- wlug - list.wlug.org.nz

Microsoft's Secure Boot UEFI Bootloader Signing Key Expires In September, Posing Problems For Linux Users
by Lawrence D'Oliveiro 23 Jul '25

23 Jul '25

If I understand this article right <https://www.tomshardware.com/tech-industry/cyber-security/microsoft-signing…>, there is a signing key stored in the flash RAM of PCs, issued by Microsoft, which is used to sign a “shim” that allows third-party Linux distros to boot. However, that key is due to expire this September. Microsoft issued an updated key two years ago, but that key may not be widely installed as yet. This leaves it up to PC/OEM vendors to issue updates to the flash RAM on their motherboards, which is not something that can be taken for granted. I’m not the only one wondering whether Secure Boot is worth the hassle: It's easy to see the appeal of Secure Boot—making it more difficult to install bootkits should be a net positive. However, the looming hassle of dealing with this expiring key is just the latest in a series of frustrations that encourage people to either stick with Windows or disable Secure Boot entirely. Right now, many people opt for the former, but will that continue to be the case as the popularity of other platforms rises ahead of Windows 10's demise? And is Secure Boot, as it currently exists, prepared for that shift?

1 0

filestash
by Peter Reutemann 22 Jul '25

22 Jul '25

Just came across "filestash": 'A Dropbox-like file manager that let you manage your data anywhere it is located: FTP • FTPS • SFTP • WebDAV • Git • S3 • NFS • SMB • Artifactory • LDAP • Mysql • Storj • CardDAV • CalDAV • Backblaze B2 • Minio • Dropbox • Google Drive' Sounds like an interesting and useful tool! -- github: https://github.com/mickael-kerjean/filestash -- source: https://mastodon.social/@nixCraft/114893327737674577 Cheers, Peter

1 0

Actively exploited vulnerability gives extraordinary control over server fleets
by Peter Reutemann 21 Jul '25

21 Jul '25

'Hackers are exploiting a maximum-severity vulnerability that has the potential to give them complete control over thousands of servers, many of which handle mission-critical tasks inside data centers, the US Cybersecurity and Infrastructure Security Agency is warning. The vulnerability, carrying a severity rating of 10 out of a possible 10, resides in the AMI MegaRAC, a widely used firmware package that allows large fleets of servers to be remotely accessed and managed even when power is unavailable or the operating system isn't functioning. These motherboard-attached microcontrollers, known as baseboard management controllers (BMCs), give extraordinary control over servers inside data centers. Administrators use BMCs to reinstall operating systems, install or modify apps, and make configuration changes to large numbers of servers without physically being on premises and, in many cases, without the servers being turned on. Successful compromise of a single BMC can be used to pivot into internal networks and compromise all other BMCs. CVE-2024-54085, as the vulnerability is tracked, allows for authentication bypasses by making a simple web request to a vulnerable BMC device over HTTP. The vulnerability was discovered by security firm Eclypsium and disclosed in March. The disclosure included proof-of-concept exploit code allowing a remote attacker to create an admin account without providing any authentication. At the time of the disclosure, there were no known reports of the vulnerability being actively exploited. On Wednesday, CISA added CVE-2024-54085 to its list of vulnerabilities known to be exploited in the wild. The notice provided no further details.' -- source: https://arstechnica.com/security/2025/06/active-exploitation-of-ami-managem… Cheers, Peter

4 6

KDE's Android TV Alternative, Plasma Bigscreen, Rises From the Dead
by Peter Reutemann 16 Jul '25

16 Jul '25

'Plasma Bigscreen, KDE's TV-focused interface, is being revived after years of inactivity thanks to contributor Devin, who overhauled the UI, redesigned the Settings app, improved app launching, and updated key modules. While still in progress -- with features like HDMI-CEC remote support and a virtual keyboard pending -- the project aims to rejoin KDE's official Plasma release schedule, potentially in version 6.5. Neowin reports: If you have not heard of it, Plasma Bigscreen is a Plasma shell for televisions, with original support for the now-defunct Mycroft AI assistant. It used to provide a simple launcher for apps and custom "Mycroft Skills" before development stalled, causing most distributions to drop it. The project was left behind during the big transition to Plasma 6 last year because no one had ported it in time for the megarelease. After a friend of his started poking at the code, Devin stepped in to tackle the much-needed work. [...] For anyone who wants to test this out, you can do as Devin did by installing Plasma Bigscreen on a Raspberry Pi using postmarketOS, though you would have to compile it yourself or pull from the nightly repos to get the latest changes. Applications like Kodi and VacuumTube (smart TV version of YouTube) work well with remote navigation, and some games like SuperTuxKart are playable. Controller support exists, but getting TV remotes to work over HDMI CEC is still untested. The project is far from finished; it still needs an arrow-navigable virtual keyboard and a clearer long-term direction now that Mycroft is gone. Still, the goal is to get it back into the official Plasma release schedule, possibly for version 6.5. ' -- source: https://tech.slashdot.org/story/25/07/15/1956221 Cheers, Peter

1 0

Browser Extensions Turn Nearly 1 Million Browsers Into Website-Scraping Bots
by Peter Reutemann 10 Jul '25

10 Jul '25

'Over 240 browser extensions with nearly a million total installs have been covertly turning users' browsers into web-scraping bots. "The extensions serve a wide range of purposes, including managing bookmarks and clipboards, boosting speaker volumes, and generating random numbers," reports Ars Technica. "The common thread among all of them: They incorporate MellowTel-js, an open source JavaScript library that allows developers to monetize their extensions." Ars Technica reports: Some of the data swept up in the collection free-for-all included surveillance videos hosted on Nest, tax returns, billing invoices, business documents, and presentation slides posted to, or hosted on, Microsoft OneDrive and Intuit.com, vehicle identification numbers of recently bought automobiles along with the names and addresses of the buyers, patient names and the doctors they saw, travel itineraries hosted on Priceline, Booking.com, and airline websites, Facebook Messenger attachments and Facebook photos, even when the photos were set to be private. The dragnet also collected proprietary information belonging to Tesla, Blue Origin, Amgen, Merck, Pfizer, Roche, and dozens of other companies. Tuckner said in an email Wednesday that the most recent status of the affected extensions is: - Of 45 known Chrome extensions, 12 are now inactive. Some of the extensions were removed for malware explicitly. Others have removed the library. - Of 129 Edge extensions incorporating the library, eight are now inactive. - Of 71 affected Firefox extensions, two are now inactive. Some of the inactive extensions were removed for malware explicitly. Others have removed the library in more recent updates. A complete list of extensions found by Tuckner is here.' -- source: https://tech.slashdot.org/story/25/07/09/2257245 Cheers, Peter

