- wlug - list.wlug.org.nz

The Dirty Carbon Secret Behind Solid State Memory Drives
by Peter Reutemann 03 Aug '22

03 Aug '22

'Solid state drives use far less power than hard disc drives. But a new study unexpectedly reveals that their lifetime carbon footprint is much higher than their hard disc cousins, raising difficult questions for the computer industry. From a report: The benefits of SSDs over HDDs are legion. They are smaller, mechanically simpler, faster to read and write data than their hard disc cousins. They are also more energy efficient. So with many computer manufacturers and datacenter operators looking to reduce their carbon footprints, it's easy to imagine that all this makes the choice of memory easy. But all is not as it seems, say Swamit Tannu at University of Wisconsin in Madison and Prashant Nair at the University of British Columbia in Vancouver. SSDs have a dirty secret. Tannu and Nair have measured the carbon footprint per gigabyte of these devices across their entire lifetimes and, unexpectedly, it turns out that SSDs are significantly dirtier. "Compared to SSDs, the embodied [carbon] cost of HDDs is at least an order of magnitude lower," say the researchers. Tannu and Nair come to their conclusion by adding up the amount of carbon emitted throughout the estimated 10-year lifespans of these devices. This includes the carbon emitted during manufacture, during operation, for transportation and for disposal. The carbon emitted during operation is straightforward to calculate. To read and write data, HDDs consume 4.2 Watts versus 1.3W for SSDs. The researchers calculate that a 1 terabyte HDD emits the equivalent of 159 kilograms of carbon dioxide during a 10-year operating lifespan. By comparison, a 1 terabyte SSD emits just 49.2 kg over 10 years. But SSDs are significantly more carbon intensive to manufacture. That's because the chip fabrication facilities for SSDs operate at extreme temperatures and pressures that are energy intensive to maintain. And bigger memories require more chips, which increases the footprint accordingly. All this adds up to a significant carbon footprint for SSD manufacture. Tannu and Nair calculate that manufacturing a 1 terabyte SSD emits the equivalent of 320 kg of carbon dioxide. By comparison, a similar HDD emits just 40 kg. So the lifetime footprint for a 1 terabyte SSD is 369.2 kg of carbon dioxide equivalent versus 199 kg for an HDD. So HDDs are much cleaner. That's a counterintuitive result with important implications. At the very least, it suggests that computer manufacturers and cloud data storage operators should reconsider the way they use SSDs and HDDs. For example, almost 40 per cent of the carbon footprint of a desktop computer comes from its SSD, compared to just 4 per cent from the CPU and 11 per cent from the GPU.' -- source: https://hardware.slashdot.org/story/22/08/02/1837229 I wish my drives would last 10 years, neither HDD or SSD seem to last that long... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Releases Linux 5.19 - From an Apple Silicon MacBook
by Peter Reutemann 01 Aug '22

01 Aug '22

'"Linus Torvalds just released Linux 5.19 as stable for the newest version of the Linux kernel..." reports Phoronix. But they also note that on the Linux kernel mailing list, "Torvalds went on to write about his Arm-based MacBook [running an AArch64 Apple M1 SoC]... now under Linux thanks to the work of the Asahi Linux project." Torvalds wrote: [T]he most interesting part here is that I did the release (and am writing this) on an arm64 laptop. It's something I've been waiting for for a _loong_ time, and it's finally reality, thanks to the Asahi team. We've had arm64 hardware around running Linux for a long time, but none of it has really been usable as a development platform until now. It's the third time I'm using Apple hardware for Linux development — I did it many years ago for powerpc development on a ppc970 machine. And then a decade+ ago when the Macbook Air was the only real thin-and-lite around. And now as an arm64 platform. Not that I've used it for any real work, I literally have only been doing test builds and boots and now the actual release tagging. But I'm trying to make sure that the next time I travel, I can travel with this as a laptop and finally dogfooding the arm64 side too. ' -- source: https://apple.slashdot.org/story/22/07/31/2326216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What's New in Linux Mint 21 Cinnamon
by Peter Reutemann 01 Aug '22

01 Aug '22

'Today saw the release of Linux Mint 21 "Vanessa" Cinnamon Edition, a long term support release (supported until 2027). Release notes at LinuxMint.com promise that it comes with "refinements and many new features to make your desktop experience more comfortable." Among the highlights: its Bluetooth manager is now Blueman (instead of Blueberry). Blueberry depended on gnome-bluetooth, which was developed exclusively for GNOME. In contrast, Blueman relies on the standard Bluez stack which works everywhere and can even be used or queried from the command line. The Blueman manager and tray icon provide many features that weren't available in Blueberry and a lot more information which can be used to monitor your connection or troubleshoot Bluetooth issues. Out of the box Blueman features better connectivity, especially when it comes to headsets and audio profiles. In preparation for Linux Mint 21 the Blueman user interface was improved and received support for symbolic icons. Upstream, Blueman and Bluez are actively developed and used in many environments. The lack of thumbnails for some common file types was identified as a usability issue. To address it a new Xapp project called xapp-thumbnailers was started and is now featured in Linux Mint 21. The project brings support for the following mimetypes: - AppImage - ePub - MP3 (album cover) - RAW pictures (most formats) - Webp Automated tasks are great to keep your computer safe but they can sometimes affect the system's performance while you're working on it. A little process monitor was added to Linux Mint to detect automated updates and automated system snapshots running in the background. Whenever an automated task is running the monitor places an icon in your system tray. Your computer might still become slow momentarily during an update or a snapshot, but with a quick look on the tray you'll immediately know what's going on.... Linux Mint 21 uses IPP, also known as Driverless Printing and Scanning (i.e. a standard protocol which communicates with printers/scanners without using drivers). For most printers and scanners no drivers are needed, and the device is detected automatically. And there's also a fabulous collection of new backgrounds.' -- source: https://linux.slashdot.org/story/22/07/31/1922217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next month
by Peter Reutemann 29 Jul '22

29 Jul '22

Hi everyone For next month's meeting (I know, I'm early this time round!), I was thinking of the following topic: Essential command-line tools like find, grep, cat, less/more, bc, head/tail, etc. Rather than just one person demoing tools, I'm thinking more of a joint effort, where everyone can demo one or more tools. Doesn't matter if the same tool comes up more than once. There will be always useful options to hear about! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Costs Of Mobile Data By Country
by Lawrence D'Oliveiro 27 Jul '22

27 Jul '22

Report on a table compiled in the UK <https://www.theregister.com/2022/07/26/mobile_data_survey/>, on comparative mobile data costs in different countries, puts NZ at 210th place out of 233 countries surveyed. We are paying USD6.72 per gigabyte (NZD11.00), with entries lower down going to over USD40, while ones at the top go down to mere cents. Australia is paying about a tenth of what we are.

1 0

Discovery of new UEFI rootkit exposes an ugly truth: The attacks are invisible to us
by Peter Reutemann 27 Jul '22

27 Jul '22

'Researchers have unpacked a major cybersecurity find—a malicious UEFI-based rootkit used in the wild since 2016 to ensure computers remained infected even if an operating system is reinstalled or a hard drive is completely replaced. The firmware compromises the UEFI, the low-level and highly opaque chain of firmware required to boot up nearly every modern computer. As the software that bridges a PC’s device firmware with its operating system, the UEFI—short for Unified Extensible Firmware Interface—is an OS in its own right. It’s located in an SPI-connected flash storage chip soldered onto the computer motherboard, making it difficult to inspect or patch the code. Because it’s the first thing to run when a computer is turned on, it influences the OS, security apps, and all other software that follows. On Monday, researchers from Kaspersky profiled CosmicStrand, the security firm’s name for a sophisticated UEFI rootkit that the company detected and obtained through its antivirus software. The find is among only a handful of such UEFI threats known to have been used in the wild. Until recently, researchers assumed that the technical demands required to develop UEFI malware of this caliber put it out of reach of most threat actors. Now, with Kaspersky attributing CosmicStrand to an unknown Chinese-speaking hacking group with possible ties to cryptominer malware, this type of malware may not be so rare after all. “The most striking aspect of this report is that this UEFI implant seems to have been used in the wild since the end of 2016—long before UEFI attacks started being publicly described,” Kaspersky researchers wrote. “This discovery begs a final question: If this is what the attackers were using back then, what are they using today?” While researchers from fellow security firm Qihoo360 reported on an earlier variant of the rootkit in 2017, Kaspersky and most other Western-based security firms didn’t take notice. Kaspersky’s newer research describes in detail how the rootkit—found in firmware images of some Gigabyte or Asus motherboards—is able to hijack the boot process of infected machines. The technical underpinnings attest to the sophistication of the malware.' -- source: https://arstechnica.com/information-technology/2022/07/researchers-unpack-u… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora Sours On Creative Commons 'No Rights Reserved' License
by Peter Reutemann 27 Jul '22

