- wlug - list.wlug.org.nz

Rust in Linux: Maturing with Support from Cisco, Samsung, Canonical
by Peter Reutemann 20 Nov '23

20 Nov '23

'ZDNet shares on update on "Rust in Linux: Where we are and where we're going next," citing a talk at the Linux Plumbers Conference in Richmond, Virginia by Linux/Rust developer Miguel Ojeda: In brief, Rust Linux is continuing to mature and is getting strong support from developers and vendors, such as Cisco, Samsung, and Canonical... Rust is taking the steps it needs to become — along with C — a fully-fledged member of the Linux language toolchain... That's not to say that we're ready to retire C for Rust just yet. In fact, that day is unlikely ever to come. But Rust is definitely on its way to becoming an important language for Linux development... As for the day-to-day work that's required to make Rust fully integrated with Linux, the "official" website of the initiative is now the self-explanatory Rust for Linux. This site is your one-stop source for all things Rust on Linux... However, the move forward has not been straightforward. Rust on Linux developers have discovered some problems along the way. For example, while deadlocks, when two or more threads are waiting on the other to finish, are safe in Rust, because they don't result in undefined behavior, they're not safe in the Linux kernel. The programmers are working on fixing this issue... A related issue is that there's growing interest in backporting Rust support into long-term support (LTS) versions of Linux, specifically 5.15 and 6.1. Some people are especially showing interest in the super LTS Linux 6.1 kernel. However, Linux doesn't generally allow backports into LTS Linuxes. So, if you really, really want fully featured Rust support in an older LTS kernel, you're going to need to pay for it in one way or the other. Another general rule that Rust developers have decided they're going to try to "break" is the rule against duplicate drivers. Usually, no one wants anyone wasting time reinventing the wheel, but some maintainers are open to the idea of experimenting with Rust, by starting simple with a driver they're already familiar with... These movements are small steps forward, but they're all critical for making Rust equal to C as a Linux programming language.' -- source: https://linux.slashdot.org/story/23/11/18/012228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi OS, elementary OS Will Default to Wayland
by Peter Reutemann 20 Nov '23

20 Nov '23

'Recently the Register pointed out that the new (Debian-based) Raspberry Pi OS 5.0 has "a completely new Wayland desktop environment replacing PIXEL, the older desktop based on LXDE and X.org, augmented with Mutter in its previous release." And when elementary OS 8 finally arrives, "the development team plans to finally shift to the Wayland display server by default," reports Linux magazine (adding "If you'd like to get early access to daily builds, you can do so by becoming an elementary OS sponsor on GitHub.") "This is a transition that we have been planning and working towards for several years," writes CEO/co-founder Danielle Foré, "and we're finally in the home stretch... Wayland will bring us improved performance, better app security, and opens the doors to support more complex display setups like mixed DPI multi-monitor setups." There are other things that we're experimenting with, like the possibility of an immutable OS, and there are more mundane things that will certainly happen like shipping Pipewire. You'll also see on the project board that we're looking to replace the onscreen keyboard and it's time to re-evaluate some things like SystemD Boot. You can expect lots more little features to be detailed over the coming months. Meanwhile, Linux Mint is getting "experimental" Wayland support next month. And also in December, Firefox will let Wayland support be enabled by default. And last month the Register noted a merge request for GNOME to remove the gnome-xorg.desktop file. "To put this in context, the Fedora project is considering a comparable change: removing or hiding the GNOME on X.org session from the login menu, which is already the plan for the Fedora KDE spin when it moves to KDE version 6, which is still in development."' -- source: https://tech.slashdot.org/story/23/11/18/039221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The FSF Condemns Unauthorized Derivatives of GNU Licenses
by Peter Reutemann 20 Nov '23

