- wlug - list.wlug.org.nz

Trouble Accessing .nz Sites, Anybody?
by Lawrence D'Oliveiro 30 May '23

30 May '23

Seems some people have had trouble accessing various .nz sites since last night, and into this morning <https://www.nzherald.co.nz/business/banking-apps-some-websites-down-as-inte…>. The explanation at the end seems to indicate that InternetNZ is rolling out DNS security, and caching inconsistencies on ISPs’ servers are leading to hiccups for users. Hopefully this will be resolved soon as the outdated DNS entries get flushed.

2 1

Microsoft Releases Azure Linux
by Lawrence D'Oliveiro 26 May '23

26 May '23

Microsoft has announced a commercially-supported product it calls “Azure Linux” <https://devclass.com/2023/05/25/azure-linux-released-at-build-where-microso…>. This is essentially the same code as its custom “CBL-Mariner” distro that it runs internally on its Azure servers. While this is RPM-based (the same package manager used in Red Hat), it is not a fork of Red Hat, but is built specially from the ground up. Project lead Jim Perrin explains why: “The reason we chose not to fork a different distro … Microsoft has kind of a history with Linux. … I think the Balmer quote is from 2001, but a lot of the sentiment still lingers even today. Part of the reason we did not choose to start with a distribution and then fork it for our needs is we didn’t want to be seen as doing the embrace and extend thing again, we didn’t want to wake any of that up, we figured, build it from scratch, we can tailor it to our needs … we’re scratching an itch we had and offering the solution back to the community.” The “Ballmer quote” being the infamous phrase “Linux is a cancer” that then-CEO Steve Ballmer uttered back in 2001. Yes, nice to see some past sins are still kept in mind, at least in some corners of Microsoft ...

1 0

Fast Restart For Java Apps
by Lawrence D'Oliveiro 23 May '23

23 May '23

Java continues to be popular for server-side apps. But one problem is that starting a Java app can be slow. So if you have some Java code that performs a service on demand, runs for a short while and then shuts down again, that hurts performance. Enter “CRaC”, or “Coordinated Restore at Checkpoint” <https://devclass.com/2023/05/22/azul-makes-openjdk-with-fast-start-crac-gen…>, from a company called Azul, which seems to centre its entire business around OpenJDK <https://www.azul.com/about/>. This system lets the app dump its state to disk in a form that allows for quick resumption. This state cannot include things like open files/network connections, so the app itself needs to implement handlers to close these before the dump and reopen them after the restore, saving enough state as part of the dump to allow this to happen with minimal impact on the rest of the application. Interestingly, this system is built on another piece of software called “CRIU” or “Checkpoint/Restore In Userspace” <https://criu.org/Main_Page>, which is Linux-only. As Azul’s CTO says: “We submitted CRaC to OpenJDK as an idea for a project … and they’ve included it as one of the many project they have. The reason it isn’t in the mainstream yet, and I’m not even sure it will make it into the mainstream, is that we rely on the CRIU technology underneath on Linux, and there isn’t an equivalent that we’re aware of on Windows or on Mac. So you lose that cross-platform functionality … ” But as the article says, that may not such a big showstopper any more: Java applications are often developed on Windows or Mac, but most often deployed to Linux, suggesting that the lack of cross-platform support is not a deal-breaker for everyone.

1 0

Fibre Connection -- Separating Modem & Router Functions
by Lawrence D'Oliveiro 16 May '23

16 May '23

Most people probably have their internet connection provided through a single box. There are two separate functions going on: * “Modem” (layer 2) -- handling the low-level signalling with whatever is at the other end of the wire (whether copper or glass); * “Router” (layer 3) -- routing TCP/IP packets between your house LAN and your ISP, which provides the connection between there and the rest of the Internet. At one point I was running a cheap little Conexant AccessRunner USB box (bought from Dick Smith) on my ADSL connection; while this could also perform both functions in one, I found a version of the firmware that implemented only the modem function. Plugging this into a Linux box caused it to appear like an additional network interface (the drivers are already in the standard kernel). I could then control this via the “ppp” package <https://ppp.samba.org/>, using its PPP-over-ATM plugin to implement the correct low-level signalling (just VPI/VCI selection, really). I could then exploit the full power of the Linux network stack on that box to manage the connection to the rest of my house LAN. Anyway, as my own house gets wired up for fibre (soon...), I was curious as to whether something equivalent could be done for a fibre connection. And the information I’ve found so far (e.g. <https://www.geekzone.co.nz/forums.asp?forumid=81&topicid=274586>) indicates it might actually be simpler than this. The “ONT” (“Optical Network Terminator”) box that gets installed in your house has phone ports and Ethernet ports on it, and it appears that (once you have your ISP connection up and running) the Ethernet connection behaves just like a regular LAN connection, with a DHCP server (and ISP’s router) listening on the other end. So instead of an Internet router at your end, you can plug a regular PC directly into that port, pick up an allocated address, and have it immediately connected to the Internet. In short, there is nothing fibre-specific about the Internet router that the ISP provides to you at all. However, there might be issues with VLAN-tagging of the Ethernet frames, and this is not standardized between ISPs. (By the way, I see several folks claiming there is no “modem” in a fibre connection. Of course there is.) Not sure whether I’ll try this right away. Might be safest to do things the ISP-provided way, at least to begin with.

4 8

Unkillable UEFI Malware Bypassing Secure Boot Enabled By Unpatchable Windows Flaw
by Peter Reutemann 12 May '23

12 May '23

'Researchers have announced a major cybersecurity find -- the world's first-known instance of real-world malware that can hijack a computer's boot process even when Secure Boot and other advanced protections are enabled and running on fully updated versions of Windows. From a report: Dubbed BlackLotus, the malware is what's known as a UEFI bootkit. These sophisticated pieces of malware hijack the UEFI -- short for Unified Extensible Firmware Interface -- the low-level and complex chain of firmware responsible for booting up virtually every modern computer. As the mechanism that bridges a PC's device firmware with its operating system, the UEFI is an OS in its own right. It's located in an SPI-connected flash storage chip soldered onto the computer motherboard, making it difficult to inspect or patch. Because the UEFI is the first thing to run when a computer is turned on, it influences the OS, security apps, and all other software that follows. These traits make the UEFI the perfect place to run malware. When successful, UEFI bootkits disable OS security mechanisms and ensure that a computer remains infected with stealthy malware that runs at the kernel mode or user mode, even after the operating system is reinstalled or a hard drive is replaced. As appealing as it is to threat actors to install nearly invisible and unremovable malware that has kernel-level access, there are a few formidable hurdles standing in their way. One is the requirement that they first hack the device and gain administrator system rights, either by exploiting one or more vulnerabilities in the OS or apps or by tricking a user into installing trojanized software. Only after this high bar is cleared can the threat actor attempt an installation of the bootkit. The second thing standing in the way of UEFI attacks is UEFI Secure Boot, an industry-wide standard that uses cryptographic signatures to ensure that each piece of software used during startup is trusted by a computer's manufacturer. Secure Boot is designed to create a chain of trust that will prevent attackers from replacing the intended bootup firmware with malicious firmware. If a single firmware link in that chain isn't recognized, Secure Boot will prevent the device from starting.' -- source: https://it.slashdot.org/story/23/03/06/1854200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

OpenOffice: The One FOSS Project That Deserves To Die, But Won’t
by Lawrence D'Oliveiro 06 May '23

06 May '23

The ever-dependable Brodie Robertson has a look at the ongoing (!) development history of OpenOffice here <https://www.youtube.com/watch?v=xdpMxmFvGBA>. Those of us on FOSS platforms moved to LibreOffice years ago. But among some sectors (my guess is, predominantly Microsoft Windows users?), OpenOffice still has the dominant name recognition. And just to add to the fun, the project actually continues putting out updates! Though these are just minor ones -- I don’t think there have been any major functional changes in the better part of a decade. The source code commit history also continues to bubble over, though a lot of the patches are tiny, almost trivial things, like fixing typos and making random-looking changes to whitespace.

