- wlug - list.wlug.org.nz

The Ladybird browser project
by Peter Reutemann 17 Jun '24

17 Jun '24

Just stumbled across a browser project on my mastodon feed that I hadn't heard of before: Ladybird Browser -- source: https://tech.lgbt/@nina_kali_nina/111932702661268627 -- project page: https://ladybird.dev/ -- code: https://github.com/LadybirdBrowser/ladybird Anybody ever tried that? Cheers, Peter

1 0

Ransomware attackers quickly weaponize PHP vulnerability with 9.8 severity rating
by Peter Reutemann 17 Jun '24

17 Jun '24

'Ransomware criminals have quickly weaponized an easy-to-exploit vulnerability in the PHP programming language that executes malicious code on web servers, security researchers said. As of Thursday, Internet scans performed by security firm Censys had detected 1,000 servers infected by a ransomware strain known as TellYouThePass, down from 1,800 detected on Monday. The servers, primarily located in China, no longer display their usual content; instead, many list the site’s file directory, which shows all files have been given a .locked extension, indicating they have been encrypted. An accompanying ransom note demands roughly $6,500 in exchange for the decryption key. The vulnerability, tracked as CVE-2024-4577 and carrying a severity rating of 9.8 out of 10, stems from errors in the way PHP converts Unicode characters into ASCII. A feature built into Windows known as Best Fit allows attackers to use a technique known as argument injection to convert user-supplied input into characters that pass malicious commands to the main PHP application. Exploits allow attackers to bypass CVE-2012-1823, a critical code execution vulnerability patched in PHP in 2012. CVE-2024-4577 affects PHP only when it runs in a mode known as CGI, in which a web server parses HTTP requests and passes them to a PHP script for processing. Even when PHP isn’t set to CGI mode, however, the vulnerability may still be exploitable when PHP executables such as php.exe and php-cgi.exe are in directories that are accessible by the web server. This configuration is extremely rare, with the exception of the XAMPP platform, which uses it by default. An additional requirement appears to be that the Windows locale—used to personalize the OS to the local language of the user—must be set to either Chinese or Japanese.' -- source: https://arstechnica.com/security/2024/06/thousands-of-servers-infected-with… Cheers, Peter

2 1

Raspberry Pi is Now a Public Company
by Peter Reutemann 12 Jun '24

12 Jun '24

'Who would have thought that Raspberry Pi, the maker of the tiny, cheap, single-board computers, would become a public company? Yet, this is exactly what's happening: Raspberry Pi priced its IPO on the London Stock Exchange on Tuesday morning at $3.56 per share, valuing it at $689 million. Shortly after that, the company's shares jumped a nice 32% to $4.70. It means that Raspberry Pi could end up raising more than $200 million during its IPO process. Raspberry Pi has sold 60 million units since its inception. In 2023 alone, Raspberry Pi generated $266 million in revenue and $66 million in gross profit. Raspberry Pi Ltd, the public company, is the commercial subsidiary of the Raspberry Pi Foundation. The Foundation says it wants to make it easier for people to learn coding through a low-cost, programmable computer. It also remains the main shareholder of Raspberry Pi Ltd.' -- source: https://tech.slashdot.org/story/24/06/11/144251 Cheers, Peter

1 0

One-Line Patch For Intel Meteor Lake Yields Up To 72% Better Performance
by Peter Reutemann 11 Jun '24

11 Jun '24

'Michael Larabel reports via Phoronix: Covered last week on Phoronix was a new patch from Intel that with tuning to the P-State CPU frequency scaling driver was showing big wins for Intel Core Ultra "Meteor Lake" performance and power efficiency. I was curious with the Intel claims posted for a couple benchmarks and thus over the weekend set out to run many Intel Meteor Lake benchmarks on this one-line kernel patch... The results are great for boosting the Linux performance of Intel Core ultra laptops with as much as 72% better performance. [...] When looking at the CPU power consumption overall, for the wide variety of workloads tested it was just a slight uptick in power use and thus overall leading to slightly better power efficiency too. See all the data here. So this is quite a nice one-line Linux kernel patch for Meteor Lake and will hopefully be mainlined to the Linux kernel for Linux 6.11 if not squeezing it in as a "fix" for the current Linux 6.10 cycle. It's just too bad though that it took six months after launch for this tuned EPP value to be determined. Fresh benchmarks between Intel Core Ultra and AMD Ryzen on the latest Linux software will be coming up soon on Phoronix.' -- source: https://hardware.slashdot.org/story/24/06/10/2031256 Cheers, Peter

1 0

Nasty Linux Bug, CVE-2024-1086, is on the loose
by Peter Reutemann 05 Jun '24

05 Jun '24

'A few months back, CVE-2024-1086, a nasty use-after-free vulnerability in the Linux kernel's netfilter, was revealed. With a Common Vulnerability Scoring System (CVSS) score of 7.8, this bug, with the foundation for most Linux network firewall and Network Address Translation (NAT) programs, was a nasty little security hole. With it, Netfliter's table component could be exploited to achieve local privilege escalation. Worse still, you didn't need to be terribly clever to use it, so a local attacker could escalate privileges from a regular user to root in no time flat. Adding insult to injury, this vulnerability was present in pretty much all the major Linux distributions, including Debian, Fedora, Red Hat, and Ubuntu. In short, pretty much any Linux distribution using any kernel version between 5.14 and 6.6.14 could be hacked. Ouch! But, the fix has been in place since January 2024, when the flaw was patched. So, if we've been good little system administrators, we shouldn't have anything to worry about, right? Right!? Wrong. The US Cybersecurity and Infrastructure Security Agency (CISA) has flagged it and added it to the Known Exploited Vulnerabilities (KEV) catalog. It turns out that it's being actively exploited in the wild.' -- source: https://opensourcewatch.beehiiv.com/p/nasty-linux-bug-cve20241086-loose Cheers, Peter

1 0

The Raspberry Pi 5 Gets an AI Upgrade
by Peter Reutemann 05 Jun '24

05 Jun '24

'Today, Raspberry Pi introduced a new kit that adds AI functionality to the Raspberry Pi 5. ZDNet reports: The Raspberry Pi AI kit combines an M.2-format Hailo 8L AI accelerator with the Raspberry Pi M.2 HAT+ to create a powerful yet power-efficient solution. The Hailo-8L NPU (Neural Processing Unit) chip, capable of 13 trillion operations per second (TOPS), is built into an M.2 2242 form factor module that attaches to the M.2 HAT+. When connected to a Raspberry Pi 5 board running the latest Raspberry Pi OS, the NPU is automatically available for AI computing tasks. The AI module also has direct access to the Raspberry Pi's camera software stack and works with both first-party and third-party cameras. The NPU allows the Raspberry Pi 5 to perform AI tasks such as object and facial recognition, human pose analysis, and more. Using an NPU frees up the Raspberry Pi 5's CPU, allowing it to focus on other tasks, making your projects more efficient and powerful. The Raspberry Pi AI kit is also compatible with the Raspberry Pi Active Cooler, ensuring optimal performance without overheating. Additionally, you can purchase a clear protective layer to prevent damage to the board, giving you peace of mind while working on your projects. The AI kit is priced at $70. It's available from Raspberry Pi Approved Resellers, including PiHut, PiShop.us, and CanaKit. ' -- source: https://hardware.slashdot.org/story/24/06/04/2037238 Cheers, Peter

1 0

CentOS 7’s Final Countdown: 30 Days Left Until Support Ends
by Peter Reutemann 04 Jun '24

04 Jun '24

'In just 30 days, we’ll witness the end of an era for Linux with the cessation of support for CentOS 7—the last supported version of this once-dominant server operating system still receiving updates. Let’s take a quick look back at its journey. Ten years ago, on July 7, 2014, CentOS 7 was released as a fully compatible fork of Red Hat Enterprise Linux 7. Since its initial CentOS 2 version in 2004, the distribution has become extremely popular, establishing itself as the go-to server operating system over the last decade. After nine minor version updates, the latest being CentOS 7.9, in November 2020, Red Hat made a significant announcement. It marked the end of CentOS as a server operating system and transitioned it to CentOS Stream—a rolling release distro and upstream public development branch for Red Hat Enterprise Linux (RHEL). To complicate things further, CentOS 8, expected to receive updates until 2029, was prematurely retired at the end of December 2021. This leaves only CentOS 7 as the only version to complete its entire maintenance period, which ends in just 30 days on June 30, 2024. So, consider this as a final reminder if you’re still using CentOS 7 and haven’t yet migrated your system. Time is running out, and here are some alternative options to switch to a RHEL-compatible and supported replacement.' -- source: https://linuxiac.com/centos-7-has-30-days-left-until-support-ends/ Cheers, Peter

