- wlug - list.wlug.org.nz

Just When You Thought Y2K Was Done And Dusted ...
by Lawrence D'Oliveiro 25 Oct '22

25 Oct '22

Remember what the whole Y2K issue was like, over a quarter-century ago? And all the work that had to be done to fix it? You’d think that lessons were learned, software developers would be wiser, and henceforth they would always use four digits for year numbers, so that a situation like that would not occur again. Guess again. Recently I hit a situation where a piece of software was *still* using just two digits for year numbers. Basically it was maintaining Certificate Revocation Lists (CRLs) for OpenVPN connections; these have an expiry date, in the form of the “nextupdate” field, to ensure that outdated lists are regularly replaced with fresh ones, to reduce the chance that anybody is inadvertently continuing to use compromised keys. The software in question is pfSense, from Netgate <https://forum.netgate.com/topic/172870/crl-has-expired>. The standard format for these CRLs can handle a full range of dates, but the internal system on pfSense for generating them can only handle years from 1950 to 2049. The generated CRLs were being given validity durations of 9999 days, which was fine up until about August this year, when the expiry date went past 2049, and wrapped around to 1950. On an incoming connection attempt, OpenSSL would check the CRL, find it invalid, and cause OpenVPN to drop the connection. The forum discussion above links to a patch to fix the issue. Only the patch doesn’t really make for a permanent fix: all it does is reduce the assigned validity duration from 9999 days to 730 days; the actual underlying software is still only working with 2-digit year numbers. This gives Netgate a few decades’ breathing room to come up with a proper fix.

2 2

Online Misinformation Monitor Newsletter
by Lawrence D'Oliveiro 20 Oct '22

20 Oct '22

Came across this useful series of monthly reports <https://www.newsguardtech.com/misinformation-monitor/> on how online services are being conduits for spreading misinformation and disinformation. Don’t trust them? Learn to watch out for those who keep insisting they are correct, versus those who are willing to offer reasons why they are correct (and are willing to correct their mistakes) <https://www.newsguardtech.com/about/why-should-you-trust-us/>.

1 0

Firefox 106 Is Now Available With PDF Annotation, Firefox View
by Peter Reutemann 20 Oct '22

20 Oct '22

'Firefox 106 is now available for download, bringing various new features and enhancements, such as a new PDF editing feature and new way to organize recently closed tabs. 9to5Linux reports: Mozilla says that Firefox 106 finally brings the long-anticipated two-finger swipe horizontal gesture for navigating back and forward on a website without having to hold down the Alt key. [...] Firefox 106 also introduces annotation capabilities to the built-in PDF viewer so you can write text, draw, or add signatures on PDF files. You'll be able to change the size and color of the text tool, as well as the thickness, opacity, and color of the draw tool. Another interesting new feature of the Firefox 106 release is called Firefox View, which is implemented as a pinned tab, promising to help you get back to the content you've previously discovered by allowing you to switch seamlessly between your devices running Firefox. On top of all that, Firefox 106 also brings major WebRTC changes to improve Windows and Wayland screen sharing, RTP performance and reliability, statistics, and more. There are also the usual bug and security fixes to make Firefox more stable and reliable on your system. ' -- source: https://news.slashdot.org/story/22/10/19/2053217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In Praise of FFmpeg
by Peter Reutemann 19 Oct '22

19 Oct '22

'Drew DeVault, prolific FOSS blogger and hacker behind SourceHut, Sway, wlroots, and many other projects, writes in a blog post: I have relied on ffmpeg for many tasks and for many years. It has always been there to handle any little multimedia-related task I might put it to for personal use -- re-encoding audio files so they fit on my phone, taking clips from videos to share, muxing fonts into mkv files, capturing video from my webcam, live streaming hacking sessions on my own platform, or anything else I can imagine. It formed the foundation of MediaCrush back in the day, where we used it to optimize multimedia files for efficient viewing on the web, back when that was more difficult than "just transcode it to a webm." ffmpeg is notable for being one of the first large-scale FOSS projects to completely eradicate proprietary software in its niche. Virtually all multimedia-related companies rely on ffmpeg to do their heavy lifting. It took a complex problem and solved it, with free software. The book is now closed on multimedia: ffmpeg is the solution to almost all of your problems. And if it's not, you're more likely to patch ffmpeg than to develop something new. The code is accessible and the community are experts in your problem domain. ffmpeg is one of the foremost pillars of achievement in free software. It has touched the lives of every reader, whether they know it or not. If you've ever watched TV, or gone to a movie, or watched videos online, or listened to a podcast, odds are that ffmpeg was involved in making it possible. It is one of the most well-executed and important software projects of all time.' -- source: https://tech.slashdot.org/story/22/10/17/188205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google Announces KataOS
by Peter Reutemann 19 Oct '22

