- wlug - list.wlug.org.nz

Mozilla, Like Google, is Looking Ahead To the End of Apple's WebKit Rule
by Peter Reutemann 08 Feb '23

08 Feb '23

'Mozilla is planning for the day when Apple will no longer require its competitors to use the WebKit browser engine in iOS. From a report: Mozilla conducted similar experiments that never went anywhere years ago but in October 2022 posted an issue in the GitHub repository housing the code for the iOS version of Firefox that includes a reference to GeckoView, a wrapper for Firefox's Gecko rendering engine. Under the current Apple App Store Guidelines, iOS browser apps must use WebKit. So a Firefox build incorporating Gecko rather than WebKit currently cannot be distributed through the iOS App Store. As we reported last week, Mozilla is not alone in anticipating an iOS App Store regime that tolerates browser competition. Google has begun work on a Blink-based version of Chrome for iOS. The major browser makers -- Apple, Google, and Mozilla -- each have their own browser rendering engines. Apple's Safari is based on WebKit; Google's Chrome and its open source Chromium foundation is based on Blink (forked from WebKit a decade ago); and Mozilla's Firefox is based on Gecko. Microsoft developed its own Trident rendering engine in the outdated Internet Explorer and a Trident fork called EdgeHTML in legacy versions of Edge but has relied on Blink since rebasing its Edge browser on Chromium code.' -- source: https://news.slashdot.org/story/23/02/07/1733204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Carbonyl: a New Graphical Web Browser in Your Linux Terminal
by Peter Reutemann 07 Feb '23

07 Feb '23

'Long-time Slashdot reader destinyland writes: Someone made a Chromium fork... for your terminal. The terminal-based browser Carbonyl "adheres to, and is compatible with modern standards," writes MUO, "meaning that pages behave as they should, and you can even watch streaming video, within the Linux terminal!" But best of all, "Pages connect and render in an instant—seemingly quicker than a desktop GUI browser, and every page we visited was rendered correctly." >From the article: There are a bunch of good reasons to browse the internet from the comfort of your terminal. It could be that eschewing the bloat of X.org and Wayland, a terminal is all you have. Maybe you like SSHing into remote machines and browsing the internet from there. Perhaps you, like us, just really, really like terminals. Whatever the reason, your choices of web browsers have, until recently, been limited, and your experience of the world wide web has been a janky, barely-functional one.... We tested Carbonyl in a range of Linux terminals, including the XFCE terminal. GNOME terminal, kitty, and the glorious Cool Retro Terminal. Carbonyl was smooth, fast, and flawless in all of them. We even connected to our Raspberry Pi via SSH in CRT, and ran Carbonyl remotely, watching Taylor Swift music videos on YouTube. No problem. And yes, you can use it to play DOOM.' -- source: https://linux.slashdot.org/story/23/02/04/0246248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Swears It's Not Coming For Your Data With Scan For Old Office Versions
by Peter Reutemann 07 Feb '23

07 Feb '23

'Microsoft wants everyone to know that it isn't looking to invade their privacy while looking through their Windows PCs to find out-of-date versions of Office software. From a report: In its KB5021751 update last month, Microsoft included a plan to scan Windows systems to smoke out those Office versions that are no longer supported or nearing the end of support. Those include Office 2007 (which saw support end in 2017) and Office 2010 (in 2020) and the 2013 build (this coming April). The company stressed that it would run only one time and would not install anything on the user's Windows system, adding that the file for the update is scanned to ensure it's not infected by malware and is stored on highly secure servers to prevent unauthorized changes to it. The update caused some discussion among users, at least enough to convince Microsoft to make another pitch that it is respecting user privacy and won't access private data despite scanning their systems. The update collects diagnostic and performance data so that it can determine the use of various versions of Office and how to best support and service them, the software maker wrote in an expanded note this week. The update will silently run once to collect the data and no files are left on the user's systems once the scan is completed.' -- source: https://yro.slashdot.org/story/23/02/06/1753258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LINUX OS and Desktop build - Compatibility question
by Michael James 02 Feb '23

