- wlug - list.wlug.org.nz

Debian Curl Now Supports HTTP3: What You Need To Know
by Peter Reutemann 09 Jul '24

09 Jul '24

'Good news for Debian users! HTTP3 arrives in Debian Curl. Yes, starting with curl 8.0.0-2, Debian users can now utilize HTTP3. This marks a significant upgrade in the capabilities of curl, enhancing its performance and efficiency in handling web communications. This new feature can be easily tested using the --http3-only flag.' -- source: https://ostechnix.com/debian-curl-supports-http3/ Cheers, Peter

2 1

No more boot loader: Please use the kernel instead
by Peter Reutemann 09 Jul '24

09 Jul '24

'We are working on a new scheme to replace the GRUB bootloader with a fast, secure, Linux-based, user-space solution: nmbl (for no more boot loader). Most people are familiar with GRUB, a powerful, flexible, fully-featured bootloader that is used on multiple architectures (x86_64, aarch64, ppc64le OpenFirmware). Although GRUB is quite versatile and capable, its features create complexity that is difficult to maintain, and that both duplicate and lag behind the Linux kernel while also creating numerous security holes. On the other hand, the Linux kernel, which has a large developer base, benefits from fast feature development, quick responses to vulnerabilities and greater overall scrutiny. We (Red Hat boot loader engineering) will present our solution to this problem, which is to use the Linux kernel as its own bootloader. Loaded by the EFI stub on UEFI, and packed into a unified kernel image (UKI), the kernel, initramfs, and kernel command line, contain everything they need to reach the final boot target. All necessary drivers, filesystem support, and networking are already built in and code duplication is avoided. We will showcase the work done so far, and ask you for your feedback and use cases.' -- source: https://pretalx.com/devconf-cz-2024/talk/W3AVCT/ -- video: https://www.youtube.com/watch?v=ywrSDLp926M Cheers, Peter

1 0

FreeBSD Contributor Mocks Gloomy Predictions for the Open Source Movement
by Peter Reutemann 08 Jul '24

08 Jul '24

'In Communications of the ACM,/em>, long-time FreeBSD contributor Poul-Henning Kamp mocks the idea that the free and open-source software has "come apart" and "will end in tears and regret." Economists and others focused on money — like my bank — have had a lot of trouble figuring out the free and open source software (FOSS) phenomenon, and eventually they seem to have reached the conclusion that it just makes no sense. So, they go with the flow. Recently, very serious people in the FOSS movement have started to write long and thoughtful opinion pieces about how it has all come apart and will end in tears and regret. Allow me to disagree... What follows is a humorous history of how the Open Source movement bested a series of ill-conceived marketing failures starting after the "utterly bad" 1980s when IBM had an "unimaginably huge monopoly" — and an era of vendor lock-in from companies trying to be the next IBM: Out of that utter market failure came Minix, (Net/Free/Open)BSD, and Linux, at a median year of approximately 1991. I can absolutely guarantee that if we had been able to buy a reasonably priced and solid Unix for our 32-bit PCs — no strings attached — nobody would be running FreeBSD or Linux today, except possibly as an obscure hobby. Bill Gates would also have had a lot less of our money... The essay moves on to when "that dot-com thing happened, fueled by the availability of FOSS operating systems, which did a much better job than any operating system you could buy — not just for the price, but in absolute terms of performance on any given piece of hardware. Thus, out of utter market failure, the FOSS movement was born." And ultimately, the essay ends with our present day, and the phenomenon of companies that "make a business out of FOSS or derivatives thereof..." The "F" in FOSS was never silent. In retrospect, it seems clear that open source was not so much the goal itself as a means to an end, which is freedom: freedom to fix broken things, freedom from people who thought they could clutch the source code tightly and wield our ignorance of it as a weapon to force us all to pay for and run Windows Vista. But the FOSS movement has won what it wanted, and no matter how much oldsters dream about their glorious days as young revolutionaries, it is not coming back; the frustrations and anger of IT in 2024 are entirely different from those of 1991. One very big difference is that more people have realized that source code is a liability rather than an asset. For some, that realization came creeping along the path from young teenage FOSS activists in the late 1990s to CIOs of BigCorp today. For most of us, I expect, it was the increasingly crushing workload of maintaining legacy code bases...' -- source: https://news.slashdot.org/story/24/07/07/0243241 Cheers, Peter

1 0

“RegreSSHion” vulnerability in OpenSSH gives attackers root on Linux
by Peter Reutemann 03 Jul '24

03 Jul '24

'Researchers have warned of a critical vulnerability affecting the OpenSSH networking utility that can be exploited to give attackers complete control of Linux and Unix servers with no authentication required. The vulnerability, tracked as CVE-2024-6387, allows unauthenticated remote code execution with root system rights on Linux systems that are based on glibc, an open source implementation of the C standard library. The vulnerability is the result of a code regression introduced in 2020 that reintroduced CVE-2006-5051, a vulnerability that was fixed in 2006. With thousands, if not millions, of vulnerable servers populating the Internet, this latest vulnerability could pose a significant risk. [...] The vulnerability affects the following: - OpenSSH versions earlier than 4.4p1 are vulnerable to this signal handler race condition unless they are patched for CVE-2006-5051 and CVE-2008-4109. - Versions from 4.4p1 up to, but not including, 8.5p1 are not vulnerable due to a transformative patch for CVE-2006-5051, which made a previously unsafe function secure. - The vulnerability resurfaces in versions from 8.5p1 up to, but not including, 9.8p1 due to the accidental removal of a critical component in a function.' -- source: https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-opens… OpenSSH 9.8 was released July 1st: https://www.openssh.com/ Cheers, Peter

1 0

Made Move To Wayland
by Lawrence D'Oliveiro 01 Jul '24

01 Jul '24

I’d been running Wayland OK on my laptop for some months now, but I held off putting it on my main machine for one reason: when I logged into a Wayland session, Emacs would not recognize my Compose key (which I have set to Caps Lock). Today I finally figured out I have to install the “emacs-pgtk” package instead of “emacs-gtk”; the former is built with a version of GTK that works with Wayland. And yes, my Compose key works again. Still have to get used to slightly different input behaviour: previously, once I hit Compose, nothing would appear until I finished the whole key sequence. Now it echoes each keystroke immediately as I type it, in place, overwriting the previous echo (starting with an underline for the Compose key itself), then when I have typed the last key, it overwrites the echo area with the final character.

2 6

From Jupyter To JupyterLab
by Lawrence D'Oliveiro 28 Jun '24

28 Jun '24

I’ve been using Jupyter <https://jupyter.org/> as a convenient basis for “scratchpad” programming (not just in Python, but also some other languages) for a while now. I had heard about this next-generation “JupyterLab” thing they were working on, but always held off trying it out. Then I did my usual monthly upgrade of Debian Unstable on my main machine a few days ago, and this time my Jupyter installation broke. So I updated my wrapper scripts for building Jupyter from source, to check out more recent versions of all the necessary components. Got the build done, started it up, and ... it seems my Jupyter has turned into JupyterLab. Yup, it has a new interface now. The file-manager display no longer seems to open things with a single click; that now only selects items, and you then have to perform an action (like open a notebook) from a right-click menu. And there is no “open in new tab/window” menu item; creating a new tab always happens when opening a notebook, while opening a subfolder always replaces the current tab contents. I used to be able to middle-click on a folder to open it in a new tab, but that option is now gone. There is an option in the right-click menu to “Copy Shareable Link”. When you do this on a notebook or folder and paste the result into the address bar, it opens the item in what I can only call “lab” mode. The window now has three panes, with the middle one an editor-type display, for viewing/editing notebook contents and other document content. The left-hand pane can show various things, selected by clicking one of the icons in its leftmost margin: it can show folder contents, or the table of contents of the current notebook, or a summary of open notebooks, running processes etc. And in the right-hand pane, there are various kinds of “tools” (for debugging, inspection etc) that only seem to appear when viewing notebook content. Ah, discovered how to control the visibility of this “tool” pane: it has two icons for selecting the two different categories of this it can display. But if you click the icon for the section that is already showing, the whole pane shrinks down to a narrow strip just showing the icons. Click again to expand the pane, of course. Further ah, same thing happens with the left-hand pane: click the icon for the section that’s already showing, and that pane too shrinks down. Hiding both the left- and right-hand panes brings you almost back to the old-style minimal-frills notebook/document display, except it only takes a click to bring one of those extras back. The middle pane has its own tab system, to let you have multiple documents open at once. You can drag its internal tabs around to tile them vertically or horizontally. And you can just drag a document to here from the folder display on the left to open it. Click on the document tab header, and that item opens in a separate browser window/tab. If nothing is open here it defaults to showing a “Launcher” tab, with icons for creating notebooks, opening terminal sessions, and creating other document types. The “lab” mode is activated by having an extra “/lab” part in the URL; if you remove this, it reverts to the old-style view of a single folder or notebook. Another thing that has changed is the way notebooks are saved. Previously, there was a menu option to “save and checkpoint” (with no option to do a manual save without checkpointing). And I found that if you tried to close the view of a modified notebook, it would ask to confirm you wanted to close the tab/window, but regardless of which you selected, the notebook would still be saved back to the file. Now that confirm-close trick no longer does saving; you have to explicitly select Save from the File menu, or hit CTRL/S. Checkpointing might still happen automatically as part of autosaving; I can’t find a menu option for explicitly creating a checkpoint, only for restoring from one. So anyway, a lot of intriguing new stuff in there to discover. If you like experimenting with code (as I do), Jupyter can be a great way to do it.