1 0

I used System76’s Pangolin for weeks, and Linux was not the biggest problem
by Peter Reutemann 05 May '23

05 May '23

'After using System76’s Pangolin as my primary work laptop for nearly six weeks, I can tell you this: If you need a 15-inch Linux-focused laptop, this is the one to get. The Pangolin is a solid device, designed more for dependability and convenience than ultrabook portability or cutting-edge parts, but it still has reasonably modern hardware (especially its 144 Hz screen). The Pangolin and its native Pop!_OS are a showcase for how remarkably normal Linux can feel as a daily driver in 2023. Normal, and with lots of ports. It’s hard to do a nuts-and-bolts comparison of the Pangolin to most other laptops, due largely to benchmark comparability between Linux and most laptops running Windows or macOS. But it’s also not entirely necessary. There’s only one real version of the Pangolin available—one processor, one amount of RAM, then variable, user-expandable storage. We’ll show you how the Pangolin did on a couple tests. But how this laptop works for you is much more about what you’re bringing to it and what you're willing to put into customizing it to your liking. I came to the Pangolin as someone who has made a few attempts at using Linux as a daily driver. I know enough command line, vim, and Unix-based architecture to be conversant, and I have two Raspberry Pis that are constantly being improved. Still, I'm more hobbyist than practitioner. And yet the Pangolin presented no real problems as I used it for almost any task I needed to get done. Its combination of solid software and practical hardware choices make it an easy system to recommend, so long as you know you need Linux. Its maker-made operating system, Pop!_OS, almost never gave me problems, except when I was trying to make it run benchmarks. Starting with a rock-solid Linux install, where every bit of hardware is supported and functional, made me more eager to poke at the edges and see what I could customize.' -- source: https://arstechnica.com/gadgets/2023/05/review-system76-pangolin-is-a-solid… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'sudo' and 'su' Are Being Rewritten In Rust For Memory Safety
by Peter Reutemann 02 May '23

02 May '23

'Phoronix reports: With the financial backing of Amazon Web Services, sudo and su are being rewritten in the Rust programming language in order to increase the memory safety for the widely relied upon software... to further enhance Linux/open-source security. "[B]ecause it's written in C, sudo has experienced many vulnerabilities related to memory safety issues," according to a blog post announcing the project: It's important that we secure our most critical software, particularly from memory safety vulnerabilities. It's hard to imagine software that's much more critical than sudo and su. This work is being done by a joint team from Ferrous Systems and Tweede Golf with generous support from Amazon Web Services. The work plan is viewable here. The GitHub repository is here. ' -- source: https://linux.slashdot.org/story/23/05/01/0020239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Announces DentOS 3.0, an Open Source Network OS for Disaggregated Networks
by Peter Reutemann 01 May '23

01 May '23

'This month the Linux Foundation announced version 3.0 of DentOS, an open source network operating system using the Linux kernel, Switchdev, and other Linux-based projects for a standardized network operating system "without abstractions or overhead," according to the project's web page. "All underlying infrastructure — including ASIC and Silicon for networking and datapath — is treated equally; while existing abstractions, APIs, drivers, low-level overhead, and other open software are simplified. DENT unites silicon vendors, ODMs, SIs, OEMs, and end users across all verticals to enable the transition to disaggregated networks." Or, as the Linux Foundation, the operating system provides "a flexible and customizable platform for network administrators to manage their networks." DENT provides access to open source-based switches at a lower cost and with more flexibility compared to proprietary switches with locked ecosystems. Network wiring closets in many facilities--including retail stores, warehousing, remote locations, enterprises, and small and mid-sized businesses--are often small, requiring a compact solution for network management. Additionally, staff expertise may be limited, and branch-office switches from leading suppliers can require costly contracts. DENT can be easily deployed on white-box hardware in small spaces, providing an efficient and cost-effective solution for network management. As a result, DENT deployment can significantly enhance network management in a wide range of environments, providing greater efficiency, reliability, and scalability... DentOS enables Amazon's Just Walk Out Technology to connect and manage thousands of devices like cameras, sensors, entry and exit gates, and access points on the network edge. ' -- source: https://tech.slashdot.org/story/23/04/30/010222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Not-So-Stupid(?) Linux Trick
by Lawrence D'Oliveiro 28 Apr '23

28 Apr '23

Here’s a command that can sometimes look a bit unnerving in operation, but is actually quite safe: rmdir -p «dir» where «dir» is some directory. Or to watch the whole process in action, add the option to give progress messages: rmdir -pv «dir» Background: the basic command rmdir «dir» deletes the named directory, but only if it is empty. The “-p” option takes this further, by then trying to delete the parent of «dir», and if that succeeds, the parent of that, and so on. It stops only when it gets to a nonempty directory, or when it has done all components of «dir». So if, for example, you try this on an absolute path, this will mean the command always stops on an error. And the error could quite likely be on a directory which contains important stuff that you care about. But, as I said, it’s quite safe, since it won’t delete that stuff. But I told you it could be unnerving, didn’t I?

1 0

New Intel Linux Graphics Driver Patches Released, Up To 10-15% Better Performance
by Peter Reutemann 28 Apr '23

28 Apr '23

'A new set of patches have been released for the Intel Linux graphics driver that "can provide 10-15% better performance when operating in the tuned mode," reports Phoronix. From the report: The set of Intel i915 Linux kernel graphics driver patches are about exposing the Intel RPS (Requested Power State) up/down thresholds. Right now the Intel Linux kernel driver has static values set for the up/down thresholds between power states while these patches would make them dynamically configurable by user-space. Google engineer Syed Faaiz Hussain raised the issue that they experimented with the Intel RPS tuning and were able to manage up to 15% better performance. With Counter-Strike: Global Offensive with OpenGL was a 14.5% boost, CS:GO with Vulkan was 12.9% faster, and Civilization VI with OpenGL was 11% faster while Strange Brigade was unchanged. No other game numbers were provided. But as this is about changing the threshold for how aggressively the Intel graphics hardware switches power states, the proposed patches leave it up to user-space to adjust the thresholds as they wish. Google engineers are interested in hooking this into Feral's GameMode so that the values could be automatically tuned when launching games and then returning to their former state when done gaming, in order to maximize battery life / power efficiency. The only downside with these current patches are that they work only for non-GuC based platforms... So the latest Alder/Raptor Lake notebooks as well as Intel DG2/Alchemist discrete graphics currently aren't able to make use of this tuning option. ' -- source: https://tech.slashdot.org/story/23/04/27/1927209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel 6.3 Released
by Peter Reutemann 27 Apr '23

