- wlug - list.wlug.org.nz

Fedora Linux 40 Officially Released
by Peter Reutemann 24 Apr '24

24 Apr '24

'Fedora Linux 40 distribution has been officially released -- powered by the latest Linux 6.8 kernel series, and featuring the GNOME 46 and KDE Plasma 6 desktop environments, reports 9to5Linux: "Powered by the latest and greatest Linux 6.8 kernel series, the Fedora Linux 40 release ships with the GNOME 46 desktop environment for the flagship Fedora Workstation edition and the KDE Plasma 6 desktop environment for the Fedora KDE Spin, which defaults to the Wayland session as the X11 session was completely removed." "Fedora Linux 40 also includes some interesting package management changes, such as dropping Delta RPMs and disabling support in the default configuration of DNF / DNF5. It also changes the DNF behavior to no longer download filelists by default. However, this release doesn't ship with the long-awaited DNF5 package manager. For AMD GPUs, Fedora Linux 40 ships with AMD ROCm 6.0 as the latest release of AMD's software optimized for AI and HPC workload performance, which enables support for the newest flagship AMD Instinct MI300A and MI300X datacenter GPUs."' -- source: https://linux.slashdot.org/story/24/04/23/1452255 Cheers, Peter

1 0

Ex WH Cyber Policy Director: Microsoft Is A Threat To US National Security
by Lawrence D'Oliveiro 23 Apr '24

23 Apr '24

Microsoft has become so dominant a supplier to the US Government that it cannot be effectively called to account on its repeated security lapses <https://www.theregister.com/2024/04/21/microsoft_national_security_risk/>. Even something as basic as event logging (which would have helped track exposure to things like the SolarWinds breach) was an extra-cost service that Microsoft customers had to pay for. Microsoft is squeezing a lot of profit out of those customers, and it feels no need to let up.

1 0

Ubuntu 24.04 Yields a 20% Performance Advantage Over Windows 11 On Ryzen 7 Framework Laptop
by Peter Reutemann 19 Apr '24

19 Apr '24

'Michael Larabel reports via Phoronix: With the Framework 16 laptop one of the performance pieces I've been meaning to carry out has been seeing out Linux performs against Microsoft Windows 11 for this AMD Ryzen 7 7840HS powered modular/upgradeable laptop. Recently getting around to it in my benchmarking queue, I also compared the performance of Ubuntu 23.10 to the near final Ubuntu 24.04 LTS on this laptop up against a fully-updated Microsoft Windows 11 installation. The Framework 16 review unit as a reminder was configured with the 8-core / 16-thread AMD Ryzen 7 7840HS Zen 4 SoC with Radeon RX 7700S graphics, a 512GB SN810 NVMe SSD, MediaTek MT7922 WiFi, and a 2560 x 1600 display. In the few months of testing out the Framework 16 predominantly under Linux it's been working out very well. With also having a Windows 11 partition as shipped by Framework, after updating that install it made for an interesting comparison against the Ubuntu 23.10 and Ubuntu 24.04 performance. The same Framework 16 AMD laptop was used throughout all of the testing for looking at the out-of-the-box performance across Microsoft Windows 11, Ubuntu 23.10, and the near-final state of Ubuntu 24.04. [...] Out of 101 benchmarks carried out on all three operating systems with the Framework 16 laptop, Ubuntu 24.04 was the fastest in 67% of those tests, the prior Ubuntu 23.10 led in 22% (typically with slim margins to 24.04), and then Microsoft Windows 11 was the front-runner just 10% of the time... If taking the geomean of all 101 benchmark results, Ubuntu 23.10 was 16% faster than Microsoft Windows 11 while Ubuntu 24.04 enhanced the Ubuntu Linux performance by 3% to yield a 20% advantage over Windows 11 on this AMD Ryzen 7 7840HS laptop. Ubuntu 24.04 is looking very good in the performance department and will see its stable release next week. ' -- source: https://hardware.slashdot.org/story/24/04/18/2321230 Cheers, Peter

1 0

FFmpeg 7.0 “Dijkstra”: Best New Features
by Peter Reutemann 19 Apr '24

19 Apr '24

'One of the major updates in FFmpeg 7.0 is the parallel execution of operations for unpacking/packing media containers, decoding, encoding, and applying filters using the ffmpeg command line utility. This feature allows for the simultaneous execution of multiple tasks, resulting in a significant improvement in performance and efficiency, particularly when working with large-scale multimedia projects. Another notable addition is the support for encoding and decoding video in MPEG-5 format (EVC – Essential Video Coding) using the external library libxevd. This new format provides high efficiency transmission and storage of all screen resolutions, supports video with an extended dynamic range (HDR), and panoramic video in 360-degree mode. In addition, FFmpeg 7.0 has added unpackers and packers of media containers (demuxer/muxer) for the QOA (Quite OK Audio) format, which is used for transmitting audio with loss of quality. QOA decoding is claimed to be three times faster than Ogg-Vorbis while achieving higher quality and compression levels compared to ADPCM. The new version also includes unpackers and packers of media containers (demuxer/muxer) for the IAMF (Immersive Audio Model and Format) format, which defines a container for distributing surround sound. The format provides for the transmission of additional information necessary for the operation of sound stage reconstruction and sound mixing algorithms, and takes into account the propagation of sound signals in three-dimensional space to recreate sound as close to natural as possible. An experimental decoder for the VVC (Versatile Video Coding) format, also known as the H.266 video compression standard, has been added in FFmpeg 7.0. This new format provides high efficiency transmission and storage of all screen resolutions, supports video with an extended dynamic range (HDR), and panoramic video in 360-degree mode. The ffplay utility has added support for hardware acceleration of decoding using the Vulkan and libplacebo APIs, and the ability to use API D3D12VA (Direct 3D 12 Video Encoding) for hardware acceleration of decoding of H264, HEVC, VP9, AV1, MPEG-2 and VC1 formats has been implemented. [...] Remember: This version is NOT backward compatible. That means, many CLI options and API are removed which are long deprecated. So use caution before upgrading to version 7.0.' -- source: https://www.debugpoint.com/ffmpeg-7-0-features/ Cheers, Peter -- My Open Source Blog - http://open.fracpete.org

1 0

High Priority PuTTY Vulnerability Threatens Server Access Security
by Peter Reutemann 19 Apr '24

19 Apr '24

'A critical security vulnerability in PuTTY, a very popular software for secure terminal access to remote servers, has been discovered. This vulnerability could put the private keys of many users at risk. Cataloged as CVE-2024-31497, the vulnerability affects PuTTY version numbers between 0.68 and 0.80. So, if you have been using PuTTY during this time, it is important to be aware of what this means for your data security. Fabian Bäumer and Marcus Brinkmann of the Ruhr University Bochum found the vulnerability. It concerns how PuTTY forms signatures from the ECDSA private keys on the NIST P521 curve. The vulnerability with PuTTY is that it creates a component of the signature called ‘nonce’ during the generation process. This randomly generated number can be used once in a cryptographic communication, thus ensuring that old communications cannot be reused in replay attacks. However, PuTTY used a deterministic method to generate nonces due to the lack of a high-quality random number generator in early Windows systems. This deterministic method was biased for the P521 curve, which made the private key recovery possible. Simply put, an attacker who gets hold of multiple signed messages can potentially recover your private key due to a specific bias in the signature creation process. This would allow them to forge signatures and access any servers where you’ve used this key.' -- source: https://linuxiac.com/high-priority-putty-vulnerability-found/ Cheers, Peter -- My Open Source Blog - http://open.fracpete.org

1 0

Packages With “t64” On The Ends Of Their Names
by Lawrence D'Oliveiro 15 Apr '24

15 Apr '24

Lately, in Debian Unstable, I have noticed package names starting to appear with “t64” on the ends. No doubt this will percolate through to Debian derivatives as well. I wondered what this was about, and found this forum thread <https://www.antixforum.com/forums/topic/t64-at-the-end-of-a-package-title/>. This has to do with the “year-2038” problem, which should only affect 32-bit systems anyway. But it seems some people are sufficiently concerned about this to ensure that their code will build with a 64-bit size for time_t (the POSIX type for holding the number of seconds since 1st January 1970), even on 32-bit systems. This is controlled at build time by setting the _TIME_BITS symbol to the value 64. There is a file /usr/include/features-time64.h (present if you have the libc6-dev package installed) that does the necessary setup of other time-related API calls based on this. On 64-bit systems (which is what most of us would be running by now), there would be absolutely no difference in the code with this setting. So the change in package name is I think only to maintain compatibility with 32-bit architectures.

1 0

“Highly capable” hackers root corporate networks by exploiting firewall 0-day
by Peter Reutemann 15 Apr '24

15 Apr '24

'Highly capable hackers are rooting multiple corporate networks by exploiting a maximum-severity zero-day vulnerability in a firewall product from Palo Alto Networks, researchers said Friday. The vulnerability, which has been under active exploitation for at least two weeks now, allows the hackers with no authentication to execute malicious code with root privileges, the highest possible level of system access, researchers said. The extent of the compromise, along with the ease of exploitation, has earned the CVE-2024-3400 vulnerability the maximum severity rating of 10.0. The ongoing attacks are the latest in a rash of attacks aimed at firewalls, VPNs, and file-transfer appliances, which are popular targets because of their wealth of vulnerabilities and direct pipeline into the most sensitive parts of a network.' -- source: https://arstechnica.com/security/2024/04/highly-capable-hackers-root-corpor… Cheers, Peter

1 0

APT Interface 'Revamped' For Ubuntu 24.10 and Debian Trixie with Colors and Columns
by Peter Reutemann 15 Apr '24

15 Apr '24

'Ubuntu 24.10 [expected this October] and Debian GNU/Linux 13 "Trixie" [expected June-July 2025] "will feature a refined APT command-line interface," reports 9to5Linux: APT developer and Canonical engineer Julian Andres Klode took to LinkedIn to present the revamped APT interface powered by the upcoming APT 3.0 package manager that looks to give users a more concise and well-laid-out command-line output when updating, installing, or removing packages via the terminal emulator. The new APT 3.0 UI brings a columnar display that will make it easier for users to quickly scan for a package name, support for colors (red for removals and green for other changes), which makes it easier to quickly distinguish commands at a glance, and smoother install progress bars using Unicode blocks. In addition, the new APT 3.0 command-line interface will be less verbose and offer more padding to make it easier to separate sections and extract the relevant information for you. "Bleeding-edge users and Linux enthusiasts who want to try this right now can check out Debian Unstable..."' -- source: https://linux.slashdot.org/story/24/04/14/052258 Cheers, Peter

1 0

Canonical Says Qualcomm Has Joined Ubuntu's 'Silicon Partner' Program
by Peter Reutemann 15 Apr '24

15 Apr '24

'Intel, Nvidia, AMD, and Arm are among Canonical's "silicon partners," a program that "ensures maximum Ubuntu compatibility and long-term support with certified hardware," according to Web Pro News. And now Qualcomm is set to be Canonical's next silicon partner, "giving Qualcomm access to optimized versions of Ubuntu for its processors." Companies looking to use Ubuntu on Qualcomm chips will benefit from an OS that provides 10 years of support and security updates. The collaboration is expected to be a boon for AI, edge computing, and IoT applications. "The combination of Qualcomm Technologies' processors with the popularity of Ubuntu among AI and IoT developers is a game changer for the industry," commented Dev Singh, Vice President, Business Development and Head of Building, Enterprise & Industrial Automation, Qualcomm Technologies, Inc... "Optimised Ubuntu and Ubuntu Core images will be available for Qualcomm SoCs," according to the announcement, "enabling enterprises to meet their regulatory, compliance and security demands for AI at the edge and the broader IoT market with a secure operating system that is supported for 10 years." Qualcomm Technologies chose to partner with Canonical to create an optimised Ubuntu for Qualcomm IoT chipsets, giving developers an easy path to create safe, compliant, security-focused, and high-performing applications for multiple industries including industrial, robotics and edge automation... Developers and enterprises can benefit from the Ubuntu Certified Hardware program, which features a growing list of certified ODM boards and devices based on Qualcomm SoCs. These certified devices deliver an optimised Ubuntu experience out-of-the-box, enabling developers to focus on developing applications and bringing products to market.' -- source: https://news.slashdot.org/story/24/04/14/1652246 Cheers, Peter

1 0

New Spectre V2 Attack Impacts Linux Systems On Intel CPUs
by Peter Reutemann 14 Apr '24

14 Apr '24

'BleepingComputer reports: Researchers have demonstrated the "first native Spectre v2 exploit" for a new speculative execution side-channel flaw that impacts Linux systems running on many modern Intel processors. Spectre V2 is a new variant of the original Spectre attack discovered by a team of researchers at the VUSec group from VU Amsterdam. The researchers also released a tool that uses symbolic execution to identify exploitable code segments within the Linux kernel to help with mitigation. The new finding underscores the challenges in balancing performance optimization with security, which makes addressing fundamental CPU flaws complicated even six years after the discovery of the original Spectre.... As the CERT Coordination Center (CERT/CC) disclosed yesterday, the new flaw, tracked as CVE-2024-2201, allows unauthenticated attackers to read arbitrary memory data by leveraging speculative execution, bypassing present security mechanisms designed to isolate privilege levels. "An unauthenticated attacker can exploit this vulnerability to leak privileged memory from the CPU by speculatively jumping to a chosen gadget," reads the CERT/CC announcement. "Current research shows that existing mitigation techniques of disabling privileged eBPF and enabling (Fine)IBT are insufficient in stopping BHI exploitation against the kernel/hypervisor." ' -- source: https://linux.slashdot.org/story/24/04/13/1911230 Cheers, Peter

1 0

In a First, AlmaLinux Patches a Security Hole That Remains Unpatched in Upstream RHEL
by Peter Reutemann 10 Apr '24

10 Apr '24

'AlmaLinux, a three year old Linux distribution that started life as a clone of Red Hat Enterprise Linux, on Tuesday announced that it had created a patch to fix CVE-2024-1086, a security vulnerability that Red Hat evidently doesn’t think is important enough to patch in RHEL right away. “Though this was flagged as something to be fixed in Red Hat Enterprise Linux, Red Hat has only rated this as a moderate impact,” benny Vasquez, chairperson at the AlmaLinux Foundation explained in an article on the distro’s website on Tuesday. “Our users have asked us to patch this more quickly, and as such, we have opted to include patches ourselves. We released this kernel patch to the testing repo last weekend and plan to push it to production on Wednesday, April 3rd.” Since Vasquez’s post a production ready version of the fix was made available through the distro’s repositories, and Red Hat has re-evaluated the threat from its end and raised the severity level from “moderate” to “important.” There is still no sign of a patch from Red Hat, however, although the company has posted several methods for mitigating the threat. “This flaw is trivially exploitable on most RHEL-equivalent systems,” Vasquez said. “There are many proof-of-concept posts available now, including one from our Infrastructure team lead, Jonathan Wright (Dealing with CVE-2024-1086). In multi-user scenarios, this flaw is especially problematic.”' -- source: https://fossforce.com/2024/04/in-a-first-almalinux-patches-a-security-hole-… Cheers, Peter

1 0

EndeavourOS Bids Farewell to ARM Branch
by Peter Reutemann 10 Apr '24

10 Apr '24

'In a heartfelt announcement today, Bryan Poerwo, founder and project leader of EndeavourOS, marked the end of its ARM product branch. This project has been part of the EndeavourOS journey since its inception from the remnants of Antergos in 2019. The initiative, which began with the help of a passionate community member known as Pudge, later a leading figure of the EndeavourOS ARM team, aimed to extend the reach of EndeavourOS to ARM devices such as the ODROID N2, ODROID XU4, and Raspberry Pi 4. Over nearly five years, EndeavourOS ARM flourished, witnessing additions like support for the PineBook Pro and Raspberry Pi 5 and implementing a Calamares install option alongside the original scripts. However, the journey was challenging. The rapid advancement of Linux and desktop environments on x86_64 devices contrasted sharply with the slower pace of development in the ARM landscape, presenting a series of obstacles that tested the resolve of the project’s pioneers. The widening gap between ARM and x86_64 architectures, reduced external support, and personal transitions in hardware preferences led to a heartfelt decision to conclude the EndeavourOS ARM project. But not all is lost. As the project ends, the community remains hopeful, inviting anyone willing to carry the torch forward. The project’s GitHub repository continues to be available, serving as a foundation for future endeavors in the ARM Linux space.' -- source: https://linuxiac.com/endeavouros-bids-farewell-to-arm-branch/ Cheers, Peter

1 0

TrueNAS Moving From FreeBSD To Debian
by Lawrence D'Oliveiro 09 Apr '24

09 Apr '24

TrueNAS, makers of a turnkey system installation designed for NAS servers, announced close to a month ago that they were changing the emphasis in their product development from “TrueNAS CORE” (which is FreeBSD-based) to “TrueNAS SCALE” (which is Linux-based, specifically Debian-based) <https://www.theregister.com/2024/03/18/truenas_abandons_freebsd/>. This article <https://blocksandfiles.com/2024/04/08/ixsystems-no-one-is-getting-marooned/> gives some more background on the move: Kris Moore, SVP for engineering, told us: “Upstream has shifted. So first of all, ZFS, that’s kind of the heart and soul of TrueNAS and was for FreeNAS as well. Most of that [development] work takes place on Linux these days; features testing, all that happens on Linux. FreeBSD is the thing you port to and you’re done. So that momentum has moved.” ... “We had a huge chunk of our engineering staff spending time improving FreeBSD as opposed to working on features and functionalities. What’s happened now with the transition to having a Debian basis, the people I used to have 90 percent of their time working on FreeBSD, they’re working on ZFS features now … That’s what I want to see; value add for everybody versus sitting around, implementing something Linux had a years ago.” The irony in that is, ZFS was deliberately released by Sun (now Oracle) under a licence that is designed to be incompatible with the GPL that covers the Linux kernel. If you want to argue otherwise, consider that Oracle still refuses to include ZFS with its own Linux distro, preferring to offer you btrfs instead. Of course, you could also view that as a sign of a lack of confidence in its own home-grown filesystem ...

