- wlug - list.wlug.org.nz

Is Firefox OK?
by Peter Reutemann 21 Feb '22

21 Feb '22

'At the end of 2008, Firefox was flying high. Twenty percent of the 1.5 billion people online were using Mozilla’s browser to navigate the web. In Indonesia, Macedonia, and Slovenia, more than half of everyone going online was using Firefox. “Our market share in the regions above has been growing like crazy,” Ken Kovash, Mozilla’s president at the time, wrote in a blog post. Almost 15 years later, things aren’t so rosy. Across all devices, the browser has slid to less than 4 percent of the market—on mobile it’s a measly half a percent. “Looking back five years and looking at our market share and our own numbers that we publish, there's no denying the decline,” says Selena Deckelmann, senior vice president of Firefox. Mozilla’s own statistics show a drop of around 30 million monthly active users from the start of 2019 to the start of 2022. “In the last couple years, what we've seen is actually a pretty substantial flattening,” Deckelmann adds.' -- source: https://arstechnica.com/gadgets/2022/02/is-firefox-ok/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Millions of WordPress sites get forced update to patch critical plugin flaw
by Peter Reutemann 21 Feb '22

21 Feb '22

'Millions of WordPress sites have received a forced update over the past day to fix a critical vulnerability in a plugin called UpdraftPlus. The mandatory patch came at the request of UpdraftPlus developers because of the severity of the vulnerability, which allows untrusted subscribers, customers, and others to download the site’s private database as long as they have an account on the vulnerable site. Databases frequently include sensitive information about customers or the site’s security settings, leaving millions of sites susceptible to serious data breaches that spill passwords, user names, IP addresses, and more.' -- source: https://arstechnica.com/information-technology/2022/02/millions-of-wordpres… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Developers Patch Bugs Faster Than Microsoft, Apple, and Google, Study Shows
by Peter Reutemann 21 Feb '22

21 Feb '22

'Linux programmers fixed bugs faster than anyone — in an average of just 25 days (improving from 32 days in 2019 to just 15 in 2021). That's the conclusion of Google's "Project Zero" security research team, which studied the speed of bug-fixing from January 2019 to December 2021. ZDNet reports that Linux's competition "didn't do nearly as well." For instance, Apple, 69 days; Google, 44 days; and Mozilla, 46 days. Coming in at the bottom was Microsoft, 83 days, and Oracle, albeit with only a handful of security problems, with 109 days. By Project Zero's count, others, which included primarily open-source organizations and companies such as Apache, Canonical, Github, and Kubernetes, came in with a respectable 44 days. Generally, everyone's getting faster at fixing security bugs. In 2021, vendors took an average of 52 days to fix reported security vulnerabilities. Only three years ago the average was 80 days. In particular, the Project Zero crew noted that Microsoft, Apple, and Linux all significantly reduced their time to fix over the last two years. As for mobile operating systems, Apple iOS with an average of 70 days is a nose better than Android with its 72 days. On the other hand, iOS had far more bugs, 72, than Android with its 10 problems. Browsers problems are also being fixed at a faster pace. Chrome fixed its 40 problems with an average of just under 30 days. Mozilla Firefox, with a mere 8 security holes, patched them in an average of 37.8 days. Webkit, Apple's web browser engine, which is primarily used by Safari, has a much poorer track record. Webkit's programmers take an average of over 72 days to fix bugs.' -- source: https://linux.slashdot.org/story/22/02/20/1915222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why I Don’t Like Checking Version Numbers
by Lawrence D'Oliveiro 18 Feb '22

18 Feb '22

Some major web browsers will soon be hitting version 100. The rollover to a 3-digit version number is going to trigger a repeat of what happened when version numbers rolled from 9 to 10 -- some sites turned out to have buggy version checking based simplistically on strings rather than numeric values, and misbehave <https://www.theregister.com/2022/02/17/browsers_version_100_websites_bug/>. As a matter of habit, I have long been reluctant to condition behaviour in my own code based on writing code to look up version numbers of things. I prefer to include some kind of check that more directly determines the existence of relevant functionality.

