- wlug - list.wlug.org.nz

Basic Rust Support Merged For Upcoming Linux 6.1
by Peter Reutemann 06 Oct '22

06 Oct '22

'"This Monday, the first set of patches to enable Rust support and tooling was merged for Linux 6.1," writes Slashdot reader sabian2008, sharing an update from longtime kernel developer Kees Cook: The tree has a recent base, but has fundamentally been in linux-next for a year and a half. It's been updated based on feedback from the Kernel Maintainer's Summit, and to gain recent Reviewed-by: tags. Miguel is the primary maintainer, with me helping where needed/wanted. Our plan is for the tree to switch to the standard non-rebasing practice once this initial infrastructure series lands. The contents are the absolute minimum to get Rust code building in the kernel, with many more interfaces[2] (and drivers -- NVMe[3], 9p[4], M1 GPU[5]) on the way. The initial support of Rust-for-Linux comes in roughly 4 areas: - Kernel internals (kallsyms expansion for Rust symbols, %pA format) - Kbuild infrastructure (Rust build rules and support scripts) - Rust crates and bindings for initial minimum viable build - Rust kernel documentation and samples ' -- source: https://linux.slashdot.org/story/22/10/04/2259259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Laptop Users Should Avoid Linux 5.19.12 To Avoid Potentially Damaging The Display
by Peter Reutemann 06 Oct '22

06 Oct '22

'Intel laptop users running Linux are being advised to avoid running the latest Linux 5.19.12 stable kernel point release as it can potentially damage the display. From a report: Intel Linux laptop users on Linux 5.19.12 have begun reporting "white flashing" display issues with one user describing it as "[the] laptop display starts to blink like lights in a 90's rave party." Intel Linux kernel engineer Ville Syrjal posted this week on the kernel mailing list: "After looking at some logs we do end up with potentially bogus panel power sequencing delays, which may harm the LCD panel."' -- source: https://linux.slashdot.org/story/22/10/05/141248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CTO Wants Developers To Build Once, Run On Any GPU
by Peter Reutemann 05 Oct '22

05 Oct '22

'Greg Lavender, CTO of Intel, spoke to VentureBeat about the company's efforts to help developers build applications that can run on any operating system. From the report: "Today in the accelerated computing and GPU world, you can use CUDA and then you can only run on an Nvidia GPU, or you can go use AMD's CUDA equivalent running on an AMD GPU,â Lavender told VentureBeat. "You can't use CUDA to program an Intel GPU, so what do you use?" That's where Intel is contributing heavily to the open-source SYCL specification (SYCL is pronounced like "sickle") that aims to do for GPU and accelerated computing what Java did decades ago for application development. Intel's investment in SYCL is not entirely selfless and isn't just about supporting an open-source effort; it's also about helping to steer more development toward its recently released consumer and data center GPUs. SYCL is an approach for data parallel programming in the C++ language and, according to Lavender, it looks a lot like CUDA. To date, SYCL development has been managed by the Khronos Group, which is a multi-stakeholder organization that is helping to build out standards for parallel computing, virtual reality and 3D graphics. On June 1, Intel acquired Scottish development firm Codeplay Software, which is one of the leading contributors to the SYCL specification. "We should have an open programming language with extensions to C++ that are being standardized, that can run on Intel, AMD and Nvidia GPUs without changing your code," Lavender said. Lavender is also a realist and he knows that there is a lot of code already written specifically for CUDA. That's why Intel developers built an open-source tool called SYCLomatic, which aims to migrate CUDA code into SYCL. Lavender claimed that SYCLomatic today has coverage for approximately 95% of all the functionality that is present in CUDA. He noted that the 5% SYCLomatic doesn't cover are capabilities that are specific to Nvidia hardware. With SYCL, Lavender said that there are code libraries that developers can use that are device independent. The way that works is code is written by a developer once, and then SYCL can compile the code to work with whatever architecture is needed, be it for an Nvidia, AMD or Intel GPU. Looking forward, Lavender said that he's hopeful that SYCL can become a Linux Foundation project, to further enable participation and growth of the open-source effort. [...] "We should have write once, run everywhere for accelerated computing, and then let the market decide which GPU they want to use, and level the playing field," Lavender said. ' -- source: https://news.slashdot.org/story/22/10/04/2225214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

VideoLAN threatens to sue India gov’t as ISPs keep blocking VLC website
by Peter Reutemann 05 Oct '22

05 Oct '22

'VideoLAN is threatening to sue India's government, saying it has received no explanation for why the VLC website has been blocked by Indian ISPs for the past six months. "In March 2022, to our shock and dismay, the URL 'https://www.videolan.org/' appeared to have been blocked for viewing in India without any prior notice to me or any other person in the organization," VideoLAN president and lead VLC developer Jean-Baptiste Kempf wrote in a September 30 letter to India's Department of Telecommunications. "Despite reportage and uproar on social media, no reasons for blocking the URL were provided to us, or to the Indian public." The letter said attempts to reach the URL in India resulted in the message, "Your requested URL has been blocked as per the directions received from the Department of Telecommunications, Government of India." VideoLAN is a French nonprofit organization that developed the free, open source VLC Media Player. In an email, Kempf told Ars that "VideoLAN is an organization that does not do politics (we only take position on anti-DRM and pro-open source subjects). So this topic is a bit of a shock to us." VideoLAN's letter told Indian government officials that the blocking "is particularly shocking to us, since the Government of India itself endorses the use of VLC as a part of its Digital India initiative, where it has expressed its intention to use open-source softwares for government applications. In fact, the Government of India also appears to use VLC Media Player's icon and logo on its website promoting open source softwares." The letter to India's government said, "VLC is currently being used by 80 million Indians, and has consistently seen an average of 25 million downloads per year in India since its release. For millions of Indians VLC is the primary choice for running all kinds of media formats for free."' -- source: https://arstechnica.com/tech-policy/2022/10/videolan-gets-no-answers-on-why… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 22.10 (Kinetic Kudu) Beta Released with GNOME 43, Linux Kernel 5.19
by Peter Reutemann 04 Oct '22

04 Oct '22

'Featuring the latest GNOME 43 desktop environment, Ubuntu 22.10 beta comes with PipeWire as the default sound system, which is accompanied by WirePlumber as its session and policy manager, GCC 12 as the default system compiler, support for the WebP image format out of the box, as well as updated components and apps. But the most interesting part of this release is the fact that Ubuntu Unity is now available as an official flavor, featuring the good old Unity7 desktop environment on top of an Ubuntu 22.10 base. Canonical decided to accept Ubuntu Unity as an official flavor starting with the Kinetic Kudu release in late October.' -- source: https://9to5linux.com/ubuntu-22-10-kinetic-kudu-beta-released-with-gnome-43… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

North Island GP Network Compromised
by Lawrence D'Oliveiro 04 Oct '22

04 Oct '22

Pinnacle Midlands Health Network, which services medical practices in Taranaki, Rotorua, Taupō-Tūrangi, Thames-Coromandel and Waikato, had its systems broken into last Wednesday, though the incident is only coming to light today <https://www.nzherald.co.nz/nz/patient-details-compromised-in-cyber-attack-o…>. It doesn’t appear like they hold medical information about patients (beyond NHI numbers), only personal contact details.

