- wlug - list.wlug.org.nz

SerenityOS: Homage To The 1990s
by Lawrence D'Oliveiro 19 Aug '21

19 Aug '21

Here <https://arstechnica.com/gadgets/2021/08/not-a-linux-distro-review-serenityo…> is a review of SerenityOS, a complete open-source POSIXy OS that does not use any GNU, Linux or BSD code. The review spends a lot of time on the GUI, which is consciously designed around a 1990s aesthetic. As usual, this sort of thing leaves me wondering “you could implement that whole look and feel on top of a Linux kernel, so why make your own?”. Then, further down, we get to this: Some of the paradigm shifts Kling and fellow contributors have introduced are neither weird nor trivial, though. SerenityOS's kernel, for example, exposes its internals as JSON rather than unstructured text. System utilities consuming kernel information therefore have a much simpler time of formatting it for display and/or internal decisions. Aha! Now there is something which could very well have a point. Though the Linux approach is to have the information exposed in these kernel pseudo-files in a simple (not unstructured!) text format that is both easy to parse and also somewhat comprehensible to a human viewer (which is harder to say of JSON). If you want to pass around object streams in a Linux command line, jq <https://github.com/stedolan/jq> is available as a standard Debian package, for doing precisely this sort of manipulation of JSON-formatted data. (Is that someone in Microsoft’s PowerShell group saying “I told you so!” ... ?)

1 0

Google's Fuchsia OS Is Rolling Out Widely To 1st-Gen Nest Hubs
by Peter Reutemann 19 Aug '21

19 Aug '21

'More owners of the first-generation Nest Hub are receiving the update to Google's Fuchsia operating system as it expands beyond the Preview program. 9to5Google reports: Back in May, Google formally released Fuchsia, its effort to develop a "not Linux" operating system from scratch, which has been years in the making. The first device to receive the new OS was Google's 2018 smart display, the Nest Hub -- not to be confused with the second generation Nest Hub with sleep tracking released earlier this year -- taking it permanently off of the existing Linux based "Cast OS" without negatively affecting the UI or experience. At the time, the rollout of Fuchsia was limited to a select few devices that were enrolled in the "Preview program" available to all devices via the Google Home app. Over time, the number of Nest Hubs running Fuchsia was expanded, with Google no doubt watching carefully for any issues with the upgrade. Late last week, Google updated a support page to reflect that the Nest Hub has received a new firmware update for both the Preview program and all other devices. Specifically, the first-gen Nest Hub is now receiving firmware version 1.52.260996. Google confirmed to us that this update does indeed include the upgrade to Fuchsia. All goes well, this means in a matter of days, all first-gen Nest Hub devices in households around the world should be running Fuchsia. ' -- source: https://tech.slashdot.org/story/21/08/18/2056255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firewalls and Middleboxes Can Be Weaponized For Gigantic DDoS Attacks
by Peter Reutemann 18 Aug '21

18 Aug '21

'In an award-winning paper last week, academics said they discovered a way to abuse the TCP protocol, firewalls, and other network middleboxes to launch giant distributed denial of service (DDoS) attacks against any target on the internet. Authored by computer scientists from the University of Maryland and the University of Colorado Boulder, the research is the first of its kind to describe a method to carry out DDoS reflective amplification attacks via the TCP protocol, previously thought to be unusable for such operations. Making matters worse, researchers said the amplification factor for these TCP-based attacks is also far larger than UDP protocols, making TCP protocol abuse one of the most dangerous forms of carrying out a DDoS attack known to date and very likely to be abused in the future.' -- source: https://it.slashdot.org/story/21/08/17/1941202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Glibc Security Fix Created a Nastier Linux Bug
by Peter Reutemann 17 Aug '21

