- wlug - list.wlug.org.nz

YubiKeys Are Vulnerable To Cloning Attacks Thanks To Newly Discovered Side Channel
by Peter Reutemann 04 Sep '24

04 Sep '24

'The YubiKey 5, the most widely used hardware token for two-factor authentication based on the FIDO standard, contains a cryptographic flaw that makes the finger-size device vulnerable to cloning when an attacker gains brief physical access to it, researchers said Tuesday. ArsTechnica: The cryptographic flaw, known as a side channel, resides in a small microcontroller that's used in a vast number of other authentication devices, including smartcards used in banking, electronic passports, and the accessing of secure areas. While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven't tested other devices using the microcontroller, which is SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contain the same vulnerability. YubiKey-maker Yubico issued an advisory in coordination with a detailed disclosure report from NinjaLab, the security firm that reverse-engineered the YubiKey 5 series and devised the cloning attack. All YubiKeys running firmware prior to version 5.7 -- which was released in May and replaces the Infineon cryptolibrary with a custom one -- are vulnerable. Updating key firmware on the YubiKey isn't possible. That leaves all affected YubiKeys permanently vulnerable.' -- source: https://it.slashdot.org/story/24/09/03/1810216 Cheers, Peter

1 0

Microsoft Says Its Recall Uninstall Option in Windows 11 is Just a Bug
by Peter Reutemann 03 Sep '24

03 Sep '24

'While the latest update to Windows 11 makes it look like the upcoming Recall feature can be easily removed by users, Microsoft tells us it's just a bug and a fix is coming. Deskmodder spotted the change last week in the latest 24H2 version of Windows 11, with KB5041865 seemingly delivering the ability to uninstall Recall from the Windows Features section. "We are aware of an issue where Recall is incorrectly listed as an option under the 'Turn Windows features on or off' dialog in Control Panel," says Windows senior product manager Brandon LeBlanc in a statement to The Verge. "This will be fixed in an upcoming update."' -- source: https://it.slashdot.org/story/24/09/02/2241242 The only way to push a feature that users don't want: make it mandatory! I think, the technical term for this approach is "enshittification": https://en.wikipedia.org/wiki/Enshittification Cheers, Peter

1 0

Rust for Linux Maintainer Steps Down in Frustration With 'Nontechnical Nonsense'
by Peter Reutemann 03 Sep '24

03 Sep '24

'Efforts to add Rust code to the Linux kernel has suffered a setback as one of the maintainers of the Rust for Linux project has stepped down -- citing frustration with "nontechnical nonsense." The Register: Wedson Almeida Filho, a software engineer at Microsoft who has overseen the Rust for Linux project, announced his resignation in a message to the Linux kernel development mailing list. "I am retiring from the project," Filho declared. "After almost four years, I find myself lacking the energy and enthusiasm I once had to respond to some of the nontechnical nonsense, so it's best to leave it up to those who still have it in them." [...] Memory safety bugs are regularly cited as the major source of serious software vulnerabilities by organizations overseeing large projects written in C and C++. So in recent years there's been a concerted push from large developers like Microsoft and Google, and well as from government entities like the US Cybersecurity and Infrastructure Security Agency, to use memory-safe programming languages -- among them Rust. Discussions about adding Rust to Linux date back to 2020 and were realized in late 2022 with the release of Linux 6.1. "I truly believe the future of kernels is with memory-safe languages," Filho's note continued. "I am no visionary but if Linux doesn't internalize this, I'm afraid some other kernel will do to it what it did to Unix."' -- source: https://linux.slashdot.org/story/24/09/02/194205 Cheers, Peter

1 0

Public DNS Services
by Lawrence D'Oliveiro 02 Sep '24

02 Sep '24

So I finally got connected to fibre today, and I was pleased to discover that the ISP (https://simplybroadband.co.nz/) offers IPv6 as well. Is this common nowadays? We all know about the public DNS services offered by Google (8.8.8.8, 8.8.4.4) and Cloudflare (1.1.1.1, 1.0.0.1); did you know these addresses have names as well? And of course there are IPv6 addresses to go with the IPv4 ones. Try this command to find out all the related Google DNS services: host -a dns.google. (Yup, that’s “dns.google.”, no “.com” or anything else on the end.) That’s quite a breathtaking list of entries. For Cloudflare, try host one.one.one.one. Note that the “-a” option (“tell me everything”) doesn’t work with Cloudflare; quite a few online services are now imposing restrictions on these “all info” lookups, but clearly not Google, at least not on this domain: obviously they want it to remain easy for people to discover the services they’re offering.

1 1

Linux 6.12 To Optionally Display A QR Code During Kernel Panics
by Peter Reutemann 31 Aug '24

31 Aug '24

'A new feature has been submitted for inclusion in Linux 6.12, allowing the display of a QR code when a kernel panic occurs using the DRM Panic handler. This QR code can capture detailed error information that is often missed in traditional text-based panic messages, making it more user-friendly. The feature, written in Rust, is optional and can be enabled via a specific build switch. This implementation follows similar ideas from other operating systems and earlier discussions in the Linux community.' -- source: https://linux.slashdot.org/story/24/08/30/1856206 Cheers, Peter

1 0

Malware Infiltrates Pidgin Messenger's Official Plugin Repository
by Peter Reutemann 31 Aug '24

31 Aug '24

'The Pidgin messaging app removed the ScreenShareOTR plugin from its third-party plugin list after it was found to be used to install keyloggers, information stealers, and malware targeting corporate networks. BleepingComputer reports: The plugin was promoted as a screen-sharing tool for secure Off-The-Record (OTR) protocol and was available for both Windows and Linux versions of Pidgin. According to ESET, the malicious plugin was configured to infect unsuspecting users with DarkGate malware, a powerful malware threat actors use to breach networks since QBot's dismantling by the authorities. [...] Those who installed it are recommended to remove it immediately and perform a full system scan with an antivirus tool, as DarkGate may be lurking on their system. After publishing our story, Pidgin's maintainer and lead developer, Gary Kramlich, notified us on Mastodon to say that they do not keep track of how many times a plugin is installed. To prevent similar incidents from happening in the future, Pidgin announced that, from now on, it will only accept third-party plugins that have an OSI Approved Open Source License, allowing scrutiny into their code and internal functionality.' -- source: https://it.slashdot.org/story/24/08/30/2047211 Cheers, Peter

1 0

$50 2GB Raspberry Pi 5 comes with a lower price and a tweaked, cheaper CPU
by Peter Reutemann 30 Aug '24

30 Aug '24

'We're many months past the worst of the Raspberry Pi shortages, and the board is finally widely available at its suggested retail price at most sites without wait times or quantity limitations. One sign that the Pi Foundation is feeling more confident about the stock situation: the launch of a new 2GB configuration of the Raspberry Pi 5, available starting today for $50. That's $10 less than the 4GB configuration and $30 less than the 8GB version of the board. Raspberry Pi CEO Eben Upton writes that the 2GB version of the board includes a revised version of the Broadcom BCM2712C1 SoC that is slightly cheaper to manufacture. Upton says that the D0 stepping of the BCM2712C1 strips out some "dark silicon" built-in functionality that the Pi wasn't using but was still taking up space on the silicon die and increasing the cost of the chip. "From the perspective of a Raspberry Pi user, [the chip] is functionally identical to its predecessor: the same fast quad-core processor; the same multimedia capabilities; and the same PCI Express bus that has proven to be one of the most exciting features of the Raspberry Pi 5 platform," Upton writes. "However, it is cheaper to make, and so is available to us at somewhat lower cost. And this, combined with the savings from halving the memory capacity, has allowed us to take $10 out of the cost of the finished product." At $50, the price tag is still north of the baseline $35 price that the Pi started at for many years. The Pi 4 had a 1GB model for $35 when it launched, and there was a $35 2GB model available for a while in 2020, but widespread shortages and supply chain issues led to a "temporary" price increase in late 2021 that is, as of this writing, still in place. At least the 2GB Pi 5 is only $5 more expensive than the 2GB version of the Pi 4, which is still in stock for $45 at many retailers.' -- source: https://arstechnica.com/gadgets/2024/08/new-2gb-raspberry-pi-5-option-knock… Cheers, Peter

1 1

'Uncertainty' Drives LinkedIn To Migrate From CentOS To Azure Linux
by Peter Reutemann 30 Aug '24

