- wlug - list.wlug.org.nz

ANZ Bank Tries GitHub Copilot, Likes What It Sees
by Lawrence D'Oliveiro 11 Feb '24

11 Feb '24

ANZ Bank tried a study with its in-house Python programmers <https://www.theregister.com/2024/02/10/anz_bank_github_copilot/>, and found "The group that had access to GitHub Copilot was able to complete their tasks 42.36 percent faster than the control group participants," the report says. "...The code produced by Copilot participants contained fewer code smells and bugs on average, meaning it would be more maintainable and less likely to break in production." In terms of code security, they didn’t find that Copilot helped, but neither did it make things worse. But then, these were relatively simple programming exercises. The report also cites another study which found that AI assistance is leading to lower code quality.

1 0

Mozilla Names New CEO as It Pivots To Data Privacy
by Peter Reutemann 09 Feb '24

09 Feb '24

'Mozilla, which manages the open-source Firefox browser, announced today that Mitchell Baker is stepping down as CEO to focus on AI and internet safety as chair of the nonprofit foundation. Laura Chambers, a Mozilla board member and entrepreneur with experience at Airbnb, PayPal, and eBay, will step in as interim CEO to run operations until a permanent replacement is found. Fortune: Baker, a Silicon Valley pioneer who co-founded the Mozilla Project, says it was her decision to step down as CEO, adding that the move is motivated by a sense of urgency over the current state of the internet and public trust. "We want to offer an alternative for people to have better products," says Baker, who wants to draw more attention to policies, products and processes to challenge business models built on fueling outrage. "What are the connections between this global malaise and how humans are engaging with each other and technology?" Chambers says she plans to focus on building out new products that address growing privacy concerns while actively looking for a full-time CEO. Prior to being recruited to the Mozilla board three years ago, Chambers says she was feeling "pretty disillusioned" about society because of the influence of money in politics and the growing power of the tech giants. "I was confused about what to do and this felt like a genuine way to make an impact." Chambers says she won't be seeking a permanent CEO role because she plans to move back to Australia later this year for family reasons. "I think this is an example of Mozilla doing the right role modelling in how to manage a succession," says Chambers. ' -- source: https://news.slashdot.org/story/24/02/08/1511234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Critical Vulnerability Affecting Most Linux Distros Allows For Bootkits
by Peter Reutemann 08 Feb '24

08 Feb '24

'Linux developers are in the process of patching a high-severity vulnerability that, in certain cases, allows the installation of malware that runs at the firmware level, giving infections access to the deepest parts of a device where they're hard to detect or remove. ArsTechnica: The vulnerability resides in shim, which in the context of Linux is a small component that runs in the firmware early in the boot process before the operating system has started. More specifically, the shim accompanying virtually all Linux distributions plays a crucial role in secure boot, a protection built into most modern computing devices to ensure every link in the boot process comes from a verified, trusted supplier. Successful exploitation of the vulnerability allows attackers to neutralize this mechanism by executing malicious firmware at the earliest stages of the boot process before the Unified Extensible Firmware Interface firmware has loaded and handed off control to the operating system. The vulnerability, tracked as CVE-2023-40547, is what's known as a buffer overflow, a coding bug that allows attackers to execute code of their choice. It resides in a part of the shim that processes booting up from a central server on a network using the same HTTP that the the web is based on. Attackers can exploit the code-execution vulnerability in various scenarios, virtually all following some form of successful compromise of either the targeted device or the server or network the device boots from. "An attacker would need to be able to coerce a system into booting from HTTP if it's not already doing so, and either be in a position to run the HTTP server in question or MITM traffic to it," Matthew Garrett, a security developer and one of the original shim authors, wrote in an online interview. "An attacker (physically present or who has already compromised root on the system) could use this to subvert secure boot (add a new boot entry to a server they control, compromise shim, execute arbitrary code)."' -- source: https://linux.slashdot.org/story/24/02/07/1749248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Overzealous Spam Filters
by Lawrence D'Oliveiro 07 Feb '24

07 Feb '24

Two recent news items about important messages being lost in the recipients’ spam filters. Some months ago, the Banking Ombudsman sent out a warning about investment scams to various financial institutions, but the ANZ never saw theirs <https://www.nzherald.co.nz/nz/anz-misses-investment-scam-warning-from-banki…>. One scam victim believes that her case might have been caught sooner if the bank had taken suitable notice of such a warning. And a US-based team wanted to join Formula 1, but it seems they never got the invitation to meet in person to discuss their application, because it got classed as spam <https://arstechnica.com/cars/2024/02/a-spam-folder-may-have-foiled-andretti…>. And so their application was rejected. But then, in this case you’d think more than one attempt would have been made to get in touch. In both cases, the sender address would have been something unusual, not the kind of thing you or I might see in our in-box (in one case, the Banking Ombudsman, in the other case, the Formula 1 rights body). If we got such a message, it would be wise to score it as being more likely to be some sort of scam. But for organizations that work in those areas that are more likely to engage in such communications, it would make sense to customize their spam filters in the opposite direction, don’t you think?

2 2

Enabling Case-Insensitive Filenames On Linux
by Lawrence D'Oliveiro 06 Feb '24

06 Feb '24

The ext4 filesystem has had the “casefold” option for a while now <https://lwn.net/Articles/784041/>. This allows you to specify, when you initialize a new filesystem, that you want file/directory names to be treated as case-insensitive. At the same time, you have to specify that the filenames are to be interpreted as UTF-8 encoding; normally the kernel doesn’t care, it only singles out ASCII slash and NUL bytes for special interpretation, and simply passes through any other byte values in the names. I was able to create such a filesystem, but I wasn’t able to mount it in my last-upgraded-just-a-few-days-ago Debian Unstable setup. When I try, it fails, and in the dmesg log I see Filesystem with casefold feature cannot be mounted without CONFIG_UNICODE Turns out the Debian 5.10 kernel has not been built with this CONFIG_UNICODE option enabled. However, this situation looks set to change shortly, according to <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985689>.

2 3

browsh
by Peter Reutemann 06 Feb '24

06 Feb '24

Hi everyone Just came across browsh: 'A fully interactive, real-time, and modern text-based browser rendered to TTYs and browsers' https://github.com/browsh-org/browsh Seems like a cool way of browsing in the shell. I've used lynx in the past for that. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a Microsoft Update Broke VS Code Editor on Ubuntu
by Peter Reutemann 05 Feb '24

05 Feb '24

'Microsoft's Visual Studio Code editor now includes a voice command that launches GitHub Copilot Chat just by saying "Hey Code." But one Linux blog notes that the editor has suddenly stopped supporting Ubuntu 18.04 LTS — "a move causing issues for scores of developers." VS Code 1.86 (aka the 'January 2024' update) saw Microsoft bump the minimum build requirements for the text editor's popular remote dev tools to â¥glibc 2.28 — but Ubuntu 18.04 LTS uses glibc 2.27, ergo they no longer work. While Ubuntu 18.04 is supported by Canonical until 2028 (through ESM) a major glibc upgrade is unlikely. Thus, this "breaking change" is truly breaking workflows... It seems affected developers were caught off-guard as this (rather impactful) change was not signposted before, during, or after the VS Code update (which is installed automatically for most, and the update was pushed out to Ubuntu 18.04 machines). Indeed, most only discovered this issue after update was installed, they tried to connect to a remote server, and discovered it failed. The resulting error message does mention deprecation and links to an FAQ on the VS Code website with workarounds (i.e. downgrade). But as one developer politely put it.... "It could have checked the libc versions and refused the update. Now, many people are screwed in the middle of their work." The article points out an upgrade to Ubuntu 20.04 LTS will address the problem. On GitHub a Microsoft engineer posted additional options from VS Code's documentation: If you are unable to upgrade your Linux distribution, the recommended alternative is to use our web client. If you would like to use the desktop version, then you can download the VS Code release 1.85. Depending on your platform, make sure to disable updates to stay on that version. Microsoft then locked the thread on GitHub as "too heated" and limited conversation to just collaborators. In a related thread someone suggested installing VS Code's Flatpak, which was still on version 1.85 — and then disabling updates. But soon Microsoft had locked that thread as well as "too heated," again limiting conversation to collaborators.' -- source: https://linux.slashdot.org/story/24/02/04/0116229 When you can't take criticism for a balls-up, lock the discussion thread! Hmm... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LibreOffice 24.2 Delivers Advanced Features and Global Accessibility
by Peter Reutemann 02 Feb '24