17 Aug '21

'A fix that was made in early June to the GNU C Library (glibc) introduced a new and nastier problem. Steven J. Vaughan-Nichols writes via ZDNet: The first problem wasn't that bad. As Siddhesh Poyarekar, a Red Hat principal software engineer wrote, "In order to mount a minimal attack using this flaw, an attacker needs many pre-requisites to be able to even crash a program using this mq_notify bug." Still, it needed patching and so it was fixed. Alas, the fix contained an even nastier bug. While checking the patch, Nikita Popov, a member of the CloudLinux TuxCare Team, found the problem. It turns out that it is possible to cause a situation where a segmentation fault could be triggered within the library. This can lead to any application using the library crashing. This, of course, would cause a Denial-of-Service (DoS) issue. This problem, unlike the earlier one, would be much easier to trigger. Whoops. Red Hat gives the problem in its Common Vulnerability Scoring System (CVSS) a score of 7.5, which is "high." An attack using it would be easy to build and requires no privileges to be made. In short, it's bad news. Popov himself thinks "every Linux application including interpreters of other languages (python, PHP) is linked with glibc. It's the second important thing after the kernel itself, so the impact is quite high." [...] The good news is both the vulnerability and code fix have been submitted to the glibc development team. It has already been incorporated into upstream glibc. In addition, a new test has been submitted to glibc's automated test suite to pick up this situation and prevent it from happening in the future. The bottom line is sometimes changed in unrelated code paths can lead to behaviors changing elsewhere without the programmer realizing what's going on. This test will catch this situation. The Linux distributors are still working out the best way to deploy the fix. In the meantime, if you want to be extra careful -- and I think you should be -- you should upgrade to the newest stable version of glibc 2.34 or higher. ' -- source: https://it.slashdot.org/story/21/08/16/2131221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian 11 'Bullseye' Released As Stable
by Peter Reutemann 16 Aug '21

16 Aug '21

'"One of the oldest and most renowned distributions of Linux has been released!" âwrites Slashdot reader Washuu2. Phoronix reports it took "just over two years in development." Debian 11 brings many new features as outlined this morning with the big upgrade to Linux 5.10 LTS, exFAT file-system support, control groups v2, yescrypt for password hashing, and a plethora of updated packages. GNOME 3.38, KDE Plasma 5.20, and Xfce 4.16 are among the desktop options for Debian 11. Debian.org adds: Do you want to celebrate the release? We provide some bullseye artwork that you can share or use as base for your own creations. Follow the conversation about bullseye in social media via the #ReleasingDebianBullseye and #Debian11Bullseye hashtags... Around the world, there were even several in-person and online release parties — with a few more upcoming!' -- source: https://linux.slashdot.org/story/21/08/15/171228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting this month
by Peter Reutemann 16 Aug '21

16 Aug '21

Hi everyone At this stage, we don't have any talk(s) lined up for our meeting this month. Anybody feeling like a quick show and tell about some software or project that they've been working on lately? Or another topic that they'd like to discuss? Thanks! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

“Androids”: A History Of The Development Of The Android Operating System
by Lawrence D'Oliveiro 15 Aug '21

15 Aug '21

Chet Haase, one of the Android engineers, has published a book called “Androids”, giving an account of the early development of the mobile OS. A review is here <https://arstechnica.com/gadgets/2021/08/review-androids-is-a-developer-comm…>, and an excerpt is here <https://arstechnica.com/information-technology/2021/08/excerpt-the-history-…>. Before Android the company got acquired by Google, they were shopping themselves around to various groups of venture capitalists. From the beginning, the platform was going to be built on Open Source components like the Linux kernel. So how were they going to make money, if the main part of the platform was being given away for free? The initial answer was to offer paid-for services that would be resold by the carriers. This whole idea went away after the Google acquisition. Interesting to review the state of play at the time Android Inc were pitching their new OS: Symbian had some support from different vendors, but surprisingly (to me, at least), it left the whole UI layer up to the device maker, with no attempt at standardization between vendors. How were you to write portable apps in that situation? No wonder it had limited uptake. Sun were offering Java ME for mobile devices, but again, this was subject to differing, not-quite-compatible “profiles” for different devices, further complicating the headache of writing code to run across those devices. As I understand it, it also ran just a single Java VM on the device which had to be shared across all applications, which made it totally unsuited to a modern multitasking OS. The Hiptop device from Danger, Inc also gets a mention. Not a few people considered it probably the best mobile device to come out up to that point. Not mentioned in the above is that Microsoft acquired Danger. But because its platform was built on Java, which Microsoft had an allergy to, they wasted 18 months of product development time excising the Java dependency, totally losing the window of opportunity for releasing a new device. When the Kin finally came out, it probably held the world record for some product category for the shortest time on the market before being heavily discounted in clearance sales (about a month). One key point is that, when Google acquired Android, they continued to let it run like an independent company, at least for the first few years. This allowed the innovation to continue to flourish ... at least for a while.

