- wlug - list.wlug.org.nz

openSUSE Wants A New Logo
by Lawrence D'Oliveiro 09 Dec '23

09 Dec '23

openSUSE is asking for submissions of new logos for the main project and its various offshoots. I must say the list of entrants so far <https://en.opensuse.org/Logocontest> is quite varied. Even the ones based on a (recognizable) gecko theme still manage to portray it in a remarkable number of ways.

2 1

Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack
by Peter Reutemann 07 Dec '23

07 Dec '23

'Hundreds of Windows and Linux computer models from virtually all hardware makers are vulnerable to a new attack that executes malicious firmware early in the boot-up sequence, a feat that allows infections that are nearly impossible to detect or remove using current defense mechanisms. The attack—dubbed LogoFAIL by the researchers who devised it—is notable for the relative ease in carrying it out, the breadth of both consumer- and enterprise-grade models that are susceptible, and the high level of control it gains over them. In many cases, LogoFAIL can be remotely executed in post-exploit situations using techniques that can’t be spotted by traditional endpoint security products. And because exploits run during the earliest stages of the boot process, they are able to bypass a host of defenses, including the industry-wide Secure Boot, Intel’s Secure Boot, and similar protections from other companies that are devised to prevent so-called bootkit infections. LogoFAIL is a constellation of two dozen newly discovered vulnerabilities that have lurked for years, if not decades, in Unified Extensible Firmware Interfaces responsible for booting modern devices that run Windows or Linux. The vulnerabilities are the product of almost a year’s worth of work by Binarly, a firm that helps customers identify and secure vulnerable firmware. The vulnerabilities are the subject of a coordinated mass disclosure released Wednesday. The participating companies comprise nearly the entirety of the x64 and ARM CPU ecosystem, starting with UEFI suppliers AMI, Insyde, and Phoenix (sometimes still called IBVs or independent BIOS vendors); device manufacturers such as Lenovo, Dell, and HP; and the makers of the CPUs that go inside the devices, usually Intel, AMD or designers of ARM CPUs. The researchers unveiled the attack on Wednesday at the Black Hat Security Conference in London. The affected parties are releasing advisories that disclose which of their products are vulnerable and where to obtain security patches. Links to advisories and a list of vulnerability designations appears at the end of this article. [...] LogoFAIL vulnerabilities are tracked under the following designations: - CVE-2023-5058 - CVE-2023-39538 - CVE-2023-39539 - CVE-2023-40238' -- source: https://arstechnica.com/security/2023/12/just-about-every-windows-and-linux… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Ready, Fire! Aim.”
by Lawrence D'Oliveiro 07 Dec '23

07 Dec '23

NASA’s OSIRIS REx mission successfully returned a sample to Earth from the asteroid Bennu back in September, three years after it was collected. However, it could so easily have gone wrong, due to a little oopsie, according to <https://arstechnica.com/space/2023/12/nasas-asteroid-mission-struck-its-tar…>. What was supposed to happen was, at an altitude of 100,000 feet, the return capsule should have deployed its drogue chute. Then, five minutes later, the cord for this chute would be cut, allowing the main chute to unfurl, after the drogue had done its part in slowing down the capsule descent. Instead, due to a case of (literal) crossed wires, the signal sent at 100,000 feet triggered the cutting (intead of the deployment) of the drogue chute cord, while it was still packed inside the capsule. Then, at 9,000 feet, the release of the main chute caused the drogue chute to pop out first, and immediately fall away. Luckily, there was sufficient margin in the design of the main chute that it was able to cope with the higher descent speed, and bring the capsule down to a safe landing even with this complete failure of the drogue chute. And it was all down to insufficiently clear assembly instructions: "In the design plans for the system, the word 'main' was used inconsistently between the device that sends the electric signals, and the device that receives the signals," NASA said in a written statement. "On the signal side, 'main' meant the main parachute. In contrast, on the receiver side 'main' was used as a reference to a pyrotechnic that fires to release the parachute canister cover and deploy the drogue. "Engineers connected the two mains, causing the parachute deployment actions to occur out of order," NASA said. See, it’s not just software (and hardware) that needs debugging; documentation does, too.

