- wlug - list.wlug.org.nz

Microsoft Screws Up Linux
by Lawrence D'Oliveiro 17 Jul '22

17 Jul '22

Remember that version 1.0 of WSL (“Windows Services for Linux”) tried to emulate Linux APIs on top of the Windows kernel, but that turned out to be impossible to get right. (Why not? Windows kernel not functional enough?) So WSL 2.0 abandoned this approach, to bring in a true-blue Linux kernel running under a cut-down version of Microsoft’s Hyper-V virtualization system. Problem solved, right? You’d think having an actual Linux kernel would be sufficient to implement actual Linux APIs. And so Microsoft can offer regular Linux distros like Ubuntu to run on Windows, under WSL. But it turns out WSL actually relies on a specially-patched Microsoft version of the Linux kernel. So you can’t just take any old Linux distro and install it. Which is why you only have the option of distros specially packaged for the Microsoft Store. Furthermore, this special WSL kernel has some bugs in it that a regular Linux kernel does not. I discovered this while browsing through the open-issues list for libffi <https://github.com/libffi/libffi>. This library offers a “foreign-function interface”, which high-level languages can use to call functions written in C. For example, this library is the basis of Python’s ever-handy ctypes module. Look at this issue <https://github.com/libffi/libffi/issues/552>, where the script for building libffi fails under WSL. One participant has narrowed the problem down to this: The following shell script which performs the issued part in a generated configure file is as follows: #!/bin/bash exec 5>>my.log { touch my.log mkdir -p workdir cd workdir test -f ../my.log && mv ../my.log . stat my.log } On a Linux system single partition, the stat call will show expected data. In a WSL environment on an NTFS mount, the call will fail. The only real subtlety is that the enclosing block has a file open for writing that the code inside the block is moving to a different directory. But all this has perfectly-defined behaviour according to the POSIX spec. This applies even if the destination directory is on a separate filesystem, so that the “mv” command has to turn the rename into a copy-then-delete. I tried that script on my genuine Linux system, with and without “workdir” being a separate filesystem. I even tried formatting the separate filesystem as an NTFS volume. The code worked fine in all cases. So what’s going wrong? It could be the age-old Windows bugbear, where you cannot access a file that has already been opened somewhere else, because it is “locked”. Somehow Microsoft has transplanted this limitation into its own version of the Linux kernel. This may be a “feature” under Windows, but it is no longer conforming to POSIX filesystem semantics!

1 0

Network Un-Neutrality Coming To Europe?
by Lawrence D'Oliveiro 14 Jul '22

14 Jul '22

Seems some ISPs are lobbying the European Commission to allow them to charge fees to companies such as Google, Meta and Netflix for providing their content to the ISPs’ paying customers <https://arstechnica.com/tech-policy/2022/07/eu-lawmakers-slam-idea-of-forci…>. Because the ISPs aren’t already charging their customers enough? They claim that the big content providers are somehow getting a “free ride” (even though they have to pay for their own Internet connections)? Our previous discussion about the consequences of such policies: <https://list.waikato.ac.nz/hyperkitty/list/wlug(a)list.waikato.ac.nz/thread…> (Seems the list archive was moved to a different system at some point, invalidating all previous archive links.)

1 0

X.Org Server Hit By New Local Privilege Escalation, Remote Code Execution Vulnerabilities
by Peter Reutemann 13 Jul '22

13 Jul '22

'Getting things started for this "Patch Tuesday" are the disclosure of two new X.Org Server vulnerabilities. Phoronix reports: These issues affecting out-of-bounds accesses with the X.Org Server can lead to local privilege elevation on systems where the X.Org Server is running privileged and remote code execution for SSH X forwarding sessions. CVE-2022-2319 and CVE-2022-2320 were made public this morning and both deal with the X.Org Server's Xkb keyboard extension not properly validating input that could lead to out-of-bounds memory writes. Fixes for these XKB vulnerabilities have been patched in X.Org Server Git and xorg-server 21.1.4 point release is expected soon with these fixes. Both vulnerabilities were discovered by Trend Micro's Zero Day Initiative. ' -- source: https://it.slashdot.org/story/22/07/12/2012211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Working Speculative Execution Attack Sends Intel and AMD Scrambling
by Peter Reutemann 13 Jul '22