1 0

Fwd: [NZLUG] Call for Proposals - Sysadmin Miniconf at Linux.conf.au 2022
by Peter Reutemann 13 Aug '21

13 Aug '21

Apologies for cross-posting, but you might be interested in the call for papers outlined below. Cheers, Peter ---------- Forwarded message --------- From: Simon Lyall <simon(a)darkmere.gen.nz> Date: Thu, Aug 12, 2021 at 11:29 PM Subject: [NZLUG] Call for Proposals - Sysadmin Miniconf at Linux.conf.au 2022 To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> The Call for Proposals is now up for the Sysadmin Miniconf at Linux.conf.au 2022. The Miniconf is on January 14th and the rest of the conference is the 2 days afterwards. All events are online. We are looking for 30 minute long Operations-related talks. We'd particularly love your War Stories about responding to the global pandemic and general work for home, or how you avoided earning war stories. The good news is that all talks accepted to the Miniconf get a free ticket for the whole of the conference! The bad news is that the CFP closes in just over 3 weeks from now on September 5th. So don't delay getting your proposal in. See our long CFP for more details: https://sysadmin.miniconf.org/cfp22.html Then Register and Login the the Conference dashboard to submit a proposal: https://linux.conf.au/dashboard -- Simon Lyall | Very Busy | Web: http://www.simonlyall.com/ "To stay awake all night adds a day to your life" - Stilgar _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Centralization Versus Decentralization On The Internet
by Lawrence D'Oliveiro 12 Aug '21

12 Aug '21

A thoughtful, at times somewhat technical article <https://www.theregister.com/2021/08/11/decentralized_internet/> on the original philosophy of the designers of the Internet that nothing should be centralized, and how that was modified somewhat with the concept of “Software-Defined Networking”, without compromising the robustness of a decentralized underlying framework. The World-Wide Web, on the other hand, is a very different matter: rampant centralization, not just at the level of social-media networks and cloud services, but also at the lower layer of “Content-Delivery Networks” (CDNs) has led to the creation of way too many of what the engineers call SPOFs (“Single Points Of Failure”), where a breakdown in any of these can lead to a complete failure of any number of services that have become crucially dependent on them. Is the pendulum swinging away from centralization now? The author seems to think so; but I suspect the fat profit margins are still driving things in the wrong direction.

1 0

Firefox 91 Pushes Privacy With Stronger New Cookie-clearing Option
by Peter Reutemann 11 Aug '21

11 Aug '21

'WIth the release of Firefox 91 on Tuesday, Mozilla has introduced a bigger hammer for smashing the cookies that websites, advertisers and tracking companies can use to record your online behavior. From a report: The new feature, called enhanced cookie clearing, is designed to block tracking not just from a website, but also from third parties whose code appears on the site. The technology is designed to let you clear cookies for a particular website but also the more aggressive "supercookies" designed to evade lesser privacy protections. The feature is an option if you enable Firefox's strict mode for cookie handling, which partitions website data into separate storage containers. "You can easily recognize and remove all data a website has stored on your computer, without having to worry about leftover data from third parties embedded in that website," Mozilla said in a blog post. ' -- source: https://news.slashdot.org/story/21/08/10/1637219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: DMARC enforced
by Lawrence D'Oliveiro 09 Aug '21

