- wlug - list.wlug.org.nz

Neofetch is over, but many screenshot system info tools stand ready
by Peter Reutemann 16 Sep '24

16 Sep '24

'Almost nobody truly needed Neofetch, but the people who did use it? They really liked it. Neofetch, run from a terminal, displayed key system information alongside an ASCII-art image of the operating system or distribution running on that system. You knew most of this data, but if you're taking a screenshot of your system, it looked cool and conveyed a lot of data in a small space. "The overall purpose of Neofetch is to be used in screen-shots of your system," wrote Neofetch's creator, Dylan Araps, on its Github repository. "Neofetch shows the information other people want to see." Neofetch did that, providing cool screenshots and proof-of-life images across nearly 150 OS versions until late April. The last update to the tool was made three years before that, and Araps' Github profile now contains a rather succinct coda: "Have taken up farming." Araps joins "going to a commune in Vermont" and "I now make furniture out of wood" in the pantheon of programmers who do not just leave the field, but flee into another realm entirely. As sometimes happens, the void was filled not by one decent replacement but many.' Alternatives from the article: - https://github.com/fastfetch-cli/fastfetch - https://github.com/ThatOneCalculator/NerdFetch - https://github.com/hykilpikonna/hyfetch - https://github.com/Macchina-CLI/macchina - https://github.com/Dr-Noob/cpufetch -- source: https://arstechnica.com/gadgets/2024/09/neofetch-is-over-but-many-screensho… Cheers, Peter

1 0

Ubuntu 22.04.5 LTS (Jammy Jellyfish) Is Now Available Powered by Linux Kernel 6.8
by Peter Reutemann 16 Sep '24

16 Sep '24

'Canonical released today Ubuntu 22.04.5 LTS as the fifth and last planned point release to the Ubuntu 22.04 LTS (Jammy Jellyfish) long-term supported operating system series bringing the latest security patches and updated components. Ubuntu 22.04.5 LTS is here six and a half months after Ubuntu 22.04.4 LTS as an up-to-date installation media designed for those of you who want to install Ubuntu 22.04 LTS (Jammy Jellyfish) on a new computer and don’t want to download hundreds of updated packages from the repositories after the installation. Apart from the security patches and updated packages that have been released during the past six months, the Ubuntu 22.04.5 LTS point release is powered by a newer kernel from the Ubuntu 24.04 LTS (Noble Numbat) operating system series, namely Linux kernel 6.8, to better support installations on newer hardware.' -- source: https://9to5linux.com/ubuntu-22-04-5-lts-jammy-jellyfish-is-now-available-p… Cheers, Peter

1 0

Haiku (Originally 'OpenBeOS') Releases Long Awaited R1/Beta5
by Peter Reutemann 16 Sep '24

16 Sep '24

'Haiku (the MIT-licensed operating system, inspired by BeOS) has released its fifth beta for Haiku R1. Some new features include improved UI color management, improved dark mode coloring, Tracker improvements, TUN/TAP support for VPN connections, TCP throughput improvements, performance optimizations, UFS2 (BSD's filesystem) read-only support, new FAT filesystem driver, improved hardware support, improved POSIX compliance, improved performance, and more. Slashdot has been covering the fate of the BeOS since 2000 (as well as the short-lived derivative project ZETA — and Haiku). And now "With a history of over two decades and previously known as OpenBeOS, today's Haiku is pushing forward..." writes the site NotebookCheck: Haiku is a spiritual successor to BeOS, with a focus on a clean and user-friendly design paired with low system requirements. The minimum system requirements are still an Intel Pentium II/AMD Athlon CPU or better, at least 384 MB RAM, an 800x600 screen, and at least 3GB storage. It works on both 32-bit and 64-bit x86 PCs, and the 32-bit version can run many unmodified BeOS applications. It might be the best desktop open-source operating system not based on Linux or Unix... It works well in a virtual machine like VirtualBox or UTM. ' -- source: https://news.slashdot.org/story/24/09/14/158240 Anybody ever tried running/using Haiku? Cheers, Peter

1 0

'Samba' Networking Protocol Project Gets Big Funding from the German Sovereign Tech Fund
by Peter Reutemann 16 Sep '24

16 Sep '24

'Samba is "a free software re-implementation of the SMB networking protocol," according to Wikipedia. And now the Samba project "has secured significant funding (€688,800.00) from the German Sovereign Tech Fund to advance the project," writes Jeremy Allison — Sam (who is Slashdot reader #8,157 — and also a long standing member of Samba's core team): The investment was successfully applied for by [information security service provider] SerNet. Over the next 18 months, Samba developers from SerNet will tackle 17 key development subprojects aimed at enhancing Samba's security, scalability, and functionality. The Sovereign Tech Fund is a German federal government funding program that supports the development, improvement, and maintenance of open digital infrastructure. Their goal is to sustainably strengthen the open source ecosystem. The project's focus is on areas like SMB3 Transparent Failover, SMB3 UNIX extensions, SMB-Direct, Performance and modern security protocols such as SMB over QUIC. These improvements are designed to ensure that Samba remains a robust and secure solution for organizations that rely on a sovereign IT infrastructure. Development work began as early as September the 1st and is expected to be completed by the end of February 2026 for all sub-projects. All development will be done in the open following the existing Samba development process. First gitlab CI pipelines have already been running and gitlab MRs will appear soon! Back in 2000, Jeremy Allison answered questions from Slashdot readers about Samba. Allison is now a board member at both the GNOME Foundation and the Software Freedom Conservancy, a distinguished engineer at Rocky Linux creator CIQ, and a long-time free software advocate.' -- source: https://news.slashdot.org/story/24/09/14/1726252 Cheers, Peter

1 0

copying random sample of files
by Peter Reutemann 12 Sep '24

12 Sep '24

Hi everyone I was just wondering how I can copy a random subset of files from one folder to another. And, of course, there bash utilities for that... ;-) I came across two solutions for copying 20 files from the current directory into DEST: - shuf cp `ls | shuf -n 20` DEST - sort (using random sort) ls | sort -R | tail -20 | while read file do cp $file DEST done source: https://stackoverflow.com/questions/414164/ Man pages: - shuf: https://www.man7.org/linux/man-pages/man1/shuf.1.html - sort: https://man7.org/linux/man-pages/man1/sort.1.html Cheers, Peter

3 3

Rogue WHOIS server gives researcher superpowers no one should ever have
by Peter Reutemann 12 Sep '24

12 Sep '24

'It’s not every day that a security researcher acquires the ability to generate counterfeit HTTPS certificates, track email activity, and the position to execute code of his choice on thousands of servers—all in a single blow that cost only $20 and a few minutes to land. But that’s exactly what happened recently to Benjamin Harris. Harris, the CEO and founder of security firm watchTowr, did all of this by registering the domain dotmobiregistry.net. The domain was once the official home of the authoritative WHOIS server for .mobi, a top-level domain used to indicate that a website is optimized for mobile devices. At some point—it’s not clear precisely when—this WHOIS server, which acts as the official directory for every domain ending in .mobi, was relocated, from whois.dotmobiregistry.net to whois.nic.mobi. While retreating to his Las Vegas hotel room during last month’s Black Hat security conference in Las Vegas, Harris noticed that the previous dotmobiregistry.net owners had allowed the domain to expire. He then scooped it up and set up his own .mobi WHOIS server there.' -- source: https://arstechnica.com/security/2024/09/rogue-whois-server-gives-researche… Cheers, Peter

1 0

Floorp browser
by Peter Reutemann 12 Sep '24

12 Sep '24

Hi everyone Just came across the Floorp browser, which is based on Firefox. Refreshing news, as most new browsers nowadays seem to be Chromium-based... 'Floorp, an amazing free and open-source browser backed by a Japanese company, has gained quite a bit of attention recently for offering data and privacy protection, including high customization options such as Vivaldi in relation to Chrome. The browser's performance was quite fascinating, as it was able to achieve 60% more speed compared to Firefox when tested with Speedometer and JetStream 2 benchmarking tools. If your current browser is Firefox and you love to tweak your browser, then I highly recommend you give it a try. The following is a list of data privacy and customization options offered by Floorp: - An option to enable strong fingerprints, disabling WebGL, and HTTPs for every site is available. - Open the link, image, and media in a new tab and immediately move to it. - Provide a vertical tab on the right side of the browser to quickly open certain sites or browser settings. - Built-in option to change between different user agents. - Offers a preset of 80 keyboard shortcuts for different browser actions. - It comes with Floorp Notes Sync, similar to Vivialdi, to keep your notes. - Integrated with Firefox sync to synchronize your browser bookmarks, cookies, logins, open tabs, etc.' -- source: https://ubuntushell.com/install-floorp/ -- project: https://floorp.app/ Cheers, Peter