13 Jul '22

'Some microprocessors from Intel and AMD are vulnerable to a newly discovered speculative execution attack that can covertly leak password data and other sensitive material, sending both chipmakers scrambling once again to contain what is proving to be a stubbornly persistent vulnerability. Ars Technica reports: Researchers from ETH Zurich have named their attack Retbleed because it exploits a software defense known as retpoline, which was introduced in 2018 to mitigate the harmful effects of speculative execution attacks. Speculative execution attacks, also known as Spectre, exploit the fact that when modern CPUs encounter a direct or indirect instruction branch, they predict the address for the next instruction they're about to receive and automatically execute it before the prediction is confirmed. Spectre works by tricking the CPU into executing an instruction that accesses sensitive data in memory that would normally be off-limits to a low-privileged application. Retbleed then extracts the data after the operation is canceled. [...] The ETH Zurich researchers have conclusively shown that retpoline is insufficient for preventing speculative execution attacks. Their Retbleed proof-of-concept works against Intel CPUs with the Kaby Lake and Coffee Lake microarchitectures and AMD Zen 1, Zen 1+, and Zen 2 microarchitectures. In response to the research, both Intel and AMD advised customers to adopt new mitigations that the researchers said will add as much as 28 percent more overhead to operations. [...] Both Intel and AMD have responded with advisories. Intel has confirmed that the vulnerability exists on Skylake-generation processors that don't have a protection known as enhanced Indirect Branch Restricted Speculation (eIBRS) in place. "Intel has worked with the Linux community and VMM vendors to provide customers with software mitigation guidance which should be available on or around today's public disclosure date," Intel wrote in a blog post. "Note that Windows systems are not affected given that these systems use Indirect Branch Restricted Speculation (IBRS) by default which is also the mitigation being made available to Linux users. Intel is not aware of this issue being exploited outside of a controlled lab environment." AMD, meanwhile, has also published guidance. "As part of its ongoing work to identify and respond to new potential security vulnerabilities, AMD is recommending software suppliers consider taking additional steps to help guard against Spectre-like attacks," a spokesman wrote in an email. The company has also published a whitepaper. [Research Kaveh Razavi added:] "Retbleed is more than just a retpoline bypass on Intel, specially on AMD machines. AMD is in fact going to release a white paper introducing Branch Type Confusion based on Retbleed. Essentially, Retbleed is making AMD CPUs confuse return instructions with indirect branches. This makes exploitation of returns very trivial on AMD CPUs." The mitigations will come at a cost that the researchers measured to be between 12 percent and 28 percent more computational overhead. Organizations that rely on affected CPUs should carefully read the publications from the researchers, Intel, and AMD and be sure to follow the mitigation guidance.' -- source: https://hardware.slashdot.org/story/22/07/12/2052224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lenovo are now shipping (some) laptops that only boot Windows by default
by Eliot Blennerhassett 13 Jul '22

13 Jul '22

"Starting in 2022 for Secured-core PCs it is a Microsoft requirement for the 3rd Party Certificate to be disabled by default. The apparent secured-core requirement for 2022 is that the second of these CAs should not be trusted by default. As a result, drivers or bootloaders signed with this certificate will not run on these systems. This means that, out of the box, these systems will not boot anything other than Windows[1]." https://mjg59.dreamwidth.org/60248.html ... are we surprised? -- Eliot

2 1

Two-Factor Authentication Doesn’t Help Against Phishing Attacks
by Lawrence D'Oliveiro 13 Jul '22

13 Jul '22

This article <https://arstechnica.com/information-technology/2022/07/microsoft-details-ph…> points out that using a second authentication factor cannot really guard against “man-in-the-middle” attacks. If the fake site is passing on your credentials to carry out a logon to the real site, then it can also pass on any extra authentication factors that are coming through alternative channels: One of the few visually suspicious elements in the scam is the domain name used in the proxy site landing page. Still, given the opaqueness of most organization-specific login pages, even the sketchy domain name might not be a dead giveaway. Too often, it seems, this use of obscure login URLs neuters the effectiveness of the only real clue that the user might have to a phishing attack. My own insurance company is doing this sort of thing. They send me a renewal reminder e-mail, and all the links in it go through some online Adobe-run service for tracking the clicks. (Why can it not go through their own domain name, at least?) I told them about it last year and again this year: this year I finally got a response asking me to send them the offending message, which I did.