1 0

AMD Warns of New Meltdown, Spectre-like Bugs Affecting CPUs
by Peter Reutemann 10 Jul '25

10 Jul '25

'AMD is warning users of a newly discovered form of side-channel attack affecting a broad range of its chips that could lead to information disclosure. Register: Akin to Meltdown and Spectre, the Transient Scheduler Attack (TSA) comprises four vulnerabilities that AMD said it discovered while looking into a Microsoft report about microarchitectural leaks. The four bugs do not appear too venomous at face value -- two have medium-severity ratings while the other two are rated "low." However, the low-level nature of the exploit's impact has nonetheless led Trend Micro and CrowdStrike to assess the threat as "critical." The reasons for the low severity scores are the high degree of complexity involved in a successful attack -- AMD said it could only be carried out by an attacker able to run arbitrary code on a target machine. It affects AMD processors (desktop, mobile and datacenter models), including 3rd gen and 4th gen EPYC chips -- the full list is here.' -- source: https://it.slashdot.org/story/25/07/09/1835230 Cheers, Peter

1 0

GIMP 3.2 Promises New Paint Mode, Support for Importing Photoshop Patterns
by Peter Reutemann 04 Jul '25

04 Jul '25

'GIMP 3.2 promises new features like theme colors for Brush, Font, and Palette, a new paint blend mode called Overwrite that lets you directly replace the pixels over the area you paint, a new setting in the text tool to control the direction of the text outline, and automatic match of Linux and Windows OS themes. It also promises support for using ART (AnotherRawTherapee) as a Camera Raw loader, a new option to export to Krita‘s .kpl palette format, support for importing Photoshop patterns, as well as support for using presets from Photoshop’s Curves and Levels filters in GIMP’s Curves and Levels filters. In addition, GIMP 3.2 will bring initial support for exporting Photoshop Large format (PSB) files, support for importing APNG animations, support for loading multi-layer OpenEXR images, support for importing and exporting JPEG 2000 images, and support for loading and exporting Sony Playstation 1 TIM textures and images. But wait, that’s not all because GIMP 3.2 also promises support for importing Nokia’s historical black and white Over-the-Air Bitmap format, support for importing the GIF variant known as Jeff’s Image Format (.jif), and support for importing Advanced Video Coding (AVCI) still images. Among other noteworthy changes, GIMP 3.2 promises to improve non-destructive editing, update the CMYK Color Selector to calculate and display the Total Ink Coverage of the selected color, and implement a new API to create a GimpCoordinates widget in the auto-generated dialog.' -- source: https://9to5linux.com/gimp-3-2-promises-new-paint-mode-support-for-importin… Cheers, Peter

1 0

Let's Encrypt Rolls Out Free Security Certs For IP Addresses
by Peter Reutemann 04 Jul '25

04 Jul '25

'Let's Encrypt, a certificate authority (CA) known for its free TLS/SSL certificates, has begun issuing digital certificates for IP addresses. From a report: It's not the first CA to do so. PositiveSSL, Sectigo, and GeoTrust all offer TLS/SSL certificates for use with IP addresses, at prices ranging from $40 to $90 or so annually. But Let's Encrypt does so at no cost. For those with a static IP address who want to host a website, an IP address certificate provides a way to offer visitors a secure connection with that numeric identifier while avoiding the nominal expense of a domain name.' -- source: https://it.slashdot.org/story/25/07/03/1452239 Cheers, Peter

1 0

Linux’s Remarkable Journey From One Dev's Hobby To 40 Million Lines Of Code - And Counting
by Lawrence D'Oliveiro 03 Jul '25

03 Jul '25

A retrospective <https://www.zdnet.com/article/linuxs-remarkable-journey-from-one-devs-hobby…> on how the Linux kernel project got to where it is today. Quotes: “We're always building on the kernel, despite the fact that a lot of things were happening in the world over these three decades. We had the dotcom crash in 2000. We had the SCO lawsuit. In 2008, there was the global economic crisis. And of course, we had the COVID pandemic. But you don't really see an effect on the development speed of Linux from any of these events. We have somehow managed to sustain everything we can do despite all the stuff that has happened in the world.” ... Of course, for years, no one took Linux seriously. It was dismissed as a toy in an era when Unix fragmentation and the rise of Windows NT dominated industry thinking. The prevailing wisdom held that only large corporations could build operating system kernels, leaving little attention for a community-driven initiative. Yet, as Corbet noted, Linux exemplified Clayton Christensen's concept of disruptive innovation: a technology dismissed as inferior that quietly matures until it overtakes established players. Why did the BSDs lose their early lead? Another factor, Corbet explained, was that in the early 1990s, the BSD Unix systems were much more mature than Linux; they were capable of doing more and were more usable. Still, their permissive BSD license model led to a whole bunch of forks. None of them gained the critical mass in terms of either the development community or adoption to dominate Linux. Instead, the Linux kernel stayed one thing. It stayed together, in part because its GPLv2 copyright policy meant everybody retains their copyright under the same license. Some other open-source projects (including GNU) insist that contributors sign a “Contributor Licence Agreement”, turning over their copyright to some official body in charge of the project. The Linux kernel does not, and there are others that don’t.

1 0

PNG Spec, 3rd Edition, Is Out
by Lawrence D'Oliveiro 27 Jun '25

27 Jun '25

There is has been a major update to the specification for the PNG (“Portable Network Graphics”) file-format spec <https://www.programmax.net/articles/png-is-back/>, 20 years on from the previous edition. New features include support for high-dynamic-range colour gamuts, using a new metadata entry type that is much more compact than a full embedded ICC colour profile, and the official acceptance of the APNG format for animating a sequence of images within a single PNG file.

1 0

Lyon Abandons Microsoft Office To Strengthen 'Digital Sovereignty'
by Peter Reutemann 26 Jun '25

26 Jun '25

'The City of Lyon will replace Microsoft's office suite with free office software, including OnlyOffice for office work and Linux and PostgreSQL for systems and databases. The city aims to "no longer be dependent on American software solutions and acquire true digital sovereignty," according to an official statement. ' -- source: https://slashdot.org/story/25/06/25/1757229 Great to see that the digital sovereignty movement gaining momentum, if only down-under as well... Cheers, Peter

1 0

Mozilla Formally Discontinues Its DeepSpeech Project
by Peter Reutemann 26 Jun '25

26 Jun '25

'One of the interesting projects engaged in by Mozilla that directly wasn't related to their web browser efforts was DeepSpeech, an embedded/offline speech-to-text engine. To not much surprise given the lack of activity in recent years, last week they finally and formally discontinued the open-source project. Mozilla DeepSpeech was a promising speech-to-text engine with great performance for real-time communication even when running on Raspberry Pi SBCs and other low-power systems.' -- source: https://tech.slashdot.org/story/25/06/25/1851201 It's hard to compete with other publicly available models like OpenAI's whisper, which are really, really good. Cheers, Peter

