- wlug - list.wlug.org.nz

Firefox and Chrome are squaring off over ad-blocker extensions
by Peter Reutemann 12 Jun '22

12 Jun '22

'There’s a growing split over how much room browsers should leave for ad blocking — and Chrome and Firefox have ended up on opposite sides of the fight. The rupture centers on a feature called Web Request, commonly used in ad blockers and crucial for any system that looks to block off a domain wholesale. Google has long had security concerns about Web Request and has worked to cut it out of the most recent extension standard, called Manifest V3, or MV3 for short. But, in a recent blog post, Mozilla made clear that Firefox will maintain support for Web Request, keeping the door open for the most sophisticated forms of ad blocking. Google’s strategy has been roundly criticized by privacy advocates — the Electronic Frontier Foundation has been a vocal opponent — but the search company hasn’t been swayed. Though Firefox has a far smaller share of the desktop marketplace than Chrome, it could be a chance for Mozilla’s product to really define itself. For Google though, sticking with MV3 will have a huge impact on the overall role of ad blocking on the modern web. ' -- source: https://www.theverge.com/2022/6/10/23131029/mozilla-ad-blocking-firefox-goo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MIT Researchers Uncover 'Unpatchable' Flaw in Apple M1 Chips
by Peter Reutemann 12 Jun '22

12 Jun '22

'Apple's M1 chips have an "unpatchable" hardware vulnerability that could allow attackers to break through its last line of security defenses, MIT researchers have discovered. TechCrunch reports: The vulnerability lies in a hardware-level security mechanism utilized in Apple M1 chips called pointer authentication codes, or PAC. This feature makes it much harder for an attacker to inject malicious code into a device's memory and provides a level of defense against buffer overflow exploits, a type of attack that forces memory to spill out to other locations on the chip. Researchers from MIT's Computer Science and Artificial Intelligence Laboratory, however, have created a novel hardware attack, which combines memory corruption and speculative execution attacks to sidestep the security feature. The attack shows that pointer authentication can be defeated without leaving a trace, and as it utilizes a hardware mechanism, no software patch can fix it. The attack, appropriately called "Pacman," works by "guessing" a pointer authentication code (PAC), a cryptographic signature that confirms that an app hasn't been maliciously altered. This is done using speculative execution -- a technique used by modern computer processors to speed up performance by speculatively guessing various lines of computation -- to leak PAC verification results, while a hardware side-channel reveals whether or not the guess was correct. What's more, since there are only so many possible values for the PAC, the researchers found that it's possible to try them all to find the right one.' -- source: https://apple.slashdot.org/story/22/06/11/0250238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HP releases its $1,099 Linux laptop for developers
by Peter Reutemann 11 Jun '22

11 Jun '22

'HP released its Dev One Linux laptop today. Aimed at coders, the 14-inch clamshell comes at a lower price than previous Ubuntu-based HP clamshells. Starting at $1,099, the Dev One begins to keep costs low by opting for an AMD, rather than Intel, CPU and skipping the discrete graphics card. HP's last Linux laptops, part of its ZBook workstation lineup, went well over $2,000 and offered up to Intel Xeon processors and Nvidia RTX GPUs.' -- source: https://arstechnica.com/gadgets/2022/06/hps-linux-based-amd-laptop-releases… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

New ultra-stealthy Linux backdoor isn’t your everyday malware discovery
by Peter Reutemann 10 Jun '22

10 Jun '22

'Researchers have unearthed a discovery that doesn’t occur all that often in the realm of malware: a mature, never-before-seen Linux backdoor that uses novel evasion techniques to conceal its presence on infected servers, in some cases even with a forensic investigation. On Thursday, researchers from Intezer and The BlackBerry Threat Research & Intelligence Team said that the previously undetected backdoor combines high levels of access with the ability to scrub any sign of infection from the file system, system processes, and network traffic. Dubbed Symbiote, it targets financial institutions in Brazil and was first detected in November.' -- source: https://arstechnica.com/information-technology/2022/06/novel-techniques-in-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Who Needs Modern Emacs?
by Peter Reutemann 08 Jun '22