02 Feb '24

'The Document Foundation has officially launched LibreOffice 24.2, which is now available for download for Windows, macOS, and Linux platforms. This release introduces a new calendar-based version numbering system (YY.M). Here’s what it’s all about. The latest major release of the well-known office suite was 7.6. However, this is set to change with the introduction of 24.2, as the version numbering will now follow a “year.month” pattern, similar to that used by Ubuntu releases, for example. This change aims to simplify version identification for end users, making it more intuitive to understand.' -- source: https://linuxiac.com/libreoffice-24-2-delivers-advanced-features-and-global… ...and here I was, thinking that I missed a truckload of releases. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Microsoft Stole My Chrome Tabs, and It Wants Yours, Too'
by Peter Reutemann 31 Jan '24

31 Jan '24

'Tom Warren, writing for The Verge: Last week, I turned on my PC, installed a Windows update, and rebooted to find Microsoft Edge automatically open with the Chrome tabs I was working on before the update. I don't use Microsoft Edge regularly, and I have Google Chrome set as my default browser. Bleary-eyed at 9AM, it took me a moment to realize that Microsoft Edge had simply taken over where I'd left off in Chrome. I never imported my data into Microsoft Edge, nor did I confirm whether I wanted to import my tabs. But here was Edge automatically opening after a Windows update with all the Chrome tabs I'd been working on. I didn't even realize I was using Edge at first, and I was confused why all my tabs were suddenly logged out. After the shock wore off, I looked to make sure I hadn't accidentally allowed this behavior. I found a setting in Microsoft Edge that imports data from Google Chrome on each launch. "Always have access to your recent browsing data each time you browse on Microsoft Edge," reads Microsoft's description of the feature in Edge. This setting was disabled, and I had never been asked to turn it on. So I went to install the same Windows update on a laptop, which actually resulted in it failing and my having to do a system restore. Once the system restore was complete, the same thing happened. Edge opened automatically with all of my Chrome tabs. I haven't been able to replicate the behavior on other PCs, but a number of X users replied to my post about this saying they have experienced the same thing in the past.' -- source: https://it.slashdot.org/story/24/01/30/1824233 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Is Planning a London IPO, But Its CEO Expects 'No Change' In Focus
by Peter Reutemann 31 Jan '24

31 Jan '24

'Ars Technica: The business arm of Raspberry Pi is preparing to make an initial public offering (IPO) in London. CEO Eben Upton tells Ars that should the IPO happen, it will let Raspberry Pi's not-for-profit side expand by "at least a factor of 2X." And while it's "an understandable thing" that Raspberry Pi enthusiasts could be concerned, "while I'm involved in running the thing, I don't expect people to see any change in how we do things." CEO Eben Upton confirmed in an interview with Bloomberg News that Raspberry Pi had appointed bankers at London firms Peel Hunt and Jefferies to prepare for "when the IPO market reopens." Raspberry previously raised money from Sony and semiconductor and software design firm ARM, and it sought public investment. Upton denied or didn't quite deny IPO rumors in 2021, and Bloomberg reported Raspberry Pi was considering an IPO in early 2022. After ARM took a minority stake in the company in November 2023, Raspberry Pi was valued at roughly 400 million pounds, or just over $500 million. Given the company's gradual recovery from pandemic supply chain shortages, and the success of the Raspberry Pi 5 launch, the company's IPO will likely jump above that level, even with a listing in the UK rather than the more typical US IPO. Upton told The Register that "the business is in a much better place than it was last time we looked at it [an IPO]. We partly stopped because the markets got bad. And we partly stopped because our business became unpredictable." "It's a good thing, in that people care about us," Upton said in response to concerned hobbyists and tech enthusiasts. "What Raspberry Pi [builds] are the products we want to buy, and then we sell them to people like us," Upton said. "Certainly, while I'm involved in it, I can't imagine an environment in which the hobbyists are not going to be incredibly important." The IPO is "about the foundation," Upton said, with that charitable arm selling some of its majority stake in the business entity to raise funds and expand. "We've not cooked up some new way for a not-for-profit to do an IPO, no," he noted. [He told Ars that Raspberry Pi's business arm has had both strategic and private investors in its history, along with a majority shareholder in its Foundation (which in 2016 owned 75 percent of shares), and that he doesn't see changes to what Pi has built. He also noted that the foundation was previously funded by dividends from the business side.] "We do this transaction, and the proceeds of that transaction allow the foundation to train teachers, run clubs, expand programs, and ... do those things at, at least, a factor of 2X. That's what I'm most excited about." Upton said there would be "no change" to the kinds of products Pi makes, and that makers are "culturally important to us." [...] "If people think that an IPO means we're going to ... push prices up, push the margins up, push down the feature sets, the only answer we can give is, watch us. Keep watching," he said. "Let's look at it in 15, 20 years' time."' -- source: https://hardware.slashdot.org/story/24/01/30/2212232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux On Mars: The Final Chapter
by Lawrence D'Oliveiro 30 Jan '24

30 Jan '24

You may have heard that the “Ingenuity” helicopter, which has been flying on Mars for the last three years, came a cropper and broke one of its rotor blades a couple of weeks ago. Not bad for a project that was really put together as an afterthought, a proof of concept that was planned to maybe last 30 days and make five flights at most. Here <https://arstechnica.com/space/2024/01/now-that-weve-flown-on-mars-what-come…> is a description of some more details of how it was put together, within stringent limits on both mass and money. Apparently, a radiation-hardened RAD750 computer, which is normally used for such space missions, costs a quarter of a million USD. And would have weighed too much anyway. So they used a cheap, lightweight Qualcomm chip instead, state of the art for smartphones of just a few years ago. And massively more powerful. And of course they ran off-the-shelf open-source software on it <https://www.jpl.nasa.gov/news/meet-the-open-source-software-powering-nasas-…>, <https://www.theverge.com/2021/2/19/22291324/linux-perseverance-mars-curiosi…>, <https://spectrum.ieee.org/nasa-designed-perseverance-helicopter-rover-fly-a…>. Flying a chopper on Mars isn’t easy: the rotor tips on Ingenuity were moving at Mach 0.65 (on Mars, Mach 1.0, the speed of sound, is about 240m/s). A future chopper is planned to push this to Mach 0.95. You might say they were cutting corners on this design, which made it inherently more risky. But if the lower costs and simpler development can lead to shorter lead times, and hence more missions, maybe a higher failure rate would be worth it.

1 0

Remembering Unix Desktops - and What We Can Learn From Them
by Peter Reutemann 29 Jan '24

29 Jan '24

'"As important as its historically underhanded business dealings were for its success, Microsoft didn't have to cheat to win," argues a new article in the Register. "The Unix companies were doing a great job of killing themselves off." You see, while there were many attempts to create software development standards for Unix, they were too general to do much good — for example Portable Operating System Interface (POSIX) — or they became mired in the business consortium fights between the Open Systems Foundation and Unix International, which became known as the Unix wars. While the Unix companies were busy ripping each other to shreds, Microsoft was smiling all the way to the bank. The core problem was that the Unix companies couldn't settle on software standards. Independent Software Vendors (ISV) had to write applications for each Unix platform. Each of these had only a minute desktop market share. It simply made no business sense for programmers to write one version of an application for SCO OpenDesktop (also known as OpenDeathtrap), another for NeXTStep, and still another one for SunOS. Does that sound familiar? That kind of thing is still a problem for the Linux desktop, and it's why I'm a big fan of Linux containerized desktop applications, such as Red Hat's Flatpak and Canonical's Snap. By the time the two sides finally made peace by joining forces in The Open Group in 1996, it was too late. Unix was crowded out on the conventional desktop, and the workstation became pretty much a Sun Microsystems-only play. Linux's GPL license created an "enforced" consortia that allowed it to take over, according to the article — and with Linus Torvalds as Linux's single leader, "it avoided the old Unix trap of in-fighting... I've been to many Linux Plumbers meetings. There, I've seen him and the top Linux kernel developers work with each other without any drama. Today's Linux is a group effort... The Linux distributors and developers have learned their Unix history lessons. They've realized that it takes more than open source; it takes open standards and consensus to make a successful desktop operating system. And the article also points out that one of those early Unix desktops "is still alive, well, and running in about one in four desktops." That operating system, of course, is macOS X, the direct descendent of NeXT's NeXTSTEP. You could argue that macOS, based on the multi-threaded, multi-processing microkernel operating system Mach, BSD Unix, and the open source Darwin, is the most successful of all Unix operating systems. ' -- source: https://tech.slashdot.org/story/24/01/28/0241228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