1 0

Veteran Editors Notepad++ and Geany Hit Milestone Versions
by Peter Reutemann 07 Dec '23

07 Dec '23

'Liam Proven reports via The Register: One of the best FOSS text editors for Windows, Notepad++, is turning 20, while cross platform Geany just hit version 2.0 as it turns 18 years old. Notepad++'s version 8.6 is the twentieth anniversary release of one of the go-to FOSS text editors for Windows. [...] If you use an Arm-powered Windows machine, such as the ThinkPad X13S, there is now a native Arm64 version. It still supports x86-32 as well, and there are portable versions which work without being installed locally -- handy if you don't have admin rights. There is even a usefully recent version for Windows XP if you are still using that geriatric OS. This release adds multi-select, allowing you to manipulate multiple instances of the same text at once, which looks confusing but very powerful. It is a staple on all of the Reg FOSS desk's Windows partitions, thanks to its inclusion in the essential Windows post-install setup tool Ninite. Ninite will install -- and update -- a whole swath of FOSS and freeware tools for Windows, making setup of a new machine doable in just a couple of clicks. And if you keep the Ninite installer file around, you can re-run it later and it will update everything it installed first time around. Ninite does offer other programmers' editors, such as Eclipse and Microsoft Visual Studio Code -- but they are behemoths by comparison. VSCode is implemented as an Electron app, meaning that it's huge, embeds an entire copy of Chromium, and scoffs RAM like it's going out of fashion. Notepad++ is a native Win32 app, making it tiny and fast: the download is less than 5MB, one twentieth the size of VSCode. Sluggish, bloated editors are not just a problem on Windows. Gargantuan Electron apps are distressingly prevalent on Linux and macOS as well. This vulture is guilty of using some, and even recommending them -- because some of them can do things that nothing else can. That's not true in the case of plain text editors, though. You don't have to put up with apps that take a good fraction of a gigabyte for this. Geany is a good example. It straddles the line between a text editor and an IDE: it can manage multi-project files, automatically call out to compilers and suchlike, and parse their output to highlight errors. We last mentioned it nearly a decade ago but the project recently reached voting age -- at least for humans -- and after this milestone in maturity its developers called the latest release version 2.0. It has better support for dark mode, a new tree view in its sidebar, adds a bunch of new supported file types, and can detect if the user changes the type of a file and re-do its syntax highlighting to match. ' -- source: https://news.slashdot.org/story/23/12/06/2153200 Yes, Notepad++ and 7zip are usually the first things I install on Windows boxes, to get something more usable than the built-in tools. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Developers Trust AI-Written Code Too Much
by Lawrence D'Oliveiro 06 Dec '23

06 Dec '23

Some worrying results from a survey <https://devclass.com/2023/12/05/ai-assistants-write-insecure-code-that-huma…> of the increasing use of AI-generated program code. The survey references a study ... from late last year which looked at “how developers choose to interact with AI code assistants and the ways in which those interactions cause security mistakes,” though the study was limited to university students. There are some shocks here, including the willingness of the AI assistant to generate SQL “that built the query string via string concatenation,” a sure route to SQL injection vulnerabilities. And also a very common feature in code written by PHP developers. Perhaps that kind of code figured very prominently in the training sets for these AIs? Also note this: A key problem is that human intuition seems inclined to trust AI engines more than their known limitations merit. It is known that generative AI is not reliable; yet a lifetime of learning that computers are more logical than humans is hard to overcome. Surely this is just the stereotypical, simplistic Hollywood movie/TV view of computers? Can people in the real world be that dumb? Those of us with experience of computers realize that “more logical than humans” merely means “being able to follow longer logical inference chains than humans”. But if the assumptions the computer is starting from are wrong, the inferences it draws are going to be just as wrong: “Garbage In, Garbage Out” as the old saying goes. And bugs in the algorithms for following those inference chains (e.g. incorrect coding of calculation formulas) just make things worse.

