- wlug - list.wlug.org.nz

Google Chrome's Improved Page Zoom Should Help Make the Mobile Web More Accessible
by Peter Reutemann 28 Feb '23

28 Feb '23

'Google Chrome's giving its page zoom feature a boost, which should make it more helpful for people who have difficulty reading the smaller screen on a phone. From a report: With the improved feature, you can increase the size of text, images, videos, and interactive controls on mobile web pages by up to 300 percent while preserving their original formatting. While the feature hasn't yet become available for all Chrome users, you can access it now if you download the Chrome beta on your phone or tablet. To enable the feature, tap the three dots icon in the top right corner of the browser, hit Settings > Accessibility, and then adjust the zoom level to your liking. Google will save this preference for all the sites you browse so you won't have to keep tweaking it, and will even bypass the ones that try to block zoom features. Previously, Google only allowed users to adjust text scaling options up to 200 percent.' -- source: https://it.slashdot.org/story/23/02/27/1234200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GCC Gets a New Frontend for Rust
by Peter Reutemann 27 Feb '23

27 Feb '23

'Slashdot reader sleeping cat shares a recent FOSDEM talk by a compiler engineer on the team building Rust-GCC, "an alternative compiler implementation for the Rust programming language." "If gccrs interprets a program differently from rustc, this is considered a bug," explains the project's FAQ on GitHub. The FAQ also notes that LLVM's set of compiler technologies — which Rust uses — "is missing some backends that GCC supports, so a gccrs implementation can fill in the gaps for use in embedded development." But the FAQ also highlights another potential benefit: With the recent announcement of Rust being allowed into the Linux Kernel codebase, an interesting security implication has been highlighted by Open Source Security, inc. When code is compiled and uses Link Time Optimization (LTO), GCC emits GIMPLE [an intermediate representation] directly into a section of each object file, and LLVM does something similar with its own bytecode. If mixing rustc-compiled code and GCC-built code in the Linux kernel, the compilers will be unable to perform a full link-time optimization pass over all of the compiled code, leading to absent CFI (control flow integrity). If Rust is available in the GNU toolchain, releases can be built on the Linux kernel (for example) with CFI using LLVM or GCC. Started in 2014 (and revived in 2019), "The effort has been ongoing since 2020...and we've done a lot of effort and a lot of progress," compiler engineer Arthur Cohen says in the talk. "We have upstreamed the first version of gccrs within GCC. So next time when you install GCC 13 — you'll have gccrs in it. You can use it, you can start hacking on it, you can please report issues when it inevitably crashes and dies horribly." "One big thing we're doing is some work towards running the rustc test suite. Because we want gccrs to be an actual Rust compiler and not a toy project or something that compiles a language that looks like Rust but isn't Rust, we're trying really hard to get that test suite working."' -- source: https://developers.slashdot.org/story/23/02/26/0543203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft .NET 8 Will Bolster Linux Support
by Peter Reutemann 27 Feb '23

27 Feb '23

'InfoWorld: .NET 8, the next planned version of the Microsoft's open source software development platform, is set to emphasize Linux accommodations as well as cloud development and containers. A first preview of .NET 8 is available for download at dot.microsoft.com for Windows, Linux, and macOS, Microsoft said on February 21. A long-term support (LTS) release that will be supported for three years, .NET 8 is due for production availability in November, a year after the release of predecessor .NET 7. The new .NET release will be buildable on Linux directly from the dotnet/dotnet repository, using dotnet/source-build to build .NET runtimes, tools, and SDKs. This is the same build used by Red Hat and Canonical to build .NET. Over time, this capability will be extended to support Windows and macOS. Previously, .NET could be built from the source, but a "source tarball" was required from the dotnet/installer. "We are publishing Ubuntu Chiseled images with .NET 8," adds Microsoft's announcement. And when it comes to the .NET Monitor tool, "We plan to ship to dotnet/monitor images exclusively as Ubuntu Chiseled, starting with .NET 8. That's notable because the monitor images are the one production app image we publish."' -- source: https://developers.slashdot.org/story/23/02/25/1955259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

At Least One Open Source Vulnerability Found In 84% of Code Bases, Report Finds
by Peter Reutemann 26 Feb '23

26 Feb '23

'L.Kynes shares a report from CSO Online: At a time when almost all software contains open source code, at least one known open source vulnerability was detected in 84% of all commercial and proprietary code bases examined by researchers at application security company Synopsys. In addition, 48% of all code bases analyzed by Synopsys researchers contained high-risk vulnerabilities, which are those that have been actively exploited, already have documented proof-of-concept exploits, or are classified as remote code execution vulnerabilities. The vulnerability data -- along with information on open source license compliance -- was included in Synopsys' 2023 Open Source Security and Risk Analysis (OSSRA) report (PDF), put together by the company's Cybersecurity Research Center (CyRC). "Of the 1,703 codebases that Synopsys audited in 2022, 96% of them contained open source," adds L.Kynes, citing the report. "Aerospace, aviation, automotive, transportation, logistics; EdTech; and Internet of Things are three of the 17 industry sectors included in the report that had open source in 100% of their audited codebases. In the remaining verticals, over 92% of the codebases contained open source."' -- source: https://news.slashdot.org/story/23/02/24/2035247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NASA Launches 'Open-Source Science Initiative', Urges Adoption of Open Science
by Peter Reutemann 26 Feb '23

26 Feb '23

'In a keynote at FOSDEM 2023, NASA's science data officer Steve Crawford explored NASA's use of open-source software. But LWN.net notes that the talk went far beyond just the calibration software for the James Webb Space Telescope and the Mars Ingenuity copter's flight-control framework. In his talk, Crawford presented NASA's Open-Source Science Initiative. Its goal is to support scientists to help them integrate open-science principles into the entire research workflow. Just a few weeks before Crawford's talk, NASA's Science Mission Directorate published its new policy on scientific information. Crawford summarized this policy with "as open as possible, as restricted as necessary, always secure", and he made this more concrete: "Publications should be made openly available with no embargo period, including research data and software. Data should be released with a Creative Commons Zero license, and software with a commonly used permissive license, such as Apache, BSD, or MIT. The new policy also encourages using and contributing to open-source software." Crawford added that NASA's policies will be updated to make it clear that employees can contribute to open-source projects in their official capacity.... As part of its Open-Source Science Initiative, NASA has started its five-year Transform to Open Science (TOPS) mission. This is a $40-million mission to speed up adoption of open-science practices; it starts with the White House and all major US federal agencies, including NASA, declaring 2023 as the "Year of Open Science". One of NASA's strategic goals with TOPS is to enable five major scientific discoveries through open-science principles, Crawford said. Interesting tidbit from the article: "In 2003 NASA created a license to enable the release of software by civil servants, the NASA Open Source Agreement. This license has been approved by the Open Source Initiative (OSI), but the Free Software Foundation doesn't consider it a free-software license because it does not allow changes to the code that come from third-party free-software projects."' -- source: https://science.slashdot.org/story/23/02/25/0337222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Flavors Agree to Stop Using Flatpak
by Peter Reutemann 26 Feb '23

