- wlug - list.wlug.org.nz

Openwall Releases 'Linux Kernel Runtime Guard' 0.9.0
by Peter Reutemann 19 Apr '21

19 Apr '21

'Long-time Slashdot reader xiando shares news from LinuxReviews: Linux Kernel Runtime Guard (LKRG) is a security module for the Linux kernel developed by Openwall. The latest release adds compatibility with Linux kernels up to soon to be released 5.12, support for building LKRG into kernel images, support for old 32-bit x86 machines and more... The Linux Kernel Runtime Guard is an out-of-tree kernel module you can install as a kernel module, or, with the 0.9.0 release, build into your Linux kernel. It does run-time integrity checks to detect security vulnerability exploits against the Linux kernel. An Openwall developer also notes in the announcement that "During LKRG development and testing I've found 7 Linux kernel bugs, 4 of them have CVE numbers."' -- source: https://news.slashdot.org/story/21/04/17/2118236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian Votes to Issue No Statement on Stallman's Return to the FSF Board
by Peter Reutemann 19 Apr '21

19 Apr '21

'Debian Project Secretary Kurt Roeckx has announced the results of a closely-watched vote on what statement would be made about Richard Stallman's readmission to the Free Software Foundation's board. Seven options were considered, with the Debian project's 420 voting developers also asked to rank their preferred outcomes: - Option 1: "Call for the FSF board removal, as in rms-open-letter.github.io" - Option 2: "Call for Stallman's resignation from all FSF bodies" - Option 3: "Discourage collaboration with the FSF while Stallman is in a leading position" - Option 4: "Call on the FSF to further its governance processes" - Option 5: "Support Stallman's reinstatement, as in rms-support-letter.github.io" - Option 6: "Denounce the witch-hunt against RMS and the FSF" - Option 7: "Debian will not issue a public statement on this issue" While all seven options achieved a quorum of votes, two failed to achieve a majority — options 5 and 6. ("Support Stallman's reinstatement" and "Denounce the witch-hunt...") The option receiving the most votes was #7 (not issuing a public statement) — but it wasn't that simple. The vote's final outcome was determined by comparing every possible pair of options to determine which option would still be preferred by a majority of voters in each possible comparision. In this case, that winner was still the option which had also received the most votes: Debian will not issue a public statement on this issue. The Debian Project will not issue a public statement on whether Richard Stallman should be removed from leadership positions or not. Any individual (including Debian members) wishing to (co-)sign any of the open letters on this subject is invited to do this in a personal capacity. The results are captured in an elaborate graph. Numbers inside the ovals show the final ratio of yes to no votes (so a number higher than 1.00 indicates a majority, with much higher numbers indicating much larger majorities). Numbers outside the ovals (along the lines) indicate the number of voters who'd preferred the winning choice over the losing choice (toward which the arrow is pointing). The winning option is highlighted in blue.' -- source: https://linux.slashdot.org/story/21/04/18/1727209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Says Rust Closer for Linux Kernel Development, Calls C++ 'A Crap Language'
by Peter Reutemann 18 Apr '21

18 Apr '21

'Google's Android team supports Rust for developing the Android operating system. Now they're also helping evaluate Rust for Linux kernel development. Their hopes, among other things, are that "New code written in Rust has a reduced risk of memory safety bugs, data races and logic bugs overall," that "abstractions that are easier to reason about," and "More people get involved overall in developing the kernel, thanks to the usage of a modern language." Linus Torvalds responded in a new interview with IT Wire (shared by Slashdot reader juul_advocate): The first patches for Rust support in the Linux kernel have been posted and the man behind the kernel says the fact that these are being discussed is much more important than a long post by Google about the language. Linus Torvalds told iTWire in response to queries that Rust support was "not there yet", adding that things were "getting to the point where maybe it might be mergeable for 5.14 or something like that..." Torvalds said that it was still early days for Rust support, "but at least it's in a 'this kind of works, there's an example, we can build on it'." Asked about a suggestion by a commenter on the Linux Weekly News website, who said, during a discussion on the Google post, "The solution here is simple: just use C++ instead of Rust", Torvalds could not restrain himself from chortling. "LOL," was his response. "C++ solves _none_ of the C issues, and only makes things worse. It really is a crap language. "For people who don't like C, go to a language that actually offers you something worthwhile. Like languages with memory safety and [which] can avoid some of the dangers of C, or languages that have internal GC [garbage collection] support and make memory management easier. C++ solves all the wrong problems, and anybody who says 'rewrite the kernel in C++' is too ignorant to even know that." He said that when one spoke of the dangers of C, one was also speaking about part of what made C so powerful, "and allows you to implement all those low-level things efficiently". Torvalds added that, while garbage collection is "a very good thing in most other situations," it's "generally not necessarily something you can do in a low-level system programming."' -- source: https://developers.slashdot.org/story/21/04/17/009241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Happy 50th Birthday FTP
by Peter Reutemann 18 Apr '21

