- wlug - list.wlug.org.nz

Android phones get PC webcam capabilities in the latest beta
by Peter Reutemann 25 Sep '23

25 Sep '23

'Here's a fun new use for your Android phone: A PC webcam! In the latest Android beta, plugging a phone into a PC will reveal a new option in the USB Preferences menu for webcam functionality. Just pick that option instead of the default "file transfer," and the phone camera will register itself as a webcam. Then you can fire up Zoom and start video calling. The Android build with this feature is "Android 14 QPR1 Beta 1." Android's getting confusing with all these overlapping betas, but the current stable version is still Android 13. Android 14, currently on its 10th beta/developer preview, will most likely be out alongside the Pixel 8 in October. Android 14 QPR1 is the quarterly release after the first stable build of Android 14, and it should be out around December. (QPR stands for quarterly platform release.) These happen between major releases, often marketed as "feature drops." Right now, Android 13 is technically "Android 13 QPR3."' -- source: https://arstechnica.com/gadgets/2023/09/android-phones-get-pc-webcam-capabi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Behind the Scenes at 'Have I Been Pwned'
by Peter Reutemann 25 Sep '23

25 Sep '23

'The founder of the data-breach notification site Have I Been Pwned manages "the largest known repository of stolen data on the planet," reports Australia's public broadcaster ABC, including over 6 billion email address. Yet with no employees, Troy Hunt manages all of the technical and operational aspects single-handedly, and "has ended up playing an oddly central role in global cybersecurity." Troy is very careful with how he handles what he finds. He only collects (and encrypts) the mobile numbers, emails and passwords that he finds in the breaches, discarding the victims' names, physical addresses, bank details and other sensitive information. The idea is to let users find out where their data has been leaked from, but without exposing them to further risk. Once he identifies where a data breach has occurred, Troy also contacts the organisation responsible to allow it to inform its users before he does. This, he says, is often the hardest step of the process because he has to convince them it's legitimate and not some kind of scam itself. He's not required to give organisations this opportunity, much less persist when they ignore his messages or accuse him of trying to shake them down for money. But there's evidence that this approach is working. Despite the legal grey area he has operated in for a decade now, he's avoided being sued by any of the organisations responsible for the 705 breaches that are now searchable on Have I Been Pwned. These days, major tech companies like Mozilla and 1Password use Have I Been Pwned, and Troy likes to point out that dozens of national governments and law enforcement agencies also partner with his service... "He's not a company that's audited. He's just a dude on the web," says Jane Andrew, an expert on data breaches at the University of Sydney. "I think it's so shocking that this is where we find out information about ourselves. She says governments and law enforcement have, in general, left it to individuals to deal with the fallout from data breaches... Without an effective global regulator, Professor Andrew says, a crucial part of the world's cybersecurity infrastructure is left to rely on the goodwill of this one man on the Gold Coast.' -- source: https://it.slashdot.org/story/23/09/24/201233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LMDE-5 download
by john 24 Sep '23

24 Sep '23

I recently decided to try LMDE-5 Mate version. I found all my usual download sources were returning a 404 error, Checked again at 9.35am https://blog.linuxmint.com/?p=4281 Has this been pulled for some reason??

2 1

Linux gives up on 6-year LTS kernels, says they’re too much work
by Peter Reutemann 21 Sep '23

21 Sep '23

'The LTS (long-term support) period for the Linux kernel is being cut down. In 2017, the kernel jumped from two years of support to six. Now, six years later, it turns out that's a lot of work. ZDNet reports that at the Open Source Summit Europe this week (videos will be out in a few weeks), Linux Weekly News executive editor Jonathan Corbet announced the Linux kernel will return to two years of LTS support. The plan to cut back down to two years isn't instant. The Linux community is still honoring the current end-of-life timelines, so 6.1, 5.15, 5.10, 5.4, 4.19, and 4.14 are still six years, but new kernels will only get two years. Even this six-year window was supposed to be an optional thing when it started, with the release page FAQ saying, "Each new longterm kernel usually starts with only a 2-year projected EOL that can be extended further if there is enough interest from the industry at large to help support it for a longer period of time." The reality was that everything received a six-year life span, and now that will no longer be the case. Corbet cited a mix of lack of use and a lack of support for why Linux is cutting back on LTS kernels. Corbet says, "There's really no point to maintaining [old kernels] for that long because people are not using them." The other big problem is the burnout from maintainers, which are often unpaid and could use a lot more support from the billion-dollar companies that benefit from using Linux.' -- source: https://arstechnica.com/gadgets/2023/09/linux-gives-up-on-6-year-lts-thats-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

The Signal Protocol used by 1+ billion people is getting a post-quantum makeover
by Peter Reutemann 21 Sep '23

21 Sep '23

'The Signal Foundation, maker of the Signal Protocol that encrypts messages sent by more than a billion people, has rolled out an update designed to prepare for a very real prospect that’s never far from the thoughts of just about every security engineer on the planet: the catastrophic fall of cryptographic protocols that secure some of the most sensitive secrets today. The Signal Protocol is a key ingredient in the Signal, Google RCS, and WhatsApp messengers, which collectively have more than 1 billion users. It’s the engine that provides end-to-end encryption, meaning messages encrypted with the apps can be decrypted only by the recipients and no one else, including the platforms enabling the service. Until now, the Signal Protocol encrypted messages and voice calls with X3DH, a specification based on a form of cryptography known as Elliptic Curve Diffie-Hellman. [...] There is little disagreement, however, that there will come a day when many of the most widely used forms of encryption will die at the hands of quantum computing. To head off that doomsday eventuality, engineers and mathematicians have been developing a new class of PQC, short for post-quantum cryptography. The PQC added to the Signal Protocol on Monday is called PQXDH. It uses the same X3DH specification the Signal Protocol has always employed. On top, it adds an additional layer of encryption using Crystals-Kyber, one of four PQC algorithms the National Institute of Standards and Technology selected last year as a potential replacement to ECC and other quantum-vulnerable forms of encryption.' -- source: https://arstechnica.com/security/2023/09/signal-preps-its-encryption-engine… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Terraform Fork Gets Renamed OpenTofu, Joins Linux Foundation
by Peter Reutemann 21 Sep '23

21 Sep '23

'TechCrunch: When HashiCorp announced it was changing its Terraform license in August, it set off a firestorm in the open source community, and actually represented an existential threat to startups that were built on top of the popular open source project. The community went into action and within weeks they had written a manifesto, and soon after that launched an official fork called OpenTF. Today, that group went a step further when the Linux Foundation announced OpenTofu, the official name for the Terraform fork, which will live forever under the auspices of the foundation as an open source project. At the same time, the project announced it would be applying for entry into the Cloud Native Computing Foundation (CNCF). "OpenTofu is an open and community-driven response to Terraform's recently announced license change from a Mozilla Public License v2.0 (MPLv2) to a Business Source License v1.1 providing everyone with a reliable, open source alternative under a neutral governance model," the foundation said in a statement. The name is deliberately playful says Yevgeniy (Jim) Brikman from the OpenTofu founding team, who is also co-founder of Gruntwork. "I'm glad your reaction was to laugh. That's a good thing. We're trying to keep things a little more humorous," Brikman told TechCrunch, but the group is dead serious when it comes to building an open fork. [...] "The first thing was to get an alpha release out there. So you can go to the OpenTofu website and download OpenTofu and start using it and trying it out," he said. "Then the next thing is a stable release. That's coming in the very near future, but there's work to do. Once you have a stable release, people can start using it. Then we can start growing adoption, and once we start growing adoption, some of the big players will start stepping in when some of the big players start stepping in other big players will start stepping in as well."' -- source: https://linux.slashdot.org/story/23/09/20/1951214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chinese hackers have unleashed a never-before-seen Linux backdoor
by Peter Reutemann 19 Sep '23

