- wlug - list.wlug.org.nz

GitHub: With Great Power Comes Great Responsibility ... For Both Good And Evil
by Lawrence D'Oliveiro 13 Jan '24

13 Jan '24

Seems GitHub has become a popular place to host malware in a form that is difficult to shut down <https://www.theregister.com/2024/01/12/github_malware_popularity/>. One thing I was surprised to learn from that article is that, as far as China is concerned, GitHub has apparently grown too big to block <https://www.npr.org/2019/04/10/709490855/github-has-become-a-haven-for-chin…>. Which means it becomes a sort-of-safe haven for activity which might be seen as politically subversive (such as demanding your rights to limited working hours as supposedly guaranteed under the law). Of course, that report was from nearly five years ago, and things could have changed since then. But the 996.icu repo referenced in there still exists, and still shows signs of activity as of a few months ago.

1 0

“I’m Sorry Dave, I’m Afraid I Can’t Do That” -- Or Not
by Lawrence D'Oliveiro 13 Jan '24

13 Jan '24

There has been a flood of products with very odd descriptions on Amazon lately <https://arstechnica.com/ai/2024/01/lazy-use-of-ai-leads-to-amazon-products-…>. For example, “I’m sorry but I cannot fulfill this request it goes against OpenAI use policy—Black”. Also available in other colours, and similar in sizes like 10mm×3m. And unique features like “Regrettably, the information you’re searching for is not available — we strive to maintain the highest standards of integrity and will not compromise the authenticity and accuracy of our product descriptions”. And who wouldn’t want to buy after hearing “Our [product] can be used for a variety of tasks, such [task 1], [task 2], and [task 3]]”? Are you thinking “I gotta get me some of that”?

1 0

X11 Conservancy Project
by Lawrence D'Oliveiro 13 Jan '24

13 Jan '24

Here’s a website <https://x11cp.org/> dedicated to trying to keep alive GUI programs dating from the early days of X11. I think they’re also trying to ensure that the code can still be built and run. This is the second time I’ve come across Codeberg, which offers an open-source-based hosting facility for Git repositories.

1 0

Why More PC Gaming Handhelds Should Ditch Windows For SteamOS
by Lawrence D'Oliveiro 12 Jan '24

12 Jan '24

The success of the Steam Deck is encouraging at least one third-party vendor to bring out its own gaming handheld that will be running the Linux-based SteamOS instead of Microsoft Windows <https://arstechnica.com/gaming/2024/01/why-more-pc-gaming-handhelds-should-…>. While compatibility with the overwhelming majority of Windows-only games still leaves something to be desired, the usability of the platform is already a definite selling point: While Proton does come with at least some performance overhead, a variety of Steam Deck benchmarks show games running under SteamOS tend to perform comparably (or sometimes better) than those running under Windows on the handheld. That's also a huge change from the Steam Machines era, when Ars' testing showed that many SteamOS games ran significantly worse than their Windows counterparts on the same desktop hardware. The Windows platform is just plain unsuited to a handheld gaming device: Our review of the ROG Ally highlights just how annoying it can be to have to fiddle with Windows settings on a touchscreen running "an awkwardly scaled" version of the OS. Though Microsoft has not been sitting still: And while Microsoft has experimented with a handheld-friendly version of Windows meant for portable gaming devices, nothing public has yet come of the effort. But unless it launches a much more concerted effort than it has managed to date, there’s a chance Windows may lose its undisputed dominance in the last major market where it has one: PC gaming.

