- wlug - list.wlug.org.nz

Microsoft's xCloud Game Streaming Looks Worse On Linux Than Windows
by Peter Reutemann 07 Jul '22

07 Jul '22

'As noted by a Reddit user and confirmed by Ars Technica, Microsoft's xCloud game streaming looks noticeable worse when running on Linux than Windows. From the report: With the Linux User-Agent, edges are generally less sharp and colors are a little more washed out. The difference is even more apparent if you zoom in on the Forza logo and menu text, which shows a significant reduction in clarity. Interestingly, the dip in quality seems to go away if you enable "Clarity Boost, an Edge-exclusive feature that "provid[es] the optimal look and feel while playing Xbox games from the cloud," according to Microsoft. That's great for Linux users who switched over to Microsoft Edge when it launched on Linux last November. But Linux users who stick with Firefox, Chrome, or other browsers are currently stuck with apparently reduced streaming quality. That Linux quality dip has led some to speculate that Microsoft is trying to reserve the best xCloud streaming performance for Windows machines in an attempt to attract more users to its own operating system. But using a Macintosh User-Agent string provides streaming performance similar to that on Windows, which would seem to be a big omission if that theory were true. Microsoft also hasn't published any kind of "best on Windows"-style marketing in promoting xCloud streaming, which would seemingly be a key component of trying to attract new Windows users. (The quality difference could be a roundabout attempt to get Linux users to switch to the Edge browser, where Clarity Boost offers the best possible quality. But that still wouldn't fully explain why Windows users on other browsers, without Clarity Boost, also get better streaming quality than their Linux brethren.) Others have suggested that the downgrade could simply be a bug caused by Microsoft's naive parsing of the User-Agent strings. That's because the User-Agent strings for Android browsers generally identify themselves as some version of Linux ("Linux; Android 11; HD1905," for example). Microsoft's xCloud code might simply see the "Linux" in that string, assume the user is running Android, then automatically throttle the streaming quality to account for the (presumably) reduced screen size of an Android phone or tablet. ' -- source: https://games.slashdot.org/story/22/07/06/2040206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Systemd Creator Lands At Microsoft
by Peter Reutemann 07 Jul '22

07 Jul '22

'Yesterday, Phoronix reported that the lead developer of systemd, Lennart Poettering, left Red Hat. "It turns out he had joined Microsoft and [is] continuing his work on systemd," writes Phoronix's Michael Larabel in a new report. He continues: While some may not always align with his views or approaches to handling some things, there is no overstating his enormous contributions to the Linux/open-source world and his dedication to advancing the ecosystem over the years. This may take many by surprise but let's not forget Microsoft has over time employed a number of Linux developers and other prominent open-source developers... Microsoft currently employs Python creator Guido van Rossum, GNOME creator Miguel de Icaza had been employed by Microsoft from 2016 when they acquired Xamarin to earlier this year when he left, Nat Friedman as part of Xamarin-Microsoft served as GitHub CEO following Microsoft's acquisition, Gentoo Linux founder Daniel Robbins was previously employed by Microsoft, Steve French as the Linux CIFS/SMB2/SMB3 maintainer and Samba team member works for Microsoft, and Microsoft employs/previously-employed a large number of upstream Linux developers like Matteo Croce, Matthew Wilcox, Shyam Prasad N, Michael Kelley, and many others beyond just the usual immediately recognizable names to Linux enthusiasts/developers. It was also just earlier this year that Christian Brauner as another longtime Linux kernel developer joined Microsoft. Christian Brauner is Berlin-based like Lennart and moved on to Microsoft after the past half-decade at Canonical working on the Linux kernel, LXC, systemd, and more. ' -- source: https://linux.slashdot.org/story/22/07/06/2348255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PulseAudio and Systemd Creator, Lennart Poettering, Reportedly Leaves Red Hat
by Peter Reutemann 06 Jul '22

06 Jul '22

'To much surprise, the lead developer of systemd Lennart Poettering who also led the creation of PulseAudio, Avahi, and has been a prolific free software contributor has reportedly left Red Hat. Michael Larabel writes via Phoronix: So far no public announcement appears to have been made, but according to a source has been reportedly removed from Red Hat's internal employee database. Yesterday Lennart did comment on the public Fedora devel mailing list to having now created a personal Red Hat Bugzilla account for his Fedora contributions after it was raised in bug reports and brought up on the mailing list that Lennart's Red Hat account is disabled. Emailing his Red Hat address this morning indeed yields an auto-response that it's no longer in use. He's still active in systemd world with new commits made as of today, so it will be interesting to see where he ends up or his next moves with his vast Linux ecosystem expertise and pivotal role in spearheading systemd's direction. ' -- source: https://linux.slashdot.org/story/22/07/05/2040215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Gtk 5 Might Drop X.11 Support, Says GNOME Dev
by Peter Reutemann 06 Jul '22

06 Jul '22

'One of the GNOME developers has suggested that the next major release of Gtk could drop support for the X window system. The Register reports: Emmanuele Bassi opened a discussion last week on the GNOME project's Gitlab instance that asked whether the developers could drop X.11 support in the next release of Gtk. At this point, it is only a suggestion, but if it gets traction, this could significantly accelerate the move to the Wayland display server and the end of X.11. Don't panic: Gtk 5 is not imminent. Gtk is a well-established toolkit, originally designed for the GIMP bitmap editing program back in 1998. Gtk 4 arrived relatively recently, shortly before the release of GNOME 40 in 2021. GNOME 40 has new user-interface guidelines, and as a part of this, Gtk 4 builds GNOME's Adwaita theme into the toolkit by means of the new libadwaita library, which is breaking the appearance of some existing apps. Also, to be fair, as we recently covered, the X window system is very old now and isn't seeing major changes, although new releases of parts of it do still happen. This discussion is almost certain to get wildly contentious, and the thread on Gitlab has been closed to further comments for now. If this idea gains traction, one likely outcome might well be a fork of Gtk, just as happened when GNOME 3 came out. [...] A lot of the features of the current version, X.11, are no longer used or relevant to most users. Even so, X.12 is barely even in the planning stages yet.' -- source: https://news.slashdot.org/story/22/07/05/2110211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vim 9.0 Released
by Peter Reutemann 05 Jul '22

05 Jul '22

'After many years of gradual improvement Vim now takes a big step with a major release. Besides many small additions the spotlight is on a new incarnation of the Vim script language: Vim9 script. Why Vim9 script: A new script language, what is that needed for? Vim script has been growing over time, while preserving backwards compatibility. That means bad choices from the past often can't be changed and compatibility with Vi restricts possible solutions. Execution is quite slow, each line is parsed every time it is executed. The main goal of Vim9 script is to drastically improve performance. This is accomplished by compiling commands into instructions that can be efficiently executed. An increase in execution speed of 10 to 100 times can be expected. A secondary goal is to avoid Vim-specific constructs and get closer to commonly used programming languages, such as JavaScript, TypeScript and Java. The performance improvements can only be achieved by not being 100% backwards compatible. For example, making function arguments available by creating an "a:" dictionary involves quite a lot of overhead. In a Vim9 function this dictionary is not available. Other differences are more subtle, such as how errors are handled. For those with a large collection of legacy scripts: Not to worry! They will keep working as before. There are no plans to drop support for legacy script. No drama like with the deprecation of Python 2.' -- source: https://developers.slashdot.org/story/22/07/04/193233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

no more scrolling...
by Peter Reutemann 05 Jul '22

05 Jul '22

Hi everyone Been working on a Rasperry Pi without graphical user interface and simply log in on the command-line. One thing that has been puzzling me is why I can no longer scroll backwards/forwards using SHIFT+PGUP/PGDOWN. Instead I have to use "| less" on output now. Turns out that this functionality got removed from the kernel: https://www.linuxquestions.org/questions/slackware-14/the-latest-kernel-rel… Not every device will have a graphical user interface, especially not IoT devices. So that's rather annoying... :-( Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