19 Sep '23

'Researchers have discovered a never-before-seen backdoor for Linux that’s being used by a threat actor linked to the Chinese government. The new backdoor originates from a Windows backdoor named Trochilus, which was first seen in 2015 by researchers from Arbor Networks, now known as Netscout. They said that Trochilus executed and ran only in memory, and the final payload never appeared on disks in most cases. That made the malware difficult to detect. Researchers from NHS Digital in the UK have said Trochilus was developed by APT10, an advanced persistent threat group linked to the Chinese government that also goes by the names Stone Panda and MenuPass. Other groups eventually used it, and its source code has been available on GitHub for more than six years. Trochilus has been seen being used in campaigns that used a separate piece of malware known as RedLeaves. In June, researchers from security firm Trend Micro found an encrypted binary file on a server known to be used by a group they had been tracking since 2021. By searching VirusTotal for the file name, libmonitor.so.2, the researchers located an executable Linux file named “mkmon”. This executable contained credentials that could be used to decrypt libmonitor.so.2 file and recover its original payload, leading the researchers to conclude that “mkmon” is an installation file that delivered and decrypted libmonitor.so.2. The Linux malware ported several functions found in Trochilus and combined them with a new Socket Secure (SOCKS) implementation. The Trend Micro researchers eventually named their discovery SprySOCKS, with “spry” denoting its swift behavior and the added SOCKS component. SprySOCKS implements the usual backdoor capabilities, including collecting system information, opening an interactive remote shell for controlling compromised systems, listing network connections, and creating a proxy based on the SOCKS protocol for uploading files and other data between the compromised system and the attacker-controlled command server.' -- source: https://arstechnica.com/security/2023/09/never-before-seen-linux-backdoor-i… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Linux Mint Debian Edition' Begins Public Beta Testing
by Peter Reutemann 18 Sep '23

18 Sep '23

'This week saw the public beta-testing release of "Linux Mint Debian Edition". Besides listing download locations, its release notes also list out the project's three goals: - Ensure Linux Mint would be able to continue to deliver the same user experience - See how much work would be involved if Ubuntu was ever to disappear. - Guarantee the software we develop is compatible outside of Ubuntu. 9to5Linux reports: Based on the Debian GNU/Linux 12 "Bookworm" operating system series, Linux Mint Debian Edition 6 is powered by the long-term supported Linux 6.1 LTS kernel series and features the latest Cinnamon 5.8 desktop environment that was introduced with the Linux Mint 21.2 "Victoria" release in July 2023â¦ [T]his release comes with a new look and feel thanks to newly added folder icons with different color variants, improved consistency of tooltips to look the same across different apps and desktops, support for symbolic icons that adapt to their background, and full support for HEIF and AVIF' -- source: https://linux.slashdot.org/story/23/09/16/2147219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

KSMBD Finally Reaches 'Stable' State in Release Candidate for Linux Kernel 6.6
by Peter Reutemann 18 Sep '23

18 Sep '23

'When Linus Torvalds announced Linux kernel 6.6's first release candidate, it included a newly-stable version of KSMBD, which is Samsung's in-kernel server for the SMB protocol (for sharing files/folders/printers over a network). An announcement in 2021 had said that "For many cases the current userspace server choices were suboptimal either due to memory footprint, performance or difficulty integrating well with advanced Linux features." LWN noted at the time that Linux has been using "the user-space Samba solution since shortly after the beginning." In a sense, ksmbd is not meant to compete with Samba; indeed, it has been developed in cooperation with the Samba project. It is, however, meant to be a more performant and focused solution than Samba is; at this point, Samba includes a great deal of functionality beyond simple file serving. Ksmbd claims significant performance improvements on a wide range of benchmarks...One other reason — which tends to be spoken rather more quietly — is that a new implementation can be licensed under GPLv2, while Samba is GPLv3. The Register notes that when Samba switched to GPL 3, "one result was that Apple dropped Samba from Mac OS X and replaced it with its own, in-house server called SMBX." And they also remember that a month after its debut in 2021, "Linux sysadmins got to enjoy KSMBD's first security exploit." What's changed now is that it has faced considerable security testing and as a result it is no longer marked as experimental. It's been developed with the assistance of the Samba team, which itself documents how to use it. It's compatible with existing Samba configuration files. As the team says, "It is not meant to replace the existing Samba fileserver 'smbd', but rather be an extension and will integrate with Samba in the future...." KSMBD is also important in that placing such core server functionality right inside the kernel represents a significant potential attack surface for crackers... The new bcachefs file system will not be going into kernel 6.6, and its developer is not happy. "It's taken some time to get KSMBD to a state that was considered stable," points out Linux magazine. That time has come, and KSMBD is planned for Linux kernel 6.6.: But why is KSMBD important? First off, it promises considerable performance gains and better support for modern features such as Remote Direct Memory Access (RDMA)... KSMBD also adds enhanced security, considerably better performance for both single and multi-thread read/write, better stability, and higher compatibility. In the end, hopefully, this KSMBD will also mean easier share setups in Linux without having to jump through the same hoops one must with the traditional Samba setup.' -- source: https://linux.slashdot.org/story/23/09/16/0412208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Error message.
by john 14 Sep '23

14 Sep '23

Hi All, I attempted to install Warpinator using this guide: https://ubunlog.com/en/warpinator-sends-and-receives-files-on-a-local-netwo… I thought the install was a success even though I needed to issue "|sudo apt install -f"| On running the program from a terminal a sad outcome appears....... john(a)johnbuntu:~$ warpinator Gtk-Message: 09:36:55.896: Failed to load module "xapp-gtk3-module" 2023-09-14 09:36:56,719::warpinator: Initializing Warpinator 2023-09-14 09:36:57,000::warpinator: Starting server on xxx.xxx.x.x Any help will be much appreciated.. Cheers John..

2 1

Mozilla Patches Firefox, Thunderbird Against Zero-Day Exploited in Attacks
by Peter Reutemann 14 Sep '23

14 Sep '23

'Mozilla has released emergency security updates to fix a critical zero-day vulnerability exploited in the wild, impacting its Firefox web browser and Thunderbird email client. From a report: Tracked as CVE-2023-4863, the security flaw is caused by a heap buffer overflow in the WebP code library (libwebp), whose impact spans from crashes to arbitrary code execution. "Opening a malicious WebP image could lead to a heap buffer overflow in the content process. We are aware of this issue being exploited in other products in the wild," Mozilla said in an advisory published on Tuesday. Mozilla addressed the exploited zero-day in Firefox 117.0.1, Firefox ESR 115.2.1, Firefox ESR 102.15.1, Thunderbird 102.15.1, and Thunderbird 115.2.2. Even though specific details regarding the WebP flaw's exploitation in attacks remain undisclosed, this critical vulnerability is being abused in real-world scenarios.' -- source: https://tech.slashdot.org/story/23/09/13/1328236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Password-stealing Linux malware served for 3 years and no one noticed
by Peter Reutemann 13 Sep '23

13 Sep '23

'A download site surreptitiously served Linux users malware that stole passwords and other sensitive information for more than three years until it finally went quiet, researchers said on Tuesday. The site, freedownloadmanager[.]org, offered a benign version of a Linux offering known as the Free Download Manager. Starting in 2020, the same domain at times redirected users to the domain deb.fdmpkg[.]org, which served a malicious version of the app. The version available on the malicious domain contained a script that downloaded two executable files to the /var/tmp/crond and /var/tmp/bs file paths. The script then used the cron job scheduler to cause the file at /var/tmp/crond to launch every 10 minutes. With that, devices that had installed the booby-trapped version of Free Download Manager were permanently backdoored. After accessing an IP address for the malicious domain, the backdoor launched a reverse shell that allowed the attackers to remotely control the infected device. Researchers from Kaspersky, the security firm that discovered the malware, then ran the backdoor on a lab device to observe how it behaved. “This stealer collects data such as system information, browsing history, saved passwords, cryptocurrency wallet files, as well as credentials for cloud services (AWS, Google Cloud, Oracle Cloud Infrastructure, Azure),” the researchers wrote in a report on Tuesday. “After collecting information from the infected machine, the stealer downloads an uploader binary from the C2 server, saving it to /var/tmp/atd. It then uses this binary to upload stealer execution results to the attackers’ infrastructure.”' -- source: https://arstechnica.com/security/2023/09/password-stealing-linux-malware-se… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Multi-Account Containers
by Peter Reutemann 11 Sep '23