I abandoned OpenLiteSpeed and went back to good ol’ Nginx
by Peter Reutemann 29 Jan '24

29 Jan '24

'Since 2017, in what spare time I have (ha!), I help my colleague Eric Berger host his Houston-area weather forecasting site, Space City Weather. It’s an interesting hosting challenge—on a typical day, SCW does maybe 20,000–30,000 page views to 10,000–15,000 unique visitors, which is a relatively easy load to handle with minimal work. But when severe weather events happen—especially in the summer, when hurricanes lurk in the Gulf of Mexico—the site’s traffic can spike to more than a million page views in 12 hours. That level of traffic requires a bit more prep to handle. For a very long time, I ran SCW on a backend stack made up of HAProxy for SSL termination, Varnish Cache for on-box caching, and Nginx for the actual web server application—all fronted by Cloudflare to absorb the majority of the load. (I wrote about this setup at length on Ars a few years ago for folks who want some more in-depth details.) This stack was fully battle-tested and ready to devour whatever traffic we threw at it, but it was also annoyingly complex, with multiple cache layers to contend with, and that complexity made troubleshooting issues more difficult than I would have liked. So during some winter downtime two years ago, I took the opportunity to jettison some complexity and reduce the hosting stack down to a single monolithic web server application: OpenLiteSpeed.' -- source: https://arstechnica.com/gadgets/2024/01/i-abandoned-openlitespeed-and-went-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unix Pioneer Ken Thompson Has Abandoned Apple For Linux
by Lawrence D'Oliveiro 28 Jan '24

28 Jan '24

Something I didn’t hear about, which happened earlier last year <https://forums.freebsd.org/threads/unix-pioneer-ken-thompson-announces-hes-…>. Ken Thompson, one of the original Bell Labs crew that created Unix, now 80 years old, was asked what OS he uses, and he replied: I have, for most of my life — because I was sort of born into it — run Apple. Now recently, meaning within the last five years, I've become more and more depressed, and what Apple is doing to something that should allow you to work is just atrocious. But they are taking a lot of space and time to do it, so it's okay. And I have come, within the last month or two, to say, even though I've invested, you know, a zillion years in Apple — I'm throwing it away. And I'm going to Linux. To Raspbian in particular.

1 0

OpenWrt, now 20 years old, is crafting its own future-proof reference hardware
by Peter Reutemann 24 Jan '24

24 Jan '24

'OpenWrt, the open source firmware that sprang from Linksys' use of open source code in its iconic WRT54G router and subsequent release of its work, is 20 years old this year. To keep the project going, lead developers have proposed creating a "fully upstream supported hardware design," one that would prevent the need for handling "binary blobs" in modern router hardware and let DIY router enthusiasts forge their own path. OpenWRT project members, 13 of which signed off on this hardware, are keeping the "OpenWrt One" simple, while including "some nice features we believe all OpenWrt supported platforms should have," including "almost unbrickable" low-level firmware, an on-board real-time clock with a battery backup, and USB-PD power. The price should be under $100 and the schematics and code publicly available. But OpenWrt will not be producing or selling these boards, "for a ton of reasons." The group is looking to the Banana Pi makers to distribute a fitting device, with every device producing a donation to the Software Freedom Conservancy earmarked for OpenWrt. That money could then be used for hosting expenses, or "maybe an OpenWrt summit."' -- source: https://arstechnica.com/gadgets/2024/01/openwrt-now-20-years-old-is-craftin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Easy Relative Symbolic Links
by Lawrence D'Oliveiro 23 Jan '24

23 Jan '24

You probably know about the “ln” command to create a new link to an existing file. You probably know about “ln -s” to create a symbolic link. But did you know about “ln -rs” to easily create relative symbolic links? Relative links are often preferable to absolute ones, because that way they stay valid if the whole containing directory tree is moved to a different location (e.g. as the result of a bind mount). But typing the right number of “../” prefixes can get quite fiddly. And if you want to rely on autocomplete to help, you have to change directory to the destination where the symlink is to be created. Instead, a simpler way is to use “ln -rs”, then use autocomplete from wherever you are to get to the right source file/directory, and the ln command will automatically convert the resulting path, whatever it might be (either absolute or relative to your current working directory) to a suitable relative one based on the destination for the link. <https://manpages.debian.org/ln.1.en.html>

1 1

HP Says The Quiet Part Out Loud
by Lawrence D'Oliveiro 23 Jan '24

23 Jan '24

You’d think, if you were buying a printer, you were the one making the investment, and expecting an outcome of suitable print quality (and quantity) in return. But not, it seems, if you buy an HP printer. Company boss Enrique Lores has made it quite clear <https://www.theregister.com/2024/01/19/hps_ceo_spells_it_out/>: "Every time a customer buys a printer, it's an investment for us. We are investing in that customer, and if that customer doesn't print enough or doesn't use our supplies, it's a bad investment." If you think this is some offhand remark, taken out of context or something, how about this statement from December, by their CFO of the time: "We absolutely see when you move a customer from that pure transactional model ... whether it's Instant Ink, plus adding on that paper, we sort of see a 20 percent uplift on the value of that customer because you're locking that person, committing to a longer-term relationship." In short, they are going to squeeze you for as much ink revenue as they can. Third-party ink cartridges are obviously a threat to this business model, that must be exterminated. I wonder, if they could figure out how to make you get the paper from them as well, they wouldn’t do that ... oh wait ... she already mentioned paper ...

2 2

Timezone Data Changes
by Lawrence D'Oliveiro 23 Jan '24

23 Jan '24

The maintainers of the timezone database (tzdata) have been cleaning up some things lately. Namely, removing all the alias names that are not of the common IANA «region»/«city» form, but refer to specific countries, from the core package. NZ’s two timezones, “NZ” and “NZ-CHAT” were among these special cases. Also the ones beginning “US/” for the various timezones in the USA. <https://tracker.debian.org/news/1451157/accepted-tzdata-2023c-8-source-into…> <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040997> <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056908> These latter names are still available if you install the “tzdata-legacy” package. So you need to have that installed if you want to continue setting “TZ=NZ”. Either that, or learn to start saying “TZ=Pacific/Auckland” instead.

1 0

All This AI Stuff Costs A Lot Of Money
by Lawrence D'Oliveiro 21 Jan '24

21 Jan '24

According to this article <https://arstechnica.com/gadgets/2024/01/alexa-is-in-trouble-paid-for-alexa-…> (based on anonymous sources), Amazon is on a struggle to make money out of its Alexa service, particularly a new, “Generative-AI”-based version coming out at some non-yet-publicly-disclosed point. I was flabbergasted at this: Amazon has to do something to turn Alexa into a viable revenue source. In late 2022, Insider reported that Alexa was on track to lose Amazon $10 billion that year. The following months were filled with numerous layoffs at Amazon ... $10 billion!? I wonder how much of that is *not* the electricity bills for running all the servers ...

1 0

Rust-Written Linux Scheduler Continues Showing Promising Results For Gaming
by Peter Reutemann 21 Jan '24

21 Jan '24

'"A Canonical engineer has been experimenting with implementing a Linux scheduler within the Rust programming language..." Phoronix reported Monday, "that works via sched_ext for implementing a scheduler using eBPF that can be loaded during run-time." The project was started "just for fun" over Christmas, according to a post on X by Canonical-based Linux kernel engineer Andrea Righi, adding "I'm pretty shocked to see that it doesn't just work, but it can even outperform the default Linux scheduler (EEVDF) with certain workloads (i.e., gaming)." Phoronix notes the a YouTube video accompanying the tweet shows "a game with the scx_rustland scheduler outperforming the default Linux kernel scheduler while running a parallel kernel build in the background." "For sure the build takes longer," Righi acknowledged in a later post. "This scheduler doesn't magically makes everything run faster, it simply prioritizes more the interactive workloads vs CPU-intensive background jobs." Righi followed up by adding "And the whole point of this demo was to prove that, despite the overhead of running a scheduler in user-space, we can still achieve interesting performance, while having the advantages of being in user-space (ease of experimentation/testing, reboot-less updates, etc.)" Wednesday Righi added some improvements, posting that "Only 19 lines of code (comments included) for ~2x performance improvement on SMT isn't bad... and I spent my lunch break playing Counter Strike 2 to test this patch..." And work seems to be continuing, judging by a fresh post from Righi on Thursday. "I fixed virtme-ng to run inside Docker and used it to create a github CI workflow for sched-ext that clones the latest kernel, builds it and runs multiple VMs to test all the scx schedulers. And it does that in only ~20min. I'm pretty happy about virtme-ng now."' -- source: https://developers.slashdot.org/story/24/01/20/0716232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Network Time Man's Time Has Ended
by Lawrence D'Oliveiro 20 Jan '24

20 Jan '24

Dave Mills, creator of NTP, the Network Time Protocol that keeps all our computer clocks synced to within hundredths of a second, has passed away at the age of 85 <https://arstechnica.com/gadgets/2024/01/inventor-of-ntp-protocol-that-keeps…>.

