- wlug - list.wlug.org.nz

Linux Kernel 6.0 Released for the AmigaOne X1000/X5000 PowerPC-Based AmigaOS Computers
by Peter Reutemann 17 Oct '22

17 Oct '22

'Hyperion Entertainment is pleased to announce the immediate availability of a very substantial and comprehensive update of the Software Development Kit (SDK) for AmigaOS 4.1 54.16. Also Linux: Kernel 6.0 for AmigaOne X1000/X5000 has been released and the biggest Amiga event of the year will be held upcoming weekend in Mönchengladbach, Germany: the Amiga37 event.' -- source: https://linux.slashdot.org/story/22/10/15/2124215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Office Rebranding
by Lawrence D'Oliveiro 14 Oct '22

14 Oct '22

I suppose you’ve heard by now that “Microsoft Office” is losing the “Office” part of the name, and becoming “Microsoft 365”. Accompanying this rebranding is a new set of logos <https://arstechnica.com/gadgets/2022/10/rip-to-microsoft-office-henceforth-…>. One thing I notice about them is the gradient shading, shadows and general faux-3D look. Does this mark an end to the “flat” design fad that seems to have become so popular over the last decade? Or does this only apply to the logo branding, not to onscreen icons, UI etc? (In which case, I wonder how their design gurus feel about such a disconnect between those different aspects of the same product.) Of course, I ask this as someone who never stopped being a fan of 3D style ...

1 0

Android Leaks Some Traffic Even When 'Always-On VPN' Is Enabled
by Peter Reutemann 13 Oct '22

13 Oct '22

'Mullvad VPN has discovered that Android leaks traffic every time the device connects to a WiFi network, even if the "Block connections without VPN," or "Always-on VPN," features is enabled. BleepingComputer reports: The data being leaked outside VPN tunnels includes source IP addresses, DNS lookups, HTTPS traffic, and likely also NTP traffic. This behavior is built into the Android operating system and is a design choice. However, Android users likely didn't know this until now due to the inaccurate description of the "VPN Lockdown" features in Android's documentation. Mullvad discovered the issue during a security audit that hasn't been published yet, issuing a warning yesterday to raise awareness on the matter and apply additional pressure on Google. Android offers a setting under "Network & Internet" to block network connections unless you're using a VPN. This feature is designed to prevent accidental leaks of the user's actual IP address if the VPN connection is interrupted or drops suddenly. Unfortunately, this feature is undercut by the need to accommodate special cases like identifying captive portals (like hotel WiFi) that must be checked before the user can log in or when using split-tunnel features. This is why Android is configured to leak some data upon connecting to a new WiFi network, regardless of whether you enabled the "Block connections without VPN" setting. Mullvad reported the issue to Google, requesting the addition of an option to disable connectivity checks. "This is a feature request for adding the option to disable connectivity checks while "Block connections without VPN" (from now on lockdown) is enabled for a VPN app," explains Mullvad in a feature request on Google's Issue Tracker. "This option should be added as the current VPN lockdown behavior is to leaks connectivity check traffic (see this issue for incorrect documentation) which is not expected and might impact user privacy." In response to Mullvad's request, a Google engineer said this is the intended functionality and that it would not be fixed for the following reasons: - Many VPNs actually rely on the results of these connectivity checks to function, - The checks are neither the only nor the riskiest exemptions from VPN connections, - The privacy impact is minimal, if not insignificant, because the leaked information is already available from the L2 connection. Mullvad countered these points and the case remains open.' -- source: https://tech.slashdot.org/story/22/10/12/2057246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Wi-Fi Spy Drones Snooped On Financial Services Firm
by Lawrence D'Oliveiro 13 Oct '22

13 Oct '22

Some security experts predicted this possibility years ago, and now we are seeing it for real <https://www.theregister.com/2022/10/12/drone-roof-attack/>: drones being used to attack network security. The company’s security team twigged to something odd going on when a user (or at least a device answering to their MAC address) seemed to be in two places at once: at home some distance away, and yet also at the premises, on a wi-fi network. Using a Fluke wi-fi meter, they traced the signal and found, not one, but two drones parked on the roof of the building. One had a “Wi-Fi Pineapple” penetration-testing device (which you can buy for USD120), while the other was carrying a range of kit, including a Raspberry Pi and a mini laptop. Seemed the attackers took advantage of a temporary lapse in security, due to some facilities reorganizations at the company, to trick a user into entering their credentials on a fake login page.

1 0

VirtualBox 7.0 adds first ARM Mac client, full encryption, Windows 11 TPM
by Peter Reutemann 12 Oct '22

12 Oct '22

'Nearly four years after its last major release, VirtualBox 7.0 arrives with a… host of new features. Chief among them are Windows 11 support via TPM, EFI Secure Boot support, full encryption for virtual machines, and a few Linux niceties. [...] Linux hosts receive "reworked" screen resizing, along with "initial support" for automatic updating of the Guest Additions inside Linux guests. Perhaps most interesting for Linux hosts is support for DXVK, the Vulkan-based implementation of DirectX layers that allows for running 3D Windows applications in Wine. This provides some parity with Windows hosts, which receive standard DirectX 11 support in this 7.0 release.' -- source: https://arstechnica.com/gadgets/2022/10/virtualbox-7-0-adds-first-arm-mac-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Confirms Alder Lake BIOS Source Code Leaked
by Peter Reutemann 10 Oct '22

10 Oct '22

'Tom's Hardware reports: We recently broke the news that Intel's Alder Lake BIOS source code had been leaked to 4chan and Github, with the 6GB file containing tools and code for building and optimizing BIOS/UEFI images. We reported the leak within hours of the initial occurrence, so we didn't yet have confirmation from Intel that the leak was genuine. Intel has now issued a statement to Tom's Hardware confirming the incident: "Our proprietary UEFI code appears to have been leaked by a third party. We do not believe this exposes any new security vulnerabilities as we do not rely on obfuscation of information as a security measure. This code is covered under our bug bounty program within the Project Circuit Breaker campaign, and we encourage any researchers who may identify potential vulnerabilities to bring them our attention through this program...." The BIOS/UEFI of a computer initializes the hardware before the operating system has loaded, so among its many responsibilities, is establishing connections to certain security mechanisms, like the TPM (Trusted Platform Module). Now that the BIOS/UEFI code is in the wild and Intel has confirmed it as legitimate, both nefarious actors and security researchers alike will undoubtedly probe it to search for potential backdoors and security vulnerabilities.... Intel hasn't confirmed who leaked the code or where and how it was exfiltrated. However, we do know that the GitHub repository, now taken down but already replicated widely, was created by an apparent LC Future Center employee, a China-based ODM that manufactures laptops for several OEMs, including Lenovo. ' -- source: https://hardware.slashdot.org/story/22/10/09/2330258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Launches New Free Tier for Its Security-Focused 'Ubuntu Pro'
by Peter Reutemann 10 Oct '22