30 Aug '24

'The Register's Liam Proven reports: Microsoft's in-house professional networking site is moving to Microsoft's in-house Linux. This could mean that big changes are coming for the former CBL-Mariner distro. Ievgen Priadka's post on the LinkedIn Engineering blog, titled Navigating the transition: adopting Azure Linux as LinkedIn's operating system, is the visible sign of what we suspect has been a massive internal engineering effort. It describes some of the changes needed to migrate what the post calls "most of our fleet" from the end-of-life CentOS 7 to Microsoft Azure Linux -- the distro that grew out of and replaced its previous internal distro, CBL-Mariner. This is an important stage in a long process. Microsoft acquired LinkedIn way back in 2016. Even so, as recently as the end of last year, we reported that a move to Azure had been abandoned, which came a few months after it laid off almost 700 LinkedIn staff -- the majority in R&D. The blog post is over 3,500 words long, so there's quite a lot to chew on -- and we're certain that this has been passed through and approved by numerous marketing and management people and scoured of any potentially embarrassing admissions. Some interesting nuggets remain, though. We enjoyed the modest comment that: "However, with the shift to CentOS Stream, users felt uncertain about the project's direction and the timeline for updates. This uncertainty created some concerns about the reliability and support of CentOS as an operating system." [...] There are some interesting technical details in the post too. It seems LinkedIn is running on XFS -- also the RHEL default file system, of course -- with the notable exception of Hadoop, and so the Azure Linux team had to add XFS support. Some CentOS and actual RHEL is still used in there somewhere. That fits perfectly with using any of the RHELatives. However, the post also mentions that the team developed a tool to aid with deploying via MaaS, which it explicitly defines as Metal as a Service. MaaS is a Canonical service, although it does support other distros -- so as well as CentOS, there may have been some Ubuntu in the LinkedIn stack as well. Some details hint at what we suspect were probably major deployment headaches. [...] Some of the other information covers things the teams did not do, which is equally informative. [...] ' -- source: https://linux.slashdot.org/story/24/08/28/2345255 Cheers, Peter

1 0

Microsoft Donates the Mono Project To Wine
by Peter Reutemann 28 Aug '24

28 Aug '24

'Microsoft has decided to donate the Mono Project to the developers of Wine, FOSS that allows Windows applications to run on Unix-like operating systems. "Mono is a software platform designed to allow developers to easily create cross platform applications," notes GameOnLinux's Liam Dawe. "It is an open source implementation of Microsoft's .NET Framework based on the ECMA standards for C# and the Common Language Runtime." "Wine already makes use of Mono and this move makes sense with Microsoft focusing on open-source .NET and other efforts," adds Phoronix's Michael Larabel. "Formally handing over control of the upstream Mono project to WineHQ is a nice move by Microsoft rather than just letting the upstream Mono die off or otherwise forked." Microsoft's Jeff Schwartz announced the move on the Mono website and in a GitHub post: The Mono Project (mono/mono) ('original mono') has been an important part of the .NET ecosystem since it was launched in 2001. Microsoft became the steward of the Mono Project when it acquired Xamarin in 2016. The last major release of the Mono Project was in July 2019, with minor patch releases since that time. The last patch release was February 2024. We are happy to announce that the WineHQ organization will be taking over as the stewards of the Mono Project upstream at wine-mono / Mono - GitLab ( winehq.org) Source code in existing mono/mono and other repos will remain available, although repos may be archived. Binaries will remain available for up to four years. Microsoft maintains a modern fork of Mono runtime in the dotnet/runtime repo and has been progressively moving workloads to that fork. That work is now complete, and we recommend that active Mono users and maintainers of Mono-based app frameworks migrate to .NET which includes work from this fork. We want to recognize that the Mono Project was the first .NET implementation on Android, iOS, Linux, and other operating systems. The Mono Project was a trailblazer for the .NET platform across many operating systems. It helped make cross-platform .NET a reality and enabled .NET in many new places and we appreciate the work of those who came before us. Thank you to all the Mono developers!' -- source: https://tech.slashdot.org/story/24/08/27/2043216 Cheers, Peter

1 0

OSMC Vero V
by Lawrence D'Oliveiro 28 Aug '24

28 Aug '24

Just thought I’d mention, I got one of these gadgets <https://osmc.tv/> (the latest “Vero V” model) delivered to my doorstep today. This is to replace a Western Digital “WDTV” media streamer that I got from Dick Smith over a decade ago, that I have been getting more annoyed with. The OSMC software is built on Kodi, with some extra stuff of their own. You should be able to download it and set up your own installation, I just decided to get one of their boxes preassembled and preinstalled. They’re based in the UK. That WDTV box was always fussy about the kinds of files it would play, and what codecs and what bit rates etc it could cope with. When I tried something like .flv files for example, it would play OK if I didn’t try going fast forward/reverse, otherwise it would get stuck. Certain kinds of files could screw it up so badly, the only way to recover was to turn it off and on again. This new box is built on a much more modern Linux base, so I expect its media support will be correspondingly improved. Already it has started playing a .webm file, which the old box wouldn’t even look at. If anybody is curious to know more, just ask. I see there is even an online “store” of addons I can install, for extra capabilities.

2 3

The Linux Kernel Gets 60 CVEs A Week
by Lawrence D'Oliveiro 23 Aug '24

23 Aug '24

The Linux kernel team gets 60 logged reports of security vulnerabilities each week, according to longtime developer Greg Kroah-Hartman. He ought to know; he is the point of first contact for such reports, according to <https://www.zdnet.com/article/the-linux-security-team-issues-60-cves-a-week…>. On the bright side, most of them will likely not affect you. The total kernel source tree is up to 38 million lines of code, and your typical OS installation uses only a small fraction of that. To quote GregKH: “Your phone, the most complex beast out there, uses about 4 million lines of code”. They don’t take their time about dealing with vulnerabilities, either: This crew doesn't take embargoes or use pre-announcements. Why not? Because they believe -- with reason -- all these approaches do is lead to information leaks. Instead, they aim to get fixes out to users as quickly as possible. Typically, this is done within a week of having a patch available. This approach ensures that users are promptly notified of security issues and can update their systems accordingly. Another GregKH quote: “If you're not using the latest stable/long-term kernel system, your system is insecure”. Which means, you need to do a kernel update just about every week. The thing is, Kroah-Hartman said, "We have proof this can be done. Debian runs over 80% of the world's servers and they're using stable kernel updates. Android, billions of devices out there, takes every stable kernel update on a couple months lag, but they're doing it and keeping their devices secure. There's nothing more complex than embedded into the system, and there's nothing more common and easy to use than a Debian server.

1 0

Litespeed Cache bug exposes millions of WordPress sites to takeover attacks
by Peter Reutemann 22 Aug '24

22 Aug '24

'A critical vulnerability in the LiteSpeed Cache WordPress plugin can let attackers take over millions of websites after creating rogue admin accounts. LiteSpeed Cache is open-source and the most popular WordPress site acceleration plugin, with over 5 million active installations and support for WooCommerce, bbPress, ClassicPress, and Yoast SEO. The unauthenticated privilege escalation vulnerability (CVE-2024-28000) was found in the plugin's user simulation feature and is caused by a weak hash check in LiteSpeed Cache up to and including version 6.3.0.1. Security researcher John Blackbourn submitted the flaw to Patchstack's bug bounty program on August 1. The LiteSpeed team developed a patch and shipped it with LiteSpeed Cache version 6.4, released on August 13. Successful exploitation enables any unauthenticated visitors to gain administrator-level access, which can be used to completely take over websites running vulnerable LiteSpeed Cache versions by installing malicious plugins, changing critical settings, redirecting traffic to malicious websites, distributing malware to visitors, or stealing user data.' -- source: https://www.bleepingcomputer.com/news/security/litespeed-cache-bug-exposes-… Cheers, Peter

1 0

“Something has gone seriously wrong,” dual-boot systems warn after Microsoft update
by Peter Reutemann 21 Aug '24

