- wlug - list.wlug.org.nz

The FSF Condemns Unauthorized Derivatives of GNU Licenses
by Peter Reutemann 20 Nov '23

20 Nov '23

'The Free Sofware Foundation issued a clarifying blog post this week, saying the organization is "pleased when people use GNU licenses to distribute and license software." But "we condemn the use of unauthorized, confusing derivatives of the licenses." Unfortunately, some authors engage in confusing practices by drafting licenses using existing terms and conditions of GNU free software licenses, without the intention of granting all four freedoms to users. For example, we have long seen attempts to add restrictions to the license text itself, placed in the LICENSE file, or included elsewhere in the program's release. An example is the so-called "Commons Clause," which, when applied to a free software license, affirms that the program is covered by the license. But, at the same time, is contradicting in its meaning by asserting that selling copies of the program or implementing a commercial service with the program is prohibited. The immediate consequence of the practice of inserting a restriction into a GNU license in this way is the confusion it causes for the community. Users still see the name of the original license, with its preamble and terms and conditions intact, transmitting a strong message that the purpose of the license is to enable users — grant users — their essential software freedoms. This message is clear from the license's text, and is bolstered from the renown accrued by the FSF and GNU trademarks, and their decades of free software advocacy. At the same time, these same users see a contradictory statement of the "Commons Clause," which is clearly contrary to the sprit of the free software movement and the Free Software Definition... [T]o make it even clearer that added restrictions are incompatible with our license, we gave users the right to delete such added restrictions [in 2007] and preserve the program's freedom. But we at the FSF have another legal tool against attempts to release programs under GNU General Public Licenses that have been wrongly altered to become nonfree licenses. The FSF holds copyrights and common law trademarks to the GNU family of General Public Licenses. Moreover, the FSF holds registered trademarks for "FSF," "Free Software Foundation," and "GNU." [...] We can't control the drafting by others of proprietary software licenses, but we can and do forbid doing this in a way that misleadingly associates those licenses with GNU or GNU licenses... [W]e are entitled to legally enforce our copyright and trademark for FSF licenses that have been altered by added restrictions to a verbatim GNU license... Licenses that confuse users about the freedoms they grant are damaging to the free software movement because they threaten to dilute the value and power of these licenses. When GNU licenses are misused through such confusing practices, it harms the renown accrued by the GNU project and the FSF over decades of free software advocacy. It is our duty to all computer users to stop these practices, and, if necessary, we will use our legal rights to this end. ' -- source: https://news.slashdot.org/story/23/11/19/1826218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Runs Ubuntu
by Lawrence D'Oliveiro 16 Nov '23

16 Nov '23

The November list of the top 500 supercomputers in the world, released a few days ago <https://top500.org/lists/top500/2023/11/> has, at number 3, a machine called “Eagle”, which is apparently part of Microsoft’s Azure cloud. Looking into the details of this <https://top500.org/system/180236/>, the OS is listed as “Ubuntu 22.04”. And there is another Microsoft-based super at number 15 <https://top500.org/system/180171/>, obviously older because its OS is listed as “Ubuntu 20.04”. And at number 23 <https://top500.org/system/180024/>, we have one running “Ubuntu 18.04 LTS”. Then a few more, even older, down in the 50s, all on Ubuntu 16.04 LTS. Conclusion: they won’t even use their own Windows-based Hyper-V virtualization architecture on high-performance installations. The ARM-based Fugaku machine, which was top of the list not so long ago, has dropped to number 4. Apart from that and two IBM POWER-based entries, the rest of the top 10 is currently all x86-based.

1 0

Firefox Going To Ship With Wayland Enabled By Default
by Peter Reutemann 16 Nov '23

16 Nov '23

'Michael Larabel reports via Phoronix: Guardrails have been in place where the Firefox browser has enabled Wayland by default (when running on recent GTK versions) but as of today that code has been removed... Firefox will try to move forward with stable releases where Wayland will ship by default! Mozilla Bug 1752398 to "ship the Wayland backend to release" has been closed this evening! After the ticket was open for the past two years, it's now deemed ready to hopefully ship enabled for Firefox 121! This patch drops the "early beta or earlier" check to let Wayland support be enabled by default when running on recent GTK versions (GTK 3.24.30 threshold). Firefox 121 is due for release around 19 December and if all continues to hold, it will finally ship with the Wayland back-end enabled by default as another big step forward. ' -- source: https://news.slashdot.org/story/23/11/15/2116232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Proposed Acquisition Of Serato By Pioneer DJ Ruffling Feathers
by Lawrence D'Oliveiro 15 Nov '23