1 0

MIT License text becomes viral “sad girl” piano ballad generated by AI
by Peter Reutemann 09 Apr '24

09 Apr '24

'We've come a long way since primitive AI music generators in 2022. Today, AI tools like Suno.ai allow any series of words to become song lyrics, including inside jokes (as you'll see below). On Wednesday, prompt engineer Riley Goodside tweeted an AI-generated song created with the prompt "sad girl with piano performs the text of the MIT License," and it began to circulate widely in the AI community online.' -- source: https://arstechnica.com/information-technology/2024/04/mit-license-text-bec… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

German state gov. ditching Windows for Linux, 30K workers migrating
by Peter Reutemann 08 Apr '24

08 Apr '24

''Schleswig-Holstein, one of Germany’s 16 states, on Wednesday confirmed plans to move tens of thousands of systems from Microsoft Windows to Linux. The announcement follows previously established plans to migrate the state government off Microsoft Office in favor of open source LibreOffice. As spotted by The Document Foundation, the government has apparently finished its pilot run of LibreOffice and is now announcing plans to expand to more open source offerings. In 2021, the state government announced plans to move 25,000 computers to LibreOffice by 2026. At the time, Schleswig-Holstein said it had already been testing LibreOffice for two years. -- source: https://arstechnica.com/information-technology/2024/04/german-state-gov-dit… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenBSD 7.5 Released
by Peter Reutemann 08 Apr '24

08 Apr '24

'Slashdot reader Mononymous writes: The latest release of OpenBSD, the FOSS Unix-like operating system focused on correctness and security over features and performance, has been released. This version includes newer driver support, performance improvements, stability fixes, and lots of package updates. One highlight is a complete port of KDE Plasma 5. You can view the announcement and get the bits at OpenBSD.org. Phoronix reports that with OpenBSD 7.5 "there is a number of improvements for ARM (AArch64) hardware, never-ending kernel optimizations and other tuning work, countless package updates, and other adjustments to this popular BSD platform."' -- source: https://tech.slashdot.org/story/24/04/06/0519207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tip For Repairing Ancient Linux Installations
by Lawrence D'Oliveiro 02 Apr '24

02 Apr '24

Here’s the scenario: there is a malfunctioning server running a really ancient Linux installation (e.g. 2.6.x-series kernel). You boot up with a reasonably recent copy of SystemRescue, mount the machine’s filesystem, try to chroot into it and run a shell ... and it segfaults. Seems there has been a subtle incompatible change in Linux kernel behaviour since those times, to do with the disabling of something called the “vsyscall” mechanism (which is specific to 64-bit x86-based machines, I understand). This was supposed to be a way to speed up certain commonly-executed system calls (I think getting the system time was one of them) by allowing direct transfers to certain entry points with fixed memory addresses for invoking them. It was later decided this was a bad idea (I think for security reasons). The mechanism has not been completely removed (yet), but nowadays it is disabled by default. To get around this, you need to boot SystemRescue with a change to the kernel command-line parameters, adding this item vsyscall=emulate After you get to a shell, you can confirm that this setting is in effect by checking the /proc/self/maps file (the memory mappings for your own process). At the bottom, there should be an entry with “[vdso]” in it, and below that another line with “[vsyscall]”. The presence of the latter line indicates that vsyscall emulation is in effect. This is not present when I check a process on my own machine, for example. Linus is legendary for being a stickler for never, ever breaking backward compatibility for userland. So the reasons for turning this off must have been pretty compelling, for him to agree to it. But the compromise is, it’s still there to be enabled if you really, really need it. There’s a bit more technical info here <https://0xax.gitbooks.io/linux-insides/content/SysCall/linux-syscall-3.html>, if you are interested. By the way, the above page is part of a book beginning here <https://0xax.gitbooks.io/linux-insides/content/>, about the insides of the Linux kernel. The whole book seems to be accessible from that link, but if you step up a level, the site doesn’t seem to have any idea about the existence of that book.

3 4

Uncle Sam’s Had It Up To Here With “Unforgivable” SQL Injection Flaws
by Lawrence D'Oliveiro 27 Mar '24

27 Mar '24

We all know SQL injection attacks are an ongoing problem <https://www.theregister.com/2024/03/26/fbi_cisa_sql_injection/>. What interested me about this article is this part: Software vendors have been advised to use parameterized queries with prepared statements to mitigate SQL injection vulnerabilities. According to the authorities, these allow user-input data to be separated from SQL queries and "better embody a secure by design approach" compared to input sanitization techniques. These are deployed by some vendors, but were branded "brittle" by CISA and the FBI. They said they're also difficult to deploy on a large scale and are more easily bypassed. Funny, that. Every time I post examples of how I dynamically construct SQL query strings with proper quoting of user input, I get yelled at and told to use “parameterized queries” and “prepared statements”, or even an ORM. Yet here we have the security experts saying that that is not a good solution, just like I thought all along.

1 0

Mozilla’s privacy service drops a provider with ties to people-search sites
by Peter Reutemann 26 Mar '24

26 Mar '24

'Mozilla's Monitor Plus, a service launched by the privacy-minded tech firm in February, notes on its pitch page that there is "a $240 billion industry of data brokers selling your private information for profit" and that its offering can "take back your privacy." Mozilla's most recent move to protect privacy has been to cut out one of the key providers of Monitor Plus' people-search protections, Onerep. That comes after reporting from security reporter Brian Krebs, who uncovered Onerep CEO and founder Dimitri Shelest as the founder of "dozens of people-search services since 2010," including one, Nuwber, that still sells the very kind of "background reports" that Monitor Plus seeks to curb. Shelest told Krebs in a statement (PDF) that he did have an ownership stake in Nuwber, but that Nuwber has "zero cross-over or information-sharing with Onerep" and that he no longer operates any other people-search sites. Shelest admitted the bad look but said that his experience with people search gave Onerep "the best tech and team in the space." Brandon Borrman, vice president of communications at Mozilla, said in a statement that while "customer data was never at risk, the outside financial interests and activities of Onerep’s CEO do not align with our values." Mozilla is "working now to solidify a transition plan," Borrman said. A Mozilla spokesperson confirmed to Ars today that Mozilla is continuing to offer Monitor Plus, suggesting no pause in subscriptions, at least for the moment.' -- source: https://arstechnica.com/gadgets/2024/03/mozillas-privacy-service-drops-a-pr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

decrypting PDFs
by Peter Reutemann 22 Mar '24

22 Mar '24

Hi everyone I've long had a problem with being unable to open some PDFs that could be either viewed on Windows or on Google Drive. For some reason, some PDFs appear to be encrypted (but not requiring a password??). Today, I found an approach that allows me to access these files also on my Linux machine using pdftk. pdftk allows you to decrypt PDFs by supplying a password (https://www.ubuntumint.com/remove-password-from-pdf-on-linux/) pdftk <protected>.pdf input_pw <password> output <new>.pdf However, the following seemed to work on these weird PDF files, without having to supply a password: pdftk <protected>.pdf output <new>.pdf And now my PDF viewers (okular, xreader, etc) no longer complain that they can't open the file. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Formula 1 Chief Appalled to Find Team Using Excel to Manage 20,000 Car Parts
by Lawrence D'Oliveiro 21 Mar '24

21 Mar '24

<https://arstechnica.com/cars/2024/03/formula-1-chief-appalled-to-find-team-…>: The Williams car build workbook, with roughly 20,000 individual parts, was "a joke," Vowles recently told The Race. "Impossible to navigate and impossible to update." This colossal Excel file lacked information on how much each of those parts cost and the time it took to produce them, along with whether the parts were already on order. ... Banks cited Tim Worstall's 2013 contention that Excel could be "the most dangerous software on the planet." Back then, international investment bankers were found manually copying and pasting Excel between Excel sheets to do their work, and it raised alarm.

1 0

Database-Based Operating System 'DBOS' Does Things Linux Can't
by Peter Reutemann 19 Mar '24

19 Mar '24

'Databricks CTO Matei Zaharia "said that Databricks had to keep track of scheduling a million things," remembers adjunct MIT professor Michael Stonebraker. " He said that this can't be done with traditional operating system scheduling, and so this was done out of a Postgres database. And then he started to whine that Postgres was too slow, and I told him we can do better than that...." This resulted in DBOS — short for "database operating system" — which they teamed up to build with teams Stanford and MIT, according to The Next Platform: They founded a company to commercialize the idea in April 2023 and secured $8.5 million initial seed funding to start building the real DBOS. Engine Ventures and Construct Capital led the funding, along with Sinewave and GutBrain Ventures... "The state that the operating system has to keep track of — memory, files, messages, and so on — is approximately linear to the resources you have got," says Stonebraker. "So without me saying another word, keeping track of operating system state is a database problem not addressed by current operating system schedulers. Moreover, OLTP [Online Transaction Processing] database performance has gone up dramatically, and that is why we thought instead of running the database system in user space on top of the operating system, why don't we invert our thinking 180 degrees and run the operating system on top of the database, with all of the operating services are coded in SQL...?" For now, DBOS can give the same kind of performance as that full blown Linux operating system, and thanks to the distributed database underpinnings of its kernel, it can do things that a Linux kernel just cannot do... One is provide reliable execution, which means that if a program running atop DBOS is ever interrupted, it starts where it left off and does not have to redo its work from some arbitrary earlier point and does not crash and have to start from the beginning. And because every little bit of the state of the operating system — and therefore the applications that run atop it — is preserved, you can go backwards in time in the system and restart the operating system if it experiences some sort of anomaly, such as a bad piece of application software running or a hack attack. You can use this "time travel" feature, as Stonebraker calls it, to reproduce what are called heisenbugs — ones that are very hard to reproduce precisely because there is no shared state in the distributed Linux and Kubernetes environment and that are increasingly prevalent in a world of microservices. The other benefit of the DBOS is that it presents a smaller attack surface for hackers, which boosts security, and that you analyze the metrics of the operating system in place since they are already in a NoSQL database that can be queried rather than aggregating a bunch of log files from up and down the software stack to try to figure out what is going on... There is also a custom tier for DBOS, which we presume costs money, that can use other databases and datastores for user application data, stores more than three days of log data, can have multiple users per account, that adds email and Slack support with DBOS techies, and that is available on other clouds as well as AWS. The operating system kernel/scheduler "is itself largely a database," with services written in TypeScript, according to the article. The first iteration used the FoundationDB distributed key-value store for its scheduling core (open sourced by Apple in 2018), according to the article — "a blazingly fast NoSQL database... Stonebraker says there is no reason to believe that DBOS can't scale across 1 million cores or more and support Java, Python, and other application languages as they are needed by customers..." And the article speculates they could take things even further. "There is no reason why DBOS cannot complete the circle and not only have a database as an operating system kernel, but also have a relational database as the file system for applications."' -- source: https://developers.slashdot.org/story/24/03/18/0038232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Ends its Privacy-Friendly GPS-Style Location Service
by Peter Reutemann 18 Mar '24

18 Mar '24

'Mozilla Location Service offered "a free, open way to offer GPS-style location detection features" for developers on devices without GPS hardware, remembers the Linux blog OMG Ubuntu. It used signals like Wi-Fi access points and Bluetooth beacons "without any of the privacy implications most competing geolocation services have." But Friday they reported that Mozilla "has announced it is ending access to Mozilla Location Service (MLS), which provides accurate, privacy-respecting, and crowdsourced geolocation data." Developers and 3rd-party projects that use MLS to detect a users' location, such as the freedesktop.org location framework GeoClue, which is used by apps like GNOME Maps and Weather, have only a few months left to continue using the service... In late March, POST data submissions will return 403 responses. Finally, on June 12, all 3rd-party API keys will be removed and MLS data only accessible by Mozilla... MLS' accuracy has declined in recent years. Patent infringement claims in 2019 saw Mozilla reach a settlement to avoid litigation. As part of that settlement it was forced to make changes to MLS that impacted its ability to invest in (commercially exploit?) and improve the service. The article notes that GeoClue "already supports multiple location detection methods, including IP-based ones," so it should continue operating. "But the sad reality is that there just aren't a lot of free, open, privacy-friendly, accurate, and (rather importantly for a framework built in to Linux desktops) reliable alternatives to Mozilla Location Services, which has built up a colossal 'signal map' from which to pinpoint locations." "We are grateful for the contributions of the community to MLS to both the code and the dataset," a Mozilla senior engineering manager said in a statement.' -- source: https://tech.slashdot.org/story/24/03/17/2150221/mozilla-ends-its-privacy-f… I wasn't even aware that Mozilla was offering such a service... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

1986 Presentation On Setting A Computer’s Clock Correctly
by Lawrence D'Oliveiro 18 Mar '24

18 Mar '24

One of the recent additions to the Bitsavers vintage computing collection is this presentation from 1986 <http://bitsavers.trailing-edge.com/pdf/ibm/share/SHARE67_Presentation_on_Se…> at a session of SHARE (one of the IBM user groups), on how to ensure your computer’s time is set correctly. Remember, this was before NTP. But there was already a worldwide network of atomic clocks, keeping synchronization with each other, and there were shortwave stations, like WWV in Boulder, Colorado, that would broadcast pips once per second, synchronized to the atomic clock network. And there were even consumer-level gadgets, like the one mentioned in the article from Heath, that would automatically decode those broadcasts and output a time code a computer could read. The article has some nice background info. Like did you know there can be up to a 1-second discrepancy between GMT and UTC? (Actually I think from other sources the limit might be more like 0.9 seconds.) IBM’s mainframe OS developers were perceptive enough to realize that it can be useful to have the computer keep time in GMT, and maintain an offset for calculating local time. Particular site admins could of course have the choice of using local time for the system time, and setting the offset to zero. Changing the offset for daylight saving could be a fraught procedure, though. The level of confusion it could cause for running applications was such that it was safer to do a reboot. One little item I don’t recall coming across before, another of those NASA programming screwups: One of the famous programming mistakes of all time was by the programmer who thought the earth revolved on its axis once every 24 hours and used that fact to calculate landing sites for the Mercury space flights. Our first astronauts spent a lot more time in the water than they should have because of that.

