- wlug - list.wlug.org.nz

Euro-Office 1.0 Is Here
by Lawrence D'Oliveiro 12 Jun '26

12 Jun '26

An EU-sponsored project to create an open-source office suite to act as a drop-in replacement for Microsoft Office/365 has put out a version 1.0 release <https://www.zdnet.com/article/euro-office-is-here-libreoffice-supporters-ar…>. One hiccup along the way was the copyright holders on the original code, Ascensio, have put a strange requirement on their source, namely that it was released under AGPLv3, but with a further condition saying that its trademarks and logos and stuff *could not* be removed from the code. And yet, at the same time, there was also a declaration that the source code did *not* come with a licence to use said trademarks and logos -- a copyright booby-trap if ever there was one. Bradley Kühn, author of the “A” part of the AGPL, takes this apart here <https://sfconservancy.org/blog/2026/apr/16/badgeware-onlyoffice-nextcloud-a…>. The general verdict seems to be that Ascensio’s legal threats are toothless, and the EU consortium is free to do all the usual things with the source code as per the terms of the AGPLv3, including strip out any proprietary trademarks and logos. That’s not the only controversy over the project, of course; many people are pointing out that it would have been much less troublesome to start from a well-established code base like LibreOffice. But it seems like the EU specifically wanted something that would work as seamlessly as possible with Microsoft’s native document formats, rather than any open standard.

1 0

High-Severity Vulnerability In Linux Caused By a Single Errant Character
by Peter Reutemann 10 Jun '26

10 Jun '26

'Ars Technica reports: Researchers have analyzed a high-severity vulnerability in Linux that's able to escalate untrusted users to root by exploiting a bug you don't often see: a single errant character inside the kernel. The vulnerability, tracked as CVE-2026-23111, is located in nf_tables, a subsystem of the Linux kernel that provides packet filtering capabilities. It's used to manage firewall rules and replaces older subsystems such as iptables, ip6tables, arptables, and ebtables. The presence of a single mis-issued exclamation point in code implementing nf_tables introduced a use-after-free, a class of vulnerability that corrupts memory by placing malicious code at memory addresses that haven't been properly freed of their previous contents. CVE-2026-23111 can be exploited by an unprivileged user or process to elevate system rights to root. The exploit works by disrupting the deletion of verdicts -- a determination within the nf_tables framework that determines if a packet matches a rule calling for a certain action to be performed. This process can use what are known as catchall elements, which act as a wildcard in the event a lookup doesn't match any other element in the set. When a verdict map is deleted from memory, catchall elements are deactivated and a chain's reference counter is decremented. When errors occur the deletion can be reversed and the counter incremented. CVE-2026-53111 allows for that process to be altered. As a result, the exploit can decrement the variable an arbitrary number of times and then delete and free the chain when some objects still point to it. Although the kernel vulnerability was fixed in February, multiple proof-of-concept exploits have since emerged, including one from FuzzingLabs in April and another from Exodus Intelligence that works on Debian and Ubuntu.' -- source: https://it.slashdot.org/story/26/06/09/181245 Cheers, Peter

1 0

“Line In The Sand”: Children’s Commissioner Says Social Media Ban Isn’t Enough
by Lawrence D'Oliveiro 02 Jun '26

02 Jun '26

Our Children’s Commissioner <https://www.stuff.co.nz/nz-news/360985806/line-sand-childrens-commissioner-…> says a ban on social media by underage users is a “blunt instrument”. But rather than let the platforms go back to doing as they wish, Achmad is pushing the Government to attempt something more ambitious. While a ban would take kids off social platforms, the Australian model demonstrates that it does not make tech companies liable for the harm caused, nor does it always alter how they operate. “We need legislation that is going to set requirements on these tech companies and social media platforms to prevent harm, to report harm, and to remove harmful content,” Achmad says.“I think that together, New Zealand and other countries can make that collective effort and draw a line in the sand around our expectations on how these big businesses should not be negatively impacting the rights of children.” While the social media companies hate the ban, I’m sure they would hate this even worse. Because it’s a more direct attack on their very business model, by forcing them to take more responsibility for its effects.

1 0

Unintended Prompt-Injection Attack
by Lawrence D'Oliveiro 28 May '26

28 May '26

When you use Google to search for the word “disregard”, the “AI overview” part at the top is mysteriously missing. (Did it ever work?) It seems, as a workaround, that Google is currently substituting a plain old dictionary definition, until it can figure out how to bring back the “AI overview” for that word <https://www.theverge.com/tech/938218/an-update-on-googles-disregard-issue>.