20 Nov '23

'The Free Sofware Foundation issued a clarifying blog post this week, saying the organization is "pleased when people use GNU licenses to distribute and license software." But "we condemn the use of unauthorized, confusing derivatives of the licenses." Unfortunately, some authors engage in confusing practices by drafting licenses using existing terms and conditions of GNU free software licenses, without the intention of granting all four freedoms to users. For example, we have long seen attempts to add restrictions to the license text itself, placed in the LICENSE file, or included elsewhere in the program's release. An example is the so-called "Commons Clause," which, when applied to a free software license, affirms that the program is covered by the license. But, at the same time, is contradicting in its meaning by asserting that selling copies of the program or implementing a commercial service with the program is prohibited. The immediate consequence of the practice of inserting a restriction into a GNU license in this way is the confusion it causes for the community. Users still see the name of the original license, with its preamble and terms and conditions intact, transmitting a strong message that the purpose of the license is to enable users — grant users — their essential software freedoms. This message is clear from the license's text, and is bolstered from the renown accrued by the FSF and GNU trademarks, and their decades of free software advocacy. At the same time, these same users see a contradictory statement of the "Commons Clause," which is clearly contrary to the sprit of the free software movement and the Free Software Definition... [T]o make it even clearer that added restrictions are incompatible with our license, we gave users the right to delete such added restrictions [in 2007] and preserve the program's freedom. But we at the FSF have another legal tool against attempts to release programs under GNU General Public Licenses that have been wrongly altered to become nonfree licenses. The FSF holds copyrights and common law trademarks to the GNU family of General Public Licenses. Moreover, the FSF holds registered trademarks for "FSF," "Free Software Foundation," and "GNU." [...] We can't control the drafting by others of proprietary software licenses, but we can and do forbid doing this in a way that misleadingly associates those licenses with GNU or GNU licenses... [W]e are entitled to legally enforce our copyright and trademark for FSF licenses that have been altered by added restrictions to a verbatim GNU license... Licenses that confuse users about the freedoms they grant are damaging to the free software movement because they threaten to dilute the value and power of these licenses. When GNU licenses are misused through such confusing practices, it harms the renown accrued by the GNU project and the FSF over decades of free software advocacy. It is our duty to all computer users to stop these practices, and, if necessary, we will use our legal rights to this end. ' -- source: https://news.slashdot.org/story/23/11/19/1826218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Runs Ubuntu
by Lawrence D'Oliveiro 16 Nov '23

16 Nov '23

The November list of the top 500 supercomputers in the world, released a few days ago <https://top500.org/lists/top500/2023/11/> has, at number 3, a machine called “Eagle”, which is apparently part of Microsoft’s Azure cloud. Looking into the details of this <https://top500.org/system/180236/>, the OS is listed as “Ubuntu 22.04”. And there is another Microsoft-based super at number 15 <https://top500.org/system/180171/>, obviously older because its OS is listed as “Ubuntu 20.04”. And at number 23 <https://top500.org/system/180024/>, we have one running “Ubuntu 18.04 LTS”. Then a few more, even older, down in the 50s, all on Ubuntu 16.04 LTS. Conclusion: they won’t even use their own Windows-based Hyper-V virtualization architecture on high-performance installations. The ARM-based Fugaku machine, which was top of the list not so long ago, has dropped to number 4. Apart from that and two IBM POWER-based entries, the rest of the top 10 is currently all x86-based.

1 0

Firefox Going To Ship With Wayland Enabled By Default
by Peter Reutemann 16 Nov '23

16 Nov '23

'Michael Larabel reports via Phoronix: Guardrails have been in place where the Firefox browser has enabled Wayland by default (when running on recent GTK versions) but as of today that code has been removed... Firefox will try to move forward with stable releases where Wayland will ship by default! Mozilla Bug 1752398 to "ship the Wayland backend to release" has been closed this evening! After the ticket was open for the past two years, it's now deemed ready to hopefully ship enabled for Firefox 121! This patch drops the "early beta or earlier" check to let Wayland support be enabled by default when running on recent GTK versions (GTK 3.24.30 threshold). Firefox 121 is due for release around 19 December and if all continues to hold, it will finally ship with the Wayland back-end enabled by default as another big step forward. ' -- source: https://news.slashdot.org/story/23/11/15/2116232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Proposed Acquisition Of Serato By Pioneer DJ Ruffling Feathers
by Lawrence D'Oliveiro 15 Nov '23

15 Nov '23

Serato is an NZ-based company that produces a software product that allows “scratching” of audio files on a computer. They provide special vinyl records that contain, not music, but a special time code that the software can recognize whether it is played forwards or backwards or fast or slow at whatever point, and keep the audio in sync. And if and when the vinyl wears out, you can just get new discs--your precious audio data remains pristine, free from the imperfections of being actually being encoded on vinyl. Now, an international company wants to buy them out <https://www.1news.co.nz/2023/11/15/kiwi-start-up-caught-up-in-controversial…>. And another international company, InMusic, is concerned enough about the deal here in little old NZ, to raise an objection. By the way, I find it a bit odd to find Serato described as a “start-up” in the subhead, but as a “software giant” just a few lines further down. I first heard of them about a quarter-century ago, so they are hardly newcomers. I suppose a hundred-million-odd turnover makes them a “giant” in NZ terms, yet the prospect of becoming part of a much larger company could make the present operation seem like a minnow in comparison. Or maybe not: maybe their present size already gives them a huge fraction of what is a fairly niche market. And sure enough, after all this time, there are open-source alternatives <https://alternativeto.net/software/serato-dj/>. I had a quick look at the info on Mixxx <https://mixxx.org/>, and they do mention “vinyl record control”, where you “use turntables with timecode vinyl records to control playback and scratch your digital music files as if they were pressed on vinyl”. Some more info on timecode vinyl is here <https://mixxx.org/news/2021-11-21-dvs-internals-pt1/>. Among the formats supported is the Serato one, and discs are apparently available from the company for “£10-20 each” <http://xwax.org/overview.html>. By the way, Debian includes packages in its standard repo for both Mixxx and xwax.