1 0

Just 10 lines of code can steal AI secrets from Apple, AMD, and Qualcomm GPUs
by Peter Reutemann 18 Jan '24

18 Jan '24

'As more companies ramp up development of artificial intelligence systems, they are increasingly turning to graphics processing unit (GPU) chips for the computing power they need to run large language models (LLMs) and to crunch data quickly at massive scale. Between video game processing and AI, demand for GPUs has never been higher, and chipmakers are rushing to bolster supply. In new findings released today, though, researchers are highlighting a vulnerability in multiple brands and models of mainstream GPUs—including Apple, Qualcomm, and AMD chips—that could allow an attacker to steal large quantities of data from a GPU’s memory. The silicon industry has spent years refining the security of central processing units, or CPUs, so they don’t leak data in memory even when they are built to optimize for speed. However, since GPUs were designed for raw graphics processing power, they haven’t been architected to the same degree with data privacy as a priority. As generative AI and other machine learning applications expand the uses of these chips, though, researchers from New York-based security firm Trail of Bits say that vulnerabilities in GPUs are an increasingly urgent concern. “There is a broader security concern about these GPUs not being as secure as they should be and leaking a significant amount of data,” Heidy Khlaaf, Trail of Bits’ engineering director for AI and machine learning assurance, tells WIRED. “We’re looking at anywhere from 5 megabytes to 180 megabytes. In the CPU world, even a bit is too much to reveal.” To exploit the vulnerability, which the researchers call LeftoverLocals, attackers would need to already have established some amount of operating system access on a target’s device. Modern computers and servers are specifically designed to silo data so multiple users can share the same processing resources without being able to access each others’ data. But a LeftoverLocals attack breaks down these walls. Exploiting the vulnerability would allow a hacker to exfiltrate data they shouldn’t be able to access from the local memory of vulnerable GPUs, exposing whatever data happens to be there for the taking, which could include queries and responses generated by LLMs as well as the weights driving the response.' -- source: https://arstechnica.com/security/2024/01/new-attack-steals-ai-secrets-from-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Generating PDF Files From man Pages
by Lawrence D'Oliveiro 17 Jan '24

17 Jan '24

I’ve been writing documentation for some of my published scripts in the form of man pages. The troff/groff markup is not hard to get to grips with--the man pages for the relevant tools have a lot of useful info. And it’s easy to view the results without any special installation step, since the man(1) command includes the “-l” option to treat its argument as a file name. But if the topic name has any slashes in it, such treatment is automatic without even needing this option. Thus, in my project source directory, I can type something as simple as man ./render-batch.1 to view the man page I wrote for the “render-batch” command. Conversion to PDF is easy, too, using the underlying groff command that man itself uses to format the page, just specifying a different output “device” (i.e. format), e.g. groff -man -Tpdf «troff-file» >«output-file» Or, if I don’t want to save the output PDF file, but just pipe it straight to a viewer like Okular, this works: groff -man -Tpdf «troff-file» | okular - This is particularly useful, for example, for debugging the difference between dashes and hyphens. You are supposed to use “\-” for the hyphen-minus character (as used to prefix command-line options, for example), while hyphens in regular text should be written as “-”. The two look the same in a normal man-page view, but they get rendered differently in PDF files. However, I found that groff does not correctly render various Unicode UTF-8 characters when generating PDF output. For example, I like to use curly quotes “”. These look OK in regular man output, but get turned into junk in PDF output. After some searching online, it appears this is a known limitation of groff, because it uses various 8-bit byte codes internally for its own purposes, precluding their use as part of UTF-8 encoding. But there is a tool called “preconv” that can convert various encodings into a more groff-friendly text representation. For example preconv -e utf-8 «troff-file» | groff -man -Tpdf | okular - Since my locale is set to a UTF-8 one by default, I don’t even need the “-e” option: preconv «troff-file» | groff -man -Tpdf | okular - Or, if you want to save the output: preconv «troff-file» | groff -man -Tpdf >«output-file» Going back to the example filename I used before, these translate to something like preconv render-batch.1 | groff -man -Tpdf | okular - preconv render-batch.1 | groff -man -Tpdf >render-batch.pdf Another variation is to use preconv «troff-file» | groff -man -Tpdf | { okular - & } This spawns the Okular part of the pipeline in the background, so it comes back to the shell prompt immediately that starts running. This is convenient with a GUI tool like Okular, because I can run other commands while continuing to view the output PDF file. So how is it that groff is capable of handling these characters just fine when invoked via man? That I haven’t figured out yet ...

1 2

Chrome Updates Incognito Warning To Admit Google Tracks Users In 'Private' Mode
by Peter Reutemann 17 Jan '24

17 Jan '24

'Ars Technica: Google is updating the warning on Chrome's Incognito mode to make it clear that Google and websites run by other companies can still collect your data in the web browser's semi-private mode. The change is being made as Google prepares to settle a class-action lawsuit that accuses the firm of privacy violations related to Chrome's Incognito mode. The expanded warning was recently added to Chrome Canary, a nightly build for developers. The warning appears to directly address one of the lawsuit's complaints, that the Incognito mode's warning doesn't make it clear that Google collects data from users of the private mode. Many tech-savvy people already know that while private modes in web browsers prevent some data from being stored on your device, they don't prevent tracking by websites or Internet service providers. But many other people may not understand exactly what Incognito mode does, so the more specific warning could help educate users. The new warning seen in Chrome Canary when you open an incognito window says: "You've gone Incognito. Others who use this device won't see your activity, so you can browse more privately. This won't change how data is collected by websites you visit and the services they use, including Google." The wording could be interpreted to refer to Google websites and third-party websites, including third-party websites that rely on Google ad services. The new warning was not yet in the developer, beta, and stable branches of Chrome as of today. It also wasn't in Chromium. The change to Canary was previously reported by MSPowerUser. Incognito mode in the stable version of Chrome still says: "You've gone Incognito. Now you can browse privately, and other people who use this device won't see your activity." Among other changes, the Canary warning replaces "browse privately" with "browse more privately." The stable and Canary warnings both say that your browsing activity might still be visible to "websites you visit," "your employer or school," or "your Internet service provider." But only the Canary warning currently includes the caveat that Incognito mode "won't change how data is collected by websites you visit and the services they use, including Google." The old and new warnings both say that Incognito mode prevents Chrome from saving your browsing history, cookies and site data, and information entered in forms, but that "downloads, bookmarks and reading list items will be saved." Both warnings link to this page, which provides more detail on Incognito mode.' -- source: https://yro.slashdot.org/story/24/01/16/2110250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wine 9.0 Released
by Peter Reutemann 17 Jan '24