09 Aug '21

On Mon, 9 Aug 2021 13:09:11 +1200, Peter Reutemann via wlug wrote: > "The university will be changing the DMARC action for the domain space > waikato.ac.nz from quarantine to reject on Monday 16th August." Just been looking at the DMARC overview <https://dmarc.org/overview/>, and I think there is some confusion here. What the University is doing is changing the recommended action for other MTAs receiving mail purporting to come _from_ the waikato.ac.nz domain, not the action it takes on receiving mail sent _to_ the waikato.ac.nz domain. In other words, this shouldn’t really make any difference to members of this list. If the systems that pick up their mail do DMARC checks, this shouldn’t matter (assuming the Uni sysadmins haven’t misconfigured anything ;)); if they don’t, it doesn’t matter anyway.

2 1

Re: DMARC enforced
by Lawrence D'Oliveiro 09 Aug '21

09 Aug '21

On Mon, 9 Aug 2021 13:09:11 +1200, Peter Reutemann via wlug wrote: > Just received an email from the IT department: > "The university will be changing the DMARC action for the domain space > waikato.ac.nz from quarantine to reject on Monday 16th August." What was the effect of “quarantine” before? Would it have been causing delays in posts getting through? (Because I don’t think I noticed any on mine.) On a further look, I found the following header line in the echo of my last posting back to myself: spf=pass (google.com: best guess record for domain of ldo(a)geek-central.gen.nz designates 72.249.182.57 as permitted sender) So it seems like Google’s algorithms are smart enough to figure out that my mail is coming from an address associated with that domain.

2 1

Re: DMARC enforced
by David McNab 09 Aug '21

09 Aug '21

And for added 'fun' (as opposed to fun), we just need outside senders' mailservers to quietly drop the resulting NDR messages :P On Mon, 9 Aug 2021 at 13:09, Peter Reutemann via wlug < wlug(a)list.waikato.ac.nz> wrote: > > > > ---------- Forwarded message ---------- > From: Peter Reutemann <fracpete(a)waikato.ac.nz> > To: wlug List <wlug(a)list.waikato.ac.nz> > Cc: > Bcc: > Date: Mon, 9 Aug 2021 13:09:11 +1200 > Subject: [wlug] DMARC enforced > Hi everyone > > Just received an email from the IT department: > "The university will be changing the DMARC action for the domain space > waikato.ac.nz from quarantine to reject on Monday 16th August." > > However, for mailing lists they put some mitigation options in place. > > Please let me know if you encounter any problems posting to the WLUG > list (starting next week). > > Cheers, Peter > -- > Peter Reutemann > Dept. of Computer Science > University of Waikato, NZ > +64 (7) 577-5304 > http://www.cms.waikato.ac.nz/~fracpete/ > http://www.data-mining.co.nz/ > > > > ---------- Forwarded message ---------- > From: Peter Reutemann via wlug <wlug(a)list.waikato.ac.nz> > To: wlug List <wlug(a)list.waikato.ac.nz> > Cc: Peter Reutemann <fracpete(a)waikato.ac.nz> > Bcc: > Date: Mon, 9 Aug 2021 13:09:11 +1200 > Subject: [wlug] DMARC enforced > _______________________________________________ > wlug mailing list -- wlug(a)list.waikato.ac.nz | To unsubscribe send an > email to wlug-leave(a)list.waikato.ac.nz > Unsubscribe: > https://list.waikato.ac.nz/postorius/lists/wlug.list.waikato.ac.nz >

1 0

DMARC enforced
by Peter Reutemann 09 Aug '21

09 Aug '21

Hi everyone Just received an email from the IT department: "The university will be changing the DMARC action for the domain space waikato.ac.nz from quarantine to reject on Monday 16th August." However, for mailing lists they put some mitigation options in place. Please let me know if you encounter any problems posting to the WLUG list (starting next week). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Trace Toolkit Next Generation 2.13 Facilitates Quick Reaction To Kernel/User-space Instrumentation Hits
by Peter Reutemann 09 Aug '21