11 Sep '23

Hi everyone Just came across this Firefox plugin: The Firefox Multi-Account Containers extension lets you carve out a separate box for each of your online lives – no more opening a different browser just to check your work email! Under the hood, it separates website storage into tab-specific Containers. Cookies downloaded by one Container are not available to other Containers. You can even integrate individual Containers with Mozilla VPN to protect your browsing and location. With the Firefox Multi-Account Containers extension, you can... - Sign in to two different accounts on the same site (for example, you could sign in to work email and home email in two different Container tabs. - Keep different kinds of browsing far away from each other (for example, you might use one Container tab for managing your Checking Account and a different Container tab for searching for new songs by your favorite band) - Avoid leaving social-network footprints all over the web (for example, you could use a Container tab for signing in to a social network, and use a different tab for visiting online news sites, keeping your social identity separate from tracking scripts on news sites) - Protect your browsing activity in individual Containers using Mozilla VPN, so you can shop while travelling abroad but check your bank account from a server in your home country. -- source: https://discuss.systems/@ricci/111024736570863186 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Connected cars are a “privacy nightmare,” Mozilla Foundation says
by Peter Reutemann 07 Sep '23

07 Sep '23

'Today, the Mozilla Foundation published its analysis of how well automakers handle the privacy of data collected by their connected cars, and the results will be unlikely to surprise any regular reader of Ars Technica. The researchers were horrified by their findings, stating that "cars are the worst product category we have ever reviewed for privacy." Mozilla looked at 25 car brands and found that all of them collected too much personal data, and from multiple sources—monitoring not just which buttons you push or what you do in any of the infotainment system's apps but also data from other sources like satellite radio or third-party maps. Or even when you connect your phone—remember that prompt asking you if you wanted to share all your contacts and notes with your car when you connected it via Bluetooth? While some gathered data seems innocuous or even helpful—feedback to improve cabin ergonomics and UIs, for example—some data is decidedly not. For example, Nissan's privacy policy says it can collect "sensitive personal information, including driver’s license number, national or state identification number, citizenship status, immigration status, race, national origin, religious or philosophical beliefs, sexual orientation, sexual activity, precise geolocation, health diagnosis data, and genetic information," although it's unlikely your car knows whether you're getting busy in the back seat. While this might be technically possible with a car fitted with a camera-based driver-monitoring system, Nissan's privacy policy notes the data source for the quoted paragraph as "direct contact with users and Nissan employees." (Although more sophisticated driver-monitoring systems that claim to detect emotional states have been demonstrated at shows like CES, we're unaware of any that are in production.) Mozilla found plenty more to worry about. Eighty-four percent of the brands they analyzed said they can share your data, and 76 percent said they can sell it. And more than half say they'll share data with the government and law enforcement by request. Users have very little control over what those brands do with their data. Only two of the 25 brands (Renault and Dacia) tell users they have the right to have their data deleted, and neither sell cars in the United States.' -- source: https://arstechnica.com/cars/2023/09/connected-cars-are-a-privacy-nightmare… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ArcaOS 5.1.0 (OEM OS/2 Warp Operating System) Now Available
by Peter Reutemann 04 Sep '23

04 Sep '23

'ArcaOS 5.1.0 is an OEM distribution of IBM's discontinued OS/2 Warp operating system. This new version of ArcaOS offers UEFI compatibility allowing it to run in modern x86 hardware and also includes the ability to install to GPT-based disk layouts. At OS2World the OS/2 community has been called upon to report supported hardware, open source any OS/2 software, make public as much OS/2 documentation as possible and post the important platform links. OS2World insists that open source has helped OS/2 in the past years and it is time to look under the hood to try to clone internal components like Control Program, Presentation Manager, SOM and Workplace Shell.' -- source: https://tech.slashdot.org/story/23/09/02/1912223 The one and only time I came across OS/2 was in the late 90s (at a bank)... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

ReiserFS is now “obsolete” in the Linux kernel and should be gone by 2025
by Peter Reutemann 01 Sep '23

01 Sep '23

'When Apple was about to introduce Time Machine in Mac OS X Leopard, John Siracusa wrote in the summer of 2006 about how a new file system should be coming to Macs (which it did, 11 years later). The Mac, Siracusa wrote, needed something that could efficiently handle lots of tiny files, volume management with pooled storage, checksum-based data integrity, and snapshots. It needed something like ZFS or, perhaps, ReiserFS, file systems “notable for their willingness to reconsider past assumptions about file system design.” Two months later, the name Reiser would lose most of its prestige and pick up a tragic association it would never shake. Police arrested the file system’s namesake, Hans Reiser, and charged him with murder in connection with the disappearance of his estranged wife. Reiser’s work on Linux file systems was essentially sentenced to obscurity from that point on. Now that designation has been made official, as the file system that was once the default on systems like SUSE Linux has been changed from “Supported” to “Obsolete” in the latest Linux 6.6 kernel merge process (as reported by Phoronix). While a former employee of Reiser’s company, Namesys, continues out-of-source work on later versions of ReiserFS, it is likely to disappear from the kernel entirely in a matter of years, likely 2025. It's an ignoble end for a filesystem that, at one time, could have been the next big thing for Linux file systems.' -- source: https://arstechnica.com/gadgets/2023/08/the-torrid-saga-of-reiserfs-nears-i… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Removes Fake Signal and Telegram Apps Hosted on Play
by Peter Reutemann 01 Sep '23

01 Sep '23

'Researchers say they have found fake apps in Google Play that masqueraded as legitimate ones for the Signal and Telegram messaging platforms. The malicious apps could pull messages or other sensitive information from legitimate accounts when users took certain actions. ArsTechnica: An app with the name Signal Plus Messenger was available on Play for nine months and had been downloaded from Play roughly 100 times before Google took it down last April after being tipped off by security firm ESET. It was also available in the Samsung app store and on signalplus[.]org, a dedicated website mimicking the official Signal.org. An app calling itself FlyGram, meanwhile, was created by the same threat actor and was available through the same three channels. Google removed it from Play in 2021. Both apps remain available in the Samsung store. Both apps were built on open source code available from Signal and Telegram. Interwoven into that code was an espionage tool tracked as BadBazaar. The Trojan has been linked to a China-aligned hacking group tracked as GREF. BadBazaar has been used previously to target Uyghurs and other Turkic ethnic minorities. The FlyGram malware was also shared in a Uyghur Telegram group, further aligning it to previous targeting by the BadBazaar malware family. Signal Plus could monitor sent and received messages and contacts if people connected their infected device to their legitimate Signal number, as is normal when someone first installs Signal on their device. Doing so caused the malicious app to send a host of private information to the attacker, including the device IMEI number, phone number, MAC address, operator details, location data, Wi-Fi information, emails for Google accounts, contact list, and a PIN used to transfer texts in the event one was set up by the user.' -- source: https://tech.slashdot.org/story/23/08/31/1655233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

With Version 117, Firefox Finally Speaks Chrome's Translation Language
by Peter Reutemann 01 Sep '23

01 Sep '23

'The latest version of the flagship FOSS browser is out, and it's picked up one of the main features for which we keep Chrome around. >From a report: The Firefox version 117 feature list might not look all that impressive, but it does have a big-ticket feature that may tempt people back: automatic translation. The snag is it's disabled by default in the release version, and you'll have to manually enable it. Although it was enabled in the betas, Mozilla has decided to go for a staged rollout and not enable it for everyone until Firefox 118 in six weeks or so. The new feature is integrated, privacy-respecting machine translation between multiple languages. This was already possible in older versions, but it needed an extension, and that had two side effects. One is that the extension hooked deep into the core of the browser in ways that Mozilla wasn't comfortable about, and the other is that once your text had been sent out to a third-party website, it could be snooped upon -- but the victims of any snooping would blame the browser, even if it wasn't the browser's fault. To enable it, go to the configuration page (enter about:config in the address bar), and search for a setting called browser.translations.enable.' -- source: https://tech.slashdot.org/story/23/08/31/1658259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FreeBSD Can Now Boot in 25 Milliseconds
by Peter Reutemann 31 Aug '23

31 Aug '23

'Replacing a sort algorithm in the FreeBSD kernel has improved its boot speed by a factor of 100 or more... and although it's aimed at a micro-VM, the gains should benefit everyone. From a report: MicroVMs are a hot area of technology R&D in the last half decade or so. The core idea is a re-invention of some of concepts and technology that IBM invented along with the hypervisor in the 1960s: designing OSes specifically to run as guests under another OS. This means building the OS specifically to run inside a VM, and to talk to resources provided by a specific hypervisor rather than to fake hardware. This means that the guest OS needs next to no support for real hardware, just VirtIO drivers which talk directly to facilities provided by the host hypervisor. In turn, the hypervisor doesn't have to provide an emulated PCI bus, emulated power management, emulated graphics card, emulated network interface cards, and so on. The result is that the hypervisor itself can be much smaller and simpler. The result of ruthlessly chopping down both the hypervisor, and the OS that runs inside it, is that both ends can be much smaller and simpler. That means that VMs can use much fewer resources, and start up much quicker.' -- source: https://tech.slashdot.org/story/23/08/30/1525238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nautilus File Manager Gets New Features in Upcoming GNOME 45
by Peter Reutemann 29 Aug '23

