- wlug - list.wlug.org.nz

Is Firefox OK?
by Peter Reutemann 21 Feb '22

21 Feb '22

'At the end of 2008, Firefox was flying high. Twenty percent of the 1.5 billion people online were using Mozilla’s browser to navigate the web. In Indonesia, Macedonia, and Slovenia, more than half of everyone going online was using Firefox. “Our market share in the regions above has been growing like crazy,” Ken Kovash, Mozilla’s president at the time, wrote in a blog post. Almost 15 years later, things aren’t so rosy. Across all devices, the browser has slid to less than 4 percent of the market—on mobile it’s a measly half a percent. “Looking back five years and looking at our market share and our own numbers that we publish, there's no denying the decline,” says Selena Deckelmann, senior vice president of Firefox. Mozilla’s own statistics show a drop of around 30 million monthly active users from the start of 2019 to the start of 2022. “In the last couple years, what we've seen is actually a pretty substantial flattening,” Deckelmann adds.' -- source: https://arstechnica.com/gadgets/2022/02/is-firefox-ok/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Millions of WordPress sites get forced update to patch critical plugin flaw
by Peter Reutemann 21 Feb '22

21 Feb '22

'Millions of WordPress sites have received a forced update over the past day to fix a critical vulnerability in a plugin called UpdraftPlus. The mandatory patch came at the request of UpdraftPlus developers because of the severity of the vulnerability, which allows untrusted subscribers, customers, and others to download the site’s private database as long as they have an account on the vulnerable site. Databases frequently include sensitive information about customers or the site’s security settings, leaving millions of sites susceptible to serious data breaches that spill passwords, user names, IP addresses, and more.' -- source: https://arstechnica.com/information-technology/2022/02/millions-of-wordpres… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Developers Patch Bugs Faster Than Microsoft, Apple, and Google, Study Shows
by Peter Reutemann 21 Feb '22

21 Feb '22

'Linux programmers fixed bugs faster than anyone — in an average of just 25 days (improving from 32 days in 2019 to just 15 in 2021). That's the conclusion of Google's "Project Zero" security research team, which studied the speed of bug-fixing from January 2019 to December 2021. ZDNet reports that Linux's competition "didn't do nearly as well." For instance, Apple, 69 days; Google, 44 days; and Mozilla, 46 days. Coming in at the bottom was Microsoft, 83 days, and Oracle, albeit with only a handful of security problems, with 109 days. By Project Zero's count, others, which included primarily open-source organizations and companies such as Apache, Canonical, Github, and Kubernetes, came in with a respectable 44 days. Generally, everyone's getting faster at fixing security bugs. In 2021, vendors took an average of 52 days to fix reported security vulnerabilities. Only three years ago the average was 80 days. In particular, the Project Zero crew noted that Microsoft, Apple, and Linux all significantly reduced their time to fix over the last two years. As for mobile operating systems, Apple iOS with an average of 70 days is a nose better than Android with its 72 days. On the other hand, iOS had far more bugs, 72, than Android with its 10 problems. Browsers problems are also being fixed at a faster pace. Chrome fixed its 40 problems with an average of just under 30 days. Mozilla Firefox, with a mere 8 security holes, patched them in an average of 37.8 days. Webkit, Apple's web browser engine, which is primarily used by Safari, has a much poorer track record. Webkit's programmers take an average of over 72 days to fix bugs.' -- source: https://linux.slashdot.org/story/22/02/20/1915222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why I Don’t Like Checking Version Numbers
by Lawrence D'Oliveiro 18 Feb '22

18 Feb '22

Some major web browsers will soon be hitting version 100. The rollover to a 3-digit version number is going to trigger a repeat of what happened when version numbers rolled from 9 to 10 -- some sites turned out to have buggy version checking based simplistically on strings rather than numeric values, and misbehave <https://www.theregister.com/2022/02/17/browsers_version_100_websites_bug/>. As a matter of habit, I have long been reluctant to condition behaviour in my own code based on writing code to look up version numbers of things. I prefer to include some kind of check that more directly determines the existence of relevant functionality.

1 0

Ransomware-As-A-Service
by Lawrence D'Oliveiro 10 Feb '22

10 Feb '22

From <https://www.theregister.com/2022/02/09/uk_us_au_ransomware_warning/>: Ransomware attacks are proliferating as criminals turn to gangs providing turnkey post-compromise services, Britain's National Cyber Security Centre (NCSC) has warned. So, ransomware has become so routine, it has spawned specialists who will take care of many of the technical details for you. For a fee, of course. I think “turnkey post-compromise services” shall be my phrase of the week ...

1 0

Listening To The Radio Killed My Car Stereo!
by Lawrence D'Oliveiro 10 Feb '22

10 Feb '22

From <https://arstechnica.com/cars/2022/02/radio-station-snafu-in-seattle-bricks-…>: ... the problem began on January 30 and afflicted Mazdas from model years 2014 to 2017 when the cars were tuned to the local NPR station, KUOW 94.9. At some point during the day's broadcast, a signal from KUOW caused the Mazdas' infotainment systems to crash—the screens died and the radios were stuck on 94.9 FM. The problem was image files† in the HD radio stream that the infotainment system didn’t know how to decode (they were lacking filename extensions). So it crashed. But the files were still in its cache on reboot, so it tried to decode them again. And crashed again. And it appears, there is no way to get rid of those files or reset the system to a safe state without major hardware surgery. And a replacement unit costs USD1,500 -- if you can get one. Luckily, Mazda has advised that it knows about the problem, and will replace the affected units free of charge -- once supplies are available. †Radio with pictures? Who knew?

1 0

System76 Linux workstation looks ready for gaming, too
by Peter Reutemann 04 Feb '22

04 Feb '22

'System76's latest Linux laptop combines one of AMD's most powerful 5000 series mobile CPUs with Nvidia's mid-range RTX 3060. Configurable to up to $3,442, the Kudu targets Linux users who have a lot of work to do, while quietly nodding at those who like to play games every now and then, too. The 15.6-inch Kudu is the second-priciest offering in System76's laptop lineup. It comes with an octa-core AMD Ryzen 9 5900HX, which has a base clock speed of 3.3 GHz and a boost of up to 4.6 GHz.' -- source: https://arstechnica.com/gadgets/2022/02/system76-linux-laptop-unites-amd-nv… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla is Shutting Down Its VR Web Browser, Firefox Reality
by Peter Reutemann 04 Feb '22