08 Jun '22

'Every now and again I come across some discussion on making Emacs "modern". The argument always go more or less like this - Emacs doesn't look and behave like and the world will end if we don't copy something "crucial" from it. [...] If you ask me -- there's pretty much nothing we can do that would suddenly make Emacs as popular as VS Code. But you know what -- that's perfectly fine. After all there are plenty of "modern" editors that are even less popular than Emacs, so clearly being "modern" doesn't make you popular. And there's also our "arch-nemesis" vim, that's supposedly as "dated" as Emacs, but is extremely popular.' -- source: https://it.slashdot.org/story/22/06/07/1942258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Apple Will Allow Linux VMs To Run Intel Apps With Rosetta In macOS Ventura
by Peter Reutemann 08 Jun '22

08 Jun '22

'Ars Technica: One of the few things that Intel Macs can do that Apple Silicon Macs can't is run operating systems written for Intel or AMD processors inside of virtual machines. Most notably, this has meant that there is currently no legal way to run Windows on an Apple Silicon Mac. Apple Silicon Macs can, however, run operating systems written for Arm processors inside of virtual machines, including other versions of macOS and Arm-compatible versions of Linux. And those Linux VMs are getting a new feature in macOS Ventura: the ability to run apps written for x86 processors using Rosetta, the same binary translation technology that allows Apple Silicon Macs to run apps written for Intel Macs. Apple's documentation will walk you through the requirements for using Rosetta within a Linux guest operating system -- it requires creating a shared directory that both macOS and Linux can access and running some terminal commands in Linux to get it set up. But once you do those steps, you'll be able to enjoy the wider app compatibility that comes with being able to run x86 code as well as Arm code. Some developers, including Hector Martin of the Asahi Linux project and Twitter user @never_released, have already found that these steps can also enable Rosetta on non-Apple ARM CPUs as long as they're modern enough to support at least version 8.2 of the Arm instruction set. As Martin points out, this isn't strictly legal because of macOS's licensing restrictions, and there are some relatively minor Apple-specific hardware features needed to unlock Rosetta's full capabilities.' -- source: https://apple.slashdot.org/story/22/06/07/208222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HTTP/3 Is Officially An IETF Spec
by Lawrence D'Oliveiro 07 Jun '22

07 Jun '22

QUIC is now officially HTTP/3, as described in RFC 9114 <https://www.theregister.com/2022/06/07/http3_rfc_9114_published/>. Not everybody is keen on it: there still seem to be some concerns over privacy, as well as over the claimed performance boost. Actually, a previous spec (RFC9000) had “Proposed Standard” status over a year ago, but it wasn’t (officially) being referred to as “HTTP/3” back then.

1 0

LastPass No Longer Requires a Password To Access Your Vault
by Peter Reutemann 07 Jun '22

07 Jun '22

'LastPass says they're now the first password manager with a passwordless sign-in feature. Engadget reports: Grant permission through the LastPass Authenticator mobile app and you can update account info on the web without entering your master password. The approach relies on FIDO-compliant password-free technology. The feature is available to both personal and business users. LastPass is also promising options beyond the Authenticator app in the future, such as relying on biometric scans or hardware security keys. ' -- source: https://it.slashdot.org/story/22/06/06/2111206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME Shell is Being Ported to Phones
by Peter Reutemann 05 Jun '22