29 Aug '23

'The upcoming release of GNOME 45 — expected September 20th — will bring new features to the Nautilus file manager (now in public beta testing). An anonymous reader shared this report from 9to5Linux: Nautilus in GNOME 45 already received a search performance boost, support for dropping images directly from web pages, an improved Grid View that now indicates starred files too, the ability to display bytes size as a tooltip for folder properties, and a more adaptive design for the sidebar. It also got an improved file opening experience while sandboxed (think Flatpak, Snap, etc.), a more consistent date and time format, a more simplistic definition of the Keyboard Shortcuts window, the ability to refocus the search bar using the Ctrl+F keyboard shortcut, and a better archiving experience. But there's room for more new features as Nautilus now received new "Search Everywhere" buttons to expand the search scope and a modern full-height sidebar layout, along with refined sidebar sizing and folding threshold. This is what Nautilus looks like in GNOME 45. The article includes some screenshots, adding that Nautilus "also received some performance improvements to more quickly generate multiple thumbnails, provide users with flickerless transition into and from search, and avoid DBus-activating other apps when it starts."' -- source: https://linux.slashdot.org/story/23/08/27/2329227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux What's New in Linux 6.5?
by Peter Reutemann 28 Aug '23

28 Aug '23

'9to5Linux: Just a couple of days after celebrating its 32nd anniversary , Linus Torvalds announced today the final release of the Linux 6.5 kernel series as a major update that introduces several new features, updated and new drivers for better hardware support, and other changes. After seven weeks of RCs, Linux kernel 6.5 is here with new features like MIDI 2.0 support in ALSA, ACPI support for the RISC-V architecture, Landlock support for UML (User-Mode Linux), better support for AMD "Zen" systems, as well as user-space support for the ARMv8.8 memcpy/memset instructions. Also new in Linux 6.5 is Intel TPMI (Topology Aware Register and PM Capsule Interface) support for the power capping subsystem and a TPMI interface driver for Intel RAPL, and the "runnable boosting" feature in the EAS balancer to improve CPU utilization for specific workloads. This release also improves SMP scheduling's load balancer to recognize SMT cores with more than one busy sibling and allows lower-priority CPUs to pull tasks to avoid superfluous migrations, and improves EXT4 file system's journalling, block allocator subsystems, and performance for parallel DIO overwrites.' -- source: https://linux.slashdot.org/story/23/08/27/2316212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Can You Run Linux On a Commodore 64?
by Peter Reutemann 28 Aug '23

28 Aug '23

'llvm-mos adapts the popular LLVM compiler to target the MOS 6502 processor (the 1980s microprocessor used in early home computing devices like the Apple II and the Commodore 64). So developer Onno Kortman used it to cross-compile semu, a "minimalist RISC-V system emulator capable of running Linux the kernel and corresponding userland." And by the end of the day, Kortman has Linux running on a Commodore 64. Long-time Slashdot reader johnwbyrd shared the link to Kortman's repository. Some quotes: "But does it run Linux?" can now be finally and affirmatively answered for the Commodore C64...! It runs extremely slowly and it needs a RAM Expansion Unit (REU), as there is no chance to fit it all into just 64KiB. It even emulates virtual memory with an MMU.... The screenshots took VICE a couple hours in "warp mode" (activate it with Alt-W) to generate. So, as is, a real C64 should be able to boot Linux within a week or so. The compiled 6502 code is not really optimized yet, and it might be realistic to squeeze a factor 10x of performance out of this. Maybe even a simple form of JIT compilation? It should also be possible to implement starting a checkpointed VM (quickly precomputed on x86-64) to avoid the lengthy boot process... I also tested a minimal micropython port (I can clean it up and post it on github if there is interest), that one does not use the MMU and is almost barely remotely usable with lots of optimism at 100% speed. A key passage: I have not tested it on real hardware yet, that's the next challenge .. for you. So please send me a link to a timelapse video of an original unit with REU booting Linux :D Its GitHub repository has build and run instructions...' -- source: https://linux.slashdot.org/story/23/08/27/1532207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bloomberg Terminals Still Exist
by Lawrence D'Oliveiro 27 Aug '23

27 Aug '23

Bloomberg still supplies special terminals for accessing the services it provides, and those services cost a pretty penny -- over $40,000 a year for each. And Kāinga Ora has seven of the things <https://www.nzherald.co.nz/nz/politics/kainga-ora-spends-more-than-300000-a…>. These things have a long history. A look at some older versions: <https://www.bloomberg.com/professional/blog/look-back-bloomberg-keyboard/>.

1 0

When A Certificate Authority Is Too Big To Fail
by Lawrence D'Oliveiro 26 Aug '23

26 Aug '23

Certificate authorities (CAs) have a crucial role in the chain of trust that binds the computing world together right now. So when it turns out that a rather large company (Symantec) has been issuing dodgy certificates for many years, the ramifications run uncomfortably wide. Google has been gradually winding down its trust of Symantec-issued over a multiyear period, because blocking them all at once would just be too painful for its users. It turns out some of these CAs are also used for signing applications for Windows. Microsoft finally got around to blocking the Symantec one within the last few days, only to abruptly reverse course and trust it again, because it caused serious trouble for too many Windows systems <https://arstechnica.com/security/2023/08/a-renegade-certificate-is-removed-…>. The applications concerned should have been updated to not depend on such a worthless CA. But it seems, ensuring Windows users update all their relevant apps can be a mountain just too high to climb.

1 0

Firefox Users May Import Chrome Extensions Now
by Peter Reutemann 25 Aug '23

25 Aug '23

'Mozilla has implemented the WebExtensions system in its browser, allowing Firefox users to import select extensions from other browsers like Chrome. gHacks reports: The feature, which is in testing at the moment, can be enabled by all users of the latest stable version of Firefox. 1. Load about:config in the browser's address bar. 2. Confirm that you will be careful to continue. 3. Search for browser.migrate.chrome.extensions.enabled. 4. Set the feature to True, which enables it. 5. Restart Firefox. Mozilla has integrated it into the browser's import functionality, which users may use on first run or at any time from the Settings page. To do so, select Menu > Settings > Import Data (button), or load about:preferences#general in the browser's address bar and activate the import data button on the page. Select Chrome from the list, expand the available import options and make sure extensions are checked. Imports are usually limited to some data, such as bookmarks or the browsing history. Firefox is the first major browser, maybe the first browser at all, that adds extensions to the list of supported imports. The feature is limited at the time to Google Chrome and select extensions. Even though Firefox and Chrome extensions use the same framework, WebExtensions, they are not compatible immediately. Firefox users who attempt to install extensions from Chrome's Web Store may notice that this is not working. Mozilla decided to create a list of extension pairs for extensions that are available on the Chrome Web Store and the Mozilla Add-ons Store. Instead of importing the Chrome extension directly, Firefox is installing the Firefox version of the extension from Mozilla's own extension store. ' -- source: https://news.slashdot.org/story/23/08/24/2233242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WinRAR Flaw Lets Hackers Run Programs When You Open RAR Archives
by Peter Reutemann 23 Aug '23

23 Aug '23

'A critical vulnerability (CVE-2023-40477) has been patched in WinRAR, enabling remote attackers to execute arbitrary code by luring victims into opening a specially crafted RAR file. The severity rating is only 7.8 though due to user deception being necessary. BleepingComputer reports: The vulnerability was discovered by researcher "goodbyeselene" of Zero Day Initiative, who reported the flaw to the vendor, RARLAB, on June 8th, 2023. "The specific flaw exists within the processing of recovery volumes," reads the security advisory released on ZDI's site. "The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer." RARLAB released WinRAR version 6.23 on August 2nd, 2023, effectively addressing CVE-2023-40477. Therefore, WinRAR users are strongly advised to apply the available security update immediately. Apart from the RAR4 recovery volumes processing code fix, version 6.23 addresses an issue with specially crafted archives leading to wrong file initiation, which is also considered a high-severity problem.' -- source: https://it.slashdot.org/story/23/08/18/2157249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Latest Android Runtime (ART) Update Led To Apps Starting 30% Faster
by Peter Reutemann 22 Aug '23