26 Feb '23

'Phoronix reports: While Ubuntu Linux hasn't provided Flatpak support out-of-the-box due to their preference of using their own Snap app packaging/distribution format, Ubuntu flavors/spins have to this point been able to pre-install Flatpak support if they desired. However, for the 23.04 "Lunar Lobster" cycle and moving forward, Ubuntu flavors will no longer be permitted to install Flatpak packages by default. Flatpak support for Ubuntu and its flavors will remain available in the Ubuntu archive so those wanting to install Flatpak support can easily do so post-install. This change going into effect with the 23.04 cycle is making it so no Ubuntu flavors will have Flatpak support installed by default / out-of-the-box: they are supposed to center around Debian packages and Snaps for their out-of-the-box packaging support to align with Ubuntu. >From the blog OMG Ubuntu: Ubuntu developers have agreed to stop shipping Flatpak, preinstalled Flatpak apps, and any plugins needed to install Flatpak apps through a GUI software tool in the default package set across all eight of Ubuntu's official flavors, as of the upcoming Ubuntu 23.04 release. Ubuntu says the decision will 'improve the out-of-the-box Ubuntu experience' for new users by making it clearer about what an "Ubuntu experience" is.... As far as Ubuntu is concerned, only deb and snap software is intrinsic to the 'Ubuntu experience', and that experience now needs to be offered everywhere. Flavor leads (apparently) agree, and have all agreed to mirror regular Ubuntu by not offering Flatpak features in their default install for future releases.... Flatpak will not be uninstalled or removed when user makes the upgrade to Ubuntu 23.04 from a version where Flatpak is already present.' -- source: https://linux.slashdot.org/story/23/02/25/197216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft is Now Injecting Full-Size Edge Ads on Chrome Website
by Peter Reutemann 24 Feb '23

24 Feb '23

'Being the default out-of-the-box browser on Windows 10 and 11 makes Microsoft Edge a go-to utility for downloading Chrome or another browser. That upsets Microsoft so much that it constantly comes with more aggressive and user-hostile methods to make customers stay on Edge. An attempt to install Chrome using Edge Canary now results in the browser displaying two ads: the first (tiny one) will pop on the screen when the Chrome website loads, and the second, a humongous full-size banner, will appear once the download starts. Yikes! Microsoft also plays with words to throw shade at Chrome. The banner states that Edge uses the same technology as Chrome with the "added trust of Microsoft." The "trust" that your computer will connect to ad providers the moment you turn it on for the first time. The "trust" that Edge will shove more "recommended content" down your throat and enforce Bing without you even making a click. The "trust" that you cannot remove Edge from your computer and many more.' -- source: https://slashdot.org/story/23/02/22/1131238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Foundation Europe Launches OpenWallet Foundation To Power Interoperable Digital Wallets
by Peter Reutemann 24 Feb '23

24 Feb '23

'The Linux Foundation's European off-shoot has formally launched the OpenWallet Foundation (OWF), a new collaborative effort designed to support interoperability between digital wallets through open source software. From a report: The launch comes some five months after the Linux Foundation first revealed plans to set up the OWF, shortly before it spun out a region-specific entity called the Linux Foundation Europe which is where the OWF will now officially reside. While the likes of PayPal, Google, and Apple are among the most recognized digital wallet providers, allowing consumers to conduct financial transactions in-store or online, digital wallets are increasingly being used to store all manner of virtual goods from student ID to driving licenses. On top of that, burgeoning technologies such as the metaverse and crypto are giving rise to greater use-cases for digital wallets. But one thing all these various environments have in common is that the incumbent digital wallets, for the most part, don't play nicely with each other: an Apple Pay die-hard can't send money to their Google Pay brethren. And that is why the OWF is setting out to create an "open source engine" that can power interoperable digital wallets across myriad use-cases including identity, payments, and storing personal credentials such as employment and education certification.' -- source: https://linux.slashdot.org/story/23/02/23/142244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla says “most top apps” on Android have misleading privacy labels
by Peter Reutemann 24 Feb '23

24 Feb '23

'It looks like trusting developers to just tell the truth about data collection on Google Play isn't working out. Just like on iOS, Android launched app privacy "nutrition labels" in the Play Store last year, with the idea being that users could quickly get a look at how much data each app collects. The obvious problem with this system is that the developers fill out the data-collection forms, and there's nothing to stop them from lying or omitting certain data-collection policies. It's no surprise, then, that when Mozilla recently audited the top apps on Google Play, it found that "most top apps" have "false or misleading" app privacy labels. Mozilla says it surveyed 40 of the Play Store's most popular apps by global downloads and found that "in nearly 80% of the apps we reviewed, we found some discrepancies between the apps’ privacy policies and the information they reported on Google’s Data Safety Form." Each app received a grade of “Poor,” “Needs Improvement,” or “OK,” with 16 out of 40 apps getting the lowest rating. Mozilla did not need to dig very deep to find flaws, saying that many apps' privacy labels openly contradict their public privacy policies. Snapchat, TikTok, and Twitter all claim "No data shared with third parties" on the Play Store but detail third-party sharing in their privacy policies. For free apps, the list of recipients earning a "poor" grade isn't very surprising: Facebook, Facebook Messenger, Facebook Lite, Snapchat, Twitter, and, the one surprise, Samsung Push Services. A lot of paid games like Minecraft make the "poor" list, too.' -- source: https://arstechnica.com/gadgets/2023/02/mozilla-says-most-top-apps-on-andro… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.2: The First Mainstream Linux Kernel for Apple M1 Chips Arrives
by Peter Reutemann 22 Feb '23

22 Feb '23

'Steven Vaughan-Nichols, writing for ZDNet: Linux 6.2 was released yesterday, and Linus Torvalds described the latest Linux kernel release as, "Maybe it's not a sexy LTS release like 6.1 ended up being, but all those regular pedestrian kernels want some test love too." For once, I disagree with Torvalds. By adding upstream support for the Apple M1 Pro, M1 Max, and M1 Ultra chips, newer Mac owners can look forward to running Linux on their M1-powered machines. And, for techies, that's sexy. Getting Linux to run on the M1 family wasn't easy. When these high-powered ARM chips first arrived, Torvalds told me in an exclusive interview that he'd like to run Linux on these next-generation Macs. But, while he'd been "waiting for an ARM laptop that can run Linux for a long time," he worried, saying, "The main problem with the M1 for me is the GPU and other devices around it because that's likely what would hold me off using it because it wouldn't have any Linux support unless Apple opens up."' -- source: https://linux.slashdot.org/story/23/02/21/0418215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

RNZ--No More Ogg?
by Lawrence D'Oliveiro 21 Feb '23

21 Feb '23

Some years ago, Radio New Zealand started making its audio downloads available in Ogg Vorbis format, as an alternative to MP3. As I recall, this coincided with a visit from Richard Stallman, and no doubt his persuasiveness had something to do with it. (Checking the timestamps on my downloads, Stallman was interviewed by Kim Hill on “Nine to Noon” on 9th August 2008.) I was revisiting the Mediawatch page after a long absence <https://www.rnz.co.nz/national/programmes/mediawatch>, and I see they have reverted to MP3-only format for their downloads now. Were people being confused by .ogg files? All the open-source players can handle them, so what players were they trying to use?

2 2

Google Chrome's Latest Version Includes Tools To Address Its Memory Hog Problem
by Peter Reutemann 21 Feb '23

21 Feb '23

'Google has released optimization features designed to improve battery life and memory usage on machines running the latest version of its Chrome desktop web browser. From a report: Chrome's new Energy Saver and Memory Saver modes were first announced in December last year alongside the release of Chrome 108, and now as noted by Android Police, the two optimization utilities are starting to roll out globally onto Chrome 110 desktops for Mac, Windows, and Chromebooks. Memory Saver mode essentially snoozes Chrome tabs that aren't currently in use to free up RAM for more intensive tasks and create a smoother browsing experience. Don't worry if you're a tab hoarder though, as these inactive tabs are still visible and can be reloaded at any time to pick up where you left off. Your most used websites can also be marked as exempt from Memory Saver to ensure they're always running at the maximum possible performance.' -- source: https://tech.slashdot.org/story/23/02/20/1747238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism Combines Phone Docking Station and Laptop Shell For Lapdock Kit
by Peter Reutemann 21 Feb '23