1 0

Superfile: A Modern Terminal File Manager for Linux and macOS
by Peter Reutemann 20 Jun '24

20 Jun '24

'Superfile is a modern terminal file manager that recently caught my attention; it’s not only easy to use but is very user-friendly compared to its alternatives, such as Ranger, MC, or nnn. It allows you to create files and directories, view (process, metadata, clipboard), provide a navigation pane, create multiple panels to work in two separate directories, support plugins, offer a variety of themes, and much more. The project is new, so there have been active updates every week, allowing you to see new features quickly. I’ve also been using it for a few days, and honestly, one key factor in using DE in Linux for me was its easy-to-use file manager, but with Superfile, there’s no need for that now.' -- source: https://linuxtldr.com/installing-superfile/ I've used mc in the past, being familiar with norton commander, but I might give Superfile a go in the future. Cheers, Peter

1 0

systemd-tmpfiles, deleting /home
by Peter Reutemann 19 Jun '24

19 Jun '24

Saw this on my mastodon feed: 'TIL (thankfully second hand) that running "systemd-tmpfiles --purge" will delete /home in systemd 256 [1]. Apparently if you think linux is mainly for running cloud services, this seems reasonable to you. Or something. [1] tested with systemd-tmpfiles --dry-run --purge on debian. I guess it _could_ be a Debian addition, but I'm guessing not.' -- source: https://mathstodon.xyz/@bremner/112615591101488528 Anyone keen on giving it a go??? :-) Cheers, Peter

2 1

DietPi Released a New Version 9.5
by Peter Reutemann 19 Jun '24

19 Jun '24

Just saw these release notes come across my feed: https://dietpi.com/docs/releases/v9_5/ Since I'd never heard of DiePi before: 'DietPi is a highly optimised & minimal Debian-based Linux distribution. DietPi is extremely lightweight at its core, and also extremely easy to install and use. Setting up a single board computer (SBC) or even a computer, for both regular or server use, takes time and skill. DietPi provides an easy way to install and run favourite software you choose.' -- source: https://dietpi.com/docs/ And it supports a range of boards: https://dietpi.com/docs/hardware/ RPis, Odroid, Pine64, Radxa, Sparky, ASUS Tinker board, NanoPi, Orange Pi Cheers, Peter

1 0

KDE Plasma 6.1 Released
by Peter Reutemann 19 Jun '24

19 Jun '24

'"The KDE community announced the latest release of their popular desktop environment: Plasma 6.1," writes longtime Slashdot reader jrepin. From the announcement: While Plasma 6.0 was all about getting the migration to the underlying Qt 6 frameworks correct, Plasma 6.1 is where developers start implementing the features that will take you desktop to a new level. In this release, you will find features that go far beyond subtle changes to themes and tweaks to animations (although there is plenty of those too). Among some of the new features in this release you will find improved remote desktop support with a new built-in server, overhauled and streamlined desktop edit mode, restoration of open applications from the previous session on Wayland, synchronization of keyboard LED colors with the desktop accent color, making mouse cursor bigger and easier to find by shaking it, edge barriers (a sticky area for mouse cursor near the edges between screens), explicit sync support eliminates flickering and glitches for NVidia graphics card users on Wayland, and triple buffering support for smoother animations and screen rendering.' -- source: https://tech.slashdot.org/story/24/06/18/2050203 Cheers, Peter

1 0

High-severity vulnerabilities affect a wide range of Asus router models
by Peter Reutemann 18 Jun '24

18 Jun '24

'Hardware manufacturer Asus has released updates patching multiple critical vulnerabilities that allow hackers to remotely take control of a range of router models with no authentication or interaction required of end users. The most critical vulnerability, tracked as CVE-2024-3080 is an authentication bypass flaw that can allow remote attackers to log into a device without authentication. The vulnerability, according to the Taiwan Computer Emergency Response Team / Coordination Center (TWCERT/CC), carries a severity rating of 9.8 out of 10. [...] A second vulnerability tracked as CVE-2024-3079 affects the same router models. It stems from a buffer overflow flaw and allows remote hackers who have already obtained administrative access to an affected router to execute commands. TWCERT/CC is warning of a third vulnerability affecting various Asus router models. It’s tracked as CVE-2024-3912 and can allow remote hackers to execute commands with no user authentication required.' -- source: https://arstechnica.com/security/2024/06/high-severity-vulnerabilities-affe… The article lists affected routers and links to their respective bios/firmware pages. Cheers, Peter

1 0

The Ladybird browser project
by Peter Reutemann 17 Jun '24

17 Jun '24

Just stumbled across a browser project on my mastodon feed that I hadn't heard of before: Ladybird Browser -- source: https://tech.lgbt/@nina_kali_nina/111932702661268627 -- project page: https://ladybird.dev/ -- code: https://github.com/LadybirdBrowser/ladybird Anybody ever tried that? Cheers, Peter

1 0

Ransomware attackers quickly weaponize PHP vulnerability with 9.8 severity rating
by Peter Reutemann 17 Jun '24

17 Jun '24

'Ransomware criminals have quickly weaponized an easy-to-exploit vulnerability in the PHP programming language that executes malicious code on web servers, security researchers said. As of Thursday, Internet scans performed by security firm Censys had detected 1,000 servers infected by a ransomware strain known as TellYouThePass, down from 1,800 detected on Monday. The servers, primarily located in China, no longer display their usual content; instead, many list the site’s file directory, which shows all files have been given a .locked extension, indicating they have been encrypted. An accompanying ransom note demands roughly $6,500 in exchange for the decryption key. The vulnerability, tracked as CVE-2024-4577 and carrying a severity rating of 9.8 out of 10, stems from errors in the way PHP converts Unicode characters into ASCII. A feature built into Windows known as Best Fit allows attackers to use a technique known as argument injection to convert user-supplied input into characters that pass malicious commands to the main PHP application. Exploits allow attackers to bypass CVE-2012-1823, a critical code execution vulnerability patched in PHP in 2012. CVE-2024-4577 affects PHP only when it runs in a mode known as CGI, in which a web server parses HTTP requests and passes them to a PHP script for processing. Even when PHP isn’t set to CGI mode, however, the vulnerability may still be exploitable when PHP executables such as php.exe and php-cgi.exe are in directories that are accessible by the web server. This configuration is extremely rare, with the exception of the XAMPP platform, which uses it by default. An additional requirement appears to be that the Windows locale—used to personalize the OS to the local language of the user—must be set to either Chinese or Japanese.' -- source: https://arstechnica.com/security/2024/06/thousands-of-servers-infected-with… Cheers, Peter

2 1

Raspberry Pi is Now a Public Company
by Peter Reutemann 12 Jun '24

12 Jun '24

'Who would have thought that Raspberry Pi, the maker of the tiny, cheap, single-board computers, would become a public company? Yet, this is exactly what's happening: Raspberry Pi priced its IPO on the London Stock Exchange on Tuesday morning at $3.56 per share, valuing it at $689 million. Shortly after that, the company's shares jumped a nice 32% to $4.70. It means that Raspberry Pi could end up raising more than $200 million during its IPO process. Raspberry Pi has sold 60 million units since its inception. In 2023 alone, Raspberry Pi generated $266 million in revenue and $66 million in gross profit. Raspberry Pi Ltd, the public company, is the commercial subsidiary of the Raspberry Pi Foundation. The Foundation says it wants to make it easier for people to learn coding through a low-cost, programmable computer. It also remains the main shareholder of Raspberry Pi Ltd.' -- source: https://tech.slashdot.org/story/24/06/11/144251 Cheers, Peter

