- wlug - list.wlug.org.nz

A History Of ARM, Part 2
by Lawrence D'Oliveiro 22 Nov '22

22 Nov '22

Quite a nice article <https://arstechnica.com/gadgets/2022/11/a-history-of-arm-part-2-everything-…> covering the founding of ARM Ltd as parent company Acorn was hitting financial headwinds. Apple played an absolutely crucial part in keeping the company viable in its early days by being among its biggest customers: the Newton PDA sold 60,000 units in its first year, which was a flop for Apple but, at $20 a unit for royalties, a big boost for ARM Ltd at the time. In those early days, the company found it an uphill struggle to be taken seriously by the bigger players. Companies like Motorola and TI had trouble appreciating why they could not create their own in-house designs instead of licensing one from ARM, even when the latter could be done for a fraction of the cost of the former. But the boss was canny and persistent enough to make the right sort of deals to build a sound basis for the company: For Robin Saxby, the idea of working with rival chip companies was always part of the strategy. “Turn your enemies into friends,” he would say. “Why should they fight you if they can make more money for themselves by collaborating with you?” Unfortunately, big companies don’t always act rationally ...

1 0

AMD Finally Opens Up Its Radeon Raytracing Analyzer 'RRA' Source Code
by Peter Reutemann 22 Nov '22

22 Nov '22

'Michael Larabel, reporting for Phoronix: This summer AMD announced the Radeon Raytracing Analyzer "RRA" as part of their developer software suite for helping to profile ray-tracing performance/issues on Windows and Linux with both Direct3D 12 and the Vulkan API. Initially the RRA 1.0 release was binary-only but now AMD has made good on their "GPUOpen" approach and made it open-source. As noted back in my original article from July on the Radeon Raytracing Analyzer release: "Radeon Raytracing Analyzer is hosted on GitHub but the only content in the actual Git repository right now is documentation, so it would appear that at least initially this is a closed-source package though some documentation also says it's MIT licensed." Last week that was cleared up with the Radeon Raytracing Analyzer source code going public. There are build instructions for compiling the RRA 1.0 sources on both Microsoft Windows and Linux while the Linux instructions are tailoring to Ubuntu use. Building the Radeon Raytracing Analyzer depends upon the Qt 5.15 toolkit.' -- source: https://news.slashdot.org/story/22/11/21/1716219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The Creator of Homebrew's Plan To Get Open Source Contributors Paid - Using Blockchain
by Peter Reutemann 21 Nov '22

21 Nov '22

'The creator of the Linux/macOS package manager Homebrew has a new package manager named Tea. But according to Stack Overflow's podcast, the software also "aims to solve the problem of providing funding for popular open source projects." While he is not a crypto bull, Max was inspired with a solution for the open source funding dilemma by his efforts to buy and sell an NFT. A contract written in code and shared in public enforced a rule sending a portion of his proceeds to the digital objects original creator. What if the same funding mechanism could be applied to open source projects?Â In March of 2022, Max and his co-founder launched Tea, a sort of spirtual successor to Homebrew. It has a lot of new features Max wanted in a package manager, plus a blockchain based approach to ensuring that creators, maintainers, and contributors of open source software can all get paid for their efforts. You can read Max's launch post on Tea here and yes, of course there is a white paper. The paper describes the proposed solution as "a decentralized system for fairly remunerating open-source developers based on their contributions to the entire ecosystem and enacted through the tea incentive algorithm applied across all entries in the tea registry." And the launch post calls tea "our revolution against a failing system," arguing "We're taking our knowledge of how to make development more efficient and throwing innovations nobody has ever really considered before. "Package managers haven't been sexy. Until now. Most importantly, we're moving the package registry on-chain (relax, we'll use a low-energy proof of stake chain). This has numerous benefits due to the inherent benefits of blockchain technology." For starters, decentralized storage will make the packages always-available and immutable, signed by maintainers themselves. But there's more: web3 has enabled novel new ways to distribute value, and with our system people who care about the health of the open source ecosystem buy some token and stake it. Periodically, we reward this staking because it is securing our token network. We give a portion of these rewards to the staker and a portion to packages of their choice along with all the dependencies of those packages. Note that no portion goes to us. We're not like the other app stores.... tea is the home to a DAO that will ensure the open source maintainers that keep the Internet running are rewarded as they deserve. An introduction to the white paper adds that in the spirit of the open source movement, "we're inviting developers, speculators, and enthusiasts alike to contribute to our white paper and help brew the future of the internet. This is our revolutionary undertaking to create equitable openâsource for web3, and we want you to be a part of laying its groundwork."' -- source: https://news.slashdot.org/story/22/11/19/2047223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can Mastodon Be A Twitter Alternative?
by Lawrence D'Oliveiro 18 Nov '22