1 0

Intel Fixes High-Severity CPU Bug That Causes 'Very Strange Behavior'
by Peter Reutemann 15 Nov '23

15 Nov '23

'Ars Technica: Intel on Tuesday pushed microcode updates to fix a high-severity CPU bug that has the potential to be maliciously exploited against cloud-based hosts. The flaw, affecting virtually all modern Intel CPUs, causes them to "enter a glitch state where the normal rules don't apply," Tavis Ormandy, one of several security researchers inside Google who discovered the bug, reported. Once triggered, the glitch state results in unexpected and potentially serious behavior, most notably system crashes that occur even when untrusted code is executed within a guest account of a virtual machine, which, under most cloud security models, is assumed to be safe from such faults. Escalation of privileges is also a possibility. The bug, tracked under the common name Reptar and the designation CVE-2023-23583, is related to how affected CPUs manage prefixes, which change the behavior of instructions sent by running software. Intel x64 decoding generally allows redundant prefixes -- meaning those that don't make sense in a given context -- to be ignored without consequence. During testing in August, Ormandy noticed that the REX prefix was generating "unexpected results" when running on Intel CPUs that support a newer feature known as fast short repeat move, which was introduced in the Ice Lake architecture to fix microcoding bottlenecks. The unexpected behavior occurred when adding the redundant rex.r prefixes to the FSRM-optimized rep mov operation. [...] Intel's official bulletin lists two classes of affected products: those that were already fixed and those that are fixed using microcode updates released Tuesday. An exhaustive list of affected CPUs is available here. As usual, the microcode updates will be available from device or motherboard manufacturers. While individuals aren't likely to face any immediate threat from this vulnerability, they should check with the manufacturer for a fix. People with expertise in x86 instruction and decoding should read Ormandy's post in its entirety. For everyone else, the most important takeaway is this: "However, we simply don't know if we can control the corruption precisely enough to achieve privilege escalation." That means it's not possible for people outside of Intel to know the true extent of the vulnerability severity. That said, anytime code running inside a virtual machine can crash the hypervisor the VM runs on, cloud providers like Google, Microsoft, Amazon, and others are going to immediately take notice.' -- source: https://it.slashdot.org/story/23/11/14/2257235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In a First, Cryptographic Keys Protecting SSH Connections Stolen in New Attack
by Peter Reutemann 15 Nov '23

15 Nov '23

'For the first time, researchers have demonstrated that a large portion of cryptographic keys used to protect data in computer-to-server SSH traffic are vulnerable to complete compromise when naturally occurring computational errors occur while the connection is being established. ArsTechnica: Underscoring the importance of their discovery, the researchers used their findings to calculate the private portion of almost 200 unique SSH keys they observed in public Internet scans taken over the past seven years. The researchers suspect keys used in IPsec connections could suffer the same fate. SSH is the cryptographic protocol used in secure shell connections that allows computers to remotely access servers, usually in security-sensitive enterprise environments. IPsec is a protocol used by virtual private networks that route traffic through an encrypted tunnel. The vulnerability occurs when there are errors during the signature generation that takes place when a client and server are establishing a connection. It affects only keys using the RSA cryptographic algorithm, which the researchers found in roughly a third of the SSH signatures they examined. That translates to roughly 1 billion signatures out of the 3.2 billion signatures examined. Of the roughly 1 billion RSA signatures, about one in a million exposed the private key of the host. While the percentage is infinitesimally small, the finding is nonetheless surprising for several reasons -- most notably because most SSH software in use has deployed a countermeasure for decades that checks for signature faults before sending a signature over the Internet. Another reason for the surprise is that until now, researchers believed that signature faults exposed only RSA keys used in the TLS -- or Transport Layer Security -- protocol encrypting Web and email connections. They believed SSH traffic was immune from such attacks because passive attackers -- meaning adversaries simply observing traffic as it goes by -- couldn't see some of the necessary information when the errors happened.' -- source: https://it.slashdot.org/story/23/11/13/1446217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Asahi: Not Just A Distro
by Lawrence D'Oliveiro 14 Nov '23