1 2

SynthSaga -- A Good Use For AI
by Lawrence D'Oliveiro 09 Sep '24

09 Sep '24

Have a look at some of the stuff on this channel <https://www.youtube.com/@SynthSaga/videos> -- science-fiction-themed, steampunk, dieselpunk, alternative realities, whatever you want to call it. Mostly monochrome, but I still found several of them mind-blowing. Not sure if the audio was part of the same AI process, or if the artist (yes, I’d call them an artist) created that separately. Yeah, there are lots of glitches and bugs and hilariously impossible occlusions and the like. But that just adds to the hallucinatory feel. And each one is short, which leaves you wanting more. Wouldn’t you like to spend some time in a world like one of those? Just try to ignore the glitches in the matrix and go with the flow. ;)

1 0

3D Volumetric Voxel Display
by Lawrence D'Oliveiro 09 Sep '24

09 Sep '24

A guy from Weta Workshop has created a “volumetric voxel” display for showing 3D images, by spinning a regular 2D panel at a dizzyingly high speed (more than 300rpm). The images are fairly low-res: think 1980s pixelated graphics extended to the third dimension. <https://www.theverge.com/2024/9/6/24238004/doom-volumetric-voxel-display-an…> I hope it’s covered in some shield, not just to keep errant fingers (and other body parts away), but in case something ... um ... comes apart unexpectedly ...

1 0

Germany’s Sovereign Tech Fund Injects €686,400 into FreeBSD
by Peter Reutemann 04 Sep '24

04 Sep '24

'Sovereign Tech Fund, a funding pot supported financially by the German Federal Ministry for Economic Affairs and Climate Action and hosted by the German Federal Agency for Disruptive Innovation, has once again been one of Open Source’s great friends and supporters. After providing €1 million in financial support to GNOME at the end of last year and investing €203K in GStreamer and €157K in FFmpeg earlier this year, the company is now making another impressive donation to the open-source ecosystem. The FreeBSD Foundation has announced a €686,400 investment from STF to enhance the FreeBSD operating system’s infrastructure and security.' -- source: https://linuxiac.com/sovereign-tech-fund-injects-686400-into-freebsd/ Cheers, Peter

2 1

Elasticsearch Will Be Open Source Again as CTO Declares Changed Landscape
by Peter Reutemann 04 Sep '24

04 Sep '24

'Elastic, creator of popular search engine Elasticsearch and visualization tool Kibana, plans to introduce the AGPL open-source license alongside its existing licenses. The move comes three years after Elastic ditched the Apache 2.0 license, sparking controversy in the tech community. Founder Shay Banon says the change aims to clarify Elastic's market position following AWS's creation of OpenSearch, a fork of Elasticsearch. Despite initial friction, Banon claims Elastic's relationship with AWS has improved, citing growth in Elastic Cloud revenue and customer base.' -- source: https://news.slashdot.org/story/24/09/03/0511245 Cheers, Peter

1 0

YubiKeys Are Vulnerable To Cloning Attacks Thanks To Newly Discovered Side Channel
by Peter Reutemann 04 Sep '24

04 Sep '24

'The YubiKey 5, the most widely used hardware token for two-factor authentication based on the FIDO standard, contains a cryptographic flaw that makes the finger-size device vulnerable to cloning when an attacker gains brief physical access to it, researchers said Tuesday. ArsTechnica: The cryptographic flaw, known as a side channel, resides in a small microcontroller that's used in a vast number of other authentication devices, including smartcards used in banking, electronic passports, and the accessing of secure areas. While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven't tested other devices using the microcontroller, which is SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contain the same vulnerability. YubiKey-maker Yubico issued an advisory in coordination with a detailed disclosure report from NinjaLab, the security firm that reverse-engineered the YubiKey 5 series and devised the cloning attack. All YubiKeys running firmware prior to version 5.7 -- which was released in May and replaces the Infineon cryptolibrary with a custom one -- are vulnerable. Updating key firmware on the YubiKey isn't possible. That leaves all affected YubiKeys permanently vulnerable.' -- source: https://it.slashdot.org/story/24/09/03/1810216 Cheers, Peter

1 0

Microsoft Says Its Recall Uninstall Option in Windows 11 is Just a Bug
by Peter Reutemann 03 Sep '24

03 Sep '24

'While the latest update to Windows 11 makes it look like the upcoming Recall feature can be easily removed by users, Microsoft tells us it's just a bug and a fix is coming. Deskmodder spotted the change last week in the latest 24H2 version of Windows 11, with KB5041865 seemingly delivering the ability to uninstall Recall from the Windows Features section. "We are aware of an issue where Recall is incorrectly listed as an option under the 'Turn Windows features on or off' dialog in Control Panel," says Windows senior product manager Brandon LeBlanc in a statement to The Verge. "This will be fixed in an upcoming update."' -- source: https://it.slashdot.org/story/24/09/02/2241242 The only way to push a feature that users don't want: make it mandatory! I think, the technical term for this approach is "enshittification": https://en.wikipedia.org/wiki/Enshittification Cheers, Peter

1 0

Rust for Linux Maintainer Steps Down in Frustration With 'Nontechnical Nonsense'
by Peter Reutemann 03 Sep '24

03 Sep '24

'Efforts to add Rust code to the Linux kernel has suffered a setback as one of the maintainers of the Rust for Linux project has stepped down -- citing frustration with "nontechnical nonsense." The Register: Wedson Almeida Filho, a software engineer at Microsoft who has overseen the Rust for Linux project, announced his resignation in a message to the Linux kernel development mailing list. "I am retiring from the project," Filho declared. "After almost four years, I find myself lacking the energy and enthusiasm I once had to respond to some of the nontechnical nonsense, so it's best to leave it up to those who still have it in them." [...] Memory safety bugs are regularly cited as the major source of serious software vulnerabilities by organizations overseeing large projects written in C and C++. So in recent years there's been a concerted push from large developers like Microsoft and Google, and well as from government entities like the US Cybersecurity and Infrastructure Security Agency, to use memory-safe programming languages -- among them Rust. Discussions about adding Rust to Linux date back to 2020 and were realized in late 2022 with the release of Linux 6.1. "I truly believe the future of kernels is with memory-safe languages," Filho's note continued. "I am no visionary but if Linux doesn't internalize this, I'm afraid some other kernel will do to it what it did to Unix."' -- source: https://linux.slashdot.org/story/24/09/02/194205 Cheers, Peter

1 0

Public DNS Services
by Lawrence D'Oliveiro 02 Sep '24

02 Sep '24

So I finally got connected to fibre today, and I was pleased to discover that the ISP (https://simplybroadband.co.nz/) offers IPv6 as well. Is this common nowadays? We all know about the public DNS services offered by Google (8.8.8.8, 8.8.4.4) and Cloudflare (1.1.1.1, 1.0.0.1); did you know these addresses have names as well? And of course there are IPv6 addresses to go with the IPv4 ones. Try this command to find out all the related Google DNS services: host -a dns.google. (Yup, that’s “dns.google.”, no “.com” or anything else on the end.) That’s quite a breathtaking list of entries. For Cloudflare, try host one.one.one.one. Note that the “-a” option (“tell me everything”) doesn’t work with Cloudflare; quite a few online services are now imposing restrictions on these “all info” lookups, but clearly not Google, at least not on this domain: obviously they want it to remain easy for people to discover the services they’re offering.

