- wlug - list.wlug.org.nz

GitHub and EFF Back YouTube Ripper In Legal Battle With the RIAA
by Peter Reutemann 11 Feb '23

11 Feb '23

'GitHub and digital rights group EFF have filed briefs supporting stream-ripping site Yout.com in its legal battle with the RIAA. GitHub warns that the lower court's decision threatens to criminalize the work of many other developers. The EFF, meanwhile, stresses that an incorrect interpretation of the DMCA harms people who use stream-rippers lawfully. TorrentFreak reports: In 2020, YouTube ripper Yout.com sued the RIAA, asking a Connecticut district court to declare that the site does not violate the DMCA's anti-circumvention provision. The music group had previously used DMCA takedown notices to remove many of Yout's appearances in Google's search results. This had a significant impact on revenues, the site argued, adding that it always believed it wasn't breaking any laws and hoped the court would agree. Last October, the Connecticut district court concluded that Yout had failed to show that it doesn't circumvent YouTube's technological protection measures. As such, it could be breaking the law. Yout operator Johnathan Nader opted to appeal the decision. Nader's attorneys filed their opening brief (PDF) last week at the Court of Appeals for the Second Circuit, asking it to reverse the lower court's decision. The YouTube ripper is not the only party calling for a reversal. Yesterday, Microsoft-owned developer platform GitHub submitted an amicus brief that argues for the same. And in a separate filing, the EFF also agrees that the lower court's decision should be overturned. GitHub's brief starts by pointing out that the company takes no position on the ultimate resolution of this appeal, nor does it side with all of Yout's arguments. However, it does believe that the lower court's interpretation of the DMCA is dangerous. The district court held that stream rippers can violate the DMCA's anti-circumvention provision. The court noted that these tools allow people to download video and audio from YouTube, despite the streaming platform's lack of a download button. According to GitHub, this conclusion is premature, dangerous, and places other software types at risk. In the present lawsuit, GitHub reiterates that stream-ripping tools should not be outlawed. The fact that YouTube doesn't have a download button doesn't mean that tools that enable people to download videos circumvent technological access restrictions. "YouTube's decision not to provide its own 'download' button, however, is not a restriction on access to works. It merely affects how users experience them," GitHub writes. If the court order is allowed to stand, GitHub warns that a broad group of developers could be exposed to criminal liability, effectively chilling technological innovation. YouTube download tools are not the only types of software at risk, according to GitHub. There are many others that affect 'how users experience' online websites. These could also be seen as problematic, based on the district court's expansive interpretation of the DMCA. These widely accepted tools could put their creators at risk if the DMCA is interpreted too strictly, GitHub warns. The Electronic Frontier Foundation (EFF) also submitted an amicus curiae brief (PDF) yesterday. The digital rights group takes interest in copyright cases, particularly when they get in the way of people's ability to freely use technology. In this instance, EFF points out that stream-rippers such as Yout.com provide a neutral technology with plenty of legal uses. They can be used for infringing purposes, but that's also true for existing technologies -- the printing press, for example. "Like every reproduction technology -- from the printing press to the smartphone -- these programs, colloquially called 'streamrippers,' have important lawful uses as well as infringing ones. "Video creators, educators, journalists, and human rights organizations all depend on the ability to make copies of user-uploaded videos," EFF adds. In common with GitHub, EFF notes that the absence of a download button on YouTube doesn't imply that download tools automatically violate the DMCA, especially when there are no effective download restrictions on the platform. [...] According to EFF, Yout and similar tools provide the same functions as video cassette recorders once did. They allow people to make copies of videos that are posted publicly by their creators. In addition, these tools are vital for some reporters and useful to creatives who use them for future work. ' -- source: https://yro.slashdot.org/story/23/02/10/2243240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Future Of Thunderbird
by Peter Reutemann 10 Feb '23