18 Apr '21

'FTP (file transfer protocol) celebrated its 50th anniversary this week. Long-time Slashdot reader sandbagger shares an article commemorating a half-century of FTP: Over the years, the FTP protocol got refined with 16 different revisions(*1) adding support with TCP/IP, a secure extension also known as FTPS which is leveraging the same tech as HTTPS and more recent addition like IPv6 support. Fifty years after its inception, FTP is still going very strong with millions of FTP server still being exposed on the internet which is fairly amazing considering the bad press it gets... ' -- source: https://tech.slashdot.org/story/21/04/17/2143200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slackware Approaches 28th Birthday With New Beta Release
by Peter Reutemann 18 Apr '21

18 Apr '21

'Slashdot reader LeeLynx shares news from The Register about a Slackware 15 beta release (following the debut of February's alpha), "nearly five years after the distribution last saw a major update." (And nearly 28 years after its initial release back in 1993...) Created by Patrick Volkerding (who still lays claim to the title Benevolent Dictator For Life), the current release version arrived in the form of 2016's 14.2... The Linux kernel has been updated to 5.10.30 (at time of writing) with 5.11.14 available for testing. Desktop fans may be pleased to see, among the many updates, KDE Plasma hitting 5.21.4 as well as updates for old faithfuls, such as Mozilla Firefox and Thunderbird. The beta itself dropped on 12 April (with the 5.10.29 kernel) and Volkerding noted: "I'm going to go ahead and call this a beta even though there's still no fix for the illegal instruction issue with 32-bit mariadb. But there should be soon." Tinkering has continued since, judging by the change log, although the beta tag brings hope there will be a release before long.' -- source: https://linux.slashdot.org/story/21/04/18/007214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

China and Huawei's Dystopian 'New IP' Plan for 6G
by Peter Reutemann 18 Apr '21

18 Apr '21

'Just Security: Huawei's plans for 6G and beyond make U.S. concerns over 5G look paltry: Huawei is proposing a fundamental internet redesign, which it calls "New IP," designed to build "intrinsic security" into the web. Intrinsic security means that individuals must register to use the internet, and authorities can shut off an individual user's internet access at any time. In short, Huawei is looking to integrate China's "social credit," surveillance, and censorship regimes into the internet's architecture... To avoid scrutiny of New IP's shortcomings, Huawei has circumvented international standards bodies where experts might challenge the technical shortcomings of the proposal. Instead, Huawei has worked through the United Nations' International Telecommunications Union (ITU), where Beijing holds more political sway... Huawei dominance on New IP and 6G would not only create a less free, less interoperable internet, it would pave the way for authoritarian governments to gain expanded say over future changes to the internet for years to come.' -- source: https://tech.slashdot.org/story/21/04/17/2041239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 16 Apr '21

16 Apr '21

Hi everyone Due to ANZAC day being observed on Monday 26th, our next WLUG meeting is a week early on the 19th (ie next week!): 'Home automation (aka smart home) is now widely available through a range of consumer products. But often, these devices are only accessible through closed-source apps and also tend to "phone home". Let's have a look, together with Peter Reutemann, at Home Assistant (https://www.home-assistant.io/) an open-source home automation framework that puts local control and privacy first.' -- source: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861049/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FreeBSD 13 Released
by Peter Reutemann 16 Apr '21

