- wlug - list.wlug.org.nz

Serious vulnerabilities in Matrix’s end-to-end encryption have been patched
by Peter Reutemann 29 Sep '22

29 Sep '22

'Developers of the open source Matrix messenger protocol are releasing an update on Thursday to fix critical end-to-end encryption vulnerabilities that subvert the confidentiality and authentication guarantees that have been key to the platform's meteoric rise. Matrix is a sprawling ecosystem of open source and proprietary chat and collaboration clients and servers that are fully interoperable. The best-known app in this family is Element, a chat client for Windows, macOS, iOS, and Android, but there's a dizzying array of other members as well. Matrix roughly aims to do for real-time communication what the SMTP standard does for email, which is to provide a federated protocol allowing user clients connected to different servers to exchange messages with each other. Unlike SMTP, however, Matrix offers robust end-to-end encryption, or E2EE, designed to ensure that messages can't be spoofed and that only the senders and receivers of messages can read the contents. Matthew Hodgson—the co-founder and project lead for Matrix and the CEO and CTO at Element, the maker of the flagship Element app—said in an email that conservative estimates are that there are about 69 million Matrix accounts spread throughout some 100,000 servers. The company currently sees about 2.5 million monthly active users using its Matrix.org server, though he said this is also likely an underestimate. Among the hundreds of organizations announcing plans to build internal messaging systems based on Matrix are Mozilla, KDE, and the governments of France and Germany. On Wednesday, a team of researchers published research that reports a host of vulnerabilities that undermine Matrix's authentication and confidentiality guarantees. All of the attacks described by the researchers require the aid of a malicious or compromised homeserver that targets the users who connect to it. In some cases, there are ways for experienced users to detect an attack is underway.' -- source: https://arstechnica.com/information-technology/2022/09/matrix-patches-vulne… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Stock Hacking TV Footage
by Lawrence D'Oliveiro 27 Sep '22

27 Sep '22

On the TVNZ news a few minutes ago, in the stock footage they were showing while John Campbell was talking about some tech-related story or other, I saw the words “struct group_info init_groups” pop up. So I did an online search, and found this Reddit thread <https://www.reddit.com/r/InternetIsBeautiful/comments/g8hcgo/this_site_make…>. Turns out there’s a website where you can pretend to be typing furiously, and this text comes up, as though it was what you were typing, to let you play at being a hacker on TV. Incidentally, the code in question is based on real code, from the Linux kernel.

1 0

20-year-old Linux workaround is still slowing down AMD systems
by Peter Reutemann 27 Sep '22

27 Sep '22

'AMD has come a long way since 2002, but the Linux kernel still treats modern Threadrippers like Athlon-era systems—at least in one potentially lag-inducing respect. AMD engineer Prateek Nayak recently submitted a patch to Linux's processor idle drivers that would "skip dummy wait for processors based on the Zen microarchitecture." When ACPI support was added to the Linux kernel in 2002—written by Andy Grover, committed by Linus Torvalds—it included a "dummy wait op." The system essentially read data with no purpose other than delaying the next instruction until the CPU could fully stop with the STPCLK# command. This allowed for some power saving and compatibility during the early days of ACPI implementation when some chipsets wouldn't move to an idle state when one would expect it. But today's Zen-based AMD chips don't need this workaround, and, as Nayak writes, it's hurting them, at least in specific workloads on Linux. Testing with instruction-based sampling (IBS) workloads shows that "a significant amount of time is spent in the dummy op, which incorrectly gets accounted as C-State residency." The CPU, seeing all this low-effort dummy work, can push into deeper, slower C-State, which then makes the CPU take longer to "wake up," especially on jobs that require lots of switching between busy and idle states. Nayak ran tests in tbench on a dual-socket Zen3 system against the baseline Linux kernel, a kernel with the C2 state entirely disabled, and a kernel with the dummy wait operation patched out. His patched version saw a 1,390 percent increase in minimum MB/s throughput and a 51 percent increase in mean MB/s over the baseline kernel, often just a little behind having C2 disabled entirely.' -- source: https://arstechnica.com/gadgets/2022/09/20-year-old-linux-workaround-is-sti… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Senators Introduce a Bill To Protect Open-Source Software
by Peter Reutemann 25 Sep '22