10 Feb '23

'Thunderbird blog: Before we really dig in, let's start with the future. We believe it's a bright one! With this year's release of Thunderbird 115 "Supernova," we're doing much more than just another yearly release. It's a modernized overhaul of the software, both visually and technically. Thunderbird is undergoing a massive rework from the ground up to get rid of all the technical and interface debt accumulated over the past 10 years. This is not an easy task, but it's necessary to guarantee the sustainability of the project for the next 20 years. Simply "adding stuff on top" of a crumbling architecture is not sustainable, and we can't keep ignoring it. Throughout the next 3 years, the Thunderbird project is aiming at these primary objectives: 1. Make the code base leaner and more reliable, rewrite ancient code, remove technical debt. 2. Rebuild the interface from scratch to create a consistent design system, as well as developing and maintaining an adaptable and extremely customizable user interface. 3. Switch to a monthly release schedule. Inside those objectives there are hundreds of very large steps that need to happen, and achieving everything will require a lot of time and resources.' -- source: https://it.slashdot.org/story/23/02/09/1651259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

US NIST Unveils Winning Encryption Algorithm For IoT Data Protection
by Peter Reutemann 09 Feb '23

09 Feb '23

'The National Institute of Standards and Technology (NIST) announced that ASCON is the winning bid for the "lightweight cryptography" program to find the best algorithm to protect small IoT (Internet of Things) devices with limited hardware resources. BleepingComputer reports: ASCON was selected as the best of the 57 proposals submitted to NIST, several rounds of security analysis by leading cryptographers, implementation and benchmarking results, and feedback received during workshops. The whole program lasted for four years, having started in 2019. NIST says all ten finalists exhibited exceptional performance that surpassed the set standards without raising security concerns, making the final selection very hard. ASCON was eventually picked as the winner for being flexible, encompassing seven families, energy efficient, speedy on weak hardware, and having low overhead for short messages. NIST also considered that the algorithm had withstood the test of time, having been developed in 2014 by a team of cryptographers from Graz University of Technology, Infineon Technologies, Lamarr Security Research, and Radboud University, and winning the CAESAR cryptographic competition's "lightweight encryption" category in 2019. Two of ASCON's native features highlighted in NIST's announcement are AEAD (Authenticated Encryption with Associated Data) and hashing. AEAD is an encryption mode that provides confidentiality and authenticity for transmitted or stored data, combining symmetric encryption and MAC (message authentication code) to prevent unauthorized access or tampering. Hashing is a data integrity verification mechanism that creates a string of characters (hash) from unique inputs, allowing two data exchange points to validate that the encrypted message has not been tampered with. Despite ASCON's lightweight nature, NIST says the scheme is powerful enough to offer some resistance to attacks from powerful quantum computers at its standard 128-bit nonce. However, this is not the goal or purpose of this standard, and lightweight cryptography algorithms should only be used for protecting ephemeral secrets. ' -- source: https://it.slashdot.org/story/23/02/08/2239210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 14 Preview 1 is Out, Will Officially Ban Installation of Old Apps
by Peter Reutemann 09 Feb '23

09 Feb '23

'Android 14 is here -- or the first preview is, at least. From a report: Google is kicking off the months-long developer preview process for Android's latest version, which will get a final release in the second half of the year. Even with multiple previews, Google likes to keep the final set of Android features under wraps at least until its I/O conference in May, so we can't look at the features here to determine the scope of Android 14. These are just some of the features Google wants developers to have a head start on. The biggest news is that Android 14 will block the installation of old Android apps. As Android changes over the years, new APIs and increased security, privacy, or background processing restrictions could break old apps, but Android's backward-compatibility system keeps these old apps running. Apps can declare the newest version of Android they support via a "Target SDK" flag. To prevent old apps from breaking, new features and app restrictions in, say, Android 12 only apply to apps that target Android 12 or above. Older apps will continue to run with the older set of restrictions they're used to. (A different setting, called "Minimum SDK," determines if a new app can run on an old Android OS.) The system works great for honest developers, but if you're building a piece of malware, it's an easy decision to target a very old version of Android. While you'll get access to fewer features, you'll also be subject to fewer security and privacy restrictions. For the first time, Android 14 will close this malware loophole by simply refusing to install old apps. The cutoff point is generous enough that it shouldn't cause anyone problems; any app targeting the 8-year-old Android 6.0 or below will be blocked. Google says it picked Android 6 because it's the version that introduced runtime permissions, the allow/deny boxes that pop up asking for things like camera access. In addition, "some malware apps use a targetSdkVersion of [Android 5.1] to avoid being subjected to the runtime permission model introduced in 2015 by Android 6.0," Google said.' -- source: https://tech.slashdot.org/story/23/02/08/1919253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.1 Officially Promoted To Being An LTS Kernel
by Peter Reutemann 09 Feb '23

