- wlug - list.wlug.org.nz

Microsoft's Secure Boot UEFI Bootloader Signing Key Expires In September, Posing Problems For Linux Users
by Lawrence D'Oliveiro 23 Jul '25

23 Jul '25

If I understand this article right <https://www.tomshardware.com/tech-industry/cyber-security/microsoft-signing…>, there is a signing key stored in the flash RAM of PCs, issued by Microsoft, which is used to sign a “shim” that allows third-party Linux distros to boot. However, that key is due to expire this September. Microsoft issued an updated key two years ago, but that key may not be widely installed as yet. This leaves it up to PC/OEM vendors to issue updates to the flash RAM on their motherboards, which is not something that can be taken for granted. I’m not the only one wondering whether Secure Boot is worth the hassle: It's easy to see the appeal of Secure Boot—making it more difficult to install bootkits should be a net positive. However, the looming hassle of dealing with this expiring key is just the latest in a series of frustrations that encourage people to either stick with Windows or disable Secure Boot entirely. Right now, many people opt for the former, but will that continue to be the case as the popularity of other platforms rises ahead of Windows 10's demise? And is Secure Boot, as it currently exists, prepared for that shift?

1 0

filestash
by Peter Reutemann 22 Jul '25

22 Jul '25

Just came across "filestash": 'A Dropbox-like file manager that let you manage your data anywhere it is located: FTP • FTPS • SFTP • WebDAV • Git • S3 • NFS • SMB • Artifactory • LDAP • Mysql • Storj • CardDAV • CalDAV • Backblaze B2 • Minio • Dropbox • Google Drive' Sounds like an interesting and useful tool! -- github: https://github.com/mickael-kerjean/filestash -- source: https://mastodon.social/@nixCraft/114893327737674577 Cheers, Peter

1 0

Actively exploited vulnerability gives extraordinary control over server fleets
by Peter Reutemann 21 Jul '25

21 Jul '25

'Hackers are exploiting a maximum-severity vulnerability that has the potential to give them complete control over thousands of servers, many of which handle mission-critical tasks inside data centers, the US Cybersecurity and Infrastructure Security Agency is warning. The vulnerability, carrying a severity rating of 10 out of a possible 10, resides in the AMI MegaRAC, a widely used firmware package that allows large fleets of servers to be remotely accessed and managed even when power is unavailable or the operating system isn't functioning. These motherboard-attached microcontrollers, known as baseboard management controllers (BMCs), give extraordinary control over servers inside data centers. Administrators use BMCs to reinstall operating systems, install or modify apps, and make configuration changes to large numbers of servers without physically being on premises and, in many cases, without the servers being turned on. Successful compromise of a single BMC can be used to pivot into internal networks and compromise all other BMCs. CVE-2024-54085, as the vulnerability is tracked, allows for authentication bypasses by making a simple web request to a vulnerable BMC device over HTTP. The vulnerability was discovered by security firm Eclypsium and disclosed in March. The disclosure included proof-of-concept exploit code allowing a remote attacker to create an admin account without providing any authentication. At the time of the disclosure, there were no known reports of the vulnerability being actively exploited. On Wednesday, CISA added CVE-2024-54085 to its list of vulnerabilities known to be exploited in the wild. The notice provided no further details.' -- source: https://arstechnica.com/security/2025/06/active-exploitation-of-ami-managem… Cheers, Peter

4 6

KDE's Android TV Alternative, Plasma Bigscreen, Rises From the Dead
by Peter Reutemann 16 Jul '25