09 Aug '21

'LTTng has been called "the killer app for system-level debugging and performance tuning." And now long-time Slashdot reader compudj writes: It's the official release of LTTng 2.13 — Nordicité! LTTng is a kernel and user-space tracer for Linux. The most notable features of this release are: - Event-rule matches condition triggers and new actions, allowing internal actions or external monitoring applications to quickly react when kernel or user-space instrumentation is hit - Notification payload capture, allowing external monitoring applications to read elements of the instrumentation payload when instrumentation is hit. - Instrumentation API: vtracef and vtracelog (LTTng-UST) - User space time namespace context (LTTng-UST and LTTng-modules).' -- source: https://linux.slashdot.org/story/21/08/07/182213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Fiercely Guards The Privacy Of Its Advertisers
by Lawrence D'Oliveiro 07 Aug '21

07 Aug '21

Facebook has shut down all accounts and access for New York University’s Ad Observatory project <https://www.theregister.com/2021/08/04/facebook_research_lockdown/>. This project was using a browser extension to garner information about ads shown to Facebook users without the cooperation of Facebook itself. However, the project <https://adobservatory.org/> tries to be fully transparent about what it is doing to volunteers who choose to install the extension, and as is common these days, the source code is available on GitHub. Part of Facebook’s excuse is that the extension is somehow scraping information from the website that is “not publicly viewable”. How such information is getting to the user’s browser is not explained. Facebook has its own alternative research platform, called “FORT”, that it makes available to selected researchers on a strictly controlled basis. One of the conditions is that Facebook is given pre-publication access to research papers in order to identify--and remove--information that it considers to be “confidential”. Naturally, this kind of thing rings alarm bells for researchers. Another group has published an open letter <https://freedom-to-tinker.com/2021/08/05/facebooks-illusory-promise-of-tran…> pointing out why this is not an acceptable alternative.

1 1

Firefox Lost Almost 50 Million Users In 3 Years
by Peter Reutemann 05 Aug '21

05 Aug '21

'A report from It's FOSS, written by Ankush Das: Mozilla's Firefox is the only popular alternative to Chromium-based browsers. It has been the default choice for Linux users and privacy-conscious users across every platform. However, even with all benefits as one of the best web browsers around, it is losing its grip for the past few years. I came across a Reddit thread by u/nixcraft, which highlighted more details on the decline in the userbase of Firefox since 2018. And surprisingly, the original source for this information is Firefox's Public Data Report. As per the official stats, the reported number of active (monthly) users was about 244 million at the end of 2018. And, it seems to have declined to 198 million at the end of Q2 2021. So, that makes it a whopping ~46 million decline in the userbase. Considering 2021 is the year when privacy-focused tools saw a big boost in their userbase, Mozilla's Firefox is looking at a constant decline. Especially when Firefox manages to introduce some industry-first privacy practices. Quite the irony, eh? Just for fun, here's a timeline of our stories reporting on Firefox's download milestones from the mid-2000s: September 19, 2004: 1 Million Firefoxes in 4 Days December 12, 2004: Firefox Reaches 10 Million Downloads February 17, 2005: Firefox Breaks 25 Million Downloads April 26, 2005: Firefox nears 50 Million Downloads July 29, 2005: Firefox Downloads Reach 75 Million October 19, 2005: Firefox Tops 100 Million Downloads September 11, 2007: Firefox Hits 400 Million Downloads July 3, 2008: Firefox Breaks 8 Million, Gets Into Guinness' -- source: https://news.slashdot.org/story/21/08/04/2137205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome To No Longer Show Secure Website Indicators
by Peter Reutemann 04 Aug '21