1 1

Linux 6.12 To Optionally Display A QR Code During Kernel Panics
by Peter Reutemann 31 Aug '24

31 Aug '24

'A new feature has been submitted for inclusion in Linux 6.12, allowing the display of a QR code when a kernel panic occurs using the DRM Panic handler. This QR code can capture detailed error information that is often missed in traditional text-based panic messages, making it more user-friendly. The feature, written in Rust, is optional and can be enabled via a specific build switch. This implementation follows similar ideas from other operating systems and earlier discussions in the Linux community.' -- source: https://linux.slashdot.org/story/24/08/30/1856206 Cheers, Peter

1 0

Malware Infiltrates Pidgin Messenger's Official Plugin Repository
by Peter Reutemann 31 Aug '24

31 Aug '24

'The Pidgin messaging app removed the ScreenShareOTR plugin from its third-party plugin list after it was found to be used to install keyloggers, information stealers, and malware targeting corporate networks. BleepingComputer reports: The plugin was promoted as a screen-sharing tool for secure Off-The-Record (OTR) protocol and was available for both Windows and Linux versions of Pidgin. According to ESET, the malicious plugin was configured to infect unsuspecting users with DarkGate malware, a powerful malware threat actors use to breach networks since QBot's dismantling by the authorities. [...] Those who installed it are recommended to remove it immediately and perform a full system scan with an antivirus tool, as DarkGate may be lurking on their system. After publishing our story, Pidgin's maintainer and lead developer, Gary Kramlich, notified us on Mastodon to say that they do not keep track of how many times a plugin is installed. To prevent similar incidents from happening in the future, Pidgin announced that, from now on, it will only accept third-party plugins that have an OSI Approved Open Source License, allowing scrutiny into their code and internal functionality.' -- source: https://it.slashdot.org/story/24/08/30/2047211 Cheers, Peter

1 0

$50 2GB Raspberry Pi 5 comes with a lower price and a tweaked, cheaper CPU
by Peter Reutemann 30 Aug '24

30 Aug '24

'We're many months past the worst of the Raspberry Pi shortages, and the board is finally widely available at its suggested retail price at most sites without wait times or quantity limitations. One sign that the Pi Foundation is feeling more confident about the stock situation: the launch of a new 2GB configuration of the Raspberry Pi 5, available starting today for $50. That's $10 less than the 4GB configuration and $30 less than the 8GB version of the board. Raspberry Pi CEO Eben Upton writes that the 2GB version of the board includes a revised version of the Broadcom BCM2712C1 SoC that is slightly cheaper to manufacture. Upton says that the D0 stepping of the BCM2712C1 strips out some "dark silicon" built-in functionality that the Pi wasn't using but was still taking up space on the silicon die and increasing the cost of the chip. "From the perspective of a Raspberry Pi user, [the chip] is functionally identical to its predecessor: the same fast quad-core processor; the same multimedia capabilities; and the same PCI Express bus that has proven to be one of the most exciting features of the Raspberry Pi 5 platform," Upton writes. "However, it is cheaper to make, and so is available to us at somewhat lower cost. And this, combined with the savings from halving the memory capacity, has allowed us to take $10 out of the cost of the finished product." At $50, the price tag is still north of the baseline $35 price that the Pi started at for many years. The Pi 4 had a 1GB model for $35 when it launched, and there was a $35 2GB model available for a while in 2020, but widespread shortages and supply chain issues led to a "temporary" price increase in late 2021 that is, as of this writing, still in place. At least the 2GB Pi 5 is only $5 more expensive than the 2GB version of the Pi 4, which is still in stock for $45 at many retailers.' -- source: https://arstechnica.com/gadgets/2024/08/new-2gb-raspberry-pi-5-option-knock… Cheers, Peter

1 1

'Uncertainty' Drives LinkedIn To Migrate From CentOS To Azure Linux
by Peter Reutemann 30 Aug '24

30 Aug '24

'The Register's Liam Proven reports: Microsoft's in-house professional networking site is moving to Microsoft's in-house Linux. This could mean that big changes are coming for the former CBL-Mariner distro. Ievgen Priadka's post on the LinkedIn Engineering blog, titled Navigating the transition: adopting Azure Linux as LinkedIn's operating system, is the visible sign of what we suspect has been a massive internal engineering effort. It describes some of the changes needed to migrate what the post calls "most of our fleet" from the end-of-life CentOS 7 to Microsoft Azure Linux -- the distro that grew out of and replaced its previous internal distro, CBL-Mariner. This is an important stage in a long process. Microsoft acquired LinkedIn way back in 2016. Even so, as recently as the end of last year, we reported that a move to Azure had been abandoned, which came a few months after it laid off almost 700 LinkedIn staff -- the majority in R&D. The blog post is over 3,500 words long, so there's quite a lot to chew on -- and we're certain that this has been passed through and approved by numerous marketing and management people and scoured of any potentially embarrassing admissions. Some interesting nuggets remain, though. We enjoyed the modest comment that: "However, with the shift to CentOS Stream, users felt uncertain about the project's direction and the timeline for updates. This uncertainty created some concerns about the reliability and support of CentOS as an operating system." [...] There are some interesting technical details in the post too. It seems LinkedIn is running on XFS -- also the RHEL default file system, of course -- with the notable exception of Hadoop, and so the Azure Linux team had to add XFS support. Some CentOS and actual RHEL is still used in there somewhere. That fits perfectly with using any of the RHELatives. However, the post also mentions that the team developed a tool to aid with deploying via MaaS, which it explicitly defines as Metal as a Service. MaaS is a Canonical service, although it does support other distros -- so as well as CentOS, there may have been some Ubuntu in the LinkedIn stack as well. Some details hint at what we suspect were probably major deployment headaches. [...] Some of the other information covers things the teams did not do, which is equally informative. [...] ' -- source: https://linux.slashdot.org/story/24/08/28/2345255 Cheers, Peter

1 0

Microsoft Donates the Mono Project To Wine
by Peter Reutemann 28 Aug '24

28 Aug '24

'Microsoft has decided to donate the Mono Project to the developers of Wine, FOSS that allows Windows applications to run on Unix-like operating systems. "Mono is a software platform designed to allow developers to easily create cross platform applications," notes GameOnLinux's Liam Dawe. "It is an open source implementation of Microsoft's .NET Framework based on the ECMA standards for C# and the Common Language Runtime." "Wine already makes use of Mono and this move makes sense with Microsoft focusing on open-source .NET and other efforts," adds Phoronix's Michael Larabel. "Formally handing over control of the upstream Mono project to WineHQ is a nice move by Microsoft rather than just letting the upstream Mono die off or otherwise forked." Microsoft's Jeff Schwartz announced the move on the Mono website and in a GitHub post: The Mono Project (mono/mono) ('original mono') has been an important part of the .NET ecosystem since it was launched in 2001. Microsoft became the steward of the Mono Project when it acquired Xamarin in 2016. The last major release of the Mono Project was in July 2019, with minor patch releases since that time. The last patch release was February 2024. We are happy to announce that the WineHQ organization will be taking over as the stewards of the Mono Project upstream at wine-mono / Mono - GitLab ( winehq.org) Source code in existing mono/mono and other repos will remain available, although repos may be archived. Binaries will remain available for up to four years. Microsoft maintains a modern fork of Mono runtime in the dotnet/runtime repo and has been progressively moving workloads to that fork. That work is now complete, and we recommend that active Mono users and maintainers of Mono-based app frameworks migrate to .NET which includes work from this fork. We want to recognize that the Mono Project was the first .NET implementation on Android, iOS, Linux, and other operating systems. The Mono Project was a trailblazer for the .NET platform across many operating systems. It helped make cross-platform .NET a reality and enabled .NET in many new places and we appreciate the work of those who came before us. Thank you to all the Mono developers!' -- source: https://tech.slashdot.org/story/24/08/27/2043216 Cheers, Peter

1 0

OSMC Vero V
by Lawrence D'Oliveiro 28 Aug '24

28 Aug '24

Just thought I’d mention, I got one of these gadgets <https://osmc.tv/> (the latest “Vero V” model) delivered to my doorstep today. This is to replace a Western Digital “WDTV” media streamer that I got from Dick Smith over a decade ago, that I have been getting more annoyed with. The OSMC software is built on Kodi, with some extra stuff of their own. You should be able to download it and set up your own installation, I just decided to get one of their boxes preassembled and preinstalled. They’re based in the UK. That WDTV box was always fussy about the kinds of files it would play, and what codecs and what bit rates etc it could cope with. When I tried something like .flv files for example, it would play OK if I didn’t try going fast forward/reverse, otherwise it would get stuck. Certain kinds of files could screw it up so badly, the only way to recover was to turn it off and on again. This new box is built on a much more modern Linux base, so I expect its media support will be correspondingly improved. Already it has started playing a .webm file, which the old box wouldn’t even look at. If anybody is curious to know more, just ask. I see there is even an online “store” of addons I can install, for extra capabilities.