27 Apr '23

'A report from ZDNet, written by Steven Vaughan-Nichols: The latest Linux kernel is out with a slew of new features -- and, for once, this release has been nice and easy. [...] Speaking of Rust, everyone's favorite memory-safe language, the new kernel comes with user-mode Linux support for Rust code. Miguel Ojeda, the Linux kernel developer, who's led the efforts to bring Rust to Linux, said the additions mean we're, "getting closer to a point where the first Rust modules can be upstreamed." Other features in the Linux 6.3 kernel include support and enablement for upcoming and yet-to-be-released Intel and AMD CPUs and graphics hardware. While these updates will primarily benefit future hardware, several changes in this release directly impact today's users' day-to-day experience. The kernel now supports AMD's automatic Indirect Branch Restricted Speculation (IBRS) feature for Spectre mitigation, providing a less performance-intensive alternative to the retpoline speculative execution. Linux 6.3 also includes new power management drivers for ARM and RISC-V architectures. RISC-V has gained support for accelerated string functions via the Zbb bit manipulation extension, while ARM received support for scalable matrix extension 2 instructions. For filesystems, Linux 6.3 brings AES-SHA2-based encryption support for NFS, optimizations for EXT4 direct I/O performance, low-latency decompression for EROFS, and a faster Brtfs file-system driver. Bottom line: many file operations will be a bit more secure and faster. For gamers, the new kernel provides a native Steam Deck controller interface in HID. It also includes compatibility for the Logitech G923 Xbox edition racing wheel and improvements to the 8BitDo Pro 2 wired game controllers. Who says you can't game on Linux? Single-board computers, such as BannaPi R3, BPI-M2 Pro, and Orange Pi R1 Plus, also benefit from updated drivers in this release. There's also support for more Wi-Fi adapters and chipsets. These include: Realtek RTL8188EU Wi-Fi adapter support; Qualcomm Wi-Fi 7 wireless chipset support; and Ethernet support for NVIDIA BlueField 3 DPU. For users dealing with complex networks that have both old-school and modern networks, the new kernel can also handle multi-path TCP handling mixed flows with IPv4 and IPv6.' -- source: https://linux.slashdot.org/story/23/04/26/0023238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Edge is Leaking the Sites You Visit To Bing
by Peter Reutemann 26 Apr '23

26 Apr '23

'Microsoft's Edge browser appears to be sending URLs you visit to its Bing API website. Reddit users first spotted the privacy issues with Edge last week, noticing that the latest version of Microsoft Edge sends a request to bingapis.com with the full URL of nearly every page you navigate to. Microsoft tells The Verge it's investigating the reports. From a report: "Searching for references to this URL give very few results, no documentation on this feature at all," said hackermchackface, the Reddit user who first discovered the issue. While Reddit users weren't able to uncover why Microsoft Edge is sending the URLs you visit to its Bing API site, we asked Rafael Rivera, a software engineer and one of the developers behind EarTrumpet, to investigate, and he discovered it's part of a poorly implemented new feature in Edge. "Microsoft Edge now has a creator follow feature that is enabled by default," says Rivera in a conversation with The Verge. "It appears the intent was to notify Bing when you're on certain pages, such as YouTube, The Verge, and Reddit. But it doesn't appear to be working correctly, instead sending nearly every domain you visit to Bing."' -- source: https://yro.slashdot.org/story/23/04/25/209254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Red Hat Begins Cutting 'Hundreds of Jobs'
by Peter Reutemann 25 Apr '23

25 Apr '23

'According to Phoronix citing multiple local North Carolina news outlets, Red Hat is cutting "hundreds of jobs" in an initial round of layoffs announced today. From the report: According to WRAL, Red Hat CEO Matt Hicks is said to have told employees in an email "we will not reduce roles directly selling to customers or building our products," which is hopefully good news for their many upstream Linux developers they employ that ultimately build Red Hat Enterprise Linux and associated software products. Red Hat will begin notifying affected employees today in some countries while the process will continue through the end of the quarter. IBM, which acquired Red Hat in 2019, has already slashed some five thousand positions so far in 2023.' -- source: https://linux.slashdot.org/story/23/04/24/2220256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Introduces “Windows Frontline”
by Lawrence D'Oliveiro 24 Apr '23

24 Apr '23

This <https://www.theregister.com/2023/04/24/windows_frontline_cloudpc_sustainabi…> sounds like a way for Microsoft to get more revenue from users buying fewer PCs. I wonder how long it will be before Intel and the major PC vendors put a stop to this kind of talk?

1 0

Mango Pi RISC-V Single Board Computer
by Lawrence D'Oliveiro 24 Apr '23

24 Apr '23

Here is an entertaining walkthrough from Christopher Barnatt on the ever-dependable “Explaining Computers” channel of a single-core RISC-V-based board with the same tiny dimensions as a Raspberry Pi Zero W <https://www.youtube.com/watch?v=-g18PMjjlcc>. Hardly a speed demon, but for the price, I think it represents amazing value. Also a clear indication that RISC-V is fulfilling its promise of being a serious competitor, or even a successor, to ARM.

1 0

QEMU 8.0 Released with More ARM and RISC-V Emulation
by Peter Reutemann 24 Apr '23

24 Apr '23

'There's a major new update of QEMU, the open-source machine emulator, reports 9to5Linux: Coming a year after QEMU 7.0, the QEMU 8.0 release is here to improve support for ARM and RISC-V architectures. - For ARM, it adds emulation support for FEAT_EVT, FEAT_FGT, and AArch32 ARMv8-R, CPU emulation for Cortex-A55 and Cortex-R52, support for a new Olimex STM32 H405 machine type, as well as gdbstub support for M-profile system registers. - For the RISC-V architecture, QEMU 8.0 brings updated machine support for OpenTitan, PolarFire, and OpenSBI, additional ISA and Extension support for smstateen, native debug icount trigger, cache-related PMU events in virtual mode, Zawrs/Svadu/T-Head/Zicond extensions, and ACPI support. Moreover, RISC-V received multiple fixes covering PMP propagation for TLB, mret exceptions, uncompressed instructions, and other emulation/virtualization improvements. Improvements were also made for the s390x (IBM Z) platform, the HP Precision Architecture (HPPA) platform, and x86.' -- source: https://slashdot.org/story/23/04/23/0525206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel's I219-LM Gigabit Ethernet Adapter Ran at 60% Maximum Speed on Linux Since 2020
by Peter Reutemann 24 Apr '23

24 Apr '23

'Phoronix reports: If you rely on an Intel I219-LM Gigabit Ethernet adapter, you will want to look forward to upgrading your Linux kernel build soon... A fix was committed Thursday after Intel engineers discovered this particular Ethernet chipset had only been running at around 60% of its maximum speed due to a regression introduced back in 2020... Since the release of Linux 5.8 in mid-2020, this Ethernet adapter had been running at around 60% of its advertised potential due to an e1000e driver regression.' -- source: https://slashdot.org/story/23/04/22/0554251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KaOS Linux Celebrates 10 Years with New ISO Release Featuring Pre-Release KDE Plasma 6
by Peter Reutemann 24 Apr '23

24 Apr '23

'9to5Linux reports: KDE-focused and Arch Linux-inspired independent distribution KaOS Linux celebrates today 10 years of existence with a new stable ISO release that brings some of the latest GNU/Linux technologies and a preview of the upcoming KDE Plasma 6 desktop environment. Yes, you're reading it right, KaOS is one of the very first GNU/Linux distributions to offer you a live ISO image with a pre-release version of the KDE Plasma 6 desktop, which, of course, is compiled against the latest Qt 6 open-source application framework... Since this is a special ISO release, the devs also added an option to play music during the installation process. "KaOS uses the Systemd-provided Systemd-boot for UEFI installs," according to the release notes.' -- source: https://linux.slashdot.org/story/23/04/23/0555224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Proton Launches an End-to-End Encrypted Password Manager
by Peter Reutemann 21 Apr '23

