- wlug - list.wlug.org.nz

German state gov. ditching Windows for Linux, 30K workers migrating
by Peter Reutemann 08 Apr '24

08 Apr '24

''Schleswig-Holstein, one of Germany’s 16 states, on Wednesday confirmed plans to move tens of thousands of systems from Microsoft Windows to Linux. The announcement follows previously established plans to migrate the state government off Microsoft Office in favor of open source LibreOffice. As spotted by The Document Foundation, the government has apparently finished its pilot run of LibreOffice and is now announcing plans to expand to more open source offerings. In 2021, the state government announced plans to move 25,000 computers to LibreOffice by 2026. At the time, Schleswig-Holstein said it had already been testing LibreOffice for two years. -- source: https://arstechnica.com/information-technology/2024/04/german-state-gov-dit… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenBSD 7.5 Released
by Peter Reutemann 08 Apr '24

08 Apr '24

'Slashdot reader Mononymous writes: The latest release of OpenBSD, the FOSS Unix-like operating system focused on correctness and security over features and performance, has been released. This version includes newer driver support, performance improvements, stability fixes, and lots of package updates. One highlight is a complete port of KDE Plasma 5. You can view the announcement and get the bits at OpenBSD.org. Phoronix reports that with OpenBSD 7.5 "there is a number of improvements for ARM (AArch64) hardware, never-ending kernel optimizations and other tuning work, countless package updates, and other adjustments to this popular BSD platform."' -- source: https://tech.slashdot.org/story/24/04/06/0519207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tip For Repairing Ancient Linux Installations
by Lawrence D'Oliveiro 02 Apr '24

02 Apr '24

Here’s the scenario: there is a malfunctioning server running a really ancient Linux installation (e.g. 2.6.x-series kernel). You boot up with a reasonably recent copy of SystemRescue, mount the machine’s filesystem, try to chroot into it and run a shell ... and it segfaults. Seems there has been a subtle incompatible change in Linux kernel behaviour since those times, to do with the disabling of something called the “vsyscall” mechanism (which is specific to 64-bit x86-based machines, I understand). This was supposed to be a way to speed up certain commonly-executed system calls (I think getting the system time was one of them) by allowing direct transfers to certain entry points with fixed memory addresses for invoking them. It was later decided this was a bad idea (I think for security reasons). The mechanism has not been completely removed (yet), but nowadays it is disabled by default. To get around this, you need to boot SystemRescue with a change to the kernel command-line parameters, adding this item vsyscall=emulate After you get to a shell, you can confirm that this setting is in effect by checking the /proc/self/maps file (the memory mappings for your own process). At the bottom, there should be an entry with “[vdso]” in it, and below that another line with “[vsyscall]”. The presence of the latter line indicates that vsyscall emulation is in effect. This is not present when I check a process on my own machine, for example. Linus is legendary for being a stickler for never, ever breaking backward compatibility for userland. So the reasons for turning this off must have been pretty compelling, for him to agree to it. But the compromise is, it’s still there to be enabled if you really, really need it. There’s a bit more technical info here <https://0xax.gitbooks.io/linux-insides/content/SysCall/linux-syscall-3.html>, if you are interested. By the way, the above page is part of a book beginning here <https://0xax.gitbooks.io/linux-insides/content/>, about the insides of the Linux kernel. The whole book seems to be accessible from that link, but if you step up a level, the site doesn’t seem to have any idea about the existence of that book.

3 4

Uncle Sam’s Had It Up To Here With “Unforgivable” SQL Injection Flaws
by Lawrence D'Oliveiro 27 Mar '24

27 Mar '24

We all know SQL injection attacks are an ongoing problem <https://www.theregister.com/2024/03/26/fbi_cisa_sql_injection/>. What interested me about this article is this part: Software vendors have been advised to use parameterized queries with prepared statements to mitigate SQL injection vulnerabilities. According to the authorities, these allow user-input data to be separated from SQL queries and "better embody a secure by design approach" compared to input sanitization techniques. These are deployed by some vendors, but were branded "brittle" by CISA and the FBI. They said they're also difficult to deploy on a large scale and are more easily bypassed. Funny, that. Every time I post examples of how I dynamically construct SQL query strings with proper quoting of user input, I get yelled at and told to use “parameterized queries” and “prepared statements”, or even an ORM. Yet here we have the security experts saying that that is not a good solution, just like I thought all along.

1 0

Mozilla’s privacy service drops a provider with ties to people-search sites
by Peter Reutemann 26 Mar '24

26 Mar '24

'Mozilla's Monitor Plus, a service launched by the privacy-minded tech firm in February, notes on its pitch page that there is "a $240 billion industry of data brokers selling your private information for profit" and that its offering can "take back your privacy." Mozilla's most recent move to protect privacy has been to cut out one of the key providers of Monitor Plus' people-search protections, Onerep. That comes after reporting from security reporter Brian Krebs, who uncovered Onerep CEO and founder Dimitri Shelest as the founder of "dozens of people-search services since 2010," including one, Nuwber, that still sells the very kind of "background reports" that Monitor Plus seeks to curb. Shelest told Krebs in a statement (PDF) that he did have an ownership stake in Nuwber, but that Nuwber has "zero cross-over or information-sharing with Onerep" and that he no longer operates any other people-search sites. Shelest admitted the bad look but said that his experience with people search gave Onerep "the best tech and team in the space." Brandon Borrman, vice president of communications at Mozilla, said in a statement that while "customer data was never at risk, the outside financial interests and activities of Onerep’s CEO do not align with our values." Mozilla is "working now to solidify a transition plan," Borrman said. A Mozilla spokesperson confirmed to Ars today that Mozilla is continuing to offer Monitor Plus, suggesting no pause in subscriptions, at least for the moment.' -- source: https://arstechnica.com/gadgets/2024/03/mozillas-privacy-service-drops-a-pr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

decrypting PDFs
by Peter Reutemann 22 Mar '24

22 Mar '24

Hi everyone I've long had a problem with being unable to open some PDFs that could be either viewed on Windows or on Google Drive. For some reason, some PDFs appear to be encrypted (but not requiring a password??). Today, I found an approach that allows me to access these files also on my Linux machine using pdftk. pdftk allows you to decrypt PDFs by supplying a password (https://www.ubuntumint.com/remove-password-from-pdf-on-linux/) pdftk <protected>.pdf input_pw <password> output <new>.pdf However, the following seemed to work on these weird PDF files, without having to supply a password: pdftk <protected>.pdf output <new>.pdf And now my PDF viewers (okular, xreader, etc) no longer complain that they can't open the file. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Formula 1 Chief Appalled to Find Team Using Excel to Manage 20,000 Car Parts
by Lawrence D'Oliveiro 21 Mar '24

21 Mar '24

<https://arstechnica.com/cars/2024/03/formula-1-chief-appalled-to-find-team-…>: The Williams car build workbook, with roughly 20,000 individual parts, was "a joke," Vowles recently told The Race. "Impossible to navigate and impossible to update." This colossal Excel file lacked information on how much each of those parts cost and the time it took to produce them, along with whether the parts were already on order. ... Banks cited Tim Worstall's 2013 contention that Excel could be "the most dangerous software on the planet." Back then, international investment bankers were found manually copying and pasting Excel between Excel sheets to do their work, and it raised alarm.