18 Nov '22

This article <https://www.aljazeera.com/economy/2022/11/7/can-mastodon-be-a-twitter-alter…> says: With Twitter in disarray since the world’s richest person took control of it last week, Mastodon, a decentralised, open alternative from privacy-obsessed Germany, has seen a flood of new users. Nevertheless, this “flood” is a mere trickle compared to the torrent of users that is Twitter -- a million or so active monthly users on the one, versus over 200 times that on the other. The decentralization of Mastodon means that no single entity can take control of it. But it also makes it harder for users to find their way around. [Mastodon creator] Rochko, whose Mastodon foundation runs on a shoestring crowdfunded budget topped up with a modest grant from the European Commission, has found a particularly receptive audience among privacy-conscious European regulators. Germany’s data protection commissioner is waging a campaign to get government bodies to close their Facebook pages, since, he says, there is no way of hosting a page there that conforms to European privacy laws. Authorities should move to the federal government’s own Mastodon instance, he says. The European Commission also maintains a server for European Union bodies to toot from. Yeah ... “toot” ...

3 7

DuckDuckGo’s anti-tracking Android tool could be “even more powerful” than iOS
by Peter Reutemann 17 Nov '22

17 Nov '22

'Privacy-focused search site DuckDuckGo has added yet another way to prevent more of your data from going to advertisers, opening its App Tracking Protection for Android to beta testers. DuckDuckGo is positioning App Tracking Protection as something like Apple's App Tracking Transparency for iOS devices, but "even more powerful." Enabling the service in the DuckDuckGo app for Android (under the "More from DuckDuckGo" section) installs a local VPN service on your phone, which can then start automatically blocking trackers on DDG's public blocklist. DuckDuckGo says this happens "without sending app data to DuckDuckGo or other remote servers."' -- source: https://arstechnica.com/gadgets/2022/11/duckduckgos-android-anti-tracking-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora 37 Now Available With GNOME 43 Desktop, Official Raspberry Pi 4 Support
by Peter Reutemann 17 Nov '22

17 Nov '22

'Fedora 37 is now officially released. From a report: Fedora 37 brings the GNOME 43 desktop to Fedora Workstation 37, updated toolchain components like Glibc 2.36 and LLVM 15 and Binutils 2.38, official support for the Raspberry Pi 4, retiring 32-bit ARMv7 support, Fedora CoreOS has been promoted to a Fedora Edition, Perl 5.36, Python 3.11, RPM 4.18, LXQt 1.1, and a wealth of other updated packages.' -- source: https://linux.slashdot.org/story/22/11/16/1744258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

India Lifts Download Ban On VLC
by Peter Reutemann 15 Nov '22

15 Nov '22

'India has lifted the download ban on VLC, more than nine months after it mysteriously blocked the official website of the popular media playback software in the South Asian market. From a report: VideoLAN, the popular software's developer, filed a legal notice last month seeking an explanation from the nation's IT and Telecom ministries for the block order. The Ministry of Electronics and IT has removed its ban on the website of VLC media player, New Delhi-based advocacy group Internet Freedom Foundation, which provided legal support to VideoLAN, said on Monday. VideoLAN confirmed the order. Indian telecom operators began blocking VideoLAN's official website, where it lists links to downloading VLC, in February of this year, VideoLAN president and lead developer Jean-Baptiste Kempf told TechCrunch in an earlier interview. India is one of the largest markets for VLC.' -- source: https://news.slashdot.org/story/22/11/14/1130222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenPrinting Keeps Old Printers Working -- Even On Windows
by Lawrence D'Oliveiro 12 Nov '22

