- wlug - list.wlug.org.nz

Password-stealing Linux malware served for 3 years and no one noticed
by Peter Reutemann 13 Sep '23

13 Sep '23

'A download site surreptitiously served Linux users malware that stole passwords and other sensitive information for more than three years until it finally went quiet, researchers said on Tuesday. The site, freedownloadmanager[.]org, offered a benign version of a Linux offering known as the Free Download Manager. Starting in 2020, the same domain at times redirected users to the domain deb.fdmpkg[.]org, which served a malicious version of the app. The version available on the malicious domain contained a script that downloaded two executable files to the /var/tmp/crond and /var/tmp/bs file paths. The script then used the cron job scheduler to cause the file at /var/tmp/crond to launch every 10 minutes. With that, devices that had installed the booby-trapped version of Free Download Manager were permanently backdoored. After accessing an IP address for the malicious domain, the backdoor launched a reverse shell that allowed the attackers to remotely control the infected device. Researchers from Kaspersky, the security firm that discovered the malware, then ran the backdoor on a lab device to observe how it behaved. “This stealer collects data such as system information, browsing history, saved passwords, cryptocurrency wallet files, as well as credentials for cloud services (AWS, Google Cloud, Oracle Cloud Infrastructure, Azure),” the researchers wrote in a report on Tuesday. “After collecting information from the infected machine, the stealer downloads an uploader binary from the C2 server, saving it to /var/tmp/atd. It then uses this binary to upload stealer execution results to the attackers’ infrastructure.”' -- source: https://arstechnica.com/security/2023/09/password-stealing-linux-malware-se… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Multi-Account Containers
by Peter Reutemann 11 Sep '23

11 Sep '23

Hi everyone Just came across this Firefox plugin: The Firefox Multi-Account Containers extension lets you carve out a separate box for each of your online lives – no more opening a different browser just to check your work email! Under the hood, it separates website storage into tab-specific Containers. Cookies downloaded by one Container are not available to other Containers. You can even integrate individual Containers with Mozilla VPN to protect your browsing and location. With the Firefox Multi-Account Containers extension, you can... - Sign in to two different accounts on the same site (for example, you could sign in to work email and home email in two different Container tabs. - Keep different kinds of browsing far away from each other (for example, you might use one Container tab for managing your Checking Account and a different Container tab for searching for new songs by your favorite band) - Avoid leaving social-network footprints all over the web (for example, you could use a Container tab for signing in to a social network, and use a different tab for visiting online news sites, keeping your social identity separate from tracking scripts on news sites) - Protect your browsing activity in individual Containers using Mozilla VPN, so you can shop while travelling abroad but check your bank account from a server in your home country. -- source: https://discuss.systems/@ricci/111024736570863186 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Connected cars are a “privacy nightmare,” Mozilla Foundation says
by Peter Reutemann 07 Sep '23

07 Sep '23

'Today, the Mozilla Foundation published its analysis of how well automakers handle the privacy of data collected by their connected cars, and the results will be unlikely to surprise any regular reader of Ars Technica. The researchers were horrified by their findings, stating that "cars are the worst product category we have ever reviewed for privacy." Mozilla looked at 25 car brands and found that all of them collected too much personal data, and from multiple sources—monitoring not just which buttons you push or what you do in any of the infotainment system's apps but also data from other sources like satellite radio or third-party maps. Or even when you connect your phone—remember that prompt asking you if you wanted to share all your contacts and notes with your car when you connected it via Bluetooth? While some gathered data seems innocuous or even helpful—feedback to improve cabin ergonomics and UIs, for example—some data is decidedly not. For example, Nissan's privacy policy says it can collect "sensitive personal information, including driver’s license number, national or state identification number, citizenship status, immigration status, race, national origin, religious or philosophical beliefs, sexual orientation, sexual activity, precise geolocation, health diagnosis data, and genetic information," although it's unlikely your car knows whether you're getting busy in the back seat. While this might be technically possible with a car fitted with a camera-based driver-monitoring system, Nissan's privacy policy notes the data source for the quoted paragraph as "direct contact with users and Nissan employees." (Although more sophisticated driver-monitoring systems that claim to detect emotional states have been demonstrated at shows like CES, we're unaware of any that are in production.) Mozilla found plenty more to worry about. Eighty-four percent of the brands they analyzed said they can share your data, and 76 percent said they can sell it. And more than half say they'll share data with the government and law enforcement by request. Users have very little control over what those brands do with their data. Only two of the 25 brands (Renault and Dacia) tell users they have the right to have their data deleted, and neither sell cars in the United States.' -- source: https://arstechnica.com/cars/2023/09/connected-cars-are-a-privacy-nightmare… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ArcaOS 5.1.0 (OEM OS/2 Warp Operating System) Now Available
by Peter Reutemann 04 Sep '23

04 Sep '23

'ArcaOS 5.1.0 is an OEM distribution of IBM's discontinued OS/2 Warp operating system. This new version of ArcaOS offers UEFI compatibility allowing it to run in modern x86 hardware and also includes the ability to install to GPT-based disk layouts. At OS2World the OS/2 community has been called upon to report supported hardware, open source any OS/2 software, make public as much OS/2 documentation as possible and post the important platform links. OS2World insists that open source has helped OS/2 in the past years and it is time to look under the hood to try to clone internal components like Control Program, Presentation Manager, SOM and Workplace Shell.' -- source: https://tech.slashdot.org/story/23/09/02/1912223 The one and only time I came across OS/2 was in the late 90s (at a bank)... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

ReiserFS is now “obsolete” in the Linux kernel and should be gone by 2025
by Peter Reutemann 01 Sep '23

01 Sep '23

'When Apple was about to introduce Time Machine in Mac OS X Leopard, John Siracusa wrote in the summer of 2006 about how a new file system should be coming to Macs (which it did, 11 years later). The Mac, Siracusa wrote, needed something that could efficiently handle lots of tiny files, volume management with pooled storage, checksum-based data integrity, and snapshots. It needed something like ZFS or, perhaps, ReiserFS, file systems “notable for their willingness to reconsider past assumptions about file system design.” Two months later, the name Reiser would lose most of its prestige and pick up a tragic association it would never shake. Police arrested the file system’s namesake, Hans Reiser, and charged him with murder in connection with the disappearance of his estranged wife. Reiser’s work on Linux file systems was essentially sentenced to obscurity from that point on. Now that designation has been made official, as the file system that was once the default on systems like SUSE Linux has been changed from “Supported” to “Obsolete” in the latest Linux 6.6 kernel merge process (as reported by Phoronix). While a former employee of Reiser’s company, Namesys, continues out-of-source work on later versions of ReiserFS, it is likely to disappear from the kernel entirely in a matter of years, likely 2025. It's an ignoble end for a filesystem that, at one time, could have been the next big thing for Linux file systems.' -- source: https://arstechnica.com/gadgets/2023/08/the-torrid-saga-of-reiserfs-nears-i… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Removes Fake Signal and Telegram Apps Hosted on Play
by Peter Reutemann 01 Sep '23

01 Sep '23

'Researchers say they have found fake apps in Google Play that masqueraded as legitimate ones for the Signal and Telegram messaging platforms. The malicious apps could pull messages or other sensitive information from legitimate accounts when users took certain actions. ArsTechnica: An app with the name Signal Plus Messenger was available on Play for nine months and had been downloaded from Play roughly 100 times before Google took it down last April after being tipped off by security firm ESET. It was also available in the Samsung app store and on signalplus[.]org, a dedicated website mimicking the official Signal.org. An app calling itself FlyGram, meanwhile, was created by the same threat actor and was available through the same three channels. Google removed it from Play in 2021. Both apps remain available in the Samsung store. Both apps were built on open source code available from Signal and Telegram. Interwoven into that code was an espionage tool tracked as BadBazaar. The Trojan has been linked to a China-aligned hacking group tracked as GREF. BadBazaar has been used previously to target Uyghurs and other Turkic ethnic minorities. The FlyGram malware was also shared in a Uyghur Telegram group, further aligning it to previous targeting by the BadBazaar malware family. Signal Plus could monitor sent and received messages and contacts if people connected their infected device to their legitimate Signal number, as is normal when someone first installs Signal on their device. Doing so caused the malicious app to send a host of private information to the attacker, including the device IMEI number, phone number, MAC address, operator details, location data, Wi-Fi information, emails for Google accounts, contact list, and a PIN used to transfer texts in the event one was set up by the user.' -- source: https://tech.slashdot.org/story/23/08/31/1655233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

With Version 117, Firefox Finally Speaks Chrome's Translation Language
by Peter Reutemann 01 Sep '23

01 Sep '23

'The latest version of the flagship FOSS browser is out, and it's picked up one of the main features for which we keep Chrome around. >From a report: The Firefox version 117 feature list might not look all that impressive, but it does have a big-ticket feature that may tempt people back: automatic translation. The snag is it's disabled by default in the release version, and you'll have to manually enable it. Although it was enabled in the betas, Mozilla has decided to go for a staged rollout and not enable it for everyone until Firefox 118 in six weeks or so. The new feature is integrated, privacy-respecting machine translation between multiple languages. This was already possible in older versions, but it needed an extension, and that had two side effects. One is that the extension hooked deep into the core of the browser in ways that Mozilla wasn't comfortable about, and the other is that once your text had been sent out to a third-party website, it could be snooped upon -- but the victims of any snooping would blame the browser, even if it wasn't the browser's fault. To enable it, go to the configuration page (enter about:config in the address bar), and search for a setting called browser.translations.enable.' -- source: https://tech.slashdot.org/story/23/08/31/1658259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FreeBSD Can Now Boot in 25 Milliseconds
by Peter Reutemann 31 Aug '23

31 Aug '23

'Replacing a sort algorithm in the FreeBSD kernel has improved its boot speed by a factor of 100 or more... and although it's aimed at a micro-VM, the gains should benefit everyone. From a report: MicroVMs are a hot area of technology R&D in the last half decade or so. The core idea is a re-invention of some of concepts and technology that IBM invented along with the hypervisor in the 1960s: designing OSes specifically to run as guests under another OS. This means building the OS specifically to run inside a VM, and to talk to resources provided by a specific hypervisor rather than to fake hardware. This means that the guest OS needs next to no support for real hardware, just VirtIO drivers which talk directly to facilities provided by the host hypervisor. In turn, the hypervisor doesn't have to provide an emulated PCI bus, emulated power management, emulated graphics card, emulated network interface cards, and so on. The result is that the hypervisor itself can be much smaller and simpler. The result of ruthlessly chopping down both the hypervisor, and the OS that runs inside it, is that both ends can be much smaller and simpler. That means that VMs can use much fewer resources, and start up much quicker.' -- source: https://tech.slashdot.org/story/23/08/30/1525238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nautilus File Manager Gets New Features in Upcoming GNOME 45
by Peter Reutemann 29 Aug '23

29 Aug '23

'The upcoming release of GNOME 45 — expected September 20th — will bring new features to the Nautilus file manager (now in public beta testing). An anonymous reader shared this report from 9to5Linux: Nautilus in GNOME 45 already received a search performance boost, support for dropping images directly from web pages, an improved Grid View that now indicates starred files too, the ability to display bytes size as a tooltip for folder properties, and a more adaptive design for the sidebar. It also got an improved file opening experience while sandboxed (think Flatpak, Snap, etc.), a more consistent date and time format, a more simplistic definition of the Keyboard Shortcuts window, the ability to refocus the search bar using the Ctrl+F keyboard shortcut, and a better archiving experience. But there's room for more new features as Nautilus now received new "Search Everywhere" buttons to expand the search scope and a modern full-height sidebar layout, along with refined sidebar sizing and folding threshold. This is what Nautilus looks like in GNOME 45. The article includes some screenshots, adding that Nautilus "also received some performance improvements to more quickly generate multiple thumbnails, provide users with flickerless transition into and from search, and avoid DBus-activating other apps when it starts."' -- source: https://linux.slashdot.org/story/23/08/27/2329227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux What's New in Linux 6.5?
by Peter Reutemann 28 Aug '23

28 Aug '23

'9to5Linux: Just a couple of days after celebrating its 32nd anniversary , Linus Torvalds announced today the final release of the Linux 6.5 kernel series as a major update that introduces several new features, updated and new drivers for better hardware support, and other changes. After seven weeks of RCs, Linux kernel 6.5 is here with new features like MIDI 2.0 support in ALSA, ACPI support for the RISC-V architecture, Landlock support for UML (User-Mode Linux), better support for AMD "Zen" systems, as well as user-space support for the ARMv8.8 memcpy/memset instructions. Also new in Linux 6.5 is Intel TPMI (Topology Aware Register and PM Capsule Interface) support for the power capping subsystem and a TPMI interface driver for Intel RAPL, and the "runnable boosting" feature in the EAS balancer to improve CPU utilization for specific workloads. This release also improves SMP scheduling's load balancer to recognize SMT cores with more than one busy sibling and allows lower-priority CPUs to pull tasks to avoid superfluous migrations, and improves EXT4 file system's journalling, block allocator subsystems, and performance for parallel DIO overwrites.' -- source: https://linux.slashdot.org/story/23/08/27/2316212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Can You Run Linux On a Commodore 64?
by Peter Reutemann 28 Aug '23

28 Aug '23

'llvm-mos adapts the popular LLVM compiler to target the MOS 6502 processor (the 1980s microprocessor used in early home computing devices like the Apple II and the Commodore 64). So developer Onno Kortman used it to cross-compile semu, a "minimalist RISC-V system emulator capable of running Linux the kernel and corresponding userland." And by the end of the day, Kortman has Linux running on a Commodore 64. Long-time Slashdot reader johnwbyrd shared the link to Kortman's repository. Some quotes: "But does it run Linux?" can now be finally and affirmatively answered for the Commodore C64...! It runs extremely slowly and it needs a RAM Expansion Unit (REU), as there is no chance to fit it all into just 64KiB. It even emulates virtual memory with an MMU.... The screenshots took VICE a couple hours in "warp mode" (activate it with Alt-W) to generate. So, as is, a real C64 should be able to boot Linux within a week or so. The compiled 6502 code is not really optimized yet, and it might be realistic to squeeze a factor 10x of performance out of this. Maybe even a simple form of JIT compilation? It should also be possible to implement starting a checkpointed VM (quickly precomputed on x86-64) to avoid the lengthy boot process... I also tested a minimal micropython port (I can clean it up and post it on github if there is interest), that one does not use the MMU and is almost barely remotely usable with lots of optimism at 100% speed. A key passage: I have not tested it on real hardware yet, that's the next challenge .. for you. So please send me a link to a timelapse video of an original unit with REU booting Linux :D Its GitHub repository has build and run instructions...' -- source: https://linux.slashdot.org/story/23/08/27/1532207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bloomberg Terminals Still Exist
by Lawrence D'Oliveiro 27 Aug '23

27 Aug '23

Bloomberg still supplies special terminals for accessing the services it provides, and those services cost a pretty penny -- over $40,000 a year for each. And Kāinga Ora has seven of the things <https://www.nzherald.co.nz/nz/politics/kainga-ora-spends-more-than-300000-a…>. These things have a long history. A look at some older versions: <https://www.bloomberg.com/professional/blog/look-back-bloomberg-keyboard/>.

1 0

When A Certificate Authority Is Too Big To Fail
by Lawrence D'Oliveiro 26 Aug '23

26 Aug '23

Certificate authorities (CAs) have a crucial role in the chain of trust that binds the computing world together right now. So when it turns out that a rather large company (Symantec) has been issuing dodgy certificates for many years, the ramifications run uncomfortably wide. Google has been gradually winding down its trust of Symantec-issued over a multiyear period, because blocking them all at once would just be too painful for its users. It turns out some of these CAs are also used for signing applications for Windows. Microsoft finally got around to blocking the Symantec one within the last few days, only to abruptly reverse course and trust it again, because it caused serious trouble for too many Windows systems <https://arstechnica.com/security/2023/08/a-renegade-certificate-is-removed-…>. The applications concerned should have been updated to not depend on such a worthless CA. But it seems, ensuring Windows users update all their relevant apps can be a mountain just too high to climb.