1 0

One-Line Patch For Intel Meteor Lake Yields Up To 72% Better Performance
by Peter Reutemann 11 Jun '24

11 Jun '24

'Michael Larabel reports via Phoronix: Covered last week on Phoronix was a new patch from Intel that with tuning to the P-State CPU frequency scaling driver was showing big wins for Intel Core Ultra "Meteor Lake" performance and power efficiency. I was curious with the Intel claims posted for a couple benchmarks and thus over the weekend set out to run many Intel Meteor Lake benchmarks on this one-line kernel patch... The results are great for boosting the Linux performance of Intel Core ultra laptops with as much as 72% better performance. [...] When looking at the CPU power consumption overall, for the wide variety of workloads tested it was just a slight uptick in power use and thus overall leading to slightly better power efficiency too. See all the data here. So this is quite a nice one-line Linux kernel patch for Meteor Lake and will hopefully be mainlined to the Linux kernel for Linux 6.11 if not squeezing it in as a "fix" for the current Linux 6.10 cycle. It's just too bad though that it took six months after launch for this tuned EPP value to be determined. Fresh benchmarks between Intel Core Ultra and AMD Ryzen on the latest Linux software will be coming up soon on Phoronix.' -- source: https://hardware.slashdot.org/story/24/06/10/2031256 Cheers, Peter

1 0

Nasty Linux Bug, CVE-2024-1086, is on the loose
by Peter Reutemann 05 Jun '24

05 Jun '24

'A few months back, CVE-2024-1086, a nasty use-after-free vulnerability in the Linux kernel's netfilter, was revealed. With a Common Vulnerability Scoring System (CVSS) score of 7.8, this bug, with the foundation for most Linux network firewall and Network Address Translation (NAT) programs, was a nasty little security hole. With it, Netfliter's table component could be exploited to achieve local privilege escalation. Worse still, you didn't need to be terribly clever to use it, so a local attacker could escalate privileges from a regular user to root in no time flat. Adding insult to injury, this vulnerability was present in pretty much all the major Linux distributions, including Debian, Fedora, Red Hat, and Ubuntu. In short, pretty much any Linux distribution using any kernel version between 5.14 and 6.6.14 could be hacked. Ouch! But, the fix has been in place since January 2024, when the flaw was patched. So, if we've been good little system administrators, we shouldn't have anything to worry about, right? Right!? Wrong. The US Cybersecurity and Infrastructure Security Agency (CISA) has flagged it and added it to the Known Exploited Vulnerabilities (KEV) catalog. It turns out that it's being actively exploited in the wild.' -- source: https://opensourcewatch.beehiiv.com/p/nasty-linux-bug-cve20241086-loose Cheers, Peter

1 0

The Raspberry Pi 5 Gets an AI Upgrade
by Peter Reutemann 05 Jun '24

05 Jun '24

'Today, Raspberry Pi introduced a new kit that adds AI functionality to the Raspberry Pi 5. ZDNet reports: The Raspberry Pi AI kit combines an M.2-format Hailo 8L AI accelerator with the Raspberry Pi M.2 HAT+ to create a powerful yet power-efficient solution. The Hailo-8L NPU (Neural Processing Unit) chip, capable of 13 trillion operations per second (TOPS), is built into an M.2 2242 form factor module that attaches to the M.2 HAT+. When connected to a Raspberry Pi 5 board running the latest Raspberry Pi OS, the NPU is automatically available for AI computing tasks. The AI module also has direct access to the Raspberry Pi's camera software stack and works with both first-party and third-party cameras. The NPU allows the Raspberry Pi 5 to perform AI tasks such as object and facial recognition, human pose analysis, and more. Using an NPU frees up the Raspberry Pi 5's CPU, allowing it to focus on other tasks, making your projects more efficient and powerful. The Raspberry Pi AI kit is also compatible with the Raspberry Pi Active Cooler, ensuring optimal performance without overheating. Additionally, you can purchase a clear protective layer to prevent damage to the board, giving you peace of mind while working on your projects. The AI kit is priced at $70. It's available from Raspberry Pi Approved Resellers, including PiHut, PiShop.us, and CanaKit. ' -- source: https://hardware.slashdot.org/story/24/06/04/2037238 Cheers, Peter

1 0

CentOS 7’s Final Countdown: 30 Days Left Until Support Ends
by Peter Reutemann 04 Jun '24

04 Jun '24

'In just 30 days, we’ll witness the end of an era for Linux with the cessation of support for CentOS 7—the last supported version of this once-dominant server operating system still receiving updates. Let’s take a quick look back at its journey. Ten years ago, on July 7, 2014, CentOS 7 was released as a fully compatible fork of Red Hat Enterprise Linux 7. Since its initial CentOS 2 version in 2004, the distribution has become extremely popular, establishing itself as the go-to server operating system over the last decade. After nine minor version updates, the latest being CentOS 7.9, in November 2020, Red Hat made a significant announcement. It marked the end of CentOS as a server operating system and transitioned it to CentOS Stream—a rolling release distro and upstream public development branch for Red Hat Enterprise Linux (RHEL). To complicate things further, CentOS 8, expected to receive updates until 2029, was prematurely retired at the end of December 2021. This leaves only CentOS 7 as the only version to complete its entire maintenance period, which ends in just 30 days on June 30, 2024. So, consider this as a final reminder if you’re still using CentOS 7 and haven’t yet migrated your system. Time is running out, and here are some alternative options to switch to a RHEL-compatible and supported replacement.' -- source: https://linuxiac.com/centos-7-has-30-days-left-until-support-ends/ Cheers, Peter

1 0

Fun With The du Command
by Lawrence D'Oliveiro 29 May '24

29 May '24

Looking at the space taken up by my copy of the Blender source code: ldo(a)theon:projects> du -ks blender 1444272 blender Most of that is in the commit history: ldo(a)theon:projects> du -ks blender/.git 1139640 blender/.git So how much isn’t? ldo(a)theon:projects> du -ks blender/.git blender 1139640 blender/.git 304632 blender Do you see what happened there? If you specify a directory, and then its containing directory on the same command, du will subtract the usage of the former from the latter. This gives you an easy way of determining the space taken up by a directory, not including particular subdirectories. This can be broken down even more: ldo(a)theon:projects> du -ks blender/.git blender/extern blender/intern blender/source blender 1139640 blender/.git 40536 blender/extern 15712 blender/intern 105188 blender/source 143196 blender Here, “extern” is various open-source libraries from other sources, that have been copied into the Blender source tree, while “intern” is code that originated from Blender itself, that has been organized into its own libraries. And as you can see, there is still a whole bunch left in other subdirectories. Does this work recursively? ldo(a)theon:projects> du -ks blender/.git blender/intern/cycles blender/intern blender 1139640 blender/.git 8880 blender/intern/cycles 6832 blender/intern 288920 blender Yes it does. Here we can see that the Cycles renderer makes up a bit over half the contents of “intern”.

1 0

datamash - basic numeric, textual and statistical operations
by Peter Reutemann 28 May '24

28 May '24

Hi everyone I quite often need to do some quick and dirty statistical calculations on the command-line and I typically use cat and sed to extract the data that I need from text files. In the past, I've then switched to LibreOffice Calc for some basic statistics like mean/stdev. Today, I finally spent a bit more time having a look around what else I can use directly on the command-line and came across the following that fits the bill perfectly: datamash - https://www.gnu.org/software/datamash/ With that tool, I can finally apply a single command-line to textual output for generating a quick mean/stdev: ... | datamash mean 1 sstdev 1 --header-out mean(field-1) sstdev(field-1) 577.62815533981 128.99238940453 Cheers, Peter

2 1

Memory Sealing 'mseal' System Call Merged For Linux 6.10
by Peter Reutemann 27 May '24

27 May '24

'"Merged this Friday evening into the Linux 6.10 kernel is the new mseal() system call for memory sealing," reports Phoronix: The mseal system call was led by Jeff Xu of Google's Chrome team. The goal with memory sealing is to also protect the memory mapping itself against modification. The new mseal Linux documentation explains: "Modern CPUs support memory permissions such as RW and NX bits. The memory permission feature improves security stance on memory corruption bugs, i.e. the attacker can't just write to arbitrary memory and point the code to it, the memory has to be marked with X bit, or else an exception will happen. Memory sealing additionally protects the mapping itself against modifications. This is useful to mitigate memory corruption issues where a corrupted pointer is passed to a memory management system... Memory sealing can automatically be applied by the runtime loader to seal .text and .rodata pages and applications can additionally seal security-critical data at runtime. A similar feature already exists in the XNU kernel with the VM_FLAGS_PERMANENT flag and on OpenBSD with the mimmutable syscall." The mseal system call is designed to be used by the likes of the GNU C Library "glibc" while loading ELF executables to seal non-writable memory segments or by the Google Chrome web browser and other browsers for protecting security sensitive data structures.' -- source: https://linux.slashdot.org/story/24/05/26/2117251 Cheers, Peter