27 Jul '22

'Fedora, the popular Linux distribution, will no longer incorporate software licensed under CC0, the Creative Commons "No Rights Reserved" license. In order to support the wide re-use of copyrighted content in new works, CC0 provides authors "a way to waive all their copyright and related rights in their works to the fullest extent allowed by law." The license arose in response to the 1998 Sonny Bono Copyright Term Extension Act (CTEA), which extended the duration of copyright by 20 years at the expense of the public domain. But CC0 explicitly says the licensor does not waive patent rights, which for free and open source software (FOSS) is a potential problem. That means, for instance as described here, if you use CC0-licensed code in your project, and the author of that code later claims your project is infringing a patent they own regarding that code, your defense will be limited. Avoiding the use of CC0-licensed code is one way to steer clear of these so-called submarine patents that could years later torpedo you. In a message to The Fedora Project's mailing list for legal issues, Richard Fontana, a technology lawyer for Red Hat (which sponsors Fedora), explained that while CC0 is cited as a "good license," it won't be for much longer. "We plan to classify CC0 as allowed-content only, so that CC0 would no longer be allowed for code," said Fontana. "This is a fairly unusual change and may have an impact on a nontrivial number of Fedora packages (that is not clear to me right now), and we may grant a carveout for existing packages that include CC0-covered code." Fontana said there's a growing consensus in the FOSS community that licenses without any form of patent licensing or forbearance aren't suitable. CC0, he said, like other Creative Commons licenses, includes a clause that explicitly states no patent rights are waived by the licensor.' -- source: https://linux.slashdot.org/story/22/07/26/2028205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Coding Mistake Made Intel GPUs 100X Slower in Ray Tracing
by Peter Reutemann 26 Jul '22

26 Jul '22

'Intel Linux GPU driver developers have released an update that results in a massive 100X boost in ray tracing performance. This is something to be celebrated, of course. However, on the flip side, the driver was 100X slower than it should have been because of a memory allocation oversight. Tom's Hardware reports: Linux-centric news site Phoronix reports that a fix merged into the open-source Intel Mesa Vulkan driver was implemented by Intel Linux graphics driver engineering stalwart Lionel Landwerlin on Thursday. The developer wryly commented that the merge request, which already landed in Mesa 22.2, would deliver "Like a 100x (not joking) improvement." Intel has been working on Vulkan raytracing support since late 2020, but this fix is better late than never. Usually, the Vulkan driver would ensure temporary memory used for Vulkan raytracing work would be in local memory, i.e., the very fast graphics memory onboard the discrete GPU. A line of code was missing, so this memory allocation housekeeping task wasn't set. Thus, the Vulkan driver would shift ray tracing data to slower offboard system memory and back. Think of the continued convoluted transfers to this slower memory taking place, slowing down the raytracing performance significantly. It turns out, as per our headline, that setting a flag for "ANV_BO_ALLOC_LOCAL_MEM" ensured that the VRAM would be used instead, and a 100X performance boost was the result. "Mesa 22.2, which includes the new code, is due to be branched in the coming days and will be included in a bundle of other driver refinements, which should reach end-users by the end of August," adds the report.' -- source: https://tech.slashdot.org/story/22/07/25/2316244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Review: Framework’s next-gen Laptop follows through on its upgradeable promises
by Peter Reutemann 26 Jul '22

26 Jul '22

'It's one thing to say you're making a fully user-serviceable, upgradeable laptop. It's another thing to actually follow through with it. The original Framework Laptop we reviewed last year did a lot of things right. It's easy to open and work on, the ports can be swapped out to suit your needs, and it's sturdy and well-built enough to stand up to traditional, less-upgradeable-and-repairable ultrabooks like Dell's XPS 13 or Lenovo's ThinkPad X1 Carbon. But making "one surprisingly good laptop" isn't the same as creating a laptop ecosystem with upgradeable, interchangeable, user-serviceable parts. To do that, you need to keep up with new component releases. You need to address the shortcomings of your original design (or even release new revisions) without ending support for or breaking compatibility with previous versions of your design. And your small, independent company needs to continue to exist so it can keep getting all that work done, year after year, for a few years. I can't say what the next year or two will bring, but I can say that the second-generation Framework Laptop is still doing almost everything right. It's a lightly revised version of the original chassis designed around a 12th-generation Intel Core CPU rather than an 11th-gen version, and the motherboard exists as a drop-in upgrade for anyone who has already bought a Framework Laptop. The Framework Laptop does have problems, especially when it comes to battery life. But overall, it's a thoughtfully designed computer that treats do-it-yourselfers and PC builders like adults who can make their own decisions. There still isn't another laptop quite like it.' -- source: https://arstechnica.com/gadgets/2022/07/review-frameworks-next-gen-laptop-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting on Monday
by Peter Reutemann 26 Jul '22

26 Jul '22

Hi everyone We have a meeting on Monday with the following topic: 'Open source software is always about choice. Whereas Windows users can't really do much about the desktop experience that gets dictated by Microsoft, Linux users can choose from a wide variety of desktop environments. Tonight, we will explore a range of these: MATE, Cinnamon, Gnome, KDE, LXDE, XFCE and maybe more. If your favorite environment is not listed, then please join in and demo it!' Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776683/ Virtual meeting link: https://bbb2.nzoss.nz/b/pet-w7y-nxe-vxh Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Zero-day used to infect Chrome users could pose threat to Edge and Safari users, too
by Peter Reutemann 22 Jul '22

22 Jul '22

'A secretive seller of cyberattack software recently exploited a previously unknown Chrome vulnerability and two other zero-days in campaigns that covertly infected journalists and other targets with sophisticated spyware, security researchers said. CVE-2022-2294, as the vulnerability is tracked, stems from memory corruption flaws in Web Real-Time Communications, an open-source project that provides JavaScript programming interfaces to enable real-time voice, text, and video communications capabilities between web browsers and devices. Google patched the flaw on July 4 after researchers from security firm Avast privately notified the company it was being exploited in watering hole attacks, which infect targeted websites with malware in hopes of then infecting the users known to frequent them. Microsoft and Apple have since patched the same WebRTC flaw in their Edge and Safari browsers, respectively.' -- source: https://arstechnica.com/information-technology/2022/07/exploit-seller-used-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dell’s XPS 13 Plus Developer Edition gets Ubuntu 22.04 LTS certified
by Peter Reutemann 21 Jul '22

21 Jul '22

'Dell is extending its love for Linux to the Dell XPS 13 Plus. The Developer Edition of the laptop has been Ubuntu 22.04 LTS-certified, Canonical announced today. That means the laptop will be sold starting in August with the latest version of Ubuntu, and owners of the XPS 13 Plus Developer Edition can download Ubuntu 22.04 LTS today (even if they bought it with Windows 11) for guaranteed performance. The XPS 13 Plus Developer Edition is the first 22.04 LTS-certified laptop, joining only some Raspberry Pi devices in certification. However, Dell has been certifying some of its XPS laptops, as well as other machines, for Ubuntu for generations. HP and Lenovo also have Ubuntu-certified systems. Of course, Ubuntu certification means all the components will "work as expected," as Canonical's announcement today put it. Further, Ubuntu LTS certification means the device will have support for at least 10 years. Ubuntu's release cycle page states that LTS (long-term support) releases include 10 years of "Base Package" maintenance and security updates. "Certified devices also include specific software or drivers that differ from the default distribution where required. These are defined in a meta-package that automatically [installs] the optimal configuration of packages, drivers, and kernel to deliver the best experience on that device," Canonical's announcement said.' -- source: https://arstechnica.com/gadgets/2022/07/dells-xps-13-plus-developer-edition… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google, Oracle Cloud Servers Wilt in UK Heatwave, Take Down Websites
by Peter Reutemann 20 Jul '22