10 Oct '22

'"Starting with the Ubuntu 16.04 edition and including the later LTS versions, Canonical will offer expanded security coverage for critical, high, and medium Common Vulnerabilities and Exposures (CVEs) to all of Ubuntu's open-source applications and toolchains for ten years," reports ZDNet. "Yes, you read that right, you get security patches not just for the operating system, but for all of Ubuntu's open-source applications for a decade." Most of these are server programs, such as Ansible, Apache Tomcat, Drupal, Nagios, Redis, and WordPress. But, it also includes such developer essentials as Docker, Node.js, phpMyAdmin, Python 2, and Rust. Altogether, Canonical is supporting more than 23,000 packages. Indeed, it's now offering security for, as Mark Shuttleworth, Canonical's CEO, said, "Security coverage to every single package in the Ubuntu distribution." Canonical isn't doing this on its own. It's offering free, improved security in partnership with the security management company Tenable. Robert Huber, Tenable's Chief Security Officer, said, "Ubuntu Pro offers security patch assurance for a broad spectrum of open-source software. Together, we give customers a foundation for trustworthy open source." Beyond ordinary security, Canonical is backporting security fixes from newer application versions. This enables Ubuntu Pro users to use the Ubuntu release of their choice for long-term security without forced upgrades. Happy to keep using Ubuntu 20.04? No problem. You can run it until April 2030. Knock yourself out.... Users can obtain a free personal Ubuntu Pro subscription at ubuntu.com/pro for up to five machines. This free tier is for personal and small-scale commercial use. Mark Shuttleworth, CEO of Ubuntu's parent company company Canonical, explains in a new video that Ubuntu "is now the world's most widely used Linux..." "What makes most proud, though, is that we have found a way to make this available free of charge to anybody for their personal and for small-scale commercial use.... full commercial use for you, and any business you own, on up to five machines."' -- source: https://linux.slashdot.org/story/22/10/09/007217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Court Won’t Order Bad Tenants Facebook Group To Release Information
by Lawrence D'Oliveiro 10 Oct '22

10 Oct '22

A bunch of landlords in NZ were running a Facebook group called “Bad Tenants”, where they were sharing personal details about tenants <https://www.nzherald.co.nz/nz/court-wont-force-bad-tenants-facebook-group-t…>: ... it provides a space for landlords to share personal information about their tenants as a warning to other property owners, essentially blacklisting them. The Privacy Commission and Renters United have stated explicitly that this sharing of private information is against the law. So a tenant named Adam Sheehan took a complaint to the Privacy Commissioner last year, who directed that the group hand over any information they had about him. But they did not comply, and deleted the group. So then he went to court. But the court decided that there was no way they could enforce any decision made against the group. Under the Privacy Act 2020, any individual can request information that any organisation holds about them - whether it's the police, the Ministry of Health or an insurance broker - and they have to supply it. However, because a Facebook group isn't an organisation or an incorporated body, just a group of individuals, there was no one specifically for the tribunal to order to release Sheehan's information. I wonder, when groups or accounts or pages are deleted, does Facebook guarantee that that information really and permanently disappears?

2 1

Matter Smart Home Standard Officially Launches
by Peter Reutemann 07 Oct '22

07 Oct '22

'The Connectivity Standards Alliance and its members that include Apple, Google, Amazon, Samsung, and other smart home manufacturers, today announced the official launch of the Matter 1.0 smart home accessory standard. MacRumors reports: Companies that have agreed to support Matter now have all of the resources that they need to begin implementing Matter into their platforms, so we could see Apple integrating Matter into HomeKit very soon. In fact, iOS 16.1 is already laying the groundwork for Matter, so Matter could be announced with the launch of the update. With the Matter 1.0 launch, authorized test labs are now available for product certification, tools are available, and the open-source reference design SDK is complete. Alliance members with devices that have already been deployed and with plans to update their products with Matter support can do so as soon as their products are certified. The Connectivity Standards Alliance says that the first release of Matter will support a variety of smart home products such as lighting, HVAC controls, window coverings, safety and security sensors, door locks, media devices, controllers, and bridges. "What started as a mission to unravel the complexities of connectivity has resulted in Matter, a single, global IP-based protocol that will fundamentally change the IoT," said Tobin Richardson, President and CEO of the Connectivity Standards Alliance. "This release is the first step on a journey our community and the industry are taking to make the IoT more simple, secure, and valuable no matter who you are or where you live. With global support from companies large and small, today's Matter 1.0 release is more than a milestone for our organization and our members; it is a celebration of what is possible." ' -- source: https://mobile.slashdot.org/story/22/10/04/2145233 Home assistant has support for it: https://www.home-assistant.io/blog/2022/05/29/matter-in-home-assistant-work… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Adafruit’s Cheekmate gets to the bottom (ahem) of chess cheating controversy
by Peter Reutemann 07 Oct '22

07 Oct '22

'The Internet has been abuzz for weeks about a particularly juicy chess cheating controversy that erupted last month. The reigning chess world champion, Magnus Carlsen, lost in the third round to a 19-year-old upstart, Hans Niemann, in what was widely considered to be a shocking upset. Carlsen withdrew from the tournament the next day, and his cryptic comments on Twitter fueled rampant speculation that Niemann had cheated. The fact that Niemann admitted to cheating in online chess matches didn't help his case, but he steadfastly insisted he never cheated in over-the-board games. The fierce debate eventually produced a bizarre viral conspiracy theory that Niemann had used anal beads to receive coded messages during the match. But would that even be possible? The folks at Adafruit Industries were sufficiently intrigued to put the theory to the test—you know, just to get to the bottom of the matter. The result is a prototype device called Cheekmate—because the Adafruit team rightfully loves their punny innuendoes—complete with a step-by-step guide for those who might want to build their own prototype. This device, Adafruit insists, is not for actual cheating: "That would be asinine… in brief, a stain on the sport, but to record for posterior whether this sort of backdoor intrusion is even plausible or just an Internet myth." Lacking any willing human volunteers to test the prototype, they ended up embedding Cheekmate in a big, juicy slab of pork butt.' -- source: https://arstechnica.com/gaming/2022/10/adafruits-cheekmate-gets-to-the-bott… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IceWM Reaches Version 3 After a Mere 25 Years
by Peter Reutemann 06 Oct '22

06 Oct '22

'A new version of a quarter-century-old window manager shows that there's still room for improvement and innovation, even in established, mature tools. The Register reports: IceWM is [...] a traditional stacking window manager allowing you to open, move, and resize windows. It's relatively simple, easy, and quick to learn. By default, it also provides an app launcher and an app switcher, using the familiar Windows 95 model: a hierarchical start menu and a taskbar. If you do a minimal install of openSUSE, you get IceWM. It's also one of the defaults in the lightweight antiX and Absolute Linux distros. With such a relatively simple remit, it's good to see that development is still going on. Version 2.0 appeared late in 2020, removing a legacy protocol and adding a new image rendering engine. Now version 3.0 is out with a whole new feature: tabbed windows. Reminiscent of one of The Reg FOSS desk's favorite OSes, the late and great Be OS, tabbed windows turn the title bar into a tab that is less than the full width of the window. In IceWM 3, this allows you to attach windows together to form one entity that can be moved and sized in a single operation â" but the contents of the different windows can be accessed individually using each one's tab. In other words, it works like browser tabs, but the different windows don't need to be from the same parent application. "IceWM's new tabbed windows are the sort of relatively simple improvement to the very well-established metaphor of window management that this vulture really likes to see: small, elegant, and yet helpful," adds The Register's Liam Proven. "We feel that there's plenty more room for improvement within this space. For instance, very few window managers offer the choice of where the title bar (or tab) is located; on a widescreen, placing them on the side, as wm2 and wmx do, would save valuable vertical pixels."' -- source: https://tech.slashdot.org/story/22/10/05/214241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Filling A USB Stick
by Lawrence D'Oliveiro 06 Oct '22

06 Oct '22

Does anybody else fill USB sticks full of data? I have a backup regime currently based on 32GiB sticks, and I find it can take up to around 8 hours to fill one with files. (USB 3 sticks might have been a bit quicker, maybe half that time). So I tried an alternative approach: use dd to copy the stick to an image file, do a loopback mount of that image file, do the backup copy to the mounted image, dismount it, then use dd to copy it back to the actual stick. Time taken: typically less than 10 minutes to copy the stick to an image file, and up to an hour to copy the image file back to a USB 3 stick, or around 3 and a half hours for a USB 2 stick. The backup to the image file itself took an hour at most. Overall, still a substantial saving in time using the image-file approach. Doing a restore from the sticks is fast enough that I do this directly from them, without bothering with intermediate image files. Also I notice quite a variation in the actual capacities of the sticks. They are all nominally 32GiB = 2 ** 35 bytes, but the sizes of the usable partitions range from 89.5% of this to 91.4% -- well short of what it says on the tin. Even if you say it’s supposed to be 32GB = 32 * 10 ** 9 bytes, capacities range from 96.1% to 98.1% of the nominal value.