16 Jul '25

'Plasma Bigscreen, KDE's TV-focused interface, is being revived after years of inactivity thanks to contributor Devin, who overhauled the UI, redesigned the Settings app, improved app launching, and updated key modules. While still in progress -- with features like HDMI-CEC remote support and a virtual keyboard pending -- the project aims to rejoin KDE's official Plasma release schedule, potentially in version 6.5. Neowin reports: If you have not heard of it, Plasma Bigscreen is a Plasma shell for televisions, with original support for the now-defunct Mycroft AI assistant. It used to provide a simple launcher for apps and custom "Mycroft Skills" before development stalled, causing most distributions to drop it. The project was left behind during the big transition to Plasma 6 last year because no one had ported it in time for the megarelease. After a friend of his started poking at the code, Devin stepped in to tackle the much-needed work. [...] For anyone who wants to test this out, you can do as Devin did by installing Plasma Bigscreen on a Raspberry Pi using postmarketOS, though you would have to compile it yourself or pull from the nightly repos to get the latest changes. Applications like Kodi and VacuumTube (smart TV version of YouTube) work well with remote navigation, and some games like SuperTuxKart are playable. Controller support exists, but getting TV remotes to work over HDMI CEC is still untested. The project is far from finished; it still needs an arrow-navigable virtual keyboard and a clearer long-term direction now that Mycroft is gone. Still, the goal is to get it back into the official Plasma release schedule, possibly for version 6.5. ' -- source: https://tech.slashdot.org/story/25/07/15/1956221 Cheers, Peter

1 0

Browser Extensions Turn Nearly 1 Million Browsers Into Website-Scraping Bots
by Peter Reutemann 10 Jul '25

10 Jul '25

'Over 240 browser extensions with nearly a million total installs have been covertly turning users' browsers into web-scraping bots. "The extensions serve a wide range of purposes, including managing bookmarks and clipboards, boosting speaker volumes, and generating random numbers," reports Ars Technica. "The common thread among all of them: They incorporate MellowTel-js, an open source JavaScript library that allows developers to monetize their extensions." Ars Technica reports: Some of the data swept up in the collection free-for-all included surveillance videos hosted on Nest, tax returns, billing invoices, business documents, and presentation slides posted to, or hosted on, Microsoft OneDrive and Intuit.com, vehicle identification numbers of recently bought automobiles along with the names and addresses of the buyers, patient names and the doctors they saw, travel itineraries hosted on Priceline, Booking.com, and airline websites, Facebook Messenger attachments and Facebook photos, even when the photos were set to be private. The dragnet also collected proprietary information belonging to Tesla, Blue Origin, Amgen, Merck, Pfizer, Roche, and dozens of other companies. Tuckner said in an email Wednesday that the most recent status of the affected extensions is: - Of 45 known Chrome extensions, 12 are now inactive. Some of the extensions were removed for malware explicitly. Others have removed the library. - Of 129 Edge extensions incorporating the library, eight are now inactive. - Of 71 affected Firefox extensions, two are now inactive. Some of the inactive extensions were removed for malware explicitly. Others have removed the library in more recent updates. A complete list of extensions found by Tuckner is here.' -- source: https://tech.slashdot.org/story/25/07/09/2257245 Cheers, Peter

1 0

AMD Warns of New Meltdown, Spectre-like Bugs Affecting CPUs
by Peter Reutemann 10 Jul '25

10 Jul '25

'AMD is warning users of a newly discovered form of side-channel attack affecting a broad range of its chips that could lead to information disclosure. Register: Akin to Meltdown and Spectre, the Transient Scheduler Attack (TSA) comprises four vulnerabilities that AMD said it discovered while looking into a Microsoft report about microarchitectural leaks. The four bugs do not appear too venomous at face value -- two have medium-severity ratings while the other two are rated "low." However, the low-level nature of the exploit's impact has nonetheless led Trend Micro and CrowdStrike to assess the threat as "critical." The reasons for the low severity scores are the high degree of complexity involved in a successful attack -- AMD said it could only be carried out by an attacker able to run arbitrary code on a target machine. It affects AMD processors (desktop, mobile and datacenter models), including 3rd gen and 4th gen EPYC chips -- the full list is here.' -- source: https://it.slashdot.org/story/25/07/09/1835230 Cheers, Peter

1 0

GIMP 3.2 Promises New Paint Mode, Support for Importing Photoshop Patterns
by Peter Reutemann 04 Jul '25