1 0

Database-Based Operating System 'DBOS' Does Things Linux Can't
by Peter Reutemann 19 Mar '24

19 Mar '24

'Databricks CTO Matei Zaharia "said that Databricks had to keep track of scheduling a million things," remembers adjunct MIT professor Michael Stonebraker. " He said that this can't be done with traditional operating system scheduling, and so this was done out of a Postgres database. And then he started to whine that Postgres was too slow, and I told him we can do better than that...." This resulted in DBOS — short for "database operating system" — which they teamed up to build with teams Stanford and MIT, according to The Next Platform: They founded a company to commercialize the idea in April 2023 and secured $8.5 million initial seed funding to start building the real DBOS. Engine Ventures and Construct Capital led the funding, along with Sinewave and GutBrain Ventures... "The state that the operating system has to keep track of — memory, files, messages, and so on — is approximately linear to the resources you have got," says Stonebraker. "So without me saying another word, keeping track of operating system state is a database problem not addressed by current operating system schedulers. Moreover, OLTP [Online Transaction Processing] database performance has gone up dramatically, and that is why we thought instead of running the database system in user space on top of the operating system, why don't we invert our thinking 180 degrees and run the operating system on top of the database, with all of the operating services are coded in SQL...?" For now, DBOS can give the same kind of performance as that full blown Linux operating system, and thanks to the distributed database underpinnings of its kernel, it can do things that a Linux kernel just cannot do... One is provide reliable execution, which means that if a program running atop DBOS is ever interrupted, it starts where it left off and does not have to redo its work from some arbitrary earlier point and does not crash and have to start from the beginning. And because every little bit of the state of the operating system — and therefore the applications that run atop it — is preserved, you can go backwards in time in the system and restart the operating system if it experiences some sort of anomaly, such as a bad piece of application software running or a hack attack. You can use this "time travel" feature, as Stonebraker calls it, to reproduce what are called heisenbugs — ones that are very hard to reproduce precisely because there is no shared state in the distributed Linux and Kubernetes environment and that are increasingly prevalent in a world of microservices. The other benefit of the DBOS is that it presents a smaller attack surface for hackers, which boosts security, and that you analyze the metrics of the operating system in place since they are already in a NoSQL database that can be queried rather than aggregating a bunch of log files from up and down the software stack to try to figure out what is going on... There is also a custom tier for DBOS, which we presume costs money, that can use other databases and datastores for user application data, stores more than three days of log data, can have multiple users per account, that adds email and Slack support with DBOS techies, and that is available on other clouds as well as AWS. The operating system kernel/scheduler "is itself largely a database," with services written in TypeScript, according to the article. The first iteration used the FoundationDB distributed key-value store for its scheduling core (open sourced by Apple in 2018), according to the article — "a blazingly fast NoSQL database... Stonebraker says there is no reason to believe that DBOS can't scale across 1 million cores or more and support Java, Python, and other application languages as they are needed by customers..." And the article speculates they could take things even further. "There is no reason why DBOS cannot complete the circle and not only have a database as an operating system kernel, but also have a relational database as the file system for applications."' -- source: https://developers.slashdot.org/story/24/03/18/0038232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Ends its Privacy-Friendly GPS-Style Location Service
by Peter Reutemann 18 Mar '24

18 Mar '24

'Mozilla Location Service offered "a free, open way to offer GPS-style location detection features" for developers on devices without GPS hardware, remembers the Linux blog OMG Ubuntu. It used signals like Wi-Fi access points and Bluetooth beacons "without any of the privacy implications most competing geolocation services have." But Friday they reported that Mozilla "has announced it is ending access to Mozilla Location Service (MLS), which provides accurate, privacy-respecting, and crowdsourced geolocation data." Developers and 3rd-party projects that use MLS to detect a users' location, such as the freedesktop.org location framework GeoClue, which is used by apps like GNOME Maps and Weather, have only a few months left to continue using the service... In late March, POST data submissions will return 403 responses. Finally, on June 12, all 3rd-party API keys will be removed and MLS data only accessible by Mozilla... MLS' accuracy has declined in recent years. Patent infringement claims in 2019 saw Mozilla reach a settlement to avoid litigation. As part of that settlement it was forced to make changes to MLS that impacted its ability to invest in (commercially exploit?) and improve the service. The article notes that GeoClue "already supports multiple location detection methods, including IP-based ones," so it should continue operating. "But the sad reality is that there just aren't a lot of free, open, privacy-friendly, accurate, and (rather importantly for a framework built in to Linux desktops) reliable alternatives to Mozilla Location Services, which has built up a colossal 'signal map' from which to pinpoint locations." "We are grateful for the contributions of the community to MLS to both the code and the dataset," a Mozilla senior engineering manager said in a statement.' -- source: https://tech.slashdot.org/story/24/03/17/2150221/mozilla-ends-its-privacy-f… I wasn't even aware that Mozilla was offering such a service... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

1986 Presentation On Setting A Computer’s Clock Correctly
by Lawrence D'Oliveiro 18 Mar '24

18 Mar '24

One of the recent additions to the Bitsavers vintage computing collection is this presentation from 1986 <http://bitsavers.trailing-edge.com/pdf/ibm/share/SHARE67_Presentation_on_Se…> at a session of SHARE (one of the IBM user groups), on how to ensure your computer’s time is set correctly. Remember, this was before NTP. But there was already a worldwide network of atomic clocks, keeping synchronization with each other, and there were shortwave stations, like WWV in Boulder, Colorado, that would broadcast pips once per second, synchronized to the atomic clock network. And there were even consumer-level gadgets, like the one mentioned in the article from Heath, that would automatically decode those broadcasts and output a time code a computer could read. The article has some nice background info. Like did you know there can be up to a 1-second discrepancy between GMT and UTC? (Actually I think from other sources the limit might be more like 0.9 seconds.) IBM’s mainframe OS developers were perceptive enough to realize that it can be useful to have the computer keep time in GMT, and maintain an offset for calculating local time. Particular site admins could of course have the choice of using local time for the system time, and setting the offset to zero. Changing the offset for daylight saving could be a fraught procedure, though. The level of confusion it could cause for running applications was such that it was safer to do a reboot. One little item I don’t recall coming across before, another of those NASA programming screwups: One of the famous programming mistakes of all time was by the programmer who thought the earth revolved on its axis once every 24 hours and used that fact to calculate landing sites for the Mercury space flights. Our first astronauts spent a lot more time in the water than they should have because of that.

1 0

Free/Libre 'GnuCOBOL' Compiler Reaches Maturity, Can Compete with Proprietary Offerings
by Peter Reutemann 18 Mar '24

18 Mar '24

'After 20 years of development, the open source GnuCOBOL "has reached an industrial maturity and can compete with proprietary offers in all environments," said OCamlPro founder and GnuCOBOL contributor Fabrice Le Fessant, in a FOSDEM talk about the technology. GnuCOBOL turns COBOL source code into executable applications. It is very cross-platform, running Linux, BSD, many proprietary Unixes, macOS, and Windows, even Android. And the latest version, v.32, is being used in many commercial settings... Sobisch noted that the GnuCOBOL is seeing a lot of commercial deployments, such as for banking back-end apps, many of which are being migrated from Micro Focus, with users reporting performance improvements as a result. The French DGFIP federal agency moved from a GCOS mainframe to GnuCOBOL, with the help of Le Fessant's firm. Originally called OpenCOBOL, the project was started in 2002 and renamed GnuCOBOL in 2013. In the past three years, it has received attention from 13 contributors with 460 commits. Most Linux package managers have a copy of GnuCOBOL for the program for downloading... It can compile to C code (C89+), making it extremely portable, from mainframes to Raspberry Pi's, Sobisch said... Also new is SuperBOL, a development studio for GnuCOBOL developed by Le Fessant's OCamlPro. It runs as a VSCode Extension and features a full COBOL processor (written in OCaml). ' -- source: https://developers.slashdot.org/story/24/03/17/1810257 Anything COBOL related takes time, I guess... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Raspberry Pi OS Is Now Powered by Linux 6.6 LTS, Improves Raspberry Pi 5 Support
by Peter Reutemann 15 Mar '24