1 0

Basic Rust Support Merged For Upcoming Linux 6.1
by Peter Reutemann 06 Oct '22

06 Oct '22

'"This Monday, the first set of patches to enable Rust support and tooling was merged for Linux 6.1," writes Slashdot reader sabian2008, sharing an update from longtime kernel developer Kees Cook: The tree has a recent base, but has fundamentally been in linux-next for a year and a half. It's been updated based on feedback from the Kernel Maintainer's Summit, and to gain recent Reviewed-by: tags. Miguel is the primary maintainer, with me helping where needed/wanted. Our plan is for the tree to switch to the standard non-rebasing practice once this initial infrastructure series lands. The contents are the absolute minimum to get Rust code building in the kernel, with many more interfaces[2] (and drivers -- NVMe[3], 9p[4], M1 GPU[5]) on the way. The initial support of Rust-for-Linux comes in roughly 4 areas: - Kernel internals (kallsyms expansion for Rust symbols, %pA format) - Kbuild infrastructure (Rust build rules and support scripts) - Rust crates and bindings for initial minimum viable build - Rust kernel documentation and samples ' -- source: https://linux.slashdot.org/story/22/10/04/2259259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Laptop Users Should Avoid Linux 5.19.12 To Avoid Potentially Damaging The Display
by Peter Reutemann 06 Oct '22

06 Oct '22

'Intel laptop users running Linux are being advised to avoid running the latest Linux 5.19.12 stable kernel point release as it can potentially damage the display. From a report: Intel Linux laptop users on Linux 5.19.12 have begun reporting "white flashing" display issues with one user describing it as "[the] laptop display starts to blink like lights in a 90's rave party." Intel Linux kernel engineer Ville Syrjal posted this week on the kernel mailing list: "After looking at some logs we do end up with potentially bogus panel power sequencing delays, which may harm the LCD panel."' -- source: https://linux.slashdot.org/story/22/10/05/141248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CTO Wants Developers To Build Once, Run On Any GPU
by Peter Reutemann 05 Oct '22

05 Oct '22

'Greg Lavender, CTO of Intel, spoke to VentureBeat about the company's efforts to help developers build applications that can run on any operating system. From the report: "Today in the accelerated computing and GPU world, you can use CUDA and then you can only run on an Nvidia GPU, or you can go use AMD's CUDA equivalent running on an AMD GPU,â Lavender told VentureBeat. "You can't use CUDA to program an Intel GPU, so what do you use?" That's where Intel is contributing heavily to the open-source SYCL specification (SYCL is pronounced like "sickle") that aims to do for GPU and accelerated computing what Java did decades ago for application development. Intel's investment in SYCL is not entirely selfless and isn't just about supporting an open-source effort; it's also about helping to steer more development toward its recently released consumer and data center GPUs. SYCL is an approach for data parallel programming in the C++ language and, according to Lavender, it looks a lot like CUDA. To date, SYCL development has been managed by the Khronos Group, which is a multi-stakeholder organization that is helping to build out standards for parallel computing, virtual reality and 3D graphics. On June 1, Intel acquired Scottish development firm Codeplay Software, which is one of the leading contributors to the SYCL specification. "We should have an open programming language with extensions to C++ that are being standardized, that can run on Intel, AMD and Nvidia GPUs without changing your code," Lavender said. Lavender is also a realist and he knows that there is a lot of code already written specifically for CUDA. That's why Intel developers built an open-source tool called SYCLomatic, which aims to migrate CUDA code into SYCL. Lavender claimed that SYCLomatic today has coverage for approximately 95% of all the functionality that is present in CUDA. He noted that the 5% SYCLomatic doesn't cover are capabilities that are specific to Nvidia hardware. With SYCL, Lavender said that there are code libraries that developers can use that are device independent. The way that works is code is written by a developer once, and then SYCL can compile the code to work with whatever architecture is needed, be it for an Nvidia, AMD or Intel GPU. Looking forward, Lavender said that he's hopeful that SYCL can become a Linux Foundation project, to further enable participation and growth of the open-source effort. [...] "We should have write once, run everywhere for accelerated computing, and then let the market decide which GPU they want to use, and level the playing field," Lavender said. ' -- source: https://news.slashdot.org/story/22/10/04/2225214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

VideoLAN threatens to sue India gov’t as ISPs keep blocking VLC website
by Peter Reutemann 05 Oct '22

05 Oct '22

'VideoLAN is threatening to sue India's government, saying it has received no explanation for why the VLC website has been blocked by Indian ISPs for the past six months. "In March 2022, to our shock and dismay, the URL 'https://www.videolan.org/' appeared to have been blocked for viewing in India without any prior notice to me or any other person in the organization," VideoLAN president and lead VLC developer Jean-Baptiste Kempf wrote in a September 30 letter to India's Department of Telecommunications. "Despite reportage and uproar on social media, no reasons for blocking the URL were provided to us, or to the Indian public." The letter said attempts to reach the URL in India resulted in the message, "Your requested URL has been blocked as per the directions received from the Department of Telecommunications, Government of India." VideoLAN is a French nonprofit organization that developed the free, open source VLC Media Player. In an email, Kempf told Ars that "VideoLAN is an organization that does not do politics (we only take position on anti-DRM and pro-open source subjects). So this topic is a bit of a shock to us." VideoLAN's letter told Indian government officials that the blocking "is particularly shocking to us, since the Government of India itself endorses the use of VLC as a part of its Digital India initiative, where it has expressed its intention to use open-source softwares for government applications. In fact, the Government of India also appears to use VLC Media Player's icon and logo on its website promoting open source softwares." The letter to India's government said, "VLC is currently being used by 80 million Indians, and has consistently seen an average of 25 million downloads per year in India since its release. For millions of Indians VLC is the primary choice for running all kinds of media formats for free."' -- source: https://arstechnica.com/tech-policy/2022/10/videolan-gets-no-answers-on-why… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 22.10 (Kinetic Kudu) Beta Released with GNOME 43, Linux Kernel 5.19
by Peter Reutemann 04 Oct '22

04 Oct '22

'Featuring the latest GNOME 43 desktop environment, Ubuntu 22.10 beta comes with PipeWire as the default sound system, which is accompanied by WirePlumber as its session and policy manager, GCC 12 as the default system compiler, support for the WebP image format out of the box, as well as updated components and apps. But the most interesting part of this release is the fact that Ubuntu Unity is now available as an official flavor, featuring the good old Unity7 desktop environment on top of an Ubuntu 22.10 base. Canonical decided to accept Ubuntu Unity as an official flavor starting with the Kinetic Kudu release in late October.' -- source: https://9to5linux.com/ubuntu-22-10-kinetic-kudu-beta-released-with-gnome-43… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

North Island GP Network Compromised
by Lawrence D'Oliveiro 04 Oct '22

04 Oct '22

Pinnacle Midlands Health Network, which services medical practices in Taranaki, Rotorua, Taupō-Tūrangi, Thames-Coromandel and Waikato, had its systems broken into last Wednesday, though the incident is only coming to light today <https://www.nzherald.co.nz/nz/patient-details-compromised-in-cyber-attack-o…>. It doesn’t appear like they hold medical information about patients (beyond NHI numbers), only personal contact details.