USB installer tool removes Windows 11’s Microsoft account requirements (and more)
by Peter Reutemann 05 Jul '22

05 Jul '22

'One of the new "features" coming to the Windows 11 22H2 update is a Microsoft account requirement for all new installs, regardless of whether you are using the Home or Pro version of the operating system. And that's too bad, because the 22H2 update corrects a few of Windows 11's original shortcomings while adding some nice quality-of-life improvements. An easy workaround for this requirement is the Rufus USB formatting tool, which can create USB install media for Windows and all kinds of other operating systems. Rufus has already offered some flags to remove Windows 11's system requirement checks from the installer, removing the need for clunky Windows Registry edits and other workarounds. But the beta of version 3.19 will also remove the Microsoft account requirement for new installs, making it easy to set up a new Windows PC with a traditional local account. When setting up Windows 11, make sure not to connect your PC to the Internet before creating your user account. This trick worked to circumvent the Microsoft account requirement in Windows 11 Pro and some of the later versions of Windows 10 but is being removed entirely from Windows 11 22H2. The Rufus tool merely reverts to the pre-22H2 status quo.' -- source: https://arstechnica.com/gadgets/2022/06/usb-installer-tool-removes-windows-… Nice to see open-source "fixing" this mandatory account issue. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The tiniest Raspberry Pi gets a new version with built-in Wi-Fi
by Peter Reutemann 04 Jul '22

04 Jul '22

'The Raspberry Pi Zero series is the smallest version of the popular single-board computer that most people have experience with, but there's one Pi that's even smaller: the Raspberry Pi Pico. Launched in January of 2021 for just $4, the Pico's RP2040 microcontroller incorporates a pair of 133MHz Arm Cortex-M0+ CPU cores and 264 kilobytes (not megabytes) of memory. The low specs and low price make it well-suited for single-purpose devices that don't need much processing power instead of running general-purpose software like the larger Pi boards. To help support companies who want to use the Pico as a basis for Internet-connected smart devices, the Raspberry Pi Foundation is introducing a few new variants of the Pico today. The most notable, the Raspberry Pi Pico W, adds built-in Wi-Fi connectivity to the board while increasing the price from $4 to $6.' -- source: https://arstechnica.com/gadgets/2022/06/the-tiniest-raspberry-pi-gets-a-new… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open-Standard Audio/MIDI plugins: A Dose Of CLAP
by Lawrence D'Oliveiro 01 Jul '22

01 Jul '22

Music/audio production tools commonly support plugins to augment their capabilities. However, well-supported plugin architectures have mostly been proprietary. For example, Steinberg’s VST2 is strictly controlled via a proprietary licence. They are now promoting VST3, which is being made available under the GPL, but their (mis)handling of the VST2→VST3 transition has left a bad taste in many developers’ mouths. On Linux, you will likely heard of open-source plugin systems like LADSPA, DSSI and LV2. And also JUCE and GMPI. Of these, LV2 seems like the most popular, but developers report that it can be hard to get to grips with. Here is a backgrounder <https://lwn.net/Articles/890272/> by Alexandre Prokoudine on the current state of play, leading up to the introduction of Yet Another Plugin Standard, the “Clever Audio Plugin”, or “CLAP” (fnarr-fnarr). He goes into more detail in the followup <https://lwn.net/Articles/893048/>. And he has a bunch of more info on his own site <https://librearts.org/2022/06/introducing-clap/>.

1 0

Mycroft’s Mimic 3 -- A Privacy-Focused, Open-Source Text-To-Speech Engine
by Lawrence D'Oliveiro 30 Jun '22

30 Jun '22

Just came across this video <https://www.youtube.com/watch?v=egrMopDIvPE> on the “Learn Linux TV” channel, talking about this new device that does text to speech. The actual speech-synthesis software is open-source. The original “Mimic1” has been around for a while, but the new version takes advantage of newer Raspberry π hardware. He talks about it not needing an Internet connection any more: I think this was a requirement of the old hardware, not the software as such. You can build and install the software (old or new) yourself, it’s freely available from their GitHub repos. Interesting that the build instructions for Microsoft Windows recommend doing a cross-build from Linux, this being faster than a native Windows build.

1 0

How The Swiss Post E-Voting System Addresses Client-Side Vulnerabilities
by Lawrence D'Oliveiro 30 Jun '22

30 Jun '22

There has been a lot of talk about E-voting. But the trouble with most such systems proposed is that they tend to have weaknesses allowing the voting system to be subverted. Switzerland is one of those places that has implemented a system that seems to address the most common weaknesses. This article <https://freedom-to-tinker.com/2022/06/29/how-the-swiss-post-e-voting-system…>, part of a series on E-voting systems, gives an overview of how it works. Each voter is sent a piece of paper through the mail. This has a unique code on it that they use to initiate the online voting process. It also contains a series of codes associated with each possible response from the voting system (calculated from the voter-specific code). So as the voter enters their choice, they can verify that the code shown is the correct one for that choice. So even if the voting app, or the browser, or the user’s PC has been compromised, the attacker still cannot know what the codes are -- those are only known to the central voting system, and disclosed only to that voter. Any attempt to fake the voter’s selection will cause a code mismatch that should raise alarm bells. So the voting system is not entirely paperless: basically, nobody knows how to create a secure, yet completely paperless, voting system. Which is not to say the system is completely foolproof: the next instalment promises to reveal some issues with the scheme.

1 0

Firefox Can Now Automatically Remove Tracking From URLs
by Peter Reutemann 30 Jun '22

30 Jun '22

'Mozilla's latest Firefox browser release has a new feature that prevents sites like Facebook from tracking you across websites. Called Query Parameter Stripping, it automatically removes strings of characters added to the end of an URL.' -- source: https://news.slashdot.org/story/22/06/29/1939203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A wide range of routers are under attack by new, unusually sophisticated malware
by Peter Reutemann 29 Jun '22

29 Jun '22

'An unusually advanced hacking group has spent almost two years infecting a wide range of routers in North America and Europe with malware that takes full control of connected devices running Windows, macOS, and Linux, researchers reported on Tuesday. So far, researchers from Lumen Technologies' Black Lotus Labs say they've identified at least 80 targets infected by the stealthy malware, infecting routers made by Cisco, Netgear, Asus, and DayTek. Dubbed ZuoRAT, the remote access Trojan is part of a broader hacking campaign that has existed since at least the fourth quarter of 2020 and continues to operate. The discovery of custom-built malware written for the MIPS architecture and compiled for small office and home office routers is significant, particularly given its range of capabilities. Its ability to enumerate all devices connected to an infected router and collect the DNS lookups and network traffic they send and receive and remain undetected is the hallmark of a highly sophisticated threat actor.' -- source: https://arstechnica.com/information-technology/2022/06/a-wide-range-of-rout… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MNT shrinks its open source Reform laptop into a 7-inch pocket PC throwback
by Peter Reutemann 29 Jun '22