05 Jun '22

'"As part of the design process for what ended up becoming GNOME 40 the design team worked on a number of experimental concepts," reports a blog post at Gnome.org's shell-dev blog, "a few of which were aimed at better support for tablets and other smaller devices." "Ever since then, some of us have been thinking about what it would take to fully port GNOME Shell to a phone form factor." It's an intriguing question because post-GNOME 40, there's not that much missing for GNOME Shell to work on phones, even if not perfectly.... On top of that, many of the things we're currently working towards for desktop are also relevant for mobile, including quick settings, the notifications redesign, and an improved on-screen keyboard. Given all of this synergy, we felt this is a great moment to actually give mobile GNOME Shell a try. Thanks to the Prototype Fund, a grant program supporting public interest software by the German Ministry of Education (BMBF), we've been working on mobile support for GNOME Shell for the past few months. We're not expecting to complete every aspect of making GNOME Shell a daily driveable phone shell as part of this grant project. That would be a much larger effort because it would mean tackling things like calls on the lock screen, PIN code unlock, emergency calls, a flashlight quick toggle, and other small quality-of-life features. However, we think the basics of navigating the shell, launching apps, searching, using the on-screen keyboard, etc. are doable in the context of this project, at least at a prototype stage. Of course, making a detailed roadmap for this kind of effort is hard and we will keep adjusting it as things progress and become more concrete... There's a lot of work ahead, but going forward progress will be faster and more visible because it will be work on the actual UI, rather than on internal APIs. Now that some of the basics are in place we're also excited to do more testing and development on actual phone hardware, which is especially important for tweaking things like the on-screen keyboard. Their blog post includes a video showing "what this currently looks like on laptops" and then one showing it running "on actual phone hardware." And someone has also posted a video on Twitter showing it running on a OnePlus 6 smartphone.' -- source: https://tech.slashdot.org/story/22/06/04/228254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Freeing Up of Hundreds of Millions of IPv4 Addresses Mooted
by Peter Reutemann 03 Jun '22

03 Jun '22

'Work is afoot to free up several internet protocol version 4 (IPv4) address ranges which have been unroutable as reserved, invalid or used for loopback networks since the 1980s. Reader Bismillah shares a report: Seth Schoen, who co-founded the free transport layer security digital certificate provider Let's Encrypt is working on an IPv4 clean-up project that would take address currently not routed on the public Internet, and make them generally usable. Presenting on the IPv4 Unicast Extensions Project at the Asia Pacific Regional Internet Conference on Operational Technologies (APRICOT), Schoen said decisions taken during the 1980s to keep several IPv4 address ranges as "special", has led to a substantial amount of numbering resources going to waste. This "even though the reasons behind the those decisions has not been borne out," Schoen said. Taking the 240/4, 0/8, 127/8, 225/8-232/8 ranges, and making them available as ordinary unicast numbering resources for networks would add some 419 million IPv4 addresses. Due to the rapid growth of the Internet, the number of 32-bit IPv4 addresses has become scarce, with some regional registries being unable to allocate additional blocks to networks. The scarcity has caused IPv4 address hoarding, high prices for sub-allocations and even fraud to get more space.' -- source: https://tech.slashdot.org/story/22/05/31/1958213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 5

Have an old iPad lying around? You might be able to make it run Linux soon
by Peter Reutemann 03 Jun '22

03 Jun '22

'If you have a 2013- or 2014-era iPad sitting around unused because it's not getting updates from Apple anymore and has stopped running the apps you need, some developers are working on an alternative software solution for you. Developer Konrad Dybcio and a Linux enthusiast going by "quaack723" have collaborated to get Linux kernel version 5.18 booting on an old iPad Air 2, a major feat for a device that was designed to never run any operating system other than Apple's. The project appears to use an Alpine Linux-based distribution called "postmarketOS," a relatively small but actively developed distribution made primarily for Android devices. Dybcio used a "checkm8" hashtag in his initial tweet about the project, strongly implying that they used the "Checkm8" bootrom exploit published back in 2019 to access the hardware. For now, the developers only have Linux running on some older iPad hardware using A7 and A8-based chips—this includes the iPad Air, iPad Air 2, and a few generations of iPad mini. But subsequent tweets imply that it will be possible to get Linux up and running on any device with an A7 or A8 in it, including the iPhone 5S and the original HomePod.' -- source: https://arstechnica.com/gadgets/2022/06/developers-get-linux-up-and-running… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AROS One x86 v1.7 and MorphOS 3.17 PPC Released
by Peter Reutemann 02 Jun '22

