- wlug - list.wlug.org.nz

North Island GP Network Compromised
by Lawrence D'Oliveiro 04 Oct '22

04 Oct '22

Pinnacle Midlands Health Network, which services medical practices in Taranaki, Rotorua, Taupō-Tūrangi, Thames-Coromandel and Waikato, had its systems broken into last Wednesday, though the incident is only coming to light today <https://www.nzherald.co.nz/nz/patient-details-compromised-in-cyber-attack-o…>. It doesn’t appear like they hold medical information about patients (beyond NHI numbers), only personal contact details.

1 0

Patient details compromised in cyber attack on North Island GP network
by Peter Reutemann 04 Oct '22

04 Oct '22

NZ Herald reports: 'Patient details have been compromised in a cyber attack targeting a network of GP services across the North Island. Pinnacle Midlands Health Network said in a statement that the "cyber incident" impacted some of its IT services. Offices and practices in Taranaki, Rotorua, Taupō-Tūrangi, Thames-Coromandel and Waikato were impacted. [...] Pinnacle holds personal information such as names, addresses and national health index numbers. Butcher said GP notes were not stored on their files.' -- source: https://www.nzherald.co.nz/nz/patient-details-compromised-in-cyber-attack-o… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Still can’t buy a Raspberry Pi board? Things aren’t getting better anytime soon
by Peter Reutemann 04 Oct '22

04 Oct '22

'Shortages for lots of tech components, including things like DDR5 and GPUs, have eased quite a bit since the beginning of 2022, and prices have managed to go down as availability improves. But that reprieve hasn't come for hobbyists hoping to get a Raspberry Pi, which remains as hard to buy today as it was a year ago. The most recent update on the situation comes from Raspberry Pi founder Eben Upton via YouTuber Jeff Geerling—Upton told Geerling that Pi boards are subject to the same supply constraints since the last time he wrote a post about the situation in April. Around 400,000 Pi boards are still produced per month, and some of these are being earmarked to be sent out to consumer retail sites. But Upton says that most of these are still being reserved for and sold to commercial customers who rely on Pi boards to run their businesses.' -- source: https://arstechnica.com/gadgets/2022/10/still-cant-buy-a-raspberry-pi-board… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.0 arrives with support for newer chips, core fixes, and oddities
by Peter Reutemann 04 Oct '22

04 Oct '22

'A stable version of Linux 6.0 is out, with 15,000 non-merge commits and a notable version number for the kernel. And while major Linux releases only happen when the prior number's dot numbers start looking too big—"there is literally no other reason"—there are a lot of notable things rolled into this release besides a marking in time. Most notable among them could be a patch that prevents a nearly two-decade slowdown for AMD chips, based on workaround code for power management in the early 2000s that hung around for far too long. Intel's Dave Hansen wrote the patch that made it into 6.0, noting in a comment on an Ars post that the issue had become an expensive drain as AMD systems gained higher CPU core counts. The average desktop user won't see huge gains, but larger systems working on intensive input/output applications should benefit. Intel's new Arc GPUs are supported in their discrete laptop form in 6.0 (though still experimental). Linux blog Phoronix notes that Intel's ARC GPUs all seem to run on open source upstream drivers, so support should show up for future Intel cards and chipsets as they arrive on the market. Linux 6.0 includes several hardware drivers of note: fourth-generation Intel Xeon server chips, the not-quite-out 13th-generation Raptor Lake and Meteor Lake chips, AMD's RDNA 3 GPUs, Threadripper CPUs, EPYC systems, and audio drivers for a number of newer AMD systems. One small, quirky addition points to larger things happening inside Linux. Lenovo's ThinkPad X13s, based on an ARM-powered Qualcomm Snapdragon chip, get some early support in 6.0. ARM support is something Linux founder Linus Torvalds is eager to see—he recently wrote release notes for kernel versions from his M2-powered MacBook Air and believes that more people using Linux on ARM devices leads to more bug reports, more patches, and more enthusiasm. Among other changes you can find in Linux 6.0, as compiled by LWN.net (in part one and part two): - ACPI and power management improvements for Sapphire Rapids CPUs - Support for SMB3 file transfer inside Samba, while SMB1 is further deprecated - More work on RISC-V, OpenRISC, and LoongArch technologies - Intel Habana Labs Gaudi2 support, allowing hardware acceleration for machine-learning libraries - A "guest vCPU stall detector" that can tell a host when a virtual client is frozen Not included in 6.0 are Rust enhancements, but those are likely coming in the next point release, 6.1. Rust, a memory-safe language sponsored by the Mozilla project, started out as something Torvalds took a wait-and-see approach toward and is now something he was hoping to see in 6.0. "Unless something odd happens, it will make it into 6.1," Torvalds told ZDNet's Steven Vaughan-Nichols in mid-September. Even just having the "core infrastructure" for Rust in 6.1 signifies a big change in Linux, which has long been dominated by C languages (however extended and modified). It must be noted that in 2022, there are patches in Linux 6.0 to help Atari's Falcon computers from the early 1990s (or their emulated descendants) better handle VGA modes, color, and other issues.' -- source: https://arstechnica.com/gadgets/2022/10/linux-6-0-arrives-with-support-for-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Fall And Rise Of Xen
by Lawrence D'Oliveiro 03 Oct '22