29 Jun '22

'A few months ago, we reviewed the MNT Reform, which attempts to bring the dream of entirely open source hardware to an audience that doesn't want to design and build a laptop totally from scratch. Now, MNT is bringing its open-hardware ethos to a second PC, a 7-inch "Pocket Reform" laptop that recalls the design of old clamshell Pocket PCs, just like the big Reform references the design of chunky '90s ThinkPads. The Pocket Reform borrows many of the big Reform laptop's design impulses, including a low-profile mechanical keyboard and trackball-based pointing device and a chunky, retro-throwback design. The device includes a 7-inch 1080p screen, a pair of USB-C ports (one of which is used for charging), a microSD slot for storage expansion, and a micro HDMI port for connecting to a display when you're at your desk.' -- source: https://arstechnica.com/gadgets/2022/06/mnt-reform-laptops-open-hardware-ap… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Is Cautiously Optimistic About Bringing Rust Into Linux Kernel's Next Release
by Peter Reutemann 29 Jun '22

29 Jun '22

'ZDNet: For over three decades, Linux has been written in the C programming language. Indeed, Linux is C's most outstanding accomplishment. But the last few years have seen a growing momentum to make the Rust programming language Linux's second Linux language. At the recent Open Source Summit in Austin, Texas, Linux creator Linus Torvald said he could see Rust making it into the Linux kernel as soon as the next major release. "I'd like to see the Rust infrastructure merging to be started in the next release, but we'll see." Linux said after the summit. "I won't force it, and it's not like it's going to be doing anything really meaningful at that point -- it would basically be the starting point. So, no promises." Now, you may ask: "Why are they adding Rust at all?" Rust lends itself more easily to writing secure software. Samartha Chandrashekar, an AWS product manager, said it "helps ensure thread safety and prevent memory-related errors, such as buffer overflows that can lead to security vulnerabilities." Many other developers agree with Chandrashekar. Torvalds also agrees and likes that Rust is more memory-safe. "There are real technical reasons like memory safety and why Rust is good to get in the kernel." Mind you, no one is going to be rewriting the entire 30 or so million lines of the Linux kernel into Rust. As Linux developer Nelson Elhage said in his summary of the 2020 Linux Plumber's meeting on Rust in Linux: "They're not proposing a rewrite of the Linux kernel into Rust; they are focused only on moving toward a world where new code may be written in Rust." The three areas of potential concern for Rust support are making use of the existing APIs in the kernel, architecture support, and dealing with application binary interface (ABI) compatibility between Rust and C.' -- source: https://linux.slashdot.org/story/22/06/28/0448235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Releases Firefox 102
by Peter Reutemann 29 Jun '22

29 Jun '22

'Today, Mozilla released Firefox 102. New features include: * Tired of too many windows crowding your screen? You can now disable automatic opening of the download panel every time a new download starts. Read more. * Firefox now mitigates query parameter tracking when navigating sites in ETP strict mode. * Subtitles and captions for Picture-in-Picture (PiP) are now available at HBO Max, Funimation, Dailymotion, Tubi, Disney+ Hotstar, and SonyLIV. This allows you to view video in a small window pinned to a corner of the screen while navigating between apps or browsing content on the main screen. But do not get fooled, the most important feature is that this release is an ESR, this is super-important of a host of reasons: * Firefox ESR is the basis for KaiOS (an evolution of BootToGecko), an OS for Semi-Smart Phones very popular in India (100milion+), SE Asia + Africa (~60Milion), so, whatever made the cut in 102 will define the base capabilities for KaiOS for the next year. * Firefox ESR is the basis for Thunderbird, so, if you use Thunderbird or a derivative, whatever made the cut in 102 will underpin Thunderbird for the next year. * Many popular Linux distros (like Debian or Kali) use Firefox ESR as the default browser. * Many companies and organizations use Firefox ESR as their default browser, and many SW development companies certify Firefox ESR as an alowed browser for their SW. So, 102 is a very important release, becuase it brings a year of advances to ESR.' -- source: https://news.slashdot.org/story/22/06/28/198214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a Turkish Municipal District Switched to GNU/Linux
by Peter Reutemann 28 Jun '22

28 Jun '22

'Today I learned Turkey's Scientific and Technological Research Council has a subsidiary developing a GNU/Linux distro called Pardus, "redesigned to be used in accordance with the practices and habits of users in Turkey." And this week the Free Software Foundation published a post from the proud project leader of Pardus, explaining exactly why open source was chosen in the district of Eyüpsultan (on the European side of Istanbul) and how they got it implemented: After the municipal elections held in 2014, the new administration realized (through internal financial analysis reports) that a large amount of money was being spent on licensing proprietary software. Looking to cut costs, management asked for a study to be carried out for solutions. As the Eyüpsultan municipality's IT department, we recommended to replace Microsoft Windows with Pardus GNU/Linux instead. We described our preference to transition to free software as "the desire to be independent from a company as well as the savings to be gained from cutting hefty license fees." Additionally, we spoke about how the four freedoms would improve things outside of the budget. For example, we told the administration that users, when using free software, can fully benefit from the rights they have over the programs running on their computers. We also informed everyone that, when the software they run is proprietary, it means that a company claims rights over the user, and that such a claim of ownership can place restrictions on users in how they may or may not use the software. We told them that this is unacceptable. Arguments such as these were among the deciding factors that influenced our transition to free software. The plan was presented to the municipal administration and widely accepted. The municipal administration approved the project, and in January, 2015, the Eyüpsultan municipality started using free software applications such as LibreOffice (e.g. Writer, Calc, Impress, etc.). Prior to the implementations, basic user training on LibreOffice software was provided to the personnel of the institution. Over time, users were gradually and steadily directed to free systems, and, notably, without receiving backlash from users.... Training was an important item in the transition to Pardus GNU/Linux. Besides an online support forum, they've also set up a live call center to answer questions. "I think we may be the only distribution that helps with issues via a call center." So how do they feel now about that transition, eight years later? Free software has many advantages, including flexibility, high performance, major cost savings from licensing fees, independence from any particular company, and compliance with interoperability standards. Therefore, the transition of Eyüpsultan municipality to free software has resulted in benefits that were both strategic and practical. We believe, in the near future, more organizations will need to understand the philosophy of free software and the opportunities that free software provides. The municipal budget has freed up money as a result of the moving from proprietary software to free software. The savings from the "proprietary software licenses" line of the budget was applied to the district in the form of new projects. The money goes now to, among other things, increasing the number of new parks and gardens, bicycle paths, and security cameras in the parks. Additionally, by increasing the number of classes we provide technical training, we started to provide classes in robotics and computation to young people. The Eyüpsultan municipality is now increasing the opportunities for students to further develop their personalities, abilities, goals, and self-discovery. It introduces young people to technology and encourages them to produce new technologies. One final effect of using free software? It encourages others to do the same: As a result of this brave decision, many of the Istanbul district municipalities have started working to switch or have already made the switch to the Pardus GNU/Linux operating system. Institutions in other cities of the country have also expressed growing interest by asking questions about the Pardus operating system and free software.' -- source: https://news.slashdot.org/story/22/06/27/0154233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ventoy - new bootable USB solution
by Peter Reutemann 27 Jun '22