17 Jan '24

'Version 9.0 of Wine, the free and open-source compatibility layer that lets you run Windows apps on Unix-like operating systems, has been released. "Highlights of Wine 9.0 include an experimental Wayland graphics driver with features like basic window management, support for multiple monitors, high-DPI scaling, relative motion events, as well as Vulkan support," reports 9to5Linux. From the report: The Vulkan driver has been updated to support Vulkan 1.3.272 and later, the PostScript driver has been reimplemented to work from Windows-format spool files and avoid any direct calls from the Unix side, and there's now a dark theme option on WinRT theming that can be enabled in WineCfg. Wine 9.0 also adds support for many more instructions to Direct3D 10 effects, implements the Windows Media Video (WMV) decoder DirectX Media Object (DMO), implements the DirectShow Audio Capture and DirectShow MPEG-1 Video Decoder filters, and adds support for video and system streams, as well as audio streams to the DirectShow MPEG-1 Stream Splitter filter. Desktop integration has been improved in this release to allow users to close the desktop window in full-screen desktop mode by using the "Exit desktop" entry in the Start menu, as well as support for export URL/URI protocol associations as URL handlers to the Linux desktop. Audio support has been enhanced in Wine 9.0 with the implementation of several DirectMusic modules, DLS1 and DLS2 sound font loading, support for the SF2 format for compatibility with Linux standard MIDI sound fonts, Doppler shift support in DirectSound, Indeo IV50 Video for Windows decoder, and MIDI playback in dmsynth. Among other noteworthy changes, Wine 9.0 brings loader support for ARM64X and ARM64EC modules, along with the ability to run existing Windows binaries on ARM64 systems and initial support for building Wine for the ARM64EC architecture. There's also a new 32-bit x86 emulation interface, a new WoW64 mode that supports running of 32-bit apps on recent macOS versions that don't support 32-bit Unix processes, support for DirectInput action maps to improve compatibility with many old video games that map controller inputs to in-game actions, as well as Windows 10 as the default Windows version for new prefixes. Last but not least, the kernel has been updated to support address space layout randomization (ASLR) for modern PE binaries, better memory allocation performance through the Low Fragmentation Heap (LFH) implementation, and support memory placeholders in the virtual memory allocator to allow apps to reserve virtual space. Wine 9.0 also adds support for smart cards, adds support for Diffie-Hellman keys in BCrypt, implements the Negotiate security package, adds support for network interface change notifications, and fixes many bugs. For a full list of changes, check out the release notes. You can download Wine 9.0 from WineHQ.' -- source: https://tech.slashdot.org/story/24/01/16/2253237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Is No Longer Bringing the Full Chrome Browser To Fuchsia
by Peter Reutemann 16 Jan '24

16 Jan '24

'Google has formally discontinued its efforts to bring the full Chrome browser experience to its Fuchsia operating system. 9to5Google reports: In 2021, we reported that the Chromium team had begun an effort to get the full Chrome/Chromium browser running on Google's in-house Fuchsia operating system. Months later, in early 2022, we were even able to record a video of the progress, demonstrating that Chromium (the open-source-only variant of Chrome) could work relatively well on a Fuchsia-powered device. This was far from the first time that the Chromium project had been involved with Fuchsia. Google's full lineup of Nest Hub smart displays is currently powered by Fuchsia under the hood, and those displays have limited web browsing capabilities through an embedded version of the browser. In contrast to that minimal experience, Google was seemingly working to bring the full might of Chrome to Fuchsia. To observers, this was yet another signal that Google intended for Fuchsia to grow beyond the smart home and serve as a full desktop operating system. After all, what good is a laptop or desktop without a web browser? Fans of the Fuchsia project have anticipated its eventual expansion to desktop since Fuchsia was first shown to run on Google's Pixelbook hardware. However, in the intervening time -- a period that also saw significant layoffs in the Fuchsia division -- it seems that Google has since shifted Fuchsia in a different direction. The clearest evidence of that move comes from a Chromium code change (and related bug tracker post) published last month declaring that the "Chrome browser on fuchsia won't be maintained."' -- source: https://tech.slashdot.org/story/24/01/15/2350230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Mint 21.3: Its First Official Release with Wayland Support
by Peter Reutemann 15 Jan '24

15 Jan '24

'Linux Mint 21.3 is now available to download, reports the blog OMG Obuntu. It's the first version to offer Wayland support in its Cinnamon desktop: Following a successful bout of bug-busting in last month's beta release, Mint devs have gone ahead and rubber-stamped a stable release. Thus, you can reasonably expect to not encounter any major issues when installing or using it... [I]t's based on Ubuntu 22.04 LTS and continues to use the Linux 5.15 kernel by default, but newer kernels are available to install within the OS... In my own testing I find Cinnamon's Wayland support to be well-rounded. It's not perfect but I didn't hit any major snafus that prevented me from working (though admittedly I did only attempt 'basic' tasks like web browsing, playing music, and adding applets). However, Cinnamon's Wayland support is in an early state, is not enabled by default, and Linux Mint devs expect it won't be good enough for everyone until the 23.x series (due 2026) at the earliest. Still, try it out yourself and see if it works for you. Select the 'Cinnamon on Wayland (Experimental)' session from the login screen session selector, and then login as normal... Additionally, the latest version of Mozilla Firefox is pre-installed (as a deb, not a Snap) Among the new features are a whole new category of desktop add-ons — "Actions" — which upgrade the right-clicking context menu. (So for .iso files there's two new choices: "Verify" or "Make bootable USB stick".) The article says there's also "a raft of smaller refinements," plus "a bevvy of buffs and embellishments" for Linux Mint's homegrown apps. Any Linux Mint users reading Slashdot? Share your thoughts or experiences in the comments...' -- source: https://linux.slashdot.org/story/24/01/14/1830255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub: With Great Power Comes Great Responsibility ... For Both Good And Evil
by Lawrence D'Oliveiro 13 Jan '24

13 Jan '24

Seems GitHub has become a popular place to host malware in a form that is difficult to shut down <https://www.theregister.com/2024/01/12/github_malware_popularity/>. One thing I was surprised to learn from that article is that, as far as China is concerned, GitHub has apparently grown too big to block <https://www.npr.org/2019/04/10/709490855/github-has-become-a-haven-for-chin…>. Which means it becomes a sort-of-safe haven for activity which might be seen as politically subversive (such as demanding your rights to limited working hours as supposedly guaranteed under the law). Of course, that report was from nearly five years ago, and things could have changed since then. But the 996.icu repo referenced in there still exists, and still shows signs of activity as of a few months ago.

1 0

“I’m Sorry Dave, I’m Afraid I Can’t Do That” -- Or Not
by Lawrence D'Oliveiro 13 Jan '24

13 Jan '24

There has been a flood of products with very odd descriptions on Amazon lately <https://arstechnica.com/ai/2024/01/lazy-use-of-ai-leads-to-amazon-products-…>. For example, “I’m sorry but I cannot fulfill this request it goes against OpenAI use policy—Black”. Also available in other colours, and similar in sizes like 10mm×3m. And unique features like “Regrettably, the information you’re searching for is not available — we strive to maintain the highest standards of integrity and will not compromise the authenticity and accuracy of our product descriptions”. And who wouldn’t want to buy after hearing “Our [product] can be used for a variety of tasks, such [task 1], [task 2], and [task 3]]”? Are you thinking “I gotta get me some of that”?

1 0

X11 Conservancy Project
by Lawrence D'Oliveiro 13 Jan '24

13 Jan '24

Here’s a website <https://x11cp.org/> dedicated to trying to keep alive GUI programs dating from the early days of X11. I think they’re also trying to ensure that the code can still be built and run. This is the second time I’ve come across Codeberg, which offers an open-source-based hosting facility for Git repositories.

1 0

Why More PC Gaming Handhelds Should Ditch Windows For SteamOS
by Lawrence D'Oliveiro 12 Jan '24

12 Jan '24

The success of the Steam Deck is encouraging at least one third-party vendor to bring out its own gaming handheld that will be running the Linux-based SteamOS instead of Microsoft Windows <https://arstechnica.com/gaming/2024/01/why-more-pc-gaming-handhelds-should-…>. While compatibility with the overwhelming majority of Windows-only games still leaves something to be desired, the usability of the platform is already a definite selling point: While Proton does come with at least some performance overhead, a variety of Steam Deck benchmarks show games running under SteamOS tend to perform comparably (or sometimes better) than those running under Windows on the handheld. That's also a huge change from the Steam Machines era, when Ars' testing showed that many SteamOS games ran significantly worse than their Windows counterparts on the same desktop hardware. The Windows platform is just plain unsuited to a handheld gaming device: Our review of the ROG Ally highlights just how annoying it can be to have to fiddle with Windows settings on a touchscreen running "an awkwardly scaled" version of the OS. Though Microsoft has not been sitting still: And while Microsoft has experimented with a handheld-friendly version of Windows meant for portable gaming devices, nothing public has yet come of the effort. But unless it launches a much more concerted effort than it has managed to date, there’s a chance Windows may lose its undisputed dominance in the last major market where it has one: PC gaming.