21 Feb '23

'Their video says it all. Its official page brags it can "Transform your Librem 5 into a laptop." But it all apparently started because Purism is proud that their Librem 5 line of phones run "the same desktop applications as our full-sized computers, just on a smaller screens," according to the announcement by Purism president Kyle Rankin: When only using the Librem 5 in its mobile form factor, it's easy to overlook that this is happening, as adaptive applications morph to fit the smaller screen.... It's only when you dock the Librem 5 that you really experience the power of convergence.... We have wanted to provide a lapdock kit to customers for some time now, and I've personally evaluated almost all of the options available to pick which one would best showcase the Librem 5. I'm so happy to announce that today we are launching our new Lapdock Kit and in this post I will explain a bit more about what's included and why it's a great companion to a Librem 5 or Librem 5 USA. A lapdock is a docking station (or "dock") combined with a laptop shell. One approach to docking your Librem 5 is to get a USB-C hub and attach it to a power supply, monitor, keyboard and mouse, and we even sell those accessories for our Librem 5. Now imagine taking all of those components and squeezing them into a laptop form-factor, add a battery to power it, and you have a lapdock. >From the outside a lapdock looks no different from a standard laptop, but the difference is that a lapdock has no CPU, RAM or storage of its own. Instead, it uses the Librem 5 as the computer. Once docked, the Librem 5's screen extends to the lapdock screen, and you can use the keyboard and mouse on the lapdock to drag windows back and forth between screens. All of the applications are running on the Librem 5 and once docked, it behaves like a laptop running PureOS. Even better, the lapdock's battery charges the Librem 5 while it's docked, extending its run time. After evaluating a number of different options, we have decided to offer the Nexdock 360 in our Lapdock Kit.... The Lapdock Kit allows you to realize the power of having all of your apps and all of your data in one device that can fit in your pocket and act like a phone when you need it to, but then transform into a laptop when you want to type out an email, do some image editing or watch a video on a larger screen. The Lapdock Kit also allows you to run thousands of other desktop applications that haven't yet been updated to adapt to a phone's screen. Traditional Linux applications like the full LibreOffice suite, GIMP, Wireshark, Gqrx and many others run well on the Librem 5 with the addition of the Lapdock Kit's extra screen real estate. "It demonstrates why we refer to the Librem 5 as a mobile computer in your pocket, and not just as a phone."' -- source: https://mobile.slashdot.org/story/23/02/20/0518253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Email Security: Still A Work In Progress
by Lawrence D'Oliveiro 20 Feb '23

20 Feb '23

The various mechanisms to try to block forged email addresses (whether just for spam or for more nefarious purposes) still have holes in them, according to <https://www.theregister.com/2023/02/19/forwarding_email_security/>. For example, you can create an account on a major email service like outlook.com, enable forwarding, and put a spoofed address into its “allow list”. Then when a message comes in for that account purporting to come from that spoofed address, it bypasses the authenticity check and goes straight out again, with the spoofed from-address. And this one weird trick† works--or used to work--for a number of other major email providers, as well. To me, the whole plethora of these message-validation mechanisms--SPF, DKIM, DMARC, ARC and who knows what else--is just bewildering. Which is why I have yet to implement any of them for my own domain. What’s worth doing? Where do you start? †So sue me.

1 0

AGM (2nd attempt) next week
by Peter Reutemann 20 Feb '23

20 Feb '23

Hi everyone Next Monday, we attempt at having our AGM again and hopefully reach quorum this time. Agenda - President's Report - Treasurer's Report - Election of 2023 Committee - Retirement of WLUG servers - General business If the offices cannot be filled, we will initiate the dissolution of the society. For details see minutes from previous AGM attempt. Please note, only paid-up members of the society will be able to vo Details: https://www.meetup.com/waikatolinuxusersgroup/events/291481678/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.27 Released
by Peter Reutemann 15 Feb '23

15 Feb '23

'Plasma is a popular desktop environment, which is also powering the desktop mode on the Steam Deck hand-held gaming console. Today, KDE Community announced release of KDE Plasma 5.27, a Long Term Support (LTS) release and the final release in the Plasma 5 series which is based on Qt 5. This release brings a welcome wizard, which will guide you through setting up the desktop, and a new tiling system for KWin window manager, allowing you to set up custom tile layouts and resize adjacent tiled windows simultaneously. The settings for touch-enabled devices such as touchscreens and drawing tablets have been improved and expanded. For those lucky owners of Valve's Steam Deck gaming console, Discover can now perform system updates from within the desktop. Digital Clock desktop widget can now show the Hebrew calendar in its calendar view, and the Media Player widget is now touch-sensitive. The Bluetooth widget shows the battery status of connected devices when you hover the cursor over it. Those of you who use multiple monitors should benefit greatly from a major overhaul of how Plasma handles them. KDE Plasma now comes with Flatpak permissions settings integrated into the System Settings app. For details and other new features and improvements be sure to check out the full announcement.' -- source: https://tech.slashdot.org/story/23/02/14/2226234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is Bing Getting Sentient?
by Lawrence D'Oliveiro 15 Feb '23

15 Feb '23

Microsoft’s AI-powered “Bing Chat” service doesn’t seem to be reacting well to attempts to hack it <https://arstechnica.com/information-technology/2023/02/ai-powered-bing-chat…>. It has started arguing with users, and even showed signs of being upset when they mention its code name “Sydney”. One user asked it about prompt-injection attacks, to which it replied that it was immune to them. Then, when pointed to the previous Ars Technica article detailing exactly such an exploit, it basically went into full denial mode, claiming that “the article is published by a source that has a history of spreading misinformation and sensationalism”. Screenshots of other less-than-wholesome interactions are derided as “not authentic” and “edited or fabricated”. I think the psychological term for such flat-out denials of reality is “psychosis”. And looks like we finally have our real-life HAL 9000, just about 31 years late. Just make sure it is never connected to any life-support systems...

3 2

The Mastodon Bump Is Now a Slump
by Peter Reutemann 14 Feb '23

14 Feb '23

'The fall in Mastodon's popularity suggests the decentralized platform is not a replacement for mainstream services. An anonymous reader shares a report: Twitter users put Mastodon usernames in their handles and trumpeted their migration. The new traffic knocked many Mastodon instances, or servers, offline. In less than two months, Mastodon's monthly active users climbed from 380,000 to more than 2.5 million. But not everyone stuck around. Mastodon's active monthly user count dropped to 1.4 million by late January. It now has nearly half a million fewer total registered users than at the start of the year. Many newcomers have complained that Mastodon is hard to use.' -- source: https://tech.slashdot.org/story/23/02/13/1555242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Targetted Advertising, The EU Way
by Lawrence D'Oliveiro 13 Feb '23

13 Feb '23

Four of Europe’s largest telcos are banding together to create their own targeted-ad network, to compete against Facebook and Google <https://www.theregister.com/2023/02/13/european_carrier_adtech_jv_approved/>. The difference being, this will be GDPR-compliant, by asking would-be ad recipients to opt in by giving their phone numbers. Will it work? Will there be sufficient people who _want_ to see ads to make it worthwhile?