22 Aug '23

'The latest update to the Android Runtime (ART) -- the "engine behind the Android operating system (OS)" -- has resulted in app startup time "improvements of up to 30% on some devices," says Google. 9to5Google reports: Behind the scenes, "ART is the same for all devices" and: "The ART APEX module is a complex piece of software with an order of magnitude more APIs than any other APEX module. It also backs a quarter of the developer APIs available in the Android SDK. In addition, ART has a compiler that aims to make the most of the underlying hardware by generating chipset-specific instructions, such as Arm SVE." The testing process for Android Runtime updates involves "compiling over 18 million APKs and running app compatibility tests, and startup, performance, and memory benchmarks on a variety of Android devices that replicate the diversity of our ecosystem as closely as possible." There's then a very gradual rollout process. Google also notes developer improvements with every update "like OpenJDK improvements and compiler optimizations that benefit both Java and Kotlin," with ART 13 resulting in the "fastest-ever adoption of a new OpenJDK [11] release on Android devices." ART 14 is rolling out "in the coming months" with "new compiler and runtime optimizations that improve performance while reducing code size," as well as OpenJDK 17.' -- source: https://slashdot.org/story/23/08/21/212202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AlmaLinux Leader Says Red Hat's Code Crackdown Isn't a Threat
by Peter Reutemann 21 Aug '23

21 Aug '23

'Yes, Red Hat Enterprise Linux changed its licensing last month — but how will that affect AlmaLinux? The chair of the nonprofit AlmaLinux OS Foundation, benny Vasquez, tells SiliconANGLE that "For typical users, there's very, very little difference. Overall, we're still exactly the same way we were, except for kernel updates." Updates may no longer be available the day a new version of RHEL comes out, but developers still have access to Red Hat's planned enhancements and bug fixes via CentOS Stream, a version of RHEL that Red Hat uses as essentially a test bed for new features that might later be incorporated into its flagship product. From a practical perspective, that's nearly as good as having access to the production source code, Vasquez said. "While there is a generally accepted understanding that not everything in CentOS Stream will end up in RHEL, that's not how it works in practice," she said. "I can't think of anything they have shipped in RHEL that wasn't in Stream first." That's still no guarantee, but the workarounds AlmaLinux has put in place over the past month should address all but the most outlier cases, Vasquez said. The strategy has shifted from bug-for-bug compatibility to being application binary interface-compatible... ABI compatibility doesn't guarantee that problems will never occur, but glitches should be rare and can usually be resolved by recompiling the source code. "It is sufficient for us to be ABI-compatible with RHEL," Vasquez said. "The most important thing is that this allows our community to feel stability." In fact, Red Hat's change of direction has been a blessing in disguise for AlmaLinux, she said... "We view this as a release from our bonds of being one-to-one." Patches can be applied without waiting for a cue from Red Hat and "we get to engage with our community in a completely new and exciting way." AlmaLinux has also seen a modest financial windfall from Red Hat's decision. "The outpouring of support has been pretty impressive," Vasquez said. "People have shown up for event staffing and website maintenance and infrastructure management and we've gotten more financial backing from corporations." Vasquez also told the site that "the number of everyday people throwing in $5 has more than quadrupled."' -- source: https://linux.slashdot.org/story/23/08/20/0247259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian Turns 30
by Peter Reutemann 18 Aug '23

18 Aug '23

'Debian blog: Over 30 years ago the late Ian Murdock wrote to the comp.os.linux.development newsgroup about the completion of a brand-new Linux release which he named "The Debian Linux Release." He built the release by hand, from scratch, so to speak. Ian laid out guidelines for how this new release would work, what approach the release would take regarding its size, manner of upgrades, installation procedures; and with great care of consideration for users without Internet connection. Unaware that he had sparked a movement in the fledgling F/OSS community, Ian worked on and continued to work on Debian. The release, now aided by volunteers from the newsgroup and around the world, grew and continues to grow as one of the largest and oldest FREE operating systems that still exist today. Debian at its core is comprised of Users, Contributors, Developers, and Sponsors, but most importantly, People. Ians drive and focus remains embedded in the core of Debian, it remains in all of our work, it remains in the minds and hands of the users of The Universal Operating System. The Debian Project is proud and happy to share our anniversary not exclusively unto ourselves, instead we share this moment with everyone, as we come together in celebration of a resounding community that works together, effects change, and continues to make a difference, not just in our work but around the world. Debian is present in cluster systems, datacenters, desktop computers, embedded systems, IoT devices, laptops, servers, it may possibly be powering the web server and device you are reading this article on, and it can also be found in Spacecraft.' -- source: https://linux.slashdot.org/story/23/08/17/136231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Farewell, Type-1 Fonts
by Lawrence D'Oliveiro 17 Aug '23

17 Aug '23

Following the lead of other vendors, now Adobe itself is abandoning support for the venerable “Type 1” font format that it created <https://arstechnica.com/gadgets/2023/08/microsoft-adobe-and-others-have-dro…>. Back in the days when PostScript printers were new and wonderful things, the PostScript language was an open, published spec, but the high-quality font format that Adobe’s printers used was not. This format included a “secret sauce” in the form of “hints” to the rasterizer that smoothed out irregularities. Because if you took letter shapes expressed as scalable vector graphics and tried rendering them in a straight geometric fashion at typical text sizes on a black-and-white output device, even at as high as 300 dpi, there would be a noticeable roughness to the shapes. Nowadays the techniques for applying such hinting are no longer such a big secret. However, I take issue with this bit: ... it's possible that you created a document in 2022 that you simply won't be able to open in 2023. The change will also cause problems if you open and work with decades-old files with any kind of regularity; files that use Type 1 fonts will begin generating lots of "missing font" messages ... As far as I know, office-type and layout-type apps do not typically embed fonts in the document. Instead, they store font-matching information (family name, weight etc) that will be used to find the best available fonts when the document is next opened, perhaps on a different system. Remember, it is only the old font format that is being dropped; the same classic, professional-quality font designs that people have been using for years or decades will still be available, just in the newer formats. So a proper font match, if it is installed, can still be found. A self-contained document format like PDF does embed fonts (typically only in subset form), but that has its own internal font representation, so it should not be affected by the demise of Type-1. This part is true, though: You'll also either need to convert any specialized PostScript Type 1 font that you may have paid for in the past or pay for an equivalent OpenType alternative. This article <https://www.prepressure.com/fonts/basics/history> is a good potted history of font formats (the important ones, at any rate). By the way, I don’t think the open-source FreeType library is dropping support for Type-1 font rendering any time soon. It still handles Multiple Master fonts, which Adobe gave up on a long time ago.

1 1

Windows Server Forgets What Time It Is
by Lawrence D'Oliveiro 17 Aug '23

17 Aug '23

Seems that, some years ago, Microsoft added a “feature” to Windows Server, called “Secure Time Seeding”. This was supposed to offer alternative ways for a server machine to keep track of the correct time, in the event of failures in the more usual mechanisms. Unfortunately, this “feature” only seems to have introduced a new source of problems, where the server can suddenly throw its date and time setting off by as much as several months, often with unfortunate consequences for the applications running on it <https://arstechnica.com/security/2023/08/windows-feature-that-resets-system…>. At this stage, Microsoft is still in the “no comment” stage of (not) responding to this problem. Reports of issues go right back to the introduction of the feature, back in 2016. They may only be happening intermittently, but it seems to me this is still enough to damage what trust there may still be left in Microsoft’s product.

1 0

Firefox Finally Outperforming Google Chrome In SunSpider
by Peter Reutemann 16 Aug '23

16 Aug '23

'Michael Larabel writes via Phoronix: Mozilla developers are celebrating that they are now faster than Google Chrome with the SunSpider JavaScript benchmark, although that test has been superseded by the JetStream benchmark. Last week a new Firefox Nightly News was published that outlines that "We're now apparently beating Chrome on the SunSpider JavaScript benchmark!" The provided numbers now show Firefox easily beating Chrome in this decade-old JavaScript benchmark. The benchmarks come from AreWeFastYet.com. Meanwhile for the newer and more demanding JetStream 2.0 benchmark, Google Chrome continues to win easily over Firefox. ' -- source: https://news.slashdot.org/story/23/08/15/2015210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

From The “How Not To Design A Website” Department
by Lawrence D'Oliveiro 15 Aug '23

15 Aug '23

Found a link to some past news items on this site reporting on Munich city’s back-and-forth migrations between Linux and Windows. The last linked item was this <https://www.ip-watch.org/2018/06/12/former-munich-mayor-warns-negative-effe…>. Bad enough that that light, thin text is almost unreadable against a similarly-coloured background, I decided to search the site for “munich” to see if I could find a more recent item, and got this: <https://www.ip-watch.org/?s=munich>. In case they fix it later, the top part has this message: Deprecated: strlen(): Passing null to parameter #1 ($string) of type string is deprecated in /home/clients/5bc716f64eaa5eb2ef6cc74a6b9b690a/web/weblog/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/utils.php on line 445 and at the bottom it says “Not found, error 404” and that the page I am looking for (search results??) no longer exists. Who knew? Mind you, PHP is the only language where features can be marked “no longer deprecated” in later releases, so who knows, perhaps they will later decide to assign a meaning to finding the length of a string when the string isn’t actually a string ...