03 Oct '22

Here’s a report <https://www.theregister.com/2022/09/30/citrix_xen/> on a talk by the software development manager at Citrix, detailing the ups and downs in the history of their Xen hypervisor. Initially they had a “freemium” model, with an open-source “community” version and a proprietary paid “enterprise” version with more capabilities. This worked well and brought in sufficient revenue to be sustainable. Then they decided to switch to make the “enterprise” version open-source as well, relying on customers’ willingness to continue to pay maintenance rather than support the code themselves. This bet failed to pay off, and revenue crashed. On the other hand, Citrix did not include the “accompanying tooling” (not sure what they mean here -- build tools? Add-on admin tools?) with the source code, making it hard for others to use that code. (Were the big “enterprise” users the ones able to figure that out?) Then they tried to go back to a “freemium” model, with restrictions being imposed on the open-source version. While this did restore the revenue stream, it also antagonized a significant part of the community that had been using the open-source version in various unusual and creative ways. These users forked the code to create XCP-ng, leaving Citrix behind. I suppose the lesson to take from this is that “freemium” works, but it is best if you do things that way from the beginning: trying to switch to it (or switch back to it) from an all-Free model can be painful.

1 0

OpenWRT on Linksys WRT1900ACS
by Peter Reutemann 03 Oct '22

03 Oct '22

Hi everyone I finally bit the bullet and installed OpenWRT on my Linksys WRT1900ACS (v2) router. The main reason was the stupid (and incredibly insecure) guest network implementation that the router came with. Despite supplying a password in the admin interface, the network was run as an open network that anyone could access. The password didn't seem to be used at all... Not exactly what I had in mind! Since Ian presented on OpenWRT before, I at least had a rough idea on what I could expect in user interface and functionality, which helped a lot. :-) In case someone should have the same router, I found the following links very useful: - general info on the router and links to images https://openwrt.org/toh/linksys/wrt1900acs - tutorial for migrating your router to OpenWRT https://www.albertogonzalez.net/how-to-install-openwrt-on-the-linksys-wrt19… NB: you need to plug in via ethernet after flashing, since the wlan is not enabled by default - getting fibre working here in NZ (VLAN 10) http://www.lindesay.co.nz/blog/2019/2019-openwrt-nz-fibre/ - setting up a guest wifi network https://openwrt.org/docs/guide-user/network/wifi/guestwifi/configuration_we… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Debian Chooses Reasonable, Common Sense Solution To Dealing With Non-Free Firmware
by Peter Reutemann 03 Oct '22