21 Aug '24

'Last Tuesday, loads of Linux users—many running packages released as early as this year—started reporting their devices were failing to boot. Instead, they received a cryptic error message that included the phrase: “Something has gone seriously wrong.” The cause: an update Microsoft issued as part of its monthly patch release. It was intended to close a 2-year-old vulnerability in GRUB, an open source boot loader used to start up many Linux devices. The vulnerability, with a severity rating of 8.6 out of 10, made it possible for hackers to bypass secure boot, the industry standard for ensuring that devices running Windows or other operating systems don’t load malicious firmware or software during the bootup process. CVE-2022-2601 was discovered in 2022, but for unclear reasons, Microsoft patched it only last Tuesday. Tuesday’s update left dual-boot devices—meaning those configured to run both Windows and Linux—no longer able to boot into the latter when Secure Boot was enforced. When users tried to load Linux, they received the message: “Verifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation.” Almost immediately support and discussion forums lit up with reports of the failure. “Note that Windows says this update won't apply to systems that dual-boot Windows and Linux,” one frustrated person wrote. “This obviously isn't true, and likely depends on your system configuration and the distribution being run. It appears to have made some linux efi shim bootloaders incompatible with microcrap efi bootloaders (that's why shifting from MS efi to 'other OS' in efi setup works). It appears that Mint has a shim version that MS SBAT doesn't recognize.” The reports indicate that multiple distributions, including Debian, Ubuntu, Linux Mint, Zorin OS, Puppy Linux, are all affected. Microsoft has yet to acknowledge the error publicly, explain how it wasn’t detected during testing, or provide technical guidance to those affected. Company representatives didn’t respond to an email seeking answers.' -- source: https://arstechnica.com/security/2024/08/a-patch-microsoft-spent-2-years-pr… Cheers, Peter

1 0

Check Linux / Unix configuration files for syntax errors
by Peter Reutemann 14 Aug '24

14 Aug '24

Just came across this post, which I thought quite handy: 'In Linux and UNIX system services are configured using various text files located in /etc/ or /usr/local/etc/ directory tree. A typical server system could have dozens of configuration files. You can check your configuration files for syntax errors without starting the server and validate all settings. In some cases, it is possible to check the sanity of specific data/config options and directories. Text files are easier to manage remotely. You can use ssh and a text editor. If there is an error in configuration, the server may not start. It may result in a disaster. This post explains how to quickly find out a syntax error for popular servers and test configuration file for syntax errors.' -- source: https://www.cyberciti.biz/tips/check-unix-linux-configuration-file-for-synt… Cheers, Peter

1 0

Almost unfixable “Sinkclose” bug affects hundreds of millions of AMD chips
by Peter Reutemann 12 Aug '24

12 Aug '24

'Security flaws in your computer's firmware, the deep-seated code that loads first when you turn the machine on and controls even how its operating system boots up, have long been a target for hackers looking for a stealthy foothold. But only rarely does that kind of vulnerability appear not in the firmware of any particular computer maker, but in the chips found across hundreds of millions of PCs and servers. Now security researchers have found one such flaw that has persisted in AMD processors for decades, and that would allow malware to burrow deep enough into a computer's memory that, in many cases, it may be easier to discard a machine than to disinfect it. At the Defcon hacker conference, Enrique Nissim and Krzysztof Okupski, researchers from the security firm IOActive, plan to present a vulnerability in AMD chips they're calling Sinkclose. The flaw would allow hackers to run their own code in one of the most privileged modes of an AMD processor, known as System Management Mode, designed to be reserved only for a specific, protected portion of its firmware. IOActive's researchers warn that it affects virtually all AMD chips dating back to 2006, or possibly even earlier.' -- source: https://arstechnica.com/security/2024/08/almost-unfixable-sinkclose-bug-aff… Cheers, Peter

1 0

Mozilla Wants You To Love Firefox Again
by Peter Reutemann 12 Aug '24

12 Aug '24

'Mozilla's interim CEO Laura Chambers "says the company is reinvesting in Firefox after letting it languish in recent years," reports Fast Company, "hoping to reestablish the browser as independent alternative to the likes of Google's Chrome and Apple's Safari. "But some of those investments, which also include forays into generative AI, may further upset the community that's been sticking with Firefox all these years..." Chambers acknowledges that Mozilla lost sight of Firefox in recent years as it chased opportunities outside the browser, such as VPN service and email masking. When she replaced Mitchell Baker as CEO in February, the company scaled back those other efforts and made Firefox a priority again. "Yes, Mozilla is refocusing on Firefox," she says. "Obviously, it's our core product, so it's an important piece of the business for us, but we think it's also really an important part of the internet." Some of that focus involves adding features that have become table-stakes in other browsers. In June, Mozilla added vertical tab support in Firefox's experimental branch, echoing a feature that Microsoft's Edge browser helped popularize three years ago. It's also working on tab grouping features and an easier way to switch between user profiles. Mozilla is even revisiting the concept of web apps, in which users can install websites as freestanding desktop applications. Mozilla abandoned work on Progressive Web Apps in Firefox a few years ago to the dismay of many power users, but now it's talking with community members about a potential path forward. "We haven't always prioritized those features as highly as we should have," Chambers says. "That's been a real shift that's been very felt in the community, that the things they're asking for . . . are really being prioritized and brought to life." Firefox was criticized for testing a more private alternative to tracking cookies which could make summaries of aggregated data available to advertisers. (Though it was only tested on a few sites, "Privacy-Preserving Attribution" was enabled by default.) But EFF staff technologist Lena Cohen tells Fast Company that approach was "much more privacy-preserving" than Google's proposal for a "Privacy Sandbox." And according to the article, "Mozilla's system only measures the success rate of ads — it doesn't help companies target those ads in the first place — and it's less susceptible to abuse due to limits on how much data is stored and which parties are allowed to access it." In June, Mozilla also announced its acquisition of Anonym, a startup led by former Meta executives that has its own privacy-focused ad measurement system. While Mozilla has no plans to integrate Anonym's tech in Firefox, the move led to even more anxiety about the kind of company Mozilla was becoming. The tension around Firefox stems in part from Mozilla's precarious financial position, which is heavily dependent on royalty payments from Google. In 2022, nearly 86% of Mozilla's revenue came from Google, which paid $510 million to be Firefox's default search engine. Its attempts to diversify, through VPN service and other subscriptions, haven't gained much traction. Chambers says that becoming less dependent on Google is "absolutely a priority," and acknowledges that building an ad-tech business is one way of doing that. Mozilla is hoping that emerging privacy regulations and wider adoption of anti-tracking tools in web browsers will increase demand for services like Anonym and for systems like Firefox's privacy-preserving ad measurements. Other revenue-generating ideas are forthcoming. Chambers says Mozilla plans to launch new products outside of Firefox under a "design sprint" model, aimed at quickly figuring out what works and what doesn't. It's also making forays into generative AI in Firefox, starting with a chatbot sidebar in the browser's experimental branch. Chambers "says to expect a bigger marketing push for Firefox in the United States soon, echoing a 'Challenge the default' ad campaign that was successful in Germany last summer. Mozilla's nonprofit ownership structure, and the idea that it's not beholden to corporate interests, figures heavily into those plans."' -- source: https://tech.slashdot.org/story/24/08/11/1635254 Cheers, Peter

1 0

Ubuntu Will Start Shipping With the Latest Upstream Linux Kernel - Even Release Candidates
by Peter Reutemann 12 Aug '24

12 Aug '24

'Here's a question from the blog OMG Ubuntu. "Ever get miffed reading about a major new Ubuntu release only to learn it doesn't come with the newest Linux kernel? "Well, that'll soon be a thing of the past." Canonical's announced a big shift in kernel selection process for future Ubuntu release, an "aggressive kernel version commitment policy" pivot that means it will ship the latest upstream kernel code in development at the time of a new Ubuntu release. Yes, even if that upstream kernel hasn't yet seen a formal stable release (and received the requisite newspaper-graphic-topped rundown on this blog). Which is a huge change. Currently, new Ubuntu releases include the most recent stable Linux kernel release at the time of the kernel freeze milestone in the Ubuntu development cycle. Here's the official announcement by Canonical's Brett Grandbois. "Ubuntu will now ship the absolute latest available version of the upstream Linux kernel at the specified Ubuntu release freeze date, even if upstream is still in Release Candidate status..." It is actually expected that Late Releases will be the exception rather than the norm and in most releases these guidelines will not be necessary as the upstream kernel will release with enough time for the Ubuntu kernel to stabilize. However, adopting a more aggressive kernel version commitment policy does require us to be prepared for a possible Late Release situation and therefore informing the community on what they can expect. ' -- source: https://news.slashdot.org/story/24/08/11/075217 Cheers, Peter

1 0

You can kick the alpha tires on System76’s Cosmic, a new Linux desktop
by Peter Reutemann 09 Aug '24

