- wlug - list.wlug.org.nz

Debian isn't waiting for 2038 to blow up, switches to 64-bit time for everything
by Peter Reutemann 31 Jul '25

31 Jul '25

'Venerable Linux distribution Debian is side-stepping the Y2K38 bug – also known as the Unix Epochalypse – by switching to 64-bit time for everything but the oldest of supported hardware, starting with the upcoming Debian 13 "Trixie" release. "[We will] use 64-bit time_t on 32-bit architectures to avoid the 'year 2038 problem' when the existing 32-bit signed int rolls over (potentially setting time back to 1900)," the Debian maintainers say of the move and the problem it aims to fix. y2k illustration retro futuristic The 'nothing-happened' Y2K bug – how the IT industry worked overtime to save world's computers READ MORE "This is now less than 15 years away and plenty of systems that will have problems have already been shipped. We should stop adding to the problem." Readers of a certain vintage will remember well the "Y2K problem," caused by retrospectively shortsighted attempts to save a couple of bytes by using two-digit years – meaning that "2000" is represented as "00" and assumed to be "1900." While predictions of aircraft falling from the skies and bank balances being wiped out by negative-decades of interest did not, thankfully, come true, that was purely due to the tireless behind-the-scenes work of software developers who were able to patch affected systems before celebrating the turn of the century. There's another, less well-known clock problem looming, however: the Unix Epochalypse,which affects any systems that measure time the Unix way – in seconds elapsed since January 1, 1970. Come the very precise time of 03:14:07 UTC on January 19, 2038, the number of seconds elapsed will be larger than can be represented by a signed 32-bit integer. This would be fine if the decision hadn't been made all those years ago to store the number of seconds in exactly such a format.' -- source: https://www.theregister.com/2025/07/25/y2k38_bug_debian/ Cheers, Peter

1 0

Malware Discovered in Arch Linux AUR Packages
by Peter Reutemann 28 Jul '25

28 Jul '25

Something for the arch users on here: 'If you are an Arch user, you know – AUR (Arch User Repository) is a double-edged sword—it’s incredibly useful but requires caution. Unfortunately, that caution was warranted yet again this week when three AUR packages were found to contain malware. The issue came to light on July 16 when a user uploaded a malicious package, librewolf-fix-bin, to the AUR. Within hours, two more packages—firefox-patch-bin and zen-browser-patched-bin—followed, all traced back to the same bad actor. Security researchers quickly identified the threat: a Remote Access Trojan (RAT) hidden in a script pulled from a GitHub repository. For those unfamiliar, a RAT is no joke—it can grant attackers full control over an infected system, enabling them to steal data, install additional malware, or spy on users. Thankfully, the Arch Linux security team responded promptly as soon as they became aware of the issue. By July 18, all three malicious packages had been removed from AUR.' -- source: https://linuxiac.com/malware-discovered-in-arch-linux-aur-packages/ Cheers, Peter

1 0

Clear Linux Discontinued as Intel Pulls the Plug Overnight
by Peter Reutemann 28 Jul '25

28 Jul '25

'Unfortunately, there’s a bit of sad news out of the Linux world this week, with Clear Linux taking center stage. What I’m talking about is that Intel has formally ended support for Clear Linux OS, drawing a rapid close to a nearly decade-long effort to showcase aggressive, upstream-friendly performance optimizations on x86_64. In a blog post titled “All good things come to an end: Shutting down Clear Linux OS,” the announcement states that support ends immediately, with no trailing window for security updates. "After years of innovation and community collaboration, we’re ending support for Clear Linux OS. Effective immediately, Intel will no longer provide security patches, updates, or maintenance for Clear Linux OS, and the Clear Linux OS GitHub repository will be archived in read-only mode." Crucially, “effective immediately” is not rhetorical: Intel states that there will be no further security patches, updates, or maintenance, and the project’s GitHub repository is to be archived in a read-only manner. As you can guess, that abrupt cutoff leaves any production or lab systems running Clear Linux exposed going forward, so administrators now face an urgent migration. For those unfamiliar, Clear Linux (a project launched in 2015) is an open-source, rolling-release Linux distribution developed by Intel’s Open Source Technology Center, purpose-built to showcase and leverage Intel’s hardware strengths, with a focus on high performance, security, and cloud-native workloads. -- source: https://linuxiac.com/intel-shuts-down-clear-linux-os/ Cheers, Peter