1 0

Fun With The du Command
by Lawrence D'Oliveiro 29 May '24

29 May '24

Looking at the space taken up by my copy of the Blender source code: ldo(a)theon:projects> du -ks blender 1444272 blender Most of that is in the commit history: ldo(a)theon:projects> du -ks blender/.git 1139640 blender/.git So how much isn’t? ldo(a)theon:projects> du -ks blender/.git blender 1139640 blender/.git 304632 blender Do you see what happened there? If you specify a directory, and then its containing directory on the same command, du will subtract the usage of the former from the latter. This gives you an easy way of determining the space taken up by a directory, not including particular subdirectories. This can be broken down even more: ldo(a)theon:projects> du -ks blender/.git blender/extern blender/intern blender/source blender 1139640 blender/.git 40536 blender/extern 15712 blender/intern 105188 blender/source 143196 blender Here, “extern” is various open-source libraries from other sources, that have been copied into the Blender source tree, while “intern” is code that originated from Blender itself, that has been organized into its own libraries. And as you can see, there is still a whole bunch left in other subdirectories. Does this work recursively? ldo(a)theon:projects> du -ks blender/.git blender/intern/cycles blender/intern blender 1139640 blender/.git 8880 blender/intern/cycles 6832 blender/intern 288920 blender Yes it does. Here we can see that the Cycles renderer makes up a bit over half the contents of “intern”.

1 0

datamash - basic numeric, textual and statistical operations
by Peter Reutemann 28 May '24

28 May '24

Hi everyone I quite often need to do some quick and dirty statistical calculations on the command-line and I typically use cat and sed to extract the data that I need from text files. In the past, I've then switched to LibreOffice Calc for some basic statistics like mean/stdev. Today, I finally spent a bit more time having a look around what else I can use directly on the command-line and came across the following that fits the bill perfectly: datamash - https://www.gnu.org/software/datamash/ With that tool, I can finally apply a single command-line to textual output for generating a quick mean/stdev: ... | datamash mean 1 sstdev 1 --header-out mean(field-1) sstdev(field-1) 577.62815533981 128.99238940453 Cheers, Peter

2 1

Memory Sealing 'mseal' System Call Merged For Linux 6.10
by Peter Reutemann 27 May '24

27 May '24

'"Merged this Friday evening into the Linux 6.10 kernel is the new mseal() system call for memory sealing," reports Phoronix: The mseal system call was led by Jeff Xu of Google's Chrome team. The goal with memory sealing is to also protect the memory mapping itself against modification. The new mseal Linux documentation explains: "Modern CPUs support memory permissions such as RW and NX bits. The memory permission feature improves security stance on memory corruption bugs, i.e. the attacker can't just write to arbitrary memory and point the code to it, the memory has to be marked with X bit, or else an exception will happen. Memory sealing additionally protects the mapping itself against modifications. This is useful to mitigate memory corruption issues where a corrupted pointer is passed to a memory management system... Memory sealing can automatically be applied by the runtime loader to seal .text and .rodata pages and applications can additionally seal security-critical data at runtime. A similar feature already exists in the XNU kernel with the VM_FLAGS_PERMANENT flag and on OpenBSD with the mimmutable syscall." The mseal system call is designed to be used by the likes of the GNU C Library "glibc" while loading ELF executables to seal non-writable memory segments or by the Google Chrome web browser and other browsers for protecting security sensitive data structures.' -- source: https://linux.slashdot.org/story/24/05/26/2117251 Cheers, Peter

1 0

Ubuntu 24.04 Now Runs on the Nintendo Switch (Unofficially)
by Peter Reutemann 27 May '24

27 May '24

'"The fact it's possible at all is a credit to the ingenuity of the open-source community," writes the blog OMG Ubuntu: Switchroot is an open-source project that allows Android and Linux-based distros like Ubuntu to run on the Nintendo Switch — absolutely not something Nintendo approves of much less supports, endorses, or encourages, etc! I covered the loophole that made this possible back in 2018. Back then the NVIDIA Tegra X1-powered Nintendo Switch was still new and Linux support for much of the console's internal hardware in a formative state (a polite way to say 'not everything worked'). But as the popularity of Nintendo's handheld console ballooned (to understate it) so the 'alternative OS' Switch scene grew, and before long Linux support for Switch hardware was in full bloom... A number of Linux for Switchroot (L4S) distributions have since been released, designated as Linux for Tegra (L4T) builds. As these can boot from a microSD card it's even possible to dualboot the Switch OS with Linux, which is neat! Recently, a fresh set of L4T Ubuntu images were released based on the newest Ubuntu 24.04 LTS release. These builds work on all Switch versions, from the OG (exploit-friendly) unit through to newer, patched models (where a modchip is required)... I'm told all of the Nintendo Switch internal hardware now works under Linux, including Wi-Fi, Bluetooth, sleep mode, accelerated graphics, the official dock... Everything, basically. And despite being a 7 year old ARM device the performance is said to remain decent. "Upstream snafus have delayed the release of builds with GNOME Shell..."' -- source: https://games.slashdot.org/story/24/05/26/035202 Cheers, Peter

1 0

Disabling Google Search (Mis)Features
by Lawrence D'Oliveiro 26 May '24

26 May '24

This article <https://arstechnica.com/gadgets/2024/05/google-searchs-udm14-trick-lets-you…> explains how you can add an option to a Google search URL to turn off the new AI functionality. Another option lets you specify that you want a verbatim search on what you typed, rather than a “fuzzy” search. It also describes how you can configure your browser for more convenient invocation of these options.

1 0

Sovereign Tech Fund Backs FFmpeg Project with a €157K Infusion
by Peter Reutemann 24 May '24

24 May '24

'Sovereign Tech Fund, a funding pot supported financially by the German Federal Ministry for Economic Affairs and Climate Action, has once again shown itself to be one of Open Source’s great friends and supporters. After providing €1 million in financial support to GNOME at the end of last year and investing more than €200K in the GStreamer project earlier this year, the company is continuing its support for multimedia projects by funding FFmpeg. In light of this, last week, FFmpeg announced its first governmental sponsorship, Germany’s Sovereign Tech Fund, which has stepped forward to support the maintenance and sustainability of FFmpeg, a cornerstone software in the multimedia industry, by investing €157K in the project.' -- source: https://linuxiac.com/sovereign-tech-fund-backs-ffmpeg-project/ Cheers, Peter

2 1

RISC-V Now Supports Rust In the Linux Kernel
by Peter Reutemann 24 May '24

24 May '24

'Michael Larabel reports via Phoronix: The latest RISC-V port updates have been merged for the in-development Linux 6.10 kernel. Most notable with today's RISC-V merge to Linux 6.10 is now supporting the Rust programming language within the Linux kernel. RISC-V joins the likes of x86_64, LoongArch, and ARM64 already supporting the use of the in-kernel Rust language support. The use of Rust within the mainline Linux kernel is still rather limited with just a few basic drivers so far and a lot of infrastructure work taking place, but there are a number of new drivers and other subsystem support on the horizon. RISC-V now supporting Rust within the Linux kernel will become more important moving forward. The RISC-V updates for Linux 6.10 also add byte/half-word compare-and-exchange, support for Zihintpause within hwprobe, a PR_RISCV_SET_ICACHE_FLUSH_CTX prctl(), and support for lockless lockrefs. More details on these RISC-V updates for Linux 6.10 via this Git merge. ' -- source: https://linux.slashdot.org/story/24/05/22/2337254 Cheers, Peter

1 0

A Root-Server at the Internet's Core Lost Touch With Its Peers. We Still Don't Know Why.
by Peter Reutemann 24 May '24

24 May '24

'A server maintained by Cogent Communications, one of the 13 root servers crucial to the Internet's domain name system, fell out of sync with its peers for over four days due to an unexplained glitch. This issue, which could have caused worldwide stability and security problems, was resolved on Wednesday. The root servers store cryptographic keys necessary for authenticating intermediate servers under the DNSSEC mechanism. Inconsistencies in these keys across the 13 servers could lead to an increased risk of attacks such as DNS cache poisoning. Engineers postponed planned updates to the .gov and .int domain name servers' DNSSEC to use ECDSA cryptographic keys until the situation stabilized. Cogent stated that it became aware of the issue on Tuesday and resolved it within 25 hours. ArsTechnica, which has a great writeup about the incident, adds: Initially, some people speculated that the depeering of Tata Communications, the c-root site outage, and the update errors to the c-root itself were all connected somehow. Given the vagueness of the statement, the relation of those events still isn't entirely clear.' -- source: https://it.slashdot.org/story/24/05/23/1745246 Cheers, Peter