1 0

Firefox Users May Import Chrome Extensions Now
by Peter Reutemann 25 Aug '23

25 Aug '23

'Mozilla has implemented the WebExtensions system in its browser, allowing Firefox users to import select extensions from other browsers like Chrome. gHacks reports: The feature, which is in testing at the moment, can be enabled by all users of the latest stable version of Firefox. 1. Load about:config in the browser's address bar. 2. Confirm that you will be careful to continue. 3. Search for browser.migrate.chrome.extensions.enabled. 4. Set the feature to True, which enables it. 5. Restart Firefox. Mozilla has integrated it into the browser's import functionality, which users may use on first run or at any time from the Settings page. To do so, select Menu > Settings > Import Data (button), or load about:preferences#general in the browser's address bar and activate the import data button on the page. Select Chrome from the list, expand the available import options and make sure extensions are checked. Imports are usually limited to some data, such as bookmarks or the browsing history. Firefox is the first major browser, maybe the first browser at all, that adds extensions to the list of supported imports. The feature is limited at the time to Google Chrome and select extensions. Even though Firefox and Chrome extensions use the same framework, WebExtensions, they are not compatible immediately. Firefox users who attempt to install extensions from Chrome's Web Store may notice that this is not working. Mozilla decided to create a list of extension pairs for extensions that are available on the Chrome Web Store and the Mozilla Add-ons Store. Instead of importing the Chrome extension directly, Firefox is installing the Firefox version of the extension from Mozilla's own extension store. ' -- source: https://news.slashdot.org/story/23/08/24/2233242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WinRAR Flaw Lets Hackers Run Programs When You Open RAR Archives
by Peter Reutemann 23 Aug '23

23 Aug '23

'A critical vulnerability (CVE-2023-40477) has been patched in WinRAR, enabling remote attackers to execute arbitrary code by luring victims into opening a specially crafted RAR file. The severity rating is only 7.8 though due to user deception being necessary. BleepingComputer reports: The vulnerability was discovered by researcher "goodbyeselene" of Zero Day Initiative, who reported the flaw to the vendor, RARLAB, on June 8th, 2023. "The specific flaw exists within the processing of recovery volumes," reads the security advisory released on ZDI's site. "The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer." RARLAB released WinRAR version 6.23 on August 2nd, 2023, effectively addressing CVE-2023-40477. Therefore, WinRAR users are strongly advised to apply the available security update immediately. Apart from the RAR4 recovery volumes processing code fix, version 6.23 addresses an issue with specially crafted archives leading to wrong file initiation, which is also considered a high-severity problem.' -- source: https://it.slashdot.org/story/23/08/18/2157249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Latest Android Runtime (ART) Update Led To Apps Starting 30% Faster
by Peter Reutemann 22 Aug '23

22 Aug '23

'The latest update to the Android Runtime (ART) -- the "engine behind the Android operating system (OS)" -- has resulted in app startup time "improvements of up to 30% on some devices," says Google. 9to5Google reports: Behind the scenes, "ART is the same for all devices" and: "The ART APEX module is a complex piece of software with an order of magnitude more APIs than any other APEX module. It also backs a quarter of the developer APIs available in the Android SDK. In addition, ART has a compiler that aims to make the most of the underlying hardware by generating chipset-specific instructions, such as Arm SVE." The testing process for Android Runtime updates involves "compiling over 18 million APKs and running app compatibility tests, and startup, performance, and memory benchmarks on a variety of Android devices that replicate the diversity of our ecosystem as closely as possible." There's then a very gradual rollout process. Google also notes developer improvements with every update "like OpenJDK improvements and compiler optimizations that benefit both Java and Kotlin," with ART 13 resulting in the "fastest-ever adoption of a new OpenJDK [11] release on Android devices." ART 14 is rolling out "in the coming months" with "new compiler and runtime optimizations that improve performance while reducing code size," as well as OpenJDK 17.' -- source: https://slashdot.org/story/23/08/21/212202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AlmaLinux Leader Says Red Hat's Code Crackdown Isn't a Threat
by Peter Reutemann 21 Aug '23

21 Aug '23

'Yes, Red Hat Enterprise Linux changed its licensing last month — but how will that affect AlmaLinux? The chair of the nonprofit AlmaLinux OS Foundation, benny Vasquez, tells SiliconANGLE that "For typical users, there's very, very little difference. Overall, we're still exactly the same way we were, except for kernel updates." Updates may no longer be available the day a new version of RHEL comes out, but developers still have access to Red Hat's planned enhancements and bug fixes via CentOS Stream, a version of RHEL that Red Hat uses as essentially a test bed for new features that might later be incorporated into its flagship product. From a practical perspective, that's nearly as good as having access to the production source code, Vasquez said. "While there is a generally accepted understanding that not everything in CentOS Stream will end up in RHEL, that's not how it works in practice," she said. "I can't think of anything they have shipped in RHEL that wasn't in Stream first." That's still no guarantee, but the workarounds AlmaLinux has put in place over the past month should address all but the most outlier cases, Vasquez said. The strategy has shifted from bug-for-bug compatibility to being application binary interface-compatible... ABI compatibility doesn't guarantee that problems will never occur, but glitches should be rare and can usually be resolved by recompiling the source code. "It is sufficient for us to be ABI-compatible with RHEL," Vasquez said. "The most important thing is that this allows our community to feel stability." In fact, Red Hat's change of direction has been a blessing in disguise for AlmaLinux, she said... "We view this as a release from our bonds of being one-to-one." Patches can be applied without waiting for a cue from Red Hat and "we get to engage with our community in a completely new and exciting way." AlmaLinux has also seen a modest financial windfall from Red Hat's decision. "The outpouring of support has been pretty impressive," Vasquez said. "People have shown up for event staffing and website maintenance and infrastructure management and we've gotten more financial backing from corporations." Vasquez also told the site that "the number of everyday people throwing in $5 has more than quadrupled."' -- source: https://linux.slashdot.org/story/23/08/20/0247259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian Turns 30
by Peter Reutemann 18 Aug '23

18 Aug '23

'Debian blog: Over 30 years ago the late Ian Murdock wrote to the comp.os.linux.development newsgroup about the completion of a brand-new Linux release which he named "The Debian Linux Release." He built the release by hand, from scratch, so to speak. Ian laid out guidelines for how this new release would work, what approach the release would take regarding its size, manner of upgrades, installation procedures; and with great care of consideration for users without Internet connection. Unaware that he had sparked a movement in the fledgling F/OSS community, Ian worked on and continued to work on Debian. The release, now aided by volunteers from the newsgroup and around the world, grew and continues to grow as one of the largest and oldest FREE operating systems that still exist today. Debian at its core is comprised of Users, Contributors, Developers, and Sponsors, but most importantly, People. Ians drive and focus remains embedded in the core of Debian, it remains in all of our work, it remains in the minds and hands of the users of The Universal Operating System. The Debian Project is proud and happy to share our anniversary not exclusively unto ourselves, instead we share this moment with everyone, as we come together in celebration of a resounding community that works together, effects change, and continues to make a difference, not just in our work but around the world. Debian is present in cluster systems, datacenters, desktop computers, embedded systems, IoT devices, laptops, servers, it may possibly be powering the web server and device you are reading this article on, and it can also be found in Spacecraft.' -- source: https://linux.slashdot.org/story/23/08/17/136231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Farewell, Type-1 Fonts
by Lawrence D'Oliveiro 17 Aug '23

17 Aug '23

Following the lead of other vendors, now Adobe itself is abandoning support for the venerable “Type 1” font format that it created <https://arstechnica.com/gadgets/2023/08/microsoft-adobe-and-others-have-dro…>. Back in the days when PostScript printers were new and wonderful things, the PostScript language was an open, published spec, but the high-quality font format that Adobe’s printers used was not. This format included a “secret sauce” in the form of “hints” to the rasterizer that smoothed out irregularities. Because if you took letter shapes expressed as scalable vector graphics and tried rendering them in a straight geometric fashion at typical text sizes on a black-and-white output device, even at as high as 300 dpi, there would be a noticeable roughness to the shapes. Nowadays the techniques for applying such hinting are no longer such a big secret. However, I take issue with this bit: ... it's possible that you created a document in 2022 that you simply won't be able to open in 2023. The change will also cause problems if you open and work with decades-old files with any kind of regularity; files that use Type 1 fonts will begin generating lots of "missing font" messages ... As far as I know, office-type and layout-type apps do not typically embed fonts in the document. Instead, they store font-matching information (family name, weight etc) that will be used to find the best available fonts when the document is next opened, perhaps on a different system. Remember, it is only the old font format that is being dropped; the same classic, professional-quality font designs that people have been using for years or decades will still be available, just in the newer formats. So a proper font match, if it is installed, can still be found. A self-contained document format like PDF does embed fonts (typically only in subset form), but that has its own internal font representation, so it should not be affected by the demise of Type-1. This part is true, though: You'll also either need to convert any specialized PostScript Type 1 font that you may have paid for in the past or pay for an equivalent OpenType alternative. This article <https://www.prepressure.com/fonts/basics/history> is a good potted history of font formats (the important ones, at any rate). By the way, I don’t think the open-source FreeType library is dropping support for Type-1 font rendering any time soon. It still handles Multiple Master fonts, which Adobe gave up on a long time ago.

1 1

Windows Server Forgets What Time It Is
by Lawrence D'Oliveiro 17 Aug '23

17 Aug '23

Seems that, some years ago, Microsoft added a “feature” to Windows Server, called “Secure Time Seeding”. This was supposed to offer alternative ways for a server machine to keep track of the correct time, in the event of failures in the more usual mechanisms. Unfortunately, this “feature” only seems to have introduced a new source of problems, where the server can suddenly throw its date and time setting off by as much as several months, often with unfortunate consequences for the applications running on it <https://arstechnica.com/security/2023/08/windows-feature-that-resets-system…>. At this stage, Microsoft is still in the “no comment” stage of (not) responding to this problem. Reports of issues go right back to the introduction of the feature, back in 2016. They may only be happening intermittently, but it seems to me this is still enough to damage what trust there may still be left in Microsoft’s product.

1 0

Firefox Finally Outperforming Google Chrome In SunSpider
by Peter Reutemann 16 Aug '23

16 Aug '23

'Michael Larabel writes via Phoronix: Mozilla developers are celebrating that they are now faster than Google Chrome with the SunSpider JavaScript benchmark, although that test has been superseded by the JetStream benchmark. Last week a new Firefox Nightly News was published that outlines that "We're now apparently beating Chrome on the SunSpider JavaScript benchmark!" The provided numbers now show Firefox easily beating Chrome in this decade-old JavaScript benchmark. The benchmarks come from AreWeFastYet.com. Meanwhile for the newer and more demanding JetStream 2.0 benchmark, Google Chrome continues to win easily over Firefox. ' -- source: https://news.slashdot.org/story/23/08/15/2015210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

From The “How Not To Design A Website” Department
by Lawrence D'Oliveiro 15 Aug '23

15 Aug '23

Found a link to some past news items on this site reporting on Munich city’s back-and-forth migrations between Linux and Windows. The last linked item was this <https://www.ip-watch.org/2018/06/12/former-munich-mayor-warns-negative-effe…>. Bad enough that that light, thin text is almost unreadable against a similarly-coloured background, I decided to search the site for “munich” to see if I could find a more recent item, and got this: <https://www.ip-watch.org/?s=munich>. In case they fix it later, the top part has this message: Deprecated: strlen(): Passing null to parameter #1 ($string) of type string is deprecated in /home/clients/5bc716f64eaa5eb2ef6cc74a6b9b690a/web/weblog/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/utils.php on line 445 and at the bottom it says “Not found, error 404” and that the page I am looking for (search results??) no longer exists. Who knew? Mind you, PHP is the only language where features can be marked “no longer deprecated” in later releases, so who knows, perhaps they will later decide to assign a meaning to finding the length of a string when the string isn’t actually a string ...

1 0

Should There Be an 'Official' Version of Linux?
by C. A. Fillekes 15 Aug '23

15 Aug '23

I was surprised, a couple years ago, to find that most of my gnome desktop applications had ceased being exportable to different machines' displays over the network. Even Firefox. Ordinary vanilla X11 is unwieldy, but it at least had that one key feature, and has had it since well before MS Windows ruined everything.

1 0

Should There Be an 'Official' Version of Linux?
by Peter Reutemann 14 Aug '23

14 Aug '23

'Why aren't more people using Linux on the desktop? Slashdot reader technology_dude shares one solution: Jack Wallen at ZDNet says establishing an "official" version of Linux may (or may not) help Linux on the desktop increase the number of users, mostly as someplace to point new users. It makes sense to me. What does Slashdot think and what would be the challenges, other than acceptance of a particular flavor? Wallen argues this would also create a standard for hardware and software vendors to target, which "could equate to even more software and hardware being made available to Linux." (And an "official" Linux might also be more appealing to business users.) Wallen suggests it be "maintained and controlled by a collective of people from users, developers, and corporations (such as Intel and AMD) with a vested interest in the success of this project... There would also be corporate backing for things like marketing (such as TV commercials)." He also suggests basing it on Debian, and supporting both Snap and Flatpak... In comments on the original submission, long-time Slashdot reader bobbomo points instead to kernel.org, arguing "There already is an official version of Linux called mainline. Everything else is backports." And jd (Slashdot user #1,658) believes that the official Linux is the Linux Standard Base. "All distributions, more-or-less, conform to the LSB, which gives you a pseudo 'official' Linux. About the one variable is the package manager. And there are ways to work around that." Unfortunately, according to Wikipedia... The LSB standard stopped being updated in 2015 and current Linux distributions do not adhere to or offer it; however, the lsb_release command is sometimes still available.[citation needed] On February 7, 2023, a former maintainer of the LSB wrote, "The LSB project is essentially abandoned." That post (on the lsb-discuss mailing list) argues the LSB approach was "partially superseded" by Snaps and Flatpaks (for application portability and stability). And of course, long-time Slashdot user menkhaura shares the obligatory XKCD comic... It's not exactly the same thing, but days after ZDNet's article, CIQ, Oracle, and SUSE announced the Open Enterprise Linux Association, a new collaborative trade association to foster "the development of distributions compatible with Red Hat Enterprise Linux." So where does that leave us? Share your own thoughts in the comments. And should there be an "official" version of Linux?' -- source: https://linux.slashdot.org/story/23/08/12/1835204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Does Desktop Linux Have a Firefox Problem?
by Peter Reutemann 14 Aug '23

14 Aug '23

'OS News' managing editor calls Firefox "the single most important desktop Linux application," shipping in most distros (with some users later opting for a post-installation download of Chrome). But "I'm genuinely worried about the state of browsers on Linux, and the future of Firefox on Linux in particular..." While both GNOME and KDE nominally invest in their own two browsers, GNOME Web and Falkon, their uptake is limited and releases few and far between. For instance, none of the major Linux distributions ship GNOME Web as their default browser, and it lacks many of the features users come to expect from a browser. Falkon, meanwhile, is updated only sporadically, often going years between releases. Worse yet, Falkon uses Chromium through QtWebEngine, and GNOME Web uses WebKit (which are updated separately from the browser, so browser releases are not always a solid metric!), so both are dependent on the goodwill of two of the most ruthless corporations in the world, Google and Apple respectively. Even Firefox itself, even though it's clearly the browser of choice of distributions and Linux users alike, does not consider Linux a first-tier platform. Firefox is first and foremost a Windows browser, followed by macOS second, and Linux third. The love the Linux world has for Firefox is not reciprocated by Mozilla in the same way, and this shows in various places where issues fixed and addressed on the Windows side are ignored on the Linux side for years or longer. The best and most visible example of that is hardware video acceleration. This feature has been a default part of the Windows version since forever, but it wasn't enabled by default for Linux until Firefox 115, released only in early July 2023. Even then, the feature is only enabled by default for users of Intel graphics — AMD and Nvidia users need not apply. This lack of video acceleration was — and for AMD and Nvidia users, still is — a major contributing factor to Linux battery life on laptops taking a serious hit compared to their Windows counterparts... It's not just hardware accelerated video decoding. Gesture support has taken much longer to arrive on the Linux version than it did on the Windows version — things like using swipes to go back and forward, or pinch to zoom on images... I don't see anyone talking about this problem, or planning for the eventual possible demise of Firefox, what that would mean for the Linux desktop, and how it can be avoided or mitigated. In an ideal world, the major stakeholders of the Linux desktop — KDE, GNOME, the various major distributions — would get together and seriously consider a plan of action. The best possible solution, in my view, would be to fork one of the major browser engines (or pick one and significantly invest in it), and modify this engine and tailor it specifically for the Linux desktop. Stop living off the scraps and leftovers thrown across the fence from Windows and macOS browser makers, and focus entirely on making a browser engine that is optimised fully for Linux, its graphics stack, and its desktops. Have the major stakeholders work together on a Linux-first — or even Linux-only — browser engine, leaving the graphical front-end to the various toolkits and desktop environments.... I think it's highly irresponsible of the various prominent players in the desktop Linux community, from GNOME to KDE, from Ubuntu to Fedora, to seemingly have absolutely zero contingency plans for when Firefox enshittifies or dies...' -- source: https://news.slashdot.org/story/23/08/13/226217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Mozilla To Bring Firefox Desktop Extension To Android Browser
by Peter Reutemann 12 Aug '23