04 Feb '22

'A top VR web browser is closing down. Today, Mozilla announced it's shutting down its Firefox Reality browser -- the four-year-old browser built for use in virtual reality environments. The technology had allowed users to access the web from within their VR headset, doing things like visiting URLs, performing searches, and browsing both the 2D and 3D internet using your VR hand controllers, instead of a mouse. >From a report: Firefox Reality first launched in fall 2018 and has been available on Viveport, Oculus, Pico, and Hololens platforms through their various app stores. While capable of surfing the 2D web, the expectation was that users would largely use the new technology to browse and interact with the web's 3D content, like 360-degree panoramic images and videos, 3D models, and WebVR games, for example. But in an announcement published today, Mozilla says the browser will be removed from the stores where it's been available for download in the "coming weeks." Mozilla is instead directing users who still want to utilize a web browser in VR to Igalia's upcoming open-source browser, Wolvic, which is based on Firefox Reality's source code. This browser will be available for download starting next week, so users won't have to go without -- they'll just have to make the switch.' -- source: https://tech.slashdot.org/story/22/02/03/1653218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slackware, the Oldest Actively Maintained Linux Distro, Releases Version 15.0
by Peter Reutemann 04 Feb '22

04 Feb '22

'Slackware, the oldest actively maintained Linux distribution, released version 15.0 yesterday after a long release cycle that goes all the way back to 2016 where the last version (14.2) was released. According to the release notes, the whole spirit of this release is: "Keep it familiar, but make it modern." Among the news, this release offers kernel 5.15.19, PAM, PipeWire and PulseAudio, Wayland and X11 graphical systems, and Rust and Python 3. As graphical environments, both Xfce 4.16 and the latest Plasma 5 (Plasma 5.23.5, Frameworks 5.90, KDE apps 21.12 running under Qt 5.15.3) are available, with Cinnamon and Mate also available from third parties. The main compilers are gcc-11.2 and llvm 13.0. The default browser is Firefox 91.5esr, with Chromium available as a third-party repository. And... no systemd at all. Slackware can be downloaded from a variety of mirrors. BitTorrent downloads are going to be available too. I've used Slackware for 20 years and it's always impressed me with its stability and speed. I encourage everyone interested to try it.' -- source: https://linux.slashdot.org/story/22/02/04/027213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Says Windows May Need Up To 8 Hours of Online Time To Update
by Peter Reutemann 03 Feb '22

03 Feb '22

'According to a post on the Microsoft IT Pro Blog, Windows computers will need at least eight hours of online time to obtain and install the latest OS updates successfully. Tom's Hardware reports: Another revelation in the post is that Microsoft tracks how long PCs are connected to Windows Update, calling the statistics "Update Connectivity." The data is available to IT managers in the InTune app, a component of the Endpoint management suite. The post details Microsoft's attempts to figure out why some Windows devices aren't getting the latest quality and feature updates, and discovered that two hours of continuous connectivity was required to get updates. It then took six hours after the release of the patch for a machine to update itself reliably. Microsoft's figures show that 50 percent of Windows devices left behind by Windows Update and running a build of Windows 10 that's no longer serviced do not spend enough time connected to have the patches downloaded and installed in the background. This figure drops to 25 percent for customers using a serviced build of the operating system that lags behind in security updates by 60 days or more. The goods news, as noted by Tom's Hardware, is that "Windows 11 updates are smaller than their Windows 10 counterparts due to improved compression [and] new Microsoft Graph APIs," which should help speed up the update process.' -- source: https://tech.slashdot.org/story/22/02/01/2056211 Bloatware? I can download/install full Linux distros in less time (and updates don't take that long either, not even a full version upgrade!). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Insights Into WSL 1.0
by Lawrence D'Oliveiro 03 Feb '22

03 Feb '22

You may remember that Microsoft’s initial attempt at “Windows Services for Linux”, WSL 1.0 (or maybe just plain “WSL”), involved emulating Linux APIs on top of the Windows kernel. This was later scrapped in favour of the current WSL 2.0, which runs an actual Linux kernel, virtualized. Clearly, Microsoft found it problematic trying to keep things compatible with the native Linux kernel, and decided it was simpler to just run the real article. This report <https://www.theregister.com/2022/02/02/oracle_linux_microsoft/> links in passing to an interesting blog post <https://jmmv.dev/2020/11/wsl-lost-potential.html> covering some of the technicalities of how WSL 1.0 was implemented. Windows NT has, or had, the notion of different “environment subsystems” or “personalities” implemented in layers on top of the core kernel; in fact, Win32 is (or was) just one of these “personalities”, with the original POSIX layer being another. That blog post says that WSL1 was implemented as just such a “personality”. And if that had not been scrapped, it would have made some interesting kinds of integration across Windows and Linux processes possible. However, a reader comment to the original article <https://forums.theregister.com/forum/all/2022/02/02/oracle_linux_microsoft/…>, claiming to come from a former “PM” (“Product Manager”?) for WSL, emphatically declares ... WSL is not an NT kernel "personality" and is in no way related to NT's POSIX subsystem. Not even slightly. They are entirely different implementations of different things and share zero architecture and implementation details. This reinforces an impression I’ve had, that much of the modularity of the original Windows NT architecture has decayed away over the years, sacrificed by Microsoft to marketing exigencies. And that includes the whole “environment subsystem” concept. So WSL1 was actually less modular than it might have appeared to begin with, and that would have added to the support headaches.

1 0

64-bit Raspberry Pi OS exits beta, is available for all Pi 3, 4, and Zero 2 boards
by Peter Reutemann 03 Feb '22

03 Feb '22

'The Raspberry Pi hardware has included a 64-bit processor since the Pi 3 launched in early 2016, but the Raspberry Pi OS (formerly known as Raspbian) has remained primarily 32-bit. The Raspberry Pi Foundation has been testing a 64-bit version of the OS since 2020, though, and today the organization announced that the 64-bit version is leaving beta and is now a fully supported OS option on all 64-bit Pi hardware. This includes the Pi 3, Pi 4, Pi Zero 2 W, and all variants thereof.' -- source: https://arstechnica.com/gadgets/2022/02/64-bit-raspberry-pi-os-exits-beta-i… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backblaze Hard Drive Reliability Stats For 2021
by Lawrence D'Oliveiro 02 Feb '22

02 Feb '22

Data-backup company Backblaze has released its annual report on hard-drive reliability for 2021 <https://www.theregister.com/2022/02/01/backblaze_hd_reliability_stats_show/>. Interesting that there is an overall longer-term downward trend in drive failures, though this can fluctuate some. The company is in a good position to compare different brands and models, since they tend to shop around a lot (look at that list). Their whole system is designed to cope with drive failures, and given how many drives they have, they get a lot of failures. So there is plenty of raw data available to analyze, which they make freely available.