1 0

Mozilla Says It's Concerned About Windows Recall
by Peter Reutemann 23 May '24

23 May '24

'Microsoft's Windows Recall feature is attracting controversy before even venturing out of preview. From a report: The principle is simple. Windows takes a snapshot of a user's active screen every few seconds and dumps it to disk. The user can then scroll through the snapshots and, when something is selected, the user is given options to interact with the content. Mozilla's Chief Product Officer, Steve Teixeira, told The Register: "Mozilla is concerned about Windows Recall. From a browser perspective, some data should be saved, and some shouldn't. Recall stores not just browser history, but also data that users type into the browser with only very coarse control over what gets stored. While the data is stored in encrypted format, this stored data represents a new vector of attack for cybercriminals and a new privacy worry for shared computers. "Microsoft is also once again playing gatekeeper and picking which browsers get to win and lose on Windows -- favoring, of course, Microsoft Edge. Microsoft's Edge allows users to block specific websites and private browsing activity from being seen by Recall. Other Chromium-based browsers can filter out private browsing activity but lose the ability to block sensitive websites (such as financial sites) from Recall. "Right now, there's no documentation on how a non-Chromium based, third-party browser, such as Firefox, can protect user privacy from Recall. Microsoft did not engage our cooperation on Recall, but we would have loved for that to be the case, which would have enabled us to partner on giving users true agency over their privacy, regardless of the browser they choose."' -- source: https://tech.slashdot.org/story/24/05/22/1939244 Cheers, Peter

1 0

Linux 6.10 Honors One Last Request By Hans Reiser
by Peter Reutemann 22 May '24

22 May '24

'Phoronix: ReiserFS lead developer and convicted murderer Hans Reiser a few months back wrote letters to be made public apologizing for his social mistakes and other commentary. In his written communications he also made a last request for ReiserFS in the Linux kernel: "Assuming that the decision is to remove [ReiserFS] V3 from the kernel, I have just one request: that for one last release the README be edited to add Mikhail Gilula, Konstantin Shvachko, and Anatoly Pinchuk to the credits, and to delete anything in there I might have said about why they were not credited. It is time to let go." Hans credits his improved social and communication skills learned in prison among other details shared in the public letters. Per the indirect request by Hans Reiser, SUSE's Jan Kara has now altered the ReiserFS README file with the changes going in today to the Linux 6.10 kernel. The negative language was removed and instead acknowledging their contributions.' -- source: https://linux.slashdot.org/story/24/05/21/217228 Cheers, Peter

1 0

New Windows AI feature records everything you’ve done on your PC
by Peter Reutemann 22 May '24

22 May '24

'At a Build conference event on Monday, Microsoft revealed a new AI-powered feature called "Recall" for Copilot+ PCs that will allow Windows 11 users to search and retrieve their past activities on their PC. To make it work, Recall records everything users do on their PC, including activities in apps, communications in live meetings, and websites visited for research. Despite encryption and local storage, the new feature raises privacy concerns for certain Windows users. "Recall uses Copilot+ PC advanced processing capabilities to take images of your active screen every few seconds," Microsoft says on its website. "The snapshots are encrypted and saved on your PC’s hard drive. You can use Recall to locate the content you have viewed on your PC using search or on a timeline bar that allows you to scroll through your snapshots." By performing a Recall action, users can access a snapshot from a specific time period, providing context for the event or moment they are searching for. It also allows users to search through teleconference meetings they've participated in and videos watched using an AI-powered feature that transcribes and translates speech. At first glance, the Recall feature seems like it may set the stage for potential gross violations of user privacy. Despite reassurances from Microsoft, that impression persists for second and third glances as well. For example, someone with access to your Windows account could potentially use Recall to see everything you've been doing recently on your PC, which might extend beyond the embarrassing implications of pornography viewing and actually threaten the lives of journalists or perceived enemies of the state. Despite the privacy concerns, Microsoft says that the Recall index remains local and private on-device, encrypted in a way that is linked to a particular user's account. "Recall screenshots are only linked to a specific user profile and Recall does not share them with other users, make them available for Microsoft to view, or use them for targeting advertisements. Screenshots are only available to the person whose profile was used to sign in to the device," Microsoft says. Users can pause, stop, or delete captured content and can exclude specific apps or websites. Recall won't take snapshots of InPrivate web browsing sessions in Microsoft Edge or DRM-protected content. However, Recall won't actively hide sensitive information like passwords and financial account numbers that appear on-screen.' -- source: https://arstechnica.com/gadgets/2024/05/microsofts-new-recall-feature-will-… Talking about intrusive OS... I wonder whether there will be an ad-supported, cheap version of Windows in the future where the user can't turn Recall off, giving Microsoft a large pool of free training data... Cheers, Peter

2 1

Ubuntu 24.10 to Default to Wayland for NVIDIA Users
by Peter Reutemann 20 May '24

20 May '24

'OMG Ubuntu: Ubuntu first switched to using Wayland as its default display server in 2017 before reverting the following year. It tried again in 2021 and has stuck with it since. But while Wayland is what most of us now log into after installing Ubuntu, anyone doing so on a PC or laptop with an NVIDIA graphics card present instead logs into an Xorg/X11 session. This is because NVIDIA's proprietary graphics drivers (which many, especially gamers, opt for to get the best performance, access to full hardware capabilities, etc) have not supported Wayland as well as as they could've. Past tense as, thankfully, things have changed in the past few years. NVIDIA's warmed up to Wayland (partly as it has no choice given that Wayland is now standard and a 'maybe one day' solution, and partly because it wants to: opportunities/benefits/security). With the NVIDIA + Wayland sitch' now in a better state than before — but not perfect — Canonical's engineers say they feel confident enough in the experience to make the Ubuntu Wayland session default for NVIDIA graphics card users in Ubuntu 24.10.' -- source: https://news.slashdot.org/story/24/05/20/013218 Cheers, Peter

1 0

Linux Foundation Announces Launch of 'High Performance Software Foundation'
by Peter Reutemann 20 May '24

20 May '24

'This week the nonprofit Linux Foundation announced the launch of the High Performance Software Foundation, which "aims to build, promote, and advance a portable core software stack for high performance computing" (or HPC) by "increasing adoption, lowering barriers to contribution, and supporting development efforts." It promises initiatives focused on "continuously built, turnkey software stacks," as well as other initiatives including architecture support and performance regression testing. Its first open source technical projects are: - Spack: the HPC package manager. - Kokkos: a performance-portable programming model for writing modern C++ applications in a hardware-agnostic way. - Viskores (formerly VTK-m): a toolkit of scientific visualization algorithms for accelerator architectures. - HPCToolkit: performance measurement and analysis tools for computers ranging from desktop systems to GPU-accelerated supercomputers. - Apptainer: Formerly known as Singularity, Apptainer is a Linux Foundation project providing a high performance, full featured HPC and computing optimized container subsystem. - E4S: a curated, hardened distribution of scientific software packages. As use of HPC becomes ubiquitous in scientific computing and digital engineering, and AI use cases multiply, more and more data centers deploy GPUs and other compute accelerators. The High Performance Software Foundation will provide a neutral space for pivotal projects in the high performance computing ecosystem, enabling industry, academia, and government entities to collaborate on the scientific software. The High Performance Software Foundation benefits from strong support across the HPC landscape, including Premier Members Amazon Web Services (AWS), Hewlett Packard Enterprise, Lawrence Livermore National Laboratory, and Sandia National Laboratories; General Members AMD, Argonne National Laboratory, Intel, Kitware, Los Alamos National Laboratory, NVIDIA, and Oak Ridge National Laboratory; and Associate Members University of Maryland, University of Oregon, and Centre for Development of Advanced Computing. In a statement, an AMD vice president said that by joining "we are using our collective hardware and software expertise to help develop a portable, open-source software stack for high-performance computing across industry, academia, and government." And an AWS executive said the high-performance computing community "has a long history of innovation being driven by open source projects. AWS is thrilled to join the High Performance Software Foundation to build on this work. In particular, AWS has been deeply involved in contributing upstream to Spack, and we're looking forward to working with the HPSF to sustain and accelerate the growth of key HPC projects so everyone can benefit." The new foundation will "set up a technical advisory committee to manage working groups tackling a variety of HPC topics," according to the announcement, following a governance model based on the Cloud Native Computing Foundation.' -- source: https://tech.slashdot.org/story/24/05/19/2234254 Cheers, Peter

1 0

Why a 'Frozen' Distribution Linux Kernel Isn't the Safest Choice for Security
by Peter Reutemann 20 May '24