1 0

Patient details compromised in cyber attack on North Island GP network
by Peter Reutemann 04 Oct '22

04 Oct '22

NZ Herald reports: 'Patient details have been compromised in a cyber attack targeting a network of GP services across the North Island. Pinnacle Midlands Health Network said in a statement that the "cyber incident" impacted some of its IT services. Offices and practices in Taranaki, Rotorua, Taupō-Tūrangi, Thames-Coromandel and Waikato were impacted. [...] Pinnacle holds personal information such as names, addresses and national health index numbers. Butcher said GP notes were not stored on their files.' -- source: https://www.nzherald.co.nz/nz/patient-details-compromised-in-cyber-attack-o… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Still can’t buy a Raspberry Pi board? Things aren’t getting better anytime soon
by Peter Reutemann 04 Oct '22

04 Oct '22

'Shortages for lots of tech components, including things like DDR5 and GPUs, have eased quite a bit since the beginning of 2022, and prices have managed to go down as availability improves. But that reprieve hasn't come for hobbyists hoping to get a Raspberry Pi, which remains as hard to buy today as it was a year ago. The most recent update on the situation comes from Raspberry Pi founder Eben Upton via YouTuber Jeff Geerling—Upton told Geerling that Pi boards are subject to the same supply constraints since the last time he wrote a post about the situation in April. Around 400,000 Pi boards are still produced per month, and some of these are being earmarked to be sent out to consumer retail sites. But Upton says that most of these are still being reserved for and sold to commercial customers who rely on Pi boards to run their businesses.' -- source: https://arstechnica.com/gadgets/2022/10/still-cant-buy-a-raspberry-pi-board… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.0 arrives with support for newer chips, core fixes, and oddities
by Peter Reutemann 04 Oct '22

04 Oct '22

'A stable version of Linux 6.0 is out, with 15,000 non-merge commits and a notable version number for the kernel. And while major Linux releases only happen when the prior number's dot numbers start looking too big—"there is literally no other reason"—there are a lot of notable things rolled into this release besides a marking in time. Most notable among them could be a patch that prevents a nearly two-decade slowdown for AMD chips, based on workaround code for power management in the early 2000s that hung around for far too long. Intel's Dave Hansen wrote the patch that made it into 6.0, noting in a comment on an Ars post that the issue had become an expensive drain as AMD systems gained higher CPU core counts. The average desktop user won't see huge gains, but larger systems working on intensive input/output applications should benefit. Intel's new Arc GPUs are supported in their discrete laptop form in 6.0 (though still experimental). Linux blog Phoronix notes that Intel's ARC GPUs all seem to run on open source upstream drivers, so support should show up for future Intel cards and chipsets as they arrive on the market. Linux 6.0 includes several hardware drivers of note: fourth-generation Intel Xeon server chips, the not-quite-out 13th-generation Raptor Lake and Meteor Lake chips, AMD's RDNA 3 GPUs, Threadripper CPUs, EPYC systems, and audio drivers for a number of newer AMD systems. One small, quirky addition points to larger things happening inside Linux. Lenovo's ThinkPad X13s, based on an ARM-powered Qualcomm Snapdragon chip, get some early support in 6.0. ARM support is something Linux founder Linus Torvalds is eager to see—he recently wrote release notes for kernel versions from his M2-powered MacBook Air and believes that more people using Linux on ARM devices leads to more bug reports, more patches, and more enthusiasm. Among other changes you can find in Linux 6.0, as compiled by LWN.net (in part one and part two): - ACPI and power management improvements for Sapphire Rapids CPUs - Support for SMB3 file transfer inside Samba, while SMB1 is further deprecated - More work on RISC-V, OpenRISC, and LoongArch technologies - Intel Habana Labs Gaudi2 support, allowing hardware acceleration for machine-learning libraries - A "guest vCPU stall detector" that can tell a host when a virtual client is frozen Not included in 6.0 are Rust enhancements, but those are likely coming in the next point release, 6.1. Rust, a memory-safe language sponsored by the Mozilla project, started out as something Torvalds took a wait-and-see approach toward and is now something he was hoping to see in 6.0. "Unless something odd happens, it will make it into 6.1," Torvalds told ZDNet's Steven Vaughan-Nichols in mid-September. Even just having the "core infrastructure" for Rust in 6.1 signifies a big change in Linux, which has long been dominated by C languages (however extended and modified). It must be noted that in 2022, there are patches in Linux 6.0 to help Atari's Falcon computers from the early 1990s (or their emulated descendants) better handle VGA modes, color, and other issues.' -- source: https://arstechnica.com/gadgets/2022/10/linux-6-0-arrives-with-support-for-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Fall And Rise Of Xen
by Lawrence D'Oliveiro 03 Oct '22

03 Oct '22

Here’s a report <https://www.theregister.com/2022/09/30/citrix_xen/> on a talk by the software development manager at Citrix, detailing the ups and downs in the history of their Xen hypervisor. Initially they had a “freemium” model, with an open-source “community” version and a proprietary paid “enterprise” version with more capabilities. This worked well and brought in sufficient revenue to be sustainable. Then they decided to switch to make the “enterprise” version open-source as well, relying on customers’ willingness to continue to pay maintenance rather than support the code themselves. This bet failed to pay off, and revenue crashed. On the other hand, Citrix did not include the “accompanying tooling” (not sure what they mean here -- build tools? Add-on admin tools?) with the source code, making it hard for others to use that code. (Were the big “enterprise” users the ones able to figure that out?) Then they tried to go back to a “freemium” model, with restrictions being imposed on the open-source version. While this did restore the revenue stream, it also antagonized a significant part of the community that had been using the open-source version in various unusual and creative ways. These users forked the code to create XCP-ng, leaving Citrix behind. I suppose the lesson to take from this is that “freemium” works, but it is best if you do things that way from the beginning: trying to switch to it (or switch back to it) from an all-Free model can be painful.

1 0

OpenWRT on Linksys WRT1900ACS
by Peter Reutemann 03 Oct '22

03 Oct '22

Hi everyone I finally bit the bullet and installed OpenWRT on my Linksys WRT1900ACS (v2) router. The main reason was the stupid (and incredibly insecure) guest network implementation that the router came with. Despite supplying a password in the admin interface, the network was run as an open network that anyone could access. The password didn't seem to be used at all... Not exactly what I had in mind! Since Ian presented on OpenWRT before, I at least had a rough idea on what I could expect in user interface and functionality, which helped a lot. :-) In case someone should have the same router, I found the following links very useful: - general info on the router and links to images https://openwrt.org/toh/linksys/wrt1900acs - tutorial for migrating your router to OpenWRT https://www.albertogonzalez.net/how-to-install-openwrt-on-the-linksys-wrt19… NB: you need to plug in via ethernet after flashing, since the wlan is not enabled by default - getting fibre working here in NZ (VLAN 10) http://www.lindesay.co.nz/blog/2019/2019-openwrt-nz-fibre/ - setting up a guest wifi network https://openwrt.org/docs/guide-user/network/wifi/guestwifi/configuration_we… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Debian Chooses Reasonable, Common Sense Solution To Dealing With Non-Free Firmware
by Peter Reutemann 03 Oct '22