1 0

Free/Libre 'GnuCOBOL' Compiler Reaches Maturity, Can Compete with Proprietary Offerings
by Peter Reutemann 18 Mar '24

18 Mar '24

'After 20 years of development, the open source GnuCOBOL "has reached an industrial maturity and can compete with proprietary offers in all environments," said OCamlPro founder and GnuCOBOL contributor Fabrice Le Fessant, in a FOSDEM talk about the technology. GnuCOBOL turns COBOL source code into executable applications. It is very cross-platform, running Linux, BSD, many proprietary Unixes, macOS, and Windows, even Android. And the latest version, v.32, is being used in many commercial settings... Sobisch noted that the GnuCOBOL is seeing a lot of commercial deployments, such as for banking back-end apps, many of which are being migrated from Micro Focus, with users reporting performance improvements as a result. The French DGFIP federal agency moved from a GCOS mainframe to GnuCOBOL, with the help of Le Fessant's firm. Originally called OpenCOBOL, the project was started in 2002 and renamed GnuCOBOL in 2013. In the past three years, it has received attention from 13 contributors with 460 commits. Most Linux package managers have a copy of GnuCOBOL for the program for downloading... It can compile to C code (C89+), making it extremely portable, from mainframes to Raspberry Pi's, Sobisch said... Also new is SuperBOL, a development studio for GnuCOBOL developed by Le Fessant's OCamlPro. It runs as a VSCode Extension and features a full COBOL processor (written in OCaml). ' -- source: https://developers.slashdot.org/story/24/03/17/1810257 Anything COBOL related takes time, I guess... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Raspberry Pi OS Is Now Powered by Linux 6.6 LTS, Improves Raspberry Pi 5 Support
by Peter Reutemann 15 Mar '24

15 Mar '24

'The Raspberry Pi Foundation released today a new build of their Debian-based Raspberry Pi OS operating for the Raspberry Pi single-board computers adding a new kernel from the Linux 6.6 long-term supported series, updated components, and various improvements. While still based on the latest Debian GNU/Linux 12 “Bookworm” operating system series, Raspberry Pi OS is now powered by the Linux 6.6 LTS kernel series, which is a major upgrade from Linux kernel 6.1 LTS used in previous releases. This update also includes the latest Chromium 122 and Mozilla Firefox 123 web browsers. The new Raspberry Pi OS release offers better support for the latest Raspberry Pi 5 SBC by improving the handling of the power button. In addition, it also adds new settings for headless resolution to the Screen Configuration, while removing the setting of headless resolution for Wayland from Raspberry Pi Configuration.' -- source: https://9to5linux.com/raspberry-pi-os-is-now-powered-by-linux-6-6-lts-impro… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Never-before-seen Linux malware gets installed using 1-day exploits
by Peter Reutemann 12 Mar '24

12 Mar '24

'Researchers have unearthed Linux malware that circulated in the wild for at least two years before being identified as a credential stealer that’s installed by the exploitation of recently patched vulnerabilities. The newly identified malware is a Linux variant of NerbianRAT, a remote access Trojan first described in 2022 by researchers at security firm Proofpoint. Last Friday, Checkpoint Research revealed that the Linux version has existed since at least the same year, when it was uploaded to the VirusTotal malware identification site. Checkpoint went on to conclude that Magnet Goblin—the name the security firm uses to track the financially motivated threat actor using the malware—has installed it by exploiting “1-days,” which are recently patched vulnerabilities. Attackers in this scenario reverse engineer security updates, or copy associated proof-of-concept exploits, for use against devices that have yet to install the patches. Checkpoint also identified MiniNerbian, a smaller version of NerbianRAT for Linux that’s used to backdoor servers running the Magento ecommerce server, primarily for use as command and control servers that devices infected by NerbianRAT connect to. Researchers elsewhere have reported encountering servers that appear to have been compromised with MiniNerbian, but Checkpoint Research appears to have been the first to identify the underlying binary.' -- source: https://arstechnica.com/security/2024/03/never-before-seen-linux-malware-ge… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.9 Will Be the First To Top 10 Million Git Objects
by Peter Reutemann 12 Mar '24

12 Mar '24

'Linus Torvalds has released version 6.8 of the Linux Kernel. "So it took a bit longer for the commit counts to come down this release than I tend to prefer," Torvalds wrote on the Linx kernel mailing list on Sunday, "but a lot of that seemed to be about various selftest updates (networking in particular) rather than any actual real sign of problems." "And the last two weeks have been pretty quiet, so I feel there's no real reason to delay 6.8." So he delivered it, ending his own speculation that this cut of the kernel might need an eighth release candidate. Torvalds found time to note what he described as "a bit of random git numerology" as when work ended on this version of the kernel the git repository used to track it contained 9.996 million objects." "This is the last mainline kernel to have less than ten million git objects," Torvalds wrote. "Of course, there is absolutely nothing special about it apart from a nice round number. Git doesn't care," he added. Fair enough -- especially as noted that other trees, such as linux-next, have well and truly passed ten million objects.' -- source: https://linux.slashdot.org/story/24/03/11/1620223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Do Scientists Take Backups?
by Lawrence D'Oliveiro 11 Mar '24

11 Mar '24

Martin Eve, who works at Crossref, which manages the DOI system which tries to offer permanent online links to scientific publications and other digital documents, decided to do a survey of those links, to see how many of them would still actually resolve. The results were less than reassuring <https://arstechnica.com/science/2024/03/study-finds-that-we-could-lose-scie…>. If/when a publisher goes bankrupt, what happens to their online archives? Do researchers who submit papers keep backup copies of their papers?

3 6

It’s A Raspberry Pi!
by Lawrence D'Oliveiro 08 Mar '24

08 Mar '24

Was anybody watching Channel 200 (Juice TV) a minute ago? There was a lovely Linux text screen with a shell prompt saying the machine name was “pberrypi”.

1 1

“We Had To Educate Oracle About Our Contract”
by Lawrence D'Oliveiro 08 Mar '24

08 Mar '24

Slightly chilling words to hear, don’t you think? Corporations that do volume deals with proprietary suppliers like Oracle and SAP have to agree to allow periodic audits by the vendor to ensure they are complying with the licence terms. Vendors have been known to try to pull a fast one during these audits. This customer <https://www.theregister.com/2024/03/06/oracle_audits/> mentions that Oracle, in particular, had a tendency to assume the software was licensed under their current terms, when in fact the contract was agreed under quite different, older terms. Hence the need to keep “educating” (i.e. reminding) the vendor about what the correct criteria were.

1 0

Fedora Workstation 41 To No Longer Install GNOME X.Org Session By Default
by Peter Reutemann 08 Mar '24

08 Mar '24

'Michael Larabel writes via Phoronix: Fedora Workstation has long defaulted to using GNOME's Wayland session by default, but it has continued to install the GNOME X.Org session for fallback purposes or those opting to use it instead. But for the Fedora Workstation 41 release later in the year, there is a newly-approved plan to no longer have that GNOME X.Org session installed by default. Recently there was a Fedora Workstation ticket opened to no longer install the GNOME X.Org session by default. This is just about whether the X.Org session is pre-installed but would continue to live in the repository for those wanting to explicitly install it. The Fedora Workstation working group decided to go ahead with this change for the Fedora 41 cycle, not the upcoming Fedora 40 release. So pending any obstacles by FESCo, which is unlikely. Fedora Workstation 41 will not be installing the GNOME X.Org session by default. Long live Wayland.' -- source: https://news.slashdot.org/story/24/03/07/2157258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to Run Android Applications on Ubuntu with Waydroid
by Peter Reutemann 06 Mar '24

06 Mar '24

'Waydroid is an excellent tool that lets you access Android apps like native applications on your Linux machine, following a container-based philosophy similar to the Android subsystem in Windows and capable of booting the full Android system. It has access to Linux namespaces (user, pid, uts, net, mount, ipc), and within the container, Android has direct access to the system hardware. Currently, the provided Android OS will be based on Lineage OS 21 (Android 11), so certain discontinued apps might not work.' -- source: https://ubuntushell.com/install-waydroid/ The article has step-by-step instructions. Looks like an interesting tool! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Opus 1.5 Gets a Serious Machine Learning Upgrade
by Peter Reutemann 05 Mar '24

05 Mar '24

'Longtime Slashdot reader jmv writes: After more than two years of work, Opus 1.5 is out. It brings many new features that can improve quality and the general audio experience through machine learning, while maintaining fully-compatibility with previous releases. See this release page demonstrating all the new features, including: - Significant improvement to packet loss robustness using Deep Redundancy (DRED) - Improved packet loss concealment through Deep PLC - Low-bitrate speech quality enhancement down to 6 kb/s wideband - Improved x86 (AVX2) and Arm (Neon) optimizations - Support for 4th and 5th order ambisonics' -- source: https://news.slashdot.org/story/24/03/04/2126211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Passes 4% Desktop Market Share
by Peter Reutemann 05 Mar '24

05 Mar '24

'"Linux gained from 3% to 4% in 8 months," writes longtime Slashdot reader bobdevine. Linuxiac reports: According to the latest data from StatCounter, a leading web traffic analysis tool, Linux's market share has reached 4.03%. At first glance, the number might seem modest, but it represents a significant leap. Let's break it down. It took Linux 30 years to secure a 3% share of desktop operating systems, a milestone reached last June. Impressively, the open-source operating system has surged by an additional 1% in the last eight months.' -- source: https://linux.slashdot.org/story/24/03/04/2159239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

French Court Issues Damages Award For Violation of GPL
by Peter Reutemann 04 Mar '24

04 Mar '24

'Some news from "Copyleft Currents", the blog of open-source/IP lawyer Heather Meeker: On February 14, 2024, the Court of Appeal of Paris issued an order stating that Orange, a major French telecom provider, had infringed the copyight of Entr'Ouvert's Lasso software and violated the GPL. They ordered Orange to pay €500,000 in compensatory damages and €150,000 for moral damages. This case has been ongoing for many years. Entr'ouvert is the publisher of Lasso, a reference library for the Security Assertion Markup Language (SAML) protocol, an open standard for identity providers to authenticate users and pass authentication tokens to online services. This is the open protocol that enables single sign-on (SSO). The Lasso product is dual licensed by Entr'Ouvert under GPL or commercial licenses. In 2005, Orange won a contract with the French Agency for the Development of Electronic Administration to develop parts of the service-public.fr portal, which allows users to interact online with the government for administrative procedures. Orange used the Lasso software in the solution, but did not pass on the rights to its modifications free of charge under GPL, or make the source code to its modifications available. Entr'Ouvert sued Orange in 2010, and the case wended its way through the courts, turning on, among other things, issues of proof of Entr'Ouvert 's copyright interest in the software, and whether the case properly sounded in breach of contract or copyright infringement... The compensatory damages were based on both lost profits of the plaintiff and disgorgement of profits of Orange. Moral damages compensate the plaintiff for harm to reputation or other non-monetary injury.' -- source: https://news.slashdot.org/story/24/03/03/030200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rentware Comes To Hardware
by Lawrence D'Oliveiro 01 Mar '24

01 Mar '24

You already have companies like Adobe and Autodesk making their software subscription-only, so you have to keep paying to use it; now HP is bringing the same idea to its printers <https://arstechnica.com/gadgets/2024/02/hp-wants-you-to-pay-up-to-36-month-…>. You pay a monthly fee (inclusive of ink as well as printer rental), and you get to print a certain number of pages each month. This will require an always-on Internet connection, so HP can monitor your printer. This will allow them to collect information, not just on ink levels, but on what kind of printing you are doing, even the applications you are using. How would you like to “never own a printer again”? (Their tag line.) I suppose you should be grateful they aren’t requiring you to buy their paper as well. At least, not yet ...

1 0

'Paying People To Work on Open Source is Good Actually'
by Peter Reutemann 01 Mar '24

01 Mar '24

'Jacob Kaplan-Moss, one of the lead developers of Django, writes in a long post that he says has come from a place of frustration: [...] Instead, every time a maintainer finds a way to get paid, people show up to criticize and complain. Non-OSI licenses "don"t count" as open source. Someone employed by Microsoft is "beholden to corporate interests" and not to be trusted. Patreon is "asking for handouts." Raising money through GitHub sponsors is "supporting Microsoft's rent-seeking." VC funding means we're being set up for a "rug pull" or "enshitification." Open Core is "bait and switch." None of this is hypothetical; each of these examples are actual things I've seen said about maintainers who take money for their work. One maintainer even told me he got criticized for selling t-shirts! Look. There are absolutely problems with every tactic we have to support maintainers. It's true that VC investment comes with strings attached that often lead to problems down the line. It sucks that Patreon or GitHub (and Stripe) take a cut of sponsor money. The additional restrictions imposed by PolyForm or the BSL really do go against the Freedom 0 ideal. I myself am often frustrated by discovering that some key feature I want out of an open core tool is only available to paid licensees. But you can criticize these systems while still supporting and celebrating the maintainers! Yell at A16Z all you like, I don't care. (Neither do they.) But yelling at a maintainer because they took money from a VC is directing that anger in the wrong direction. The structural and societal problems that make all these different funding models problematic aren't the fault of the people trying to make a living doing open source. It's like yelling at someone for shopping at Dollar General when it's the only store they have access to. Dollar General's predatory business model absolutely sucks, as do the governmental policies that lead to food deserts, but none of that is on the shoulders of the person who needs milk and doesn't have alternatives.' -- source: https://news.slashdot.org/story/24/02/29/0746221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

HDMI Forum Rejects Open-Source HDMI 2.1 Driver Support Sought By AMD
by Peter Reutemann 01 Mar '24

01 Mar '24

'Michael Larabel, reporting at Phoronix: One of the limitations of AMD's open-source Linux graphics driver has been the inability to implement HDMI 2.1+ functionality on the basis of legal requirements by the HDMI Forum. AMD engineers had been working to come up with a solution in conjunction with the HDMI Forum for being able to provide HDMI 2.1+ capabilities with their open-source Linux kernel driver, but it looks like those efforts for now have concluded and failed. For three years there has been a bug report around 4K(a)120Hz being unavailable via HDMI 2.1 on the AMD Linux driver. Similarly, there have been bug reports like 5K @ 240Hz not possible either with the AMD graphics driver on Linux. As covered back in 2021, the HDMI Forum closing public specification access is hurting open-source support. AMD as well as the X.Org Foundation have been engaged with the HDMI Forum to try to come up with a solution to be able to provide open-source implementations of the now-private HDMI specs. AMD Linux engineers have spent months working with their legal team and evaluating all HDMI features to determine if/how they can be exposed in their open-source driver. AMD had code working internally and then the past few months were waiting on approval from the HDMI Forum. Sadly, the HDMI Forum has turned down AMD's request for open-source driver support.' -- source: https://it.slashdot.org/story/24/02/29/076217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cloudflare Makes Pingora Rust Framework Open-Source
by Peter Reutemann 29 Feb '24

29 Feb '24

'Michael Larabel reports via Phoronix: Back in 2022 Cloudflare announced they were ditching Nginx for an in-house, Rust-written software called Pingora. Today Cloudflare is open-sourcing the Pingora framework. Cloudflare announced today that they have open-sourced Pingora under an Apache 2.0 license. Pingora is a Rust async multi-threaded framework for building programmable network services. Pingora has long been used internally within Cloudflare and is capable of sustaining a lot of traffic while now Pingora is being open-sourced for helping to build infrastructure outside of Cloudflare.' -- source: https://news.slashdot.org/story/24/02/28/2352248 -- github: https://github.com/cloudflare/pingora Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 6 Released
by Peter Reutemann 29 Feb '24