20 May '24

'Jeremy Allison — Sam (Slashdot reader #8,157) is a Distinguished Engineer at Rocky Linux creator CIQ. This week he published a blog post responding to promises of Linux distros "carefully selecting only the most polished and pristine open source patches from the raw upstream open source Linux kernel in order to create the secure distribution kernel you depend on in your business." But do carefully curated software patches (applied to a known "frozen" Linux kernel) really bring greater security? "After a lot of hard work and data analysis by my CIQ kernel engineering colleagues Ronnie Sahlberg and Jonathan Maple, we finally have an answer to this question. It's no." The data shows that "frozen" vendor Linux kernels, created by branching off a release point and then using a team of engineers to select specific patches to back-port to that branch, are buggier than the upstream "stable" Linux kernel created by Greg Kroah-Hartman. How can this be? If you want the full details the link to the white paper is here. But the results of the analysis couldn't be clearer. - A "frozen" vendor kernel is an insecure kernel. A vendor kernel released later in the release schedule is doubly so. - The number of known bugs in a "frozen" vendor kernel grows over time. The growth in the number of bugs even accelerates over time. - There are too many open bugs in these kernels for it to be feasible to analyze or even classify them.... [T]hinking that you're making a more secure choice by using a "frozen" vendor kernel isn't a luxury we can still afford to believe. As Greg Kroah-Hartman explicitly said in his talk "Demystifying the Linux Kernel Security Process": "If you are not using the latest stable / longterm kernel, your system is insecure." CIQ describes its report as "a count of all the known bugs from an upstream kernel that were introduced, but never fixed in RHEL 8." For the most recent RHEL 8 kernels, at the time of writing, these counts are: RHEL 8.6 : 5034 RHEL 8.7 : 4767 RHEL 8.8 : 4594 In RHEL 8.8 we have a total of 4594 known bugs with fixes that exist upstream, but for which known fixes have not been back-ported to RHEL 8.8. The situation is worse for RHEL 8.6 and RHEL 8.7 as they cut off back-porting earlier than RHEL 8.8 but of course that did not prevent new bugs from being discovered and fixed upstream.... This whitepaper is not meant as a criticism of the engineers working at any Linux vendors who are dedicated to producing high quality work in their products on behalf of their customers. This problem is extremely difficult to solve. We know this is an open secret amongst many in the industry and would like to put concrete numbers describing the problem to encourage discussion. Our hope is for Linux vendors and the community as a whole to rally behind the kernel.org stable kernels as the best long term supported solution. As engineers, we would prefer this to allow us to spend more time fixing customer specific bugs and submitting feature improvements upstream, rather than the endless grind of backporting upstream changes into vendor kernels, a practice which can introduce more bugs than it fixes. ZDNet calls it "an open secret in the Linux community." It's not enough to use a long-term support release. You must use the most up-to-date release to be as secure as possible. Unfortunately, almost no one does that. Nevertheless, as Google Linux kernel engineer Kees Cook explained, "So what is a vendor to do? The answer is simple: if painful: Continuously update to the latest kernel release, either major or stable." Why? As Kroah-Hartman explained, "Any bug has the potential of being a security issue at the kernel level...." Although [CIQ's] programmers examined RHEL 8.8 specifically, this is a general problem. They would have found the same results if they had examined SUSE, Ubuntu, or Debian Linux. Rolling-release Linux distros such as Arch, Gentoo, and OpenSUSE Tumbleweed constantly release the latest updates, but they're not used in businesses.' -- source: https://linux.slashdot.org/story/24/05/19/0030248 Cheers, Peter

1 0

Google patches its fifth zero-day vulnerability of the year in Chrome
by Peter Reutemann 13 May '24

13 May '24

'Google has updated its Chrome browser to patch a high-severity zero-day vulnerability that allows attackers to execute malicious code on end user devices. The fix marks the fifth time this year the company has updated the browser to protect users from an existing malicious exploit. The vulnerability, tracked as CVE-2024-4671, is a “use after free,” a class of bug that occurs in C-based programming languages. In these languages, developers must allocate memory space needed to run certain applications or operations. They do this by using “pointers” that store the memory addresses where the required data will reside. Because this space is finite, memory locations should be deallocated once the application or operation no longer needs it. Use-after-free bugs occur when the app or process fails to clear the pointer after freeing the memory location. In some cases, the pointer to the freed memory is used again and points to a new memory location storing malicious shellcode planted by an attacker’s exploit, a condition that will result in the execution of this code. On Thursday, Google said an anonymous source notified it of the vulnerability. The vulnerability carries a severity rating of 8.8 out of 10. In response, Google said, it would be releasing versions 124.0.6367.201/.202 for macOS and Windows and 124.0.6367.201 for Linux in subsequent days. “Google is aware that an exploit for CVE-2024-4671 exists in the wild,” the company said.' -- source: https://arstechnica.com/security/2024/05/google-patches-its-fifth-zero-day-… Cheers, Peter

1 0

AMD Core Performance Boost For Linux Getting Per-CPU Core Controls
by Peter Reutemann 13 May '24

13 May '24

'Phoronix: For the past several months AMD Linux engineers have been working on AMD Core Performance Boost support for their P-State CPU frequency scaling driver. The ninth iteration of these patches were posted on Monday and besides the global enabling/disabling support for Core Performance Boost, it's now possible to selectively toggle the feature on a per-CPU core basis... The new interface is under /sys/devices/system/cpu/cpuX/cpufreq/amd_pstate_boost_cpb for each CPU core. Thus users can tune whether particular CPU cores are boosted above the base frequency.' -- source: https://linux.slashdot.org/story/24/05/11/229219 Cheers, Peter

1 0

Linux Kernel 6.9 Officially Released
by Peter Reutemann 13 May '24

13 May '24

'"6.9 is now out," Linus Torvalds posted on the Linux kernel mailing list, "and last week has looked quite stable (and the whole release has felt pretty normal)." Phoronix writes that Linux 6.9 "has a number of exciting features and improvements for those habitually updating to the newest version." And Slashdot reader prisoninmate shared this report from 9to5Linux: Highlights of Linux kernel 6.9 include Rust support on AArch64 (ARM64) architectures, support for the Intel FRED (Flexible Return and Event Delivery) mechanism for improved low-level event delivery, support for AMD SNP (Secure Nested Paging) guests, and a new dm-vdo (virtual data optimizer) target in device mapper for inline deduplication, compression, zero-block elimination, and thin provisioning. Linux kernel 6.9 also supports the Named Address Spaces feature in GCC (GNU Compiler Collection) that allows the compiler to better optimize per-CPU data access, adds initial support for FUSE passthrough to allow the kernel to serve files from a user-space FUSE server directly, adds support for the Energy Model to be updated dynamically at run time, and introduces a new LPA2 mode for ARM 64-bit processors... Linux kernel 6.9 will be a short-lived branch supported for only a couple of months. It will be succeeded by Linux kernel 6.10, whose merge window has now been officially opened by Linus Torvalds. Linux kernel 6.10 is expected to be released in mid or late September 2024. "Rust language has been updated to version 1.76.0 in Linux 6.9," according to the article. And Linus Torvalds shared one more details on the Linux kernel mailing list. "I now have a more powerful arm64 machine (thanks to Ampere), so the last week I've been doing almost as many arm64 builds as I have x86-64, and that should obviously continue during the upcoming merge window too."' -- source: https://linux.slashdot.org/story/24/05/12/2212235 Cheers, Peter

1 0

Fedora Asahi Remix 40 is another big step forward for Linux on Apple Silicon Mac
by Peter Reutemann 10 May '24

10 May '24

'Asahi Linux, the project that aims to bring desktop Linux to Apple hardware with Apple silicon—the M series of chips—is out with Fedora Asahi Remix 40. More hardware features of Apple devices are supported, the Fedora Linux 40-based distro ships with KDE's new Plasma 6 desktop, and untold numbers of bugs are squashed, to be replaced with reams more. Fedora Asahi Remix is a "fully integrated distro," according to the Asahi team, and you can "expect a solid and high-quality experience without any unwanted surprises." It supports all the M1 and M2 devices in the MacBook, Mac Mini, Mac Studio, and iMac lines. It's OpenGL 4.6 and OpenGL ES 3.2 certified, and comes with "the best Linux laptop audio you've ever heard." So, should you install it on your Mac? Keep scrolling down Asahi's release page and check the "Device support" section. Still missing from most M-series Apple devices are support for Thunderbolt and USB4, built-in microphones, and Touch ID, as well as USB-C display support. Speakers are not supported on the iMac. And HDMI audio is in rough shape, being able to "break audio on the system completely." Still, for someone using an Apple laptop primarily as a portable device, or simply connecting to a monitor with less modern all-in-one cables, there is a desktop awaiting. Installing it is a single cURL command.' -- source: https://arstechnica.com/gadgets/2024/05/fedora-asahi-remix-40-is-another-bi… Cheers, Peter