12 Nov '22

This report from the Ubuntu Summit <https://www.theregister.com/2022/11/10/openprinting_keeps_old_printers_work…> I think nicely highlights the inevitable consequences of Microsoft allowing Linux into Windows with WSL2. Linux has long had better support for older printers and other hardware than Windows. Even after the vendors of the products drop support for their Windows drivers, others have found ways to create and maintain open-source drivers for those products. Now, the circle is turning back, with these same open-source drivers being offered back to Windows users, by running them on the Linux subsystem under WSL2. I don’t think it’s a coincidence that this offering is coming from Ubuntu/Canonical, given their increasingly cosy relationship with Microsoft. Sure, if you want to talk “Embrace, Extend, Extinguish”, just note that the platform being “embraced” and “extended” is not Linux being extended with formerly Windows-only capabilities, but Windows being extended with formerly Linux-only capabilities. As Microsoft and other vendors increasingly realize that, instead of developing proprietary Windows-only drivers, it is much less work to encourage the creation of open-source ones for Linux, that Windows can also use in this way via WSL2, where do you think this is going to lead?

1 0

Lenovo Driver Goof Poses Security Risk for Users of 25 Notebook Models
by Peter Reutemann 11 Nov '22

11 Nov '22

'More than two dozen Lenovo notebook models are vulnerable to malicious hacks that disable the UEFI secure-boot process and then run unsigned UEFI apps or load bootloaders that permanently backdoor a device, researchers warned on Wednesday. From a report: At the same time that researchers from security firm ESET disclosed the vulnerabilities, the notebook maker released security updates for 25 models, including ThinkPads, Yoga Slims, and IdeaPads. Vulnerabilities that undermine the UEFI secure boot can be serious because they make it possible for attackers to install malicious firmware that survives multiple operating system reinstallations. Short for Unified Extensible Firmware Interface, UEFI is the software that bridges a computer's device firmware with its operating system. As the first piece of code to run when virtually any modern machine is turned on, it's the first link in the security chain. Because the UEFI resides in a flash chip on the motherboard, infections are difficult to detect and remove. Typical measures such as wiping the hard drive and reinstalling the OS have no meaningful impact because the UEFI infection will simply reinfect the computer afterward. ESET said the vulnerabilities -- tracked as CVE-2022-3430, CVE-2022-3431, and CVE-2022-3432 -- "allow disabling UEFI Secure Boot or restoring factory default Secure Boot databases (incl. dbx): all simply from an OS." Secure boot uses databases to allow and deny mechanisms. The DBX database, in particular, stores cryptographic hashes of denied keys. Disabling or restoring default values in the databases makes it possible for an attacker to remove restrictions that would normally be in place.' -- source: https://it.slashdot.org/story/22/11/10/1610252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SPARK: A Competitor To Rust?
by Lawrence D'Oliveiro 09 Nov '22

09 Nov '22

Here’s another contender for a modern language that is low-level yet emphasizes minimization of bugs, to compete with the likes of Rust: it’s called SPARK <https://devclass.com/2022/11/08/spark-as-good-as-rust-for-safer-coding-adac…>. It’s not a completely new language, since according to the report it is a subset of Ada. The original Ada language came about in the 1980s out of a competition organized by the US Department of Defense, to create a language specifically designed for programming embedded and safety-critical systems. The most high-profile application of it that I know of is that the life-support systems on the International Space Station are written in Ada, and run on ancient (but well-tested) Intel 386 processors. So I would say that’s a good pedigree to start from.