09 Aug '24

'System76 has released an alpha version of its Cosmic desktop environment for Linux and Unix-like systems. The Linux hardware firm isn't targeting only its customers with its GNOME replacement; it also hopes to get distro maintainers and app makers on board with its Rust-built, UX-focused desktop. While the Cosmic desktop will be built into the Linux vendor's Pop!_OS (which is also in the alpha ISO), it's also available to other systems, as you might expect. System76 provides drop-in instructions for Fedora and Arch Linux installs, among others. System76 says it is "excited to see COSMIC integration elevate Linux as a whole," along with what results "from making UX-building more accessible." By building Cosmic natively in the Rust language, System76 also intends to provide a more stable and memory-safe environment for apps. Cosmic shows deep attention to tiling, keyboard shortcuts, and panel and dock customization, as has been present on its Pop!_OS. I'm a bit of a boring side-by-side, single-workspace type; Gardiner Bryant on YouTube went deeper into the Cosmic alpha's tiling, panels, and GTK app acceptance. I found that getting Cosmic into a reasonable shape I could work from, and picking up its keyboard window shortcuts, was easier than with either KDE or GNOME. One thing System76 made clear in its push for Cosmic is its readiness for more deeply integrated themes. System76 offered a few examples in its press materials, and I must admit a fondness for its over-the-top examples. -- source: https://arstechnica.com/gadgets/2024/08/you-can-kick-the-alpha-tires-on-sys… Cheers, Peter

1 0

Chrome’s Manifest V3, and its changes for ad blocking, are coming real soon
by Peter Reutemann 07 Aug '24

07 Aug '24

'Google Chrome's long, long project to implement a new browser extension platform is seemingly going to happen, for real, after six years of cautious movement. One of the first ways people are seeing this is if they use uBlock Origin, a popular ad-blocking extension, as noted by Bleeping Computer. Recently, Chrome users have seen warnings pop up that "This extension may soon no longer be supported," with links asking the user to "Remove or replace it with similar extensions" from Chrome's Web Store. You might see a similar warning on some extensions if you head to Chrome's Extensions page (chrome://extensions). What's happening is Chrome preparing to make Manifest V3 required for extensions that want to run on its platform. First announced in 2018, the last word on Manifest V3 was that V2 extensions would start being nudged out in early June on the Beta, Dev, and Canary update channels. Users will be able to manually re-enable V2 extensions "for a short time," Google has said, "but over time, this toggle will go away as well." The shift for enterprise Chrome deployments is expected to be put off until June 2025. ' -- source: https://arstechnica.com/gadgets/2024/08/chromes-manifest-v3-and-its-changes… Cheers, Peter

1 0

Germany to Fund Open Source Software Maintainers Through New Fellowship Program
by Peter Reutemann 07 Aug '24

07 Aug '24

'If you’re of the ilk to complain about governments giving money away and what that means for taxpayers, the Germans — or at least their government — are doing this because it will be good for the economy, meaning they think it’ll make folks better able to pay their taxes rather just empty their pockets for the taxman. This is also why they’ve already spending a substantial amount of money to help fund over 40 FOSS projects. “Open source infrastructure is the backbone of our digital world – and the work of the people who maintain it is essential to ensuring the security and availability of this global resource,” Mirko Swillus wrote in a blog that was published on Thursday. “They lead project development, review changes, manage community interactions, and tackle security issues.” Swillus is program manager at Sovereign Tech Fund, and the blog was to announce fund’s new Fellowship for Maintainers program. “With this new fellowship program, we’re directly investing in the people behind the code by paying maintainers of critical open source components for their work,” he wrote.' -- source: https://fossforce.com/2024/08/germany-to-fund-open-source-software-maintain… Cheers, Peter

1 0

How to replace Windows with Linux Mint on your PC
by Peter Reutemann 05 Aug '24

05 Aug '24

'Are you sick of Windows fouling up? Do you want to try something different? Then, it's time to try the best Linux desktop, Linux Mint 22. I've used more operating systems than you can shake a stick at. I cut my teeth on IBM 360/OS in the 1970s. Since then, I've used every Apple and Microsoft operating system you've heard of, and many you've never known, such as A/UX and Microsoft Xenix. I've also used well over 100 different Unix and Linux distributions. So, when I say Linux Mint 22 -- the latest long-term support (LTS) version of Linux Mint -- is not just the best Linux desktop, but the best desktop, it means something. - Materials needed: Windows PC, internet connection, and a DVD-RW or USB stick with 3GB or more storage - Estimated time: 2 hours - Estimated cost: $5' -- source: https://www.zdnet.com/article/how-to-replace-windows-with-linux-mint-on-you… With the continuing enshittification [1] of Windows, maybe a good time to get folks moved to a less intrusive operating system... Cheers, Peter [1] https://en.wikipedia.org/wiki/Enshittification

1 0

First Look at Serpent OS: Minimal GNOME Desktop and Rust-Based Package Manager
by Peter Reutemann 02 Aug '24

02 Aug '24

'The wait is finally over and Ikey Doherty’s long-anticipated Serpent OS distribution has an ISO image that people can download and test on bare metal hardware or virtual machines to see what the fuss is all about. Four years ago I broke news that Ikey Doherty is making a new distro called Serpent Linux (it was later changed to Serpent OS) aiming to provide the Linux community with a truly modern distribution for people who want to just use Linux. The name of the distribution is inspired by the Serpent game created by Ikey Doherty. At that time, Serpent OS was supposed to ship with the KDE Plasma desktop environment by default, but things have changed and GNOME was chosen as the default for the initial release. The first pre-alpha ISO image includes the older GNOME 45.3 release, but I’m sure the final release will use a more recent version. Serpent OS offers a minimal GNOME desktop experience with only a handful of apps pre-installed, such as the Mozilla Firefox web browser, GNOME Console terminal emulator, GNOME Text Editor text editing app, Zed code editor, GNOME’s Loupe image viewer, and GNOME Extensions. However, Serpent OS supports Flatpak apps if you need to install the apps you need, but Flatpak support is not installed by default in this pre-alpha release.' -- source: https://9to5linux.com/first-look-at-serpent-os-minimal-gnome-desktop-and-ru… Cheers, Peter

1 0

“In the future, computers may weigh no more than 1.5 tonnes.”
by Lawrence D'Oliveiro 01 Aug '24

01 Aug '24

Nice collection of vintage computer pics/clips, along with some pithy quotes from the times (1945-1990). Which ones can you identify without looking at the captions? <https://www.docubyte.com/projects/guide-to-computing/>

1 0

The Unintended Consequences Linux’s Wayland Adoption Will Have on BSD
by Peter Reutemann 31 Jul '24

31 Jul '24

'Like most people who use Linux as their daily driver, I’ve been pleased lately to see that Wayland is finally getting some serious traction and is on its way to being the default display server for most mainstream Linux distributions. It’s been a long trip from the days when we first heard that X was on its way out and that Wayland was on its way in — 15 years as a matter of fact — so the better performance, more svelte code base, enhanced security, and all of the other advantages that Wayland brings to the table being just about here for some of us, and already here for others, is indeed good news. But before we pop the cork on the champagne bottles and start the celebrations, perhaps we should consider that this good news for Linux might not be good news for those running BSD or one of the Unixes, which is something that normally would never occur to me to think about since I’ve never tried to use BSD. The only reason I’m thinking about it now is because this weekend I ran across a post by Chris Siebenmann, a Unix systems administrator at the University of Toronto’s CS Labs. Being a Unix guy by day (and I suspect a BSD guy by night), he’s all on what Wayland on Linux means to BSD/Unix stuck on X, and he’s been thinking about what Linux’s move to Wayland is going to mean for desktop BSDs and Unixes. “Once upon a time, the future of Unix desktops looked fairly straightforward,” he wrote. “Everyone ran on X, so the major threat to cross-Unix portability in major desktops was the use of Linux only APIs, which became especially D-Bus and systemd related things. Unix desktops that were less attached to tight integration with the Linux environment would probably stay easily available on FreeBSD, OpenBSD, and so on.” The main thing I got from that is that for a long time, the BSDs have benefited somewhat from Linux. In this case, because both operating systems use X, it was relatively easy (“relatively” probably being the key word here) to port most popular “Linux” desktop environments to BSD. The trouble is, according to Siebenmann, those days might be coming to an end.' -- source: https://fossforce.com/2024/07/the-unintended-consequences-linuxs-wayland-ad… Cheers, Peter