04 Aug '21

'Google Chrome will no longer show whether a site you are visiting is secure and only show when you visit an insecure website. Bleeping Computer reports: To further push web developers into only using HTTPS on their sites, Google introduced the protocol as a ranking factor. Those not hosting a secure site got a potentially minor hit in their Google search results rankings. It has appeared to have worked as according to the 'HTTPS encryption on the web' of Google's Transparency Report, over 90% of all browser connections in Google Chrome currently use an HTTPS connection. Currently, when you visit a secure site, Google Chrome will display a little locked icon indicating that your communication with the site is encrypted, as shown below. As most website communication is now secure, Google is testing a new feature that removes the lock icon for secure sites. This feature is available to test in Chrome 93 Beta, and Chrome 94 Canary builds by enabling the 'Omnibox Updated connection security indicators' flag. With this feature enabled, Google Chrome will only display security indicators when the site is not secure. For businesses who wish to have continued HTTPS security indicators, Google has added an enterprise policy for Chrome 93 named 'LockIconInAddressBarEnabled' that can be used to enable the lock icon again on the address bar. ' -- source: https://tech.slashdot.org/story/21/08/03/2049218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Will Kill Off Very Old Versions of Android Next Month
by Peter Reutemann 04 Aug '21

04 Aug '21

'Ars Technica: Google has started emailing users of very old Android devices to tell them it's time to say goodbye. Starting September 27, devices running Android 2.3.7 and lower will no longer be able to log in to Google services, effectively killing a big portion of the on-rails Android experience. As Google puts it in an official community post, "If you sign in to your device after September 27, you may get username or password errors when you try to use Google products and services like Gmail, YouTube, and Maps." Android is one of the most cloud-based operating systems ever. Especially in older versions, many included apps and services were tied to your Google login, and if that stops working, a large chunk of your phone is bricked. While Android can update many core components without shipping a full system update today, Android 2.3.7 Gingerbread, released around 10 years ago, was not so modular. The individual Google apps started to be updatable through the Android Market/Play Store, but signing in to Google was still a system-level service and is frozen in time. Any Google services wanting to allow sign-ins from those versions would have to conform to 2011-era security standards, which means turning off two-factor authentication and enabling a special "allow less-secure access" setting in your Google account. Really, these old Android versions have to die eventually because they're just too insecure. Google shows active user base breakdowns for Android versions in Android Studio, and Gingerbread has such a low device count that it doesn't even make the list. It's less than 0.2 percent of active devices, behind 14 other versions of Android. Users of these old devices could still sideload a third-party app store and find replacements for all the Google apps, but if you're a technical user and can't get a new device, there's a good chance you could load a whole new operating system with an aftermarket Android ROM. After September 27, the oldest version of Android you'll be able to sign in to is Android 3.0 Honeycomb, which is only for tablets.' -- source: https://tech.slashdot.org/story/21/08/03/207222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD and Valve Working On New Linux CPU Performance Scaling Design
by Peter Reutemann 03 Aug '21

03 Aug '21

'Along with other optimizations to benefit the Steam Deck, AMD and Valve have been jointly working on CPU frequency/power scaling improvements to enhance the Steam Play gaming experience on modern AMD platforms running Linux. Phoronix reports: It's no secret that the ACPI CPUFreq driver code has at times been less than ideal on recent AMD processors with delivering less than expected performance/behavior with being slow to ramp up to a higher performance state or otherwise coming up short of disabling the power management functionality outright. AMD hasn't traditionally worked on the Linux CPU frequency scaling code as much as Intel does to their P-State scaling driver and other areas of power management at large. AMD is ramping up efforts in these areas including around the Linux scheduler given their recent hiring spree while it now looks like thanks to the Steam Deck there is renewed interest in better optimizing the CPU frequency scaling under Linux. AMD and Valve have been working to improve the performance/power efficiency for modern AMD platforms running on Steam Play (Proton / Wine) and have spearheaded "[The ACPI CPUFreq driver] was not very performance/power efficiency for modern AMD platforms...a new CPU performance scaling design for AMD platform which has better performance per watt scaling on such as 3D game like Horizon Zero Dawn with VKD3D-Proton on Steam." AMD will be presenting more about this effort next month at XDC. It's quite possible this new effort is focused on ACPI CPPC support with the previously proposed AMD_CPUFreq. Back when Zen 2 launched in 2019, AMD did post patches for their new CPUFreq driver that leveraged ACPI Collaborative Processor Performance Controls but the driver was never mainlined nor any further iterations of the patches posted. When inquiring about that work a few times since then, AMD has always said it's been basically due to resource constraints that it wasn't a focus at that time. Upstream kernel developers also voiced their preference to seeing AMD work to improve the generic ACPI CPPC CPUFreq driver code rather than having another vendor-specific solution. It's also possible AMD has been working on better improvements around the now-default Schedutil governor for scheduler utilization data in making CPU frequency scaling decisions. ' -- source: https://hardware.slashdot.org/story/21/08/02/2018218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Mars Helicopter Contributors
by Lawrence D'Oliveiro 03 Aug '21