16 Apr '21

'"FreeBSD, the other Linux, reached version 13," writes long-time Slashdot reader undoman. "The operating system is known for its stable code, native ZFS support, and use of the more liberal BSD licenses." Phoronix highlights some of the major new improvements: FreeBSD 13.0 delivers on performance improvements (particularly for Intel CPUs we've seen in benchmarks thanks to hardware P-States), upgrading to LLVM Clang 11 as the default compiler toolchain, POWER 64-bit support improvements, a wide variety of networking improvements, 64-bit ARM (AArch64) now being a tier-one architecture alongside x86_64, EFI boot improvements, AES-NI is now included by default for generic kernel builds, the default CPU support for i386 is bumped to i686 from i486, and a variety of other hardware support improvements. Various obsolete GNU tools have been removed like an old version of GNU Debugger used for crashinfo, obsolete GCC 4.2.1 and Binutils 2.17 were dropped from the main tree, and also switching to a BSD version of grep. ' -- source: https://tech.slashdot.org/story/21/04/15/2034216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

EFF Partners With DuckDuckGo
by Peter Reutemann 16 Apr '21

16 Apr '21

'The Electronic Frontier Foundation (EFF) today announced it has enhanced its groundbreaking HTTPS Everywhere browser extension by incorporating rulesets from DuckDuckGo Smarter Encryption. According to the digital rights group's press release, HTTPS Everywhere is "a collaboration with The Tor Project and a key component of EFF's effort to encrypt the web and make the Internet ecosystem safe for users and website owners." From the press release: "DuckDuckGo Smarter Encryption has a list of millions of HTTPS-encrypted websites, generated by continually crawling the web instead of through crowdsourcing, which will give HTTPS Everywhere users more coverage for secure browsing," said Alexis Hancock, EFF Director of Engineering and manager of HTTPS Everywhere and Certbot web encrypting projects. "We're thrilled to be partnering with DuckDuckGo as we see HTTPS become the default protocol on the net and contemplate HTTPS Everywhere's future." EFF began building and maintaining a crowd-sourced list of encrypted HTTPS versions of websites for a free browser extension -- HTTPS Everywhere -- which automatically takes users to them. That keeps users' web searching, pages visited, and other private information encrypted and safe from trackers and data thieves that try to intercept and steal personal information in transit from their browser. [...] DuckDuckGo, a privacy-focused search engine, also joined the effort with Smarter Encryption to help users browse securely by detecting unencrypted, non-secure HTTP connections to websites and automatically upgrading them to encrypted connections. With more domain coverage in Smarter Encryption, HTTPS Everywhere users are provided even more protection. HTTPS Everywhere rulesets will continue to be hosted through this year, giving our partners who use them time to adjust. We will stop taking new requests for domains to be added at the end of May. ' -- source: https://yro.slashdot.org/story/21/04/15/2047229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Inspur, China's Largest Cloud Hardware Vendor, Joins Open-Source Patent Consortium
by Peter Reutemann 14 Apr '21

14 Apr '21

'ZDNet: The Open Invention Network (OIN) defends the intellectual property (IP) rights of Linux and open-source software developers from patent trolls and the like. This is a global fight and now the OIN has a new, powerful allied member in China: Inspur. Inspur is a leading worldwide provider and China's leading data center infrastructure, cloud computing, and artificial intelligence (AI) server providers. While not a household name like Lenovo, Inspur ranks among the world's top-three server manufacturers. Inspur is only the latest of many companies to join the OIN. Besides such primarily hardware-oriented companies as Inspur, Baidu, China's largest search engine company, and global banks such as Barclays and the TD Bank Group, have joined the OIN. In 2021, companies far removed from traditional Linux companies such as Canonical, Red Hat, and SUSE all recognize Linux and OSS's importance. Donny Zhang, VP of Inspur information, said, "Linux and open source are critical elements in technologies which we are developing and provisioning. By joining the Open Invention Network, we are demonstrating our continued commitment to innovation, and supporting it with patent non-aggression in core Linux and adjacent open-source software." "Linux is rewriting what is possible in infrastructure computing," says OIN CEO Keith Bergelt. "OSS-based cloud computing and on-premise data centers are driving down the cost-per-compute while significantly increasing businesses' ability to provision AI and machine-learning (ML) capabilities. We appreciate Inspur's participation in joining OIN and demonstrating its commitment to innovation and patent non-aggression in open source."' -- source: https://news.slashdot.org/story/21/04/13/2058235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NAME:WRECK Vulnerabilities Impact Millions of Smart and Industrial Devices
by Peter Reutemann 14 Apr '21