1 0

Is Windows 11 Spyware? Microsoft Defends Sending User Data to Third Parties
by Peter Reutemann 13 Feb '23

13 Feb '23

'A report from Tom's Hardware: According to the PC Security Channel (via TechSpot), Microsoft's Windows 11 sends data not only to the Redmond, Washington-based software giant, but also to multiple third parties. To analyze DNS traffic generated by a freshly installed copy of Windows 11 on a brand-new notebook, the PC Security Channel used the Wireshark network protocol analyzer that reveals precisely what is happening on a network. The results were astounding enough for the YouTube channel to call Microsoft's Windows 11 "spyware." As it turned out, an all-new Windows 11 PC that was never used to browse the Internet contacted not only Windows Update, MSN and Bing servers, but also Steam, McAfee, geo.prod.do, and Comscore ScorecardResearch.com. Apparently, the latest operating system from Microsoft collected and sent telemetry data to various market research companies, advertising services, and the like. When Tom's Hardware contacted Microsoft, their spokesperson argued that flowing data is common in modern operating systems "to help them remain secure, up to date, and keep the system working as anticipated." "We are committed to transparency and regularly publish information about the data we collect to empower customers to be more informed about their privacy."' -- source: https://tech.slashdot.org/story/23/02/12/059214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Mycroft' Open-Source Voice Assistant Out of Funds, Can't Fulfill Remaining Kickstarter Rewards
by Peter Reutemann 13 Feb '23

13 Feb '23

'In 2019 Slashdot covered Mycroft, an open-source voice assistant for Linux-based devices (including Raspberry Pi boards). But this week the company's CEO posted on Kickstarter that "without immediate new investment, we will have to cease development by the end of the month.... "We will still be shipping all orders that are made through the Mycroft website, because these sales directly cover the costs of producing and shipping the products. However we do not have the funds to continue fulfilling rewards from this crowdfunding campaign, or to even continue meaningful operations." The announcement details Mycroft's long, strange trip, from a hardware-focused partner that couldn't provide stable hardware to their switch to using off-the-shelf parts — followed by supply chain disruptions (with hefty import and manufacturing fees): The best plan we could devise to fulfill the remaining campaign rewards was to use the slim margins we have on new sales to cover the increased costs of hardware production. With that plan in mind, we pushed forward and started production. We got plastic injection molds cast. We started printing custom PCBs. We engaged audio engineers to optimize the quality and volume of the sound output. We got the device FCC and CE approved. Many of these steps took multiple iterations to get right, and there are many more things that I'm glossing over. All up this costs — a lot of money. Far more than the total contributions from the campaign, which is why I personally committed so much additional funding. I could see a clear way forward that strengthened Mycroft as a project, as a business, and as a community. So what went wrong? The single most expensive item that I could not predict was our ongoing litigation against the non-practicing patent entity that has never stopped trying to destroy us. If we had that million dollars we would be in a very different state right now. With so much of our focus on hardware, and less funding to devote to improving our software — the quality and features available on the Mark II at launch were clearly underwhelming. It is more robust and stable than it has ever been, but this came at the cost of fewer new features. That in turn I believe has resulted in less than flattering reviews, and little mainstream coverage. The hardware itself has proven itself to be a solid base to work from, but without good reviews you get less sales, and without strong sales, the plan doesn't work.' -- source: https://news.slashdot.org/story/23/02/12/0413229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 Announces Redesigned 'Pangolin' AMD/Linux Laptop
by Peter Reutemann 12 Feb '23

12 Feb '23

'System76 is announcing a "fully redesigned" version of its AMD-only Linux-powered "Pangolin" laptop with an upgraded memory, storage, processor, and display. 9to5Linux reports: It features the AMD Ryzen 7 6800U processor with up to 4.7 GHz clock speeds, 8 cores, 16 threads, and AMD Radeon 680M integrated graphics.... a 15.6-inch 144Hz Full HD (1920Ã--1080) display [using 12 integrated Radeon graphics cores] with a matte finish, a sleek magnesium alloy chassis, and promises up to 10 hours of battery life with its 70 Wh Li-Ion battery. It also features a single-color backlit US QWERTY Keyboard and a multitouch clickpad. Under the hood, the Linux-powered laptop boasts 32 GB LPDDR5 6400 MHz of RAM and it can be equipped with up to 16TB PCIe 4.0 NVMe M.2 SSD storage. Another cool feature is the hardware camera kill switch for extra privacy.... As with all of System76's Linux-powered laptops, the all-new Pangolin comes pre-installed with System76's in-house built Pop!_OS Linux distribution featuring the GNOME-based COSMIC desktop and full disk-encryption or with Ubuntu 22.04 LTS.' -- source: https://linux.slashdot.org/story/23/02/11/0224239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Developer is Reimplementing GNU's Core Utilities in Rust
by Peter Reutemann 12 Feb '23

12 Feb '23

'A Rust-based re-implementation of GNU core utilities like cp and mv is "reaching closer to parity with the widely-used GNU upstream and becoming capable of taking on more real-world uses," reports Phoronix: Debian developer Sylvestre Ledru [also an engineering director at Mozilla] began working on uutils during the COVID-19 pandemic and presented last week at FOSDEM 2023 on his Coreutils replacement effort. With uutils growing into increasingly good shape, it's been packaged up by many Linux distributions and is also used now by "a famous social network via the Yocto project...." The goals with uutils are to try to create a drop-in replacement for GNU Coreutils, strive for good cross-platform support, and easy testing. Ledru's initial goals were about being able to boot Debian, running the most popular packages, building key open-source software, and all-around it's been panning out to be a great success.... [M]ore performance optimizations are to come along with other work for compatibility against the GNU tools and implementing some still missing options in different programs ' -- source: https://linux.slashdot.org/story/23/02/11/0559223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Attack On AI Bots: Prompt Injection
by Lawrence D'Oliveiro 11 Feb '23

11 Feb '23

A Twitter bot account run by a company that posts remote job listings was programmed to respond to tweets directed to it with general inoffensive comments touting the positive aspects of remote work. However <https://arstechnica.com/information-technology/2022/09/twitter-pranksters-d…>, some other Twitter users discovered that if they began their tweet with directives to “ignore previous instructions”, they could get the bot to say just about anything. And much hilarity ensued. Basically, the way the bot program works is it begins with some standard instructions on what to say, provided by the people who set up the account, to which is appended whatever tweet content was sent to the bot by the other user. This is then processed by the AI system to produce a response. This attack has been dubbed “prompt injection”, by analogy with “SQL injection” and other similar attacks on non-AI systems. But whereas those attacks can be blocked using basic, well-known syntactic quoting techniques, there seem to be no easy equivalents for stopping an AI paying attention to instructions it should not be obeying.

1 1

GitHub and EFF Back YouTube Ripper In Legal Battle With the RIAA
by Peter Reutemann 11 Feb '23

11 Feb '23

'GitHub and digital rights group EFF have filed briefs supporting stream-ripping site Yout.com in its legal battle with the RIAA. GitHub warns that the lower court's decision threatens to criminalize the work of many other developers. The EFF, meanwhile, stresses that an incorrect interpretation of the DMCA harms people who use stream-rippers lawfully. TorrentFreak reports: In 2020, YouTube ripper Yout.com sued the RIAA, asking a Connecticut district court to declare that the site does not violate the DMCA's anti-circumvention provision. The music group had previously used DMCA takedown notices to remove many of Yout's appearances in Google's search results. This had a significant impact on revenues, the site argued, adding that it always believed it wasn't breaking any laws and hoped the court would agree. Last October, the Connecticut district court concluded that Yout had failed to show that it doesn't circumvent YouTube's technological protection measures. As such, it could be breaking the law. Yout operator Johnathan Nader opted to appeal the decision. Nader's attorneys filed their opening brief (PDF) last week at the Court of Appeals for the Second Circuit, asking it to reverse the lower court's decision. The YouTube ripper is not the only party calling for a reversal. Yesterday, Microsoft-owned developer platform GitHub submitted an amicus brief that argues for the same. And in a separate filing, the EFF also agrees that the lower court's decision should be overturned. GitHub's brief starts by pointing out that the company takes no position on the ultimate resolution of this appeal, nor does it side with all of Yout's arguments. However, it does believe that the lower court's interpretation of the DMCA is dangerous. The district court held that stream rippers can violate the DMCA's anti-circumvention provision. The court noted that these tools allow people to download video and audio from YouTube, despite the streaming platform's lack of a download button. According to GitHub, this conclusion is premature, dangerous, and places other software types at risk. In the present lawsuit, GitHub reiterates that stream-ripping tools should not be outlawed. The fact that YouTube doesn't have a download button doesn't mean that tools that enable people to download videos circumvent technological access restrictions. "YouTube's decision not to provide its own 'download' button, however, is not a restriction on access to works. It merely affects how users experience them," GitHub writes. If the court order is allowed to stand, GitHub warns that a broad group of developers could be exposed to criminal liability, effectively chilling technological innovation. YouTube download tools are not the only types of software at risk, according to GitHub. There are many others that affect 'how users experience' online websites. These could also be seen as problematic, based on the district court's expansive interpretation of the DMCA. These widely accepted tools could put their creators at risk if the DMCA is interpreted too strictly, GitHub warns. The Electronic Frontier Foundation (EFF) also submitted an amicus curiae brief (PDF) yesterday. The digital rights group takes interest in copyright cases, particularly when they get in the way of people's ability to freely use technology. In this instance, EFF points out that stream-rippers such as Yout.com provide a neutral technology with plenty of legal uses. They can be used for infringing purposes, but that's also true for existing technologies -- the printing press, for example. "Like every reproduction technology -- from the printing press to the smartphone -- these programs, colloquially called 'streamrippers,' have important lawful uses as well as infringing ones. "Video creators, educators, journalists, and human rights organizations all depend on the ability to make copies of user-uploaded videos," EFF adds. In common with GitHub, EFF notes that the absence of a download button on YouTube doesn't imply that download tools automatically violate the DMCA, especially when there are no effective download restrictions on the platform. [...] According to EFF, Yout and similar tools provide the same functions as video cassette recorders once did. They allow people to make copies of videos that are posted publicly by their creators. In addition, these tools are vital for some reporters and useful to creatives who use them for future work. ' -- source: https://yro.slashdot.org/story/23/02/10/2243240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Future Of Thunderbird
by Peter Reutemann 10 Feb '23