1 0

Biggest Linux Kernel Release Ever Welcomes bcachefs File System, Jettisons Itanium
by Peter Reutemann 12 Jan '24

12 Jan '24

'Linux kernel 6.7 has been released, including support for the new next-gen copy-on-write (COW) bcachefs file system. The Register reports: Linus Torvalds announced the release on Sunday, noting that it is "one of the largest kernel releases we've ever had." Among the bigger and more visible changes are a whole new file system, along with fresh functionality for several existing ones; improved graphics support for several vendors' hardware; and the removal of an entire CPU architecture. [...] The single biggest feature of 6.7 is the new bcachefs file system, which we examined in March 2022. As this is the first release of Linux to include the new file system, it definitely would be premature to trust any important data to it yet, but this is a welcome change. The executive summary is that bcachefs is a next-generation file system that, like Btrfs and ZFS, provides COW functionality. COW enables the almost instant creation of "snapshots" of all or part of a drive or volume, which enables the OS to make disk operations transactional: In other words, to provide an "undo" function for complex sets of disk write operations. Having a COW file system on Linux isn't new. The existing next-gen file system in the kernel, Btrfs, also supports COW snapshots. The version in 6.7 sees several refinements. It inherits a feature implemented for Steam OS: Two Btrfs file systems with the same ID can be mounted simultaneously, for failover scenarios. It also has improved quota support and a new raid_stripe_tree that improves handling of arrays of dissimilar drives. Btrfs remains somewhat controversial. Red Hat banished it from RHEL years ago (although Oracle Linux still offers it) but SUSE's distros depend heavily upon it. It will be interesting to see how quickly SUSE's Snapper tool gains support for bcachefs: This new COW contender may reveal unquestioned assumptions built into the code. Since Snapper is also used in several non-SUSE distros, including Spiral Linux, Garuda, and siduction, they're tied to Btrfs as well. The other widely used FOSS next-gen file system, OpenZFS, also supports COW, but licensing conflicts prevent ZFS being fully integrated into the Linux kernel. So although multiple distros (such as NixOS, Proxmox, TrueNAS Scale, Ubuntu, and Void Linux) support ZFS, it must remain separate and distinct. This results in limitations, such as the ZFS Advanced Read Cache being separate from Linux's page cache. Bcachefs is all-GPL and doesn't suffer from such limitations. It aims to supply the important features of ZFS, such as integrated volume management, while being as fast as ext4 or XFS, and also surpass Btrfs in both performance and, crucially, reliability. ' -- source: https://linux.slashdot.org/story/24/01/11/2021234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Devices Are Under Attack By a Never-Before-Seen Worm
by Peter Reutemann 11 Jan '24

11 Jan '24

'Previously unknown self-replicating malware has been infecting Linux devices worldwide, installing cryptomining malware using unusual concealment methods. The worm is a customized version of Mirai botnet malware, which takes control of Linux-based internet-connected devices to infect others. Mirai first emerged in 2016, delivering record-setting distributed denial-of-service attacks by compromising vulnerable devices. Once compromised, the worm self-replicates by scanning for and guessing credentials of additional vulnerable devices. While traditionally used for DDoS attacks, this latest variant focuses on covert cryptomining. ArsTechnica adds: On Wednesday, researchers from network security and reliability firm Akamai revealed that a previously unknown Mirai-based network they dubbed NoaBot has been targeting Linux devices since at least last January. Instead of targeting weak telnet passwords, the NoaBot targets weak passwords connecting SSH connections. Another twist: Rather than performing DDoSes, the new botnet installs cryptocurrency mining software, which allows the attackers to generate digital coins using victims' computing resources, electricity, and bandwidth. The cryptominer is a modified version of XMRig, another piece of open source malware. More recently, NoaBot has been used to also deliver P2PInfect, a separate worm researchers from Palo Alto Networks revealed last July. Akamai has been monitoring NoaBot for the past 12 months in a honeypot that mimics real Linux devices to track various attacks circulating in the wild. To date, attacks have originated from 849 distinct IP addresses, almost all of which are likely hosting a device that's already infected. The following figure tracks the number of attacks delivered to the honeypot over the past year.' -- source: https://linux.slashdot.org/story/24/01/10/1727219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel 4.14 Reaches End of Life After More Than Six Years of Maintenance
by Peter Reutemann 11 Jan '24