14 Nov '23

The Ubuntu Summit that recently took place had discussions about running Ubuntu on ARM and RISC-V processors <https://www.theregister.com/2023/11/13/ubuntu_for_arm64_laptops/>. One interesting thing in that article is that the Asahi project, which was getting Linux running on Apple’s ARM-based machines, is no longer confined to Arch Linux. It is now also working with Ubuntu, with the help of a developer from, of all things, the OpenBSD project. And there are other alternatives, including Fedora and Debian. Also interesting to read how Apple makes the little speakers in its laptops sound better than they should, by carefully driving them beyond what would normally be considered their “safe” power limits, based on the frequency characteristics of the signal at any moment. This technique has been recreated in an open-source program called “speakersafetyd”.

1 0

I Wonder If This Is A WordPress Thing ...
by Lawrence D'Oliveiro 14 Nov '23

14 Nov '23

You may not notice it, but a remarkable number of sites are built on WordPress. Seems the ability to customize the layout of such sites is limitless. But I think one of the clues that WordPress lies underneath is sometimes you see image URLs that look like MHMA5269-copy-1698399489.jpg?resize=770,513&quality=80 I think this is characteristic of some image-manipulation plugin that resizes the image for embedding in the page. In this case, I tried the part from the “?” onwards, and ended up with a much larger and higher-quality image file.

1 0

Why Chrome Enabled WebAssembly Garbage Collection (WasmGC) By Default
by Peter Reutemann 13 Nov '23

13 Nov '23

'In Chrome, JavaScript (and WebAssembly) code are both executed by Google's open source V8 engine — which already has garbage-collecting capabilities. "This means developers making use of, for example, PHP compiled to Wasm, end up shipping a garbage collector implementation of the ported language (PHP) to the browser that already has a garbage collector," writes Google developer advocate Thomas Steiner, "which is as wasteful as it sounds." "This is where WasmGC comes in." WebAssembly Garbage Collection (or WasmGC) is a proposal of the WebAssembly Community Group [which] adds struct and array heap types, which means support for non-linear memory allocation... In simplified terms, this means that with WasmGC, porting a programming language to WebAssembly means the programming language's garbage collector no longer needs to be part of the port, but instead the existing garbage collector can be used. Sometime on Halloween, Steiner wrote that in Chrome, WebAssembly garbage collection is now enabled by default. But then he explored what this means for high-level programming languages (with their own built-in garbage collection) being compiled into WebAssembly: To verify the real-world impact of this improvement, Chrome's Wasm team has compiled versions of the Fannkuch benchmark (which allocates data structures as it works) from C, Rust, and Java. The C and Rust binaries could be anywhere from 6.1 K to 9.6 K depending on the various compiler flags, while the Java version is much smaller at only 2.3 K! C and Rust do not include a garbage collector, but they do still bundle malloc/free to manage memory, and the reason Java is smaller here is because it doesn't need to bundle any memory management code at all. This is just one specific example, but it shows that WasmGC binaries have the potential of being very small, and this is even before any significant work on optimizing for size. The blog post includes two examples of WasmGC-ported programming languages in action: - "One of the first programming languages that has been ported to Wasm thanks to WasmGC is Kotlin in the form of Kotlin/Wasm." - "The Dart and Flutter teams at Google are also preparing support for WasmGC. The Dart-to-Wasm compilation work is almost complete, and the team is working on tooling support for delivering Flutter web applications compiled to WebAssembly."' -- source: https://developers.slashdot.org/story/23/11/12/0456220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

Remote desktop without using x protocols
by David Nicholls 10 Nov '23

10 Nov '23

I have noticed a number of distros are starting to drop support for x11. This becomes annoying if you are wanting to remote into a Linux box (itth a GUI) RDP style prior to logging in as all the documented solutions that don't require a cloud, docker or server seem to need xrdp, xvnc or similar x based solution installed. Can anyone point me to a cross platform project that does not require x11? -- Cheers... David Nicholls

2 2

Canonical Reveals More Details About Ubuntu Core Desktop
by Peter Reutemann 09 Nov '23