14 Apr '21

'Catalin Cimpanu, reporting at Record: Security researchers have found a new set of vulnerabilities that impact hundreds of millions of servers, smart devices, and industrial equipment. Called NAME:WRECK, the vulnerabilities have been discovered by enterprise IoT security firm Forescout as part of its internal research program named Project Memoria -- which the company describes as "an initiative that aims at providing the cybersecurity community with the largest study on the security of TCP/IP stacks." Although never visible to end-users, TCP/IP stacks are libraries that vendors add to their firmware to support internet connectivity and other networking functions for their devices. These libraries are very small but, in most cases, underpin the most basic functions of a device, and any vulnerability here exposes users to remote attacks. The NAME:WRECK research is the fifth set of vulnerabilities impacting TCP/IP libraries that have been disclosed over the past three years, and the third set disclosed part of Project Memoria.' -- source: https://it.slashdot.org/story/21/04/13/1849248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

There's Another Facebook Phone Number Database Online
by Peter Reutemann 14 Apr '21

14 Apr '21

'An online tool lets customers pay to unmask the phone numbers of Facebook users that liked a specific Page, and the underlying dataset appears to be separate from the 500 million account database that made headlines last week, signifying another data breach or large scale scraping of Facebook users' data, Motherboard reports. From the report: Motherboard verified the tool, which comes in the form of a bot on the social network and messaging platform Telegram, outputs accurate phone numbers of Facebook users that aren't included in the dataset of 500 million users. The data also appears to be different to another Telegram bot outputting Facebook phone numbers that Motherboard first reported on in January. "Hello, can you tell me how you got my number?" one person included in the dataset asked Motherboard when reached for comment. "Omg, this is insane," they added. Another person returned Motherboard's call and, after confirming their name, said "If you have my number then yes it seems the data is accurate." A description for the bot reads "The bot give [sic] out the phone numbers of users who have liked the Facebook page." To use the bot, customers need to first identify the unique identification code of the Facebook Page they want to get phone numbers from, be that a band, restaurant, or any other sort of Page. This is possible with at least one free to use website. From there, customers enter that code into the bot, which provides a cost of the data in U.S. dollars and the option to proceed with the purchase, according to Motherboard's tests. A Page with tens of thousands of likes from Facebook users can cost a few hundred dollars, the bot shows. The data for Motherboard's own Page would return 134,803 results and cost $539, for example.' -- source: https://tech.slashdot.org/story/21/04/13/1953232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nvidia To Make CPUs, Going After Intel
by Peter Reutemann 13 Apr '21

13 Apr '21

'Nvidia said it's offering the company's first server microprocessors, extending a push into Intel's most lucrative market with a chip aimed at handling the most complicated computing work. Intel shares fell more than 2% on the news. From a report: The graphics chipmaker has designed a central processing unit, or CPU, based on technology from Arm, a company it's trying to acquire from Japan's SoftBank Group. The Swiss National Supercomputing Centre and U.S. Department of Energy's Los Alamos National Laboratory will be the first to use the chips in their computers, Nvidia said Monday at an online event. Nvidia has focused mainly on graphics processing units, or GPUs, which are used to power video games and data-heavy computing tasks in data centers. CPUs, by contrast, are a type of chip that's more of a generalist and can do basic tasks like running operating systems. Expanding into this product category opens up more revenue opportunities for Nvidia. Founder and Chief Executive Officer Jensen Huang has made Nvidia the most valuable U.S. chipmaker by delivering on his promise to give graphics chips a major role in the explosion in cloud computing. Data center revenue contributes about 40% of the company's sales, up from less than 7% just five years ago. Intel still has more than 90% of the market in server processors, which can sell for more than $10,000 each. The CPU, named Grace after the late pioneering computer scientist Grace Hopper, is designed to work closely with Nvidia graphics chips to better handle new computing problems that will come with a trillion parameters. Systems working with the new chip will be 10 times faster than those currently using a combination of Nvidia graphics chips and Intel CPUs. The new product will be available at the beginning of 2023, Nvidia said.' -- source: https://hardware.slashdot.org/story/21/04/12/1639237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The FSF Doubles Down On Restoring RMS After His Non-Apology Apology
by Peter Reutemann 13 Apr '21

