- wlug - list.wlug.org.nz

OpenBSD 7.5 Released
by Peter Reutemann 08 Apr '24

08 Apr '24

'Slashdot reader Mononymous writes: The latest release of OpenBSD, the FOSS Unix-like operating system focused on correctness and security over features and performance, has been released. This version includes newer driver support, performance improvements, stability fixes, and lots of package updates. One highlight is a complete port of KDE Plasma 5. You can view the announcement and get the bits at OpenBSD.org. Phoronix reports that with OpenBSD 7.5 "there is a number of improvements for ARM (AArch64) hardware, never-ending kernel optimizations and other tuning work, countless package updates, and other adjustments to this popular BSD platform."' -- source: https://tech.slashdot.org/story/24/04/06/0519207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tip For Repairing Ancient Linux Installations
by Lawrence D'Oliveiro 02 Apr '24

02 Apr '24

Here’s the scenario: there is a malfunctioning server running a really ancient Linux installation (e.g. 2.6.x-series kernel). You boot up with a reasonably recent copy of SystemRescue, mount the machine’s filesystem, try to chroot into it and run a shell ... and it segfaults. Seems there has been a subtle incompatible change in Linux kernel behaviour since those times, to do with the disabling of something called the “vsyscall” mechanism (which is specific to 64-bit x86-based machines, I understand). This was supposed to be a way to speed up certain commonly-executed system calls (I think getting the system time was one of them) by allowing direct transfers to certain entry points with fixed memory addresses for invoking them. It was later decided this was a bad idea (I think for security reasons). The mechanism has not been completely removed (yet), but nowadays it is disabled by default. To get around this, you need to boot SystemRescue with a change to the kernel command-line parameters, adding this item vsyscall=emulate After you get to a shell, you can confirm that this setting is in effect by checking the /proc/self/maps file (the memory mappings for your own process). At the bottom, there should be an entry with “[vdso]” in it, and below that another line with “[vsyscall]”. The presence of the latter line indicates that vsyscall emulation is in effect. This is not present when I check a process on my own machine, for example. Linus is legendary for being a stickler for never, ever breaking backward compatibility for userland. So the reasons for turning this off must have been pretty compelling, for him to agree to it. But the compromise is, it’s still there to be enabled if you really, really need it. There’s a bit more technical info here <https://0xax.gitbooks.io/linux-insides/content/SysCall/linux-syscall-3.html>, if you are interested. By the way, the above page is part of a book beginning here <https://0xax.gitbooks.io/linux-insides/content/>, about the insides of the Linux kernel. The whole book seems to be accessible from that link, but if you step up a level, the site doesn’t seem to have any idea about the existence of that book.

3 4

Uncle Sam’s Had It Up To Here With “Unforgivable” SQL Injection Flaws
by Lawrence D'Oliveiro 27 Mar '24

27 Mar '24

We all know SQL injection attacks are an ongoing problem <https://www.theregister.com/2024/03/26/fbi_cisa_sql_injection/>. What interested me about this article is this part: Software vendors have been advised to use parameterized queries with prepared statements to mitigate SQL injection vulnerabilities. According to the authorities, these allow user-input data to be separated from SQL queries and "better embody a secure by design approach" compared to input sanitization techniques. These are deployed by some vendors, but were branded "brittle" by CISA and the FBI. They said they're also difficult to deploy on a large scale and are more easily bypassed. Funny, that. Every time I post examples of how I dynamically construct SQL query strings with proper quoting of user input, I get yelled at and told to use “parameterized queries” and “prepared statements”, or even an ORM. Yet here we have the security experts saying that that is not a good solution, just like I thought all along.

1 0

Mozilla’s privacy service drops a provider with ties to people-search sites
by Peter Reutemann 26 Mar '24

26 Mar '24

'Mozilla's Monitor Plus, a service launched by the privacy-minded tech firm in February, notes on its pitch page that there is "a $240 billion industry of data brokers selling your private information for profit" and that its offering can "take back your privacy." Mozilla's most recent move to protect privacy has been to cut out one of the key providers of Monitor Plus' people-search protections, Onerep. That comes after reporting from security reporter Brian Krebs, who uncovered Onerep CEO and founder Dimitri Shelest as the founder of "dozens of people-search services since 2010," including one, Nuwber, that still sells the very kind of "background reports" that Monitor Plus seeks to curb. Shelest told Krebs in a statement (PDF) that he did have an ownership stake in Nuwber, but that Nuwber has "zero cross-over or information-sharing with Onerep" and that he no longer operates any other people-search sites. Shelest admitted the bad look but said that his experience with people search gave Onerep "the best tech and team in the space." Brandon Borrman, vice president of communications at Mozilla, said in a statement that while "customer data was never at risk, the outside financial interests and activities of Onerep’s CEO do not align with our values." Mozilla is "working now to solidify a transition plan," Borrman said. A Mozilla spokesperson confirmed to Ars today that Mozilla is continuing to offer Monitor Plus, suggesting no pause in subscriptions, at least for the moment.' -- source: https://arstechnica.com/gadgets/2024/03/mozillas-privacy-service-drops-a-pr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