1 0

Firefox On the Brink?
by Peter Reutemann 06 Dec '23

06 Dec '23

'An anonymous reader shares a report: A somewhat obscure guideline for developers of U.S. government websites may be about to accelerate the long, sad decline of Mozilla's Firefox browser. There already are plenty of large entities, both public and private, whose websites lack proper support for Firefox; and that will get only worse in the near future, because the 'fox's auburn paws are perilously close to the lip of the proverbial slippery slope. The U.S. Web Design System (USWDS) provides a comprehensive set of standards which guide those who build the U.S. government's many websites. Its documentation for developers borrows a "2% rule" from its British counterpart: "... we officially support any browser above 2% usage as observed by analytics.usa.gov." (Firefox's market share was 2.2%, per the traffic for the previous ninety days.) [...] "So what?" you may wonder. "That's just for web developers in the U.S. government. It doesn't affect any other web devs." Actually, it very well could. Here's how I envision the dominoes falling: 1. Once Firefox slips below the 2% threshold in the government's visitor analytics, USWDS tells government web devs they don't have to support Firefox anymore. 2. When that word gets out, it spreads quickly to not only the front-end dev community but also the corporate IT departments for whom some web devs work. Many corporations do a lot of business with the government and, thus, whatever the government does from an IT standpoint is going to influence what corporations do. 3. Corporations see this change as an opportunity to lower dev costs and delivery times, in that it provides an excuse to remove some testing (and, in rare cases, specific coding) from their development workflow.' -- source: https://news.slashdot.org/story/23/12/05/0745251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenZFS Fixes Data Corruption Issue
by Peter Reutemann 05 Dec '23

05 Dec '23

'A pull request has been merged to fix a data corruption issue in OpenZFS (the open-source implementation of the ZFS file system and volume manager). "OpenZFS 2.2.2 and 2.1.14 released with fix in place," reports a Thursday comment on GitHub. Earlier this week, jd (Slashdot reader #1,658) wrote: All versions of OpenZFS 2.2 suffer from a defect that can corrupt the data. Attempts to mitigate the bug have reduced the likelihood of it occurring, but so far nobody has been able to pinpoint what is going wrong or why. Phoronix reported on Monday: Over the US holiday weekend it became more clear that this OpenZFS data corruption bug isn't isolated to just the v2.2 release — older versions are also susceptible — and that v2.2.1 is still prone to possible data corruption. The good news at least is that data corruption in real-world scenarios is believed to be limited but with some scripting help the corruption can be reproduced. It's also now believed that the OpenZFS 2.2 block cloning feature just makes encountering the problem more likely. ' -- source: https://news.slashdot.org/story/23/12/03/0134224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

RHEL 10 Plans To Drop X.Org Server Except For XWayland
by Peter Reutemann 01 Dec '23

01 Dec '23

'"Red Hat is going to do away with the X.Org server and support Wayland and XWayland for apps that currently (or only) run on X11," writes Slashdot reader motang. Red Hat's Carlos Soriano Sanchez confirmed on the Red Hat blog: "The result of this evaluation is that, while there are still some gaps and applications that need some level of adaptation, we believe the Wayland infrastructure and ecosystem are in good shape, and that we're on a good path for the identified blockers to be resolved by the time RHEL 10 is out, planned to be released on the first half of 2025. With this, we've decided to remove Xorg server and other X servers (except Xwayland) from RHEL 10 and the following releases. Xwayland should be able to handle most X11 clients that won't immediately be ported to Wayland, and if needed, our customers will be able to stay on RHEL 9 for its full life cycle while resolving the specifics needed for transitioning to a Wayland ecosystem. It's important to note that "Xorg Server" and "X11" are not synonymous, X11 is a protocol that will continue to be supported through Xwayland, while the Xorg Server is one of the implementations of the X11 protocol. [...] This decision will allow us to focus our efforts starting from RHEL 10 solely on a modern stack and ecosystem. This means we will be able to tackle problems such as HDR, increased security, setups with mixed low and high density displays or very high density displays, better GPU/Display hot-plugging, better gestures and scrolling, and so on. We are confident that Wayland will provide a solid platform and we're excited to work with the community and all of our partners and customers on building the future for Linux." ' -- source: https://linux.slashdot.org/story/23/11/29/0559207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Don Hopkins Blog
by Lawrence D'Oliveiro 30 Nov '23