10 Feb '23

'Thunderbird blog: Before we really dig in, let's start with the future. We believe it's a bright one! With this year's release of Thunderbird 115 "Supernova," we're doing much more than just another yearly release. It's a modernized overhaul of the software, both visually and technically. Thunderbird is undergoing a massive rework from the ground up to get rid of all the technical and interface debt accumulated over the past 10 years. This is not an easy task, but it's necessary to guarantee the sustainability of the project for the next 20 years. Simply "adding stuff on top" of a crumbling architecture is not sustainable, and we can't keep ignoring it. Throughout the next 3 years, the Thunderbird project is aiming at these primary objectives: 1. Make the code base leaner and more reliable, rewrite ancient code, remove technical debt. 2. Rebuild the interface from scratch to create a consistent design system, as well as developing and maintaining an adaptable and extremely customizable user interface. 3. Switch to a monthly release schedule. Inside those objectives there are hundreds of very large steps that need to happen, and achieving everything will require a lot of time and resources.' -- source: https://it.slashdot.org/story/23/02/09/1651259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

US NIST Unveils Winning Encryption Algorithm For IoT Data Protection
by Peter Reutemann 09 Feb '23

09 Feb '23

'The National Institute of Standards and Technology (NIST) announced that ASCON is the winning bid for the "lightweight cryptography" program to find the best algorithm to protect small IoT (Internet of Things) devices with limited hardware resources. BleepingComputer reports: ASCON was selected as the best of the 57 proposals submitted to NIST, several rounds of security analysis by leading cryptographers, implementation and benchmarking results, and feedback received during workshops. The whole program lasted for four years, having started in 2019. NIST says all ten finalists exhibited exceptional performance that surpassed the set standards without raising security concerns, making the final selection very hard. ASCON was eventually picked as the winner for being flexible, encompassing seven families, energy efficient, speedy on weak hardware, and having low overhead for short messages. NIST also considered that the algorithm had withstood the test of time, having been developed in 2014 by a team of cryptographers from Graz University of Technology, Infineon Technologies, Lamarr Security Research, and Radboud University, and winning the CAESAR cryptographic competition's "lightweight encryption" category in 2019. Two of ASCON's native features highlighted in NIST's announcement are AEAD (Authenticated Encryption with Associated Data) and hashing. AEAD is an encryption mode that provides confidentiality and authenticity for transmitted or stored data, combining symmetric encryption and MAC (message authentication code) to prevent unauthorized access or tampering. Hashing is a data integrity verification mechanism that creates a string of characters (hash) from unique inputs, allowing two data exchange points to validate that the encrypted message has not been tampered with. Despite ASCON's lightweight nature, NIST says the scheme is powerful enough to offer some resistance to attacks from powerful quantum computers at its standard 128-bit nonce. However, this is not the goal or purpose of this standard, and lightweight cryptography algorithms should only be used for protecting ephemeral secrets. ' -- source: https://it.slashdot.org/story/23/02/08/2239210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 14 Preview 1 is Out, Will Officially Ban Installation of Old Apps
by Peter Reutemann 09 Feb '23

09 Feb '23

'Android 14 is here -- or the first preview is, at least. From a report: Google is kicking off the months-long developer preview process for Android's latest version, which will get a final release in the second half of the year. Even with multiple previews, Google likes to keep the final set of Android features under wraps at least until its I/O conference in May, so we can't look at the features here to determine the scope of Android 14. These are just some of the features Google wants developers to have a head start on. The biggest news is that Android 14 will block the installation of old Android apps. As Android changes over the years, new APIs and increased security, privacy, or background processing restrictions could break old apps, but Android's backward-compatibility system keeps these old apps running. Apps can declare the newest version of Android they support via a "Target SDK" flag. To prevent old apps from breaking, new features and app restrictions in, say, Android 12 only apply to apps that target Android 12 or above. Older apps will continue to run with the older set of restrictions they're used to. (A different setting, called "Minimum SDK," determines if a new app can run on an old Android OS.) The system works great for honest developers, but if you're building a piece of malware, it's an easy decision to target a very old version of Android. While you'll get access to fewer features, you'll also be subject to fewer security and privacy restrictions. For the first time, Android 14 will close this malware loophole by simply refusing to install old apps. The cutoff point is generous enough that it shouldn't cause anyone problems; any app targeting the 8-year-old Android 6.0 or below will be blocked. Google says it picked Android 6 because it's the version that introduced runtime permissions, the allow/deny boxes that pop up asking for things like camera access. In addition, "some malware apps use a targetSdkVersion of [Android 5.1] to avoid being subjected to the runtime permission model introduced in 2015 by Android 6.0," Google said.' -- source: https://tech.slashdot.org/story/23/02/08/1919253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.1 Officially Promoted To Being An LTS Kernel
by Peter Reutemann 09 Feb '23

09 Feb '23

'Linux 6.1 was widely anticipated to be a Long-Term Support (LTS) kernel with normally the last major release series for the calendar year normally promoted to LTS status. Greg Kroah-Hartman as the Linux stable maintainer went ahead today and formally recognized Linux 6.1 as the 2022 LTS kernel. From a report: Greg KH was planning on Linux 6.1 being LTS given its December debut. But he was waiting on feedback from kernel stakeholders over their test results with Linux 6.1 and plans around using Linux 6.1 for the long-term. He's finally collected enough positive responses -- along with co-maintainer Sasha Levin -- that there is confidence in maintaining Linux 6.1 as an LTS series. As of now the plan is on maintaining Linux 6.1 through December 2026, which is just a few months longer than the current Linux 5.15 LTS series that will be maintained through October 2026. We'll see over time if Linux 6.1 ends up potentially being maintained for the longer six-year LTS period that would put it through 2028. However, the number of Linux LTS series being maintained in tandem is growing and will ultimately depend upon how much these kernels are used by major industry players and how much commitment there is for testing of the point release candidates, etc.' -- source: https://linux.slashdot.org/story/23/02/08/174210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

minutes from AGM
by Peter Reutemann 08 Feb '23

08 Feb '23

Hi everyone Apologies for the late update on our AGM last month. You can find the minutes here: http://wiki.wlug.org.nz/MeetingTopics.2023-01-23 Since we were unable to get a quorum, we will try again on February 27th at 7.30pm (in-person and online). Should we be able unable to fill the required offices and spots on the committee, we will start the process for dissolving the society. See above minutes for details. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Mozilla, Like Google, is Looking Ahead To the End of Apple's WebKit Rule
by Peter Reutemann 08 Feb '23