2 1

LZ4 Compression Algorithm Gets Multi-Threaded Update
by Peter Reutemann 29 Jul '24

29 Jul '24

'Slashdot reader Seven Spirals brings news about the lossless compression algorithm LZ4: The already wonderful performance of the LZ4 compressor just got better with multi-threaded additions to it's codebase. In many cases, LZ4 can compress data faster than it can be written to disk giving this particular compressor some very special applications. The Linux kernel as well as filesystems like ZFS use LZ4 compression extensively. This makes LZ4 more comparable to the Zstd compression algorithm, which has had multi-threaded performance for a while, but cannot match the LZ4 compressor for speed, though it has some direct LZ4. >From Linuxiac.com: - On Windows 11, using an Intel 7840HS CPU, compression time has improved from 13.4 seconds to just 1.8 seconds — a 7.4 times speed increase. - macOS users with the M1 Pro chip will see a reduction from 16.6 seconds to 2.55 seconds, a 6.5 times faster performance. - For Linux users on an i7-9700k, the compression time has been reduced from 16.2 seconds to 3.05 seconds, achieving a 5.4 times speed boost... The release supports lesser-known architectures such as LoongArch, RISC-V, and others, ensuring LZ4's portability across various platforms. ' -- source: https://hardware.slashdot.org/story/24/07/28/0057247 Cheers, Peter

1 0

What Happens If You Connect Windows XP To the Internet In 2024?
by Peter Reutemann 29 Jul '24

29 Jul '24

'Long-time Slashdot reader sandbagger writes: Have you ever wondered if it's true you can instantly get malware? In this video, a person connects an XP instance directly to the internet with no firewall to see just how fast it gets compromised by malware, rootkits, malicious services and new user accounts. The answer — fast! Malwarebytes eventually finds eight different viruses/Trojan horses -- and a DNS changer. (One IP address leads back to the Russian federation.) It's fun to watch -- within just a few hours a new Windows user has even added themself. And for good measure, he also opens up Internet Explorer... - Windows XP -- very insecure, they conclude at the end of the video. Very easy for random software from the internet to get more privileges than you, and it is very hard to solve that. - Also, just out of curiosity I tried this on Windows 7. And even with all of the same settings, nothing happened. I let it run for 10 hours. So it seems like this may be a problem in historical Windows.' -- source: https://tech.slashdot.org/story/24/07/28/2137216 Cheers, Peter

1 0

Secure Boot is completely broken on 200+ models from 5 big device makers
by Peter Reutemann 26 Jul '24

26 Jul '24

'On Thursday, researchers from security firm Binarly revealed that Secure Boot is completely compromised on more than 200 device models sold by Acer, Dell, Gigabyte, Intel, and Supermicro. The cause: a cryptographic key underpinning Secure Boot on those models that was compromised in 2022. In a public GitHub repository committed in December of that year, someone working for multiple US-based device manufacturers published what’s known as a platform key, the cryptographic key that forms the root-of-trust anchor between the hardware device and the firmware that runs on it. The repository was located at https://github.com/raywu-aaeon/Ryzen2000_4000.git, and it's not clear when it was taken down. The repository included the private portion of the platform key in encrypted form. The encrypted file, however, was protected by a four-character password, a decision that made it trivial for Binarly, and anyone else with even a passing curiosity, to crack the passcode and retrieve the corresponding plain text. The disclosure of the key went largely unnoticed until January 2023, when Binarly researchers found it while investigating a supply-chain incident. Now that the leak has come to light, security experts say it effectively torpedoes the security assurances offered by Secure Boot. “It’s a big problem,” said Martin Smolár, a malware analyst specializing in rootkits who reviewed the Binarly research and spoke to me about it. “It’s basically an unlimited Secure Boot bypass for these devices that use this platform key. So until device manufacturers or OEMs provide firmware updates, anyone can basically… execute any malware or untrusted code during system boot. Of course, privileged access is required, but that’s not a problem in many cases.”' -- source: https://arstechnica.com/security/2024/07/secure-boot-is-completely-compromi… Cheers, Peter

2 1

distrobox
by Peter Reutemann 26 Jul '24

26 Jul '24

Just came across distrobox, which seems a useful extension to container managers like docker/podman/lilipod, allowing you to run other distros in your shell: 'Use any Linux distribution inside your terminal. Enable both backward and forward compatibility with software and freedom to use whatever distribution you’re more comfortable with. Distrobox uses podman, docker or lilipod to create containers using the Linux distribution of your choice. The created container will be tightly integrated with the host, allowing sharing of the HOME directory of the user, external storage, external USB devices and graphical apps (X11/Wayland), and audio.' -- source: https://distrobox.it/ That should be especially useful for people working in environments where they are forced to use a specific host OS. As long as they have one of the supported container managers available, they can easily switch! Cheers, Peter

1 0

Anyone can Access Deleted and Private Repository Data on GitHub
by Peter Reutemann 26 Jul '24

26 Jul '24

'You can access data from deleted forks, deleted repositories and even private repositories on GitHub. And it is available forever. This is known by GitHub, and intentionally designed that way. This is such an enormous attack vector for all organizations that use GitHub that we’re introducing a new term: Cross Fork Object Reference (CFOR). A CFOR vulnerability occurs when one repository fork can access sensitive data from another fork (including data from private and deleted forks). Similar to an Insecure Direct Object Reference, in CFOR users supply commit hashes to directly access commit data that otherwise would not be visible to them. ' -- source: https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo… Interesting read! Cheers, Peter

1 0

Run0 vs Sudo: What’s the Difference?
by Peter Reutemann 25 Jul '24

25 Jul '24

'Run0 is a new privilege escalation program for Systemd-based Linux systems. Similar to sudo, it allows you to run commands as a root user and access your machine’s internals. In this article, we compare Run0 vs Sudo to help you determine the right privilege escalation tool for you.' -- source: https://www.maketecheasier.com/run0-vs-sudo-whats-the-difference/ Honestly, I only came across Run0 the other day. I still remember the days of using "su" to get stuff done, long before sudo. Is anyone using Run0? What are your experiences? Cheers, Peter

1 0

It Never Rains But It Pours
by Lawrence D'Oliveiro 24 Jul '24

24 Jul '24

Instructive to read this notice <https://rimuhosting.com/maintenance.jsp?server_maint_oid=5241959612&sn_oid=…> about progress in fixing an issue in the Dallas co-lo centre for Rimu hosting. As a customer, I wasn’t affected (though I could have been), and I have no complaints with the way this was handled--it was great that they kept customers like me apprised of developments like this. The interesting part is how a single initial failure can lead to a cascade of other failures. From the description, the original problem was a breakdown of a transformer feeding power from the grid. To allow it to be repaired, the power was switched to a backup generator. The generator then shut down with a belt problem. So power went to UPS batteries. These ran flat before the generator could be brought back to operation. So various parts of the facility were left without power. After power was restored, it was discovered that some (network?) switches had failed to come up. So a bunch of physical boxes holding customers’ VMs had to be physically moved to a different location where they could get connectivity again. From that point, the disruption was (mostly) over as far as customers were concerned, though there was obviously still work to be done to get the infrastructure back to its normal state. I think that a lot of theoretical statistical modelling of the odds of system failures tends to assume that failures of individual components will be independent of each other. Yet time and time again in the real world, we discover that this is not the case.