1 0

Ransomware-As-A-Service
by Lawrence D'Oliveiro 10 Feb '22

10 Feb '22

From <https://www.theregister.com/2022/02/09/uk_us_au_ransomware_warning/>: Ransomware attacks are proliferating as criminals turn to gangs providing turnkey post-compromise services, Britain's National Cyber Security Centre (NCSC) has warned. So, ransomware has become so routine, it has spawned specialists who will take care of many of the technical details for you. For a fee, of course. I think “turnkey post-compromise services” shall be my phrase of the week ...

1 0

Listening To The Radio Killed My Car Stereo!
by Lawrence D'Oliveiro 10 Feb '22

10 Feb '22

From <https://arstechnica.com/cars/2022/02/radio-station-snafu-in-seattle-bricks-…>: ... the problem began on January 30 and afflicted Mazdas from model years 2014 to 2017 when the cars were tuned to the local NPR station, KUOW 94.9. At some point during the day's broadcast, a signal from KUOW caused the Mazdas' infotainment systems to crash—the screens died and the radios were stuck on 94.9 FM. The problem was image files† in the HD radio stream that the infotainment system didn’t know how to decode (they were lacking filename extensions). So it crashed. But the files were still in its cache on reboot, so it tried to decode them again. And crashed again. And it appears, there is no way to get rid of those files or reset the system to a safe state without major hardware surgery. And a replacement unit costs USD1,500 -- if you can get one. Luckily, Mazda has advised that it knows about the problem, and will replace the affected units free of charge -- once supplies are available. †Radio with pictures? Who knew?

1 0

System76 Linux workstation looks ready for gaming, too
by Peter Reutemann 04 Feb '22

04 Feb '22

'System76's latest Linux laptop combines one of AMD's most powerful 5000 series mobile CPUs with Nvidia's mid-range RTX 3060. Configurable to up to $3,442, the Kudu targets Linux users who have a lot of work to do, while quietly nodding at those who like to play games every now and then, too. The 15.6-inch Kudu is the second-priciest offering in System76's laptop lineup. It comes with an octa-core AMD Ryzen 9 5900HX, which has a base clock speed of 3.3 GHz and a boost of up to 4.6 GHz.' -- source: https://arstechnica.com/gadgets/2022/02/system76-linux-laptop-unites-amd-nv… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla is Shutting Down Its VR Web Browser, Firefox Reality
by Peter Reutemann 04 Feb '22

04 Feb '22

'A top VR web browser is closing down. Today, Mozilla announced it's shutting down its Firefox Reality browser -- the four-year-old browser built for use in virtual reality environments. The technology had allowed users to access the web from within their VR headset, doing things like visiting URLs, performing searches, and browsing both the 2D and 3D internet using your VR hand controllers, instead of a mouse. >From a report: Firefox Reality first launched in fall 2018 and has been available on Viveport, Oculus, Pico, and Hololens platforms through their various app stores. While capable of surfing the 2D web, the expectation was that users would largely use the new technology to browse and interact with the web's 3D content, like 360-degree panoramic images and videos, 3D models, and WebVR games, for example. But in an announcement published today, Mozilla says the browser will be removed from the stores where it's been available for download in the "coming weeks." Mozilla is instead directing users who still want to utilize a web browser in VR to Igalia's upcoming open-source browser, Wolvic, which is based on Firefox Reality's source code. This browser will be available for download starting next week, so users won't have to go without -- they'll just have to make the switch.' -- source: https://tech.slashdot.org/story/22/02/03/1653218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slackware, the Oldest Actively Maintained Linux Distro, Releases Version 15.0
by Peter Reutemann 04 Feb '22

04 Feb '22

'Slackware, the oldest actively maintained Linux distribution, released version 15.0 yesterday after a long release cycle that goes all the way back to 2016 where the last version (14.2) was released. According to the release notes, the whole spirit of this release is: "Keep it familiar, but make it modern." Among the news, this release offers kernel 5.15.19, PAM, PipeWire and PulseAudio, Wayland and X11 graphical systems, and Rust and Python 3. As graphical environments, both Xfce 4.16 and the latest Plasma 5 (Plasma 5.23.5, Frameworks 5.90, KDE apps 21.12 running under Qt 5.15.3) are available, with Cinnamon and Mate also available from third parties. The main compilers are gcc-11.2 and llvm 13.0. The default browser is Firefox 91.5esr, with Chromium available as a third-party repository. And... no systemd at all. Slackware can be downloaded from a variety of mirrors. BitTorrent downloads are going to be available too. I've used Slackware for 20 years and it's always impressed me with its stability and speed. I encourage everyone interested to try it.' -- source: https://linux.slashdot.org/story/22/02/04/027213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Says Windows May Need Up To 8 Hours of Online Time To Update
by Peter Reutemann 03 Feb '22