15 Mar '24

'The Raspberry Pi Foundation released today a new build of their Debian-based Raspberry Pi OS operating for the Raspberry Pi single-board computers adding a new kernel from the Linux 6.6 long-term supported series, updated components, and various improvements. While still based on the latest Debian GNU/Linux 12 “Bookworm” operating system series, Raspberry Pi OS is now powered by the Linux 6.6 LTS kernel series, which is a major upgrade from Linux kernel 6.1 LTS used in previous releases. This update also includes the latest Chromium 122 and Mozilla Firefox 123 web browsers. The new Raspberry Pi OS release offers better support for the latest Raspberry Pi 5 SBC by improving the handling of the power button. In addition, it also adds new settings for headless resolution to the Screen Configuration, while removing the setting of headless resolution for Wayland from Raspberry Pi Configuration.' -- source: https://9to5linux.com/raspberry-pi-os-is-now-powered-by-linux-6-6-lts-impro… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Never-before-seen Linux malware gets installed using 1-day exploits
by Peter Reutemann 12 Mar '24

12 Mar '24

'Researchers have unearthed Linux malware that circulated in the wild for at least two years before being identified as a credential stealer that’s installed by the exploitation of recently patched vulnerabilities. The newly identified malware is a Linux variant of NerbianRAT, a remote access Trojan first described in 2022 by researchers at security firm Proofpoint. Last Friday, Checkpoint Research revealed that the Linux version has existed since at least the same year, when it was uploaded to the VirusTotal malware identification site. Checkpoint went on to conclude that Magnet Goblin—the name the security firm uses to track the financially motivated threat actor using the malware—has installed it by exploiting “1-days,” which are recently patched vulnerabilities. Attackers in this scenario reverse engineer security updates, or copy associated proof-of-concept exploits, for use against devices that have yet to install the patches. Checkpoint also identified MiniNerbian, a smaller version of NerbianRAT for Linux that’s used to backdoor servers running the Magento ecommerce server, primarily for use as command and control servers that devices infected by NerbianRAT connect to. Researchers elsewhere have reported encountering servers that appear to have been compromised with MiniNerbian, but Checkpoint Research appears to have been the first to identify the underlying binary.' -- source: https://arstechnica.com/security/2024/03/never-before-seen-linux-malware-ge… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.9 Will Be the First To Top 10 Million Git Objects
by Peter Reutemann 12 Mar '24

12 Mar '24

'Linus Torvalds has released version 6.8 of the Linux Kernel. "So it took a bit longer for the commit counts to come down this release than I tend to prefer," Torvalds wrote on the Linx kernel mailing list on Sunday, "but a lot of that seemed to be about various selftest updates (networking in particular) rather than any actual real sign of problems." "And the last two weeks have been pretty quiet, so I feel there's no real reason to delay 6.8." So he delivered it, ending his own speculation that this cut of the kernel might need an eighth release candidate. Torvalds found time to note what he described as "a bit of random git numerology" as when work ended on this version of the kernel the git repository used to track it contained 9.996 million objects." "This is the last mainline kernel to have less than ten million git objects," Torvalds wrote. "Of course, there is absolutely nothing special about it apart from a nice round number. Git doesn't care," he added. Fair enough -- especially as noted that other trees, such as linux-next, have well and truly passed ten million objects.' -- source: https://linux.slashdot.org/story/24/03/11/1620223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Do Scientists Take Backups?
by Lawrence D'Oliveiro 11 Mar '24

11 Mar '24

Martin Eve, who works at Crossref, which manages the DOI system which tries to offer permanent online links to scientific publications and other digital documents, decided to do a survey of those links, to see how many of them would still actually resolve. The results were less than reassuring <https://arstechnica.com/science/2024/03/study-finds-that-we-could-lose-scie…>. If/when a publisher goes bankrupt, what happens to their online archives? Do researchers who submit papers keep backup copies of their papers?

3 6

It’s A Raspberry Pi!
by Lawrence D'Oliveiro 08 Mar '24

08 Mar '24

Was anybody watching Channel 200 (Juice TV) a minute ago? There was a lovely Linux text screen with a shell prompt saying the machine name was “pberrypi”.

1 1

“We Had To Educate Oracle About Our Contract”
by Lawrence D'Oliveiro 08 Mar '24

08 Mar '24

Slightly chilling words to hear, don’t you think? Corporations that do volume deals with proprietary suppliers like Oracle and SAP have to agree to allow periodic audits by the vendor to ensure they are complying with the licence terms. Vendors have been known to try to pull a fast one during these audits. This customer <https://www.theregister.com/2024/03/06/oracle_audits/> mentions that Oracle, in particular, had a tendency to assume the software was licensed under their current terms, when in fact the contract was agreed under quite different, older terms. Hence the need to keep “educating” (i.e. reminding) the vendor about what the correct criteria were.

1 0

Fedora Workstation 41 To No Longer Install GNOME X.Org Session By Default
by Peter Reutemann 08 Mar '24

08 Mar '24

'Michael Larabel writes via Phoronix: Fedora Workstation has long defaulted to using GNOME's Wayland session by default, but it has continued to install the GNOME X.Org session for fallback purposes or those opting to use it instead. But for the Fedora Workstation 41 release later in the year, there is a newly-approved plan to no longer have that GNOME X.Org session installed by default. Recently there was a Fedora Workstation ticket opened to no longer install the GNOME X.Org session by default. This is just about whether the X.Org session is pre-installed but would continue to live in the repository for those wanting to explicitly install it. The Fedora Workstation working group decided to go ahead with this change for the Fedora 41 cycle, not the upcoming Fedora 40 release. So pending any obstacles by FESCo, which is unlikely. Fedora Workstation 41 will not be installing the GNOME X.Org session by default. Long live Wayland.' -- source: https://news.slashdot.org/story/24/03/07/2157258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to Run Android Applications on Ubuntu with Waydroid
by Peter Reutemann 06 Mar '24

06 Mar '24

'Waydroid is an excellent tool that lets you access Android apps like native applications on your Linux machine, following a container-based philosophy similar to the Android subsystem in Windows and capable of booting the full Android system. It has access to Linux namespaces (user, pid, uts, net, mount, ipc), and within the container, Android has direct access to the system hardware. Currently, the provided Android OS will be based on Lineage OS 21 (Android 11), so certain discontinued apps might not work.' -- source: https://ubuntushell.com/install-waydroid/ The article has step-by-step instructions. Looks like an interesting tool! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Opus 1.5 Gets a Serious Machine Learning Upgrade
by Peter Reutemann 05 Mar '24

05 Mar '24

'Longtime Slashdot reader jmv writes: After more than two years of work, Opus 1.5 is out. It brings many new features that can improve quality and the general audio experience through machine learning, while maintaining fully-compatibility with previous releases. See this release page demonstrating all the new features, including: - Significant improvement to packet loss robustness using Deep Redundancy (DRED) - Improved packet loss concealment through Deep PLC - Low-bitrate speech quality enhancement down to 6 kb/s wideband - Improved x86 (AVX2) and Arm (Neon) optimizations - Support for 4th and 5th order ambisonics' -- source: https://news.slashdot.org/story/24/03/04/2126211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Passes 4% Desktop Market Share
by Peter Reutemann 05 Mar '24

