- wlug - list.wlug.org.nz

WireGuard for Windows 0.3.1 is the release you’ve been waiting for
by Peter Reutemann 26 Nov '20

26 Nov '20

'This Monday, WireGuard founder and lead developer Jason Donenfeld announced a new WireGuard release for the Windows platform. The release is something of a godsend for administrators hoping to implement WireGuard as a replacement for more traditional end-user VPNs in a business environment, adding several new features that will make their lives easier—or simply make its implementation possible, in environments where it otherwise would not. If you haven't heard about WireGuard yet, it's a relatively new VPN protocol featuring advanced cryptography. It's implemented from the ground up as an exercise in cleanly written, minimalist, maximally secure and performant code—and it succeeded at those goals well enough to get Linus Torvalds' own rarely-seen stamp of approval. ' -- source: https://arstechnica.com/gadgets/2020/11/wireguard-for-windows-0-3-1-is-the-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linus Torvalds Would Like To Use An M1 Mac For Linux, But...
by Peter Reutemann 25 Nov '20

25 Nov '20

'Yes, Torvalds said he'd love to have one of the new M1-powered Apple laptops, but it won't run Linux and, in an exclusive interview he explains why getting Linux to run well on it isn't worth the trouble. Steven J. Vaughan-Nichols writes via ZDNet: Recently, on the Real World Technologies forum, Linux's creator Linus Torvalds was asked what he thought of the new M1-powered Apple laptops. Torvalds replied, "I'd absolutely love to have one if it just ran Linux." You may think, "what's the problem? Doesn't Linux run on practically every processor on the planet from 80386s to IBM s390x to the ARM family of which Apple's M1 chip is a child?" Well, yes, yes it does. But it takes more than a processor to run a computer. Torvalds would like to run Linux on these next-generation Macs. As he said, "I've been waiting for an ARM laptop that can run Linux for a long time. The new Air would be almost perfect, except for the OS. And I don't have the time to tinker with it, or the inclination to fight companies that don't want to help." Aye, there's the rub. In an exclusive interview, Torvalds expanded on why he can't see porting Linux to the M1-based Macs. "The main problem with the M1 for me is the GPU and other devices around it, because that's likely what would hold me off using it because it wouldn't have any Linux support unless Apple opens up." Still, while Torvalds knows Apple opening up their chipsets "seems unlikely, but hey, you can always hope." Even if that "wasn't an issue," Torvalds continued, "My personal hope would be more cores. Even in a laptop, I don't care about 20-hour battery life (and I wouldn't get it building kernels anyway). I'd rather plug it in a bit more often, and have 8 big cores." As for the Mac's limited RAM -- no more than 16GBs on current models -- he can live with that. "16GBs is actually ok by me because I don't tend to do things that require a lot more RAM. All I do is read email, do git and kernel compiles. And yes, I have 64GB in my desktop, but that's because I have 32 cores and 64 threads, and I do hugely parallel builds. Honestly, even then 32GB would be sufficient for my loads." That said, other developers and power users may want more from the new Macs, Torvalds thinks. "The people who really want tons of memory are the ones doing multiple VMs or huge RAW file photography and video." ' -- source: https://hardware.slashdot.org/story/20/11/24/2225209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZLUG] CFP: LCA2021 Systems Administration Miniconf
by Peter Reutemann 25 Nov '20

25 Nov '20

Apologies for cross-posting, but since the event is down-under/online some people on this list might want to present/attend. Cheers, Peter ---------- Forwarded message --------- From: Ewen McNeill Date: Wed, Nov 25, 2020 at 11:33 AM Subject: [NZLUG] CFP: LCA2021 Systems Administration Miniconf To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> linux.conf.au 2021 is being held in an "Online Only" format from 23-25 January 2021 (Saturday through Monday!), starting with a Miniconf day on Saturday 2021-01-23. Based in UTC+11 (AEDT), it makes for a "sleep in" schedule for attending from New Zealand! Tickets are extra affordable this year (AU $125/$70/$30), and on sale now: https://lca2021.linux.org.au/attend/tickets/ (Sadly NZers don't get the electronic badge option :-( ) The Systems Administration Miniconf is one of four Miniconfs being held on Saturday 2021-01-23, and would welcome your presentation proposals now (closes 2020-12-18 AoE). For details see: https://sysadmin.miniconf.org/cfp21.html or read on, as the CFP is repeated below for your convenience. Ewen -=- cut here -=- LCA2021 Systems Administration Miniconf: Call for Presentations Saturday 2021-01-23 10:45-17:30 UTC+11 at Linux.conf.au 2021, Online Virtualisation has won! As of 2021, they have even virtualised our Systems Administration Miniconf! TL;DR: If you know our Miniconf, and know online presenting, you can propose your 15-20 minute Linux-related operations talk via the LCA2021 Dashboard *before* 2020-12-18: https://linux.conf.au/dashboard We'd particularly love your 2020 War Stories! Read on to find out more :-) Introduction ============ The linux.conf.au Systems Administration Miniconf returns for the 15th time as part of the very online linux.conf.au 2021, to be held without a venue (Venueless!), online on Saturday 2021-01-23, based in UTC+11 (AEDT -- Australian Eastern Daylight Time). The Systems Administration Miniconf focuses on tips, tricks, tools, and best practices used to manage real-world Linux environments both large and small. From single small servers through to 2,000 node Kubernetes Clusters. The organisers of the Systems Administration Miniconf would like to invite proposals for presentations to be delivered at the Miniconf. Please forward this CFP to your colleagues, peers, social networks, and other relevant mailing lists. Please help by encouraging submissions from people you would like to hear present at this Miniconf. We are open to presentations from speakers anywhere in the world, but please be mindful of the need to present during daytime in UTC+11 which may not be daytime in your local timezone (presenting late at night or very early in your morning is tricky!). More information and details of previous presentations at the Miniconf can be found at the website: https://sysadmin.miniconf.org/ Presentation Topics =================== 2020 has been a surprising year, and not the least for systems administration -- remote *everything* came with a rush, leaving many officeless, and dependent on the Internet and video conferencing. We would be particularly interested in talks about how 2020 has gone for your systems, how you dealt with the rapid changes in operating environment, and what your plans look like for a world where touching physical hardware frequently seems increasingly unlikely. Tell us your war stories :-) We would be very interested in retrospectives and "lessons learned" from the past year. We of course also welcome the usual range of talks on systems technology, automation, monitoring, troubleshooting, best current practices and so on. Presentations should be of a technical nature and speakers should assume that members of the audience have at least a couple of years experience in professional Linux administration (many in the audience will have decades of experience). Format of Presentations ======================= Due to the online only format, and its increased demands on the AV team, we have to fit into a more fixed structure within the LCA2021 Miniconf day. So we have less flexibility in our choice of presentations, that usual. We have openings for 15 and 20 minute short presentations (ie, each approximately half of a 45-minute "session", with a 10 minute gap in between). LCA2021 have indicated they have a strong preference for presentations to be given live, which will be easier if your local time zone is close to UTC+11 and you have an Internet connection with good upload speeds. For accepted Miniconf speakers the LCA2021 AV Team will want to check in with you *early* January 2021 to help ensure your presentation audio and visuals come across as well as possible. You may wish to watch the AV Team advice from PyConline AU 2020 to get some advanced hints on small changes you could make to help your presentation look and sound great: https://www.youtube.com/watch?v=C1TBqdULp4E Submitting talks ================ Please note that in order to give a presentation or attend the Miniconf you must be registered (and paid up by the time the conference happens) for the main linux.conf.au conference. Either for the full conference (Sat/Sun/Mon), or at least for the Miniconf day (Saturday 2021-01-23). As a one off "online only, LCA2021 only" special we have access to a small pool of "Miniconf Speaker" tickets, so if your employer will not pay for your ticket and the conference cost makes it difficult for you to attend/present please get in touch and we will see if we can help. To submit a talk to the LCA2021 Sysadmin Miniconf, create an account on the LCA2021 website: https://linux.conf.au/dashboard create a speaker profile, and then select "Systems Administration Miniconf Talk" (in the "New Proposal" section of the Dashboard), or while logged into the LCA2021 site, go directly to: https://linux.conf.au/proposals/submit/sysadmin-miniconf/ Questions should be sent to: lca2021 at sysadmin.miniconf.org Dates and Deadlines =================== To encourage early submissions, priority (both of inclusion and scheduling) will be given to presentations submitted by 23:59 (AoE -- ie any time zone) on Sunday 6 December 2020. If you have a good presentation idea, please let us know early, even if you need time to finalise the presentation abstract. 2020-12-06 - Deadline for early submissions 2020-12-11 - early acceptances 2020-12-18 - Deadline for all submissions 2020-12-21 - final acceptances 2020-12-24 - LCA2021 Sysadmin Miniconf initial programme published 2021-01-21 - LCA2021 Sysadmin Miniconf held (Online, UTC+11) Contact and Questions ===================== Please see our website at https://sysadmin.miniconf.org for more information on the miniconf, past presentations and presenting at it. If you have any questions please feel free to email the organisers at: lca2021 at sysadmin.miniconf.org -=- cut here -=- _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LISP presentation uploaded to WLUG github.
by Ian Stewart 25 Nov '20