09 Feb '23

'Linux 6.1 was widely anticipated to be a Long-Term Support (LTS) kernel with normally the last major release series for the calendar year normally promoted to LTS status. Greg Kroah-Hartman as the Linux stable maintainer went ahead today and formally recognized Linux 6.1 as the 2022 LTS kernel. From a report: Greg KH was planning on Linux 6.1 being LTS given its December debut. But he was waiting on feedback from kernel stakeholders over their test results with Linux 6.1 and plans around using Linux 6.1 for the long-term. He's finally collected enough positive responses -- along with co-maintainer Sasha Levin -- that there is confidence in maintaining Linux 6.1 as an LTS series. As of now the plan is on maintaining Linux 6.1 through December 2026, which is just a few months longer than the current Linux 5.15 LTS series that will be maintained through October 2026. We'll see over time if Linux 6.1 ends up potentially being maintained for the longer six-year LTS period that would put it through 2028. However, the number of Linux LTS series being maintained in tandem is growing and will ultimately depend upon how much these kernels are used by major industry players and how much commitment there is for testing of the point release candidates, etc.' -- source: https://linux.slashdot.org/story/23/02/08/174210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

minutes from AGM
by Peter Reutemann 08 Feb '23

08 Feb '23

Hi everyone Apologies for the late update on our AGM last month. You can find the minutes here: http://wiki.wlug.org.nz/MeetingTopics.2023-01-23 Since we were unable to get a quorum, we will try again on February 27th at 7.30pm (in-person and online). Should we be able unable to fill the required offices and spots on the committee, we will start the process for dissolving the society. See above minutes for details. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Mozilla, Like Google, is Looking Ahead To the End of Apple's WebKit Rule
by Peter Reutemann 08 Feb '23

08 Feb '23

'Mozilla is planning for the day when Apple will no longer require its competitors to use the WebKit browser engine in iOS. From a report: Mozilla conducted similar experiments that never went anywhere years ago but in October 2022 posted an issue in the GitHub repository housing the code for the iOS version of Firefox that includes a reference to GeckoView, a wrapper for Firefox's Gecko rendering engine. Under the current Apple App Store Guidelines, iOS browser apps must use WebKit. So a Firefox build incorporating Gecko rather than WebKit currently cannot be distributed through the iOS App Store. As we reported last week, Mozilla is not alone in anticipating an iOS App Store regime that tolerates browser competition. Google has begun work on a Blink-based version of Chrome for iOS. The major browser makers -- Apple, Google, and Mozilla -- each have their own browser rendering engines. Apple's Safari is based on WebKit; Google's Chrome and its open source Chromium foundation is based on Blink (forked from WebKit a decade ago); and Mozilla's Firefox is based on Gecko. Microsoft developed its own Trident rendering engine in the outdated Internet Explorer and a Trident fork called EdgeHTML in legacy versions of Edge but has relied on Blink since rebasing its Edge browser on Chromium code.' -- source: https://news.slashdot.org/story/23/02/07/1733204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Carbonyl: a New Graphical Web Browser in Your Linux Terminal
by Peter Reutemann 07 Feb '23

07 Feb '23

'Long-time Slashdot reader destinyland writes: Someone made a Chromium fork... for your terminal. The terminal-based browser Carbonyl "adheres to, and is compatible with modern standards," writes MUO, "meaning that pages behave as they should, and you can even watch streaming video, within the Linux terminal!" But best of all, "Pages connect and render in an instant—seemingly quicker than a desktop GUI browser, and every page we visited was rendered correctly." >From the article: There are a bunch of good reasons to browse the internet from the comfort of your terminal. It could be that eschewing the bloat of X.org and Wayland, a terminal is all you have. Maybe you like SSHing into remote machines and browsing the internet from there. Perhaps you, like us, just really, really like terminals. Whatever the reason, your choices of web browsers have, until recently, been limited, and your experience of the world wide web has been a janky, barely-functional one.... We tested Carbonyl in a range of Linux terminals, including the XFCE terminal. GNOME terminal, kitty, and the glorious Cool Retro Terminal. Carbonyl was smooth, fast, and flawless in all of them. We even connected to our Raspberry Pi via SSH in CRT, and ran Carbonyl remotely, watching Taylor Swift music videos on YouTube. No problem. And yes, you can use it to play DOOM.' -- source: https://linux.slashdot.org/story/23/02/04/0246248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Swears It's Not Coming For Your Data With Scan For Old Office Versions
by Peter Reutemann 07 Feb '23