1 0

Rentware Comes To Cars
by Lawrence D'Oliveiro 13 Jul '22

13 Jul '22

Korean BMW owners can now pay a monthly fee to activate features in their cars such as heated seats, automatic high-beam switching, or being able to save video from the car’s cameras <https://www.theregister.com/2022/07/12/bmw_locks_korean_car_owners/>. Customers have expressed their dislike of this idea, which means you can expect to see it spread more widely.

1 0

Microsoft Resorts To Registry Hack To Keep Outlook From Using Windows 11 Search
by Lawrence D'Oliveiro 12 Jul '22

12 Jul '22

The catalogue of sadness here <https://www.theregister.com/2022/07/11/outlook_search/> just goes on: The indexing service is infamously fragile ... A temporary workaround is to simply switch off Windows Desktop Search to force Outlook to use its built-in service. Users that choose this option will be warned that Search will be impacted because a group policy has turned off the Windows Search service, but let's face it, less-than-slick performance has long been a hallmark of the Windows Search services. ... Windows Search has long blighted Microsoft's flagship operating system, and behind the scenes Windows Search continues to cause grief for some.

1 0

Hackers Uncover Ways To Unlock and Start Nearly All Modern Honda-Branded Vehicles
by Peter Reutemann 12 Jul '22

12 Jul '22

'The Drive: Hackers have uncovered ways to unlock and start nearly all modern Honda-branded vehicles by wirelessly stealing codes from an owner's key fob. Dubbed "Rolling Pwn," the attack allows any individual to "eavesdrop" on a remote key fob from nearly 100 feet away and reuse them later to unlock or start a vehicle in the future without owner's knowledge. Despite Honda's dispute that the technology in its key fobs "would not allow the vulnerability," The Drive has independently confirmed the validity of the attack with its own demonstration. Older vehicles used static codes for keyless entry. These static codes are inherently vulnerable, as any individual can capture and replay them at will to lock and unlock a vehicle. Manufacturers later introduced rolling codes to improve vehicle security. Rolling codes work by using a Pseudorandom Number Generator (PRNG). When a lock or unlock button is pressed on a paired key fob, the fob sends a unique code wirelessly to the vehicle encapsulated within the message. The vehicle then checks the code sent to it against its internal database of valid PRNG-generated codes, and if the code is valid, the car grants the request to lock, unlock, or start the vehicle. The database contains several allowed codes, as a key fob may not be in range of a vehicle when a button is pressed and may transmit a different code than what the vehicle is expecting to be next chronologically. This series of codes is also known as a "window," When a vehicle receives a newer code, it typically invalidates all previous codes to protect against replay attacks. This attack works by eavesdropping on a paired keyfob and capturing several codes sent by the fob. The attacker can later replay a sequence of valid codes and re-sync the PRNG. This allows the attacker to re-use older codes that would normally be invalid, even months after the codes have been captured. [...] Contrary to Honda's claim, I independently confirmed the vulnerability by capturing and replaying a sequence of lock and unlock requests with my 2021 Honda Accord and a Software-Defined Radio. Despite being able to start and unlock the car, the vulnerability doesn't allow the attacker to actually drive off with the vehicle due to the proximity functionality of the key fob. However, the fact that a bad actor can get this far is already a bad sign. At this time, the following vehicles may be affected by the vulnerability: 2012 Honda Civic, 2018 Honda X-RV, 2020 Honda C-RV, 2020 Honda Accord, 2021 Honda Accord, 2020 Honda Odyssey, 2021 Honda Inspire, 2022 Honda Fit, 2022 Honda Civic, 2022 Honda VE-1, and 2022 Honda Breeze. It's not yet clear if this affects any Acura-branded vehicles. "[W]e've looked into past similar allegations and found them to lack substance," said a Honda spokesperson in a statement to The Drive. "While we don't yet have enough information to determine if this report is credible, the key fobs in the referenced vehicles are equipped with rolling code technology that would not allow the vulnerability as represented in the report. In addition, the videos offered as evidence of the absence of rolling code do not include sufficient evidence to support the claims."' -- source: https://tech.slashdot.org/story/22/07/11/2023254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Toward a Future We Want to Live In' - EFF Celebrates 32nd Birthday
by Peter Reutemann 11 Jul '22

