- wlug - list.wlug.org.nz

Decentralized Operating System - GRIDNET OS
by john 18 Jul '23

18 Jul '23

This post just arrived at a forum I use, It seems a bit above my pay level. https://www.cybertechhelp.com/showthread.php?p=1312176#post1312176 Cheers John..

1 0

Is Wayland Becoming the Favored Way to Get a GUI on Linux?
by Peter Reutemann 18 Jul '23

18 Jul '23

'The Register shares its collection of "signs that Wayland is becoming the favored way to get a GUI on Linux." - The team developing Linux for Apple Silicon Macs said they didn't have the manpower to work on X.org support. - A year ago, the developers of the Gtk toolkit used by many Linux apps and desktops said that the next version may drop support for X11... - One of the developers of the Budgie desktop, Campbell Jones, recently published a blog post with a wildly controversial title that made The Reg FOSS desk smile: "Wayland is pretty good, actually." He lays out various benefits that Wayland brings to developers, and concludes: "Primarily, what I've learned is that Wayland is actually really well-designed. The writing is on the wall for X, and Wayland really is the future." Partly as a result of this, it looks likely that the next version of the Budgie desktop, Budgie 11, will only support Wayland, completely dropping support for X11. The team point out that this is not such a radical proposition: there was a proposal to make KDE 6 sessions default to Wayland as long ago as last October... - The GNOME spin of Fedora has defaulted to Wayland since version 25 in 2017, and the GNOME flavor of Ubuntu since 21.04. - [T]here's now an experimental effort to get Wayland working on OpenBSD. The effort happened at the recent OpenBSD hackathon in Tallinn, Estonia, and the developer's comments are encouraging. It's already available as part of FreeBSD.' -- source: https://linux.slashdot.org/story/23/07/17/0159246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WordPress plugin installed on 1 million+ sites logged plaintext passwords
by Peter Reutemann 17 Jul '23

17 Jul '23

'All-In-One Security, a WordPress security plugin installed on more than 1 million websites, has issued a security update after being caught three weeks ago logging plaintext passwords and storing them in a database accessible to website admins. The passwords were logged when users of a site using the plugin, typically abbreviated as AIOS, logged in, the developer of AIOS said Thursday. The developer said the logging was the result of a bug introduced in May in version 5.1.9. Version 5.2.0 released Thursday fixes the bug and also “deletes the problematic data from the database.” The database was available to people with administrative access to the website.' -- source: https://arstechnica.com/security/2023/07/wordpress-plugin-installed-on-1-mi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AlmaLinux No Longer Aims For 1:1 Compatibility With RHEL
by Peter Reutemann 17 Jul '23

17 Jul '23

'Phoronix: With Red Hat now restricting access to the RHEL source repositories, AlmaLinux and other downstreams that have long provided "community" rebuilds of Red Hat Enterprise Linux with 1:1 compatibility to upstream RHEL have been left sorting out what to do. Benny Vasquez, Chair of the Board for the AlmaLinux OS Foundation, wrote in a blog post yesterday: After much discussion, the AlmaLinux OS Foundation board today has decided to drop the aim to be 1:1 with RHEL. AlmaLinux OS will instead aim to be Application Binary Interface (ABI) compatible*. We will continue to aim to produce an enterprise-grade, long-term distribution of Linux that is aligned and ABI compatible with RHEL in response to our community's needs, to the extent it is possible to do, and such that software that runs on RHEL will run the same on AlmaLinux. For a typical user, this will mean very little change in your use of AlmaLinux. Red Hat-compatible applications will still be able to run on AlmaLinux OS, and your installs of AlmaLinux will continue to receive timely security updates. The most remarkable potential impact of the change is that we will no longer be held to the line of "bug-for-bug compatibility" with Red Hat, and that means that we can now accept bug fixes outside of Red Hat's release cycle. While that means some AlmaLinux OS users may encounter bugs that are not in Red Hat, we may also accept patches for bugs that have not yet been accepted upstream, or shipped downstream." ' -- source: https://linux.slashdot.org/story/23/07/14/215209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When Open Becomes Opaque: the Changing Face of Open-Source Hardware Companies
by Peter Reutemann 17 Jul '23

17 Jul '23

'A thoughtful post on the Adafruit Blog chronicles the problems facing open-source hardware companies, and how more and more companies, including Sparkfun, Arduino and Prusa, are becoming more and more proprietary. In Arduino's case, they are deliberately trying to stamp out the clones undercutting them. The new Arduino Pro is not open source in any way, and the web site has now removed references to being an open source company. As always there are subtleties and nuances. In the case of Prusa, not only are Chinese companies taking Prusa designs and source to make proprietary, closed-source products, they are also actively patenting designs and algorithms they've taken from open source. The original submission ends with a question. "With Red Hat recently taking a step towards becoming a proprietary software company (which happens to use and work on open source projects) and now these reports, what are Slashdotters' thoughts on the future? "Are truly open source companies doomed to failure, especially when overseas companies do not respect or even understand the principles of open source development?"' -- source: https://news.slashdot.org/story/23/07/15/1853247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Speed Versus Bandwidth
by Lawrence D'Oliveiro 16 Jul '23