30 Nov '23

Following some random link (as you do) left me ending up at a collection of postings on Medium <https://donhopkins.medium.com/> by one Don Hopkins. His brief bio on that page starts “User interface flower child”, and his personal network includes such luminaries as Alan Kay and bright sparks at Sun Microsystems and elsewhere. (You can tell from those names that he’s been around a while.) Here <https://donhopkins.medium.com/alan-kay-on-should-web-browsers-have-stuck-to…> is an example of the kind of freewheeling discussion he and his mates get into, over the connections between web browsers, the PostScript printing language, Apple’s old HyperCard and AppleScript technologies, Xerox PARC, SimCity (!) and other fun stuff. Including some concepts that might have been, but never were.

1 0

ownCloud vulnerability with maximum 10 severity score comes under “mass” exploitation
by Peter Reutemann 30 Nov '23

30 Nov '23

'Security researchers are tracking what they say is the “mass exploitation” of a security vulnerability that makes it possible to take full control of servers running ownCloud, a widely used open source file-sharing server app. The vulnerability, which carries the maximum severity rating of 10, makes it possible to obtain passwords and cryptographic keys allowing administrative control of a vulnerable server by sending a simple Web request to a static URL, ownCloud officials warned last week. Within four days of the November 21 disclosure, researchers at security firm Greynoise said, they began observing “mass exploitation” in their honeypot servers, which masqueraded as vulnerable ownCloud servers to track attempts to exploit the vulnerability. The number of IP addresses sending the web requests has slowly risen since then. At the time this post went live on Ars, it had reached 13. “We're seeing hits to the specific endpoint that exposes sensitive information, which would be considered exploitation,” Glenn Thorpe, senior director of security research & detection engineering at Greynoise, said in an interview on Mastodon. “At the moment, we've seen 13 IPs that are hitting our unadvertised sensors, which indicates that they are pretty much spraying it across the internet to see what hits.” CVE-2023-49103 resides in versions 0.2.0 and 0.3.0 of graphapi, an app that runs in some ownCloud deployments, depending on the way they’re configured. A third-party code library used by the app provides a URL that, when accessed, reveals configuration details from the PHP-based environment. In last week’s disclosure, ownCloud officials said that in containerized configurations—such as those using the Docker virtualization tool—the URL can reveal data used to log in to the vulnerable server. The officials went on to warn that simply disabling the app in such cases wasn’t sufficient to lock down a vulnerable server.' -- source: https://arstechnica.com/security/2023/11/owncloud-vulnerability-with-a-maxi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FFmpeg 6.1 “Heaviside”
by Lawrence D'Oliveiro 29 Nov '23