03 Feb '22

'According to a post on the Microsoft IT Pro Blog, Windows computers will need at least eight hours of online time to obtain and install the latest OS updates successfully. Tom's Hardware reports: Another revelation in the post is that Microsoft tracks how long PCs are connected to Windows Update, calling the statistics "Update Connectivity." The data is available to IT managers in the InTune app, a component of the Endpoint management suite. The post details Microsoft's attempts to figure out why some Windows devices aren't getting the latest quality and feature updates, and discovered that two hours of continuous connectivity was required to get updates. It then took six hours after the release of the patch for a machine to update itself reliably. Microsoft's figures show that 50 percent of Windows devices left behind by Windows Update and running a build of Windows 10 that's no longer serviced do not spend enough time connected to have the patches downloaded and installed in the background. This figure drops to 25 percent for customers using a serviced build of the operating system that lags behind in security updates by 60 days or more. The goods news, as noted by Tom's Hardware, is that "Windows 11 updates are smaller than their Windows 10 counterparts due to improved compression [and] new Microsoft Graph APIs," which should help speed up the update process.' -- source: https://tech.slashdot.org/story/22/02/01/2056211 Bloatware? I can download/install full Linux distros in less time (and updates don't take that long either, not even a full version upgrade!). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Insights Into WSL 1.0
by Lawrence D'Oliveiro 03 Feb '22

03 Feb '22

You may remember that Microsoft’s initial attempt at “Windows Services for Linux”, WSL 1.0 (or maybe just plain “WSL”), involved emulating Linux APIs on top of the Windows kernel. This was later scrapped in favour of the current WSL 2.0, which runs an actual Linux kernel, virtualized. Clearly, Microsoft found it problematic trying to keep things compatible with the native Linux kernel, and decided it was simpler to just run the real article. This report <https://www.theregister.com/2022/02/02/oracle_linux_microsoft/> links in passing to an interesting blog post <https://jmmv.dev/2020/11/wsl-lost-potential.html> covering some of the technicalities of how WSL 1.0 was implemented. Windows NT has, or had, the notion of different “environment subsystems” or “personalities” implemented in layers on top of the core kernel; in fact, Win32 is (or was) just one of these “personalities”, with the original POSIX layer being another. That blog post says that WSL1 was implemented as just such a “personality”. And if that had not been scrapped, it would have made some interesting kinds of integration across Windows and Linux processes possible. However, a reader comment to the original article <https://forums.theregister.com/forum/all/2022/02/02/oracle_linux_microsoft/…>, claiming to come from a former “PM” (“Product Manager”?) for WSL, emphatically declares ... WSL is not an NT kernel "personality" and is in no way related to NT's POSIX subsystem. Not even slightly. They are entirely different implementations of different things and share zero architecture and implementation details. This reinforces an impression I’ve had, that much of the modularity of the original Windows NT architecture has decayed away over the years, sacrificed by Microsoft to marketing exigencies. And that includes the whole “environment subsystem” concept. So WSL1 was actually less modular than it might have appeared to begin with, and that would have added to the support headaches.

1 0

64-bit Raspberry Pi OS exits beta, is available for all Pi 3, 4, and Zero 2 boards
by Peter Reutemann 03 Feb '22

03 Feb '22

'The Raspberry Pi hardware has included a 64-bit processor since the Pi 3 launched in early 2016, but the Raspberry Pi OS (formerly known as Raspbian) has remained primarily 32-bit. The Raspberry Pi Foundation has been testing a 64-bit version of the OS since 2020, though, and today the organization announced that the 64-bit version is leaving beta and is now a fully supported OS option on all 64-bit Pi hardware. This includes the Pi 3, Pi 4, Pi Zero 2 W, and all variants thereof.' -- source: https://arstechnica.com/gadgets/2022/02/64-bit-raspberry-pi-os-exits-beta-i… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backblaze Hard Drive Reliability Stats For 2021
by Lawrence D'Oliveiro 02 Feb '22