1 0

Ubuntu To Disable Intel Graphics Security Mitigations To Boost GPU Performance By Up To 20%
by Peter Reutemann 24 Jun '25

24 Jun '25

'Disabling Intel graphics security mitigations in GPU compute stacks for OpenCL and Level Zero can yield a performance boost of up to 20%, prompting Ubuntu's Canonical and Intel to disable these mitigations in future Ubuntu packages. Phoronix's Michael Larabel reports: Intel does allow building their GPU compute stack without these mitigations by using the "NEO_DISABLE_MITIGATIONS" build option and that is what Canonical is looking to set now for Ubuntu packages to avoid the significant performance impact. This work will likely all be addressed in time for Ubuntu 25.10. This NEO_DISABLE_MITIGATIONS option is just for compiling the Intel Compute Runtime stack and doesn't impact the Linux kernel security mitigations or else outside of Intel's "NEO" GPU compute stack. Both Intel and Canonical are in agreement with this move and it turns out that even Intel's GitHub binary packages for their Compute Runtime for OpenCL and Level Zero ship with the mitigations disabled due to the performance impact. This Ubuntu Launchpad bug report for the Intel Compute Runtime notes some of the key takeaways. There is also this PPA where Ubuntu developers are currently testing their Compute Runtime builds with NEO_DISABLE_MITIGATIONS enabled for disabling the mitigations.' -- source: https://news.slashdot.org/story/25/06/23/2046259 Cheers, Peter

1 0

WebVM
by Peter Reutemann 24 Jun '25

24 Jun '25

Just came across this project on my Mastodon feed: 'WebVM is a server-less virtual environment running fully client-side in HTML5/WebAssembly. It's designed to be Linux ABI-compatible. It runs an unmodified Debian distribution including many native development toolchains. WebVM is powered by the CheerpX virtualization engine, and enables safe, sandboxed client-side execution of x86 binaries on any browser. CheerpX includes an x86-to-WebAssembly JIT compiler, a virtual block-based file system, and a Linux syscall emulator.' -- github: https://github.com/leaningtech/webvm -- mastodon: https://mastodon.social/@nixCraft/114735683692335386 Cheers, Peter

1 0

How The Grateful Dead Built The Internet
by Lawrence D'Oliveiro 23 Jun '25

23 Jun '25

Here’s an interesting piece, from the BBC of all places, about the role that a hippie band that started in the 1960s went on to play in the culture of the early Internet <https://www.bbc.com/future/article/20250618-how-the-grateful-dead-shaped-so…>. Not only were their stage shows technology-heavy, but they somehow managed to attract a major following among technologists of all kinds. Among the other members of that milieu was Steward Brand, creator of the Whole Earth Catalog, a resource for those looking for tools to help them live a simpler life, less dominated by faceless corporates and promoting more intimate, personal power. Quote from the introduction: “We are as gods and might as well get used to it.” Brand went on to co-found the WELL, aka the “Whole Earth ’Lectronic Link”, which started out as a BBS with users connecting via dialup lines, before becoming an Internet-connected service -- one of the earliest examples, if not *the* earliest example, of “social media”, if you will. John Perry Barlow, one of the lyricists for the Grateful Dead, got heavily involved in the WELL and then went on to found the Electronic Frontier Foundation, dedicated to the preservation of free speech and other civil rights in the online world.

2 1

OpenPGP Versus GnuPG
by Lawrence D'Oliveiro 23 Jun '25

23 Jun '25

It seems the developers of GnuPG are starting to diverge from the OpenPGP standard, and go their own, incompatible way. I got notes about this from the last few upgrades of my Debian Unstable systems, and so searching about online led me (yet again) to the ever-dependable ArchLinux Wiki <https://wiki.archlinux.org/title/GnuPG>, which has a section on “OpenPGP compatibility”, with links to more details about the schism. So the Debian folks seem reluctant to go along with this, and they’re not the only ones.

2 1

Bill Gates Gets To Meet The Famous Linus Torvalds
by Lawrence D'Oliveiro 23 Jun '25

23 Jun '25

Did you know, Torvalds and Gates had never met before <https://www.theverge.com/news/690815/bill-gates-linus-torvalds-meeting-photo>. The third older guy with them is Dave Cutler, mastermind of Windows NT. Not sure if he was the one responsible for putting in drive letters and all those “reserved” file names or not.

1 0

The Kubuntu Focus Team Announces The M2 GEN 6
by Peter Reutemann 16 Jun '25

16 Jun '25

'The Kubuntu Focus team has some exciting news to share. We have launched the sixth generation of the flagship M2 laptop, featuring the Intel Core Ultra 9 275HX CPU with 24 threads, Nvidia® GeForce® RTX 50-series GPUs, and many more upgrades. See more about this laptop in the press release, and see the press photos here!' -- source: https://www.einpresswire.com/article/820847974/kubuntu-focus-announces-the-… -- photos: https://drive.google.com/drive/folders/1mTmiw5HuJ8XkJ_yqy-R9YT-BqD-lmG3D Cheers, Peter

1 0

Denmark Is Dumping Microsoft Office and Windows For LibreOffice and Linux
by Peter Reutemann 13 Jun '25

13 Jun '25

'ZDNet reports: Denmark's Minister of Digitalization, Caroline Stage, has announced that the Danish government will start moving away from Microsoft Office to LibreOffice. Why? It's not because open-source is better, although I would argue that it is, but because Denmark wants to claim "digital sovereignty." In the States, you probably haven't heard that phrase, but in the European Union, digital sovereignty is a big deal and getting bigger. A combination of security, economic, political, and societal imperatives is driving the EU's digital sovereignty moves. EU leaders are seeking to reduce Europe's dependence on foreign technology providers, primarily those from the United States, and to assert greater control over its digital infrastructure, data, and technological future. Why? Because they're concerned about who controls European data, who sets the rules, and who can potentially cut off access to essential services in times of geopolitical tension. "Money issues have also played a decisive role," writes ZDNet's Steven Vaughan-Nichols. "Copenhagen's Microsoft software bill has soared from 313 million kroner in 2018 to 538 million kroner -- about $53 million in 2023, a 72% increase in just five years. David Heinemeier Hansson (DHH), a Dane, inventor of Ruby on Rails, and co-owner of the software developer company 37Signals, has said: "Denmark is one of the most highly digitalized countries in the world. It's also one of the most Microsoft-dependent. In fact, Microsoft is by far and away the single biggest dependency, so it makes perfect sense to start the quest for digital sovereignty there."' -- source: https://linux.slashdot.org/story/25/06/12/0335229 Cheers, Peter