20 Jul '22

'Cloud services and servers hosted by Google and Oracle in the UK have dropped offline due to cooling issues as the nation experiences a record-breaking heatwave. From a report: When the mercury hit 40.3C (104.5F) in eastern England, the highest ever registered by a country not used to these conditions, datacenters couldn't take the heat. Selected machines were powered off to avoid long-term damage, causing some resources, services, and virtual machines to became unavailable, taking down unlucky websites and the like. Multiple Oracle Cloud Infrastructure resources are offline, including networking, storage, and compute provided by its servers in the south of UK. Cooling systems were blamed, and techies switched off equipment in a bid to prevent hardware burning out, according to a status update from Team Oracle. "As a result of unseasonal temperatures in the region, a subset of cooling infrastructure within the UK South (London) Data Centre has experienced an issue," Oracle said on Tuesday at 1638 UTC. "As a result some customers may be unable to access or use Oracle Cloud Infrastructure resources hosted in the region.' -- source: https://it.slashdot.org/story/22/07/19/204256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Denmark Bans Chromebooks, Google Workspace In Schools Over Data Transfer Risks
by Peter Reutemann 20 Jul '22

20 Jul '22

'Denmark is effectively banning Google's services in schools, after officials in the municipality of Helsingor were last year ordered to carry out a risk assessment around the processing of personal data by Google. TechCrunch reports: In a verdict published last week, Denmark's data protection agency, Datatilsynet, revealed that data processing involving students using Google's cloud-based Workspace software suite -- which includes Gmail, Google Docs, Calendar and Google Drive -- "does not meet the requirements" of the European Union's GDPR data privacy regulations. Specifically, the authority found that the data processor agreement -- or Google's terms and conditions -- seemingly allow for data to be transferred to other countries for the purpose of providing support, even though the data is ordinarily stored in one of Google's EU data centers. Google's Chromebook laptops, and by extension Google Workspace, are used in schools across Denmark. But Datatilsynet focused specifically on Helsingor for the risk assessment after the municipality reported a "breach of personal data security" back in 2020. While this latest ruling technically only applies to schools in Helsingor for now, Datatilsynet notes that many of the conclusions it has reached will "probably apply to other municipalities" that use Google Chromebooks and Workspace. It added that it expects these other municipalities "to take relevant steps" off the back of the decision it reached in Helsingor. The ban is effective immediately, but Helsingor has until August 3 to delete user data. A Google spokesperson told TechCrunch in a statement: "We know that students and schools expect the technology they use to be legally compliant, responsible, and safe. That's why for years, Google has invested in privacy best practices and diligent risk assessments, and made our documentation widely available so anyone can see how we help organizations to comply with the GDPR. Schools own their own data. We only process their data in accordance with our contracts with them. In Workspace for Education, students' data is never used for advertising or other commercial purposes. Independent organizations have audited our services, and we keep our practices under constant review to maintain the highest possible standards of safety and compliance."' -- source: https://news.slashdot.org/story/22/07/18/2059204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Disentangling The Debian Derivatives: Which Should You Use?
by Lawrence D'Oliveiro 19 Jul '22

19 Jul '22

Intro to just a few <https://www.theregister.com/2022/07/18/disentangling_the_debian_derivatives/> members of the sprawling family of Debian derivatives. I think one of the reasons it has spawned so many offshoots is because the maintainers have made a point of ensuring the tools they use to create the distro itself are easy to use, adapt and configure, not just for themselves, but for others, too.

1 0

Servers running Digium Phones VoiP software are getting backdoored
by Peter Reutemann 19 Jul '22

19 Jul '22

'Servers running the open source Asterisk communication software for Digium VoiP services are under attack by hackers who are managing to commandeer the machines to install web shell interfaces that give the attackers covert control, researchers have reported. Researchers from security firm Palo Alto Networks said they suspect the hackers are gaining access to the on-premises servers by exploiting CVE-2021-45461. The critical remote code-execution flaw was discovered as a zero-day vulnerability late last year, when it was being exploited to execute malicious code on servers running fully updated versions of Rest Phone Apps, aka restapps, which is a VoiP package sold by a company called Sangoma. The vulnerability resides in FreePBX, the world's most widely used open source software for Internet-based Private Branch Exchange systems, which enable internal and external communications in organizations' private internal telephone networks. CVE-2021-45461 carries a severity rating of 9.8 out of 10 and allows hackers to execute malicious code that takes complete control of servers.' -- source: https://arstechnica.com/information-technology/2022/07/servers-running-digi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Apple’s Windows 10
by Lawrence D'Oliveiro 19 Jul '22

19 Jul '22

Fred Brooks predicted long ago that complex pieces of software would eventually reach the point of irreducible entropy, where any attempt to fix a bug would simply introduce a new one. Microsoft’s Windows 10 seems to be about there, and it’s now clear that Apple’s macOS 10.15 “Catalina” has also joined that elite group <https://www.theregister.co.uk/2020/05/27/apple_catalina_update/>: The first spin of Catalina, officially released in October 2019, was a mess. ... The biggest issue was that all kinds of apps simply stopped working. ... Peripherals like mice, keyboards and printers stopped working. Email went missing; iCloud backups failed; users were constantly harassed by login requests; updates didn’t update ... ... So came for the first update to its new system one week after the main launch which fixed some, but not all, of the issues. ... Version two came in December 2019 and fixed some of those issues, but not all. ... More bug fixes came with version three in January 2020, but the OS seemed to have finally stabilized; something that was then spectacularly undone with version .4. ... Then we had the “supplemental update” to version 10.15.4, which fixed some, but not all, of the problems – most significantly the problem with Finder and transferring large files. And, amazingly, appeared to undo the good work that had been done with website security and broke SSH for some users. But now, with version point-five this week, that problem appears to have been sorted and, of course, your battery might last longer too.

1 1

Linux distro for Apple silicon Macs is already up and running on the brand-new M2
by Peter Reutemann 19 Jul '22

19 Jul '22

'Unlike Intel Macs, Apple silicon Macs were designed to run only Apple's software. But the developers on the Asahi Linux team have been working to change that, painstakingly reverse-engineering support for Apple's processors and other Mac hardware and releasing it as a work-in-progress distro that can actually boot up and run on bare metal, no virtualization required. The Asahi Linux team put out a new release today with plenty of additions and improvements. Most notably, the distro now supports the M1 Ultra and the Mac Studio and has added preliminary support for the M2 MacBook Pro (which has been tested firsthand by the team) and the M2 MacBook Air (which hasn't been tested but ought to work). Preliminary Bluetooth support for all Apple silicon Macs has also been added, though the team notes that it works poorly when connected to a 2.4GHz Wi-Fi network because "Wi-Fi/Bluetooth coexistence isn't properly configured yet." There are still many other things that aren't working properly, including the USB-A ports on the Studio, faster-than-USB-2.0 speeds from any Type-C/Thunderbolt ports, and GPU acceleration, but progress is being made on all of those fronts. GPU work in particular is coming along, with a "prototype driver" that is "good enough to run real graphics applications and benchmarks" already up and running, though it's not included in this release.' -- source: https://arstechnica.com/gadgets/2022/07/linux-distro-for-apple-silicon-macs… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In Defence Of Swap: Common Misconceptions
by Lawrence D'Oliveiro 19 Jul '22

19 Jul '22

Came across this page <https://chrisdown.name/2018/01/02/in-defence-of-swap.html>, which gives an overview of the point of swap space. Some people (including myself) think “we have so much RAM on our systems nowadays, why bother allocating any swap space at all?” But really it’s more than just an overflow area for when you run out of RAM, it is a basis for more efficiently managing that RAM, no matter how much you might have. Actually I found the above linked from this <https://www.freedesktop.org/software/systemd/man/systemd-oomd.service.html> manual page on systemd-oomd. This service (available via an additional package on Debian) tries to take corrective action when the system starts running low on memory, before things get bad enough to wake up the kernel’s dreaded “OOM-killer”.