02 Feb '22

Data-backup company Backblaze has released its annual report on hard-drive reliability for 2021 <https://www.theregister.com/2022/02/01/backblaze_hd_reliability_stats_show/>. Interesting that there is an overall longer-term downward trend in drive failures, though this can fluctuate some. The company is in a good position to compare different brands and models, since they tend to shop around a lot (look at that list). Their whole system is designed to cope with drive failures, and given how many drives they have, they get a lot of failures. So there is plenty of raw data available to analyze, which they make freely available.

1 0

Remembering Windows Vista
by Lawrence D'Oliveiro 02 Feb '22

02 Feb '22

Here is a look back <https://www.theregister.com/2022/02/01/happy_birthday_windows_vista/> at the troubled gestation of Windows Vista. It’s useful as a retrospective, full of links to reports on developments from that time. One of the article links is to this analysis <https://www.theregister.com/2001/08/07/ms_poised_to_switch_windows/> of where Microsoft was supposedly going at the time. (Re)reading that is like peering through a portal into an alien, forgotten world -- one where the company was full of grandiose plans for building an entire OS on Dotnet, making your Exchange mail folders look like a filesystem volume, tying the representation of Office documents to proprietary features of NTFS, and turning the filesystem itself into a database. And one where users and pundits took such plans seriously.

1 0

German Court Fines Company For Linking To Google-Hosted Web Font
by Lawrence D'Oliveiro 01 Feb '22

01 Feb '22

Seems lots of websites link to web fonts hosted by Google. But do they realize this means that users of their sites are sending their IP addresses to Google’s servers? And that not getting the consent of your users to such a thing can land you in legal trouble, at least in the EU? <https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/> I don’t know why people do this anyway -- depending on another site just introduces an additional potential point of failure to your site. Fonts are not that big‡: how great a hardship would it be to copy them to your own site, and link to them there? ‡Had a quick check of my /usr/share/fonts/truetype/noto/ directory, which contains an installation of Google’s entire Unicode-friendly “Noto” font collection; that’s got 2380 entries totalling not quite half a gigabyte.

1 0

A Developer Watching QA Test The Product
by Lawrence D'Oliveiro 01 Feb '22

01 Feb '22

Those with OCD tendencies might want to look away ... <https://www.youtube.com/watch?v=baY3SaIhfl0>

1 0

Fwd: [NZLUG] Fwd: Flounder startup 5th Feb 1PM Melbourne time
by Peter Reutemann 01 Feb '22

01 Feb '22

Apologies for cross-posting, but this event might be of interest to some of you. Cheers, Peter ---------- Forwarded message --------- From: Russell Coker <russell(a)coker.com.au> Date: Sun, Jan 30, 2022 at 10:53 PM Subject: [NZLUG] Fwd: Flounder startup 5th Feb 1PM Melbourne time To: DL Neil <nzlug(a)etelligence.info>, Stephen Dalton <steve(a)refactor.com.au>, NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz>, Mark Foster <blakjak(a)blakjak.net> https://flounder.coker.com.au/2022/01/30/flounder-overview/ The FLOSS Down Under group (Flounder) group is starting next Saturday 1PM Melbourne time (the above page summarises it). https://b.coker.com.au/ The above URL will redirect to the meeting URL, it's deliberately short so if your primary device has an issue you can quickly type it into another device. We haven't entirely decided on the main feature, but thinking of having it be hands on training on BTRFS and ZFS while at the same time discussing new advances (both new technology and older technology that has become cheaper and thus more usable) in storage for FOSS systems. If there's someone who has experience with Optane on Linux who could give a 10+ minute talk about it then please contact me off list. The meetings will include a summary and discussion of new free software that is noteworthy (with input welcome from anyone who thinks we missed something noteworthy). We will also have some mention of recent security issues and other changes to the environment that we operate in. Anyone who wants to contribute to a meeting can contact me in advance to have some time reserved for a lightning talk or a feature talk at a future meeting. Please forward this message to all free software users groups in Australia and NZ. Note that this is not designed to compete with existing LUGs, but to offer something different. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Bug in Early Creative Commons Licenses Has Enabled a New Breed of Superpredator
by Peter Reutemann 01 Feb '22