1 0

Ubuntu 24.04 Now Runs on the Nintendo Switch (Unofficially)
by Peter Reutemann 27 May '24

27 May '24

'"The fact it's possible at all is a credit to the ingenuity of the open-source community," writes the blog OMG Ubuntu: Switchroot is an open-source project that allows Android and Linux-based distros like Ubuntu to run on the Nintendo Switch — absolutely not something Nintendo approves of much less supports, endorses, or encourages, etc! I covered the loophole that made this possible back in 2018. Back then the NVIDIA Tegra X1-powered Nintendo Switch was still new and Linux support for much of the console's internal hardware in a formative state (a polite way to say 'not everything worked'). But as the popularity of Nintendo's handheld console ballooned (to understate it) so the 'alternative OS' Switch scene grew, and before long Linux support for Switch hardware was in full bloom... A number of Linux for Switchroot (L4S) distributions have since been released, designated as Linux for Tegra (L4T) builds. As these can boot from a microSD card it's even possible to dualboot the Switch OS with Linux, which is neat! Recently, a fresh set of L4T Ubuntu images were released based on the newest Ubuntu 24.04 LTS release. These builds work on all Switch versions, from the OG (exploit-friendly) unit through to newer, patched models (where a modchip is required)... I'm told all of the Nintendo Switch internal hardware now works under Linux, including Wi-Fi, Bluetooth, sleep mode, accelerated graphics, the official dock... Everything, basically. And despite being a 7 year old ARM device the performance is said to remain decent. "Upstream snafus have delayed the release of builds with GNOME Shell..."' -- source: https://games.slashdot.org/story/24/05/26/035202 Cheers, Peter

1 0

Disabling Google Search (Mis)Features
by Lawrence D'Oliveiro 26 May '24

26 May '24

This article <https://arstechnica.com/gadgets/2024/05/google-searchs-udm14-trick-lets-you…> explains how you can add an option to a Google search URL to turn off the new AI functionality. Another option lets you specify that you want a verbatim search on what you typed, rather than a “fuzzy” search. It also describes how you can configure your browser for more convenient invocation of these options.

1 0

Sovereign Tech Fund Backs FFmpeg Project with a €157K Infusion
by Peter Reutemann 24 May '24

24 May '24

'Sovereign Tech Fund, a funding pot supported financially by the German Federal Ministry for Economic Affairs and Climate Action, has once again shown itself to be one of Open Source’s great friends and supporters. After providing €1 million in financial support to GNOME at the end of last year and investing more than €200K in the GStreamer project earlier this year, the company is continuing its support for multimedia projects by funding FFmpeg. In light of this, last week, FFmpeg announced its first governmental sponsorship, Germany’s Sovereign Tech Fund, which has stepped forward to support the maintenance and sustainability of FFmpeg, a cornerstone software in the multimedia industry, by investing €157K in the project.' -- source: https://linuxiac.com/sovereign-tech-fund-backs-ffmpeg-project/ Cheers, Peter

2 1

RISC-V Now Supports Rust In the Linux Kernel
by Peter Reutemann 24 May '24

24 May '24

'Michael Larabel reports via Phoronix: The latest RISC-V port updates have been merged for the in-development Linux 6.10 kernel. Most notable with today's RISC-V merge to Linux 6.10 is now supporting the Rust programming language within the Linux kernel. RISC-V joins the likes of x86_64, LoongArch, and ARM64 already supporting the use of the in-kernel Rust language support. The use of Rust within the mainline Linux kernel is still rather limited with just a few basic drivers so far and a lot of infrastructure work taking place, but there are a number of new drivers and other subsystem support on the horizon. RISC-V now supporting Rust within the Linux kernel will become more important moving forward. The RISC-V updates for Linux 6.10 also add byte/half-word compare-and-exchange, support for Zihintpause within hwprobe, a PR_RISCV_SET_ICACHE_FLUSH_CTX prctl(), and support for lockless lockrefs. More details on these RISC-V updates for Linux 6.10 via this Git merge. ' -- source: https://linux.slashdot.org/story/24/05/22/2337254 Cheers, Peter

1 0

A Root-Server at the Internet's Core Lost Touch With Its Peers. We Still Don't Know Why.
by Peter Reutemann 24 May '24

24 May '24

'A server maintained by Cogent Communications, one of the 13 root servers crucial to the Internet's domain name system, fell out of sync with its peers for over four days due to an unexplained glitch. This issue, which could have caused worldwide stability and security problems, was resolved on Wednesday. The root servers store cryptographic keys necessary for authenticating intermediate servers under the DNSSEC mechanism. Inconsistencies in these keys across the 13 servers could lead to an increased risk of attacks such as DNS cache poisoning. Engineers postponed planned updates to the .gov and .int domain name servers' DNSSEC to use ECDSA cryptographic keys until the situation stabilized. Cogent stated that it became aware of the issue on Tuesday and resolved it within 25 hours. ArsTechnica, which has a great writeup about the incident, adds: Initially, some people speculated that the depeering of Tata Communications, the c-root site outage, and the update errors to the c-root itself were all connected somehow. Given the vagueness of the statement, the relation of those events still isn't entirely clear.' -- source: https://it.slashdot.org/story/24/05/23/1745246 Cheers, Peter

1 0

Mozilla Says It's Concerned About Windows Recall
by Peter Reutemann 23 May '24

23 May '24

'Microsoft's Windows Recall feature is attracting controversy before even venturing out of preview. From a report: The principle is simple. Windows takes a snapshot of a user's active screen every few seconds and dumps it to disk. The user can then scroll through the snapshots and, when something is selected, the user is given options to interact with the content. Mozilla's Chief Product Officer, Steve Teixeira, told The Register: "Mozilla is concerned about Windows Recall. From a browser perspective, some data should be saved, and some shouldn't. Recall stores not just browser history, but also data that users type into the browser with only very coarse control over what gets stored. While the data is stored in encrypted format, this stored data represents a new vector of attack for cybercriminals and a new privacy worry for shared computers. "Microsoft is also once again playing gatekeeper and picking which browsers get to win and lose on Windows -- favoring, of course, Microsoft Edge. Microsoft's Edge allows users to block specific websites and private browsing activity from being seen by Recall. Other Chromium-based browsers can filter out private browsing activity but lose the ability to block sensitive websites (such as financial sites) from Recall. "Right now, there's no documentation on how a non-Chromium based, third-party browser, such as Firefox, can protect user privacy from Recall. Microsoft did not engage our cooperation on Recall, but we would have loved for that to be the case, which would have enabled us to partner on giving users true agency over their privacy, regardless of the browser they choose."' -- source: https://tech.slashdot.org/story/24/05/22/1939244 Cheers, Peter

1 0

Linux 6.10 Honors One Last Request By Hans Reiser
by Peter Reutemann 22 May '24

22 May '24

'Phoronix: ReiserFS lead developer and convicted murderer Hans Reiser a few months back wrote letters to be made public apologizing for his social mistakes and other commentary. In his written communications he also made a last request for ReiserFS in the Linux kernel: "Assuming that the decision is to remove [ReiserFS] V3 from the kernel, I have just one request: that for one last release the README be edited to add Mikhail Gilula, Konstantin Shvachko, and Anatoly Pinchuk to the credits, and to delete anything in there I might have said about why they were not credited. It is time to let go." Hans credits his improved social and communication skills learned in prison among other details shared in the public letters. Per the indirect request by Hans Reiser, SUSE's Jan Kara has now altered the ReiserFS README file with the changes going in today to the Linux 6.10 kernel. The negative language was removed and instead acknowledging their contributions.' -- source: https://linux.slashdot.org/story/24/05/21/217228 Cheers, Peter

1 0

New Windows AI feature records everything you’ve done on your PC
by Peter Reutemann 22 May '24