1 0

Biggest Linux Kernel Release Ever Welcomes bcachefs File System, Jettisons Itanium
by Peter Reutemann 12 Jan '24

12 Jan '24

'Linux kernel 6.7 has been released, including support for the new next-gen copy-on-write (COW) bcachefs file system. The Register reports: Linus Torvalds announced the release on Sunday, noting that it is "one of the largest kernel releases we've ever had." Among the bigger and more visible changes are a whole new file system, along with fresh functionality for several existing ones; improved graphics support for several vendors' hardware; and the removal of an entire CPU architecture. [...] The single biggest feature of 6.7 is the new bcachefs file system, which we examined in March 2022. As this is the first release of Linux to include the new file system, it definitely would be premature to trust any important data to it yet, but this is a welcome change. The executive summary is that bcachefs is a next-generation file system that, like Btrfs and ZFS, provides COW functionality. COW enables the almost instant creation of "snapshots" of all or part of a drive or volume, which enables the OS to make disk operations transactional: In other words, to provide an "undo" function for complex sets of disk write operations. Having a COW file system on Linux isn't new. The existing next-gen file system in the kernel, Btrfs, also supports COW snapshots. The version in 6.7 sees several refinements. It inherits a feature implemented for Steam OS: Two Btrfs file systems with the same ID can be mounted simultaneously, for failover scenarios. It also has improved quota support and a new raid_stripe_tree that improves handling of arrays of dissimilar drives. Btrfs remains somewhat controversial. Red Hat banished it from RHEL years ago (although Oracle Linux still offers it) but SUSE's distros depend heavily upon it. It will be interesting to see how quickly SUSE's Snapper tool gains support for bcachefs: This new COW contender may reveal unquestioned assumptions built into the code. Since Snapper is also used in several non-SUSE distros, including Spiral Linux, Garuda, and siduction, they're tied to Btrfs as well. The other widely used FOSS next-gen file system, OpenZFS, also supports COW, but licensing conflicts prevent ZFS being fully integrated into the Linux kernel. So although multiple distros (such as NixOS, Proxmox, TrueNAS Scale, Ubuntu, and Void Linux) support ZFS, it must remain separate and distinct. This results in limitations, such as the ZFS Advanced Read Cache being separate from Linux's page cache. Bcachefs is all-GPL and doesn't suffer from such limitations. It aims to supply the important features of ZFS, such as integrated volume management, while being as fast as ext4 or XFS, and also surpass Btrfs in both performance and, crucially, reliability. ' -- source: https://linux.slashdot.org/story/24/01/11/2021234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Devices Are Under Attack By a Never-Before-Seen Worm
by Peter Reutemann 11 Jan '24

11 Jan '24

'Previously unknown self-replicating malware has been infecting Linux devices worldwide, installing cryptomining malware using unusual concealment methods. The worm is a customized version of Mirai botnet malware, which takes control of Linux-based internet-connected devices to infect others. Mirai first emerged in 2016, delivering record-setting distributed denial-of-service attacks by compromising vulnerable devices. Once compromised, the worm self-replicates by scanning for and guessing credentials of additional vulnerable devices. While traditionally used for DDoS attacks, this latest variant focuses on covert cryptomining. ArsTechnica adds: On Wednesday, researchers from network security and reliability firm Akamai revealed that a previously unknown Mirai-based network they dubbed NoaBot has been targeting Linux devices since at least last January. Instead of targeting weak telnet passwords, the NoaBot targets weak passwords connecting SSH connections. Another twist: Rather than performing DDoSes, the new botnet installs cryptocurrency mining software, which allows the attackers to generate digital coins using victims' computing resources, electricity, and bandwidth. The cryptominer is a modified version of XMRig, another piece of open source malware. More recently, NoaBot has been used to also deliver P2PInfect, a separate worm researchers from Palo Alto Networks revealed last July. Akamai has been monitoring NoaBot for the past 12 months in a honeypot that mimics real Linux devices to track various attacks circulating in the wild. To date, attacks have originated from 849 distinct IP addresses, almost all of which are likely hosting a device that's already infected. The following figure tracks the number of attacks delivered to the honeypot over the past year.' -- source: https://linux.slashdot.org/story/24/01/10/1727219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel 4.14 Reaches End of Life After More Than Six Years of Maintenance
by Peter Reutemann 11 Jan '24

11 Jan '24

'Originally released on November 12th, 2017, the long-term supported (LTS) Linux 4.14 kernel series has now reached its end of supported life after being maintained for more than six years. Renowned kernel developer Greg Kroah-Hartman announced today on the Linux kernel mailing list the release of Linux 4.14.336 as what appears to be the last maintenance update to the long-term supported Linux 4.14 kernel series, which is now marked as EOL (End of Life) on the kernel.org website. "This is the LAST 4.14.y kernel to be released. It is now officially end-of-life. Do NOT use this kernel version anymore, please move to a newer one, as shown on the kernel.org releases page," said Greg Kroah-Hartman. "If you are stuck at this version due to a vendor requiring it, go get support from that vendor for this obsolete kernel tree, as that is what you are paying them for."' -- source: https://linux.slashdot.org/story/24/01/10/1729216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Computer Says You Are A Thief
by Lawrence D'Oliveiro 10 Jan '24

10 Jan '24

Been hearing about this on and off for a few years, but it seems things have come to a head with the airing of a four-part documentary series about the massive scandal of the “Horizon” financial software used by the British Post Office <https://www.aljazeera.com/news/2024/1/9/the-great-british-post-office-scand…>. Basically, the buggy software was reporting incorrect transaction amounts, and these reports were believed over the protestations of the branch managers, leading to several hundred of the latter being prosecuted and convicted of theft and false accounting. In desperation at not being believed, some of them tried to plug the holes with their own money. Some even committed suicide. It took twenty years from the introduction of the system before a court ruled that the fault lay with the software, not with so many innocent people. (Why was the software considered to be above reproach for so long?) Even now, only a small proportion of the false convictions have been overturned. The Post Office CEO at the time has bowed to pressure and returned her CBE award. The software is still in use.

1 0

speed camera with RPi - NZ edition
by Peter Reutemann 10 Jan '24

10 Jan '24

Hi everyone Just stumbled across this news item in one of the reviews for the Raspberry Pi 4 on PBTech's website: https://www.stuff.co.nz/national/119894942/diy-speed-camera-nabs-hoons-near… And, would you believe it, the article even linked the source code: https://github.com/gregtinkers/carspeed.py Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical wants better Snap support outside Ubuntu, based on latest hires
by Peter Reutemann 10 Jan '24

10 Jan '24

'Snaps, the self-contained application packages that Ubuntu has long seen as a simpler app store and a potential solution to dependency hell, could be getting better support outside Ubuntu itself, based on one recent hire and potentially more. As spotted by the Phoronix blog, developer Zygmunt Krynicki, who worked at Ubuntu distributor Canonical from 2012 through 2020, posted Friday on Mastodon that he was "returning as a snap developer later this month." His main focus would be "cross-distribution support," Krynicki wrote, and "unlike in the past this will be my full time job. I'm very excited for what is ahead for snaps." He also noted, in a later reply, that he was "not coming back alone." Krynicki, reached Monday on Mastodon, noted that he was at a very early stage in his work. But he intended to look at the state of support across distributions, determine which long-term and short-term work to focus on, and "work on the internals and get things progressively better, even if that is not flashy." That means refactoring some of the code and, "if realistic, change some of the old ideas that I believe hold the project back," Krynicki wrote. The challenge will be finding ways to "experiment with new ideas in ways that allow controlled but more rapid progress," while maintaining stability. But all of that needs discussing with his team, when they're fully in place, Krynicki wrote. That team and their work would indicate that the Ubuntu makers have listened to perhaps the most common criticism of Snaps, whether perceptual, logistical, or both: that Snaps are an Ubuntu-focused phenomenon. Snap packages have difficulty working without AppArmor, a kernel extension that is a default in Ubuntu but not every other Linux distribution. Canonical also maintains the Snap Store. While other stores of Snaps are possible, some distributions and software packagers have turned instead to Flatpak, a similarly containerized system that doesn't have deep ties to any one distribution.' -- source: https://arstechnica.com/gadgets/2024/01/canonical-wants-better-snap-support… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Discusses Maintainers, AI, and Rust in the Kernel
by Peter Reutemann 08 Jan '24