11 Jul '22

'"Today at the Electronic Frontier Foundation, we're celebrating 32 years of fighting for technology users around the world," reads a new announcement posted at EFF.org: If you were online back in the 90s, you might remember that it was pretty wild. We had bulletin boards, FTP, Gopher, and, a few years later, homespun websites. You could glimpse a future where anyone, anywhere in the world could access information, float new ideas, and reach each other across vast distances. It was exciting and the possibilities seemed endless. But the founders of EFF also knew that a better future wasn't automatic. You don't organize a team of lawyers, technologists, and activists because you think technology will magically fix everything — you do it because you expect a fight. Three decades later, thanks to those battles, the internet does much of what it promised: it connects and lifts up major grassroots movements for equity, civil liberties, and human rights and allows people to connect and organize to counteract the ugliness of the world. But we haven't yet won that future we envisioned. Just as the web connects us, it also serves as a hunting ground for those who want to surveil and control our actions, those who wish to harass and spread hate, as well as others who seek to monetize our every move and thought. Information collected for one purpose is freely repurposed in ways that oppress us, rather than lift us up. The truth is that digital tools allow those with horrible ideas to connect with each other just as it does those with beautiful, healing ones. EFF has always seen both the beauty and destructive potential of the internet, and we've always put our marker down on the side of justice, freedom, and innovation. We work every day toward a future we want to live in, and we don't do it alone. Support from the public makes every one of EFF's activism campaigns, software projects, and court filings possible. Together, we anchor the movement for a better digital world, and ensure that technology supports freedom, justice, and innovation for all people of the world. In fact, I invite every digital freedom supporter to join EFF during our summer membership drive. Right now, you can be a member for as little as $20, get some special new gear, and ensure that tech users always have a formidable defender in EFF. So how does the EFF team celebrate this auspicious anniversary? EFF does what it does best: stand up for users and innovators in the courts, in the halls of power, in the public conversation. We build privacy-protecting tools, teach skills to community members, share knowledge with allies, and preserve the best aspects of the wild web. In other words, we use every tool in our deep arsenal to fight for a better and brighter digital future for all. Thank you for standing with EFF when it counts.' -- source: https://yro.slashdot.org/story/22/07/10/199234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Six Ground-Breaking New Linux Laptops Released in the Last Two Weeks
by Peter Reutemann 11 Jul '22

11 Jul '22

'In the last two weeks six new Linux laptops have hit the market (or were announced). "The Linux hardware scene is getting better by the day," writes the site FOSS Weekly: - Star Labs teases its new StarFighter Linux Laptop with a 4K (10-bit IPS) display. - MNT Research introduces a "more affordable" 7-inch mini Linux laptop, the MNT Pocket Reform. - KDE's Slimbook 4 is here with AMD Ryzen 7 5700U processor and a better battery, starting from $1,000. "Buying from Slimbook supports KDE development too," notes Gaming on Linux, adding that there's a choice of 14 or 15.6 inch displays. - TUXEDO's Pulse 15 — Gen2 (also with an AMD Ryzen 7 5700U processor) has a 15-inch HiDPI WQHD 165Hz display, along with eight cores and 16 threads. (And the Register notes its twin cooling fans, "allowing them to overclock the chip and run it at 35W," and a choice of distros.) - Pre-orders have opened for the Roma — the first RISC-V Laptop (which may ship in September). Ars Technica reports they're offering "free Silicon upgrades" — that is free system-on-a-chip and system-on-module upgrades for its quad-core RISC-V CPU. And there's also a companion NPU/GPU, notes a blog post at RISCV.org, "for the fastest, seamless RISC-V native software development available." (As well as "early access to next-generation laptop and accessory upgrades at generous discounts or for free.") The blog post calls it a "Web3-friendly platform with NFT creation and publication plus integrated MetaMask-style wallet." - System 76's "Lemur" Alder Lake- and coreboot-powered laptop arrives with 14 hours of battery life.' -- source: https://linux.slashdot.org/story/22/07/10/2019230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Will Microsoft Ban Commercial Open Source from Its App Store?
by Peter Reutemann 10 Jul '22