1 0

The Linux Kernel Has Been Forcing Different Behavior For Processes Starting With 'X'
by Peter Reutemann 09 Nov '22

09 Nov '22

'"An ugly hack within the Linux kernel that has been in mainline for over three years has been called out," writes Phoronix's Michael Larabel. "Due to a buggy X.Org Server / xf86-video-modesetting DDX, the Linux kernel has been imposing different behavior on whether a process starts with 'X' and in turn disable the atomic mode-setting support." Linux security researcher and WireGuard creator, Jason Donenfeld, discovered the 'ugly code' within the kernel and commented on it via the kernel mailing list. "The commit to this kernel with the 'X' first character check was made back in September 2019," notes Larabel. "The 'good' news is that since then on user-space side back in 2019 the xf86-video-modesetting code went ahead and disabled atomic support by default. So technically if running an updated X.Org stack within the past three years, this kernel hack isn't necessary anymore since user-space is just then avoiding the atomic API."' -- source: https://linux.slashdot.org/story/22/11/08/2211244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE: Stopping The Windows/Super Key From Popping Up The App Menu
by Lawrence D'Oliveiro 07 Nov '22

07 Nov '22

I thought I had this disabled before, but KDE Plasma has this feature where you just need to press and release the Super key (or “Windows” key, if your keyboard has the proprietary logo on it), and the application menu will appear. It seems there is no GUI setting to disable this, but you can turn it off according to this <https://superuser.com/questions/1156130/kde-disable-super-l-windows-key-key…>. First, make the described edit to your KWin config file, in ~/.config/kwinrc, which you can do conveniently with kwriteconfig5 --file kwinrc --group ModifierOnlyShortcuts --key Meta "" Then either log out your GUI session and log in again, or try just restarting your window manager with kwin_x11 --replace & in some convenient terminal window. The writeup above doesn’t mention putting the “&” on the end, so KWin remains attached to that terminal session, which means you can’t use it for anything else ...

1 0

Outlawing Dark Patterns
by Lawrence D'Oliveiro 05 Nov '22

05 Nov '22

“Dark patterns” is a term coined to describe user interfaces designed to manipulate people into giving up time, money or personal data that they didn’t intend to. A common example is the obstacle course you often have to go through to cancel a subscription to something online. Another example is the use of countdown timers to rush buyers into hasty decisions. They may not be out-and-out deceptive, but they do come close. Now, the US states of California and Washington are looking to pass laws to restrict this practice. <https://arstechnica.com/tech-policy/2021/01/lawmakers-take-aim-at-insidious…>

2 2

New Hampshire Set To Pilot Voting Machines That Use Open-Source Software
by Peter Reutemann 04 Nov '22

04 Nov '22

'According to The Record, New Hampshire will pilot a new kind of voting machine that will use open-source software to tally the votes. The Record reports: The software that runs voting machines is typically distributed in a kind of black box -- like a car with its hood sealed shut. Because the election industry in the U.S. is dominated by three companies -- Dominion, Election Systems & Software and Hart InterCivic -- the software that runs their machines is private. The companies consider it their intellectual property and that has given rise to a roster of unfounded conspiracy theories about elections and their fairness. New Hampshire's experiment with open-source software is meant to address exactly that. The software by its very design allows you to pop the hood, modify the code, make suggestions for how to make it better, and work with other people to make it run more smoothly. The thinking is, if voting machines run on software anyone can audit and run, it is less likely to give rise to allegations of vote rigging. The effort to make voting machines more transparent is the work of a group called VotingWorks. [...] On November 8, VotingWorks machines will be used in a real election in real time. New Hampshire is the second state to use the open-source machines after Mississippi first did so in 2019. Some 3,000 voters will run their paper ballots through the new machines, and then, to ensure nothing went awry, those same votes will be hand counted in a public session in Concord, N.H. Anyone who cares to will be able to see if the new machines recorded the votes correctly. The idea is to make clear there is nothing to hide. If someone is worried that a voting machine is programmed to flip a vote to their opponent, they can simply hire a computer expert to examine it and see, in real time. ' -- source: https://politics.slashdot.org/story/22/11/03/2155238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