2 1

Apple Quietly Launches Container On GitHub To Bring Linux Development To macOS
by Peter Reutemann 12 Jun '25

12 Jun '25

'A report from NERDS.xyz: Apple has released a new developer tool on GitHub called Container, offering a fresh approach to running Linux containers directly on macOS. Unlike Docker or Podman, this tool is designed to feel at home in the Apple ecosystem and hooks into frameworks already built into the operating system. Container runs standard OCI images, but it doesn't use a single shared Linux VM. Instead, it creates a small Linux virtual machine for every container you spin up. That sounds heavy at first, but the VMs are lightweight and boot quickly. Each one is isolated, which Apple claims improves both security and privacy. Developers can run containerized workloads locally with native macOS support and without needing to install third-party container platforms.' -- source: https://linux.slashdot.org/story/25/06/11/2116233 Cheers, Peter

2 1

FreeBSD 14.3 Released
by Peter Reutemann 12 Jun '25

12 Jun '25

'Michael Larabel of Phoronix highlights the key updates in today's stable release of FreeBSD 14.3: FreeBSD 14.3 has back-ported a number of improvements from FreeBSD 15 back to the FreeBSD 14 series. Plus a number of routine package updates and other fixes. Some of the FreeBSD 14.3-RELEASE highlights include: - Updating the ZFS support against OpenZFS 2.2.7. - Merging of the Realtek RTW88 and RTW89 WiFi drivers based on the Linux 6.14 kernel code. - The LinuxKPI code has been improved to support crypto offload as well as the 802.11n and 802.11ac standards. - The Intel IX Ethernet driver has added support for the x550 1000BAS-BX SFP modules. - Thor2 PCI IDs added to the Broadcom NetXtreme "BNXT" driver along with support for 400G speed modules. - XZ 5.8.1, OpenSSH 9.9p2, OpenSSL 3.0.16, and many other package updates. - Syscons as the legacy system console driver is now considered deprecated. Syscons is not compatible with UEFI, lacks UTF-8 support, and is Giant-locked. ' -- source: https://bsd.slashdot.org/story/25/06/10/2146224 Cheers, Peter

2 1

Ubuntu Linux 25.10 Quietly Kills Off GNOME On Xorg As Wayland Takes Over
by Peter Reutemann 12 Jun '25

12 Jun '25

'Ubuntu 25.10, known as Questing Quokka, is taking a big turn under the hood. Canonical has dropped support for the GNOME desktop running on Xorg. Starting with this release, the default Ubuntu session now uses Wayland only. Yes, folks, there's no longer an option to log into GNOME on Xorg.' -- source: https://news.slashdot.org/story/25/06/10/181234 Cheers, Peter

1 0

New Linux Flaws Allow Password Hash Theft via Core Dumps in Ubuntu, RHEL, Fedora
by Peter Reutemann 12 Jun '25

12 Jun '25

'Two information disclosure flaws have been identified in apport and systemd-coredump, the core dump handlers in Ubuntu, Red Hat Enterprise Linux, and Fedora, according to the Qualys Threat Research Unit (TRU). Tracked as CVE-2025-5054 and CVE-2025-4598, both vulnerabilities are race condition bugs that could enable a local attacker to obtain access to access sensitive information. Tools like Apport and systemd-coredump are designed to handle crash reporting and core dumps in Linux systems. "These race conditions allow a local attacker to exploit a SUID program and gain read access to the resulting core dump," Saeed Abbasi, manager of product at Qualys TRU, said.' -- source: https://thehackernews.com/2025/05/new-linux-flaws-allow-password-hash.html Cheers, Peter

1 0

Wikipedia Pauses AI-Generated Summaries After Editor Backlash
by Peter Reutemann 12 Jun '25

12 Jun '25

'The Wikimedia Foundation halted an experiment that would have displayed AI-generated summaries atop Wikipedia articles after the platform's volunteer editor community delivered an overwhelmingly negative response to the proposal. The foundation announced the two-week mobile trial on June 2 and suspended it just one day later following dozens of critical comments from editors. The experiment, called "Simple Article Summaries," would have used Cohere's open-weight Aya model to generate simplified versions of complex Wikipedia articles. The AI-generated summaries would have appeared at the top of articles with a yellow "unverified" label, requiring users to click to expand and read them. Editors responded with comments including "very bad idea," "strongest possible oppose," and simply "Yuck."' -- source: https://news.slashdot.org/story/25/06/11/1732215 Cheers, Peter

1 0

Android 16 Is Here
by Peter Reutemann 11 Jun '25

11 Jun '25

'Today, we're bringing you Android 16, rolling out first to supported Pixel devices with more phone brands to come later this year. This is the earliest Android has launched a major release in the last few years, which ensures you get the latest updates as soon as possible on your devices. Android 16 lays the foundation for our new Material 3 Expressive design, with features that make Android more accessible and easy to use.' -- source: https://mobile.slashdot.org/story/25/06/10/2021249 Cheers, Peter

1 0

RIP Bill Atkinson
by Lawrence D'Oliveiro 08 Jun '25

08 Jun '25

This article <https://daringfireball.net/linked/2025/06/07/bill-atkinson-rip> reports the death of legendary Apple Macintosh pioneer Bill Atkinson, at the age of 74, from cancer. Atkinson is known for, among other things, the “QuickDraw” graphics engine, which was at the core of how those early Macintoshes could manage graphics drawing at interactive speeds, on a processor running at a nominal 8MHz clock speed, with no hardware acceleration. He also created the MacPaint application, to show off the artistic capabilities of the Macintosh -- and its ease of use. There is a video somewhere of Atkinson’s 2-year-old daughter using MacPaint, her tiny fist barely big enough to cover the mouse, otherwise being quite comfortable figuring out the drawing tools. And later, he created HyperCard, which was one of those forays into “end-user programming” which was perhaps more successful than most. Atkinson is named on Apple’s patent for the “region” structure, which was a compact way of representing arbitrary regions of pixels, which might have holes in them or even consist of entirely disjoint pieces. These structures were heavily used in QuickDraw for clipping graphics drawing (particularly for dealing with overlapping windows), though they could be rendered as graphics objects in their own right. Apple’s patent meant that nobody else could use that structure. For example, X11 had to use a less efficient way of representing pixel regions. The patent did finally expire around 2004, I think it was.