05 Mar '24

'"Linux gained from 3% to 4% in 8 months," writes longtime Slashdot reader bobdevine. Linuxiac reports: According to the latest data from StatCounter, a leading web traffic analysis tool, Linux's market share has reached 4.03%. At first glance, the number might seem modest, but it represents a significant leap. Let's break it down. It took Linux 30 years to secure a 3% share of desktop operating systems, a milestone reached last June. Impressively, the open-source operating system has surged by an additional 1% in the last eight months.' -- source: https://linux.slashdot.org/story/24/03/04/2159239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

French Court Issues Damages Award For Violation of GPL
by Peter Reutemann 04 Mar '24

04 Mar '24

'Some news from "Copyleft Currents", the blog of open-source/IP lawyer Heather Meeker: On February 14, 2024, the Court of Appeal of Paris issued an order stating that Orange, a major French telecom provider, had infringed the copyight of Entr'Ouvert's Lasso software and violated the GPL. They ordered Orange to pay €500,000 in compensatory damages and €150,000 for moral damages. This case has been ongoing for many years. Entr'ouvert is the publisher of Lasso, a reference library for the Security Assertion Markup Language (SAML) protocol, an open standard for identity providers to authenticate users and pass authentication tokens to online services. This is the open protocol that enables single sign-on (SSO). The Lasso product is dual licensed by Entr'Ouvert under GPL or commercial licenses. In 2005, Orange won a contract with the French Agency for the Development of Electronic Administration to develop parts of the service-public.fr portal, which allows users to interact online with the government for administrative procedures. Orange used the Lasso software in the solution, but did not pass on the rights to its modifications free of charge under GPL, or make the source code to its modifications available. Entr'Ouvert sued Orange in 2010, and the case wended its way through the courts, turning on, among other things, issues of proof of Entr'Ouvert 's copyright interest in the software, and whether the case properly sounded in breach of contract or copyright infringement... The compensatory damages were based on both lost profits of the plaintiff and disgorgement of profits of Orange. Moral damages compensate the plaintiff for harm to reputation or other non-monetary injury.' -- source: https://news.slashdot.org/story/24/03/03/030200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rentware Comes To Hardware
by Lawrence D'Oliveiro 01 Mar '24

01 Mar '24

You already have companies like Adobe and Autodesk making their software subscription-only, so you have to keep paying to use it; now HP is bringing the same idea to its printers <https://arstechnica.com/gadgets/2024/02/hp-wants-you-to-pay-up-to-36-month-…>. You pay a monthly fee (inclusive of ink as well as printer rental), and you get to print a certain number of pages each month. This will require an always-on Internet connection, so HP can monitor your printer. This will allow them to collect information, not just on ink levels, but on what kind of printing you are doing, even the applications you are using. How would you like to “never own a printer again”? (Their tag line.) I suppose you should be grateful they aren’t requiring you to buy their paper as well. At least, not yet ...

1 0

'Paying People To Work on Open Source is Good Actually'
by Peter Reutemann 01 Mar '24

01 Mar '24

'Jacob Kaplan-Moss, one of the lead developers of Django, writes in a long post that he says has come from a place of frustration: [...] Instead, every time a maintainer finds a way to get paid, people show up to criticize and complain. Non-OSI licenses "don"t count" as open source. Someone employed by Microsoft is "beholden to corporate interests" and not to be trusted. Patreon is "asking for handouts." Raising money through GitHub sponsors is "supporting Microsoft's rent-seeking." VC funding means we're being set up for a "rug pull" or "enshitification." Open Core is "bait and switch." None of this is hypothetical; each of these examples are actual things I've seen said about maintainers who take money for their work. One maintainer even told me he got criticized for selling t-shirts! Look. There are absolutely problems with every tactic we have to support maintainers. It's true that VC investment comes with strings attached that often lead to problems down the line. It sucks that Patreon or GitHub (and Stripe) take a cut of sponsor money. The additional restrictions imposed by PolyForm or the BSL really do go against the Freedom 0 ideal. I myself am often frustrated by discovering that some key feature I want out of an open core tool is only available to paid licensees. But you can criticize these systems while still supporting and celebrating the maintainers! Yell at A16Z all you like, I don't care. (Neither do they.) But yelling at a maintainer because they took money from a VC is directing that anger in the wrong direction. The structural and societal problems that make all these different funding models problematic aren't the fault of the people trying to make a living doing open source. It's like yelling at someone for shopping at Dollar General when it's the only store they have access to. Dollar General's predatory business model absolutely sucks, as do the governmental policies that lead to food deserts, but none of that is on the shoulders of the person who needs milk and doesn't have alternatives.' -- source: https://news.slashdot.org/story/24/02/29/0746221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

HDMI Forum Rejects Open-Source HDMI 2.1 Driver Support Sought By AMD
by Peter Reutemann 01 Mar '24

01 Mar '24

'Michael Larabel, reporting at Phoronix: One of the limitations of AMD's open-source Linux graphics driver has been the inability to implement HDMI 2.1+ functionality on the basis of legal requirements by the HDMI Forum. AMD engineers had been working to come up with a solution in conjunction with the HDMI Forum for being able to provide HDMI 2.1+ capabilities with their open-source Linux kernel driver, but it looks like those efforts for now have concluded and failed. For three years there has been a bug report around 4K(a)120Hz being unavailable via HDMI 2.1 on the AMD Linux driver. Similarly, there have been bug reports like 5K @ 240Hz not possible either with the AMD graphics driver on Linux. As covered back in 2021, the HDMI Forum closing public specification access is hurting open-source support. AMD as well as the X.Org Foundation have been engaged with the HDMI Forum to try to come up with a solution to be able to provide open-source implementations of the now-private HDMI specs. AMD Linux engineers have spent months working with their legal team and evaluating all HDMI features to determine if/how they can be exposed in their open-source driver. AMD had code working internally and then the past few months were waiting on approval from the HDMI Forum. Sadly, the HDMI Forum has turned down AMD's request for open-source driver support.' -- source: https://it.slashdot.org/story/24/02/29/076217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cloudflare Makes Pingora Rust Framework Open-Source
by Peter Reutemann 29 Feb '24

29 Feb '24

'Michael Larabel reports via Phoronix: Back in 2022 Cloudflare announced they were ditching Nginx for an in-house, Rust-written software called Pingora. Today Cloudflare is open-sourcing the Pingora framework. Cloudflare announced today that they have open-sourced Pingora under an Apache 2.0 license. Pingora is a Rust async multi-threaded framework for building programmable network services. Pingora has long been used internally within Cloudflare and is capable of sustaining a lot of traffic while now Pingora is being open-sourced for helping to build infrastructure outside of Cloudflare.' -- source: https://news.slashdot.org/story/24/02/28/2352248 -- github: https://github.com/cloudflare/pingora Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 6 Released
by Peter Reutemann 29 Feb '24

29 Feb '24

'"Today, the KDE Community is announcing a new major release of Plasma 6.0 and Gear 24.02," writes longtime Slashdot reader jrepin. "The new version brings new windows and desktop overview effects, improved color management, a cleaner theme, better overall performance, and much more." From the announcement: KDE Plasma is a modern, feature-rich desktop environment for Linux-based operating systems. Known for its sleek design, customizable interface, and extensive set of applications, it is also open source, devoid of ads, and makes protecting your privacy and personal data a priority. With Plasma 6, the technology stack has undergone two major upgrades: a transition to the latest version of the application framework, Qt 6, and a migration to the modern Linux graphics platform, Wayland. We will continue providing support for the legacy X11 session for users who prefer to stick with it for now. [...] KDE Gear 24.02 brings many applications to Qt 6. In addition to the changes in Breeze, many applications adopted a more frameless look for their interface.' -- source: https://tech.slashdot.org/story/24/02/28/2137237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub besieged by millions of malicious repositories in ongoing attack
by Peter Reutemann 29 Feb '24