iproute2 Docs
by Lawrence D'Oliveiro 04 Nov '22

04 Nov '22

The “ip” command, aka the “iproute2” suite, offers a huge amount of functionality for managing the Linux network stack. The initial man page, “man ip”, gives an overview, and (at least on my current system) ends with references to more: SEE ALSO ip-address(8), ip-addrlabel(8), ip-ioam(8), ip-l2tp(8), ip-link(8), ip-maddress(8), ip-monitor(8), ip-mptcp(8), ip-mroute(8), ip-neighbour(8), ip-netns(8), ip-ntable(8), ip-route(8), ip-rule(8), ip-stats(8) ip-tcp_metrics(8), ip-token(8), ip-tunnel(8), ip-vrf(8), ip-xfrm(8) IP Command reference ip-cref.ps That “ip-cref.ps” file doesn’t seem to be included in any Debian packages I can see. However, when I look in the /usr/share/man/man8 directory, I find a few more man pages not mentioned in the above list: ip-nexthop.8.gz ip-fou.8.gz ip-macsec.8.gz ip-gue.8.gz (symlink to ip-fou.8.gz) ip-netconf.8.gz ip-sr.8.gz That “ip fou”/“ip gue” command lets you tunnel arbitrary IP protocols over a pair of UDP ports. The home page for online docs is at <https://wiki.linuxfoundation.org/networking/iproute2>. Among the links is this nice step-by-step intro to doing some useful things with it <https://lartc.org/howto/lartc.iproute2.html>.

1 0

The Godot Game Engine Now Has Its Own Foundation
by Peter Reutemann 04 Nov '22

04 Nov '22

'The Godot Engine now has its own foundation to continue funding themselves. Previously, they teamed up with the Software Freedom Conservancy to handle fiscal sponsorship duties. Phoronix reports: The Godot engine developers and Software Freedom Conservancy mutually agreed to move the open-source game engine project to its own foundation. The Godot Foundation has been setup in the Netherlands as its own organization modeled after the policies of the SFC. The Godot Foundation is to help this game engine achieve its next level of growth and project a stronger image for the project. "We have just started the process of moving to the Foundation," writes Godot Engine lead developer, Juan Linietsky, in a blog post. "For now all of Godot's funding and contractors are still managed by the SFC. The SFC will gradually reduce its work for Godot and the new foundation will slowly ramp up. Stay tuned for announcements in the future as we finalize the Foundation's organizational structure and officially begin operations." More details can be found via the Godot Engine blog.' -- source: https://news.slashdot.org/story/22/11/02/2045240 Anyone keen to showcase this engine at one of our meetings? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Ad For GIMP.org Served Info-Stealing Malware Via Lookalike
by Peter Reutemann 03 Nov '22

03 Nov '22

'A report from BleepingComputer, written by Ax Sharma: Searching for 'GIMP' on Google as recently as last week would show visitors an ad for 'GIMP.org,' the official website of the well known graphics editor, GNU Image Manipulation Program. This ad would appear to be legitimate as it'd state 'GIMP.org' as the destination domain. But clicking on it drove visitors to a lookalike phishing website that provided them with a 700 MB executable disguised as GIMP which, in reality, was malware. Reddit user ZachIngram04 earlier shared the development stating that the ad previously took users to a Dropbox URL to serve malware, but was soon "replaced with an even more malicious one" which employed a fake replica website 'gilimp.org' to serve malware. BleepingCompuer observed another domain 'gimp.monster' related to this campaign. To pass off the trojanized executable as GIMP in a believable manner to the user, the threat actor artificially inflated the malware, that is otherwise under 5 MB in size, to 700 MB by a simple technique known as binary padding. It still isn't clear if this instance was a slip up caused by a potential bug in Google Ad Manager that allowed malvertising.' -- source: https://tech.slashdot.org/story/22/11/02/1944255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mastodon Gained 70,000 Users After Musk's Twitter Takeover
by Peter Reutemann 03 Nov '22