13 Apr '21

'In late March, the Free Software Foundation (FSF) readmitted its founder Richard M. Stallman (RMS) to its board, catching everyone by surprise. Now, weeks later, RMS "offers a defensive non-apology apology for the words and actions that led to his resignation from the FSF," writes Steven J. Vaughan-Nichols via ZDNet. Slashdot reader destinyland shares an excerpt of his statement from the Free Software Foundation's official website: Looking back over his life starting as a teenager, Stallman writes: "I realized that I didn't understand the subtle cues that other people were responding to. Later in life, I discovered that some people had negative reactions to my behavior, which I did not even know about. Tending to be direct and honest with my thoughts, I sometimes made others uncomfortable or even offended them -- especially women. This was not a choice: I didn't understand the problem enough to know which choices there were." "Sometimes I lost my temper because I didn't have the social skills to avoid it," Stallman adds. "Some people could cope with this; others were hurt. I apologize to each of them. Please direct your criticism at me, not at the Free Software Foundation. Occasionally I learned something about relationships and social skills, so over the years I've found ways to get better at these situations. When people help me understand an aspect of what went wrong, and that shows me a way of treating people better, I teach myself to recognize when I should act that way. I keep making this effort, and over time, I improve. Some have described me as being 'tone-deaf,' and that is fair. With my difficulty in understanding social cues, that tends to happen." This is just an excerpt. But through eight short paragraphs, Stallman seems to want to offer up a larger context for his badly-received defense of Professor Minsky on an MIT mailing list. (And Stallman adds later that "I condemn racism and sexism, including their systemic forms, so when people say I don't, that hurts too...") "I've learned something from this about how to be kind to people who have been hurt," writes Stallman. "In the future, that will help me be kind to people in other situations, which is what I hope to do." "RMS did not, however, address the many other issues which caused people to regret his return to a position of leadership," writes Vaughan-Nichols. Soon after the RMS post appeared on the FSF's front page, the board spoke on why they'd brought him back. The unsigned document states: The voting members of the Free Software Foundation, which include the board of directors, voted to appoint Richard Stallman to a board seat after several months of thorough discussion and thoughtful deliberation. We decided to bring RMS back because we missed his wisdom. His historical, legal and technical acumen on free software is unrivaled. He has a deep sensitivity to the ways that technologies can contribute to both the enhancement and the diminution of basic human rights. His global network of connections is invaluable. He remains the most articulate philosopher and an unquestionably dedicated advocate of freedom in computing. RMS acknowledges that he has made mistakes. He has sincere regrets, especially at how anger toward him personally has negatively impacted the reputation and mission of FSF. While his personal style remains troubling for some, a majority of the board feel his behavior has moderated and believe that his thinking strengthens the work of the FSF in pursuit of its mission. We take full responsibility for how badly we handled the news of his election to a board seat. We had planned a flow of information that was not executed in a timely manner or delivered in the proper sequence. [...]' -- source: https://news.slashdot.org/story/21/04/12/2039234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Git.PHP.net Not Compromised in Supply Chain Attack, but User Database Leak Possible
by Peter Reutemann 12 Apr '21