1 0

Switzerland Now Requires All Government Software To Be Open Source
by Peter Reutemann 24 Jul '24

24 Jul '24

'Switzerland has enacted the "Federal Law on the Use of Electronic Means for the Fulfillment of Government Tasks" (EMBAG), mandating open-source software (OSS) in the public sector to enhance transparency, security, and efficiency. "This new law requires all public bodies to disclose the source code of software developed by or for them unless third-party rights or security concerns prevent it," writes ZDNet's Steven Vaughan-Nichols. "This 'public money, public code' approach aims to enhance government operations' transparency, security, and efficiency." From the report: Making this move wasn't easy. It began in 2011 when the Swiss Federal Supreme Court published its court application, Open Justitia, under an OSS license. The proprietary legal software company Weblaw wasn't happy about this. There were heated political and legal fights for more than a decade. Finally, the EMBAG was passed in 2023. Now, the law not only allows the release of OSS by the Swiss government or its contractors, but also requires the code to be released under an open-source license "unless the rights of third parties or security-related reasons would exclude or restrict this." Professor Dr. Matthias Sturmer, head of the Institute for Public Sector Transformation at the Bern University of Applied Sciences, led the fight for this law. He hailed it as "a great opportunity for government, the IT industry, and society." Sturmer believes everyone will benefit from this regulation, as it reduces vendor lock-in for the public sector, allows companies to expand their digital business solutions, and potentially leads to reduced IT costs and improved services for taxpayers. In addition to mandating OSS, the EMBAG also requires the release of non-personal and non-security-sensitive government data as Open Government Data (OGD). This dual "open by default" approach marks a significant paradigm shift towards greater openness and practical reuse of software and data. Implementing the EMBAG is expected to serve as a model for other countries considering similar measures. It aims to promote digital sovereignty and encourage innovation and collaboration within the public sector. The Swiss Federal Statistical Office (BFS) is leading the law's implementation, but the organizational and financial aspects of the OSS releases still need to be clarified. ' -- source: https://news.slashdot.org/story/24/07/23/2025220 Cheers, Peter

1 0

Linux Mint 22 “Wilma” Is Now Available for Download, Here’s What’s New
by Peter Reutemann 24 Jul '24

24 Jul '24

'Linux Mint 22 is now available for download as the latest stable release of this popular Ubuntu-based operating system for the masses featuring the Cinnamon, Xfce, and MATE desktop environments. Dubbed “Wilma”, Linux Mint 22 is based on the Ubuntu 24.04 LTS (Noble Numbat) operating system series and uses the Linux 6.8 kernel. It will receive security updates until 2029 and new kernel versions as they’re available upstream in the Ubuntu 24.04 LTS repositories. The flagship edition features the latest Cinnamon 6.2 desktop environment while the Xfce and MATE editions ship with the Xfce 4.18 and MATE 1.26 desktop environments. The Wayland session in the Cinnamon edition is still in an experimental state and Linux Mint 22 Cinnamon will default to X11. Linux Mint 22 comes with PipeWire as the default sound server, support for the new Debian DEB822 format, GTK4 support for themes, improved HiDPI support during boot, better language support, artwork improvements, and FAT32 in File System Transposition mode support for the ISO images. Software-wise, Linux Mint 22 features the Mozilla Thunderbird email client as a native DEB package, a new GNOME Online Accounts GTK independent XApp to support the Online Accounts functionality, and a new Web App called Matrix, which is preinstalled by default and connects you to the Matrix chat network. Furthermore, it features JXL (JPEG-XL) image support in the Pix image viewer, a confirmation dialog pop-up when deleting a snapshot in the Timeshift backup tool, the ability to configure the default position of newly created notes in the Sticky note-taking app, and support for the Xed text editor to duplicate selected text. It also disables unverified Flatpak apps by default in the Software Manager app, which received some welcome changes like improved multi-threading, a new preferences page, and a banner slideshow. In addition, Software Manager now loads faster than before and the main window appears instantly. On top of that, Linux Mint 22 comes with a new package called xapp-thumbnailer-gimp that provides a thumbnailer for GIMP (.xcf) files and an updated xfce4-xapp-status-plugin tray applet that lets you configure icon sizes for full-color and symbolic icons.' -- source: https://9to5linux.com/linux-mint-22-wilma-is-now-available-for-download-her… Cheers, Peter

1 0

Apache Software Foundation is Retiring its Feather Logo
by Peter Reutemann 23 Jul '24

23 Jul '24

'The Apache Software Foundation (ASF) has announced plans to evolve its corporate logo and brand system to better represent its "community over code" ethos and promote inclusivity. Why? Because the ASF took seriously concerns raised by Natives in Tech and other members of the open-source community regarding the appropriateness of using Indigenous imagery. So, the ASF will retire its iconic feather logo, which has been a central part of the foundation's identity since 1999. The organization acknowledges that, as a non-Indigenous entity, it is inappropriate to continue using Indigenous themes or language in its branding. The group also realizes that the logo has been very popular for almost 30 years, but they feel this is the right thing to do. This comes after ASF changed the name of its flagship event to Community Over Code from ApacheCon. The ASF's Marketing and publicity team, along with a Branding Steering Committee composed of ASF Members, is collaborating with branding and design vendors to develop a new logo. This new visual identity will embody the Foundation's history of providing software for the public good while reflecting its global contributor base. The decision to update the brand extends beyond the logo. Changes also apply to ASF open-source projects that currently use Indigenous imagery. It will not--I and the ASF repeat--not change the Apache License or any released software. ' -- source: https://opensourcewatch.beehiiv.com/p/apache-software-foundation-retiring-f… Cheers, Peter

1 0

Imperfect, Linux-powered, DIY smart TV is the embodiment of ad fatigue
by Peter Reutemann 23 Jul '24

23 Jul '24

'Smart TV owners have been subjected to a growing amount of ads and tracking. Ad fatigue, only worsened by a trend that sees streaming providers trying to force customers into subscriptions with commercials, is understandable. We’re at the point where someone would rather use a broken laptop dangling off a TV than be subjected to the watchful eye of the TV's native operating system. Earlier this month, as spotted by Tom’s Hardware, a blogger named Carl Riis, who says he’s a software engineer, shared his DIY project, a Linux-based “smart TV.” Riis’ project doesn’t stand out because it’s the most unique, clever, or clean. In fact, if you’re the type of person willing to pay a lot for TVs with strong aesthetic appeal, like TVs that can look like artwork or appear transparent, you’ll be put off by the EarlGreyTV. The system uses an old Lenovo laptop that has a broken keyboard and is attached to a TV by a string. As Riis wrote: “This may look a little insane, but it has been a great way to keep things neat while retaining access to the laptop."' -- source: https://arstechnica.com/gadgets/2024/07/broken-linux-laptop-makes-for-a-fin… Cheers, Peter

1 0

Microsoft: Linux Is the Top Operating System on Azure Today
by Peter Reutemann 23 Jul '24

23 Jul '24

'Azure used to be a cloud platform dedicated to Windows. Now, it's the most widely used operating system on Microsoft Azure. The New Stack's Joab Jackson writes: These days, Microsoft expends considerable effort that Linux runs as smoothly as possible on Azure, according to a talk given earlier this year at the Linux Foundation Open Source Summit given by two Microsoft Azure Linux Platforms Group program managers, Jack Aboutboul, and Krum Kashan. "Linux is the #1 operating system in Azure today," Aboutoul said. And all must be supported in a way that Microsoft users have come to expects. Hence, the need for the Microsoft's Linux Platforms Group, which provides support Linux to both the internal customers and to Azure customers. These days, the duo of engineers explained, Microsoft knows about as much as anyone about how to operate Linux at hyperscale. [...] As of today, there are hundreds of Azure and Azure-based services running on Linux, including the Azure Kubernetes Service (AKS), OpenAI, HDInsight, and many of the other database services. "A lot of the infrastructure powering everything else is running on Linux," Aboutoul said. "They're different flavors of Linux running all over the place," Aboutoul said. To run these services, Microsoft maintains its own kernel, Azure Linux, and in 2023 the company released its own version of Linux, Azure Linux. But Azure Linux is just a small portion of all the other flavors of Linux running on Azure, all of which Microsoft must work with to support. Overall, there are about 20,000 third-party Software as a Service (SaaS) packages in the Azure marketplace that rely on some Linux distribution. And when things go wrong, it is the Azure service engineers who get the help tickets. The company keeps a set of endorsed Linux distributions, which include Red Hat Enterprise Linux, Debian, Flatcar, Suse, Canonical, and Oracle Linux and CentOS (as managed by OpenLogic, not Red Hat). [...] Overall, the company gets about 1,000 images a month from these endorsed partners alone. Many of the distributions have multiple images (Suse has a regular one, and another one for high-performance computing, for instance). ' -- source: https://linux.slashdot.org/story/24/07/22/2157209 Cheers, Peter

1 0

Nvidia Will Fully Transition To Open-Source GPU Kernel Modules With R560 Drivers
by Peter Reutemann 19 Jul '24