03 Nov '22

'"More than 70,000 users joined Mastodon on the day after Musk's Twitter takeover announcement," writes Slashdot reader votsalo. "Mastodon is a six-year-old decentralized social media platform that uses 'federated' servers." The Guardian's Wilfred Chan writes: I joined Mastodon this week, and it took a few hours just to master its new vocabulary. Some of it is a little silly-sounding: instead of tweets, you have "toots". Things get trickier after that. Mastodon is not a single website but a network of thousands of websites called "instances", also called servers. These servers are "federated", which means they are run by different entities but can still communicate with each other without needing to go through a central system. And the space they all exist in is called the "fediverse," which some savvy tooters call "the Fedi." When you sign up for Mastodon, the first thing you do is choose a server. There are general-purpose ones, such as mastodon.social, as well as ones aimed at interest groups, such as kpop.social or linuxrocks.online. There are also joke servers like dolphin.town, where the only thing users are allowed to post is the letter "e". The server becomes part of your username (for example, wilfred(a)kpop.social), and the toots you see on your feed are toots from your server-mates, rather than from the entire fediverse. But you're also free to toot at people from other servers and even "boost" their public toots on to your feed. That's how Mastodon creates a unified global experience without being controlled by one entity, said Eugen Rochko, Mastodon's Germany-based founder and lead developer. "The servers are service providers, like Hotmail and Gmail are for email. It doesn't mean that the different servers are isolated from each other, like old school forums," he said. "Having just one account allows you to follow and interact with anyone in this global decentralized social network." But Mastodon's model comes with its own risks. If the server you join disappears, you could lose everything, just like if your email provider shut down. A Mastodon server admin also has ultimate control over everything you do: if for some reason the owner of kpop.social doesn't like that I boosted a toot from dolphin.town, they could remove it or even "defederate" the server, which would block all dolphin toots from the k-pop server completely. A server admin could also snoop on my private toots if they wanted to -- or delete my account for any reason. While Mastadon's 70,000 jump in users sounds impressive, it's "still a drop in a bucket compared with Twitter's reported 450 million daily active users," says Chan. The decentralized software also remains difficult for many people to use. According to TechCrunch, Mastadon says it has "gained 123,562 new users as of October 27, 2022 and now has 528,607 active users on the network as of October 31, 2022."' -- source: https://tech.slashdot.org/story/22/11/02/1958241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backblaze: Buying Cheaper, Less Reliable Drives Can Be Worth It
by Lawrence D'Oliveiro 02 Nov '22

02 Nov '22

Backup company Backblaze has put out another juicy status report on the reliability of its massive collection of hard drives <https://blocksandfiles.com/2022/11/01/backblaze-disk-drives/>. This one has some interesting numbers on the cost of dealing with drive failures -- it seems the hardware cost of these to the company is zero, as the failed drives get sent back to the vendors for full credit or replacement. (I guess if you buy a few thousand units at a time, you get special deals like this.) Since the company is in the business of providing sufficient redundancy that the impact of a drive failure on data integrity is essentially zero, the main cost of a failure becomes the labour cost of putting in a new drive, which comes to $300. Looked at this way, looking at the table which compares three models of drive, with unit costs ranging from $225 up to $275, and corresponding annualized failure rates of 1.5% down to 0.5%, it turns out the cheaper, flakier drive is the better deal -- amortized over a five-year service lifetime, the increased labour cost of replacing failed drives is easily outweighed by the savings in buying the drives in the first place.

1 0

OpenSSL 3 patch, once Heartbleed-level “critical,” arrives as a lesser “high”
by Peter Reutemann 02 Nov '22

02 Nov '22

'An OpenSSL vulnerability once signaled as the first critical-level patch since the Internet-reshaping Heartbleed bug has just been patched. It ultimately arrived as a "high" security fix for a buffer overflow, one that affects all OpenSSL 3.x installations, but is unlikely to lead to remote code execution. OpenSSL version 3.0.7 was announced last week as a critical security fix release. The specific vulnerabilities (now CVE-2022-37786 and CVE-2022-3602) had been largely unknown until today, but analysts and businesses in the web security field hinted there could be notable problems and maintenance pain. Some Linux distributions, including Fedora, held up releases until the patch was available. Distribution giant Akamai noted before the patch that half of their monitored networks had at least one machine with a vulnerable OpenSSL 3.x instance, and among those networks, between 0.2 and 33 percent of machines were vulnerable. But the specific vulnerabilities—limited-circumstance, client-side overflows that are mitigated by the stack layout on most modern platforms—are now patched, and rated as "High." And with OpenSSL 1.1.1 still in its long-term support phase, OpenSSL 3.x is not nearly as widespread.' -- source: https://arstechnica.com/information-technology/2022/11/openssl-3-patch-once… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LineageOS flashing
by Peter Reutemann 01 Nov '22