1 0

KDE Targets Windows 10 'Exiles' Claiming 'Your Computer is Toast'
by Peter Reutemann 05 Jun '25

05 Jun '25

'Linux desktop darling KDE is weighing in on the controversy around the impending demise of Windows 10 support with a lurid "KDE for Windows 10 Exiles" campaign. KDE's alarming "Exiles" page opens with the text "Your computer is toast" followed by a warning that Microsoft wants to turn computers running Windows 10 into junk from October 14. "It may seem like it continues to work after that date for a bit, but when Microsoft stops support for Windows 10, your perfectly good computer will be officially obsolete." Beneath a picture of a pile of tech junk, including a rotary telephone and some floppy drives, KDE proclaims: "Windows 10 will degrade as more and more bugs come to light. With nobody to correct them, you risk being hacked. Your data, identity, and control over your device could be stolen."' -- source: https://tech.slashdot.org/story/25/06/04/186206 The exiles page: https://kde.org/for/w10-exiles/ Cheers, Peter

1 0

Meta and Yandex Are De-Anonymizing Android Users' Web Browsing Identifiers
by Peter Reutemann 04 Jun '25

04 Jun '25

'"It appears as though Meta (aka: Facebook's parent company) and Yandex have found a way to sidestep the Android Sandbox," writes Slashdot reader TheWho79. Researchers disclose the novel tracking method in a report: We found that native Android apps -- including Facebook, Instagram, and several Yandex apps including Maps and Browser -- silently listen on fixed local ports for tracking purposes. These native Android apps receive browsers' metadata, cookies and commands from the Meta Pixel and Yandex Metrica scripts embedded on thousands of web sites. These JavaScripts load on users' mobile browsers and silently connect with native apps running on the same device through localhost sockets. As native apps access programmatically device identifiers like the Android Advertising ID (AAID) or handle user identities as in the case of Meta apps, this method effectively allows these organizations to link mobile browsing sessions and web cookies to user identities, hence de-anonymizing users' visiting sites embedding their scripts. This web-to-app ID sharing method bypasses typical privacy protections such as clearing cookies, Incognito Mode and Android's permission controls. Worse, it opens the door for potentially malicious apps eavesdropping on users' web activity. While there are subtle differences in the way Meta and Yandex bridge web and mobile contexts and identifiers, both of them essentially misuse the unvetted access to localhost sockets. The Android OS allows any installed app with the INTERNET permission to open a listening socket on the loopback interface (127.0.0.1). Browsers running on the same device also access this interface without user consent or platform mediation. This allows JavaScript embedded on web pages to communicate with native Android apps and share identifiers and browsing habits, bridging ephemeral web identifiers to long-lived mobile app IDs using standard Web APIs. This technique circumvents privacy protections like Incognito Mode, cookie deletion, and Android's permission model, with Meta Pixel and Yandex Metrica scripts silently communicating with apps across over 6 million websites combined. Following public disclosure, Meta ceased using this method on June 3, 2025. Browser vendors like Chrome, Brave, Firefox, and DuckDuckGo have implemented or are developing mitigations, but a full resolution may require OS-level changes and stricter enforcement of platform policies to prevent further abuse.' -- source: https://yro.slashdot.org/story/25/06/03/205251 Cheers, Peter

1 0

Beware of the Browser-in-the-Middle Attack: What It Is and How to Protect Yourself
by Peter Reutemann 04 Jun '25

04 Jun '25

'A new security threat called the browser-in-the-middle (BITM) attack has recently been uncovered, exposing users—especially those using Apple’s Safari browser—to potential exploits that could compromise their privacy and security. Reports from BleepingComputer and GBHackers highlight how attackers can take advantage of browser fullscreen features to trick users into revealing sensitive information. [...] A browser-in-the-middle attack is a phishing-like technique that leverages the browser’s fullscreen mode to impersonate legitimate websites or system dialogs. By forcing the browser to enter fullscreen mode, attackers can overlay fake login screens, pop-ups, or security warnings that look authentic but actually capture user input such as passwords, credit card numbers, or other personal data. Unlike traditional man-in-the-middle attacks that intercept communications, BITM attacks manipulate the user interface itself to create convincing illusions. Because fullscreen mode hides browser UI elements like the address bar or tabs, users may be unaware they are interacting with a fraudulent page. According to the reports, Safari’s fullscreen API is particularly vulnerable to BITM attacks. Attackers can use JavaScript to force fullscreen without user consent or notification and then display spoofed content that mimics trusted websites or system alerts. This makes Safari users a prime target, although the risk isn’t limited to this browser alone.' -- source: https://cyptd.com/beware-of-the-browser-in-the-middle-attack-what-it-is-and… Cheers, Peter

1 0

OpenSnitch: The Must-Have Application Firewall for Linux
by Peter Reutemann 29 May '25

29 May '25

'When it comes to protecting your Linux system from unwanted network connections, having a good firewall is essential. While most Linux users rely on traditional firewalls like iptables, firewalls, or ufw, these usually work at the network level and don’t give detailed control over which applications can connect to the internet. This is where OpenSnitch comes in, a GNU/Linux application firewall designed to give you control over your outgoing connections on a per-application basis. In this article, we will explore what OpenSnitch is, how it helps secure your Linux machine, and guide you through simple installation and usage steps.' -- source: https://www.tecmint.com/opensnitch-linux-application-firewall/ Cheers, Peter

1 0

Thousands of Asus routers are being hit with stealthy, persistent backdoors
by Peter Reutemann 29 May '25

29 May '25

'Thousands of home and small office routers manufactured by Asus are being infected with a stealthy backdoor that can survive reboots and firmware updates in an attack by a nation-state or another well-resourced threat actor, researchers said. The unknown attackers gain access to the devices by exploiting now-patched vulnerabilities, some of which have never been tracked through the internationally recognized CVE system. After gaining unauthorized administrative control of the devices, the threat actor installs a public encryption key for access to the device through SSH. From then on, anyone with the private key can automatically log in to the device with administrative system rights.' -- source: https://arstechnica.com/security/2025/05/thousands-of-asus-routers-are-bein… Cheers, Peter

1 0

SUSE Is Giving YaST the Dodo Bird Treatment
by Peter Reutemann 26 May '25

26 May '25

'An important piece of Linux history is set to go the way of the passenger pigeon or dodo bird later this year, when SUSE and openSUSE put YaST out to pasture. Widely regarded as a package manager, it’s actually more of a Swiss Army knife configuration tool that can be used to install software, configure hardware, set up networks and servers, and more. Exactly what it can do might be determined by the year in which you’re using it, as its feature set and role within the SUSE ecosystem have changed over the years. Although not very well known outside SUSE circles these days, from its first appearance in 1995 until SUSE was purchased by Novell in 2004, YaST was one of the reasons why SUSE was considered one of the crown jewels of Linux.' -- source: https://fossforce.com/2025/05/suse-is-giving-yast-the-dodo-bird-treatment/ When I was using SuSE back in the day, YaST was really great for newbies to do admin stuff Later on, I switched to webmin (https://github.com/webmin/webmin) as it was not restricted to a particular distro. Cheers, Peter