02 Feb '23

Kia ora WLUG Participants..... Mike here in Whanganui. A total newbie and not at all a Linux programmer nor very knowledgeable about all things Linux but a very enthusiastic Linux proponent and open source advocate. I am trying to put together a new desktop build and wish to know if it will be compatible with the latest version of Linux, whether this be Ubuntu or whichever iteration is appropriate. The components of the build are as follows, and I would be most grateful if experienced participants can have a look at them to see if everything will work together with an appropriate Linux OS so the computer runs smoothly and without any problems for the longterm. *DESKTOP BUILD COMPONENTS* ASUS PRIME Z790-P WIFI-CSM DDR5 Motherboard Corsair CMH64GX5M2B5600C36 Vengeance RGB 64GB (2x32GB) DDR5-5600 XFX Radeon RX 7900 XT SPEEDSTER MERC310 Gaming 20GB Graphics Card Intel Raptor Lake Core i9-13900F Processor Corsair iCUE H150i ELITE CAPELLIX 360mm Liquid CPU Cooler Corsair RM1000e 1000W 80 Plus Gold Fully Modular Kingston NV2 2TB PCIe Gen 4 NVMe M.2 SSD Corsair 4000D Tempered Glass Mid-Tower Seagate IronWolf Pro ST4000NE001 4TB 128MB Hard Drive With kind thanks to all, All the best, Michael James __________________________________________________________________________________________ MICHAEL JAMES PASTROFF phone: inside New Zealand 021 115 3713 outside New Zealand 64 21 115 3713

1 0

EU's Proposed CE Mark for Software Could Have Dire Impact on Open Source
by Peter Reutemann 31 Jan '23

31 Jan '23

'The EU's proposed Cyber Resilience Act (CRA), which aims to "bolster cybersecurity rules to ensure more secure hardware and software products," could have severe unintended consequences for open source software, according to leaders in the open source community. From a report: The proposed Act can be described as CE marking for software products and has four specific objectives. One is to require manufacturers to improve the security of products with digital elements "throughout the whole life cycle." Second is to offer a "coherent cybersecurity framework" by which to measure compliance. Third is to improve the transparency of digital security in products, and fourth is to enable customers to "use products with digital elements securely." The draft legislation includes an impact assessment that says "for software developers and hardware manufacturers, it will increase the direct compliance costs for new cybersecurity requirements, conformity assessment, documentation and reporting obligations." This extra cost is part of a total cost of compliance, including the burden on businesses and public authorities, estimated at EUR 29 billion ($31.54 billion), and consequent higher prices for consumers. However, the legislators foresee a cost reduction from security incidents estimated at EUR 180 to 290 billion annually. The question is though: how can free software developers afford the cost of compliance, when lack of funding is already a critical issue for many projects? Mike Milinkovich, director of the Eclipse Foundation, said it is "deeply concerned that the CRA could fundamentally alter the social contract which underpins the entire open source ecosystem: open source software provided for free, for any purpose, which can be modified and further distributed for free, but without warranty or liability to the authors, contributors, or open source distributors. Legally altering this arrangement through legislation can reasonably be expected to cause unintended consequences to the innovation economy in Europe."' -- source: https://news.slashdot.org/story/23/01/26/1211223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Customer Conned Out Of Deposit, Company Liable
by Lawrence D'Oliveiro 30 Jan '23

30 Jan '23

A malicious third party intercepted email messages between a carpeting company and a customer, and was able to send a fake email asking for a deposit to the customer with all the right contact details, but the wrong bank account number <https://www.nzherald.co.nz/lifestyle/hacker-intercepts-carpet-companys-emai…>. And now the Disputes Tribunal has ruled that, since the email looked completely convincing, with the right personal details and everything, it was not reasonable to expect the customer to be suspicious or to want to double-check. And so the company had to wear the cost of the scam.

