- wlug - list.wlug.org.nz

some leaks
by Peter Reutemann 09 Apr '21

09 Apr '21

Facebook Does Not Plan To Notify Half-Billion Users Affected by Data Leak https://tech.slashdot.org/story/21/04/07/2011245 Hackers Scraped Data from 500 Million LinkedIn Users -- and Have Posted it For Sale Online https://yro.slashdot.org/story/21/04/08/1755237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IBM Creates a COBOL Compiler For Linux On x86
by Peter Reutemann 08 Apr '21

08 Apr '21

'IBM has announced a COBOL compiler for Linux on x86. "IBM COBOL for Linux on x86 1.1 brings IBM's COBOL compilation technologies and capabilities to the Linux on x86 environment," said IBM in an announcement, describing it as "the latest addition to the IBM COBOL compiler family, which includes Enterprise COBOL for z/OS and COBOL for AIX." The Register reports: COBOL -- the common business-oriented language -- has its roots in the 1950s and is synonymous with the mainframe age and difficulties paying down technical debt accrued since a bygone era of computing. So why is IBM -- which is today obsessed with hybrid clouds -- bothering to offer a COBOL compiler for Linux on x86? Because IBM thinks you may want your COBOL apps in a hybrid cloud, albeit the kind of hybrid IBM fancies, which can mean a mix of z/OS, AIX, mainframes, POWER systems and actual public clouds. [...] But the announcement also suggests IBM doesn't completely believe this COBOL on x86 Linux caper has a future as it concludes: "This solution also provides organizations with the flexibility to move workloads back to IBM Z should performance and throughput requirements increase, or to share business logic and data with CICS Transaction Server for z/OS." The new offering requires RHEL 7.8 or later, or Ubuntu Server 16.04 LTS, 18.04 LTS, or later. ' -- source: https://linux.slashdot.org/story/21/04/08/018243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Wins Oracle Copyright Fight as Top Court Overturns Ruling
by Peter Reutemann 07 Apr '21

07 Apr '21

'The U.S. Supreme Court ruled that Alphabet's Google didn't commit copyright infringement when it used Oracle's programming code in the Android operating system, sparing Google from what could have been a multibillion-dollar award. From a report: The 6-2 ruling, which overturns a victory for Oracle, marks a climax to a decade-old case that divided Silicon Valley and promised to reshape the rules for the software industry. Oracle was seeking as much as $9 billion. The court said Google engaged in legitimate "fair use" when it put key aspects of Oracle's Java programming language in the Android operating system. Writing for the court, Justice Stephen Breyer said Google used "only what was needed to allow users to put their accrued talents to work in a new and transformative program." Each side contended the other's position would undercut innovation. Oracle said that without strong copyright protection, companies would have less incentive to invest the large sums needed to create groundbreaking products. Google said Oracle's approach would discourage the development of new software that builds on legacy products.' -- source: https://news.slashdot.org/story/21/04/05/1448243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 4

Google Open-Sources Lyra In Beta To Reduce Voice Call Bandwidth Usage
by Peter Reutemann 07 Apr '21

07 Apr '21

'Google today open-sourced Lyra in beta, an audio codec that uses machine learning to produce high-quality voice calls. VentureBeat reports: The code and demo, which are available on GitHub, compress raw audio down to 3 kilobits per second for "quality that compares favorably to other codecs," Google says. Lyra's architecture is separated into two pieces, an encoder and decoder. When someone talks into their phone, the encoder captures distinctive attributes, called features, from their speech. Lyra extracts these features in 40-millisecond chunks and then compresses and sends them over the network. It's the decoder's job to convert the features back into an audio waveform that can be played out over the listener's phone. According to Google, Lyra's architecture is similar to traditional audio codecs, which form the backbone of internet communication. But while these traditional codecs are based on digital signal processing techniques, the key advantage for Lyra comes from the ability of its decoder to reconstruct a high-quality signal. Google believes there are a number of applications Lyra might be uniquely suited to, from archiving large amounts of speech and saving battery to alleviating network congestion in emergency situations. ' -- source: https://news.slashdot.org/story/21/04/06/2013234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rust in the Android platform
by Peter Reutemann 07 Apr '21

07 Apr '21

'Correctness of code in the Android platform is a top priority for the security, stability, and quality of each Android release. Memory safety bugs in C and C++ continue to be the most-difficult-to-address source of incorrectness. We invest a great deal of effort and resources into detecting, fixing, and mitigating this class of bugs, and these efforts are effective in preventing a large number of bugs from making it into Android releases. Yet in spite of these efforts, memory safety bugs continue to be a top contributor of stability issues, and consistently represent ~70% of Android’s high severity security vulnerabilities. In addition to ongoing and upcoming efforts to improve detection of memory bugs, we are ramping up efforts to prevent them in the first place. Memory-safe languages are the most cost-effective means for preventing memory bugs. In addition to memory-safe languages like Kotlin and Java, we’re excited to announce that the Android Open Source Project (AOSP) now supports the Rust programming language for developing the OS itself. ' -- source: https://security.googleblog.com/2021/04/rust-in-android-platform.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Results of Debian Vote On Stallman To Be Known By April 17
by Peter Reutemann 07 Apr '21