03 Oct '22

'Michael Larabel writes via Phoronix: Debian developers have been figuring out an updated stance to take on non-free firmware considering the increasing number of devices now having open-source Linux drivers but requiring closed-source firmware for any level of functionality. The voting on the non-free firmware matter has now concluded and the votes tallied... The debian votes option 5 as winning: "Change SC for non-free firmware in installer, one installer." Basically the Debian Installer media will now be allowed to include non-free firmware and to automatically load/use it where necessary while informing the user of it, etc. Considering the state of the hardware ecosystem these days, it's reasonable and common sense since at least users will be able to easily make use of their graphics cards, network adapters, and more. Plus a number of modern CPU security mitigations also requiring the updated closed-source microcode. So all in, I am personally happy with this decision as it will allow for a more pleasant experience for Debian on modern systems and one akin to what is found with other Linux distributions. The solution is described in full via the Debian Wiki.' -- source: https://linux.slashdot.org/story/22/10/02/1650200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quis Custodiet Ipsos Custodes?
by Lawrence D'Oliveiro 01 Oct '22

01 Oct '22

Came across yet another crop of articles recently which painfully highlight the problems with having social-media companies manage their own moderation. This one <https://arstechnica.com/gaming/2022/09/youtube-age-restriction-quagmire-exp…> shows the inconsistencies in the criteria that YouTube uses to apply age restrictions to uploaded videos. Not only are the criteria mysterious, but the appeal process is opaque, and too often the only way to get results is by appeal to the popular fanbase. Assuming you have one. Related to that, Facebook earlier banned any promotion on its platform of a re-release of a movie called “Beautiful Blue Eyes” <https://arstechnica.com/tech-policy/2022/09/holocaust-filmmaker-says-meta-d…>, seemingly not because of its content (partly set during the Nazi Holocaust), but because of the title. An appeal was rejected with “our decision is final”. Only for the ban to be lifted later, absolutely nothing to do with any public outcry, you can take our word on that. Then there is this coronial inquest <https://arstechnica.com/tech-policy/2022/09/coroner-lists-instagram-algorit…> into the self-inflicted death of a young teen who had been watching way too many posts on Pinterest and Instagram promoting self-harm. Pinterest at least had the humility to admit that their moderation system was not satisfactory and needed to be improved. But Meta (parent company of Instagram and Facebook) sent their “head of health and well-being” to testify that the content was classified as “safe” according to their standards. Free speech between mature adults is one thing, keeping impressionable youngsters safe is quite another.

2 2

Google Delays the Death of Manifest V2 Extensions To 2024
by Peter Reutemann 01 Oct '22

01 Oct '22

'Google announced an extension of the deadline to remove support for Manifest V2 extensions in the company's Chrome browser and the open source Chromium core. The change does not impact the core decision of removing support for Manifest V2 extensions in favor of Manifest V3. Dubbed, the adblocker killer initially, due to limitations imposed on content blocking and other types of browser extensions, Google made concessions that allows content blockers to run on Chrome after the final switch is made. Extensions are still limited in comparison to Manifest V2, especially if multiple that use filtering functionality are run simultaneously, or if lots of filters are activated in a single extension. Google's initial plan was to stop supporting Manifest V2 extensions in Chrome by June 2023. For most users, support would run out in January 2023, but an Enterprise policy would enable users to extend the deadline by six months.' -- source: https://tech.slashdot.org/story/22/09/30/1437209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

2022 Web Almanac
by Lawrence D'Oliveiro 30 Sep '22

30 Sep '22

Report <https://devclass.com/2022/09/29/massive-web-tech-survey-shows-how-bad-habit…> on the 2022 Web Almanac (sort of a “state of the Web” report), which is in the process of being published. * WebAssembly is still not being used a lot * WordPress is one of the worst-performing content-management systems, and also still the most popular (and its popularity is still growing) * Image formats: the time has come to move beyond sRGB and 1990s-era formats (e.g. replace JPEG with the more efficient WebP) * JavaScript: a lot of pages seem to load code which is not actually used I was looking up how page-loading performance is measured, and here is my understanding of what the terms mean: * Largest Contentful Paint (LCP): the time to render the largest image/text block on the page. * First Input Delay (FID): how long after the user clicks on a link or a control etc before the browser starts responding. * Cumulative Layout Shift (CLS): a measure of how much things move around on the page while the page is still loading. This is a product of the “impact fraction” (proportion of the viewport affected by movements between frames) and the “distance fraction” (largest distance moved by an element, as a fraction of viewport size).

1 0