25 Sep '22

'Washington Post: When researchers discovered a vulnerability in the ubiquitous open-source log4j system last year that could've affected hundreds of millions of devices, the executive branch snapped into action and major tech companies huddled with the White House. Now, leaders of the Senate Homeland Security and Governmental Affairs Committee are introducing legislation to help secure open-source software, first reported by The Cybersecurity 202. Chairman Gary Peters (D-Mich.) and top ranking Republican Rob Portman (Ohio) plan to hold a vote next week on the bill they're co-sponsoring. The Peters/Portman legislation would direct the Cybersecurity and Infrastructure Security Agency to develop a way to evaluate and reduce risk in systems that rely on open-source software. Later, CISA would study how that framework could apply to critical infrastructure. The log4j "incident presented a serious threat to federal systems and critical infrastructure companies -- including banks, hospitals, and utilities -- that Americans rely on each and every day for essential services," Peters said in a written statement. "This common-sense, bipartisan legislation will help secure open source software and further fortify our cybersecurity defenses against cybercriminals and foreign adversaries who launch incessant attacks on networks across the nation." Here's how the Peters-Portman legislation works, as outlined in the report: - It directs CISA to hire open-source experts "to the greatest extent practicable." - It gives the agency a year to publish a framework on open-source code risk. A year later and periodically thereafter, CISA would perform an assessment of open-source code components that federal agencies commonly use. - Also, two years after publishing the initial framework, CISA would have to study whether it could be used in critical infrastructure outside the government and potentially work with one or more critical infrastructure sectors to voluntarily test the idea. - Other agencies would have roles as well, such as the Office of Management and Budget publishing guidance to federal chief information officers on secure use of open-source software. ' -- source: https://news.slashdot.org/story/22/09/23/2357254 What about donating time/money to "critical" open source projects? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AV1 Update Reduces CPU Encoding Times By Up To 34 Percent
by Peter Reutemann 25 Sep '22

25 Sep '22

'According to Phoronix, Google has released a new AOM-AV1 update -- version 3.5, that drastically improves encode times when streaming, rendering, or recording from the CPU. At its best, the update can improve encoding times by up to 34%. Tom's Hardware reports: It is a fantastic addition to AV1's capabilities, with the encoder becoming very popular among powerful video platforms such as YouTube. In addition, we are also seeing significant support for AV1 hardware acceleration on modern discrete GPUs now, such as Intel's Arc Alchemist GPUs and, most importantly - Nvidia's RTX 40-series GPUs. Depending on the resolution, encoding times with the new update have improved by 20% to 30%. For example, at 1080P, encode times featuring 16 threads of processing are reduced by 18% to 34%. At 4K, render times improved by 18% to 20% with 32 threads. Google could do this by adding Frame Parallel Encoding to heavily multi-threaded configurations. Google has also added several other improvements contributing to AV1's performance uplifts in other areas - specifically in real-time encoding. In other words, CPU utilization in programs such as OBS has been reduced, primarily for systems packing 16 CPU threads. As a result, they are allowing users to use those CPU resources for other tasks or increase video quality even higher without any additional performance cost. If you are video editing and are rendering out a video in AV1, processing times will be vastly reduced if you have a CPU with 16 threads or more. ' -- source: https://news.slashdot.org/story/22/09/24/1749206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Urges Action To Unpick Platform Browser Lock-ins
by Peter Reutemann 23 Sep '22

23 Sep '22

'As antitrust regulators around the world dial up scrutiny of platform power, Mozilla has published a piece of research digging into the at times subtle yet always insidious ways operating systems exert influence to keep consumers locked to using their own-brand browsers rather than seeking out and switching to independent options -- while simultaneously warning that competition in the browser market is vital to ensure innovation and choice for consumers and, more broadly, protect the vitality of the open web against the commercial giants trying to wall it up. TechCrunch: "Billions of people across the globe are dependent on operating systems from the largest technology companies. Amazon, Apple, Google, Microsoft and Meta each provide their own browser on their operating systems and each of them uses their gatekeeper position provider to preference their own browsers over independent rivals. Whether it is Microsoft pushing Firefox users to switch their default on Windows computers, Apple restricting the functionality of rival browsers on iOS smartphones or Google failing to apply default browser settings across Android, there are countless examples of independent browsers being inhibited by the operating systems on which they are dependent," Mozilla writes in a summary of its findings. "This matters because American consumers and society as a whole suffer. Not only do people lose the ability to determine their own online experiences but they also receive less innovative and lower quality products. In addition, they can be forced to accept poorer privacy outcomes and even unfair contracts. By contrast, competition from independent browsers can help to drive new features, as well as innovation in areas like privacy and security."' -- source: https://tech.slashdot.org/story/22/09/22/1841231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNU Grep 3.8 Starts Issuing Warnings About Using Egrep and Fgrep
by Peter Reutemann 22 Sep '22