1 0

Remembering Windows Vista
by Lawrence D'Oliveiro 02 Feb '22

02 Feb '22

Here is a look back <https://www.theregister.com/2022/02/01/happy_birthday_windows_vista/> at the troubled gestation of Windows Vista. It’s useful as a retrospective, full of links to reports on developments from that time. One of the article links is to this analysis <https://www.theregister.com/2001/08/07/ms_poised_to_switch_windows/> of where Microsoft was supposedly going at the time. (Re)reading that is like peering through a portal into an alien, forgotten world -- one where the company was full of grandiose plans for building an entire OS on Dotnet, making your Exchange mail folders look like a filesystem volume, tying the representation of Office documents to proprietary features of NTFS, and turning the filesystem itself into a database. And one where users and pundits took such plans seriously.

1 0

German Court Fines Company For Linking To Google-Hosted Web Font
by Lawrence D'Oliveiro 01 Feb '22

01 Feb '22

Seems lots of websites link to web fonts hosted by Google. But do they realize this means that users of their sites are sending their IP addresses to Google’s servers? And that not getting the consent of your users to such a thing can land you in legal trouble, at least in the EU? <https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/> I don’t know why people do this anyway -- depending on another site just introduces an additional potential point of failure to your site. Fonts are not that big‡: how great a hardship would it be to copy them to your own site, and link to them there? ‡Had a quick check of my /usr/share/fonts/truetype/noto/ directory, which contains an installation of Google’s entire Unicode-friendly “Noto” font collection; that’s got 2380 entries totalling not quite half a gigabyte.

1 0

A Developer Watching QA Test The Product
by Lawrence D'Oliveiro 01 Feb '22

01 Feb '22

Those with OCD tendencies might want to look away ... <https://www.youtube.com/watch?v=baY3SaIhfl0>

1 0

Fwd: [NZLUG] Fwd: Flounder startup 5th Feb 1PM Melbourne time
by Peter Reutemann 01 Feb '22

01 Feb '22

Apologies for cross-posting, but this event might be of interest to some of you. Cheers, Peter ---------- Forwarded message --------- From: Russell Coker <russell(a)coker.com.au> Date: Sun, Jan 30, 2022 at 10:53 PM Subject: [NZLUG] Fwd: Flounder startup 5th Feb 1PM Melbourne time To: DL Neil <nzlug(a)etelligence.info>, Stephen Dalton <steve(a)refactor.com.au>, NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz>, Mark Foster <blakjak(a)blakjak.net> https://flounder.coker.com.au/2022/01/30/flounder-overview/ The FLOSS Down Under group (Flounder) group is starting next Saturday 1PM Melbourne time (the above page summarises it). https://b.coker.com.au/ The above URL will redirect to the meeting URL, it's deliberately short so if your primary device has an issue you can quickly type it into another device. We haven't entirely decided on the main feature, but thinking of having it be hands on training on BTRFS and ZFS while at the same time discussing new advances (both new technology and older technology that has become cheaper and thus more usable) in storage for FOSS systems. If there's someone who has experience with Optane on Linux who could give a 10+ minute talk about it then please contact me off list. The meetings will include a summary and discussion of new free software that is noteworthy (with input welcome from anyone who thinks we missed something noteworthy). We will also have some mention of recent security issues and other changes to the environment that we operate in. Anyone who wants to contribute to a meeting can contact me in advance to have some time reserved for a lightning talk or a feature talk at a future meeting. Please forward this message to all free software users groups in Australia and NZ. Note that this is not designed to compete with existing LUGs, but to offer something different. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Bug in Early Creative Commons Licenses Has Enabled a New Breed of Superpredator
by Peter Reutemann 01 Feb '22

01 Feb '22

'Here’s a supreme irony: the Creative Commons licenses were invented to enable a culture of legally safe sharing, spurred by the legal terror campaign waged by the entertainment industry, led by a literal criminal predator who is now in prison for sex crimes. But because of a small oversight in old versions of the licenses created 12 years ago, a new generation of legal predator has emerged to wage a new campaign of legal terror. To make matters worse, this new kind of predator specifically targets people who operate in good faith, only using materials that they explicitly have been given permission to use.' -- source: https://doctorow.medium.com/a-bug-in-early-creative-commons-licenses-has-en… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Review: MNT Reform laptop has fully open hardware and software—for better or worse
by Peter Reutemann 01 Feb '22

01 Feb '22

'If you’re a Linux fan or open source advocate looking for a decent laptop, you actually have some solid options right now—much better, at least, than buying a Windows laptop, installing Linux on it, and hoping for the best. Dell has offered Ubuntu editions of some of its XPS laptops and other PCs for years now, and Lenovo sells a respectable collection of desktops and laptops with Linux. System76 sells a selection of Linux-friendly laptops preloaded with Ubuntu or its own Pop!_OS distribution. The repair-friendly Framework Laptop doesn’t ship with Linux, but it can be configured without an OS, and Framework promises robust Linux support from multiple distributions. But those laptops all have something in common with run-of-the-mill Windows PCs: a reliance on closed-source hardware and, often, the proprietary software and drivers needed to make it function. For some people, this is a tolerable trade-off. You put up with the closed hardware because it performs well, and it supports the standard software, development tools, and APIs that keep the computing world spinning. For others, it’s anathema—if you can’t see the source code for these “binary blobs,” they are inherently untrustworthy and should be used sparingly or not at all. The MNT Reform is a laptop for the latter group. It's a crowdfunded, developed-in-the-open, extensively documented device that cares more about being open than it cares about literally any other aspect of the computing experience. Perhaps predictably, this makes for a laptop that is ideologically pure but functionally compromised.' -- source: https://arstechnica.com/gadgets/2022/01/review-mnt-reform-laptop-has-fully-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Is Broken
by Lawrence D'Oliveiro 28 Jan '22

28 Jan '22

github.com is currently returning a server-error page.

2 4

Only 90s Web Developers Remember This
by Lawrence D'Oliveiro 28 Jan '22

28 Jan '22

An only-slightly-tongue-in-cheek expletive-laden rant <https://zachholman.com/posts/only-90s-developers/> about how Web development used to be: the wonders of the 1×1 GIF (“To this day it is the only way to vertically center elements”) and the fun of “ ”, to the coming of JavaScript to create the “Technology of Terror”, DHTML (Dynamic HTML).