25 Nov '20

Hi Folks, For last night's LISP presentation, the slide show file and the LISP demonstration programs have been uploaded to: https://github.com/WLUG/meetings/tree/master/2020/2020-11-23 The slide show is available in both .odp and .pdf formats. The demonstration programs all have shebangs for CLISP, but these may be changed to be for SBCL. The programs have been tested to work under both CLISP and SBCL. Note that SBCL seems to be fussier than CLISP and, for example, requires (defvar) functions before the variable could be loaded via a (setf) function. At the meeting Jake demonstrated the apropos function to help with finding symbols. An appendix slide has been added to the presentation to show this function. I have also added my first attempt at something resembling a real a LISP program, package-symbols.lisp. This program will list packages that are available to either SBCL or CLISP. Upon selecting a package, it will display all the symbols the package has. If the command line argument "function" is used (E.g., $ sbcl --script package-symbols function) then the symbols displayed will be filtered to only displaying symbols that are functions. cheers, Ian.

1 1

Gimp Turns 25
by Peter Reutemann 24 Nov '20

24 Nov '20

'The General Image Manipulation Program, GIMP, has turned 25. A brief celebration post detailed how the package started life as a July 1995 Usenet thought bubble by then-student Peter Mattis, who posted the following to several newsgroups: Suppose someone decided to write a graphical image manipulation program (akin to photoshop). Out of curiosity (and maybe something else), I have a few (2) questions: What kind of features should it have? (tools, selections, filters, etc.) What file formats should it support? (jpeg, gif, tiff, etc.)" Four months later, Mattis and fellow University of California Berkeley student Spencer Kimball delivered what they described as software "designed to provide an intuitive graphical interface to a variety of image editing operations." The software ran on Linux 1.2.13, Solaris 2.4, HPUX 9.05, and SGI IRIX. The answer to the file format support question turned out to be GIF, JPEG, PNG, TIFF, and XPM. The rest is history. Richard Stallman gave Mattis and Kimball permission to change the "General" in its name to "GNU", reflecting its open-source status. Today the program is released under the GNU General Public License. As the program added features such as layers, it grew more popular and eventually became a byword for offering a FOSS alternative to Photoshop even though the project pushes back against that description. The project's celebration page says volunteers did their "best to provide a sensible workflow to users by using common user interface patterns. That gave us a few questionable monikers like 'Photoshop for Linux', 'free Photoshop', and 'that ugly piece of software'. We still can wholeheartedly agree with the latter one only!"' -- source: https://it.slashdot.org/story/20/11/23/1946252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Mass-Produced, Librem 5 Linux Smartphone Begins Shipping to Customers
by Peter Reutemann 23 Nov '20

23 Nov '20

'This week Purism began shipping its mass-produced Librem 5 phone to customers, according to announcement from the company: The Librem 5 is a one-of-a-kind general-purpose computer in a phone form-factor that Purism has designed and built from scratch following a successful crowdfunding campaign that raised over $2.2 million. Both the hardware and software design is focused on respecting the end user's freedom and giving them control over their privacy and security. The Librem 5 doesn't run Android nor iOS but instead runs the same PureOS operating system as Purism's laptops and mini PC. The Librem 5 has unique hardware features including a user-removable cellular modem, WiFi card, and battery. Like with Librem laptops, the Librem 5 also features external hardware kill switches that cut power to the cellular modem, WiFi/Bluetooth, and front and back cameras and microphone so that the user can control when these devices are in use. All hardware switches can also be triggered together to enable "lockdown mode" which also disables the GPS, accelerometer and all other sensors... Another unique feature of the Librem 5 is convergence: the ability to connect the Librem 5 to a monitor or laptop dock and use it as a desktop computer running the same full-sized desktop applications as on Librem laptops. When in a phone form-factor, applications behave much like "responsive websites" and change their appearance for the smaller screen. This allows you to use the Librem 5 as a phone, a desktop, or a laptop with the same applications and same files. Their announcement notes their work on software making desktop applications "adaptive" to phone form factors, adding "This suite of software has now become the most popular software stack to use on other handheld Linux hardware." And they close with an appreciative comment from Purism's founder and CEO Todd Weaver: "Shipping the Librem 5 has been an immense multi-year developmental effort. It is the culmination of people's desire to see an alternative to Android and iOS and fund it, coupled with dedication from a team of experts addressing hardware, kernel, operating system, and applications that has turned a lofty near-impossible goal into reality. We have built a strong foundation and with the continued support of customers, the community, and developers, we will continue to deliver revolutionary products like the Librem 5 running PureOS."' -- source: https://mobile.slashdot.org/story/20/11/23/025228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Ubuntu Web Remix' Distro Offers Firefox-Based Chrome OS Alternative
by Peter Reutemann 23 Nov '20

23 Nov '20

'Rudra Saraswat is the creator of the Ubuntu Unity distro (which uses the Unity interface in place of Ubuntu's GNOME shell). But this week they released Ubuntu Web Remix, "a privacy-focused, open source alternative to Google Chrome OS/Chromium OS" using Firefox instead of Google Chrome/Chromium. Liliputing reports: If the name didn't give it away, this operating system is based on Ubuntu, but it's designed to offer a Chrome OS-like experience thanks to a simplified user interface and a set of pre-installed apps including the Firefox web browser, some web apps from /e/, and Anbox, a tool that allows you to run Android apps in Linux... You don't get the long battery life, cloud backup, and many other features that make Chromebooks different from other laptops (especially other cheap laptops). But if you're looking for a simple, web-centric operating system that isn't made by a corporate giant? Then I guess it's nice to have the option. Rudra Saraswat writes: An easy web-app (wapp) format has been created to package web-apps for the desktop. You can now create your own web apps using web technologies, package them for the desktop and install them easily. An experimental wapp store can be found at store.ubuntuweb.co, for distributing web apps. Developers and packagers can do pull requests at gitlab.com/ubuntu-web/ubuntu-web.gitlab.io to contribute wapps. ' -- source: https://news.slashdot.org/story/20/11/22/0226213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Firefox Boosted Its JavaScript Performance
by Peter Reutemann 23 Nov '20

23 Nov '20

'InfoWorld reports: Firefox users can expect improved JavaScript performance in the Firefox 83 browser, with the Warp update to the SpiderMonkey JavaScript engine enabled by default. Also called WarpBuilder, Warp improves responsiveness and memory usage and speeds up page loads by making changes to JiT (just-in-time) compilers... Warp has been shown to be faster than Ion, SpiderMonkey's previous optimizing JiT, including a 20 percent improvement on Google Docs load time. Other JavaScript-intensive websites such as Netflix and Reddit also have shown improvement... Warp has replaced the front end — the MIR building phase — of the IonMonkey JiT... Mozilla also will continue to incrementally optimize the back end of the IonMonkey JiT, as Mozilla believes there is still room for improvement for JavaScript-intensive workloads.' -- source: https://news.slashdot.org/story/20/11/22/0412232 I agree, 83 feels snappier when browsing. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After Restoring YouTube-dl, GitHub Revamps Its Copyright Takedown Policy
by Peter Reutemann 22 Nov '20

22 Nov '20

'On October 23rd GitHub initially complied with a takedown request for the open-source project youtube-dl — and then after 24 days, reinstated it. "If there's a silver lining to the episode, it's that GitHub is implementing new policies to avoid a repeat of a repeat situation moving forward," reports Engadget: First, it says a team of both technical and legal experts will manually evaluate every single section 1201 claim. In instances where there's any ambiguity to a claim, the company says it will err on the side of developers and leave their repository online. If the company's technical and legal teams ultimately find any issues with a project, GitHub will give its owners the chance to address those problems before it takes down their work. Following a takedown, it will continue to give people the chance to recover their data — provided it doesn't include any offending code. GitHub is also establishing a $1 million defense fund to provide legal aid to developers against suspect section 1201 claims, as well as doubling down on its lobbying work to amend the DMCA and other similar copyright laws across the world. ' -- source: https://yro.slashdot.org/story/20/11/21/0554250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fearing Drama, Mozilla Opens Public Consultation Before Worldwide Firefox DoH Rollout
by Peter Reutemann 20 Nov '20