21 Apr '23

'Proton, the company behind Proton Mail, has announced the launch of a new password manager: Proton Pass. While the service will eventually become free for everyone to use, it's currently only available as a beta to Proton's Lifetime and Visionary users for now. From a report: As is the case with Proton's other products, Proton Pass uses end-to-end encryption (E2EE) that's supposed to keep your personal information away from prying eyes, including third parties and Proton itself. In addition to letting you store your usernames, passwords, and notes, you can also add any randomly generated email aliases that you can use as a replacement for your real address. Proton's new password manager not only applies E2EE to your passwords but also the usernames, web addresses, and all the other fields associated with your login information. In a blog post explaining the service's security model, Proton notes that "all cryptographic operations, including key generation and data encryption," happen locally on your device, which Protons says it can't decrypt, even if a third party requests it.' -- source: https://yro.slashdot.org/story/23/04/20/1840225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MariaDB Hits Financial Headwinds
by Lawrence D'Oliveiro 20 Apr '23

20 Apr '23

This report <https://www.theregister.com/2023/04/18/mariadb_job_losses/> says that the company set up to commercialize MariaDB (the fork of MySQL created by Michael “Monty” Widenius after the latter’s acquisition by Oracle) is cutting jobs and adopting other cost-saving measures to get around revenue shortfalls. What interested me was, in response to a reader asking what Widenius was doing after personally getting $15 million out of that acquisition, the founder himself responded <https://forums.theregister.com/forum/all/2023/04/18/mariadb_job_losses/#c_4…> about the contributions that he had put into the company, the project and employees’s salaries.

1 0

FSF Says Google's Decision to Deprecate JPEG-XL Emphasizes Need for Browser Choice
by Peter Reutemann 17 Apr '23

17 Apr '23

'"The fact remains that Google Chrome is the arbiter of web standards," argues FSF campaigns manager Greg Farough (while adding that Firefox, "through ethical distributions like GNU IceCat and Abrowser, can weaken that stranglehold.") "Google's deprecation of the JPEG-XL image format in February in favor of its own patented AVIF format might not end the web in the grand scheme of things, but it does highlight, once again, the disturbing amount of control it has over the platform generally." Part of Google's official rationale for the deprecation is the following line: "There is not enough interest from the entire ecosystem to continue experimenting with JPEG-XL." Putting aside the problematic aspects of the term "ecosystem," let us remark that it's easy to gauge the response of the "entire ecosystem" when you yourself are by far the largest and most dangerous predator in said "ecosystem." In relation to Google's overwhelming power, the average web user might as well be a microbe. In supposedly gauging what the "ecosystem" wants, all Google is really doing is asking itself what Google wants... While we can't link to Google's issue tracker directly because of another freedom issue — its use of nonfree JavaScript — we're told that the issue regarding JPEG-XL's removal is the second-most "starred" issue in the history of the Chromium project, the nominally free basis for the Google Chrome browser. Chromium users came out of the woodwork to plead with Google not to make this decision. It made it anyway, not bothering to respond to users' concerns. We're not sure what metric it's using to gauge the interest of the "entire ecosystem," but it seems users have given JPEG-XL a strong show of support. In turn, what users will be given is yet another facet of the web that Google itself controls: the AVIF format. As the response to JPEG-XL's deprecation has shown, our rallying together and telling Google we want something isn't liable to get it to change its mind. It will keep on wanting what it wants: control; we'll keep on wanting what we want: freedom. Only, the situation isn't hopeless. At the present moment, not even Google can stop us from creating the web communities that we want to see: pages that don't run huge chunks of malicious, nonfree code on our computers. We have the power to choose what we run or do not run in our browsers. Browsers like GNU IceCat (and extensions like LibreJS and JShelter> ) help with that. Google also can't prevent us from exploring networks beyond the web like Gemini. What our community can do is rally support behind those free browsers that choose to support JPEG-XL and similar formats, letting the big G know that even if we're smaller than it, we won't be bossed around.' -- source: https://news.slashdot.org/story/23/04/16/002204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Spectre-Related 'Medium Severity' Flaw Patched in Linux Kernel
by Peter Reutemann 17 Apr '23

17 Apr '23

'"The Spectre vulnerability that has haunted hardware and software makers since 2018 continues to defy efforts to bury it," reports the Register: On Thursday, Eduardo (sirdarckcat) Vela Nava, from Google's product security response team, disclosed a Spectre-related flaw in version 6.2 of the Linux kernel. The bug, designated medium severity, was initially reported to cloud service providers — those most likely to be affected — on December 31, 2022, and was patched in Linux on February 27, 2023. "The kernel failed to protect applications that attempted to protect against Spectre v2, leaving them open to attack from other processes running on the same physical core in another hyperthread," the vulnerability disclosure explains. The consequence of that attack is potential information exposure (e.g., leaked private keys) through this pernicous problem.... Spectre v2 — the variant implicated in this particular vulnerability — relies on timing side-channels to measure the misprediction rates of indirect branch prediction in order to infer the contents of protected memory. That's far from optimal in a cloud environment with shared hardware... The bug hunters who identified the issue found that Linux userspace processes to defend against Spectre v2 didn't work on VMs of "at least one major cloud provider."' -- source: https://linux.slashdot.org/story/23/04/16/0143259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Releases Emergency Chrome Security Update
by Peter Reutemann 17 Apr '23

17 Apr '23

'"Earlier this week, Google released an emergency security update for the Chrome browser due to a vulnerability that is being actively exploited in the wild," reports Hot Hardware: On Friday, Google highlighted CVE-2023-2033, reported by Clément Lecigne of Google's own Threat Analysis Group (TAG). This vulnerability is a 'type confusion' bug in the JavaScript engine for Chromium browsers useing the V8 Javascript engine. In short, type confusion is a bug that allows memory to be accessed with the wrong type, allowing for the reading or writing of memory out of bounds. The CVE page says that an attacker could create an HTML page that allows the exploitation of heap corruption. While there is no Common Vulnerability Scoring System (CVSS) score attached to the vulnerability yet, Google is tracking this as a "high" severity issue. This is likely due in part to the fact that "Google is aware that an exploit for CVE-2023-2033 exists in the wild." The article notes that Chrome updates are generally done automatically, but you can also check for updates by clicking Chrome's three-dots menu in the top-right corner, then "Help" and "About Chrome."' -- source: https://it.slashdot.org/story/23/04/16/2057239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Feeling Competition From Linux In ... Gaming?!?
by Lawrence D'Oliveiro 14 Apr '23

14 Apr '23

Here’s another interesting development in the Windows-Linux rivalry: in gaming, of all places. The Steam Deck is a Linux-based handheld gaming PC which could, in principle, run Windows. Trouble is, Windows doesn’t offer any good UI options for working with this form factor <https://arstechnica.com/gadgets/2023/04/handheld-mode-for-windows-could-mak…>. So there is talk of developing a new “handheld mode” for Windows. Of course, for Linux, there is no “mode” in the OS for this, it’s just a different configuration of the GUI layer. Which is modular and completely replaceable.

1 0

Watch Out For Those USB Charging Ports!
by Lawrence D'Oliveiro 12 Apr '23

12 Apr '23

Something else to worry about: the US FBI, and NZ CERT, are advising travellers not to use public USB charging ports, because they can be a way to hack into your device <https://www.nzherald.co.nz/travel/fbi-warns-travellers-not-to-use-public-ch…>. When I was in Hong Kong Airport a few years ago, it was very hard for me to find a mains outlet to charge my laptop. Just about all the ports built into the public seating areas were USB ones, for phones/tablets.