19 Jul '24

'Nvidia is ready to fully transition to open-source Linux GPU kernel drivers, starting with the R555 series and planning a complete shift with the R560 series. The open-source kernel modules will only be available for select newer GPUs, while older architectures like Maxwell, Pascal, and Volta must continue using proprietary drivers. TechSpot reports: According to Nvidia, the open-source GPU kernel modules have helped deliver "equivalent or better" application performance compared to its proprietary kernels. The company has also added new features like Heterogeneous Memory Management (HMM) support, confidential computing, and the coherent memory architectures of the Grace platform to its open-source kernels. [...] For compatible GPUs, the default version of the driver installed by all methods is switching from proprietary to open-source. However, users will have the ability to manually select the closed-source modules if they are still available for their platform. Unfortunately, the open-source kernel modules are not available for GPUs from the older Maxwell, Pascal, and Volta architectures, meaning people still running a GTX 980 or GTX 1080 will have to continue using Nvidia's proprietary drivers. For mixed deployments with older and newer GPUs in the same system, Nvidia recommends continuing to use the proprietary driver for full compatibility. "Nvidia has moved most of its proprietary functions into a proprietary, closed-source firmware blob," adds Ars Technica's Kevin Purdy. "The parts of Nvidia's GPUs that interact with the broader Linux system are open, but the user-space drivers and firmware are none of your or the OSS community's business." ' -- source: https://news.slashdot.org/story/24/07/18/2050235 Reminds me a bit of the Brother Linux drivers that I've used in the past: open-source scripts around binary, closed-source blobs... Cheers, Peter

1 0

SUSE Requests openSUSE to Rebrand
by Peter Reutemann 18 Jul '24

18 Jul '24

'Believe it or not, an unexpected conflict has arisen in the openSUSE community with its long-time supporter and namesake, the SUSE company. At the heart of this tension lies a quiet request that has stirred not-so-quiet ripples across the open source landscape: SUSE has formally asked openSUSE to discontinue using its brand name. Richard Brown, a key figure within the openSUSE project, shared insights into the discussions that have unfolded behind closed doors. Despite SUSE’s request’s calm and respectful tone, the implications of not meeting it could be far-reaching, threatening the symbiotic relationship that has benefited both entities over the years. Let’s face it: SUSE has been more than just a namesake for openSUSE; it has actively provided resources and support far beyond what it would ordinarily need for its business operations. This generosity has fostered a thriving openSUSE project that has excelled under SUSE’s goodwill and informal support, including contributions made by SUSE employees on company time. However, the recent request for a branding separation has overshadowed this partnership. If openSUSE does not handle this request with the sensitivity and cooperation it demands, the project risks not just a reduction in support from SUSE but a potential shift in priorities away from it. The “Factory first” policy, a cornerstone of the engineering synergy between SUSE and openSUSE, could also be scrutinized, emphasizing the gravity of the current situation.' -- source: https://linuxiac.com/suse-requests-opensuse-to-rebrand/ Cheers, Peter

2 1

What Is Code?
by Lawrence D'Oliveiro 11 Jul '24

11 Jul '24

Apologies if you already know about this essay, but I just discovered it today: <https://www.bloomberg.com/graphics/2015-paul-ford-what-is-code/>. It’s long. It’s breezy, entertaining, and manages to convey some actual content. Great for recommending to friends or family members who ask what software development is all about.

1 0

Debian Curl Now Supports HTTP3: What You Need To Know
by Peter Reutemann 09 Jul '24

09 Jul '24

'Good news for Debian users! HTTP3 arrives in Debian Curl. Yes, starting with curl 8.0.0-2, Debian users can now utilize HTTP3. This marks a significant upgrade in the capabilities of curl, enhancing its performance and efficiency in handling web communications. This new feature can be easily tested using the --http3-only flag.' -- source: https://ostechnix.com/debian-curl-supports-http3/ Cheers, Peter

2 1

No more boot loader: Please use the kernel instead
by Peter Reutemann 09 Jul '24

09 Jul '24

'We are working on a new scheme to replace the GRUB bootloader with a fast, secure, Linux-based, user-space solution: nmbl (for no more boot loader). Most people are familiar with GRUB, a powerful, flexible, fully-featured bootloader that is used on multiple architectures (x86_64, aarch64, ppc64le OpenFirmware). Although GRUB is quite versatile and capable, its features create complexity that is difficult to maintain, and that both duplicate and lag behind the Linux kernel while also creating numerous security holes. On the other hand, the Linux kernel, which has a large developer base, benefits from fast feature development, quick responses to vulnerabilities and greater overall scrutiny. We (Red Hat boot loader engineering) will present our solution to this problem, which is to use the Linux kernel as its own bootloader. Loaded by the EFI stub on UEFI, and packed into a unified kernel image (UKI), the kernel, initramfs, and kernel command line, contain everything they need to reach the final boot target. All necessary drivers, filesystem support, and networking are already built in and code duplication is avoided. We will showcase the work done so far, and ask you for your feedback and use cases.' -- source: https://pretalx.com/devconf-cz-2024/talk/W3AVCT/ -- video: https://www.youtube.com/watch?v=ywrSDLp926M Cheers, Peter

1 0

FreeBSD Contributor Mocks Gloomy Predictions for the Open Source Movement
by Peter Reutemann 08 Jul '24

08 Jul '24

'In Communications of the ACM,/em>, long-time FreeBSD contributor Poul-Henning Kamp mocks the idea that the free and open-source software has "come apart" and "will end in tears and regret." Economists and others focused on money — like my bank — have had a lot of trouble figuring out the free and open source software (FOSS) phenomenon, and eventually they seem to have reached the conclusion that it just makes no sense. So, they go with the flow. Recently, very serious people in the FOSS movement have started to write long and thoughtful opinion pieces about how it has all come apart and will end in tears and regret. Allow me to disagree... What follows is a humorous history of how the Open Source movement bested a series of ill-conceived marketing failures starting after the "utterly bad" 1980s when IBM had an "unimaginably huge monopoly" — and an era of vendor lock-in from companies trying to be the next IBM: Out of that utter market failure came Minix, (Net/Free/Open)BSD, and Linux, at a median year of approximately 1991. I can absolutely guarantee that if we had been able to buy a reasonably priced and solid Unix for our 32-bit PCs — no strings attached — nobody would be running FreeBSD or Linux today, except possibly as an obscure hobby. Bill Gates would also have had a lot less of our money... The essay moves on to when "that dot-com thing happened, fueled by the availability of FOSS operating systems, which did a much better job than any operating system you could buy — not just for the price, but in absolute terms of performance on any given piece of hardware. Thus, out of utter market failure, the FOSS movement was born." And ultimately, the essay ends with our present day, and the phenomenon of companies that "make a business out of FOSS or derivatives thereof..." The "F" in FOSS was never silent. In retrospect, it seems clear that open source was not so much the goal itself as a means to an end, which is freedom: freedom to fix broken things, freedom from people who thought they could clutch the source code tightly and wield our ignorance of it as a weapon to force us all to pay for and run Windows Vista. But the FOSS movement has won what it wanted, and no matter how much oldsters dream about their glorious days as young revolutionaries, it is not coming back; the frustrations and anger of IT in 2024 are entirely different from those of 1991. One very big difference is that more people have realized that source code is a liability rather than an asset. For some, that realization came creeping along the path from young teenage FOSS activists in the late 1990s to CIOs of BigCorp today. For most of us, I expect, it was the increasingly crushing workload of maintaining legacy code bases...' -- source: https://news.slashdot.org/story/24/07/07/0243241 Cheers, Peter

1 0

“RegreSSHion” vulnerability in OpenSSH gives attackers root on Linux
by Peter Reutemann 03 Jul '24

03 Jul '24

'Researchers have warned of a critical vulnerability affecting the OpenSSH networking utility that can be exploited to give attackers complete control of Linux and Unix servers with no authentication required. The vulnerability, tracked as CVE-2024-6387, allows unauthenticated remote code execution with root system rights on Linux systems that are based on glibc, an open source implementation of the C standard library. The vulnerability is the result of a code regression introduced in 2020 that reintroduced CVE-2006-5051, a vulnerability that was fixed in 2006. With thousands, if not millions, of vulnerable servers populating the Internet, this latest vulnerability could pose a significant risk. [...] The vulnerability affects the following: - OpenSSH versions earlier than 4.4p1 are vulnerable to this signal handler race condition unless they are patched for CVE-2006-5051 and CVE-2008-4109. - Versions from 4.4p1 up to, but not including, 8.5p1 are not vulnerable due to a transformative patch for CVE-2006-5051, which made a previously unsafe function secure. - The vulnerability resurfaces in versions from 8.5p1 up to, but not including, 9.8p1 due to the accidental removal of a critical component in a function.' -- source: https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-opens… OpenSSH 9.8 was released July 1st: https://www.openssh.com/ Cheers, Peter

1 0

Made Move To Wayland
by Lawrence D'Oliveiro 01 Jul '24

01 Jul '24

I’d been running Wayland OK on my laptop for some months now, but I held off putting it on my main machine for one reason: when I logged into a Wayland session, Emacs would not recognize my Compose key (which I have set to Caps Lock). Today I finally figured out I have to install the “emacs-pgtk” package instead of “emacs-gtk”; the former is built with a version of GTK that works with Wayland. And yes, my Compose key works again. Still have to get used to slightly different input behaviour: previously, once I hit Compose, nothing would appear until I finished the whole key sequence. Now it echoes each keystroke immediately as I type it, in place, overwriting the previous echo (starting with an underline for the Compose key itself), then when I have typed the last key, it overwrites the echo area with the final character.