02 Jun '22

'Version 1.7 of AROS One for x86 has just been released and it's a distro of the "AROS Research Operating System," originally "Amiga Research Operating System." It's a standalone, free and open-source multi-media centric operating system that's designed to be portable, flexible, efficient and lightweight and can be seen dual booting with Windows 10 on an Acer laptop here. The most popular AROS specific community portal is AROS Exec. Parts of AROS were used to create the commercial PowerPC based Amiga-like operating system MorphOS, which has recently seen a new release as well, version 3.17. The most popular MorphOS specific community portal is MorphZone.' -- source: https://tech.slashdot.org/story/22/06/01/218219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Improving Your Relationship With Social Media May Call For A Targeted Approach
by Lawrence D'Oliveiro 02 Jun '22

02 Jun '22

Results of a self-experiment <https://freedom-to-tinker.com/2022/06/01/improving-your-relationship-with-s…> conducted by participants in a social networks course to find ways to improve their relationship with social media. The students split into three groups, each trying a different strategy, with the details left up to them, grouped into targeted limitation of participation in social media, targeted increase (yes, really), or elimination of participation altogether. Targeted increase involved actual posting and interaction with others on particular networks, rather than mere “doom-scrolling”. Two out of the three groups saw clear increases in well-being, and reduction in stress and loneliness. Limitation in use also improved sleep patterns. The strategy that seemed least effective was elimination: seems either limitation in use or more active participation will lead to benefits, not walking away altogether. Of course everybody is different, and as always, more research is needed. But maybe there are some ideas there you can try for yourself.

1 0

FairEmail Developer Calls It Quits After Google Falsely Flags App As Spyware
by Peter Reutemann 01 Jun '22

01 Jun '22

'"The developer of the open source email client FairEmail pulled all of his applications from Google Play and announced that he would stop development," reports gHacks. The announcement comes shortly after the developer received an email from Google stating that they believed the app was spyware. From the report: FairEmail was a popular email client for Google's Android operating system that was free to use. It was privacy-friendly, had no limitations in regards to email accounts that users could set up in the app, supported unified inbox, conversation threading, two-way synchronizing, support for OpenPGP, and a lot more. Marcel Bokhorst, the developer of the application, announced major changes to the project yesterday on XDA Developers. Earlier that week, Bokhorst received a policy violation email from Google stating that Google believed that the FairEmail application was spyware. The full statement has not been published, but Bokhorst believes that Google might have misinterpreted the use of favicons in the app. He resubmitted a new version of the application that had the use of favicons removed. The appeal he received as a response "resulted in a standard answer". While the content of the answer is unclear, it appears to have been a generic answer that Google Play Store developers have been frustrated with for a long time. Bokhorst decided to pull the application and all of his other applications from the Google Play Store. The apps won't be maintained and supported anymore according to the info. Other factors played a role in Bokhorst's decision, including the discrepancy between answering thousands of support questions per month and the application's revenue, and the inability to do something against unfair reviews in the Google Play Store. He considered keeping the applications on GitHub, but this would result in an 98% loss of audience. Google also recently forced Total Commander's developer to remove the ability to install APKs from the File Manager. If you're looking for an alternative email client, gHacks recommends the open-source app K-9 Mail.' -- source: https://tech.slashdot.org/story/22/05/19/2033249 Oh no, I just switched from K-9 to FairEmail a couple of months ago, as my K-9 was getting extremely slow with syncing mails... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Murena, the Privacy-First Android Smartphone, Arrives
by Peter Reutemann 01 Jun '22