1 0

Raspberry Pis get a built-in remote access tool: Raspberry Pi Connect
by Peter Reutemann 08 May '24

08 May '24

'One Raspberry Pi often leads to another. Soon enough, you're running out of spots in your free RealVNC account for your tiny boards and "real" computers. Even if you go the hardened route of SSH or an X connection, you have to keep track of where they all are. All of this is not the easiest thing to tackle if you're new to single-board computers or just eager to get started. Enter Raspberry Pi Connect, a new built-in way to access a Rasbperry Pi from nearly anywhere you can open a browser, whether to control yourself or provide remote assistance. On a Raspberry Pi 4, 5, or Pi 400 kit, you install Pi connect with a single terminal line, reboot the Pi, and then click a new tray icon to connect the Pi to a Raspberry Pi ID (and then enable two-factor authentication, of course). >From then on, visiting connect.raspberrypi.com gives you an encrypted connection to your desktop. It's a direct connection if possible, and if not, it runs through relay servers in London, encrypting it with DTLS and keeping only the metadata needed for the service to work. The Pi will show a notification in its tray that somebody has connected, and you can manage screen sharing from there. The Pi's docs site has a lot more on the particulars. Connect works only on 64-bit systems running the Bookworm version of Pi OS with a Wayland window server. Connect was created partly due to Pi's transition to Wayland from X, which offered its own remote desktop option. According to the Pi firm, the service runs on a peer-to-peer WebRTC connection, similar to that of Zoom, Slack, Teams, and other video-sharing services. The whole service is in beta at the moment, and the company says it's not quite sure how much traffic to expect through its relay servers.' -- source: https://arstechnica.com/gadgets/2024/05/raspberry-pis-get-a-built-in-remote… Cheers, Peter

1 0

Novel attack against virtually all VPN apps neuters their entire purpose
by Peter Reutemann 07 May '24

07 May '24

'Researchers have devised an attack against nearly all virtual private network applications that forces them to send and receive some or all traffic outside of the encrypted tunnel designed to protect it from snooping or tampering. TunnelVision, as the researchers have named their attack, largely negates the entire purpose and selling point of VPNs, which is to encapsulate incoming and outgoing Internet traffic in an encrypted tunnel and to cloak the user’s IP address. The researchers believe it affects all VPN applications when they’re connected to a hostile network and that there are no ways to prevent such attacks except when the user's VPN runs on Linux or Android. They also said their attack technique may have been possible since 2002 and may already have been discovered and used in the wild since then. The effect of TunnelVision is “the victim's traffic is now decloaked and being routed through the attacker directly,” a video demonstration explained. “The attacker can read, drop or modify the leaked traffic and the victim maintains their connection to both the VPN and the Internet.” The attack works by manipulating the DHCP server that allocates IP addresses to devices trying to connect to the local network. A setting known as option 121 allows the DHCP server to override default routing rules that send VPN traffic through a local IP address that initiates the encrypted tunnel. By using option 121 to route VPN traffic through the DHCP server, the attack diverts the data to the DHCP server itself.' -- source: https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all… Cheers, Peter

1 0

Kernel Modules Are Now Compressed
by Lawrence D'Oliveiro 06 May '24

06 May '24

Not sure if this is mentioned in any release notes anywhere, but the .ko files (loadable kernel modules) that would live in /lib/modules/«kernel version»/ are now .ko.xz files. Looks like this happened starting with the 6.6 kernel. I discovered this a few minutes ago, while trying to count how many .ko files came with my 6.7.9 Debian kernel, with find /lib/modules/$(uname -r) -name \*.ko | wc -l and was surprised to see that the answer was 0. A suitably adjusted command find /lib/modules/$(uname -r) -name \*.ko\* | wc -l returns 4165

1 0

Yet Another New systemd Feature
by Lawrence D'Oliveiro 06 May '24

06 May '24

Lennart Poettering wants to get rid of sudo now, and replace it with a new systemd feature called “run0” <https://itwire.com/business-it-news/open-source/poettering-announces-tool-i…>. It is hard to write code that runs setuid, and sudo has had quite a few security vulnerabilities over the years. So Poettering’s idea is to replace the setuid executable with another use of the existing PolicyKit system. Interesting that Poettering thinks we should get rid of the whole idea of setuid altogether. AT&T actually got a patent on the concept, back in the early days of Unix. Other OSes had the concept of privileged code, but what made setuid different is that any user can set this mode on any executable they create, and when other users run this executable (if they are allowed to), they temporarily get the permissions of the owning user. On Linux, this concept was always constrained a bit: I think it only works on compiled machine-code executables, not on interpreted scripts.

1 0

Maximum-Severity GitLab Flaw Allowing Account Hijacking Under Active Exploitation
by Peter Reutemann 03 May '24

03 May '24

'Dan Goodin reports via Ars Technica: A maximum severity vulnerability that allows hackers to hijack GitLab accounts with no user interaction required is now under active exploitation, federal government officials warned as data showed that thousands of users had yet to install a patch released in January. A change GitLab implemented in May 2023 made it possible for users to initiate password changes through links sent to secondary email addresses. The move was designed to permit resets when users didn't have access to the email address used to establish the account. In January, GitLab disclosed that the feature allowed attackers to send reset emails to accounts they controlled and from there click on the embedded link and take over the account. While exploits required no user interaction, hijackings worked only against accounts that weren't configured to use multi-factor authentication. Even with MFA, accounts remained vulnerable to password resets. The vulnerability, tracked as CVE-2023-7028, carries a severity rating of 10 out of a possible 10. The vulnerability, classified as an improper access control flaw, could pose a grave threat. GitLab software typically has access to multiple development environments belonging to users. With the ability to access them and surreptitiously introduce changes, attackers could sabotage projects or plant backdoors that could infect anyone using software built in the compromised environment. An example of a similar supply chain attack is the one that hit SolarWinds in 2021, infecting more than 18,000 of its customers. Other recent examples of supply chain attacks are here, here, and here. These sorts of attacks are powerful. By hacking a single, carefully selected target, attackers gain the means to infect thousands of downstream users, often without requiring them to take any action at all. According to Internet scans performed by security organization Shadowserver, more than 2,100 IP addresses showed they were hosting one or more vulnerable GitLab instances. In order to protect your system, you should enable MFA and install the latest patch. "GitLab users should also remember that patching does nothing to secure systems that have already been breached through exploits," notes Goodin.' -- source: https://it.slashdot.org/story/24/05/02/1934220 Cheers, Peter -- My Open Source Blog - http://open.fracpete.org

2 1

Bat is a Modern Drop-in Replacement for Cat Command on Linux
by Peter Reutemann 01 May '24

01 May '24

'The bat is a modern command-line program written in the Rust programming language, and I can confidently say it’s a great drop-in replacement for our beloved cat command. If you’re wondering why I’m hyping this so much and what it has to offer you that makes it worth replacing the cat with, then do check out its features below. Bat really has some cool features to offer, which are mentioned below. - Supports syntax highlighting for a large number of programming and markup languages. - Detect and display Git changes. - Pipe output to its own pager (e.g., “less“) if the output is too large for one screen. - Display non-printable characters such as spaces, tabs, line breaks, etc. - Offer multiple themes that can be easily configured using flags or environments. - A user-friendly command-line interface that, of course, inherits all the functionality of the “cat” command.' -- source: https://linuxtldr.com/installing-bat/ Cheers, Peter