1 0

A bug lurking for 12 years gives attackers root on most major Linux distros
by Peter Reutemann 27 Jan '22

27 Jan '22

'Linux users on Tuesday got a major dose of bad news—a 12-year-old vulnerability in a system tool called Polkit gives attackers unfettered root privileges on machines running most major distributions of the open source operating system. Previously called PolicyKit, Polkit manages system-wide privileges in Unix-like OSes. It provides a mechanism for nonprivileged processes to safely interact with privileged processes. It also allows users to execute commands with high privileges by using a component called pkexec, followed by the command.' -- source: https://arstechnica.com/information-technology/2022/01/a-bug-lurking-for-12… I think, I saw an update coming through the other day... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZLUG] Fwd: [Linux-aus] Australia (and hopefully NZ) LUG meetings
by Peter Reutemann 26 Jan '22

26 Jan '22

Apologies for cross-posting, but this may be of interest to some of you. Cheers, Peter -------- Original Message -------- From: Mark Foster <blakjak(a)blakjak.net> Sent: January 26, 2022 9:12:30 PM GMT+13:00 To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz>, russell(a)coker.com.au Subject: [NZLUG] Fwd: [Linux-aus] Australia (and hopefully NZ) LUG meetings There may be some interest in this initiative from the (now largely defunct, it seems) NZLUG mailing list.... Thanks to Russell for offering up this initiative and trying to make it accessible to New Zealanders as well as Australians. I myself am unlikely to be available but am forwarding this to NZLUG in case there's interest here. Cheers Mark (sometime NZLUG admin; there's still a mailing list with some people subscribed to it... so who knows? :)) -------- Forwarded Message -------- Subject: [Linux-aus] Australia (and hopefully NZ) LUG meetings Date: Wed, 26 Jan 2022 17:45:44 +1100 From: Russell Coker via linux-aus <linux-aus(a)lists.linux.org.au> Reply-To: russell(a)coker.com.au To: linux-aus(a)lists.linux.org.au https://etbe.coker.com.au/2022/01/26/australia-nz-linux-meetings/ I'm starting a new group for online meetings with the aim of giving benefits you can't get from watching YouTube etc. Details of how to connect etc will be available shortly. -- My Main Bloghttp://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/ _______________________________________________ linux-aus mailing list linux-aus(a)lists.linux.org.au http://lists.linux.org.au/mailman/listinfo/linux-aus To unsubscribe from this list, send a blank email to linux-aus-unsubscribe(a)lists.linux.org.au -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/.

1 0

Who's Paying to Fix Open Source Software?
by Peter Reutemann 26 Jan '22

26 Jan '22

'The Log4Shell exploit "exposes how a vulnerability in a seemingly simple bit of infrastructure code can threaten the security of banks, tech companies, governments, and pretty much any other kind of organization," writes VentureBeat. But the incident also raises some questions: Should large deep-pocketed companies besides Google, which always seems to be heavily involved in such matters, be doing more to support the cause with people and resources? Long-time Slashdot reader frank_adrian314159 shares a related article from a programming author on Dev.To, who'd read hot takes like "Open source needs to grow the hell up." and "Open source' is broken". [T]he log4j developers had this massive security issue dumped in their laps, with the expectation that they were supposed to fix it. How did that happen? How did a group of smart, hard-working people get roped into a thankless, high-pressure situation with absolutely no upside for themselves...? It is this communal mythology I want to talk about, this great open source brainwashing that makes maintainers feel like they need to go above and beyond publishing source code under an open source license — that they need to manage and grow a community, accept contributions, fix issues, follow vulnerability disclosure best practices, and many other things... In reality what is happening, is that open source maintainers are effectively unpaid outsourcing teams for giant corporations. The log4j exploit was first reported by an engineer at Alibaba — a corporation with a market capitalization of $348 billion — so the article wonders what would happen if log4j's team had sent back a bill for the time they'd spend fixing the bug. Some additional opinions (via the "This Week in Programming" column): * PuTTY maintainer Andrew Ducker: "The internet (and many large companies) are dependent on software maintained by people in their spare time, for free. This may not be sustainable." * Filippo Valsorda, a Go team member at Google: "The role of Open Source maintainer has failed to mature from a hobby into a proper profession... The status quo is unsustainable.... GitHub Sponsors and Patreon are a nice way to show gratitude, but they are an extremely unserious compensation structure." Valsorda hopes to eventually see "a whole career path with an onramp for junior maintainers, including training, like a real profession."' -- source: https://news.slashdot.org/story/21/12/18/2016216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Big Surprise Of The Week: Oracle’s Audit Process Is In Cahoots With Sales
by Lawrence D'Oliveiro 26 Jan '22

26 Jan '22

As part of the licensing terms for certain (most?) Oracle products, you have to agree to be audited by the company, to ensure your usage does not exceed the licences you have bought. Such audits are notorious for regularly telling customers that what they thought was compliance with the licence was nothing of the sort, and that they had better hand over more money to make the problem go away. Oracle’s official position has always been that there is some kind of separation between the operations of the audit department and the sales department, so the auditing process was entirely impartial and under no pressure to increase company revenues. Now some ex-Oracle execs are publicly admitting this is a load of nonsense <https://www.theregister.com/2022/01/25/oracle_audits/>. I don’t think Oracle is unique in this. Lots of big software companies (including Microsoft, I believe) offer similar site-licensing of their products, with similar audit requirements. And likely similar outcomes when an audit actually takes place.

1 0

SystemRescueCD is now just SystemRescue
by Lawrence D'Oliveiro 25 Jan '22

25 Jan '22

Since (almost) nobody uses CDs any more, the handy bootable system-fixer Linux distro has dropped the “CD” from its name <https://www.system-rescue.org/>. The latest version, 9.00, is reviewed here <https://www.theregister.com/2022/01/24/systemrescue/>. Not sure what the benefit of the new in-kernel NTFS driver is, since the existing FUSE support works fine, and benchmarks I have seen seem to indicate that one is not unambiguously faster than the other. Seems SystemRescue is very popular with Windows users: “Windows gets its underwear in a twist relatively easily, and it's not generous with tools to fix it.” The writer also says “We would have quite liked to see some tools to help with a dead Linux box, too, though.” But the main (software) issue I get with Linux installations not booting is some screwup in the bootloader, and you can use the Linux installation itself to fix that, by chrooting into it from your SystemRescue boot.

1 0

New MoonBounce UEFI Bootkit Can't Be Removed by Replacing the Hard Drive
by Peter Reutemann 25 Jan '22

25 Jan '22

'Security researchers from Kaspersky said they have discovered a novel bootkit that can infect a computer's UEFI firmware. From a report: What makes MoonBounce -- the name they gave the bootkit -- special is the fact that the malware doesn't burrow and hide inside a section of the hard drive named ESP (EFI System Partition), where some UEFI code typically resides, but instead it infects the SPI flaws memory that is found on the motherboard. This means that, unlike similar bootkits, defenders can't reinstall the operating system and replace the hard drive, as the bootkit will continue to remain on the infected device until the SPI memory is re-flashed (a very complex process) or the motherboard is replaced. According to Kaspersky, MoonBounce marks the third UEFI bootkit they have seen so far that can infect and live inside the SPI memory, following previous cases such as LoJax and MosaicRegressor. Furthermore, MoonBounce's discovery also comes after researchers have also found additional UEFI bootkits in recent months, such as ESPectre, FinSpy's UEFI bootkit, and others, which has led the Kaspersky team to conclude that what was once considered unachievable following the rollout of the UEFI standard has gradually become the norm.' -- source: https://it.slashdot.org/story/22/01/24/1815234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next week
by Peter Reutemann 24 Jan '22