29 Feb '24

'GitHub is struggling to contain an ongoing attack that’s flooding the site with millions of code repositories. These repositories contain obfuscated malware that steals passwords and cryptocurrency from developer devices, researchers said. The malicious repositories are clones of legitimate ones, making them hard to distinguish to the casual eye. An unknown party has automated a process that forks legitimate repositories, meaning the source code is copied so developers can use it in an independent project that builds on the original one. The result is millions of forks with names identical to the original one that add a payload that’s wrapped under seven layers of obfuscation. To make matters worse, some people, unaware of the malice of these imitators, are forking the forks, which adds to the flood.' -- source: https://arstechnica.com/security/2024/02/github-besieged-by-millions-of-mal… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Open Documentation Academy' Offers On-Ramp To OSS
by Peter Reutemann 28 Feb '24

28 Feb '24

'"Documentation authors at Canonical have launched the Open Documentation Academy to offer an easy way to get started contributing to open-source projects," writes longtime Slashdot reader tykev. From the blog post: Open and inclusive collaboration, and the sharing of ideas, remains the best way to develop software (and to do many other things!), but we also recognise that this "getting involved" step can be difficult. Where do you start? Who do you ask? What needs to be done? We all very much want to help people become open source contributors by building an on-ramp process. It may take some time, and we will need to adapt, but this is exactly why we've started our Open Documentation Academy. To help you get involved, the Open Documentation Academy provides a curated list of documentation tasks. Choose one, let us know, and get started. Tasks include testing and fixing tutorials, updating the outdated, restructuring large documents, and anything else you may want to suggest. Our list is growing, and a big part of the Documentation Academy will be ensuring there's always a wide range of tasks available, across as many projects and technologies as possible. And of course, we're here to help. We'll guide you through your first contributions, provide advice on approaches, and help you build your confidence. ' -- source: https://news.slashdot.org/story/24/02/28/0024205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tumblr and Wordpress Are Preparing To Sell User Data To OpenAI and Midjourney, Report Says
by Peter Reutemann 28 Feb '24

28 Feb '24

'Tumblr and Wordpress are preparing to sell user data to Midjourney and OpenAI, 404Media reported Tuesday, citing a source with internal knowledge about the deals and internal documents. From the report: The exact types of data from each platform going to each company are not spelled out in documentation we've reviewed, but internal communications reviewed by 404 Media make clear that deals between Automattic, the platforms' parent company, and OpenAI and Midjourney are imminent. The internal documentation details a messy and controversial process within Tumblr itself. One internal post made by Cyle Gage, a product manager at Tumblr, states that a query made to prepare data for OpenAI and Midjourney compiled a huge number of user posts that it wasn't supposed to. It is not clear from Gage's post whether this data has already been sent to OpenAI and Midjourney, or whether Gage was detailing a process for scrubbing the data before it was to be sent. ' -- source: https://news.slashdot.org/story/24/02/27/191230 Now's the time to move from hosted to self-hosted Wordpress instances, I guess... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

US Government Demands Memory-Safe Programming Languages
by Lawrence D'Oliveiro 28 Feb '24

28 Feb '24

The US Office of the National Cyber Director has put out a report on “a path towards secure and measurable software” <https://devclass.com/2024/02/27/white-house-demands-memory-safe-programming…>. It talks a lot about memory safety, including hardware techniques such as the old “capabilities” idea being resurrected in the CHERI project. And the Rust Foundation has chimed in with some comments about use of their language which is specifically designed to enforce memory safety. But a group of C++ fans has counterclaimed that memory safety is only “a very small part of security”, and that “C++ benefits from having a formal specification, a fully-specified memory model, and an active community of users and implementers”, and that education can improve the quality of code written in C and C++. It also tries to imply that Rust is somehow less desirable because it lacks a formal specification.

1 0

Is Windows 64-Bit Yet?
by Lawrence D'Oliveiro 27 Feb '24

27 Feb '24

Given that 64-bit Windows has been shipping for so long, you would think most Windows software, particularly Microsoft’s own software, would have made the transition from 32-bit long ago. After all, on a typical 64-bit Linux system, everything is 64-bit, and has been that way since the early days. So I was mildly surprised to discover that Visual Studio only became 64-bit in November 2021. And today I am even more surprised to discover that the change broke its own Windows Forms framework, and a fix is still not available to this day <https://devclass.com/2024/02/26/microsoft-struggles-to-address-fallout-from…>.

1 0

The State Of IoT
by Lawrence D'Oliveiro 23 Feb '24

23 Feb '24

This backflip from Microsoft <https://www.theregister.com/2024/02/21/microsoft_azure_iot_central/> retracting an earlier announcement that seemingly undermined a major part of its “Internet-of-Things” efforts seems to do little to clear the confusion. I found this part of the report quite revealing: The insider also pointed out that vendors struggle to produce value for organizations developing and deploying IoT applications. While the industry underestimated the scale of the challenge in connecting thousands of sensors, each of which could generate 86,400 values per day, it also failed to form a commercial model that worked for everyone. Vendors were focused only on owning the platform and were reluctant to build applications on anyone else's, creating a stalemate, the insider said. Meanwhile, the “maker” movement continues on its merry way, building its applications and toolkits on (and for) open-source platforms like the Raspberry Pi and Arduino, while completely failing to spend billions of dollars on proprietary products. And the proprietary companies can do nothing but search desperately for some lever that will give them that valuable vendor lock-in, but all they can achieve is wrestle each other to a stalemate. Me, I consider that a win-win situation. ;)

1 0

Linux Becomes a CVE Numbering Authority (Like Curl and Python). Is This a Turning Point?
by Peter Reutemann 19 Feb '24

19 Feb '24

'From a blog post by Greg Kroah-Hartman: As was recently announced, the Linux kernel project has been accepted as a CVE Numbering Authority (CNA) for vulnerabilities found in Linux. This is a trend, of more open source projects taking over the haphazard assignments of CVEs against their project by becoming a CNA so that no other group can assign CVEs without their involvment. Here's the curl project doing much the same thing for the same reasons. I'd like to point out the great work that the Python project has done in supporting this effort, and the OpenSSF project also encouraging it and providing documentation and help for open source projects to accomplish this. I'd also like to thank the cve.org group and board as they all made the application process very smooth for us and provided loads of help in making this all possible. As many of you all know, I have talked a lot about CVEs in the past, and yes, I think the system overall is broken in many ways, but this change is a way for us to take more responsibility for this, and hopefully make the process better over time. It's also work that it looks like all open source projects might be mandated to do with the recent rules and laws being enacted in different parts of the world, so having this in place with the kernel will allow us to notify all sorts of different CNA-like organizations if needed in the future. Kroah-Hartman links to his post on the kernel mailing list for "more details about how this is all going to work for the kernel." [D]ue to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team are overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team... No CVEs will be assigned for unfixed security issues in the Linux kernel, assignment will only happen after a fix is available as it can be properly tracked that way by the git commit id of the original fix. No CVEs will be assigned for any issue found in a version of the kernel that is not currently being actively supported by the Stable/LTS kernel team. alanw (Slashdot reader #1,822) worries this could overwhelm the CVE infrastructure, pointing to an ongoing discussion at LWN.net. But reached for a comment, Greg Kroah-Hartman thinks there's been a misunderstanding. He told Slashdot that the CVE group "explicitly asked for this as part of our application... so if they are comfortable with it, why is no one else?"' -- source: https://linux.slashdot.org/story/24/02/17/1811258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nginx core developer quits project in security dispute, starts “freenginx” fork
by Peter Reutemann 16 Feb '24