1 0

topic for next Monday?
by Peter Reutemann 19 Jul '22

19 Jul '22

Hi everyone We have a meeting coming up next Monday, but no topic/speaker at this stage. Any suggestions/volunteers? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Report: Facebook has Started Encrypting Links to Counter Browsers' Anti-Tracking Measures
by Peter Reutemann 19 Jul '22

19 Jul '22

'"Facebook has started to use a different URL scheme for site links," writes the technology blog Ghacks, "to combat URL stripping technologies that browsers such as Firefox or Brave use to improve privacy and prevent user tracking." Some sites, including Facebook, add parameters to the web address for tracking purposes. These parameters have no functionality that is relevant to the user, but sites rely on them to track users across pages and properties. Mozilla introduced support for URL stripping in Firefox 102, which it launched in June 2022. Firefox removes tracking parameters from web addresses automatically, but only in private browsing mode or when the browser's Tracking Protection feature is set to strict. Firefox users may enable URL stripping in all Firefox modes, but this requires manual configuration. Brave Browser strips known tracking parameters from web addresses as well.... It is no longer possible to remove the tracking part of the URL, as Facebook merged it with part of the required web address.' -- source: https://tech.slashdot.org/story/22/07/18/0433238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can a Fork Save Cutefish OS (or Its Desktop)?
by Peter Reutemann 18 Jul '22

18 Jul '22

'In April ZDNet called its beta "the cutest Linux distro you'll ever use," praising the polished "incredible elegance" of Debian-based Cutefish OS, with its uncluttered, MacOS-like "Cutefish DE" desktop. But now CutefishOS.com times out, with at least one Reddit user complaining "their email is not responding" and seeking contributors for a fork. But meanwhile, the technology site DebugPoint.com shares another update: It looks like the OpenMandriva project is already continuing with the development of the Cutefish DE (not the OS) for its own OS. For more details, visit the Matrix discussion page. Besides, it's worth mentioning that Arch Linux already have the Cutefish desktop packages in the community repo. You can even install it as a standalone desktop environment in Arch Linux with easy steps. As you can see, it is easier to maintain the desktop environment to continue its development because the structure is already out there. I have tested and reviewed hundreds of distros for years, and Cutefish OS is the promising one with its stunning desktop environment. It was written from the ground up with QML and C++ and took advantage of KWin. It would have been an attractive desktop as a separate component and could have been another great option besides KDE Plasma or GNOME. Many open-source projects are born and die every year, and it's unfortunate to see the situation of Cutefish OS. I hope an official fork comes up soon, and we all can contribute to it.' -- source: https://linux.slashdot.org/story/22/07/17/0143210 It's been a while to see another desktop environment in action. Anyone keen presenting Cutefish DE next Monday? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google says you can now turn these 400 Macs, PCs into reliable Chromebooks
by Peter Reutemann 18 Jul '22

18 Jul '22

'Google today announced in a blog post that ChromeOS Flex, a version of its Chromebook operating system suitable for most hardware, has moved from early access to general availability. It also said it certified "over 400" devices, including systems from Apple, Dell, and HP, to run the OS smoothly and stably. Google announced ChromeOS Flex in February, building upon its 2020 acquisition of CloudReady (CloudReady becomes ChromeOS Flex now that the latter is stable). Cloud OS Flex is downloadable to a USB drive for free, allowing you to install it on a Mac or Windows PC. The most obvious use for ChromeOS Flex is to bring new life to a dated machine that may be too old to get software updates for its native OS. Our ChromeOS Flex beta review found the OS to be an interesting alternative for people content with doing most of their computing in a browser and for getting a budget-level Chromebook experience from an 8-to 9-year-old system.' -- source: https://arstechnica.com/gadgets/2022/07/google-says-you-can-now-turn-these-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 13 marches toward release with final beta version
by Peter Reutemann 18 Jul '22

18 Jul '22

'Google is quickly marching toward the next release of Android. The company announced the "final" Android 13 beta yesterday, beta 4, with word that an official release is "coming in the weeks ahead." After the massive overhaul of Android 12, Android 13 seems to be a smaller release focusing on various improvements and tablet features. A lot of Android 13 is building on the work from Android 12 and the tablet-focused mini-release, Android 12L. There are more Material You color options and more tweaks to the new notification media player. The tablet interface has a new app-drawer button for the taskbar and split-screen drag-and-drop support for notifications. You get more control over apps with a foreground app task manager and a new permission that requires apps to ask for notification access. Under the hood there is some serious virtualization power and support for Bluetooth LE Audio. There's even finally a standard QR Code reader now.' -- source: https://arstechnica.com/gadgets/2022/07/android-13-marches-toward-release-w… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

techradar: "I've started using Mozilla Firefox and now I can never go back to Google Chrome"
by Peter Reutemann 18 Jul '22

18 Jul '22

'The year is 2008 and I had been using Mozilla Firefox for two years after my painful but inevitable breakup with Internet Explorer. But, out of school and professional necessity, I had to make the switch to Google Chrome. For the most part, it worked out for me. It had features that Firefox at the time didn’t, like being able to sync and access tabs from other devices or saving all my bookmarks under a single profile that I could transfer to other PCs. Then over the years, Google became more invasive. It, like many other major corporations, started tracking and compiling data and creating detailed profiles that it could sell to marketing firms. Lucrative business for them, but a nail in the coffin for internet privacy. The other nail is the fact that Chrome’s market share has absolutely skyrocketed during this period of time. Back in 2008 when I first made the switch, Google and Mozilla weren’t too far apart but now, thanks to most other browsers using some form of Chromium to power them, the gap might as well be an ocean. But I’m here to tell you that it doesn’t have to be that way. I finally switched back to Mozilla Firefox in 2019 and found it to be an incredible browser that had every feature Chrome had and more.' -- source: https://www.techradar.com/in/features/ive-started-using-mozilla-firefox-and… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Microsoft Screws Up Linux
by Lawrence D'Oliveiro 17 Jul '22

17 Jul '22

Remember that version 1.0 of WSL (“Windows Services for Linux”) tried to emulate Linux APIs on top of the Windows kernel, but that turned out to be impossible to get right. (Why not? Windows kernel not functional enough?) So WSL 2.0 abandoned this approach, to bring in a true-blue Linux kernel running under a cut-down version of Microsoft’s Hyper-V virtualization system. Problem solved, right? You’d think having an actual Linux kernel would be sufficient to implement actual Linux APIs. And so Microsoft can offer regular Linux distros like Ubuntu to run on Windows, under WSL. But it turns out WSL actually relies on a specially-patched Microsoft version of the Linux kernel. So you can’t just take any old Linux distro and install it. Which is why you only have the option of distros specially packaged for the Microsoft Store. Furthermore, this special WSL kernel has some bugs in it that a regular Linux kernel does not. I discovered this while browsing through the open-issues list for libffi <https://github.com/libffi/libffi>. This library offers a “foreign-function interface”, which high-level languages can use to call functions written in C. For example, this library is the basis of Python’s ever-handy ctypes module. Look at this issue <https://github.com/libffi/libffi/issues/552>, where the script for building libffi fails under WSL. One participant has narrowed the problem down to this: The following shell script which performs the issued part in a generated configure file is as follows: #!/bin/bash exec 5>>my.log { touch my.log mkdir -p workdir cd workdir test -f ../my.log && mv ../my.log . stat my.log } On a Linux system single partition, the stat call will show expected data. In a WSL environment on an NTFS mount, the call will fail. The only real subtlety is that the enclosing block has a file open for writing that the code inside the block is moving to a different directory. But all this has perfectly-defined behaviour according to the POSIX spec. This applies even if the destination directory is on a separate filesystem, so that the “mv” command has to turn the rename into a copy-then-delete. I tried that script on my genuine Linux system, with and without “workdir” being a separate filesystem. I even tried formatting the separate filesystem as an NTFS volume. The code worked fine in all cases. So what’s going wrong? It could be the age-old Windows bugbear, where you cannot access a file that has already been opened somewhere else, because it is “locked”. Somehow Microsoft has transplanted this limitation into its own version of the Linux kernel. This may be a “feature” under Windows, but it is no longer conforming to POSIX filesystem semantics!