20 Nov '20

'Mozilla has opened today a public comment and consultation period about the ways it could enable support for the controversial privacy-centric DNS-over-HTTPS (DoH) protocol inside Firefox. From a report: The browser maker's decision to open a rare public consultation period comes after the organization faced criticism last year in the UK for its plans to support DoH inside Firefox. UK government officials, law enforcement agencies, and local internet service providers criticized Mozilla for developing and wanting to roll out DoH, a feature they said could have helped suspects bypass enterprise firewalls and parental controls blocklists -- even earning the browser maker a nomination for an "Internet Villain" award from a local ISP. All last year's hoopla was caused by DoH, a web protocol developed as an alternative to the classic DNS (Domain Name System). DoH works by encrypting DNS queries (which are normally sent out in clear text) and hiding them inside normal-looking HTTPS web traffic.' -- source: https://tech.slashdot.org/story/20/11/19/1711200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

OpenStreetMap is Having a Moment
by Peter Reutemann 20 Nov '20

20 Nov '20

'Joe Morrison: The first time I spoke with Jennings Anderson, I couldn't believe what he was telling me. I mean that genuinely -- I did not believe him. He was a little incredulous about it himself. I felt like he was sharing an important secret with me that the world didn't yet know. The open secret Jennings filled me in on is that OpenStreetMap (OSM) is now at the center of an unholy alliance of the world's largest and wealthiest technology companies. The most valuable companies in the world are treating OSM as critical infrastructure for some of the most-used software ever written. The four companies in the inner circle -- Facebook, Apple, Amazon, and Microsoft -- have a combined market capitalization of over six trillion dollars. In almost every other setting, they are mortal enemies fighting expensive digital wars of attrition. Yet they now find themselves eagerly investing in and collaborating on OSM at an unprecedented scale (more on the scale later). What likely started as a conversation in a British pub between grad students in 2004 has spiraled out of control into an invaluable, strategic, voluntarily-maintained data asset the wealthiest companies in the world can't afford to replicate. I will admit that I used to think of OSM as little more than a virtuous hobby for over-educated Europeans living abroad -- a cutesy internet collectivist experiment somewhere on the spectrum between eBird and Linux. It's most commonly summarized with a variant of this analogy: OSM is to an atlas as Wikipedia is to an encyclopedia. OSM acolytes hate this comparison in the much same way baseball players resent when people describe the sport as "cricket for fat people." While vaguely truthful, it doesn't quite get to the spirit of the thing. OSM is incomparable. Over 1.5M individuals have contributed data to it. It averages 4.5M changes per day. The stats page on the OSM Wiki is a collection of hockey sticks. [...] ' -- source: https://slashdot.org/story/20/11/19/1935221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google is Rolling Out End-To-End Encryption for RCS in Android Messages Beta
by Peter Reutemann 20 Nov '20

20 Nov '20

'After two long, complicated years, every Android user worldwide (outside China) now has access to the next-gen texting standard that is replacing SMS. Google is directly offering RCS chat services through its Android Messages app to anybody who installs it and uses it as their default texting app, which partly bypasses a carrier rollout that, at times, has ranged from sluggish to incoherent to broken. From a report Just as importantly, Google has announced that it's finally beginning to enable a key privacy feature: end-to-end encryption. For Android users who use Android Messages, one-on-one chats will eventually be end-to-end encrypted by default, meaning neither carriers nor Google will be able to read the content of those messages. Even though encryption is only beginning to roll out to people who sign up for the public beta for Android Messages, turning on encryption for RCS is a very big deal. It's a massive privacy win, as it could mean that the de facto replacement for SMS will, by default, be private on the smartphone platform used by the vast majority of people worldwide. As for the people who use that other smartphone platform -- the iPhone -- we have no word on whether Apple intends to adopt the RCS standard. But as every carrier worldwide gets on board, and now that there is a clearer path to ensuring private communication with RCS, the pressure on Apple to participate is likely to build. Unfortunately, SMS becoming fully deprecated and replaced by RCS will only happen if all goes to plan for Google. Since initially announcing plans to transition to RCS as the primary texting platform for Android, the standard's rollout has been mired in confusion. In attempting to be neutral and make Android's texting a standard shared by carriers worldwide, Google set itself up with the job of herding multibillion-dollar cats -- with sadly predictable results.' -- source: https://tech.slashdot.org/story/20/11/19/1528230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

BBC Releases Doctor-Who-Themed RISC-V-Based Programming Kit
by Lawrence D'Oliveiro 20 Nov '20

20 Nov '20

The BBC has created a miniature computer, the “Doctor Who HiFive Inventor”, aimed at young ’uns trying to learn programming <https://www.theregister.com/2020/11/19/bbc_doctor_who_sifive/>. This uses a RISC-V processor from SiFive, includes quite a range of I/O interfaces, and comes with lessons narrated by Jodie “Thirteenth Doctor” Whittaker. Pricing looks comparable to Raspberry-π-based products, too.

1 0

Apple Silicon Performance
by Lawrence D'Oliveiro 20 Nov '20

20 Nov '20

You may have seen reports popping up everywhere as Apple’s new Macs running its ARM-based “Apple Silicon” chips get into the hands of the first buyers. They seem to offer remarkable performance while still managing good battery life, even while a lot of the software they are running is still written for x86 processors and being translated on the fly through the “Rosetta 2” emulator layer. One of the secrets to that performance is that the system RAM is integrated into the CPU chipset <https://www.theregister.com/2020/11/19/apple_m1_high_bandwidth_memory_perfo…>. Yup, that means RAM is not upgradeable on these machines.

1 0

Microsoft’s “Project Reunion” Leads To More Fragmentation
by Lawrence D'Oliveiro 20 Nov '20

20 Nov '20

If you thought the Microsoft Windows development landscape was already confusing enough, consider this update <https://www.theregister.com/2020/11/19/microsoft_winui_windows/> on “Project Reunion” ... which [Windows Developer VP] Gallo described as “a common platform for new apps and APIs so that they will work down-level across supported versions of Windows.” A developer asked: “For a new desktop app what is your recommendation, UWP? WinUI, WPF or WinForm?” To which there was no simple answer. Indeed, while the presentation introduced WinUI version 3, it appears WinUI 2.x will also continue to be developed. Instead, Gallo talked about no longer having binary choices, but being able to mix and match in the brave new Reunion world. I wonder if anybody at Microsoft really understands what “Reunion” means ...

1 0

Google's Native Version of Chrome For Apple's ARM Macs Is Out Now
by Peter Reutemann 19 Nov '20

19 Nov '20

'According to Chrome product manager Mark Chang, Google's version of Chrome that support ARM Macs is now available to download. The Verge reports: In theory, a native version of the notoriously resource-hungry browser might run more efficiently on Apple's Arm-based computers. In our reviews of the MacBook Air, MacBook Pro, and Mac mini equipped with the new M1 chip, though, we found that the version of Chrome built for Intel chips already runs well on Apple's new Macs, so hopefully this native version runs even better. You'll be able to pick which version of Chrome to download from the browser's website. Google began rolling out a new version of Chrome on Tuesday, touting the "the largest gain in Chrome performance in years" thanks to some under-the-hood changes. The company's blog about the new release didn't mention anything about a version optimized for Apple's Arm-based Macs.' -- source: https://apple.slashdot.org/story/20/11/18/2239226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Massive, China-State-Funded Hack Hits Companies Around the World, Report Says
by Peter Reutemann 19 Nov '20

19 Nov '20

'Ars Technica: Researchers have uncovered a massive hacking campaign that's using sophisticated tools and techniques to compromise the networks of companies around the world. The hackers, most likely from a well-known group that's funded by the Chinese government, are outfitted with both off-the-shelf and custom-made tools. One such tool exploits Zerologon, the name given to a Windows server vulnerability, patched in August, that can give attackers instant administrator privileges on vulnerable systems. Symantec uses the code name Cicada for the group, which is widely believed to be funded by the Chinese government and also carries the monikers of APT10, Stone Panda, and Cloud Hopper from other research organizations. The group has been active in espionage-style hacking since at least 2009 and almost exclusively targets companies linked to Japan. While the companies targeted in the recent campaign are located in the United States and other countries, all of them have links to Japan or Japanese companies. The attacks make extensive use of DLL side-loading, a technique that occurs when attackers replace a legitimate Windows dynamic-link library file with a malicious one. Attackers use DLL side-loading to inject malware into legitimate processes so they can keep the hack from being detected by security software. The campaign also makes use of a tool that's capable of exploiting Zerologon. Exploits work by sending a string of zeros in a series of messages that use the Netlogon protocol, which Windows servers use to let users log into networks. People with no authentication can use Zerologon to access an organization's crown jewels -- the Active Directory domain controllers that act as an all-powerful gatekeeper for all machines connected to a network. Microsoft patched the critical privilege-escalation vulnerability in August, but since then attackers have been using it to compromise organizations that have yet to install the update. Both the FBI and Department of Homeland Security have urged that systems be patched immediately. Among the machines compromised during attacks discovered by Symantec were domain controllers and file servers. Company researchers also uncovered evidence of files being exfiltrated from some of the compromised machines.' -- source: https://it.slashdot.org/story/20/11/19/0124204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