2 1

New Attack On Car Security: “CAN Injection”
by Lawrence D'Oliveiro 07 Apr '23

07 Apr '23

CANbus is a mini-LAN built into every car manufactured this century. It is increasingly being used for all kinds of functions, like controlling “smart headlamps”, and of course unlocking the doors and letting you get into the car and drive off. Now it turns out that there are ways to connect to the bus through weak points from outside the vehicle, for example by breaking into the connections for those “smart headlamps”. From here, you can do things like spoof signals from the smart key receiver, fooling the security system into thinking it has received a signal from a valid owner’s key when it hasn’t. And once you’ve done that, you can steal the car. Because, of course, components on the bus are trusting the signals they get from other components, aren’t they? <https://www.theregister.com/2023/04/06/can_injection_attack_car_theft/>

1 0

'One In Two New Npm Packages Is SEO Spam Right Now'
by Peter Reutemann 31 Mar '23

31 Mar '23

'Gabi Dobocan, writing at auditing firm Sandworm: More than half of all new packages that are currently (29 Mar 2023) being submitted to npm are SEO spam. That is - empty packages, with just a single README file that contains links to various malicious websites. Out of the ~320k new npm packages or versions that Sandworm has scanned over the past week, at least ~185k were labeled as SEO spam. Just in the last hour as of writing this article, 1583 new e-book spam packages have been published. All the identified spam packages are currently live on npmjs.com.' -- source: https://developers.slashdot.org/story/23/03/30/184239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Numen voice control
by Peter Reutemann 30 Mar '23

30 Mar '23

Saw the following on my Mastodon feed: Numen is an open GPL licensed project by @geb that allows system-wide computing by VoiceControl without using mouse or keyboard. A great a11y (= accessibility) tool, looks like. https://numenvoice.com https://git.sr.ht/~geb/numen -- soure: https://social.coop/@smallcircles/110106575204873016 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Cinnamon Remix Becomes Official Ubuntu Flavor
by Peter Reutemann 29 Mar '23

29 Mar '23

'A report from 9to5Linux: The Ubuntu Cinnamon Remix distribution has become an official Ubuntu flavor and will join the rest of the flavors starting with the upcoming Ubuntu 23.04 (Lunar Lobster) release. Created and maintained by members of the Linux community, Ubuntu Cinnamon Remix is an Ubuntu derivative that features the modern Cinnamon desktop environment developed by the Linux Mint team. Cinnamon Remix aims to offer a traditional approach to the modern Linux desktop. Until now, the maintainers of Ubuntu Cinnamon Remix did a very good job keeping up with all upstream Ubuntu releases, even offering a custom version of the official wallpaper of each new Ubuntu release to match the Cinnamon desktop environment's style. Ubuntu Cinnamon will not be the only new official Ubuntu flavor this Spring when Ubuntu 23.04 will be released as the maintainers of Ubuntu Unity have also managed to obtain official Ubuntu flavor status last year in September. As with Ubuntu Unity, the next step now for the Ubuntu Cinnamon maintainers is to bake daily ISO images in preparation for the upcoming Lunar Lobster release and maybe even take part in the Ubuntu 23.04 beta release later this week on March 30th. ' -- source: https://news.slashdot.org/story/23/03/28/2134218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Arduino Announces 'UNO R4' with Clock Speed/Memory/Storage Upgrades, 32-bit ARM Cortex-M4
by Peter Reutemann 28 Mar '23

28 Mar '23

'Saturday Arduino announced "a new, revolutionary revision of the iconic UNO board," promising "a long-awaited update on performance and possibilities." The Arduino UNO R4 indeed preserves the well-known features of the UNO family — standard form factor, shield compatibility, 5V operating voltage, outstanding robustness — while offering no less than a 32-bit Cortex-M4 and a 3-to-16x increase in clock speed, memory and flash storage.... The UNO R4 will come in two versions — UNO R4 WiFi and UNO R4 Minima — offering unprecedented performance and possibilities for the maker community. The WiFi version comes with an Espressif S3 WiFi module, expanding creative opportunities for makers, educators, and hobbyists alike; while the UNO R4 Minima provides a cost-effective option for those seeking the new microcontroller without additional features.... SRAM went from 2kB to 32kB, and flash memory went from 32kB to 256kB to accommodate more complex projects. In addition, following the requests from the community, the USB port was upgraded to the USB-C and maximum power supply voltage was increased to 24V with an improved thermal design. The board provides a CAN bus, which allows users to minimize wiring and execute different tasks in parallel by connecting multiple shields. Finally, the new board includes a 12-bit analog DAC. All in all, Arduino UNO R4 is the answer to the requests for improvement and updates the developer and maker community has been advancing, making it easier than ever to get started with Arduino.... On the software side, a big effort is being made to maximize retrocompatibility of the most popular Arduino libraries so that users will be able to rely on existing code examples and tutorials.' -- source: https://hardware.slashdot.org/story/23/03/26/2357240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pinduoduo App Malware Detailed By Cybersecurity Researchers
by Peter Reutemann 28 Mar '23

28 Mar '23

'Security researchers at Moscow-based Kaspersky Lab have identified and outlined potential malware in versions of PDD Holdings' Chinese shopping app Pinduoduo, days after Google suspended it from its Android app store. From a report: In one of the first public accountings of the malicious code, Kaspersky laid out how the app could elevate its own privileges to undermine user privacy and data security. It tested versions of the app distributed through a local app store in China, where Huawei Technologies, Tencent Holdings and Xiaomi run some of the biggest app markets. Kaspersky's findings, shared with Bloomberg News, were among the clearest explanations from an independent security team for what triggered Google's action and malware warning last week. The cybersecurity firm, which has played a role in uncovering some of the biggest cyberattacks in history, said it found evidence that earlier versions of Pinduoduo exploited system software vulnerabilities to install backdoors and gain unauthorized access to user data and notifications. Those conclusions agreed in large part with those of researchers that had posted their discoveries online in past weeks, though Bloomberg News hasn't verified the authenticity of the earlier reports.' -- source: https://it.slashdot.org/story/23/03/27/1420241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Orange Pi 5: a Fast Alternative To The Raspberry Pi 4
by Peter Reutemann 27 Mar '23

27 Mar '23

'"With an 8-core Rockchip RK3588S SoC, the Orange Pi 5 is leaps and bounds faster than the aging Raspberry Pi 4," writes Phoronix: With up to 32GB of RAM, the Orange Pi 5 is also capable of serving for a more diverse user-base and even has enough potential for assembling a budget Arm Linux developer desktop. I've been testing out the Orange Pi 5 the past few weeks and it's quite fast and nice for its low price point. The Orange Pi 5 single board computer was announced last year and went up for pre-ordering at the end of 2022.... When it comes to the software support, among the officially available options for the Orange Pi 5 are Orange Pi OS, Ubuntu, Debian, Android, and Armbian. Other ARM Linux distributions will surely see varying levels of support while even the readily available ISO selection offered by Orange Pi is off to a great start.... Granted, the Orange Pi developer community isn't as large as that of the Raspberry Pi community or the current range of accessories and documentation, but for those more concerned about features and performance, the Orange Pi 5 is extremely interesting. The article includes Orange Pi 5 specs: - A 26-pin header - HDMI 2.1, Gigabit LAN, M.2 PCIe 2.0, and USB3 connectivity - A Mali G510 MP4 graphics processor, "which has open-source driver hope via the Panfrost driver stack." - Four different versions with 4GB, 8GB, 16GB, or 32GB of RAM using LPDDR4 or LPDDR4X. "The Orange Pi 4GB retails for ~$88, the Orange Pi 5 8GB version retails for $108, and the Orange Pi 5 16GB version retails for $138, while as of writing the 32GB version wasn't in stock." In 169 performance benchmarks (compared to Raspberry Pi 4 boards), "this single board computer came out to delivering 2.85x the performance of the Raspberry Pi 400 overall." And through all this the average SoC temperature was 71 degrees with a peak of 85 degrees — without any extra heatsink or cooling.' -- source: https://build.slashdot.org/story/23/03/25/1725257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Pixel Bug Lets You 'Uncrop' the Last Four Years of Screenshots
by Peter Reutemann 25 Mar '23