1 0

Should There Be an 'Official' Version of Linux?
by C. A. Fillekes 15 Aug '23

15 Aug '23

I was surprised, a couple years ago, to find that most of my gnome desktop applications had ceased being exportable to different machines' displays over the network. Even Firefox. Ordinary vanilla X11 is unwieldy, but it at least had that one key feature, and has had it since well before MS Windows ruined everything.

1 0

Should There Be an 'Official' Version of Linux?
by Peter Reutemann 14 Aug '23

14 Aug '23

'Why aren't more people using Linux on the desktop? Slashdot reader technology_dude shares one solution: Jack Wallen at ZDNet says establishing an "official" version of Linux may (or may not) help Linux on the desktop increase the number of users, mostly as someplace to point new users. It makes sense to me. What does Slashdot think and what would be the challenges, other than acceptance of a particular flavor? Wallen argues this would also create a standard for hardware and software vendors to target, which "could equate to even more software and hardware being made available to Linux." (And an "official" Linux might also be more appealing to business users.) Wallen suggests it be "maintained and controlled by a collective of people from users, developers, and corporations (such as Intel and AMD) with a vested interest in the success of this project... There would also be corporate backing for things like marketing (such as TV commercials)." He also suggests basing it on Debian, and supporting both Snap and Flatpak... In comments on the original submission, long-time Slashdot reader bobbomo points instead to kernel.org, arguing "There already is an official version of Linux called mainline. Everything else is backports." And jd (Slashdot user #1,658) believes that the official Linux is the Linux Standard Base. "All distributions, more-or-less, conform to the LSB, which gives you a pseudo 'official' Linux. About the one variable is the package manager. And there are ways to work around that." Unfortunately, according to Wikipedia... The LSB standard stopped being updated in 2015 and current Linux distributions do not adhere to or offer it; however, the lsb_release command is sometimes still available.[citation needed] On February 7, 2023, a former maintainer of the LSB wrote, "The LSB project is essentially abandoned." That post (on the lsb-discuss mailing list) argues the LSB approach was "partially superseded" by Snaps and Flatpaks (for application portability and stability). And of course, long-time Slashdot user menkhaura shares the obligatory XKCD comic... It's not exactly the same thing, but days after ZDNet's article, CIQ, Oracle, and SUSE announced the Open Enterprise Linux Association, a new collaborative trade association to foster "the development of distributions compatible with Red Hat Enterprise Linux." So where does that leave us? Share your own thoughts in the comments. And should there be an "official" version of Linux?' -- source: https://linux.slashdot.org/story/23/08/12/1835204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Does Desktop Linux Have a Firefox Problem?
by Peter Reutemann 14 Aug '23

14 Aug '23

'OS News' managing editor calls Firefox "the single most important desktop Linux application," shipping in most distros (with some users later opting for a post-installation download of Chrome). But "I'm genuinely worried about the state of browsers on Linux, and the future of Firefox on Linux in particular..." While both GNOME and KDE nominally invest in their own two browsers, GNOME Web and Falkon, their uptake is limited and releases few and far between. For instance, none of the major Linux distributions ship GNOME Web as their default browser, and it lacks many of the features users come to expect from a browser. Falkon, meanwhile, is updated only sporadically, often going years between releases. Worse yet, Falkon uses Chromium through QtWebEngine, and GNOME Web uses WebKit (which are updated separately from the browser, so browser releases are not always a solid metric!), so both are dependent on the goodwill of two of the most ruthless corporations in the world, Google and Apple respectively. Even Firefox itself, even though it's clearly the browser of choice of distributions and Linux users alike, does not consider Linux a first-tier platform. Firefox is first and foremost a Windows browser, followed by macOS second, and Linux third. The love the Linux world has for Firefox is not reciprocated by Mozilla in the same way, and this shows in various places where issues fixed and addressed on the Windows side are ignored on the Linux side for years or longer. The best and most visible example of that is hardware video acceleration. This feature has been a default part of the Windows version since forever, but it wasn't enabled by default for Linux until Firefox 115, released only in early July 2023. Even then, the feature is only enabled by default for users of Intel graphics — AMD and Nvidia users need not apply. This lack of video acceleration was — and for AMD and Nvidia users, still is — a major contributing factor to Linux battery life on laptops taking a serious hit compared to their Windows counterparts... It's not just hardware accelerated video decoding. Gesture support has taken much longer to arrive on the Linux version than it did on the Windows version — things like using swipes to go back and forward, or pinch to zoom on images... I don't see anyone talking about this problem, or planning for the eventual possible demise of Firefox, what that would mean for the Linux desktop, and how it can be avoided or mitigated. In an ideal world, the major stakeholders of the Linux desktop — KDE, GNOME, the various major distributions — would get together and seriously consider a plan of action. The best possible solution, in my view, would be to fork one of the major browser engines (or pick one and significantly invest in it), and modify this engine and tailor it specifically for the Linux desktop. Stop living off the scraps and leftovers thrown across the fence from Windows and macOS browser makers, and focus entirely on making a browser engine that is optimised fully for Linux, its graphics stack, and its desktops. Have the major stakeholders work together on a Linux-first — or even Linux-only — browser engine, leaving the graphical front-end to the various toolkits and desktop environments.... I think it's highly irresponsible of the various prominent players in the desktop Linux community, from GNOME to KDE, from Ubuntu to Fedora, to seemingly have absolutely zero contingency plans for when Firefox enshittifies or dies...' -- source: https://news.slashdot.org/story/23/08/13/226217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Mozilla To Bring Firefox Desktop Extension To Android Browser
by Peter Reutemann 12 Aug '23

12 Aug '23

'Scott DeVaney, writing at Mozilla blog: In the coming months Mozilla will launch support for an open ecosystem of extensions on Firefox for Android on addons.mozilla.org (AMO). We'll announce a definite launch date in early September, but it's safe to expect a roll-out before the year's end. Here's everything developers need to know to get their Firefox desktop extensions ready for Android usage and discoverability on AMO. For the past few years Firefox for Android officially supported a small subset of extensions while we focused our efforts on strengthening core Firefox for Android functionality and understanding the unique needs of mobile browser users. Today, Mozilla has built the infrastructure necessary to support an open extension ecosystem on Firefox for Android. We anticipate considerable user demand for more extensions on Firefox for Android, so why not start optimizing your desktop extension for mobile-use right away?' -- source: https://news.slashdot.org/story/23/08/11/1234201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'The Open Source Licensing War is Over'
by Peter Reutemann 12 Aug '23

