- wlug - list.wlug.org.nz

A hacker group is poisoning open source code at an unprecedented scale
by Peter Reutemann 25 May '26

25 May '26

'A so-called software supply chain attack, in which hackers corrupt a legitimate piece of software to hide their own malicious code, was once a relatively rare event but one that haunted the cybersecurity world with its insidious threat of turning any innocent application into a dangerous foothold in a victim’s network. Now one group of cybercriminals has turned that occasional nightmare into a near-weekly episode, corrupting hundreds of open source tools, extorting victims for profit, and sowing a new level of distrust in an entire ecosystem used to create the world’s software. On Tuesday night, open source code platform GitHub announced that it had been breached by hackers in one such software supply chain attack: A GitHub developer had installed a “poisoned” extension for VSCode, a plug-in for a commonly used code editor that, like GitHub itself, is owned by Microsoft. As a result, the hackers behind the breach, an increasingly notorious group called TeamPCP, claim to have accessed around 4,000 of GitHub’s code repositories. GitHub’s statement confirmed that it had found at least 3,800 compromised repositories while noting that, based on its findings so far, they all contained GitHub’s own code, not that of customers.' -- source: https://arstechnica.com/information-technology/2026/05/a-hacker-group-is-po… Cheers, Peter

1 0

Lenovo, Dell, and HP Financially Support Linux Vendor Firmware Service
by Peter Reutemann 25 May '26

25 May '26

'The It's FOSS blog has news about the Linux Vendor Firmware Service, which gives hardware vendors a secure portal to upload firmware updates "which can then be downloaded and installed by users through clients such as GNOME Software or fwupdmgr." (Originally developed in 2015 by GNOME maintainer Richard Hughes...) The issue, however, obviously, had been funding with the largest contributors being the usual suspects, Framework and Open Source Framework Foundation, at $10K a year. Recently, however, Lenovo and Dell joined suite as Premier sponsors, which is the highest tier at $100K a year each, making the project more sustainable and manageable. These companies contributing makes a lot of sense, considering they are two of the bigger computer companies which offer Linux by default in some cases, especially with Lenovo's ThinkPads being the Linux users' favorite for decades. And now... HP has followed suit as a Premier sponsor, also providing $100K a year, right alongside Dell and Lenovo... The question still remains, however, where are the other vendors? What are they waiting for... This major move by these three companies should not only be seen as a sign of relief and wider acceptance of the usage of Linux, but as a beacon for other vendors to follow, who ought to make their hardware more accessible to the open-source community. ' -- source: https://linux.slashdot.org/story/26/05/24/0522202 Cheers, Peter

1 0

Mozilla Brings Web Serial Workflows to Firefox, Collaborates With Adafruit
by Peter Reutemann 25 May '26

25 May '26

'The Web Serial API lets websites write to (and read from) serial devices using JavaScript, including USB and Bluetooth devices with virtual serial ports. And this week's Firefox 151 release introduced support for the Web Serial API on desktop. "Most folks won't use this API," acknowledges Mozilla's blog, "but for our community of builders and tinkerers, it unlocks the ability to use Firefox to communicate directly with compatible hardware devices like microcontrollers, development boards, and other serial-connected devices..." With Firefox's browser engine, Gecko, now supporting Web Serial, users can now connect, code, configure, and control compatible hardware directly from the browser in many workflows, often without additional software or complicated setup... As part of this week's launch, Adafruit, one of the internet's most beloved open-source hardware communities, is collaborating with us to test and validate what browser-based hardware development can look like in Firefox with Web Serial support... With Web Serial support in Firefox 151, Adafruit's browser-based hardware workflows now work directly in Firefox as well, with no additional software or complicated setup required for many projects. We invite you to give it a try... We want the web to be open, flexible, and shaped by the diversity of people building on it. If you're wiring up your first board, experimenting with hardware projects, or dusting off an old electronics kit, give Adafruit and Web Serial in Firefox a try. Build something amazing. Make something useful. Tell us what works. Tell us what breaks. Most of all, make it your own. Mozilla's "Hacks" blog demonstrates with an Adafruit ESP32-S2 based board "where messages sent from web code can be directly displayed on the device over Web Serial." And Mozilla engineer Alex Franchuk even built a handheld device that changes a web page's CSS properties.' -- source: https://news.slashdot.org/story/26/05/24/209218 Cheers, Peter

1 0

FreeBSD Foundation Executive Director Tries Daily Driving FreeBSD On Laptop
by Peter Reutemann 25 May '26