01 Feb '22

'Here’s a supreme irony: the Creative Commons licenses were invented to enable a culture of legally safe sharing, spurred by the legal terror campaign waged by the entertainment industry, led by a literal criminal predator who is now in prison for sex crimes. But because of a small oversight in old versions of the licenses created 12 years ago, a new generation of legal predator has emerged to wage a new campaign of legal terror. To make matters worse, this new kind of predator specifically targets people who operate in good faith, only using materials that they explicitly have been given permission to use.' -- source: https://doctorow.medium.com/a-bug-in-early-creative-commons-licenses-has-en… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Review: MNT Reform laptop has fully open hardware and software—for better or worse
by Peter Reutemann 01 Feb '22

01 Feb '22

'If you’re a Linux fan or open source advocate looking for a decent laptop, you actually have some solid options right now—much better, at least, than buying a Windows laptop, installing Linux on it, and hoping for the best. Dell has offered Ubuntu editions of some of its XPS laptops and other PCs for years now, and Lenovo sells a respectable collection of desktops and laptops with Linux. System76 sells a selection of Linux-friendly laptops preloaded with Ubuntu or its own Pop!_OS distribution. The repair-friendly Framework Laptop doesn’t ship with Linux, but it can be configured without an OS, and Framework promises robust Linux support from multiple distributions. But those laptops all have something in common with run-of-the-mill Windows PCs: a reliance on closed-source hardware and, often, the proprietary software and drivers needed to make it function. For some people, this is a tolerable trade-off. You put up with the closed hardware because it performs well, and it supports the standard software, development tools, and APIs that keep the computing world spinning. For others, it’s anathema—if you can’t see the source code for these “binary blobs,” they are inherently untrustworthy and should be used sparingly or not at all. The MNT Reform is a laptop for the latter group. It's a crowdfunded, developed-in-the-open, extensively documented device that cares more about being open than it cares about literally any other aspect of the computing experience. Perhaps predictably, this makes for a laptop that is ideologically pure but functionally compromised.' -- source: https://arstechnica.com/gadgets/2022/01/review-mnt-reform-laptop-has-fully-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Is Broken
by Lawrence D'Oliveiro 28 Jan '22

28 Jan '22

github.com is currently returning a server-error page.

2 4

Only 90s Web Developers Remember This
by Lawrence D'Oliveiro 28 Jan '22

28 Jan '22

An only-slightly-tongue-in-cheek expletive-laden rant <https://zachholman.com/posts/only-90s-developers/> about how Web development used to be: the wonders of the 1×1 GIF (“To this day it is the only way to vertically center elements”) and the fun of “ ”, to the coming of JavaScript to create the “Technology of Terror”, DHTML (Dynamic HTML).

1 0

A bug lurking for 12 years gives attackers root on most major Linux distros
by Peter Reutemann 27 Jan '22

27 Jan '22

'Linux users on Tuesday got a major dose of bad news—a 12-year-old vulnerability in a system tool called Polkit gives attackers unfettered root privileges on machines running most major distributions of the open source operating system. Previously called PolicyKit, Polkit manages system-wide privileges in Unix-like OSes. It provides a mechanism for nonprivileged processes to safely interact with privileged processes. It also allows users to execute commands with high privileges by using a component called pkexec, followed by the command.' -- source: https://arstechnica.com/information-technology/2022/01/a-bug-lurking-for-12… I think, I saw an update coming through the other day... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZLUG] Fwd: [Linux-aus] Australia (and hopefully NZ) LUG meetings
by Peter Reutemann 26 Jan '22