10 Jul '22

'Microsoft has "delayed enforcement" of what could be a controversial policy change, according to the Software Freedom Conservancy: A few weeks ago, Microsoft quietly updated its Microsoft [app] Store Policies, adding new policies (which go into effect next week), that include this text: all pricing ... must ... [n]ot attempt to profit from open-source or other software that is otherwise generally available for free [meaning, in price, not freedom]. Wednesday, a number of Microsoft Store users discovered this and started asking questions. Quickly, those of us (including our own organization) that provide Free and Open Source Software (FOSS) via the Microsoft Store started asking our own questions too.... Since all (legitimate) FOSS is already available (at least in source code form) somewhere "for free" (as in "free beer"), this term (when enacted) will apply to all FOSS... Sadly, these days, companies like Microsoft have set up these app stores as gatekeepers of the software industry. The primary way that commercial software distributors reach their customers (or non-profit software distributors reach their donors) is via app stores. Microsoft has closed its iron grasp on the distribution chain of software (again) — to squeeze FOSS from the marketplace. If successful, even app store users will come to believe that the only legitimate FOSS is non-commercial FOSS. This is first and foremost an affront to all efforts to make a living writing open source software. This is not a merely hypothetical consideration. Already many developers support their FOSS development (legitimately so, at least under the FOSS licenses themselves) through app store deployments that Microsoft recently forbid in their Store.... Microsoft counter-argues that this is about curating content for customers and/or limiting FOSS selling to the (mythical) "One True Developer". But, even a redrafted policy (that Giorgio Sardo [General Manager of Apps at Microsoft] hinted at publicly early Thursday) will mandate only toxic business models for FOSS (such as demo-ware, less-featureful versions available as FOSS, while the full-featured proprietary version is available for a charge). The Conservancy argues that FOSS "was designed specifically to allow both the original developers and downstream redistributors to profit fairly from the act of convenient redistribution (such as on app stores)." But it also speculates about the sincerity of Microsoft's intentions. "We're cognizant that Microsoft probably planned all this, anyway — including the community outrage followed by their usual political theater of feigned magnanimity." The Conservancy's post Thursday received an update Friday about Microsoft's coming policy update: After we and others pointed out this problem, a Microsoft employee claimed via Twitter that they would "delay enforcement" of their new anti-FOSS regulation [giving as their reason that "it could be perceived differently than intended."] We do hope Microsoft will ultimately rectify the matter, and look forward to the change they intend to enact later. Twitter is a reasonable place to promote such a change once it's made, but an indication of non-enforcement by one executive on their personal account is a suboptimal approach. This is a precarious situation for FOSS projects who currently raise funds on the Microsoft Store; they deserve a definitive answer. Given the tight timetable (just five days!) until the problematic policy actually does go into effect, we call on Microsoft to officially publish a corrected policy now that addresses this point and move the roll-out date at least two months into the future. (We suggest September 16, 2022.) This will allow FOSS projects to digest the new policy with a reasonable amount of time, and give Microsoft time to receive feedback from the impacted projects and FOSS experts.' -- source: https://news.slashdot.org/story/22/07/09/0247213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Untrusted MS Office Macros Are Here Again
by Lawrence D'Oliveiro 09 Jul '22

09 Jul '22

Back in February, Microsoft restricted the execution of macros in Office, so that ones that came from Internet sources were disabled by default. Previously, such execution could be enabled by a single click on a button in the warning banner, but this button was taken away. Now this single-click execution enabler is back <https://arstechnica.com/information-technology/2022/07/microsoft-makes-majo…>. Clearly it broke too many existing users’ workflows, as insecure as they were. Naturally, most security experts are not happy. Though some accept that customers need more time to adjust to a stricter regime.

1 0

Microsoft's xCloud Game Streaming Looks Worse On Linux Than Windows
by Peter Reutemann 07 Jul '22