1 0

Let Sudo Insult You When You Enter Incorrect Password
by Peter Reutemann 24 Jul '25

24 Jul '25

Add some spice to your incorrect password attempts! :-) 'Sudoers is the default sudo security policy plugin in Linux; however, experienced system administrators can specify a custom security policy as well as input and output logging plugins. It is driven by the /etc/sudoers file or, alternatively by LDAP. You can define sudoers options like the insults option or several others in the file /etc/sudoers. It is set under the Defaults entries section. [...] In this article, we will explain a sudoers configuration parameter to enable an individual or system administrator to set sudo command to insult system users who enter the wrong password.' -- source: https://www.tecmint.com/sudo-insult-when-enter-wrong-password/ Cheers, Peter

1 0

FossFLOW - Isometric Diagramming Tool
by Peter Reutemann 23 Jul '25

23 Jul '25

Just came across FossFLOW: 'FossFLOW is a powerful, open-source Progressive Web App (PWA) for creating beautiful isometric diagrams. Built with React and the Isoflow (Now forked and published to NPM as fossflow) library, it runs entirely in your browser with offline support.' You can try it out here: https://stan-smith.github.io/FossFLOW/ Maybe something to consider next time you create a diagram? :-) -- code: https://github.com/stan-smith/FossFLOW -- source: https://mastodon.social/@nixCraft/114897260096883374 Cheers, Peter

1 0

Microsoft's Secure Boot UEFI Bootloader Signing Key Expires In September, Posing Problems For Linux Users
by Lawrence D'Oliveiro 23 Jul '25

23 Jul '25

If I understand this article right <https://www.tomshardware.com/tech-industry/cyber-security/microsoft-signing…>, there is a signing key stored in the flash RAM of PCs, issued by Microsoft, which is used to sign a “shim” that allows third-party Linux distros to boot. However, that key is due to expire this September. Microsoft issued an updated key two years ago, but that key may not be widely installed as yet. This leaves it up to PC/OEM vendors to issue updates to the flash RAM on their motherboards, which is not something that can be taken for granted. I’m not the only one wondering whether Secure Boot is worth the hassle: It's easy to see the appeal of Secure Boot—making it more difficult to install bootkits should be a net positive. However, the looming hassle of dealing with this expiring key is just the latest in a series of frustrations that encourage people to either stick with Windows or disable Secure Boot entirely. Right now, many people opt for the former, but will that continue to be the case as the popularity of other platforms rises ahead of Windows 10's demise? And is Secure Boot, as it currently exists, prepared for that shift?

1 0

filestash
by Peter Reutemann 22 Jul '25

22 Jul '25

Just came across "filestash": 'A Dropbox-like file manager that let you manage your data anywhere it is located: FTP • FTPS • SFTP • WebDAV • Git • S3 • NFS • SMB • Artifactory • LDAP • Mysql • Storj • CardDAV • CalDAV • Backblaze B2 • Minio • Dropbox • Google Drive' Sounds like an interesting and useful tool! -- github: https://github.com/mickael-kerjean/filestash -- source: https://mastodon.social/@nixCraft/114893327737674577 Cheers, Peter

1 0

Actively exploited vulnerability gives extraordinary control over server fleets
by Peter Reutemann 21 Jul '25