04 Jul '25

'GIMP 3.2 promises new features like theme colors for Brush, Font, and Palette, a new paint blend mode called Overwrite that lets you directly replace the pixels over the area you paint, a new setting in the text tool to control the direction of the text outline, and automatic match of Linux and Windows OS themes. It also promises support for using ART (AnotherRawTherapee) as a Camera Raw loader, a new option to export to Krita‘s .kpl palette format, support for importing Photoshop patterns, as well as support for using presets from Photoshop’s Curves and Levels filters in GIMP’s Curves and Levels filters. In addition, GIMP 3.2 will bring initial support for exporting Photoshop Large format (PSB) files, support for importing APNG animations, support for loading multi-layer OpenEXR images, support for importing and exporting JPEG 2000 images, and support for loading and exporting Sony Playstation 1 TIM textures and images. But wait, that’s not all because GIMP 3.2 also promises support for importing Nokia’s historical black and white Over-the-Air Bitmap format, support for importing the GIF variant known as Jeff’s Image Format (.jif), and support for importing Advanced Video Coding (AVCI) still images. Among other noteworthy changes, GIMP 3.2 promises to improve non-destructive editing, update the CMYK Color Selector to calculate and display the Total Ink Coverage of the selected color, and implement a new API to create a GimpCoordinates widget in the auto-generated dialog.' -- source: https://9to5linux.com/gimp-3-2-promises-new-paint-mode-support-for-importin… Cheers, Peter

1 0

Let's Encrypt Rolls Out Free Security Certs For IP Addresses
by Peter Reutemann 04 Jul '25

04 Jul '25

'Let's Encrypt, a certificate authority (CA) known for its free TLS/SSL certificates, has begun issuing digital certificates for IP addresses. From a report: It's not the first CA to do so. PositiveSSL, Sectigo, and GeoTrust all offer TLS/SSL certificates for use with IP addresses, at prices ranging from $40 to $90 or so annually. But Let's Encrypt does so at no cost. For those with a static IP address who want to host a website, an IP address certificate provides a way to offer visitors a secure connection with that numeric identifier while avoiding the nominal expense of a domain name.' -- source: https://it.slashdot.org/story/25/07/03/1452239 Cheers, Peter

1 0

Linux’s Remarkable Journey From One Dev's Hobby To 40 Million Lines Of Code - And Counting
by Lawrence D'Oliveiro 03 Jul '25

03 Jul '25

A retrospective <https://www.zdnet.com/article/linuxs-remarkable-journey-from-one-devs-hobby…> on how the Linux kernel project got to where it is today. Quotes: “We're always building on the kernel, despite the fact that a lot of things were happening in the world over these three decades. We had the dotcom crash in 2000. We had the SCO lawsuit. In 2008, there was the global economic crisis. And of course, we had the COVID pandemic. But you don't really see an effect on the development speed of Linux from any of these events. We have somehow managed to sustain everything we can do despite all the stuff that has happened in the world.” ... Of course, for years, no one took Linux seriously. It was dismissed as a toy in an era when Unix fragmentation and the rise of Windows NT dominated industry thinking. The prevailing wisdom held that only large corporations could build operating system kernels, leaving little attention for a community-driven initiative. Yet, as Corbet noted, Linux exemplified Clayton Christensen's concept of disruptive innovation: a technology dismissed as inferior that quietly matures until it overtakes established players. Why did the BSDs lose their early lead? Another factor, Corbet explained, was that in the early 1990s, the BSD Unix systems were much more mature than Linux; they were capable of doing more and were more usable. Still, their permissive BSD license model led to a whole bunch of forks. None of them gained the critical mass in terms of either the development community or adoption to dominate Linux. Instead, the Linux kernel stayed one thing. It stayed together, in part because its GPLv2 copyright policy meant everybody retains their copyright under the same license. Some other open-source projects (including GNU) insist that contributors sign a “Contributor Licence Agreement”, turning over their copyright to some official body in charge of the project. The Linux kernel does not, and there are others that don’t.

1 0

PNG Spec, 3rd Edition, Is Out
by Lawrence D'Oliveiro 27 Jun '25

27 Jun '25

There is has been a major update to the specification for the PNG (“Portable Network Graphics”) file-format spec <https://www.programmax.net/articles/png-is-back/>, 20 years on from the previous edition. New features include support for high-dynamic-range colour gamuts, using a new metadata entry type that is much more compact than a full embedded ICC colour profile, and the official acceptance of the APNG format for animating a sequence of images within a single PNG file.

1 0