1 0

A hacker group is poisoning open source code at an unprecedented scale
by Peter Reutemann 25 May '26

25 May '26

'A so-called software supply chain attack, in which hackers corrupt a legitimate piece of software to hide their own malicious code, was once a relatively rare event but one that haunted the cybersecurity world with its insidious threat of turning any innocent application into a dangerous foothold in a victim’s network. Now one group of cybercriminals has turned that occasional nightmare into a near-weekly episode, corrupting hundreds of open source tools, extorting victims for profit, and sowing a new level of distrust in an entire ecosystem used to create the world’s software. On Tuesday night, open source code platform GitHub announced that it had been breached by hackers in one such software supply chain attack: A GitHub developer had installed a “poisoned” extension for VSCode, a plug-in for a commonly used code editor that, like GitHub itself, is owned by Microsoft. As a result, the hackers behind the breach, an increasingly notorious group called TeamPCP, claim to have accessed around 4,000 of GitHub’s code repositories. GitHub’s statement confirmed that it had found at least 3,800 compromised repositories while noting that, based on its findings so far, they all contained GitHub’s own code, not that of customers.' -- source: https://arstechnica.com/information-technology/2026/05/a-hacker-group-is-po… Cheers, Peter

1 0

Lenovo, Dell, and HP Financially Support Linux Vendor Firmware Service
by Peter Reutemann 25 May '26

25 May '26

'The It's FOSS blog has news about the Linux Vendor Firmware Service, which gives hardware vendors a secure portal to upload firmware updates "which can then be downloaded and installed by users through clients such as GNOME Software or fwupdmgr." (Originally developed in 2015 by GNOME maintainer Richard Hughes...) The issue, however, obviously, had been funding with the largest contributors being the usual suspects, Framework and Open Source Framework Foundation, at $10K a year. Recently, however, Lenovo and Dell joined suite as Premier sponsors, which is the highest tier at $100K a year each, making the project more sustainable and manageable. These companies contributing makes a lot of sense, considering they are two of the bigger computer companies which offer Linux by default in some cases, especially with Lenovo's ThinkPads being the Linux users' favorite for decades. And now... HP has followed suit as a Premier sponsor, also providing $100K a year, right alongside Dell and Lenovo... The question still remains, however, where are the other vendors? What are they waiting for... This major move by these three companies should not only be seen as a sign of relief and wider acceptance of the usage of Linux, but as a beacon for other vendors to follow, who ought to make their hardware more accessible to the open-source community. ' -- source: https://linux.slashdot.org/story/26/05/24/0522202 Cheers, Peter

1 0

Mozilla Brings Web Serial Workflows to Firefox, Collaborates With Adafruit
by Peter Reutemann 25 May '26

25 May '26

'The Web Serial API lets websites write to (and read from) serial devices using JavaScript, including USB and Bluetooth devices with virtual serial ports. And this week's Firefox 151 release introduced support for the Web Serial API on desktop. "Most folks won't use this API," acknowledges Mozilla's blog, "but for our community of builders and tinkerers, it unlocks the ability to use Firefox to communicate directly with compatible hardware devices like microcontrollers, development boards, and other serial-connected devices..." With Firefox's browser engine, Gecko, now supporting Web Serial, users can now connect, code, configure, and control compatible hardware directly from the browser in many workflows, often without additional software or complicated setup... As part of this week's launch, Adafruit, one of the internet's most beloved open-source hardware communities, is collaborating with us to test and validate what browser-based hardware development can look like in Firefox with Web Serial support... With Web Serial support in Firefox 151, Adafruit's browser-based hardware workflows now work directly in Firefox as well, with no additional software or complicated setup required for many projects. We invite you to give it a try... We want the web to be open, flexible, and shaped by the diversity of people building on it. If you're wiring up your first board, experimenting with hardware projects, or dusting off an old electronics kit, give Adafruit and Web Serial in Firefox a try. Build something amazing. Make something useful. Tell us what works. Tell us what breaks. Most of all, make it your own. Mozilla's "Hacks" blog demonstrates with an Adafruit ESP32-S2 based board "where messages sent from web code can be directly displayed on the device over Web Serial." And Mozilla engineer Alex Franchuk even built a handheld device that changes a web page's CSS properties.' -- source: https://news.slashdot.org/story/26/05/24/209218 Cheers, Peter

1 0

FreeBSD Foundation Executive Director Tries Daily Driving FreeBSD On Laptop
by Peter Reutemann 25 May '26