16 Feb '24

'A core developer of Nginx, currently the world's most popular web server, has quit the project, stating that he no longer sees it as "a free and open source project… for the public good." His fork, freenginx, is "going to be run by developers, and not corporate entities," writes Maxim Dounin, and will be "free from arbitrary corporate actions." Dounin is one of the earliest and still most active coders on the open source Nginx project and one of the first employees of Nginx, Inc., a company created in 2011 to commercially support the steadily growing web server. Nginx is now used on roughly one-third of the world's web servers, ahead of Apache. Nginx Inc. was acquired by Seattle-based networking firm F5 in 2019. Later that year, two of Nginx's leaders, Maxim Konovalov and Igor Sysoev, were detained and interrogated in their homes by armed Russian state agents. Sysoev's former employer, Internet firm Rambler, claimed that it owned the rights to Nginx's source code, as it was developed during Sysoev's tenure at Rambler (where Dounin also worked). While the criminal charges and rights do not appear to have materialized, the implications of a Russian company's intrusion into a popular open source piece of the web's infrastructure caused some alarm. Sysoev left F5 and the Nginx project in early 2022. Later that year, due to the Russian invasion of Ukraine, F5 discontinued all operations in Russia. Some Nginx developers still in Russia formed Angie, developed in large part to support Nginx users in Russia. Dounin technically stopped working for F5 at that point, too, but maintained his role in Nginx "as a volunteer," according to Dounin's mailing list post. Dounin writes in his announcement that "new non-technical management" at F5 "recently decided that they know better how to run open source projects. In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers' position." While it was "quite understandable," given their ownership, Dounin wrote that it means he was "no longer able to control which changes are made in nginx," hence his departure and fork.' -- source: https://arstechnica.com/information-technology/2024/02/nginx-key-developer-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Asahi Linux Project's OpenGL Support On Apple Silicon Officially Surpasses Apple's
by Peter Reutemann 16 Feb '24

16 Feb '24

'Andrew Cunningham reports via Ars Technica: For around three years now, the team of independent developers behind the Asahi Linux project has worked to support Linux on Apple Silicon Macs, despite Apple's total lack of involvement. Over the years, the project has gone from a "highly unstable experiment" to a "surprisingly functional and usable desktop operating system." Even Linus Torvalds has used it to run Linux on Apple's hardware. The team has been steadily improving its open source, standards-conformant GPU driver for the M1 and M2 since releasing them in December 2022, and today, the team crossed an important symbolic milestone: The Asahi driver's support for the OpenGL and OpenGL ES graphics have officially passed what Apple offers in macOS. The team's latest graphics driver fully conforms with OpenGL version 4.6 and OpenGL ES version 3.2, the most recent version of either API. Apple's support in macOS tops out at OpenGL 4.1, announced in July 2010. Developer Alyssa Rosenzweig wrote a detailed blog post that announced the new driver, which had to pass "over 100,000 tests" to be deemed officially conformant. The team achieved this milestone despite the fact that Apple's GPUs don't support some features that would have made implementing these APIs more straightforward. "Regrettably, the M1 doesn't map well to any graphics standard newer than OpenGL ES 3.1," writes Rosenzweig. "While Vulkan makes some of these features optional, the missing features are required to layer DirectX and OpenGL on top. No existing solution on M1 gets past the OpenGL 4.1 feature set... Without hardware support, new features need new tricks. Geometry shaders, tessellation, and transform feedback become compute shaders. Cull distance becomes a transformed interpolated value. Clip control becomes a vertex shader epilogue. The list goes on." Now that the Asahi GPU driver supports the latest OpenGL and OpenGL ES standards -- released in 2017 and 2015, respectively -- the work turns to supporting the low-overhead Vulkan API on Apple's hardware. Vulkan support in macOS is limited to translation layers like MoltenVK, which translates Vulkan API calls to Metal ones that the hardware and OS can understand. [...] Rosenzweig's blog post didn't give any specific updates on Vulkan except to say that the team was "well on the road" to supporting it. In addition to supporting native Linux apps, supporting more graphics APIs in Asahi will allow the operating system to take better advantage of software like Valve's Proton, which already has a few games written for x86-based Windows PCs running on Arm-based Apple hardware. ' -- source: https://linux.slashdot.org/story/24/02/15/021216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Maker Mozilla Is Cutting 60 Jobs After Naming New CEO
by Peter Reutemann 14 Feb '24

14 Feb '24

'Less than a week after naming Laura Chambers as interim CEO, Firefox's maker Mozilla said it is cutting about 60 jobs, or 5% of its workforce. The cuts are primarily in the product development organization. Bloomberg reports: "We're scaling back investment in some product areas in order to focus on areas that we feel have the greatest chance of success," Mozilla said in a statement. "We intend to re-prioritize resources against products like Firefox Mobile, where there's a significant opportunity to grow and establish a better model for the industry." Mozilla last cut a significant number of jobs four years ago at the height of the Covid-19 pandemic. The not-for-profit company, which competes with Alphabet Inc.'s Google Chrome, Apple Inc.'s Safari and Microsoft Corp.'s Edge, has been grappling with sliding market share of its Firefox web browser in recent years. So far in 2024, the tech sector has cut 32,000 jobs. ' -- source: https://news.slashdot.org/story/24/02/13/2137254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HPC Wiki
by Lawrence D'Oliveiro 14 Feb '24

14 Feb '24

Recently discovered this site <https://hpc-wiki.info/hpc/HPC_Wiki>, which gives some useful introductory info to those wanting to learn how to program a supercomputer (or just curious about the process). For example, here <https://hpc-wiki.info/hpc/MPI> is an intro to one parallelization architecture, called MPI, and here <https://hpc-wiki.info/hpc/OpenMP> is an intro to another one, called OpenMP. Note the examples are given in C and Fortran, and both rely heavily on preprocessors/compiler plugins in order to generate the right code. Yes, Fortran is still in heavy use, it seems. And if you learned your Fortran before the 1990s (as I did), you may not even recognize it as the same language.

1 0

'Damn Small Linux' is Back - But Bigger
by Peter Reutemann 13 Feb '24

13 Feb '24

'Back in 2006 Slashdot reported on a 50-megabyte "micro" distro called Damn Small Linux. (And in 2012 we wrote that it "rose from the dead" with a new release candidate.) Now Damn Small Linux has been reborn again, according to its developer's web site: Creating the original DSL, a versatile 50MB distribution, was a lot of fun and one of the things I am most proud of as a personal accomplishment. However, as a concept, it was in the right place at the right time, and the computer industry has changed a lot since then. While it would be possible to make a bootable Xwindows 50MB distribution today, it would be missing many drivers and have only a handful of very rudimentary applications. People would find such a distribution a fun toy or something to build upon, but it would not be usable for the average computer user out of the gate.... The new goal of DSL is to pack as much usable desktop distribution into an image small enough to fit on a single CD, or a hard limit of 700MB. This project is meant to service older computers and have them continue to be useful far into the future. Such a notion sits well with my values. I think of this project as my way of keeping otherwise usable hardware out of landfills. As with most things in the GNU/Linux community, this project continues to stand on the shoulders of giants. I am just one guy without a CS degree, so for now, this project is based on antiX 23 i386... a fantastic distribution that I think shares much of the same spirit as the original DSL project. AntiX shares pedigree with MEPIS and also leans heavily on the geniuses at Debian. The blog It's FOSS News describes it as "a unique experience in a sea of Debian-based and Fedora-based distros." It is offered with two window managers, Fluxbox and JWM, with apt being fully enabled by default for easy package installations... At the time of writing, only the Alpha ISOs were made available on the official downloads page. It is only a matter of time before we get a stable release.' -- source: https://linux.slashdot.org/story/24/02/11/2049252 I actually used DSL back in the day... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Mozilla's Abandoned Web Engine 'Servo' is Rebooting in 2024
by Peter Reutemann 12 Feb '24