07 Feb '23

'Microsoft wants everyone to know that it isn't looking to invade their privacy while looking through their Windows PCs to find out-of-date versions of Office software. From a report: In its KB5021751 update last month, Microsoft included a plan to scan Windows systems to smoke out those Office versions that are no longer supported or nearing the end of support. Those include Office 2007 (which saw support end in 2017) and Office 2010 (in 2020) and the 2013 build (this coming April). The company stressed that it would run only one time and would not install anything on the user's Windows system, adding that the file for the update is scanned to ensure it's not infected by malware and is stored on highly secure servers to prevent unauthorized changes to it. The update caused some discussion among users, at least enough to convince Microsoft to make another pitch that it is respecting user privacy and won't access private data despite scanning their systems. The update collects diagnostic and performance data so that it can determine the use of various versions of Office and how to best support and service them, the software maker wrote in an expanded note this week. The update will silently run once to collect the data and no files are left on the user's systems once the scan is completed.' -- source: https://yro.slashdot.org/story/23/02/06/1753258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LINUX OS and Desktop build - Compatibility question
by Michael James 02 Feb '23

02 Feb '23

Kia ora WLUG Participants..... Mike here in Whanganui. A total newbie and not at all a Linux programmer nor very knowledgeable about all things Linux but a very enthusiastic Linux proponent and open source advocate. I am trying to put together a new desktop build and wish to know if it will be compatible with the latest version of Linux, whether this be Ubuntu or whichever iteration is appropriate. The components of the build are as follows, and I would be most grateful if experienced participants can have a look at them to see if everything will work together with an appropriate Linux OS so the computer runs smoothly and without any problems for the longterm. *DESKTOP BUILD COMPONENTS* ASUS PRIME Z790-P WIFI-CSM DDR5 Motherboard Corsair CMH64GX5M2B5600C36 Vengeance RGB 64GB (2x32GB) DDR5-5600 XFX Radeon RX 7900 XT SPEEDSTER MERC310 Gaming 20GB Graphics Card Intel Raptor Lake Core i9-13900F Processor Corsair iCUE H150i ELITE CAPELLIX 360mm Liquid CPU Cooler Corsair RM1000e 1000W 80 Plus Gold Fully Modular Kingston NV2 2TB PCIe Gen 4 NVMe M.2 SSD Corsair 4000D Tempered Glass Mid-Tower Seagate IronWolf Pro ST4000NE001 4TB 128MB Hard Drive With kind thanks to all, All the best, Michael James __________________________________________________________________________________________ MICHAEL JAMES PASTROFF phone: inside New Zealand 021 115 3713 outside New Zealand 64 21 115 3713

1 0

EU's Proposed CE Mark for Software Could Have Dire Impact on Open Source
by Peter Reutemann 31 Jan '23

31 Jan '23

'The EU's proposed Cyber Resilience Act (CRA), which aims to "bolster cybersecurity rules to ensure more secure hardware and software products," could have severe unintended consequences for open source software, according to leaders in the open source community. From a report: The proposed Act can be described as CE marking for software products and has four specific objectives. One is to require manufacturers to improve the security of products with digital elements "throughout the whole life cycle." Second is to offer a "coherent cybersecurity framework" by which to measure compliance. Third is to improve the transparency of digital security in products, and fourth is to enable customers to "use products with digital elements securely." The draft legislation includes an impact assessment that says "for software developers and hardware manufacturers, it will increase the direct compliance costs for new cybersecurity requirements, conformity assessment, documentation and reporting obligations." This extra cost is part of a total cost of compliance, including the burden on businesses and public authorities, estimated at EUR 29 billion ($31.54 billion), and consequent higher prices for consumers. However, the legislators foresee a cost reduction from security incidents estimated at EUR 180 to 290 billion annually. The question is though: how can free software developers afford the cost of compliance, when lack of funding is already a critical issue for many projects? Mike Milinkovich, director of the Eclipse Foundation, said it is "deeply concerned that the CRA could fundamentally alter the social contract which underpins the entire open source ecosystem: open source software provided for free, for any purpose, which can be modified and further distributed for free, but without warranty or liability to the authors, contributors, or open source distributors. Legally altering this arrangement through legislation can reasonably be expected to cause unintended consequences to the innovation economy in Europe."' -- source: https://news.slashdot.org/story/23/01/26/1211223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Customer Conned Out Of Deposit, Company Liable
by Lawrence D'Oliveiro 30 Jan '23