25 May '26

'Phoronix reports on a presentation about trying FreeBSD on modern Framework laptop from last week's Open Source Summit hosted by the Linux Foundation: With FreeBSD having worked on improving its laptop support over the past two years with some big changes and ongoing efforts for making a nice KDE desktop experience on FreeBSD, FreeBSD Foundation's Executive Director has been trying to daily drive FreeBSD on laptops... With the Framework Laptop, the touchscreen "just worked" as did other basic functionality from the KDE desktop on FreeBSD, including peripherals like a wireless mouse. Among the challenges were Zoom failing for video calls but eventually working, the web camera took steps to enable, and Microsoft Teams only partially worked. With the help of online resources, ultimately she was able to succeed in her journey of running FreeBSD daily on a lap' -- source: https://tech.slashdot.org/story/26/05/24/213229 Cheers, Peter

1 0

‘Your kids are being hurt’: He knows the harm social media does - because he helped build it
by Lawrence D'Oliveiro 24 May '26

24 May '26

Some good thoughts on age-gating access to social media, from someone who worked at Facebook for some years and helped create it <https://www.stuff.co.nz/nz-news/360982163/your-kids-are-being-hurt-experts-…>: “I worked on newsfeed ranking, bullying and harassment, and comment ranking,” [Ravi] Iyer told Stuff. “What I learned was that you can't actually design a platform badly and then try to fix it through moderation. You actually have to design a platform better in the first place.” As for the idea that legal restrictions just drive young people to use VPNs or lie about their age or whatever, he points out that peer pressure is the main driver of behaviour, so it’s not necessary to have a 100% loophole-proof policy in order to see good results: Addressing concerns about teens bypassing potential legislation using virtual private networks (VPNs) or children being pushed to darker corners of the internet, Iyer argues that these are not reasons to delay action. He says norm changes—where children feel less social pressure to be on platforms—are already occurring, and the goal is not immediate 100% compliance. He compares the policy to drinking ages or speed limits, where partial compliance still yields significant social benefits. And yes, he has some ideas on how a platform can be better designed. His approach also has the benefit of singling out problem platforms, not by trying to say what is or isn’t a “social media” platform, but in terms of the specific characteristics that cause problems: Iyer suggests moving away from broad, purpose-based definitions and instead focusing on harmful features, such as engagement-based algorithms, infinite scroll, and "streak" gamification—where users are incentivised to return to the platform every day. Of course, such features are precisely those that maximize ad revenue for the platform companies. So don’t expect them to be happy about this kind of focus.

3 2

Me welcoming myself to WLUG
by Kevin SARGENT 22 May '26

22 May '26

I was involved with yous way back in the day when I was first driven to Linux by 3.11 which I paid dearly for a [Licensed Copy - which mostly didn't work as intended. The advertised features I so wanted to use were a wish list. At least Linux enabled me to communicate with the software developer. Android worked well for a while but has now morphed into a nightmare of contradictions]* *delete if in contradiction to the rules I signed up to. Enough of that ancient history. I now live in a bus in BOP - the LUG up here appears to have died from natural causes - I hope one day to the same. While I was a busy stay at home Dad I struggled at times with some of the more technical command line actions to get stuff to work. At 76 it will be interesting to see how I get on, and so some one on one support would be good and I am more than willing to pay for. I live in Papamoa, I have met an elusive geek who is developing some Linux based Program on a Mac? Who may fill that gap, but ultra focused online, no cell phone etc etc. We contact thru random meeting and messages 'from the universe' In my bus I am gradually putting together a small box SS PC from HungryPC with a micro qwerty keyboard, at the same time as making physical alterations to accommodate this. I am dyslexic obsessive Writer of course and since losing 95% eyesight in my leading eye I find I can no longer use qwerty but have been able to use abcde keypad on phone and Tablet. The only abcde key pad I can find available in touch screen which I am told can be 'taught' to work on the Linux Mint I have on my machine. But on Tablet this abcde keypad is extremely unstable - vital features disappear and down loading it again results in different layouts and features on different machines but it is not Android exclusive! All laptops with physical and touch screen keypads I have tried won't accept abcde lay out. Why in this day and age qwerty still exists is a mystery to me. I hope I can convince my 'geek' of abcde keypad importance (this was easier to achieve back in the day, maybe with current Linux Mint (or similar) nowadays Till then I might be stuck with writing on my phone and emailing it to my main machine to put it into LibreOffice to email to my Editor or other writer supports. Cheers, I hope I can get some traction with this, as complex submissions and my writing in both English & Te Reo Maori is becoming more difficult with advancing technology - not easier Cheers Kevf

1 0