01 Jun '22

'The /e/OS-powered Murena One is the first smartphone from Murena that does its best to free you from Google without sacrificing too many core features. There are no Google apps, Google Play Services, or even the Google Assistant. It's all been replaced by open-source software alternatives with privacy-respecting features. ZDNet's Steven Vaughan-Nichols reports: Murena and Mandrake Linux founder Gael Duval was sick of it by 2017. He wanted his data to be his data, and he wanted open-source software. Almost five years later, Duval and his co-developers launched the Murena One X2. It's the first high-end Android phone using the open-source /e/OS Android fork to arrive on the market. The privacy heart of the Murena One is /e/OS V1. There have been many attempts to create an alternative to Google-based Android and Apple's iOS -- Ubuntu One, FirefoxOS, and Windows Mobile -- but all failed. Duval's approach isn't to reinvent the mobile operating system wheel, but to clean up Android of its squeaky Google privacy-invading features and replace them with privacy-respecting ones. To make this happen, Duval started with LineageOS -- an Android-based operating system, which is descended from the failed CyanogenMod Android fork. It also blends in features from the Android Open Source Project (AOSP) source-code trees. In the /e/OS, most (but not all) Google services have been removed and replaced with MicroG services. MicroG replaces Google's libraries with purely open-source implementations without hooks to Google's services. This includes libraries and apps which provide Google Play, Maps, Geolocation, and Messaging services for Android applications. In addition, /e/OS does its best to free you from higher-level Google services. For instance, Google's default search engine has been replaced with Murena's own meta-search engine. Other internet-based services, such as Domain Name Server (DNS) and Network Time Protocol (NTP), use non-Google servers. Above the operating system, you'll find Google-free applications. This includes a web browser; an e-mail client; a messaging app; a calendar; a contact manager; and a maps app that relies on Mozilla Location Service and OpenStreetMap. While it's not here yet, Murena is also working on its own take on Google Assistant, Elivia-AI. You can also run many, but not all Android apps. You'll find these apps on the operating system's App Lounge. [...] There's still one big problem: the App Lounge still relies on you logging in with your Google account. In short, the App Lounge is mainly a gateway to Google Store apps. Munera assures me that the Lounge anonymizes your data -- except if you use apps that require payment. Still, this is annoying for people who want to cut all their ties with Google. The fundamental problem is this: Muena does all it can to separate its operating system and applications from Google, but it can't -- yet -- replace Google's e-commerce and software store system. As for hardware specs, the $379 Murena One features a 6.5-inch IPS LCD display, eight-core MediaTek Helio P60 processor, side-mounted fingerprint scanner, three rear cameras (48MP + 8MP + 5MP) and 25MP front camera, and 4,500mAh battery. It also features a microSD card slot for expandable storage and headphone port.' -- source: https://mobile.slashdot.org/story/22/05/31/229225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Python Is Getting Faster: Major Performance Tweaks On Horizon
by Lawrence D'Oliveiro 01 Jun '22

01 Jun '22

This report <https://www.theregister.com/2022/05/16/python_is_getting_faster/> on what is coming in CPython 3.11 and subsequent versions talks a lot about speed improvements. Several people have looked at removing the “GIL” (“Global Interpreter Lock”), which is the single biggest obstacle to improving multithreading performance. But some kind of lock is essential to maintain reference counting of dynamically-allocated objects. Get rid of these reference counts and you move to a Java-style pure-garbage-collected model, where you can end up consuming endless amounts of RAM unless you impose explicit limits on application size. But there is this new project called “nogil” (linked in the article). Their design overview document (hosted on Google Docs) talks about, not getting rid of reference counting, but implementing a more decentralized version of it, to minimize concurrency bottlenecks. This sounds quite hopeful.

1 1

Sick Of Windows But Can’t Afford A Mac? Consult Our Cynic’s Guide To Desktop Linux
by Lawrence D'Oliveiro 01 Jun '22

01 Jun '22

Typically snarky and tongue-in-cheek overview of Linux distros <https://www.theregister.com/2022/05/31/the_cynics_guide_to_linux/>. On ChromeOS Flex: The year of Linux on the desktop came and went, and nobody noticed – maybe because it doesn't say "Linux" on it. ChromeOS only runs on ChromeBooks and ChromeBoxes, but they outsold Macs for a while before the pandemic. ... You _can_ run Debian containers: if you know what that means, go run Debian. If you don't know what that means, trust us, you don't want to. Ubuntu: Ubuntu used to be the obvious choice, but it took its eye off the "for human beings" ball ... to grab at servers – which, to be fair, is where the money is – and it shows. When it gave up on all its in-house stuff, it kept Snap, its universal app-packaging format that no other distro uses. They work, but they gobble disk space and make bootup slower. Debian: It's sort of like Ubuntu, but more out of date, harder to install, and with fewer drivers. If that sounds just your sort of thing, go for it. Fedora: Probably not worth the effort unless your day job is trying to stop RHEL boxes falling over, or trying to build code that runs on RHEL boxes without falling over. openSUSE: ... uses Btrfs and snapshots to make it easy to roll back updates – but the package manager doesn't know about snapshots, or Btrfs's famed inability to tell you how much free disk space you have, so it occasionally fills up your file system and corrupts it. Frustrated boredom or cringing terror, it's your choice: have a lot of fun! RHEL spinoffs: Or there are Rocky Linux and AlmaLinux, which are RHEL with the serial numbers filed off. Also: only 270 entries on Distrowatch? I can remember when there were more like 350 ...

