- wlug - list.wlug.org.nz

IBM To Buy Red Hat, the Top Linux Distributor, For $34 Billion
by Peter Reutemann 01 Nov '18

01 Nov '18

'International Business Machines (IBM) is acquiring software maker Red Hat in a deal valued at $34 billion, the companies said Sunday. From a report: The purchase, announced on Sunday afternoon, is the latest competitive step among large business software companies to gain an edge in the fast-growing market for Internet-style cloud computing. In June, Microsoft acquired GitHub, a major code-sharing platform for software developers, for $7.5 billion. IBM said its acquisition of Red Hat was a move to open up software development on computer clouds, in which software developers write applications that run on remote data centers. >From a press release: This acquisition brings together the best-in-class hybrid cloud providers and will enable companies to securely move all business applications to the cloud. Companies today are already using multiple clouds. However, research shows that 80 percent of business workloads have yet to move to the cloud, held back by the proprietary nature of today's cloud market. This prevents portability of data and applications across multiple clouds, data security in a multi-cloud environment and consistent cloud management. IBM and Red Hat will be strongly positioned to address this issue and accelerate hybrid multi-cloud adoption. Together, they will help clients create cloud-native business applications faster, drive greater portability and security of data and applications across multiple public and private clouds, all with consistent cloud management. In doing so, they will draw on their shared leadership in key technologies, such as Linux, containers, Kubernetes, multi-cloud management, and cloud management and automation. IBM's and Red Hat's partnership has spanned 20 years, with IBM serving as an early supporter of Linux, collaborating with Red Hat to help develop and grow enterprise-grade Linux and more recently to bring enterprise Kubernetes and hybrid cloud solutions to customers. These innovations have become core technologies within IBM's $19 billion hybrid cloud business. Between them, IBM and Red Hat have contributed more to the open source community than any other organization.' -- source: https://linux.slashdot.org/story/18/10/28/1859245 That completely flew under the radar! I still remember from my Unix sysadmin course at uni back in the days (using IBM's AIX), when an IBM guy came in for some guest lectures and mentioned that they are ramping up their investment in Linux and also offer Linux next to their own AIX Unix systems. Well, Linux has definitely come a long way! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

'Open Source Creators: Red Hat Got $34 Billion and You Got $0. Here's Why.'
by Peter Reutemann 31 Oct '18

31 Oct '18

'Donald Fischer, who served as a product manager for Red Hat Enterprise Linux during its creation and early years of growth, writes: Red Hat saw, earlier than most, that the ascendance of open source made the need to pay for code go away, but the need for support and maintenance grew larger than ever. Thus Red Hat was never in the business of selling software, rather it was in the business of addressing the practical challenges that have always come along for the ride with software. [...] As an open source developer, you created that software. You can keep your package secure, legally documented, and maintained; who could possibly do it better? So why does Red Hat make the fat profits, and not you? Unfortunately, doing business with large companies requires a lot of bureaucratic toil. That's doubly true for organizations that require security, legal, and operational standards for every product they bring in the door. Working with these organizations requires a sales and marketing team, a customer support organization, a finance back-office, and lots of other "business stuff" in addition to technology. Red Hat has had that stuff, but you haven't. And just like you don't have time to sell to large companies, they don't have time to buy from you alongside a thousand other open source creators, one at a time. Sure, big companies know how to install and use your software. (And good news! They already do.) But they can't afford to put each of 1100 npm packages through a procurement process that costs $20k per iteration. Red Hat solved this problem for one corner of open source by collecting 2,000+ open source projects together, adding assurances on top, and selling it as one subscription product. That worked for them, to the tune of billions. But did you get paid for your contributions?' -- source: https://linux.slashdot.org/story/18/10/31/1520256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The CAP Theorem Strikes Again
by Lawrence D'Oliveiro 31 Oct '18

31 Oct '18

There is a fundamental rule with distributed databases: you can pick any two of: * Maintaining data Consistency across the entire network * Maintaining data Availability across the entire network * Being able to deal with a Partitioning of the network into two or more disconnected pieces but you can never have all three. An example of this is the outage at GitHub earlier this month <https://www.theregister.co.uk/2018/10/31/github_lost_a_network_link_for_43_…>. A link broke between the east-coast and west-coast halves of their network, and in an effort to maintain ongoing service availability on both sides of the partition, they ended up sacrificing consistency of the data. Which came back to bite them when the link was re-established, and the inconsistency could not easily be resolved.