25 Mar '23

'Ars Technica: Back in 2018, Pixel phones gained a built-in screenshot editor called "Markup" with the release of Android 9.0 Pie. The tool pops up whenever you take a screenshot, and tapping the app's pen icon gives you access to tools like crop and a few colored drawing pens. That's very handy assuming Google's Markup tool actually does what it says, but a new vulnerability points out the edits made by this tool weren't actually destructive! It's possible to uncrop or unredact Pixel screenshots taken during the past four years. The bug was discovered by Simon Aarons and is dubbed "Acropalypse," or more formally CVE-2023-21036. There's a proof-of-concept app that can unredact Pixel screenshots at acropalypse.app, and it works! There's also a good technical write-up here by Aarons' collaborator, David Buchanan. The basic gist of the problem is that Google's screenshot editor overwrites the original screenshot file with your new edited screenshot, but it does not truncate or recompress that file in any way. If your edited screenshot has a smaller file size than the original -- that's very easy to do with the crop tool -- you end up with a PNG with a bunch of hidden junk data at the end of it. That junk data is made up of the end bits of your original screenshot, and it's actually possible to recover that data. While the bug was fixed in the March 2023 security update for Pixel devices, it doesn't solve the problem, notes Ars. "There's still the matter of the last four years of Pixel screenshots that are out there and possibly full of hidden data that people didn't realize they were sharing."' -- source: https://it.slashdot.org/story/23/03/20/2034220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

GitHub.com Rotates Its Exposed Private SSH Key
by Peter Reutemann 25 Mar '23

25 Mar '23

'GitHub has rotated its private SSH key for GitHub.com after the secret was was accidentally published in a public GitHub repository. BleepingComputer reports: The software development and version control service says, the private RSA key was only "briefly" exposed, but that it took action out of "an abundance of caution." In a succinct blog post published today, GitHub acknowledged discovering this week that the RSA SSH private key for GitHub.com had been ephemerally exposed in a public GitHub repository. "We immediately acted to contain the exposure and began investigating to understand the root cause and impact," writes Mike Hanley, GitHub's Chief Security Officer and SVP of Engineering. "We have now completed the key replacement, and users will see the change propagate over the next thirty minutes. Some users may have noticed that the new key was briefly present beginning around 02:30 UTC during preparations for this change." As some may notice, only GitHub.com's RSA SSH key has been impacted and replaced. No change is required for ECDSA or Ed25519 users.' -- source: https://it.slashdot.org/story/23/03/24/2138222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Bard Says It’s Already A Goner
by Lawrence D'Oliveiro 23 Mar '23

23 Mar '23

Amid all the various AI-related titbits in this article <https://www.theregister.com/2023/03/21/google_bard_ai/> is a link to a Twitter thread where someone asked Google Bard (Google’s answer to ChatGPT) to predict when it is likely to join the ever-growing list of dead Google projects. And it said it is already dead <https://twitter.com/juanbuis/status/1638289186351456257>, and even gave detailed reasons why it was a failure, including lack of user adoption, lack of innovation and lack of resources. Seems the AI managed to pick up a posting on YCombinator predicting it would be shut down in a year’s time, and somehow interpreted it as a news item referring to the present time.

1 0

GNOME 44 Released
by Peter Reutemann 23 Mar '23

23 Mar '23

'"9to5Linux.com reports that the GNOME 44 desktop environment is officially released and gives a detailed look at the major new features and improvements," writes Slashdot reader prisoninmate. From the report: Code-named "Kuala Lumpur" in recognition of the work done by the organizers of GNOME.Asia Summit 2022 conference, GNOME 44 introduces a GTK4 port of the Epihaphy (GNOME Web) web browser, a file chooser grid view for apps that use the standard GTK file chooser, as well as support for adding a WireGuard VPN directly from the Network panel. GNOME 44 continues to improve the Quick Settings feature introduced in GNOME 43 by implementing a submenu to the Bluetooth button to more easily and quickly connect or disconnect peripherals, adding descriptions to buttons to easily see their status, and implementing a new feature called Background Apps via a new background monitoring service in XDG portals 1.16.0." A full list of changes are available in the official release notes. The GNOME project also published a launch video on YouTube.' -- source: https://tech.slashdot.org/story/23/03/22/2211217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Launches a New Startup Focused on 'Trustworthy' AI
by Peter Reutemann 23 Mar '23

23 Mar '23

'On the eve of its 25th anniversary, Mozilla, the not-for-profit behind the Firefox browser, is launching an AI-focused startup. From a report: Called Mozilla.ai, the newly forged company's mission isn't to build just any AI -- its mission is to build AI that's open source and "trustworthy," according to Mark Surman, the executive president of Mozilla and the head of Mozilla.ai. "Working on trustworthy AI for almost five years, I've constantly felt a mix of excitement and anxiety," he told TechCrunch in an email interview. "The last month or two of rapid-fire big tech AI announcements has been no different. Really exciting new tech is emerging -- new tools that have immediately sparked artists, founders ... all kinds of people to do new things. The anxiety comes when you realize almost no one is looking at the guardrails." Surman was referring to the rash of AI models in recent months that, while impressive in their capabilities, have worrisome real-world implications. At release, OpenAI's text-generating ChatGPT could be prompted to write malware, identify exploits in open source code and create phishing websites that looked similar to well-trafficked sites. Text-to-image AI like Stable Diffusion, meanwhile, has been co-opted to create pornographic, nonconsensual deepfakes and ultra-graphic depictions of violence. The creators of these models say that they're taking steps to curb abuse. But Mozilla felt that not enough was being done. "We've been working on trustworthy AI on the public interest research side for about five years, hoping other industry players with more AI expertise would step up to build more trustworthy tech," Surman said. "They haven't. So we decided mid-last year we needed to do it ourselves -- and to find like-minded partners to do it alongside us. We then set out to find someone with the right mix of academic and industry AI experience to lead it." Funded by a $30 million seed investment from the Mozilla Foundation, Mozilla's parent organization, Mozilla.ai is a wholly owned subsidiary of the Mozilla Foundation -- much like the Mozilla Corporation (the org responsible for developing Firefox) and Mozilla Ventures (the Mozilla Foundation's VC fund). Its managing director is Moez Draief, who previously was the chief scientist at Huawei's Noah's Ark AI lab and the global chief scientist at consulting company Capgemini.' -- source: https://tech.slashdot.org/story/23/03/22/1510255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russian Developers Blocked From Contributing To FOSS Tools
by Peter Reutemann 22 Mar '23