2 1

I Have No Luck With Keyboards ...
by Lawrence D'Oliveiro 01 May '24

01 May '24

Yesterday I decided that my heavily-used clicky mechanical keyboard (a Das Keyboard 4) had accumulated far too much grime, and it was time to take the risk of cleaning it. In the past, every time I’ve tried cleaning a keyboard, it has never worked right afterwards. I’m a software guy, not a hardware guy. I found the keys quite easy to pry off. A light amount of leverage with a small screwdriver was helpful when space was tight, but once I’d cleared sufficient room around a key, I could pull it off just with my fingers. Even the wider keys were not hard. I found some warnings online against removing these, because of the trickiness of their extra stabilization mechanisms. But these were actually quite simple: a steel spring with its ends poked through two tiny brackets (removable, but best left in place) at each end of the key. It took a bit of pressure with the screwdriver to bend one end of the spring far enough to take it out of the hole, but it snapped immediately back to its original shape after I had taken the key out, so I saw no problem putting things back afterwards. The space bar was even simpler: just two additional support posts at the ends, in addition to the usual post (common to all the keys) that held the actual switch in the middle. After I had got all the keys off, the grime on the keyboard itself was a wonder to behold (I’ll spare you the details). I tried to use a bunched-up corner of a wet cloth, and even a vacuum cleaner with the smallest nozzle (again heeding warnings online against compressed air), and I was able to remove maybe half the accumulation of deposits, not much more. I figured that was good enough. Of course, in the process, I likely got some water into two slots that were exposed after I removed the keys. There was a recommendation online to leave things to dry for at least 6 hours. Call me impatient; I left it for just 5. Afterwards, I plugged it in, without the key caps, and tried a few keys, and was gratified to find they still worked. After that, I put back all the keys, now nice and clean and dry. Even the ones with those extra springs went back with only a slight amount of fiddling to re-engage with those brackets on the keys. And afterwards, the keyboard still worked. I left it plugged in, and went to do something else. Half an hour later, I came back to my computer ... and the keyboard was dead. Not a single response from any key. Put it back in the heater cupboard and left it overnight. No change this morning: still dead. So I feel very sad. I thought I had broken my keyboard jinx. But it’s currently zero for three. I have some other keyboards, of course, including a colourful oddity I bought from Dick Smith (whose layout leaves out the right-hand super/windows key), and a Kensington “washable” (dare I risk it?), with the pipe/backslash key in a different position. But I had grown accustomed to the volume control knob and other niceties of the Das Keyboard. Looking back through my records, I was surprised to discover I had bought it about ten years ago, from Mighty Ape. So I suppose it’s had a good run. But it seems nobody in NZ sells the things any more. So currently I mourn, and I also look for alternatives ...

3 3

T2 Linux 24.5 Released
by Peter Reutemann 30 Apr '24

30 Apr '24

'A major T2 Linux milestone has been released, shipping with full support for 25 CPU architectures and several C libraries, as well as restored support for Intel IA-64 Itanium. Additionally, many vintage X.org DDX drivers were fixed and tested to work again, as well as complete support for the latest KDE 6 and GNOME 46. T2 is known for its sophisticated cross compile support and support for nearly all existing CPU architectures: Alpha, Arc, ARM(64), Avr32, HPPA(64), IA64, M68k, MIPS(64), Nios2, PowerPC(64)(le), RISCV(64), s390x, SPARC(64), and SuperH x86(64). T2 is an increasingly popular choice for embedded systems and virtualization. It also still supports the Sony PS3, Sgi, Sun and HP workstations, as well as the latest ARM64 and RISCV64 architectures. The release contains a total of 5,140 changesets, including approximately 5,314 package updates, 564 issues fixed, 317 packages or features added and 163 removed, and around 53 improvements. Usually most packages are up-to-date, including Linux 6.8, GCC 13, LLVM/Clang 18, as well as the latest version of X.org, Mesa, Firefox, Rust, KDE 6 and GNOME 46! More information, source and binary distribution are open source and free at T2 SDE.' -- source: https://news.slashdot.org/story/24/04/29/2325210/ To be honest, haven't heard of that distro before, but sounds interesting. Cheers, Peter

2 3

Hackers try to exploit WordPress plugin vulnerability that’s as severe as it gets
by Peter Reutemann 29 Apr '24

29 Apr '24

'Hackers are assailing websites using a prominent WordPress plugin with millions of attempts to exploit a high-severity vulnerability that allows complete takeover, researchers said. The vulnerability resides in WordPress Automatic, a plugin with more than 38,000 paying customers. Websites running the WordPress content management system use it to incorporate content from other sites. Researchers from security firm Patchstack disclosed last month that WP Automatic versions 3.92.0 and below had a vulnerability with a severity rating of 9.9 out of a possible 10. The plugin developer, ValvePress, silently published a patch, which is available in versions 3.92.1 and beyond. Researchers have classified the flaw, tracked as CVE-2024-27956, as a SQL injection, a class of vulnerability that stems from a failure by a web application to query backend databases properly. SQL syntax uses apostrophes to indicate the beginning and end of a data string. By entering strings with specially positioned apostrophes into vulnerable website fields, attackers can execute code that performs various sensitive actions, including returning confidential data, giving administrative system privileges, or subverting how the web app works.' -- source: https://arstechnica.com/security/2024/04/hackers-make-millions-of-attempts-… Cheers, Peter

2 1

Alternative To Microsoft Access
by Lawrence D'Oliveiro 27 Apr '24

27 Apr '24

If anybody asks about an alternative to Microsoft Access, I think SQLite used in combination with LibreOffice will give you a lot of functionality, including comprehensive SQL support and scalability to much larger databases. Of course you can use other backends, like MariaDB/MySQL, as well. SQLite just makes it easy to have an actual database file that you can copy/move about the place, without having to do database dumps/restores. If you don’t need multiuser support, it is very convenient. I notice that libreoffice-base is now a separate package under Debian (and I suppose its derivatives as well), no longer included in the “base” (heh) LibreOffice package. Make sure to install this, along with libsqliteodbc. Now, say you have an existing SQLite3 database that you want to access from LibreOffice. Suppose it is in the file /home/ldo/hack/lo_try/test.db. In order for databases to be accessible via ODBC, they need to have entries in your ~/.odbc.ini file. This is just a text file, in the good old .ini tradition. The format for entries is very simple, e.g.: [test-db] Description=Test database for LibreOffice Base Driver=SQLite3 Database=/home/ldo/hack/lo_try/test.db Now, when you launch the LibreOffice Base database wizard, you have options to “create a new database”, “open an existing database file”, or “connect to an existing database”. Choose that last one “connect to an existing database”. The popup menu shows the available back-end drivers: choose “ODBC”. Now, when you click “Next”, there should be a text field with a “Browse...” button; clicking this should show the names of entries in your ~/.odbc.ini file, e.g. “test-db” if you used the name in my example above. Select this, and click “Finish”. Next you will be prompted for a name to save the “database file”. This is just the LibreOffice Base document that contains the settings for connecting to the actual database: LibreOffice doesn’t know or care where the database back-end keeps the actual data. After having named the LibreOffice database file, you should see the main LibreOffice Base window. In the lower half, under “Tables”, you should see a list of the tables from the database file. You can double-click a table name to see a quick list of all its records. That’s as far as I’ve got. I see a “Design View”, “Form Wizards”, and “Report Wizards”, and all kinds of other fun stuff. Should be great for building simple database applications, with a minimum of programming.

1 0

Ubuntu 24.04 LTS 'Noble Numbat' Officially Released
by Peter Reutemann 26 Apr '24

26 Apr '24

'9to5Linux: Canonical released today Ubuntu 24.04 LTS (Noble Numbat) as the latest version of its popular Linux-based operating system featuring some of the latest GNU/Linux technologies and Open Source software. Powered by Linux kernel 6.8, Ubuntu 24.04 LTS features the latest GNOME 46 desktop environment, an all-new graphical firmware update tool called Firmware Updater, Netplan 1.0 for state-of-the-art network management, updated Ubuntu font, support for the deb822 format for software sources, increased vm.max_map_count for better gaming, and Mozilla Thunderbird as a Snap by default. It also comes with an updated Flutter-based graphical desktop installer that's now capable of updating itself and features a bunch of changes like support for accessibility features, guided (unencrypted) ZFS installations, a new option to import auto-install configurations for templated custom provisioning, as well as new default installation options, such as Default selection (previously Minimal) and Extended selection (previously Normal)."' -- source: https://news.slashdot.org/story/24/04/25/2036234 Cheers, Peter

1 0

Fedora Linux 40 Officially Released
by Peter Reutemann 24 Apr '24

24 Apr '24

'Fedora Linux 40 distribution has been officially released -- powered by the latest Linux 6.8 kernel series, and featuring the GNOME 46 and KDE Plasma 6 desktop environments, reports 9to5Linux: "Powered by the latest and greatest Linux 6.8 kernel series, the Fedora Linux 40 release ships with the GNOME 46 desktop environment for the flagship Fedora Workstation edition and the KDE Plasma 6 desktop environment for the Fedora KDE Spin, which defaults to the Wayland session as the X11 session was completely removed." "Fedora Linux 40 also includes some interesting package management changes, such as dropping Delta RPMs and disabling support in the default configuration of DNF / DNF5. It also changes the DNF behavior to no longer download filelists by default. However, this release doesn't ship with the long-awaited DNF5 package manager. For AMD GPUs, Fedora Linux 40 ships with AMD ROCm 6.0 as the latest release of AMD's software optimized for AI and HPC workload performance, which enables support for the newest flagship AMD Instinct MI300A and MI300X datacenter GPUs."' -- source: https://linux.slashdot.org/story/24/04/23/1452255 Cheers, Peter

1 0

Ex WH Cyber Policy Director: Microsoft Is A Threat To US National Security
by Lawrence D'Oliveiro 23 Apr '24

23 Apr '24

Microsoft has become so dominant a supplier to the US Government that it cannot be effectively called to account on its repeated security lapses <https://www.theregister.com/2024/04/21/microsoft_national_security_risk/>. Even something as basic as event logging (which would have helped track exposure to things like the SolarWinds breach) was an extra-cost service that Microsoft customers had to pay for. Microsoft is squeezing a lot of profit out of those customers, and it feels no need to let up.