30 Jan '23

A malicious third party intercepted email messages between a carpeting company and a customer, and was able to send a fake email asking for a deposit to the customer with all the right contact details, but the wrong bank account number <https://www.nzherald.co.nz/lifestyle/hacker-intercepts-carpet-companys-emai…>. And now the Disputes Tribunal has ruled that, since the email looked completely convincing, with the right personal details and everything, it was not reasonable to expect the customer to be suspicious or to want to double-check. And so the company had to wear the cost of the scam.

1 0

Intel Kills Its RISC-V Development Environment
by Lawrence D'Oliveiro 30 Jan '23

30 Jan '23

Intel is abandoning its “Pathfinder” project <https://www.theregister.com/2023/01/30/intel_ris_v_pathfinder_discontinued/> which was an integrated environment for doing development targeted at RISC-V processors. What does this mean for RISC-V? Not a lot, I would say. What does it mean for Intel? I think the basic problem here is the same as with its attempts to move into ARM: you have a high-volume, low-margin business where a company that has grown fat on not-so-high-volume, quite high-margin x86 processors was never going to be able to compete.

1 0

Jeremy Allison Laid Off From Google
by Lawrence D'Oliveiro 28 Jan '23

28 Jan '23

Seems the latest round of layoffs from Google has hit its open-source projects particularly hard, according to Steven J Vaughan-Nichols <https://www.theregister.com/2023/01/27/google_open_source/>. The one name that immediately caught my eye was Jeremy Allison, one of the chief brains behind Samba <https://www.samba.org/>. Before joining Google, he worked at Novell. He left there in 2006 because he objected to a deal Novell made with Microsoft which was effectively a patent licence for Free software (something which the GPL doesn’t allow) <https://www.zdnet.com/article/in-case-you-missed-it-part-1-jeremy-allison-f…>. While waiting to see where else he turns up, it is worth revisiting this essay <https://www.samba.org/samba/news/articles/low_point/tale_two_stds_os2.html> from shortly before that time, where he does a comparison between the Microsoft Windows and POSIX APIs, and why there can be so many independent, yet interoperable implementations of the latter, and why there can be only one of the former (though the WINE project continues to try to change that).

1 0

Consumer Reports Looks At Memory Safety
by Lawrence D'Oliveiro 27 Jan '23

27 Jan '23

The nonprofit Consumer Reports foundation has done a study of, of all things, memory safety in computer software <https://www.theregister.com/2023/01/26/memory_safety_mainstream/>. It apparently came to the need for this after putting together a consumer-focused guide to online security. Seems like greater adoption of the Rust programming language is becoming a key part of improving the situation. Asked about C++ creator Bjarne Stroustrup's assertion that ISO standard C++ can be memory safe when rules are enforced with static analysis, [Josh Aas, of the nonprofit Internet Security Research Group] expressed skepticism. "In a very theoretical sense that ignores the practicalities of the real world, that might be true," he said. "It might very theoretically be practically possible to write memory safe C++. But it's just not how things work in our world. There are just better ways to do that. C++ was not designed from the ground up to offer memory safety."