decrypting PDFs
by Peter Reutemann 22 Mar '24

22 Mar '24

Hi everyone I've long had a problem with being unable to open some PDFs that could be either viewed on Windows or on Google Drive. For some reason, some PDFs appear to be encrypted (but not requiring a password??). Today, I found an approach that allows me to access these files also on my Linux machine using pdftk. pdftk allows you to decrypt PDFs by supplying a password (https://www.ubuntumint.com/remove-password-from-pdf-on-linux/) pdftk <protected>.pdf input_pw <password> output <new>.pdf However, the following seemed to work on these weird PDF files, without having to supply a password: pdftk <protected>.pdf output <new>.pdf And now my PDF viewers (okular, xreader, etc) no longer complain that they can't open the file. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Formula 1 Chief Appalled to Find Team Using Excel to Manage 20,000 Car Parts
by Lawrence D'Oliveiro 21 Mar '24

21 Mar '24

<https://arstechnica.com/cars/2024/03/formula-1-chief-appalled-to-find-team-…>: The Williams car build workbook, with roughly 20,000 individual parts, was "a joke," Vowles recently told The Race. "Impossible to navigate and impossible to update." This colossal Excel file lacked information on how much each of those parts cost and the time it took to produce them, along with whether the parts were already on order. ... Banks cited Tim Worstall's 2013 contention that Excel could be "the most dangerous software on the planet." Back then, international investment bankers were found manually copying and pasting Excel between Excel sheets to do their work, and it raised alarm.

1 0

Database-Based Operating System 'DBOS' Does Things Linux Can't
by Peter Reutemann 19 Mar '24

19 Mar '24

'Databricks CTO Matei Zaharia "said that Databricks had to keep track of scheduling a million things," remembers adjunct MIT professor Michael Stonebraker. " He said that this can't be done with traditional operating system scheduling, and so this was done out of a Postgres database. And then he started to whine that Postgres was too slow, and I told him we can do better than that...." This resulted in DBOS — short for "database operating system" — which they teamed up to build with teams Stanford and MIT, according to The Next Platform: They founded a company to commercialize the idea in April 2023 and secured $8.5 million initial seed funding to start building the real DBOS. Engine Ventures and Construct Capital led the funding, along with Sinewave and GutBrain Ventures... "The state that the operating system has to keep track of — memory, files, messages, and so on — is approximately linear to the resources you have got," says Stonebraker. "So without me saying another word, keeping track of operating system state is a database problem not addressed by current operating system schedulers. Moreover, OLTP [Online Transaction Processing] database performance has gone up dramatically, and that is why we thought instead of running the database system in user space on top of the operating system, why don't we invert our thinking 180 degrees and run the operating system on top of the database, with all of the operating services are coded in SQL...?" For now, DBOS can give the same kind of performance as that full blown Linux operating system, and thanks to the distributed database underpinnings of its kernel, it can do things that a Linux kernel just cannot do... One is provide reliable execution, which means that if a program running atop DBOS is ever interrupted, it starts where it left off and does not have to redo its work from some arbitrary earlier point and does not crash and have to start from the beginning. And because every little bit of the state of the operating system — and therefore the applications that run atop it — is preserved, you can go backwards in time in the system and restart the operating system if it experiences some sort of anomaly, such as a bad piece of application software running or a hack attack. You can use this "time travel" feature, as Stonebraker calls it, to reproduce what are called heisenbugs — ones that are very hard to reproduce precisely because there is no shared state in the distributed Linux and Kubernetes environment and that are increasingly prevalent in a world of microservices. The other benefit of the DBOS is that it presents a smaller attack surface for hackers, which boosts security, and that you analyze the metrics of the operating system in place since they are already in a NoSQL database that can be queried rather than aggregating a bunch of log files from up and down the software stack to try to figure out what is going on... There is also a custom tier for DBOS, which we presume costs money, that can use other databases and datastores for user application data, stores more than three days of log data, can have multiple users per account, that adds email and Slack support with DBOS techies, and that is available on other clouds as well as AWS. The operating system kernel/scheduler "is itself largely a database," with services written in TypeScript, according to the article. The first iteration used the FoundationDB distributed key-value store for its scheduling core (open sourced by Apple in 2018), according to the article — "a blazingly fast NoSQL database... Stonebraker says there is no reason to believe that DBOS can't scale across 1 million cores or more and support Java, Python, and other application languages as they are needed by customers..." And the article speculates they could take things even further. "There is no reason why DBOS cannot complete the circle and not only have a database as an operating system kernel, but also have a relational database as the file system for applications."' -- source: https://developers.slashdot.org/story/24/03/18/0038232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Ends its Privacy-Friendly GPS-Style Location Service
by Peter Reutemann 18 Mar '24