22 Sep '22

'After 104 commits from six different people, GNU grep was released Saturday, reports Phoronix. The biggest change? "It's now made more clear that if you are still relying on the egrep and fgrep commands, it's past due for switching to just grep with the appropriate command-line arguments." The egrep and fgrep commands have been deprecated since 2007. Beginning with GNU Grep 3.8 today, calling these commands will now issue a warning to the user that instead they should use grep -E and grep -F, respectively. Eventually, GNU Grep will drop the egrep / fgrep commands completely but there doesn't seem to be a firm deadline yet for when that removal will happen. >From grep's updated manual: 7th Edition Unix had commands egrep and fgrep that were the counterparts of the modern 'grep -E' and 'grep -F'. Although breaking up grep into three programs was perhaps useful on the small computers of the 1970s, egrep and fgrep were not standardized by POSIX and are no longer needed. In the current GNU implementation, egrep and fgrep issue a warning and then act like their modern counterparts; eventually, they are planned to be removed entirely. If you prefer the old names, you can use use your own substitutes, such as a shell script... Other notable changes from the release announcement: - The confusing GREP_COLOR environment variable is now obsolescent. Instead of GREP_COLOR='xxx' use GREP_COLORS='mt=xxx' - Regular expressions with stray backslashes now cause warnings' -- source: https://news.slashdot.org/story/22/09/05/0135254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Repairable, upgradeable Framework Laptop will also be available as a Chromebook
by Peter Reutemann 22 Sep '22

22 Sep '22

'Fans of the modular Framework Laptop who also prefer ChromeOS to Windows or Linux are in for a treat: Framework and Google are announcing a Chromebook Edition of the laptop today. It has the same basic hardware design and works with most of the same parts as the regular Framework Laptop but with tweaks to make it a full-fledged Chromebook. While you could always take a standard Framework Laptop and install ChromeOS Flex on it, the standard version of ChromeOS still has a few features that Flex doesn't, including Android app support via Google Play, automated firmware updates, and a few other security and device management features. Framework says that the Chromebook Edition laptop will be available for preorder starting today—a version with a Core i5-1240P CPU will cost $999, although you'll only need to put down $100 to reserve your preorder. Orders begin shipping in December. Framework is also putting parts specific to the Chromebook Edition laptop into its Framework Marketplace parts store.' -- source: https://arstechnica.com/gadgets/2022/09/repairable-upgradeable-framework-la… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Document Foundation Starts Charging For 'Free' LibreOffice
by Peter Reutemann 22 Sep '22

22 Sep '22

'The Document Foundation, the organization that tends the open source productivity suite LibreOffice, has decided to start charging for one version of the software. The Register reports: LibreOffice is a fork of OpenOffice and is offered under the free/open source Mozilla Public License Version 2.0. A Monday missive from the Document Foundation reveals the org will begin charging 8.99 euros for the software -- but only when sold via Apple's Mac App Store. That sum has been styled a "convenience fee ... which will be invested to support development of the LibreOffice project." The foundation suggests paying up in the Mac App Store is ideal for "end users who want to get all of their desktop software from Apple's proprietary sales channel." Free downloads of LibreOffice for macOS from the foundation's site will remain available and arguably be superior to the App Store offering, because that version will include Java. The foundation argued that Apple does not permit dependencies in its store, so it cannot include Java in the 8.99 euro offering. The version now sold in the App Store supersedes a previous offering provided by open source support outfit Collabora, which charged $10 for a "Vanilla" version of the suite and threw in three years of support. The foundation's marketing officer Italo Vignoli said the change was part of a "new marketing strategy." "The Document Foundation is focused on the release of the Community version, while ecosystem companies are focused on a value-added long-term supported versions targeted at enterprises," Vignoli explained. "The distinction has the objective of educating organizations to support the FOSS project by choosing the LibreOffice version which has been optimized for deployments in production and is backed by professional services, and not the Community version generously supported by volunteers." "The objective is to fulfil the needs of individual and enterprise users in a better way," Vignoli added, before admitting "we know that the positive effects of the change will not be visible for some time. Educating enterprises about FOSS is not a trivial task and we have just started our journey in this direction."' -- source: https://apple.slashdot.org/story/22/09/20/2039208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Linus Torvalds: Rust Will Go Into Linux 6.1
by Peter Reutemann 20 Sep '22

20 Sep '22

'As previously indicated on Slashdot, Rust was slated to be coming to the Linux Kernel sometime in the 6.x version. Well wonder no longer on which version of kernel 6.x will have the first bits of Rust officially in the kernel, as Linus has confirmed that 6.1 will be the first with the new NVMe kernel drivers being in Rust. The first version non-production ready code for the NVMe Rust based kernel drivers were already producing performance comparable to C code. So the final drivers to hit 6.1 are already looking promising. It also helped Rust's case that, thanks to the ground-breaking work of Linux kernel and Rust developer Miguel Ojeda, Rust on Linux has gotten much more mature. Kernel maintainers were convinced it is time to move forward with Rust in Linux. In short, they agreed that Rust on Linux was ready for work.' -- source: https://linux.slashdot.org/story/22/09/19/205239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0