12 Aug '23

'Scott DeVaney, writing at Mozilla blog: In the coming months Mozilla will launch support for an open ecosystem of extensions on Firefox for Android on addons.mozilla.org (AMO). We'll announce a definite launch date in early September, but it's safe to expect a roll-out before the year's end. Here's everything developers need to know to get their Firefox desktop extensions ready for Android usage and discoverability on AMO. For the past few years Firefox for Android officially supported a small subset of extensions while we focused our efforts on strengthening core Firefox for Android functionality and understanding the unique needs of mobile browser users. Today, Mozilla has built the infrastructure necessary to support an open extension ecosystem on Firefox for Android. We anticipate considerable user demand for more extensions on Firefox for Android, so why not start optimizing your desktop extension for mobile-use right away?' -- source: https://news.slashdot.org/story/23/08/11/1234201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'The Open Source Licensing War is Over'
by Peter Reutemann 12 Aug '23

12 Aug '23

'It's time for the open source Rambos to stop fighting and agree that developers care more about software's access and ease of use than the purity of its license, reads a piece on InfoWorld. From the report: The open source war is over, however much some want to continue soldiering on. Recently Meta (Facebook) released Llama 2, a powerful large language model (LLM) with more than 70 billion parameters. In the past, Meta had restricted use of its LLMs to research purposes, but with Llama 2, Meta opened it up; the only restriction is that it can't be used for commercial purposes. Only a handful of companies have the computational horsepower to deploy it at scale (Google, Amazon, and very, very few others). This means, of course, it's not "open source" according to the Open Source Definition (OSD), despite Meta advertising it as such. This has a few open source advocates crying, Rambo style, "They drew first blood!" and "Nothing is over! Nothing! You just don't turn it off!", insistent that Meta stop calling Llama 2 "open source." They're right, in a pedantic sort of way, but they also don't seem to realize just how irrelevant their concerns are. For years developers have been voting with their GitHub repositories to pick "open enough." It's not that open source doesn't matter, but rather it has never mattered in the way some hoped or believed. More than 10 years ago, the trend toward permissive licensing was so pronounced that RedMonk analyst James Governor declared, "Younger [developers] today are about POSS -- post open source software. [Screw] the license and governance, just commit to GitHub." In response, people in the comments fretted and scolded, saying past trends like this had resulted in "epic clusterf-s" or that "promiscuous sharing w/out a license leads to software-transmitted diseases." And yet, millions of unlicensed GitHub repositories later, we haven't entered the dark ages of software licensing. Open source, or "open enough," software now finds its way into pretty much all software, however it ends up being licensed to the end user. Ideal? Perhaps not. But a fact of life? Yep. In response, GitHub and others have devised ways to entice developers to pick open source licenses to govern their projects. As I wrote back in 2014, all these moves will likely help, but the reality is that they also won't matter. They won't matter because "open source" doesn't really matter anymore. Not as some countercultural raging against the corporate software machine, anyway. All of this led me to conclude we're in the midst of the post-open source revolution, a revolution in which software matters more than ever, but its licensing matters less and less.' -- source: https://news.slashdot.org/story/23/08/11/1221250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The Eternal Sunshine Of The SEO-Focused Site
by Lawrence D'Oliveiro 11 Aug '23

11 Aug '23

This report <https://arstechnica.com/information-technology/2023/08/the-internet-is-not-…> says that CNET, and possibly other large sites, are deleting online archives of decades-old articles in an effort to improve their rankings with search engines like Google. Google, on the other hand, is saying that such behaviour makes no difference to their rankings. I found the closing paragraph particularly interesting: From time immemorial, the protection of historical content has required making many copies without authorization, regardless of the cultural or business forces at play, and that has not changed with the Internet. Archivists operate in a parallel IP universe, borrowing scraps of reality and keeping them safe until shortsighted business decisions and copyright protectionism die down. Hopefully, despite the link rot, future historians can piece together an accurate history of our fragile digital era. In there is a link to this item from the same author <https://www.technologizer.com/2012/01/23/why-history-needs-software-piracy/>, from over a decade ago, on “Why History Needs Software Piracy”: When viewed in a historical context, the benefits of software piracy far outweigh its short-term costs. If you care about the history of technology, in fact, you should be thankful that people copy software without permission.

1 0

Abuses Of AI #397: Pak’N’Save’s Savey-Meal Bot Goes Off The Rails
by Lawrence D'Oliveiro 11 Aug '23

11 Aug '23

I wonder whose bright idea it was to offer an AI-powered recipe advisor that offered free-text input <https://www.theregister.com/2023/08/11/supermarket_reins_in_ai_recipebot/>. So naturally somebody tried entering such hazardous ingredients as ammonia and bleach, to see if the bot would make up a recipe from them. Which it did. Complete with glowing recommendations like “the perfect non-alcoholic beverage to quench your thirst and refresh your senses. It combines the invigorating scents of ammonia, bleach, and water for a truly unique experience!" It has since been revised to be a bit more, ah, conservative with its suggestions, and also only allow selection from a limited list of ingredients. Though a reader suggests that the list restriction is only implemented within the HTML page itself, not in the actual back end.

1 0

Intel's GPU Drivers Now Collect Telemetry, Including 'How You Use Your Computer'
by Peter Reutemann 10 Aug '23

10 Aug '23

'ExtremeTech: Intel has introduced a telemetry collection service by default in the latest beta driver for its Arc GPUs. You can opt out of it, but we all know most people just click "yes" to everything during a software installation. Intel's release notes for the drivers don't mention this change to how its drivers work, which is a curious omission. News of Intel adding telemetry collection to its drivers is a significant change to how its GPU drivers work. Intel has even given this new collation routine a cute name -- the Intel Computing Improvement Program. Gee, that sounds pretty wonderful. We want to improve our computing, so let's dive into the details briefly. According to TechPowerUp, which discovered the change, Intel has created a landing page for the program that explains what is collected and what isn't. At a high level, it states, "This program uses information about your computer's performance to make product improvements that may benefit you in the future." Though that sounds innocuous, Intel provides a long list of the types of data it collects, many unrelated to your computer's performance. Those include the types of websites you visit, which Intel says are dumped into 30 categories and logged without URLs or information that identifies you, including how long and how often you visit certain types of sites. It also collects information on "how you use your computer" but offers no details. It will also identify "Other devices in your computing environment." Numerous performance-related data points are also captured, such as your CPU model, display resolution, how much memory you have, and, oddly, your laptop's average battery life. The good news is that Intel allows you to opt out of this program, which is not the case with Nvidia. According to TechPowerUp, they don't even ask for permission! As for AMD, they not only give you a choice to opt out but they also explain what data they're collecting.' -- source: https://yro.slashdot.org/story/23/08/09/2030205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Visual Studio Code flaw lets extensions steal passwords
by Peter Reutemann 10 Aug '23

10 Aug '23

'Microsoft's Visual Studio Code (VS Code) code editor and development environment contains a flaw that allows malicious extensions to retrieve authentication tokens stored in Windows, Linux, and macOS credential managers. These tokens are used for integrating with various third-party services and APIs, such as Git, GitHub, and other coding platforms, so stealing them could have significant consequences for a compromised organization's data security, potentially leading to unauthorized system access, data breaches, etc. The flaw was discovered by Cycode researchers, who reported it to Microsoft along with a working proof-of-concept (PoC) they developed. Yet, the tech giant decided against fixing the issue, as extensions are not expected to be sandboxed from the rest of the environment.' -- source: https://www.bleepingcomputer.com/news/security/microsoft-visual-studio-code… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bram Moolenaar, Author of the Open Source Vim Code Editor, Has Died
by Peter Reutemann 08 Aug '23

08 Aug '23

'The creator of one of the most popular programming editors of all time, Vim, has died after a brief illness. :wq. You may not have known Bram Moolenaar’s name, but all developers know his open source programming editor, Vim. His family has reported to the Vim announcement list that Moolenaar has died. According to the note, “Bram Moolenaar passed away on 3 August 2023.” Bram suffered from a medical condition that progressed quickly over the last few weeks.” No further details are available at this time. They added Bram had “dedicated a large part of his life to VIM, and he was very proud of the VIM community that you are all part of.” This is true. Under his guidance, Vim became one of the most popular code editors in the world. Vim was based on Unix’s Vi, a screen-oriented text editor created by Bill Joy that proved to be immensely popular. Indeed, it was my first editor. Its command set, while often used in jokes, is powerful. It’s still embedded in my fingers today. I’m far from the only programmer who can say that.' -- source: https://thenewstack.io/bram-moolenaar-author-of-the-open-source-vim-code-ed… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Qualcomm—one of Arm’s biggest customers—starts a RISC-V joint venture
by Peter Reutemann 07 Aug '23

07 Aug '23

'Arm is facing down its biggest competition ever, with the up-and-coming RISC-V architecture threatening to unseat it as the CPU at the center of almost every portable device. Now, one of Arm's biggest customers is trying out RISC-V, as Qualcomm is getting involved in a joint venture dedicated to the architecture. The joint venture doesn't have a name yet, but Qualcomm, NXP, Nordic Semiconductor, Bosch, and memory giant Infineon are all teaming up to form a new company that Qualcomm's press release says is "aimed at advancing the adoption of RISC-V globally by enabling next-generation hardware development." At first, the group will be focused on automotive uses, with an "eventual expansion" to IoT and mobile, Qualcomm's biggest market. Arm doesn't manufacture any chips itself and instead exists as a design and licensing operation. It licenses both the Arm architecture, allowing companies to design an Arm-compatible chip themselves (this is what Apple does), and it also licenses completed CPU designs, allowing partners like Qualcomm, Samsung, and MediaTek to produce new SoCs year after year. Previously, we would have said Qualcomm's "next-generation hardware" project revolves around its acquisition of Nuvia, a chip design house that was founded by ex-SoC engineers from Apple, which currently makes the fastest mobile ARM chips available. Qualcomm's CPUs all use Arm's designs, and they are regularly a generation or two behind what Apple can do. If Nuvia lives up to its potential, Qualcomm's Arm chips would finally be competitive. The company says chips from Nuvia are expected to hit the market in 2024 for PCs, so Qualcomm will be sticking with Arm for a while longer. Qualcomm's "Snapdragon Automotive" products are usually based on 5-year-old phone designs, but it sounds like that's changing. A RISC-V transition, if one ever comes, is a few years down the line. RISC-V is threatening Arm for a few reasons. First is its open source licensing, which potentially lets companies avoid the fees Arm charges to make any chip compatible with its instruction set. Second is that RISC-V is also a way for companies to insulate themselves from Arm, which has become an increasingly unstable hardware partner. Arm is at the center of most mobile devices, but it doesn't make a ton of money off of this licensing business. ' -- source: https://arstechnica.com/gadgets/2023/08/qualcomm-one-of-arms-biggest-custom… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Asahi Linux’s new “flagship” distro for M-series Macs is a Fedora Remix
by Peter Reutemann 07 Aug '23

07 Aug '23

'Asahi Linux, the project aiming to bring a fully functional Linux system to Apple computers running on that company's own M-series chips, has announced that its new "flagship distro" is Fedora Asahi Remix. As announced at Fedora's Flock conference this week in Cork, Ireland, (and on Asahi Linux's blog), the Fedora Asahi Remix should be officially released by the end of August 2023. You can try it out now, but you should "expect rough spots (or even complete breakage)." The new distro will be "upstream-first," sending as many of its bespoke M-series tools back to Fedora's mainline offerings as possible. Hector Martin, writing on Asahi Linux's blog, notes that the existing project based on Arch Linux was "fully downstream." Asahi added its own package repository with scripts, forked kernel and Mesa packages, bootloader parts, and userspace support, but with "no significant involvement with upstream Arch Linux ARM or Arch Linux." Neal Gompa from Fedora reached out to talk about integrating Asahi with Fedora after the project's debut, and work began in late 2021. Now it's ready to spread a bit further. "Collaborating with distro integration experts and using distro infra(structure) like this frees us up to continue focusing on what we do best: reverse engineer hardware and develop bespoke drivers and software," Martin writes. Integration with a well-established distribution also means that bugs in desktop ARM64 Linux, "a niche platform (until now!)," Martin writes, can be addressed more quickly.' -- source: https://arstechnica.com/gadgets/2023/08/asahi-linux-will-offer-a-flagship-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The State Of ARM
by Lawrence D'Oliveiro 06 Aug '23

06 Aug '23

Everybody knows that ARM dominates the embedded market, where it ships more units per year than the entire population of the Earth. But it is making inroads in, shall we say, more “niche” markets, too, like PCs and servers. According to this <https://www.theregister.com/2023/08/02/arm_server_china/>, Canalys boss Steve Brazier says ARM already makes up 16% of the public cloud (and an even higher proportion of servers in China). But another interesting figure he mentions is “nine percent of PCs”. Now, we know that Windows-on-ARM is not that popular. Therefore, that 9% must be almost entirely running Linux-based OSes, including ChromeOS.

2 4

Linux Surpasses Mac Among Steam Gamers
by Lawrence D'Oliveiro 06 Aug '23

06 Aug '23

Windows dominates non-console gaming, of course. But according to this report <https://arstechnica.com/gadgets/2023/08/linux-surpasses-the-mac-among-steam…>, the number 2 platform (or platform family) is Linux, admittedly quite a way behind at 1.96%, ahead of the Apple Mac at 1.84%. Of the Linux share, 42% is made up of users of the Steam Deck, which is a handheld device (presumably the rest come from the various more conventional desktop distros). Microsoft has taken note of this, and is reportedly working on a “Handheld Mode” for Windows, which so far is still vapourware. Apple is also trying to do its own porting kit for Windows games to run better on Mac, analogous to WINE/Proton for Linux.