1 0

Vodafone Plans Carrier-Level User Tracking For Targeted Ads
by Peter Reutemann 01 Jun '22

01 Jun '22

'Vodafone is piloting a new advertising ID system called TrustPid, which will work as a persistent user tracker at the mobile Internet Service Provider (ISP) level. Vodafone explains that TrustPiD will be generated through randomness, and its subscribers will have the option to manage their consent over accepting the tracking via the company's Privacy Portal. BleepingComputer reports: The new system is in test phase in Germany and is intended to be impossible to bypass from within the web browser settings or through cookie blocking or IP address masking. The mobile carrier plans to assign a fixed ID to each customer and associate all user activity with it. The ID will be based on a number of parameters, so that the system will be able to maintain persistence. Then, the mobile ISP creates a personal profile based on that ID and helps advertisers serve targeted ads to each customer without disclosing any identification details. According to Vodafone, the problem that arises for its internet subscribers is that the "free" parts of the internet are threatened by stricter cookie blocking and privacy-boosting schemes. These new models threaten the targeted advertising industry, and according to Vodafone, the danger of this is losing content and platforms currently supported by ads. "Consumers appreciate the idea of a 'free' Internet, but this comes with a trade-off: publishers need a sustainable revenue model, meaning that it becomes essential to add subscription paywalls or rely on advertising to maintain free access to high-quality content," reads the explanation on the TrustPiD website, managed by Vodafone Sales and Services Limited.' -- source: https://yro.slashdot.org/story/22/05/31/2043256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lotus 1-2-3 Ported To Linux
by Peter Reutemann 31 May '22

31 May '22

'Lotus-1-2-3, an ancient spreadsheet program from Lotus Software (and later IBM), has been ported to a new operating system. drewsup writes: As reported by The Register, a Lotus 1-2-3 enthusiast called Tavis Ormandy (who is also a bug-hunter for Google Project Zero), managed to successfully port the program onto Linux, which seems to be quite the feat of reverse engineering. It's important to stress that this isn't an emulated program, but rather the original 1990 Lotus 1-2 -- for x86 Unix running natively on modern x86 Linux.' -- source: https://linux.slashdot.org/story/22/05/30/1633208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Turn an Old PC Into a High-End Amiga with AmiKit'
by Peter Reutemann 30 May '22

30 May '22

'AmiKit is a compilation of pre-installed and pre-configured Amiga programs running emulated on Windows, macOS, and Linux (as well as running on classic 68K Amigas expanded with a Vampire upgrade card). Besides original Workbench (Commodore's desktop environment/graphical filemanager), AmiKit provides Directory Opus Magellan and Scalos as desktop replacements and its "Rabbit Hole" feature allows you to launch Windows, Mac or Linux applications directly from your Amiga desktop! Anti-aliased fonts, Full HD 32-bit screen modes and DualPNG Icons support is included and this package comes with exclusive versions of the Master Control Program (MCP) and MUI 5 (Magic User Interface). The original AmigaOS (version 3.x) and Kickstart ROM (version 3.1) are required, also the recently released AmigaOS 3.2 is supported. You can also get the needed files from the Amiga Forever package(s). It even supports emulating AmigaOS 4.x (for PowerPC) easily through Flower Pot. Here's an extensive overview video by Dan Wood. An Amiga Future review of an earlier 2017 version can be read here. "Everything began in 1994 when my parents bought an Amiga 500 for me and my brother," explains AmiKit's developer. "I was 14 years old..." Fast forward to 2005, the AmiKit was born — an emulated environment including more than 350 programs. It fully replaced my old Amiga and it became a legend in the community over the years. Fast forward to 2017, a brand new AmiKit X is released, originally developed for A.L.I.C.E., followed by the XE version released in 2019, Vampire edition in 2020 and Raspberry Pi in 2021. The latest & greatest version was released in 2020. When someone, who has never heard about Amiga before, asks me why I would want to turn current modern computer into something retro and old fashioned, my short answer is: "Simply because I love Amiga!"' -- source: https://slashdot.org/story/22/05/29/2232204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Linux-Based Ransomware Targets VMware Servers
by Peter Reutemann 30 May '22