2 1

“Microsoft has simply given us no other option,” Signal says as it blocks Windows Recall
by Peter Reutemann 22 May '25

22 May '25

'Signal Messenger is warning the users of its Windows Desktop version that the privacy of their messages is under threat by Recall, the AI tool rolling out in Windows 11 that will screenshot, index, and store almost everything a user does every three seconds. Effective immediately, Signal for Windows will by default block the ability of Windows to screenshot the app. Signal users who want to disable the block—for instance to preserve a conversation for their records or make use of accessibility features for sight-impaired users—will have to change settings inside their desktop version to enable screenshots. [...] With no API for blocking Recall in the Windows Desktop version, Signal is instead invoking an API Microsoft provides for protecting copyrighted material. App developers can turn on the DRM setting to prevent Windows from taking screenshots of copyrighted content displayed in the app. Signal is now repurposing the API to add an extra layer of privacy.' -- source: https://arstechnica.com/security/2025/05/signal-resorts-to-weird-trick-to-b… Who would have thought that DRM can be useful... :-) Cheers, Peter

1 0

Hackers Now Testing ‘ClickFix’ Attacks on Linux Systems
by Peter Reutemann 22 May '25

22 May '25

'Security researchers have recently uncovered a new type of cyberattack targeting Linux systems — a technique dubbed “ClickFix.” Originally known for its impact on Windows environments, ClickFix is now being adapted and tested by threat actors against Linux platforms, signaling an expansion in both scope and sophistication. ClickFix is a novel post-exploitation tactic that allows attackers to interact with graphical desktop environments through simulated clicks and UI manipulations. By abusing legitimate tools like xdotool, attackers can automate interactions with graphical interfaces — such as clicking confirmation dialogs, accepting permissions, or launching malicious scripts — even on hardened systems. This type of attack can bypass traditional security mechanisms by operating at the user interface level, making it especially dangerous in environments where users assume GUI-based interactions are secure.' -- source: https://cyptd.com/hackers-now-testing-clickfix-attacks-on-linux-systems/ Cheers, Peter

1 0

Mobile Browsers That Stick Their Noses Into Your Business
by Peter Reutemann 22 May '25

22 May '25

'Some figures hit my desk this morning about mobile browsers and the data they collect that I found interesting enough to want to pass on. Some of this won’t surprise anybody, such as the fact that Chrome is the most data-hungry mobile browser app. What might come as a surprise to many, is that Chrome is the only browser that collects financial information, such as payment methods, card numbers, and bank account details. It also collects contacts from a phone’s address book. The figures came from Surfshark, the cybersecurity folks with an eponymous VPN, which took a look at the 10 browsers it identified as the most popular. Topping the list was Chrome, which presents a somewhat mind-boggling list of privacy intrusions that includes everything from contacts and financial information to data on location, browsing and search history, content — such as photos, videos, audio recordings, uploaded files, and other stuff — usage data, identifiers — device ID, user ID, or IP address — as well as even more data that’s not identified by the study.' -- source: https://fossforce.com/2025/05/mobile-browsers-that-stick-their-noses-into-y… One thing that I wasn't aware of under Android, you will have a unique Ad ID: Settings > Privacy > Ads > Opt out of ad personalization Cheers, Peter

1 0

KDE Is Getting a Native Virtual Machine Manager Called 'Karton'
by Peter Reutemann 21 May '25

21 May '25

'A new virtual machine manager called Karton is being developed specifically for the KDE Plasma desktop, aiming to offer a seamless, Qt-native alternative to GNOME-centric tools like GNOME Boxes. Spearheaded by University of Waterloo student Derek Lin as part of Google Summer of Code 2025, Karton uses libvirt and Qt Quick to build a user-friendly, fully integrated VM experience, with features like a custom SPICE viewer, snapshot support, and a mobile-friendly UI expected by September 2025. Neowin reports: To feel right at home in KDE, Karton is being built with Qt Quick and Kirigami. It uses the libvirt API to handle virtual machines and could eventually work across different platforms. Right now, development is focused on getting the core parts in place. Lin is working on a new domain installer that ditches direct virt-install calls in favor of libosinfo, which helps detect OS images and generate the right libvirt XML for setting up virtual machines more precisely. He's still refining device configuration and working on broader hypervisor support. Another key part of the work is building a custom SPICE viewer using Qt Quick from scratch: If you're curious, here's the list of specific deliverables Lin included in his GSoC proposal, though he notes the proposal itself is a bit outdated [...]. For those interested in the timeline, Lin's GSoC proposal says the official GSoC coding starts June 2, 2025. The goal is to have a working app ready by the midterm evaluation around July 14, 2025, with the final submission due September 1, 2025. ' -- source: https://tech.slashdot.org/story/25/05/20/2223215 Cheers, Peter

1 0

Microsoft Open Sources Windows Subsystem for Linux
by Peter Reutemann 20 May '25

20 May '25

'Windows Subsystem for Linux (WSL) is now open source, Microsoft said Monday. The tool, which allows developers to run Linux distributions directly in Windows, is available for download, modification, and contribution. "We want Windows to be a great dev box," said Pavan Davuluri, corporate VP at Microsoft. "Having great WSL performance and capabilities" allows developers "to live in the Windows-native experience and take advantage of all they need in Linux." First launched in 2016 with an emulated Linux kernel, WSL switched to using the actual Linux kernel in 2019 with WSL 2, improving compatibility. The system has since gained support for GPUs, graphical applications, and systemd. Microsoft significantly refactored core Windows components to make WSL a standalone system before open sourcing it.' -- source: https://news.slashdot.org/story/25/05/19/1654225 Cheers, Peter

1 0

Final Bookworm-Based Raspberry Pi OS Released Ahead of Debian Trixie
by Peter Reutemann 20 May '25

20 May '25

'The Raspberry Pi Foundation has just released a new version of Raspberry Pi OS, their recommended, freely distributed operating system for all Raspberry Pi devices. Still based on Debian 12 ”Bookworm,” this build is likely the last one in this series before Debian 13 “Trixie” arrives later this summer.' -- source: https://linuxiac.com/final-bookworm-based-raspberry-pi-os-released-ahead-of… Cheers, Peter