09 Nov '23

'Next April a new LTS Ubuntu arrives, and alongside it will be a whole new immutable desktop edition. At this year's Ubuntu conference in Riga, Latvia, Canonical revealed more details about its forthcoming immutable desktop distro. From a report: Core Desktop is not the next version of Ubuntu itself. Ordinary desktop and server Ubuntu aren't going anywhere, and the next release, numbered 24.04 and codenamed Noble Numbat as we mentioned last month, will be the default and come with all the usual editions and flavors. Nor is this a whole new product: it is a graphical desktop edition of the existing Ubuntu Core distro, as we examined on its release in June last year, a couple of months after 22.04. Ubuntu Core is Canonical's Internet of Things (IoT) distro, intended to be embedded on edge devices, such as digital signs and smart displays. It is an immutable distro, meaning that the root filesystem is read-only and there's no conventional package manager. Rather than being a basis for customization, like a conventional Linux, the idea is that immutable distros are rolled out and updated more like a phone or tablet OS: there's a single fixed and heavily tested OS image, and it's deployed onto the devices out in the field without modification. Updates are monolithic: a whole fresh image is pushed out, and all the OS components are upgraded in a single operation to the same combination. That isn't unique. Most of the major Linux vendors have immutable offerings, and The Reg has looked at several over the years, including MicroOS, the basis of SUSE's next-gen enterprise OS ALP. As well as the well-known ChromeOS, another immutable desktop is the educational distro Endless OS. [...] Canonical believes it has some unique new angles. Core Desktop is constructed as additional layers on top of the existing Ubuntu Core distro, and like Core, it's entirely built with a single packaging system: Ubuntu's Snap. While Snap remains controversial, it does have some compelling advantages over both SUSE and Red Hat's tooling. SUSE's transactional_update tool, while simpler than its rivals in implementation, requires a snapshot-capable filesystem, meaning that its immutable distros must use Btrfs. While it has many admirers, the number and the contents of the orange and red cells in the feature tables here in its own documentation reflect the FOSS desk's serious reservations about Btrfs.' -- source: https://news.slashdot.org/story/23/11/08/1957249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Abandons Mercurial
by Lawrence D'Oliveiro 08 Nov '23

08 Nov '23

Up to now, Mozilla has been supporting the use of both Git and Mercurial DVCSes by its contributors <https://devclass.com/2023/11/07/mozilla-will-move-firefox-development-from-…>. But no more: it is giving up on Mercurial, and making things exclusively Git-based. Furthermore, it is moving to use GitHub for hosting its repos. I can remember the discussion over which distributed VCS they should switch to about a decade ago, back when I was new to Git myself. Even then, the momentum was clearly on the side of Git. However, the Mozilla crew wanted something that would work well on Windows, not just on Linux, and back then the process-heavy execution model of Git gave poor performance on Windows. Hence they went for Mercurial. Presumably that objection no longer applies; suitable compromises have been made in the architecture of Git to cater for the platform that thinks 26 drive letters ought to be enough for anybody. (I can’t remember what Mozilla were using before that; probably Subversion.) Using GitHub, on the other hand, seems in some ways like a step backwards for distributed development. Linus Torvalds famously pilloried their lame pull-request system <https://github.com/torvalds/linux/pull/17#issuecomment-5654674>, which just happens to be the one feature of your GitHub repos that you cannot turn off.

2 2

Android 14’s storage disaster gets patched, but your data might be gone
by Peter Reutemann 08 Nov '23

08 Nov '23

'It's the start of November, and that means a new Android security patch. Google claims this one is fixing a high-profile Android 14 storage bug that was locking some people out of their devices. The November Security Bulletin contains the usual pile of security fixes, while consumer-oriented Pixel patch notes list a few user-facing changes. The important line is "Fix for issue occasionally causing devices with multiple users enabled to show out of space or be in a reboot loop." A footnote points out that this is for the "Pixel 6, Pixel 6a, 6 Pro, 7, 7 Pro, 7a, Tablet, Fold, Pixel 8, Pixel 8 Pro." We're on about day 33 of the Android 14 storage bug. For devices with multiple users set up, there is some kind of storage issue that is locking users out of their device. Some are completely unusable, with the phone bootlooping constantly and never reaching the home screen. Others are able to boot up the device but don't have access to lock storage, which causes a huge amount of issues. Some users likened the bug to "ransomware," a type of malware that encrypts your local storage and then demands money for your data. One fix is to completely erase your device with a factory reset, but a lot of users don't want to do that. The earliest reports of this started just days after the October 4 launch date. Google usually rolls updates out slowly so it can pull them if issues like this pop up to minimize damage. That didn't happen here, though. Google failed to respond quickly to initial reports and just let the bug roll out to everyone. Some people even report being freshly hit with the bug just four days ago because Google 1) let the update roll out without stopping it and 2) can't patch its software quickly enough. The biggest issue tracker thread on this bug is up to 1,000-plus likes and 850 comments of people locked out of their devices, and it took two separate rounds of news coverage for Google to acknowledge the bug after about 20 days. Google promised a rescue patch, which is now arriving, though the company said only "some" data would be recoverable and that "this update may not enable data to be recovered for devices that are repeatedly rebooting." That seems to line up with what people are experiencing now that the OTA is out. People who can boot up report fixed devices, while bootloopers aren't getting anywhere. Some users are still in the support thread hoping for some kind of data recovery for bootlooping devices, but it doesn't seem like that is going to happen.' -- source: https://arstechnica.com/gadgets/2023/11/android-14-patches-ransomware-stora… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When Linux Spooked Microsoft: Remembering 1998's Leaked 'Halloween Documents'
by Peter Reutemann 06 Nov '23