22 May '24

'At a Build conference event on Monday, Microsoft revealed a new AI-powered feature called "Recall" for Copilot+ PCs that will allow Windows 11 users to search and retrieve their past activities on their PC. To make it work, Recall records everything users do on their PC, including activities in apps, communications in live meetings, and websites visited for research. Despite encryption and local storage, the new feature raises privacy concerns for certain Windows users. "Recall uses Copilot+ PC advanced processing capabilities to take images of your active screen every few seconds," Microsoft says on its website. "The snapshots are encrypted and saved on your PC’s hard drive. You can use Recall to locate the content you have viewed on your PC using search or on a timeline bar that allows you to scroll through your snapshots." By performing a Recall action, users can access a snapshot from a specific time period, providing context for the event or moment they are searching for. It also allows users to search through teleconference meetings they've participated in and videos watched using an AI-powered feature that transcribes and translates speech. At first glance, the Recall feature seems like it may set the stage for potential gross violations of user privacy. Despite reassurances from Microsoft, that impression persists for second and third glances as well. For example, someone with access to your Windows account could potentially use Recall to see everything you've been doing recently on your PC, which might extend beyond the embarrassing implications of pornography viewing and actually threaten the lives of journalists or perceived enemies of the state. Despite the privacy concerns, Microsoft says that the Recall index remains local and private on-device, encrypted in a way that is linked to a particular user's account. "Recall screenshots are only linked to a specific user profile and Recall does not share them with other users, make them available for Microsoft to view, or use them for targeting advertisements. Screenshots are only available to the person whose profile was used to sign in to the device," Microsoft says. Users can pause, stop, or delete captured content and can exclude specific apps or websites. Recall won't take snapshots of InPrivate web browsing sessions in Microsoft Edge or DRM-protected content. However, Recall won't actively hide sensitive information like passwords and financial account numbers that appear on-screen.' -- source: https://arstechnica.com/gadgets/2024/05/microsofts-new-recall-feature-will-… Talking about intrusive OS... I wonder whether there will be an ad-supported, cheap version of Windows in the future where the user can't turn Recall off, giving Microsoft a large pool of free training data... Cheers, Peter

2 1

Ubuntu 24.10 to Default to Wayland for NVIDIA Users
by Peter Reutemann 20 May '24

20 May '24

'OMG Ubuntu: Ubuntu first switched to using Wayland as its default display server in 2017 before reverting the following year. It tried again in 2021 and has stuck with it since. But while Wayland is what most of us now log into after installing Ubuntu, anyone doing so on a PC or laptop with an NVIDIA graphics card present instead logs into an Xorg/X11 session. This is because NVIDIA's proprietary graphics drivers (which many, especially gamers, opt for to get the best performance, access to full hardware capabilities, etc) have not supported Wayland as well as as they could've. Past tense as, thankfully, things have changed in the past few years. NVIDIA's warmed up to Wayland (partly as it has no choice given that Wayland is now standard and a 'maybe one day' solution, and partly because it wants to: opportunities/benefits/security). With the NVIDIA + Wayland sitch' now in a better state than before — but not perfect — Canonical's engineers say they feel confident enough in the experience to make the Ubuntu Wayland session default for NVIDIA graphics card users in Ubuntu 24.10.' -- source: https://news.slashdot.org/story/24/05/20/013218 Cheers, Peter

1 0

Linux Foundation Announces Launch of 'High Performance Software Foundation'
by Peter Reutemann 20 May '24

20 May '24

'This week the nonprofit Linux Foundation announced the launch of the High Performance Software Foundation, which "aims to build, promote, and advance a portable core software stack for high performance computing" (or HPC) by "increasing adoption, lowering barriers to contribution, and supporting development efforts." It promises initiatives focused on "continuously built, turnkey software stacks," as well as other initiatives including architecture support and performance regression testing. Its first open source technical projects are: - Spack: the HPC package manager. - Kokkos: a performance-portable programming model for writing modern C++ applications in a hardware-agnostic way. - Viskores (formerly VTK-m): a toolkit of scientific visualization algorithms for accelerator architectures. - HPCToolkit: performance measurement and analysis tools for computers ranging from desktop systems to GPU-accelerated supercomputers. - Apptainer: Formerly known as Singularity, Apptainer is a Linux Foundation project providing a high performance, full featured HPC and computing optimized container subsystem. - E4S: a curated, hardened distribution of scientific software packages. As use of HPC becomes ubiquitous in scientific computing and digital engineering, and AI use cases multiply, more and more data centers deploy GPUs and other compute accelerators. The High Performance Software Foundation will provide a neutral space for pivotal projects in the high performance computing ecosystem, enabling industry, academia, and government entities to collaborate on the scientific software. The High Performance Software Foundation benefits from strong support across the HPC landscape, including Premier Members Amazon Web Services (AWS), Hewlett Packard Enterprise, Lawrence Livermore National Laboratory, and Sandia National Laboratories; General Members AMD, Argonne National Laboratory, Intel, Kitware, Los Alamos National Laboratory, NVIDIA, and Oak Ridge National Laboratory; and Associate Members University of Maryland, University of Oregon, and Centre for Development of Advanced Computing. In a statement, an AMD vice president said that by joining "we are using our collective hardware and software expertise to help develop a portable, open-source software stack for high-performance computing across industry, academia, and government." And an AWS executive said the high-performance computing community "has a long history of innovation being driven by open source projects. AWS is thrilled to join the High Performance Software Foundation to build on this work. In particular, AWS has been deeply involved in contributing upstream to Spack, and we're looking forward to working with the HPSF to sustain and accelerate the growth of key HPC projects so everyone can benefit." The new foundation will "set up a technical advisory committee to manage working groups tackling a variety of HPC topics," according to the announcement, following a governance model based on the Cloud Native Computing Foundation.' -- source: https://tech.slashdot.org/story/24/05/19/2234254 Cheers, Peter

1 0

Why a 'Frozen' Distribution Linux Kernel Isn't the Safest Choice for Security
by Peter Reutemann 20 May '24

20 May '24

'Jeremy Allison — Sam (Slashdot reader #8,157) is a Distinguished Engineer at Rocky Linux creator CIQ. This week he published a blog post responding to promises of Linux distros "carefully selecting only the most polished and pristine open source patches from the raw upstream open source Linux kernel in order to create the secure distribution kernel you depend on in your business." But do carefully curated software patches (applied to a known "frozen" Linux kernel) really bring greater security? "After a lot of hard work and data analysis by my CIQ kernel engineering colleagues Ronnie Sahlberg and Jonathan Maple, we finally have an answer to this question. It's no." The data shows that "frozen" vendor Linux kernels, created by branching off a release point and then using a team of engineers to select specific patches to back-port to that branch, are buggier than the upstream "stable" Linux kernel created by Greg Kroah-Hartman. How can this be? If you want the full details the link to the white paper is here. But the results of the analysis couldn't be clearer. - A "frozen" vendor kernel is an insecure kernel. A vendor kernel released later in the release schedule is doubly so. - The number of known bugs in a "frozen" vendor kernel grows over time. The growth in the number of bugs even accelerates over time. - There are too many open bugs in these kernels for it to be feasible to analyze or even classify them.... [T]hinking that you're making a more secure choice by using a "frozen" vendor kernel isn't a luxury we can still afford to believe. As Greg Kroah-Hartman explicitly said in his talk "Demystifying the Linux Kernel Security Process": "If you are not using the latest stable / longterm kernel, your system is insecure." CIQ describes its report as "a count of all the known bugs from an upstream kernel that were introduced, but never fixed in RHEL 8." For the most recent RHEL 8 kernels, at the time of writing, these counts are: RHEL 8.6 : 5034 RHEL 8.7 : 4767 RHEL 8.8 : 4594 In RHEL 8.8 we have a total of 4594 known bugs with fixes that exist upstream, but for which known fixes have not been back-ported to RHEL 8.8. The situation is worse for RHEL 8.6 and RHEL 8.7 as they cut off back-porting earlier than RHEL 8.8 but of course that did not prevent new bugs from being discovered and fixed upstream.... This whitepaper is not meant as a criticism of the engineers working at any Linux vendors who are dedicated to producing high quality work in their products on behalf of their customers. This problem is extremely difficult to solve. We know this is an open secret amongst many in the industry and would like to put concrete numbers describing the problem to encourage discussion. Our hope is for Linux vendors and the community as a whole to rally behind the kernel.org stable kernels as the best long term supported solution. As engineers, we would prefer this to allow us to spend more time fixing customer specific bugs and submitting feature improvements upstream, rather than the endless grind of backporting upstream changes into vendor kernels, a practice which can introduce more bugs than it fixes. ZDNet calls it "an open secret in the Linux community." It's not enough to use a long-term support release. You must use the most up-to-date release to be as secure as possible. Unfortunately, almost no one does that. Nevertheless, as Google Linux kernel engineer Kees Cook explained, "So what is a vendor to do? The answer is simple: if painful: Continuously update to the latest kernel release, either major or stable." Why? As Kroah-Hartman explained, "Any bug has the potential of being a security issue at the kernel level...." Although [CIQ's] programmers examined RHEL 8.8 specifically, this is a general problem. They would have found the same results if they had examined SUSE, Ubuntu, or Debian Linux. Rolling-release Linux distros such as Arch, Gentoo, and OpenSUSE Tumbleweed constantly release the latest updates, but they're not used in businesses.' -- source: https://linux.slashdot.org/story/24/05/19/0030248 Cheers, Peter