$6 Billion Linux Deal? SUSE IPO Rumored
by Peter Reutemann 18 Nov '20

18 Nov '20

'ZDNet: According to Bloomberg, EQT is planning an IPO for German Linux and enterprise software company SUSE. EQT is a Swedish-based private equity firm with 50 billion euros in raised capital. SUSE is the leading European Union (EU) Linux distributor. Over the years, SUSE has changed owners several times. First, it was acquired by Novell in 2004. Then, Attachmate, with some Microsoft funding, bought Novell and SUSE in 2010. This was followed in 2014 when Micro Focus purchased Attachmate and SUSE was spun off as an independent division. Then, EQT purchased SUSE from Micro Focus for $2.5 billion in March 2019. With an IPO of approximately $6 billion, EQT would do very well for itself in very little time. Bloomberg states that the IPO talks are in a very preliminary stage. Nothing may yet come of these conversations. As for SUSE, a company representative said, "As a company, we are constantly exploring ways to grow. But as a matter of corporate policy, we do not comment on rumor or speculation in the market."' -- source: https://linux.slashdot.org/story/20/11/17/2148202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 83 Arrives With HTTPS-Only Mode and Faster Performance
by Peter Reutemann 18 Nov '20

18 Nov '20

'Mozilla today launched Firefox 83 for Windows, Mac, and Linux. An anonymous reader shares a report: Firefox 83's highlight feature is HTTPS-Only Mode, in which the browser attempts to establish fully secure connections to every website (just like the EFF's HTTPS Everywhere). If it can't, Firefox asks for your permission before connecting to a website that doesn't support secure connections. To enable HTTPS-Only Mode, click on Firefox's menu button, hit Preferences, then Privacy & Security, scroll down to HTTPS-Only Mode, and choose "Enable HTTPS-Only Mode in all windows." [...] Firefox 83 also brings performance improvements (improved page load performance by up to 15%, page responsiveness by up to 12%, and reduced memory usage by up to 8%). Firefox 83 is also the penultimate version of the web browser that will run Flash software; Firefox 85 will completely disable it when it arrives on Jan. 12, 2021.' -- source: https://news.slashdot.org/story/20/11/17/1725230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 87 Released With Fix for NAT Slipstream Attacks, Broader FTP Deprecation
by Peter Reutemann 18 Nov '20

18 Nov '20

'Google has released today version 87 of its Chrome browser, a release that comes with a security fix for the NAT Slipstream attack technique and a broader deprecation of the FTP protocol. From a report: Todays' release is available for Windows, Mac, Linux, Chrome OS, Android, and iOS. Users can update to the new version via Chrome's built-in update utility. While in previous versions, Google has shipped some changes to Chrome settings and UI elements, almost all the major new Chrome 87 features are aimed at web developers. In Chrome 87, we have new APIs and updates to Chrome's built-in Developer Tools, such as: Support for the new Cookie Store API; new features to allow easier modification of web fonts via CSS; a new feature to let websites enumerate all the locally installed fonts; support for pan, tilt, and zoom controls on webcam streams; and, support for debugging WebAuthn operations via the Chrome DevTools.' -- source: https://slashdot.org/story/20/11/17/1810248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 18 Nov '20

18 Nov '20

Hi everyone We have a meeting coming up next Monday: "Introduction to the LISP programming language will be presented by Jake Waas and Ian Stewart. They will focus on the open source CLISP and SBCL dialects of the LISP language and the use of functions in the COMMON-LISP package. By the end of the presentation you will be able to write simple LISP programs." -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266792044/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Interview With KDE Developers
by Lawrence D'Oliveiro 17 Nov '20

17 Nov '20

Talk with a couple of the KDE “maintainers” (?) <https://www.theregister.com/2020/11/16/kde_maintainers_speak_on_why/> on the origins of KDE and where it stands today. The fact that it is built on Qt, which is heavily used in many commercial projects, means “Qt has to work well with a small footprint because of embedded systems, and that means KDE’s Plasma desktop has had a fundamental change since the mindset of KDE 3 days, when it was considered bloated and heavy,” said Riddell. “Now it’s a really fast, lightweight desktop.” Some other worthwhile info there, including discussions of working with Wayland and systemd.

1 0

GitHub Reinstates YouTube-dl Library After EFF Intervention
by Peter Reutemann 17 Nov '20

17 Nov '20

'GitHub has reinstated today the youtube-dl open-source project, a Python library that lets users download the source audio and video files behind YouTube videos. From a report: GitHub, a code-hosting repository, had previously removed the library from its portal after it received a controversial DMCA takedown request from the Recording Industry Association of America (RIAA) on October 23. In a DMCA takedown letter, RIAA argued that the library was being used to "circumvent the technological protection measures used by authorized streaming services such as YouTube" and to allow users to "reproduce and distribute music videos and sound recordings [...] without authorization." RIAA also noted that the project's source code "expressly suggests its use to copy and/or distribute the following copyrighted works." More specifically, RIAA used Section 1201 of the Digital Millennium Copyright Act (DMCA) to claim that the youtube-dl library was breaking copyright by providing a tool to circumvent copyrighted material -- even if the youtube-dl library didn't contain copyright-infringing code itself. But in a blog post today, GitHub said the library did not actually break Section 1201 of the DMCA, citing a letter it received from Electronic Frontier Foundation lawyers, who to take up the youtube-dl project's case. In the letter, the EFF team explained that Google does not have any technical measures in place to prevent the download of its videos -- all of which need to be made freely available to all kinds of apps, browsers, smart TVs, and more. Hence, EFF lawyers argued that the library could never be taken down under Section 1201 of the DMCA since the library doesn't actually circumvent any sort of copyright protection system in the first place.' -- source: https://yro.slashdot.org/story/20/11/16/1730250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ok Google: Please Publish Your DKIM Secret Keys
by Peter Reutemann 17 Nov '20

17 Nov '20

'Matthew Green, a cryptographer and professor at Johns Hopkins University, writes: The Internet is a dangerous place in the best of times. Sometimes Internet engineers find ways to mitigate the worst of these threats, and sometimes they fail. Every now and then, however, a major Internet company finds a solution that actually makes the situation worse for just about everyone. Today I want to talk about one of those cases, and how a big company like Google might be able to lead the way in fixing it. This post is about the situation with Domain Keys Identified Mail (DKIM), a harmless little spam protocol that has somehow become a monster. My request is simple and can be summarized as follows: Dear Google: would you mind rotating and publishing your DKIM secret keys on a periodic basis? This would make the entire Internet quite a bit more secure, by removing a strong incentive for criminals to steal and leak emails. The fix would cost you basically nothing, and would remove a powerful tool from hands of thieves.' -- source: https://tech.slashdot.org/story/20/11/16/1932234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

There’s Open Source, And There’s Open Source
by Lawrence D'Oliveiro 13 Nov '20

13 Nov '20

Vendors open-sourcing a bunch of code isn’t enough, if that code remains under the de-facto control of the vendor. It needs to be possible for a community to influence its development direction, rather than passively waiting for the next code drop from the vendor, according to Dave Airlie <https://www.theregister.com/2020/11/12/intel_igc_mesa/>. He says: “A warning then to anyone wishing for more vendor code sharing between OSes it generally doesn't end with Linux being better off, it ends up with Linux being more fragmented, harder to support and in the long run unsustainable.”