1 0

The DNS Encryption Controversy
by Lawrence D'Oliveiro 31 Oct '18

31 Oct '18

There is a rather acrimonious argument currently going on among the Internet technorati over two different competing protocols for implementing encryption of domain name (DNS) queries <https://www.theregister.co.uk/2018/10/30/doh-contorversy/>. One of them is called “DNS-over-TLS” and the other is “DNS-over-HTTPS”. The former passes the DNS queries over its own TLS-encrypted connection, while the latter piggybacks on good old HTTP, using the latter’s TLS capability instead. The former is clearly simpler, and one might say “purer”, but the latter is deliberately designed to make it hard to tell what DNS queries a user might be making, since they become indistinguishable from regular HTTPS connections. So the question becomes, do you see this obfuscation as a good thing or a bad thing? It is intended to prevent snoops (both Governmental and non-Governmental) from invading the privacy of users, but it also blocks “legitimate” analysis of traffic by network admins trying to manage their systems as well. Clearly, you can’t do one without the other. So is the price worth paying?

1 0

Fedora 29 Released
by Peter Reutemann 30 Oct '18

30 Oct '18

'Fedora 29 is released today. Among the new features are the ability to allow parallel installation of packages such as Node.js. Fedora 29 also supports ZRAM (formerly called compcache) for ARMv7 and v8. In addition to the more efficient use of RAM, it also increases the lifespan of microSD cards on the Raspberry Pi as well as other SBCs. "Additionally, UEFI for ARMv7 is now supported in Fedora 29, which also benefits Raspberry Pi users," reports TechRepublic. "Fedora already supported UEFI on 64-bit ARM devices."' -- source: https://linux.slashdot.org/story/18/10/30/229249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

You Can Play Over 2, 600 Windows Games on Linux Via Steam Play
by Peter Reutemann 29 Oct '18

29 Oct '18

'At the end of August, Valve announced a new version of Steam Play for Linux that included Proton, a WINE fork that made many Windows games, including more recent ones ,such as Witcher 3, Dark Souls 3 and Dishonored, playable on Linux. Just two months later, ProtonDB says there are over 2,600 Windows games that users can play on Linux, and the number is rapidly growing daily. From a report: When Valve Software launched Steam Play with Proton, it made it easier for gamers to play Windows games that hadn't yet been ported to Linux with the click of a button. Not all games may run perfectly on Linux, but that's also often the case with Windows 10, which can not play older games as well as previous versions of Windows did, even under Compatibility Mode. In only two months, the database of games that work with Proton has increased to over 2,600 -- more than half of the 5,000 Linux-native games that can be obtained through the Steam store.' -- source: https://linux.slashdot.org/story/18/10/29/1721258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Easy-to-exploit privilege escalation bug bites OpenBSD and other big name OSes
by Peter Reutemann 29 Oct '18