1 0

Google patches its fifth zero-day vulnerability of the year in Chrome
by Peter Reutemann 13 May '24

13 May '24

'Google has updated its Chrome browser to patch a high-severity zero-day vulnerability that allows attackers to execute malicious code on end user devices. The fix marks the fifth time this year the company has updated the browser to protect users from an existing malicious exploit. The vulnerability, tracked as CVE-2024-4671, is a “use after free,” a class of bug that occurs in C-based programming languages. In these languages, developers must allocate memory space needed to run certain applications or operations. They do this by using “pointers” that store the memory addresses where the required data will reside. Because this space is finite, memory locations should be deallocated once the application or operation no longer needs it. Use-after-free bugs occur when the app or process fails to clear the pointer after freeing the memory location. In some cases, the pointer to the freed memory is used again and points to a new memory location storing malicious shellcode planted by an attacker’s exploit, a condition that will result in the execution of this code. On Thursday, Google said an anonymous source notified it of the vulnerability. The vulnerability carries a severity rating of 8.8 out of 10. In response, Google said, it would be releasing versions 124.0.6367.201/.202 for macOS and Windows and 124.0.6367.201 for Linux in subsequent days. “Google is aware that an exploit for CVE-2024-4671 exists in the wild,” the company said.' -- source: https://arstechnica.com/security/2024/05/google-patches-its-fifth-zero-day-… Cheers, Peter

1 0

AMD Core Performance Boost For Linux Getting Per-CPU Core Controls
by Peter Reutemann 13 May '24

13 May '24

'Phoronix: For the past several months AMD Linux engineers have been working on AMD Core Performance Boost support for their P-State CPU frequency scaling driver. The ninth iteration of these patches were posted on Monday and besides the global enabling/disabling support for Core Performance Boost, it's now possible to selectively toggle the feature on a per-CPU core basis... The new interface is under /sys/devices/system/cpu/cpuX/cpufreq/amd_pstate_boost_cpb for each CPU core. Thus users can tune whether particular CPU cores are boosted above the base frequency.' -- source: https://linux.slashdot.org/story/24/05/11/229219 Cheers, Peter

1 0

Linux Kernel 6.9 Officially Released
by Peter Reutemann 13 May '24

13 May '24

'"6.9 is now out," Linus Torvalds posted on the Linux kernel mailing list, "and last week has looked quite stable (and the whole release has felt pretty normal)." Phoronix writes that Linux 6.9 "has a number of exciting features and improvements for those habitually updating to the newest version." And Slashdot reader prisoninmate shared this report from 9to5Linux: Highlights of Linux kernel 6.9 include Rust support on AArch64 (ARM64) architectures, support for the Intel FRED (Flexible Return and Event Delivery) mechanism for improved low-level event delivery, support for AMD SNP (Secure Nested Paging) guests, and a new dm-vdo (virtual data optimizer) target in device mapper for inline deduplication, compression, zero-block elimination, and thin provisioning. Linux kernel 6.9 also supports the Named Address Spaces feature in GCC (GNU Compiler Collection) that allows the compiler to better optimize per-CPU data access, adds initial support for FUSE passthrough to allow the kernel to serve files from a user-space FUSE server directly, adds support for the Energy Model to be updated dynamically at run time, and introduces a new LPA2 mode for ARM 64-bit processors... Linux kernel 6.9 will be a short-lived branch supported for only a couple of months. It will be succeeded by Linux kernel 6.10, whose merge window has now been officially opened by Linus Torvalds. Linux kernel 6.10 is expected to be released in mid or late September 2024. "Rust language has been updated to version 1.76.0 in Linux 6.9," according to the article. And Linus Torvalds shared one more details on the Linux kernel mailing list. "I now have a more powerful arm64 machine (thanks to Ampere), so the last week I've been doing almost as many arm64 builds as I have x86-64, and that should obviously continue during the upcoming merge window too."' -- source: https://linux.slashdot.org/story/24/05/12/2212235 Cheers, Peter

1 0

Fedora Asahi Remix 40 is another big step forward for Linux on Apple Silicon Mac
by Peter Reutemann 10 May '24

10 May '24

'Asahi Linux, the project that aims to bring desktop Linux to Apple hardware with Apple silicon—the M series of chips—is out with Fedora Asahi Remix 40. More hardware features of Apple devices are supported, the Fedora Linux 40-based distro ships with KDE's new Plasma 6 desktop, and untold numbers of bugs are squashed, to be replaced with reams more. Fedora Asahi Remix is a "fully integrated distro," according to the Asahi team, and you can "expect a solid and high-quality experience without any unwanted surprises." It supports all the M1 and M2 devices in the MacBook, Mac Mini, Mac Studio, and iMac lines. It's OpenGL 4.6 and OpenGL ES 3.2 certified, and comes with "the best Linux laptop audio you've ever heard." So, should you install it on your Mac? Keep scrolling down Asahi's release page and check the "Device support" section. Still missing from most M-series Apple devices are support for Thunderbolt and USB4, built-in microphones, and Touch ID, as well as USB-C display support. Speakers are not supported on the iMac. And HDMI audio is in rough shape, being able to "break audio on the system completely." Still, for someone using an Apple laptop primarily as a portable device, or simply connecting to a monitor with less modern all-in-one cables, there is a desktop awaiting. Installing it is a single cURL command.' -- source: https://arstechnica.com/gadgets/2024/05/fedora-asahi-remix-40-is-another-bi… Cheers, Peter

1 0

Raspberry Pis get a built-in remote access tool: Raspberry Pi Connect
by Peter Reutemann 08 May '24

08 May '24

'One Raspberry Pi often leads to another. Soon enough, you're running out of spots in your free RealVNC account for your tiny boards and "real" computers. Even if you go the hardened route of SSH or an X connection, you have to keep track of where they all are. All of this is not the easiest thing to tackle if you're new to single-board computers or just eager to get started. Enter Raspberry Pi Connect, a new built-in way to access a Rasbperry Pi from nearly anywhere you can open a browser, whether to control yourself or provide remote assistance. On a Raspberry Pi 4, 5, or Pi 400 kit, you install Pi connect with a single terminal line, reboot the Pi, and then click a new tray icon to connect the Pi to a Raspberry Pi ID (and then enable two-factor authentication, of course). >From then on, visiting connect.raspberrypi.com gives you an encrypted connection to your desktop. It's a direct connection if possible, and if not, it runs through relay servers in London, encrypting it with DTLS and keeping only the metadata needed for the service to work. The Pi will show a notification in its tray that somebody has connected, and you can manage screen sharing from there. The Pi's docs site has a lot more on the particulars. Connect works only on 64-bit systems running the Bookworm version of Pi OS with a Wayland window server. Connect was created partly due to Pi's transition to Wayland from X, which offered its own remote desktop option. According to the Pi firm, the service runs on a peer-to-peer WebRTC connection, similar to that of Zoom, Slack, Teams, and other video-sharing services. The whole service is in beta at the moment, and the company says it's not quite sure how much traffic to expect through its relay servers.' -- source: https://arstechnica.com/gadgets/2024/05/raspberry-pis-get-a-built-in-remote… Cheers, Peter

1 0

Novel attack against virtually all VPN apps neuters their entire purpose
by Peter Reutemann 07 May '24

07 May '24

'Researchers have devised an attack against nearly all virtual private network applications that forces them to send and receive some or all traffic outside of the encrypted tunnel designed to protect it from snooping or tampering. TunnelVision, as the researchers have named their attack, largely negates the entire purpose and selling point of VPNs, which is to encapsulate incoming and outgoing Internet traffic in an encrypted tunnel and to cloak the user’s IP address. The researchers believe it affects all VPN applications when they’re connected to a hostile network and that there are no ways to prevent such attacks except when the user's VPN runs on Linux or Android. They also said their attack technique may have been possible since 2002 and may already have been discovered and used in the wild since then. The effect of TunnelVision is “the victim's traffic is now decloaked and being routed through the attacker directly,” a video demonstration explained. “The attacker can read, drop or modify the leaked traffic and the victim maintains their connection to both the VPN and the Internet.” The attack works by manipulating the DHCP server that allocates IP addresses to devices trying to connect to the local network. A setting known as option 121 allows the DHCP server to override default routing rules that send VPN traffic through a local IP address that initiates the encrypted tunnel. By using option 121 to route VPN traffic through the DHCP server, the attack diverts the data to the DHCP server itself.' -- source: https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all… Cheers, Peter