12 Feb '24

'Remember "Servo," Mozilla's "next-generation browser engine," focused on performance and robustness? "The developers of Servo are starting 2024 by going all in..." reports It's FOSS News, citing a social media post from FOSDEM. "[T]he Servo Project team were there showing off the work done so far." If you were not familiar, Servo is an experimental browser engine that leverages the power of Rust to provide a memory-safe and modular experience that is highly adaptable. After Mozilla created Servo back in 2012 as a research project, it saw its share of ups and downs over the years, with it making a comeback in 2023; thanks to a fresh approach by the developers on how Servo should move forward. Even though there are plenty of open source Chrome alternatives, with this, there's a chance that we will get some really cool options based on Servo that just might give Blink and Gecko a run for the money! Just a few months back, in September 2023, after The Servo Project officially joined Linux Foundation Europe, the existing contributors from Igalia stepped up their game by taking over the project maintenance. To complement that, at Open Source Summit Europe last year, Manuel Rego from Igalia shared some really useful insights when he presented. He showcased stuff like the WebGL support, cross-platform support including mobile support for Android and Linux, among other things. They have experimented with Servo for embedded applications use-cases (like running it on Raspberry Pi), and have plans to make advances on it. As far as I can see, it looks like, Servo is faster for Raspberry Pi compared to Chromium. You can explore more such demos on Servo's demo webpage. 2024's roadmap includes "Initial Android support, that will see Servo being made to build on modern Android versions," according to the article, "with the developers publishing nightly APKs on the official website some time in the future." One fun fact? "Even though Mozilla dropped the experimental project, Firefox still utilizes some servo components in the browser" Another FOSDOM update from social media: "Thunderbird is also embracing Rust."' -- source: https://news.slashdot.org/story/24/02/11/2024233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ANZ Bank Tries GitHub Copilot, Likes What It Sees
by Lawrence D'Oliveiro 11 Feb '24

11 Feb '24

ANZ Bank tried a study with its in-house Python programmers <https://www.theregister.com/2024/02/10/anz_bank_github_copilot/>, and found "The group that had access to GitHub Copilot was able to complete their tasks 42.36 percent faster than the control group participants," the report says. "...The code produced by Copilot participants contained fewer code smells and bugs on average, meaning it would be more maintainable and less likely to break in production." In terms of code security, they didn’t find that Copilot helped, but neither did it make things worse. But then, these were relatively simple programming exercises. The report also cites another study which found that AI assistance is leading to lower code quality.

1 0

Mozilla Names New CEO as It Pivots To Data Privacy
by Peter Reutemann 09 Feb '24

09 Feb '24

'Mozilla, which manages the open-source Firefox browser, announced today that Mitchell Baker is stepping down as CEO to focus on AI and internet safety as chair of the nonprofit foundation. Laura Chambers, a Mozilla board member and entrepreneur with experience at Airbnb, PayPal, and eBay, will step in as interim CEO to run operations until a permanent replacement is found. Fortune: Baker, a Silicon Valley pioneer who co-founded the Mozilla Project, says it was her decision to step down as CEO, adding that the move is motivated by a sense of urgency over the current state of the internet and public trust. "We want to offer an alternative for people to have better products," says Baker, who wants to draw more attention to policies, products and processes to challenge business models built on fueling outrage. "What are the connections between this global malaise and how humans are engaging with each other and technology?" Chambers says she plans to focus on building out new products that address growing privacy concerns while actively looking for a full-time CEO. Prior to being recruited to the Mozilla board three years ago, Chambers says she was feeling "pretty disillusioned" about society because of the influence of money in politics and the growing power of the tech giants. "I was confused about what to do and this felt like a genuine way to make an impact." Chambers says she won't be seeking a permanent CEO role because she plans to move back to Australia later this year for family reasons. "I think this is an example of Mozilla doing the right role modelling in how to manage a succession," says Chambers. ' -- source: https://news.slashdot.org/story/24/02/08/1511234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Critical Vulnerability Affecting Most Linux Distros Allows For Bootkits
by Peter Reutemann 08 Feb '24

08 Feb '24

'Linux developers are in the process of patching a high-severity vulnerability that, in certain cases, allows the installation of malware that runs at the firmware level, giving infections access to the deepest parts of a device where they're hard to detect or remove. ArsTechnica: The vulnerability resides in shim, which in the context of Linux is a small component that runs in the firmware early in the boot process before the operating system has started. More specifically, the shim accompanying virtually all Linux distributions plays a crucial role in secure boot, a protection built into most modern computing devices to ensure every link in the boot process comes from a verified, trusted supplier. Successful exploitation of the vulnerability allows attackers to neutralize this mechanism by executing malicious firmware at the earliest stages of the boot process before the Unified Extensible Firmware Interface firmware has loaded and handed off control to the operating system. The vulnerability, tracked as CVE-2023-40547, is what's known as a buffer overflow, a coding bug that allows attackers to execute code of their choice. It resides in a part of the shim that processes booting up from a central server on a network using the same HTTP that the the web is based on. Attackers can exploit the code-execution vulnerability in various scenarios, virtually all following some form of successful compromise of either the targeted device or the server or network the device boots from. "An attacker would need to be able to coerce a system into booting from HTTP if it's not already doing so, and either be in a position to run the HTTP server in question or MITM traffic to it," Matthew Garrett, a security developer and one of the original shim authors, wrote in an online interview. "An attacker (physically present or who has already compromised root on the system) could use this to subvert secure boot (add a new boot entry to a server they control, compromise shim, execute arbitrary code)."' -- source: https://linux.slashdot.org/story/24/02/07/1749248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Overzealous Spam Filters
by Lawrence D'Oliveiro 07 Feb '24

07 Feb '24

Two recent news items about important messages being lost in the recipients’ spam filters. Some months ago, the Banking Ombudsman sent out a warning about investment scams to various financial institutions, but the ANZ never saw theirs <https://www.nzherald.co.nz/nz/anz-misses-investment-scam-warning-from-banki…>. One scam victim believes that her case might have been caught sooner if the bank had taken suitable notice of such a warning. And a US-based team wanted to join Formula 1, but it seems they never got the invitation to meet in person to discuss their application, because it got classed as spam <https://arstechnica.com/cars/2024/02/a-spam-folder-may-have-foiled-andretti…>. And so their application was rejected. But then, in this case you’d think more than one attempt would have been made to get in touch. In both cases, the sender address would have been something unusual, not the kind of thing you or I might see in our in-box (in one case, the Banking Ombudsman, in the other case, the Formula 1 rights body). If we got such a message, it would be wise to score it as being more likely to be some sort of scam. But for organizations that work in those areas that are more likely to engage in such communications, it would make sense to customize their spam filters in the opposite direction, don’t you think?

2 2

Enabling Case-Insensitive Filenames On Linux
by Lawrence D'Oliveiro 06 Feb '24

06 Feb '24

The ext4 filesystem has had the “casefold” option for a while now <https://lwn.net/Articles/784041/>. This allows you to specify, when you initialize a new filesystem, that you want file/directory names to be treated as case-insensitive. At the same time, you have to specify that the filenames are to be interpreted as UTF-8 encoding; normally the kernel doesn’t care, it only singles out ASCII slash and NUL bytes for special interpretation, and simply passes through any other byte values in the names. I was able to create such a filesystem, but I wasn’t able to mount it in my last-upgraded-just-a-few-days-ago Debian Unstable setup. When I try, it fails, and in the dmesg log I see Filesystem with casefold feature cannot be mounted without CONFIG_UNICODE Turns out the Debian 5.10 kernel has not been built with this CONFIG_UNICODE option enabled. However, this situation looks set to change shortly, according to <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985689>.