1 0

Ubuntu 24.04 Yields a 20% Performance Advantage Over Windows 11 On Ryzen 7 Framework Laptop
by Peter Reutemann 19 Apr '24

19 Apr '24

'Michael Larabel reports via Phoronix: With the Framework 16 laptop one of the performance pieces I've been meaning to carry out has been seeing out Linux performs against Microsoft Windows 11 for this AMD Ryzen 7 7840HS powered modular/upgradeable laptop. Recently getting around to it in my benchmarking queue, I also compared the performance of Ubuntu 23.10 to the near final Ubuntu 24.04 LTS on this laptop up against a fully-updated Microsoft Windows 11 installation. The Framework 16 review unit as a reminder was configured with the 8-core / 16-thread AMD Ryzen 7 7840HS Zen 4 SoC with Radeon RX 7700S graphics, a 512GB SN810 NVMe SSD, MediaTek MT7922 WiFi, and a 2560 x 1600 display. In the few months of testing out the Framework 16 predominantly under Linux it's been working out very well. With also having a Windows 11 partition as shipped by Framework, after updating that install it made for an interesting comparison against the Ubuntu 23.10 and Ubuntu 24.04 performance. The same Framework 16 AMD laptop was used throughout all of the testing for looking at the out-of-the-box performance across Microsoft Windows 11, Ubuntu 23.10, and the near-final state of Ubuntu 24.04. [...] Out of 101 benchmarks carried out on all three operating systems with the Framework 16 laptop, Ubuntu 24.04 was the fastest in 67% of those tests, the prior Ubuntu 23.10 led in 22% (typically with slim margins to 24.04), and then Microsoft Windows 11 was the front-runner just 10% of the time... If taking the geomean of all 101 benchmark results, Ubuntu 23.10 was 16% faster than Microsoft Windows 11 while Ubuntu 24.04 enhanced the Ubuntu Linux performance by 3% to yield a 20% advantage over Windows 11 on this AMD Ryzen 7 7840HS laptop. Ubuntu 24.04 is looking very good in the performance department and will see its stable release next week. ' -- source: https://hardware.slashdot.org/story/24/04/18/2321230 Cheers, Peter

1 0

FFmpeg 7.0 “Dijkstra”: Best New Features
by Peter Reutemann 19 Apr '24

19 Apr '24

'One of the major updates in FFmpeg 7.0 is the parallel execution of operations for unpacking/packing media containers, decoding, encoding, and applying filters using the ffmpeg command line utility. This feature allows for the simultaneous execution of multiple tasks, resulting in a significant improvement in performance and efficiency, particularly when working with large-scale multimedia projects. Another notable addition is the support for encoding and decoding video in MPEG-5 format (EVC – Essential Video Coding) using the external library libxevd. This new format provides high efficiency transmission and storage of all screen resolutions, supports video with an extended dynamic range (HDR), and panoramic video in 360-degree mode. In addition, FFmpeg 7.0 has added unpackers and packers of media containers (demuxer/muxer) for the QOA (Quite OK Audio) format, which is used for transmitting audio with loss of quality. QOA decoding is claimed to be three times faster than Ogg-Vorbis while achieving higher quality and compression levels compared to ADPCM. The new version also includes unpackers and packers of media containers (demuxer/muxer) for the IAMF (Immersive Audio Model and Format) format, which defines a container for distributing surround sound. The format provides for the transmission of additional information necessary for the operation of sound stage reconstruction and sound mixing algorithms, and takes into account the propagation of sound signals in three-dimensional space to recreate sound as close to natural as possible. An experimental decoder for the VVC (Versatile Video Coding) format, also known as the H.266 video compression standard, has been added in FFmpeg 7.0. This new format provides high efficiency transmission and storage of all screen resolutions, supports video with an extended dynamic range (HDR), and panoramic video in 360-degree mode. The ffplay utility has added support for hardware acceleration of decoding using the Vulkan and libplacebo APIs, and the ability to use API D3D12VA (Direct 3D 12 Video Encoding) for hardware acceleration of decoding of H264, HEVC, VP9, AV1, MPEG-2 and VC1 formats has been implemented. [...] Remember: This version is NOT backward compatible. That means, many CLI options and API are removed which are long deprecated. So use caution before upgrading to version 7.0.' -- source: https://www.debugpoint.com/ffmpeg-7-0-features/ Cheers, Peter -- My Open Source Blog - http://open.fracpete.org

1 0

High Priority PuTTY Vulnerability Threatens Server Access Security
by Peter Reutemann 19 Apr '24

19 Apr '24

'A critical security vulnerability in PuTTY, a very popular software for secure terminal access to remote servers, has been discovered. This vulnerability could put the private keys of many users at risk. Cataloged as CVE-2024-31497, the vulnerability affects PuTTY version numbers between 0.68 and 0.80. So, if you have been using PuTTY during this time, it is important to be aware of what this means for your data security. Fabian Bäumer and Marcus Brinkmann of the Ruhr University Bochum found the vulnerability. It concerns how PuTTY forms signatures from the ECDSA private keys on the NIST P521 curve. The vulnerability with PuTTY is that it creates a component of the signature called ‘nonce’ during the generation process. This randomly generated number can be used once in a cryptographic communication, thus ensuring that old communications cannot be reused in replay attacks. However, PuTTY used a deterministic method to generate nonces due to the lack of a high-quality random number generator in early Windows systems. This deterministic method was biased for the P521 curve, which made the private key recovery possible. Simply put, an attacker who gets hold of multiple signed messages can potentially recover your private key due to a specific bias in the signature creation process. This would allow them to forge signatures and access any servers where you’ve used this key.' -- source: https://linuxiac.com/high-priority-putty-vulnerability-found/ Cheers, Peter -- My Open Source Blog - http://open.fracpete.org

1 0

Packages With “t64” On The Ends Of Their Names
by Lawrence D'Oliveiro 15 Apr '24

15 Apr '24

Lately, in Debian Unstable, I have noticed package names starting to appear with “t64” on the ends. No doubt this will percolate through to Debian derivatives as well. I wondered what this was about, and found this forum thread <https://www.antixforum.com/forums/topic/t64-at-the-end-of-a-package-title/>. This has to do with the “year-2038” problem, which should only affect 32-bit systems anyway. But it seems some people are sufficiently concerned about this to ensure that their code will build with a 64-bit size for time_t (the POSIX type for holding the number of seconds since 1st January 1970), even on 32-bit systems. This is controlled at build time by setting the _TIME_BITS symbol to the value 64. There is a file /usr/include/features-time64.h (present if you have the libc6-dev package installed) that does the necessary setup of other time-related API calls based on this. On 64-bit systems (which is what most of us would be running by now), there would be absolutely no difference in the code with this setting. So the change in package name is I think only to maintain compatibility with 32-bit architectures.

1 0

“Highly capable” hackers root corporate networks by exploiting firewall 0-day
by Peter Reutemann 15 Apr '24

15 Apr '24

'Highly capable hackers are rooting multiple corporate networks by exploiting a maximum-severity zero-day vulnerability in a firewall product from Palo Alto Networks, researchers said Friday. The vulnerability, which has been under active exploitation for at least two weeks now, allows the hackers with no authentication to execute malicious code with root privileges, the highest possible level of system access, researchers said. The extent of the compromise, along with the ease of exploitation, has earned the CVE-2024-3400 vulnerability the maximum severity rating of 10.0. The ongoing attacks are the latest in a rash of attacks aimed at firewalls, VPNs, and file-transfer appliances, which are popular targets because of their wealth of vulnerabilities and direct pipeline into the most sensitive parts of a network.' -- source: https://arstechnica.com/security/2024/04/highly-capable-hackers-root-corpor… Cheers, Peter

1 0

APT Interface 'Revamped' For Ubuntu 24.10 and Debian Trixie with Colors and Columns
by Peter Reutemann 15 Apr '24

15 Apr '24

'Ubuntu 24.10 [expected this October] and Debian GNU/Linux 13 "Trixie" [expected June-July 2025] "will feature a refined APT command-line interface," reports 9to5Linux: APT developer and Canonical engineer Julian Andres Klode took to LinkedIn to present the revamped APT interface powered by the upcoming APT 3.0 package manager that looks to give users a more concise and well-laid-out command-line output when updating, installing, or removing packages via the terminal emulator. The new APT 3.0 UI brings a columnar display that will make it easier for users to quickly scan for a package name, support for colors (red for removals and green for other changes), which makes it easier to quickly distinguish commands at a glance, and smoother install progress bars using Unicode blocks. In addition, the new APT 3.0 command-line interface will be less verbose and offer more padding to make it easier to separate sections and extract the relevant information for you. "Bleeding-edge users and Linux enthusiasts who want to try this right now can check out Debian Unstable..."' -- source: https://linux.slashdot.org/story/24/04/14/052258 Cheers, Peter