1 0

Kernel Modules Are Now Compressed
by Lawrence D'Oliveiro 06 May '24

06 May '24

Not sure if this is mentioned in any release notes anywhere, but the .ko files (loadable kernel modules) that would live in /lib/modules/«kernel version»/ are now .ko.xz files. Looks like this happened starting with the 6.6 kernel. I discovered this a few minutes ago, while trying to count how many .ko files came with my 6.7.9 Debian kernel, with find /lib/modules/$(uname -r) -name \*.ko | wc -l and was surprised to see that the answer was 0. A suitably adjusted command find /lib/modules/$(uname -r) -name \*.ko\* | wc -l returns 4165

1 0

Yet Another New systemd Feature
by Lawrence D'Oliveiro 06 May '24

06 May '24

Lennart Poettering wants to get rid of sudo now, and replace it with a new systemd feature called “run0” <https://itwire.com/business-it-news/open-source/poettering-announces-tool-i…>. It is hard to write code that runs setuid, and sudo has had quite a few security vulnerabilities over the years. So Poettering’s idea is to replace the setuid executable with another use of the existing PolicyKit system. Interesting that Poettering thinks we should get rid of the whole idea of setuid altogether. AT&T actually got a patent on the concept, back in the early days of Unix. Other OSes had the concept of privileged code, but what made setuid different is that any user can set this mode on any executable they create, and when other users run this executable (if they are allowed to), they temporarily get the permissions of the owning user. On Linux, this concept was always constrained a bit: I think it only works on compiled machine-code executables, not on interpreted scripts.

1 0

Maximum-Severity GitLab Flaw Allowing Account Hijacking Under Active Exploitation
by Peter Reutemann 03 May '24

03 May '24

'Dan Goodin reports via Ars Technica: A maximum severity vulnerability that allows hackers to hijack GitLab accounts with no user interaction required is now under active exploitation, federal government officials warned as data showed that thousands of users had yet to install a patch released in January. A change GitLab implemented in May 2023 made it possible for users to initiate password changes through links sent to secondary email addresses. The move was designed to permit resets when users didn't have access to the email address used to establish the account. In January, GitLab disclosed that the feature allowed attackers to send reset emails to accounts they controlled and from there click on the embedded link and take over the account. While exploits required no user interaction, hijackings worked only against accounts that weren't configured to use multi-factor authentication. Even with MFA, accounts remained vulnerable to password resets. The vulnerability, tracked as CVE-2023-7028, carries a severity rating of 10 out of a possible 10. The vulnerability, classified as an improper access control flaw, could pose a grave threat. GitLab software typically has access to multiple development environments belonging to users. With the ability to access them and surreptitiously introduce changes, attackers could sabotage projects or plant backdoors that could infect anyone using software built in the compromised environment. An example of a similar supply chain attack is the one that hit SolarWinds in 2021, infecting more than 18,000 of its customers. Other recent examples of supply chain attacks are here, here, and here. These sorts of attacks are powerful. By hacking a single, carefully selected target, attackers gain the means to infect thousands of downstream users, often without requiring them to take any action at all. According to Internet scans performed by security organization Shadowserver, more than 2,100 IP addresses showed they were hosting one or more vulnerable GitLab instances. In order to protect your system, you should enable MFA and install the latest patch. "GitLab users should also remember that patching does nothing to secure systems that have already been breached through exploits," notes Goodin.' -- source: https://it.slashdot.org/story/24/05/02/1934220 Cheers, Peter -- My Open Source Blog - http://open.fracpete.org

2 1

Bat is a Modern Drop-in Replacement for Cat Command on Linux
by Peter Reutemann 01 May '24

01 May '24

'The bat is a modern command-line program written in the Rust programming language, and I can confidently say it’s a great drop-in replacement for our beloved cat command. If you’re wondering why I’m hyping this so much and what it has to offer you that makes it worth replacing the cat with, then do check out its features below. Bat really has some cool features to offer, which are mentioned below. - Supports syntax highlighting for a large number of programming and markup languages. - Detect and display Git changes. - Pipe output to its own pager (e.g., “less“) if the output is too large for one screen. - Display non-printable characters such as spaces, tabs, line breaks, etc. - Offer multiple themes that can be easily configured using flags or environments. - A user-friendly command-line interface that, of course, inherits all the functionality of the “cat” command.' -- source: https://linuxtldr.com/installing-bat/ Cheers, Peter

2 1

I Have No Luck With Keyboards ...
by Lawrence D'Oliveiro 01 May '24

01 May '24

Yesterday I decided that my heavily-used clicky mechanical keyboard (a Das Keyboard 4) had accumulated far too much grime, and it was time to take the risk of cleaning it. In the past, every time I’ve tried cleaning a keyboard, it has never worked right afterwards. I’m a software guy, not a hardware guy. I found the keys quite easy to pry off. A light amount of leverage with a small screwdriver was helpful when space was tight, but once I’d cleared sufficient room around a key, I could pull it off just with my fingers. Even the wider keys were not hard. I found some warnings online against removing these, because of the trickiness of their extra stabilization mechanisms. But these were actually quite simple: a steel spring with its ends poked through two tiny brackets (removable, but best left in place) at each end of the key. It took a bit of pressure with the screwdriver to bend one end of the spring far enough to take it out of the hole, but it snapped immediately back to its original shape after I had taken the key out, so I saw no problem putting things back afterwards. The space bar was even simpler: just two additional support posts at the ends, in addition to the usual post (common to all the keys) that held the actual switch in the middle. After I had got all the keys off, the grime on the keyboard itself was a wonder to behold (I’ll spare you the details). I tried to use a bunched-up corner of a wet cloth, and even a vacuum cleaner with the smallest nozzle (again heeding warnings online against compressed air), and I was able to remove maybe half the accumulation of deposits, not much more. I figured that was good enough. Of course, in the process, I likely got some water into two slots that were exposed after I removed the keys. There was a recommendation online to leave things to dry for at least 6 hours. Call me impatient; I left it for just 5. Afterwards, I plugged it in, without the key caps, and tried a few keys, and was gratified to find they still worked. After that, I put back all the keys, now nice and clean and dry. Even the ones with those extra springs went back with only a slight amount of fiddling to re-engage with those brackets on the keys. And afterwards, the keyboard still worked. I left it plugged in, and went to do something else. Half an hour later, I came back to my computer ... and the keyboard was dead. Not a single response from any key. Put it back in the heater cupboard and left it overnight. No change this morning: still dead. So I feel very sad. I thought I had broken my keyboard jinx. But it’s currently zero for three. I have some other keyboards, of course, including a colourful oddity I bought from Dick Smith (whose layout leaves out the right-hand super/windows key), and a Kensington “washable” (dare I risk it?), with the pipe/backslash key in a different position. But I had grown accustomed to the volume control knob and other niceties of the Das Keyboard. Looking back through my records, I was surprised to discover I had bought it about ten years ago, from Mighty Ape. So I suppose it’s had a good run. But it seems nobody in NZ sells the things any more. So currently I mourn, and I also look for alternatives ...