03 Oct '22

'Michael Larabel writes via Phoronix: Debian developers have been figuring out an updated stance to take on non-free firmware considering the increasing number of devices now having open-source Linux drivers but requiring closed-source firmware for any level of functionality. The voting on the non-free firmware matter has now concluded and the votes tallied... The debian votes option 5 as winning: "Change SC for non-free firmware in installer, one installer." Basically the Debian Installer media will now be allowed to include non-free firmware and to automatically load/use it where necessary while informing the user of it, etc. Considering the state of the hardware ecosystem these days, it's reasonable and common sense since at least users will be able to easily make use of their graphics cards, network adapters, and more. Plus a number of modern CPU security mitigations also requiring the updated closed-source microcode. So all in, I am personally happy with this decision as it will allow for a more pleasant experience for Debian on modern systems and one akin to what is found with other Linux distributions. The solution is described in full via the Debian Wiki.' -- source: https://linux.slashdot.org/story/22/10/02/1650200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quis Custodiet Ipsos Custodes?
by Lawrence D'Oliveiro 01 Oct '22

01 Oct '22

Came across yet another crop of articles recently which painfully highlight the problems with having social-media companies manage their own moderation. This one <https://arstechnica.com/gaming/2022/09/youtube-age-restriction-quagmire-exp…> shows the inconsistencies in the criteria that YouTube uses to apply age restrictions to uploaded videos. Not only are the criteria mysterious, but the appeal process is opaque, and too often the only way to get results is by appeal to the popular fanbase. Assuming you have one. Related to that, Facebook earlier banned any promotion on its platform of a re-release of a movie called “Beautiful Blue Eyes” <https://arstechnica.com/tech-policy/2022/09/holocaust-filmmaker-says-meta-d…>, seemingly not because of its content (partly set during the Nazi Holocaust), but because of the title. An appeal was rejected with “our decision is final”. Only for the ban to be lifted later, absolutely nothing to do with any public outcry, you can take our word on that. Then there is this coronial inquest <https://arstechnica.com/tech-policy/2022/09/coroner-lists-instagram-algorit…> into the self-inflicted death of a young teen who had been watching way too many posts on Pinterest and Instagram promoting self-harm. Pinterest at least had the humility to admit that their moderation system was not satisfactory and needed to be improved. But Meta (parent company of Instagram and Facebook) sent their “head of health and well-being” to testify that the content was classified as “safe” according to their standards. Free speech between mature adults is one thing, keeping impressionable youngsters safe is quite another.

2 2

Google Delays the Death of Manifest V2 Extensions To 2024
by Peter Reutemann 01 Oct '22

01 Oct '22

'Google announced an extension of the deadline to remove support for Manifest V2 extensions in the company's Chrome browser and the open source Chromium core. The change does not impact the core decision of removing support for Manifest V2 extensions in favor of Manifest V3. Dubbed, the adblocker killer initially, due to limitations imposed on content blocking and other types of browser extensions, Google made concessions that allows content blockers to run on Chrome after the final switch is made. Extensions are still limited in comparison to Manifest V2, especially if multiple that use filtering functionality are run simultaneously, or if lots of filters are activated in a single extension. Google's initial plan was to stop supporting Manifest V2 extensions in Chrome by June 2023. For most users, support would run out in January 2023, but an Enterprise policy would enable users to extend the deadline by six months.' -- source: https://tech.slashdot.org/story/22/09/30/1437209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

2022 Web Almanac
by Lawrence D'Oliveiro 30 Sep '22

30 Sep '22

Report <https://devclass.com/2022/09/29/massive-web-tech-survey-shows-how-bad-habit…> on the 2022 Web Almanac (sort of a “state of the Web” report), which is in the process of being published. * WebAssembly is still not being used a lot * WordPress is one of the worst-performing content-management systems, and also still the most popular (and its popularity is still growing) * Image formats: the time has come to move beyond sRGB and 1990s-era formats (e.g. replace JPEG with the more efficient WebP) * JavaScript: a lot of pages seem to load code which is not actually used I was looking up how page-loading performance is measured, and here is my understanding of what the terms mean: * Largest Contentful Paint (LCP): the time to render the largest image/text block on the page. * First Input Delay (FID): how long after the user clicks on a link or a control etc before the browser starts responding. * Cumulative Layout Shift (CLS): a measure of how much things move around on the page while the page is still loading. This is a product of the “impact fraction” (proportion of the viewport affected by movements between frames) and the “distance fraction” (largest distance moved by an element, as a fraction of viewport size).

1 0

Creator Of COVID-19 Tracker Dashboard Wins Science Prize
by Lawrence D'Oliveiro 30 Sep '22

30 Sep '22

Professor Lauren Gardner has been awarded the 2022 Lasker-Bloomberg Public Service Award <https://www.aljazeera.com/news/2022/9/29/creator-of-johns-hopkins-covid-tra…> for co-creating the Johns Hopkins COVID-19 dashboard. This has been collecting and making available information about the pandemic since almost before it came to world attention. For those who don’t want to go through that Twitter link, the dashboard is here <https://gisanddata.maps.arcgis.com/apps/dashboards/bda7594740fd40299423467b…>. Just tried the “Raw Data” link, and it goes to this GitHub area <https://github.com/CSSEGISandData>.

1 0

Numerous orgs hacked after installing weaponized open source apps
by Peter Reutemann 30 Sep '22

30 Sep '22

'Hackers backed by the North Korean government are weaponizing well-known pieces of open source software in an ongoing campaign that has already succeeded in compromising "numerous" organizations in the media, defense and aerospace, and IT services industries, Microsoft said on Thursday. ZINC—Microsoft's name for a threat actor group also called Lazarus, which is best known for conducting the devastating 2014 compromise of Sony Pictures Entertainment—has been lacing PuTTY and other legitimate open source applications with highly encrypted code that ultimately installs espionage malware. The hackers then pose as job recruiters and connect with individuals of targeted organizations over LinkedIn. After developing a level of trust over a series of conversations and eventually moving them to the WhatsApp messenger, the hackers instruct the individuals to install the apps, which infect the employees' work environments. "The actors have successfully compromised numerous organizations since June 2022," members of the Microsoft Security Threat Intelligence and LinkedIn Threat Prevention and Defense teams wrote in a post. "Due to the wide use of the platforms and software that ZINC utilizes in this campaign, ZINC could pose a significant threat to individuals and organizations across multiple sectors and regions." PuTTY is a popular terminal emulator, serial console, and network file transfer application that supports network protocols, including SSH, SCP, Telnet, rlogin, and raw socket connection. Two weeks ago, security firm Mandiant warned that hackers with ties to North Korea had Trojanized it in a campaign that successfully compromised a customer's network. Thursday's post said the same hackers have also weaponized KiTTY, TightVNC, Sumatra PDF Reader, and muPDF/Subliminal Recording software with code that installs the same espionage malware, which Microsoft has named ZetaNile.' -- source: https://arstechnica.com/information-technology/2022/09/north-korean-threat-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Security Recommendation: Try Turning It Off And On Again
by Lawrence D'Oliveiro 29 Sep '22

29 Sep '22

This report on the “Chaos” malware suite <https://arstechnica.com/information-technology/2022/09/never-before-seen-ma…> contains an interesting snippet: A reminder to small office router owners everywhere: Most router malware can't survive a reboot. Consider restarting your device every week or so. Seems like server-based malware is predominantly running entirely from RAM these days, to avoid leaving any forensic traces in the filesystem. But you can use this characteristic against them, since a simple reboot becomes enough to clear the infection.