1 0

Canon Warns Printer Users To Manually Wipe Wi-Fi Settings Before Discarding
by Peter Reutemann 03 Aug '23

03 Aug '23

'Printer manufacturer Canon is warning that sensitive Wi-Fi settings don't automatically get wiped during resets, so customers should manually delete them before selling, discarding, or getting them repaired to prevent the settings from falling into the wrong hands. >From a report: "Sensitive information on the Wi-Fi connection settings stored in the memories of inkjet printers (home and office/large format) may not be deleted by the usual initialization process," company officials wrote in an advisory on Monday. They went on to say that manual wiping should occur "when your printer may be in the hand of any third party, such as when repairing, lending or disposing the printer." Like many printers these days, those from Canon connect to networks over Wi-Fi. To do this, users must provide the SSID name, the password preventing unauthorized access to the network, and in some cases, additional information such as Wi-Fi network type, the local network IP address, the MAC address, and network profile. It would be reasonable to assume that performing a simple factory reset that returns all settings to their defaults would be enough to remove these settings, but Monday's advisory indicated that isn't necessarily the case. In the event this information is exposed, malicious actors could use them to gain unauthorized access to a network hosting a Canon printer.' -- source: https://hardware.slashdot.org/story/23/08/02/116218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AWS To Start Charging For Public IPv4 Addresses
by Peter Reutemann 01 Aug '23

01 Aug '23

'The Register: Cloud giant AWS will start charging customers for public IPv4 addresses from next year, claiming it is forced to do this because of the increasing scarcity of these and to encourage the use of IPv6 instead. It is now four years since we officially ran out of IPv4 ranges to allocate, and since then, those wanting a new public IPv4 address have had to rely on address ranges being recovered, either from from organizations that close down or those that return addresses they no longer require as they migrate to IPv6. If Amazon's cloud division is to be believed, the difficulty in obtaining public IPv4 addresses has seen the cost of acquiring a single address rise by more than 300 percent over the past five years, and as we all know, the business is a little short of cash at the moment, so is having to pass these costs on to users. "This change reflects our own costs and is also intended to encourage you to be a bit more frugal with your use of public IPv4 addresses and to think about accelerating your adoption of IPv6 as a modernization and conservation measure,' writes AWS Chief Evangelist Jeff Barr, on the company news blog. The update will come into effect on February 1, 2024, when AWS customers will see a charge of $0.005 (half a cent) per IP address per hour for all public IPv4 addresses. These charges will apparently apply whether the address is attached to a service or not, and like many AWS charges, appear inconsequential at first glance but can mount up over time if a customer is using many of them. These charges will apply to all AWS services including EC2, Relational Database Service (RDS) database instances, Elastic Kubernetes Service (EKS) nodes, and will apply across all AWS regions, the company said. However, customers will not be charged for IP addresses that they own and bring to AWS using Amazon's BYOIP feature. AWS offers a free tier for EC2, and this will include 750 hours of public IPv4 address usage per month for the first 12 months, starting from the same date the charges do.' -- source: https://tech.slashdot.org/story/23/08/01/0013249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Python’s GIL, a “major obstacle to concurrency”, will likely be removed – but slowly
by Lawrence D'Oliveiro 01 Aug '23

01 Aug '23

The Python Steering Council has officially decided on a roadmap for removing a major bottleneck to multithreading performance in Python <https://devclass.com/2023/07/31/pythons-gil-a-major-obstacle-to-concurrency…>. Currently Python uses a combination of reference-counting and garbage collection in order to avoid the need for programmers to have to keep track of allocated objects and remembering when to dispose of them. A pure garbage collection scheme, like in Java or LISP, makes it easier to support multithreading, but at the cost of memory usage that can easily get out of hand. Reference counting helps to ensure that objects disappear as soon as the program forgets its last reference to them, and this works well for most objects in a typical program, with garbage collection as a fallback for cleaning up the rest. But Python’s present scheme for maintaining reference counts (the “Global Interpeter Lock” or “GIL”) prevents Python code for taking full advantage of multiple threads. Some are advocating switching to the pure garbage-collection approach, but fortunately (I think) this is not the plan that has been adopted by the Council. Instead, they are going to use a technique known as “Biased Reference Counting”. This splits the reference count into two components, one managed by a thread which is considered to “own” the object (and is presumably responsible for most accesses to the object), while the other is managed on a shared basis by other threads accessing the object (and making fewer accesses to it). This seems to offer the best performance in tests so far. The switchover is a complicated procedure, which is certain to have implications for some existing Python code that never had to worry about thread safety before, as well as far-reaching implications for the design of the CPython implementation itself. So it will take place in multiple stages over some years, and if worst comes to worst, the changes can always be rolled back. (Or a different strategy chosen.) Seems some people are still smarting over the flak they got from the Python 2 → 3 transition. “This is not Python 4,” they are saying. But why not call it “Python 4”, as a warning over the likely compatibility issues? Even if it probably won’t be quite as painful ...

1 0

Android malware steals user credentials using optical character recognition
by Peter Reutemann 31 Jul '23

31 Jul '23

'Security researchers have unearthed a rare malware find: malicious Android apps that use optical character recognition to steal credentials displayed on phone screens. The malware, dubbed CherryBlos by researchers from security firm Trend Micro, has been embedded into at least four Android apps available outside of Google Play, specifically on sites promoting money-making scams. One of the apps was available for close to a month on Google Play but didn’t contain the malicious CherryBlos payload. The researchers also discovered suspicious apps on Google Play that were created by the same developers, but they also didn’t contain the payload. The apps took great care to conceal their malicious functionality. They used a paid version of commercial software known as Jiagubao to encrypt code and code strings to prevent analysis that can detect such functionality. They also featured techniques to ensure the app remained active on phones that had installed it. When users opened legitimate apps for Binance and other cryptocurrency services, CherryBlos overlaid windows that mimicked those of the legitimate apps. During withdrawals, CherryBlos replaced the wallet address the victim selected to receive the funds with an address controlled by the attacker. The most interesting aspect of the malware is its rare, if not novel, feature that allows it to capture mnemonic passphrases used to gain access to an account. When the legitimate apps display passphrases on phone screens, the malware first takes an image of the screen and then uses OCR to translate the image into a text format that can be used to raid the account. “Once granted, CherryBlos will perform the following two tasks: 1. Read pictures from the external storage and use OCR to extract text from these pictures [and] 2. Upload the OCR results to the C&C server at regular intervals,” the researchers wrote. Most apps related to banking and finance use a setting that prevents the taking of screenshots during sensitive transactions. CherryBlos appears to bypass such restrictions by obtaining accessibility permissions used by people with vision impairments or other types of disabilities.' -- source: https://arstechnica.com/security/2023/07/android-malware-uses-ocr-to-captur… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME Devs Are Working on a New Window Management System
by Peter Reutemann 31 Jul '23

31 Jul '23

'Managing windows — "even after 50 years, nobody's fully cracked it yet," writes GNOME developer Tobias Bernard: Most of the time you don't care about exact window sizes and positions and just want to see the windows that you need for your current task. Often that's just a single, maximized window. Sometimes it's two or three windows next to each other. It's incredibly rare that you need a dozen different overlapping windows. Yet this is what you end up with by default today, when you simply use the computer, opening apps as you need them. Messy is the default, and it's up to you to clean it up... We've wanted more powerful tiling for years, but there has not been much progress due to the huge amount of work involved on the technical side and the lack of a clear design direction we were happy with. We now finally feel like the design is at a stage where we can take concrete next steps towards making it happen, which is very exciting! The key point we keep coming back to with this work is that, if we do add a new kind of window management to GNOME, it needs to be good enough to be the default. We don't want to add yet another manual opt-in tool that doesn't solve the problems the majority of people face. The current concept imagines three possible layout states for windows: - Floating, the classic stacked windows model - Edge Tiling, i.e. windows splitting the screen edge-to-edge - Mosaic, a new window management mode which combines the best parts of tiling and floating Mosaic is the default — where "you open a window, it opens centered on the screen at a size that makes the most sense for the app." (Videos in the blog post show how this works.) "As you open more windows, the existing windows move aside to make room for the new ones. If a new window doesn't fit (e.g. because it wants to be maximized) it moves to its own workspace. If the window layout comes close to filling the screen, the windows are automatically tiled." You can also manually tile windows. If there's enough space, other windows are left in a mosaic layout. However, if there's not enough space for this mosaic layout, you're prompted to pick another window to tile alongside. You're not limited to tiling just two windows side by side. Any tile (or the remaining space) can be split by dragging another window over it, and freely resized as the window minimum sizes allow. So what's next? Windows can already set a fixed size and they have an implicit minimum size, but to build a great tiling experience we need more... At the Brno hackfest in April we had an initial discussion with GNOME Shell developers about many of the technical details. There is tentative agreement that we want to move in the direction outlined in this post, but there's still a lot of work ahead... We'd like to do user research to validate some of our assumptions on different aspects of this, but it's the kind of project that's very difficult to test outside of an actual prototype that's usable day to day. "There's another issue with GNOME's current windowing system," notes 9to5Linux. "If the stacking is interrupted, newly opened windows will be opened from the top, covering the first opened window." For this new windowing system to become a reality, the GNOME devs would have to do a lot of user research and test numerous scenarios so that everyone can be happy. As you can imagine, this could take months or even years, so if you want to get involved and help them do it faster, please reach out to the GNOME team here.' -- source: https://tech.slashdot.org/story/23/07/30/2357246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Libreboot Creator Says After Coding a Fork for 'GNU Boot Project', FSF Sent a Cease-and-Desist Letter Over Its Name
by Peter Reutemann 31 Jul '23

31 Jul '23

'Libreboot is a distribution of coreboot "aimed at replacing the proprietary BIOS firmware contained by most computers," according to Wikipedia. It was briefly part of the GNU project, until maintainer Leah Rowe and the GNU project agreed to part ways in 2017. But here in 2023, the GNU project has created a fork of Libreboot named GNU Boot... The GNU Boot fork "currently does not have a website and does not have any releases of its own," points out Libreboot's Leah Rowe, adding "My intent is to help them, and they are free — encouraged — to re-use my work... " But things have gotten messy, writes Rowe: They forked Libreboot, due to disagreement with Libreboot's Binary Blob Reduction Policy. This is a pragmatic policy, enacted in November 2022, to increase the number of coreboot users by increasing the amount of hardware supported in Libreboot... I wish GNU Boot all the best success. Truly. Although I think their project is entirely misguided (for reasons explained by modern Libreboot policy), I do think there is value in it. It provides continuity for those who wish to use something resembling the old Libreboot project... When GNU Boot first launched, as a failed hostile fork of Libreboot under the same name, I observed: their code repository was based on Libreboot from late 2022, and their website based on Libreboot in late 2021. Their same-named Libreboot site was announced during LibrePlanet 2023... [N]ow they are calling themselves GNU Boot, and it is indeed GNU, but it still has the same problem as of today: still based on very old Libreboot, and they don't even have a website. According to [the FSF's Savannah software repository], GNU Boot was created on 11 June 2023. Yet no real development, in over a month since then... I've decided that I want to help them... I decided recently that I'd simply make a release for them, exactly to their specifications (GNU Free System Distribution Guidelines), talking favourably about FSF/GNU, and so on. I'm in a position to do it (thus scratching the itch), so why not? I did this release for them — it's designated non-GeNUine Boot 20230717, and I encourage them to re-use this in their project, to get off the ground. This completely leapfrogs their current development; it's months ahead. Months. It's 8 months ahead, since their current revision is based upon Libreboot from around ~October 2022... The GNU Boot people actually sent me a cease and desist email, citing trademark infringement. Amazing... I complied with their polite request and have renamed the project to non-GeNUine Boot. The release archive was re-compiled, under this new brand name and the website was re-written accordingly. Personally, I like the new name better.' -- source: https://news.slashdot.org/story/23/07/30/0312206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Building a Better Server? Oxide Computer Ships Its First Rack
by Peter Reutemann 30 Jul '23

30 Jul '23

'Oxide Computer Company spent four years working toward "The power of the cloud in your data center... bringing hyperscaler agility to the mainstream enterprise." And on June 30, Oxide finally shipped its very first server rack. Long-time Slashdot reader destinyland shares this report: It's the culmination of years of work — to fulfill a long-standing dream. In December of 2019, Oxide co-founder Jess Frazelle had written a blog post remembering conversations over the year with people who'd been running their own workloads on-premises... "Hyperscalers like Facebook, Google, and Microsoft have what I like to call 'infrastructure privilege' since they long ago decided they could build their own hardware and software to fulfill their needs better than commodity vendors. We are working to bring that same infrastructure privilege to everyone else!" Frazelle had seen a chance to make an impact with "better integration between the hardware and software stacks, better power distribution, and better density. It's even better for the environment due to the energy consumption wins." Oxide CTO Bryan Cantrill sees real problems in the proprietary firmware that sits between hardware and system software — so Oxide's server eliminates the BIOS and UEFI altogether, and replaces the hardware-managing baseboard management controller (or BMC) with "a proper service processor." They even wrote their own custom, all-Rust operating system (named Hubris). On the Software Engineering Daily podcast, Cantrill says "These things boot like a rocket." And it's all open source. "Everything we do is out there for people to see and understand..." Cantrill added. On the Changelog podcast Cantrill assessed its significance. "I don't necessarily view it as a revolution in its own right, so much as it is bringing the open source revolution to firmware." Oxide's early funders include 92-year-old Pierre Lamond (who hired Andy Grove at Fairchild Semiconductor) — and customers who supported their vision. On Software Engineering Daily's podcast Cantrill points out that "If you're going to use a lot of compute, you actually don't want to rent it — you want to own it."' -- source: https://news.slashdot.org/story/23/07/29/192248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Encryption-breaking, password-leaking bug in many AMD CPUs could take months to fix
by Peter Reutemann 26 Jul '23

26 Jul '23

'A recently disclosed bug in many of AMD's newer consumer, workstation, and server processors can cause the chips to leak data at a rate of up to 30 kilobytes per core per second, writes Tavis Ormandy, a member of Google's Project Zero security team. Executed properly, the so-called "Zenbleed" vulnerability (CVE-2023-20593) could give attackers access to encryption keys and root and user passwords, along with other sensitive data from any system using a CPU based on AMD's Zen 2 architecture. The bug allows attackers to swipe data from a CPU's registers. Modern processors attempt to speed up operations by guessing what they'll be asked to do next, called "speculative execution." But sometimes the CPU guesses wrong; Zen 2 processors don't properly recover from certain kinds of mispredictions, which is the bug that Zenbleed exploits to do its thing. The bad news is that the exploit doesn't require physical hardware access and can be triggered by loading JavaScript on a malicious website. The good news is that, at least for now, there don't seem to be any cases of this bug being exploited in the wild yet, though this could change quickly now that the vulnerability has been disclosed, and the bug requires precise timing to exploit. "AMD is not aware of any known exploit of the described vulnerability outside the research environment," the company told Tom's Hardware. Networking company Cloudflare also says there is "no evidence of the bug being exploited" on its servers. Since the vulnerability is in the hardware, a firmware update from AMD is the best way to fully fix it; Ormandy says it is also fixable via a software update, but it "may have some performance cost." The bug affects all processors based on AMD's Zen 2 architecture, including several Ryzen desktop and laptop processors, EPYC 7002-series chips for servers, and Threadripper 3000- and 3000 Pro WX-series CPUs for workstations.' -- source: https://arstechnica.com/information-technology/2023/07/encryption-breaking-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 4.4 KitKat is truly dead, loses Play Services support
by Peter Reutemann 26 Jul '23

26 Jul '23

'The Android ecosystem rightfully gets a lot of slack for being unable to deliver operating system updates to everyone in a timely manner, but there's more to Android updates than just OS support. App updates can keep a phone chugging along even after the updates have stopped, and Google's do-it-all super app, Google Play Services, contains a ton of app APIs and features and enables the really important stuff like Play Store transactions and advertisements. Google just announced Play Services is dropping support for an old version of Android, and while OS development might stop at just three or four years, Play Services goes back way longer than that. Google announced Play Services is dropping support for Android 4.4 KitKat, which is now 10 years old. Support isn't really being artificially cut off, either. Google says KitKat's active device count is "below 1 percent," so there's not much reason to support it anymore.' -- source: https://arstechnica.com/gadgets/2023/07/google-drops-play-services-support-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slackware Linux Distribution Turns 30 Years Old
by Peter Reutemann 24 Jul '23

24 Jul '23

'This week the Slackware Linux project is celebrating its 30th anniversary. It is the oldest Linux distribution that is still in active maintenance and development. The Register reports: Version 1.0 of Slackware was announced on the July 16, 1993, and project lead Patrick Volkerding, who still maintains the distribution today, celebrated with a modest announcement: "Hey folks! It's time to acknowledge another one of those milestones... 30 (!) years since I made the post linked below announcing Slackware's first stable release after months of beta testing. Thanks to all of our dedicated contributors, loyal users, and those who have helped us to keep the lights on here. It's really been a remarkable journey that I couldn't have anticipated starting out back in 1993. Cheers! :-)"' -- source: https://linux.slashdot.org/story/23/07/21/2138223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firmware vulnerabilities in millions of computers could give hackers superuser status
by Peter Reutemann 21 Jul '23

21 Jul '23

'Two years ago, ransomware crooks breached hardware-maker Gigabyte and dumped more than 112 gigabytes of data that included information from some of its most important supply-chain partners, including Intel and AMD. Now researchers are warning that the leaked information revealed what could amount to critical zero-day vulnerabilities that could imperil huge swaths of the computing world. The vulnerabilities reside inside firmware that Duluth, Georgia-based AMI makes for BMCs (baseboard management controllers). These tiny computers soldered into the motherboard of servers allow cloud centers, and sometimes their customers, to streamline the remote management of vast fleets of computers. They enable administrators to remotely reinstall OSes, install and uninstall apps, and control just about every other aspect of the system—even when it's turned off. BMCs provide what’s known in the industry as “lights-out” system management. Lights-out forever Researchers from security firm Eclypsium analyzed AMI firmware leaked in the 2021 ransomware attack and identified vulnerabilities that had lurked for years. They can be exploited by any local or remote attacker with access to an industry-standard remote-management interface known as Redfish to execute malicious code that will run on every server inside a data center. Until the vulnerabilities are patched using an update AMI published on Thursday, they provide a means for malicious hackers—both financially motivated or nation-state sponsored—to gain superuser status inside some of the most sensitive cloud environments in the world. From there, the attackers could install ransomware and espionage malware that runs at some of the lowest levels inside infected machines. Successful attackers could also cause physical damage to servers or indefinite reboot loops that a victim organization can’t interrupt. Eclypsium warned such events could lead to “lights out forever” scenarios.' -- source: https://arstechnica.com/security/2023/07/millions-of-servers-inside-data-ce… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kevin Mitnick, Hacker Who Once Eluded Authorities, is Dead at 59
by Peter Reutemann 21 Jul '23