12 Aug '23

'It's time for the open source Rambos to stop fighting and agree that developers care more about software's access and ease of use than the purity of its license, reads a piece on InfoWorld. From the report: The open source war is over, however much some want to continue soldiering on. Recently Meta (Facebook) released Llama 2, a powerful large language model (LLM) with more than 70 billion parameters. In the past, Meta had restricted use of its LLMs to research purposes, but with Llama 2, Meta opened it up; the only restriction is that it can't be used for commercial purposes. Only a handful of companies have the computational horsepower to deploy it at scale (Google, Amazon, and very, very few others). This means, of course, it's not "open source" according to the Open Source Definition (OSD), despite Meta advertising it as such. This has a few open source advocates crying, Rambo style, "They drew first blood!" and "Nothing is over! Nothing! You just don't turn it off!", insistent that Meta stop calling Llama 2 "open source." They're right, in a pedantic sort of way, but they also don't seem to realize just how irrelevant their concerns are. For years developers have been voting with their GitHub repositories to pick "open enough." It's not that open source doesn't matter, but rather it has never mattered in the way some hoped or believed. More than 10 years ago, the trend toward permissive licensing was so pronounced that RedMonk analyst James Governor declared, "Younger [developers] today are about POSS -- post open source software. [Screw] the license and governance, just commit to GitHub." In response, people in the comments fretted and scolded, saying past trends like this had resulted in "epic clusterf-s" or that "promiscuous sharing w/out a license leads to software-transmitted diseases." And yet, millions of unlicensed GitHub repositories later, we haven't entered the dark ages of software licensing. Open source, or "open enough," software now finds its way into pretty much all software, however it ends up being licensed to the end user. Ideal? Perhaps not. But a fact of life? Yep. In response, GitHub and others have devised ways to entice developers to pick open source licenses to govern their projects. As I wrote back in 2014, all these moves will likely help, but the reality is that they also won't matter. They won't matter because "open source" doesn't really matter anymore. Not as some countercultural raging against the corporate software machine, anyway. All of this led me to conclude we're in the midst of the post-open source revolution, a revolution in which software matters more than ever, but its licensing matters less and less.' -- source: https://news.slashdot.org/story/23/08/11/1221250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The Eternal Sunshine Of The SEO-Focused Site
by Lawrence D'Oliveiro 11 Aug '23

11 Aug '23

This report <https://arstechnica.com/information-technology/2023/08/the-internet-is-not-…> says that CNET, and possibly other large sites, are deleting online archives of decades-old articles in an effort to improve their rankings with search engines like Google. Google, on the other hand, is saying that such behaviour makes no difference to their rankings. I found the closing paragraph particularly interesting: From time immemorial, the protection of historical content has required making many copies without authorization, regardless of the cultural or business forces at play, and that has not changed with the Internet. Archivists operate in a parallel IP universe, borrowing scraps of reality and keeping them safe until shortsighted business decisions and copyright protectionism die down. Hopefully, despite the link rot, future historians can piece together an accurate history of our fragile digital era. In there is a link to this item from the same author <https://www.technologizer.com/2012/01/23/why-history-needs-software-piracy/>, from over a decade ago, on “Why History Needs Software Piracy”: When viewed in a historical context, the benefits of software piracy far outweigh its short-term costs. If you care about the history of technology, in fact, you should be thankful that people copy software without permission.

1 0

Abuses Of AI #397: Pak’N’Save’s Savey-Meal Bot Goes Off The Rails
by Lawrence D'Oliveiro 11 Aug '23

11 Aug '23

I wonder whose bright idea it was to offer an AI-powered recipe advisor that offered free-text input <https://www.theregister.com/2023/08/11/supermarket_reins_in_ai_recipebot/>. So naturally somebody tried entering such hazardous ingredients as ammonia and bleach, to see if the bot would make up a recipe from them. Which it did. Complete with glowing recommendations like “the perfect non-alcoholic beverage to quench your thirst and refresh your senses. It combines the invigorating scents of ammonia, bleach, and water for a truly unique experience!" It has since been revised to be a bit more, ah, conservative with its suggestions, and also only allow selection from a limited list of ingredients. Though a reader suggests that the list restriction is only implemented within the HTML page itself, not in the actual back end.

1 0

Intel's GPU Drivers Now Collect Telemetry, Including 'How You Use Your Computer'
by Peter Reutemann 10 Aug '23

10 Aug '23

'ExtremeTech: Intel has introduced a telemetry collection service by default in the latest beta driver for its Arc GPUs. You can opt out of it, but we all know most people just click "yes" to everything during a software installation. Intel's release notes for the drivers don't mention this change to how its drivers work, which is a curious omission. News of Intel adding telemetry collection to its drivers is a significant change to how its GPU drivers work. Intel has even given this new collation routine a cute name -- the Intel Computing Improvement Program. Gee, that sounds pretty wonderful. We want to improve our computing, so let's dive into the details briefly. According to TechPowerUp, which discovered the change, Intel has created a landing page for the program that explains what is collected and what isn't. At a high level, it states, "This program uses information about your computer's performance to make product improvements that may benefit you in the future." Though that sounds innocuous, Intel provides a long list of the types of data it collects, many unrelated to your computer's performance. Those include the types of websites you visit, which Intel says are dumped into 30 categories and logged without URLs or information that identifies you, including how long and how often you visit certain types of sites. It also collects information on "how you use your computer" but offers no details. It will also identify "Other devices in your computing environment." Numerous performance-related data points are also captured, such as your CPU model, display resolution, how much memory you have, and, oddly, your laptop's average battery life. The good news is that Intel allows you to opt out of this program, which is not the case with Nvidia. According to TechPowerUp, they don't even ask for permission! As for AMD, they not only give you a choice to opt out but they also explain what data they're collecting.' -- source: https://yro.slashdot.org/story/23/08/09/2030205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Visual Studio Code flaw lets extensions steal passwords
by Peter Reutemann 10 Aug '23

10 Aug '23

'Microsoft's Visual Studio Code (VS Code) code editor and development environment contains a flaw that allows malicious extensions to retrieve authentication tokens stored in Windows, Linux, and macOS credential managers. These tokens are used for integrating with various third-party services and APIs, such as Git, GitHub, and other coding platforms, so stealing them could have significant consequences for a compromised organization's data security, potentially leading to unauthorized system access, data breaches, etc. The flaw was discovered by Cycode researchers, who reported it to Microsoft along with a working proof-of-concept (PoC) they developed. Yet, the tech giant decided against fixing the issue, as extensions are not expected to be sandboxed from the rest of the environment.' -- source: https://www.bleepingcomputer.com/news/security/microsoft-visual-studio-code… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bram Moolenaar, Author of the Open Source Vim Code Editor, Has Died
by Peter Reutemann 08 Aug '23

08 Aug '23

'The creator of one of the most popular programming editors of all time, Vim, has died after a brief illness. :wq. You may not have known Bram Moolenaar’s name, but all developers know his open source programming editor, Vim. His family has reported to the Vim announcement list that Moolenaar has died. According to the note, “Bram Moolenaar passed away on 3 August 2023.” Bram suffered from a medical condition that progressed quickly over the last few weeks.” No further details are available at this time. They added Bram had “dedicated a large part of his life to VIM, and he was very proud of the VIM community that you are all part of.” This is true. Under his guidance, Vim became one of the most popular code editors in the world. Vim was based on Unix’s Vi, a screen-oriented text editor created by Bill Joy that proved to be immensely popular. Indeed, it was my first editor. Its command set, while often used in jokes, is powerful. It’s still embedded in my fingers today. I’m far from the only programmer who can say that.' -- source: https://thenewstack.io/bram-moolenaar-author-of-the-open-source-vim-code-ed… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Qualcomm—one of Arm’s biggest customers—starts a RISC-V joint venture
by Peter Reutemann 07 Aug '23

07 Aug '23

'Arm is facing down its biggest competition ever, with the up-and-coming RISC-V architecture threatening to unseat it as the CPU at the center of almost every portable device. Now, one of Arm's biggest customers is trying out RISC-V, as Qualcomm is getting involved in a joint venture dedicated to the architecture. The joint venture doesn't have a name yet, but Qualcomm, NXP, Nordic Semiconductor, Bosch, and memory giant Infineon are all teaming up to form a new company that Qualcomm's press release says is "aimed at advancing the adoption of RISC-V globally by enabling next-generation hardware development." At first, the group will be focused on automotive uses, with an "eventual expansion" to IoT and mobile, Qualcomm's biggest market. Arm doesn't manufacture any chips itself and instead exists as a design and licensing operation. It licenses both the Arm architecture, allowing companies to design an Arm-compatible chip themselves (this is what Apple does), and it also licenses completed CPU designs, allowing partners like Qualcomm, Samsung, and MediaTek to produce new SoCs year after year. Previously, we would have said Qualcomm's "next-generation hardware" project revolves around its acquisition of Nuvia, a chip design house that was founded by ex-SoC engineers from Apple, which currently makes the fastest mobile ARM chips available. Qualcomm's CPUs all use Arm's designs, and they are regularly a generation or two behind what Apple can do. If Nuvia lives up to its potential, Qualcomm's Arm chips would finally be competitive. The company says chips from Nuvia are expected to hit the market in 2024 for PCs, so Qualcomm will be sticking with Arm for a while longer. Qualcomm's "Snapdragon Automotive" products are usually based on 5-year-old phone designs, but it sounds like that's changing. A RISC-V transition, if one ever comes, is a few years down the line. RISC-V is threatening Arm for a few reasons. First is its open source licensing, which potentially lets companies avoid the fees Arm charges to make any chip compatible with its instruction set. Second is that RISC-V is also a way for companies to insulate themselves from Arm, which has become an increasingly unstable hardware partner. Arm is at the center of most mobile devices, but it doesn't make a ton of money off of this licensing business. ' -- source: https://arstechnica.com/gadgets/2023/08/qualcomm-one-of-arms-biggest-custom… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Asahi Linux’s new “flagship” distro for M-series Macs is a Fedora Remix
by Peter Reutemann 07 Aug '23