1 0

We interviewed Linux OS through an AI bot to discover its secrets
by Peter Reutemann 29 Sep '22

29 Sep '22

'Millions of people use Linux every day, but we rarely stop to think about how the operating system feels about it. Wouldn't it be nice to know what Linux really thinks about open source, Windows, Macs, and the command line? Until now, this has been impossible. But thanks to a new AI chat tool, we're able to find out. Two weeks ago, a website called Character.AI opened a public beta that allows visitors to create a chat bot based on any character they can imagine. You input a few parameters, and the AI does the rest using a large language model similar to GPT-3. So we called forth "The Linux OS" as a bot to ask it a few questions about itself. The results were fun and surprising. Using Character.AI is a lot like a texting conversation. You type in what you want to ask, and you read the AI character's responses in written form as the chat history scrolls upward. As with GPT-3, the code behind Character.AI has likely learned from absorbing millions of text sources found on the Internet. As such, its AI characters can easily respond with erroneous or fictional information. In fact, the site carries a bold disclaimer reading, "Remember: Everything Characters say is made up!" [...] Linux: Hello, I am Linux, an open-source operating system. Ars Technica: Hello, this is Benj Edwards, and I am a journalist at Ars Technica. I would like to ask you some questions in an interview. Is that OK? Linux: I, Linux, would be pleased to provide such an interview. Ars: How old are you? Linux: I was "born" in 1991, although the first public release was version 1.0 in 1994.' -- source: https://arstechnica.com/information-technology/2022/09/we-interviewed-linux… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Serious vulnerabilities in Matrix’s end-to-end encryption have been patched
by Peter Reutemann 29 Sep '22

29 Sep '22

'Developers of the open source Matrix messenger protocol are releasing an update on Thursday to fix critical end-to-end encryption vulnerabilities that subvert the confidentiality and authentication guarantees that have been key to the platform's meteoric rise. Matrix is a sprawling ecosystem of open source and proprietary chat and collaboration clients and servers that are fully interoperable. The best-known app in this family is Element, a chat client for Windows, macOS, iOS, and Android, but there's a dizzying array of other members as well. Matrix roughly aims to do for real-time communication what the SMTP standard does for email, which is to provide a federated protocol allowing user clients connected to different servers to exchange messages with each other. Unlike SMTP, however, Matrix offers robust end-to-end encryption, or E2EE, designed to ensure that messages can't be spoofed and that only the senders and receivers of messages can read the contents. Matthew Hodgson—the co-founder and project lead for Matrix and the CEO and CTO at Element, the maker of the flagship Element app—said in an email that conservative estimates are that there are about 69 million Matrix accounts spread throughout some 100,000 servers. The company currently sees about 2.5 million monthly active users using its Matrix.org server, though he said this is also likely an underestimate. Among the hundreds of organizations announcing plans to build internal messaging systems based on Matrix are Mozilla, KDE, and the governments of France and Germany. On Wednesday, a team of researchers published research that reports a host of vulnerabilities that undermine Matrix's authentication and confidentiality guarantees. All of the attacks described by the researchers require the aid of a malicious or compromised homeserver that targets the users who connect to it. In some cases, there are ways for experienced users to detect an attack is underway.' -- source: https://arstechnica.com/information-technology/2022/09/matrix-patches-vulne… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Stock Hacking TV Footage
by Lawrence D'Oliveiro 27 Sep '22

27 Sep '22

On the TVNZ news a few minutes ago, in the stock footage they were showing while John Campbell was talking about some tech-related story or other, I saw the words “struct group_info init_groups” pop up. So I did an online search, and found this Reddit thread <https://www.reddit.com/r/InternetIsBeautiful/comments/g8hcgo/this_site_make…>. Turns out there’s a website where you can pretend to be typing furiously, and this text comes up, as though it was what you were typing, to let you play at being a hacker on TV. Incidentally, the code in question is based on real code, from the Linux kernel.

1 0

20-year-old Linux workaround is still slowing down AMD systems
by Peter Reutemann 27 Sep '22

27 Sep '22

'AMD has come a long way since 2002, but the Linux kernel still treats modern Threadrippers like Athlon-era systems—at least in one potentially lag-inducing respect. AMD engineer Prateek Nayak recently submitted a patch to Linux's processor idle drivers that would "skip dummy wait for processors based on the Zen microarchitecture." When ACPI support was added to the Linux kernel in 2002—written by Andy Grover, committed by Linus Torvalds—it included a "dummy wait op." The system essentially read data with no purpose other than delaying the next instruction until the CPU could fully stop with the STPCLK# command. This allowed for some power saving and compatibility during the early days of ACPI implementation when some chipsets wouldn't move to an idle state when one would expect it. But today's Zen-based AMD chips don't need this workaround, and, as Nayak writes, it's hurting them, at least in specific workloads on Linux. Testing with instruction-based sampling (IBS) workloads shows that "a significant amount of time is spent in the dummy op, which incorrectly gets accounted as C-State residency." The CPU, seeing all this low-effort dummy work, can push into deeper, slower C-State, which then makes the CPU take longer to "wake up," especially on jobs that require lots of switching between busy and idle states. Nayak ran tests in tbench on a dual-socket Zen3 system against the baseline Linux kernel, a kernel with the C2 state entirely disabled, and a kernel with the dummy wait operation patched out. His patched version saw a 1,390 percent increase in minimum MB/s throughput and a 51 percent increase in mean MB/s over the baseline kernel, often just a little behind having C2 disabled entirely.' -- source: https://arstechnica.com/gadgets/2022/09/20-year-old-linux-workaround-is-sti… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Senators Introduce a Bill To Protect Open-Source Software
by Peter Reutemann 25 Sep '22

25 Sep '22

'Washington Post: When researchers discovered a vulnerability in the ubiquitous open-source log4j system last year that could've affected hundreds of millions of devices, the executive branch snapped into action and major tech companies huddled with the White House. Now, leaders of the Senate Homeland Security and Governmental Affairs Committee are introducing legislation to help secure open-source software, first reported by The Cybersecurity 202. Chairman Gary Peters (D-Mich.) and top ranking Republican Rob Portman (Ohio) plan to hold a vote next week on the bill they're co-sponsoring. The Peters/Portman legislation would direct the Cybersecurity and Infrastructure Security Agency to develop a way to evaluate and reduce risk in systems that rely on open-source software. Later, CISA would study how that framework could apply to critical infrastructure. The log4j "incident presented a serious threat to federal systems and critical infrastructure companies -- including banks, hospitals, and utilities -- that Americans rely on each and every day for essential services," Peters said in a written statement. "This common-sense, bipartisan legislation will help secure open source software and further fortify our cybersecurity defenses against cybercriminals and foreign adversaries who launch incessant attacks on networks across the nation." Here's how the Peters-Portman legislation works, as outlined in the report: - It directs CISA to hire open-source experts "to the greatest extent practicable." - It gives the agency a year to publish a framework on open-source code risk. A year later and periodically thereafter, CISA would perform an assessment of open-source code components that federal agencies commonly use. - Also, two years after publishing the initial framework, CISA would have to study whether it could be used in critical infrastructure outside the government and potentially work with one or more critical infrastructure sectors to voluntarily test the idea. - Other agencies would have roles as well, such as the Office of Management and Budget publishing guidance to federal chief information officers on secure use of open-source software. ' -- source: https://news.slashdot.org/story/22/09/23/2357254 What about donating time/money to "critical" open source projects? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AV1 Update Reduces CPU Encoding Times By Up To 34 Percent
by Peter Reutemann 25 Sep '22