27 Jun '22

Hi everyone This tool just came up during our WLUG meeting: ventoy 'Ventoy is an open source tool to create bootable USB drive for ISO/WIM/IMG/VHD(x)/EFI files. With ventoy, you don't need to format the disk over and over, you just need to copy the image files to the USB drive and boot it. You can copy many image files at a time and ventoy will give you a boot menu to select them. You can also browse ISO/WIM/IMG/VHD(x)/EFI files in local disk and boot them. x86 Legacy BIOS, IA32 UEFI, x86_64 UEFI, ARM64 UEFI and MIPS64EL UEFI are supported in the same way. Both MBR and GPT partition style are supported in the same way. Most type of OS supported(Windows/WinPE/Linux/Unix/ChromeOS/Vmware/Xen...) 900+ ISO files are tested (List). 90%+ distros in distrowatch.com supported (Details).' https://github.com/ventoy/ https://www.ventoy.net/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Linux Foundation Podcast: 'Untold Stories of Open Source'
by Peter Reutemann 27 Jun '22

27 Jun '22

'The nonprofit Linux Foundation pays Linus Torvalds' salary and supports many other open source projects. But they also launched a new podcast series this week covering "The Untold Stories of Open Source." "Each week we explore the people who are supporting Open Source projects, how they became involved with it, and the problems they faced along the way," explains the podcast's GitHub page (where you can put in a pull request to suggest future episodes or track the project's progress.) The podcast is available on its official web page, as well as on Spotify, Apple, Google, or "wherever you listen to your podcasts," according to an announcement from the Linux Foundation. An introductory page says the podcast will be "used to inform the Linux and Open Source communities as to the current state in development of open source initiatives and Linux Foundation Projects. It is vendor neutral, with no interviews of commercial product vendors or sales teams." Here's the first four episodes: - Balancing Priorities at the Cloud Native Computing Foundation, with Priyanka Sharma, general manager - A Life in Open Source, with Brian Behlendorf, general manager at Open Source Security Foundation - A New Model for Technical Training, with Clyde Seepersad, senior vice president of the Linux Foundation's training/certification project - The Business Side of Open Source, with Patrick Debois, "godfather of DevOps"' -- source: https://news.slashdot.org/story/22/06/25/0041218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TIL: Bracketed-Paste Mode
by Lawrence D'Oliveiro 26 Jun '22

26 Jun '22

I’ve been noticing one or two little quirks of the KDE Konsole terminal emulator lately. One is, when I copy and paste multiple lines of commands at once, they don’t get executed one by one, in fact they don’t get executed at all: I still have to press Enter afterwards to execute them. Another is, if I forget to type CTRL-SHIFT-V to do the paste, but do CTRL-V instead (the standard Unix control character which means “enter next character literally”), the pasted text gets prefixed with “«esc»[200~” and followed by a “~” character. If it wasn’t for that CTRL-V, that escape-sequence prefix would be interpreted by the terminal emulator. (Actually it turns out that ending “~” is actually part of the sequence “«esc»[201~”, which was being misinterpreted in that case because it did not follow a proper “«esc»[200~” sequence.) It turns out both of these behaviours are by design. That special escape sequence activates “bracketed-paste” mode <https://cirw.in/blog/bracketed-paste>. This is a safety feature to guard against malicious commands: it means the paste on its own is never enough to execute anything. So the user always gets a chance to see what has been pasted, before explicitly executing it. This behaviour is probably commonplace among other terminal emulators, as well.

3 3

Linux Kernel Signature Verification Code Adds FIPS Compliance
by Peter Reutemann 26 Jun '22

26 Jun '22

'Phoronix reports a new change was merged into the soon-to-be-released Linux 5.19 on Tuesday, making the kernel's signature verification code compliant with the Federal Information Processing Standards known as FIPS: FIPS are public standards via the National Institute of Standards and Technology used by U.S. government agencies and contractors in the areas of computer security and interoperability... Known-answer self-tests are required for FIPS compliance at startup/reboot, but the Linux kernel's signature verification code has been lacking such tests. The signature checking code is used for module signing, Kexec, and other functionality. With Linux 5.19 there will now be some basic self-tests at start. The tests will make their debut in Linux 5.19-rc4.' -- source: https://linux.slashdot.org/story/22/06/25/0118254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Happy Birthday X
by Lawrence D'Oliveiro 23 Jun '22

23 Jun '22

X Windows† turns 38 years old this week <https://www.theregister.com/2022/06/22/the_x_window_system_just/>. It originated from a previous GUI system called “W” (for “Window”, I guess) which ran on the “V” microkernel-based research OS. Nobody seems able to find any source code for these earlier projects. The first version of X (X1?) only ran on the DEC VAXstation 100. By about the version called X10, it was getting more portable to other workstation hardware. And of course X11 remains (with various revisions) with us to this day. However, it’s clear much of the development momentum has left the project, and gone to candidates for an all-new redesigned-from-the-ground-up successor, like Wayland. †Or the “X Window System”, if you prefer

1 0

The World Is Not Ready For Such Power ...
by Lawrence D'Oliveiro 23 Jun '22

23 Jun '22

... says Microsoft. Recognizing the potential <https://www.theregister.com/2022/06/21/microsoft_api_ai_algorithms/> for misuse of technologies that can glean information from publicly-available images, audio etc that the subjects of those online media might not expect (including the ability to forge their likenesses), the company has pledged to come up with restrictions on how developers outside the company can use these technologies. As for developers _inside_ the company? (...crickets...)

1 0

Most Top Websites Are Not Following Best Practices In Their Password Policies
by Lawrence D'Oliveiro 23 Jun '22

23 Jun '22

Report on a survey <https://freedom-to-tinker.com/2022/06/22/most-top-websites-are-not-followin…> on the sorts of password policies in force on various popular websites. Too many of them still have unnecessary restrictions like the characters you are allowed to use, or even imposing a maximum permitted length. There is a linked blog post from one of the developers at Discourse, which argues that rules of any kind should be avoided. Or nearly any kind: there is a case for a minimum-length requirement (but be careful how you count it -- are you just going by Unicode “code points”? Or worse still, are you requiring passwords to be ASCII-only?), and checks against leaked password lists, plus some kind of entropy test to rule out trivial things like “aaaaaaaaaa”. Beyond that, let the user enter what they like. Showing the user a password-strength meter next to their entry as they choose a password is considered part of best practice nowadays. But in their article, they show that Facebook’s password-strength meter, for example, seems to prefer certain weak passwords (with a wider character set) over more random, stronger ones (from a smaller character set). Maybe there are circumstances out of the hands of the sysadmins, and the blame lies elsewhere: the article closes with One idea for future research: directly engage with system administrators, in order to understand their mindset on password security. Perhaps password policy is meant to be security theater--giving users a sense of safety without actually improving security. Or maybe websites have shifted their attention to adopting other authentication technologies, like SMS-based multi-factor authentication (which also suffers from severe weaknesses, as we discovered in previous research on SIM swaps and number recycling). Perhaps websites have to deal with security audits from firms like Deloitte recommending outdated practices. Or maybe websites face other practical constraints that the information security community doesn’t know about.