21 Jul '23

'Kevin Mitnick, once the so-called "most wanted computer criminal in US history," died on Sunday. He was 59. The New York Times adds: The cause was complications from pancreatic cancer. He had been undergoing treatment at the University of Pittsburgh Medical Center following his diagnosis more than a year ago, according to the King David Memorial Chapel & Cemetery in Las Vegas. After serving prison time for breaking into and tampering with corporate computer networks, he was released in 2000 and began a new career as a security consultant, writer and public speaker. Mr. Mitnick was best known for the crime spree during the 1990s that involved the theft of thousands of data files and credit card numbers from computers across the country. He used his skills to work his way into the nation's phone and cell networks, vandalizing government, corporate and university computer systems. Investigators at the time named him the "most wanted" computer hacker in the world. In 1995, after a more than two-year-long manhunt, Mr. Mitnick was captured by the F.B.I. and charged with the illegal use of a telephone access device and computer fraud. "He allegedly had access to corporate trade secrets worth millions of dollars. He was a very big threat," Kent Walker, a former assistant U.S. attorney in San Francisco, said at the time. In 1998, while Mr. Mitnick awaited sentencing, a group of supporters commandeered The New York Times website for several hours, forcing it to shut down. The next year, Mr. Mitnick pleaded guilty to computer and wire fraud as part of an agreement with prosecutors and was sentenced to 46 months in prison. He was also prohibited from using a computer or cellphone without the permission of his probation officer for the three years following his release. >From an obituary: Kevin was an original; much of his life reads like a fiction story. The word that most of us who knew him would use -- magnificent. He grew up brilliant and restless in the San Fernando Valley in California, an only child with a penchant for mischief, a defiant attitude toward authority, and a love for magic. Kevin's intelligence and delight in holding the rapt attention of audiences revealed themselves early in his childhood and continued throughout his life. In time, he transitioned from pranks and learning magic tricks to phone phreaking, social engineering, and computer hacking. When his desire to push boundaries led him too far astray, he landed in juvenile detention and eventually served a couple of stints in prison. His time on the FBI's Most Wanted List was well documented in his New York Times bestselling book, The Ghost in the Wires: My Adventures as the World's Most Wanted Hacker, and his other titles: The Art of Deception, The Art of Intrusion, both co-authored with William Simon, and The Art of Invisibility with Robert Vamosi. Kevin emerged from his final prison term, which he deemed a 'vacation,' in January 2000. He was a changed individual, and began constructing a new career, as a White Hat hacker and security consultant. He became a highly sought-after global public speaker, a writer, and established the successful Mitnick Security Consulting. In November 2011, he became the Chief Hacking Officer and part owner of security awareness training company KnowBe4, founded by close friend and business partner Stu Sjouwerman.' -- source: https://news.slashdot.org/story/23/07/20/031216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fear, loathing, and excitement as Threads adopts open standard used by Mastodon
by Peter Reutemann 20 Jul '23

20 Jul '23

'Days after Meta launched its new app, Threads, this month, a software engineer at the company named Ben Savage introduced himself to a developer group at the World Wide Web Consortium, a web standards body. The group, which maintains a protocol for connecting social networks called ActivityPub, had been preparing for this moment for months, ever since rumors first emerged that Meta planned to join the standard. Now, that moment had arrived. “I'm really interested to see how this interoperable future plays out!” he wrote. Warm replies to Savage’s email filtered in. And then came another response: “The company you work for does disgusting things among others. It harms relationships and isolates people. It builds walls and lures people into them. When that doesn't suffice, brutal peer pressure does … That said, welcome to the list, Ben.” Meta’s embrace of ActivityPub, used by apps including the Twitter-like Mastodon, was bound to be a little awkward. The constellation of small apps and personal servers that currently use the protocol, known as the Fediverse, is marked by an ethos of sharing and openness, not profit-seeking or user bases denominated in the billions. ActivityPub is designed to allow users of different apps to not only interact and view each others’ content, but also move their digital identity from one service to another. Mastodon, the largest app in the Fediverse, is open source and run by a nonprofit, and smaller Fediverse apps like PeerTube and Lemmy are often held up as a repudiation of the closed nature of services such as YouTube or Reddit. Corporations like Meta are typically held up as the enemy. No surprise that, despite appeals from ActivityPub leaders for civility when Meta arrived on the listserv, some couldn’t hold their tongue. Weeks-old Threads already dwarfs the Fediverse, which has been around for more than a decade and recently peaked at about 4 million active monthly users. Some Fediverse fans see that imbalance as a win: Suddenly, the network could become many times more relevant. Others consider that view naive and expect Meta’s size to push the small world of apps built on ActivityPub in undesirable directions. Some have circulated a pact to preemptively block content from Threads’ servers from appearing on their own.' -- source: https://arstechnica.com/tech-policy/2023/07/fear-loathing-and-excitement-as… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions of Emails meant for US Military Recipients Have Been Going To Mali
by Lawrence D'Oliveiro 18 Jul '23

18 Jul '23

Seems like, for the last decade, way too many emails meant for .mil addresses have been going to .ml instead <https://www.theregister.com/2023/07/18/us_military_mali_email_typos/>. The guy who runs the .ml DNS registry for the Mali Government has been trying to notify the offenders about their mistakes, with limited success. It seems to me an obvious solution is to stop using that top-level .mil, and change it to something like .mil.us instead.

1 0

Decentralized Operating System - GRIDNET OS
by john 18 Jul '23

18 Jul '23

This post just arrived at a forum I use, It seems a bit above my pay level. https://www.cybertechhelp.com/showthread.php?p=1312176#post1312176 Cheers John..

1 0

Is Wayland Becoming the Favored Way to Get a GUI on Linux?
by Peter Reutemann 18 Jul '23

18 Jul '23

'The Register shares its collection of "signs that Wayland is becoming the favored way to get a GUI on Linux." - The team developing Linux for Apple Silicon Macs said they didn't have the manpower to work on X.org support. - A year ago, the developers of the Gtk toolkit used by many Linux apps and desktops said that the next version may drop support for X11... - One of the developers of the Budgie desktop, Campbell Jones, recently published a blog post with a wildly controversial title that made The Reg FOSS desk smile: "Wayland is pretty good, actually." He lays out various benefits that Wayland brings to developers, and concludes: "Primarily, what I've learned is that Wayland is actually really well-designed. The writing is on the wall for X, and Wayland really is the future." Partly as a result of this, it looks likely that the next version of the Budgie desktop, Budgie 11, will only support Wayland, completely dropping support for X11. The team point out that this is not such a radical proposition: there was a proposal to make KDE 6 sessions default to Wayland as long ago as last October... - The GNOME spin of Fedora has defaulted to Wayland since version 25 in 2017, and the GNOME flavor of Ubuntu since 21.04. - [T]here's now an experimental effort to get Wayland working on OpenBSD. The effort happened at the recent OpenBSD hackathon in Tallinn, Estonia, and the developer's comments are encouraging. It's already available as part of FreeBSD.' -- source: https://linux.slashdot.org/story/23/07/17/0159246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WordPress plugin installed on 1 million+ sites logged plaintext passwords
by Peter Reutemann 17 Jul '23

17 Jul '23

'All-In-One Security, a WordPress security plugin installed on more than 1 million websites, has issued a security update after being caught three weeks ago logging plaintext passwords and storing them in a database accessible to website admins. The passwords were logged when users of a site using the plugin, typically abbreviated as AIOS, logged in, the developer of AIOS said Thursday. The developer said the logging was the result of a bug introduced in May in version 5.1.9. Version 5.2.0 released Thursday fixes the bug and also “deletes the problematic data from the database.” The database was available to people with administrative access to the website.' -- source: https://arstechnica.com/security/2023/07/wordpress-plugin-installed-on-1-mi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AlmaLinux No Longer Aims For 1:1 Compatibility With RHEL
by Peter Reutemann 17 Jul '23

17 Jul '23

'Phoronix: With Red Hat now restricting access to the RHEL source repositories, AlmaLinux and other downstreams that have long provided "community" rebuilds of Red Hat Enterprise Linux with 1:1 compatibility to upstream RHEL have been left sorting out what to do. Benny Vasquez, Chair of the Board for the AlmaLinux OS Foundation, wrote in a blog post yesterday: After much discussion, the AlmaLinux OS Foundation board today has decided to drop the aim to be 1:1 with RHEL. AlmaLinux OS will instead aim to be Application Binary Interface (ABI) compatible*. We will continue to aim to produce an enterprise-grade, long-term distribution of Linux that is aligned and ABI compatible with RHEL in response to our community's needs, to the extent it is possible to do, and such that software that runs on RHEL will run the same on AlmaLinux. For a typical user, this will mean very little change in your use of AlmaLinux. Red Hat-compatible applications will still be able to run on AlmaLinux OS, and your installs of AlmaLinux will continue to receive timely security updates. The most remarkable potential impact of the change is that we will no longer be held to the line of "bug-for-bug compatibility" with Red Hat, and that means that we can now accept bug fixes outside of Red Hat's release cycle. While that means some AlmaLinux OS users may encounter bugs that are not in Red Hat, we may also accept patches for bugs that have not yet been accepted upstream, or shipped downstream." ' -- source: https://linux.slashdot.org/story/23/07/14/215209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When Open Becomes Opaque: the Changing Face of Open-Source Hardware Companies
by Peter Reutemann 17 Jul '23

17 Jul '23

'A thoughtful post on the Adafruit Blog chronicles the problems facing open-source hardware companies, and how more and more companies, including Sparkfun, Arduino and Prusa, are becoming more and more proprietary. In Arduino's case, they are deliberately trying to stamp out the clones undercutting them. The new Arduino Pro is not open source in any way, and the web site has now removed references to being an open source company. As always there are subtleties and nuances. In the case of Prusa, not only are Chinese companies taking Prusa designs and source to make proprietary, closed-source products, they are also actively patenting designs and algorithms they've taken from open source. The original submission ends with a question. "With Red Hat recently taking a step towards becoming a proprietary software company (which happens to use and work on open source projects) and now these reports, what are Slashdotters' thoughts on the future? "Are truly open source companies doomed to failure, especially when overseas companies do not respect or even understand the principles of open source development?"' -- source: https://news.slashdot.org/story/23/07/15/1853247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Speed Versus Bandwidth
by Lawrence D'Oliveiro 16 Jul '23

16 Jul '23

Love the (original) opening sentence of this article <https://arstechnica.com/gadgets/2023/07/light-based-lifi-promises-amazing-w…>: Light is almost certainly the fastest thing around. So it makes sense that "light-based wireless communications," or LiFi, could blow the theoretical doors off existing radio-wave wireless standards, to the tune of a maximum 224GB per second. A correction/clarification immediately follows, but it’s clear the writer didn’t quite grasp that both visible light and radio waves are propagated by exactly the same particles--photons--travelling at exactly the same speed. What is true is that, as the frequency of the photons increases, so does their information-carrying capacity. This is why we have digital broadcasts (TV particularly), mobile phone/data services and our own wi-fi networks all moving to higher and higher frequencies. The downside is, as the frequency of a photon increases, so does its energy. And so it tends to react more and more with (i.e. be absorbed by) various bits of matter that it might encounter--such as the walls of buildings, or even the air itself. This tends to limit the useful range of these communication bands.

1 0

Torvalds Calls For Calm as Bcachefs Filesystem Doesn't Make Linux 6.5
by Peter Reutemann 11 Jul '23

11 Jul '23

'Linus Torvalds has delivered the first release candidate for version 6.5 of the Linux kernel, but warned this release may not go entirely smoothly. From a report: Torvalds's headline assessment of rc1 is "none of it looks hugely unusual." "The biggest single mention probably goes to what wasn't merged, with the bcachefs pull request resulting in a long thread (we didn't hit a hundred emails yet, but it's not far away)." As The Register reported in 2022, bcachefs is a filesystem that's been in development for nigh on a decade without being added to the kernel. Kernel-watching outlet Phoronix on Sunday wrote that the filesystem is in good shape but debate over "code changes needed to the kernel outside of the kernel module itself" have proved contentious. As a result, conversation on the Linux kernel mailing list is "often becoming heated" when the topic turns to bcachefs. In his announcement post for rc1, Torvalds wrote "Let's calm this party down."' -- source: https://linux.slashdot.org/story/23/07/10/2042253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fairphone 3 Gets Seven Years of Updates, Besting Every Other Android OEM
by Peter Reutemann 11 Jul '23

11 Jul '23

'Ars Technica: No one in the Android ecosystem can hold a candle to Apple's software support timeline for the iPhone, but there is one company that comes the closest: Fairphone. Following in the footsteps of the Fairphone 2, the Fairphone 3 is also getting an Android-industry-best seven years of OS support. Fairphone continues to run circles around giant tech companies that have a lot more resources than it does, and it's doing this even in the face of component vendors like Qualcomm dropping support for the phone's core components. The company announced today that the Fairphone 3, which was released in 2019, has had its support extended to 2026, making for seven years of updates. The company also just released Android 13 for the Fairphone 3. Google's own 2019 phone, the Pixel 4, shut down support in October 2022. Fairphone strives to make sustainable smartphones, designing its products to be repairable and also offering replacement parts for sale online. Part of that sustainability mission is an absolutely herculean effort to keep the Android updates flowing, even when Qualcomm drops critical software support for the SoC. Fairphone says the Snapdragon 632 SoC in the Fairphone 3 was only supported up to Android 11, so continuing to support the Fairphone 3 meant doing the upgrades all by itself.' -- source: https://tech.slashdot.org/story/23/07/10/213256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

CERT To Be Merged Into GCSB?
by Lawrence D'Oliveiro 10 Jul '23

10 Jul '23

Couple of local items here <https://www.theregister.com/2023/07/10/asia_tech_news_roundup/> that I hadn’t heard of before: Andrew Little is considering bringing CERT under the control of the Government Communications Security Bureau, and also Microsoft is raising cloud prices, though not those for on-prem products, in NZ.