2 3

The Linux Kernel Gets 60 CVEs A Week
by Lawrence D'Oliveiro 23 Aug '24

23 Aug '24

The Linux kernel team gets 60 logged reports of security vulnerabilities each week, according to longtime developer Greg Kroah-Hartman. He ought to know; he is the point of first contact for such reports, according to <https://www.zdnet.com/article/the-linux-security-team-issues-60-cves-a-week…>. On the bright side, most of them will likely not affect you. The total kernel source tree is up to 38 million lines of code, and your typical OS installation uses only a small fraction of that. To quote GregKH: “Your phone, the most complex beast out there, uses about 4 million lines of code”. They don’t take their time about dealing with vulnerabilities, either: This crew doesn't take embargoes or use pre-announcements. Why not? Because they believe -- with reason -- all these approaches do is lead to information leaks. Instead, they aim to get fixes out to users as quickly as possible. Typically, this is done within a week of having a patch available. This approach ensures that users are promptly notified of security issues and can update their systems accordingly. Another GregKH quote: “If you're not using the latest stable/long-term kernel system, your system is insecure”. Which means, you need to do a kernel update just about every week. The thing is, Kroah-Hartman said, "We have proof this can be done. Debian runs over 80% of the world's servers and they're using stable kernel updates. Android, billions of devices out there, takes every stable kernel update on a couple months lag, but they're doing it and keeping their devices secure. There's nothing more complex than embedded into the system, and there's nothing more common and easy to use than a Debian server.

1 0

Litespeed Cache bug exposes millions of WordPress sites to takeover attacks
by Peter Reutemann 22 Aug '24

22 Aug '24

'A critical vulnerability in the LiteSpeed Cache WordPress plugin can let attackers take over millions of websites after creating rogue admin accounts. LiteSpeed Cache is open-source and the most popular WordPress site acceleration plugin, with over 5 million active installations and support for WooCommerce, bbPress, ClassicPress, and Yoast SEO. The unauthenticated privilege escalation vulnerability (CVE-2024-28000) was found in the plugin's user simulation feature and is caused by a weak hash check in LiteSpeed Cache up to and including version 6.3.0.1. Security researcher John Blackbourn submitted the flaw to Patchstack's bug bounty program on August 1. The LiteSpeed team developed a patch and shipped it with LiteSpeed Cache version 6.4, released on August 13. Successful exploitation enables any unauthenticated visitors to gain administrator-level access, which can be used to completely take over websites running vulnerable LiteSpeed Cache versions by installing malicious plugins, changing critical settings, redirecting traffic to malicious websites, distributing malware to visitors, or stealing user data.' -- source: https://www.bleepingcomputer.com/news/security/litespeed-cache-bug-exposes-… Cheers, Peter

1 0

“Something has gone seriously wrong,” dual-boot systems warn after Microsoft update
by Peter Reutemann 21 Aug '24

21 Aug '24

'Last Tuesday, loads of Linux users—many running packages released as early as this year—started reporting their devices were failing to boot. Instead, they received a cryptic error message that included the phrase: “Something has gone seriously wrong.” The cause: an update Microsoft issued as part of its monthly patch release. It was intended to close a 2-year-old vulnerability in GRUB, an open source boot loader used to start up many Linux devices. The vulnerability, with a severity rating of 8.6 out of 10, made it possible for hackers to bypass secure boot, the industry standard for ensuring that devices running Windows or other operating systems don’t load malicious firmware or software during the bootup process. CVE-2022-2601 was discovered in 2022, but for unclear reasons, Microsoft patched it only last Tuesday. Tuesday’s update left dual-boot devices—meaning those configured to run both Windows and Linux—no longer able to boot into the latter when Secure Boot was enforced. When users tried to load Linux, they received the message: “Verifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation.” Almost immediately support and discussion forums lit up with reports of the failure. “Note that Windows says this update won't apply to systems that dual-boot Windows and Linux,” one frustrated person wrote. “This obviously isn't true, and likely depends on your system configuration and the distribution being run. It appears to have made some linux efi shim bootloaders incompatible with microcrap efi bootloaders (that's why shifting from MS efi to 'other OS' in efi setup works). It appears that Mint has a shim version that MS SBAT doesn't recognize.” The reports indicate that multiple distributions, including Debian, Ubuntu, Linux Mint, Zorin OS, Puppy Linux, are all affected. Microsoft has yet to acknowledge the error publicly, explain how it wasn’t detected during testing, or provide technical guidance to those affected. Company representatives didn’t respond to an email seeking answers.' -- source: https://arstechnica.com/security/2024/08/a-patch-microsoft-spent-2-years-pr… Cheers, Peter

1 0

Check Linux / Unix configuration files for syntax errors
by Peter Reutemann 14 Aug '24

14 Aug '24

Just came across this post, which I thought quite handy: 'In Linux and UNIX system services are configured using various text files located in /etc/ or /usr/local/etc/ directory tree. A typical server system could have dozens of configuration files. You can check your configuration files for syntax errors without starting the server and validate all settings. In some cases, it is possible to check the sanity of specific data/config options and directories. Text files are easier to manage remotely. You can use ssh and a text editor. If there is an error in configuration, the server may not start. It may result in a disaster. This post explains how to quickly find out a syntax error for popular servers and test configuration file for syntax errors.' -- source: https://www.cyberciti.biz/tips/check-unix-linux-configuration-file-for-synt… Cheers, Peter

1 0

Almost unfixable “Sinkclose” bug affects hundreds of millions of AMD chips
by Peter Reutemann 12 Aug '24

12 Aug '24

'Security flaws in your computer's firmware, the deep-seated code that loads first when you turn the machine on and controls even how its operating system boots up, have long been a target for hackers looking for a stealthy foothold. But only rarely does that kind of vulnerability appear not in the firmware of any particular computer maker, but in the chips found across hundreds of millions of PCs and servers. Now security researchers have found one such flaw that has persisted in AMD processors for decades, and that would allow malware to burrow deep enough into a computer's memory that, in many cases, it may be easier to discard a machine than to disinfect it. At the Defcon hacker conference, Enrique Nissim and Krzysztof Okupski, researchers from the security firm IOActive, plan to present a vulnerability in AMD chips they're calling Sinkclose. The flaw would allow hackers to run their own code in one of the most privileged modes of an AMD processor, known as System Management Mode, designed to be reserved only for a specific, protected portion of its firmware. IOActive's researchers warn that it affects virtually all AMD chips dating back to 2006, or possibly even earlier.' -- source: https://arstechnica.com/security/2024/08/almost-unfixable-sinkclose-bug-aff… Cheers, Peter