24 Jan '22

Hi everyone We have our AGM coming up on Monday next week, with the following agenda: - President's Report - Treasurer's Report - Election of 2022 Committee - General business - Consumption of pizza (if applicable) However, I'm not sure whether we have a meeting room, as I'm still waiting on the confirmation whether we get our room sponsored or not for the year (head of CMS was on holiday till today). And if we should get it sponsored, then I need to sort out the room booking (which will take time, too). Worst case scenario: it will be an online only one via BigBlueButton. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 7

KDE-Powering Qt's New Framework Lets Developers Bring Ads Into Their Apps
by Peter Reutemann 24 Jan '22

24 Jan '22

'"Qt, the framework that powers the KDE desktop, is announcing support for ads in client-side applications," reports Neowin: This means that application developers will now be able to serve ads in traditional desktop applications.... Windows users have been dealing with this in Metro UI apps since Windows 8 and it's something that's never gone over well on the desktop. While it's doubtful you'll see ads in KDE's core applications, it would be possible for distributions that wish to further monetize their work to fork these applications, placing ads in them.... According to the documentation, the advertising plugin supports a variety of platforms. They are as follows: - Windows 10 - Ubuntu 20.04 - Raspbian Buster - macOS - Android 7.0 — iOS "Our offering aims to disrupt the IoT industry," explains Qt's press release, "enabling new business models and business cases that before were not possible." Reactions have been mixed. Comments on Phoronix ranged from calling it "a great way for boost development on KDE" to "Not sure if I like this."' -- source: https://tech.slashdot.org/story/22/01/22/1751259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Supply chain attack used legitimate WordPress add-ons to backdoor sites
by Peter Reutemann 24 Jan '22

24 Jan '22

'Dozens of legitimate WordPress add-ons downloaded from their original sources have been found backdoored through a supply chain attack, researchers said. The backdoor has been found on “quite a few” sites running the open source content management system. The backdoor gave the attackers full administrative control of websites that used at least 93 WordPress plugins and themes downloaded from AccessPress Themes. The backdoor was discovered by security researchers from JetPack, the maker of security software owned by Automatic, provider of the WordPress.com hosting service and a major contributor to the development of WordPress. In all, Jetpack found that 40 AccessPress themes and 53 plugins were affected.' -- source: https://arstechnica.com/information-technology/2022/01/supply-chain-attack-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Blender 3.0 Released With More New Features and Improvements
by Peter Reutemann 24 Jan '22

24 Jan '22

'The Free Open Source 3D production software Blender has been released in version 3.0 (official showreel) with more new features, improvements and performance optimizations as well as further improved workflows. In recent years Blender has received an increasing rate of attention from the 3D industry, with various larger businesses such as Epic, Microsoft, Apple and most recently Intel joining the blender foundation and donating to its development fund. Blender has seen an increasing rise in usage in various industries, such as animated feature film production, architecture and game development.' -- source: https://tech.slashdot.org/story/22/01/23/0026257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New FSF Procedures Let Its 5,000 'Associate Members' Nominate New Board Members
by Peter Reutemann 24 Jan '22

24 Jan '22

'This week the Free Software Foundation's board announced that for the first time in the organization's 37-year-history, its 5,000-plus associate members will now be able to nominate and evaluate candidates for its board of directors. Under new procedures adopted by the FSF board on January 17 and summarized here, the organization will proactively engage associate members with a sufficient history of association with the FSF in the recruiting process by inviting them to suggest board nominees and then research collectively those nominees' suitability for a position on the board, including most importantly their record of commitment to free software ideals.... Following the new procedures, voting members (which include all current directors and are listed here) can start a process to recruit new directors, or a modified process to reconsider existing directors... The FSF intends to first add several new directors in 2022, utilizing these new procedures, and then begin a review of existing directors. The FSF staff and board have made this expanded engagement process a high priority and are working together to put in place the necessary infrastructure to support it, with a target to activate it within the first quarter of 2022... Voting members will review the community's nominations. A nominee may be removed from consideration if at least two voting members vote to do so without opposition from other voting members. The voting members will discuss the candidates and decide which should move forward in the process next. The FSF's associate members will then review each nominee's application, then evaluate and comment on those nominees in a private, staff-moderated discussion forum. Voting members will review this input and privately interview the finalists to assess their candidacy, ideals, and commitment to free software, then vote on their appointment.... The process is designed such that new iterations for both recruiting new directors and reviewing existing directors can be run whenever the need arises in the future. "Opening the director recruitment process to our associate members is a historic and welcome milestone for the FSF," said FSF president Geoffrey Knauth. "We are pleased to engage the free software community in attracting new talent to our leadership who will keep the freedoms.... We have worked hard to strengthen governance standards at the FSF and to create a transparent leadership recruitment process. We look forward to tackling new challenges and opportunities this year." The FSF's announcement calls the new "community engagement process" a "key result of a six-month consultant-led review designed to help make FSF governance and recruitment practices more transparent and participatory, while more systematically ensuring their commitment to the FSF's values and principles."' -- source: https://news.slashdot.org/story/22/01/22/050207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Building Your Own Silicon Chips In Your Parents’ Garage
by Lawrence D'Oliveiro 23 Jan '22

23 Jan '22

Here’s a guy named Sam Zeloof <https://arstechnica.com/information-technology/2022/01/this-22-year-old-bui…> who has been using cast-off equipment from bygone eras to put together his own chip fab. He made his first chip (an op-amp) just about four years ago; it had just six transistors. His second one (more proof of concept of the manufacturing process) had 1200 transistors. He has made a bunch of them, testing each one by hand. He is currently working on his third design, in a plan to get to a full working microprocessor.

1 0

Autodesk Acquires Moxion
by Lawrence D'Oliveiro 20 Jan '22

20 Jan '22

Moxion is an NZ-based company that manages digital “dailies” (raw footage from movie production) for remote working. It is now being acquired by content-creation behemoth Autodesk, known for its CG apps Maya and 3DS Max, among other products <https://www.hollywoodreporter.com/business/digital/autodesk-moxion-digital-…>. Here <https://www.stuff.co.nz/entertainment/film/104976105/moxion-the-kiwi-compan…> is an older backgrounder on the company’s business model. Dating from 2018, it gives some interesting examples of where the logistics of location shooting make their approach superior to traditional methods of managing footage. I’m not sure what the value of the acquitision is. I think I saw a figure of “tens of millions”, which makes Moxion a minnow in typical US terms.

