks. However, PuTTY used a deterministic method to generate nonces due to the lack of a high-quality random number generator in early Windows systems. This deterministic method was biased for the P521 curve, which made the private key recovery possible. Simply put, an attacker who gets hold of multiple signed messages can potentially recover your private key due to a specific bias in the signature creation process. This would allow them to forge signatures and access any servers where you’ve used this key.' -- source: https://linuxiac.com/high-priority-putty-vulnerability-found/ Cheers, Peter -- My Open Source Blog - http://open.fracpete.org

1 0