1 0

E-Cycle
by john 12 Nov '20

12 Nov '20

Hi All. Service industries now has a receiving warehouse offering all computers and paraphernalia can be dumped for free. Similarly any stuff that is salvageable is given away. Email ewasterecyclers(a)gmail.com Keily 021-526-4825 Adrian 020-256-2289 5 Johnson Street Dinsdale. Cheers John

1 0

Ubuntu fixes bugs that standard users could use to become root
by Peter Reutemann 12 Nov '20

12 Nov '20

'Ubuntu developers have fixed a series of vulnerabilities that made it easy for standard users to gain coveted root privileges. “This blog post is about an astonishingly straightforward way to escalate privileges on Ubuntu,” Kevin Backhouse, a researcher at GitHub, wrote in a post published on Tuesday. “With a few simple commands in the terminal, and a few mouse clicks, a standard user can create an administrator account for themselves.” The first series of commands triggered a denial-of-service bug in a daemon called accountsservice, which as its name suggests is used to manage user accounts on the computer. To do this, Backhouse created a Symlink that linked a file named .pam_environment to /dev/zero, changed the regional language setting, and sent accountsservice a SIGSTOP. With the help of a few extra commands, Backhouse was able to set a timer that gave him just enough time to log out of the account before accountsservice crashed. When done correctly, Ubuntu would restart and open a window that allowed the user to create a new account that—you guessed it—had root privileges.' -- source: https://arstechnica.com/information-technology/2020/11/ubuntu-fixes-bugs-th… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

No, the New MacBook Air is Not Faster Than 98% of PC Laptops
by Peter Reutemann 12 Nov '20

12 Nov '20

'Gordon Mah Ung, writing at PC World: Let me just say it outloud, OK? Apple is full of it. I'm referring to Apple's claim that its fanless, Arm-based MacBook Air is "faster than 98 percent of PC laptops." Yes, you read that correctly: Apple officials literally claimed that the new MacBook Air using Apple's custom M1 chip is faster than 98 percent of all PC laptops sold this year. Typically, when a company makes such a claim, it publishes a benchmark, a performance test or actual details on what it's basing that marketing claim on. This to prevent lawyers from launching out of missile silos across the world. Apple's website restates the claim by stating: "M1 is faster than the chips in 98 percent of PC laptops sold in the past year." The site also includes a detail note that states: "Testing conducted by Apple in October 2020 using preproduction 13-inch MacBook Pro systems with Apple M1 chip and 16GB of RAM. Performance measured using select industry-standard benchmarks. PC configurations from publicly available sales data over the last 12 months. Performance tests are conducted using specific computer systems and reflect approximate performance of MacBook Pro." So, not only does Apple not say what tests it's basing its claims on, it doesn't even say where it sources the comparable laptops. Does that mean the new fanless MacBook Air is faster than, say, Asus' stupidly fast Ryzen 4000 based, GeForce RTX 2060-based Zephyrus G14? Does it mean the MacBook Air is faster than Alienware's updated Area 51M? The answer, I'm going to guess is "no." Not at all. Is it faster than the miniLED-based MSI Creator 17? Probably not, either. And what is that "performance" claim hinged on? CPU performance? GPU performance? Performance running Windows? Is it using the same application running on both platforms? Is it experiential? Is this running Red Dead Redemption II or Call of Duty: Black Ops Cold War? Is it running CyberLink's PowerDirector? Is it running Fortnite? While I have absolutely no idea what Apple is basing its claims on, I can tell you that I am 98 percent sure that any of the above laptops listed will wreck the MacBook Air doing any of the tasks I just named. When Apple makes its claims, my guess is they are comparing the new M1 to Intel-based processors ranging from Atom to Celeron N to Core i3 and up, all with integrated graphics. But by not defining the word "performance," all this becomes just pure marketing spin. And is it really fair to compare a $999 MacBook to one that costs $150? Because $150 PCs are included in the 98 percent of laptops sold. Maybe Apple should compare its own $150 MacBook Air against a $150 Chromebook or Windows-based laptop. Of course, that would mean Apple would have to sell a product that most people can afford. I have no doubt the M1 will be impressive, but do I think it's going to compare to 8-cores of Ryzen 4000 performance or a GeForce RTX 2060? No.' -- source: https://apple.slashdot.org/story/20/11/11/2114225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome To Block Tab-Nabbing Attacks
by Peter Reutemann 12 Nov '20

12 Nov '20

'Google will deploy a new security feature in Chrome next year to prevent tab-nabbing, a type of web attack that allows newly opened tabs to hijack the original tab from where they were opened. From a report: The new feature is scheduled to go live with Chrome 88, to be released in January 2021. While the term "tab-nabbing" refers to a broad class of tab hijacking attacks [see OWASP, Wikipedia], Google is addressing a particular scenario. This scenario refers to situations when users click on a link, and the link opens in a new tab (via the "target=_blank" attribute). These new tabs have access to the original page that opened the new link. Via the JavaScript "window.opener" function, the newly opened tabs can modify the original page and redirect users to malicious sites. This type of attack has powered quite a few phishing campaigns across the years. To mitigate this threat, browser makers like Apple, Google, and Mozilla have created the rel="noopener" attribute.' -- source: https://tech.slashdot.org/story/20/11/11/1558242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi 4 Can Be Safely Overclocked To 2.15 GHz
by Peter Reutemann 12 Nov '20

12 Nov '20

'When the Raspberry Pi 400 (a keyboard form-factor single board computer) was released last week, the company hinted at overclocking. Testing has now shown that the heat spreader used in that design does an excellent job. The chip was already clocked at 1.8 GHz, versus the stock 1.5 GHz in the original Raspberry Pi 4 Model B board. But it can be safely overclocked to 2.15 GHz, as can the Compute Module 4 with an adequate heat sink. At 2.0 GHz, the Pi 400 got up above 60 C and showed signs of continuing to warm up even after 50 minutes, but it was nowhere near throttling. So I tried 2.2 GHz, at which speed the CPU refused to boot entirely. Backing down to 2.15 GHz, it ran just fine, so I left it for three hours. It settled in at a cozy 62.5 C, which is warm, but well within specs. I ran the CM4 with the larger heatsink at 1.8 GHz to give some basis for comparison to the cheap heatsinks. What a big difference a big hunk of aluminum makes! It settled in at a comfortable 68 C or so. Even pushing it up to 2.15 GHz and leaving it for a couple hours, it stayed just a hair below 70C (158F) -- a safe margin on the throttling threshold -- and only a few degrees warmer than that huge heat spreader in the Pi 400.' -- source: https://hardware.slashdot.org/story/20/11/11/182203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's Play Store Identified as Main Distribution Vector For Most Android Malware
by Peter Reutemann 12 Nov '20

12 Nov '20

'The official Google Play Store has been identified as the primary source of malware installs on Android devices in a recent academic study -- considered the largest one of its kind carried out to date. >From a report: Using telemetry data provided by NortonLifeLock (formerly Symantec), researchers analyzed the origin of app installations on more than 12 million Android devices for a four-month period between June and September 2019. In total, researchers looked at more than 34 million APK (Android application) installs for 7.9 million unique apps. [...] The results showed that around 67% of the malicious app installs researchers identified came from the Google Play Store. Google did not respond to a request for comment made by ZDNet almost three weeks ago.' -- source: https://tech.slashdot.org/story/20/11/11/198244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cricket NZ Makes Exclusive Deal With Amazon Prime For Indian Market
by Lawrence D'Oliveiro 11 Nov '20

11 Nov '20

Indian cricket fans (of which there are many) wanting to watch NZ matches will need to sign up for the Amazon Prime streaming service, according to this <https://www.theregister.com/2020/11/11/amazon_prime_new_zealand_cricket_dea…>. The deal will run for six years from late next year.

1 0

Lightweight Linux Distros for Old Laptop (2020)
by Peter Reutemann 11 Nov '20

11 Nov '20

'Do not discard that old PC or laptop yet. You can use a lightweight Linux distro to make them as good as new. Some of these Linux distros are specifically for use in older machines. You can use any of the lightweight Linux distros and bring your old machine back to life. In as much we focus on the old distros, we do have some new releases that do not require many resources that can re-invent your old computers. Are you in any or all of the situations below? - Your computer is but still feel like you can revive it - Your computer is modern but runs on low power - You need to install a modern computer to reserve resources to other demanding tasks If you find yourself in any of the above situations, then the best choice of action would be to start looking for the best lightweight Linux distros for old computers.' -- source: https://linoxide.com/distros/lightweight-linux-distros-for-old-laptop/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Computer Scientists Achieve 'Crown Jewel' of Cryptography
by Peter Reutemann 11 Nov '20