1 0

Mozilla Wants You To Love Firefox Again
by Peter Reutemann 12 Aug '24

12 Aug '24

'Mozilla's interim CEO Laura Chambers "says the company is reinvesting in Firefox after letting it languish in recent years," reports Fast Company, "hoping to reestablish the browser as independent alternative to the likes of Google's Chrome and Apple's Safari. "But some of those investments, which also include forays into generative AI, may further upset the community that's been sticking with Firefox all these years..." Chambers acknowledges that Mozilla lost sight of Firefox in recent years as it chased opportunities outside the browser, such as VPN service and email masking. When she replaced Mitchell Baker as CEO in February, the company scaled back those other efforts and made Firefox a priority again. "Yes, Mozilla is refocusing on Firefox," she says. "Obviously, it's our core product, so it's an important piece of the business for us, but we think it's also really an important part of the internet." Some of that focus involves adding features that have become table-stakes in other browsers. In June, Mozilla added vertical tab support in Firefox's experimental branch, echoing a feature that Microsoft's Edge browser helped popularize three years ago. It's also working on tab grouping features and an easier way to switch between user profiles. Mozilla is even revisiting the concept of web apps, in which users can install websites as freestanding desktop applications. Mozilla abandoned work on Progressive Web Apps in Firefox a few years ago to the dismay of many power users, but now it's talking with community members about a potential path forward. "We haven't always prioritized those features as highly as we should have," Chambers says. "That's been a real shift that's been very felt in the community, that the things they're asking for . . . are really being prioritized and brought to life." Firefox was criticized for testing a more private alternative to tracking cookies which could make summaries of aggregated data available to advertisers. (Though it was only tested on a few sites, "Privacy-Preserving Attribution" was enabled by default.) But EFF staff technologist Lena Cohen tells Fast Company that approach was "much more privacy-preserving" than Google's proposal for a "Privacy Sandbox." And according to the article, "Mozilla's system only measures the success rate of ads — it doesn't help companies target those ads in the first place — and it's less susceptible to abuse due to limits on how much data is stored and which parties are allowed to access it." In June, Mozilla also announced its acquisition of Anonym, a startup led by former Meta executives that has its own privacy-focused ad measurement system. While Mozilla has no plans to integrate Anonym's tech in Firefox, the move led to even more anxiety about the kind of company Mozilla was becoming. The tension around Firefox stems in part from Mozilla's precarious financial position, which is heavily dependent on royalty payments from Google. In 2022, nearly 86% of Mozilla's revenue came from Google, which paid $510 million to be Firefox's default search engine. Its attempts to diversify, through VPN service and other subscriptions, haven't gained much traction. Chambers says that becoming less dependent on Google is "absolutely a priority," and acknowledges that building an ad-tech business is one way of doing that. Mozilla is hoping that emerging privacy regulations and wider adoption of anti-tracking tools in web browsers will increase demand for services like Anonym and for systems like Firefox's privacy-preserving ad measurements. Other revenue-generating ideas are forthcoming. Chambers says Mozilla plans to launch new products outside of Firefox under a "design sprint" model, aimed at quickly figuring out what works and what doesn't. It's also making forays into generative AI in Firefox, starting with a chatbot sidebar in the browser's experimental branch. Chambers "says to expect a bigger marketing push for Firefox in the United States soon, echoing a 'Challenge the default' ad campaign that was successful in Germany last summer. Mozilla's nonprofit ownership structure, and the idea that it's not beholden to corporate interests, figures heavily into those plans."' -- source: https://tech.slashdot.org/story/24/08/11/1635254 Cheers, Peter

1 0

Ubuntu Will Start Shipping With the Latest Upstream Linux Kernel - Even Release Candidates
by Peter Reutemann 12 Aug '24

12 Aug '24

'Here's a question from the blog OMG Ubuntu. "Ever get miffed reading about a major new Ubuntu release only to learn it doesn't come with the newest Linux kernel? "Well, that'll soon be a thing of the past." Canonical's announced a big shift in kernel selection process for future Ubuntu release, an "aggressive kernel version commitment policy" pivot that means it will ship the latest upstream kernel code in development at the time of a new Ubuntu release. Yes, even if that upstream kernel hasn't yet seen a formal stable release (and received the requisite newspaper-graphic-topped rundown on this blog). Which is a huge change. Currently, new Ubuntu releases include the most recent stable Linux kernel release at the time of the kernel freeze milestone in the Ubuntu development cycle. Here's the official announcement by Canonical's Brett Grandbois. "Ubuntu will now ship the absolute latest available version of the upstream Linux kernel at the specified Ubuntu release freeze date, even if upstream is still in Release Candidate status..." It is actually expected that Late Releases will be the exception rather than the norm and in most releases these guidelines will not be necessary as the upstream kernel will release with enough time for the Ubuntu kernel to stabilize. However, adopting a more aggressive kernel version commitment policy does require us to be prepared for a possible Late Release situation and therefore informing the community on what they can expect. ' -- source: https://news.slashdot.org/story/24/08/11/075217 Cheers, Peter

1 0

You can kick the alpha tires on System76’s Cosmic, a new Linux desktop
by Peter Reutemann 09 Aug '24

09 Aug '24

'System76 has released an alpha version of its Cosmic desktop environment for Linux and Unix-like systems. The Linux hardware firm isn't targeting only its customers with its GNOME replacement; it also hopes to get distro maintainers and app makers on board with its Rust-built, UX-focused desktop. While the Cosmic desktop will be built into the Linux vendor's Pop!_OS (which is also in the alpha ISO), it's also available to other systems, as you might expect. System76 provides drop-in instructions for Fedora and Arch Linux installs, among others. System76 says it is "excited to see COSMIC integration elevate Linux as a whole," along with what results "from making UX-building more accessible." By building Cosmic natively in the Rust language, System76 also intends to provide a more stable and memory-safe environment for apps. Cosmic shows deep attention to tiling, keyboard shortcuts, and panel and dock customization, as has been present on its Pop!_OS. I'm a bit of a boring side-by-side, single-workspace type; Gardiner Bryant on YouTube went deeper into the Cosmic alpha's tiling, panels, and GTK app acceptance. I found that getting Cosmic into a reasonable shape I could work from, and picking up its keyboard window shortcuts, was easier than with either KDE or GNOME. One thing System76 made clear in its push for Cosmic is its readiness for more deeply integrated themes. System76 offered a few examples in its press materials, and I must admit a fondness for its over-the-top examples. -- source: https://arstechnica.com/gadgets/2024/08/you-can-kick-the-alpha-tires-on-sys… Cheers, Peter

1 0

Chrome’s Manifest V3, and its changes for ad blocking, are coming real soon
by Peter Reutemann 07 Aug '24

07 Aug '24

'Google Chrome's long, long project to implement a new browser extension platform is seemingly going to happen, for real, after six years of cautious movement. One of the first ways people are seeing this is if they use uBlock Origin, a popular ad-blocking extension, as noted by Bleeping Computer. Recently, Chrome users have seen warnings pop up that "This extension may soon no longer be supported," with links asking the user to "Remove or replace it with similar extensions" from Chrome's Web Store. You might see a similar warning on some extensions if you head to Chrome's Extensions page (chrome://extensions). What's happening is Chrome preparing to make Manifest V3 required for extensions that want to run on its platform. First announced in 2018, the last word on Manifest V3 was that V2 extensions would start being nudged out in early June on the Beta, Dev, and Canary update channels. Users will be able to manually re-enable V2 extensions "for a short time," Google has said, "but over time, this toggle will go away as well." The shift for enterprise Chrome deployments is expected to be put off until June 2025. ' -- source: https://arstechnica.com/gadgets/2024/08/chromes-manifest-v3-and-its-changes… Cheers, Peter

1 0

Germany to Fund Open Source Software Maintainers Through New Fellowship Program
by Peter Reutemann 07 Aug '24

07 Aug '24

'If you’re of the ilk to complain about governments giving money away and what that means for taxpayers, the Germans — or at least their government — are doing this because it will be good for the economy, meaning they think it’ll make folks better able to pay their taxes rather just empty their pockets for the taxman. This is also why they’ve already spending a substantial amount of money to help fund over 40 FOSS projects. “Open source infrastructure is the backbone of our digital world – and the work of the people who maintain it is essential to ensuring the security and availability of this global resource,” Mirko Swillus wrote in a blog that was published on Thursday. “They lead project development, review changes, manage community interactions, and tackle security issues.” Swillus is program manager at Sovereign Tech Fund, and the blog was to announce fund’s new Fellowship for Maintainers program. “With this new fellowship program, we’re directly investing in the people behind the code by paying maintainers of critical open source components for their work,” he wrote.' -- source: https://fossforce.com/2024/08/germany-to-fund-open-source-software-maintain… Cheers, Peter