1 0

Is Altering The Appearance Of A Website A Copyright Violation?
by Lawrence D'Oliveiro 20 Jan '22

20 Jan '22

A German court has just decided that a browser extension which strips ads from websites does not violate copyright <https://www.theregister.com/2022/01/19/ad_blockers_copyright_germany/>. One may have concerns with the business model of this particular company, but the general principle of a user being able (perhaps with the help of a third party) to modify a website’s content before displaying it on their own machine seems sacrosanct. However, a similar issue is being re-raised in the US, with a website owner filing a lawsuit against Google for the way its Android search app superimposes its own ads on top of the website display. It has long been decided that this does not violate copyright, but now the plaintiff is trying to argue that a website’s HTML code is not merely “intellectual property”, but actual physical property, so the principle of “trespass to chattels” can be applied to it.

1 0

Are We Getting Closer to the Year of the Linux Desktop?
by Peter Reutemann 19 Jan '22

19 Jan '22

'Earlier this year TechRepublic argued that while 2021 wasn't the year of the Linux desktop, "there was no denying the continued dominance of Linux in the enterprise space and the very slow (and subtle) growth of Linux on the desktop. And in just about every space (minus the smartphone arena), Linux made some serious gains." So would 2022 be the year of the Linux desktop? "Probably not." But developer Tim Wells honestly believes we're getting closer: The idea of the year of the Linux desktop is that there would come a year that the free and open source operating system would reach a stage that the average user could install and use it on their pc without running into problems. Linus Sebastian from Linus Tech Tips recently did an experiment where he installed Linux on his home PC for one month to see if he could use it not only for everyday tasks, but for gaming and also streaming. Ultimately he concluded (in a video just released) that this year will not be the year of the Linux desktop and that while doing everyday stuff was reasonably okay, the state of gaming on Linux (despite Valves lofty goals) is to put it simply, a shit-show. (That's my word, not his)... The experiment done by Linus seems to show that while some games do indeed run well using [Valve's Windows compatibility layer] Proton, there are just as many that run with issues. Some of those issues can be game breaking. Such as the game running, but its multiplayer functionality not working at all. Some games just plain don't work at all due to dependencies on services such as Easy Anti Cheat... In his video Linus mentions that the main problem preventing the "year of the Linux desktop" is the fragmentation. By fragmentation, he means the range of available distributions and the fact that each distribution has (potentially) different versions of libraries and drivers and software that makes the behind the scenes operate.... Flatpak and Snap as well as AppImage are making progress towards fixing this fragmentation issue, but those are not yet perfect either. Flatpak works by ensuring that the expected versions of libraries required for that software are installed along side it and independent of the existing library the distro may provide... Valve have said that the Steamdeck will also use an immutable core operating system for the same reasons. So while Linus is sure that 2022 isn't yet the year of the Linux desktop and that fragmentation is the biggest problem. I think maybe, just maybe, we're closer to solving those problems and closer perhaps to the year of the Linux desktop that some might realise.' -- source: https://linux.slashdot.org/story/22/01/15/0224235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Safari and iOS users: Your browsing activity is being leaked in real time
by Peter Reutemann 19 Jan '22

19 Jan '22

'For the past four months, Apple’s iOS and iPadOS devices and Safari browser have violated one of the Internet’s most sacrosanct security policies. The violation results from a bug that leaks user identities and browsing activity in real time. The same-origin policy is a foundational security mechanism that forbids documents, scripts, or other content loaded from one origin—meaning the protocol, domain name, and port of a given webpage or app—from interacting with resources from other origins. Without this policy, malicious sites—say, badguy.example.com—could access login credentials for Google or another trusted site when it’s open in a different browser window or tab. Since September’s release of Safari 15 and iOS and iPadOS 15, this policy has been broken wide open, research published late last week found. As a demo site graphically reveals, it’s trivial for one site to learn the domains of sites open in other tabs or windows, as well as user IDs and other identifying information associated with the other sites.' -- source: https://arstechnica.com/information-technology/2022/01/safari-and-ios-bug-r… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Malware Sees 35% Growth During 2021
by Peter Reutemann 18 Jan '22

18 Jan '22

'The number of malware infections targeting Linux devices rose by 35% in 2021, most commonly to recruit IoT devices for DDoS (distributed denial of service) attacks. BleepingComputer reports: A Crowdstrike report looking into the attack data from 2021 summarizes the following: - In 2021, there was a 35% rise in malware targeting Linux systems compared to 2020. - XorDDoS, Mirai, and Mozi were the most prevalent families, accounting for 22% of all Linux-targeting malware attacks observed in 2021. - Mozi, in particular, had explosive growth in its activity, with ten times more samples circulating in the wild the year that passed compared to the previous one. - XorDDoS also had a notable year-over-year increase of 123%. [...] The Crowstrike findings aren't surprising as they confirm an ongoing trend that emerged in previous years. For example, an Intezer report analyzing 2020 stats found that Linux malware families increased by 40% in 2020 compared to the previous year. In the first six months of 2020, a steep rise of 500% in Golang malware was recorded, showing that malware authors were looking for ways to make their code run on multiple platforms. This programming, and by extension, targeting trend, has already been confirmed in early 2022 cases and is likely to continue unabated. ' -- source: https://linux.slashdot.org/story/22/01/17/2239204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why is Android 12 So Buggy?
by Peter Reutemann 18 Jan '22

18 Jan '22

'Android 12 is one of the platform's most ambitious updates in recent history, bringing a major design overhaul to every corner of the operating system. It has also been one of the rockiest Android OS launches in the past few years. From a report: Both Samsung and OnePlus paused the rollout of their stable Android 12-based updates amid reports of serious bugs. Google itself has addressed a laundry list of bug reports from Pixel 6 owners, just as it's trying to convince them it's finally figured out how to build a truly premium phone. What in the heck is going on? The short answer is that there are some unique complicating factors at play this year but also that Android is inherently a little bit messy -- that just comes with the territory when you're designing a delightful public park compared to Apple's walled garden. Despite a refreshed look and some appealing new high-end handsets, Android is still Android -- the good and the bad. To try and figure out what the heck is going on, we talked to Mishaal Rahman, former editor-in-chief of XDA Developers, who's well known for digging into Android codebases and discovering Google's secrets. Speaking to the Pixel 6 bugs in particular, Rahman guesses that it has a lot to do with the unusually large size of the update. "Many people have called it, myself included, the biggest OS update to Android since Android 5.0 Lollipop, and that was many years ago. There are just so many massive changes to the interface and to the feature set." He also suggests that Google's commitment to issue a new Android update every year can make things worse when it's trying to do so much, and the self-imposed one-year development cycle doesn't leave much wiggle room in the timeline. "They started immediately after Android 11 was released to the public -- and they have a hard cutoff date... After that, they just focus on fixing bugs." Delay any longer, and they'd risk bumping into next year's development cycle. It's also possible that the attempt to bring timely Android updates to non-Google devices wound up backfiring. Android phone owners have been asking for faster updates for a long time -- outside of Google's Pixel phones and pricey flagships, many devices face long waits for OS updates. Sure enough, the updates have come faster this year. Case in point: Samsung users are accustomed to waiting about three months after an Android stable release to get their finished One UI update with the new version of the OS, but this year, One UI 4.0 arrived just one and a half months after Android 12. But the way things have gone this year, many users would likely have opted for a slower, stable update rather than a fast one riddled with bugs.' -- source: https://mobile.slashdot.org/story/22/01/17/2026239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