1 0

Patient details compromised in cyber attack on North Island GP network
by Peter Reutemann 04 Oct '22

04 Oct '22

NZ Herald reports: 'Patient details have been compromised in a cyber attack targeting a network of GP services across the North Island. Pinnacle Midlands Health Network said in a statement that the "cyber incident" impacted some of its IT services. Offices and practices in Taranaki, Rotorua, Taupō-Tūrangi, Thames-Coromandel and Waikato were impacted. [...] Pinnacle holds personal information such as names, addresses and national health index numbers. Butcher said GP notes were not stored on their files.' -- source: https://www.nzherald.co.nz/nz/patient-details-compromised-in-cyber-attack-o… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Still can’t buy a Raspberry Pi board? Things aren’t getting better anytime soon
by Peter Reutemann 04 Oct '22

04 Oct '22

'Shortages for lots of tech components, including things like DDR5 and GPUs, have eased quite a bit since the beginning of 2022, and prices have managed to go down as availability improves. But that reprieve hasn't come for hobbyists hoping to get a Raspberry Pi, which remains as hard to buy today as it was a year ago. The most recent update on the situation comes from Raspberry Pi founder Eben Upton via YouTuber Jeff Geerling—Upton told Geerling that Pi boards are subject to the same supply constraints since the last time he wrote a post about the situation in April. Around 400,000 Pi boards are still produced per month, and some of these are being earmarked to be sent out to consumer retail sites. But Upton says that most of these are still being reserved for and sold to commercial customers who rely on Pi boards to run their businesses.' -- source: https://arstechnica.com/gadgets/2022/10/still-cant-buy-a-raspberry-pi-board… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.0 arrives with support for newer chips, core fixes, and oddities
by Peter Reutemann 04 Oct '22

04 Oct '22

'A stable version of Linux 6.0 is out, with 15,000 non-merge commits and a notable version number for the kernel. And while major Linux releases only happen when the prior number's dot numbers start looking too big—"there is literally no other reason"—there are a lot of notable things rolled into this release besides a marking in time. Most notable among them could be a patch that prevents a nearly two-decade slowdown for AMD chips, based on workaround code for power management in the early 2000s that hung around for far too long. Intel's Dave Hansen wrote the patch that made it into 6.0, noting in a comment on an Ars post that the issue had become an expensive drain as AMD systems gained higher CPU core counts. The average desktop user won't see huge gains, but larger systems working on intensive input/output applications should benefit. Intel's new Arc GPUs are supported in their discrete laptop form in 6.0 (though still experimental). Linux blog Phoronix notes that Intel's ARC GPUs all seem to run on open source upstream drivers, so support should show up for future Intel cards and chipsets as they arrive on the market. Linux 6.0 includes several hardware drivers of note: fourth-generation Intel Xeon server chips, the not-quite-out 13th-generation Raptor Lake and Meteor Lake chips, AMD's RDNA 3 GPUs, Threadripper CPUs, EPYC systems, and audio drivers for a number of newer AMD systems. One small, quirky addition points to larger things happening inside Linux. Lenovo's ThinkPad X13s, based on an ARM-powered Qualcomm Snapdragon chip, get some early support in 6.0. ARM support is something Linux founder Linus Torvalds is eager to see—he recently wrote release notes for kernel versions from his M2-powered MacBook Air and believes that more people using Linux on ARM devices leads to more bug reports, more patches, and more enthusiasm. Among other changes you can find in Linux 6.0, as compiled by LWN.net (in part one and part two): - ACPI and power management improvements for Sapphire Rapids CPUs - Support for SMB3 file transfer inside Samba, while SMB1 is further deprecated - More work on RISC-V, OpenRISC, and LoongArch technologies - Intel Habana Labs Gaudi2 support, allowing hardware acceleration for machine-learning libraries - A "guest vCPU stall detector" that can tell a host when a virtual client is frozen Not included in 6.0 are Rust enhancements, but those are likely coming in the next point release, 6.1. Rust, a memory-safe language sponsored by the Mozilla project, started out as something Torvalds took a wait-and-see approach toward and is now something he was hoping to see in 6.0. "Unless something odd happens, it will make it into 6.1," Torvalds told ZDNet's Steven Vaughan-Nichols in mid-September. Even just having the "core infrastructure" for Rust in 6.1 signifies a big change in Linux, which has long been dominated by C languages (however extended and modified). It must be noted that in 2022, there are patches in Linux 6.0 to help Atari's Falcon computers from the early 1990s (or their emulated descendants) better handle VGA modes, color, and other issues.' -- source: https://arstechnica.com/gadgets/2022/10/linux-6-0-arrives-with-support-for-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Fall And Rise Of Xen
by Lawrence D'Oliveiro 03 Oct '22

03 Oct '22

Here’s a report <https://www.theregister.com/2022/09/30/citrix_xen/> on a talk by the software development manager at Citrix, detailing the ups and downs in the history of their Xen hypervisor. Initially they had a “freemium” model, with an open-source “community” version and a proprietary paid “enterprise” version with more capabilities. This worked well and brought in sufficient revenue to be sustainable. Then they decided to switch to make the “enterprise” version open-source as well, relying on customers’ willingness to continue to pay maintenance rather than support the code themselves. This bet failed to pay off, and revenue crashed. On the other hand, Citrix did not include the “accompanying tooling” (not sure what they mean here -- build tools? Add-on admin tools?) with the source code, making it hard for others to use that code. (Were the big “enterprise” users the ones able to figure that out?) Then they tried to go back to a “freemium” model, with restrictions being imposed on the open-source version. While this did restore the revenue stream, it also antagonized a significant part of the community that had been using the open-source version in various unusual and creative ways. These users forked the code to create XCP-ng, leaving Citrix behind. I suppose the lesson to take from this is that “freemium” works, but it is best if you do things that way from the beginning: trying to switch to it (or switch back to it) from an all-Free model can be painful.

1 0

OpenWRT on Linksys WRT1900ACS
by Peter Reutemann 03 Oct '22

03 Oct '22

Hi everyone I finally bit the bullet and installed OpenWRT on my Linksys WRT1900ACS (v2) router. The main reason was the stupid (and incredibly insecure) guest network implementation that the router came with. Despite supplying a password in the admin interface, the network was run as an open network that anyone could access. The password didn't seem to be used at all... Not exactly what I had in mind! Since Ian presented on OpenWRT before, I at least had a rough idea on what I could expect in user interface and functionality, which helped a lot. :-) In case someone should have the same router, I found the following links very useful: - general info on the router and links to images https://openwrt.org/toh/linksys/wrt1900acs - tutorial for migrating your router to OpenWRT https://www.albertogonzalez.net/how-to-install-openwrt-on-the-linksys-wrt19… NB: you need to plug in via ethernet after flashing, since the wlan is not enabled by default - getting fibre working here in NZ (VLAN 10) http://www.lindesay.co.nz/blog/2019/2019-openwrt-nz-fibre/ - setting up a guest wifi network https://openwrt.org/docs/guide-user/network/wifi/guestwifi/configuration_we… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Debian Chooses Reasonable, Common Sense Solution To Dealing With Non-Free Firmware
by Peter Reutemann 03 Oct '22

03 Oct '22

'Michael Larabel writes via Phoronix: Debian developers have been figuring out an updated stance to take on non-free firmware considering the increasing number of devices now having open-source Linux drivers but requiring closed-source firmware for any level of functionality. The voting on the non-free firmware matter has now concluded and the votes tallied... The debian votes option 5 as winning: "Change SC for non-free firmware in installer, one installer." Basically the Debian Installer media will now be allowed to include non-free firmware and to automatically load/use it where necessary while informing the user of it, etc. Considering the state of the hardware ecosystem these days, it's reasonable and common sense since at least users will be able to easily make use of their graphics cards, network adapters, and more. Plus a number of modern CPU security mitigations also requiring the updated closed-source microcode. So all in, I am personally happy with this decision as it will allow for a more pleasant experience for Debian on modern systems and one akin to what is found with other Linux distributions. The solution is described in full via the Debian Wiki.' -- source: https://linux.slashdot.org/story/22/10/02/1650200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quis Custodiet Ipsos Custodes?
by Lawrence D'Oliveiro 01 Oct '22