29 Feb '24

'"Today, the KDE Community is announcing a new major release of Plasma 6.0 and Gear 24.02," writes longtime Slashdot reader jrepin. "The new version brings new windows and desktop overview effects, improved color management, a cleaner theme, better overall performance, and much more." From the announcement: KDE Plasma is a modern, feature-rich desktop environment for Linux-based operating systems. Known for its sleek design, customizable interface, and extensive set of applications, it is also open source, devoid of ads, and makes protecting your privacy and personal data a priority. With Plasma 6, the technology stack has undergone two major upgrades: a transition to the latest version of the application framework, Qt 6, and a migration to the modern Linux graphics platform, Wayland. We will continue providing support for the legacy X11 session for users who prefer to stick with it for now. [...] KDE Gear 24.02 brings many applications to Qt 6. In addition to the changes in Breeze, many applications adopted a more frameless look for their interface.' -- source: https://tech.slashdot.org/story/24/02/28/2137237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub besieged by millions of malicious repositories in ongoing attack
by Peter Reutemann 29 Feb '24

29 Feb '24

'GitHub is struggling to contain an ongoing attack that’s flooding the site with millions of code repositories. These repositories contain obfuscated malware that steals passwords and cryptocurrency from developer devices, researchers said. The malicious repositories are clones of legitimate ones, making them hard to distinguish to the casual eye. An unknown party has automated a process that forks legitimate repositories, meaning the source code is copied so developers can use it in an independent project that builds on the original one. The result is millions of forks with names identical to the original one that add a payload that’s wrapped under seven layers of obfuscation. To make matters worse, some people, unaware of the malice of these imitators, are forking the forks, which adds to the flood.' -- source: https://arstechnica.com/security/2024/02/github-besieged-by-millions-of-mal… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Open Documentation Academy' Offers On-Ramp To OSS
by Peter Reutemann 28 Feb '24

28 Feb '24

'"Documentation authors at Canonical have launched the Open Documentation Academy to offer an easy way to get started contributing to open-source projects," writes longtime Slashdot reader tykev. From the blog post: Open and inclusive collaboration, and the sharing of ideas, remains the best way to develop software (and to do many other things!), but we also recognise that this "getting involved" step can be difficult. Where do you start? Who do you ask? What needs to be done? We all very much want to help people become open source contributors by building an on-ramp process. It may take some time, and we will need to adapt, but this is exactly why we've started our Open Documentation Academy. To help you get involved, the Open Documentation Academy provides a curated list of documentation tasks. Choose one, let us know, and get started. Tasks include testing and fixing tutorials, updating the outdated, restructuring large documents, and anything else you may want to suggest. Our list is growing, and a big part of the Documentation Academy will be ensuring there's always a wide range of tasks available, across as many projects and technologies as possible. And of course, we're here to help. We'll guide you through your first contributions, provide advice on approaches, and help you build your confidence. ' -- source: https://news.slashdot.org/story/24/02/28/0024205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tumblr and Wordpress Are Preparing To Sell User Data To OpenAI and Midjourney, Report Says
by Peter Reutemann 28 Feb '24

28 Feb '24

'Tumblr and Wordpress are preparing to sell user data to Midjourney and OpenAI, 404Media reported Tuesday, citing a source with internal knowledge about the deals and internal documents. From the report: The exact types of data from each platform going to each company are not spelled out in documentation we've reviewed, but internal communications reviewed by 404 Media make clear that deals between Automattic, the platforms' parent company, and OpenAI and Midjourney are imminent. The internal documentation details a messy and controversial process within Tumblr itself. One internal post made by Cyle Gage, a product manager at Tumblr, states that a query made to prepare data for OpenAI and Midjourney compiled a huge number of user posts that it wasn't supposed to. It is not clear from Gage's post whether this data has already been sent to OpenAI and Midjourney, or whether Gage was detailing a process for scrubbing the data before it was to be sent. ' -- source: https://news.slashdot.org/story/24/02/27/191230 Now's the time to move from hosted to self-hosted Wordpress instances, I guess... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

US Government Demands Memory-Safe Programming Languages
by Lawrence D'Oliveiro 28 Feb '24

28 Feb '24

The US Office of the National Cyber Director has put out a report on “a path towards secure and measurable software” <https://devclass.com/2024/02/27/white-house-demands-memory-safe-programming…>. It talks a lot about memory safety, including hardware techniques such as the old “capabilities” idea being resurrected in the CHERI project. And the Rust Foundation has chimed in with some comments about use of their language which is specifically designed to enforce memory safety. But a group of C++ fans has counterclaimed that memory safety is only “a very small part of security”, and that “C++ benefits from having a formal specification, a fully-specified memory model, and an active community of users and implementers”, and that education can improve the quality of code written in C and C++. It also tries to imply that Rust is somehow less desirable because it lacks a formal specification.

1 0

Is Windows 64-Bit Yet?
by Lawrence D'Oliveiro 27 Feb '24

27 Feb '24

Given that 64-bit Windows has been shipping for so long, you would think most Windows software, particularly Microsoft’s own software, would have made the transition from 32-bit long ago. After all, on a typical 64-bit Linux system, everything is 64-bit, and has been that way since the early days. So I was mildly surprised to discover that Visual Studio only became 64-bit in November 2021. And today I am even more surprised to discover that the change broke its own Windows Forms framework, and a fix is still not available to this day <https://devclass.com/2024/02/26/microsoft-struggles-to-address-fallout-from…>.

1 0

The State Of IoT
by Lawrence D'Oliveiro 23 Feb '24

23 Feb '24

This backflip from Microsoft <https://www.theregister.com/2024/02/21/microsoft_azure_iot_central/> retracting an earlier announcement that seemingly undermined a major part of its “Internet-of-Things” efforts seems to do little to clear the confusion. I found this part of the report quite revealing: The insider also pointed out that vendors struggle to produce value for organizations developing and deploying IoT applications. While the industry underestimated the scale of the challenge in connecting thousands of sensors, each of which could generate 86,400 values per day, it also failed to form a commercial model that worked for everyone. Vendors were focused only on owning the platform and were reluctant to build applications on anyone else's, creating a stalemate, the insider said. Meanwhile, the “maker” movement continues on its merry way, building its applications and toolkits on (and for) open-source platforms like the Raspberry Pi and Arduino, while completely failing to spend billions of dollars on proprietary products. And the proprietary companies can do nothing but search desperately for some lever that will give them that valuable vendor lock-in, but all they can achieve is wrestle each other to a stalemate. Me, I consider that a win-win situation. ;)

1 0

Linux Becomes a CVE Numbering Authority (Like Curl and Python). Is This a Turning Point?
by Peter Reutemann 19 Feb '24

19 Feb '24

'From a blog post by Greg Kroah-Hartman: As was recently announced, the Linux kernel project has been accepted as a CVE Numbering Authority (CNA) for vulnerabilities found in Linux. This is a trend, of more open source projects taking over the haphazard assignments of CVEs against their project by becoming a CNA so that no other group can assign CVEs without their involvment. Here's the curl project doing much the same thing for the same reasons. I'd like to point out the great work that the Python project has done in supporting this effort, and the OpenSSF project also encouraging it and providing documentation and help for open source projects to accomplish this. I'd also like to thank the cve.org group and board as they all made the application process very smooth for us and provided loads of help in making this all possible. As many of you all know, I have talked a lot about CVEs in the past, and yes, I think the system overall is broken in many ways, but this change is a way for us to take more responsibility for this, and hopefully make the process better over time. It's also work that it looks like all open source projects might be mandated to do with the recent rules and laws being enacted in different parts of the world, so having this in place with the kernel will allow us to notify all sorts of different CNA-like organizations if needed in the future. Kroah-Hartman links to his post on the kernel mailing list for "more details about how this is all going to work for the kernel." [D]ue to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team are overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team... No CVEs will be assigned for unfixed security issues in the Linux kernel, assignment will only happen after a fix is available as it can be properly tracked that way by the git commit id of the original fix. No CVEs will be assigned for any issue found in a version of the kernel that is not currently being actively supported by the Stable/LTS kernel team. alanw (Slashdot reader #1,822) worries this could overwhelm the CVE infrastructure, pointing to an ongoing discussion at LWN.net. But reached for a comment, Greg Kroah-Hartman thinks there's been a misunderstanding. He told Slashdot that the CVE group "explicitly asked for this as part of our application... so if they are comfortable with it, why is no one else?"' -- source: https://linux.slashdot.org/story/24/02/17/1811258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nginx core developer quits project in security dispute, starts “freenginx” fork
by Peter Reutemann 16 Feb '24

16 Feb '24

'A core developer of Nginx, currently the world's most popular web server, has quit the project, stating that he no longer sees it as "a free and open source project… for the public good." His fork, freenginx, is "going to be run by developers, and not corporate entities," writes Maxim Dounin, and will be "free from arbitrary corporate actions." Dounin is one of the earliest and still most active coders on the open source Nginx project and one of the first employees of Nginx, Inc., a company created in 2011 to commercially support the steadily growing web server. Nginx is now used on roughly one-third of the world's web servers, ahead of Apache. Nginx Inc. was acquired by Seattle-based networking firm F5 in 2019. Later that year, two of Nginx's leaders, Maxim Konovalov and Igor Sysoev, were detained and interrogated in their homes by armed Russian state agents. Sysoev's former employer, Internet firm Rambler, claimed that it owned the rights to Nginx's source code, as it was developed during Sysoev's tenure at Rambler (where Dounin also worked). While the criminal charges and rights do not appear to have materialized, the implications of a Russian company's intrusion into a popular open source piece of the web's infrastructure caused some alarm. Sysoev left F5 and the Nginx project in early 2022. Later that year, due to the Russian invasion of Ukraine, F5 discontinued all operations in Russia. Some Nginx developers still in Russia formed Angie, developed in large part to support Nginx users in Russia. Dounin technically stopped working for F5 at that point, too, but maintained his role in Nginx "as a volunteer," according to Dounin's mailing list post. Dounin writes in his announcement that "new non-technical management" at F5 "recently decided that they know better how to run open source projects. In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers' position." While it was "quite understandable," given their ownership, Dounin wrote that it means he was "no longer able to control which changes are made in nginx," hence his departure and fork.' -- source: https://arstechnica.com/information-technology/2024/02/nginx-key-developer-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Asahi Linux Project's OpenGL Support On Apple Silicon Officially Surpasses Apple's
by Peter Reutemann 16 Feb '24

16 Feb '24

'Andrew Cunningham reports via Ars Technica: For around three years now, the team of independent developers behind the Asahi Linux project has worked to support Linux on Apple Silicon Macs, despite Apple's total lack of involvement. Over the years, the project has gone from a "highly unstable experiment" to a "surprisingly functional and usable desktop operating system." Even Linus Torvalds has used it to run Linux on Apple's hardware. The team has been steadily improving its open source, standards-conformant GPU driver for the M1 and M2 since releasing them in December 2022, and today, the team crossed an important symbolic milestone: The Asahi driver's support for the OpenGL and OpenGL ES graphics have officially passed what Apple offers in macOS. The team's latest graphics driver fully conforms with OpenGL version 4.6 and OpenGL ES version 3.2, the most recent version of either API. Apple's support in macOS tops out at OpenGL 4.1, announced in July 2010. Developer Alyssa Rosenzweig wrote a detailed blog post that announced the new driver, which had to pass "over 100,000 tests" to be deemed officially conformant. The team achieved this milestone despite the fact that Apple's GPUs don't support some features that would have made implementing these APIs more straightforward. "Regrettably, the M1 doesn't map well to any graphics standard newer than OpenGL ES 3.1," writes Rosenzweig. "While Vulkan makes some of these features optional, the missing features are required to layer DirectX and OpenGL on top. No existing solution on M1 gets past the OpenGL 4.1 feature set... Without hardware support, new features need new tricks. Geometry shaders, tessellation, and transform feedback become compute shaders. Cull distance becomes a transformed interpolated value. Clip control becomes a vertex shader epilogue. The list goes on." Now that the Asahi GPU driver supports the latest OpenGL and OpenGL ES standards -- released in 2017 and 2015, respectively -- the work turns to supporting the low-overhead Vulkan API on Apple's hardware. Vulkan support in macOS is limited to translation layers like MoltenVK, which translates Vulkan API calls to Metal ones that the hardware and OS can understand. [...] Rosenzweig's blog post didn't give any specific updates on Vulkan except to say that the team was "well on the road" to supporting it. In addition to supporting native Linux apps, supporting more graphics APIs in Asahi will allow the operating system to take better advantage of software like Valve's Proton, which already has a few games written for x86-based Windows PCs running on Arm-based Apple hardware. ' -- source: https://linux.slashdot.org/story/24/02/15/021216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Maker Mozilla Is Cutting 60 Jobs After Naming New CEO
by Peter Reutemann 14 Feb '24

14 Feb '24

'Less than a week after naming Laura Chambers as interim CEO, Firefox's maker Mozilla said it is cutting about 60 jobs, or 5% of its workforce. The cuts are primarily in the product development organization. Bloomberg reports: "We're scaling back investment in some product areas in order to focus on areas that we feel have the greatest chance of success," Mozilla said in a statement. "We intend to re-prioritize resources against products like Firefox Mobile, where there's a significant opportunity to grow and establish a better model for the industry." Mozilla last cut a significant number of jobs four years ago at the height of the Covid-19 pandemic. The not-for-profit company, which competes with Alphabet Inc.'s Google Chrome, Apple Inc.'s Safari and Microsoft Corp.'s Edge, has been grappling with sliding market share of its Firefox web browser in recent years. So far in 2024, the tech sector has cut 32,000 jobs. ' -- source: https://news.slashdot.org/story/24/02/13/2137254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HPC Wiki
by Lawrence D'Oliveiro 14 Feb '24

14 Feb '24

Recently discovered this site <https://hpc-wiki.info/hpc/HPC_Wiki>, which gives some useful introductory info to those wanting to learn how to program a supercomputer (or just curious about the process). For example, here <https://hpc-wiki.info/hpc/MPI> is an intro to one parallelization architecture, called MPI, and here <https://hpc-wiki.info/hpc/OpenMP> is an intro to another one, called OpenMP. Note the examples are given in C and Fortran, and both rely heavily on preprocessors/compiler plugins in order to generate the right code. Yes, Fortran is still in heavy use, it seems. And if you learned your Fortran before the 1990s (as I did), you may not even recognize it as the same language.