21 Jul '25

'Hackers are exploiting a maximum-severity vulnerability that has the potential to give them complete control over thousands of servers, many of which handle mission-critical tasks inside data centers, the US Cybersecurity and Infrastructure Security Agency is warning. The vulnerability, carrying a severity rating of 10 out of a possible 10, resides in the AMI MegaRAC, a widely used firmware package that allows large fleets of servers to be remotely accessed and managed even when power is unavailable or the operating system isn't functioning. These motherboard-attached microcontrollers, known as baseboard management controllers (BMCs), give extraordinary control over servers inside data centers. Administrators use BMCs to reinstall operating systems, install or modify apps, and make configuration changes to large numbers of servers without physically being on premises and, in many cases, without the servers being turned on. Successful compromise of a single BMC can be used to pivot into internal networks and compromise all other BMCs. CVE-2024-54085, as the vulnerability is tracked, allows for authentication bypasses by making a simple web request to a vulnerable BMC device over HTTP. The vulnerability was discovered by security firm Eclypsium and disclosed in March. The disclosure included proof-of-concept exploit code allowing a remote attacker to create an admin account without providing any authentication. At the time of the disclosure, there were no known reports of the vulnerability being actively exploited. On Wednesday, CISA added CVE-2024-54085 to its list of vulnerabilities known to be exploited in the wild. The notice provided no further details.' -- source: https://arstechnica.com/security/2025/06/active-exploitation-of-ami-managem… Cheers, Peter

4 6

KDE's Android TV Alternative, Plasma Bigscreen, Rises From the Dead
by Peter Reutemann 16 Jul '25

16 Jul '25

'Plasma Bigscreen, KDE's TV-focused interface, is being revived after years of inactivity thanks to contributor Devin, who overhauled the UI, redesigned the Settings app, improved app launching, and updated key modules. While still in progress -- with features like HDMI-CEC remote support and a virtual keyboard pending -- the project aims to rejoin KDE's official Plasma release schedule, potentially in version 6.5. Neowin reports: If you have not heard of it, Plasma Bigscreen is a Plasma shell for televisions, with original support for the now-defunct Mycroft AI assistant. It used to provide a simple launcher for apps and custom "Mycroft Skills" before development stalled, causing most distributions to drop it. The project was left behind during the big transition to Plasma 6 last year because no one had ported it in time for the megarelease. After a friend of his started poking at the code, Devin stepped in to tackle the much-needed work. [...] For anyone who wants to test this out, you can do as Devin did by installing Plasma Bigscreen on a Raspberry Pi using postmarketOS, though you would have to compile it yourself or pull from the nightly repos to get the latest changes. Applications like Kodi and VacuumTube (smart TV version of YouTube) work well with remote navigation, and some games like SuperTuxKart are playable. Controller support exists, but getting TV remotes to work over HDMI CEC is still untested. The project is far from finished; it still needs an arrow-navigable virtual keyboard and a clearer long-term direction now that Mycroft is gone. Still, the goal is to get it back into the official Plasma release schedule, possibly for version 6.5. ' -- source: https://tech.slashdot.org/story/25/07/15/1956221 Cheers, Peter

1 0

Browser Extensions Turn Nearly 1 Million Browsers Into Website-Scraping Bots
by Peter Reutemann 10 Jul '25

10 Jul '25

'Over 240 browser extensions with nearly a million total installs have been covertly turning users' browsers into web-scraping bots. "The extensions serve a wide range of purposes, including managing bookmarks and clipboards, boosting speaker volumes, and generating random numbers," reports Ars Technica. "The common thread among all of them: They incorporate MellowTel-js, an open source JavaScript library that allows developers to monetize their extensions." Ars Technica reports: Some of the data swept up in the collection free-for-all included surveillance videos hosted on Nest, tax returns, billing invoices, business documents, and presentation slides posted to, or hosted on, Microsoft OneDrive and Intuit.com, vehicle identification numbers of recently bought automobiles along with the names and addresses of the buyers, patient names and the doctors they saw, travel itineraries hosted on Priceline, Booking.com, and airline websites, Facebook Messenger attachments and Facebook photos, even when the photos were set to be private. The dragnet also collected proprietary information belonging to Tesla, Blue Origin, Amgen, Merck, Pfizer, Roche, and dozens of other companies. Tuckner said in an email Wednesday that the most recent status of the affected extensions is: - Of 45 known Chrome extensions, 12 are now inactive. Some of the extensions were removed for malware explicitly. Others have removed the library. - Of 129 Edge extensions incorporating the library, eight are now inactive. - Of 71 affected Firefox extensions, two are now inactive. Some of the inactive extensions were removed for malware explicitly. Others have removed the library in more recent updates. A complete list of extensions found by Tuckner is here.' -- source: https://tech.slashdot.org/story/25/07/09/2257245 Cheers, Peter

1 0