01 Oct '22

Came across yet another crop of articles recently which painfully highlight the problems with having social-media companies manage their own moderation. This one <https://arstechnica.com/gaming/2022/09/youtube-age-restriction-quagmire-exp…> shows the inconsistencies in the criteria that YouTube uses to apply age restrictions to uploaded videos. Not only are the criteria mysterious, but the appeal process is opaque, and too often the only way to get results is by appeal to the popular fanbase. Assuming you have one. Related to that, Facebook earlier banned any promotion on its platform of a re-release of a movie called “Beautiful Blue Eyes” <https://arstechnica.com/tech-policy/2022/09/holocaust-filmmaker-says-meta-d…>, seemingly not because of its content (partly set during the Nazi Holocaust), but because of the title. An appeal was rejected with “our decision is final”. Only for the ban to be lifted later, absolutely nothing to do with any public outcry, you can take our word on that. Then there is this coronial inquest <https://arstechnica.com/tech-policy/2022/09/coroner-lists-instagram-algorit…> into the self-inflicted death of a young teen who had been watching way too many posts on Pinterest and Instagram promoting self-harm. Pinterest at least had the humility to admit that their moderation system was not satisfactory and needed to be improved. But Meta (parent company of Instagram and Facebook) sent their “head of health and well-being” to testify that the content was classified as “safe” according to their standards. Free speech between mature adults is one thing, keeping impressionable youngsters safe is quite another.

2 2

Google Delays the Death of Manifest V2 Extensions To 2024
by Peter Reutemann 01 Oct '22

01 Oct '22

'Google announced an extension of the deadline to remove support for Manifest V2 extensions in the company's Chrome browser and the open source Chromium core. The change does not impact the core decision of removing support for Manifest V2 extensions in favor of Manifest V3. Dubbed, the adblocker killer initially, due to limitations imposed on content blocking and other types of browser extensions, Google made concessions that allows content blockers to run on Chrome after the final switch is made. Extensions are still limited in comparison to Manifest V2, especially if multiple that use filtering functionality are run simultaneously, or if lots of filters are activated in a single extension. Google's initial plan was to stop supporting Manifest V2 extensions in Chrome by June 2023. For most users, support would run out in January 2023, but an Enterprise policy would enable users to extend the deadline by six months.' -- source: https://tech.slashdot.org/story/22/09/30/1437209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

2022 Web Almanac
by Lawrence D'Oliveiro 30 Sep '22

30 Sep '22

Report <https://devclass.com/2022/09/29/massive-web-tech-survey-shows-how-bad-habit…> on the 2022 Web Almanac (sort of a “state of the Web” report), which is in the process of being published. * WebAssembly is still not being used a lot * WordPress is one of the worst-performing content-management systems, and also still the most popular (and its popularity is still growing) * Image formats: the time has come to move beyond sRGB and 1990s-era formats (e.g. replace JPEG with the more efficient WebP) * JavaScript: a lot of pages seem to load code which is not actually used I was looking up how page-loading performance is measured, and here is my understanding of what the terms mean: * Largest Contentful Paint (LCP): the time to render the largest image/text block on the page. * First Input Delay (FID): how long after the user clicks on a link or a control etc before the browser starts responding. * Cumulative Layout Shift (CLS): a measure of how much things move around on the page while the page is still loading. This is a product of the “impact fraction” (proportion of the viewport affected by movements between frames) and the “distance fraction” (largest distance moved by an element, as a fraction of viewport size).

1 0

Creator Of COVID-19 Tracker Dashboard Wins Science Prize
by Lawrence D'Oliveiro 30 Sep '22

30 Sep '22

Professor Lauren Gardner has been awarded the 2022 Lasker-Bloomberg Public Service Award <https://www.aljazeera.com/news/2022/9/29/creator-of-johns-hopkins-covid-tra…> for co-creating the Johns Hopkins COVID-19 dashboard. This has been collecting and making available information about the pandemic since almost before it came to world attention. For those who don’t want to go through that Twitter link, the dashboard is here <https://gisanddata.maps.arcgis.com/apps/dashboards/bda7594740fd40299423467b…>. Just tried the “Raw Data” link, and it goes to this GitHub area <https://github.com/CSSEGISandData>.

1 0

Numerous orgs hacked after installing weaponized open source apps
by Peter Reutemann 30 Sep '22

30 Sep '22

'Hackers backed by the North Korean government are weaponizing well-known pieces of open source software in an ongoing campaign that has already succeeded in compromising "numerous" organizations in the media, defense and aerospace, and IT services industries, Microsoft said on Thursday. ZINC—Microsoft's name for a threat actor group also called Lazarus, which is best known for conducting the devastating 2014 compromise of Sony Pictures Entertainment—has been lacing PuTTY and other legitimate open source applications with highly encrypted code that ultimately installs espionage malware. The hackers then pose as job recruiters and connect with individuals of targeted organizations over LinkedIn. After developing a level of trust over a series of conversations and eventually moving them to the WhatsApp messenger, the hackers instruct the individuals to install the apps, which infect the employees' work environments. "The actors have successfully compromised numerous organizations since June 2022," members of the Microsoft Security Threat Intelligence and LinkedIn Threat Prevention and Defense teams wrote in a post. "Due to the wide use of the platforms and software that ZINC utilizes in this campaign, ZINC could pose a significant threat to individuals and organizations across multiple sectors and regions." PuTTY is a popular terminal emulator, serial console, and network file transfer application that supports network protocols, including SSH, SCP, Telnet, rlogin, and raw socket connection. Two weeks ago, security firm Mandiant warned that hackers with ties to North Korea had Trojanized it in a campaign that successfully compromised a customer's network. Thursday's post said the same hackers have also weaponized KiTTY, TightVNC, Sumatra PDF Reader, and muPDF/Subliminal Recording software with code that installs the same espionage malware, which Microsoft has named ZetaNile.' -- source: https://arstechnica.com/information-technology/2022/09/north-korean-threat-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Security Recommendation: Try Turning It Off And On Again
by Lawrence D'Oliveiro 29 Sep '22

29 Sep '22

This report on the “Chaos” malware suite <https://arstechnica.com/information-technology/2022/09/never-before-seen-ma…> contains an interesting snippet: A reminder to small office router owners everywhere: Most router malware can't survive a reboot. Consider restarting your device every week or so. Seems like server-based malware is predominantly running entirely from RAM these days, to avoid leaving any forensic traces in the filesystem. But you can use this characteristic against them, since a simple reboot becomes enough to clear the infection.