1 0

'Damn Small Linux' is Back - But Bigger
by Peter Reutemann 13 Feb '24

13 Feb '24

'Back in 2006 Slashdot reported on a 50-megabyte "micro" distro called Damn Small Linux. (And in 2012 we wrote that it "rose from the dead" with a new release candidate.) Now Damn Small Linux has been reborn again, according to its developer's web site: Creating the original DSL, a versatile 50MB distribution, was a lot of fun and one of the things I am most proud of as a personal accomplishment. However, as a concept, it was in the right place at the right time, and the computer industry has changed a lot since then. While it would be possible to make a bootable Xwindows 50MB distribution today, it would be missing many drivers and have only a handful of very rudimentary applications. People would find such a distribution a fun toy or something to build upon, but it would not be usable for the average computer user out of the gate.... The new goal of DSL is to pack as much usable desktop distribution into an image small enough to fit on a single CD, or a hard limit of 700MB. This project is meant to service older computers and have them continue to be useful far into the future. Such a notion sits well with my values. I think of this project as my way of keeping otherwise usable hardware out of landfills. As with most things in the GNU/Linux community, this project continues to stand on the shoulders of giants. I am just one guy without a CS degree, so for now, this project is based on antiX 23 i386... a fantastic distribution that I think shares much of the same spirit as the original DSL project. AntiX shares pedigree with MEPIS and also leans heavily on the geniuses at Debian. The blog It's FOSS News describes it as "a unique experience in a sea of Debian-based and Fedora-based distros." It is offered with two window managers, Fluxbox and JWM, with apt being fully enabled by default for easy package installations... At the time of writing, only the Alpha ISOs were made available on the official downloads page. It is only a matter of time before we get a stable release.' -- source: https://linux.slashdot.org/story/24/02/11/2049252 I actually used DSL back in the day... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Mozilla's Abandoned Web Engine 'Servo' is Rebooting in 2024
by Peter Reutemann 12 Feb '24

12 Feb '24

'Remember "Servo," Mozilla's "next-generation browser engine," focused on performance and robustness? "The developers of Servo are starting 2024 by going all in..." reports It's FOSS News, citing a social media post from FOSDEM. "[T]he Servo Project team were there showing off the work done so far." If you were not familiar, Servo is an experimental browser engine that leverages the power of Rust to provide a memory-safe and modular experience that is highly adaptable. After Mozilla created Servo back in 2012 as a research project, it saw its share of ups and downs over the years, with it making a comeback in 2023; thanks to a fresh approach by the developers on how Servo should move forward. Even though there are plenty of open source Chrome alternatives, with this, there's a chance that we will get some really cool options based on Servo that just might give Blink and Gecko a run for the money! Just a few months back, in September 2023, after The Servo Project officially joined Linux Foundation Europe, the existing contributors from Igalia stepped up their game by taking over the project maintenance. To complement that, at Open Source Summit Europe last year, Manuel Rego from Igalia shared some really useful insights when he presented. He showcased stuff like the WebGL support, cross-platform support including mobile support for Android and Linux, among other things. They have experimented with Servo for embedded applications use-cases (like running it on Raspberry Pi), and have plans to make advances on it. As far as I can see, it looks like, Servo is faster for Raspberry Pi compared to Chromium. You can explore more such demos on Servo's demo webpage. 2024's roadmap includes "Initial Android support, that will see Servo being made to build on modern Android versions," according to the article, "with the developers publishing nightly APKs on the official website some time in the future." One fun fact? "Even though Mozilla dropped the experimental project, Firefox still utilizes some servo components in the browser" Another FOSDOM update from social media: "Thunderbird is also embracing Rust."' -- source: https://news.slashdot.org/story/24/02/11/2024233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ANZ Bank Tries GitHub Copilot, Likes What It Sees
by Lawrence D'Oliveiro 11 Feb '24

11 Feb '24

ANZ Bank tried a study with its in-house Python programmers <https://www.theregister.com/2024/02/10/anz_bank_github_copilot/>, and found "The group that had access to GitHub Copilot was able to complete their tasks 42.36 percent faster than the control group participants," the report says. "...The code produced by Copilot participants contained fewer code smells and bugs on average, meaning it would be more maintainable and less likely to break in production." In terms of code security, they didn’t find that Copilot helped, but neither did it make things worse. But then, these were relatively simple programming exercises. The report also cites another study which found that AI assistance is leading to lower code quality.

1 0

Mozilla Names New CEO as It Pivots To Data Privacy
by Peter Reutemann 09 Feb '24

09 Feb '24

'Mozilla, which manages the open-source Firefox browser, announced today that Mitchell Baker is stepping down as CEO to focus on AI and internet safety as chair of the nonprofit foundation. Laura Chambers, a Mozilla board member and entrepreneur with experience at Airbnb, PayPal, and eBay, will step in as interim CEO to run operations until a permanent replacement is found. Fortune: Baker, a Silicon Valley pioneer who co-founded the Mozilla Project, says it was her decision to step down as CEO, adding that the move is motivated by a sense of urgency over the current state of the internet and public trust. "We want to offer an alternative for people to have better products," says Baker, who wants to draw more attention to policies, products and processes to challenge business models built on fueling outrage. "What are the connections between this global malaise and how humans are engaging with each other and technology?" Chambers says she plans to focus on building out new products that address growing privacy concerns while actively looking for a full-time CEO. Prior to being recruited to the Mozilla board three years ago, Chambers says she was feeling "pretty disillusioned" about society because of the influence of money in politics and the growing power of the tech giants. "I was confused about what to do and this felt like a genuine way to make an impact." Chambers says she won't be seeking a permanent CEO role because she plans to move back to Australia later this year for family reasons. "I think this is an example of Mozilla doing the right role modelling in how to manage a succession," says Chambers. ' -- source: https://news.slashdot.org/story/24/02/08/1511234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Critical Vulnerability Affecting Most Linux Distros Allows For Bootkits
by Peter Reutemann 08 Feb '24

08 Feb '24

'Linux developers are in the process of patching a high-severity vulnerability that, in certain cases, allows the installation of malware that runs at the firmware level, giving infections access to the deepest parts of a device where they're hard to detect or remove. ArsTechnica: The vulnerability resides in shim, which in the context of Linux is a small component that runs in the firmware early in the boot process before the operating system has started. More specifically, the shim accompanying virtually all Linux distributions plays a crucial role in secure boot, a protection built into most modern computing devices to ensure every link in the boot process comes from a verified, trusted supplier. Successful exploitation of the vulnerability allows attackers to neutralize this mechanism by executing malicious firmware at the earliest stages of the boot process before the Unified Extensible Firmware Interface firmware has loaded and handed off control to the operating system. The vulnerability, tracked as CVE-2023-40547, is what's known as a buffer overflow, a coding bug that allows attackers to execute code of their choice. It resides in a part of the shim that processes booting up from a central server on a network using the same HTTP that the the web is based on. Attackers can exploit the code-execution vulnerability in various scenarios, virtually all following some form of successful compromise of either the targeted device or the server or network the device boots from. "An attacker would need to be able to coerce a system into booting from HTTP if it's not already doing so, and either be in a position to run the HTTP server in question or MITM traffic to it," Matthew Garrett, a security developer and one of the original shim authors, wrote in an online interview. "An attacker (physically present or who has already compromised root on the system) could use this to subvert secure boot (add a new boot entry to a server they control, compromise shim, execute arbitrary code)."' -- source: https://linux.slashdot.org/story/24/02/07/1749248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Overzealous Spam Filters
by Lawrence D'Oliveiro 07 Feb '24

07 Feb '24

Two recent news items about important messages being lost in the recipients’ spam filters. Some months ago, the Banking Ombudsman sent out a warning about investment scams to various financial institutions, but the ANZ never saw theirs <https://www.nzherald.co.nz/nz/anz-misses-investment-scam-warning-from-banki…>. One scam victim believes that her case might have been caught sooner if the bank had taken suitable notice of such a warning. And a US-based team wanted to join Formula 1, but it seems they never got the invitation to meet in person to discuss their application, because it got classed as spam <https://arstechnica.com/cars/2024/02/a-spam-folder-may-have-foiled-andretti…>. And so their application was rejected. But then, in this case you’d think more than one attempt would have been made to get in touch. In both cases, the sender address would have been something unusual, not the kind of thing you or I might see in our in-box (in one case, the Banking Ombudsman, in the other case, the Formula 1 rights body). If we got such a message, it would be wise to score it as being more likely to be some sort of scam. But for organizations that work in those areas that are more likely to engage in such communications, it would make sense to customize their spam filters in the opposite direction, don’t you think?

2 2

Enabling Case-Insensitive Filenames On Linux
by Lawrence D'Oliveiro 06 Feb '24

06 Feb '24

The ext4 filesystem has had the “casefold” option for a while now <https://lwn.net/Articles/784041/>. This allows you to specify, when you initialize a new filesystem, that you want file/directory names to be treated as case-insensitive. At the same time, you have to specify that the filenames are to be interpreted as UTF-8 encoding; normally the kernel doesn’t care, it only singles out ASCII slash and NUL bytes for special interpretation, and simply passes through any other byte values in the names. I was able to create such a filesystem, but I wasn’t able to mount it in my last-upgraded-just-a-few-days-ago Debian Unstable setup. When I try, it fails, and in the dmesg log I see Filesystem with casefold feature cannot be mounted without CONFIG_UNICODE Turns out the Debian 5.10 kernel has not been built with this CONFIG_UNICODE option enabled. However, this situation looks set to change shortly, according to <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985689>.

2 3

browsh
by Peter Reutemann 06 Feb '24

06 Feb '24

Hi everyone Just came across browsh: 'A fully interactive, real-time, and modern text-based browser rendered to TTYs and browsers' https://github.com/browsh-org/browsh Seems like a cool way of browsing in the shell. I've used lynx in the past for that. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a Microsoft Update Broke VS Code Editor on Ubuntu
by Peter Reutemann 05 Feb '24

05 Feb '24

'Microsoft's Visual Studio Code editor now includes a voice command that launches GitHub Copilot Chat just by saying "Hey Code." But one Linux blog notes that the editor has suddenly stopped supporting Ubuntu 18.04 LTS — "a move causing issues for scores of developers." VS Code 1.86 (aka the 'January 2024' update) saw Microsoft bump the minimum build requirements for the text editor's popular remote dev tools to â¥glibc 2.28 — but Ubuntu 18.04 LTS uses glibc 2.27, ergo they no longer work. While Ubuntu 18.04 is supported by Canonical until 2028 (through ESM) a major glibc upgrade is unlikely. Thus, this "breaking change" is truly breaking workflows... It seems affected developers were caught off-guard as this (rather impactful) change was not signposted before, during, or after the VS Code update (which is installed automatically for most, and the update was pushed out to Ubuntu 18.04 machines). Indeed, most only discovered this issue after update was installed, they tried to connect to a remote server, and discovered it failed. The resulting error message does mention deprecation and links to an FAQ on the VS Code website with workarounds (i.e. downgrade). But as one developer politely put it.... "It could have checked the libc versions and refused the update. Now, many people are screwed in the middle of their work." The article points out an upgrade to Ubuntu 20.04 LTS will address the problem. On GitHub a Microsoft engineer posted additional options from VS Code's documentation: If you are unable to upgrade your Linux distribution, the recommended alternative is to use our web client. If you would like to use the desktop version, then you can download the VS Code release 1.85. Depending on your platform, make sure to disable updates to stay on that version. Microsoft then locked the thread on GitHub as "too heated" and limited conversation to just collaborators. In a related thread someone suggested installing VS Code's Flatpak, which was still on version 1.85 — and then disabling updates. But soon Microsoft had locked that thread as well as "too heated," again limiting conversation to collaborators.' -- source: https://linux.slashdot.org/story/24/02/04/0116229 When you can't take criticism for a balls-up, lock the discussion thread! Hmm... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LibreOffice 24.2 Delivers Advanced Features and Global Accessibility
by Peter Reutemann 02 Feb '24

02 Feb '24

'The Document Foundation has officially launched LibreOffice 24.2, which is now available for download for Windows, macOS, and Linux platforms. This release introduces a new calendar-based version numbering system (YY.M). Here’s what it’s all about. The latest major release of the well-known office suite was 7.6. However, this is set to change with the introduction of 24.2, as the version numbering will now follow a “year.month” pattern, similar to that used by Ubuntu releases, for example. This change aims to simplify version identification for end users, making it more intuitive to understand.' -- source: https://linuxiac.com/libreoffice-24-2-delivers-advanced-features-and-global… ...and here I was, thinking that I missed a truckload of releases. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Microsoft Stole My Chrome Tabs, and It Wants Yours, Too'
by Peter Reutemann 31 Jan '24

31 Jan '24

'Tom Warren, writing for The Verge: Last week, I turned on my PC, installed a Windows update, and rebooted to find Microsoft Edge automatically open with the Chrome tabs I was working on before the update. I don't use Microsoft Edge regularly, and I have Google Chrome set as my default browser. Bleary-eyed at 9AM, it took me a moment to realize that Microsoft Edge had simply taken over where I'd left off in Chrome. I never imported my data into Microsoft Edge, nor did I confirm whether I wanted to import my tabs. But here was Edge automatically opening after a Windows update with all the Chrome tabs I'd been working on. I didn't even realize I was using Edge at first, and I was confused why all my tabs were suddenly logged out. After the shock wore off, I looked to make sure I hadn't accidentally allowed this behavior. I found a setting in Microsoft Edge that imports data from Google Chrome on each launch. "Always have access to your recent browsing data each time you browse on Microsoft Edge," reads Microsoft's description of the feature in Edge. This setting was disabled, and I had never been asked to turn it on. So I went to install the same Windows update on a laptop, which actually resulted in it failing and my having to do a system restore. Once the system restore was complete, the same thing happened. Edge opened automatically with all of my Chrome tabs. I haven't been able to replicate the behavior on other PCs, but a number of X users replied to my post about this saying they have experienced the same thing in the past.' -- source: https://it.slashdot.org/story/24/01/30/1824233 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Is Planning a London IPO, But Its CEO Expects 'No Change' In Focus
by Peter Reutemann 31 Jan '24

31 Jan '24

'Ars Technica: The business arm of Raspberry Pi is preparing to make an initial public offering (IPO) in London. CEO Eben Upton tells Ars that should the IPO happen, it will let Raspberry Pi's not-for-profit side expand by "at least a factor of 2X." And while it's "an understandable thing" that Raspberry Pi enthusiasts could be concerned, "while I'm involved in running the thing, I don't expect people to see any change in how we do things." CEO Eben Upton confirmed in an interview with Bloomberg News that Raspberry Pi had appointed bankers at London firms Peel Hunt and Jefferies to prepare for "when the IPO market reopens." Raspberry previously raised money from Sony and semiconductor and software design firm ARM, and it sought public investment. Upton denied or didn't quite deny IPO rumors in 2021, and Bloomberg reported Raspberry Pi was considering an IPO in early 2022. After ARM took a minority stake in the company in November 2023, Raspberry Pi was valued at roughly 400 million pounds, or just over $500 million. Given the company's gradual recovery from pandemic supply chain shortages, and the success of the Raspberry Pi 5 launch, the company's IPO will likely jump above that level, even with a listing in the UK rather than the more typical US IPO. Upton told The Register that "the business is in a much better place than it was last time we looked at it [an IPO]. We partly stopped because the markets got bad. And we partly stopped because our business became unpredictable." "It's a good thing, in that people care about us," Upton said in response to concerned hobbyists and tech enthusiasts. "What Raspberry Pi [builds] are the products we want to buy, and then we sell them to people like us," Upton said. "Certainly, while I'm involved in it, I can't imagine an environment in which the hobbyists are not going to be incredibly important." The IPO is "about the foundation," Upton said, with that charitable arm selling some of its majority stake in the business entity to raise funds and expand. "We've not cooked up some new way for a not-for-profit to do an IPO, no," he noted. [He told Ars that Raspberry Pi's business arm has had both strategic and private investors in its history, along with a majority shareholder in its Foundation (which in 2016 owned 75 percent of shares), and that he doesn't see changes to what Pi has built. He also noted that the foundation was previously funded by dividends from the business side.] "We do this transaction, and the proceeds of that transaction allow the foundation to train teachers, run clubs, expand programs, and ... do those things at, at least, a factor of 2X. That's what I'm most excited about." Upton said there would be "no change" to the kinds of products Pi makes, and that makers are "culturally important to us." [...] "If people think that an IPO means we're going to ... push prices up, push the margins up, push down the feature sets, the only answer we can give is, watch us. Keep watching," he said. "Let's look at it in 15, 20 years' time."' -- source: https://hardware.slashdot.org/story/24/01/30/2212232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux On Mars: The Final Chapter
by Lawrence D'Oliveiro 30 Jan '24

30 Jan '24

You may have heard that the “Ingenuity” helicopter, which has been flying on Mars for the last three years, came a cropper and broke one of its rotor blades a couple of weeks ago. Not bad for a project that was really put together as an afterthought, a proof of concept that was planned to maybe last 30 days and make five flights at most. Here <https://arstechnica.com/space/2024/01/now-that-weve-flown-on-mars-what-come…> is a description of some more details of how it was put together, within stringent limits on both mass and money. Apparently, a radiation-hardened RAD750 computer, which is normally used for such space missions, costs a quarter of a million USD. And would have weighed too much anyway. So they used a cheap, lightweight Qualcomm chip instead, state of the art for smartphones of just a few years ago. And massively more powerful. And of course they ran off-the-shelf open-source software on it <https://www.jpl.nasa.gov/news/meet-the-open-source-software-powering-nasas-…>, <https://www.theverge.com/2021/2/19/22291324/linux-perseverance-mars-curiosi…>, <https://spectrum.ieee.org/nasa-designed-perseverance-helicopter-rover-fly-a…>. Flying a chopper on Mars isn’t easy: the rotor tips on Ingenuity were moving at Mach 0.65 (on Mars, Mach 1.0, the speed of sound, is about 240m/s). A future chopper is planned to push this to Mach 0.95. You might say they were cutting corners on this design, which made it inherently more risky. But if the lower costs and simpler development can lead to shorter lead times, and hence more missions, maybe a higher failure rate would be worth it.