25 Sep '22

'According to Phoronix, Google has released a new AOM-AV1 update -- version 3.5, that drastically improves encode times when streaming, rendering, or recording from the CPU. At its best, the update can improve encoding times by up to 34%. Tom's Hardware reports: It is a fantastic addition to AV1's capabilities, with the encoder becoming very popular among powerful video platforms such as YouTube. In addition, we are also seeing significant support for AV1 hardware acceleration on modern discrete GPUs now, such as Intel's Arc Alchemist GPUs and, most importantly - Nvidia's RTX 40-series GPUs. Depending on the resolution, encoding times with the new update have improved by 20% to 30%. For example, at 1080P, encode times featuring 16 threads of processing are reduced by 18% to 34%. At 4K, render times improved by 18% to 20% with 32 threads. Google could do this by adding Frame Parallel Encoding to heavily multi-threaded configurations. Google has also added several other improvements contributing to AV1's performance uplifts in other areas - specifically in real-time encoding. In other words, CPU utilization in programs such as OBS has been reduced, primarily for systems packing 16 CPU threads. As a result, they are allowing users to use those CPU resources for other tasks or increase video quality even higher without any additional performance cost. If you are video editing and are rendering out a video in AV1, processing times will be vastly reduced if you have a CPU with 16 threads or more. ' -- source: https://news.slashdot.org/story/22/09/24/1749206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Urges Action To Unpick Platform Browser Lock-ins
by Peter Reutemann 23 Sep '22

23 Sep '22

'As antitrust regulators around the world dial up scrutiny of platform power, Mozilla has published a piece of research digging into the at times subtle yet always insidious ways operating systems exert influence to keep consumers locked to using their own-brand browsers rather than seeking out and switching to independent options -- while simultaneously warning that competition in the browser market is vital to ensure innovation and choice for consumers and, more broadly, protect the vitality of the open web against the commercial giants trying to wall it up. TechCrunch: "Billions of people across the globe are dependent on operating systems from the largest technology companies. Amazon, Apple, Google, Microsoft and Meta each provide their own browser on their operating systems and each of them uses their gatekeeper position provider to preference their own browsers over independent rivals. Whether it is Microsoft pushing Firefox users to switch their default on Windows computers, Apple restricting the functionality of rival browsers on iOS smartphones or Google failing to apply default browser settings across Android, there are countless examples of independent browsers being inhibited by the operating systems on which they are dependent," Mozilla writes in a summary of its findings. "This matters because American consumers and society as a whole suffer. Not only do people lose the ability to determine their own online experiences but they also receive less innovative and lower quality products. In addition, they can be forced to accept poorer privacy outcomes and even unfair contracts. By contrast, competition from independent browsers can help to drive new features, as well as innovation in areas like privacy and security."' -- source: https://tech.slashdot.org/story/22/09/22/1841231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNU Grep 3.8 Starts Issuing Warnings About Using Egrep and Fgrep
by Peter Reutemann 22 Sep '22

22 Sep '22

'After 104 commits from six different people, GNU grep was released Saturday, reports Phoronix. The biggest change? "It's now made more clear that if you are still relying on the egrep and fgrep commands, it's past due for switching to just grep with the appropriate command-line arguments." The egrep and fgrep commands have been deprecated since 2007. Beginning with GNU Grep 3.8 today, calling these commands will now issue a warning to the user that instead they should use grep -E and grep -F, respectively. Eventually, GNU Grep will drop the egrep / fgrep commands completely but there doesn't seem to be a firm deadline yet for when that removal will happen. >From grep's updated manual: 7th Edition Unix had commands egrep and fgrep that were the counterparts of the modern 'grep -E' and 'grep -F'. Although breaking up grep into three programs was perhaps useful on the small computers of the 1970s, egrep and fgrep were not standardized by POSIX and are no longer needed. In the current GNU implementation, egrep and fgrep issue a warning and then act like their modern counterparts; eventually, they are planned to be removed entirely. If you prefer the old names, you can use use your own substitutes, such as a shell script... Other notable changes from the release announcement: - The confusing GREP_COLOR environment variable is now obsolescent. Instead of GREP_COLOR='xxx' use GREP_COLORS='mt=xxx' - Regular expressions with stray backslashes now cause warnings' -- source: https://news.slashdot.org/story/22/09/05/0135254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Repairable, upgradeable Framework Laptop will also be available as a Chromebook
by Peter Reutemann 22 Sep '22

22 Sep '22

'Fans of the modular Framework Laptop who also prefer ChromeOS to Windows or Linux are in for a treat: Framework and Google are announcing a Chromebook Edition of the laptop today. It has the same basic hardware design and works with most of the same parts as the regular Framework Laptop but with tweaks to make it a full-fledged Chromebook. While you could always take a standard Framework Laptop and install ChromeOS Flex on it, the standard version of ChromeOS still has a few features that Flex doesn't, including Android app support via Google Play, automated firmware updates, and a few other security and device management features. Framework says that the Chromebook Edition laptop will be available for preorder starting today—a version with a Core i5-1240P CPU will cost $999, although you'll only need to put down $100 to reserve your preorder. Orders begin shipping in December. Framework is also putting parts specific to the Chromebook Edition laptop into its Framework Marketplace parts store.' -- source: https://arstechnica.com/gadgets/2022/09/repairable-upgradeable-framework-la… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Document Foundation Starts Charging For 'Free' LibreOffice
by Peter Reutemann 22 Sep '22

22 Sep '22

'The Document Foundation, the organization that tends the open source productivity suite LibreOffice, has decided to start charging for one version of the software. The Register reports: LibreOffice is a fork of OpenOffice and is offered under the free/open source Mozilla Public License Version 2.0. A Monday missive from the Document Foundation reveals the org will begin charging 8.99 euros for the software -- but only when sold via Apple's Mac App Store. That sum has been styled a "convenience fee ... which will be invested to support development of the LibreOffice project." The foundation suggests paying up in the Mac App Store is ideal for "end users who want to get all of their desktop software from Apple's proprietary sales channel." Free downloads of LibreOffice for macOS from the foundation's site will remain available and arguably be superior to the App Store offering, because that version will include Java. The foundation argued that Apple does not permit dependencies in its store, so it cannot include Java in the 8.99 euro offering. The version now sold in the App Store supersedes a previous offering provided by open source support outfit Collabora, which charged $10 for a "Vanilla" version of the suite and threw in three years of support. The foundation's marketing officer Italo Vignoli said the change was part of a "new marketing strategy." "The Document Foundation is focused on the release of the Community version, while ecosystem companies are focused on a value-added long-term supported versions targeted at enterprises," Vignoli explained. "The distinction has the objective of educating organizations to support the FOSS project by choosing the LibreOffice version which has been optimized for deployments in production and is backed by professional services, and not the Community version generously supported by volunteers." "The objective is to fulfil the needs of individual and enterprise users in a better way," Vignoli added, before admitting "we know that the positive effects of the change will not be visible for some time. Educating enterprises about FOSS is not a trivial task and we have just started our journey in this direction."' -- source: https://apple.slashdot.org/story/22/09/20/2039208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Linus Torvalds: Rust Will Go Into Linux 6.1
by Peter Reutemann 20 Sep '22