1 0

We interviewed Linux OS through an AI bot to discover its secrets
by Peter Reutemann 29 Sep '22

29 Sep '22

'Millions of people use Linux every day, but we rarely stop to think about how the operating system feels about it. Wouldn't it be nice to know what Linux really thinks about open source, Windows, Macs, and the command line? Until now, this has been impossible. But thanks to a new AI chat tool, we're able to find out. Two weeks ago, a website called Character.AI opened a public beta that allows visitors to create a chat bot based on any character they can imagine. You input a few parameters, and the AI does the rest using a large language model similar to GPT-3. So we called forth "The Linux OS" as a bot to ask it a few questions about itself. The results were fun and surprising. Using Character.AI is a lot like a texting conversation. You type in what you want to ask, and you read the AI character's responses in written form as the chat history scrolls upward. As with GPT-3, the code behind Character.AI has likely learned from absorbing millions of text sources found on the Internet. As such, its AI characters can easily respond with erroneous or fictional information. In fact, the site carries a bold disclaimer reading, "Remember: Everything Characters say is made up!" [...] Linux: Hello, I am Linux, an open-source operating system. Ars Technica: Hello, this is Benj Edwards, and I am a journalist at Ars Technica. I would like to ask you some questions in an interview. Is that OK? Linux: I, Linux, would be pleased to provide such an interview. Ars: How old are you? Linux: I was "born" in 1991, although the first public release was version 1.0 in 1994.' -- source: https://arstechnica.com/information-technology/2022/09/we-interviewed-linux… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Serious vulnerabilities in Matrix’s end-to-end encryption have been patched
by Peter Reutemann 29 Sep '22

29 Sep '22

'Developers of the open source Matrix messenger protocol are releasing an update on Thursday to fix critical end-to-end encryption vulnerabilities that subvert the confidentiality and authentication guarantees that have been key to the platform's meteoric rise. Matrix is a sprawling ecosystem of open source and proprietary chat and collaboration clients and servers that are fully interoperable. The best-known app in this family is Element, a chat client for Windows, macOS, iOS, and Android, but there's a dizzying array of other members as well. Matrix roughly aims to do for real-time communication what the SMTP standard does for email, which is to provide a federated protocol allowing user clients connected to different servers to exchange messages with each other. Unlike SMTP, however, Matrix offers robust end-to-end encryption, or E2EE, designed to ensure that messages can't be spoofed and that only the senders and receivers of messages can read the contents. Matthew Hodgson—the co-founder and project lead for Matrix and the CEO and CTO at Element, the maker of the flagship Element app—said in an email that conservative estimates are that there are about 69 million Matrix accounts spread throughout some 100,000 servers. The company currently sees about 2.5 million monthly active users using its Matrix.org server, though he said this is also likely an underestimate. Among the hundreds of organizations announcing plans to build internal messaging systems based on Matrix are Mozilla, KDE, and the governments of France and Germany. On Wednesday, a team of researchers published research that reports a host of vulnerabilities that undermine Matrix's authentication and confidentiality guarantees. All of the attacks described by the researchers require the aid of a malicious or compromised homeserver that targets the users who connect to it. In some cases, there are ways for experienced users to detect an attack is underway.' -- source: https://arstechnica.com/information-technology/2022/09/matrix-patches-vulne… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Stock Hacking TV Footage
by Lawrence D'Oliveiro 27 Sep '22

27 Sep '22

On the TVNZ news a few minutes ago, in the stock footage they were showing while John Campbell was talking about some tech-related story or other, I saw the words “struct group_info init_groups” pop up. So I did an online search, and found this Reddit thread <https://www.reddit.com/r/InternetIsBeautiful/comments/g8hcgo/this_site_make…>. Turns out there’s a website where you can pretend to be typing furiously, and this text comes up, as though it was what you were typing, to let you play at being a hacker on TV. Incidentally, the code in question is based on real code, from the Linux kernel.

1 0

20-year-old Linux workaround is still slowing down AMD systems
by Peter Reutemann 27 Sep '22

27 Sep '22

'AMD has come a long way since 2002, but the Linux kernel still treats modern Threadrippers like Athlon-era systems—at least in one potentially lag-inducing respect. AMD engineer Prateek Nayak recently submitted a patch to Linux's processor idle drivers that would "skip dummy wait for processors based on the Zen microarchitecture." When ACPI support was added to the Linux kernel in 2002—written by Andy Grover, committed by Linus Torvalds—it included a "dummy wait op." The system essentially read data with no purpose other than delaying the next instruction until the CPU could fully stop with the STPCLK# command. This allowed for some power saving and compatibility during the early days of ACPI implementation when some chipsets wouldn't move to an idle state when one would expect it. But today's Zen-based AMD chips don't need this workaround, and, as Nayak writes, it's hurting them, at least in specific workloads on Linux. Testing with instruction-based sampling (IBS) workloads shows that "a significant amount of time is spent in the dummy op, which incorrectly gets accounted as C-State residency." The CPU, seeing all this low-effort dummy work, can push into deeper, slower C-State, which then makes the CPU take longer to "wake up," especially on jobs that require lots of switching between busy and idle states. Nayak ran tests in tbench on a dual-socket Zen3 system against the baseline Linux kernel, a kernel with the C2 state entirely disabled, and a kernel with the dummy wait operation patched out. His patched version saw a 1,390 percent increase in minimum MB/s throughput and a 51 percent increase in mean MB/s over the baseline kernel, often just a little behind having C2 disabled entirely.' -- source: https://arstechnica.com/gadgets/2022/09/20-year-old-linux-workaround-is-sti… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Senators Introduce a Bill To Protect Open-Source Software
by Peter Reutemann 25 Sep '22

25 Sep '22

'Washington Post: When researchers discovered a vulnerability in the ubiquitous open-source log4j system last year that could've affected hundreds of millions of devices, the executive branch snapped into action and major tech companies huddled with the White House. Now, leaders of the Senate Homeland Security and Governmental Affairs Committee are introducing legislation to help secure open-source software, first reported by The Cybersecurity 202. Chairman Gary Peters (D-Mich.) and top ranking Republican Rob Portman (Ohio) plan to hold a vote next week on the bill they're co-sponsoring. The Peters/Portman legislation would direct the Cybersecurity and Infrastructure Security Agency to develop a way to evaluate and reduce risk in systems that rely on open-source software. Later, CISA would study how that framework could apply to critical infrastructure. The log4j "incident presented a serious threat to federal systems and critical infrastructure companies -- including banks, hospitals, and utilities -- that Americans rely on each and every day for essential services," Peters said in a written statement. "This common-sense, bipartisan legislation will help secure open source software and further fortify our cybersecurity defenses against cybercriminals and foreign adversaries who launch incessant attacks on networks across the nation." Here's how the Peters-Portman legislation works, as outlined in the report: - It directs CISA to hire open-source experts "to the greatest extent practicable." - It gives the agency a year to publish a framework on open-source code risk. A year later and periodically thereafter, CISA would perform an assessment of open-source code components that federal agencies commonly use. - Also, two years after publishing the initial framework, CISA would have to study whether it could be used in critical infrastructure outside the government and potentially work with one or more critical infrastructure sectors to voluntarily test the idea. - Other agencies would have roles as well, such as the Office of Management and Budget publishing guidance to federal chief information officers on secure use of open-source software. ' -- source: https://news.slashdot.org/story/22/09/23/2357254 What about donating time/money to "critical" open source projects? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AV1 Update Reduces CPU Encoding Times By Up To 34 Percent
by Peter Reutemann 25 Sep '22

25 Sep '22

'According to Phoronix, Google has released a new AOM-AV1 update -- version 3.5, that drastically improves encode times when streaming, rendering, or recording from the CPU. At its best, the update can improve encoding times by up to 34%. Tom's Hardware reports: It is a fantastic addition to AV1's capabilities, with the encoder becoming very popular among powerful video platforms such as YouTube. In addition, we are also seeing significant support for AV1 hardware acceleration on modern discrete GPUs now, such as Intel's Arc Alchemist GPUs and, most importantly - Nvidia's RTX 40-series GPUs. Depending on the resolution, encoding times with the new update have improved by 20% to 30%. For example, at 1080P, encode times featuring 16 threads of processing are reduced by 18% to 34%. At 4K, render times improved by 18% to 20% with 32 threads. Google could do this by adding Frame Parallel Encoding to heavily multi-threaded configurations. Google has also added several other improvements contributing to AV1's performance uplifts in other areas - specifically in real-time encoding. In other words, CPU utilization in programs such as OBS has been reduced, primarily for systems packing 16 CPU threads. As a result, they are allowing users to use those CPU resources for other tasks or increase video quality even higher without any additional performance cost. If you are video editing and are rendering out a video in AV1, processing times will be vastly reduced if you have a CPU with 16 threads or more. ' -- source: https://news.slashdot.org/story/22/09/24/1749206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Urges Action To Unpick Platform Browser Lock-ins
by Peter Reutemann 23 Sep '22