12 Apr '21

'Inside.com's developer newsletter reports: The PHP team no longer believes the git.php.net server was compromised in a recent attack, which prompted PHP to move servers to GitHub and caused the team to temporarily put releases on hold until mid-April... In an update offering further insight into the root cause of the late March attack, the team says because it's possible the master.php.net user database was exposed, master.php.net has been moved to main.php.net. The team also reset php.net passwords, and you can visit https://main.php.net/forgot.php to set a new password. In addition, git.php.net and svn.php.net are both read-only now. Two malicious commits were pushed to the php-src repo from PHP founder Rasmus Lerdorf and PHP core developer Nikita Popov, Popov announced March 28. After an investigation, the PHP team reassured users these malicious commits never reached end-users. However, the team decided to move to GitHub after determining maintaining its own git infrastructure is "an unnecessary security risk." "In 2019, the PHP team temporarily shut down its Git server after discovering that an attacker had maliciously replaced the official PHP Extension and Application Repository with a malicious one," reports CPO magazine. But this newer supply chain attack "targeted any server that uses PHP ZLib compression when sending data. Most servers use this functionality on almost all content except images and archives that are already size optimized." The supply chain attack would have turned PHP into a remote web shell through which the attackers could execute any command without authentication. This is because the malicious attackers would have the same privileges as the web server running PHP. The backdoor is triggered at the start of a request by checking if the request contains the word "zerodium." If this condition was met, PHP executes the code in the "User-Agentt" request header. The header closely resembles the PHP "User-Agent" request for checking for browser properties. The rest of the request would thus be treated as a command that could be executed on a PHP server using the server's privileges. This would allow the hackers to run any arbitrary command without the need for further privileges... PHP powers 80% of all websites. Thus, a successful supply chain attack exploiting the language could prove catastrophic.' -- source: https://developers.slashdot.org/story/21/04/11/022247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Reactions to Arch Linux's New Guided Installer
by Peter Reutemann 12 Apr '21

12 Apr '21

'Long-time Slashdot reader xiando quotes LinuxReviews: The community distribution Arch Linux has up to now required you to manually install it by entering a whole lot of scary commands in a terminal. Arch version 2021.04.01 features a new guided installer [reached by] typing python -m archinstall guided into the console you get when you boot the Arch Linux installation ISO. It is not very novice-friendly, or user-friendly, but it gets the job done and it will work fine for those with some basic GNU/Linux knowledge. Tech Radar writes that previously Arch Linux had "a rather convoluted installation process, which has given rise to a stream of Arch-based distros that are easier to install," adding that the new installer "was reportedly promoted as an official installation mechanism back in January, and was actively worked upon leading to its inclusion in the installation medium." Users have been calling on Arch Linux for simplifying the installation process for a long time, to bring it in line with other Linux distros. However, the Arch philosophy has always been to put the users in charge of every aspect of their installation, which is the antithesis of automated installers. Phoronix calls the new installer "very quick and easy," although "granted not as user-friendly / polished as say the Debian Installer, Red Hat's Anaconda installer, even Ubuntu's Subiquity, and other TUI/GUI Linux installers out there." They also note that Archinstall "does allow automatically partitioning the drive with your choice of file-system options, automatically installing a desktop environment if desired, configuring the network interfaces, and all the other basics." The method is quick enough that I'll likely use archinstall for future Arch Linux benchmarks on Phoronix as it also then applies a sane set of defaults for users... Five minutes or less and off to the races, ready for Arch Linux." But Slashdot reader I75BJC still favors "scary commands in a terminal," leaving this comment on the original submission: If you can't type with the big adults, stay on your PlayStation. Even Apple, with its very good GUI has a command line. The command line commands are more flexible, more specific, more subtle than the pointy-clicky GUI.' -- source: https://linux.slashdot.org/story/21/04/10/1755241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple M1 hardware support merged into Linux 5.13
by Peter Reutemann 10 Apr '21

10 Apr '21

'Asahi Linux—founded by Hector "marcan" Martin—has merged initial support for Apple M1 hardware into the Linux system-on-chip (SOC) tree, where it will hopefully make it into the Linux 5.13 kernel (which we can expect roughly in July).' -- source: https://arstechnica.com/gadgets/2021/04/apple-m1-hardware-support-merged-in… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

APKPure App Contained Malicious Adware, Say Researchers
by Peter Reutemann 10 Apr '21