19 Oct '22

'Last Friday, Google announced the release of KataOS, a security-minded operating system focused on embedded devices running ambient machine learning workloads. As Phoronix notes, it uses the Rust programming language and is "built atop the seL4 microkernel as its foundatin." From Google's Open-Source Blog: As the foundation for this new operating system, we chose seL4 as the microkernel because it puts security front and center; it is mathematically proven secure, with guaranteed confidentiality, integrity, and availability. Through the seL4 CAmkES framework, we're also able to provide statically-defined and analyzable system components. KataOS provides a verifiably-secure platform that protects the user's privacy because it is logically impossible for applications to breach the kernel's hardware security protections and the system components are verifiably secure. KataOS is also implemented almost entirely in Rust, which provides a strong starting point for software security, since it eliminates entire classes of bugs, such as off-by-one errors and buffer overflows. The current GitHub release includes most of the KataOS core pieces, including the frameworks we use for Rust (such as the sel4-sys crate, which provides seL4 syscall APIs), an alternate rootserver written in Rust (needed for dynamic system-wide memory management), and the kernel modifications to seL4 that can reclaim the memory used by the rootserver. KataOS code is being worked on via GitHub under the AmbiML umbrella.' -- source: https://tech.slashdot.org/story/22/10/17/2256206 Someone keen to demo this at one of our next meetings? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linus Torvalds To Kernel Devs: Grow Up and Stop Pulling All-Nighters Just Before Deadline
by Peter Reutemann 19 Oct '22

19 Oct '22

'Linux kernel boss Linus Torvalds has released the first release candidate for version 6.1 of the project and added an appeal for developers to make his life easier by adding code earlier in the development cycle. The Register reports: "Let me just say that after I got my machine sorted out and caught up with the merge window, I was somewhat frustrated with various late pull requests. I've mentioned this before, but it's _really_ quite annoying to get quite a few pull requests in the last few days of the merge window." He then offered further guidance on how kernel devs can do it right. "Yes, the merge window is two weeks, but that's very much to allow me time to look things over, not 'two weeks to hurriedly put together a branch that you send Linus on Friday of the second week'," he wrote. "The whole 'do an all-nighter to get the paper in the day before the deadline' is something that should have gone out the window after high school. Not for kernel development." His next line was: "You know who you are." "Anyway, it's not the first time I've said this, I doubt it will be the last. But maybe more people could take it to heart, ok?" he added, before concluding his post with a slightly non-traditional call for testers to visit Linux's git tree because "The merge window may not be the biggest ever, but it's certainly big enough that the shortlog is much too big to post, and below is just my usual merge log." "For all the gory details, please refer to the git tree."' -- source: https://linux.slashdot.org/story/22/10/17/220230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu's New Terminal 'Ad' is Angering Users
by Peter Reutemann 19 Oct '22

19 Oct '22

'Joey Sneddon, reporting at OMG! Ubuntu: In September I tweeted a screenshot of something unexpected that has started to show up in the terminal when I ran system updates. It didn't enrage me at the time (and it kinda still doesn't) but I did find it a little ... Off. Now, if you're suitably tuned-in to the Linux newswire and/or an avid attendee of social media you'll probably heard about the drama in question. If you haven't, then allow me to... Yes, the furore is over an "ad" for Ubuntu Pro, Canonical's revamped support offering that replaces/augments Ubuntu Advantage (which has been around for many years) that appears in the terminal when managing system updates. Other people are calling it an "ad" (hence quote marks). I prefer the term plug (which, it turns out, some people aren't familiar with; it means to mention something in order to promote it). For although this sentence is technically advertising something, in this case Ubuntu Pro, the offering itself is free for regular users (on up-to five devices). Thus, it's not like this is an "ad" that generates Canonical revenue. It's more akin to a public service announcement to raise awareness.' -- source: https://news.slashdot.org/story/22/10/18/1847203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Xv6 Open-Source Teaching OS
by Lawrence D'Oliveiro 17 Oct '22