07 Jul '22

'As noted by a Reddit user and confirmed by Ars Technica, Microsoft's xCloud game streaming looks noticeable worse when running on Linux than Windows. From the report: With the Linux User-Agent, edges are generally less sharp and colors are a little more washed out. The difference is even more apparent if you zoom in on the Forza logo and menu text, which shows a significant reduction in clarity. Interestingly, the dip in quality seems to go away if you enable "Clarity Boost, an Edge-exclusive feature that "provid[es] the optimal look and feel while playing Xbox games from the cloud," according to Microsoft. That's great for Linux users who switched over to Microsoft Edge when it launched on Linux last November. But Linux users who stick with Firefox, Chrome, or other browsers are currently stuck with apparently reduced streaming quality. That Linux quality dip has led some to speculate that Microsoft is trying to reserve the best xCloud streaming performance for Windows machines in an attempt to attract more users to its own operating system. But using a Macintosh User-Agent string provides streaming performance similar to that on Windows, which would seem to be a big omission if that theory were true. Microsoft also hasn't published any kind of "best on Windows"-style marketing in promoting xCloud streaming, which would seemingly be a key component of trying to attract new Windows users. (The quality difference could be a roundabout attempt to get Linux users to switch to the Edge browser, where Clarity Boost offers the best possible quality. But that still wouldn't fully explain why Windows users on other browsers, without Clarity Boost, also get better streaming quality than their Linux brethren.) Others have suggested that the downgrade could simply be a bug caused by Microsoft's naive parsing of the User-Agent strings. That's because the User-Agent strings for Android browsers generally identify themselves as some version of Linux ("Linux; Android 11; HD1905," for example). Microsoft's xCloud code might simply see the "Linux" in that string, assume the user is running Android, then automatically throttle the streaming quality to account for the (presumably) reduced screen size of an Android phone or tablet. ' -- source: https://games.slashdot.org/story/22/07/06/2040206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Systemd Creator Lands At Microsoft
by Peter Reutemann 07 Jul '22

07 Jul '22

'Yesterday, Phoronix reported that the lead developer of systemd, Lennart Poettering, left Red Hat. "It turns out he had joined Microsoft and [is] continuing his work on systemd," writes Phoronix's Michael Larabel in a new report. He continues: While some may not always align with his views or approaches to handling some things, there is no overstating his enormous contributions to the Linux/open-source world and his dedication to advancing the ecosystem over the years. This may take many by surprise but let's not forget Microsoft has over time employed a number of Linux developers and other prominent open-source developers... Microsoft currently employs Python creator Guido van Rossum, GNOME creator Miguel de Icaza had been employed by Microsoft from 2016 when they acquired Xamarin to earlier this year when he left, Nat Friedman as part of Xamarin-Microsoft served as GitHub CEO following Microsoft's acquisition, Gentoo Linux founder Daniel Robbins was previously employed by Microsoft, Steve French as the Linux CIFS/SMB2/SMB3 maintainer and Samba team member works for Microsoft, and Microsoft employs/previously-employed a large number of upstream Linux developers like Matteo Croce, Matthew Wilcox, Shyam Prasad N, Michael Kelley, and many others beyond just the usual immediately recognizable names to Linux enthusiasts/developers. It was also just earlier this year that Christian Brauner as another longtime Linux kernel developer joined Microsoft. Christian Brauner is Berlin-based like Lennart and moved on to Microsoft after the past half-decade at Canonical working on the Linux kernel, LXC, systemd, and more. ' -- source: https://linux.slashdot.org/story/22/07/06/2348255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PulseAudio and Systemd Creator, Lennart Poettering, Reportedly Leaves Red Hat
by Peter Reutemann 06 Jul '22

06 Jul '22

'To much surprise, the lead developer of systemd Lennart Poettering who also led the creation of PulseAudio, Avahi, and has been a prolific free software contributor has reportedly left Red Hat. Michael Larabel writes via Phoronix: So far no public announcement appears to have been made, but according to a source has been reportedly removed from Red Hat's internal employee database. Yesterday Lennart did comment on the public Fedora devel mailing list to having now created a personal Red Hat Bugzilla account for his Fedora contributions after it was raised in bug reports and brought up on the mailing list that Lennart's Red Hat account is disabled. Emailing his Red Hat address this morning indeed yields an auto-response that it's no longer in use. He's still active in systemd world with new commits made as of today, so it will be interesting to see where he ends up or his next moves with his vast Linux ecosystem expertise and pivotal role in spearheading systemd's direction. ' -- source: https://linux.slashdot.org/story/22/07/05/2040215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Gtk 5 Might Drop X.11 Support, Says GNOME Dev
by Peter Reutemann 06 Jul '22