1 0

Raspberry Pi Connect Goes Stable
by Peter Reutemann 19 May '25

19 May '25

'After just twelve months of public testing, Raspberry Pi Connect—the company’s browser-based remote-access service—officially graduated from beta with the release of version 2.5. According to Raspberry Pi engineer Chris Lowder, the platform’s install base has already topped 100,000 registered boards. Earlier iterations of the software relied on frequent polling: each Pi woke up at regular intervals to ask Raspberry Pi’s servers whether anyone wanted to connect. That design was easy on the cloud side—traffic remained predictable—but it quietly chewed through users’ data plans and power budgets. Version 2.5 replaces that pattern with a single, persistent HTTP connection. Now, when a user presses “Connect” in the web dashboard, the server broadcasts a wake-up event to the board, initiating the handshake on demand instead of on a schedule. Beyond wake-ups, every Connect client has been sending status heartbeats to keep the dashboard in sync. The new release debounces that chatter, dropping superfluous packets and compressing each remaining heartbeat by roughly 50 percent.' -- source: https://linuxiac.com/raspberry-pi-connect-goes-stable/ Anyone got any experience with this that they'd like to share? Cheers, Peter

1 0

Spies hack high-value mail servers using an exploit from yesteryear
by Peter Reutemann 16 May '25

16 May '25

'Threat actors, likely supported by the Russian government, hacked multiple high-value mail servers around the world by exploiting XSS vulnerabilities, a class of bug that was among the most commonly exploited in decades past. XSS is short for cross-site scripting. Vulnerabilities result from programming errors found in webserver software that, when exploited, allow attackers to execute malicious code in the browsers of people visiting an affected website. XSS first got attention in 2005, with the creation of the Samy Worm, which knocked MySpace out of commission when it added more than one million MySpace friends to a user named Samy. XSS exploits abounded for the next decade and have gradually fizzled more recently, although this class of attacks continues now. On Thursday, security firm ESET reported that Sednit, a Kremlin-backed hacking group also tracked as APT28, Fancy Bear, Forest Blizzard, and Sofacy—gained access to high-value email accounts by exploiting XSS vulnerabilities in mail server software from four different makers. Those packages are: Roundcube, MDaemon, Horde, and Zimbra.' -- source: https://arstechnica.com/security/2025/05/spies-hack-high-value-mail-servers… Cheers, Peter

1 0

Google Restores File Permissions For Nexcloud
by Peter Reutemann 16 May '25

16 May '25

'Nextcloud has been in an ongoing battle with Google over the tech giant revoking the All Files permission from the Nextcloud Android App, which prevents users from managing their files on their server. After a blog post and several tech sites reported on the issue, "Google reached out to us [Nexcloud] and offered to restore the permission, which will give users back the functionality that was lost." Nextcloud is working on an app update and hopes to have it pushed out within a week.' -- source: https://tech.slashdot.org/story/25/05/15/208221 Cheers, Peter

2 1

You Can Now Upgrade Ubuntu 24.10 to Ubuntu 25.04, Here’s How
by Peter Reutemann 15 May '25

15 May '25

'After almost a month of waiting, Ubuntu 24.10 (Oracular Oriole) users can finally upgrade their installations to the latest Ubuntu 25.04 (Plucky Puffin) release. Here’s a step-by-step tutorial with screenshots on how to perform the upgrade! Ubuntu 24.10 was released on October 10th, 2024, and will be supported for a couple more months, until July 2025. Since this isn’t an LTS (Long Term Support) release, users might want to consider upgrading to Ubuntu 25.04 as soon as possible. Compared to Ubuntu 24.10, the Ubuntu 25.04 release ships with a newer kernel for better hardware support, namely Linux 6.14, the Mesa 25 graphics stack series for a better gaming experience, the latest GNOME 48 desktop environment, as well as some of the most recent GNU/Linux technologies.' -- source: https://9to5linux.com/you-can-now-upgrade-ubuntu-24-10-to-ubuntu-25-04-here… Cheers, Peter

1 0

Introducing oniux: Kernel-level Tor isolation for any Linux app
by Peter Reutemann 15 May '25

15 May '25

'When launching privacy-critical apps and services, developers want to make sure that every packet really only goes through Tor. One mistyped proxy setting–or a single system-call outside the SOCKS wrapper–and your data is suddenly on the line. That's why today, we are excited to introduce oniux: a small command-line utility providing Tor network isolation for third-party applications using Linux namespaces. Built on Arti, and onionmasq, oniux drop-ships any Linux program into its own network namespace to route it through Tor and strips away the potential for data leaks. If your work, activism, or research demands rock-solid traffic isolation, oniux delivers it.' -- source: https://blog.torproject.org/introducing-oniux-tor-isolation-using-linux-nam… Cheers, Peter

1 0

European Vulnerability Database (EUVD)
by Peter Reutemann 14 May '25

14 May '25

Talking about vulnerabilities... 'The European Vulnerability Database (EUVD) is now fully operational, offering a streamlined platform to monitor critical and actively exploited security flaws amid the US struggles with budget cuts, delayed disclosures, and confusion around the future of its own tracking systems https://euvd.enisa.europa.eu/' -- source: https://mastodon.social/@nixCraft/114501509209870711 Cheers, Peter

1 0

Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations)
by Peter Reutemann 14 May '25

14 May '25

'In July 2024, the upstream Screen maintainer asked us [2] if we could have a look at the current Screen code base. We treated this request with lower priority, since we already had a cursory look at Screen a few years earlier, without finding any problems. When we actually found time to look into it again, we were surprised to find a local root exploit in the Screen 5.0.0 major version update affecting distributions that ship it as setuid-root (Arch Linux and NetBSD). We also found a number of additional, less severe issues that partly also affect older Screen versions still found in the majority of distributions.' -- source: https://www.openwall.com/lists/oss-security/2025/05/12/1 Cheers, Peter

1 0

FreeBSD Wants to Know a Few Things
by Peter Reutemann 14 May '25

14 May '25

'The FreeBSD Core Team and the FreeBSD Foundation have a few questions it would like to ask its users. What this means is that it’s survey time at FreeBSD… again. In other words, 2024’s user survey turns out not to have been the one-off we thought it was, and the FreeBSD Community Survey is looking like it’s going to become an annual event. This year’s survey was announced on Friday will run through May 7. Taking it won’t take much time — 15 minutes the organization says on its website — and the information gleaned from the results will be key for keeping the project on track. The foundation says that last year’s survey was used to help it determine the project’s priorities — which can change from year to year — as well as a guide for its development efforts and community engagement strategies for the upcoming year and beyond. The surveys are helpful for identifying user needs, assessing satisfaction levels, and highlighting areas requiring improvement, such as hardware support, documentation, and contribution processes.' -- source: https://fossforce.com/2025/04/freebsd-wants-to-know-a-few-things/ Link to survey in the referenced article. Anybody on the mailing list using a BSD variant currently? Cheers, Peter