EFF praises Android’s new 2G kill switch, wants Apple to follow suit
by Peter Reutemann 17 Jan '22

17 Jan '22

'The Electronic Frontier Foundation is celebrating Google's addition of a 2G kill switch to Android 12. The digital rights group has been campaigning against the dated, insecure 2G cellular standard since 2020, and Android is the first mobile OS to take the group's advice and let users completely disable 2G. In the US, carriers shut down 2G years ago, and the 3G shutdown is already underway. Phones have not really gotten the message, though, and modems still try to connect to any nearby 2G signals automatically. The problem is that 2G is very old, and it's a lot like connecting to a WEP-secured Wi-Fi hotspot—the security is obsolete, so it's easy to crack. If you're in a country where legitimate uses of 2G are long dead, the standard only serves as an attack vector via fake cell phone towers, so why not just shut it off?' -- source: https://arstechnica.com/gadgets/2022/01/eff-praises-androids-new-2g-kill-sw… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russia says it has neutralized the cutthroat REvil ransomware gang
by Peter Reutemann 17 Jan '22

17 Jan '22

'Russian law enforcement authorities said on Friday that they have arrested 14 people associated with REvil, a top ransomware group that has disrupted critical operations of wealthy targets and held their data hostage. The action, carried out by Russia’s FSB, the successor agency to the KGB, is a rare example of the country’s government cracking down on cybercrime by its citizens. The US and Russia have no extradition treaty in place, and critics have said the Kremlin routinely harbors cybercriminals as long as they don’t target organizations located in the former Soviet Union. The arrests come as tensions between Russia and the US escalate over a standoff involving Ukraine.' -- source: https://arstechnica.com/information-technology/2022/01/russia-says-it-has-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backdoor RAT for Windows, macOS, and Linux went undetected until now
by Peter Reutemann 17 Jan '22

17 Jan '22

'Researchers have uncovered a never-before-seen backdoor malware written from scratch for systems running Windows, macOS, or Linux that remained undetected by virtually all malware scanning engines. Researchers from security firm Intezer said they discovered SysJoker—the name they gave the backdoor malware—on the Linux-based Webserver of a “leading educational institution.” As the researchers dug in, they found SysJoker versions for both Windows and macOS as well. They suspect the cross-platform RAT—short for remote access trojan—was unleashed in the second half of last year. The discovery is significant for several reasons. First, fully cross-platform malware is something of a rarity, with most malicious software being written for one specific operating system. The RAT was also written from scratch and made use of four separate command-and-control servers, an indication that the people who developed and used it were part of an advanced threat actor that invested significant resources. It’s also unusual for previously unseen Linux malware to be found in a real-world attack.' -- source: https://arstechnica.com/information-technology/2022/01/backdoor-for-windows… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Restores Account of Developer Who Intentionally Corrupted His Libraries
by Peter Reutemann 17 Jan '22

17 Jan '22

'What happened after a developer intentionally corrupted two of their libraries which collectively had more than 20 million weekly downloads and thousands of dependent projects? Mike Melanson's "This Week in Programming" column reports: In response to the corrupted libraries, Microsoft quickly suspended his GitHub access and reverted the projects on npm.... While this might seem like an open and shut case to some — the developer committed malicious code and GitHub and npm did what it had to do to protect its users — a debate broke out around a developer's rights to do what they wish with their code, no matter how many projects and dependencies it may have. "GitHub suspending someone's account for modifying their own code in a project they own however they want spooks me a lot more than NPM reverting a package," [tweeted one company's Director of Engineering & Technology]. "I kind of love what Marak did to make a point and protest to be honest." An article on iProgrammer further outlines the dilemma present in what might otherwise seem like a clear-cut case.... "Yes, it is open source in that you can fork it and can contribute to it but does this mean that GitHub is justified in denying you the right to change or even destroy your own code?" As of last night, however, it would appear that the entire affair is merely one for intellectual debate, as GitHub has indeed lived up to what some might view as its end of the bargain: the developer's account is active, he has been allowed to remove his faker.js library on GitHub (depended upon as it might be), and has since offered an update that he does "not have Donkey Brains".' -- source: https://developers.slashdot.org/story/22/01/15/212234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Host of Youtube-dl Web Site Sued by Major Record Labels
by Peter Reutemann 17 Jan '22

17 Jan '22

'"As part of their growing battle against popular open source software tool youtube-dl, three major music labels are now suing Uberspace, the company that currently hosts the official youtube-dl homepage," reports TorrentFreak: According to plaintiffs Sony, Universal and Warner, youtube-dl circumvents YouTube's "rolling cipher" technology, something a German court found to be illegal in 2017.... While the RIAA's effort to take down youtube-dl from GitHub grabbed all the headlines, moves had already been underway weeks before that in Germany. Law firm Rasch works with several major music industry players and it was on their behalf that cease-and-desist orders were sent to local hosting service Uberspace. The RIAA complained that the company was hosting the official youtube-dl website although the tool itself was hosted elsewhere. "The software itself wasn't hosted on our systems anyway so, to be honest, I felt it to be quite ridiculous to involve us in this issue anyway — a lawyer specializing in IT laws should know better," Jonas Pasche from Uberspace said at the time. In emailed correspondence today Uberspace informed TorrentFreak that, following the cease-and-desist in October 2020, three major music labels are now suing the company in Germany... According to the labels, youtube-dl poses a risk to their business and enables users to download their artists' copyrighted works by circumventing YouTube's technical measures. As a result, Uberspace should not be playing a part in the tool's operations by hosting its website if it does not wish to find itself liable too.... The alleged illegality of youtube-dl is indeed controversial. While YouTube's terms of service generally disallow downloading, in Germany there is the right to make a private copy, with local rights group GEMA collecting fees to compensate for just that. Equally, when users upload content to YouTube under a Creative Commons license, for example, they agree to others in the community making use of that content. "Even if YouTube doesn't provide video download functionality right out of the box, the videos are not provided with copy protection," says former EU MP Julia Reda from the Society for Freedom Rights (GFF) to NetzPolitik. "Not only does YouTube pay license fees for music, we all pay fees for the right to private copying in the form of the device fee, which is levied with every purchase of smartphones or storage media," says Reda. "Despite this double payment, Sony, Universal and Warner Music want to prevent us from exercising our right to private copying by saving YouTube videos locally on the hard drive."' -- source: https://news.slashdot.org/story/22/01/16/025217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pine64's Newest Linux Smartphone 'PinePhone Pro Explorer Edition' Now Available for Pre-Order
by Peter Reutemann 17 Jan '22