1 0

Network Un-Neutrality Coming To Europe?
by Lawrence D'Oliveiro 14 Jul '22

14 Jul '22

Seems some ISPs are lobbying the European Commission to allow them to charge fees to companies such as Google, Meta and Netflix for providing their content to the ISPs’ paying customers <https://arstechnica.com/tech-policy/2022/07/eu-lawmakers-slam-idea-of-forci…>. Because the ISPs aren’t already charging their customers enough? They claim that the big content providers are somehow getting a “free ride” (even though they have to pay for their own Internet connections)? Our previous discussion about the consequences of such policies: <https://list.waikato.ac.nz/hyperkitty/list/wlug(a)list.waikato.ac.nz/thread…> (Seems the list archive was moved to a different system at some point, invalidating all previous archive links.)

1 0

X.Org Server Hit By New Local Privilege Escalation, Remote Code Execution Vulnerabilities
by Peter Reutemann 13 Jul '22

13 Jul '22

'Getting things started for this "Patch Tuesday" are the disclosure of two new X.Org Server vulnerabilities. Phoronix reports: These issues affecting out-of-bounds accesses with the X.Org Server can lead to local privilege elevation on systems where the X.Org Server is running privileged and remote code execution for SSH X forwarding sessions. CVE-2022-2319 and CVE-2022-2320 were made public this morning and both deal with the X.Org Server's Xkb keyboard extension not properly validating input that could lead to out-of-bounds memory writes. Fixes for these XKB vulnerabilities have been patched in X.Org Server Git and xorg-server 21.1.4 point release is expected soon with these fixes. Both vulnerabilities were discovered by Trend Micro's Zero Day Initiative. ' -- source: https://it.slashdot.org/story/22/07/12/2012211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Working Speculative Execution Attack Sends Intel and AMD Scrambling
by Peter Reutemann 13 Jul '22

13 Jul '22

'Some microprocessors from Intel and AMD are vulnerable to a newly discovered speculative execution attack that can covertly leak password data and other sensitive material, sending both chipmakers scrambling once again to contain what is proving to be a stubbornly persistent vulnerability. Ars Technica reports: Researchers from ETH Zurich have named their attack Retbleed because it exploits a software defense known as retpoline, which was introduced in 2018 to mitigate the harmful effects of speculative execution attacks. Speculative execution attacks, also known as Spectre, exploit the fact that when modern CPUs encounter a direct or indirect instruction branch, they predict the address for the next instruction they're about to receive and automatically execute it before the prediction is confirmed. Spectre works by tricking the CPU into executing an instruction that accesses sensitive data in memory that would normally be off-limits to a low-privileged application. Retbleed then extracts the data after the operation is canceled. [...] The ETH Zurich researchers have conclusively shown that retpoline is insufficient for preventing speculative execution attacks. Their Retbleed proof-of-concept works against Intel CPUs with the Kaby Lake and Coffee Lake microarchitectures and AMD Zen 1, Zen 1+, and Zen 2 microarchitectures. In response to the research, both Intel and AMD advised customers to adopt new mitigations that the researchers said will add as much as 28 percent more overhead to operations. [...] Both Intel and AMD have responded with advisories. Intel has confirmed that the vulnerability exists on Skylake-generation processors that don't have a protection known as enhanced Indirect Branch Restricted Speculation (eIBRS) in place. "Intel has worked with the Linux community and VMM vendors to provide customers with software mitigation guidance which should be available on or around today's public disclosure date," Intel wrote in a blog post. "Note that Windows systems are not affected given that these systems use Indirect Branch Restricted Speculation (IBRS) by default which is also the mitigation being made available to Linux users. Intel is not aware of this issue being exploited outside of a controlled lab environment." AMD, meanwhile, has also published guidance. "As part of its ongoing work to identify and respond to new potential security vulnerabilities, AMD is recommending software suppliers consider taking additional steps to help guard against Spectre-like attacks," a spokesman wrote in an email. The company has also published a whitepaper. [Research Kaveh Razavi added:] "Retbleed is more than just a retpoline bypass on Intel, specially on AMD machines. AMD is in fact going to release a white paper introducing Branch Type Confusion based on Retbleed. Essentially, Retbleed is making AMD CPUs confuse return instructions with indirect branches. This makes exploitation of returns very trivial on AMD CPUs." The mitigations will come at a cost that the researchers measured to be between 12 percent and 28 percent more computational overhead. Organizations that rely on affected CPUs should carefully read the publications from the researchers, Intel, and AMD and be sure to follow the mitigation guidance.' -- source: https://hardware.slashdot.org/story/22/07/12/2052224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lenovo are now shipping (some) laptops that only boot Windows by default
by Eliot Blennerhassett 13 Jul '22

13 Jul '22

"Starting in 2022 for Secured-core PCs it is a Microsoft requirement for the 3rd Party Certificate to be disabled by default. The apparent secured-core requirement for 2022 is that the second of these CAs should not be trusted by default. As a result, drivers or bootloaders signed with this certificate will not run on these systems. This means that, out of the box, these systems will not boot anything other than Windows[1]." https://mjg59.dreamwidth.org/60248.html ... are we surprised? -- Eliot

2 1

Two-Factor Authentication Doesn’t Help Against Phishing Attacks
by Lawrence D'Oliveiro 13 Jul '22

13 Jul '22

This article <https://arstechnica.com/information-technology/2022/07/microsoft-details-ph…> points out that using a second authentication factor cannot really guard against “man-in-the-middle” attacks. If the fake site is passing on your credentials to carry out a logon to the real site, then it can also pass on any extra authentication factors that are coming through alternative channels: One of the few visually suspicious elements in the scam is the domain name used in the proxy site landing page. Still, given the opaqueness of most organization-specific login pages, even the sketchy domain name might not be a dead giveaway. Too often, it seems, this use of obscure login URLs neuters the effectiveness of the only real clue that the user might have to a phishing attack. My own insurance company is doing this sort of thing. They send me a renewal reminder e-mail, and all the links in it go through some online Adobe-run service for tracking the clicks. (Why can it not go through their own domain name, at least?) I told them about it last year and again this year: this year I finally got a response asking me to send them the offending message, which I did.

1 0

Rentware Comes To Cars
by Lawrence D'Oliveiro 13 Jul '22

13 Jul '22

Korean BMW owners can now pay a monthly fee to activate features in their cars such as heated seats, automatic high-beam switching, or being able to save video from the car’s cameras <https://www.theregister.com/2022/07/12/bmw_locks_korean_car_owners/>. Customers have expressed their dislike of this idea, which means you can expect to see it spread more widely.

1 0

Microsoft Resorts To Registry Hack To Keep Outlook From Using Windows 11 Search
by Lawrence D'Oliveiro 12 Jul '22

12 Jul '22

The catalogue of sadness here <https://www.theregister.com/2022/07/11/outlook_search/> just goes on: The indexing service is infamously fragile ... A temporary workaround is to simply switch off Windows Desktop Search to force Outlook to use its built-in service. Users that choose this option will be warned that Search will be impacted because a group policy has turned off the Windows Search service, but let's face it, less-than-slick performance has long been a hallmark of the Windows Search services. ... Windows Search has long blighted Microsoft's flagship operating system, and behind the scenes Windows Search continues to cause grief for some.