1 0

Android 14 Set To Block Certain Outdated Apps From Being Installed
by Peter Reutemann 25 Jan '23

25 Jan '23

'To help reduce the potential for malware, Android 14 will begin fully blocking the installation of apps that target outdated versions of Android. 9to5Google reports: For years now, the guidelines for the Google Play Store have ensured that Android developers keep their apps updated to use the latest features and safety measures of the Android platform. Just this month, the guidelines were updated, requiring newly listed Play Store apps to target Android 12 at a minimum. Up to this point, these minimum API level requirements have only applied to apps that are intended for the Google Play Store. Should a developer wish to create an app for an older version, they can do so and simply ask their users to sideload the APK file manually. Similarly, if an Android app hasn't been updated since the guidelines changed, the Play Store will continue serving the app to those who have installed it once before. According to a newly posted code change, Android 14 is set to make API requirements stricter, entirely blocking the installation of outdated apps. This change would block users from sideloading specific APK files and also block app stores from installing those same apps. Initially, Android 14 devices will only block apps that target especially old Android versions. Over time though, the plan is to increase the threshold to Android 6.0 (Marshmallow), with Google having a mechanism to "progressively ramp [it] up." That said, it will likely still be up to each device maker to decide the threshold for outdated apps or whether to enable it at all. The report notes that it'll still be possible to install an outdated version of an app "through a command shell, by using a new flag."' -- source: https://tech.slashdot.org/story/23/01/24/225226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google’s Fuchsia OS was one of the hardest hit by last week’s layoffs
by Peter Reutemann 24 Jan '23

24 Jan '23

'Google is still reeling from the biggest layoff in company history last Friday. Earlier cost cuts over the past six months have resulted in several projects being shut down or deprioritized at Google, and it's hard to fire 12,000 people without some additional projects taking a hit. The New York Times has a report about which divisions are being hit the hardest, and a big one is Google's future OS development group, Fuchsia. While the overall company cut 6 percent of its employees, the Times pointed out that Fuchsia saw an outsize 16 percent of the 400-person staff take a hit. While it's not clear what that means for the future of the division, the future of Fuchsia's division has never really been clear. Fuchsia has been a continuous mystery inside Google since it first saw widespread press coverage in 2017. Google rarely officially talks about it, leaving mostly rumors and Github documentation for figuring out what's going on. The OS isn't a small project, though—it's not even based on Linux, opting instead to use a custom, in-house kernel, so Google really is building an entire OS from scratch. Google actually ships the OS today to consumers in its Nest smart displays, where it replaced the older Cast OS. The in-place operating system swap was completely invisible to consumers compared to the old OS, came with zero benefits, and was never officially announced or promoted. There's not much you can do with it on a locked-down smart display, so even after shipping, Fuchsia is still a mystery. The biggest questions surrounding Fuchsia are: "Why does this exist, and what are its goals?" Is Fuchsia an eventual replacement for Android or Chrome OS? Around 2018, when we first got Fuchsia running on a Pixelbook, the source code documentation for the custom kernel said it "targets modern phones and modern personal computers with fast processors," which certainly made it sound like an Android and/or Chrome OS successor being built for flagship devices. That early codebase also included graphical user interfaces for PCs and phones, further driving home that this was a consumer OS. After Fuchsia got some initial publicity, it removed its public interface code. 2018 also saw a foundational Bloomberg report calling Fuchsia "a successor to Android," and saying the team planned to launch on smart speakers in 2021 (which was spot on) and would later move into phones and laptops in 2023. Even the name "Fuchsia" was a reference to Apple projects some members of the team had been involved with. "Pink" was the codename for a canceled successor to classic Mac OS, and "Purple" was the codename for the iPhone OS. The color Fuchsia is a mix of pink and purple, so this all sounded very ambitious.' -- source: https://arstechnica.com/gadgets/2023/01/big-layoffs-at-googles-fuchsia-os-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

83% of GNOME Users Installed Extensions, Survey Shows
by Peter Reutemann 24 Jan '23