1 0

Remembering Unix Desktops - and What We Can Learn From Them
by Peter Reutemann 29 Jan '24

29 Jan '24

'"As important as its historically underhanded business dealings were for its success, Microsoft didn't have to cheat to win," argues a new article in the Register. "The Unix companies were doing a great job of killing themselves off." You see, while there were many attempts to create software development standards for Unix, they were too general to do much good — for example Portable Operating System Interface (POSIX) — or they became mired in the business consortium fights between the Open Systems Foundation and Unix International, which became known as the Unix wars. While the Unix companies were busy ripping each other to shreds, Microsoft was smiling all the way to the bank. The core problem was that the Unix companies couldn't settle on software standards. Independent Software Vendors (ISV) had to write applications for each Unix platform. Each of these had only a minute desktop market share. It simply made no business sense for programmers to write one version of an application for SCO OpenDesktop (also known as OpenDeathtrap), another for NeXTStep, and still another one for SunOS. Does that sound familiar? That kind of thing is still a problem for the Linux desktop, and it's why I'm a big fan of Linux containerized desktop applications, such as Red Hat's Flatpak and Canonical's Snap. By the time the two sides finally made peace by joining forces in The Open Group in 1996, it was too late. Unix was crowded out on the conventional desktop, and the workstation became pretty much a Sun Microsystems-only play. Linux's GPL license created an "enforced" consortia that allowed it to take over, according to the article — and with Linus Torvalds as Linux's single leader, "it avoided the old Unix trap of in-fighting... I've been to many Linux Plumbers meetings. There, I've seen him and the top Linux kernel developers work with each other without any drama. Today's Linux is a group effort... The Linux distributors and developers have learned their Unix history lessons. They've realized that it takes more than open source; it takes open standards and consensus to make a successful desktop operating system. And the article also points out that one of those early Unix desktops "is still alive, well, and running in about one in four desktops." That operating system, of course, is macOS X, the direct descendent of NeXT's NeXTSTEP. You could argue that macOS, based on the multi-threaded, multi-processing microkernel operating system Mach, BSD Unix, and the open source Darwin, is the most successful of all Unix operating systems. ' -- source: https://tech.slashdot.org/story/24/01/28/0241228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

I abandoned OpenLiteSpeed and went back to good ol’ Nginx
by Peter Reutemann 29 Jan '24

29 Jan '24

'Since 2017, in what spare time I have (ha!), I help my colleague Eric Berger host his Houston-area weather forecasting site, Space City Weather. It’s an interesting hosting challenge—on a typical day, SCW does maybe 20,000–30,000 page views to 10,000–15,000 unique visitors, which is a relatively easy load to handle with minimal work. But when severe weather events happen—especially in the summer, when hurricanes lurk in the Gulf of Mexico—the site’s traffic can spike to more than a million page views in 12 hours. That level of traffic requires a bit more prep to handle. For a very long time, I ran SCW on a backend stack made up of HAProxy for SSL termination, Varnish Cache for on-box caching, and Nginx for the actual web server application—all fronted by Cloudflare to absorb the majority of the load. (I wrote about this setup at length on Ars a few years ago for folks who want some more in-depth details.) This stack was fully battle-tested and ready to devour whatever traffic we threw at it, but it was also annoyingly complex, with multiple cache layers to contend with, and that complexity made troubleshooting issues more difficult than I would have liked. So during some winter downtime two years ago, I took the opportunity to jettison some complexity and reduce the hosting stack down to a single monolithic web server application: OpenLiteSpeed.' -- source: https://arstechnica.com/gadgets/2024/01/i-abandoned-openlitespeed-and-went-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unix Pioneer Ken Thompson Has Abandoned Apple For Linux
by Lawrence D'Oliveiro 28 Jan '24

28 Jan '24

Something I didn’t hear about, which happened earlier last year <https://forums.freebsd.org/threads/unix-pioneer-ken-thompson-announces-hes-…>. Ken Thompson, one of the original Bell Labs crew that created Unix, now 80 years old, was asked what OS he uses, and he replied: I have, for most of my life — because I was sort of born into it — run Apple. Now recently, meaning within the last five years, I've become more and more depressed, and what Apple is doing to something that should allow you to work is just atrocious. But they are taking a lot of space and time to do it, so it's okay. And I have come, within the last month or two, to say, even though I've invested, you know, a zillion years in Apple — I'm throwing it away. And I'm going to Linux. To Raspbian in particular.

1 0

OpenWrt, now 20 years old, is crafting its own future-proof reference hardware
by Peter Reutemann 24 Jan '24

24 Jan '24

'OpenWrt, the open source firmware that sprang from Linksys' use of open source code in its iconic WRT54G router and subsequent release of its work, is 20 years old this year. To keep the project going, lead developers have proposed creating a "fully upstream supported hardware design," one that would prevent the need for handling "binary blobs" in modern router hardware and let DIY router enthusiasts forge their own path. OpenWRT project members, 13 of which signed off on this hardware, are keeping the "OpenWrt One" simple, while including "some nice features we believe all OpenWrt supported platforms should have," including "almost unbrickable" low-level firmware, an on-board real-time clock with a battery backup, and USB-PD power. The price should be under $100 and the schematics and code publicly available. But OpenWrt will not be producing or selling these boards, "for a ton of reasons." The group is looking to the Banana Pi makers to distribute a fitting device, with every device producing a donation to the Software Freedom Conservancy earmarked for OpenWrt. That money could then be used for hosting expenses, or "maybe an OpenWrt summit."' -- source: https://arstechnica.com/gadgets/2024/01/openwrt-now-20-years-old-is-craftin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Easy Relative Symbolic Links
by Lawrence D'Oliveiro 23 Jan '24

23 Jan '24

You probably know about the “ln” command to create a new link to an existing file. You probably know about “ln -s” to create a symbolic link. But did you know about “ln -rs” to easily create relative symbolic links? Relative links are often preferable to absolute ones, because that way they stay valid if the whole containing directory tree is moved to a different location (e.g. as the result of a bind mount). But typing the right number of “../” prefixes can get quite fiddly. And if you want to rely on autocomplete to help, you have to change directory to the destination where the symlink is to be created. Instead, a simpler way is to use “ln -rs”, then use autocomplete from wherever you are to get to the right source file/directory, and the ln command will automatically convert the resulting path, whatever it might be (either absolute or relative to your current working directory) to a suitable relative one based on the destination for the link. <https://manpages.debian.org/ln.1.en.html>

1 1

HP Says The Quiet Part Out Loud
by Lawrence D'Oliveiro 23 Jan '24

23 Jan '24

You’d think, if you were buying a printer, you were the one making the investment, and expecting an outcome of suitable print quality (and quantity) in return. But not, it seems, if you buy an HP printer. Company boss Enrique Lores has made it quite clear <https://www.theregister.com/2024/01/19/hps_ceo_spells_it_out/>: "Every time a customer buys a printer, it's an investment for us. We are investing in that customer, and if that customer doesn't print enough or doesn't use our supplies, it's a bad investment." If you think this is some offhand remark, taken out of context or something, how about this statement from December, by their CFO of the time: "We absolutely see when you move a customer from that pure transactional model ... whether it's Instant Ink, plus adding on that paper, we sort of see a 20 percent uplift on the value of that customer because you're locking that person, committing to a longer-term relationship." In short, they are going to squeeze you for as much ink revenue as they can. Third-party ink cartridges are obviously a threat to this business model, that must be exterminated. I wonder, if they could figure out how to make you get the paper from them as well, they wouldn’t do that ... oh wait ... she already mentioned paper ...

2 2

Timezone Data Changes
by Lawrence D'Oliveiro 23 Jan '24

23 Jan '24

The maintainers of the timezone database (tzdata) have been cleaning up some things lately. Namely, removing all the alias names that are not of the common IANA «region»/«city» form, but refer to specific countries, from the core package. NZ’s two timezones, “NZ” and “NZ-CHAT” were among these special cases. Also the ones beginning “US/” for the various timezones in the USA. <https://tracker.debian.org/news/1451157/accepted-tzdata-2023c-8-source-into…> <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040997> <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056908> These latter names are still available if you install the “tzdata-legacy” package. So you need to have that installed if you want to continue setting “TZ=NZ”. Either that, or learn to start saying “TZ=Pacific/Auckland” instead.

1 0

All This AI Stuff Costs A Lot Of Money
by Lawrence D'Oliveiro 21 Jan '24

21 Jan '24

According to this article <https://arstechnica.com/gadgets/2024/01/alexa-is-in-trouble-paid-for-alexa-…> (based on anonymous sources), Amazon is on a struggle to make money out of its Alexa service, particularly a new, “Generative-AI”-based version coming out at some non-yet-publicly-disclosed point. I was flabbergasted at this: Amazon has to do something to turn Alexa into a viable revenue source. In late 2022, Insider reported that Alexa was on track to lose Amazon $10 billion that year. The following months were filled with numerous layoffs at Amazon ... $10 billion!? I wonder how much of that is *not* the electricity bills for running all the servers ...

1 0

Rust-Written Linux Scheduler Continues Showing Promising Results For Gaming
by Peter Reutemann 21 Jan '24

21 Jan '24

'"A Canonical engineer has been experimenting with implementing a Linux scheduler within the Rust programming language..." Phoronix reported Monday, "that works via sched_ext for implementing a scheduler using eBPF that can be loaded during run-time." The project was started "just for fun" over Christmas, according to a post on X by Canonical-based Linux kernel engineer Andrea Righi, adding "I'm pretty shocked to see that it doesn't just work, but it can even outperform the default Linux scheduler (EEVDF) with certain workloads (i.e., gaming)." Phoronix notes the a YouTube video accompanying the tweet shows "a game with the scx_rustland scheduler outperforming the default Linux kernel scheduler while running a parallel kernel build in the background." "For sure the build takes longer," Righi acknowledged in a later post. "This scheduler doesn't magically makes everything run faster, it simply prioritizes more the interactive workloads vs CPU-intensive background jobs." Righi followed up by adding "And the whole point of this demo was to prove that, despite the overhead of running a scheduler in user-space, we can still achieve interesting performance, while having the advantages of being in user-space (ease of experimentation/testing, reboot-less updates, etc.)" Wednesday Righi added some improvements, posting that "Only 19 lines of code (comments included) for ~2x performance improvement on SMT isn't bad... and I spent my lunch break playing Counter Strike 2 to test this patch..." And work seems to be continuing, judging by a fresh post from Righi on Thursday. "I fixed virtme-ng to run inside Docker and used it to create a github CI workflow for sched-ext that clones the latest kernel, builds it and runs multiple VMs to test all the scx schedulers. And it does that in only ~20min. I'm pretty happy about virtme-ng now."' -- source: https://developers.slashdot.org/story/24/01/20/0716232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Network Time Man's Time Has Ended
by Lawrence D'Oliveiro 20 Jan '24

20 Jan '24

Dave Mills, creator of NTP, the Network Time Protocol that keeps all our computer clocks synced to within hundredths of a second, has passed away at the age of 85 <https://arstechnica.com/gadgets/2024/01/inventor-of-ntp-protocol-that-keeps…>.

1 0

Just 10 lines of code can steal AI secrets from Apple, AMD, and Qualcomm GPUs
by Peter Reutemann 18 Jan '24

18 Jan '24

'As more companies ramp up development of artificial intelligence systems, they are increasingly turning to graphics processing unit (GPU) chips for the computing power they need to run large language models (LLMs) and to crunch data quickly at massive scale. Between video game processing and AI, demand for GPUs has never been higher, and chipmakers are rushing to bolster supply. In new findings released today, though, researchers are highlighting a vulnerability in multiple brands and models of mainstream GPUs—including Apple, Qualcomm, and AMD chips—that could allow an attacker to steal large quantities of data from a GPU’s memory. The silicon industry has spent years refining the security of central processing units, or CPUs, so they don’t leak data in memory even when they are built to optimize for speed. However, since GPUs were designed for raw graphics processing power, they haven’t been architected to the same degree with data privacy as a priority. As generative AI and other machine learning applications expand the uses of these chips, though, researchers from New York-based security firm Trail of Bits say that vulnerabilities in GPUs are an increasingly urgent concern. “There is a broader security concern about these GPUs not being as secure as they should be and leaking a significant amount of data,” Heidy Khlaaf, Trail of Bits’ engineering director for AI and machine learning assurance, tells WIRED. “We’re looking at anywhere from 5 megabytes to 180 megabytes. In the CPU world, even a bit is too much to reveal.” To exploit the vulnerability, which the researchers call LeftoverLocals, attackers would need to already have established some amount of operating system access on a target’s device. Modern computers and servers are specifically designed to silo data so multiple users can share the same processing resources without being able to access each others’ data. But a LeftoverLocals attack breaks down these walls. Exploiting the vulnerability would allow a hacker to exfiltrate data they shouldn’t be able to access from the local memory of vulnerable GPUs, exposing whatever data happens to be there for the taking, which could include queries and responses generated by LLMs as well as the weights driving the response.' -- source: https://arstechnica.com/security/2024/01/new-attack-steals-ai-secrets-from-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Generating PDF Files From man Pages
by Lawrence D'Oliveiro 17 Jan '24

17 Jan '24

I’ve been writing documentation for some of my published scripts in the form of man pages. The troff/groff markup is not hard to get to grips with--the man pages for the relevant tools have a lot of useful info. And it’s easy to view the results without any special installation step, since the man(1) command includes the “-l” option to treat its argument as a file name. But if the topic name has any slashes in it, such treatment is automatic without even needing this option. Thus, in my project source directory, I can type something as simple as man ./render-batch.1 to view the man page I wrote for the “render-batch” command. Conversion to PDF is easy, too, using the underlying groff command that man itself uses to format the page, just specifying a different output “device” (i.e. format), e.g. groff -man -Tpdf «troff-file» >«output-file» Or, if I don’t want to save the output PDF file, but just pipe it straight to a viewer like Okular, this works: groff -man -Tpdf «troff-file» | okular - This is particularly useful, for example, for debugging the difference between dashes and hyphens. You are supposed to use “\-” for the hyphen-minus character (as used to prefix command-line options, for example), while hyphens in regular text should be written as “-”. The two look the same in a normal man-page view, but they get rendered differently in PDF files. However, I found that groff does not correctly render various Unicode UTF-8 characters when generating PDF output. For example, I like to use curly quotes “”. These look OK in regular man output, but get turned into junk in PDF output. After some searching online, it appears this is a known limitation of groff, because it uses various 8-bit byte codes internally for its own purposes, precluding their use as part of UTF-8 encoding. But there is a tool called “preconv” that can convert various encodings into a more groff-friendly text representation. For example preconv -e utf-8 «troff-file» | groff -man -Tpdf | okular - Since my locale is set to a UTF-8 one by default, I don’t even need the “-e” option: preconv «troff-file» | groff -man -Tpdf | okular - Or, if you want to save the output: preconv «troff-file» | groff -man -Tpdf >«output-file» Going back to the example filename I used before, these translate to something like preconv render-batch.1 | groff -man -Tpdf | okular - preconv render-batch.1 | groff -man -Tpdf >render-batch.pdf Another variation is to use preconv «troff-file» | groff -man -Tpdf | { okular - & } This spawns the Okular part of the pipeline in the background, so it comes back to the shell prompt immediately that starts running. This is convenient with a GUI tool like Okular, because I can run other commands while continuing to view the output PDF file. So how is it that groff is capable of handling these characters just fine when invoked via man? That I haven’t figured out yet ...