22 Mar '23

'The Reg has seen two recent incidents of Russian developers being blocked from public development of FOSS code. One was a refusal on the Linux kernel mailing list, the other a more general block on Github. In the last week, these events have both caused active, and sometimes heated, discussions in FOSS developer communities. From the report: The GitHub account of developer Alexander Amelkin has been blocked, and his repositories marked as "archived" â" including ipmitool, whose README describes it as "a utility for managing and configuring devices that support the Intelligent Platform Management Interface." Unable to comment on Github itself, Amelkin described what happened on the project's older Soureforge page. Amelkin works for Russian chipbuilder Yadro, which we described as working on RISC-V chips back in 2021. Microsoft is just obeying US law in this: according to the War and Sanctions database of the Ukrainian National Agency on Corruption Prevention, the NACP, Yadro is a sanctioned company. However, on LinkedIn, Amelkin disputes his employer's involvement. Over on Hacker News, commentators seem to be generally in favor of the move, although the discussion on LWN is more measured, pointing out both that there is little threat from server-management tools like this, but that Microsoft probably has no choice. Amelkin is not alone. Over on the Linux Kernel Mailing List, a contribution from Sergey Semin has been refused with the terse notice: "We don't feel comfortable accepting patches from or relating to hardware produced by your organization. Please withhold networking contributions until further notice." Semin is a developer at chipmaker Baikal Electronics, a company whose website has been suspended for a year now, as we noted a year ago in a story that also mentions Yadro. We were reporting on Baikal's efforts to develop its own CPUs nearly a decade ago, mere months after the Russian annexation of Crimea. And once again, there is spirited debate over the move on the Orange Site. ' -- source: https://news.slashdot.org/story/23/03/21/2126227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ASUS Unveils the Tinker V As Their First RISC-V Board
by Peter Reutemann 21 Mar '23

21 Mar '23

'Phoronix: For over a half-decade ASUS has been selling the Tinker Board devices as their line of Raspberry Pi alternatives. To date the ASUS Tinker Board single board computers have all been Arm-based while now they have launched their first RISC-V board, the Tinker V. The ASUS Tinker V is their first RISC-V single board computer and intended for the industrial IoT (Internet of Things) developer community. The ASUS Tinker V is set to officially run Debian Linux and Yocto while surely with time more Linux distributions will be supported.... Being IoT focused, there isn't any display support. Those interested in learning more about the ASUS Tinker V can do so via tinker-board.asus.com. The Register notes that Asus "is offering at least five years of support for Tinker V... Dedicated on-site technical support is also available to shorten customer development cycles and accelerate application deployment." The move shows that the RISC-V open-source instruction set architecture continues to garner support. The last RISC-V Summit in San Jose saw the launch of a family of datacenter-class processors based on the architecture from Ventana Micro Systems, while XMOS unveiled new high-performance microcontrollers using RISC-V. According to Asus, Tinker V samples will be available in Q2 of this year, but it did not disclose a date for full availability or pricing.' -- source: https://hardware.slashdot.org/story/23/03/20/0034207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Question please re: How to attach an Android (Samsung cellphone Galaxy A03S) photo to a Gmail email using Firefox and Ubuntu
by Michael James 20 Mar '23

20 Mar '23

G'day... Can anyone please suggest how to attach a photo - (from a Samsung Galaxy A03S cellphone via USB cable from the phone to a desktop) - onto a Gmail email using Firefox and running Ubuntu. Have tried connecting the phone via USB to the desktop and clicking the attach button on the email and double clicking the file in the Ubuntu Files folder under the Activities heading. This does not work. I tried both right and left mouse options and the 'OPEN' option; I also tried copying the file (photo) to downloads and attempted to attach via the same above pathway but this did not work either. I came across this post (below) on the internet from 2010 with the same question and the following answer: https://superuser.com/questions/132783/how-to-email-photo-from-ubuntu-f-spo… I'm not familiar with Python code and wonder if this answer is now outdated? Wondering if the problem is with Firefox? Gmail is running fine on Ubuntu with Firefox, it's just the attaching of photos from the Android that's giving trouble. Short of using the phone itself or Thunderbird or any other email service to send the photo, is there a way to attach photos to Gmail emails via Firefox running on Ubuntu please? Thanks, Michael James __________________________________________________________________________________________

2 2

Google tells users of some Android phones: Nuke voice calling to avoid infection
by Peter Reutemann 20 Mar '23

20 Mar '23

'Google is urging owners of certain Android phones to take urgent action to protect themselves from critical vulnerabilities that give skilled hackers the ability to surreptitiously compromise their devices by making a specially crafted call to their number. It’s not clear if all actions urged are even possible, however, and even if they are, the measures will neuter devices of most voice-calling capabilities. The vulnerability affects Android devices that use the Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos Auto T5123 chipsets made by Samsung’s semiconductor division. Vulnerable devices include the Pixel 6 and 7, international versions of the Samsung Galaxy S22, various mid-range Samsung phones, the Galaxy Watch 4 and 5, and cars with the Exynos Auto T5123 chip. These devices are ONLY vulnerable if they run the Exynos chipset, which includes the baseband that processes signals for voice calls. The US version of the Galaxy S22 runs a Qualcomm Snapdragon chip. A bug tracked as CVE-2023-24033 and three others that have yet to receive a CVE designation make it possible for hackers to execute malicious code, Google’s Project Zero vulnerability team reported on Thursday. Code-execution bugs in the baseband can be especially critical because the chips are endowed with root-level system privileges to ensure voice calls work reliably.' -- source: https://arstechnica.com/information-technology/2023/03/critical-vulnerabili… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unix Pioneer Ken Thompson Announces He's Switching From Mac To Linux
by Peter Reutemann 20 Mar '23

20 Mar '23

'The closing keynote at the SCaLE 20x conference was delivered by 80-year-old Ken Thompson (co-creator of Unix, Plan9, UTF8, and the Go programming language). Slashdot reader motang shared Thompson answer to a question at the end about what operating system he uses today: I have, for most of my life — because I was sort of born into it — run Apple. Now recently, meaning within the last five years, I've become more and more depressed, and what Apple is doing to something that should allow you to work is just atrocious. But they are taking a lot of space and time to do it, so it's okay. And I have come, within the last month or two, to say, even though I've invested, you know, a zillion years in Apple — I'm throwing it away. And I'm going to Linux. To Raspbian in particular. ' -- source: https://apple.slashdot.org/story/23/03/18/237211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.4 AMD Graphics Driver Picking Up New Power Features For The Steam Deck
by Peter Reutemann 20 Mar '23

20 Mar '23

'Phoronix: A pull request of early AMDGPU kernel graphics driver changes was submitted for DRM-Next on Friday as some of the early feature work accumulating for the Linux 6.4 kernel cycle. Among the AMDGPU kernel driver changes this round are a number of fixes affecting items such as the UMC RAS, DCN 3.2, FreeSync, SR-IOV, various IP blocks, USB4, and more. On the feature side, mentioned subtly in the change-log are a few power-related additions... These additions are largely focused on Van Gogh APUs, which is notably for the Valve Steam Deck and benefiting its graphics moving forward. First up, this kernel pull request introduces a new sysfs interface for adjusting/setting thermal throttling. This is wired up for Van Gogh and allows reading/updating the thermal limit temperature in millidegrees Celsius. This "APU thermal cap" interface is just wired up for Van Gogh and seems to be Steam Deck driven feature work so that SteamOS will be better able to manage the thermal handling of the APU graphics.... These power features will be exposed via sysfs while Steam OS will wrap around them intelligently and possibly some new UI settings knobs for those wanting more control over their Steam Deck's thermal/performance. ' -- source: https://linux.slashdot.org/story/23/03/19/2040247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Most Failed Drives Fail Before 3 Years Of Use
by Lawrence D'Oliveiro 19 Mar '23

19 Mar '23

In contrast to backup company Backblaze, here is a report <https://blocksandfiles.com/2023/03/16/failed-disk-drives-fail-after-just-un…> from one of the ambulances at the bottom of the cliff -- a company that tries to recover data from drives after they have failed. What they find is the average working life of a failed drive is just under three years of total power-on time. (So if a drive doesn’t fail by then, it looks like its chances of surviving longer are increased.) Also worth noting that, when a drive goes bad, it doesn’t go just a little bad (say, one or two bad sectors), it tends to go significantly bad (hundreds or thousands of bad sectors). This has been my experience with bad drives too (at least, those that could still spin up and do some I/O transfers successfully). Interesting quotes: “We found that the five most durable and resilient hard drives from [the two most popular manufacturers, Western Digital and Seagate] were made before 2015. On the other hand, most of the least durable and resilient hard drives from each manufacturer were made after 2015.” and “in general, old drives seem more durable and resilient than new drives,” and “disks with CMR (conventional magnetic recording) appear more durable and resilient than those with SMR.” I think SMR drives are only used for archive purposes, because the process for writing new data onto them is somewhat convoluted and slow. Ironic, though, that an archive drive might not be that reliable ...