06 Nov '23

't happened a quarter of a century ago. The New York Times wrote that "An internal memorandum reflecting the views of some of Microsoft's top executives and software development managers reveals deep concern about the threat of free software and proposes a number of strategies for competing against free programs that have recently been gaining in popularity." The memo warns that the quality of free software can meet or exceed that of commercial programs and describes it as a potentially serious threat to Microsoft. The document was sent anonymously last week to Eric Raymond, a key figure in a loosely knit group of software developers who collaboratively create and distribute free programs ranging from operating systems to Web browsers. Microsoft executives acknowledged that the document was authentic... In addition to acknowledging that free programs can compete with commercial software in terms of quality, the memorandum calls the free software movement a "long-term credible" threat and warns that employing a traditional Microsoft marketing strategy known as "FUD," an acronym for "fear, uncertainty and doubt," will not succeed against the developers of free software. The memorandum also voices concern that Linux is rapidly becoming the dominant version of Unix for computers powered by Intel microprocessors. The competitive issues, the note warns, go beyond the fact that the software is free. It is also part of the open-source software, or O.S.S., movement, which encourages widespread, rapid development efforts by making the source code — that is, the original lines of code written by programmers — readily available to anyone. This enables programmers the world over to continually write or suggest improvements or to warn of bugs that need to be fixed. The memorandum notes that open software presents a threat because of its ability to mobilize thousands of programmers. "The ability of the O.S.S. process to collect and harness the collective I.Q. of thousands of individuals across the Internet is simply amazing," the memo states. "More importantly, O.S.S. evangelization scales with the size of the Internet much faster than our own evangelization efforts appear to scale." Back in 1998, Slashdot's CmdrTaco covered the whole brouhaha — including this CNN article: A second internal Microsoft memo on the threat Linux poses to Windows NT calls the operating system "a best-of-breed Unix" and wonders aloud if the open-source operating system's momentum could be slowed in the courts. As with the first "Halloween Document," the memo — written by product manager Vinod Valloppillil and another Microsoft employee, Josh Cohen — was obtained by Linux developer Eric Raymond and posted on the Internet. In it, Cohen and Valloppillil, who also authored the first "Halloween Document," appear to suggest that Microsoft could slow the open-source development of Linux with legal battles. "The effect of patents and copyright in combating Linux remains to be investigated," the duo wrote. Microsoft's slogain in 1998 was "Where do you want to go today?" So Eric Raymond published the documents on his web site under the headline "Where will Microsoft try to drag you today? Do you really want to go there?" 25 years later, and it's all still up there and preserved for posterity on Raymond's web page — a collection of leaked Microsoft documents and related materials known collectively as "the Halloween documents." And Raymond made a point of thanking the writers of the documents, "for authoring such remarkable and effective testimonials to the excellence of Linux and open-source software in general."' -- source: https://linux.slashdot.org/story/23/11/05/046247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Update/upgrade
by john 03 Nov '23

03 Nov '23

For some time I have been receiving a message regarding missing firmware. I do have an onboard AMD GPU do I need to go hunting or am I suffering from fomo? W: Possible missing firmware /lib/firmware/amdgpu/ip_discovery.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/vega10_cap.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/sienna_cichlid_cap.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/navi12_cap.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/psp_13_0_10_ta.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/psp_13_0_10_sos.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/aldebaran_cap.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/aldebaran_sjt_mec2.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/aldebaran_sjt_mec.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_imu.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_rlc.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_mec.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_me.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_pfp.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_0_toc.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/sdma_6_0_3.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/sienna_cichlid_mes1.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/sienna_cichlid_mes.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/navi10_mes.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_mes1.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_mes_2.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_mes.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/smu_13_0_10.bin for module amdgpu Cheers John..