10 Apr '21

'Security researchers say APKPure, a widely popular app for installing older or discontinued Android apps from outside of Google's app store, contained malicious adware that flooded the victim's device with unwanted ads. From a report: Kaspersky Lab said that it alerted APKPure on Thursday that its most recent app version, 3.17.18, contained malicious code that siphoned off data from a victim's device without their knowledge, and pushed ads to the device's lock screen and in the background to generate fraudulent revenue for the adware operators. But the researchers said that the malicious code had the capacity to download other malware, potentially putting affected victims at further risk.' -- source: https://it.slashdot.org/story/21/04/09/1834230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Critical Zoom Vulnerability Triggers Remote Code Execution Without User Input
by Peter Reutemann 10 Apr '21

10 Apr '21

'ZDNet: A zero-day vulnerability in Zoom which can be used to launch remote code execution (RCE) attacks has been disclosed by researchers. The researchers from Computest demonstrated a three-bug attack chain that caused an RCE on a target machine, and all without any form of user interaction. As Zoom has not yet had time to patch the critical security issue, the specific technical details of the vulnerability are being kept under wraps. However, an animation of the attack in action demonstrates how an attacker was able to open the calculator program of a machine running Zoom following its exploit. As noted by Malwarebytes, the attack works on both Windows and Mac versions of Zoom, but it has not -- yet -- been tested on iOS or Android. The browser version of the videoconferencing software is not impacted. Computest researchers Daan Keuper and Thijs Alkemade earned themselves $200,000 for this Zoom discovery, as it was part of the Pwn2Own contest. In a statement to Tom's Guide, Zoom thanked the Computest researchers and said the company was "working to mitigate this issue with respect to Zoom Chat." In-session Zoom Meetings and Zoom Video Webinars are not affected. "The attack must also originate from an accepted external contact or be a part of the target's same organizational account," Zoom added. "As a best practice, Zoom recommends that all users only accept contact requests from individuals they know and trust."' -- source: https://it.slashdot.org/story/21/04/09/209227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wix and Their Dirty Tricks
by Peter Reutemann 09 Apr '21

09 Apr '21

'Matt Mullenweg, co-founder of the open-source blogging platform WordPress, writes: Wix, the website builder company you may remember from stealing WordPress code and lying about it, has now decided the best way to gain relevance is attacking the open source WordPress community in a bizarre set of ads. They can't even come up with original concepts for attack ads, and have tried to rip-off of Apple's Mac vs PC ads, but tastelessly personify the WordPress community as an absent, drunken father in a therapy session. I have a lot of empathy for whoever was forced to work on these ads, including the actors, it must have felt bad working on something that's like Encyclopedia Britannica attacking Wikipedia. WordPress is a global movement of hundreds of thousands of volunteers and community members, coming together to make the web a better place. The code, and everything you put into it, belongs to you, and its open source license ensures that you're in complete control, now and forever. WordPress is free, and also gives you freedom. So if we're comparing website builders to abusive relationships, Wix is one that locks you in the basement and doesn't let you leave. I'm surprised consumer protection agencies haven't gone after them. Wix is a for-profit company with a valuation that peaked at around 20 billion dollars, and whose business model is getting customers to pay more and more every year and making it difficult to leave or get a refund. (Don't take my word for it, look at their investor presentations.) They are so insecure that they are also the only website creator I'm aware of that doesn't allow you to export your content, so they're like a roach motel where you can check in but never check out. Once you buy into their proprietary stack you're locked in, which even their support documentation admits.' -- source: https://it.slashdot.org/story/21/04/08/2011222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

some leaks
by Peter Reutemann 09 Apr '21

09 Apr '21

Facebook Does Not Plan To Notify Half-Billion Users Affected by Data Leak https://tech.slashdot.org/story/21/04/07/2011245 Hackers Scraped Data from 500 Million LinkedIn Users -- and Have Posted it For Sale Online https://yro.slashdot.org/story/21/04/08/1755237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IBM Creates a COBOL Compiler For Linux On x86
by Peter Reutemann 08 Apr '21