1 0

How to replace Windows with Linux Mint on your PC
by Peter Reutemann 05 Aug '24

05 Aug '24

'Are you sick of Windows fouling up? Do you want to try something different? Then, it's time to try the best Linux desktop, Linux Mint 22. I've used more operating systems than you can shake a stick at. I cut my teeth on IBM 360/OS in the 1970s. Since then, I've used every Apple and Microsoft operating system you've heard of, and many you've never known, such as A/UX and Microsoft Xenix. I've also used well over 100 different Unix and Linux distributions. So, when I say Linux Mint 22 -- the latest long-term support (LTS) version of Linux Mint -- is not just the best Linux desktop, but the best desktop, it means something. - Materials needed: Windows PC, internet connection, and a DVD-RW or USB stick with 3GB or more storage - Estimated time: 2 hours - Estimated cost: $5' -- source: https://www.zdnet.com/article/how-to-replace-windows-with-linux-mint-on-you… With the continuing enshittification [1] of Windows, maybe a good time to get folks moved to a less intrusive operating system... Cheers, Peter [1] https://en.wikipedia.org/wiki/Enshittification

1 0

First Look at Serpent OS: Minimal GNOME Desktop and Rust-Based Package Manager
by Peter Reutemann 02 Aug '24

02 Aug '24

'The wait is finally over and Ikey Doherty’s long-anticipated Serpent OS distribution has an ISO image that people can download and test on bare metal hardware or virtual machines to see what the fuss is all about. Four years ago I broke news that Ikey Doherty is making a new distro called Serpent Linux (it was later changed to Serpent OS) aiming to provide the Linux community with a truly modern distribution for people who want to just use Linux. The name of the distribution is inspired by the Serpent game created by Ikey Doherty. At that time, Serpent OS was supposed to ship with the KDE Plasma desktop environment by default, but things have changed and GNOME was chosen as the default for the initial release. The first pre-alpha ISO image includes the older GNOME 45.3 release, but I’m sure the final release will use a more recent version. Serpent OS offers a minimal GNOME desktop experience with only a handful of apps pre-installed, such as the Mozilla Firefox web browser, GNOME Console terminal emulator, GNOME Text Editor text editing app, Zed code editor, GNOME’s Loupe image viewer, and GNOME Extensions. However, Serpent OS supports Flatpak apps if you need to install the apps you need, but Flatpak support is not installed by default in this pre-alpha release.' -- source: https://9to5linux.com/first-look-at-serpent-os-minimal-gnome-desktop-and-ru… Cheers, Peter

1 0

“In the future, computers may weigh no more than 1.5 tonnes.”
by Lawrence D'Oliveiro 01 Aug '24

01 Aug '24

Nice collection of vintage computer pics/clips, along with some pithy quotes from the times (1945-1990). Which ones can you identify without looking at the captions? <https://www.docubyte.com/projects/guide-to-computing/>

1 0

The Unintended Consequences Linux’s Wayland Adoption Will Have on BSD
by Peter Reutemann 31 Jul '24

31 Jul '24

'Like most people who use Linux as their daily driver, I’ve been pleased lately to see that Wayland is finally getting some serious traction and is on its way to being the default display server for most mainstream Linux distributions. It’s been a long trip from the days when we first heard that X was on its way out and that Wayland was on its way in — 15 years as a matter of fact — so the better performance, more svelte code base, enhanced security, and all of the other advantages that Wayland brings to the table being just about here for some of us, and already here for others, is indeed good news. But before we pop the cork on the champagne bottles and start the celebrations, perhaps we should consider that this good news for Linux might not be good news for those running BSD or one of the Unixes, which is something that normally would never occur to me to think about since I’ve never tried to use BSD. The only reason I’m thinking about it now is because this weekend I ran across a post by Chris Siebenmann, a Unix systems administrator at the University of Toronto’s CS Labs. Being a Unix guy by day (and I suspect a BSD guy by night), he’s all on what Wayland on Linux means to BSD/Unix stuck on X, and he’s been thinking about what Linux’s move to Wayland is going to mean for desktop BSDs and Unixes. “Once upon a time, the future of Unix desktops looked fairly straightforward,” he wrote. “Everyone ran on X, so the major threat to cross-Unix portability in major desktops was the use of Linux only APIs, which became especially D-Bus and systemd related things. Unix desktops that were less attached to tight integration with the Linux environment would probably stay easily available on FreeBSD, OpenBSD, and so on.” The main thing I got from that is that for a long time, the BSDs have benefited somewhat from Linux. In this case, because both operating systems use X, it was relatively easy (“relatively” probably being the key word here) to port most popular “Linux” desktop environments to BSD. The trouble is, according to Siebenmann, those days might be coming to an end.' -- source: https://fossforce.com/2024/07/the-unintended-consequences-linuxs-wayland-ad… Cheers, Peter

2 1

LZ4 Compression Algorithm Gets Multi-Threaded Update
by Peter Reutemann 29 Jul '24

29 Jul '24

'Slashdot reader Seven Spirals brings news about the lossless compression algorithm LZ4: The already wonderful performance of the LZ4 compressor just got better with multi-threaded additions to it's codebase. In many cases, LZ4 can compress data faster than it can be written to disk giving this particular compressor some very special applications. The Linux kernel as well as filesystems like ZFS use LZ4 compression extensively. This makes LZ4 more comparable to the Zstd compression algorithm, which has had multi-threaded performance for a while, but cannot match the LZ4 compressor for speed, though it has some direct LZ4. >From Linuxiac.com: - On Windows 11, using an Intel 7840HS CPU, compression time has improved from 13.4 seconds to just 1.8 seconds — a 7.4 times speed increase. - macOS users with the M1 Pro chip will see a reduction from 16.6 seconds to 2.55 seconds, a 6.5 times faster performance. - For Linux users on an i7-9700k, the compression time has been reduced from 16.2 seconds to 3.05 seconds, achieving a 5.4 times speed boost... The release supports lesser-known architectures such as LoongArch, RISC-V, and others, ensuring LZ4's portability across various platforms. ' -- source: https://hardware.slashdot.org/story/24/07/28/0057247 Cheers, Peter

1 0

What Happens If You Connect Windows XP To the Internet In 2024?
by Peter Reutemann 29 Jul '24

29 Jul '24

'Long-time Slashdot reader sandbagger writes: Have you ever wondered if it's true you can instantly get malware? In this video, a person connects an XP instance directly to the internet with no firewall to see just how fast it gets compromised by malware, rootkits, malicious services and new user accounts. The answer — fast! Malwarebytes eventually finds eight different viruses/Trojan horses -- and a DNS changer. (One IP address leads back to the Russian federation.) It's fun to watch -- within just a few hours a new Windows user has even added themself. And for good measure, he also opens up Internet Explorer... - Windows XP -- very insecure, they conclude at the end of the video. Very easy for random software from the internet to get more privileges than you, and it is very hard to solve that. - Also, just out of curiosity I tried this on Windows 7. And even with all of the same settings, nothing happened. I let it run for 10 hours. So it seems like this may be a problem in historical Windows.' -- source: https://tech.slashdot.org/story/24/07/28/2137216 Cheers, Peter

1 0

Secure Boot is completely broken on 200+ models from 5 big device makers
by Peter Reutemann 26 Jul '24

26 Jul '24

'On Thursday, researchers from security firm Binarly revealed that Secure Boot is completely compromised on more than 200 device models sold by Acer, Dell, Gigabyte, Intel, and Supermicro. The cause: a cryptographic key underpinning Secure Boot on those models that was compromised in 2022. In a public GitHub repository committed in December of that year, someone working for multiple US-based device manufacturers published what’s known as a platform key, the cryptographic key that forms the root-of-trust anchor between the hardware device and the firmware that runs on it. The repository was located at https://github.com/raywu-aaeon/Ryzen2000_4000.git, and it's not clear when it was taken down. The repository included the private portion of the platform key in encrypted form. The encrypted file, however, was protected by a four-character password, a decision that made it trivial for Binarly, and anyone else with even a passing curiosity, to crack the passcode and retrieve the corresponding plain text. The disclosure of the key went largely unnoticed until January 2023, when Binarly researchers found it while investigating a supply-chain incident. Now that the leak has come to light, security experts say it effectively torpedoes the security assurances offered by Secure Boot. “It’s a big problem,” said Martin Smolár, a malware analyst specializing in rootkits who reviewed the Binarly research and spoke to me about it. “It’s basically an unlimited Secure Boot bypass for these devices that use this platform key. So until device manufacturers or OEMs provide firmware updates, anyone can basically… execute any malware or untrusted code during system boot. Of course, privileged access is required, but that’s not a problem in many cases.”' -- source: https://arstechnica.com/security/2024/07/secure-boot-is-completely-compromi… Cheers, Peter