08 Feb '23

'Mozilla is planning for the day when Apple will no longer require its competitors to use the WebKit browser engine in iOS. From a report: Mozilla conducted similar experiments that never went anywhere years ago but in October 2022 posted an issue in the GitHub repository housing the code for the iOS version of Firefox that includes a reference to GeckoView, a wrapper for Firefox's Gecko rendering engine. Under the current Apple App Store Guidelines, iOS browser apps must use WebKit. So a Firefox build incorporating Gecko rather than WebKit currently cannot be distributed through the iOS App Store. As we reported last week, Mozilla is not alone in anticipating an iOS App Store regime that tolerates browser competition. Google has begun work on a Blink-based version of Chrome for iOS. The major browser makers -- Apple, Google, and Mozilla -- each have their own browser rendering engines. Apple's Safari is based on WebKit; Google's Chrome and its open source Chromium foundation is based on Blink (forked from WebKit a decade ago); and Mozilla's Firefox is based on Gecko. Microsoft developed its own Trident rendering engine in the outdated Internet Explorer and a Trident fork called EdgeHTML in legacy versions of Edge but has relied on Blink since rebasing its Edge browser on Chromium code.' -- source: https://news.slashdot.org/story/23/02/07/1733204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Carbonyl: a New Graphical Web Browser in Your Linux Terminal
by Peter Reutemann 07 Feb '23

07 Feb '23

'Long-time Slashdot reader destinyland writes: Someone made a Chromium fork... for your terminal. The terminal-based browser Carbonyl "adheres to, and is compatible with modern standards," writes MUO, "meaning that pages behave as they should, and you can even watch streaming video, within the Linux terminal!" But best of all, "Pages connect and render in an instant—seemingly quicker than a desktop GUI browser, and every page we visited was rendered correctly." >From the article: There are a bunch of good reasons to browse the internet from the comfort of your terminal. It could be that eschewing the bloat of X.org and Wayland, a terminal is all you have. Maybe you like SSHing into remote machines and browsing the internet from there. Perhaps you, like us, just really, really like terminals. Whatever the reason, your choices of web browsers have, until recently, been limited, and your experience of the world wide web has been a janky, barely-functional one.... We tested Carbonyl in a range of Linux terminals, including the XFCE terminal. GNOME terminal, kitty, and the glorious Cool Retro Terminal. Carbonyl was smooth, fast, and flawless in all of them. We even connected to our Raspberry Pi via SSH in CRT, and ran Carbonyl remotely, watching Taylor Swift music videos on YouTube. No problem. And yes, you can use it to play DOOM.' -- source: https://linux.slashdot.org/story/23/02/04/0246248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Swears It's Not Coming For Your Data With Scan For Old Office Versions
by Peter Reutemann 07 Feb '23

07 Feb '23

'Microsoft wants everyone to know that it isn't looking to invade their privacy while looking through their Windows PCs to find out-of-date versions of Office software. From a report: In its KB5021751 update last month, Microsoft included a plan to scan Windows systems to smoke out those Office versions that are no longer supported or nearing the end of support. Those include Office 2007 (which saw support end in 2017) and Office 2010 (in 2020) and the 2013 build (this coming April). The company stressed that it would run only one time and would not install anything on the user's Windows system, adding that the file for the update is scanned to ensure it's not infected by malware and is stored on highly secure servers to prevent unauthorized changes to it. The update caused some discussion among users, at least enough to convince Microsoft to make another pitch that it is respecting user privacy and won't access private data despite scanning their systems. The update collects diagnostic and performance data so that it can determine the use of various versions of Office and how to best support and service them, the software maker wrote in an expanded note this week. The update will silently run once to collect the data and no files are left on the user's systems once the scan is completed.' -- source: https://yro.slashdot.org/story/23/02/06/1753258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LINUX OS and Desktop build - Compatibility question
by Michael James 02 Feb '23

02 Feb '23

Kia ora WLUG Participants..... Mike here in Whanganui. A total newbie and not at all a Linux programmer nor very knowledgeable about all things Linux but a very enthusiastic Linux proponent and open source advocate. I am trying to put together a new desktop build and wish to know if it will be compatible with the latest version of Linux, whether this be Ubuntu or whichever iteration is appropriate. The components of the build are as follows, and I would be most grateful if experienced participants can have a look at them to see if everything will work together with an appropriate Linux OS so the computer runs smoothly and without any problems for the longterm. *DESKTOP BUILD COMPONENTS* ASUS PRIME Z790-P WIFI-CSM DDR5 Motherboard Corsair CMH64GX5M2B5600C36 Vengeance RGB 64GB (2x32GB) DDR5-5600 XFX Radeon RX 7900 XT SPEEDSTER MERC310 Gaming 20GB Graphics Card Intel Raptor Lake Core i9-13900F Processor Corsair iCUE H150i ELITE CAPELLIX 360mm Liquid CPU Cooler Corsair RM1000e 1000W 80 Plus Gold Fully Modular Kingston NV2 2TB PCIe Gen 4 NVMe M.2 SSD Corsair 4000D Tempered Glass Mid-Tower Seagate IronWolf Pro ST4000NE001 4TB 128MB Hard Drive With kind thanks to all, All the best, Michael James __________________________________________________________________________________________ MICHAEL JAMES PASTROFF phone: inside New Zealand 021 115 3713 outside New Zealand 64 21 115 3713

1 0

EU's Proposed CE Mark for Software Could Have Dire Impact on Open Source
by Peter Reutemann 31 Jan '23

31 Jan '23

'The EU's proposed Cyber Resilience Act (CRA), which aims to "bolster cybersecurity rules to ensure more secure hardware and software products," could have severe unintended consequences for open source software, according to leaders in the open source community. From a report: The proposed Act can be described as CE marking for software products and has four specific objectives. One is to require manufacturers to improve the security of products with digital elements "throughout the whole life cycle." Second is to offer a "coherent cybersecurity framework" by which to measure compliance. Third is to improve the transparency of digital security in products, and fourth is to enable customers to "use products with digital elements securely." The draft legislation includes an impact assessment that says "for software developers and hardware manufacturers, it will increase the direct compliance costs for new cybersecurity requirements, conformity assessment, documentation and reporting obligations." This extra cost is part of a total cost of compliance, including the burden on businesses and public authorities, estimated at EUR 29 billion ($31.54 billion), and consequent higher prices for consumers. However, the legislators foresee a cost reduction from security incidents estimated at EUR 180 to 290 billion annually. The question is though: how can free software developers afford the cost of compliance, when lack of funding is already a critical issue for many projects? Mike Milinkovich, director of the Eclipse Foundation, said it is "deeply concerned that the CRA could fundamentally alter the social contract which underpins the entire open source ecosystem: open source software provided for free, for any purpose, which can be modified and further distributed for free, but without warranty or liability to the authors, contributors, or open source distributors. Legally altering this arrangement through legislation can reasonably be expected to cause unintended consequences to the innovation economy in Europe."' -- source: https://news.slashdot.org/story/23/01/26/1211223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Customer Conned Out Of Deposit, Company Liable
by Lawrence D'Oliveiro 30 Jan '23

30 Jan '23

A malicious third party intercepted email messages between a carpeting company and a customer, and was able to send a fake email asking for a deposit to the customer with all the right contact details, but the wrong bank account number <https://www.nzherald.co.nz/lifestyle/hacker-intercepts-carpet-companys-emai…>. And now the Disputes Tribunal has ruled that, since the email looked completely convincing, with the right personal details and everything, it was not reasonable to expect the customer to be suspicious or to want to double-check. And so the company had to wear the cost of the scam.