1 0

Mega says it can’t decrypt your files. New POC exploit shows otherwise
by Peter Reutemann 22 Jun '22

22 Jun '22

'In the decade since larger-than-life character Kim Dotcom founded Mega, the cloud storage service has amassed 250 million registered users and stores a whopping 120 billion files that take up more than 1,000 petabytes of storage. A key selling point that has helped fuel the growth is an extraordinary promise that no top-tier Mega competitors make: Not even Mega can decrypt the data it stores. On the company's homepage, for instance, Mega displays an image that compares its offerings to Dropbox and Google Drive. In addition to noting Mega's lower prices, the comparison emphasizes that Mega offers end-to-end encryption, whereas the other two do not. Over the years, the company has repeatedly reminded the world of this supposed distinction, which is perhaps best summarized in this blog post. In it, the company claims, "As long as you ensure that your password is sufficiently strong and unique, no one will ever be able to access your data on MEGA. Even in the exceptionally improbable event MEGA's entire infrastructure is seized!" (emphasis added). Third-party reviewers have been all too happy to agree and to cite the Mega claim when recommending the service. Research published on Tuesday shows there's no truth to the claim that Mega, or an entity with control over Mega's infrastructure, is unable to access data stored on the service. The authors say that the architecture Mega uses to encrypt files is riddled with fundamental cryptography flaws that make it trivial for anyone with control of the platform to perform a full key recovery attack on users once they have logged in a sufficient number of times. With that, the malicious party can decipher stored files or even upload incriminating or otherwise malicious files to an account; these files look indistinguishable from genuinely uploaded data.' -- source: https://arstechnica.com/information-technology/2022/06/mega-says-it-cant-de… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

RISC OS: 35-Year-Old Original ARM OS Is Alive and Well
by Peter Reutemann 22 Jun '22

22 Jun '22

'RISC OS, the operating system of the original Arm computer, the Acorn Archimedes, is still very much alive -- and doing relatively well for its age. The Register reports: In June 1987, Acorn launched the Archimedes A305 and A310, starting at $982 and running a new operating system called Arthur. At the time, it was a radical and very fast computer. In his review (PDF) for Personal Computer World, Dick Pountain memorably said: "It loads huge programs with a faint burping noise, in the time it takes to blink an eye." Arthur was loosely related to Acorn's earlier MOS, the BBC Micro operating system but looked very different thanks to a prototype graphical desktop, implemented in BBC BASIC, that could charitably be called "technicolor." Renamed RISC OS, version 2 followed in 1989 -- the same year that Sun started selling its new SPARCstation 1 (a snip at $9,200) and DEC launched the MIPS R2000-chipset-based DECstation 3100 (for $10,800). RISC OS has had a rather convoluted history, partly due to Acorn spinning out Arm, eventually pulling out of the computer market, rebranding as Element 14 and being acquired by Broadcom, where Arm co-designer Sophie Wilson still works today. And partly due to drama over the ownership of the OS post-Acorn at one point. One fork of RISC OS still supports Acorn-era Arm's odd 26-bit mode, meaning that today it mostly runs on the commercial Virtual Acorn emulator. The other branch, designed for the 32-bit mode of more recent Arm chips, is now owned by RISC OS Developments, which made it fully open source back in 2018. Development and maintenance is done by the team at RISC OS Open Ltd -- ROOL for short -- which offers downloads for a variety of current Arm hardware, such as the Titanium desktops. [...] RISC OS Developments are still working on new functionality for the OS. Notably, it recently released a new TCP/IP stack, derived from OpenBSD. Right now, the main benefit is IPv6 support. A feature more significant to most users is still in development: Wi-Fi support. Also still under development, but available to paid backers, is a new RISC OS web browser, Iris. RISC OS does come with a choice of browsers -- NetSurf and Otter -- but the plan is that the new Iris browser will be a native app, with the RISC OS look and feel, but using the WebKit engine for better compatibility with the modern web. The main remaining limitation is SMP. As an OS from the 1980s, long before the 21st-century technology of mainstream multicore processors, RISC OS practically only supports a single CPU core. Various experimental efforts are under way to address this. One has got NetBSD running on another core, and another has the experimental Genode OS running alongside RISC OS. Another effort is working on adding SMP support into the RISC OS kernel itself.' -- source: https://tech.slashdot.org/story/22/06/21/2036227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.25 Released
by Peter Reutemann 20 Jun '22

20 Jun '22

'Long-time Slashdot reader jrepin describes Plasma as "a popular desktop environment, which is also powering the desktop mode on the Steam Deck portable gaming console." And this week the KDE Community announced the release of KDE Plasma 5.25: This new version brings many improvements... - The accent colour can now be set based on the prominent colour from the current desktop background image (it updates if you use slide-show wallpapers) and it applies to more graphical elements. - Floating Panels add a margin all around the panel to make it float while no window is maximised. - Touch-screen mode can now be activated by detaching the screen, rotating it 360, or enabling it manually. - The Global Theme settings page lets you pick and choose which parts to apply. - The Application page for Discover has been redesigned and gives you links to the application's documentation and website, and shows what system resources it has access to. - Panels can now be navigated with the keyboard, and you can assign custom shortcuts to focus individual panels. Lilputing.com adds that "There's a new Overview effect that zooms out to display previews of all currently-running apps and virtual desktops. You can access this view with a four-finger pinch on a touchscreen or touchpad, and from this view, you can also search for apps, documents, or browser tabs or add, remove, or rename virtual desktops."' -- source: https://tech.slashdot.org/story/22/06/18/045234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

WLUG meeting next Monday
by Peter Reutemann 20 Jun '22

20 Jun '22

Hi everyone We have a (hybrid) meeting next Monday with the following line up: 'Tom Butz will talk about his experience of installing Linux Mint 20 on his laptop and Ian Stewart of getting Ubuntu 22.04 dual-booting Linux/Windows on a UEFI-enabled device.' Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776671/ Link for virtual meeting: https://bbb2.nzoss.nz/b/pet-pgj-enn-fbi Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Linux Botnet That Spreads Using Stolen SSH Keys
by Peter Reutemann 20 Jun '22

20 Jun '22

'ZDNet is warning that Linux users need to watch out for "a new peer-to-peer (P2P) botnet that spreads between networks using stolen SSH keys and runs its crypto-mining malware in a device's memory." The Panchan P2P botnet was discovered by researchers at Akamai in March and the company is now warning it could be taking advantage of collaboration between academic institutions to spread by causing previously stolen SSH authentication keys to be shared across networks. But rather than stealing intellectual property from these educational institutions, the Panchan botnet is using their Linux servers to mine cryptocurrency, according to Akamai... "Instead of just using brute force or dictionary attacks on randomized IP addresses like most botnets do, the malware also reads the id_rsa and known_hosts files to harvest existing credentials and use them to move laterally across the network...." Akamai found 209 peers, but only 40 of them are currently active and they were mostly located in Asia. And why is the education sector more impacted by Panchan? Akamai guesses this could be because of poor password hygiene, or that the malware moves across the network with stolen SSH keys. Akamai writes that the malware "catches Linux termination signals (specifically SIGTERM — 0xF and SIGINT — 0x2) that are sent to it, and ignores them. "This makes it harder to terminate the malware, but not impossible, since SIGKILL isn't handled (because it isn't possible, according to the POSIX standard, page 313)."' -- source: https://linux.slashdot.org/story/22/06/18/2046253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft’s Patch Trouble
by Lawrence D'Oliveiro 17 Jun '22

17 Jun '22

This article <https://arstechnica.com/information-technology/2022/06/botched-and-silent-p…> relates Microsoft’s ongoing troubles coming up with proper patches for security-related issues in its systems. For example, there was a vulnerability in Azure that took over three months and three different patches before the problem could be considered fixed. (The article describes the time interval as “five months”, but to be fair, the final patch came out just over three months after the initial notification.) Then there is the “Follina” vulnerability, which lets an attacker execute code via Microsoft Office, even if you have macro autoexecution disabled. This was finally patched earlier this week -- over seven weeks after it had been seen being actively exploited in the wild. Microsoft’s response has a sentence beginning “We are deeply committed...”. I think this PR usage of the word “committed” should be on a bingo card for content-free buzzwords.