06 Jul '22

'One of the GNOME developers has suggested that the next major release of Gtk could drop support for the X window system. The Register reports: Emmanuele Bassi opened a discussion last week on the GNOME project's Gitlab instance that asked whether the developers could drop X.11 support in the next release of Gtk. At this point, it is only a suggestion, but if it gets traction, this could significantly accelerate the move to the Wayland display server and the end of X.11. Don't panic: Gtk 5 is not imminent. Gtk is a well-established toolkit, originally designed for the GIMP bitmap editing program back in 1998. Gtk 4 arrived relatively recently, shortly before the release of GNOME 40 in 2021. GNOME 40 has new user-interface guidelines, and as a part of this, Gtk 4 builds GNOME's Adwaita theme into the toolkit by means of the new libadwaita library, which is breaking the appearance of some existing apps. Also, to be fair, as we recently covered, the X window system is very old now and isn't seeing major changes, although new releases of parts of it do still happen. This discussion is almost certain to get wildly contentious, and the thread on Gitlab has been closed to further comments for now. If this idea gains traction, one likely outcome might well be a fork of Gtk, just as happened when GNOME 3 came out. [...] A lot of the features of the current version, X.11, are no longer used or relevant to most users. Even so, X.12 is barely even in the planning stages yet.' -- source: https://news.slashdot.org/story/22/07/05/2110211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vim 9.0 Released
by Peter Reutemann 05 Jul '22

05 Jul '22

'After many years of gradual improvement Vim now takes a big step with a major release. Besides many small additions the spotlight is on a new incarnation of the Vim script language: Vim9 script. Why Vim9 script: A new script language, what is that needed for? Vim script has been growing over time, while preserving backwards compatibility. That means bad choices from the past often can't be changed and compatibility with Vi restricts possible solutions. Execution is quite slow, each line is parsed every time it is executed. The main goal of Vim9 script is to drastically improve performance. This is accomplished by compiling commands into instructions that can be efficiently executed. An increase in execution speed of 10 to 100 times can be expected. A secondary goal is to avoid Vim-specific constructs and get closer to commonly used programming languages, such as JavaScript, TypeScript and Java. The performance improvements can only be achieved by not being 100% backwards compatible. For example, making function arguments available by creating an "a:" dictionary involves quite a lot of overhead. In a Vim9 function this dictionary is not available. Other differences are more subtle, such as how errors are handled. For those with a large collection of legacy scripts: Not to worry! They will keep working as before. There are no plans to drop support for legacy script. No drama like with the deprecation of Python 2.' -- source: https://developers.slashdot.org/story/22/07/04/193233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

no more scrolling...
by Peter Reutemann 05 Jul '22

05 Jul '22

Hi everyone Been working on a Rasperry Pi without graphical user interface and simply log in on the command-line. One thing that has been puzzling me is why I can no longer scroll backwards/forwards using SHIFT+PGUP/PGDOWN. Instead I have to use "| less" on output now. Turns out that this functionality got removed from the kernel: https://www.linuxquestions.org/questions/slackware-14/the-latest-kernel-rel… Not every device will have a graphical user interface, especially not IoT devices. So that's rather annoying... :-( Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

USB installer tool removes Windows 11’s Microsoft account requirements (and more)
by Peter Reutemann 05 Jul '22

05 Jul '22

'One of the new "features" coming to the Windows 11 22H2 update is a Microsoft account requirement for all new installs, regardless of whether you are using the Home or Pro version of the operating system. And that's too bad, because the 22H2 update corrects a few of Windows 11's original shortcomings while adding some nice quality-of-life improvements. An easy workaround for this requirement is the Rufus USB formatting tool, which can create USB install media for Windows and all kinds of other operating systems. Rufus has already offered some flags to remove Windows 11's system requirement checks from the installer, removing the need for clunky Windows Registry edits and other workarounds. But the beta of version 3.19 will also remove the Microsoft account requirement for new installs, making it easy to set up a new Windows PC with a traditional local account. When setting up Windows 11, make sure not to connect your PC to the Internet before creating your user account. This trick worked to circumvent the Microsoft account requirement in Windows 11 Pro and some of the later versions of Windows 10 but is being removed entirely from Windows 11 22H2. The Rufus tool merely reverts to the pre-22H2 status quo.' -- source: https://arstechnica.com/gadgets/2022/06/usb-installer-tool-removes-windows-… Nice to see open-source "fixing" this mandatory account issue. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The tiniest Raspberry Pi gets a new version with built-in Wi-Fi
by Peter Reutemann 04 Jul '22