08 Jan '24

'ZDNet reports that "At the Linux Foundation's Open Source Summit Japan, Linus Torvalds and his good friend Dirk Hohndel, the head of Verizon open source, talked about the current state of Linux: Speaking of maintainers, Hohndel brought up the question of "maintainer fatigue and how draining and stressful this role is...." Torvalds replied, "It's much easier to find developers; we have a lot of developers. Some people think that you have to be a superdeveloper who can do everything to be a maintainer, but that's not actually true...." Hohndel commented that the aging of the kernel community is a "double-edged sword." Torvalds agreed, but he noted that "one of the things I liked about the Rust side of the kernel, was that there was one maintainer who was clearly much younger than most of the maintainers. We can clearly see that certain areas in the kernel bring in more young people...." Hohndel and Torvalds also talked about the use of the Rust language in the Linux kernel. Torvalds said, "It's been growing, but we don't have any part of the kernel that really depends on Rust yet. To me, Rust was one of those things that made technical sense, but to me personally, even more important was that we need to not stagnate as a kernel and as developers." That said, Torvalds continued, "Rust has not really shown itself as the next great big thing. But I think during next year, we'll actually be starting to integrate drivers and some even major subsystems that are starting to use it actively. So it's one of those things that is going to take years before it's a big part of the kernel. But it's certainly shaping up to be one of those." Torvalds also said he enjoyed the fact that open source "has become the standard within the industry." But later Hohndel, calling AI "autocorrect on steroids," asked Torvalds if he thought he'd ever see submissions of LLM-written code. "I'm convinced it's gonna happen. And it may well be happening already, maybe on a smaller scale where people use it more to help write code." But, unlike many people, Torvalds isn't too worried about AI. "It's clearly something where automation has always helped people write code. This is not anything new at all...." But, "What about hallucinations?," asked Hohndel. Torvalds, who will never stop being a little snarky, said, "I see the bugs that happen without AI every day. So that's why I'm not so worried. I think we're doing just fine at making mistakes on our own." ' -- source: https://linux.slashdot.org/story/23/12/09/0644247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

How Does FreeBSD Compare to Linux on a Raspberry Pi?
by Peter Reutemann 08 Jan '24

08 Jan '24

'Klaus Zimmermann (a self-described "friendly hacker") recently posted a "State of the Distro" post, choosing his favorite distributions for things like portable installation from a USB drive (Alpine Linux) and for a desktop OS (Debian Linux or Devuan). But when it comes to a distro for the Raspberry Pi, (at least until the 4), Zimmerman argues that FreeBSD's performance is "unlike any other Linux distribution I've ever seen, even with cpupower activated and overclocking." Nope, no match — FreeBSD's performance on the Pi is still way better, even without overclocking. You can browse a modern web, have things scroll smoothly, watch videos and even play some 3D games like Quake with it! And if you overclock it a little (2GHz) you can even make it run that gargantua MS Teams. But what about all that lackluster driver support? WiFi drivers still on the 802.11g standard and all? Surely you can't be serious about it when Linux offers all that support out of the box, right? Wrong, actually. For starters, the drivers provided for the Pi's hardware are often half-assed proprietary blobs... I no longer think FreeBSD is really at fault if the driver support for the hardware is not helpful to begin with. Even drivers you find for Linux are shaky at best. So yes, I will keep using FreeBSD on the Pi. As a desktop. With USB WiFi and audio adapters for those services, because the existing hardware is sort of moot even otherwise. And with those USB adapters — and FreeBSD — the Pi works really well, truly desktop-like. I'd be curious to hear from Slashdot's readers about their own experiments with Linux (and FreeBSD) on a Raspberry Pi. Zimmerman's final winner, for the "Server" category, was Debian — though of his two servers, one is just an XMPP server set up on a Raspberry Pi. "I found that using Debian on the Pi is a real joy. Easy and simple to set up, familiar environment and all. So I'm keeping it. "This concept is about to be overshadowed, however, by my growing like of FreeBSD lately..."' -- source: https://linux.slashdot.org/story/24/01/07/0327229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ZDNet Calls Rhino Linux 'New Coolest Linux Distro'
by Peter Reutemann 08 Jan '24

08 Jan '24

'If you're starting the new year with a new Linux distro, ZDNet just ran an enthusiastic profile of Rhino Linux, calling it "beautiful" with "one of the more useful command-line package managers on the market." Rhino uses a modern take on the highly efficient and customizable Xfce desktop (dubbed "Unicorn") to help make the interface immediately familiar to anyone who logs in. You'll find a dock on the left edge of the screen that contains launchers for common applications, access to the Application Grid (where you can find all of your installed software), and a handy Search Bar (Ulauncher) that allows you to quickly search for and launch any installed app (or even the app settings) you need... Thanks to myriad configuration options, Xfce can be a bit daunting. At the same time, the array of settings makes Xfce highly customizable, which is exactly what the Rhino developers did when they designed this desktop. For those who want a desktop that makes short work of accessing files, the Rhino developers have added a really nifty tool to the top bar. You'll find a listing of some folders you have in your Home directory (Files, Documents, Music, Pictures, Video). If you click on one of those entries, you'll see a list of the most recently accessed files within the directory. Click on the file you want to open with the default, associated application... Rhino opts for the Pacstall package manager over the traditional apt-get. That's not to say apt-get isn't on the system — it is. But with Rhino Linux, there's a much easier path to getting the software you want installed... [W]hen you first run the installed OS, you are greeted with a window that allows you to select what package managers you want to use. You can select from Snap, Flatpak, and AppImages (or all three). Next, the developers added a handy tool (rhino-pkg) that makes installing from the command line very simple. When the distro launched in August, 9to5Linux described it as "a unique distribution for Ubuntu fans who wanted a rolling-release system where they install once and receive updates forever." The theming looks gorgeous and it's provided by the Elementary Xfce Darker icon theme, Xubuntu's Greybird GTK theme, and Ubuntu's Yaru Dark WM theme. It also comes with some cool features, such as a dedicated and full-screen desktop switcher provided by Xfdashboard... ' -- source: https://news.slashdot.org/story/24/01/07/2036245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

RIP: Software Design Pioneer And Pascal Creator Niklaus Wirth
by Lawrence D'Oliveiro 06 Jan '24

06 Jan '24

Famed computer scientist Niklaus Wirth has passed away, just a few weeks before reaching his 90th birthday <https://www.theregister.com/2024/01/04/niklaus_wirth_obituary/>. He is known for being a champion of simplicity in programming language and system design. He had a falling out with the committee that was coming up with a successor to Algol-60 (itself a driver for many important language-implementation techniques), and so went off and created Pascal. And then a few more languages after that. In his criticism of the language, Algol-68, that the committee eventually came up with, I found this excerpt illuminating on the milieu of the time: I am discouraged! I thought I had recognized the short-comings of the commercially available languages; they provide no guidance to programming discipline, and lack a logically coherent structure. Algol 60 had provided an answer and a solution. Unfortunately, it lacked some features which many practitioners badly need. It was relatively easy to remedy some defects and some defaults of Algol 60. We had implemented such an extension of Algol; it contains the data types long real, complex, and character strings, along with one other major extension. But guess how many requests we received for this system. None! Nobody is interested in a new language, particuarly if it is not supported by the big manufacturers or has received the blessing of some standards committee. But I see no chances that either a big manufacturer or a committee will ever produce a language acceptable to our standards or clarity, simplicity, and rigor. Remember, this was published in November 1968. Notice the assumption that the only sort of language implementation that might be worth using is a “commercially-available” one, with the backing of a “big” company behind it. There was no thought that an implementation with source code freely available could ever be considered “commercial”, either in usage or quality. And on top of that, every OS was different; there was nothing like the near-universality of POSIX-type OSes we enjoy today. And some of the differences were downright--quirky, shall we say. So even if such a source code project were available, porting it to all the platforms in common use would likely have been a nightmare.

1 0

Since the Demise of Atom, 'Pulsar' Offers an Alternative Code Editor
by Peter Reutemann 01 Jan '24

01 Jan '24

'On December 15 GitHub declared end-of-life for its "hackable text editor" Atom. But Long-time Slashdot reader BrendaEM wants to remind everyone that after the announcement of Atom's sunset, "the community came together to keep Atom alive." First there was the longstanding fork Atom-Community. But "due to differences in long-term goals for the editor, a new version was born: Pulsar." >From the Pulsar web site: Pulsar [sometimes referred to as Pulsar-Edit] aims to not only reach feature parity with the original Atom, but to bring Pulsar into the 21st century by updating the underlying architecture, and supporting modern features. With many new features on the roadmap, once Pulsar is stable, it will be a true, Community-Based, Hackable, Text Editor. "Of course, the user interface is much of the same," writes the blog Its FOSS, and it's cross-platform (supporting Linux, macOS, and Windows). "The essentials seem to be there with the documentation, packages, and features like the ability to install packages from Git repositories..."' -- source: https://tech.slashdot.org/story/24/01/01/016215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a Cray-1 Supercomputer Compares to a Raspberry Pi
by Peter Reutemann 01 Jan '24