01 Nov '22

Hi everyone Since I've talked about flashing LineageOS on Android phones before... In the past, I've always used TWRP (https://twrp.me/) as recovery tool on the phones. However, the tools has been lagging behind with Android 12 support and the 3.7.0 release (which in theory added Android 12 support) failed on my old Galaxy S7 (I'm using custom ROMs supplied by Ivan Meier). Unfortunately, OrangeFox Recovery, which seems a popular alternative to TWRP, didn't support my Galaxy S7. However, I found a little workaround for that dilemma: though I used TWRP to install Android 11, during the setup process I then ticked the box to also update the recovery tool with LineageOS recovery with the every subsequent update. After updating the phone to the latest Android 11, I had LineageOS recovery on there which has (working) support for Android 12 and I managed to upgrade successfully to 12. Just in case somebody runs into a similar problem... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vanilla OS: More Than Just Vanilla GNOME With Ubuntu
by Peter Reutemann 31 Oct '22

31 Oct '22

'Slashdot reader Soul_Predator writes: Vanilla OS is Ubuntu on stock GNOME, with on-demand immutability and package selection freedom. It is currently a beta project, with a stable release planned for the next month. "The first-time setup process is a breeze to experience," writes It's FOSS News, applauding how it lets uses choose and enable Flatpak/Snap/AppImage. Overall, a package manager that installs applications utilizing a container, getting the ability to choose your package managers, on-demand immutability, and vanilla GNOME make it seem like a good deal to keep an eye on... I'd say it is a project that I believe a lot of users will appreciate. You can download the ISO by joining its Discord channel for now. The ISO is not yet publicly available to all. Take a look at its documentation if you are curious. However, as per the roadmap, they plan to have a release candidate soon enough. ' -- source: https://tech.slashdot.org/story/22/10/29/1953233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Teaching The Kids To Be Safe Online
by Lawrence D'Oliveiro 30 Oct '22

30 Oct '22

A program is being introduced into schools to give students a better appreciation for how to keep themselves safe online <https://www.stuff.co.nz/national/education/130292250/students-urged-to-be-l…>. It covers things like spotting phishing attacks, and avoiding making personal information public that you might regret later: Naenae College principal Nic Richards said while students were experts in social media, parents and teachers were aware that “the decisions made now can exist online forever.” “Experts” in putting information up and interacting with other users, not so savvy perhaps in understanding the consequences of doing so. And maybe some of what they learn will rub off on others in their family ... including their parents?

1 0

“You must enable DRM to play some audio or video on this page.”
by Lawrence D'Oliveiro 28 Oct '22

28 Oct '22

I have seen Firefox give me this message that I need to “enable DRM” (i.e. install support for Encrypted Media Extensions) when I visit certain pages. One site that is currently triggering this for me is Metservice <https://www.metservice.com/towns-cities/locations/hamilton>. Yet I can’t see anything on that page that I might be blocked from playing. There is a Video Forecast clip, but I seem to be able to play that OK. Anybody else get this message?

3 2

'Old/Weird Laptops' Sought To Help Test Linux Kernel Backlight Drivers
by Peter Reutemann 28 Oct '22

28 Oct '22

'Do you have a laptop that's either "pretty old" or "weird in some other way"? Did it ship without Windows from the factory, or did you flash its firmware with coreboot? You could help the Linux kernel move its backlight code forward without abandoning quirky gear like yours. ArsTechnica: Hans de Goede, a longtime Linux developer and principal engineer at Red Hat, writes on his Livejournal about the need to test "a special group of laptops" to prevent their backlight controls from disappearing in Linux kernel 6.1. Old laptop tests are needed because de Goede is initiating some major changes to user-space backlight controls, something he has been working on since 2014. As detailed at Linux blog Phoronix, there are multiple issues with how Linux tries to address the wide variety of backlight schemes in displays, which de Goede laid out at the recent Linux Plumbers Conference. There can be multiple backlight devices operating a single display, leaving high-level controls to "guess which one will work." Brightness control requires root permissions at the moment. And "0" passed along as a backlight value remains a conundrum, as the engineer pointed out in 2014: Is that entirely off, or as low as the display can be lit?' -- source: https://linux.slashdot.org/story/22/10/27/1920206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0