2 2

Chrome Not Proceeding With Web Integrity API Deemed By Many To Be DRM
by Peter Reutemann 03 Nov '23

03 Nov '23

'Back in July, Google's work on a Web Integrity API emerged and many equated it to DRM. While prototyped, it was only at the proposal stage and the company announced today it's not going ahead with it. With this proposal, Google wanted to give websites a way to confirm the authenticity of the user and their device/browser. The Web Integrity API would let websites "request a token that attests key facts about the environment their client code is running in." It's not all too different from the Play Integrity API (SafetyNet) on Android that Google Wallet and other banking apps use to make sure a device hasn't been tampered with (rooted). ' -- source: https://it.slashdot.org/story/23/11/02/2040234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bye-Bye Theora
by Lawrence D'Oliveiro 03 Nov '23

03 Nov '23

Seems the old Theora video codec, an early attempt at a freely-licensable algorithm unencumbered by patent restrictions, has largely fallen into disuse <https://www.theregister.com/2023/11/02/theora_video_codec_deprecation/>. In other words, it has served its purpose, and the patent minefields that used to plague video encoding have (to mix metaphors) been effectively defanged. I remember when the Xiph.org foundation came out with the Vorbis audio codec as a free alternative to MP3, back when Fraunhofer was still vigorously enforcing its patents on the latter. Xiph also came up with a multimedia container format called “Ogg”, which could handle both audio and video. But given it was, at least in the early years, only used for audio, quite a lot of people assumed that a “.ogg” file was audio-only. So the video files had to have the “.ogv” file extension (I think there were some “.oga” files to indicate that they were audio-only). The name “Theora” comes from Theora Jones, one of the principal characters in the old “Max Headroom” TV series. “Vorbis” is from a character in Terry Pratchett’s “Discworld” novels. I thought “Ogg” also came from those novels, but Wikipedia says no.

2 1

Arm Acquires Minority Stake in Raspberry Pi
by Peter Reutemann 03 Nov '23

03 Nov '23

'Arm today announced that it has made a strategic investment, a minority stake in Raspberry Pi -- the arm of Raspberry Pi responsible for the new Raspberry Pi 5 and past Raspberry Pi products. From a report: Arm's minority stake extends the long-term partnership between Arm and Raspberry Pi, which has seen Arm CPUs feature in all of the Raspberry Pi and Raspberry Pi Pico SoC. The partnership began way before the Raspberry Pi was available for sale, in 2008 -- when the original board was still just a dream. Fast-forward to 2023 and we have a generation of learners who have taken their first steps with coding, science and electronics thanks to the Raspberry Pi.' -- source: https://hardware.slashdot.org/story/23/11/02/1638205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Jupyter Server Behind Reverse Proxy
by Lawrence D'Oliveiro 02 Nov '23

02 Nov '23

I’ve been experimenting with running a Jupyter server inside an LXC container, and making it publicly accessible in a controlled way, via a reverse-proxy setup in Apache. This way, the web server handles all the authentication access, the Jupyter server doesn’t need to impose any restrictions. And being isolated inside a container should help to minimize the impact of a security breach. I found some related documentation here <https://jupyterhub.readthedocs.io/en/stable/howto/configuration/config-prox…>, though it talks about JupyterHub, not Jupyter. This part matched what I initially tried (but didn’t fully work on its own): ProxyPreserveHost on ProxyPass http://«container-host»:«port»/ ProxyPassReverse http://«container-host»:«port»/ This line was not something I did, so I’m not sure it’s really needed: RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME} However, this whole rewrite business I found to be quite unnecessary: RewriteEngine On RewriteCond %{HTTP:Connection} Upgrade [NC] RewriteCond %{HTTP:Upgrade} websocket [NC] RewriteRule /(.*) ws://«container-host»:«port»/$1 [P,L] Because the same effect can be achieved much more simply, by one small change to those initial three lines: ProxyPreserveHost on ProxyPass http://«container-host»:«port»/ upgrade=websocket ProxyPassReverse http://«container-host»:«port»/ Notice that “upgrade=websocket” bit? That’s all it took to get the proxying to work.