24 Jan '23

'Last summer GNOME invited people to voluntarily run the tool gnome-info-collect on their systems to send back (non-sensitive/non-identifiable) data about their system configurations. 2,560 people ran the tool, and they're now releasing the data. Here's the distribution of distros for all 2,560 respondents: Fedora: 1,376 (54.69%) Arch: 469 (18.64%) Ubuntu: 267 (10.61%) Manjaro: 140 (5.56%) EndeavourOS: 66 (2.62%) Debian: 44 (1.75%) openSUSE: 38 (1.51%) Pop! 38 (1.51%) Other: 78 (3.10%) And the breakdown of hardware manufacturers (top four): Lenovo: 516 (23.54%) Dell: 329 (15.01%) ASUS: 261 (11.91%) HP: 223 (10.17%) The site OMG! Linux pointed out that 90% of systems had Flatpak installed — (though it's enabled by default on Fedora, which was 54.69% of all the respondents). Some other interesting stats they noticed: - Most common default browser: Firefox (73.14%), Chrome (11.64%), Brave (4.76%). [Microsoft Edge was the default browser on 37 systems (1.51%) ] - 83% of users have at least one (non-default) GNOME extension installed - 'App Indicator' is the most popular extension (by 43% of those using extensions) - GSConnect, User Themes, and Dash to Panel/Dock also widely used - Most popular desktop apps: GIMP (58.48%), VLC (53.71%), Steam (53.40%) [...] The popularity of GNOME extensions will surprise no-one. It is a solid indicator that the existing GNOME extension system is good at doing what it's there to: let users augment and extend their system in the ways they want. GNOME's report adds that "it's exciting to see the popularity of new GNOME apps like Flatseal, To Do, Bottles, and Fragments." One other interesting stat from their report: 55% of the participants were using Online Accounts, with Google the most common one added, followed by Nextcloud and Microsoft. But "Some of the account types had very little usage at all, with Foursquare, Facebook, Media Server, Flickr and Last.fm all being active on less than 1% of systems."' -- source: https://tech.slashdot.org/story/23/01/23/0355247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Which Performs Better on Linux: Firefox or Chrome?
by Peter Reutemann 23 Jan '23

23 Jan '23

'Phoronix compares the performance of Firefox and Chrome on the Linux desktop. They used recent releases (at default settings) for both browsers on an Intel Core i9 13900K "Raptor Lake" system with Radeon RX 6700XT graphics, concluding "out-of-the-box Google Chrome continues performing much better overall than Mozilla Firefox." One area where Firefox does better out-of-the-box is around the HTML5 Canvas such as measured via the CanvasMark test case. For the demanding JetStream 2 benchmark as one of the most demanding browser tests currently, Chrome on Linux was 67% faster than Firefox on this same Intel Raptor Lake desktop. Firefox did have a small win in the rather basic JavaScript Maze solver benchmark. Firefox at least was in a competitive space for the WebAssembly (WASM) benchmarks, but aside from that Google Chrome continues holding strong on Linux in the performance department.' -- source: https://news.slashdot.org/story/23/01/22/1922212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pioneering Apple Lisa goes “open source” thanks to Computer History Museum
by Peter Reutemann 20 Jan '23

20 Jan '23

'As part of the Apple Lisa's 40th birthday celebrations, the Computer History Museum has released the source code for Lisa OS version 3.1 under an Apple Academic License Agreement. With Apple's blessing, the Pascal source code is available for download from the CHM website after filling out a form. Lisa Office System 3.1 dates back to April 1984, during the early Mac era, and it was the Lisa equivalent of operating systems like macOS and Windows today. The entire source package weighs is about 26MB and consists of over 1,300 commented source files, divided nicely into subfolders that denote code for the main Lisa OS, various included apps, and the Lisa Toolkit development system.' -- source: https://arstechnica.com/information-technology/2023/01/pioneering-apple-lis… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How Amazon Scammers Get Good Product Reviews
by Lawrence D'Oliveiro 18 Jan '23

18 Jan '23

In this report on a fake <https://arstechnica.com/gadgets/2023/01/64gb-microsd-cards-are-posing-as-16…> 16TB SSD that only turned out to be 64GB, there is a description of how the seller was able to accumulate quite a bunch of effusive reviews: the listing would originally have been for an entirely different, legitimate product. Then once a good number of positive comments had been built up, it would have been switched for the scam. The switch might happen multiple times, for legitimate products each time, to keep adding to the positivity, until the final con. However, this does mean that you end up with an accumulation of rather odd reviews: However, reading some of these reviews made me question if we've been using SSDs wrong all this time. A review on one of the remarkably cheap portable SSD listings declared the product to be "a very colorful throw, but thinner" than expected. Another reported that the drive proved "very soft and perfect" for their 6-year-old. One review pointed to the SSD being a "beautiful portrait" that looks great in the kitchen, while another five-star review pointed to the high microphone and video quality.