26 Jan '22

Apologies for cross-posting, but this may be of interest to some of you. Cheers, Peter -------- Original Message -------- From: Mark Foster <blakjak(a)blakjak.net> Sent: January 26, 2022 9:12:30 PM GMT+13:00 To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz>, russell(a)coker.com.au Subject: [NZLUG] Fwd: [Linux-aus] Australia (and hopefully NZ) LUG meetings There may be some interest in this initiative from the (now largely defunct, it seems) NZLUG mailing list.... Thanks to Russell for offering up this initiative and trying to make it accessible to New Zealanders as well as Australians. I myself am unlikely to be available but am forwarding this to NZLUG in case there's interest here. Cheers Mark (sometime NZLUG admin; there's still a mailing list with some people subscribed to it... so who knows? :)) -------- Forwarded Message -------- Subject: [Linux-aus] Australia (and hopefully NZ) LUG meetings Date: Wed, 26 Jan 2022 17:45:44 +1100 From: Russell Coker via linux-aus <linux-aus(a)lists.linux.org.au> Reply-To: russell(a)coker.com.au To: linux-aus(a)lists.linux.org.au https://etbe.coker.com.au/2022/01/26/australia-nz-linux-meetings/ I'm starting a new group for online meetings with the aim of giving benefits you can't get from watching YouTube etc. Details of how to connect etc will be available shortly. -- My Main Bloghttp://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/ _______________________________________________ linux-aus mailing list linux-aus(a)lists.linux.org.au http://lists.linux.org.au/mailman/listinfo/linux-aus To unsubscribe from this list, send a blank email to linux-aus-unsubscribe(a)lists.linux.org.au -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/.

1 0

Who's Paying to Fix Open Source Software?
by Peter Reutemann 26 Jan '22

26 Jan '22

'The Log4Shell exploit "exposes how a vulnerability in a seemingly simple bit of infrastructure code can threaten the security of banks, tech companies, governments, and pretty much any other kind of organization," writes VentureBeat. But the incident also raises some questions: Should large deep-pocketed companies besides Google, which always seems to be heavily involved in such matters, be doing more to support the cause with people and resources? Long-time Slashdot reader frank_adrian314159 shares a related article from a programming author on Dev.To, who'd read hot takes like "Open source needs to grow the hell up." and "Open source' is broken". [T]he log4j developers had this massive security issue dumped in their laps, with the expectation that they were supposed to fix it. How did that happen? How did a group of smart, hard-working people get roped into a thankless, high-pressure situation with absolutely no upside for themselves...? It is this communal mythology I want to talk about, this great open source brainwashing that makes maintainers feel like they need to go above and beyond publishing source code under an open source license — that they need to manage and grow a community, accept contributions, fix issues, follow vulnerability disclosure best practices, and many other things... In reality what is happening, is that open source maintainers are effectively unpaid outsourcing teams for giant corporations. The log4j exploit was first reported by an engineer at Alibaba — a corporation with a market capitalization of $348 billion — so the article wonders what would happen if log4j's team had sent back a bill for the time they'd spend fixing the bug. Some additional opinions (via the "This Week in Programming" column): * PuTTY maintainer Andrew Ducker: "The internet (and many large companies) are dependent on software maintained by people in their spare time, for free. This may not be sustainable." * Filippo Valsorda, a Go team member at Google: "The role of Open Source maintainer has failed to mature from a hobby into a proper profession... The status quo is unsustainable.... GitHub Sponsors and Patreon are a nice way to show gratitude, but they are an extremely unserious compensation structure." Valsorda hopes to eventually see "a whole career path with an onramp for junior maintainers, including training, like a real profession."' -- source: https://news.slashdot.org/story/21/12/18/2016216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Big Surprise Of The Week: Oracle’s Audit Process Is In Cahoots With Sales
by Lawrence D'Oliveiro 26 Jan '22

26 Jan '22

As part of the licensing terms for certain (most?) Oracle products, you have to agree to be audited by the company, to ensure your usage does not exceed the licences you have bought. Such audits are notorious for regularly telling customers that what they thought was compliance with the licence was nothing of the sort, and that they had better hand over more money to make the problem go away. Oracle’s official position has always been that there is some kind of separation between the operations of the audit department and the sales department, so the auditing process was entirely impartial and under no pressure to increase company revenues. Now some ex-Oracle execs are publicly admitting this is a load of nonsense <https://www.theregister.com/2022/01/25/oracle_audits/>. I don’t think Oracle is unique in this. Lots of big software companies (including Microsoft, I believe) offer similar site-licensing of their products, with similar audit requirements. And likely similar outcomes when an audit actually takes place.

1 0