30 May '22

'"Researchers at Trend Micro have discovered some new Linux-based ransomware that's being used to attack VMware ESXi servers," reports CSO Online. (They describe the ESXi servers as "a bare-metal hypervisor for creating and running several virtual machines that share the same hard drive storage.") Called Cheerscrypt, the bad app is following in the footsteps of other ransomware programs — such as LockBit, Hive and RansomEXX — that have found ESXi an efficient way to infect many computers at once with malicious payloads. Roger Grimes, a defense evangelist with security awareness training provider KnowBe4, explains that most of the world's organizations operate using VMware virtual machines. "It makes the job of ransomware attackers far easier because they can encrypt one server — the VMware server — and then encrypt every guest VM it contains. One compromise and encryption command can easily encrypt dozens to hundreds of other virtually run computers all at once." "Most VM shops use some sort of VM backup product to back up all guest servers, so finding and deleting or corrupting one backup repository kills the backup image for all the hosted guest servers all at once," Grimes adds.... The gang behind Cheerscrypt uses a "double extortion" technique to extract money from its targets, the researchers explain. "Security Alert!!!" the attackers' ransom message declares. "We hacked your company successfully. All files have been stolen and encrypted by us. If you want to restore your files or avoid file leaks, please contact us." -- source: https://linux.slashdot.org/story/22/05/28/2243237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google is Rolling Out Chrome 102 with 32 Security Fixes, One Critical
by Peter Reutemann 29 May '22

29 May '22

'This week Google began a rolling release for stable Chrome version 102 "with 32 security fixes for browser on Windows, Mac and Linux," reports ZDNet: Chrome 102 for the desktop includes 32 security fixes reported to Google by external researchers. There's one critical flaw, while eight are high severity, nine are medium severity, and seven are low severity. Google also creates other fixes for issues found through internal testing... The critical flaw, labelled as CVE-2022-1853, is a 'use after free in IndexedDB', an interface for applications to store data in a user's browser.... "My guess is that an attacker could construct a specially crafted website and take over the visitor's browser by manipulating the IndexedDB," says Pieter Arntz, a malware intelligence researcher at Malwarebytes. None of the flaws fixed in this Chrome 102 stable release were zero days, meaning flaws that were exploited before Google released a patch for it. Google's Project Zero (GPZ) team last year counted 58 zero-day exploits for popular software in 2021. Twenty-five of these were in browsers, of which 14 affected Chrome. Google engineers argue zero-day counts are rising because vendors are improving detection, fixes and disclosure. However, GPZ researchers argue the industry as a whole is not making zero days hard enough for attackers, who often rely on tweaking existing flaws rather than being forced to conjure up entirely new exploitation methods. Linux/Mac/Windows users of Chrome can check Help/About to see if the update has already rolled out to their system — or if they need to update manually.' -- source: https://it.slashdot.org/story/22/05/28/186213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Newest Version of Systemd Includes Experimental Feature for A/B-Style Updating
by Peter Reutemann 29 May '22