17 Jan '22

'"Linux fans rejoice!" writes Hot Hardware. " Pine64's newest smartphone is officially available for pre-order." PinePhone Pro Explorer Edition pre-orders opened up Tuesday. Devices that are pre-ordered before January 18th will be shipped from Pine64's Hong Kong warehouse by January 24th and should arrive by early February.... According to Pine64, the PinePhone Pro Explorer Edition is the "fastest mainline Linux smartphone on the market." It uses a Rockchip RK3399S SoC that is composed of two ARM A72 cores (1.5GHz) and four A53 efficiency cores (1.5GHz).... Consumers will also likely be pleased with the price of the device. The PinePhone Pro Explorer Edition currently rings in at $399 USD. The production run is purportedly "large" and interested consumers should therefore be able to easily purchase the device at this price. Liliputing adds: While the PinePhone Pro has better hardware than the original PinePhone, Pine64 plans to continue selling both phones indefinitely. The first-gen phone will continue to sell for $150 to $200, offering an entry-level option for folks that want to experiment with mobile Linux, while the higher-priced PinePhone Pro should offer a hardware experience closer to what folks would expect from a modern mid-range phone.... In addition to the PinePhone Keyboard, the recently launched PinePhone wireless charging case, fingerprint reader case, and LoRa cases should all work with either phone. But the new phone has a faster processor, more memory and storage, higher-resolution cameras, a higher-speed USB-C port and support for WiFi 5 and Bluetooth 4.1. And those features should make it a little more viable as a replacement for an iPhone or Android device... if you're comfortable running work-in-progress software. They also add that "Thanks to the recent launch of the $50 PinePhone Keyboard, you can also think of the PinePhone Pro as a $400 phone that can be used as a $449 mini-laptop...." And the Pine64 site's January update also points out that "Pico 8 Raspberry Pi port works on the PinePhone," adding "yes, it does run DOOM."' -- source: https://mobile.slashdot.org/story/22/01/16/0051226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pine64's 'PineNote' E-Ink Tablet Now Available for $399 for Developers
by Peter Reutemann 17 Jan '22

17 Jan '22

'"The PineNote is a tablet with a 10.1 inch grayscale E Ink display and pen support," reports Liliputing. "It's designed to be a hackable, Linux-friendly device and it's one of the latest products from the makers of the PinePhone and PineBook line of devices." First introduced last summer, the PineNote began shipping to developers in limited quantities in December. Now it's available for anyone to purchase for $399 — no invitation required. But it's probably only a good idea to buy one if you're a developer or very early adopter because there's very little software available for the PineNote so far. At this point, Pine64 is shipping the PineNote without an operating system installed. It will have only a bootloader, allowing developers and enthusiasts to load their own software... [D]evelopers have already made some progress in getting builds Alpine and Debian Linux to run on the E Ink slate, and according to Pine64, there are ports for NixOS and other operating systems on the way. There's already a partially working display driver, but it's still a work in progress. The goal is to allow developers to port mainline Linux operating systems and applications to play well with a monochrome display with a slow refresh rate. Developers have also figured out how to enable support PineNote's touchscreen, audio playback, and USB port, making it possible to use USB keyboards, storage devices, and other peripherals.' -- source: https://hardware.slashdot.org/story/22/01/16/012231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Adhole, the Massive Public Pi-hole Instance, Shuts Down
by Peter Reutemann 14 Jan '22

14 Jan '22

'segaboy81 writes: I've been running Pihole for years (for myself), but this guy was running one for everybody! Since 2017, those not so savvy who still wanted the experience of Pi-hole, could turn to Adhole.org. That is, until now. Adhole.org is shutting down, citing issues with maintenance and stability' -- source: https://it.slashdot.org/story/22/01/13/1858208 Haven't used Pi-Hole myself, but maybe someone here would be willing to demo it at one of our up-coming meetings? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nikola Static Website Generator now supports Māori language
by Ian Stewart 13 Jan '22

13 Jan '22

Kia ora, The developers of the Nikola static website and blog generator ( https://getnikola.com/ ) recently released version 8.2.0. The website generator is written in python and is an open-source project that is developed on a github repository ( https://github.com/getnikola/nikola ) Nikola V8.2.0 supports 55 languages and now includes support for Māori. Thus a website may be built that is only in Māori. Alternatively a website may default to displaying English and then have the options to select Māori, French or Chinese, etc. For details on how to install Nikola refer to: https://getnikola.com/getting-started.html Kia pārekareka, Ian.

1 0

Raspberry Pi Can Detect Malware By Scanning For Electromagnetic Waves
by Peter Reutemann 13 Jan '22

13 Jan '22

'Gizmodo reports: A team of researchers at France's Research Institute of Computer Science and Random Systems created an anti-malware system centered around a Raspberry Pi that scans devices for electromagnetic waves. As reported by Tom's Hardware, the security device uses an oscilloscope (Picoscope 6407) and H-Field probe connected to a Raspberry Pi 2B to pick up abnormalities in specific electromagnetic waves emitted by computers that are under attack, a technique the researchers say is used to "obtain precise knowledge about malware type and identity." The detection system then relies on Convolution Neural Networks (CNN) to determine whether the data gathered indicates the presence of a threat. Using this technique, researchers claims they could record 100,000 measurement traces from IoT devices infected by genuine malware samples, and predicted three generic and one benign malware class with an accuracy as high as 99.82%. Best of all, no software is needed and the device you're scanning doesn't need to be manipulated in any way. As such, bad actors won't be successful with their attempts to conceal malicious code from malware detection software using obfuscation techniques. "Our method does not require any modification on the target device. Thus, it can be deployed independently from the resources available without any overhead. Moreover, our approach has the advantage that it can hardly be detected and evaded by the malware authors," researchers wrote in the paper.' -- source: https://hardware.slashdot.org/story/22/01/12/2214257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Reinvention Of The Chord Keyboard
by Lawrence D'Oliveiro 13 Jan '22

13 Jan '22

Someone else has invented a new chord keyboard <https://www.nzherald.co.nz/technology/the-end-of-the-qwerty-keyboard-new-ga…>. The idea of being able to type using multiple fingers for each keystroke, instead of just one, is not new. There is also the convenience aspect, for example being able to mount the two halves on the sides of your body, so you can use the keyboard on the go. And adding a predictive system allows it to exceed the speeds of the world’s fastest typists on a conventional keyboard. But the drawback is always the same: it needs special training to use, and most people simply cannot be bothered. Come to think of it, is there any reason you cannot add chord recognition to a conventional typewriter-style keyboard? As in holding down multiple non-modifier keys at once.

2 1