1 0

Redis returns to open source with AGPLv3 license but not everyone is happy
by Peter Reutemann 14 May '25

14 May '25

'Over the last few years, companies like Redis, Elastic, MongoDB, and HashiCorp have abandoned their open-source license roots and switched to proprietary models. However, there is one significant problem with this attempt to squeeze more money from their formerly open-source programs: it doesn't work. Redis, the widely used in-memory key-value database, appears to have figured this out. Last year, Redis dumped its three-clause Berkeley Software Distribution (BSD) license and replaced it with the read-only Redis Source Available License (RSALv2) and Server Side Public License (SSPLv1). Now, Redis has officially returned to an open-source license, announcing that Redis 8 will be available under the open-source GNU Affero General Public License version 3 (AGPLv3). Last year's change was intended to prevent large cloud providers from offering Redis as a managed service without contributing to the project, a challenge many open-source companies face in the cloud era. However, the move ticked off developers. The result was a fork, Valkey, backed by the Linux Foundation and major cloud vendors. Valkey has proven to be very popular. Indeed, Amazon Web Services (AWS), Google, Ericsson, and Oracle have all adopted Valkey. [...] The new AGPLv3 option, effective with the recently released Redis 8, represents a significant shift. AGPLv3 is an Open Source Initiative (OSI)-approved, copyleft license that requires any modifications or derivative works to be released under the same terms, and crucially, mandates that source code be made available to users who interact with the software over a network. This network clause is meant to close the so-called "Software as a Service (SaaS) loophole," ensuring that cloud providers who offer Redis as a service must either open-source their changes or negotiate a commercial license with Redis Inc.' -- source: https://www.zdnet.com/article/redis-returns-to-open-source-with-agplv3-lice… Cheers, Peter

1 0

Nextcloud Cries Foul Over Google Play Store App Rejection
by Peter Reutemann 14 May '25

14 May '25

'Nextcloud has accused Google of sabotaging its Android Files app by revoking the "All files access" permission, which the company says cripples functionality for its 824,000 users and forces reliance on limited alternatives like SAF and MediaStore. The Register reports: Nextcloud's Android Files app is a file synchronization tool that, according to the company, has long had permission to read and write all file types. "Nextcloud has had this feature since its inception in 2016," it said, "and we never heard about any security concerns from Google about it." That changed in 2024, when someone or something at Google's Play Store decided to revoke the permission, effectively crippling the application. Nextcloud was instructed to use "a more privacy-aware replacement." According to Nextcloud, "SAF cannot be used, as it is for sharing/exposing our files to other apps ... MediaStore API cannot be used as it does not allow access to other files, but only media files." Attempts to raise the issue with Google resulted in little more than copy-and-pasted sections of the developer guide. "Despite multiple appeals from our side and sharing additional background, Google is not considering reinstating upload for all files," Nextcloud said. The issue seems to stem from the Play Store. While a fully functional version is available on F-Droid, the Play Store edition is subject to Google's imposed limitations. Regarding the All files access permission, Google's developer documentation states: "If you target Android 11 and declare All files access, it can affect your ability to publish and update your app on Google Play." Nextcloud is clearly aggrieved by the change, as are its users. "This might look like a small technical detail but it is clearly part of a pattern of actions to fight the competition," it said. "What we are experiencing is a piece of the script from the big tech playbook." [...] Are there nefarious actors at play here, an automated process that auto-rejects apps with elevated access requirements, or is it just simple incompetence? "Either way," Nextcloud said, "it results in companies like ours just giving up, reducing functionality just to avoid getting kicked out of their app store." "The issue is that small companies -- like ours -- have pretty much no recourse," it added. Nextcloud went on to criticize oversight processes as slow-moving, with fines that sound hefty but amount to little more than a slap on the wrist. "Big Tech is scared that small players like Nextcloud will disrupt them, like they once disrupted other companies. So they try to shut the door."' -- source: https://tech.slashdot.org/story/25/05/13/2045258 Cheers, Peter

1 0

openSUSE Removes Deepin Desktop Over Security Policy Violations
by Peter Reutemann 09 May '25

09 May '25

'In recent development, the openSUSE project has decided to remove the Deepin Desktop Environment (DDE), well-known for its polished visuals and user-friendly experience, from its repositories, citing substantial packaging policy violations. According to disclosures from the openSUSE security team, a troubling workaround was discovered in the DDE packaging. Specifically, the Deepin community packager introduced a “license agreement” dialog within the deepin-feature-enable package, effectively circumventing standard security review processes required by openSUSE. Ordinarily, components such as D-Bus system service configurations and Polkit policies must undergo stringent review by the SUSE security team before being whitelisted for inclusion in openSUSE distributions. In this case, however, the discovered “license agreement” allowed users to bypass these security checks, installing components flagged by the security team as potentially unsafe simply by accepting the license.' -- source: https://linuxiac.com/opensuse-removes-deepin-desktop-over-security-policy-v… Cheers, Peter

1 0

Linux Drops Support For 486 and Early Pentium Processors
by Peter Reutemann 09 May '25

09 May '25

'ZDNet reports: RIP, 486 processor. You've had a long run since Intel released you back in 1989. While Microsoft stopped supporting you with the release of Windows XP in 2001, Linux kept you alive and well for another 20+ years. But all good things must come to an end, and with the forthcoming release of the Linux 6.15 kernel, the 486 and the first Pentium processors will be sunsetted. Why? Linus Torvalds wrote recently on the Linux Kernel Mailing List (LKML), "I really get the feeling that it's time to leave i486 support behind. There's zero real reason for anybody to waste one second of development effort on this kind of issue." Senior Linux kernel developer Ingo Molnar put Torvalds' remark into context, writing, "In the x86 architecture, we have various complicated hardware emulation facilities on x86-32 to support ancient 32-bit CPUs that very very few people are using with modern kernels. This compatibility glue is sometimes even causing problems that people spend time to resolve, which time could be spent on other things." "This will be the first time Linux has dropped support for a major chip family since 2012, when Linux stopped supporting the 386 family," notes ZDNet's Steven Vaughan-Nichols. "Moving forward, the minimum supported x86 CPU will now be the original Pentium (P5) or newer, requiring the presence of the Time Stamp Counter (TSC) and the CMPXCHG8B (CX8) instruction. These features are absent in the older 486 and early 586 processors, such as the IDT WinChip and AMD Elan families." That said, you can continue running Linux on Pentium CPUs, but you'll have to "run museum kernels," as Torvalds pointed out in 2022 when he first floated the idea of ending support for 486.' -- source: https://hardware.slashdot.org/story/25/05/08/1927245 Cheers, Peter

1 0