1 0

Raspberry Pi Smart Vertical Farming Takes Veggies To New Heights
by Peter Reutemann 02 Nov '23

02 Nov '23

'Tanay Tanay has developed a smart vertical farming system using a Raspberry Pi 4 as the central controller, with features such as Bluetooth and Wi-Fi support for remote plant monitoring, precise automated watering based on moisture levels, and environmental factor tracking. Tom's Hardware reports: The end result is a Pi-powered system with tons of cool goodies to take your plant care to the next level. Tanay is able to monitor all sorts of environmental factors like how much light is available, how moist the air is, how much water is in the soil, what the temperature is and much more. The icing on the cake is a user-friendly interface that can be used to manually water the plants. The main board for this project is a Raspberry Pi 4 B. It's connected to an Arduino Nano R3 which is assigned to a specific plant. Some of the sensors confirmed in the design are a soil moisture sensor, an ambient light sensor as well as a water level depth detection sensor. You could always add more or take away modules depending on what you want to do with your vertical farm. For example, a camera could be used to log plant growth progress over time. Tanay explains that ThingSpeak, an IoT platform, was used in the project design. ' -- source: https://hardware.slashdot.org/story/23/11/01/0043259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Apple “Innovation” Bites The Dust
by Lawrence D'Oliveiro 01 Nov '23

01 Nov '23

This commentary <https://www.theregister.com/2023/11/01/apple_kills_off_touchpad/> on Apple’s latest product introductions mentions, among other things, the company’s abandonment of its “touch bar” technology: Personally, my biggest gripe with the Touch Bar during the two years I used it was the overall lack of tactility. Because it replaced the top row of keys with an indistinct plate of glass, and its contents changed depending on what you were doing, using it required looking away from the screen and down at the keyboard. Am I really the only one to notice the great irony of touchscreens, that they cannot be operated by touch? That, being a featureless flat surface in tactile terms, you have to look at the image being displayed on them to figure out where the buttons are?

2 1

Russia Blocks 167 VPNs, Steps Up OpenVPN and WireGuard Disruption
by Peter Reutemann 01 Nov '23

01 Nov '23

'TorrentFreak reports: The head of the Russian department responsible for identifying threats to the "stability, security and integrity" of the internet, has revealed the extent of the Kremlin's VPN crackdown. Former FSO officer Sergei Khutortsev, a central figure in Russia's 'sovereign internet' project, confirmed that 167 VPN services are now blocked along with over 200 email services. Russia is also reported as stepping up measures against protocols such as OpenVPN, IKEv2 and WireGuard. [...] An in-depth report published by TheIns.ru has details of the monitoring/blocking system reportedly deployed in Russia, how much it costs (4.3 billion rubles/$43 million in 2020, 24.7 billion rubles/$247 million for 2022-2024), and the names of the companies supplying the components. The publication also obtained original documents that apparently show some of the protocols Russia initially intended to block. They include older VPN protocols IPSec, L2TP, and PPTP, plus the BitTorrent protocol still widely used today. The full report on the system, which reveals the use of Intel chips/chipsets in 965 servers manufactured by Huawei and already purchased by Russia, plus another 2400+ servers for 2023/24, is available here.' -- source: https://tech.slashdot.org/story/23/10/31/2124234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Plans RISC-V Android Tools In 2024, Wants Developers To 'Be Ready'
by Peter Reutemann 01 Nov '23

01 Nov '23

'Ars Technica reports: Android is slowly entering the RISC-V era. So far we've seen Google say it wants to give the up-and-coming CPU architecture "tier-1" support in Android, putting RISC-V on equal footing with Arm. Qualcomm has announced the first mass-market RISC-V Android chip, a still-untitled Snapdragon Wear chip for smartwatches. Now Google has announced a timeline for developer tools via the Google Open Source Blog. The last post is titled "Android and RISC-V: What you need to know to be ready." Getting the Android OS and app ecosystem to support a new architecture is going to take an incredible amount of work from Google and developers, and these tools are laying the foundation for that work. First up, Google already has the "Cuttlefish" virtual device emulator running, including a gif of it booting up. This isn't the official "Android Emulator" -- which is targeted at app developers doing app development -- Cuttlefish is a hardware emulator for Android OS development. It's the same idea as the Android Emulator but for the bottom half of the tech stack -- the kernel, framework, and hardware bits. Cuttlefish lets Google and other Android OS contributors work on a RISC-V Android build without messing with an individual RISC-V device. Google says it's working well enough now that you can download and emulate a RISC-V device today, though the company warns that nothing is optimized yet. The next step is getting the Android Emulator (for app developers) up and running, and Google says: "By 2024, the plan is to have emulators available publicly, with a full feature set to test applications for various device form factors!" The nice thing about Android is that most app code is written with no architecture in mind -- it's all just Java/Kotlin. So once the Android RunTime starts spitting out RISC-V code, a lot of app code should Just Work. That means most of the porting work will need to go into things written in the NDK, the native developer kit, like libraries and games. The emulator will still be great for testing, though.' -- source: https://developers.slashdot.org/story/23/10/31/2059206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0