11 Nov '20

'A cryptographic master tool called indistinguishability obfuscation has for years seemed too good to be true. Three researchers have figured out that it can work. Erica Klarreich, reporting for Quanta Magazine: In 2018, Aayush Jain, a graduate student at the University of California, Los Angeles, traveled to Japan to give a talk about a powerful cryptographic tool he and his colleagues were developing. As he detailed the team's approach to indistinguishability obfuscation (iO for short), one audience member raised his hand in bewilderment. "But I thought iO doesn't exist?" he said. At the time, such skepticism was widespread. Indistinguishability obfuscation, if it could be built, would be able to hide not just collections of data but the inner workings of a computer program itself, creating a sort of cryptographic master tool from which nearly every other cryptographic protocol could be built. It is "one cryptographic primitive to rule them all," said Boaz Barak of Harvard University. But to many computer scientists, this very power made iO seem too good to be true. Computer scientists set forth candidate versions of iO starting in 2013. But the intense excitement these constructions generated gradually fizzled out, as other researchers figured out how to break their security. As the attacks piled up, "you could see a lot of negative vibes," said Yuval Ishai of the Technion in Haifa, Israel. Researchers wondered, he said, "Who will win: the makers or the breakers?" "There were the people who were the zealots, and they believed in [iO] and kept working on it," said Shafi Goldwasser, director of the Simons Institute for the Theory of Computing at the University of California, Berkeley. But as the years went by, she said, "there was less and less of those people." Now, Jain -- together with Huijia Lin of the University of Washington and Amit Sahai, Jain's adviser at UCLA -- has planted a flag for the makers. In a paper posted online on August 18, the three researchers show for the first time how to build indistinguishability obfuscation using only "standard" security assumptions. All cryptographic protocols rest on assumptions -- some, such as the famous RSA algorithm, depend on the widely held belief that standard computers will never be able to quickly factor the product of two large prime numbers. A cryptographic protocol is only as secure as its assumptions, and previous attempts at iO were built on untested and ultimately shaky foundations. The new protocol, by contrast, depends on security assumptions that have been widely used and studied in the past. "Barring a really surprising development, these assumptions will stand," Ishai said. While the protocol is far from ready to be deployed in real-world applications, from a theoretical standpoint it provides an instant way to build an array of cryptographic tools that were previously out of reach. For instance, it enables the creation of "deniable" encryption, in which you can plausibly convince an attacker that you sent an entirely different message from the one you really sent, and "functional" encryption, in which you can give chosen users different levels of access to perform computations using your data. The new result should definitively silence the iO skeptics, Ishai said. "Now there will no longer be any doubts about the existence of indistinguishability obfuscation," he said. "It seems like a happy end."' -- source: https://science.slashdot.org/story/20/11/10/1922225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

And Now For Some Local Bork
by Lawrence D'Oliveiro 10 Nov '20

10 Nov '20

A laser projection mural in Christchurch goes slightly wrong, showing a Windows 10 message instead <https://www.theregister.com/2020/11/09/bork/>: There can be few of us who have not felt the clammy hand of a Windows update on our shoulder, but sticking it on a mural and declaring it "art"? That takes a New Zealander.

1 0

HP Replaces 'Free Ink for Life' Plan With '99 Cents a Month Or Your Printer Stops Working'
by Peter Reutemann 10 Nov '20

10 Nov '20

'In a new essay at EFF.org, Cory Doctorow re-visits HP's anti-consumer "security updates" that disabled third-party ink cartridges (while missing real vulnerabilities that could actually bypass network firewalls). Doctorow writes that it was just the beginning: HP's latest gambit challenges the basis of private property itself: a bold scheme! With the HP Instant Ink program, printer owners no longer own their ink cartridges or the ink in them. Instead, HP's customers have to pay a recurring monthly fee based on the number of pages they anticipate printing from month to month; HP mails subscribers cartridges with enough ink to cover their anticipated needs. If you exceed your estimated page-count, HP bills you for every page (if you choose not to pay, your printer refuses to print, even if there's ink in the cartridges). If you don't print all your pages, you can "roll over" a few of those pages to the next month, but you can't bank a year's worth of pages to, say, print out your novel or tax paperwork. Once you hit your maximum number of "banked" pages, HP annihilates any other pages you've paid for (but continues to bill you every month). Now, you may be thinking, "All right, but at least HP's customers know what they're getting into when they take out one of these subscriptions," but you've underestimated HP's ingenuity. HP takes the position that its offers can be retracted at any time. For example, HP's "Free Ink for Life" subscription plan offered printer owners 15 pages per month as a means of tempting users to try out its ink subscription plan and of picking up some extra revenue in those months when these customers exceeded their 15-page limit. But Free Ink for Life customers got a nasty shock at the end of last month: HP had unilaterally canceled their "free ink for life" plan and replaced it with "a $0.99/month for all eternity or your printer stops working" plan... For would-be robber-barons, "smart" gadgets are a moral hazard, an irresistible temptation to use those smarts to reconfigure the very nature of private property, such that only companies can truly own things, and the rest of us are mere licensors, whose use of the devices we purchase is bound by the ever-shifting terms and conditions set in distant boardrooms. From Apple to John Deere to GM to Tesla to Medtronic, the legal fiction that you don't own anything is used to force you to arrange your affairs to benefit corporate shareholders at your own expense. And when it comes to "razors and blades" business-model, embedded systems offer techno-dystopian possibilities that no shaving company ever dreamed of: the ability to use law and technology to prevent competitors from offering their own consumables. >From coffee pods to juice packets, from kitty litter to light-bulbs, the printer-ink cartridge business-model has inspired many imitators. HP has come a long way since the 1930s, reinventing itself several times, pioneering personal computers and servers. But the company's latest reinvention as a wallet-siphoning ink grifter is a sad turn indeed, and the only thing worse than HP's decline is the many imitators it has inspired.' -- source: https://hardware.slashdot.org/story/20/11/09/0221226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tim Berners Lee's Startup Inrupt Releases Privacy Platform for Enterprises
by Peter Reutemann 10 Nov '20

10 Nov '20

'Inrupt, the startup from World Wide Web founder Tim Berners-Lee, announced an enterprise version of the Solid privacy platform today, which allows large organizations and governments to build applications that put users in control of their data . From a report: Berners-Lee has always believed that the web should be free and open, but large organizations have grown up over the last 20 years that make their money using our data. He wanted to put people back in charge of their data, and the Solid open source project, developed at MIT, was the first step in that process. Three years ago he launched Inrupt, a startup built on top of the open source project, and hired John Bruce to run the company. The two shared the same vision of shifting data ownership without changing the way websites get developed. With Solid, developers use the same standards and methods of building sites, and these applications will work in any browser. What Solid aims to do is alter the balance of data power and redirect it to the user. "Fast forward to today, and we're releasing the first significant technology as the fruits of our labor, which is an enterprise version of Solid to be deployed at scale by large organizations," Bruce explained. The core idea behind this approach is that users control their data in online storage entities called Personal Online Data Stores or Pods for short. The enterprise version consists of Solid Server to manage the Pods, and developers can build applications using an SDK to take advantage of the Pods and access the data they need to do a particular job like pay taxes or interact with a healthcare provider. Bruce points out that the enterprise version is fully compatible with the open source Solid project specifications. The company has been working with some major organizations prior to today's release including the BBC and National Health Service in the UK and the Government of Flanders in Belgium as they have been working to bring this to market.' -- source: https://yro.slashdot.org/story/20/11/09/1453252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Compal, the Second-Largest Laptop Manufacturer in the World, Hit By Ransomware
by Peter Reutemann 10 Nov '20

10 Nov '20

'Compal, a Taiwanese electronics company that builds laptops for some of the world's largest computer brands, suffered a ransomware attack over the weekend. From a report: Responsible for the breach is believed to be the DoppelPaymer ransomware gang, according to a screenshot of the ransom note shared by Compal employees with Yahoo Taiwan reporters. According to Taiwanese media, the incident was discovered on Sunday morning and is believed to have impacted around 30% of Compal's computer fleet. Employees arriving at work were greeted by a memo from Compal's IT staff, asking workers to check the status of their workstations and back up important files on systems that were not impacted.' -- source: https://it.slashdot.org/story/20/11/09/1615207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FTC Announces a Settlement With Zoom Over Security Issues
by Peter Reutemann 10 Nov '20

10 Nov '20

'Zoom will implement new security practices as part of a proposed settlement with the Federal Trade Commission, the agency announced on Monday. From a report: "Zoom has agreed to a requirement to establish and implement a comprehensive security program, a prohibition on privacy and security misrepresentations, and other detailed and specific relief to protect its user base, which has skyrocketed from 10 million in December 2019 to 300 million in April 2020 during the COVID-19 pandemic," the FTC said in a press release.' -- source: https://news.slashdot.org/story/20/11/09/1645233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cyberattackers Now Also Make Linux Versions of Their Ransomware
by Peter Reutemann 09 Nov '20