1 0

Hackers Uncover Ways To Unlock and Start Nearly All Modern Honda-Branded Vehicles
by Peter Reutemann 12 Jul '22

12 Jul '22

'The Drive: Hackers have uncovered ways to unlock and start nearly all modern Honda-branded vehicles by wirelessly stealing codes from an owner's key fob. Dubbed "Rolling Pwn," the attack allows any individual to "eavesdrop" on a remote key fob from nearly 100 feet away and reuse them later to unlock or start a vehicle in the future without owner's knowledge. Despite Honda's dispute that the technology in its key fobs "would not allow the vulnerability," The Drive has independently confirmed the validity of the attack with its own demonstration. Older vehicles used static codes for keyless entry. These static codes are inherently vulnerable, as any individual can capture and replay them at will to lock and unlock a vehicle. Manufacturers later introduced rolling codes to improve vehicle security. Rolling codes work by using a Pseudorandom Number Generator (PRNG). When a lock or unlock button is pressed on a paired key fob, the fob sends a unique code wirelessly to the vehicle encapsulated within the message. The vehicle then checks the code sent to it against its internal database of valid PRNG-generated codes, and if the code is valid, the car grants the request to lock, unlock, or start the vehicle. The database contains several allowed codes, as a key fob may not be in range of a vehicle when a button is pressed and may transmit a different code than what the vehicle is expecting to be next chronologically. This series of codes is also known as a "window," When a vehicle receives a newer code, it typically invalidates all previous codes to protect against replay attacks. This attack works by eavesdropping on a paired keyfob and capturing several codes sent by the fob. The attacker can later replay a sequence of valid codes and re-sync the PRNG. This allows the attacker to re-use older codes that would normally be invalid, even months after the codes have been captured. [...] Contrary to Honda's claim, I independently confirmed the vulnerability by capturing and replaying a sequence of lock and unlock requests with my 2021 Honda Accord and a Software-Defined Radio. Despite being able to start and unlock the car, the vulnerability doesn't allow the attacker to actually drive off with the vehicle due to the proximity functionality of the key fob. However, the fact that a bad actor can get this far is already a bad sign. At this time, the following vehicles may be affected by the vulnerability: 2012 Honda Civic, 2018 Honda X-RV, 2020 Honda C-RV, 2020 Honda Accord, 2021 Honda Accord, 2020 Honda Odyssey, 2021 Honda Inspire, 2022 Honda Fit, 2022 Honda Civic, 2022 Honda VE-1, and 2022 Honda Breeze. It's not yet clear if this affects any Acura-branded vehicles. "[W]e've looked into past similar allegations and found them to lack substance," said a Honda spokesperson in a statement to The Drive. "While we don't yet have enough information to determine if this report is credible, the key fobs in the referenced vehicles are equipped with rolling code technology that would not allow the vulnerability as represented in the report. In addition, the videos offered as evidence of the absence of rolling code do not include sufficient evidence to support the claims."' -- source: https://tech.slashdot.org/story/22/07/11/2023254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Toward a Future We Want to Live In' - EFF Celebrates 32nd Birthday
by Peter Reutemann 11 Jul '22

11 Jul '22

'"Today at the Electronic Frontier Foundation, we're celebrating 32 years of fighting for technology users around the world," reads a new announcement posted at EFF.org: If you were online back in the 90s, you might remember that it was pretty wild. We had bulletin boards, FTP, Gopher, and, a few years later, homespun websites. You could glimpse a future where anyone, anywhere in the world could access information, float new ideas, and reach each other across vast distances. It was exciting and the possibilities seemed endless. But the founders of EFF also knew that a better future wasn't automatic. You don't organize a team of lawyers, technologists, and activists because you think technology will magically fix everything — you do it because you expect a fight. Three decades later, thanks to those battles, the internet does much of what it promised: it connects and lifts up major grassroots movements for equity, civil liberties, and human rights and allows people to connect and organize to counteract the ugliness of the world. But we haven't yet won that future we envisioned. Just as the web connects us, it also serves as a hunting ground for those who want to surveil and control our actions, those who wish to harass and spread hate, as well as others who seek to monetize our every move and thought. Information collected for one purpose is freely repurposed in ways that oppress us, rather than lift us up. The truth is that digital tools allow those with horrible ideas to connect with each other just as it does those with beautiful, healing ones. EFF has always seen both the beauty and destructive potential of the internet, and we've always put our marker down on the side of justice, freedom, and innovation. We work every day toward a future we want to live in, and we don't do it alone. Support from the public makes every one of EFF's activism campaigns, software projects, and court filings possible. Together, we anchor the movement for a better digital world, and ensure that technology supports freedom, justice, and innovation for all people of the world. In fact, I invite every digital freedom supporter to join EFF during our summer membership drive. Right now, you can be a member for as little as $20, get some special new gear, and ensure that tech users always have a formidable defender in EFF. So how does the EFF team celebrate this auspicious anniversary? EFF does what it does best: stand up for users and innovators in the courts, in the halls of power, in the public conversation. We build privacy-protecting tools, teach skills to community members, share knowledge with allies, and preserve the best aspects of the wild web. In other words, we use every tool in our deep arsenal to fight for a better and brighter digital future for all. Thank you for standing with EFF when it counts.' -- source: https://yro.slashdot.org/story/22/07/10/199234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Six Ground-Breaking New Linux Laptops Released in the Last Two Weeks
by Peter Reutemann 11 Jul '22

11 Jul '22

'In the last two weeks six new Linux laptops have hit the market (or were announced). "The Linux hardware scene is getting better by the day," writes the site FOSS Weekly: - Star Labs teases its new StarFighter Linux Laptop with a 4K (10-bit IPS) display. - MNT Research introduces a "more affordable" 7-inch mini Linux laptop, the MNT Pocket Reform. - KDE's Slimbook 4 is here with AMD Ryzen 7 5700U processor and a better battery, starting from $1,000. "Buying from Slimbook supports KDE development too," notes Gaming on Linux, adding that there's a choice of 14 or 15.6 inch displays. - TUXEDO's Pulse 15 — Gen2 (also with an AMD Ryzen 7 5700U processor) has a 15-inch HiDPI WQHD 165Hz display, along with eight cores and 16 threads. (And the Register notes its twin cooling fans, "allowing them to overclock the chip and run it at 35W," and a choice of distros.) - Pre-orders have opened for the Roma — the first RISC-V Laptop (which may ship in September). Ars Technica reports they're offering "free Silicon upgrades" — that is free system-on-a-chip and system-on-module upgrades for its quad-core RISC-V CPU. And there's also a companion NPU/GPU, notes a blog post at RISCV.org, "for the fastest, seamless RISC-V native software development available." (As well as "early access to next-generation laptop and accessory upgrades at generous discounts or for free.") The blog post calls it a "Web3-friendly platform with NFT creation and publication plus integrated MetaMask-style wallet." - System 76's "Lemur" Alder Lake- and coreboot-powered laptop arrives with 14 hours of battery life.' -- source: https://linux.slashdot.org/story/22/07/10/2019230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Will Microsoft Ban Commercial Open Source from Its App Store?
by Peter Reutemann 10 Jul '22