1 0

MSI Accidentally Breaks Secure Boot for Hundreds of Motherboards
by Peter Reutemann 18 Jan '23

18 Jan '23

'Over 290 MSI motherboards are reportedly affected by an insecure default UEFI Secure Boot setting that allows any operating system image to run regardless of whether it has a wrong or missing signature. From a report: This discovery comes from a Polish security researcher named Dawid Potocki, who claims that he did not receive a response despite his efforts to contact MSI and inform them about the issue. The issue, according to Potocki, impacts many Intel and AMD-based MSI motherboards that use a recent firmware version, affecting even brand-new MSI motherboard models.' -- source: https://tech.slashdot.org/story/23/01/17/1728239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next Monday
by Peter Reutemann 16 Jan '23

16 Jan '23

Hi everyone Just a reminder that our AGM (annual general meeting) is next week on Monday: https://www.meetup.com/waikatolinuxusersgroup/events/290343641/ Only paid-up members will be able to vote. The AGM will be held in hybrid mode, in-person and via BigBlueButton: https://bbb2.nzoss.nz/b/pet-hmf-zqf-5ts BTW After nearly 10 years I won't be standing for president (or any other office) anymore. Due to personal reasons, I can no longer give the president's office the required attention (like organizing meetings, finding speakers/topics, presenting, etc). This presents a great opportunity for someone new to step up and bring in a fresh perspective to the society! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Vulnerability with 9.8 severity in Control Web Panel is under active exploit
by Peter Reutemann 16 Jan '23

16 Jan '23

'Malicious hackers have begun exploiting a critical vulnerability in unpatched versions of the Control Web Panel, a widely used interface for web hosting. “This is an unauthenticated RCE,” members of the Shadowserver group wrote on Twitter, using the abbreviation for remote code exploit. “Exploitation is trivial and a PoC published.” PoC refers to a proof-of-concept code that exploits the vulnerability. The vulnerability is tracked as CVE-2022-44877. It was discovered by Numan Türle of Gais Cyber Security and patched in October in version 0.9.8.1147. Advisories didn’t go public until earlier this month, however, making it likely some users still aren’t aware of the threat. Figures provided by Security firm GreyNoise show that attacks began on January 7 and have slowly ticked up since then, with the most recent round continuing through Wednesday. The company said the exploits are coming from four separate IP addresses located in the US, Netherlands, and Thailand. Shadowserver shows that there are roughly 38,000 IP addresses running Control Web Panel, with the highest concentration in Europe, followed by North America and Asia. The severity rating for CVE-2022-44877 is 9.8 out of a possible 10. “Bash commands can be run because double quotes are used to log incorrect entries to the system,” the advisory for the vulnerability stated. As a result, unauthenticated hackers can execute malicious commands during the login process. The following video demonstrates the flow of the exploit.' -- source: https://arstechnica.com/information-technology/2023/01/vulnerability-with-9… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Preparing To Disable Drivers For Microsoft's RNDIS Protocol
by Peter Reutemann 16 Jan '23

16 Jan '23

'Phoronix reports: With the next Linux kernel cycle we could see upstream disable their driver support for Microsoft's Remote Network Driver Interface Specification (RNDIS) protocol due to security concerns. RNDIS is the proprietary protocol used atop USB for virtual Ethernet functionality. The support for RNDIS outside of Microsoft Windows has been mixed. RNDIS isn't widely used today in cross-platform environments and due to security concerns the upstream Linux kernel is looking to move the RNDIS kernel drivers behind the "BROKEN" Kconfig option so they effectively become disabled in future kernel builds. Ultimately once marked as "BROKEN" for a while, the drivers will likely be eventually removed from the upstream source tree. Greg Kroah-Hartman wrote in a commit: "The Microsoft RNDIS protocol is, as designed, insecure and vulnerable on any system that uses it with untrusted hosts or devices. Because the protocol is impossible to make secure, just disable all rndis drivers to prevent anyone from using them again."' -- source: https://linux.slashdot.org/story/23/01/15/0220203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0