29 Nov '23

Seems there is another numbered-version release of FFmpeg <https://www.theregister.com/2023/11/24/ffmpeg_6_1/>. I didn’t even notice: I did a fresh build a few days ago, and I fetch my upstream from <git://source.ffmpeg.org/ffmpeg>, and it appears that repo now actually points to <http://git.videolan.org/?p=ffmpeg.git>. And I just build whatever happens to be at the head of the master branch at the time. This FFmpeg version is named “Heaviside”, after Oliver Heaviside, a major figure in the whole 19th-century ferment over electromagnetic theory, Maxwell’s equations, the development of the associated mathematical techniques of vector analysis, quaternions and all that jazz. If you are interested, here <https://www.youtube.com/watch?v=M12CJIuX8D4> is an entertaining exposition on the very human figures involved in these developments, from a presenter who combines an enthusiasm for the subject with the patience to dig up a remarkable amount of detail (including personal foibles, naturally) about what went on. Why build FFmpeg yourself? Because then you can enable combinations of options that are not legally allowed in any prebuilt binary package. For example, you can have both “--enable-gpl” and “--enable-nonfree”, and end up with a build that is marked “unredistributable”. FFmpeg is both a set of command-line tools, and a set of libraries underlying them, that can also be built into other custom applications. For those intimidated by the truly breathtaking array of options in the command-line tools, there are GUI front-ends to make the functionality more approachable. I hear HandBrake is quite popular. Though I was disappointed to discover that, instead of being a simple GUI wrapper around the command-line tools, it builds its own application directly around the libraries. The downsides of this are that it limits the functionality it can make available, and also makes it harder to keep up with changes to that functionality.

1 1

Roll On The ARM-Based Supers
by Lawrence D'Oliveiro 29 Nov '23

29 Nov '23

Report on the status of ARM-based supercomputing <https://www.nextplatform.com/2023/11/28/hpc-pioneers-pave-the-way-for-a-flo…>. The Fugaku machine was top of the Top500 list from June 2020 to November 2021, which was a pretty decent run. That Fujitsu A64FX chip also powers other supers on the list. But now more entrants are on the way. In terms of user experience, the article reports quite a mixed bag. Some apps are yet to be tuned to wring maximum performance out of ARM hardware, while others build and run nicely without any drama at all. And of course, at some point we should see the first RISC-V machine(s) enter the list.

1 0

MyACC Offline After “Fraudulent Activity”
by Lawrence D'Oliveiro 29 Nov '23

29 Nov '23

ACC’s self-service web portal for accident victims has been temporarily taken down after “apparent fraudulent access” <https://www.nzherald.co.nz/business/myacc-offline-after-fraudulent-activity…>. Here’s hoping it’s not yet another mass compromise of user data ...

1 0

OpenZFS Data-Corruption Bug
by Lawrence D'Oliveiro 29 Nov '23

29 Nov '23

Seems OpenZFS has a problem which, under rare conditions, can turn parts of your data into rubbish <https://www.theregister.com/2023/11/27/openzfs_2_2_0_data_corruption/>. Initially it was thought this bug was introduced in version 2.2.0, but now there is some indication that it goes back much earlier. It certainly seems difficult to reproduce, and at least one commenter on the article is saying not to worry about it, it’s not going to affect most “traditional” users (whatever that means). It seems the issue does date back to after Oracle closed the source on the original ZFS project and made it proprietary again. Open-source ZFS has long been a controversial issue. Linus Torvalds is not impressed with its performance, for example <https://list.waikato.ac.nz/archives/list/wlug(a)list.waikato.ac.nz/thread/C…>. Also, many have said that the licence it uses, the CDDL, is deliberately designed to be incompatible with the GPL used by the Linux kernel and many other projects. Ubuntu seem to disagree, and are happy to include OpenZFS with their Linux distro. Interestingly, Oracle also offer a Linux distro. And they have never offered ZFS with that, even though there is clearly demand for such a feature. Some interpret this as a tacit admission that the licence _is_ indeed GPL-incompatible. Because if Oracle bundled CDDL-licensed software with that made available under the GPL, then under the terms of the latter, they also give permission to anybody else to do the same. The implication is, they don’t want to do that.