1 0

Mastodon fixes critical “TootRoot” vulnerability allowing node hijacking
by Peter Reutemann 10 Jul '23

10 Jul '23

'The maintainers of the open source software that powers the Mastodon social network published a security update on Thursday that patches a critical vulnerability making it possible for hackers to backdoor the servers that push content to individual users. Mastodon is based on a federated model. The federation comprises thousands of separate servers known as "instances." Individual users create an account with one of the instances, which in turn exchange content to and from users of other instances. To date, Mastodon has more than 12,000 instances and 14.5 million users, according to fedidb.org/, a site that tracks statistics related to Mastodon. A critical bug tracked as CVE-2023-36460 was one of two vulnerabilities rated as critical that were fixed on Thursday. In all, Mastodon on Thursday patched five vulnerabilities. So far, Mastodon gGmbH, the nonprofit that maintains the software instances uses to operate the social network, has released few details about CVE-2023-36460 other than to describe it as an “arbitrary file creation through media attachments” flaw. “Using carefully crafted media files, attackers can cause Mastodon's media processing code to create arbitrary files at any location," Mastodon said. "This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution.” In a Mastodon post, independent security researcher Kevin Beaumont went a step further, writing that exploiting the vulnerability allowed someone “to send a toot which makes a webshell on instances that process said toot.” He coined the name #TootRoot because user posts, known as toots, allowed hackers to potentially gain root access to instances.' -- source: https://arstechnica.com/security/2023/07/mastodon-fixes-critical-tootroot-v… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Discovered a New Linux Kernel 'StackRot' Privilege Escalation Vulnerability
by Peter Reutemann 10 Jul '23

10 Jul '23

'Wednesday Greg Kroah-Hartman announced the release of the 6.4.2 kernel. "All users of the 6.4 kernel series must upgrade." The Hacker News reports: Details have emerged about a newly identified security flaw in the Linux kernel that could allow a user to gain elevated privileges on a target host. Dubbed StackRot (CVE-2023-3269, CVSS score: 7.8), the flaw impacts Linux versions 6.1 through 6.4. There is no evidence that the shortcoming has been exploited in the wild to date. "As StackRot is a Linux kernel vulnerability found in the memory management subsystem, it affects almost all kernel configurations and requires minimal capabilities to trigger," Peking University security researcher Ruihan Li said. "However, it should be noted that maple nodes are freed using RCU callbacks, delaying the actual memory deallocation until after the RCU grace period. Consequently, exploiting this vulnerability is considered challenging." Following responsible disclosure on June 15, 2023, it has been addressed in stable versions 6.1.37, 6.3.11, and 6.4.1 as of July 1, 2023, after a two-week effort led by Linus Torvalds. A proof-of-concept (PoC) exploit and additional technical specifics about the bug are expected to be made public by the end of the month. ZDNet points out that Linux 6.4 "offers improved hardware enablement for ARM boards" and does a better job with the power demands of Steam Deck gaming devices. And "On the software side, the Linux 6.4 release includes more upstreamed Rust code. We're getting ever closer to full in-kernel Rust language support." The Register also notes that Linux 6.4 also includes "the beginnings of support for Apple's M2 processors," along with support for hibernation of RISC-V CPUs, "a likely presage to such silicon powering laptop computers."' -- source: https://linux.slashdot.org/story/23/07/09/0131210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Undocumented Raspberry Pi
by Lawrence D'Oliveiro 10 Jul '23

10 Jul '23

This little project <https://github.com/cariboulabs/cariboulite> for an SDR (Software-Defined Radio) addon card for a Raspberry Pi popped up on my feed. What caught my eye was that it made use of something called “SMI” (the “Secondary Memory Interface”) which exists on the GPIO connector but is not properly documented. There is a link to this blog post <https://iosoft.blog/2020/07/16/raspberry-pi-smi/> in which the writer reports some investigations into the details of this interface. Speed tests in that article give results of 25 16-bit samples per second or more, depending on the Raspberry Pi model; though note there are some odd glitches sometimes, as well as high bus contention (clearly pushing the Pi hardware to its limits). Maybe this is why the interface is not documented: because it is not considered production-ready ...

1 0

AMD CPU Use Among Linux Gamers Approaching 70% Marketshare
by Peter Reutemann 05 Jul '23

05 Jul '23

'The June Steam Survey results show that AMD CPUs have gained significant popularity among Linux gamers, with a market share of 67% -- a remarkable 7% increase from the previous month. Phoronix reports: In part that's due to the Steam Deck being powered by an AMD SoC but it's been a trend building for some time of AMD's increasing Ryzen CPU popularity among Linux users to their open-source driver work and continuing to build more good will with the community. In comparison, last June the AMD CPU Linux gaming marketshare came in at 45% while Intel was at 54%. Or at the start of 2023, AMD CPUs were at a 55% marketshare among Linux gamers. Or if going back six years, AMD CPU use among Linux gamers was a mere 18% during the early Ryzen days. It's also the direct opposite on the Windows side. When looking at the Steam Survey results for June limited to Windows, there Intel has a 68% marketshare to AMD at 32%. Beyond the Steam Deck, it's looking like AMD's efforts around open-source drivers, AMD expanding their Linux client (Ryzen) development efforts over the past two years, promises around OpenSIL, and other efforts commonly covered on Phoronix are paying off for AMD in wooing over their Linux gaming customer base.' -- source: https://hardware.slashdot.org/story/23/07/03/2233208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 115 Released
by Peter Reutemann 05 Jul '23

05 Jul '23

'Today, Mozilla released Firefox 115. Changes most visible to users include: * Hardware video decoding is now enabled for Intel GPUs on Linux.. * Migrating from another browser? Now you can bring over payment methods you've saved in Chrome-based browsers to Firefox. * The Tab Manager dropdown now features close buttons, so you can close tabs more quickly. * The Firefox for Android address bar's new search button allows you to easily switch between search engines and search your bookmarks and browsing history. * We've refreshed and streamlined the user interface for importing data in from other browsers. * Users without platform support for H264 video decoding can now fallback to Cisco's OpenH264 plugin for playback. But the most important feature is that this release is the new ESR. Why this is important? y'all ask, well: * Many a "downstream" project depends on Firefox ESR, for example the famous email client Thunderbird, or KaiOS (a mobile OS very popular in India, SE Asia, Africa and LatAm), so, for better or worse, whatever made it to (or is lacking from) this version of the browser, those projects have to use for the next year. * Firefox ESR is the default browser of many distros, like Debian and Kali Linux, so, whatever made it to this version will be there for next year, ditto to whatever is lacking. * If you are on old -- unsupported OSs, like Windows 7, 8-8.1 or MacOS 10.14 (Mojave, the last MacOS with support for 32 Bit Apps), 10.13 or 10.12 you will automatically be migrated to Firefox ESR, so this will be your browser until Sept. 2024.' -- source: https://news.slashdot.org/story/23/07/04/189258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation's Yocto Project Expands LTS to 4 Years
by Peter Reutemann 03 Jul '23

03 Jul '23

'Wikipedia defines the Yocto Project as "a Linux Foundation collaborative open source project whose goal is to produce tools and processes that enable the creation of Linux distributions for embedded and IoT software that are independent of the underlying architecture of the embedded hardware." This week the Linux Foundation shared an update on the 12-year-old Yocto Project: In an effort to support the community, The Yocto Project announced the first Long Term Support (LTS) release in October 2020. Today, we are delighted to announce that we are expanding the LTS release and extending the lifecycle from 2 to 4 years as standard. The continued growth of the Yocto Project coincides with the welcomed addition of Exein as a Platinum Member, joining AMD/Xilinx, Arm, AWS, BMW Group, Cisco, Comcast, Intel, Meta and WindRiver. As a Member, Exein brings its embedded security expertise across billions of devices to the core of the Yocto Project... "The Yocto Project has been at the forefront of OS technologies for over a decade," said Andrew Wafaa, Yocto Project Chairperson. "The adaptability and variety of the tooling provided are clearly making a difference to the community. We are delighted to welcome Exein as a member as their knowledge and experience in providing secure Yocto Project based builds to customers will enable us to adapt to the modern landscape being set by the US Digital Strategy and the EU Cyber Resilience Act." "We're extremely excited to become a Platinum Partner of the Yocto Project," said Gianni Cuozzo, founder and CEO of Exein. "The Yocto Project is the most important project in the embedded Linux space, powering billions of devices every year. We take great pride in contributing our extensive knowledge and expertise in embedded security to foster a future that is both enhanced and secure for Yocto-powered devices. We are dedicated to supporting the growth of the Yocto Project as a whole, aiming to improve its support for modern languages like Rust, and assist developers and OEMs in aligning with the goals outlined in the EU Cyber Resilience Act." ' -- source: https://linux.slashdot.org/story/23/07/01/0346241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave aims to curb practice of websites that port scan visitors
by Peter Reutemann 30 Jun '23

30 Jun '23

'The Brave browser will take action against websites that snoop on visitors by scanning their open Internet ports or accessing other network resources that can expose personal information. Starting in version 1.54, Brave will automatically block website port scanning, a practice that a surprisingly large number of sites were found engaging in a few years ago. According to this list compiled in 2021 by a researcher who goes by the handle G666g1e, 744 websites scanned visitors’ ports, most or all without providing notice or seeking permission in advance. eBay, Chick-fil-A, Best Buy, Kroger, and Macy's were among the offending websites.' -- source: https://arstechnica.com/security/2023/06/brave-will-soon-control-which-site… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Comprehensive Analysis of the GPL Issues With the Red Hat Enterprise Linux (RHEL) Business Mode
by Peter Reutemann 30 Jun '23

30 Jun '23

'For approximately twenty years, Red Hat (now a fully owned subsidiary of IBM) has experimented with building a business model for operating system deployment and distribution that looks, feels, and acts like a proprietary one, but nonetheless complies with the GPL and other standard copyleft terms. Software rights activists, including SFC, have spent decades talking to Red Hat and its attorneys about how the Red Hat Enterprise Linux (RHEL) business model courts disaster and is actively unfriendly to community-oriented Free and Open Source Software (FOSS). These pleadings, discussions, and encouragements have, as far as we can tell, been heard and seriously listened to by key members of Red Hat's legal and OSPO departments, and even by key C-level executives, but they have ultimately been rejected and ignored — sometimes even with a “fine, then sue us for GPL violations” attitude. Activists have found this discussion frustrating, but kept the nature and tenure of these discussions as an “open secret” until now because we all had hoped that Red Hat's behavior would improve. Recent events show that the behavior has simply gotten worse, and is likely to get even worse.' -- source: https://sfconservancy.org/blog/2023/jun/23/rhel-gpl-analysis/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Potted History Of 60 Years Of Computer Networking
by Lawrence D'Oliveiro 29 Jun '23

29 Jun '23

These guys, Larry Peterson and Bruce Davie, have done a whole series of open-source books all around the common theme of “A Systems Approach”. Here <https://www.theregister.com/2023/06/28/60_years_of_networking/> one of them offers a summary of the origins of the Internet, going back to the invention of packet switching and “best effort” delivery, and how that turned out to be such an important change from the traditional telephone network. He also takes the credit/blame for a long-standing myth about the Internet: I feel obligated to point out that there is no mention in this paper of the internet being designed to withstand nuclear attack. Unfortunately, I was responsible for perpetuating that misconception in an early edition of Computer Networks: A Systems Approach. Leiner et al debunk this myth and explain its origins in their paper, but it’s a remarkably persistent one. “[C]ontinue despite loss of networks or gateways” is as close as it gets. But now, cracks are starting to show in the trend toward centralization of popular Internet services. Not only is the “Fediverse” providing alternatives to Twitter and Facebook, but it is now also offering choices to those fed up with recent developments at Reddit, as well.

1 0

The ReactOS Project Suddenly Shows Signs of Life
by Peter Reutemann 29 Jun '23

29 Jun '23

'ReactOS is an open-source operating system that aims to replicate Microsoft Windows, and can already run many Windows applications without modification. ReactOS published a new (infrequent) newsletter to outline recent work. It reveals that progress has slowed down recently, but the project definitely isn't dead. The newsletter also acknowledges the team hasn't put out a new version since the end of 2021, although progress continues. Due to shifting focuses to quality releases, they are no longer on a quarterly release cadence. The date of the next release is not set yet, but according to a huge list of already-implemented changes they aim for it to be a substantial update. The last update to ReactOS was version 0.4.14, released on December 2021. While developers were previously committed to releasing updates every three months, that has since changed and updates will now be focused on quality rather than quantity. For the ReactOS team to be confident enough to release something, it needs to have less than 20 known unfixed regressions while adding new features and functions. Behind the scenes, it looks like things are spinning well. The team specifically highlighted its progress on the x64 port of ReactOS, which went from being a non-booting mess to an operating system that boots up and mostly works. It doesn't run any x86 programs since it doesn't have WoW64, but it's going well.' -- source: https://tech.slashdot.org/story/23/06/28/212238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Microsoft's GitHub Under Fire For DDoSing Crucial Open Source Project Website
by Peter Reutemann 29 Jun '23

29 Jun '23

'The servers used by the GMP project, an open source arithmetic library at the heart of GCC and other programs, slowed to a crawl earlier this month due to a large amount of network traffic originating from Microsoft servers. The Register reports: Torbjorn Granlund, principal author of GMP, raised the alarm in a note to the project's mailing list. "The GMP servers are under attack by several hundred IP addresses owned by Microsoft Corporation," he wrote. "We do not know if this is made with malice by Microsoft, if it is some sort of mistake, or if [it is one] of their cloud customers ... running the attack. The attack targets the GMP repo, with thousands of identical requests. The requests are cleverly chosen as to cause heavy system load. "We're firewalling off all of Microsoft's IP addresses as an emergency response." The following day, Mike Blacker, director of threat hunting, operations, and response at Microsoft's GitHub, had identified the culprit: a GitHub Actions Workflow that clones a Mercurial repo and has been forked more than 700 of times. "Microsoft and GitHub have investigated the issue and determined that a GitHub user updated a script within the FFmpeg-Builds project that pulled content from https://gmplib.org," explained Blacker. "This build was configured to run parallel simultaneous tests on 100 different types of computers/architectures. This activity does not appear to be nefarious. [GMP] appears to have limited infrastructure that could not sustain the limited, yet simultaneous requests." [...] As of last week, the excessive traffic was still an issue. "Our servers are fully available again, but that's the result of us adding all participating Microsoft network ranges to our firewall," the GMP project explains on its webpage. "We understand that we are far from the first project to take such measures against Github." The Register asked Granlund whether he was satisfied with Microsoft-GitHub's response, and he told us he had only heard once from Blacker. "I blocked about 40 IP ranges from accessing our web server," he explained. "A week after this started, there was still intensive traffic from the same IP addresses, perhaps 100 different Microsoft addresses all in all, belonging to about 40 ranges. The difference was that that traffic just caused minuscule load, and a log line in the firewall." "Problem solved. I cannot care less if they no longer can access gmplib.org. I find it interesting how little responsibility Github/Microsoft assume here. They seem to think that they are entitled to bash away at smaller sites." ' -- source: https://tech.slashdot.org/story/23/06/28/2045228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Let’s Encrypt Outage--Did Anybody Notice?
by Lawrence D'Oliveiro 29 Jun '23

29 Jun '23

Just noticed a mention in passing in this article <https://www.theregister.com/2023/06/28/microsofts_github_gmp_project/> that Let’s Encrypt was issuing bad certificates over a period of about an hour earlier this month <https://letsencrypt.status.io/pages/incident/55957a99e800baa4470002da/648b3…>. An explanation of what went wrong (from a third party who does monitoring of CA (mis)behaviour as part of his job) is here <https://www.agwa.name/blog/post/last_weeks_lets_encrypt_downtime>. Seems like many of the people affected were still using their bad certificates a week after the incident. Did you have one of the bad certificates? That article mentions a new addition to the ACME auto-renewal protocols that would allow clients to resolve a glitch like this in future without any manual intervention.