09 Nov '20

'"Security firm Kaspersky said Friday that it discovered a Linux version of the RansomEXX ransomware," reports ZDNet, "marking the first time a major Windows ransomware strain has been ported to Linux to aid in targeted intrusions." RansomEXX is a relatively new ransomware strain that was first spotted earlier this year in June. The ransomware has been used in attacks against the Texas Department of Transportation, Konica Minolta, U.S. government contractor Tyler Technologies, Montreal's public transportation system, and, most recently, against Brazil's court system (STJ)... The RansomEXX gang creating a Linux version of their Windows ransomware is in tune with how many companies operate today, with many firms running internal systems on Linux, and not always on Windows Server. A Linux version makes perfect sense from an attacker's perspective; always looking to expand and touch as much core infrastructure as possible in their quest to cripple companies and demand higher ransoms. What we see from RansomEXX may soon turn out to be an industry-defining trend, with other big ransomware groups rolling out their Linux versions in the future as well. And, this trend appears to have already begun. According to cyber-security firm Emsisoft, besides RansomEXX, the Mespinoza (Pysa) ransomware gang has also recently developed a Linux variant from their initial Windows version.' -- source: https://linux.slashdot.org/story/20/11/07/0541223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Verdict After Hackaday's Teardown of a Raspberry Pi 400: 'Very, Very Slick'
by Peter Reutemann 09 Nov '20

09 Nov '20

'"You can't send Hackaday a piece of gear without us taking it apart," warns an article shared by Slashdot reader beggarwoman. Hackady's verdict? The new Raspberry Pi 400 "is very, very slick." Inside, there's a flat-flex that connects the keyboard, and you see that big aluminum heat sink. It's almost the full size of the keyboard, and it's thick and heat-taped to the CPU. You know it means business. It's also right up against the aluminum bottom of the keyboard, suggesting it could get radiative help that way, and maybe keep your fingers warm in the winter. (I didn't feel any actual heat, but it's gotta go somewhere, right? There are also vents in the underside of the case.) Four PZ1 screws and a little bit of courage to unstick the pad get you underneath the heat spreader to find, surprise!, a Raspberry Pi 4. This was a little anticlimactic, as I've just spent a couple weeks looking over the schematics for my review of the new Compute Module 4, and it's just exactly what you'd expect. It's a Raspberry Pi 4, with all the ports broken out, inside a nice keyboard, with a beefy heat spreader. Ethernet magnetics sit on one side, and the wireless module sits on the other. That's it! "[C]ombine this with a small touch screen, and run it all off of a 5 V power pack, and you've got a ton of portable computing in a very small package. "If you're not mousing around all the time anyway, there's a certain streamlined simplicity here that's mighty tempting."' -- source: https://hardware.slashdot.org/story/20/11/07/1938245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

On Older Versions of Android, Many Let's Encrypt-Secured Sites May Stop Working in 2021
by Peter Reutemann 09 Nov '20

09 Nov '20

'This year Let's Encrypt announced that it's issued a billion certificates, and it's been estimated they've made certs for almost 30% of web domains. But Friday they posted that "The DST Root X3 root certificate that we relied on to get us off the ground is going to expire — on September 1, 2021. Fortunately, we're ready to stand on our own, and rely solely on our own root certificate." "However, this does introduce some compatibility woes." Some software that hasn't been updated since 2016 (approximately when our root was accepted to many root programs) still doesn't trust our root certificate, ISRG Root X1. Most notably, this includes versions of Android prior to 7.1.1. That means those older versions of Android will no longer trust certificates issued by Let's Encrypt. Android has a long-standing and well known issue with operating system updates. There are lots of Android devices in the world running out-of-date operating systems. The causes are complex and hard to fix: for each phone, the core Android operating system is commonly modified by both the manufacturer and a mobile carrier before an end-user receives it. When there's an update to Android, both the manufacturer and the mobile carrier have to incorporate those changes into their customized version before sending it out. Often manufacturers decide that's not worth the effort. The result is bad for the people who buy these devices: many are stuck on operating systems that are years out of date. Currently, 66.2% of Android devices are running version 7.1 or above. The remaining 33.8% of Android devices will eventually start getting certificate errors when users visit sites that have a Let's Encrypt certificate. In our communications with large integrators, we have found that this represents around 1-5% of traffic to their sites. Hopefully these numbers will be lower by the time DST Root X3 expires next year, but the change may not be very significant. Let's Encrypt engineer Jacob Hoffman-Andrews explains that "In the time between now and September 29 we plan to start serving certificates with the 'alternate' link relation 186 to allow Automatic Certificate Management Environment (ACME) clients to programmatically select a chain they prefer." But Friday's blog post explains that won't solve everything: There will be site owners that receive complaints from users and we are empathetic to that being not ideal. We're working hard to alert site owners so you can plan and prepare. We encourage site owners to deploy a temporary fix (switching to the alternate certificate chain) to keep your site working while you evaluate what you need for a long-term solution: whether you need to run a banner asking your Android users on older OSes to install Firefox, stop supporting older Android versions, drop back to HTTP for older Android versions, or switch to a CA that is installed on those older versions. Gizmodo notes that Firefox will be unaffected "since it relies on its own certificate store that includes Let's Encrypt's root, though that wouldn't keep applications from breaking or ensure functionality beyond your browser." They describe Let's Encrypt as "the Mozilla-partnered nonprofit," and offers this succinct summary of the problem. "One of the world's top certificate authorities warns that phones running versions of Android prior to 7.1.1 Nougat will be cut off from large portions of the secure web starting in 2021."' -- source: https://it.slashdot.org/story/20/11/08/1654223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Generating Flag Emojis
by Lawrence D'Oliveiro 08 Nov '20

08 Nov '20

You may have seen our new Foreign Minister, Nanaia Mahuta, tweeting her congratulations to the next President of the USA, including a couple of country flag emojis. I was looking through the Unicode character list for the codes for country flags, and discovered that there aren’t any, as such. Instead, there is this range of special character codes (“Regional indicator symbols”): 1F1E6 REGIONAL INDICATOR SYMBOL LETTER A ... 1F1FF REGIONAL INDICATOR SYMBOL LETTER Z with a note saying These characters can be used in pairs to represent regional codes. In some emoji implementations, certain pairs may be recognized and displayed by alternate means; for instance, an implementation might recognize F + R and display this combination with a symbol representing the flag of France. So for example if I enter U+1F1F3 (the code for N in the above block) followed by U+1F1FF (the code for Z), being the ISO-3166 regional code for NZ, the text-rendering system could replace them with the NZ flag: 🇳🇿. Anyway, I found out this works in YouTube comments as well. (Not that I’m saying the YouTube commenting system is particularly fine -- but that’s another story...)

1 0

EFF Argues RIAA is 'Abusing DMCA' to Take Down YouTube-DL
by Peter Reutemann 08 Nov '20

08 Nov '20

'While the RIAA has objected to a tool for downloading online videos, EFF senior activist Elliot Harmon responds with this question. "Who died and put them in charge of YouTube?" He asks the question in a new video "explainer" on the controversy, and argues in a new piece at EFF.org that the youtube-dl tool "doesn't infringe on any RIAA copyrights." RIAA's argument relies on a different section of the DMCA, Section 1201. DMCA 1201 says that it's illegal to bypass a digital lock in order to access or modify a copyrighted work. Copyright holders have argued that it's a violation of DMCA 1201 to bypass DRM even if you're doing it for completely lawful purposes; for example, if you're downloading a video on YouTube for the purpose of using it in a way that's protected by fair use. (And thanks to the way that copyright law has been globalized via trade agreements, similar laws exist in many other jurisdictions too.) RIAA argues that since youtube-dl could be used to download music owned by RIAA-member labels, no one should be able to use the tool, even for completely lawful purposes. This is an egregious abuse of the notice-and-takedown system, which is intended to resolve disputes over allegedly infringing material online. Again, youtube-dl doesn't use RIAA-member labels' music in any way. The makers of youtube-dl simply shared information with the public about how to perform a certain task — one with many completely lawful applications. Harmon wants to hear from people using youtube-dl for lawful purposes. And he also links to an earlier EFF piece arguing that DMCA 1201 "is incredibly broad, apparently allowing rightsholders to legally harass any 'trafficker' in code that lets users re-take control of their devices from DRM locks..." And EFF's concern over DMCA 1201 has been ongoing: DMCA 1201 has been loaded with terrible implications for innovation and free expression since the day it was passed. For many years, EFF documented these issues in our "Unintended Consequences" series; we continue to organize and lobby for temporary exemptions to its provisions for the purposes of cellphone unlocking, restoring vintage videogames and similar fair uses, as well as file and defend lawsuits in the United States to try and mitigate its damage. We look forward to the day when it is no longer part of U.S. law. But due to the WIPO Copyright Treaty, the DMCA's anti-circumvention provisions infest much of the world's jurisdictions too, including the European Union via the Information Society Directive 2001/29/EC.' -- source: https://yro.slashdot.org/story/20/11/07/0313228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave Hits 20 Million Monthly Users a Year After 1.0 Release
by Peter Reutemann 06 Nov '20