17 Oct '22

You may know that the MINIX operating system, the inspiration for Linux, was created for teaching purposes (namely, Andrew Tanenbaum’s “Operating Systems” textbook). In the same vein, Xv6 is a newer teaching OS from MIT <https://pdos.csail.mit.edu/6.828/2022/xv6.html>, for use in an undergraduate operating systems course. Originally it was implemented on x86, but now it has moved to RISC-V. The inspiration for Xv6 was the old 6th Edition Unix from Bell Labs from 1975, back when it only ran on DEC PDP-11 processors. This OS version was the subject of the famous “Lions book” <https://en.wikipedia.org/wiki/A_Commentary_on_the_UNIX_Operating_System>, circulation of which was supposed to be restricted to those with licences to the Unix source code. And then with the 7th Edition, AT&T even forbade classroom use of this source code. Nevertheless, the book still spread via, shall we say, samizdat ... The Xv6 GitHub area is here <https://github.com/mit-pdos>.

1 0

Pine64 Announces 'Sub-$10, Linux-Capable' SBC - the Ox64
by Peter Reutemann 17 Oct '22

17 Oct '22

'Pine64 has announced a new "sub $10 Linux capable single board computer" called the Ox64. Liliputing says the tiny SBC "looks a lot like a Raspberry Pi Pico. But while Raspberry Pi's tiny board is powered by an RP2040 microcontroller, the Ox64 has a dual-core RISC-V processor, 64MB of embedded RAM, and support for up to 128Mb of flash storage plus a microSD card for additional storage." It's expected to support RTOS and Linux and blurs the lines between a microcontroller and a (very low power) single-board PC. It's expected to go on sale in November with prices starting at $6 for an RTOS-ready version of the board and $8 for a Linux-compatible model. As spotted by CNX Software earlier this month, the board is designed to be a small, inexpensive single-board computer with a RISC-V processor that's aimed at developers. Pine64's October update also reveals that their Star64 and QuartzPro64 single-board computers "now boot Linux (and run it well too already!)"' -- source: https://news.slashdot.org/story/22/10/15/2314226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bad DIMM on Linus Torvalds' Desktop System Moves Kernel Merges to His Laptop
by Peter Reutemann 17 Oct '22

17 Oct '22

'When a kernel developer asked Linus Torvalds if he'd missed a Git pull, Torvalds "revealed the request was still in his queue as 'I'm doing merges (very slowly) on my laptop, while waiting for new ECC memory DIMMs to arrive,'" reports The Register: Torvalds needs the DIMMs because over the last few days he experienced what he described as "some instability on my main desktop... with random memory corruption in user space resulting in my allmodconfig builds randomly failing with internal compiler errors etc." The Linux boss's first thought was that a new kernel bug had caused the problem — which isn't good but sometimes happens. His instinct was wrong. "It was literally a DIMM going bad in my machine randomly after 2.5 years of it being perfectly stable," he wrote. "Go figure. Verified first by booting an old kernel, and then with memtest86+ overnight." Torvalds appears to have been tracking delivery of the new DIMMs as he reported replacement memory was "out for delivery" and predicted it should arrive later on Sunday evening.... His post also mentions that his main PC was set up for error correction code memory (ECC memory), but "during the early days of COVID when there wasn't any ECC memory available at any sane prices. And then I never got around to fixing it, until I had to detect errors the hard way." "I absolutely *detest* the crazy industry politics and bad vendors that have made ECC memory so 'special'," he added.' -- source: https://linux.slashdot.org/story/22/10/15/2334251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0