3 3

T2 Linux 24.5 Released
by Peter Reutemann 30 Apr '24

30 Apr '24

'A major T2 Linux milestone has been released, shipping with full support for 25 CPU architectures and several C libraries, as well as restored support for Intel IA-64 Itanium. Additionally, many vintage X.org DDX drivers were fixed and tested to work again, as well as complete support for the latest KDE 6 and GNOME 46. T2 is known for its sophisticated cross compile support and support for nearly all existing CPU architectures: Alpha, Arc, ARM(64), Avr32, HPPA(64), IA64, M68k, MIPS(64), Nios2, PowerPC(64)(le), RISCV(64), s390x, SPARC(64), and SuperH x86(64). T2 is an increasingly popular choice for embedded systems and virtualization. It also still supports the Sony PS3, Sgi, Sun and HP workstations, as well as the latest ARM64 and RISCV64 architectures. The release contains a total of 5,140 changesets, including approximately 5,314 package updates, 564 issues fixed, 317 packages or features added and 163 removed, and around 53 improvements. Usually most packages are up-to-date, including Linux 6.8, GCC 13, LLVM/Clang 18, as well as the latest version of X.org, Mesa, Firefox, Rust, KDE 6 and GNOME 46! More information, source and binary distribution are open source and free at T2 SDE.' -- source: https://news.slashdot.org/story/24/04/29/2325210/ To be honest, haven't heard of that distro before, but sounds interesting. Cheers, Peter

2 3

Hackers try to exploit WordPress plugin vulnerability that’s as severe as it gets
by Peter Reutemann 29 Apr '24

29 Apr '24

'Hackers are assailing websites using a prominent WordPress plugin with millions of attempts to exploit a high-severity vulnerability that allows complete takeover, researchers said. The vulnerability resides in WordPress Automatic, a plugin with more than 38,000 paying customers. Websites running the WordPress content management system use it to incorporate content from other sites. Researchers from security firm Patchstack disclosed last month that WP Automatic versions 3.92.0 and below had a vulnerability with a severity rating of 9.9 out of a possible 10. The plugin developer, ValvePress, silently published a patch, which is available in versions 3.92.1 and beyond. Researchers have classified the flaw, tracked as CVE-2024-27956, as a SQL injection, a class of vulnerability that stems from a failure by a web application to query backend databases properly. SQL syntax uses apostrophes to indicate the beginning and end of a data string. By entering strings with specially positioned apostrophes into vulnerable website fields, attackers can execute code that performs various sensitive actions, including returning confidential data, giving administrative system privileges, or subverting how the web app works.' -- source: https://arstechnica.com/security/2024/04/hackers-make-millions-of-attempts-… Cheers, Peter

2 1

Alternative To Microsoft Access
by Lawrence D'Oliveiro 27 Apr '24

27 Apr '24

If anybody asks about an alternative to Microsoft Access, I think SQLite used in combination with LibreOffice will give you a lot of functionality, including comprehensive SQL support and scalability to much larger databases. Of course you can use other backends, like MariaDB/MySQL, as well. SQLite just makes it easy to have an actual database file that you can copy/move about the place, without having to do database dumps/restores. If you don’t need multiuser support, it is very convenient. I notice that libreoffice-base is now a separate package under Debian (and I suppose its derivatives as well), no longer included in the “base” (heh) LibreOffice package. Make sure to install this, along with libsqliteodbc. Now, say you have an existing SQLite3 database that you want to access from LibreOffice. Suppose it is in the file /home/ldo/hack/lo_try/test.db. In order for databases to be accessible via ODBC, they need to have entries in your ~/.odbc.ini file. This is just a text file, in the good old .ini tradition. The format for entries is very simple, e.g.: [test-db] Description=Test database for LibreOffice Base Driver=SQLite3 Database=/home/ldo/hack/lo_try/test.db Now, when you launch the LibreOffice Base database wizard, you have options to “create a new database”, “open an existing database file”, or “connect to an existing database”. Choose that last one “connect to an existing database”. The popup menu shows the available back-end drivers: choose “ODBC”. Now, when you click “Next”, there should be a text field with a “Browse...” button; clicking this should show the names of entries in your ~/.odbc.ini file, e.g. “test-db” if you used the name in my example above. Select this, and click “Finish”. Next you will be prompted for a name to save the “database file”. This is just the LibreOffice Base document that contains the settings for connecting to the actual database: LibreOffice doesn’t know or care where the database back-end keeps the actual data. After having named the LibreOffice database file, you should see the main LibreOffice Base window. In the lower half, under “Tables”, you should see a list of the tables from the database file. You can double-click a table name to see a quick list of all its records. That’s as far as I’ve got. I see a “Design View”, “Form Wizards”, and “Report Wizards”, and all kinds of other fun stuff. Should be great for building simple database applications, with a minimum of programming.

1 0

Ubuntu 24.04 LTS 'Noble Numbat' Officially Released
by Peter Reutemann 26 Apr '24

26 Apr '24

'9to5Linux: Canonical released today Ubuntu 24.04 LTS (Noble Numbat) as the latest version of its popular Linux-based operating system featuring some of the latest GNU/Linux technologies and Open Source software. Powered by Linux kernel 6.8, Ubuntu 24.04 LTS features the latest GNOME 46 desktop environment, an all-new graphical firmware update tool called Firmware Updater, Netplan 1.0 for state-of-the-art network management, updated Ubuntu font, support for the deb822 format for software sources, increased vm.max_map_count for better gaming, and Mozilla Thunderbird as a Snap by default. It also comes with an updated Flutter-based graphical desktop installer that's now capable of updating itself and features a bunch of changes like support for accessibility features, guided (unencrypted) ZFS installations, a new option to import auto-install configurations for templated custom provisioning, as well as new default installation options, such as Default selection (previously Minimal) and Extended selection (previously Normal)."' -- source: https://news.slashdot.org/story/24/04/25/2036234 Cheers, Peter

1 0

Fedora Linux 40 Officially Released
by Peter Reutemann 24 Apr '24

24 Apr '24

'Fedora Linux 40 distribution has been officially released -- powered by the latest Linux 6.8 kernel series, and featuring the GNOME 46 and KDE Plasma 6 desktop environments, reports 9to5Linux: "Powered by the latest and greatest Linux 6.8 kernel series, the Fedora Linux 40 release ships with the GNOME 46 desktop environment for the flagship Fedora Workstation edition and the KDE Plasma 6 desktop environment for the Fedora KDE Spin, which defaults to the Wayland session as the X11 session was completely removed." "Fedora Linux 40 also includes some interesting package management changes, such as dropping Delta RPMs and disabling support in the default configuration of DNF / DNF5. It also changes the DNF behavior to no longer download filelists by default. However, this release doesn't ship with the long-awaited DNF5 package manager. For AMD GPUs, Fedora Linux 40 ships with AMD ROCm 6.0 as the latest release of AMD's software optimized for AI and HPC workload performance, which enables support for the newest flagship AMD Instinct MI300A and MI300X datacenter GPUs."' -- source: https://linux.slashdot.org/story/24/04/23/1452255 Cheers, Peter

1 0

Ex WH Cyber Policy Director: Microsoft Is A Threat To US National Security
by Lawrence D'Oliveiro 23 Apr '24

23 Apr '24

Microsoft has become so dominant a supplier to the US Government that it cannot be effectively called to account on its repeated security lapses <https://www.theregister.com/2024/04/21/microsoft_national_security_risk/>. Even something as basic as event logging (which would have helped track exposure to things like the SolarWinds breach) was an extra-cost service that Microsoft customers had to pay for. Microsoft is squeezing a lot of profit out of those customers, and it feels no need to let up.

1 0

Ubuntu 24.04 Yields a 20% Performance Advantage Over Windows 11 On Ryzen 7 Framework Laptop
by Peter Reutemann 19 Apr '24

19 Apr '24

'Michael Larabel reports via Phoronix: With the Framework 16 laptop one of the performance pieces I've been meaning to carry out has been seeing out Linux performs against Microsoft Windows 11 for this AMD Ryzen 7 7840HS powered modular/upgradeable laptop. Recently getting around to it in my benchmarking queue, I also compared the performance of Ubuntu 23.10 to the near final Ubuntu 24.04 LTS on this laptop up against a fully-updated Microsoft Windows 11 installation. The Framework 16 review unit as a reminder was configured with the 8-core / 16-thread AMD Ryzen 7 7840HS Zen 4 SoC with Radeon RX 7700S graphics, a 512GB SN810 NVMe SSD, MediaTek MT7922 WiFi, and a 2560 x 1600 display. In the few months of testing out the Framework 16 predominantly under Linux it's been working out very well. With also having a Windows 11 partition as shipped by Framework, after updating that install it made for an interesting comparison against the Ubuntu 23.10 and Ubuntu 24.04 performance. The same Framework 16 AMD laptop was used throughout all of the testing for looking at the out-of-the-box performance across Microsoft Windows 11, Ubuntu 23.10, and the near-final state of Ubuntu 24.04. [...] Out of 101 benchmarks carried out on all three operating systems with the Framework 16 laptop, Ubuntu 24.04 was the fastest in 67% of those tests, the prior Ubuntu 23.10 led in 22% (typically with slim margins to 24.04), and then Microsoft Windows 11 was the front-runner just 10% of the time... If taking the geomean of all 101 benchmark results, Ubuntu 23.10 was 16% faster than Microsoft Windows 11 while Ubuntu 24.04 enhanced the Ubuntu Linux performance by 3% to yield a 20% advantage over Windows 11 on this AMD Ryzen 7 7840HS laptop. Ubuntu 24.04 is looking very good in the performance department and will see its stable release next week. ' -- source: https://hardware.slashdot.org/story/24/04/18/2321230 Cheers, Peter

1 0