1 2

Chrome Updates Incognito Warning To Admit Google Tracks Users In 'Private' Mode
by Peter Reutemann 17 Jan '24

17 Jan '24

'Ars Technica: Google is updating the warning on Chrome's Incognito mode to make it clear that Google and websites run by other companies can still collect your data in the web browser's semi-private mode. The change is being made as Google prepares to settle a class-action lawsuit that accuses the firm of privacy violations related to Chrome's Incognito mode. The expanded warning was recently added to Chrome Canary, a nightly build for developers. The warning appears to directly address one of the lawsuit's complaints, that the Incognito mode's warning doesn't make it clear that Google collects data from users of the private mode. Many tech-savvy people already know that while private modes in web browsers prevent some data from being stored on your device, they don't prevent tracking by websites or Internet service providers. But many other people may not understand exactly what Incognito mode does, so the more specific warning could help educate users. The new warning seen in Chrome Canary when you open an incognito window says: "You've gone Incognito. Others who use this device won't see your activity, so you can browse more privately. This won't change how data is collected by websites you visit and the services they use, including Google." The wording could be interpreted to refer to Google websites and third-party websites, including third-party websites that rely on Google ad services. The new warning was not yet in the developer, beta, and stable branches of Chrome as of today. It also wasn't in Chromium. The change to Canary was previously reported by MSPowerUser. Incognito mode in the stable version of Chrome still says: "You've gone Incognito. Now you can browse privately, and other people who use this device won't see your activity." Among other changes, the Canary warning replaces "browse privately" with "browse more privately." The stable and Canary warnings both say that your browsing activity might still be visible to "websites you visit," "your employer or school," or "your Internet service provider." But only the Canary warning currently includes the caveat that Incognito mode "won't change how data is collected by websites you visit and the services they use, including Google." The old and new warnings both say that Incognito mode prevents Chrome from saving your browsing history, cookies and site data, and information entered in forms, but that "downloads, bookmarks and reading list items will be saved." Both warnings link to this page, which provides more detail on Incognito mode.' -- source: https://yro.slashdot.org/story/24/01/16/2110250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wine 9.0 Released
by Peter Reutemann 17 Jan '24

17 Jan '24

'Version 9.0 of Wine, the free and open-source compatibility layer that lets you run Windows apps on Unix-like operating systems, has been released. "Highlights of Wine 9.0 include an experimental Wayland graphics driver with features like basic window management, support for multiple monitors, high-DPI scaling, relative motion events, as well as Vulkan support," reports 9to5Linux. From the report: The Vulkan driver has been updated to support Vulkan 1.3.272 and later, the PostScript driver has been reimplemented to work from Windows-format spool files and avoid any direct calls from the Unix side, and there's now a dark theme option on WinRT theming that can be enabled in WineCfg. Wine 9.0 also adds support for many more instructions to Direct3D 10 effects, implements the Windows Media Video (WMV) decoder DirectX Media Object (DMO), implements the DirectShow Audio Capture and DirectShow MPEG-1 Video Decoder filters, and adds support for video and system streams, as well as audio streams to the DirectShow MPEG-1 Stream Splitter filter. Desktop integration has been improved in this release to allow users to close the desktop window in full-screen desktop mode by using the "Exit desktop" entry in the Start menu, as well as support for export URL/URI protocol associations as URL handlers to the Linux desktop. Audio support has been enhanced in Wine 9.0 with the implementation of several DirectMusic modules, DLS1 and DLS2 sound font loading, support for the SF2 format for compatibility with Linux standard MIDI sound fonts, Doppler shift support in DirectSound, Indeo IV50 Video for Windows decoder, and MIDI playback in dmsynth. Among other noteworthy changes, Wine 9.0 brings loader support for ARM64X and ARM64EC modules, along with the ability to run existing Windows binaries on ARM64 systems and initial support for building Wine for the ARM64EC architecture. There's also a new 32-bit x86 emulation interface, a new WoW64 mode that supports running of 32-bit apps on recent macOS versions that don't support 32-bit Unix processes, support for DirectInput action maps to improve compatibility with many old video games that map controller inputs to in-game actions, as well as Windows 10 as the default Windows version for new prefixes. Last but not least, the kernel has been updated to support address space layout randomization (ASLR) for modern PE binaries, better memory allocation performance through the Low Fragmentation Heap (LFH) implementation, and support memory placeholders in the virtual memory allocator to allow apps to reserve virtual space. Wine 9.0 also adds support for smart cards, adds support for Diffie-Hellman keys in BCrypt, implements the Negotiate security package, adds support for network interface change notifications, and fixes many bugs. For a full list of changes, check out the release notes. You can download Wine 9.0 from WineHQ.' -- source: https://tech.slashdot.org/story/24/01/16/2253237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Is No Longer Bringing the Full Chrome Browser To Fuchsia
by Peter Reutemann 16 Jan '24

16 Jan '24

'Google has formally discontinued its efforts to bring the full Chrome browser experience to its Fuchsia operating system. 9to5Google reports: In 2021, we reported that the Chromium team had begun an effort to get the full Chrome/Chromium browser running on Google's in-house Fuchsia operating system. Months later, in early 2022, we were even able to record a video of the progress, demonstrating that Chromium (the open-source-only variant of Chrome) could work relatively well on a Fuchsia-powered device. This was far from the first time that the Chromium project had been involved with Fuchsia. Google's full lineup of Nest Hub smart displays is currently powered by Fuchsia under the hood, and those displays have limited web browsing capabilities through an embedded version of the browser. In contrast to that minimal experience, Google was seemingly working to bring the full might of Chrome to Fuchsia. To observers, this was yet another signal that Google intended for Fuchsia to grow beyond the smart home and serve as a full desktop operating system. After all, what good is a laptop or desktop without a web browser? Fans of the Fuchsia project have anticipated its eventual expansion to desktop since Fuchsia was first shown to run on Google's Pixelbook hardware. However, in the intervening time -- a period that also saw significant layoffs in the Fuchsia division -- it seems that Google has since shifted Fuchsia in a different direction. The clearest evidence of that move comes from a Chromium code change (and related bug tracker post) published last month declaring that the "Chrome browser on fuchsia won't be maintained."' -- source: https://tech.slashdot.org/story/24/01/15/2350230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Mint 21.3: Its First Official Release with Wayland Support
by Peter Reutemann 15 Jan '24

15 Jan '24

'Linux Mint 21.3 is now available to download, reports the blog OMG Obuntu. It's the first version to offer Wayland support in its Cinnamon desktop: Following a successful bout of bug-busting in last month's beta release, Mint devs have gone ahead and rubber-stamped a stable release. Thus, you can reasonably expect to not encounter any major issues when installing or using it... [I]t's based on Ubuntu 22.04 LTS and continues to use the Linux 5.15 kernel by default, but newer kernels are available to install within the OS... In my own testing I find Cinnamon's Wayland support to be well-rounded. It's not perfect but I didn't hit any major snafus that prevented me from working (though admittedly I did only attempt 'basic' tasks like web browsing, playing music, and adding applets). However, Cinnamon's Wayland support is in an early state, is not enabled by default, and Linux Mint devs expect it won't be good enough for everyone until the 23.x series (due 2026) at the earliest. Still, try it out yourself and see if it works for you. Select the 'Cinnamon on Wayland (Experimental)' session from the login screen session selector, and then login as normal... Additionally, the latest version of Mozilla Firefox is pre-installed (as a deb, not a Snap) Among the new features are a whole new category of desktop add-ons — "Actions" — which upgrade the right-clicking context menu. (So for .iso files there's two new choices: "Verify" or "Make bootable USB stick".) The article says there's also "a raft of smaller refinements," plus "a bevvy of buffs and embellishments" for Linux Mint's homegrown apps. Any Linux Mint users reading Slashdot? Share your thoughts or experiences in the comments...' -- source: https://linux.slashdot.org/story/24/01/14/1830255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub: With Great Power Comes Great Responsibility ... For Both Good And Evil
by Lawrence D'Oliveiro 13 Jan '24

13 Jan '24

Seems GitHub has become a popular place to host malware in a form that is difficult to shut down <https://www.theregister.com/2024/01/12/github_malware_popularity/>. One thing I was surprised to learn from that article is that, as far as China is concerned, GitHub has apparently grown too big to block <https://www.npr.org/2019/04/10/709490855/github-has-become-a-haven-for-chin…>. Which means it becomes a sort-of-safe haven for activity which might be seen as politically subversive (such as demanding your rights to limited working hours as supposedly guaranteed under the law). Of course, that report was from nearly five years ago, and things could have changed since then. But the 996.icu repo referenced in there still exists, and still shows signs of activity as of a few months ago.

1 0

“I’m Sorry Dave, I’m Afraid I Can’t Do That” -- Or Not
by Lawrence D'Oliveiro 13 Jan '24

13 Jan '24

There has been a flood of products with very odd descriptions on Amazon lately <https://arstechnica.com/ai/2024/01/lazy-use-of-ai-leads-to-amazon-products-…>. For example, “I’m sorry but I cannot fulfill this request it goes against OpenAI use policy—Black”. Also available in other colours, and similar in sizes like 10mm×3m. And unique features like “Regrettably, the information you’re searching for is not available — we strive to maintain the highest standards of integrity and will not compromise the authenticity and accuracy of our product descriptions”. And who wouldn’t want to buy after hearing “Our [product] can be used for a variety of tasks, such [task 1], [task 2], and [task 3]]”? Are you thinking “I gotta get me some of that”?

1 0

X11 Conservancy Project
by Lawrence D'Oliveiro 13 Jan '24

13 Jan '24

Here’s a website <https://x11cp.org/> dedicated to trying to keep alive GUI programs dating from the early days of X11. I think they’re also trying to ensure that the code can still be built and run. This is the second time I’ve come across Codeberg, which offers an open-source-based hosting facility for Git repositories.

1 0

Why More PC Gaming Handhelds Should Ditch Windows For SteamOS
by Lawrence D'Oliveiro 12 Jan '24

12 Jan '24

The success of the Steam Deck is encouraging at least one third-party vendor to bring out its own gaming handheld that will be running the Linux-based SteamOS instead of Microsoft Windows <https://arstechnica.com/gaming/2024/01/why-more-pc-gaming-handhelds-should-…>. While compatibility with the overwhelming majority of Windows-only games still leaves something to be desired, the usability of the platform is already a definite selling point: While Proton does come with at least some performance overhead, a variety of Steam Deck benchmarks show games running under SteamOS tend to perform comparably (or sometimes better) than those running under Windows on the handheld. That's also a huge change from the Steam Machines era, when Ars' testing showed that many SteamOS games ran significantly worse than their Windows counterparts on the same desktop hardware. The Windows platform is just plain unsuited to a handheld gaming device: Our review of the ROG Ally highlights just how annoying it can be to have to fiddle with Windows settings on a touchscreen running "an awkwardly scaled" version of the OS. Though Microsoft has not been sitting still: And while Microsoft has experimented with a handheld-friendly version of Windows meant for portable gaming devices, nothing public has yet come of the effort. But unless it launches a much more concerted effort than it has managed to date, there’s a chance Windows may lose its undisputed dominance in the last major market where it has one: PC gaming.

1 0

Biggest Linux Kernel Release Ever Welcomes bcachefs File System, Jettisons Itanium
by Peter Reutemann 12 Jan '24

12 Jan '24

'Linux kernel 6.7 has been released, including support for the new next-gen copy-on-write (COW) bcachefs file system. The Register reports: Linus Torvalds announced the release on Sunday, noting that it is "one of the largest kernel releases we've ever had." Among the bigger and more visible changes are a whole new file system, along with fresh functionality for several existing ones; improved graphics support for several vendors' hardware; and the removal of an entire CPU architecture. [...] The single biggest feature of 6.7 is the new bcachefs file system, which we examined in March 2022. As this is the first release of Linux to include the new file system, it definitely would be premature to trust any important data to it yet, but this is a welcome change. The executive summary is that bcachefs is a next-generation file system that, like Btrfs and ZFS, provides COW functionality. COW enables the almost instant creation of "snapshots" of all or part of a drive or volume, which enables the OS to make disk operations transactional: In other words, to provide an "undo" function for complex sets of disk write operations. Having a COW file system on Linux isn't new. The existing next-gen file system in the kernel, Btrfs, also supports COW snapshots. The version in 6.7 sees several refinements. It inherits a feature implemented for Steam OS: Two Btrfs file systems with the same ID can be mounted simultaneously, for failover scenarios. It also has improved quota support and a new raid_stripe_tree that improves handling of arrays of dissimilar drives. Btrfs remains somewhat controversial. Red Hat banished it from RHEL years ago (although Oracle Linux still offers it) but SUSE's distros depend heavily upon it. It will be interesting to see how quickly SUSE's Snapper tool gains support for bcachefs: This new COW contender may reveal unquestioned assumptions built into the code. Since Snapper is also used in several non-SUSE distros, including Spiral Linux, Garuda, and siduction, they're tied to Btrfs as well. The other widely used FOSS next-gen file system, OpenZFS, also supports COW, but licensing conflicts prevent ZFS being fully integrated into the Linux kernel. So although multiple distros (such as NixOS, Proxmox, TrueNAS Scale, Ubuntu, and Void Linux) support ZFS, it must remain separate and distinct. This results in limitations, such as the ZFS Advanced Read Cache being separate from Linux's page cache. Bcachefs is all-GPL and doesn't suffer from such limitations. It aims to supply the important features of ZFS, such as integrated volume management, while being as fast as ext4 or XFS, and also surpass Btrfs in both performance and, crucially, reliability. ' -- source: https://linux.slashdot.org/story/24/01/11/2021234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Devices Are Under Attack By a Never-Before-Seen Worm
by Peter Reutemann 11 Jan '24

11 Jan '24

'Previously unknown self-replicating malware has been infecting Linux devices worldwide, installing cryptomining malware using unusual concealment methods. The worm is a customized version of Mirai botnet malware, which takes control of Linux-based internet-connected devices to infect others. Mirai first emerged in 2016, delivering record-setting distributed denial-of-service attacks by compromising vulnerable devices. Once compromised, the worm self-replicates by scanning for and guessing credentials of additional vulnerable devices. While traditionally used for DDoS attacks, this latest variant focuses on covert cryptomining. ArsTechnica adds: On Wednesday, researchers from network security and reliability firm Akamai revealed that a previously unknown Mirai-based network they dubbed NoaBot has been targeting Linux devices since at least last January. Instead of targeting weak telnet passwords, the NoaBot targets weak passwords connecting SSH connections. Another twist: Rather than performing DDoSes, the new botnet installs cryptocurrency mining software, which allows the attackers to generate digital coins using victims' computing resources, electricity, and bandwidth. The cryptominer is a modified version of XMRig, another piece of open source malware. More recently, NoaBot has been used to also deliver P2PInfect, a separate worm researchers from Palo Alto Networks revealed last July. Akamai has been monitoring NoaBot for the past 12 months in a honeypot that mimics real Linux devices to track various attacks circulating in the wild. To date, attacks have originated from 849 distinct IP addresses, almost all of which are likely hosting a device that's already infected. The following figure tracks the number of attacks delivered to the honeypot over the past year.' -- source: https://linux.slashdot.org/story/24/01/10/1727219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel 4.14 Reaches End of Life After More Than Six Years of Maintenance
by Peter Reutemann 11 Jan '24

11 Jan '24

'Originally released on November 12th, 2017, the long-term supported (LTS) Linux 4.14 kernel series has now reached its end of supported life after being maintained for more than six years. Renowned kernel developer Greg Kroah-Hartman announced today on the Linux kernel mailing list the release of Linux 4.14.336 as what appears to be the last maintenance update to the long-term supported Linux 4.14 kernel series, which is now marked as EOL (End of Life) on the kernel.org website. "This is the LAST 4.14.y kernel to be released. It is now officially end-of-life. Do NOT use this kernel version anymore, please move to a newer one, as shown on the kernel.org releases page," said Greg Kroah-Hartman. "If you are stuck at this version due to a vendor requiring it, go get support from that vendor for this obsolete kernel tree, as that is what you are paying them for."' -- source: https://linux.slashdot.org/story/24/01/10/1729216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Computer Says You Are A Thief
by Lawrence D'Oliveiro 10 Jan '24

10 Jan '24

Been hearing about this on and off for a few years, but it seems things have come to a head with the airing of a four-part documentary series about the massive scandal of the “Horizon” financial software used by the British Post Office <https://www.aljazeera.com/news/2024/1/9/the-great-british-post-office-scand…>. Basically, the buggy software was reporting incorrect transaction amounts, and these reports were believed over the protestations of the branch managers, leading to several hundred of the latter being prosecuted and convicted of theft and false accounting. In desperation at not being believed, some of them tried to plug the holes with their own money. Some even committed suicide. It took twenty years from the introduction of the system before a court ruled that the fault lay with the software, not with so many innocent people. (Why was the software considered to be above reproach for so long?) Even now, only a small proportion of the false convictions have been overturned. The Post Office CEO at the time has bowed to pressure and returned her CBE award. The software is still in use.