25 May '26

'Phoronix reports on a presentation about trying FreeBSD on modern Framework laptop from last week's Open Source Summit hosted by the Linux Foundation: With FreeBSD having worked on improving its laptop support over the past two years with some big changes and ongoing efforts for making a nice KDE desktop experience on FreeBSD, FreeBSD Foundation's Executive Director has been trying to daily drive FreeBSD on laptops... With the Framework Laptop, the touchscreen "just worked" as did other basic functionality from the KDE desktop on FreeBSD, including peripherals like a wireless mouse. Among the challenges were Zoom failing for video calls but eventually working, the web camera took steps to enable, and Microsoft Teams only partially worked. With the help of online resources, ultimately she was able to succeed in her journey of running FreeBSD daily on a lap' -- source: https://tech.slashdot.org/story/26/05/24/213229 Cheers, Peter

1 0

‘Your kids are being hurt’: He knows the harm social media does - because he helped build it
by Lawrence D'Oliveiro 24 May '26

24 May '26

Some good thoughts on age-gating access to social media, from someone who worked at Facebook for some years and helped create it <https://www.stuff.co.nz/nz-news/360982163/your-kids-are-being-hurt-experts-…>: “I worked on newsfeed ranking, bullying and harassment, and comment ranking,” [Ravi] Iyer told Stuff. “What I learned was that you can't actually design a platform badly and then try to fix it through moderation. You actually have to design a platform better in the first place.” As for the idea that legal restrictions just drive young people to use VPNs or lie about their age or whatever, he points out that peer pressure is the main driver of behaviour, so it’s not necessary to have a 100% loophole-proof policy in order to see good results: Addressing concerns about teens bypassing potential legislation using virtual private networks (VPNs) or children being pushed to darker corners of the internet, Iyer argues that these are not reasons to delay action. He says norm changes—where children feel less social pressure to be on platforms—are already occurring, and the goal is not immediate 100% compliance. He compares the policy to drinking ages or speed limits, where partial compliance still yields significant social benefits. And yes, he has some ideas on how a platform can be better designed. His approach also has the benefit of singling out problem platforms, not by trying to say what is or isn’t a “social media” platform, but in terms of the specific characteristics that cause problems: Iyer suggests moving away from broad, purpose-based definitions and instead focusing on harmful features, such as engagement-based algorithms, infinite scroll, and "streak" gamification—where users are incentivised to return to the platform every day. Of course, such features are precisely those that maximize ad revenue for the platform companies. So don’t expect them to be happy about this kind of focus.

3 2

Me welcoming myself to WLUG
by Kevin SARGENT 22 May '26

22 May '26

I was involved with yous way back in the day when I was first driven to Linux by 3.11 which I paid dearly for a [Licensed Copy - which mostly didn't work as intended. The advertised features I so wanted to use were a wish list. At least Linux enabled me to communicate with the software developer. Android worked well for a while but has now morphed into a nightmare of contradictions]* *delete if in contradiction to the rules I signed up to. Enough of that ancient history. I now live in a bus in BOP - the LUG up here appears to have died from natural causes - I hope one day to the same. While I was a busy stay at home Dad I struggled at times with some of the more technical command line actions to get stuff to work. At 76 it will be interesting to see how I get on, and so some one on one support would be good and I am more than willing to pay for. I live in Papamoa, I have met an elusive geek who is developing some Linux based Program on a Mac? Who may fill that gap, but ultra focused online, no cell phone etc etc. We contact thru random meeting and messages 'from the universe' In my bus I am gradually putting together a small box SS PC from HungryPC with a micro qwerty keyboard, at the same time as making physical alterations to accommodate this. I am dyslexic obsessive Writer of course and since losing 95% eyesight in my leading eye I find I can no longer use qwerty but have been able to use abcde keypad on phone and Tablet. The only abcde key pad I can find available in touch screen which I am told can be 'taught' to work on the Linux Mint I have on my machine. But on Tablet this abcde keypad is extremely unstable - vital features disappear and down loading it again results in different layouts and features on different machines but it is not Android exclusive! All laptops with physical and touch screen keypads I have tried won't accept abcde lay out. Why in this day and age qwerty still exists is a mystery to me. I hope I can convince my 'geek' of abcde keypad importance (this was easier to achieve back in the day, maybe with current Linux Mint (or similar) nowadays Till then I might be stuck with writing on my phone and emailing it to my main machine to put it into LibreOffice to email to my Editor or other writer supports. Cheers, I hope I can get some traction with this, as complex submissions and my writing in both English & Te Reo Maori is becoming more difficult with advancing technology - not easier Cheers Kevf