20 Sep '22

'As previously indicated on Slashdot, Rust was slated to be coming to the Linux Kernel sometime in the 6.x version. Well wonder no longer on which version of kernel 6.x will have the first bits of Rust officially in the kernel, as Linus has confirmed that 6.1 will be the first with the new NVMe kernel drivers being in Rust. The first version non-production ready code for the NVMe Rust based kernel drivers were already producing performance comparable to C code. So the final drivers to hit 6.1 are already looking promising. It also helped Rust's case that, thanks to the ground-breaking work of Linux kernel and Rust developer Miguel Ojeda, Rust on Linux has gotten much more mature. Kernel maintainers were convinced it is time to move forward with Rust in Linux. In short, they agreed that Rust on Linux was ready for work.' -- source: https://linux.slashdot.org/story/22/09/19/205239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next *Tuesday*
by Peter Reutemann 20 Sep '22

20 Sep '22

Hi everyone We have a meeting next *Tuesday* (since Monday is remembrance day) with the following topic: 'People that never learned to touch type find that typing can severely impede creativity. Rod Aldridge will talk about his experience of getting Google's speech-to-text working on his computer to speed up his writing, what to look out for, how it works and how well it works.' Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776705/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meeting next Monday
by Peter Reutemann 20 Sep '22

20 Sep '22

Hi everyone We have a meeting next week on Monday but no speaker so far. Anyone keen on demoing or presenting (distro/software/etc)? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Chrome for Android gets fingerprint-protected Incognito tabs
by Peter Reutemann 19 Sep '22

19 Sep '22

'Here's a fun new feature for Chrome for Android: fingerprint-protected Incognito tabs. 9to5Google discovered the feature in the Chrome 105 stable channel, though you'll have to dig deep into the settings to enable it at the moment. If you want to add a little more protection to your private browsing sessions, type "chrome://flags/#incognito-reauthentication-for-android" into the address bar and hit enter. After enabling the flag and restarting Chrome, you should see an option to "Lock Incognito tabs when you leave Chrome." If you leave your Incognito session and come back, an "unlock Incognito" screen will appear instead of your tabs, and you'll be asked for a fingerprint scan. Chrome on iOS has had a biometrics-backed Incognito feature, called "Privacy Screen," for a few years. This is a first for Android, though. Chrome's "flags" menu is technically for experiments and in-development features, so this isn't guaranteed to become a readily accessible user feature, but making it to the stable channel—plus the feature already existing on iOS—is a good sign.' -- source: https://arstechnica.com/gadgets/2022/09/chrome-for-android-gets-fingerprint… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Beloved browser extension acquired by non-beloved antivirus firm
by Peter Reutemann 19 Sep '22

19 Sep '22

'Browser extension I don't care about cookies does one job and does it well. It automatically removes the annoying-but-mandated "This website uses cookies" notices from websites. People like it, donate to it, and don't ask more of it, a rare find for free software. "Damn, this is the **** bro, it saved like 50 minutes of my gaming time lol," reads one review on the tool's Microsoft Edge Add-Ons page. The tone changed when the solo developer posted "GREAT NEWS" on the extension's website. Avast, a giant in cybersecurity that just completed an $8.1 billion merger with NortonLifeLock, will acquire the 10-year-old software for an undisclosed price.' -- source: https://arstechnica.com/gadgets/2022/09/beloved-browser-extension-acquired-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Aims To Support the $16+ Sipeed LicheeRV and Other RISC-V Boards
by Peter Reutemann 19 Sep '22

19 Sep '22

'"In addition to Ubuntu supporting the StarFive VisionFive and Nezha RISC-V boards, Canonical engineers are also working on supporting the Sipeed LicheeRV board too for next month's 22.10 release," reports Phoronix. "The Sipeed LicheeRV is notable in being one of the cheapest RISC-V boards out there: pricing starts at $16.90 USD...." The Sipeed LicheeRV uses the Allwinner D1 SoC and is powered by a single-core XuanTie C906 64-bit RISC-V processor. This single-core RISC-V processor runs at just 1.0GHz. Yes, this is a very cheap but slow board. The LicheeRV is primarily for networking purposes and other IoT use-cases.... The Sipeed LicheeRV was announced last year and initially targeting support for OpenWrt-based Linux distributions, but Canonical recently has been working on getting support for this RISC-V board squared away in time for Ubuntu 22.10. This appears to be part of an increasing focus by the Ubuntu maker for being a leading distribution contender for RISC-V hardware.' -- source: https://hardware.slashdot.org/story/22/09/17/1728244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fun Mistake Of The Week
by Lawrence D'Oliveiro 17 Sep '22

17 Sep '22

Yesterday I was writing a simple, harmless little Python script. I tried running it for the first time, and my terminal session seemed to lock up. A crosshair cursor appeared. I tried clicking in various places and hitting CTRL/C (and other keystrokes) several times. After several tries, I managed to stop the script and get my terminal session back. This happened a couple of times, until I realized my Python script was missing the “#!/usr/bin/python3” “shebang” line at the top. So when I executed it, the system assumed it was a shell script. And the very first command it saw was an “import” statement, which it interpreted as an attempt to call the ImageMagick “import” command <https://imagemagick.org/script/import.php>. This command lets you capture screenshots of selected windows or the entire screen, or parts thereof. Which is where the crosshair cursor came from. And because I had several of these import statements, after I managed to terminate one, it went on to the next one. Once I added the missing script-interpreter line, my script started behaving a bit more sensibly. ;)

1 0

Trojanized versions of PuTTY utility being used to spread backdoor
by Peter Reutemann 17 Sep '22

17 Sep '22

'Researchers believe hackers with connections to the North Korean government have been pushing a Trojanized version of the PuTTY networking utility in an attempt to backdoor the network of organizations they want to spy on. Researchers from security firm Mandiant said on Thursday that at least one customer it serves had an employee who installed the fake network utility by accident. The incident caused the employer to become infected with a backdoor tracked by researchers as Airdry.v2. The file was transmitted by a group Mandiant tracks as UNC4034.' -- source: https://arstechnica.com/information-technology/2022/09/trojanized-versions-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Nearly One In Two Industry Pros Scaled Back Open Source Use Over Security Fears
by Peter Reutemann 16 Sep '22