1 0

Intel Kills Its RISC-V Development Environment
by Lawrence D'Oliveiro 30 Jan '23

30 Jan '23

Intel is abandoning its “Pathfinder” project <https://www.theregister.com/2023/01/30/intel_ris_v_pathfinder_discontinued/> which was an integrated environment for doing development targeted at RISC-V processors. What does this mean for RISC-V? Not a lot, I would say. What does it mean for Intel? I think the basic problem here is the same as with its attempts to move into ARM: you have a high-volume, low-margin business where a company that has grown fat on not-so-high-volume, quite high-margin x86 processors was never going to be able to compete.

1 0

Jeremy Allison Laid Off From Google
by Lawrence D'Oliveiro 28 Jan '23

28 Jan '23

Seems the latest round of layoffs from Google has hit its open-source projects particularly hard, according to Steven J Vaughan-Nichols <https://www.theregister.com/2023/01/27/google_open_source/>. The one name that immediately caught my eye was Jeremy Allison, one of the chief brains behind Samba <https://www.samba.org/>. Before joining Google, he worked at Novell. He left there in 2006 because he objected to a deal Novell made with Microsoft which was effectively a patent licence for Free software (something which the GPL doesn’t allow) <https://www.zdnet.com/article/in-case-you-missed-it-part-1-jeremy-allison-f…>. While waiting to see where else he turns up, it is worth revisiting this essay <https://www.samba.org/samba/news/articles/low_point/tale_two_stds_os2.html> from shortly before that time, where he does a comparison between the Microsoft Windows and POSIX APIs, and why there can be so many independent, yet interoperable implementations of the latter, and why there can be only one of the former (though the WINE project continues to try to change that).

1 0

Consumer Reports Looks At Memory Safety
by Lawrence D'Oliveiro 27 Jan '23

27 Jan '23

The nonprofit Consumer Reports foundation has done a study of, of all things, memory safety in computer software <https://www.theregister.com/2023/01/26/memory_safety_mainstream/>. It apparently came to the need for this after putting together a consumer-focused guide to online security. Seems like greater adoption of the Rust programming language is becoming a key part of improving the situation. Asked about C++ creator Bjarne Stroustrup's assertion that ISO standard C++ can be memory safe when rules are enforced with static analysis, [Josh Aas, of the nonprofit Internet Security Research Group] expressed skepticism. "In a very theoretical sense that ignores the practicalities of the real world, that might be true," he said. "It might very theoretically be practically possible to write memory safe C++. But it's just not how things work in our world. There are just better ways to do that. C++ was not designed from the ground up to offer memory safety."

1 0

Android 14 Set To Block Certain Outdated Apps From Being Installed
by Peter Reutemann 25 Jan '23

25 Jan '23

'To help reduce the potential for malware, Android 14 will begin fully blocking the installation of apps that target outdated versions of Android. 9to5Google reports: For years now, the guidelines for the Google Play Store have ensured that Android developers keep their apps updated to use the latest features and safety measures of the Android platform. Just this month, the guidelines were updated, requiring newly listed Play Store apps to target Android 12 at a minimum. Up to this point, these minimum API level requirements have only applied to apps that are intended for the Google Play Store. Should a developer wish to create an app for an older version, they can do so and simply ask their users to sideload the APK file manually. Similarly, if an Android app hasn't been updated since the guidelines changed, the Play Store will continue serving the app to those who have installed it once before. According to a newly posted code change, Android 14 is set to make API requirements stricter, entirely blocking the installation of outdated apps. This change would block users from sideloading specific APK files and also block app stores from installing those same apps. Initially, Android 14 devices will only block apps that target especially old Android versions. Over time though, the plan is to increase the threshold to Android 6.0 (Marshmallow), with Google having a mechanism to "progressively ramp [it] up." That said, it will likely still be up to each device maker to decide the threshold for outdated apps or whether to enable it at all. The report notes that it'll still be possible to install an outdated version of an app "through a command shell, by using a new flag."' -- source: https://tech.slashdot.org/story/23/01/24/225226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google’s Fuchsia OS was one of the hardest hit by last week’s layoffs
by Peter Reutemann 24 Jan '23

24 Jan '23

'Google is still reeling from the biggest layoff in company history last Friday. Earlier cost cuts over the past six months have resulted in several projects being shut down or deprioritized at Google, and it's hard to fire 12,000 people without some additional projects taking a hit. The New York Times has a report about which divisions are being hit the hardest, and a big one is Google's future OS development group, Fuchsia. While the overall company cut 6 percent of its employees, the Times pointed out that Fuchsia saw an outsize 16 percent of the 400-person staff take a hit. While it's not clear what that means for the future of the division, the future of Fuchsia's division has never really been clear. Fuchsia has been a continuous mystery inside Google since it first saw widespread press coverage in 2017. Google rarely officially talks about it, leaving mostly rumors and Github documentation for figuring out what's going on. The OS isn't a small project, though—it's not even based on Linux, opting instead to use a custom, in-house kernel, so Google really is building an entire OS from scratch. Google actually ships the OS today to consumers in its Nest smart displays, where it replaced the older Cast OS. The in-place operating system swap was completely invisible to consumers compared to the old OS, came with zero benefits, and was never officially announced or promoted. There's not much you can do with it on a locked-down smart display, so even after shipping, Fuchsia is still a mystery. The biggest questions surrounding Fuchsia are: "Why does this exist, and what are its goals?" Is Fuchsia an eventual replacement for Android or Chrome OS? Around 2018, when we first got Fuchsia running on a Pixelbook, the source code documentation for the custom kernel said it "targets modern phones and modern personal computers with fast processors," which certainly made it sound like an Android and/or Chrome OS successor being built for flagship devices. That early codebase also included graphical user interfaces for PCs and phones, further driving home that this was a consumer OS. After Fuchsia got some initial publicity, it removed its public interface code. 2018 also saw a foundational Bloomberg report calling Fuchsia "a successor to Android," and saying the team planned to launch on smart speakers in 2021 (which was spot on) and would later move into phones and laptops in 2023. Even the name "Fuchsia" was a reference to Apple projects some members of the team had been involved with. "Pink" was the codename for a canceled successor to classic Mac OS, and "Purple" was the codename for the iPhone OS. The color Fuchsia is a mix of pink and purple, so this all sounded very ambitious.' -- source: https://arstechnica.com/gadgets/2023/01/big-layoffs-at-googles-fuchsia-os-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

83% of GNOME Users Installed Extensions, Survey Shows
by Peter Reutemann 24 Jan '23

24 Jan '23

'Last summer GNOME invited people to voluntarily run the tool gnome-info-collect on their systems to send back (non-sensitive/non-identifiable) data about their system configurations. 2,560 people ran the tool, and they're now releasing the data. Here's the distribution of distros for all 2,560 respondents: Fedora: 1,376 (54.69%) Arch: 469 (18.64%) Ubuntu: 267 (10.61%) Manjaro: 140 (5.56%) EndeavourOS: 66 (2.62%) Debian: 44 (1.75%) openSUSE: 38 (1.51%) Pop! 38 (1.51%) Other: 78 (3.10%) And the breakdown of hardware manufacturers (top four): Lenovo: 516 (23.54%) Dell: 329 (15.01%) ASUS: 261 (11.91%) HP: 223 (10.17%) The site OMG! Linux pointed out that 90% of systems had Flatpak installed — (though it's enabled by default on Fedora, which was 54.69% of all the respondents). Some other interesting stats they noticed: - Most common default browser: Firefox (73.14%), Chrome (11.64%), Brave (4.76%). [Microsoft Edge was the default browser on 37 systems (1.51%) ] - 83% of users have at least one (non-default) GNOME extension installed - 'App Indicator' is the most popular extension (by 43% of those using extensions) - GSConnect, User Themes, and Dash to Panel/Dock also widely used - Most popular desktop apps: GIMP (58.48%), VLC (53.71%), Steam (53.40%) [...] The popularity of GNOME extensions will surprise no-one. It is a solid indicator that the existing GNOME extension system is good at doing what it's there to: let users augment and extend their system in the ways they want. GNOME's report adds that "it's exciting to see the popularity of new GNOME apps like Flatseal, To Do, Bottles, and Fragments." One other interesting stat from their report: 55% of the participants were using Online Accounts, with Google the most common one added, followed by Nextcloud and Microsoft. But "Some of the account types had very little usage at all, with Foursquare, Facebook, Media Server, Flickr and Last.fm all being active on less than 1% of systems."' -- source: https://tech.slashdot.org/story/23/01/23/0355247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Which Performs Better on Linux: Firefox or Chrome?
by Peter Reutemann 23 Jan '23