1 0

Ubuntu Core 22 Brings Real-Time Linux Options To IoT
by Peter Reutemann 17 Jun '22

17 Jun '22

'Embedded and internet of things (IoT) devices are a growing category of computing, and with that growth has come expanded needs for security and manageability. One way to help secure embedded and IoT deployments is with a secured operating system, such as Canonical's Ubuntu Core. The Ubuntu Core provides an optimized version of the open-source Ubuntu Linux operating system for smaller device footprints, using an approach that puts applications into containers. On June 15, Ubuntu Core 22 became generally available, providing users with new capabilities to help accelerate performance and lock down security. Ubuntu Core 22 is based on the Ubuntu 22.04 Linux operating system, which is Canonical's flagship Linux distribution that's made available for cloud, server and desktop users. Rather than being a general purpose OS, Ubuntu Core makes use of the open-source Snap container technology that was originally developed by Canonical to run applications. With Snaps, an organization can configure which applications should run in a specific IoT or embedded device and lock down the applications for security. Snaps provide a cryptographically authenticated approach for application updates.' -- source: https://news.slashdot.org/story/22/06/15/1729255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A New Vulnerability in Intel and AMD CPUs Lets Hackers Steal Encryption Keys
by Peter Reutemann 17 Jun '22

17 Jun '22

'Microprocessors from Intel, AMD, and other companies contain a newly discovered weakness that remote attackers can exploit to obtain cryptographic keys and other secret data traveling through the hardware, researchers said on Tuesday. From a report: Hardware manufacturers have long known that hackers can extract secret cryptographic data from a chip by measuring the power it consumes while processing those values. Fortunately, the means for exploiting power-analysis attacks against microprocessors is limited because the threat actor has few viable ways to remotely measure power consumption while processing the secret material. Now, a team of researchers has figured out how to turn power-analysis attacks into a different class of side-channel exploit that's considerably less demanding. The team discovered that dynamic voltage and frequency scaling (DVFS) -- a power and thermal management feature added to every modern CPU -- allows attackers to deduce the changes in power consumption by monitoring the time it takes for a server to respond to specific carefully made queries. The discovery greatly reduces what's required. With an understanding of how the DVFS feature works, power side-channel attacks become much simpler timing attacks that can be done remotely. The researchers have dubbed their attack Hertzbleed because it uses the insights into DVFS to expose -- or bleed out -- data that's expected to remain private. The vulnerability is tracked as CVE-2022-24436 for Intel chips and CVE-2022-23823 for AMD CPUs. The researchers have already shown how the exploit technique they developed can be used to extract an encryption key from a server running SIKE, a cryptographic algorithm used to establish a secret key between two parties over an otherwise insecure communications channel.' -- source: https://it.slashdot.org/story/22/06/15/1715226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tsunami of junk traffic that broke DDoS records delivered by tiniest of botnets
by Peter Reutemann 16 Jun '22

16 Jun '22

'A massive flood of malicious traffic that recently set a new distributed denial-of-service record came from an unlikely source. A botnet of just 5,000 devices was responsible as extortionists and vandals continue to develop ever more powerful attacks to knock sites offline, security researchers said. The DDoS delivered 26 million HTTPS requests per second, breaking the previous record of 15.3 million requests for that protocol set only seven weeks ago, Cloudflare Product Manager Omer Yoachimik reported. Unlike more common DDoS payloads such as HTTP, SYN, or SYN-ACK packets, malicious HTTPS requests require considerably more computing resources for the attacker to deliver and for the defender or victim to absorb. ' -- source: https://arstechnica.com/information-technology/2022/06/tsunami-of-junk-traf… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft finds Linux desktop flaw that gives root to untrusted users
by Peter Reutemann 14 Jun '22

14 Jun '22

'Vulnerabilities recently discovered by Microsoft make it easy for people with a toehold on many Linux desktop systems to quickly gain root system rights— the latest elevation of privileges flaw to come to light in the open source OS. As operating systems have been hardened to withstand compromises in recent years, elevation of privilege (EoP) vulnerabilities have become a crucial ingredient for most successful hacks. They can be exploited in concert with other vulnerabilities that on their own are often considered less severe, with the latter giving what’s called local access and the former escalating the root access. From there, adversaries with physical access or limited system rights can deploy backdoors or execute code of their choice. Nimbuspwn, as Microsoft has named the EoP threat, is two vulnerabilities that reside in the networkd-dispatcher, a component in many Linux distributions that dispatch network status changes and can run various scripts to respond to a new status. When a machine boots, networkd-dispatcher runs as root. The flaws, tracked as CVE-2022-29799 and CVE-2022-29800, combine threats including directory traversal, symlink race, and time-of-check time-of-use (TOCTOU) race condition.' -- source: https://arstechnica.com/information-technology/2022/04/microsoft-finds-linu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Credentials for thousands of open source projects free for the taking—again!
by Peter Reutemann 14 Jun '22

14 Jun '22

'A service that helps open source developers write and test software is leaking thousands of authentication tokens and other security-sensitive secrets. Many of these leaks allow hackers to access the private accounts of developers on Github, Docker, AWS, and other code repositories, security experts said in a new report. The availability of the third-party developer credentials from Travis CI has been an ongoing problem since at least 2015. At that time, security vulnerability service HackerOne reported that a Github account it used had been compromised when the service exposed an access token for one of the HackerOne developers. A similar leak presented itself again in 2019 and again last year. The tokens give anyone with access to them the ability to read or modify the code stored in repositories that distribute an untold number of ongoing software applications and code libraries. The ability to gain unauthorized access to such projects opens the possibility of supply chain attacks, in which threat actors tamper with malware before it's distributed to users. The attackers can leverage their ability to tamper with the app to target huge numbers of projects that rely on the app in production servers. Despite this being a known security concern, the leaks have continued, researchers in the Nautilus team at the Aqua Security firm are reporting. A series of two batches of data the researchers accessed using the Travis CI programming interface yielded 4.28 million and 770 million logs from 2013 through May 2022. After sampling a small percentage of the data, the researchers found what they believe are 73,000 tokens, secrets, and various credentials.' -- source: https://arstechnica.com/information-technology/2022/06/credentials-for-thou… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Email client K-9 Mail will become Thunderbird for Android
by Peter Reutemann 14 Jun '22

14 Jun '22

'The open source Thunderbird email client has a long and storied history, but until now, that history has been limited to the desktop. That's about to change, according to a post on the Thunderbird blog. Thunderbird will be coming to Android through the popular open source mobile email client K-9 Mail. According to Thunderbird's Jason Evangelho, the Thunderbird team has acquired the source code and naming rights to K-9 Mail. K-9 Mail project maintainer Christian Ketterer (who goes by "cketti" in the OSS community) will join the Thunderbird team, and over time, K-9 Mail will become Thunderbird for Android.' -- source: https://arstechnica.com/gadgets/2022/06/email-client-k-9-mail-will-become-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Working To Provide Good Support For The VisionFive Low-Cost RISC-V Board
by Peter Reutemann 13 Jun '22