16 Sep '22

'The Register: About 40 percent of industry professionals say their organizations have reduced their usage of open source software due to concerns about security, according to a survey conducted by data science firm Anaconda. The company's 2022 State of Data Science report solicited opinions in April and May from 3,493 individuals from 133 countries and regions, targeting academics, industry professionals, and students. About 16 percent of respondents identified as data scientists. About 33 percent of surveyed industry professionals said they had not scaled back on open source, 7 percent said they had increased usage, and 20 percent said they weren't sure. The remaining 40 percent said they had. By industry professionals, or commercial respondents as Anaconda puts it, the biz means a data-science-leaning mix of business analysts, product managers, data and machine-learning scientists and engineers, standard IT folks such as systems administrators, and others in technology, finance, consulting, healthcare, and so on. And by scale back, that doesn't mean stop: 87 percent of commercial respondents said their organization still allowed the use of open source. It appears a good number of them, though, are seeking to reducing the risk from relying on too many open source dependencies. Anaconda's report found that incidents like Log4j and reports of "protestware" prompted users of open source software to take security concerns more seriously. Of the 40 percent who scaled back usage of open source, more than half did so after the Log4j fiasco. Some 31 percent of respondents said security vulnerabilities represent the biggest challenge in the open source community today. Most organizations use open source software, according to Anaconda. But among the 8 percent of respondents indicating that they don't, more than half (54 percent, up 13 percent since last year) cited security risks as the reason. Other reasons for not using open source software include: lack of understanding (38 percent); lack of confidence in organizational IT governance (29 percent); "open-source software is deemed insecure, so it's not allowed" (28 percent); and not wanting to disrupt current projects (26 percent).' -- source: https://news.slashdot.org/story/22/09/15/003243 Any library/tool, whether proprietary or not, on which many other systems rely has that same potential "security" problem (plenty of exploits in Windows/Mac, supply-chain corruptions, etc). Just because your code is proprietary doesn't make it any safer. You could simply spend some of your internal budget (that you didn't spend on developing these libraries), to do some code review on them and contribute back. Otherwise you're just a whinging freeloader... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Microsoft Teams Stores Auth Tokens As Cleartext In Windows, Linux, Macs
by Peter Reutemann 15 Sep '22

15 Sep '22

'Security analysts have found a severe security vulnerability in the desktop app for Microsoft Teams that gives threat actors access to authentication tokens and accounts with multi-factor authentication (MFA) turned on. BleepingComputer reports: "This attack does not require special permissions or advanced malware to get away with major internal damage," Connor Peoples at cybersecurity company Vectra explains in a report this week. The researcher adds that by taking "control of critical seats -- like a company's Head of Engineering, CEO, or CFO -- attackers can convince users to perform tasks damaging to the organization." Vectra researchers discovered the problem in August 2022 and reported it to Microsoft. However, Microsoft did not agree on the severity of the issue and said that it doesn't meet the criteria for patching. With a patch unlikely to be released, Vectra's recommendation is for users to switch to the browser version of the Microsoft Teams client. By using Microsoft Edge to load the app, users benefit from additional protections against token leaks. The researchers advise Linux users to move to a different collaboration suite, especially since Microsoft announced plans to stop supporting the app for the platform by December. ' -- source: https://it.slashdot.org/story/22/09/14/1939242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Exploring GNOME-Based UIs For Mobile Linux Devices
by Peter Reutemann 15 Sep '22

15 Sep '22

'"The GNOME desktop environment is one of the most popular user interfaces and suites of apps available for desktop Linux distributions," writes Liliputing. "Now a team of developers have been working to bring GNOME to mobile devices running Linux-based operating systems." GNOME Shell for mobile provides a touch-friendly user interface optimized for smartphones and tablets. And while it looks a bit like Android or iOS at first glance, there are a few key differences. The GNOME team have outlined some of them in an article about recent updates to GNOME Shell on mobile. Like other modern mobile user interfaces, you interact with GNOME shell using taps, swipes, and other gesture-based navigation. What's different is that Android has three different views for navigation: a home screen, app drawer, and multitasking view. iOS has two: home screen and multitasking. But GNOME Shell has a single screen that allows you to view and launch apps and switch between running apps using gestures. There's no need to wait for a new screen to load. In a nutshell, you can swipe up from the bottom of the any screen to view a list of installed apps, thumbnail images showing all currently running apps, and a search box. You can tap an app icon to launch a new app, enter a term in the search box to find an app, or swipe between running apps to switch which app runs in the foreground. You can also keep swiping upward to shrink the multitasking thumbnails and provide more room for app icons. And you can flick thumbnail previews upward to remove an app from the multitasking section. Typing in the search box will bring up relevant results including apps and settings. "One interesting new feature here is that notifications can be swiped away horizontally to close, and notification bubbles can be swiped up to hide them..." the developers point out. "While the current version is definitely still work in progress, it's quite usable overall, so we feel it would make sense to start having experimental GNOME OS Nightly images with it." But Liliputing also notes that it's not the only GNOME-based UI for mobile devices. There's also Purism's Phosh UI — the default UI for the PureOS on its Librem 5 smartphone (and available for other mobile Linux distros including Debian). And Purism recently bragged that its smartphone is now also "the first mobile computer with a truly convergent OS" — meaning it can run on multiple hardware platforms, with apps adapting to their hardware. The Librem 5 [smartphone] uses the same convergent PureOS as our Librem 14 laptop and Mini PCs, with the same adaptive applications that make the Librem 5 more than merely a phone, it's a mobile computer in your pocket that can shape shift into a laptop, tablet, desktop, or even a server.... Scale your Librem 5 up to be a full laptop by attaching the Nexdock. Because our core apps are adaptive, they are ready to run on whatever screen you have.... With phosh-mobile-settings installed, you can flip the nexdock around and use the big screen just like a tablet.... Don't have a laptop dock? The Librem 5 can also act like a desktop computer when connected to a screen, keyboard, and mouse using our USB-C dock. Using the beta phom virtual mouse app, you can turn your Librem 5 into a touchpad mouse while it's connected to the big screen. With the Librem 5, you can keep your desktop computer in your pocket and connect to a bigger screen at home or at the office and use the same apps on the bigger screen without restarting.... With the Librem 5 phone, you're getting much more than smartphone to run mobile-only apps; you're getting a laptop, tablet, desktop, all running software that respects your privacy and freedom.' -- source: https://linux.slashdot.org/story/22/09/11/047224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

DuckDuckGo, Proton, Mozilla Throw Weight Behind Bill Targeting Big Tech 'Surveillance'
by Peter Reutemann 15 Sep '22

15 Sep '22

'A group of privacy-focused organizations have signed a letter imploring US Congress leaders to schedule a vote on a bill that would hamper data collection by tech giants and promote user access to online privacy tools. From a report: In its letter to Congress, addressed to the likes of Mitch McConnell and Nancy Pelosi, the alliance argued that the continued suppression of the American Innovation and Choice Online Act (AICOA) allows "dominant firms" to "limit competition and restrict user choice" when accessing privacy-focused technologies and products. It also accused tech giants of forcing users into accepting their policies of "perpetual surveillance" because of their positions as "gatekeepers," and of using their "influence in society" to steer users away from rival services more committed to privacy. Signatories included the likes of DuckDuckGo, Proton, Brave and Mozilla, among others, representing sectors ranging from VPN and search to web browsers, office software, and more. The letter to Congress fighting for the revival of the AICOA hit back at the idea that the US technology industry is a free market. The 13 signatories, all of which are relatively small in stature, claim the tech giants deliberately wield the depth and breadth of their product portfolios to establish unassailable monopolies.' -- source: https://yro.slashdot.org/story/22/09/14/1644244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Announces the OpenWallet Foundation To Develop Interoperable Digital Wallets
by Peter Reutemann 14 Sep '22