29 Oct '18

'Several big-name Linux and BSD operating systems are vulnerable to an exploit that gives untrusted users powerful root privileges. The critical flaw in the X.org server—the open-source implementation of the X11 system that helps manage graphics displays—affects OpenBSD, widely considered to be among the most secure OSes. It also impacts some versions of the Red Hat, Ubuntu, Debian, and CentOS distributions of Linux. An advisory X.org developers published Thursday disclosed the 23-month-old bug that, depending on how OS developers configure it, lets hackers or untrusted users elevate very limited system rights to unfettered root. The vulnerability, which is active when OSes run X.org in privileged (setuid) mode, allows files to be overwritten using the -logfile and -modulepath parameters. It also makes it trivial for low-privilege users to escalate system rights. A variety of nuances are leading to widely divergent assessments of the bug's severity. “Depending on whom you talk to, the reported severity will vary greatly,” Louis Dion-Marcil, a security researcher at GoSecure, told Ars. “I think most people will tell you it is very severe, and I would agree with them. The bug allows you to write arbitrary data to arbitrary files, which might seem trivial and not that dangerous, but it effectively allows regular, unprivileged users to elevate their privileges to the one of complete administrator of the system.”' -- source: https://arstechnica.com/information-technology/2018/10/x-org-bug-that-gives… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Zealand Chooses Google Chromebooks Over Microsoft Windows 10 For Education
by Peter Reutemann 28 Oct '18

28 Oct '18

'Google announced this week that it has signed an agreement with New Zealand's Ministry of Education to provide all state and state integrated schools in the country with Chrome Education licenses. The three-year agreement goes into effect on November 1 next month. From a report: "Starting on November 1, as part of an agreement with Google and the New Zealand Ministry of Education, all state and state-integrated schools across New Zealand will be able to start claiming Ministry-funded Chrome Education licenses to manage new and existing unmanaged Chromebooks. The Chrome Education license was developed to make device management in schools a breeze, so that teachers and students can focus on what's most important -- teaching and learning. Equipped with the Chrome Education license, schools can utilize essential education features to better support the many ways Chromebooks are used in the classroom," says Suan Ye, Head of Google for Education, Australia and New Zealand.' -- source: https://news.slashdot.org/story/18/10/28/2214209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linus Torvalds and Greg K-H Talk About Linux Community, Dealing with Hardware Bugs, Chromebooks Gaining Traction, Microsoft, Companies Gleaning Data and More
by Peter Reutemann 28 Oct '18

28 Oct '18

'Swapnil Bhartiya, who runs the blog TFIR, had a chance to interview Linus Torvalds at Open Source Summit in the second half of August this year. (Some context: The interview, which was published this week, took place before Mr. Torvalds said he needs to take a step back to reflect on how he has dealt with the community over the years. Since then, we have learned that Mr. Torvalds is returning to his position.) In the wide-ranging interview, Mr. Torvalds has touched a wide-range of subjects, including formulating workarounds for the problematic hardware bugs (Meltdown, Spectre), and Chromebooks gaining traction (though it is still not a machine that he could use for his work yet). He also talked about companies gleaning a lot of data about their users, regulations, (a tad bit of politics), Linux community. Greg Kroah-Hartman (aka Greg K-H) joined Mr. Bhartiya and Mr. Torvalds for the second half of the interview. On Sunday, Mr. Bhartiya published an additional interview of Mr. Kroah-Hartman.' -- source: https://linux.slashdot.org/story/18/10/28/1437239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New SystemD Vulnerability Discovered
by Peter Reutemann 28 Oct '18

28 Oct '18

'The Register reports that a new security bug in systemd "can be exploited over the network to, at best, potentially crash a vulnerable Linux machine, or, at worst, execute malicious code on the box" by a malicious host on the same network segment as the victim. According to one Red Hat security engineer, "An attacker could exploit this via malicious DHCP server to corrupt heap memory on client machines, resulting in a denial of service or potential code execution." According to the bug description, systemd-networkd "contains a DHCPv6 client which is written from scratch and can be spawned automatically on managed interfaces when IPv6 router advertisements are received." OneHundredAndTen shared this article from the Register: In addition to Ubuntu and Red Hat Enterprise Linux, systemd has been adopted as a service manager for Debian, Fedora, CoreOS, Mint, and SUSE Linux Enterprise Server. We're told RHEL 7, at least, does not use the vulnerable component by default. Systemd creator Leonard Poettering has already published a security fix for the vulnerable component -- this should be weaving its way into distros as we type. If you run a systemd-based Linux system, and rely on systemd-networkd, update your operating system as soon as you can to pick up the fix when available and as necessary.' -- source: https://news.slashdot.org/story/18/10/27/196227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0