16 Jul '23

Love the (original) opening sentence of this article <https://arstechnica.com/gadgets/2023/07/light-based-lifi-promises-amazing-w…>: Light is almost certainly the fastest thing around. So it makes sense that "light-based wireless communications," or LiFi, could blow the theoretical doors off existing radio-wave wireless standards, to the tune of a maximum 224GB per second. A correction/clarification immediately follows, but it’s clear the writer didn’t quite grasp that both visible light and radio waves are propagated by exactly the same particles--photons--travelling at exactly the same speed. What is true is that, as the frequency of the photons increases, so does their information-carrying capacity. This is why we have digital broadcasts (TV particularly), mobile phone/data services and our own wi-fi networks all moving to higher and higher frequencies. The downside is, as the frequency of a photon increases, so does its energy. And so it tends to react more and more with (i.e. be absorbed by) various bits of matter that it might encounter--such as the walls of buildings, or even the air itself. This tends to limit the useful range of these communication bands.

1 0

Torvalds Calls For Calm as Bcachefs Filesystem Doesn't Make Linux 6.5
by Peter Reutemann 11 Jul '23

11 Jul '23

'Linus Torvalds has delivered the first release candidate for version 6.5 of the Linux kernel, but warned this release may not go entirely smoothly. From a report: Torvalds's headline assessment of rc1 is "none of it looks hugely unusual." "The biggest single mention probably goes to what wasn't merged, with the bcachefs pull request resulting in a long thread (we didn't hit a hundred emails yet, but it's not far away)." As The Register reported in 2022, bcachefs is a filesystem that's been in development for nigh on a decade without being added to the kernel. Kernel-watching outlet Phoronix on Sunday wrote that the filesystem is in good shape but debate over "code changes needed to the kernel outside of the kernel module itself" have proved contentious. As a result, conversation on the Linux kernel mailing list is "often becoming heated" when the topic turns to bcachefs. In his announcement post for rc1, Torvalds wrote "Let's calm this party down."' -- source: https://linux.slashdot.org/story/23/07/10/2042253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fairphone 3 Gets Seven Years of Updates, Besting Every Other Android OEM
by Peter Reutemann 11 Jul '23

11 Jul '23

'Ars Technica: No one in the Android ecosystem can hold a candle to Apple's software support timeline for the iPhone, but there is one company that comes the closest: Fairphone. Following in the footsteps of the Fairphone 2, the Fairphone 3 is also getting an Android-industry-best seven years of OS support. Fairphone continues to run circles around giant tech companies that have a lot more resources than it does, and it's doing this even in the face of component vendors like Qualcomm dropping support for the phone's core components. The company announced today that the Fairphone 3, which was released in 2019, has had its support extended to 2026, making for seven years of updates. The company also just released Android 13 for the Fairphone 3. Google's own 2019 phone, the Pixel 4, shut down support in October 2022. Fairphone strives to make sustainable smartphones, designing its products to be repairable and also offering replacement parts for sale online. Part of that sustainability mission is an absolutely herculean effort to keep the Android updates flowing, even when Qualcomm drops critical software support for the SoC. Fairphone says the Snapdragon 632 SoC in the Fairphone 3 was only supported up to Android 11, so continuing to support the Fairphone 3 meant doing the upgrades all by itself.' -- source: https://tech.slashdot.org/story/23/07/10/213256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

CERT To Be Merged Into GCSB?
by Lawrence D'Oliveiro 10 Jul '23

10 Jul '23

Couple of local items here <https://www.theregister.com/2023/07/10/asia_tech_news_roundup/> that I hadn’t heard of before: Andrew Little is considering bringing CERT under the control of the Government Communications Security Bureau, and also Microsoft is raising cloud prices, though not those for on-prem products, in NZ.

1 0

Mastodon fixes critical “TootRoot” vulnerability allowing node hijacking
by Peter Reutemann 10 Jul '23

10 Jul '23

'The maintainers of the open source software that powers the Mastodon social network published a security update on Thursday that patches a critical vulnerability making it possible for hackers to backdoor the servers that push content to individual users. Mastodon is based on a federated model. The federation comprises thousands of separate servers known as "instances." Individual users create an account with one of the instances, which in turn exchange content to and from users of other instances. To date, Mastodon has more than 12,000 instances and 14.5 million users, according to fedidb.org/, a site that tracks statistics related to Mastodon. A critical bug tracked as CVE-2023-36460 was one of two vulnerabilities rated as critical that were fixed on Thursday. In all, Mastodon on Thursday patched five vulnerabilities. So far, Mastodon gGmbH, the nonprofit that maintains the software instances uses to operate the social network, has released few details about CVE-2023-36460 other than to describe it as an “arbitrary file creation through media attachments” flaw. “Using carefully crafted media files, attackers can cause Mastodon's media processing code to create arbitrary files at any location," Mastodon said. "This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution.” In a Mastodon post, independent security researcher Kevin Beaumont went a step further, writing that exploiting the vulnerability allowed someone “to send a toot which makes a webshell on instances that process said toot.” He coined the name #TootRoot because user posts, known as toots, allowed hackers to potentially gain root access to instances.' -- source: https://arstechnica.com/security/2023/07/mastodon-fixes-critical-tootroot-v… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0