1 0

The Linux coders turning the ROG Ally and other handhelds into Steam Deck clones
by Peter Reutemann 28 Jun '23

28 Jun '23

'As soon as I was done with my review of the Asus ROG Ally, I grabbed my best USB stick and started looking for ISOs to download. Windows is, of course, the main highway to most PC gaming, but it's also (as detailed in the review) not yet built to work well on a 7-inch gaming handheld. The ROG Ally ships with Windows (Home) installed and a bunch of Asus software, but it is still, at heart, a PC. With effort, you can get into the BIOS, disable Secure Boot, plug in a USB stick, and boot a USB stick with a live Linux distribution on it. [...] With Ubuntu 23.04 installed, I could run the Phoronix Test Suite and run glxgears, which showed that at least some kind of 3D acceleration was happening. I installed Cyberpunk 2077 through Steam's Proton compatibility tool, benchmarked it, and got, well, very sad numbers. Cyberpunk saw that my GPU was the Ally's key feature—an AMD Ryzen Z1 Extreme. But it ran at 17 and 23 frames per second averages on "Medium" and "Steam Deck" settings, respectively (at 720p resolution and 60 Hz refresh rate). With nothing to lose, I installed the latest AMD Linux drivers, ran those benchmarks again, and lo and behold, improvement: 30.8 and 27.32 fps on "Medium" and "Steam Deck." That's notably shy of the 38 and 34 frames per second I clocked on the same benchmark in Windows. Then again, I'm guessing at drivers, and I can't do much to control thermals or power draw.' -- source: https://arstechnica.com/gadgets/2023/06/the-linux-coders-turning-the-rog-al… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Kart - git for geospatial data
by Peter Reutemann 27 Jun '23

27 Jun '23

Hi everyone Just came across this interesting project on my Mastodon feed (https://cloudisland.nz/@dznz/110613146633504731) Kart - Distributed version-control for geospatial and tabular data "stores geospatial and tabular data in Git, providing version control at the row and cell level." https://kartproject.org/ Is being developed by local company Koordinates and released under GPLv2 with linking exception. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Foundation Celebrates Zephyr Project's Small Real-Time Operating System
by Peter Reutemann 27 Jun '23

27 Jun '23

'This week the Linux Foundation shared an update on the Zephyr Project, a small real-time operating system for connected, resource-constrained and embedded devices: The project recently achieved several milestones including surpassing 80,000 commits since it was released in open source in 2015. This is an average of almost 2 commits per hour, which was made recently by 490 individuals, including 166 first-timers, who contributed to the 3.4 release. Zephyr RTOS supports over 450 boards running embedded microcontrollers from Arm and RISC-V to Tensilica, NIOS, ARC and x86 as single and multicore systems... Zephyr RTOS has a growing set of software libraries that can be used across various applications and industry sectors such as Industrial IoT, wearables, machine learning and more. It is built with an emphasis on broad chipset support, security, dependability, long-term support releases and a growing open source ecosystem... The Zephyr community will be at the Zephyr Developer Summit, which takes place on June 27-30 in Prague, Czech Republic, and virtually as part of the first-ever Embedded Open Source Summit. [Register here for virtual attendance.] Arduino will be joining Zephyr's Technical Steering Committee, along with Technology Innovation Institute and the American multinational semiconductor company Analog Devices (or ADI, who will also be joining its governing board). Arduino's CEO said "We believe that Zephyr OS is a truly special project that will play a significant role in the Arduino ecosystem and will be a big priority for us." As a "Platinum"-level sponsor, ADI joins Antmicro, Baumer, Google, Intel, Meta, Nordic Semiconductor, NXP, Oticon, Qualcomm Innovation Center and T-Mobile.' -- source: https://news.slashdot.org/story/23/06/26/0234245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GCC Steering Committee Announces a Code of Conduct
by Peter Reutemann 26 Jun '23

26 Jun '23

'GCC is the GNU project's free and open-source cross-platform compiler collection. Now an anonymous reader shared this announcement from the mailing list for GCC: The GCC Steering Committee has decided to adopt a Code of Conduct for interactions in GCC project spaces, including mailing lists, bugzilla, and IRC. The vast majority of the time, the GCC community is a very civil, cooperative space. On the rare occasions that it isn't, it's helpful to have something to point to to remind people of our expectations. It's also good for newcomers to have something to refer to, for both how they are expected to conduct themselves and how they can expect to be treated... At this time the CoC is preliminary: the code itself should be considered active, but the CoC committee (and so the reporting and response procedures) are not yet in place. There's also an official FAQ, and GCC's Code of Conduct begins with this introduction. "Like the free software community as a whole, the GCC community is made up of a mixture of professionals and volunteers from all over the world, working on every aspect of the project — including mentorship, teaching, and connecting people." Where this leads to issues and unhappiness, "we have a few ground rules that we ask people to adhere to... [T]ake it in the spirit in which it's intended — a guide to make it easier to enrich all of us, the project, and the broader communities in which we participate."' -- source: https://news.slashdot.org/story/23/06/25/2255253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PipeWire Versus PulseAudio+JACK
by Lawrence D'Oliveiro 25 Jun '23

25 Jun '23

Came across this PipeWire FAQ <https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/FAQ>, which among other things explains why there is a need to replace both PulseAudio and JACK. Briefly, it started from a wish to manage video inputs and outputs in a similar way to audio inputs and outputs, and also fix some performance/configuration limitations in the older specs. And if you are wondering why all your sound devices have suddenly acquired a “Pro Audio” option in their settings, this explains that as well. Also, for those complaining that Wayland’s stricter security model breaks basic functionality like screen recording and sharing, it appears PipeWire is the basis for the solution to that problem.

1 0

DuckDuckGo browser beta for Windows bakes in a lot of privacy tools
by Peter Reutemann 23 Jun '23

23 Jun '23

'Privacy-focused firm DuckDuckGo has released a public beta of its browser for Windows, offering more default privacy protections and an assortment of Duck-made browsing tools. More than a year after debuting its browser for Mac in private beta, the search engine and tracking antagonist offers many of those same features to a much wider audience. Like its Mac browser, DuckDuckGo (DDG) uses "the underlying operating system rendering API" rather than its own forked browser code. That's "a Windows WebView2 call that utilizes the Blink rendering engine underneath," according to DuckDuckGo's blog post. Fittingly, the browser reports itself as Microsoft Edge at most header-scanning sites.' -- source: https://arstechnica.com/gadgets/2023/06/duckduckgo-offers-its-privacy-cente… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Art Of Refurbishing Old Computers
by Lawrence D'Oliveiro 22 Jun '23

22 Jun '23

Interesting report <https://www.theregister.com/2023/06/21/pc_officina_positive_trashware/> on an Italian organization, which mentions some points which could be useful to those doing the same thing here: how to salvage and refurbish old PCs for donation to those who can’t afford something new. Note that they won’t take any old rubbish: they will no longer accept 32-bit machines or those needing DDR2 RAM, for example. Their current recommended OS is Linux Mint 21 with XFCE, but they will source Microsoft Windows for those who really want it (at what cost?).

1 0

Latest SUSE Linux Enterprise Goes All in With Confidential Computing
by Peter Reutemann 21 Jun '23

21 Jun '23

'SUSE's latest release of SUSE Linux Enterprise 15 Service Pack 5 (SLE 15 SP5) has a focus on security, claiming it as the first distro to offer full support for confidential computing to protect data. From a report: According to SUSE, the latest version of its enterprise platform is designed to deliver high-performance computing capabilities, with an inevitable mention of AI/ML workloads, plus it claims to have extended its live-patching capabilities. The release also comes just weeks after the community release openSUSE Leap 15.5 was made available, with the two sharing a common core. The Reg's resident open source guru noted that Leap 15.6 has now been confirmed as under development, which implies that a future SLE 15 SP6 should also be in the pipeline. SUSE announced the latest version at its SUSECON event in Munich, along with a new report on cloud security issues claiming that more than 88 percent of IT teams have reported at least one cloud security incident over the the past year. This appears to be the justification for the claim that SLE 15 SP5 is the first Linux distro to support "the entire spectrum" of confidential computing, allowing customers to run fully encrypted virtual machines on their infrastructure to protect applications and their associated data. Confidential computing relies on hardware-based security mechanisms in the processor to provide this protection, so enterprises hoping to take advantage of this will need to ensure their servers have the necessary support, such as AMD's Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) and Intel's Trust Domain Extensions (TDX).' -- source: https://linux.slashdot.org/story/23/06/20/1846203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PostgreSQL Reconsiders Its Process-Based Model
by Peter Reutemann 20 Jun '23

20 Jun '23

'Jonathan Corbet, writing at LWN: In the fast-moving open-source world, programs can come and go quickly; a tool that has many users today can easily be eclipsed by something better next week. Even in this environment, though, some programs endure for a long time. As an example, consider the PostgreSQL database system, which traces its history back to 1986. Making fundamental changes to a large code base with that much history is never an easy task. As fundamental changes go, moving PostgreSQL away from its process-oriented model is not a small one, but it is one that the project is considering seriously. A PostgreSQL instance runs as a large set of cooperating processes, including one for each connected client. These processes communicate through a number of shared-memory regions using an elaborate library that enables the creation of complex data structures in a setting where not all processes have the same memory mapped at the same address. This model has served the project well for many years, but the world has changed a lot over the history of this project. As a result, PostgreSQL developers are increasingly thinking that it may be time to make a change.' -- source: https://tech.slashdot.org/story/23/06/19/1723259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

KDE Plasma 6 Is Now 'Fairly Livable'
by Peter Reutemann 20 Jun '23

20 Jun '23

'Prominent KDE developer Nate Graham believes that Plasma 6 is now "fairly livable" and recommends KDE developers and power users / enthusiasts start giving it a try. Phoronix reports: He characterized Plasma 6 as: "Basically everything in Plasma compiles with Qt 6, and at this point Plasma 6 is fairly livable. To give you a sense of how livable, it's good enough that over the past 2 months, I've gone on three KDE-related trips from the USA to Europe, with my only computer running Plasma 6 in "current git master" state, with work-in-progress merge requests applied! Its stability has been good enough that this has caused me no apprehension, and indeed, it's been totally fine on each trip. So seriously, if you're a KDE developer or an adventurous user, start living on Plasma 6! Jump right in, the water's fine. :)" He went on to write more about the current development activities around Plasma 6. He also shared his personal beliefs around Plasma 6.0 release timing although no official release schedule is yet to be determined. Nate's belief is that Plasma 6.0 will likely be ready for release sometime between December and March.' -- source: https://developers.slashdot.org/story/23/06/19/212256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The State Of Linux Music Production
by Lawrence D'Oliveiro 17 Jun '23

17 Jun '23

Been messing about with my old MIDI keyboard again, after a long while putting it aside. It now complains about a “low battery” warning, but I think that only affects the onboard sound settings, which I’m not particularly fussed about. I got a USB-MIDI interface a few years back, and I can use that with the keyboard to drive sound sources on my main machine. But things have changed in the Linux music world since the last time I tried this (at least on Debian). JACK and PulseAudio have both been replaced by this new thing, PipeWire, which is supposed to handle video, audio and MIDI routing through a common architecture. So I no longer have to start up jackd when I want to switch to music-production mode (in fact, trying to run jackd under PipeWire will screw up your audio something awful). Instead, patching between sources and sinks is done via WirePlumber, for which a convenient GUI frontend is available in the form of qpwgraph. All the main PipeWire-related processes are managed as user-level services via systemd. One thing hasn’t changed, and that is the incompatibility between ALSA MIDI ports and JACK MIDI ports: that USB-MIDI interface only appears to the system as ports of the ALSA kind, whereas JACK-aware apps want to accept MIDI data via ports of the JACK kind. So I still have to start up the old “a2jmidid” program to provide a bridge between these two. qpwgraph shows all these different kinds of entities, each labelled with its type: “ALSA”, “PW” (PipeWire) or “JACK”. The latter two can be connected directly to one another, while ALSA ports can only be connected to ALSA ports. The colour-coding--purple for ALSA MIDI ports, red for JACK/PipeWire MIDI, green for JACK/PipeWire audio--is a hint that you can only connect matching colours. Some JACK-aware apps still have trouble running under PipeWire; for these, there is the “pw-jack” tool, which substitutes the JACK dynamic libraries with ones that hook directly into PipeWire before launching the specified app. E.g. I had to run a2jmidid with pw-jack a2jmidid Also, the command pw-jack zynaddsubfx -O jack tells ZynAddSubFX to run with its JACK interface active, and I can route events from my keyboard to it via the intermediary nodes automatically created by a2jmidid. Don’t forget to hook up its audio output terminals to the box representing my speakers, and voilà, I can make sound.

1 0

Analysis Of The GMail Fake Email Exploit
by Lawrence D'Oliveiro 15 Jun '23

15 Jun '23

You may have heard about an interesting hack a few days ago <https://www.theregister.com/2023/06/09/google_bimi_email_authentication/>, where some low-lifes figured out how to send fraudulent emails to GMail users that showed a “verified” blue BIMI checkmark, indicating that the recipient could trust the from-address as authentic. But of course it was not. The details of how the hack was perpetrated are quite intricate, and involve some subtle interplay between the mail-processing policies of GMail (where the recipients had their accounts, and which implements the BIMI check), Microsoft (which ran the Exchange servers where the fraudsters got accounts, and from which the fraudulent messages were sent) and UPS (the purported sender of the fake emails). Of course, all three parties have since taken action to ensure this particular scenario will not happen again. ThioJoe offers up a good explanation of how it all worked here <https://www.youtube.com/watch?v=Czc0F_A82rE>. If your eyes glaze over at the mention of SPF versus DKIM versus DMARC--well, you’re not alone. When I looked at whether I should implement something like this on my own mail server to try to ensure that spammers could not send out fake emails under my name, I felt the same way. So I just decided not to bother. For now ...

1 0

Question re: Desktop computer running Ubuntu is slow, mouse and keyboard missing commands
by Michael James 14 Jun '23

14 Jun '23

Can anyone please assist with this Ubuntu desktop severely slowed down, mouse and keyboard severely delayed, skipping and or typing multiple letters/numbers with the problem progressively getting worse. Internet speed is at standard mark. Thanks, Noho ora mai, All the best, Michael James __________________________________________________________________________________________ MICHAEL JAMES PASTROFF phone: inside New Zealand 021 115 3713 outside New Zealand 64 21 115 3713

2 2

Edge Sends Images You View Online To Microsoft
by Peter Reutemann 13 Jun '23

13 Jun '23

'Not so long ago, Microsoft Edge ended up in hot waters after users discovered a bug leaking your browser history to Bing. Now you may want to toggle off another feature to ensure Edge is not sending every picture you view online to Microsoft. Edge has a built-in image enhancement tool that, according to Microsoft, can use "super-resolution to improve clarity, sharpness, lighting, and contrast in images on the web." Although the feature sounds exciting, recent Microsoft Edge Canary updates have provided more information on how image enhancement works. The browser now warns that it sends image links to Microsoft instead of performing on-device enhancements.' -- source: https://yro.slashdot.org/story/23/06/12/182216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian 12 'Bookworm' Released
by Peter Reutemann 12 Jun '23

12 Jun '23

'Slashdot reader e065c8515d206cb0e190 shared the big announcement from Debian.org: After 1 year, 9 months, and 28 days of development, the Debian project is proud to present its new stable version 12 (code name bookworm). bookworm will be supported for the next 5 years thanks to the combined work of the Debian Security team and the Debian Long Term Support team... This release contains over 11,089 new packages for a total count of 64,419 packages, while over 6,296 packages have been removed as obsolete. 43,254 packages were updated in this release. The overall disk usage for bookworm is 365,016,420 kB (365 GB), and is made up of 1,341,564,204 lines of code. bookworm has more translated man pages than ever thanks to our translators who have made man-pages available in multiple languages such as: Czech, Danish, Greek, Finnish, Indonesian, Macedonian, Norwegian (Bokmål), Russian, Serbian, Swedish, Ukrainian, and Vietnamese. All of the systemd man pages are now completely available in German. The Debian Med Blend introduces a new package: shiny-server which simplifies scientific web applications using R. We have kept to our efforts of providing Continuous Integration support for Debian Med team packages. Install the metapackages at version 3.8.x for Debian bookworm. The Debian Astro Blend continues to provide a one-stop solution for professional astronomers, enthusiasts, and hobbyists with updates to almost all versions of the software packages in the blend. astap and planetary-system-stacker help with image stacking and astrometry resolution. openvlbi, the open source correlator, is now included. Support for Secure Boot on ARM64 has been reintroduced: users of UEFI-capable ARM64 hardware can boot with Secure Boot mode enabled to take full advantage of the security feature. 9to5Linux has screenshots, and highlights some new features: Debian 12 also brings read/write support for APFS (Apple File System) with the apfsprogs and apfs-dkms utilities, a new tool called ntfs2btrfs that lets you convert NTFS drives to Btrfs, a new malloc implementation called mimalloc, a new kernel SMB server called ksmbd-tools, and support for the merged-usr root file system layout... This release also includes completely new artwork called Emerald, designed (once again) by Juliette Taka. New fonts are also present in this major Debian release, along with a new fnt command-line tool for accessing 1,500 DFSG-compliant fonts. Debian 12 "bookworm" ships with several desktop environments, including: - Gnome 43, - KDE Plasma 5.27, - LXDE 11, - LXQt 1.2.0, - MATE 1.26, - Xfce 4.18' -- source: https://linux.slashdot.org/story/23/06/11/0333242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Excel Has Become A Threat To Democracy
by Lawrence D'Oliveiro 07 Jun '23

07 Jun '23

Austria’s Social Democratic Party recently held an election for a new leader, according to <https://www.theregister.com/2023/06/06/austria_election_excel_blunder/>. Trouble was, two days after announcing the result had gone one way, they then had to report that in fact it was the other way round, owing to a stuffup involving an Excel spreadsheet. I suppose the only good news is that this was strictly an in-party election, not something involving any level of Government.

1 0

The State Of Fibre Broadband In The USA
by Lawrence D'Oliveiro 07 Jun '23

07 Jun '23

Came across this report <https://arstechnica.com/tech-policy/2023/06/internet-users-love-fiber-servi…>, which is interesting to compare with conditions in NZ: In terms of availability, the Federal Communications Commission broadband map indicates that about 38 percent of US residents can get fiber. The percentage drops to 29 percent when including only fiber services that offer gigabit download speeds and at least 100Mbps upload speeds. Basically, US broadband is dominated by companies with heavy investments in cable (and some ADSL), who have no interest in obsoleting that investment any sooner than they have to. Moral: there are places where a free market works, but strategic infrastructure buildouts is not one of them.