01 Jan '24

'Roy Longbottom worked for the U.K. covernment's Central Computer Agency from 1960 to 1993, and "from 1972 to 2022 I produced and ran computer benchmarking and stress testing programs..." Known as the official design authority for the Whetstone benchmark), Longbottom writes that "In 2019 (aged 84), I was recruited as a voluntary member of Raspberry Pi pre-release Alpha testing team." And this week — now at age 87 — Longbottom has created a web page titled "Cray 1 supercomputer performance comparisons with home computers, phones and tablets." And one statistic really captures the impact of our decades of technological progress. "In 1978, the Cray 1 supercomputer cost $7 Million, weighed 10,500 pounds and had a 115 kilowatt power supply. It was, by far, the fastest computer in the world. The Raspberry Pi costs around $70 (CPU board, case, power supply, SD card), weighs a few ounces, uses a 5 watt power supply and is more than 4.5 times faster than the Cray 1." ' -- source: https://tech.slashdot.org/story/23/12/31/0017205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Source-Based Gentoo Linux Goes Binary
by Peter Reutemann 01 Jan '24

01 Jan '24

'While Gentoo Linux is best-known as source-based Linux distribution, "our package manager, Portage, already for years also has support for binary packages," according to its web page. It notes that source- and binary-based package installations can be freely mixed. But now... To speed up working with slow hardware and for overall convenience, we're now also offering binary packages for download and direct installation! For most architectures, this is limited to the core system and weekly updates — not so for amd64 and arm64 however. There we've got a stunning >20 GByte of packages on our mirrors, from LibreOffice to KDE Plasma and from Gnome to Docker. Gentoo stable, updated daily. Enjoy! "We have a rather neat binary package guide on our Wiki that goes into much more detail..." the announcement points out. The packages are cryptographically signed with the same key as the stages.' -- source: https://linux.slashdot.org/story/23/12/30/1756208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Peppermint OS Builds Single-Site Browsers for Debian Systems
by Peter Reutemann 31 Dec '23

31 Dec '23

'They create a dedicated desktop icon for your favorite web-based application — a simplified browser that opens to that single URL. Yet while Linux usually offers the same functionality as other operating systems, "Peppermint OS's Ice and its successor Kumo are the only free software versions of Site-Specific Browsers available on Linux," according to Linux magazine. "Fortunately for those who want this functionality, Peppermint OS is a Debian derivative, and both can be installed on Debian and most other derivatives." Since SSBs first appeared in 2005, they have been available on both Windows and macOS. On Linux, however, the availability has come and gone. On Linux, Firefox once had an SSB mode, but it was discontinued in 2020 on the grounds that it had multiple bugs that were time-consuming to fix and there was "little to no perceived user benefit to the feature." Similarly, Chromium once had a basic SSB menu item, Create Application Shortcut, which no longer appears in recent versions. As for GNOME Web's (Epiphany's) Install Site as Web Application, while it still appears in the menu, it is no longer functional. Today, Linux users who want to try SSBs have no choices except Ice or Kumo. Neither Ice or Kumo appears in any repository except Peppermint OS's. But because Peppermint OS installs packages from Debian 12 ("bookworm"), either can be installed to Debian or a derivative... To install successfully, at least one of Firefox, Chrome, Chromium, or Vivaldi also must be installed... Because both Ice and Kumo are written in Python, they can be run on any desktop. The article concludes that Site-Specific Browsers might make more sense "on a network or in a business where their isolation provides another layer of security. Or perhaps the time for SSBs is past and there's a reason browsers have tried to implement them, and then discarded them."' -- source: https://linux.slashdot.org/story/23/12/30/0527205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox: scrollbar buttons gone
by Peter Reutemann 30 Dec '23

30 Dec '23

Hi everyone Call me old-fashioned, but I do like the arrow buttons on scrollbars. Especially on very long pages (eg OpenWRT's hardware table) where I want move the view port only a little bit... On my Linux 20.3 MATE, I managed to get them back by using these CSS settings: scrollbar { -GtkScrollbar-has-backward-stepper: true; -GtkScrollbar-has-forward-stepper: true; } In the following config file: ~/.config/gtk-3.0/gtk.css -- source: https://support.mozilla.org/en-US/questions/1420887 Also, if you don't like the thin overlay scrollbars, then set the following FF option ("about:config") to "false": widget.gtk.overlay-scrollbars.enabled Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Adventure (Latest Reboot Of An Ancient Classic)
by Lawrence D'Oliveiro 23 Dec '23

23 Dec '23

Just doing some random browsing on my system, and came across a Debian package called “open-adventure”. Finding my way to its home page at Eric Raymond’s site <http://www.catb.org/~esr/open-adventure/>, I discover that it is a project to modernize the source code for the original “ADVENT” game dating from 1976-1977, the one that originated the whole concept of text-based adventure games. The original code was written in Fortran; this one rewrites it all in clean, almost-idiomatic C (as opposed to automatically-translated GOTO-ridden C), and incorporates such innovations as using YAML as the source code for the maze format (translated to C structures at build time). It has been carefully regression-tested against the Fortran original(s) to ensure the gameplay is identical (and the few conscious deviations can be disabled if you want). The developers also kept in mind the possibility of porting the code further, to more modern languages like Python or Go. In the meantime, they have declared the project “finished” as of earlier this year, with all known bug reports closed and all compatibility tests passed.

1 0

LMDE
by john 21 Dec '23

21 Dec '23

After enduring a few minor health issues over the past months I have finally got round to installing Linux Mint Debian edition 5 Bullseye. I think due to the Cinnamon Desktop environment it is marginally slower than the Mate DE I was using with my Ubuntu Jammy Jellyfish distribution. I didn't find the minor difference to be any problem for me. I am well pleased with the performance, look and feel of it and have not (so far) found anything unpleasant or difficult. It appears to me to be well suited to a first time user or for someone migrating from Windows. Cheers John..

2 1

Fedora Asahi Remix Officially Released For Apple Silicon Macs
by Peter Reutemann 21 Dec '23

21 Dec '23

'9to5Linux: Announced in early August and initially planned for the end of the month, the Fedora Asahi Remix distribution is finally here for those who want to install the Fedora Linux operating system on their Apple Silicon Macs. Previously a remix of Arch Linux ARM, the Fedora Asahi Remix distribution is the result of a multi-year collaboration between the Asahi Linux project and the Fedora Project, enabling you to have a proper daily driver on your Apple Silicon Mac thanks to Fedora Linux's excellent 64-bit ARM support. The distro is based on the latest Fedora Linux 39 release and ships with the KDE Plasma 5.27 LTS desktop environment by default, using Wayland. This promises a smooth Linux desktop experience on Apple hardware similar to macOS. Fedora Asahi Remix also comes with XWayland for those who want to run X11 apps. In addition, it features non-conformant OpenGL 3.3 support including GPU-accelerated geometry shaders and transform feedback, PipeWire by default with WirePlumber, as well as the Calamares graphical installer. ' -- source: https://apple.slashdot.org/story/23/12/20/0357233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SSH protects the world’s most sensitive networks. It just got a lot weaker
by Peter Reutemann 20 Dec '23

20 Dec '23

'Named Terrapin, the new hack works only when an attacker has an active adversary-in-the middle position on the connection between the admins and the network they remotely connect to. Also known as a man-in-the-middle or MitM attack, this occurs when an attacker secretly positioned between two parties intercepts communications and assumes the identity of both the recipient and the sender. This provides the ability to both intercept and to alter communications. While this position can be difficult for an attacker to achieve, it’s one of the scenarios from which SSH was thought to have immunity. For Terrapin to be viable, the connection it interferes with also must be secured by either "ChaCha20-Poly1305" or "CBC with Encrypt-then-MAC," both of which are cipher modes added to the SSH protocol (in 2013 and 2012, respectively). A scan performed by the researchers found that 77 percent of SSH servers exposed to the Internet support at least one of the vulnerable encryption modes, while 57 percent of them list a vulnerable encryption mode as the preferred choice. At its core, Terrapin works by altering or corrupting information transmitted in the SSH data stream during the handshake—the earliest stage of a connection, when the two parties negotiate the encryption parameters they will use to establish a secure connection. The attack targets the BPP, short for Binary Packet Protocol, which is designed to ensure that adversaries with an active position can't add or drop messages exchanged during the handshake. Terrapin relies on prefix truncation, a class of attack that removes specific messages at the very beginning of a data stream.' -- source: https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-inte… This SUSE knowledge base entry lists some configuration changes that one can apply (section "Additional Information"): https://www.suse.com/de-de/support/kb/doc/?id=000021295 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1