23 Jan '23

'Phoronix compares the performance of Firefox and Chrome on the Linux desktop. They used recent releases (at default settings) for both browsers on an Intel Core i9 13900K "Raptor Lake" system with Radeon RX 6700XT graphics, concluding "out-of-the-box Google Chrome continues performing much better overall than Mozilla Firefox." One area where Firefox does better out-of-the-box is around the HTML5 Canvas such as measured via the CanvasMark test case. For the demanding JetStream 2 benchmark as one of the most demanding browser tests currently, Chrome on Linux was 67% faster than Firefox on this same Intel Raptor Lake desktop. Firefox did have a small win in the rather basic JavaScript Maze solver benchmark. Firefox at least was in a competitive space for the WebAssembly (WASM) benchmarks, but aside from that Google Chrome continues holding strong on Linux in the performance department.' -- source: https://news.slashdot.org/story/23/01/22/1922212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pioneering Apple Lisa goes “open source” thanks to Computer History Museum
by Peter Reutemann 20 Jan '23

20 Jan '23

'As part of the Apple Lisa's 40th birthday celebrations, the Computer History Museum has released the source code for Lisa OS version 3.1 under an Apple Academic License Agreement. With Apple's blessing, the Pascal source code is available for download from the CHM website after filling out a form. Lisa Office System 3.1 dates back to April 1984, during the early Mac era, and it was the Lisa equivalent of operating systems like macOS and Windows today. The entire source package weighs is about 26MB and consists of over 1,300 commented source files, divided nicely into subfolders that denote code for the main Lisa OS, various included apps, and the Lisa Toolkit development system.' -- source: https://arstechnica.com/information-technology/2023/01/pioneering-apple-lis… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How Amazon Scammers Get Good Product Reviews
by Lawrence D'Oliveiro 18 Jan '23

18 Jan '23

In this report on a fake <https://arstechnica.com/gadgets/2023/01/64gb-microsd-cards-are-posing-as-16…> 16TB SSD that only turned out to be 64GB, there is a description of how the seller was able to accumulate quite a bunch of effusive reviews: the listing would originally have been for an entirely different, legitimate product. Then once a good number of positive comments had been built up, it would have been switched for the scam. The switch might happen multiple times, for legitimate products each time, to keep adding to the positivity, until the final con. However, this does mean that you end up with an accumulation of rather odd reviews: However, reading some of these reviews made me question if we've been using SSDs wrong all this time. A review on one of the remarkably cheap portable SSD listings declared the product to be "a very colorful throw, but thinner" than expected. Another reported that the drive proved "very soft and perfect" for their 6-year-old. One review pointed to the SSD being a "beautiful portrait" that looks great in the kitchen, while another five-star review pointed to the high microphone and video quality.

1 0

MSI Accidentally Breaks Secure Boot for Hundreds of Motherboards
by Peter Reutemann 18 Jan '23

18 Jan '23

'Over 290 MSI motherboards are reportedly affected by an insecure default UEFI Secure Boot setting that allows any operating system image to run regardless of whether it has a wrong or missing signature. From a report: This discovery comes from a Polish security researcher named Dawid Potocki, who claims that he did not receive a response despite his efforts to contact MSI and inform them about the issue. The issue, according to Potocki, impacts many Intel and AMD-based MSI motherboards that use a recent firmware version, affecting even brand-new MSI motherboard models.' -- source: https://tech.slashdot.org/story/23/01/17/1728239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next Monday
by Peter Reutemann 16 Jan '23

16 Jan '23

Hi everyone Just a reminder that our AGM (annual general meeting) is next week on Monday: https://www.meetup.com/waikatolinuxusersgroup/events/290343641/ Only paid-up members will be able to vote. The AGM will be held in hybrid mode, in-person and via BigBlueButton: https://bbb2.nzoss.nz/b/pet-hmf-zqf-5ts BTW After nearly 10 years I won't be standing for president (or any other office) anymore. Due to personal reasons, I can no longer give the president's office the required attention (like organizing meetings, finding speakers/topics, presenting, etc). This presents a great opportunity for someone new to step up and bring in a fresh perspective to the society! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Vulnerability with 9.8 severity in Control Web Panel is under active exploit
by Peter Reutemann 16 Jan '23

16 Jan '23

'Malicious hackers have begun exploiting a critical vulnerability in unpatched versions of the Control Web Panel, a widely used interface for web hosting. “This is an unauthenticated RCE,” members of the Shadowserver group wrote on Twitter, using the abbreviation for remote code exploit. “Exploitation is trivial and a PoC published.” PoC refers to a proof-of-concept code that exploits the vulnerability. The vulnerability is tracked as CVE-2022-44877. It was discovered by Numan Türle of Gais Cyber Security and patched in October in version 0.9.8.1147. Advisories didn’t go public until earlier this month, however, making it likely some users still aren’t aware of the threat. Figures provided by Security firm GreyNoise show that attacks began on January 7 and have slowly ticked up since then, with the most recent round continuing through Wednesday. The company said the exploits are coming from four separate IP addresses located in the US, Netherlands, and Thailand. Shadowserver shows that there are roughly 38,000 IP addresses running Control Web Panel, with the highest concentration in Europe, followed by North America and Asia. The severity rating for CVE-2022-44877 is 9.8 out of a possible 10. “Bash commands can be run because double quotes are used to log incorrect entries to the system,” the advisory for the vulnerability stated. As a result, unauthenticated hackers can execute malicious commands during the login process. The following video demonstrates the flow of the exploit.' -- source: https://arstechnica.com/information-technology/2023/01/vulnerability-with-9… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Preparing To Disable Drivers For Microsoft's RNDIS Protocol
by Peter Reutemann 16 Jan '23

16 Jan '23

'Phoronix reports: With the next Linux kernel cycle we could see upstream disable their driver support for Microsoft's Remote Network Driver Interface Specification (RNDIS) protocol due to security concerns. RNDIS is the proprietary protocol used atop USB for virtual Ethernet functionality. The support for RNDIS outside of Microsoft Windows has been mixed. RNDIS isn't widely used today in cross-platform environments and due to security concerns the upstream Linux kernel is looking to move the RNDIS kernel drivers behind the "BROKEN" Kconfig option so they effectively become disabled in future kernel builds. Ultimately once marked as "BROKEN" for a while, the drivers will likely be eventually removed from the upstream source tree. Greg Kroah-Hartman wrote in a commit: "The Microsoft RNDIS protocol is, as designed, insecure and vulnerable on any system that uses it with untrusted hosts or devices. Because the protocol is impossible to make secure, just disable all rndis drivers to prevent anyone from using them again."' -- source: https://linux.slashdot.org/story/23/01/15/0220203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint "Uma and Vera"idle problem..
by John 15 Jan '23

15 Jan '23

Hi Folks, My installation of Linux mint Vera 21.1 has a very annoying habit of going into "idle" mode after 10 minutes. Makes watching a movie or listening to music a less than enjoyable task. I have on past installations of Mint sought answers, including running a couple of lengthy bash scripts I found in the forums to no avail. AFAIK my screensaver and power management setting are OK. the problem seems widespread through all the applications I have tried so far Rythmbox Celluloid VLC and Netflix Any help will be appreciated.. Cheers John..

2 10