07 Apr '21

'iTWire: The outcome of a general resolution proposed by the Debian GNU/Linux project, to decide how to react to the return of Free Software Foundation founder Richard Stallman to the board, will be known on April 17, with voting now underway. The original proposal for a GR was made by Steve Langasek, who also works for Canonical, the company behind Ubuntu, and calls for co-signing an existing letter which wants Stallman gone and the FSF board sacked. There has been a lot of discussion around the issue. Six alternatives have been proposed. The proposals are: - remove the entire FSF board as in an existing letter; - seek Stallman's resignation from all FSF bodies; - discourage collaboration with the FSF while Stallman remains in a leading position; - ask FSF to further its governance processes; - support Stallman's reinstatement; - denounce the witch hunt against Stallman and the FSF; and - issue no public statement on the issue. During the organization's LibrePlanet virtual event on March 19, Stallman announced that he was rejoining the board and does not intend to resign again. His return has drawn condemnation from many people in the free software community. Just days after his announcement, an open letter calling for Stallman to be removed again and for the FSF's entire board to resign was signed by hundreds of people. Linux giant Red Hat has decided to pull funding, while the 'Open Source Initiative' said that it "will not participate in any events that include Richard M. Stallman," adding that it "cannot collaborate with the Free Software Foundation until Stallman is removed from the organization's leadership."' -- source: https://linux.slashdot.org/story/21/04/05/239225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Back In The Day ...
by Lawrence D'Oliveiro 06 Apr '21

06 Apr '21

Came across this story <https://forums.theregister.com/forum/all/2021/04/05/who_me/#c_4233327> in a comment to an article about, shall we say, Customs foibles: A friend of mine got pulled over by US Customs because of the reel of half-inch magtape sticking out his hand luggage. Customs guy: what's on your tape, data or softtware? Friend: why do you need to know? Customs guy: if it's software, you need to pay import tax and duty. if it's data, you don't Friend: it's data - it's input for testing a compiler

1 0

Linus Torvalds Discusses Intel and AMD's New Proposals for Interrupt/Exception Handling
by Peter Reutemann 05 Apr '21

05 Apr '21

'"AMD and Intel have both proposed better ways of doing interrupt and exception handling the last few months," reports LinuxReviews.org. Then they share this analysis Linus Torvalds posted on the Real World Technologies forum: "The AMD version is essentially "Fix known bugs in the exception handling definition". The Intel version is basically "Yeah, the protected mode 80286 exception handling was bad, then 386 made it odder with the 32-bit extensions, and then syscall/sysenter made everything worse, and then the x86-64 extensions introduced even more problems. So let's add a mode bit where all the crap goes away". In contrast, the AMD one is basically a minimal effort to fix actual fundamental problems with all that legacy-induced crap that are nasty to work around and that have caused issues... Both are valid on their own, and they are actually fairly independent. Honestly, the AMD paper looks like a quick "we haven't even finished thinking all the details through, but we know these parts were broken, so we might as well release this". I don't know how long it has been brewing, but judging by the "TBD" things in that paper, I think it's a "early rough draft"." In the article (shared by long-time Slashdot reader xiando), LinuxReviews.org summarizes the state of the conversation today: Torvalds went on to say that while AMD's proposed "quick fix" would be easier to implement for him and others operating system vendors, it's not ideal in the long run. Intel's proposal throws the entire existing interrupt descriptor table (IDT) delivery system under the bus so it can be replaced with what they call a new "FRED event delivery" system. Torvalds believes this is a better long-term solution... While the pros and cons of Intel and AMD's respective proposals for interrupt and event handling in future processors are worthy of discussion, it's in reality mostly up to Intel. They are the bigger and more powerful corporation. It is more likely than not that future processors from Intel will use their proposed Flexible Return and Event Delivery system. Their next generation processors won't, it will take years not months before consumer CPUs have the FRED technology. Remember, the above-mentioned technical document was published earlier this month [in March]. Things do not magically go from the drawing-board to store-shelves overnight. Intel isn't going to just hand the FRED technology over to AMD and help them implement it. We will likely see both move forward with their own proposals. Intel will have FRED and AMD will have Supervisor Entry Extensions until AMD, inevitably, adopts FRED or some form of it years down the line. They also note that Torvalds took issue with a poster arguing that microkernels are more secure than monolithic kernels like Linux. "Bah, you're just parroting the usual party line that had absolutely no basis in reality and when you look into the details, doesn't actually hold up. It's all theory and handwaving and just repeating the same old FUD that was never actually really relevant."' -- source: https://hardware.slashdot.org/story/21/04/03/179214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

AMD Zen 3 CPUs Vulnerable To Spectre-like Attacks via PSF Feature
by Peter Reutemann 05 Apr '21

05 Apr '21

'US chipmaker AMD advised customers last week to disable a new performance feature if they plan to use CPUs for sensitive operations, as this feature is vulnerable to Spectre-like side-channel attacks. >From a report: Called Predictive Store Forwarding (PSF), this feature was added to AMD CPUs part of the company's Zen 3 core architecture, a processor series dedicated to gaming and high-performance computing, which launched in November 2020. The feature implements a technique called speculative execution, which works by running multiple alternative CPU operations in advance to make results available faster, and then discarding "predicted" data once deemed unneeded.' -- source: https://it.slashdot.org/story/21/04/02/1721241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open-Source Software Becomes a Standard In Dortmund, Germany
by Peter Reutemann 05 Apr '21

05 Apr '21

The Council of the German city of Dortmund has announced that it's embracing free and open-source software, wherever possible. The Document Foundation reports: The Dortmund Council has declared digitalisation to be a political leadership task in its Memorandum 2020 to 2025. In the course of this, two central resolutions for free software were passed on February 11, 2021, for which the minutes were published on March 30: - "Use of open source software where possible." - "Software developed by the administration or commissioned for development is made available to the general public." With this resolution, city policy takes on the shaping of municipal digital sovereignty and digital participation. The resolution means a reversal of the burden of proof in favor of open source software -- and at the expense of proprietary software. In the future, the administration will have to justify why open source software cannot be used for every proprietary software application. Based on the report of the Dortmund city administration on the investigation of the potentials of free software and open standards, open source software is understood in the sense of free software. ' -- source: https://news.slashdot.org/story/21/04/02/1957213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0