1 0

speed camera with RPi - NZ edition
by Peter Reutemann 10 Jan '24

10 Jan '24

Hi everyone Just stumbled across this news item in one of the reviews for the Raspberry Pi 4 on PBTech's website: https://www.stuff.co.nz/national/119894942/diy-speed-camera-nabs-hoons-near… And, would you believe it, the article even linked the source code: https://github.com/gregtinkers/carspeed.py Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical wants better Snap support outside Ubuntu, based on latest hires
by Peter Reutemann 10 Jan '24

10 Jan '24

'Snaps, the self-contained application packages that Ubuntu has long seen as a simpler app store and a potential solution to dependency hell, could be getting better support outside Ubuntu itself, based on one recent hire and potentially more. As spotted by the Phoronix blog, developer Zygmunt Krynicki, who worked at Ubuntu distributor Canonical from 2012 through 2020, posted Friday on Mastodon that he was "returning as a snap developer later this month." His main focus would be "cross-distribution support," Krynicki wrote, and "unlike in the past this will be my full time job. I'm very excited for what is ahead for snaps." He also noted, in a later reply, that he was "not coming back alone." Krynicki, reached Monday on Mastodon, noted that he was at a very early stage in his work. But he intended to look at the state of support across distributions, determine which long-term and short-term work to focus on, and "work on the internals and get things progressively better, even if that is not flashy." That means refactoring some of the code and, "if realistic, change some of the old ideas that I believe hold the project back," Krynicki wrote. The challenge will be finding ways to "experiment with new ideas in ways that allow controlled but more rapid progress," while maintaining stability. But all of that needs discussing with his team, when they're fully in place, Krynicki wrote. That team and their work would indicate that the Ubuntu makers have listened to perhaps the most common criticism of Snaps, whether perceptual, logistical, or both: that Snaps are an Ubuntu-focused phenomenon. Snap packages have difficulty working without AppArmor, a kernel extension that is a default in Ubuntu but not every other Linux distribution. Canonical also maintains the Snap Store. While other stores of Snaps are possible, some distributions and software packagers have turned instead to Flatpak, a similarly containerized system that doesn't have deep ties to any one distribution.' -- source: https://arstechnica.com/gadgets/2024/01/canonical-wants-better-snap-support… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Discusses Maintainers, AI, and Rust in the Kernel
by Peter Reutemann 08 Jan '24

08 Jan '24

'ZDNet reports that "At the Linux Foundation's Open Source Summit Japan, Linus Torvalds and his good friend Dirk Hohndel, the head of Verizon open source, talked about the current state of Linux: Speaking of maintainers, Hohndel brought up the question of "maintainer fatigue and how draining and stressful this role is...." Torvalds replied, "It's much easier to find developers; we have a lot of developers. Some people think that you have to be a superdeveloper who can do everything to be a maintainer, but that's not actually true...." Hohndel commented that the aging of the kernel community is a "double-edged sword." Torvalds agreed, but he noted that "one of the things I liked about the Rust side of the kernel, was that there was one maintainer who was clearly much younger than most of the maintainers. We can clearly see that certain areas in the kernel bring in more young people...." Hohndel and Torvalds also talked about the use of the Rust language in the Linux kernel. Torvalds said, "It's been growing, but we don't have any part of the kernel that really depends on Rust yet. To me, Rust was one of those things that made technical sense, but to me personally, even more important was that we need to not stagnate as a kernel and as developers." That said, Torvalds continued, "Rust has not really shown itself as the next great big thing. But I think during next year, we'll actually be starting to integrate drivers and some even major subsystems that are starting to use it actively. So it's one of those things that is going to take years before it's a big part of the kernel. But it's certainly shaping up to be one of those." Torvalds also said he enjoyed the fact that open source "has become the standard within the industry." But later Hohndel, calling AI "autocorrect on steroids," asked Torvalds if he thought he'd ever see submissions of LLM-written code. "I'm convinced it's gonna happen. And it may well be happening already, maybe on a smaller scale where people use it more to help write code." But, unlike many people, Torvalds isn't too worried about AI. "It's clearly something where automation has always helped people write code. This is not anything new at all...." But, "What about hallucinations?," asked Hohndel. Torvalds, who will never stop being a little snarky, said, "I see the bugs that happen without AI every day. So that's why I'm not so worried. I think we're doing just fine at making mistakes on our own." ' -- source: https://linux.slashdot.org/story/23/12/09/0644247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

How Does FreeBSD Compare to Linux on a Raspberry Pi?
by Peter Reutemann 08 Jan '24

08 Jan '24

'Klaus Zimmermann (a self-described "friendly hacker") recently posted a "State of the Distro" post, choosing his favorite distributions for things like portable installation from a USB drive (Alpine Linux) and for a desktop OS (Debian Linux or Devuan). But when it comes to a distro for the Raspberry Pi, (at least until the 4), Zimmerman argues that FreeBSD's performance is "unlike any other Linux distribution I've ever seen, even with cpupower activated and overclocking." Nope, no match — FreeBSD's performance on the Pi is still way better, even without overclocking. You can browse a modern web, have things scroll smoothly, watch videos and even play some 3D games like Quake with it! And if you overclock it a little (2GHz) you can even make it run that gargantua MS Teams. But what about all that lackluster driver support? WiFi drivers still on the 802.11g standard and all? Surely you can't be serious about it when Linux offers all that support out of the box, right? Wrong, actually. For starters, the drivers provided for the Pi's hardware are often half-assed proprietary blobs... I no longer think FreeBSD is really at fault if the driver support for the hardware is not helpful to begin with. Even drivers you find for Linux are shaky at best. So yes, I will keep using FreeBSD on the Pi. As a desktop. With USB WiFi and audio adapters for those services, because the existing hardware is sort of moot even otherwise. And with those USB adapters — and FreeBSD — the Pi works really well, truly desktop-like. I'd be curious to hear from Slashdot's readers about their own experiments with Linux (and FreeBSD) on a Raspberry Pi. Zimmerman's final winner, for the "Server" category, was Debian — though of his two servers, one is just an XMPP server set up on a Raspberry Pi. "I found that using Debian on the Pi is a real joy. Easy and simple to set up, familiar environment and all. So I'm keeping it. "This concept is about to be overshadowed, however, by my growing like of FreeBSD lately..."' -- source: https://linux.slashdot.org/story/24/01/07/0327229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ZDNet Calls Rhino Linux 'New Coolest Linux Distro'
by Peter Reutemann 08 Jan '24

08 Jan '24

'If you're starting the new year with a new Linux distro, ZDNet just ran an enthusiastic profile of Rhino Linux, calling it "beautiful" with "one of the more useful command-line package managers on the market." Rhino uses a modern take on the highly efficient and customizable Xfce desktop (dubbed "Unicorn") to help make the interface immediately familiar to anyone who logs in. You'll find a dock on the left edge of the screen that contains launchers for common applications, access to the Application Grid (where you can find all of your installed software), and a handy Search Bar (Ulauncher) that allows you to quickly search for and launch any installed app (or even the app settings) you need... Thanks to myriad configuration options, Xfce can be a bit daunting. At the same time, the array of settings makes Xfce highly customizable, which is exactly what the Rhino developers did when they designed this desktop. For those who want a desktop that makes short work of accessing files, the Rhino developers have added a really nifty tool to the top bar. You'll find a listing of some folders you have in your Home directory (Files, Documents, Music, Pictures, Video). If you click on one of those entries, you'll see a list of the most recently accessed files within the directory. Click on the file you want to open with the default, associated application... Rhino opts for the Pacstall package manager over the traditional apt-get. That's not to say apt-get isn't on the system — it is. But with Rhino Linux, there's a much easier path to getting the software you want installed... [W]hen you first run the installed OS, you are greeted with a window that allows you to select what package managers you want to use. You can select from Snap, Flatpak, and AppImages (or all three). Next, the developers added a handy tool (rhino-pkg) that makes installing from the command line very simple. When the distro launched in August, 9to5Linux described it as "a unique distribution for Ubuntu fans who wanted a rolling-release system where they install once and receive updates forever." The theming looks gorgeous and it's provided by the Elementary Xfce Darker icon theme, Xubuntu's Greybird GTK theme, and Ubuntu's Yaru Dark WM theme. It also comes with some cool features, such as a dedicated and full-screen desktop switcher provided by Xfdashboard... ' -- source: https://news.slashdot.org/story/24/01/07/2036245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

RIP: Software Design Pioneer And Pascal Creator Niklaus Wirth
by Lawrence D'Oliveiro 06 Jan '24

06 Jan '24

Famed computer scientist Niklaus Wirth has passed away, just a few weeks before reaching his 90th birthday <https://www.theregister.com/2024/01/04/niklaus_wirth_obituary/>. He is known for being a champion of simplicity in programming language and system design. He had a falling out with the committee that was coming up with a successor to Algol-60 (itself a driver for many important language-implementation techniques), and so went off and created Pascal. And then a few more languages after that. In his criticism of the language, Algol-68, that the committee eventually came up with, I found this excerpt illuminating on the milieu of the time: I am discouraged! I thought I had recognized the short-comings of the commercially available languages; they provide no guidance to programming discipline, and lack a logically coherent structure. Algol 60 had provided an answer and a solution. Unfortunately, it lacked some features which many practitioners badly need. It was relatively easy to remedy some defects and some defaults of Algol 60. We had implemented such an extension of Algol; it contains the data types long real, complex, and character strings, along with one other major extension. But guess how many requests we received for this system. None! Nobody is interested in a new language, particuarly if it is not supported by the big manufacturers or has received the blessing of some standards committee. But I see no chances that either a big manufacturer or a committee will ever produce a language acceptable to our standards or clarity, simplicity, and rigor. Remember, this was published in November 1968. Notice the assumption that the only sort of language implementation that might be worth using is a “commercially-available” one, with the backing of a “big” company behind it. There was no thought that an implementation with source code freely available could ever be considered “commercial”, either in usage or quality. And on top of that, every OS was different; there was nothing like the near-universality of POSIX-type OSes we enjoy today. And some of the differences were downright--quirky, shall we say. So even if such a source code project were available, porting it to all the platforms in common use would likely have been a nightmare.

1 0

Since the Demise of Atom, 'Pulsar' Offers an Alternative Code Editor
by Peter Reutemann 01 Jan '24

01 Jan '24

'On December 15 GitHub declared end-of-life for its "hackable text editor" Atom. But Long-time Slashdot reader BrendaEM wants to remind everyone that after the announcement of Atom's sunset, "the community came together to keep Atom alive." First there was the longstanding fork Atom-Community. But "due to differences in long-term goals for the editor, a new version was born: Pulsar." >From the Pulsar web site: Pulsar [sometimes referred to as Pulsar-Edit] aims to not only reach feature parity with the original Atom, but to bring Pulsar into the 21st century by updating the underlying architecture, and supporting modern features. With many new features on the roadmap, once Pulsar is stable, it will be a true, Community-Based, Hackable, Text Editor. "Of course, the user interface is much of the same," writes the blog Its FOSS, and it's cross-platform (supporting Linux, macOS, and Windows). "The essentials seem to be there with the documentation, packages, and features like the ability to install packages from Git repositories..."' -- source: https://tech.slashdot.org/story/24/01/01/016215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a Cray-1 Supercomputer Compares to a Raspberry Pi
by Peter Reutemann 01 Jan '24

01 Jan '24

'Roy Longbottom worked for the U.K. covernment's Central Computer Agency from 1960 to 1993, and "from 1972 to 2022 I produced and ran computer benchmarking and stress testing programs..." Known as the official design authority for the Whetstone benchmark), Longbottom writes that "In 2019 (aged 84), I was recruited as a voluntary member of Raspberry Pi pre-release Alpha testing team." And this week — now at age 87 — Longbottom has created a web page titled "Cray 1 supercomputer performance comparisons with home computers, phones and tablets." And one statistic really captures the impact of our decades of technological progress. "In 1978, the Cray 1 supercomputer cost $7 Million, weighed 10,500 pounds and had a 115 kilowatt power supply. It was, by far, the fastest computer in the world. The Raspberry Pi costs around $70 (CPU board, case, power supply, SD card), weighs a few ounces, uses a 5 watt power supply and is more than 4.5 times faster than the Cray 1." ' -- source: https://tech.slashdot.org/story/23/12/31/0017205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Source-Based Gentoo Linux Goes Binary
by Peter Reutemann 01 Jan '24

01 Jan '24

'While Gentoo Linux is best-known as source-based Linux distribution, "our package manager, Portage, already for years also has support for binary packages," according to its web page. It notes that source- and binary-based package installations can be freely mixed. But now... To speed up working with slow hardware and for overall convenience, we're now also offering binary packages for download and direct installation! For most architectures, this is limited to the core system and weekly updates — not so for amd64 and arm64 however. There we've got a stunning >20 GByte of packages on our mirrors, from LibreOffice to KDE Plasma and from Gnome to Docker. Gentoo stable, updated daily. Enjoy! "We have a rather neat binary package guide on our Wiki that goes into much more detail..." the announcement points out. The packages are cryptographically signed with the same key as the stages.' -- source: https://linux.slashdot.org/story/23/12/30/1756208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Peppermint OS Builds Single-Site Browsers for Debian Systems
by Peter Reutemann 31 Dec '23

31 Dec '23

'They create a dedicated desktop icon for your favorite web-based application — a simplified browser that opens to that single URL. Yet while Linux usually offers the same functionality as other operating systems, "Peppermint OS's Ice and its successor Kumo are the only free software versions of Site-Specific Browsers available on Linux," according to Linux magazine. "Fortunately for those who want this functionality, Peppermint OS is a Debian derivative, and both can be installed on Debian and most other derivatives." Since SSBs first appeared in 2005, they have been available on both Windows and macOS. On Linux, however, the availability has come and gone. On Linux, Firefox once had an SSB mode, but it was discontinued in 2020 on the grounds that it had multiple bugs that were time-consuming to fix and there was "little to no perceived user benefit to the feature." Similarly, Chromium once had a basic SSB menu item, Create Application Shortcut, which no longer appears in recent versions. As for GNOME Web's (Epiphany's) Install Site as Web Application, while it still appears in the menu, it is no longer functional. Today, Linux users who want to try SSBs have no choices except Ice or Kumo. Neither Ice or Kumo appears in any repository except Peppermint OS's. But because Peppermint OS installs packages from Debian 12 ("bookworm"), either can be installed to Debian or a derivative... To install successfully, at least one of Firefox, Chrome, Chromium, or Vivaldi also must be installed... Because both Ice and Kumo are written in Python, they can be run on any desktop. The article concludes that Site-Specific Browsers might make more sense "on a network or in a business where their isolation provides another layer of security. Or perhaps the time for SSBs is past and there's a reason browsers have tried to implement them, and then discarded them."' -- source: https://linux.slashdot.org/story/23/12/30/0527205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox: scrollbar buttons gone
by Peter Reutemann 30 Dec '23

30 Dec '23

Hi everyone Call me old-fashioned, but I do like the arrow buttons on scrollbars. Especially on very long pages (eg OpenWRT's hardware table) where I want move the view port only a little bit... On my Linux 20.3 MATE, I managed to get them back by using these CSS settings: scrollbar { -GtkScrollbar-has-backward-stepper: true; -GtkScrollbar-has-forward-stepper: true; } In the following config file: ~/.config/gtk-3.0/gtk.css -- source: https://support.mozilla.org/en-US/questions/1420887 Also, if you don't like the thin overlay scrollbars, then set the following FF option ("about:config") to "false": widget.gtk.overlay-scrollbars.enabled Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0