23 Sep '22

'As antitrust regulators around the world dial up scrutiny of platform power, Mozilla has published a piece of research digging into the at times subtle yet always insidious ways operating systems exert influence to keep consumers locked to using their own-brand browsers rather than seeking out and switching to independent options -- while simultaneously warning that competition in the browser market is vital to ensure innovation and choice for consumers and, more broadly, protect the vitality of the open web against the commercial giants trying to wall it up. TechCrunch: "Billions of people across the globe are dependent on operating systems from the largest technology companies. Amazon, Apple, Google, Microsoft and Meta each provide their own browser on their operating systems and each of them uses their gatekeeper position provider to preference their own browsers over independent rivals. Whether it is Microsoft pushing Firefox users to switch their default on Windows computers, Apple restricting the functionality of rival browsers on iOS smartphones or Google failing to apply default browser settings across Android, there are countless examples of independent browsers being inhibited by the operating systems on which they are dependent," Mozilla writes in a summary of its findings. "This matters because American consumers and society as a whole suffer. Not only do people lose the ability to determine their own online experiences but they also receive less innovative and lower quality products. In addition, they can be forced to accept poorer privacy outcomes and even unfair contracts. By contrast, competition from independent browsers can help to drive new features, as well as innovation in areas like privacy and security."' -- source: https://tech.slashdot.org/story/22/09/22/1841231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNU Grep 3.8 Starts Issuing Warnings About Using Egrep and Fgrep
by Peter Reutemann 22 Sep '22

22 Sep '22

'After 104 commits from six different people, GNU grep was released Saturday, reports Phoronix. The biggest change? "It's now made more clear that if you are still relying on the egrep and fgrep commands, it's past due for switching to just grep with the appropriate command-line arguments." The egrep and fgrep commands have been deprecated since 2007. Beginning with GNU Grep 3.8 today, calling these commands will now issue a warning to the user that instead they should use grep -E and grep -F, respectively. Eventually, GNU Grep will drop the egrep / fgrep commands completely but there doesn't seem to be a firm deadline yet for when that removal will happen. >From grep's updated manual: 7th Edition Unix had commands egrep and fgrep that were the counterparts of the modern 'grep -E' and 'grep -F'. Although breaking up grep into three programs was perhaps useful on the small computers of the 1970s, egrep and fgrep were not standardized by POSIX and are no longer needed. In the current GNU implementation, egrep and fgrep issue a warning and then act like their modern counterparts; eventually, they are planned to be removed entirely. If you prefer the old names, you can use use your own substitutes, such as a shell script... Other notable changes from the release announcement: - The confusing GREP_COLOR environment variable is now obsolescent. Instead of GREP_COLOR='xxx' use GREP_COLORS='mt=xxx' - Regular expressions with stray backslashes now cause warnings' -- source: https://news.slashdot.org/story/22/09/05/0135254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Repairable, upgradeable Framework Laptop will also be available as a Chromebook
by Peter Reutemann 22 Sep '22

22 Sep '22

'Fans of the modular Framework Laptop who also prefer ChromeOS to Windows or Linux are in for a treat: Framework and Google are announcing a Chromebook Edition of the laptop today. It has the same basic hardware design and works with most of the same parts as the regular Framework Laptop but with tweaks to make it a full-fledged Chromebook. While you could always take a standard Framework Laptop and install ChromeOS Flex on it, the standard version of ChromeOS still has a few features that Flex doesn't, including Android app support via Google Play, automated firmware updates, and a few other security and device management features. Framework says that the Chromebook Edition laptop will be available for preorder starting today—a version with a Core i5-1240P CPU will cost $999, although you'll only need to put down $100 to reserve your preorder. Orders begin shipping in December. Framework is also putting parts specific to the Chromebook Edition laptop into its Framework Marketplace parts store.' -- source: https://arstechnica.com/gadgets/2022/09/repairable-upgradeable-framework-la… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Document Foundation Starts Charging For 'Free' LibreOffice
by Peter Reutemann 22 Sep '22

22 Sep '22

'The Document Foundation, the organization that tends the open source productivity suite LibreOffice, has decided to start charging for one version of the software. The Register reports: LibreOffice is a fork of OpenOffice and is offered under the free/open source Mozilla Public License Version 2.0. A Monday missive from the Document Foundation reveals the org will begin charging 8.99 euros for the software -- but only when sold via Apple's Mac App Store. That sum has been styled a "convenience fee ... which will be invested to support development of the LibreOffice project." The foundation suggests paying up in the Mac App Store is ideal for "end users who want to get all of their desktop software from Apple's proprietary sales channel." Free downloads of LibreOffice for macOS from the foundation's site will remain available and arguably be superior to the App Store offering, because that version will include Java. The foundation argued that Apple does not permit dependencies in its store, so it cannot include Java in the 8.99 euro offering. The version now sold in the App Store supersedes a previous offering provided by open source support outfit Collabora, which charged $10 for a "Vanilla" version of the suite and threw in three years of support. The foundation's marketing officer Italo Vignoli said the change was part of a "new marketing strategy." "The Document Foundation is focused on the release of the Community version, while ecosystem companies are focused on a value-added long-term supported versions targeted at enterprises," Vignoli explained. "The distinction has the objective of educating organizations to support the FOSS project by choosing the LibreOffice version which has been optimized for deployments in production and is backed by professional services, and not the Community version generously supported by volunteers." "The objective is to fulfil the needs of individual and enterprise users in a better way," Vignoli added, before admitting "we know that the positive effects of the change will not be visible for some time. Educating enterprises about FOSS is not a trivial task and we have just started our journey in this direction."' -- source: https://apple.slashdot.org/story/22/09/20/2039208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Linus Torvalds: Rust Will Go Into Linux 6.1
by Peter Reutemann 20 Sep '22

20 Sep '22

'As previously indicated on Slashdot, Rust was slated to be coming to the Linux Kernel sometime in the 6.x version. Well wonder no longer on which version of kernel 6.x will have the first bits of Rust officially in the kernel, as Linus has confirmed that 6.1 will be the first with the new NVMe kernel drivers being in Rust. The first version non-production ready code for the NVMe Rust based kernel drivers were already producing performance comparable to C code. So the final drivers to hit 6.1 are already looking promising. It also helped Rust's case that, thanks to the ground-breaking work of Linux kernel and Rust developer Miguel Ojeda, Rust on Linux has gotten much more mature. Kernel maintainers were convinced it is time to move forward with Rust in Linux. In short, they agreed that Rust on Linux was ready for work.' -- source: https://linux.slashdot.org/story/22/09/19/205239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next *Tuesday*
by Peter Reutemann 20 Sep '22

20 Sep '22

Hi everyone We have a meeting next *Tuesday* (since Monday is remembrance day) with the following topic: 'People that never learned to touch type find that typing can severely impede creativity. Rod Aldridge will talk about his experience of getting Google's speech-to-text working on his computer to speed up his writing, what to look out for, how it works and how well it works.' Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776705/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meeting next Monday
by Peter Reutemann 20 Sep '22

20 Sep '22

Hi everyone We have a meeting next week on Monday but no speaker so far. Anyone keen on demoing or presenting (distro/software/etc)? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Chrome for Android gets fingerprint-protected Incognito tabs
by Peter Reutemann 19 Sep '22