08 Apr '21

'IBM has announced a COBOL compiler for Linux on x86. "IBM COBOL for Linux on x86 1.1 brings IBM's COBOL compilation technologies and capabilities to the Linux on x86 environment," said IBM in an announcement, describing it as "the latest addition to the IBM COBOL compiler family, which includes Enterprise COBOL for z/OS and COBOL for AIX." The Register reports: COBOL -- the common business-oriented language -- has its roots in the 1950s and is synonymous with the mainframe age and difficulties paying down technical debt accrued since a bygone era of computing. So why is IBM -- which is today obsessed with hybrid clouds -- bothering to offer a COBOL compiler for Linux on x86? Because IBM thinks you may want your COBOL apps in a hybrid cloud, albeit the kind of hybrid IBM fancies, which can mean a mix of z/OS, AIX, mainframes, POWER systems and actual public clouds. [...] But the announcement also suggests IBM doesn't completely believe this COBOL on x86 Linux caper has a future as it concludes: "This solution also provides organizations with the flexibility to move workloads back to IBM Z should performance and throughput requirements increase, or to share business logic and data with CICS Transaction Server for z/OS." The new offering requires RHEL 7.8 or later, or Ubuntu Server 16.04 LTS, 18.04 LTS, or later. ' -- source: https://linux.slashdot.org/story/21/04/08/018243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Wins Oracle Copyright Fight as Top Court Overturns Ruling
by Peter Reutemann 07 Apr '21

07 Apr '21

'The U.S. Supreme Court ruled that Alphabet's Google didn't commit copyright infringement when it used Oracle's programming code in the Android operating system, sparing Google from what could have been a multibillion-dollar award. From a report: The 6-2 ruling, which overturns a victory for Oracle, marks a climax to a decade-old case that divided Silicon Valley and promised to reshape the rules for the software industry. Oracle was seeking as much as $9 billion. The court said Google engaged in legitimate "fair use" when it put key aspects of Oracle's Java programming language in the Android operating system. Writing for the court, Justice Stephen Breyer said Google used "only what was needed to allow users to put their accrued talents to work in a new and transformative program." Each side contended the other's position would undercut innovation. Oracle said that without strong copyright protection, companies would have less incentive to invest the large sums needed to create groundbreaking products. Google said Oracle's approach would discourage the development of new software that builds on legacy products.' -- source: https://news.slashdot.org/story/21/04/05/1448243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 4

Google Open-Sources Lyra In Beta To Reduce Voice Call Bandwidth Usage
by Peter Reutemann 07 Apr '21

07 Apr '21

'Google today open-sourced Lyra in beta, an audio codec that uses machine learning to produce high-quality voice calls. VentureBeat reports: The code and demo, which are available on GitHub, compress raw audio down to 3 kilobits per second for "quality that compares favorably to other codecs," Google says. Lyra's architecture is separated into two pieces, an encoder and decoder. When someone talks into their phone, the encoder captures distinctive attributes, called features, from their speech. Lyra extracts these features in 40-millisecond chunks and then compresses and sends them over the network. It's the decoder's job to convert the features back into an audio waveform that can be played out over the listener's phone. According to Google, Lyra's architecture is similar to traditional audio codecs, which form the backbone of internet communication. But while these traditional codecs are based on digital signal processing techniques, the key advantage for Lyra comes from the ability of its decoder to reconstruct a high-quality signal. Google believes there are a number of applications Lyra might be uniquely suited to, from archiving large amounts of speech and saving battery to alleviating network congestion in emergency situations. ' -- source: https://news.slashdot.org/story/21/04/06/2013234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rust in the Android platform
by Peter Reutemann 07 Apr '21

07 Apr '21

'Correctness of code in the Android platform is a top priority for the security, stability, and quality of each Android release. Memory safety bugs in C and C++ continue to be the most-difficult-to-address source of incorrectness. We invest a great deal of effort and resources into detecting, fixing, and mitigating this class of bugs, and these efforts are effective in preventing a large number of bugs from making it into Android releases. Yet in spite of these efforts, memory safety bugs continue to be a top contributor of stability issues, and consistently represent ~70% of Android’s high severity security vulnerabilities. In addition to ongoing and upcoming efforts to improve detection of memory bugs, we are ramping up efforts to prevent them in the first place. Memory-safe languages are the most cost-effective means for preventing memory bugs. In addition to memory-safe languages like Kotlin and Java, we’re excited to announce that the Android Open Source Project (AOSP) now supports the Rust programming language for developing the OS itself. ' -- source: https://security.googleblog.com/2021/04/rust-in-android-platform.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0