06 Nov '20

'One year after its first 1.0 release, Brave says it has hit the milestone of 20.5 million active monthly users. "At the same time last year, the browser had 8.7 million active monthly users, and of the 20 million monthly users, 7 million are daily users, which represents more than a doubling of last year's 3 million," reports ZDNet. "Brave added that since Apple allowed browsers other than its own to be the default option on iOS, it has seen its iOS user base increase by a third." From the report: One of the touted features of the browser is that it hates ads, and will go out of its way to block them, unless users decide to see Brave-powered advertisements. To that end, Brave has hit "2 billion ad confirmation events" and completed 2,215 campaigns from over 460 companies. The browser maker says its users have a click-through rate of 9%, way and away outstripping industry averages. The browser also has its own cryptocurrency, Basic Attention Tokens, that users use to "tip" content creators. Thus far, 26 million of the tokens have been sent to creators. At the time of writing, the blockchain-based token is trading for just under 18 cents, meaning $4.6 million has been sent from users. ' -- source: https://tech.slashdot.org/story/20/11/05/0424253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Why Do Printers Still Suck?
by Peter Reutemann 06 Nov '20

06 Nov '20

'Just when we need them the most, with print shops locked down, online schooling in session, and everyone working from home, they fail to step up. From a column: Printers have been my enemy ever since I can remember. My first office job involved an evil printer that suffered daily paper jams. Tasked with fixing it, I suffered frequent burns and paper cuts. It had a door you had to close just so, or it would immediately break again with the dreaded phantom paper jam. It tormented me for months, completely indifferent to my cries. There isn't even any paper in it! More than two decades later, printers haven't improved at all. It feels like printer companies stopped innovating sometime in the '90s when sales stopped climbing. In fact, it's almost as if they've regressed. Manufacturers tempt with unbelievably cheap deals on printers and then nail you on expensive ink. To make sure they get their pound of flesh, they focus an inordinate effort on making sure printers only work with proprietary ink cartridges. [...] Three years and a couple of printers later, sick of being gouged for ink cartridges that always seem to run out at the worst moment, I optimistically signed up for a printing subscription plan. The idea is you are charged a flat fee based on how many pages you print each month, and the printer automatically orders ink refills when it's running low. Reading this back, I can only cringe at my naivety. Things were fine for the first few weeks. Then I made the mistake of turning the printer off. It doesn't like to be turned off. It started emailing me, insisting that it needs to be turned on and connected to the internet so the subscription plan can work properly. Every time I turn it on, it prints an ink-heavy test page. It is incredibly good at printing test pages -- it just won't print the document you want. Things got worse when I made the mistake of changing my internet service provider. I forgot about the printer for a while. Then I suddenly needed it. I didn't have time to set up the Wi-Fi, so I plugged directly into the printer with a good old-fashioned cable. It refused to print. I refused to connect it to the internet, so it refused to print for me. To get it working again I had to completely uninstall everything related to the printer, update my drivers, install three separate programs, carry it to another room to plug directly into my desktop, carry it back again, hold down the correct button sequence at the stroke of midnight, spin around three times, and recite the printer incantation into a mirror. It's finally connected and working ... for now. But I know it's only a matter of time before it betrays me again.' -- source: https://hardware.slashdot.org/story/20/11/05/2049213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

LibreOffice: OpenOffice Should Give Up And Die, Already
by Lawrence D'Oliveiro 06 Nov '20

06 Nov '20

Seems OpenOffice still has the edge in brand recognition over LibreOffice, in spite of being a largely moribund project with no major releases in 6 years. Yet, in spite of occasional talk of shutting it down, it continues to lurk, unloved, in some obscure corner of the ASF Orbiting HQ. <https://www.theregister.com/2020/10/15/libreoffice_openoffice_taunts/>

1 1

AMD Ryzen 5000 Series Processors Set a New Performance Bar Over Intel
by Peter Reutemann 06 Nov '20

06 Nov '20

'AMD made bold claims when the company unveiled its new Zen 3-based Ryzen 5000 series processors early last month. Statements like "historic IPC uplift" and "fastest for gamers" were waved about like flags of victory. However, as with most things in the computing world, independent testing is always the best way to validate claims. Today AMD lifted the embargo on 3rd party reviews and, in testing, AMD's new Ryzen 5000 series CPUs set a new performance bar virtually across the board, and one that Intel currently can't touch. There are four processors in the initial Ryzen 5000 series lineup, though it's a safe bet more will be coming later. The current entry point is the Ryzen 5 5600X 6-core / 8-thread processor, followed by the 8-core / 16-thread Ryzen 7 5800X, 12-core / 24 thread Ryzen 9 5900X, and the flagship 16-core / 32-thread Ryzen 9 5950X. All of these new CPUs are backwards compatible with AMD socket AM4 motherboards. In comparison to Zen 2, Zen 3 has a larger L1 branch target buffer and improved bandwidth through multiple parts of its pipeline with additional load/store flexibility. Where Zen 2 could handle 2 load and 1 store per cycle, Zen 3 can handle 3 load and 2 stores. All told, AMD is claiming an average 19% increase in IPC with Zen 3, which is a huge uplift gen-over-gen. Couple that IPC uplift with stronger multi-core scaling and a new unified L3 cache configuration, and Zen 3's performance looks great across a wide variety of workloads for both content creation and gaming especially. AMD's Ryzen 9 5950X, Ryzen 9 5900X, Ryzen 7 5800X and Ryzen 5 5600X will be priced at $799, $549, $449 and $299, respectively and should be on retail and etail shelves starting today.' -- source: https://slashdot.org/story/20/11/05/208242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dell Adding Hardware Privacy Driver For Linux
by Peter Reutemann 05 Nov '20

05 Nov '20

'According to Phoronix, a Dell privacy driver is is being prepared for the Linux kernel. From the report: Beginning in Dell's 2021 laptop models they are providing hardware-based "privacy buttons" to disable microphone and camera support. These new Dell privacy buttons are basically hardware kill switches for the microphone and web camera video stream. The Dell privacy driver sent out on Tuesday for the Linux kernel is about manipulating the relevant LEDs and tracking the status of the hardware-based controls where as the actual toggling of the audio/video support is handled by the hardware. The Dell privacy driver in its current form is talked about for the camera and microphone support but the patch does also note a "PRIVACY_SCREEN_STATUS" bit as well. Presumably they will be extending this privacy driver as well for privacy screen handling around reducing the horizontal/vertical viewing angles of the display. The dell-privacy Linux driver in its initial form can be found via the kernel mailing list. It's great seeing Dell working on this driver punctually for Linux ahead of their next-gen laptops. ' -- source: https://linux.slashdot.org/story/20/11/04/2216242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Mint Introduces Its Own Take On the Chromium Web Browser
by Peter Reutemann 05 Nov '20

05 Nov '20

'Mint's programmers, led by lead developer, Clement "Clem" Lefebvre, have built their own take on Google's open-source Chromium web browser. ZDNet reports: Some of you may be saying, "Wait, haven't they offered Chromium for years? Well, yes, and no. For years, Mint used Ubuntu's Chromium build. But then Canonical, Ubuntu's parent company, moved from releasing Chromium as an APT-compatible DEB package to a Snap. The Ubuntu Snap software packing system, along with its rivals Flatpak and AppImage, is a new, container-oriented way of installing Linux applications. The older way of installing Linux apps, such as DEB and RPM package management systems for the Debian and Red Hat Linux families, incorporate the source code and hard-coded paths for each program. While tried and true, these traditional packages are troublesome for developers. They require programmers to hand-craft Linux programs to work with each specific distro and its various releases. They must ensure that each program has access to specific libraries' versions. That's a lot of work and painful programming, which led to the process being given the name: Dependency hell. Snap avoids this problem by incorporating the application and its libraries into a single package. It's then installed and mounted on a SquashFS virtual file system. When you run a Snap, you're running it inside a secured container of its own. For Chromium, in particular, Canonical felt using Snaps was the best way to handle this program. [...] Lefebvre wrote, "The Chromium browser is now available in the official repositories for both Linux Mint and LMDE. If you've been waiting for this I'd like to thank you for your patience." Part of the reason was, well, Canonical was right. Building Chromium from source code is one really slow process. He explained, "To guarantee reactivity and timely updates we had to automate the process of detecting, packaging and compiling new versions of Chromium. This is an application which can require more than 6 hours per build on a fast computer. We allocated a new build server with high specifications (Ryzen 9 3900, 128GB RAM, NMVe) and reduced the time it took to build Chromium to a little more than an hour." That's a lot of power! Still, for those who love it, up-to-date builds of Chromium are now available for Mint users. ' -- source: https://linux.slashdot.org/story/20/11/03/2157255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0