29 May '22

'"Let's popularize image-based OSes," writes Lennart Poettering, "with modernized security properties built around immutability, SecureBoot, TPM2, adaptability, auto-updating, factory reset, uniformity — built from traditional distribution packages, but deployed via images." Or, as the Register puts it, the Systemd Linux init system "continues to grow and develop, as does Linux itself." They delve into the rationale for the new systemd-sysupdate and kernel-install features, noting "The former is still described as an experimental feature, so relax — for now." No, this does not mean that systemd is becoming a package manager. Like it or not, though, the nature of operating systems is changing. Modern ones are large, complex, and need regular updates, and as The Register has examined in depth recently, this means that the design of Linux distributions is changing radically.... ChromeOS doesn't have a package manager; neither do Fedora's Silverblue and Kinoite versions. You get a tested, known-good image of the OS. Updates are distributed as a complete image, like they are today with Android or iOS. ChromeOS has two root partitions: one live and one spare. The currently running OS updates the spare partition, then you reboot into that one. If everything works, it updates the now-idle second root partition. If it doesn't all work perfectly, then you still have the previous version available to use, and you can just reboot into that again. When a fixed image becomes available, the OS automatically tries again on the spare instance. The idea is that you always have a known-good OS partition available, which sounds like a benefit to us. Presumably the users are happy too: Chromebook sales may be down, and they only have a fixed lifespan, but there are still well over a hundred million of them out there. So, no, systemd is not going to become a package manager, because ordinary distros won't have a package manager at all, except maybe Flatpak, or Snap or something similar. The new functionality, including managing installed kernels, is to facilitate A/B type dual-live-system partitions. For some insight into this vision, Lennart Poettering, lead architect of systemd, has described this in a blog post titled "Bringing Everything Together." Other updates include "changes to systemd-networkd, such as systemd-resolved starting earlier in the boot sequence, and more cautious allocation of default routes," the article points out, adding that new releases of systemd "ppear roughly twice a year, so the chances are that this will appear in the fall releases of Ubuntu and Fedora... "If you still prefer to avoid systemd, don't despair. There are still a selection of distros that eschew it altogether, including Devuan GNU+Linux, Alpine Linux, and Void Linux.' -- source: https://linux.slashdot.org/story/22/05/28/194237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How CentOS Stream and RHEL 9 Led to AlmaLinux 9
by Peter Reutemann 29 May '22

29 May '22

'DNet writes that in late 2020 Red Hat decided "they'd no longer release CentOS Linux as a standalone distribution. Instead, CentOS Stream would work as a beta for RHEL." So where are we now? The competition immediately sprang up to replace CentOS. The two most important of these are the AlmaLinux OS Foundation's AlmaLinux and Rocky Enterprise Software Foundation's Rocky Linux. [May 16th saw the release of Rocky Linux 8.6.] Now, mere weeks after the release of RHEL 9, AlmaLinux 9 has arrived. Like RHEL itself, AlmaLinux 9 starts from CentOS Stream via RHEL. Indeed, AlmaLinux developers are CentOS Stream contributors. The bottom line is that CentOS 9 is an identical twin to RHEL 9 — except for the names and trademarks. It has all the same features, all the same advances, and, for better or worse, all the same bugs. Besides the big server architectures, AlmaLinux is also ready to run on everything from cloud and Docker images to Microsoft's Windows Subsystem for Linux and Raspberry Pi, the article points out. And Jack Aboutboul, AlmaLinux's Community Manager, tells ZDNet "We are building AlmaLinux with the specific goal of creating an independent CentOS successor that is truly community-centric and designed for everyone... We offer everyone a uniform platform that is safe, secure, easy to use, and dependable to build your tomorrow on."' -- source: https://linux.slashdot.org/story/22/05/28/1649229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.19 Adds 500K Lines of New Graphics Driver Code
by Peter Reutemann 27 May '22

27 May '22

'The current Linux kernel in development, 5.19, added 495,793 new lines of code for graphic driver updates. David Airlie sent in the new lines as part of Direct Rendering Manager (DRM) subsystem of Linux. The majority of additions were for AMD's RDNA and CDNA platforms but Intel also submitted changes for their DG2 graphics as well. Updates also came from Qualcomm and MediaTek for their GPU offerings.' -- source: https://tech.slashdot.org/story/22/05/26/2046227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0