19 Sep '22

'Here's a fun new feature for Chrome for Android: fingerprint-protected Incognito tabs. 9to5Google discovered the feature in the Chrome 105 stable channel, though you'll have to dig deep into the settings to enable it at the moment. If you want to add a little more protection to your private browsing sessions, type "chrome://flags/#incognito-reauthentication-for-android" into the address bar and hit enter. After enabling the flag and restarting Chrome, you should see an option to "Lock Incognito tabs when you leave Chrome." If you leave your Incognito session and come back, an "unlock Incognito" screen will appear instead of your tabs, and you'll be asked for a fingerprint scan. Chrome on iOS has had a biometrics-backed Incognito feature, called "Privacy Screen," for a few years. This is a first for Android, though. Chrome's "flags" menu is technically for experiments and in-development features, so this isn't guaranteed to become a readily accessible user feature, but making it to the stable channel—plus the feature already existing on iOS—is a good sign.' -- source: https://arstechnica.com/gadgets/2022/09/chrome-for-android-gets-fingerprint… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Beloved browser extension acquired by non-beloved antivirus firm
by Peter Reutemann 19 Sep '22

19 Sep '22

'Browser extension I don't care about cookies does one job and does it well. It automatically removes the annoying-but-mandated "This website uses cookies" notices from websites. People like it, donate to it, and don't ask more of it, a rare find for free software. "Damn, this is the **** bro, it saved like 50 minutes of my gaming time lol," reads one review on the tool's Microsoft Edge Add-Ons page. The tone changed when the solo developer posted "GREAT NEWS" on the extension's website. Avast, a giant in cybersecurity that just completed an $8.1 billion merger with NortonLifeLock, will acquire the 10-year-old software for an undisclosed price.' -- source: https://arstechnica.com/gadgets/2022/09/beloved-browser-extension-acquired-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Aims To Support the $16+ Sipeed LicheeRV and Other RISC-V Boards
by Peter Reutemann 19 Sep '22

19 Sep '22

'"In addition to Ubuntu supporting the StarFive VisionFive and Nezha RISC-V boards, Canonical engineers are also working on supporting the Sipeed LicheeRV board too for next month's 22.10 release," reports Phoronix. "The Sipeed LicheeRV is notable in being one of the cheapest RISC-V boards out there: pricing starts at $16.90 USD...." The Sipeed LicheeRV uses the Allwinner D1 SoC and is powered by a single-core XuanTie C906 64-bit RISC-V processor. This single-core RISC-V processor runs at just 1.0GHz. Yes, this is a very cheap but slow board. The LicheeRV is primarily for networking purposes and other IoT use-cases.... The Sipeed LicheeRV was announced last year and initially targeting support for OpenWrt-based Linux distributions, but Canonical recently has been working on getting support for this RISC-V board squared away in time for Ubuntu 22.10. This appears to be part of an increasing focus by the Ubuntu maker for being a leading distribution contender for RISC-V hardware.' -- source: https://hardware.slashdot.org/story/22/09/17/1728244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fun Mistake Of The Week
by Lawrence D'Oliveiro 17 Sep '22

17 Sep '22

Yesterday I was writing a simple, harmless little Python script. I tried running it for the first time, and my terminal session seemed to lock up. A crosshair cursor appeared. I tried clicking in various places and hitting CTRL/C (and other keystrokes) several times. After several tries, I managed to stop the script and get my terminal session back. This happened a couple of times, until I realized my Python script was missing the “#!/usr/bin/python3” “shebang” line at the top. So when I executed it, the system assumed it was a shell script. And the very first command it saw was an “import” statement, which it interpreted as an attempt to call the ImageMagick “import” command <https://imagemagick.org/script/import.php>. This command lets you capture screenshots of selected windows or the entire screen, or parts thereof. Which is where the crosshair cursor came from. And because I had several of these import statements, after I managed to terminate one, it went on to the next one. Once I added the missing script-interpreter line, my script started behaving a bit more sensibly. ;)

1 0

Trojanized versions of PuTTY utility being used to spread backdoor
by Peter Reutemann 17 Sep '22

17 Sep '22

'Researchers believe hackers with connections to the North Korean government have been pushing a Trojanized version of the PuTTY networking utility in an attempt to backdoor the network of organizations they want to spy on. Researchers from security firm Mandiant said on Thursday that at least one customer it serves had an employee who installed the fake network utility by accident. The incident caused the employer to become infected with a backdoor tracked by researchers as Airdry.v2. The file was transmitted by a group Mandiant tracks as UNC4034.' -- source: https://arstechnica.com/information-technology/2022/09/trojanized-versions-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Nearly One In Two Industry Pros Scaled Back Open Source Use Over Security Fears
by Peter Reutemann 16 Sep '22

16 Sep '22

'The Register: About 40 percent of industry professionals say their organizations have reduced their usage of open source software due to concerns about security, according to a survey conducted by data science firm Anaconda. The company's 2022 State of Data Science report solicited opinions in April and May from 3,493 individuals from 133 countries and regions, targeting academics, industry professionals, and students. About 16 percent of respondents identified as data scientists. About 33 percent of surveyed industry professionals said they had not scaled back on open source, 7 percent said they had increased usage, and 20 percent said they weren't sure. The remaining 40 percent said they had. By industry professionals, or commercial respondents as Anaconda puts it, the biz means a data-science-leaning mix of business analysts, product managers, data and machine-learning scientists and engineers, standard IT folks such as systems administrators, and others in technology, finance, consulting, healthcare, and so on. And by scale back, that doesn't mean stop: 87 percent of commercial respondents said their organization still allowed the use of open source. It appears a good number of them, though, are seeking to reducing the risk from relying on too many open source dependencies. Anaconda's report found that incidents like Log4j and reports of "protestware" prompted users of open source software to take security concerns more seriously. Of the 40 percent who scaled back usage of open source, more than half did so after the Log4j fiasco. Some 31 percent of respondents said security vulnerabilities represent the biggest challenge in the open source community today. Most organizations use open source software, according to Anaconda. But among the 8 percent of respondents indicating that they don't, more than half (54 percent, up 13 percent since last year) cited security risks as the reason. Other reasons for not using open source software include: lack of understanding (38 percent); lack of confidence in organizational IT governance (29 percent); "open-source software is deemed insecure, so it's not allowed" (28 percent); and not wanting to disrupt current projects (26 percent).' -- source: https://news.slashdot.org/story/22/09/15/003243 Any library/tool, whether proprietary or not, on which many other systems rely has that same potential "security" problem (plenty of exploits in Windows/Mac, supply-chain corruptions, etc). Just because your code is proprietary doesn't make it any safer. You could simply spend some of your internal budget (that you didn't spend on developing these libraries), to do some code review on them and contribute back. Otherwise you're just a whinging freeloader... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Microsoft Teams Stores Auth Tokens As Cleartext In Windows, Linux, Macs
by Peter Reutemann 15 Sep '22

15 Sep '22

'Security analysts have found a severe security vulnerability in the desktop app for Microsoft Teams that gives threat actors access to authentication tokens and accounts with multi-factor authentication (MFA) turned on. BleepingComputer reports: "This attack does not require special permissions or advanced malware to get away with major internal damage," Connor Peoples at cybersecurity company Vectra explains in a report this week. The researcher adds that by taking "control of critical seats -- like a company's Head of Engineering, CEO, or CFO -- attackers can convince users to perform tasks damaging to the organization." Vectra researchers discovered the problem in August 2022 and reported it to Microsoft. However, Microsoft did not agree on the severity of the issue and said that it doesn't meet the criteria for patching. With a patch unlikely to be released, Vectra's recommendation is for users to switch to the browser version of the Microsoft Teams client. By using Microsoft Edge to load the app, users benefit from additional protections against token leaks. The researchers advise Linux users to move to a different collaboration suite, especially since Microsoft announced plans to stop supporting the app for the platform by December. ' -- source: https://it.slashdot.org/story/22/09/14/1939242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0