1 0

Canonical Says Qualcomm Has Joined Ubuntu's 'Silicon Partner' Program
by Peter Reutemann 15 Apr '24

15 Apr '24

'Intel, Nvidia, AMD, and Arm are among Canonical's "silicon partners," a program that "ensures maximum Ubuntu compatibility and long-term support with certified hardware," according to Web Pro News. And now Qualcomm is set to be Canonical's next silicon partner, "giving Qualcomm access to optimized versions of Ubuntu for its processors." Companies looking to use Ubuntu on Qualcomm chips will benefit from an OS that provides 10 years of support and security updates. The collaboration is expected to be a boon for AI, edge computing, and IoT applications. "The combination of Qualcomm Technologies' processors with the popularity of Ubuntu among AI and IoT developers is a game changer for the industry," commented Dev Singh, Vice President, Business Development and Head of Building, Enterprise & Industrial Automation, Qualcomm Technologies, Inc... "Optimised Ubuntu and Ubuntu Core images will be available for Qualcomm SoCs," according to the announcement, "enabling enterprises to meet their regulatory, compliance and security demands for AI at the edge and the broader IoT market with a secure operating system that is supported for 10 years." Qualcomm Technologies chose to partner with Canonical to create an optimised Ubuntu for Qualcomm IoT chipsets, giving developers an easy path to create safe, compliant, security-focused, and high-performing applications for multiple industries including industrial, robotics and edge automation... Developers and enterprises can benefit from the Ubuntu Certified Hardware program, which features a growing list of certified ODM boards and devices based on Qualcomm SoCs. These certified devices deliver an optimised Ubuntu experience out-of-the-box, enabling developers to focus on developing applications and bringing products to market.' -- source: https://news.slashdot.org/story/24/04/14/1652246 Cheers, Peter

1 0

New Spectre V2 Attack Impacts Linux Systems On Intel CPUs
by Peter Reutemann 14 Apr '24

14 Apr '24

'BleepingComputer reports: Researchers have demonstrated the "first native Spectre v2 exploit" for a new speculative execution side-channel flaw that impacts Linux systems running on many modern Intel processors. Spectre V2 is a new variant of the original Spectre attack discovered by a team of researchers at the VUSec group from VU Amsterdam. The researchers also released a tool that uses symbolic execution to identify exploitable code segments within the Linux kernel to help with mitigation. The new finding underscores the challenges in balancing performance optimization with security, which makes addressing fundamental CPU flaws complicated even six years after the discovery of the original Spectre.... As the CERT Coordination Center (CERT/CC) disclosed yesterday, the new flaw, tracked as CVE-2024-2201, allows unauthenticated attackers to read arbitrary memory data by leveraging speculative execution, bypassing present security mechanisms designed to isolate privilege levels. "An unauthenticated attacker can exploit this vulnerability to leak privileged memory from the CPU by speculatively jumping to a chosen gadget," reads the CERT/CC announcement. "Current research shows that existing mitigation techniques of disabling privileged eBPF and enabling (Fine)IBT are insufficient in stopping BHI exploitation against the kernel/hypervisor." ' -- source: https://linux.slashdot.org/story/24/04/13/1911230 Cheers, Peter

1 0

In a First, AlmaLinux Patches a Security Hole That Remains Unpatched in Upstream RHEL
by Peter Reutemann 10 Apr '24

10 Apr '24

'AlmaLinux, a three year old Linux distribution that started life as a clone of Red Hat Enterprise Linux, on Tuesday announced that it had created a patch to fix CVE-2024-1086, a security vulnerability that Red Hat evidently doesn’t think is important enough to patch in RHEL right away. “Though this was flagged as something to be fixed in Red Hat Enterprise Linux, Red Hat has only rated this as a moderate impact,” benny Vasquez, chairperson at the AlmaLinux Foundation explained in an article on the distro’s website on Tuesday. “Our users have asked us to patch this more quickly, and as such, we have opted to include patches ourselves. We released this kernel patch to the testing repo last weekend and plan to push it to production on Wednesday, April 3rd.” Since Vasquez’s post a production ready version of the fix was made available through the distro’s repositories, and Red Hat has re-evaluated the threat from its end and raised the severity level from “moderate” to “important.” There is still no sign of a patch from Red Hat, however, although the company has posted several methods for mitigating the threat. “This flaw is trivially exploitable on most RHEL-equivalent systems,” Vasquez said. “There are many proof-of-concept posts available now, including one from our Infrastructure team lead, Jonathan Wright (Dealing with CVE-2024-1086). In multi-user scenarios, this flaw is especially problematic.”' -- source: https://fossforce.com/2024/04/in-a-first-almalinux-patches-a-security-hole-… Cheers, Peter

1 0

EndeavourOS Bids Farewell to ARM Branch
by Peter Reutemann 10 Apr '24

10 Apr '24

'In a heartfelt announcement today, Bryan Poerwo, founder and project leader of EndeavourOS, marked the end of its ARM product branch. This project has been part of the EndeavourOS journey since its inception from the remnants of Antergos in 2019. The initiative, which began with the help of a passionate community member known as Pudge, later a leading figure of the EndeavourOS ARM team, aimed to extend the reach of EndeavourOS to ARM devices such as the ODROID N2, ODROID XU4, and Raspberry Pi 4. Over nearly five years, EndeavourOS ARM flourished, witnessing additions like support for the PineBook Pro and Raspberry Pi 5 and implementing a Calamares install option alongside the original scripts. However, the journey was challenging. The rapid advancement of Linux and desktop environments on x86_64 devices contrasted sharply with the slower pace of development in the ARM landscape, presenting a series of obstacles that tested the resolve of the project’s pioneers. The widening gap between ARM and x86_64 architectures, reduced external support, and personal transitions in hardware preferences led to a heartfelt decision to conclude the EndeavourOS ARM project. But not all is lost. As the project ends, the community remains hopeful, inviting anyone willing to carry the torch forward. The project’s GitHub repository continues to be available, serving as a foundation for future endeavors in the ARM Linux space.' -- source: https://linuxiac.com/endeavouros-bids-farewell-to-arm-branch/ Cheers, Peter

1 0

TrueNAS Moving From FreeBSD To Debian
by Lawrence D'Oliveiro 09 Apr '24

09 Apr '24

TrueNAS, makers of a turnkey system installation designed for NAS servers, announced close to a month ago that they were changing the emphasis in their product development from “TrueNAS CORE” (which is FreeBSD-based) to “TrueNAS SCALE” (which is Linux-based, specifically Debian-based) <https://www.theregister.com/2024/03/18/truenas_abandons_freebsd/>. This article <https://blocksandfiles.com/2024/04/08/ixsystems-no-one-is-getting-marooned/> gives some more background on the move: Kris Moore, SVP for engineering, told us: “Upstream has shifted. So first of all, ZFS, that’s kind of the heart and soul of TrueNAS and was for FreeNAS as well. Most of that [development] work takes place on Linux these days; features testing, all that happens on Linux. FreeBSD is the thing you port to and you’re done. So that momentum has moved.” ... “We had a huge chunk of our engineering staff spending time improving FreeBSD as opposed to working on features and functionalities. What’s happened now with the transition to having a Debian basis, the people I used to have 90 percent of their time working on FreeBSD, they’re working on ZFS features now … That’s what I want to see; value add for everybody versus sitting around, implementing something Linux had a years ago.” The irony in that is, ZFS was deliberately released by Sun (now Oracle) under a licence that is designed to be incompatible with the GPL that covers the Linux kernel. If you want to argue otherwise, consider that Oracle still refuses to include ZFS with its own Linux distro, preferring to offer you btrfs instead. Of course, you could also view that as a sign of a lack of confidence in its own home-grown filesystem ...

1 0

MIT License text becomes viral “sad girl” piano ballad generated by AI
by Peter Reutemann 09 Apr '24

09 Apr '24

'We've come a long way since primitive AI music generators in 2022. Today, AI tools like Suno.ai allow any series of words to become song lyrics, including inside jokes (as you'll see below). On Wednesday, prompt engineer Riley Goodside tweeted an AI-generated song created with the prompt "sad girl with piano performs the text of the MIT License," and it began to circulate widely in the AI community online.' -- source: https://arstechnica.com/information-technology/2024/04/mit-license-text-bec… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0