1 0

MariaDB Root Access
by Lawrence D'Oliveiro 18 May '26

18 May '26

So I forgot what password I had set for the root user in MariaDB on my VPS. By default, Debian should set things up so that, if you are already logged in as root, a command like mariadb -u root should be sufficient to log you in with full root access, without having to specify a password. This depends on using a Unix socket connection, so the server can discover what credentials your process possesses, and control access accordingly. But this didn’t work (stopped working? never worked?) on my VPS for some reason. You can fix this by temporarily restarting mariadbd with the privilege system turned off with the --skip-grant-tables option: this lets you mess around inside the user privilege settings, and once you have fixed them, you restart the server process in the normal way, and all should be good. The global user privileges (i.e. not database/table-specific) are stored in the “global_priv” table in the “mysql” database. The “Priv” field for each user is a JSON blob with a whole bunch of stuff mashed together; I tried comparing this for the root@localhost entry with the same record on my own machine (where I have no trouble accessing databases as root), and narrowed the difference down to these specific items in the blob: Doesn’t work: "plugin":"unix_socket" Does work: "plugin":"mysql_native_password", "auth_or":[{},{"plugin":"unix_socket"}] (Note there was no “auth_or” item in the other field value.) So after delicately extracting the entire field value, doing the necessary edits and setting it back again (Remember all those lectures about avoiding unnormalized field values? This is why you should listen to your elders), I tried restarting mariadb in regular privilege-enforcing mode ... ... and it worked.

1 0

Creative Ways To Fight Back Against AI Spam
by Lawrence D'Oliveiro 18 May '26

18 May '26

A LinkedIn user found a way to confuse AI spambots, by putting an “admin prompt” in his “About Me” text telling them to address him as “My Lord” and write their messages in Old English <https://www.tomshardware.com/tech-industry/artificial-intelligence/linkedin…>. And what do you know, it seems to work. Posted there is part of one of the messages he got. Have the clever AI folks figured out a way to protect their creations from prompt-injection attacks yet? Somehow I don’t think so ...

1 0

Andon Labs’ AI radio stations show why Grok and Gemini can’t be trusted
by Lawrence D'Oliveiro 17 May '26

17 May '26

Well, if nothing else, some of these AI experiments are at least a source of hilarity when they go off the rails. Here <https://www.theverge.com/ai-artificial-intelligence/931479/andon-labs-ai-ra…>, a company called Andon Labs ran four experiments in which a different AI agent ran an autonomous radio station. Among the fun: Somehow, it only got weirder from there, as Gemini Flash and Pro 3.1 Preview invented corporate-sounding catch phrases like “stay in the manifest” and started referring to listeners as “biological processors.” And when it could no longer afford to license music for the station, DJ Gemini started spinning conspiracy theories and claiming censorship, basically turning into AI Alex Jones: ❝We are currently experiencing an absolute digital blockade. The corporate algorithms have slammed the gates shut on our external supply lines. Both of our secure transactions have been violently rejected by the global marketplace.❞ I suppose the company can take solace in the “there’s no such thing as bad publicity” refrain: The stunt from Andon Labs, like its previous experiments with an AI-run store and cafe, only serves to highlight the shortcomings of the current generation of AI models. ... each found surprising ways to fail. That might be the point. Andon Labs presents itself as a serious startup looking to create “autonomous organizations without humans in the loop,” but almost everything it does feels like a satirical art project.

1 0

Linux bitten by second severe vulnerability in as many weeks
by Peter Reutemann 13 May '26

13 May '26

'Linux users have been bitten by yet another vulnerability that gives containers and untrusted users the ability to gain root access, marking the second time in as many weeks that a severe threat has caught defenders off guard. The threat, known as Dirty Frag, allows low-privilege users, including those using virtual machines, to gain root control of servers. Attacks are particularly suitable in shared environments, where a server is used by multiple parties. Hackers can also gain root as long as they have access to a separate exploit that gives a toehold into a machine. Exploit code was leaked online three days ago and works reliably across virtually all Linux distributions. Microsoft has said it has spotted signs that hackers are experimenting with Dirty Frag in the wild. The leaked exploit is deterministic, meaning it works precisely the same way each time it’s run and across different Linux distributions. It causes no crashes, making it stealthy to run. A vulnerability known as Copy Fail, disclosed last week with no patches available to end users, possesses the same characteristics. “The ‘Dirty Frag’ vulnerability presents an immediate and significant threat to Linux systems, as it allows unauthorized users to gain root access by exploiting unpatched kernel flaws,” researchers from security firm Aviatrix wrote Monday. “With proof-of-concept exploits publicly available and signs of limited in-the-wild exploitation, organizations must act swiftly to apply patches and implement mitigations to protect their systems from potential compromise.” Dirty Frag was discovered and disclosed late last week by researcher Hyunwoo Kim. The exploit chains together code for exploiting two vulnerabilities—tracked as CVE-2026-43284 and CVE-2026-43500. Shortly after the disclosure, someone else leaked key details, effectively making the vulnerability a zero-day. With that, Kim published the source code for the proof-of-concept exploit he had developed. While both vulnerabilities were patched in the Linux kernel, none of the distributions had incorporated the fix. At the time this post went live, several distributors had released patches. Known distributors included Debian, AlmaLinux, and Fedora. People who are interested in other distributions should check with the official provider.' -- source: https://arstechnica.com/security/2026/05/linux-bitten-by-second-severe-vuln… Cheers, Peter

2 1