10 Jul '22

'Microsoft has "delayed enforcement" of what could be a controversial policy change, according to the Software Freedom Conservancy: A few weeks ago, Microsoft quietly updated its Microsoft [app] Store Policies, adding new policies (which go into effect next week), that include this text: all pricing ... must ... [n]ot attempt to profit from open-source or other software that is otherwise generally available for free [meaning, in price, not freedom]. Wednesday, a number of Microsoft Store users discovered this and started asking questions. Quickly, those of us (including our own organization) that provide Free and Open Source Software (FOSS) via the Microsoft Store started asking our own questions too.... Since all (legitimate) FOSS is already available (at least in source code form) somewhere "for free" (as in "free beer"), this term (when enacted) will apply to all FOSS... Sadly, these days, companies like Microsoft have set up these app stores as gatekeepers of the software industry. The primary way that commercial software distributors reach their customers (or non-profit software distributors reach their donors) is via app stores. Microsoft has closed its iron grasp on the distribution chain of software (again) — to squeeze FOSS from the marketplace. If successful, even app store users will come to believe that the only legitimate FOSS is non-commercial FOSS. This is first and foremost an affront to all efforts to make a living writing open source software. This is not a merely hypothetical consideration. Already many developers support their FOSS development (legitimately so, at least under the FOSS licenses themselves) through app store deployments that Microsoft recently forbid in their Store.... Microsoft counter-argues that this is about curating content for customers and/or limiting FOSS selling to the (mythical) "One True Developer". But, even a redrafted policy (that Giorgio Sardo [General Manager of Apps at Microsoft] hinted at publicly early Thursday) will mandate only toxic business models for FOSS (such as demo-ware, less-featureful versions available as FOSS, while the full-featured proprietary version is available for a charge). The Conservancy argues that FOSS "was designed specifically to allow both the original developers and downstream redistributors to profit fairly from the act of convenient redistribution (such as on app stores)." But it also speculates about the sincerity of Microsoft's intentions. "We're cognizant that Microsoft probably planned all this, anyway — including the community outrage followed by their usual political theater of feigned magnanimity." The Conservancy's post Thursday received an update Friday about Microsoft's coming policy update: After we and others pointed out this problem, a Microsoft employee claimed via Twitter that they would "delay enforcement" of their new anti-FOSS regulation [giving as their reason that "it could be perceived differently than intended."] We do hope Microsoft will ultimately rectify the matter, and look forward to the change they intend to enact later. Twitter is a reasonable place to promote such a change once it's made, but an indication of non-enforcement by one executive on their personal account is a suboptimal approach. This is a precarious situation for FOSS projects who currently raise funds on the Microsoft Store; they deserve a definitive answer. Given the tight timetable (just five days!) until the problematic policy actually does go into effect, we call on Microsoft to officially publish a corrected policy now that addresses this point and move the roll-out date at least two months into the future. (We suggest September 16, 2022.) This will allow FOSS projects to digest the new policy with a reasonable amount of time, and give Microsoft time to receive feedback from the impacted projects and FOSS experts.' -- source: https://news.slashdot.org/story/22/07/09/0247213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Untrusted MS Office Macros Are Here Again
by Lawrence D'Oliveiro 09 Jul '22

09 Jul '22

Back in February, Microsoft restricted the execution of macros in Office, so that ones that came from Internet sources were disabled by default. Previously, such execution could be enabled by a single click on a button in the warning banner, but this button was taken away. Now this single-click execution enabler is back <https://arstechnica.com/information-technology/2022/07/microsoft-makes-majo…>. Clearly it broke too many existing users’ workflows, as insecure as they were. Naturally, most security experts are not happy. Though some accept that customers need more time to adjust to a stricter regime.

1 0

Microsoft's xCloud Game Streaming Looks Worse On Linux Than Windows
by Peter Reutemann 07 Jul '22

07 Jul '22

'As noted by a Reddit user and confirmed by Ars Technica, Microsoft's xCloud game streaming looks noticeable worse when running on Linux than Windows. From the report: With the Linux User-Agent, edges are generally less sharp and colors are a little more washed out. The difference is even more apparent if you zoom in on the Forza logo and menu text, which shows a significant reduction in clarity. Interestingly, the dip in quality seems to go away if you enable "Clarity Boost, an Edge-exclusive feature that "provid[es] the optimal look and feel while playing Xbox games from the cloud," according to Microsoft. That's great for Linux users who switched over to Microsoft Edge when it launched on Linux last November. But Linux users who stick with Firefox, Chrome, or other browsers are currently stuck with apparently reduced streaming quality. That Linux quality dip has led some to speculate that Microsoft is trying to reserve the best xCloud streaming performance for Windows machines in an attempt to attract more users to its own operating system. But using a Macintosh User-Agent string provides streaming performance similar to that on Windows, which would seem to be a big omission if that theory were true. Microsoft also hasn't published any kind of "best on Windows"-style marketing in promoting xCloud streaming, which would seemingly be a key component of trying to attract new Windows users. (The quality difference could be a roundabout attempt to get Linux users to switch to the Edge browser, where Clarity Boost offers the best possible quality. But that still wouldn't fully explain why Windows users on other browsers, without Clarity Boost, also get better streaming quality than their Linux brethren.) Others have suggested that the downgrade could simply be a bug caused by Microsoft's naive parsing of the User-Agent strings. That's because the User-Agent strings for Android browsers generally identify themselves as some version of Linux ("Linux; Android 11; HD1905," for example). Microsoft's xCloud code might simply see the "Linux" in that string, assume the user is running Android, then automatically throttle the streaming quality to account for the (presumably) reduced screen size of an Android phone or tablet. ' -- source: https://games.slashdot.org/story/22/07/06/2040206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Systemd Creator Lands At Microsoft
by Peter Reutemann 07 Jul '22

07 Jul '22

'Yesterday, Phoronix reported that the lead developer of systemd, Lennart Poettering, left Red Hat. "It turns out he had joined Microsoft and [is] continuing his work on systemd," writes Phoronix's Michael Larabel in a new report. He continues: While some may not always align with his views or approaches to handling some things, there is no overstating his enormous contributions to the Linux/open-source world and his dedication to advancing the ecosystem over the years. This may take many by surprise but let's not forget Microsoft has over time employed a number of Linux developers and other prominent open-source developers... Microsoft currently employs Python creator Guido van Rossum, GNOME creator Miguel de Icaza had been employed by Microsoft from 2016 when they acquired Xamarin to earlier this year when he left, Nat Friedman as part of Xamarin-Microsoft served as GitHub CEO following Microsoft's acquisition, Gentoo Linux founder Daniel Robbins was previously employed by Microsoft, Steve French as the Linux CIFS/SMB2/SMB3 maintainer and Samba team member works for Microsoft, and Microsoft employs/previously-employed a large number of upstream Linux developers like Matteo Croce, Matthew Wilcox, Shyam Prasad N, Michael Kelley, and many others beyond just the usual immediately recognizable names to Linux enthusiasts/developers. It was also just earlier this year that Christian Brauner as another longtime Linux kernel developer joined Microsoft. Christian Brauner is Berlin-based like Lennart and moved on to Microsoft after the past half-decade at Canonical working on the Linux kernel, LXC, systemd, and more. ' -- source: https://linux.slashdot.org/story/22/07/06/2348255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PulseAudio and Systemd Creator, Lennart Poettering, Reportedly Leaves Red Hat
by Peter Reutemann 06 Jul '22

06 Jul '22

'To much surprise, the lead developer of systemd Lennart Poettering who also led the creation of PulseAudio, Avahi, and has been a prolific free software contributor has reportedly left Red Hat. Michael Larabel writes via Phoronix: So far no public announcement appears to have been made, but according to a source has been reportedly removed from Red Hat's internal employee database. Yesterday Lennart did comment on the public Fedora devel mailing list to having now created a personal Red Hat Bugzilla account for his Fedora contributions after it was raised in bug reports and brought up on the mailing list that Lennart's Red Hat account is disabled. Emailing his Red Hat address this morning indeed yields an auto-response that it's no longer in use. He's still active in systemd world with new commits made as of today, so it will be interesting to see where he ends up or his next moves with his vast Linux ecosystem expertise and pivotal role in spearheading systemd's direction. ' -- source: https://linux.slashdot.org/story/22/07/05/2040215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Gtk 5 Might Drop X.11 Support, Says GNOME Dev
by Peter Reutemann 06 Jul '22

06 Jul '22

'One of the GNOME developers has suggested that the next major release of Gtk could drop support for the X window system. The Register reports: Emmanuele Bassi opened a discussion last week on the GNOME project's Gitlab instance that asked whether the developers could drop X.11 support in the next release of Gtk. At this point, it is only a suggestion, but if it gets traction, this could significantly accelerate the move to the Wayland display server and the end of X.11. Don't panic: Gtk 5 is not imminent. Gtk is a well-established toolkit, originally designed for the GIMP bitmap editing program back in 1998. Gtk 4 arrived relatively recently, shortly before the release of GNOME 40 in 2021. GNOME 40 has new user-interface guidelines, and as a part of this, Gtk 4 builds GNOME's Adwaita theme into the toolkit by means of the new libadwaita library, which is breaking the appearance of some existing apps. Also, to be fair, as we recently covered, the X window system is very old now and isn't seeing major changes, although new releases of parts of it do still happen. This discussion is almost certain to get wildly contentious, and the thread on Gitlab has been closed to further comments for now. If this idea gains traction, one likely outcome might well be a fork of Gtk, just as happened when GNOME 3 came out. [...] A lot of the features of the current version, X.11, are no longer used or relevant to most users. Even so, X.12 is barely even in the planning stages yet.' -- source: https://news.slashdot.org/story/22/07/05/2110211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vim 9.0 Released
by Peter Reutemann 05 Jul '22