2 1

distrobox
by Peter Reutemann 26 Jul '24

26 Jul '24

Just came across distrobox, which seems a useful extension to container managers like docker/podman/lilipod, allowing you to run other distros in your shell: 'Use any Linux distribution inside your terminal. Enable both backward and forward compatibility with software and freedom to use whatever distribution you’re more comfortable with. Distrobox uses podman, docker or lilipod to create containers using the Linux distribution of your choice. The created container will be tightly integrated with the host, allowing sharing of the HOME directory of the user, external storage, external USB devices and graphical apps (X11/Wayland), and audio.' -- source: https://distrobox.it/ That should be especially useful for people working in environments where they are forced to use a specific host OS. As long as they have one of the supported container managers available, they can easily switch! Cheers, Peter

1 0

Anyone can Access Deleted and Private Repository Data on GitHub
by Peter Reutemann 26 Jul '24

26 Jul '24

'You can access data from deleted forks, deleted repositories and even private repositories on GitHub. And it is available forever. This is known by GitHub, and intentionally designed that way. This is such an enormous attack vector for all organizations that use GitHub that we’re introducing a new term: Cross Fork Object Reference (CFOR). A CFOR vulnerability occurs when one repository fork can access sensitive data from another fork (including data from private and deleted forks). Similar to an Insecure Direct Object Reference, in CFOR users supply commit hashes to directly access commit data that otherwise would not be visible to them. ' -- source: https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo… Interesting read! Cheers, Peter

1 0

Run0 vs Sudo: What’s the Difference?
by Peter Reutemann 25 Jul '24

25 Jul '24

'Run0 is a new privilege escalation program for Systemd-based Linux systems. Similar to sudo, it allows you to run commands as a root user and access your machine’s internals. In this article, we compare Run0 vs Sudo to help you determine the right privilege escalation tool for you.' -- source: https://www.maketecheasier.com/run0-vs-sudo-whats-the-difference/ Honestly, I only came across Run0 the other day. I still remember the days of using "su" to get stuff done, long before sudo. Is anyone using Run0? What are your experiences? Cheers, Peter

1 0

It Never Rains But It Pours
by Lawrence D'Oliveiro 24 Jul '24

24 Jul '24

Instructive to read this notice <https://rimuhosting.com/maintenance.jsp?server_maint_oid=5241959612&sn_oid=…> about progress in fixing an issue in the Dallas co-lo centre for Rimu hosting. As a customer, I wasn’t affected (though I could have been), and I have no complaints with the way this was handled--it was great that they kept customers like me apprised of developments like this. The interesting part is how a single initial failure can lead to a cascade of other failures. From the description, the original problem was a breakdown of a transformer feeding power from the grid. To allow it to be repaired, the power was switched to a backup generator. The generator then shut down with a belt problem. So power went to UPS batteries. These ran flat before the generator could be brought back to operation. So various parts of the facility were left without power. After power was restored, it was discovered that some (network?) switches had failed to come up. So a bunch of physical boxes holding customers’ VMs had to be physically moved to a different location where they could get connectivity again. From that point, the disruption was (mostly) over as far as customers were concerned, though there was obviously still work to be done to get the infrastructure back to its normal state. I think that a lot of theoretical statistical modelling of the odds of system failures tends to assume that failures of individual components will be independent of each other. Yet time and time again in the real world, we discover that this is not the case.

1 0

Switzerland Now Requires All Government Software To Be Open Source
by Peter Reutemann 24 Jul '24

24 Jul '24

'Switzerland has enacted the "Federal Law on the Use of Electronic Means for the Fulfillment of Government Tasks" (EMBAG), mandating open-source software (OSS) in the public sector to enhance transparency, security, and efficiency. "This new law requires all public bodies to disclose the source code of software developed by or for them unless third-party rights or security concerns prevent it," writes ZDNet's Steven Vaughan-Nichols. "This 'public money, public code' approach aims to enhance government operations' transparency, security, and efficiency." From the report: Making this move wasn't easy. It began in 2011 when the Swiss Federal Supreme Court published its court application, Open Justitia, under an OSS license. The proprietary legal software company Weblaw wasn't happy about this. There were heated political and legal fights for more than a decade. Finally, the EMBAG was passed in 2023. Now, the law not only allows the release of OSS by the Swiss government or its contractors, but also requires the code to be released under an open-source license "unless the rights of third parties or security-related reasons would exclude or restrict this." Professor Dr. Matthias Sturmer, head of the Institute for Public Sector Transformation at the Bern University of Applied Sciences, led the fight for this law. He hailed it as "a great opportunity for government, the IT industry, and society." Sturmer believes everyone will benefit from this regulation, as it reduces vendor lock-in for the public sector, allows companies to expand their digital business solutions, and potentially leads to reduced IT costs and improved services for taxpayers. In addition to mandating OSS, the EMBAG also requires the release of non-personal and non-security-sensitive government data as Open Government Data (OGD). This dual "open by default" approach marks a significant paradigm shift towards greater openness and practical reuse of software and data. Implementing the EMBAG is expected to serve as a model for other countries considering similar measures. It aims to promote digital sovereignty and encourage innovation and collaboration within the public sector. The Swiss Federal Statistical Office (BFS) is leading the law's implementation, but the organizational and financial aspects of the OSS releases still need to be clarified. ' -- source: https://news.slashdot.org/story/24/07/23/2025220 Cheers, Peter

1 0

Linux Mint 22 “Wilma” Is Now Available for Download, Here’s What’s New
by Peter Reutemann 24 Jul '24

24 Jul '24

'Linux Mint 22 is now available for download as the latest stable release of this popular Ubuntu-based operating system for the masses featuring the Cinnamon, Xfce, and MATE desktop environments. Dubbed “Wilma”, Linux Mint 22 is based on the Ubuntu 24.04 LTS (Noble Numbat) operating system series and uses the Linux 6.8 kernel. It will receive security updates until 2029 and new kernel versions as they’re available upstream in the Ubuntu 24.04 LTS repositories. The flagship edition features the latest Cinnamon 6.2 desktop environment while the Xfce and MATE editions ship with the Xfce 4.18 and MATE 1.26 desktop environments. The Wayland session in the Cinnamon edition is still in an experimental state and Linux Mint 22 Cinnamon will default to X11. Linux Mint 22 comes with PipeWire as the default sound server, support for the new Debian DEB822 format, GTK4 support for themes, improved HiDPI support during boot, better language support, artwork improvements, and FAT32 in File System Transposition mode support for the ISO images. Software-wise, Linux Mint 22 features the Mozilla Thunderbird email client as a native DEB package, a new GNOME Online Accounts GTK independent XApp to support the Online Accounts functionality, and a new Web App called Matrix, which is preinstalled by default and connects you to the Matrix chat network. Furthermore, it features JXL (JPEG-XL) image support in the Pix image viewer, a confirmation dialog pop-up when deleting a snapshot in the Timeshift backup tool, the ability to configure the default position of newly created notes in the Sticky note-taking app, and support for the Xed text editor to duplicate selected text. It also disables unverified Flatpak apps by default in the Software Manager app, which received some welcome changes like improved multi-threading, a new preferences page, and a banner slideshow. In addition, Software Manager now loads faster than before and the main window appears instantly. On top of that, Linux Mint 22 comes with a new package called xapp-thumbnailer-gimp that provides a thumbnailer for GIMP (.xcf) files and an updated xfce4-xapp-status-plugin tray applet that lets you configure icon sizes for full-color and symbolic icons.' -- source: https://9to5linux.com/linux-mint-22-wilma-is-now-available-for-download-her… Cheers, Peter