1 0

PHP 8.0 End of Life Is Today, November 26, 2023
by Peter Reutemann 27 Nov '23

27 Nov '23

'Slashdot reader sysadminafterdark writes: Released on November 26, 2020, PHP 8 brought many optimizations and powerful features to the language.Fast forward to today, and PHP 8 is getting the boot in favor of 8.1, 8.2, and 8.3 with 8.4 in development. This leaves some websites at risk of breaking and potential security issues. Hearing of this news, I upgraded my own blog and wrote an article on how to add the Remi repository and update. I run Enterprise Linux (The best distro out there) so if you are standing up new boxes, just keep in mind the PHP in the repo is deprecated.' -- source: https://developers.slashdot.org/story/23/11/26/1826247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

util-linux Collection
by Lawrence D'Oliveiro 26 Nov '23

26 Nov '23

I was looking at the source repository for the util-linux package <https://github.com/util-linux/util-linux>, and discovered that the collection of tools is larger than I thought. There are also a few items listed that aren’t (yet?) in the installed package on my Debian Unstable system. For example, I recently discovered that the “mount” command not only does mounting and unmounting of volumes, but without any options it will also output a list of all current mounts, and this can be done by nonprivileged users. But util-linux includes a more powerful command for this purpose called “findmnt”, which includes more elaborate options for obtaining information about mounted filesystems, including monitoring changes to them. In that repo, I also found “lsfd”, which is meant to be a replacement for “lsof” that takes advantage of newer capabilities specific to the Linux kernel. Also there is “lsns”, which displays information about namespaces. Firefox, in particular, seems to use a whole lot of these, presumably as part of its mechanisms for isolating its processes from each other. This is in addition to other useful ones like “lscpu”, “lspci” “lsusb”, “lsmem”, “lsblk”, “lslocks” and “lsirq”. Interesting that quite a few of these commands support JSON output format. If you don’t want to go this far, you can explicitly specify which columns are included in the output; this is recommended if you want to parse the output in scripts, instead of relying on the default output format not changing. And yes, I have seen some over-elaborate scripts that went to a whole lot of trouble to extract the information they needed from some command, instead of using options in the command to output that information directly.

1 0

Microsoft Windows And The “USB Cart Of Death”
by Lawrence D'Oliveiro 26 Nov '23

26 Nov '23

For all Microsoft’s efforts, it seems Windows and USB have never sat entirely easily together. Here <https://www.theregister.com/2023/11/25/windows_usb_cart_of_death/> is a story from the early days, of how QA people (remember when Microsoft had QA people?) would torment kernel developers by wheeling in a cart laden with USB devices, all daisy-chained together, plugging them in to the test machine, pulling the plug out again, and watching the resulting crash. "The goal," said Chen, "was to get it to the point where you could plug in the USB Cart of Death and unplug it anytime you wanted, and everything would still work... and I think they made it." Note that “I think”. I suppose things are better nowadays, somewhat. I remember when I was starting to learn Android development, I was bemused to discover that Windows required a special USB driver in order to allow live debugging on a connected Android device. This was not necessary on any other platform--their built-in USB support was quite sufficient. And wouldn’t you know it, that limitation still applies to current versions of Windows <https://developer.android.com/studio/run/win-usb>.

1 0

Microsoft’s “Project Silica”: Glass-Based Archival Storage
by Lawrence D'Oliveiro 24 Nov '23

24 Nov '23

A group at Microsoft is researching the potential of being able to store data in slabs of quartz glass, at densities comparable to hard drives or even higher <https://blocksandfiles.com/2023/11/22/microsoft-silica-glass-based-storage/>. The data is encoded optically in the glass, using femtosecond laser pulses. There can be hundreds of layers of data within a single block of glass. However, reading back the data involves processing scanned images of the glass layers through a “machine learning algorithm”. This can take some time. That means verification of a backup you just did is going to be just as slow.