13 Jun '22

'"Ubuntu developers have been working on bringing up and improving support for the Starfive VisionFive," writes Phoronix, calling the $179 device "one of the most promising 'low-cost' RISC-V single board computers to date... intended to run full-blown RISC-V Linux distributions." The board comes in two varieties with 4GB or 8GB of system memory, powered by a dual-core SiFive U74 RV64 SoC @ 1.0GHz, an NVDLA deep learning accelerator engine, a Tensilica-VP6 Vision DSP, and a neural network engine.... Considering the performance of the much more capable HiFive Unmatched development board (that is also multiple times more expensive) and even that sometimes being outpaced by the Raspberry Pi, don't get too excited for the dual-core 1.0GHz RISC-V 64-bit SoC for general purpose workloads. But this VisionFive board may be interesting for some machine learning and other use-cases thanks to its additional accelerators. It's also one of the few RISC-V boards capable of running a full Linux distribution in the sub-$200 space. Since the upstream Linux 5.17 kernel there has been mainline support for the VisionFive v1 board. Ubuntu developers are working on enabling the StarFive VisionFive board for their RISC-V kernel build. ' -- source: https://linux.slashdot.org/story/22/06/12/1524230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox and Chrome are squaring off over ad-blocker extensions
by Peter Reutemann 12 Jun '22

12 Jun '22

'There’s a growing split over how much room browsers should leave for ad blocking — and Chrome and Firefox have ended up on opposite sides of the fight. The rupture centers on a feature called Web Request, commonly used in ad blockers and crucial for any system that looks to block off a domain wholesale. Google has long had security concerns about Web Request and has worked to cut it out of the most recent extension standard, called Manifest V3, or MV3 for short. But, in a recent blog post, Mozilla made clear that Firefox will maintain support for Web Request, keeping the door open for the most sophisticated forms of ad blocking. Google’s strategy has been roundly criticized by privacy advocates — the Electronic Frontier Foundation has been a vocal opponent — but the search company hasn’t been swayed. Though Firefox has a far smaller share of the desktop marketplace than Chrome, it could be a chance for Mozilla’s product to really define itself. For Google though, sticking with MV3 will have a huge impact on the overall role of ad blocking on the modern web. ' -- source: https://www.theverge.com/2022/6/10/23131029/mozilla-ad-blocking-firefox-goo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MIT Researchers Uncover 'Unpatchable' Flaw in Apple M1 Chips
by Peter Reutemann 12 Jun '22

12 Jun '22

'Apple's M1 chips have an "unpatchable" hardware vulnerability that could allow attackers to break through its last line of security defenses, MIT researchers have discovered. TechCrunch reports: The vulnerability lies in a hardware-level security mechanism utilized in Apple M1 chips called pointer authentication codes, or PAC. This feature makes it much harder for an attacker to inject malicious code into a device's memory and provides a level of defense against buffer overflow exploits, a type of attack that forces memory to spill out to other locations on the chip. Researchers from MIT's Computer Science and Artificial Intelligence Laboratory, however, have created a novel hardware attack, which combines memory corruption and speculative execution attacks to sidestep the security feature. The attack shows that pointer authentication can be defeated without leaving a trace, and as it utilizes a hardware mechanism, no software patch can fix it. The attack, appropriately called "Pacman," works by "guessing" a pointer authentication code (PAC), a cryptographic signature that confirms that an app hasn't been maliciously altered. This is done using speculative execution -- a technique used by modern computer processors to speed up performance by speculatively guessing various lines of computation -- to leak PAC verification results, while a hardware side-channel reveals whether or not the guess was correct. What's more, since there are only so many possible values for the PAC, the researchers found that it's possible to try them all to find the right one.' -- source: https://apple.slashdot.org/story/22/06/11/0250238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HP releases its $1,099 Linux laptop for developers
by Peter Reutemann 11 Jun '22

11 Jun '22

'HP released its Dev One Linux laptop today. Aimed at coders, the 14-inch clamshell comes at a lower price than previous Ubuntu-based HP clamshells. Starting at $1,099, the Dev One begins to keep costs low by opting for an AMD, rather than Intel, CPU and skipping the discrete graphics card. HP's last Linux laptops, part of its ZBook workstation lineup, went well over $2,000 and offered up to Intel Xeon processors and Nvidia RTX GPUs.' -- source: https://arstechnica.com/gadgets/2022/06/hps-linux-based-amd-laptop-releases… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

New ultra-stealthy Linux backdoor isn’t your everyday malware discovery
by Peter Reutemann 10 Jun '22

10 Jun '22

'Researchers have unearthed a discovery that doesn’t occur all that often in the realm of malware: a mature, never-before-seen Linux backdoor that uses novel evasion techniques to conceal its presence on infected servers, in some cases even with a forensic investigation. On Thursday, researchers from Intezer and The BlackBerry Threat Research & Intelligence Team said that the previously undetected backdoor combines high levels of access with the ability to scrub any sign of infection from the file system, system processes, and network traffic. Dubbed Symbiote, it targets financial institutions in Brazil and was first detected in November.' -- source: https://arstechnica.com/information-technology/2022/06/novel-techniques-in-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Who Needs Modern Emacs?
by Peter Reutemann 08 Jun '22

08 Jun '22

'Every now and again I come across some discussion on making Emacs "modern". The argument always go more or less like this - Emacs doesn't look and behave like and the world will end if we don't copy something "crucial" from it. [...] If you ask me -- there's pretty much nothing we can do that would suddenly make Emacs as popular as VS Code. But you know what -- that's perfectly fine. After all there are plenty of "modern" editors that are even less popular than Emacs, so clearly being "modern" doesn't make you popular. And there's also our "arch-nemesis" vim, that's supposedly as "dated" as Emacs, but is extremely popular.' -- source: https://it.slashdot.org/story/22/06/07/1942258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Apple Will Allow Linux VMs To Run Intel Apps With Rosetta In macOS Ventura
by Peter Reutemann 08 Jun '22

08 Jun '22

'Ars Technica: One of the few things that Intel Macs can do that Apple Silicon Macs can't is run operating systems written for Intel or AMD processors inside of virtual machines. Most notably, this has meant that there is currently no legal way to run Windows on an Apple Silicon Mac. Apple Silicon Macs can, however, run operating systems written for Arm processors inside of virtual machines, including other versions of macOS and Arm-compatible versions of Linux. And those Linux VMs are getting a new feature in macOS Ventura: the ability to run apps written for x86 processors using Rosetta, the same binary translation technology that allows Apple Silicon Macs to run apps written for Intel Macs. Apple's documentation will walk you through the requirements for using Rosetta within a Linux guest operating system -- it requires creating a shared directory that both macOS and Linux can access and running some terminal commands in Linux to get it set up. But once you do those steps, you'll be able to enjoy the wider app compatibility that comes with being able to run x86 code as well as Arm code. Some developers, including Hector Martin of the Asahi Linux project and Twitter user @never_released, have already found that these steps can also enable Rosetta on non-Apple ARM CPUs as long as they're modern enough to support at least version 8.2 of the Arm instruction set. As Martin points out, this isn't strictly legal because of macOS's licensing restrictions, and there are some relatively minor Apple-specific hardware features needed to unlock Rosetta's full capabilities.' -- source: https://apple.slashdot.org/story/22/06/07/208222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HTTP/3 Is Officially An IETF Spec
by Lawrence D'Oliveiro 07 Jun '22

07 Jun '22

QUIC is now officially HTTP/3, as described in RFC 9114 <https://www.theregister.com/2022/06/07/http3_rfc_9114_published/>. Not everybody is keen on it: there still seem to be some concerns over privacy, as well as over the claimed performance boost. Actually, a previous spec (RFC9000) had “Proposed Standard” status over a year ago, but it wasn’t (officially) being referred to as “HTTP/3” back then.