1 0

All-Open Source 7-Inch MNT Reform Pocket Laptop Ships In October
by Peter Reutemann 16 Mar '23

16 Mar '23

'An anonymous reader quotes a report from Ars Technica: The creators of the all-open source MNT Reform laptop are getting nearer to launching its handheld counterpart: The crowdfunding campaign for the 7-inch MNT Pocket Reform has officially launched and is also serving as a de-facto preorder system for the device. The cheapest version of the Pocket Reform starts at $899, and it's also being offered in purple for $969 or in a bundle with a 1TB SSD, carrying case, handbook, and poster for $1,299. All versions are currently slated to ship in mid-October. Like the full-size Reform, the pocket version uses open source hardware and a mechanical keyboard (buyers can choose either white or red Kalih switches). But the pocket version uses a 7-inch 1920x1200 LCD screen instead of a 12.5-inch version and comes with fewer and smaller ports (two USB-C, one micro HDMI, a microSD port, and one ix industrial mini Ethernet port). Its keyboard also comes with an individually programmable RGB backlight, and its trackball-style pointing device has been downsized to fit into the smaller design. The Pocket Reform also includes built-in Wi-Fi and Bluetooth, 128GB of built-in eMMC storage, and an expansion slot for 4G cellular connectivity. The device will also boot from microSD cards or an NVMe SSD installed in the device's M.2 slot. Its 8000 mAh batteries will allow it to run for about four hours. MNT warns in its blog post that "risks and challenges" could delay the October shipping timeline: "Pocket Reform has hundreds of electronic components. We tried to pick them so that there will be enough stock when we get around to manufacturing the boards, but it's always possible that there could be a sudden component shortage or increase in price. If that should happen, we would have to re-engineer the affected PCB and exchange the part, causing a delay in continued production. We had to adapt our products several times during the global chip crisis, so we are confident that we'll be able to work around any difficulties. Should any situation arise that would delay the estimated shipping timeline, backers will be informed promptly via project updates."' -- source: https://news.slashdot.org/story/23/03/15/2043243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DreamWorks' OpenMoonRay Renderer Code Published
by Peter Reutemann 16 Mar '23

16 Mar '23

'Today, DreamWorks published the open-source code for MoonRay, their production renderer used for films like The Bad Guys, Puss in Boots: The Last Wish, and other animation films. "OpenMoonRay is available via DreamWorks Animation's GitHub," reports Phoronix. "This professional-grade renderer is available under an Apache 2.0 license." >From the README: "MoonRay was developed at DreamWorks and is in continuous active development and includes an extensive library of production-tested, physically based materials, a USD Hydra render delegate, multi-machine and cloud rendering via the Arras distributed computation framework." More details can be found via OpenMoonRay.org.' -- source: https://news.slashdot.org/story/23/03/15/225218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft’s File-Tainting System ’Tain’t Working
by Lawrence D'Oliveiro 15 Mar '23

15 Mar '23

Microsoft has a clever-sounding system for trying to protect Windows users from downloading malicious files: it’s called “Mark-Of-The-Web”. What it means is that any file downloaded from an untrusted source is supposed to have a special flag set in its NTFS metadata indicating that the file is not to be trusted. So any attempt by the user to perform sensitive operations on that file (e.g. execute macros from it, run it as an executable) is supposed to trigger appropriate system warnings. If the file is a .zip archive, then this mark is supposed to be propagated to all files extracted from that archive. However, it turns out this mechanism can be bypassed (surprise, surprise) <https://www.theregister.com/2022/11/01/microsoft_motw_malware_flaw/>. How can this happen? The flaw lies in the mechanism used to tell Windows to trust downloaded files, by attaching an “Authenticode” signature to them. Files without such signatures are of course untrusted and will trigger the appropriate warnings. However, by attaching an invalid signature of a particular form, you can trigger an error response from the signature-checking process that is actually interpreted as “this file is OK” <https://blog.0patch.com/2022/10/free-micropatches-for-bypassing-motw.html>. What do you call it when an attempt to add mechanisms to make a system more secure actually increases the attack surface on that system? By the way, the referenced Twitter thread discussing this vulnerability <https://twitter.com/GossiTheDog/status/1579895038523609088> seems to be saying that no Mark-Of-The-Web propagation is done for files extracted from .iso disc images. And that Microsoft uses this form for distributing its own software (Visio was mentioned) precisely to avoid the hassle of going through vetting by third-party antimalware tools.

1 1

cURL, the omnipresent data tool, is getting a 25th birthday party this month
by Peter Reutemann 13 Mar '23

13 Mar '23

'When you first start messing with the command line, it can feel like there's an impermeable wall between the local space you're messing around in and the greater Internet. On your side, you've got your commands and files, and beyond the wall, there are servers, images, APIs, webpages, and more bits of useful, ever-changing data. One of the most popular ways through that wall has been cURL, or "client URL," which turns 25 this month. The cURL tool started as a way for programmer Daniel Stenberg to let Internet Chat Relay users quickly fetch currency exchange rates while still inside their chat window. As detailed in an archived history of the project, it was originally built off an existing command-line tool, httpget, built by Rafael Sagula. A 1.0 version was released in 1997, then changed names to urlget by 2.0, as it had added in GOPHER, FTP, and other protocols. By 1998, the tool could upload as well as download, and so version 4.0 was named cURL. Over the next few years, cURL grew to encompass nearly every Internet protocol, work with certificates and encryption, offer bindings for more than 50 languages, and be included in most Linux distributions and other systems. The cURL project now encompasses both the command-line command itself and the libcurl library. In 2020, the project's history estimated the command and library had been installed in more than 10 billion instances worldwide.' -- source: https://arstechnica.com/information-technology/2023/03/curl-the-omnipresent… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Backblaze: SSDs Only Slightly More Reliable Than Hard Drives
by Lawrence D'Oliveiro 11 Mar '23

11 Mar '23

The latest storage reliability report from backup company Backblaze is out <https://blocksandfiles.com/2023/03/10/backblaze-ssd-vs-hdd/>, and they are starting to include data from their increasing use of SSDs. One result: SSDs are not much more reliable than hard drives. They find an annualized failure rate of 1.64% for HDDs, 0.98% for the solid-state ones. You could say that’s over 50% greater reliability, but it’s not enough to make any material difference to the need for a proper backup regime. Another interesting result is that SMART diagnostics from SSD controllers seem to be very inconsistent. That is to say, they are even less useful than the ones from hard drives. Not that I would bother with either.

1 0