1 0

Firefox 120 Ready With Global Privacy Control, WebAssembly GC On By Default
by Peter Reutemann 24 Nov '23

24 Nov '23

'Firefox 120 will be available tomorrow, bringing support for the Global Privacy Control "Sec-GPC" request header to indicate whether a user consents to a website or service selling or sharing their personal information with third parties. It's also enabling the WebAssembly GC extension by default, opening up new languages like Dart and Kotlin to run in the browser. Phoronix's Michael Larabel highlights some of the other features included in this release: - Ubuntu Linux users now have the ability to import data from Chromium when both are installed as Snap packages. - Picture-in-Picture mode now supports corner snapping on Windows and Linux. - Support for the light-dark() CSS color function that allows setting of colors for both light and dark without needing to use the prefers-color-scheme media feature. This allows conveniently specifying the preferred light color theme value followed by the dark color theme value. - CSS support for the lh and rlh line height units. ' -- source: https://news.slashdot.org/story/23/11/20/2132231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Ditching an IDE for hacking on Inkscape
by Ben Cottrell 23 Nov '23

23 Nov '23

I’ve acquainted myself with many IDE’s: Visual Studio, Qt Creator, CLion, and I’ve found it counter-productive to reconfigure projects and/or build environments within an IDE. Instead, I can use nvim, the MSYS MINGW x64 shell and environment (I use OpenSUSE Tumbleweed, but I have the misfortune of choosing an NVIDIA GPU, so, GNU/Windows is my mainstay). I don’t mind IDE’s if the project can be well defined within a ‘solution’ file, but even so, with Visual Studio, you may have to go through many config windows to pass the correct build flags. Other IDE’s like Qt Creator are pretty similar where you have to recreate config cache files for minor build setting changes. I feel better to forgo the latter in favour of text editors, like Notepad++ or NeoVim, even if you lose autocomplete and fancy highlighting and a nice GUI inspectors for piece-wise debugging. Building and hacking on Inkscape is going easier this way. Do you use an IDE often, or do you prefer using a special emacs setup or something similar, please share 😊 Cheers, Ben

2 1

Itanium Is Done--Stick A Fork In It
by Lawrence D'Oliveiro 22 Nov '23

22 Nov '23

Looks like Itanium support is finally well and truly being dropped from the Linux kernel <https://www.theregister.com/2023/11/21/saving_linux_on_itanium/>. I think Linus has done the right thing, by challenging the complainers to put their money where their mouth is: if they can take up the job of keeping patches up-to-date outside the mainline kernel for a year, he will look at bringing it back in again. But he doesn’t believe that will happen. I can remember in the early days of Itanium, an Intel executive said that Linux was the first OS they got going on the new architecture. And now it is the last one to abandon ship. (Microsoft gave up a long time ago.) What I find difficulty in believing is that anybody would have continued using such machines in business-essential roles, once it became clear they had no future. Every time this sort of thing comes up in a discussion, I ask: would you entrust mission-critical business functions to obsolete, unsupported hardware/software?

1 0

FreeBSD 14 Released
by Peter Reutemann 22 Nov '23

22 Nov '23

'FreeBSD 14 has been officially released. You can get it from FreeBSD.org, or via freebsd-update and source update methods for existing systems. Some highlights: - OpenSSH version 9.5p1 - OpenSSL version 3.0.12, a major upgrade from OpenSSL 1.1.1t in FreeBSD 13.2 - OpenZFS release 2.2 - The bhyve hypervisor now supports TPM and GPU passthrough This version will now create user home directories in /home by default, instead of the traditional /usr/home. More information on the release and changes can be found via the release announcement page. ' -- source: https://bsd.slashdot.org/story/23/11/21/0512225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can AI Be Used to Fine-Tune Linux Kernel Performance?
by Peter Reutemann 21 Nov '23