1 0

LastPass No Longer Requires a Password To Access Your Vault
by Peter Reutemann 07 Jun '22

07 Jun '22

'LastPass says they're now the first password manager with a passwordless sign-in feature. Engadget reports: Grant permission through the LastPass Authenticator mobile app and you can update account info on the web without entering your master password. The approach relies on FIDO-compliant password-free technology. The feature is available to both personal and business users. LastPass is also promising options beyond the Authenticator app in the future, such as relying on biometric scans or hardware security keys. ' -- source: https://it.slashdot.org/story/22/06/06/2111206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME Shell is Being Ported to Phones
by Peter Reutemann 05 Jun '22

05 Jun '22

'"As part of the design process for what ended up becoming GNOME 40 the design team worked on a number of experimental concepts," reports a blog post at Gnome.org's shell-dev blog, "a few of which were aimed at better support for tablets and other smaller devices." "Ever since then, some of us have been thinking about what it would take to fully port GNOME Shell to a phone form factor." It's an intriguing question because post-GNOME 40, there's not that much missing for GNOME Shell to work on phones, even if not perfectly.... On top of that, many of the things we're currently working towards for desktop are also relevant for mobile, including quick settings, the notifications redesign, and an improved on-screen keyboard. Given all of this synergy, we felt this is a great moment to actually give mobile GNOME Shell a try. Thanks to the Prototype Fund, a grant program supporting public interest software by the German Ministry of Education (BMBF), we've been working on mobile support for GNOME Shell for the past few months. We're not expecting to complete every aspect of making GNOME Shell a daily driveable phone shell as part of this grant project. That would be a much larger effort because it would mean tackling things like calls on the lock screen, PIN code unlock, emergency calls, a flashlight quick toggle, and other small quality-of-life features. However, we think the basics of navigating the shell, launching apps, searching, using the on-screen keyboard, etc. are doable in the context of this project, at least at a prototype stage. Of course, making a detailed roadmap for this kind of effort is hard and we will keep adjusting it as things progress and become more concrete... There's a lot of work ahead, but going forward progress will be faster and more visible because it will be work on the actual UI, rather than on internal APIs. Now that some of the basics are in place we're also excited to do more testing and development on actual phone hardware, which is especially important for tweaking things like the on-screen keyboard. Their blog post includes a video showing "what this currently looks like on laptops" and then one showing it running "on actual phone hardware." And someone has also posted a video on Twitter showing it running on a OnePlus 6 smartphone.' -- source: https://tech.slashdot.org/story/22/06/04/228254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Freeing Up of Hundreds of Millions of IPv4 Addresses Mooted
by Peter Reutemann 03 Jun '22

03 Jun '22

'Work is afoot to free up several internet protocol version 4 (IPv4) address ranges which have been unroutable as reserved, invalid or used for loopback networks since the 1980s. Reader Bismillah shares a report: Seth Schoen, who co-founded the free transport layer security digital certificate provider Let's Encrypt is working on an IPv4 clean-up project that would take address currently not routed on the public Internet, and make them generally usable. Presenting on the IPv4 Unicast Extensions Project at the Asia Pacific Regional Internet Conference on Operational Technologies (APRICOT), Schoen said decisions taken during the 1980s to keep several IPv4 address ranges as "special", has led to a substantial amount of numbering resources going to waste. This "even though the reasons behind the those decisions has not been borne out," Schoen said. Taking the 240/4, 0/8, 127/8, 225/8-232/8 ranges, and making them available as ordinary unicast numbering resources for networks would add some 419 million IPv4 addresses. Due to the rapid growth of the Internet, the number of 32-bit IPv4 addresses has become scarce, with some regional registries being unable to allocate additional blocks to networks. The scarcity has caused IPv4 address hoarding, high prices for sub-allocations and even fraud to get more space.' -- source: https://tech.slashdot.org/story/22/05/31/1958213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 5

Have an old iPad lying around? You might be able to make it run Linux soon
by Peter Reutemann 03 Jun '22

03 Jun '22

'If you have a 2013- or 2014-era iPad sitting around unused because it's not getting updates from Apple anymore and has stopped running the apps you need, some developers are working on an alternative software solution for you. Developer Konrad Dybcio and a Linux enthusiast going by "quaack723" have collaborated to get Linux kernel version 5.18 booting on an old iPad Air 2, a major feat for a device that was designed to never run any operating system other than Apple's. The project appears to use an Alpine Linux-based distribution called "postmarketOS," a relatively small but actively developed distribution made primarily for Android devices. Dybcio used a "checkm8" hashtag in his initial tweet about the project, strongly implying that they used the "Checkm8" bootrom exploit published back in 2019 to access the hardware. For now, the developers only have Linux running on some older iPad hardware using A7 and A8-based chips—this includes the iPad Air, iPad Air 2, and a few generations of iPad mini. But subsequent tweets imply that it will be possible to get Linux up and running on any device with an A7 or A8 in it, including the iPhone 5S and the original HomePod.' -- source: https://arstechnica.com/gadgets/2022/06/developers-get-linux-up-and-running… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AROS One x86 v1.7 and MorphOS 3.17 PPC Released
by Peter Reutemann 02 Jun '22

02 Jun '22

'Version 1.7 of AROS One for x86 has just been released and it's a distro of the "AROS Research Operating System," originally "Amiga Research Operating System." It's a standalone, free and open-source multi-media centric operating system that's designed to be portable, flexible, efficient and lightweight and can be seen dual booting with Windows 10 on an Acer laptop here. The most popular AROS specific community portal is AROS Exec. Parts of AROS were used to create the commercial PowerPC based Amiga-like operating system MorphOS, which has recently seen a new release as well, version 3.17. The most popular MorphOS specific community portal is MorphZone.' -- source: https://tech.slashdot.org/story/22/06/01/218219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Improving Your Relationship With Social Media May Call For A Targeted Approach
by Lawrence D'Oliveiro 02 Jun '22

02 Jun '22

Results of a self-experiment <https://freedom-to-tinker.com/2022/06/01/improving-your-relationship-with-s…> conducted by participants in a social networks course to find ways to improve their relationship with social media. The students split into three groups, each trying a different strategy, with the details left up to them, grouped into targeted limitation of participation in social media, targeted increase (yes, really), or elimination of participation altogether. Targeted increase involved actual posting and interaction with others on particular networks, rather than mere “doom-scrolling”. Two out of the three groups saw clear increases in well-being, and reduction in stress and loneliness. Limitation in use also improved sleep patterns. The strategy that seemed least effective was elimination: seems either limitation in use or more active participation will lead to benefits, not walking away altogether. Of course everybody is different, and as always, more research is needed. But maybe there are some ideas there you can try for yourself.

1 0