1 0

Trouble Accessing .nz Sites, Anybody?
by Lawrence D'Oliveiro 30 May '23

30 May '23

Seems some people have had trouble accessing various .nz sites since last night, and into this morning <https://www.nzherald.co.nz/business/banking-apps-some-websites-down-as-inte…>. The explanation at the end seems to indicate that InternetNZ is rolling out DNS security, and caching inconsistencies on ISPs’ servers are leading to hiccups for users. Hopefully this will be resolved soon as the outdated DNS entries get flushed.

2 1

Microsoft Releases Azure Linux
by Lawrence D'Oliveiro 26 May '23

26 May '23

Microsoft has announced a commercially-supported product it calls “Azure Linux” <https://devclass.com/2023/05/25/azure-linux-released-at-build-where-microso…>. This is essentially the same code as its custom “CBL-Mariner” distro that it runs internally on its Azure servers. While this is RPM-based (the same package manager used in Red Hat), it is not a fork of Red Hat, but is built specially from the ground up. Project lead Jim Perrin explains why: “The reason we chose not to fork a different distro … Microsoft has kind of a history with Linux. … I think the Balmer quote is from 2001, but a lot of the sentiment still lingers even today. Part of the reason we did not choose to start with a distribution and then fork it for our needs is we didn’t want to be seen as doing the embrace and extend thing again, we didn’t want to wake any of that up, we figured, build it from scratch, we can tailor it to our needs … we’re scratching an itch we had and offering the solution back to the community.” The “Ballmer quote” being the infamous phrase “Linux is a cancer” that then-CEO Steve Ballmer uttered back in 2001. Yes, nice to see some past sins are still kept in mind, at least in some corners of Microsoft ...

1 0

Fast Restart For Java Apps
by Lawrence D'Oliveiro 23 May '23

23 May '23

Java continues to be popular for server-side apps. But one problem is that starting a Java app can be slow. So if you have some Java code that performs a service on demand, runs for a short while and then shuts down again, that hurts performance. Enter “CRaC”, or “Coordinated Restore at Checkpoint” <https://devclass.com/2023/05/22/azul-makes-openjdk-with-fast-start-crac-gen…>, from a company called Azul, which seems to centre its entire business around OpenJDK <https://www.azul.com/about/>. This system lets the app dump its state to disk in a form that allows for quick resumption. This state cannot include things like open files/network connections, so the app itself needs to implement handlers to close these before the dump and reopen them after the restore, saving enough state as part of the dump to allow this to happen with minimal impact on the rest of the application. Interestingly, this system is built on another piece of software called “CRIU” or “Checkpoint/Restore In Userspace” <https://criu.org/Main_Page>, which is Linux-only. As Azul’s CTO says: “We submitted CRaC to OpenJDK as an idea for a project … and they’ve included it as one of the many project they have. The reason it isn’t in the mainstream yet, and I’m not even sure it will make it into the mainstream, is that we rely on the CRIU technology underneath on Linux, and there isn’t an equivalent that we’re aware of on Windows or on Mac. So you lose that cross-platform functionality … ” But as the article says, that may not such a big showstopper any more: Java applications are often developed on Windows or Mac, but most often deployed to Linux, suggesting that the lack of cross-platform support is not a deal-breaker for everyone.

1 0

Fibre Connection -- Separating Modem & Router Functions
by Lawrence D'Oliveiro 16 May '23

16 May '23

Most people probably have their internet connection provided through a single box. There are two separate functions going on: * “Modem” (layer 2) -- handling the low-level signalling with whatever is at the other end of the wire (whether copper or glass); * “Router” (layer 3) -- routing TCP/IP packets between your house LAN and your ISP, which provides the connection between there and the rest of the Internet. At one point I was running a cheap little Conexant AccessRunner USB box (bought from Dick Smith) on my ADSL connection; while this could also perform both functions in one, I found a version of the firmware that implemented only the modem function. Plugging this into a Linux box caused it to appear like an additional network interface (the drivers are already in the standard kernel). I could then control this via the “ppp” package <https://ppp.samba.org/>, using its PPP-over-ATM plugin to implement the correct low-level signalling (just VPI/VCI selection, really). I could then exploit the full power of the Linux network stack on that box to manage the connection to the rest of my house LAN. Anyway, as my own house gets wired up for fibre (soon...), I was curious as to whether something equivalent could be done for a fibre connection. And the information I’ve found so far (e.g. <https://www.geekzone.co.nz/forums.asp?forumid=81&topicid=274586>) indicates it might actually be simpler than this. The “ONT” (“Optical Network Terminator”) box that gets installed in your house has phone ports and Ethernet ports on it, and it appears that (once you have your ISP connection up and running) the Ethernet connection behaves just like a regular LAN connection, with a DHCP server (and ISP’s router) listening on the other end. So instead of an Internet router at your end, you can plug a regular PC directly into that port, pick up an allocated address, and have it immediately connected to the Internet. In short, there is nothing fibre-specific about the Internet router that the ISP provides to you at all. However, there might be issues with VLAN-tagging of the Ethernet frames, and this is not standardized between ISPs. (By the way, I see several folks claiming there is no “modem” in a fibre connection. Of course there is.) Not sure whether I’ll try this right away. Might be safest to do things the ISP-provided way, at least to begin with.

4 8

Unkillable UEFI Malware Bypassing Secure Boot Enabled By Unpatchable Windows Flaw
by Peter Reutemann 12 May '23

12 May '23

'Researchers have announced a major cybersecurity find -- the world's first-known instance of real-world malware that can hijack a computer's boot process even when Secure Boot and other advanced protections are enabled and running on fully updated versions of Windows. From a report: Dubbed BlackLotus, the malware is what's known as a UEFI bootkit. These sophisticated pieces of malware hijack the UEFI -- short for Unified Extensible Firmware Interface -- the low-level and complex chain of firmware responsible for booting up virtually every modern computer. As the mechanism that bridges a PC's device firmware with its operating system, the UEFI is an OS in its own right. It's located in an SPI-connected flash storage chip soldered onto the computer motherboard, making it difficult to inspect or patch. Because the UEFI is the first thing to run when a computer is turned on, it influences the OS, security apps, and all other software that follows. These traits make the UEFI the perfect place to run malware. When successful, UEFI bootkits disable OS security mechanisms and ensure that a computer remains infected with stealthy malware that runs at the kernel mode or user mode, even after the operating system is reinstalled or a hard drive is replaced. As appealing as it is to threat actors to install nearly invisible and unremovable malware that has kernel-level access, there are a few formidable hurdles standing in their way. One is the requirement that they first hack the device and gain administrator system rights, either by exploiting one or more vulnerabilities in the OS or apps or by tricking a user into installing trojanized software. Only after this high bar is cleared can the threat actor attempt an installation of the bootkit. The second thing standing in the way of UEFI attacks is UEFI Secure Boot, an industry-wide standard that uses cryptographic signatures to ensure that each piece of software used during startup is trusted by a computer's manufacturer. Secure Boot is designed to create a chain of trust that will prevent attackers from replacing the intended bootup firmware with malicious firmware. If a single firmware link in that chain isn't recognized, Secure Boot will prevent the device from starting.' -- source: https://it.slashdot.org/story/23/03/06/1854200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

OpenOffice: The One FOSS Project That Deserves To Die, But Won’t
by Lawrence D'Oliveiro 06 May '23

06 May '23

The ever-dependable Brodie Robertson has a look at the ongoing (!) development history of OpenOffice here <https://www.youtube.com/watch?v=xdpMxmFvGBA>. Those of us on FOSS platforms moved to LibreOffice years ago. But among some sectors (my guess is, predominantly Microsoft Windows users?), OpenOffice still has the dominant name recognition. And just to add to the fun, the project actually continues putting out updates! Though these are just minor ones -- I don’t think there have been any major functional changes in the better part of a decade. The source code commit history also continues to bubble over, though a lot of the patches are tiny, almost trivial things, like fixing typos and making random-looking changes to whitespace.

1 0

I used System76’s Pangolin for weeks, and Linux was not the biggest problem
by Peter Reutemann 05 May '23

05 May '23

'After using System76’s Pangolin as my primary work laptop for nearly six weeks, I can tell you this: If you need a 15-inch Linux-focused laptop, this is the one to get. The Pangolin is a solid device, designed more for dependability and convenience than ultrabook portability or cutting-edge parts, but it still has reasonably modern hardware (especially its 144 Hz screen). The Pangolin and its native Pop!_OS are a showcase for how remarkably normal Linux can feel as a daily driver in 2023. Normal, and with lots of ports. It’s hard to do a nuts-and-bolts comparison of the Pangolin to most other laptops, due largely to benchmark comparability between Linux and most laptops running Windows or macOS. But it’s also not entirely necessary. There’s only one real version of the Pangolin available—one processor, one amount of RAM, then variable, user-expandable storage. We’ll show you how the Pangolin did on a couple tests. But how this laptop works for you is much more about what you’re bringing to it and what you're willing to put into customizing it to your liking. I came to the Pangolin as someone who has made a few attempts at using Linux as a daily driver. I know enough command line, vim, and Unix-based architecture to be conversant, and I have two Raspberry Pis that are constantly being improved. Still, I'm more hobbyist than practitioner. And yet the Pangolin presented no real problems as I used it for almost any task I needed to get done. Its combination of solid software and practical hardware choices make it an easy system to recommend, so long as you know you need Linux. Its maker-made operating system, Pop!_OS, almost never gave me problems, except when I was trying to make it run benchmarks. Starting with a rock-solid Linux install, where every bit of hardware is supported and functional, made me more eager to poke at the edges and see what I could customize.' -- source: https://arstechnica.com/gadgets/2023/05/review-system76-pangolin-is-a-solid… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'sudo' and 'su' Are Being Rewritten In Rust For Memory Safety
by Peter Reutemann 02 May '23

02 May '23

'Phoronix reports: With the financial backing of Amazon Web Services, sudo and su are being rewritten in the Rust programming language in order to increase the memory safety for the widely relied upon software... to further enhance Linux/open-source security. "[B]ecause it's written in C, sudo has experienced many vulnerabilities related to memory safety issues," according to a blog post announcing the project: It's important that we secure our most critical software, particularly from memory safety vulnerabilities. It's hard to imagine software that's much more critical than sudo and su. This work is being done by a joint team from Ferrous Systems and Tweede Golf with generous support from Amazon Web Services. The work plan is viewable here. The GitHub repository is here. ' -- source: https://linux.slashdot.org/story/23/05/01/0020239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Announces DentOS 3.0, an Open Source Network OS for Disaggregated Networks
by Peter Reutemann 01 May '23

01 May '23

'This month the Linux Foundation announced version 3.0 of DentOS, an open source network operating system using the Linux kernel, Switchdev, and other Linux-based projects for a standardized network operating system "without abstractions or overhead," according to the project's web page. "All underlying infrastructure — including ASIC and Silicon for networking and datapath — is treated equally; while existing abstractions, APIs, drivers, low-level overhead, and other open software are simplified. DENT unites silicon vendors, ODMs, SIs, OEMs, and end users across all verticals to enable the transition to disaggregated networks." Or, as the Linux Foundation, the operating system provides "a flexible and customizable platform for network administrators to manage their networks." DENT provides access to open source-based switches at a lower cost and with more flexibility compared to proprietary switches with locked ecosystems. Network wiring closets in many facilities--including retail stores, warehousing, remote locations, enterprises, and small and mid-sized businesses--are often small, requiring a compact solution for network management. Additionally, staff expertise may be limited, and branch-office switches from leading suppliers can require costly contracts. DENT can be easily deployed on white-box hardware in small spaces, providing an efficient and cost-effective solution for network management. As a result, DENT deployment can significantly enhance network management in a wide range of environments, providing greater efficiency, reliability, and scalability... DentOS enables Amazon's Just Walk Out Technology to connect and manage thousands of devices like cameras, sensors, entry and exit gates, and access points on the network edge. ' -- source: https://tech.slashdot.org/story/23/04/30/010222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Not-So-Stupid(?) Linux Trick
by Lawrence D'Oliveiro 28 Apr '23

28 Apr '23

Here’s a command that can sometimes look a bit unnerving in operation, but is actually quite safe: rmdir -p «dir» where «dir» is some directory. Or to watch the whole process in action, add the option to give progress messages: rmdir -pv «dir» Background: the basic command rmdir «dir» deletes the named directory, but only if it is empty. The “-p” option takes this further, by then trying to delete the parent of «dir», and if that succeeds, the parent of that, and so on. It stops only when it gets to a nonempty directory, or when it has done all components of «dir». So if, for example, you try this on an absolute path, this will mean the command always stops on an error. And the error could quite likely be on a directory which contains important stuff that you care about. But, as I said, it’s quite safe, since it won’t delete that stuff. But I told you it could be unnerving, didn’t I?

1 0

New Intel Linux Graphics Driver Patches Released, Up To 10-15% Better Performance
by Peter Reutemann 28 Apr '23

28 Apr '23

'A new set of patches have been released for the Intel Linux graphics driver that "can provide 10-15% better performance when operating in the tuned mode," reports Phoronix. From the report: The set of Intel i915 Linux kernel graphics driver patches are about exposing the Intel RPS (Requested Power State) up/down thresholds. Right now the Intel Linux kernel driver has static values set for the up/down thresholds between power states while these patches would make them dynamically configurable by user-space. Google engineer Syed Faaiz Hussain raised the issue that they experimented with the Intel RPS tuning and were able to manage up to 15% better performance. With Counter-Strike: Global Offensive with OpenGL was a 14.5% boost, CS:GO with Vulkan was 12.9% faster, and Civilization VI with OpenGL was 11% faster while Strange Brigade was unchanged. No other game numbers were provided. But as this is about changing the threshold for how aggressively the Intel graphics hardware switches power states, the proposed patches leave it up to user-space to adjust the thresholds as they wish. Google engineers are interested in hooking this into Feral's GameMode so that the values could be automatically tuned when launching games and then returning to their former state when done gaming, in order to maximize battery life / power efficiency. The only downside with these current patches are that they work only for non-GuC based platforms... So the latest Alder/Raptor Lake notebooks as well as Intel DG2/Alchemist discrete graphics currently aren't able to make use of this tuning option. ' -- source: https://tech.slashdot.org/story/23/04/27/1927209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel 6.3 Released
by Peter Reutemann 27 Apr '23

27 Apr '23

'A report from ZDNet, written by Steven Vaughan-Nichols: The latest Linux kernel is out with a slew of new features -- and, for once, this release has been nice and easy. [...] Speaking of Rust, everyone's favorite memory-safe language, the new kernel comes with user-mode Linux support for Rust code. Miguel Ojeda, the Linux kernel developer, who's led the efforts to bring Rust to Linux, said the additions mean we're, "getting closer to a point where the first Rust modules can be upstreamed." Other features in the Linux 6.3 kernel include support and enablement for upcoming and yet-to-be-released Intel and AMD CPUs and graphics hardware. While these updates will primarily benefit future hardware, several changes in this release directly impact today's users' day-to-day experience. The kernel now supports AMD's automatic Indirect Branch Restricted Speculation (IBRS) feature for Spectre mitigation, providing a less performance-intensive alternative to the retpoline speculative execution. Linux 6.3 also includes new power management drivers for ARM and RISC-V architectures. RISC-V has gained support for accelerated string functions via the Zbb bit manipulation extension, while ARM received support for scalable matrix extension 2 instructions. For filesystems, Linux 6.3 brings AES-SHA2-based encryption support for NFS, optimizations for EXT4 direct I/O performance, low-latency decompression for EROFS, and a faster Brtfs file-system driver. Bottom line: many file operations will be a bit more secure and faster. For gamers, the new kernel provides a native Steam Deck controller interface in HID. It also includes compatibility for the Logitech G923 Xbox edition racing wheel and improvements to the 8BitDo Pro 2 wired game controllers. Who says you can't game on Linux? Single-board computers, such as BannaPi R3, BPI-M2 Pro, and Orange Pi R1 Plus, also benefit from updated drivers in this release. There's also support for more Wi-Fi adapters and chipsets. These include: Realtek RTL8188EU Wi-Fi adapter support; Qualcomm Wi-Fi 7 wireless chipset support; and Ethernet support for NVIDIA BlueField 3 DPU. For users dealing with complex networks that have both old-school and modern networks, the new kernel can also handle multi-path TCP handling mixed flows with IPv4 and IPv6.' -- source: https://linux.slashdot.org/story/23/04/26/0023238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0