2 3

browsh
by Peter Reutemann 06 Feb '24

06 Feb '24

Hi everyone Just came across browsh: 'A fully interactive, real-time, and modern text-based browser rendered to TTYs and browsers' https://github.com/browsh-org/browsh Seems like a cool way of browsing in the shell. I've used lynx in the past for that. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a Microsoft Update Broke VS Code Editor on Ubuntu
by Peter Reutemann 05 Feb '24

05 Feb '24

'Microsoft's Visual Studio Code editor now includes a voice command that launches GitHub Copilot Chat just by saying "Hey Code." But one Linux blog notes that the editor has suddenly stopped supporting Ubuntu 18.04 LTS — "a move causing issues for scores of developers." VS Code 1.86 (aka the 'January 2024' update) saw Microsoft bump the minimum build requirements for the text editor's popular remote dev tools to â¥glibc 2.28 — but Ubuntu 18.04 LTS uses glibc 2.27, ergo they no longer work. While Ubuntu 18.04 is supported by Canonical until 2028 (through ESM) a major glibc upgrade is unlikely. Thus, this "breaking change" is truly breaking workflows... It seems affected developers were caught off-guard as this (rather impactful) change was not signposted before, during, or after the VS Code update (which is installed automatically for most, and the update was pushed out to Ubuntu 18.04 machines). Indeed, most only discovered this issue after update was installed, they tried to connect to a remote server, and discovered it failed. The resulting error message does mention deprecation and links to an FAQ on the VS Code website with workarounds (i.e. downgrade). But as one developer politely put it.... "It could have checked the libc versions and refused the update. Now, many people are screwed in the middle of their work." The article points out an upgrade to Ubuntu 20.04 LTS will address the problem. On GitHub a Microsoft engineer posted additional options from VS Code's documentation: If you are unable to upgrade your Linux distribution, the recommended alternative is to use our web client. If you would like to use the desktop version, then you can download the VS Code release 1.85. Depending on your platform, make sure to disable updates to stay on that version. Microsoft then locked the thread on GitHub as "too heated" and limited conversation to just collaborators. In a related thread someone suggested installing VS Code's Flatpak, which was still on version 1.85 — and then disabling updates. But soon Microsoft had locked that thread as well as "too heated," again limiting conversation to collaborators.' -- source: https://linux.slashdot.org/story/24/02/04/0116229 When you can't take criticism for a balls-up, lock the discussion thread! Hmm... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LibreOffice 24.2 Delivers Advanced Features and Global Accessibility
by Peter Reutemann 02 Feb '24

02 Feb '24

'The Document Foundation has officially launched LibreOffice 24.2, which is now available for download for Windows, macOS, and Linux platforms. This release introduces a new calendar-based version numbering system (YY.M). Here’s what it’s all about. The latest major release of the well-known office suite was 7.6. However, this is set to change with the introduction of 24.2, as the version numbering will now follow a “year.month” pattern, similar to that used by Ubuntu releases, for example. This change aims to simplify version identification for end users, making it more intuitive to understand.' -- source: https://linuxiac.com/libreoffice-24-2-delivers-advanced-features-and-global… ...and here I was, thinking that I missed a truckload of releases. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Microsoft Stole My Chrome Tabs, and It Wants Yours, Too'
by Peter Reutemann 31 Jan '24

31 Jan '24

'Tom Warren, writing for The Verge: Last week, I turned on my PC, installed a Windows update, and rebooted to find Microsoft Edge automatically open with the Chrome tabs I was working on before the update. I don't use Microsoft Edge regularly, and I have Google Chrome set as my default browser. Bleary-eyed at 9AM, it took me a moment to realize that Microsoft Edge had simply taken over where I'd left off in Chrome. I never imported my data into Microsoft Edge, nor did I confirm whether I wanted to import my tabs. But here was Edge automatically opening after a Windows update with all the Chrome tabs I'd been working on. I didn't even realize I was using Edge at first, and I was confused why all my tabs were suddenly logged out. After the shock wore off, I looked to make sure I hadn't accidentally allowed this behavior. I found a setting in Microsoft Edge that imports data from Google Chrome on each launch. "Always have access to your recent browsing data each time you browse on Microsoft Edge," reads Microsoft's description of the feature in Edge. This setting was disabled, and I had never been asked to turn it on. So I went to install the same Windows update on a laptop, which actually resulted in it failing and my having to do a system restore. Once the system restore was complete, the same thing happened. Edge opened automatically with all of my Chrome tabs. I haven't been able to replicate the behavior on other PCs, but a number of X users replied to my post about this saying they have experienced the same thing in the past.' -- source: https://it.slashdot.org/story/24/01/30/1824233 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Is Planning a London IPO, But Its CEO Expects 'No Change' In Focus
by Peter Reutemann 31 Jan '24

31 Jan '24

'Ars Technica: The business arm of Raspberry Pi is preparing to make an initial public offering (IPO) in London. CEO Eben Upton tells Ars that should the IPO happen, it will let Raspberry Pi's not-for-profit side expand by "at least a factor of 2X." And while it's "an understandable thing" that Raspberry Pi enthusiasts could be concerned, "while I'm involved in running the thing, I don't expect people to see any change in how we do things." CEO Eben Upton confirmed in an interview with Bloomberg News that Raspberry Pi had appointed bankers at London firms Peel Hunt and Jefferies to prepare for "when the IPO market reopens." Raspberry previously raised money from Sony and semiconductor and software design firm ARM, and it sought public investment. Upton denied or didn't quite deny IPO rumors in 2021, and Bloomberg reported Raspberry Pi was considering an IPO in early 2022. After ARM took a minority stake in the company in November 2023, Raspberry Pi was valued at roughly 400 million pounds, or just over $500 million. Given the company's gradual recovery from pandemic supply chain shortages, and the success of the Raspberry Pi 5 launch, the company's IPO will likely jump above that level, even with a listing in the UK rather than the more typical US IPO. Upton told The Register that "the business is in a much better place than it was last time we looked at it [an IPO]. We partly stopped because the markets got bad. And we partly stopped because our business became unpredictable." "It's a good thing, in that people care about us," Upton said in response to concerned hobbyists and tech enthusiasts. "What Raspberry Pi [builds] are the products we want to buy, and then we sell them to people like us," Upton said. "Certainly, while I'm involved in it, I can't imagine an environment in which the hobbyists are not going to be incredibly important." The IPO is "about the foundation," Upton said, with that charitable arm selling some of its majority stake in the business entity to raise funds and expand. "We've not cooked up some new way for a not-for-profit to do an IPO, no," he noted. [He told Ars that Raspberry Pi's business arm has had both strategic and private investors in its history, along with a majority shareholder in its Foundation (which in 2016 owned 75 percent of shares), and that he doesn't see changes to what Pi has built. He also noted that the foundation was previously funded by dividends from the business side.] "We do this transaction, and the proceeds of that transaction allow the foundation to train teachers, run clubs, expand programs, and ... do those things at, at least, a factor of 2X. That's what I'm most excited about." Upton said there would be "no change" to the kinds of products Pi makes, and that makers are "culturally important to us." [...] "If people think that an IPO means we're going to ... push prices up, push the margins up, push down the feature sets, the only answer we can give is, watch us. Keep watching," he said. "Let's look at it in 15, 20 years' time."' -- source: https://hardware.slashdot.org/story/24/01/30/2212232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0