11 Jan '24

'Originally released on November 12th, 2017, the long-term supported (LTS) Linux 4.14 kernel series has now reached its end of supported life after being maintained for more than six years. Renowned kernel developer Greg Kroah-Hartman announced today on the Linux kernel mailing list the release of Linux 4.14.336 as what appears to be the last maintenance update to the long-term supported Linux 4.14 kernel series, which is now marked as EOL (End of Life) on the kernel.org website. "This is the LAST 4.14.y kernel to be released. It is now officially end-of-life. Do NOT use this kernel version anymore, please move to a newer one, as shown on the kernel.org releases page," said Greg Kroah-Hartman. "If you are stuck at this version due to a vendor requiring it, go get support from that vendor for this obsolete kernel tree, as that is what you are paying them for."' -- source: https://linux.slashdot.org/story/24/01/10/1729216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Computer Says You Are A Thief
by Lawrence D'Oliveiro 10 Jan '24

10 Jan '24

Been hearing about this on and off for a few years, but it seems things have come to a head with the airing of a four-part documentary series about the massive scandal of the “Horizon” financial software used by the British Post Office <https://www.aljazeera.com/news/2024/1/9/the-great-british-post-office-scand…>. Basically, the buggy software was reporting incorrect transaction amounts, and these reports were believed over the protestations of the branch managers, leading to several hundred of the latter being prosecuted and convicted of theft and false accounting. In desperation at not being believed, some of them tried to plug the holes with their own money. Some even committed suicide. It took twenty years from the introduction of the system before a court ruled that the fault lay with the software, not with so many innocent people. (Why was the software considered to be above reproach for so long?) Even now, only a small proportion of the false convictions have been overturned. The Post Office CEO at the time has bowed to pressure and returned her CBE award. The software is still in use.

1 0

speed camera with RPi - NZ edition
by Peter Reutemann 10 Jan '24

10 Jan '24

Hi everyone Just stumbled across this news item in one of the reviews for the Raspberry Pi 4 on PBTech's website: https://www.stuff.co.nz/national/119894942/diy-speed-camera-nabs-hoons-near… And, would you believe it, the article even linked the source code: https://github.com/gregtinkers/carspeed.py Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical wants better Snap support outside Ubuntu, based on latest hires
by Peter Reutemann 10 Jan '24

10 Jan '24

'Snaps, the self-contained application packages that Ubuntu has long seen as a simpler app store and a potential solution to dependency hell, could be getting better support outside Ubuntu itself, based on one recent hire and potentially more. As spotted by the Phoronix blog, developer Zygmunt Krynicki, who worked at Ubuntu distributor Canonical from 2012 through 2020, posted Friday on Mastodon that he was "returning as a snap developer later this month." His main focus would be "cross-distribution support," Krynicki wrote, and "unlike in the past this will be my full time job. I'm very excited for what is ahead for snaps." He also noted, in a later reply, that he was "not coming back alone." Krynicki, reached Monday on Mastodon, noted that he was at a very early stage in his work. But he intended to look at the state of support across distributions, determine which long-term and short-term work to focus on, and "work on the internals and get things progressively better, even if that is not flashy." That means refactoring some of the code and, "if realistic, change some of the old ideas that I believe hold the project back," Krynicki wrote. The challenge will be finding ways to "experiment with new ideas in ways that allow controlled but more rapid progress," while maintaining stability. But all of that needs discussing with his team, when they're fully in place, Krynicki wrote. That team and their work would indicate that the Ubuntu makers have listened to perhaps the most common criticism of Snaps, whether perceptual, logistical, or both: that Snaps are an Ubuntu-focused phenomenon. Snap packages have difficulty working without AppArmor, a kernel extension that is a default in Ubuntu but not every other Linux distribution. Canonical also maintains the Snap Store. While other stores of Snaps are possible, some distributions and software packagers have turned instead to Flatpak, a similarly containerized system that doesn't have deep ties to any one distribution.' -- source: https://arstechnica.com/gadgets/2024/01/canonical-wants-better-snap-support… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0