18 Mar '24

'Mozilla Location Service offered "a free, open way to offer GPS-style location detection features" for developers on devices without GPS hardware, remembers the Linux blog OMG Ubuntu. It used signals like Wi-Fi access points and Bluetooth beacons "without any of the privacy implications most competing geolocation services have." But Friday they reported that Mozilla "has announced it is ending access to Mozilla Location Service (MLS), which provides accurate, privacy-respecting, and crowdsourced geolocation data." Developers and 3rd-party projects that use MLS to detect a users' location, such as the freedesktop.org location framework GeoClue, which is used by apps like GNOME Maps and Weather, have only a few months left to continue using the service... In late March, POST data submissions will return 403 responses. Finally, on June 12, all 3rd-party API keys will be removed and MLS data only accessible by Mozilla... MLS' accuracy has declined in recent years. Patent infringement claims in 2019 saw Mozilla reach a settlement to avoid litigation. As part of that settlement it was forced to make changes to MLS that impacted its ability to invest in (commercially exploit?) and improve the service. The article notes that GeoClue "already supports multiple location detection methods, including IP-based ones," so it should continue operating. "But the sad reality is that there just aren't a lot of free, open, privacy-friendly, accurate, and (rather importantly for a framework built in to Linux desktops) reliable alternatives to Mozilla Location Services, which has built up a colossal 'signal map' from which to pinpoint locations." "We are grateful for the contributions of the community to MLS to both the code and the dataset," a Mozilla senior engineering manager said in a statement.' -- source: https://tech.slashdot.org/story/24/03/17/2150221/mozilla-ends-its-privacy-f… I wasn't even aware that Mozilla was offering such a service... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

1986 Presentation On Setting A Computer’s Clock Correctly
by Lawrence D'Oliveiro 18 Mar '24

18 Mar '24

One of the recent additions to the Bitsavers vintage computing collection is this presentation from 1986 <http://bitsavers.trailing-edge.com/pdf/ibm/share/SHARE67_Presentation_on_Se…> at a session of SHARE (one of the IBM user groups), on how to ensure your computer’s time is set correctly. Remember, this was before NTP. But there was already a worldwide network of atomic clocks, keeping synchronization with each other, and there were shortwave stations, like WWV in Boulder, Colorado, that would broadcast pips once per second, synchronized to the atomic clock network. And there were even consumer-level gadgets, like the one mentioned in the article from Heath, that would automatically decode those broadcasts and output a time code a computer could read. The article has some nice background info. Like did you know there can be up to a 1-second discrepancy between GMT and UTC? (Actually I think from other sources the limit might be more like 0.9 seconds.) IBM’s mainframe OS developers were perceptive enough to realize that it can be useful to have the computer keep time in GMT, and maintain an offset for calculating local time. Particular site admins could of course have the choice of using local time for the system time, and setting the offset to zero. Changing the offset for daylight saving could be a fraught procedure, though. The level of confusion it could cause for running applications was such that it was safer to do a reboot. One little item I don’t recall coming across before, another of those NASA programming screwups: One of the famous programming mistakes of all time was by the programmer who thought the earth revolved on its axis once every 24 hours and used that fact to calculate landing sites for the Mercury space flights. Our first astronauts spent a lot more time in the water than they should have because of that.

1 0

Free/Libre 'GnuCOBOL' Compiler Reaches Maturity, Can Compete with Proprietary Offerings
by Peter Reutemann 18 Mar '24

18 Mar '24

'After 20 years of development, the open source GnuCOBOL "has reached an industrial maturity and can compete with proprietary offers in all environments," said OCamlPro founder and GnuCOBOL contributor Fabrice Le Fessant, in a FOSDEM talk about the technology. GnuCOBOL turns COBOL source code into executable applications. It is very cross-platform, running Linux, BSD, many proprietary Unixes, macOS, and Windows, even Android. And the latest version, v.32, is being used in many commercial settings... Sobisch noted that the GnuCOBOL is seeing a lot of commercial deployments, such as for banking back-end apps, many of which are being migrated from Micro Focus, with users reporting performance improvements as a result. The French DGFIP federal agency moved from a GCOS mainframe to GnuCOBOL, with the help of Le Fessant's firm. Originally called OpenCOBOL, the project was started in 2002 and renamed GnuCOBOL in 2013. In the past three years, it has received attention from 13 contributors with 460 commits. Most Linux package managers have a copy of GnuCOBOL for the program for downloading... It can compile to C code (C89+), making it extremely portable, from mainframes to Raspberry Pi's, Sobisch said... Also new is SuperBOL, a development studio for GnuCOBOL developed by Le Fessant's OCamlPro. It runs as a VSCode Extension and features a full COBOL processor (written in OCaml). ' -- source: https://developers.slashdot.org/story/24/03/17/1810257 Anything COBOL related takes time, I guess... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1