03 Aug '21

I was looking at some code on GitHub, and I came across a badge I hadn’t seen before on a developer’s account. It turns out it means some of their code was used on NASA’s Mars Ingenuity helicopter <https://github.com/readme/featured/nasa-ingenuity-helicopter>.

1 0

Security Versus Requirements For Internationalization
by Lawrence D'Oliveiro 01 Aug '21

01 Aug '21

Yet another incident <https://arstechnica.com/gadgets/2021/07/with-help-from-google-impersonated-…> of substituting characters with different diacritic marks in a domain name to fool people into visiting the wrong site. Seems this problem is fundamentally unfixable. We need the ability to represent words in non-English languages, simply because the world does not revolve around the English language. And differences in meanings of words just from mixing up those diacritics can sometimes be quite major.

1 0

New Android Malware Records Smartphones via VNC To Steal Passwords
by Peter Reutemann 30 Jul '21

30 Jul '21

'Security researchers have discovered a novel piece of Android malware that uses the VNC technology to record and broadcast a victim's smartphone activity, allowing threat actors to collect keyboard presses and app passwords. From a report: First spotted in March 2021 by Dutch security firm ThreatFabric, this new piece of malware, named Vultur, is a departure from other Android malware strains that usually rely on fake login screens floating on top of legitimate apps to collect a victim's credentials. Instead, Vultur opens a VNC server on the infected phone, and broadcasts screen captures to an attacker command and control server, where the Vultur operator extracts passwords for desired apps.' -- source: https://it.slashdot.org/story/21/07/29/1549220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Warnings That Work: Combating Misinformation Without Deplatforming
by Lawrence D'Oliveiro 29 Jul '21

29 Jul '21

How do you flag misleading postings on Facebook and elsewhere about vaccination, Covid-19 and other issues? Currently these platforms add a little warning next to the posting. Evidence accumulated over many years has shown that such “contextual” warnings are mostly disregarded. What does work is “interstitial” warnings: something that interrupts the user, and forces them to make a choice to continue. This works for security issues on PCs and when browsing the Internet; it can work for postings on social media, too. This article <https://freedom-to-tinker.com/2021/07/26/warnings-that-work-combating-misin…> goes into more details.

1 0

New On Bitsavers This/Last Week
by Lawrence D'Oliveiro 28 Jul '21

28 Jul '21

Among the recent additions to the Bitsavers retrocomputing archive is a scan of the Mt Xinu 1993 calendar <http://bitsavers.trailing-edge.com/pdf/mtXinu/1993_MT_XINU_Calendar.pdf>. On the flip side of each month’s page is a collection of clippings from some interestingly mythical magazines and newspapers. For example, a purported article on “How to eat a meal near a keyboard -- Safely!” hints at an implement that is both “a mouse AND a scrub-brush!”. The cover of a magazine targeted at “computer professionals” touts a report on “Strategic partnerships: What CEOs should know about space aliens” as well as “DOS removers, do they do what they claim?” And then there’s the ad for improving the productivity of your staff with a department-wide installation of a product called ... UrethraNet ...

1 0