1 0

Intel Kills Its RISC-V Development Environment
by Lawrence D'Oliveiro 30 Jan '23

30 Jan '23

Intel is abandoning its “Pathfinder” project <https://www.theregister.com/2023/01/30/intel_ris_v_pathfinder_discontinued/> which was an integrated environment for doing development targeted at RISC-V processors. What does this mean for RISC-V? Not a lot, I would say. What does it mean for Intel? I think the basic problem here is the same as with its attempts to move into ARM: you have a high-volume, low-margin business where a company that has grown fat on not-so-high-volume, quite high-margin x86 processors was never going to be able to compete.

1 0

Jeremy Allison Laid Off From Google
by Lawrence D'Oliveiro 28 Jan '23

28 Jan '23

Seems the latest round of layoffs from Google has hit its open-source projects particularly hard, according to Steven J Vaughan-Nichols <https://www.theregister.com/2023/01/27/google_open_source/>. The one name that immediately caught my eye was Jeremy Allison, one of the chief brains behind Samba <https://www.samba.org/>. Before joining Google, he worked at Novell. He left there in 2006 because he objected to a deal Novell made with Microsoft which was effectively a patent licence for Free software (something which the GPL doesn’t allow) <https://www.zdnet.com/article/in-case-you-missed-it-part-1-jeremy-allison-f…>. While waiting to see where else he turns up, it is worth revisiting this essay <https://www.samba.org/samba/news/articles/low_point/tale_two_stds_os2.html> from shortly before that time, where he does a comparison between the Microsoft Windows and POSIX APIs, and why there can be so many independent, yet interoperable implementations of the latter, and why there can be only one of the former (though the WINE project continues to try to change that).

1 0

Consumer Reports Looks At Memory Safety
by Lawrence D'Oliveiro 27 Jan '23

27 Jan '23

The nonprofit Consumer Reports foundation has done a study of, of all things, memory safety in computer software <https://www.theregister.com/2023/01/26/memory_safety_mainstream/>. It apparently came to the need for this after putting together a consumer-focused guide to online security. Seems like greater adoption of the Rust programming language is becoming a key part of improving the situation. Asked about C++ creator Bjarne Stroustrup's assertion that ISO standard C++ can be memory safe when rules are enforced with static analysis, [Josh Aas, of the nonprofit Internet Security Research Group] expressed skepticism. "In a very theoretical sense that ignores the practicalities of the real world, that might be true," he said. "It might very theoretically be practically possible to write memory safe C++. But it's just not how things work in our world. There are just better ways to do that. C++ was not designed from the ground up to offer memory safety."

1 0

Android 14 Set To Block Certain Outdated Apps From Being Installed
by Peter Reutemann 25 Jan '23

25 Jan '23

'To help reduce the potential for malware, Android 14 will begin fully blocking the installation of apps that target outdated versions of Android. 9to5Google reports: For years now, the guidelines for the Google Play Store have ensured that Android developers keep their apps updated to use the latest features and safety measures of the Android platform. Just this month, the guidelines were updated, requiring newly listed Play Store apps to target Android 12 at a minimum. Up to this point, these minimum API level requirements have only applied to apps that are intended for the Google Play Store. Should a developer wish to create an app for an older version, they can do so and simply ask their users to sideload the APK file manually. Similarly, if an Android app hasn't been updated since the guidelines changed, the Play Store will continue serving the app to those who have installed it once before. According to a newly posted code change, Android 14 is set to make API requirements stricter, entirely blocking the installation of outdated apps. This change would block users from sideloading specific APK files and also block app stores from installing those same apps. Initially, Android 14 devices will only block apps that target especially old Android versions. Over time though, the plan is to increase the threshold to Android 6.0 (Marshmallow), with Google having a mechanism to "progressively ramp [it] up." That said, it will likely still be up to each device maker to decide the threshold for outdated apps or whether to enable it at all. The report notes that it'll still be possible to install an outdated version of an app "through a command shell, by using a new flag."' -- source: https://tech.slashdot.org/story/23/01/24/225226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0