1 0

Apache Software Foundation is Retiring its Feather Logo
by Peter Reutemann 23 Jul '24

23 Jul '24

'The Apache Software Foundation (ASF) has announced plans to evolve its corporate logo and brand system to better represent its "community over code" ethos and promote inclusivity. Why? Because the ASF took seriously concerns raised by Natives in Tech and other members of the open-source community regarding the appropriateness of using Indigenous imagery. So, the ASF will retire its iconic feather logo, which has been a central part of the foundation's identity since 1999. The organization acknowledges that, as a non-Indigenous entity, it is inappropriate to continue using Indigenous themes or language in its branding. The group also realizes that the logo has been very popular for almost 30 years, but they feel this is the right thing to do. This comes after ASF changed the name of its flagship event to Community Over Code from ApacheCon. The ASF's Marketing and publicity team, along with a Branding Steering Committee composed of ASF Members, is collaborating with branding and design vendors to develop a new logo. This new visual identity will embody the Foundation's history of providing software for the public good while reflecting its global contributor base. The decision to update the brand extends beyond the logo. Changes also apply to ASF open-source projects that currently use Indigenous imagery. It will not--I and the ASF repeat--not change the Apache License or any released software. ' -- source: https://opensourcewatch.beehiiv.com/p/apache-software-foundation-retiring-f… Cheers, Peter

1 0

Imperfect, Linux-powered, DIY smart TV is the embodiment of ad fatigue
by Peter Reutemann 23 Jul '24

23 Jul '24

'Smart TV owners have been subjected to a growing amount of ads and tracking. Ad fatigue, only worsened by a trend that sees streaming providers trying to force customers into subscriptions with commercials, is understandable. We’re at the point where someone would rather use a broken laptop dangling off a TV than be subjected to the watchful eye of the TV's native operating system. Earlier this month, as spotted by Tom’s Hardware, a blogger named Carl Riis, who says he’s a software engineer, shared his DIY project, a Linux-based “smart TV.” Riis’ project doesn’t stand out because it’s the most unique, clever, or clean. In fact, if you’re the type of person willing to pay a lot for TVs with strong aesthetic appeal, like TVs that can look like artwork or appear transparent, you’ll be put off by the EarlGreyTV. The system uses an old Lenovo laptop that has a broken keyboard and is attached to a TV by a string. As Riis wrote: “This may look a little insane, but it has been a great way to keep things neat while retaining access to the laptop."' -- source: https://arstechnica.com/gadgets/2024/07/broken-linux-laptop-makes-for-a-fin… Cheers, Peter

1 0

Microsoft: Linux Is the Top Operating System on Azure Today
by Peter Reutemann 23 Jul '24

23 Jul '24

'Azure used to be a cloud platform dedicated to Windows. Now, it's the most widely used operating system on Microsoft Azure. The New Stack's Joab Jackson writes: These days, Microsoft expends considerable effort that Linux runs as smoothly as possible on Azure, according to a talk given earlier this year at the Linux Foundation Open Source Summit given by two Microsoft Azure Linux Platforms Group program managers, Jack Aboutboul, and Krum Kashan. "Linux is the #1 operating system in Azure today," Aboutoul said. And all must be supported in a way that Microsoft users have come to expects. Hence, the need for the Microsoft's Linux Platforms Group, which provides support Linux to both the internal customers and to Azure customers. These days, the duo of engineers explained, Microsoft knows about as much as anyone about how to operate Linux at hyperscale. [...] As of today, there are hundreds of Azure and Azure-based services running on Linux, including the Azure Kubernetes Service (AKS), OpenAI, HDInsight, and many of the other database services. "A lot of the infrastructure powering everything else is running on Linux," Aboutoul said. "They're different flavors of Linux running all over the place," Aboutoul said. To run these services, Microsoft maintains its own kernel, Azure Linux, and in 2023 the company released its own version of Linux, Azure Linux. But Azure Linux is just a small portion of all the other flavors of Linux running on Azure, all of which Microsoft must work with to support. Overall, there are about 20,000 third-party Software as a Service (SaaS) packages in the Azure marketplace that rely on some Linux distribution. And when things go wrong, it is the Azure service engineers who get the help tickets. The company keeps a set of endorsed Linux distributions, which include Red Hat Enterprise Linux, Debian, Flatcar, Suse, Canonical, and Oracle Linux and CentOS (as managed by OpenLogic, not Red Hat). [...] Overall, the company gets about 1,000 images a month from these endorsed partners alone. Many of the distributions have multiple images (Suse has a regular one, and another one for high-performance computing, for instance). ' -- source: https://linux.slashdot.org/story/24/07/22/2157209 Cheers, Peter

1 0

Nvidia Will Fully Transition To Open-Source GPU Kernel Modules With R560 Drivers
by Peter Reutemann 19 Jul '24

19 Jul '24

'Nvidia is ready to fully transition to open-source Linux GPU kernel drivers, starting with the R555 series and planning a complete shift with the R560 series. The open-source kernel modules will only be available for select newer GPUs, while older architectures like Maxwell, Pascal, and Volta must continue using proprietary drivers. TechSpot reports: According to Nvidia, the open-source GPU kernel modules have helped deliver "equivalent or better" application performance compared to its proprietary kernels. The company has also added new features like Heterogeneous Memory Management (HMM) support, confidential computing, and the coherent memory architectures of the Grace platform to its open-source kernels. [...] For compatible GPUs, the default version of the driver installed by all methods is switching from proprietary to open-source. However, users will have the ability to manually select the closed-source modules if they are still available for their platform. Unfortunately, the open-source kernel modules are not available for GPUs from the older Maxwell, Pascal, and Volta architectures, meaning people still running a GTX 980 or GTX 1080 will have to continue using Nvidia's proprietary drivers. For mixed deployments with older and newer GPUs in the same system, Nvidia recommends continuing to use the proprietary driver for full compatibility. "Nvidia has moved most of its proprietary functions into a proprietary, closed-source firmware blob," adds Ars Technica's Kevin Purdy. "The parts of Nvidia's GPUs that interact with the broader Linux system are open, but the user-space drivers and firmware are none of your or the OSS community's business." ' -- source: https://news.slashdot.org/story/24/07/18/2050235 Reminds me a bit of the Brother Linux drivers that I've used in the past: open-source scripts around binary, closed-source blobs... Cheers, Peter

1 0

SUSE Requests openSUSE to Rebrand
by Peter Reutemann 18 Jul '24

18 Jul '24

'Believe it or not, an unexpected conflict has arisen in the openSUSE community with its long-time supporter and namesake, the SUSE company. At the heart of this tension lies a quiet request that has stirred not-so-quiet ripples across the open source landscape: SUSE has formally asked openSUSE to discontinue using its brand name. Richard Brown, a key figure within the openSUSE project, shared insights into the discussions that have unfolded behind closed doors. Despite SUSE’s request’s calm and respectful tone, the implications of not meeting it could be far-reaching, threatening the symbiotic relationship that has benefited both entities over the years. Let’s face it: SUSE has been more than just a namesake for openSUSE; it has actively provided resources and support far beyond what it would ordinarily need for its business operations. This generosity has fostered a thriving openSUSE project that has excelled under SUSE’s goodwill and informal support, including contributions made by SUSE employees on company time. However, the recent request for a branding separation has overshadowed this partnership. If openSUSE does not handle this request with the sensitivity and cooperation it demands, the project risks not just a reduction in support from SUSE but a potential shift in priorities away from it. The “Factory first” policy, a cornerstone of the engineering synergy between SUSE and openSUSE, could also be scrutinized, emphasizing the gravity of the current situation.' -- source: https://linuxiac.com/suse-requests-opensuse-to-rebrand/ Cheers, Peter

2 1

What Is Code?
by Lawrence D'Oliveiro 11 Jul '24

11 Jul '24

Apologies if you already know about this essay, but I just discovered it today: <https://www.bloomberg.com/graphics/2015-paul-ford-what-is-code/>. It’s long. It’s breezy, entertaining, and manages to convey some actual content. Great for recommending to friends or family members who ask what software development is all about.

1 0