04 Jul '22

'The Raspberry Pi Zero series is the smallest version of the popular single-board computer that most people have experience with, but there's one Pi that's even smaller: the Raspberry Pi Pico. Launched in January of 2021 for just $4, the Pico's RP2040 microcontroller incorporates a pair of 133MHz Arm Cortex-M0+ CPU cores and 264 kilobytes (not megabytes) of memory. The low specs and low price make it well-suited for single-purpose devices that don't need much processing power instead of running general-purpose software like the larger Pi boards. To help support companies who want to use the Pico as a basis for Internet-connected smart devices, the Raspberry Pi Foundation is introducing a few new variants of the Pico today. The most notable, the Raspberry Pi Pico W, adds built-in Wi-Fi connectivity to the board while increasing the price from $4 to $6.' -- source: https://arstechnica.com/gadgets/2022/06/the-tiniest-raspberry-pi-gets-a-new… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open-Standard Audio/MIDI plugins: A Dose Of CLAP
by Lawrence D'Oliveiro 01 Jul '22

01 Jul '22

Music/audio production tools commonly support plugins to augment their capabilities. However, well-supported plugin architectures have mostly been proprietary. For example, Steinberg’s VST2 is strictly controlled via a proprietary licence. They are now promoting VST3, which is being made available under the GPL, but their (mis)handling of the VST2→VST3 transition has left a bad taste in many developers’ mouths. On Linux, you will likely heard of open-source plugin systems like LADSPA, DSSI and LV2. And also JUCE and GMPI. Of these, LV2 seems like the most popular, but developers report that it can be hard to get to grips with. Here is a backgrounder <https://lwn.net/Articles/890272/> by Alexandre Prokoudine on the current state of play, leading up to the introduction of Yet Another Plugin Standard, the “Clever Audio Plugin”, or “CLAP” (fnarr-fnarr). He goes into more detail in the followup <https://lwn.net/Articles/893048/>. And he has a bunch of more info on his own site <https://librearts.org/2022/06/introducing-clap/>.

1 0

Mycroft’s Mimic 3 -- A Privacy-Focused, Open-Source Text-To-Speech Engine
by Lawrence D'Oliveiro 30 Jun '22

30 Jun '22

Just came across this video <https://www.youtube.com/watch?v=egrMopDIvPE> on the “Learn Linux TV” channel, talking about this new device that does text to speech. The actual speech-synthesis software is open-source. The original “Mimic1” has been around for a while, but the new version takes advantage of newer Raspberry π hardware. He talks about it not needing an Internet connection any more: I think this was a requirement of the old hardware, not the software as such. You can build and install the software (old or new) yourself, it’s freely available from their GitHub repos. Interesting that the build instructions for Microsoft Windows recommend doing a cross-build from Linux, this being faster than a native Windows build.

1 0

How The Swiss Post E-Voting System Addresses Client-Side Vulnerabilities
by Lawrence D'Oliveiro 30 Jun '22

30 Jun '22

There has been a lot of talk about E-voting. But the trouble with most such systems proposed is that they tend to have weaknesses allowing the voting system to be subverted. Switzerland is one of those places that has implemented a system that seems to address the most common weaknesses. This article <https://freedom-to-tinker.com/2022/06/29/how-the-swiss-post-e-voting-system…>, part of a series on E-voting systems, gives an overview of how it works. Each voter is sent a piece of paper through the mail. This has a unique code on it that they use to initiate the online voting process. It also contains a series of codes associated with each possible response from the voting system (calculated from the voter-specific code). So as the voter enters their choice, they can verify that the code shown is the correct one for that choice. So even if the voting app, or the browser, or the user’s PC has been compromised, the attacker still cannot know what the codes are -- those are only known to the central voting system, and disclosed only to that voter. Any attempt to fake the voter’s selection will cause a code mismatch that should raise alarm bells. So the voting system is not entirely paperless: basically, nobody knows how to create a secure, yet completely paperless, voting system. Which is not to say the system is completely foolproof: the next instalment promises to reveal some issues with the scheme.

1 0

Firefox Can Now Automatically Remove Tracking From URLs
by Peter Reutemann 30 Jun '22

30 Jun '22

'Mozilla's latest Firefox browser release has a new feature that prevents sites like Facebook from tracking you across websites. Called Query Parameter Stripping, it automatically removes strings of characters added to the end of an URL.' -- source: https://news.slashdot.org/story/22/06/29/1939203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0