07 Aug '23

'Asahi Linux, the project aiming to bring a fully functional Linux system to Apple computers running on that company's own M-series chips, has announced that its new "flagship distro" is Fedora Asahi Remix. As announced at Fedora's Flock conference this week in Cork, Ireland, (and on Asahi Linux's blog), the Fedora Asahi Remix should be officially released by the end of August 2023. You can try it out now, but you should "expect rough spots (or even complete breakage)." The new distro will be "upstream-first," sending as many of its bespoke M-series tools back to Fedora's mainline offerings as possible. Hector Martin, writing on Asahi Linux's blog, notes that the existing project based on Arch Linux was "fully downstream." Asahi added its own package repository with scripts, forked kernel and Mesa packages, bootloader parts, and userspace support, but with "no significant involvement with upstream Arch Linux ARM or Arch Linux." Neal Gompa from Fedora reached out to talk about integrating Asahi with Fedora after the project's debut, and work began in late 2021. Now it's ready to spread a bit further. "Collaborating with distro integration experts and using distro infra(structure) like this frees us up to continue focusing on what we do best: reverse engineer hardware and develop bespoke drivers and software," Martin writes. Integration with a well-established distribution also means that bugs in desktop ARM64 Linux, "a niche platform (until now!)," Martin writes, can be addressed more quickly.' -- source: https://arstechnica.com/gadgets/2023/08/asahi-linux-will-offer-a-flagship-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The State Of ARM
by Lawrence D'Oliveiro 06 Aug '23

06 Aug '23

Everybody knows that ARM dominates the embedded market, where it ships more units per year than the entire population of the Earth. But it is making inroads in, shall we say, more “niche” markets, too, like PCs and servers. According to this <https://www.theregister.com/2023/08/02/arm_server_china/>, Canalys boss Steve Brazier says ARM already makes up 16% of the public cloud (and an even higher proportion of servers in China). But another interesting figure he mentions is “nine percent of PCs”. Now, we know that Windows-on-ARM is not that popular. Therefore, that 9% must be almost entirely running Linux-based OSes, including ChromeOS.

2 4

Linux Surpasses Mac Among Steam Gamers
by Lawrence D'Oliveiro 06 Aug '23

06 Aug '23

Windows dominates non-console gaming, of course. But according to this report <https://arstechnica.com/gadgets/2023/08/linux-surpasses-the-mac-among-steam…>, the number 2 platform (or platform family) is Linux, admittedly quite a way behind at 1.96%, ahead of the Apple Mac at 1.84%. Of the Linux share, 42% is made up of users of the Steam Deck, which is a handheld device (presumably the rest come from the various more conventional desktop distros). Microsoft has taken note of this, and is reportedly working on a “Handheld Mode” for Windows, which so far is still vapourware. Apple is also trying to do its own porting kit for Windows games to run better on Mac, analogous to WINE/Proton for Linux.

1 0

Canon Warns Printer Users To Manually Wipe Wi-Fi Settings Before Discarding
by Peter Reutemann 03 Aug '23

03 Aug '23

'Printer manufacturer Canon is warning that sensitive Wi-Fi settings don't automatically get wiped during resets, so customers should manually delete them before selling, discarding, or getting them repaired to prevent the settings from falling into the wrong hands. >From a report: "Sensitive information on the Wi-Fi connection settings stored in the memories of inkjet printers (home and office/large format) may not be deleted by the usual initialization process," company officials wrote in an advisory on Monday. They went on to say that manual wiping should occur "when your printer may be in the hand of any third party, such as when repairing, lending or disposing the printer." Like many printers these days, those from Canon connect to networks over Wi-Fi. To do this, users must provide the SSID name, the password preventing unauthorized access to the network, and in some cases, additional information such as Wi-Fi network type, the local network IP address, the MAC address, and network profile. It would be reasonable to assume that performing a simple factory reset that returns all settings to their defaults would be enough to remove these settings, but Monday's advisory indicated that isn't necessarily the case. In the event this information is exposed, malicious actors could use them to gain unauthorized access to a network hosting a Canon printer.' -- source: https://hardware.slashdot.org/story/23/08/02/116218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AWS To Start Charging For Public IPv4 Addresses
by Peter Reutemann 01 Aug '23

01 Aug '23

'The Register: Cloud giant AWS will start charging customers for public IPv4 addresses from next year, claiming it is forced to do this because of the increasing scarcity of these and to encourage the use of IPv6 instead. It is now four years since we officially ran out of IPv4 ranges to allocate, and since then, those wanting a new public IPv4 address have had to rely on address ranges being recovered, either from from organizations that close down or those that return addresses they no longer require as they migrate to IPv6. If Amazon's cloud division is to be believed, the difficulty in obtaining public IPv4 addresses has seen the cost of acquiring a single address rise by more than 300 percent over the past five years, and as we all know, the business is a little short of cash at the moment, so is having to pass these costs on to users. "This change reflects our own costs and is also intended to encourage you to be a bit more frugal with your use of public IPv4 addresses and to think about accelerating your adoption of IPv6 as a modernization and conservation measure,' writes AWS Chief Evangelist Jeff Barr, on the company news blog. The update will come into effect on February 1, 2024, when AWS customers will see a charge of $0.005 (half a cent) per IP address per hour for all public IPv4 addresses. These charges will apparently apply whether the address is attached to a service or not, and like many AWS charges, appear inconsequential at first glance but can mount up over time if a customer is using many of them. These charges will apply to all AWS services including EC2, Relational Database Service (RDS) database instances, Elastic Kubernetes Service (EKS) nodes, and will apply across all AWS regions, the company said. However, customers will not be charged for IP addresses that they own and bring to AWS using Amazon's BYOIP feature. AWS offers a free tier for EC2, and this will include 750 hours of public IPv4 address usage per month for the first 12 months, starting from the same date the charges do.' -- source: https://tech.slashdot.org/story/23/08/01/0013249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Python’s GIL, a “major obstacle to concurrency”, will likely be removed – but slowly
by Lawrence D'Oliveiro 01 Aug '23

01 Aug '23

The Python Steering Council has officially decided on a roadmap for removing a major bottleneck to multithreading performance in Python <https://devclass.com/2023/07/31/pythons-gil-a-major-obstacle-to-concurrency…>. Currently Python uses a combination of reference-counting and garbage collection in order to avoid the need for programmers to have to keep track of allocated objects and remembering when to dispose of them. A pure garbage collection scheme, like in Java or LISP, makes it easier to support multithreading, but at the cost of memory usage that can easily get out of hand. Reference counting helps to ensure that objects disappear as soon as the program forgets its last reference to them, and this works well for most objects in a typical program, with garbage collection as a fallback for cleaning up the rest. But Python’s present scheme for maintaining reference counts (the “Global Interpeter Lock” or “GIL”) prevents Python code for taking full advantage of multiple threads. Some are advocating switching to the pure garbage-collection approach, but fortunately (I think) this is not the plan that has been adopted by the Council. Instead, they are going to use a technique known as “Biased Reference Counting”. This splits the reference count into two components, one managed by a thread which is considered to “own” the object (and is presumably responsible for most accesses to the object), while the other is managed on a shared basis by other threads accessing the object (and making fewer accesses to it). This seems to offer the best performance in tests so far. The switchover is a complicated procedure, which is certain to have implications for some existing Python code that never had to worry about thread safety before, as well as far-reaching implications for the design of the CPython implementation itself. So it will take place in multiple stages over some years, and if worst comes to worst, the changes can always be rolled back. (Or a different strategy chosen.) Seems some people are still smarting over the flak they got from the Python 2 → 3 transition. “This is not Python 4,” they are saying. But why not call it “Python 4”, as a warning over the likely compatibility issues? Even if it probably won’t be quite as painful ...

1 0