05 Jul '22

'After many years of gradual improvement Vim now takes a big step with a major release. Besides many small additions the spotlight is on a new incarnation of the Vim script language: Vim9 script. Why Vim9 script: A new script language, what is that needed for? Vim script has been growing over time, while preserving backwards compatibility. That means bad choices from the past often can't be changed and compatibility with Vi restricts possible solutions. Execution is quite slow, each line is parsed every time it is executed. The main goal of Vim9 script is to drastically improve performance. This is accomplished by compiling commands into instructions that can be efficiently executed. An increase in execution speed of 10 to 100 times can be expected. A secondary goal is to avoid Vim-specific constructs and get closer to commonly used programming languages, such as JavaScript, TypeScript and Java. The performance improvements can only be achieved by not being 100% backwards compatible. For example, making function arguments available by creating an "a:" dictionary involves quite a lot of overhead. In a Vim9 function this dictionary is not available. Other differences are more subtle, such as how errors are handled. For those with a large collection of legacy scripts: Not to worry! They will keep working as before. There are no plans to drop support for legacy script. No drama like with the deprecation of Python 2.' -- source: https://developers.slashdot.org/story/22/07/04/193233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

no more scrolling...
by Peter Reutemann 05 Jul '22

05 Jul '22

Hi everyone Been working on a Rasperry Pi without graphical user interface and simply log in on the command-line. One thing that has been puzzling me is why I can no longer scroll backwards/forwards using SHIFT+PGUP/PGDOWN. Instead I have to use "| less" on output now. Turns out that this functionality got removed from the kernel: https://www.linuxquestions.org/questions/slackware-14/the-latest-kernel-rel… Not every device will have a graphical user interface, especially not IoT devices. So that's rather annoying... :-( Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

USB installer tool removes Windows 11’s Microsoft account requirements (and more)
by Peter Reutemann 05 Jul '22

05 Jul '22

'One of the new "features" coming to the Windows 11 22H2 update is a Microsoft account requirement for all new installs, regardless of whether you are using the Home or Pro version of the operating system. And that's too bad, because the 22H2 update corrects a few of Windows 11's original shortcomings while adding some nice quality-of-life improvements. An easy workaround for this requirement is the Rufus USB formatting tool, which can create USB install media for Windows and all kinds of other operating systems. Rufus has already offered some flags to remove Windows 11's system requirement checks from the installer, removing the need for clunky Windows Registry edits and other workarounds. But the beta of version 3.19 will also remove the Microsoft account requirement for new installs, making it easy to set up a new Windows PC with a traditional local account. When setting up Windows 11, make sure not to connect your PC to the Internet before creating your user account. This trick worked to circumvent the Microsoft account requirement in Windows 11 Pro and some of the later versions of Windows 10 but is being removed entirely from Windows 11 22H2. The Rufus tool merely reverts to the pre-22H2 status quo.' -- source: https://arstechnica.com/gadgets/2022/06/usb-installer-tool-removes-windows-… Nice to see open-source "fixing" this mandatory account issue. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The tiniest Raspberry Pi gets a new version with built-in Wi-Fi
by Peter Reutemann 04 Jul '22

04 Jul '22

'The Raspberry Pi Zero series is the smallest version of the popular single-board computer that most people have experience with, but there's one Pi that's even smaller: the Raspberry Pi Pico. Launched in January of 2021 for just $4, the Pico's RP2040 microcontroller incorporates a pair of 133MHz Arm Cortex-M0+ CPU cores and 264 kilobytes (not megabytes) of memory. The low specs and low price make it well-suited for single-purpose devices that don't need much processing power instead of running general-purpose software like the larger Pi boards. To help support companies who want to use the Pico as a basis for Internet-connected smart devices, the Raspberry Pi Foundation is introducing a few new variants of the Pico today. The most notable, the Raspberry Pi Pico W, adds built-in Wi-Fi connectivity to the board while increasing the price from $4 to $6.' -- source: https://arstechnica.com/gadgets/2022/06/the-tiniest-raspberry-pi-gets-a-new… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open-Standard Audio/MIDI plugins: A Dose Of CLAP
by Lawrence D'Oliveiro 01 Jul '22

01 Jul '22

Music/audio production tools commonly support plugins to augment their capabilities. However, well-supported plugin architectures have mostly been proprietary. For example, Steinberg’s VST2 is strictly controlled via a proprietary licence. They are now promoting VST3, which is being made available under the GPL, but their (mis)handling of the VST2→VST3 transition has left a bad taste in many developers’ mouths. On Linux, you will likely heard of open-source plugin systems like LADSPA, DSSI and LV2. And also JUCE and GMPI. Of these, LV2 seems like the most popular, but developers report that it can be hard to get to grips with. Here is a backgrounder <https://lwn.net/Articles/890272/> by Alexandre Prokoudine on the current state of play, leading up to the introduction of Yet Another Plugin Standard, the “Clever Audio Plugin”, or “CLAP” (fnarr-fnarr). He goes into more detail in the followup <https://lwn.net/Articles/893048/>. And he has a bunch of more info on his own site <https://librearts.org/2022/06/introducing-clap/>.

1 0

Mycroft’s Mimic 3 -- A Privacy-Focused, Open-Source Text-To-Speech Engine
by Lawrence D'Oliveiro 30 Jun '22

30 Jun '22

Just came across this video <https://www.youtube.com/watch?v=egrMopDIvPE> on the “Learn Linux TV” channel, talking about this new device that does text to speech. The actual speech-synthesis software is open-source. The original “Mimic1” has been around for a while, but the new version takes advantage of newer Raspberry π hardware. He talks about it not needing an Internet connection any more: I think this was a requirement of the old hardware, not the software as such. You can build and install the software (old or new) yourself, it’s freely available from their GitHub repos. Interesting that the build instructions for Microsoft Windows recommend doing a cross-build from Linux, this being faster than a native Windows build.

1 0

How The Swiss Post E-Voting System Addresses Client-Side Vulnerabilities
by Lawrence D'Oliveiro 30 Jun '22

30 Jun '22

There has been a lot of talk about E-voting. But the trouble with most such systems proposed is that they tend to have weaknesses allowing the voting system to be subverted. Switzerland is one of those places that has implemented a system that seems to address the most common weaknesses. This article <https://freedom-to-tinker.com/2022/06/29/how-the-swiss-post-e-voting-system…>, part of a series on E-voting systems, gives an overview of how it works. Each voter is sent a piece of paper through the mail. This has a unique code on it that they use to initiate the online voting process. It also contains a series of codes associated with each possible response from the voting system (calculated from the voter-specific code). So as the voter enters their choice, they can verify that the code shown is the correct one for that choice. So even if the voting app, or the browser, or the user’s PC has been compromised, the attacker still cannot know what the codes are -- those are only known to the central voting system, and disclosed only to that voter. Any attempt to fake the voter’s selection will cause a code mismatch that should raise alarm bells. So the voting system is not entirely paperless: basically, nobody knows how to create a secure, yet completely paperless, voting system. Which is not to say the system is completely foolproof: the next instalment promises to reveal some issues with the scheme.

1 0

Firefox Can Now Automatically Remove Tracking From URLs
by Peter Reutemann 30 Jun '22

30 Jun '22

'Mozilla's latest Firefox browser release has a new feature that prevents sites like Facebook from tracking you across websites. Called Query Parameter Stripping, it automatically removes strings of characters added to the end of an URL.' -- source: https://news.slashdot.org/story/22/06/29/1939203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0