21 Nov '23

'ZDNet: At the Linux Plumbers Conference, the invite-only meeting for the top Linux kernel developers, ByteDance Linux Kernel Engineer Cong Wang, proposed that we use AI and machine learning to tune the Linux kernel for the maximum results for specific workloads... There are thousands of parameters. Even for a Linux expert, tuning them for optimal performance is a long, hard job. And, of course, different workloads require different tunings for different sets of Linux kernel parameters... What ByteDance is working on is a first attempt to automate the entire Linux kernel parameter tuning process with minimal engineering efforts. Specifically, ByteDance is working on tuning Linux memory management. ByteDance has found that with machine learning algorithms, such as Bayesian optimization, automated tuning could even beat most Linux kernel engineers. Why? Well, the idea, as Wang wryly put it, "is not to put Linux kernel engineers out of business." No, the goal is "to liberate human engineers from tuning performance for each individual workload. While making better decisions with historical data, which humans often struggle with. And, last, but never least, find better solutions than those we come up with using our current trial and error, heuristic methods. In short, ByteDance's system optimizes resource usage by making real-time adjustments to things like CPU frequency scaling and memory management.' -- source: https://linux.slashdot.org/story/23/11/20/0153201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Announces Intent to Form 'High Performance Software Foundation'
by Peter Reutemann 20 Nov '23

20 Nov '23

'This week the Linux Foundation "announced the intention to form the High Performance Software Foundation. "Through a series of technical projects, the High Performance Software Foundation aims to build, promote, and advance a portable software stack for high performance computing by increasing adoption, lowering barriers to contribution, and supporting development efforts." As use of high performance computing becomes ubiquitous in scientific computing and digital engineering, and AI use cases multiply, more and more data centers deploy GPUs and other compute accelerators. The High Performance Software Foundation intends to leverage investments made by the United States Department of Energy's Exascale Computing Project, the EuroHPC Joint Undertaking, and other international projects in accelerated high performance computing to exploit the performance of this diversifying set of architectures. As an umbrella project under the Linux Foundation, HPSF intends to provide a neutral space for pivotal projects in the high performance software ecosystem, enabling industry, academia, and government entities to collaborate together on the scientific software stack. The High Performance Software Foundation already benefits from strong support across the high performance computing landscape, including leading companies and organizations like Amazon Web Services, Argonne National Laboratory, CEA, CIQ, Hewlett Packard Enterprise, Intel, Kitware, Lawrence Berkeley National Laboratory, Lawrence Livermore National Laboratory, Los Alamos National Laboratory, NVIDIA, Oak Ridge National Laboratory, Sandia National Laboratory, and the University of Oregon. Its first open source technical projects include: - Spack: the high performance computing package manager - Kokkos: a performance-portable programming model for writing modern C++ applications in a hardware-agnostic way. - AMReX: a performance-portable software framework designed to accelerate solving partial differential equations on block-structured, adaptively refined meshes. - WarpX: a performance-portable Particle-in-Cell code with advanced algorithms that won the 2022 Gordon Bell Prize - Trilinos: a collection of reusable scientific software libraries, known in particular for linear, non-linear, and transient solvers, as well as optimization and uncertainty quantification. - Apptainer: a container system and image format specifically designed for secure high-performance computing. - VTK-m: a toolkit of scientific visualization algorithms for accelerator architectures. - HPCToolkit: performance measurement and analysis tools for computers ranging from laptops to the world's largest GPU-accelerated supercomputers. - E4S: the Extreme-scale Scientific Software Stack - Charliecloud: high performance computing-tailored, lightweight, fully unprivileged container implementation.' -- source: https://tech.slashdot.org/story/23/11/19/1920250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Governments turn to Open Source for sovereignty
by Peter Reutemann 20 Nov '23

20 Nov '23

Came across this news item on my Mastodon feed: 'The German government has launched a new Open Source software project called openDesk, which aims to reduce the country’s dependency on proprietary software vendors and support transparency and interoperability. openDesk is a collection of Open Source software modules that are important for day-to-day work in the public sector, such as text creation, file collaboration, project management, email, calendar and messaging. While the initial focus is on public administration in Germany, The source code is publicly available on a government-provided GitLab called openCoDE, making it available, free of charge, for use by other organizations, industries and geographical location. Discussions are taking place with other European countries; France and Austria in particular have already expressed interest. Commissioned by the German Federal Ministry of the Interior and Home Affairs (BMI), under the project leadership of a newly created Center for Digital Sovereignty, ZenDiS.' -- source: https://mastodon.social/@janvlug/111438616208935401 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1