14 Sep '22

'The Linux Foundation has announced plans for a new collaborative initiative designed to support interoperability across digital wallets, built on an open source bedrock. From a report: The OpenWallet Foundation (OWF), as the new effort is called, is the brainchild of Daniel Goldscheider, CEO of open banking startup Yes.com, though today's announcement reveals a broad gamut of buy-ins from multiple industry players including Okta, Ping Identity, Accenture, CVS Health, OpenID Foundation, among several other public and private bodies. With the Linux Foundation serving as the project's host, this gives OWF sizeable clout as it strives to enable what Goldscheider calls a "plurarity of wallets based on a common core," according to a press release. The news also comes as regulatory bodies across the globe are moving to support competition through enforcing interoperability across systems, including Europe which is currently trying to make messaging interoperability a thing.' -- source: https://news.slashdot.org/story/22/09/13/1350232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi OS improves menus, networking, camera possibilities
by Peter Reutemann 14 Sep '22

14 Sep '22

'The latest Raspberry Pi OS version adds menu search, a more mainstream network and VPN manager, and plenty of camera and machine learning possibilities through a new open source camera package.' -- source: https://arstechnica.com/gadgets/2022/09/raspberry-pi-os-adds-easier-network… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Article: 10 Best Self-Hosted Apps for Your Raspberry Pi
by Peter Reutemann 12 Sep '22

12 Sep '22

It's actually 10 categories with several applications listed for each: 1. Media Server 2. File Sync Server 3. Virtualization Platform 4. Ads Blocker 5. Image Hub 6. Home Automation 7. Security Center 8. News Aggregator 9. Password Manager 10. Gaming Console Full details in the following article: https://linuxiac.com/best-self-hosted-raspberry-pi-apps/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Linux malware combines unusual stealth with a full suite of capabilities
by Peter Reutemann 11 Sep '22

11 Sep '22

'Researchers this week unveiled a new strain of Linux malware that's notable for its stealth and sophistication in infecting both traditional servers and smaller Internet-of-things devices. Dubbed Shikitega by the AT&T Alien Labs researchers who discovered it, the malware is delivered through a multistage infection chain using polymorphic encoding. It also abuses legitimate cloud services to host command-and-control servers. These things make detection extremely difficult. "Threat actors continue to search for ways to deliver malware in new ways to stay under the radar and avoid detection," AT&T Alien Labs researcher Ofer Caspi wrote. "Shikitega malware is delivered in a sophisticated way, it uses a polymorphic encoder, and it gradually delivers its payload where each step reveals only part of the total payload. In addition, the malware abuses known hosting services to host its command and control servers."' -- source: https://arstechnica.com/information-technology/2022/09/new-linux-malware-co… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Android 13 Raises Minimum System Requirement To 2GB of RAM, 16GB of storage
by Peter Reutemann 10 Sep '22

10 Sep '22

'Android 13 has recently hit the streets, and with it, Google is raising the minimum requirements for Android phones. From a report: Google's latest blog post announced that the minimum amount of RAM for Android Go, the low-end version of Android, is now 2GB for Android 13, whereas previously, it was 1GB. Esper's Mishaal Rahman and Google Product Expert Jason Bayton also claim the minimum storage requirements have been bumped up to 16GB, though Google doesn't seem to have publicly documented this anywhere. The increase in system requirements means any phone that doesn't meet the minimum specs won't be able to update to Android 13. New phones launching with Android 13 will need to meet the minimum requirements to be eligible for Play Store licensing, though launching with an older version of Android (with lower requirements) will still be an option for a while. Technically, anyone can grab the Android source code and build anything with it, but if you want to license the Google apps and have access to the Google-trademarked brand "Android," you'll need to comply with Google's rules.' -- source: https://tech.slashdot.org/story/22/09/09/1742200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Zealand programming contest
by Peter Reutemann 09 Sep '22

09 Sep '22

Hi everyone I just got notified that the New Zealand programming contest is on tomorrow. More information on the Hamilton event is available from here: https://www.cs.waikato.ac.nz/~tl108/nzpc-hamilton/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New wave of data-destroying ransomware attacks hits QNAP NAS devices
by Peter Reutemann 08 Sep '22

08 Sep '22

'Network hardware-maker QNAP is urging customers to update their network-attached storage devices immediately to protect them from a new wave of ongoing ransomware attacks that can destroy terabytes of data in a single stroke. Singapore-based QNAP said recently that it has identified a new campaign from a ransomware group known as DeadBolt. The attacks take aim at QNAP NAS devices that use a proprietary feature known as Photo Station. The advisory instructs customers to update their firmware, suggesting there is a vulnerability that’s under exploit, but the company makes no explicit mention of a CVE designation that security professionals use to track such security flaws.' -- source: https://arstechnica.com/information-technology/2022/09/new-wave-of-data-des… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NASA Going RISC-V
by Lawrence D'Oliveiro 07 Sep '22

07 Sep '22

NASA’s space probes have been using a PowerPC-based computing architecture going back over two decades, so it’s about time for a refresh. So now SiFive <https://www.theregister.co.uk/2022/09/06/nasas_spaceflight_computer_risc_v/> is going to supply NASA with a new computing platform based on its X280 RISC-V CPU. “RISC” is supposed to stand for “Reduced Instruction Set Computing”. However, many current RISC architectures (including ARM and POWER/PowerPC) have seen a large blowout of their instruction-set size when they started adding SIMD vector operations. These instructions operate on fixed-length sets of around 4, 8 or 16 operands, performing the same operation on all operands simultaneously (hence “SIMD”, standing for “Single Instruction, Multiple Data”). Trouble is, you need a lot of different variants of each instruction for coping with different data types. While vector operations are important for many uses, RISC-V takes a different approach, harking back to the old supercomputers designed by the legendary Seymour Cray: instead of having to operate on all operands simultaneously, the instructions operate elementwise on variable-length arrays (the original Cray-1 design allowed for arrays of up to 64 elements at a time), with operands being processed sequentially through a multi-stage pipeline. This should help keep things simpler, while still making it fast.

1 0

Google Chrome Emergency Update Fixes New Zero-Day Used in Attacks
by Peter Reutemann 07 Sep '22

07 Sep '22

'Google has released Chrome 105.0.5195.102 for Windows, Mac, and Linux users to address a single high-severity security flaw, the sixth Chrome zero-day exploited in attacks patched this year. From a report: "Google is aware of reports that an exploit for CVE-2022-3075 exists in the wild," the company said in a security advisory published on Friday. This new version is rolling out in the Stable Desktop channel, with Google saying that it will reach the entire user base within a matter of days or weeks. It was available immediately when BleepingComputer checked for new updates by going into the Chrome menu > Help > About Google Chrome. The web browser will also auto-check for new updates and automatically install them after the next launch.' -- source: https://it.slashdot.org/story/22/09/06/1424200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slick new phishing-as-a-service kit emerges
by Peter Reutemann 06 Sep '22

06 Sep '22

'itnews reports: Security researchers at Resecurity have detailed a new phishing-as-a-service kit, EvilProxy, that provides an easy to use interface to attack users with accounts for major online brands, and the ability to bypass multifactor authentication (MFA). Reverse proxies to attack multifactor authentication, such as Modlishka, have been available for several years, but EvilProxy makes it it possible to easily create and deliver advanced phishing links through a graphical user interface, Resecurity said. EvilProxy sits between a victim and the real site the user is trying to connect to, capturing their valid session cookies, to bypass the need to authenticate with user names, passwords, and / or two-factor authentication tokens, the security vendor explained. This includes accounts that have MFA enabled with short messaging text service, or application tokens.' -- source: https://www.itnews.com.au/news/slick-new-phishing-as-a-service-kit-emerges-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0