2 6

From Jupyter To JupyterLab
by Lawrence D'Oliveiro 28 Jun '24

28 Jun '24

I’ve been using Jupyter <https://jupyter.org/> as a convenient basis for “scratchpad” programming (not just in Python, but also some other languages) for a while now. I had heard about this next-generation “JupyterLab” thing they were working on, but always held off trying it out. Then I did my usual monthly upgrade of Debian Unstable on my main machine a few days ago, and this time my Jupyter installation broke. So I updated my wrapper scripts for building Jupyter from source, to check out more recent versions of all the necessary components. Got the build done, started it up, and ... it seems my Jupyter has turned into JupyterLab. Yup, it has a new interface now. The file-manager display no longer seems to open things with a single click; that now only selects items, and you then have to perform an action (like open a notebook) from a right-click menu. And there is no “open in new tab/window” menu item; creating a new tab always happens when opening a notebook, while opening a subfolder always replaces the current tab contents. I used to be able to middle-click on a folder to open it in a new tab, but that option is now gone. There is an option in the right-click menu to “Copy Shareable Link”. When you do this on a notebook or folder and paste the result into the address bar, it opens the item in what I can only call “lab” mode. The window now has three panes, with the middle one an editor-type display, for viewing/editing notebook contents and other document content. The left-hand pane can show various things, selected by clicking one of the icons in its leftmost margin: it can show folder contents, or the table of contents of the current notebook, or a summary of open notebooks, running processes etc. And in the right-hand pane, there are various kinds of “tools” (for debugging, inspection etc) that only seem to appear when viewing notebook content. Ah, discovered how to control the visibility of this “tool” pane: it has two icons for selecting the two different categories of this it can display. But if you click the icon for the section that is already showing, the whole pane shrinks down to a narrow strip just showing the icons. Click again to expand the pane, of course. Further ah, same thing happens with the left-hand pane: click the icon for the section that’s already showing, and that pane too shrinks down. Hiding both the left- and right-hand panes brings you almost back to the old-style minimal-frills notebook/document display, except it only takes a click to bring one of those extras back. The middle pane has its own tab system, to let you have multiple documents open at once. You can drag its internal tabs around to tile them vertically or horizontally. And you can just drag a document to here from the folder display on the left to open it. Click on the document tab header, and that item opens in a separate browser window/tab. If nothing is open here it defaults to showing a “Launcher” tab, with icons for creating notebooks, opening terminal sessions, and creating other document types. The “lab” mode is activated by having an extra “/lab” part in the URL; if you remove this, it reverts to the old-style view of a single folder or notebook. Another thing that has changed is the way notebooks are saved. Previously, there was a menu option to “save and checkpoint” (with no option to do a manual save without checkpointing). And I found that if you tried to close the view of a modified notebook, it would ask to confirm you wanted to close the tab/window, but regardless of which you selected, the notebook would still be saved back to the file. Now that confirm-close trick no longer does saving; you have to explicitly select Save from the File menu, or hit CTRL/S. Checkpointing might still happen automatically as part of autosaving; I can’t find a menu option for explicitly creating a checkpoint, only for restoring from one. So anyway, a lot of intriguing new stuff in there to discover. If you like experimenting with code (as I do), Jupyter can be a great way to do it.

1 0

Superfile: A Modern Terminal File Manager for Linux and macOS
by Peter Reutemann 20 Jun '24

20 Jun '24

'Superfile is a modern terminal file manager that recently caught my attention; it’s not only easy to use but is very user-friendly compared to its alternatives, such as Ranger, MC, or nnn. It allows you to create files and directories, view (process, metadata, clipboard), provide a navigation pane, create multiple panels to work in two separate directories, support plugins, offer a variety of themes, and much more. The project is new, so there have been active updates every week, allowing you to see new features quickly. I’ve also been using it for a few days, and honestly, one key factor in using DE in Linux for me was its easy-to-use file manager, but with Superfile, there’s no need for that now.' -- source: https://linuxtldr.com/installing-superfile/ I've used mc in the past, being familiar with norton commander, but I might give Superfile a go in the future. Cheers, Peter

1 0

systemd-tmpfiles, deleting /home
by Peter Reutemann 19 Jun '24

19 Jun '24

Saw this on my mastodon feed: 'TIL (thankfully second hand) that running "systemd-tmpfiles --purge" will delete /home in systemd 256 [1]. Apparently if you think linux is mainly for running cloud services, this seems reasonable to you. Or something. [1] tested with systemd-tmpfiles --dry-run --purge on debian. I guess it _could_ be a Debian addition, but I'm guessing not.' -- source: https://mathstodon.xyz/@bremner/112615591101488528 Anyone keen on giving it a go??? :-) Cheers, Peter

2 1

DietPi Released a New Version 9.5
by Peter Reutemann 19 Jun '24

19 Jun '24

Just saw these release notes come across my feed: https://dietpi.com/docs/releases/v9_5/ Since I'd never heard of DiePi before: 'DietPi is a highly optimised & minimal Debian-based Linux distribution. DietPi is extremely lightweight at its core, and also extremely easy to install and use. Setting up a single board computer (SBC) or even a computer, for both regular or server use, takes time and skill. DietPi provides an easy way to install and run favourite software you choose.' -- source: https://dietpi.com/docs/ And it supports a range of boards: https://dietpi.com/docs/hardware/ RPis, Odroid, Pine64, Radxa, Sparky, ASUS Tinker board, NanoPi, Orange Pi Cheers, Peter

1 0

KDE Plasma 6.1 Released
by Peter Reutemann 19 Jun '24

19 Jun '24

'"The KDE community announced the latest release of their popular desktop environment: Plasma 6.1," writes longtime Slashdot reader jrepin. From the announcement: While Plasma 6.0 was all about getting the migration to the underlying Qt 6 frameworks correct, Plasma 6.1 is where developers start implementing the features that will take you desktop to a new level. In this release, you will find features that go far beyond subtle changes to themes and tweaks to animations (although there is plenty of those too). Among some of the new features in this release you will find improved remote desktop support with a new built-in server, overhauled and streamlined desktop edit mode, restoration of open applications from the previous session on Wayland, synchronization of keyboard LED colors with the desktop accent color, making mouse cursor bigger and easier to find by shaking it, edge barriers (a sticky area for mouse cursor near the edges between screens), explicit sync support eliminates flickering and glitches for NVidia graphics card users on Wayland, and triple buffering support for smoother animations and screen rendering.' -- source: https://tech.slashdot.org/story/24/06/18/2050203 Cheers, Peter

1 0

High-severity vulnerabilities affect a wide range of Asus router models
by Peter Reutemann 18 Jun '24

18 Jun '24

'Hardware manufacturer Asus has released updates patching multiple critical vulnerabilities that allow hackers to remotely take control of a range of router models with no authentication or interaction required of end users. The most critical vulnerability, tracked as CVE-2024-3080 is an authentication bypass flaw that can allow remote attackers to log into a device without authentication. The vulnerability, according to the Taiwan Computer Emergency Response Team / Coordination Center (TWCERT/CC), carries a severity rating of 9.8 out of 10. [...] A second vulnerability tracked as CVE-2024-3079 affects the same router models. It stems from a buffer overflow flaw and allows remote hackers who have already obtained administrative access to an affected router to execute commands. TWCERT/CC is warning of a third vulnerability affecting various Asus router models. It’s tracked as CVE-2024-3912 and can allow remote hackers to execute commands with no user authentication required.' -- source: https://arstechnica.com/security/2024/06/high-severity-vulnerabilities-affe… The article lists affected routers and links to their respective bios/firmware pages. Cheers, Peter

1 0