15 Nov '23

Serato is an NZ-based company that produces a software product that allows “scratching” of audio files on a computer. They provide special vinyl records that contain, not music, but a special time code that the software can recognize whether it is played forwards or backwards or fast or slow at whatever point, and keep the audio in sync. And if and when the vinyl wears out, you can just get new discs--your precious audio data remains pristine, free from the imperfections of being actually being encoded on vinyl. Now, an international company wants to buy them out <https://www.1news.co.nz/2023/11/15/kiwi-start-up-caught-up-in-controversial…>. And another international company, InMusic, is concerned enough about the deal here in little old NZ, to raise an objection. By the way, I find it a bit odd to find Serato described as a “start-up” in the subhead, but as a “software giant” just a few lines further down. I first heard of them about a quarter-century ago, so they are hardly newcomers. I suppose a hundred-million-odd turnover makes them a “giant” in NZ terms, yet the prospect of becoming part of a much larger company could make the present operation seem like a minnow in comparison. Or maybe not: maybe their present size already gives them a huge fraction of what is a fairly niche market. And sure enough, after all this time, there are open-source alternatives <https://alternativeto.net/software/serato-dj/>. I had a quick look at the info on Mixxx <https://mixxx.org/>, and they do mention “vinyl record control”, where you “use turntables with timecode vinyl records to control playback and scratch your digital music files as if they were pressed on vinyl”. Some more info on timecode vinyl is here <https://mixxx.org/news/2021-11-21-dvs-internals-pt1/>. Among the formats supported is the Serato one, and discs are apparently available from the company for “£10-20 each” <http://xwax.org/overview.html>. By the way, Debian includes packages in its standard repo for both Mixxx and xwax.

1 0

Intel Fixes High-Severity CPU Bug That Causes 'Very Strange Behavior'
by Peter Reutemann 15 Nov '23

15 Nov '23

'Ars Technica: Intel on Tuesday pushed microcode updates to fix a high-severity CPU bug that has the potential to be maliciously exploited against cloud-based hosts. The flaw, affecting virtually all modern Intel CPUs, causes them to "enter a glitch state where the normal rules don't apply," Tavis Ormandy, one of several security researchers inside Google who discovered the bug, reported. Once triggered, the glitch state results in unexpected and potentially serious behavior, most notably system crashes that occur even when untrusted code is executed within a guest account of a virtual machine, which, under most cloud security models, is assumed to be safe from such faults. Escalation of privileges is also a possibility. The bug, tracked under the common name Reptar and the designation CVE-2023-23583, is related to how affected CPUs manage prefixes, which change the behavior of instructions sent by running software. Intel x64 decoding generally allows redundant prefixes -- meaning those that don't make sense in a given context -- to be ignored without consequence. During testing in August, Ormandy noticed that the REX prefix was generating "unexpected results" when running on Intel CPUs that support a newer feature known as fast short repeat move, which was introduced in the Ice Lake architecture to fix microcoding bottlenecks. The unexpected behavior occurred when adding the redundant rex.r prefixes to the FSRM-optimized rep mov operation. [...] Intel's official bulletin lists two classes of affected products: those that were already fixed and those that are fixed using microcode updates released Tuesday. An exhaustive list of affected CPUs is available here. As usual, the microcode updates will be available from device or motherboard manufacturers. While individuals aren't likely to face any immediate threat from this vulnerability, they should check with the manufacturer for a fix. People with expertise in x86 instruction and decoding should read Ormandy's post in its entirety. For everyone else, the most important takeaway is this: "However, we simply don't know if we can control the corruption precisely enough to achieve privilege escalation." That means it's not possible for people outside of Intel to know the true extent of the vulnerability severity. That said, anytime code running inside a virtual machine can crash the hypervisor the VM runs on, cloud providers like Google, Microsoft, Amazon, and others are going to immediately take notice.' -- source: https://it.slashdot.org/story/23/11/14/2257235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In a First, Cryptographic Keys Protecting SSH Connections Stolen in New Attack
by Peter Reutemann 15 Nov '23

15 Nov '23

'For the first time, researchers have demonstrated that a large portion of cryptographic keys used to protect data in computer-to-server SSH traffic are vulnerable to complete compromise when naturally occurring computational errors occur while the connection is being established. ArsTechnica: Underscoring the importance of their discovery, the researchers used their findings to calculate the private portion of almost 200 unique SSH keys they observed in public Internet scans taken over the past seven years. The researchers suspect keys used in IPsec connections could suffer the same fate. SSH is the cryptographic protocol used in secure shell connections that allows computers to remotely access servers, usually in security-sensitive enterprise environments. IPsec is a protocol used by virtual private networks that route traffic through an encrypted tunnel. The vulnerability occurs when there are errors during the signature generation that takes place when a client and server are establishing a connection. It affects only keys using the RSA cryptographic algorithm, which the researchers found in roughly a third of the SSH signatures they examined. That translates to roughly 1 billion signatures out of the 3.2 billion signatures examined. Of the roughly 1 billion RSA signatures, about one in a million exposed the private key of the host. While the percentage is infinitesimally small, the finding is nonetheless surprising for several reasons -- most notably because most SSH software in use has deployed a countermeasure for decades that checks for signature faults before sending a signature over the Internet. Another reason for the surprise is that until now, researchers believed that signature faults exposed only RSA keys used in the TLS -- or Transport Layer Security -- protocol encrypting Web and email connections. They believed SSH traffic was immune from such attacks because passive attackers -- meaning adversaries simply observing traffic as it goes by -- couldn't see some of the necessary information when the errors happened.' -- source: https://it.slashdot.org/story/23/11/13/1446217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Asahi: Not Just A Distro
by Lawrence D'Oliveiro 14 Nov '23

14 Nov '23

The Ubuntu Summit that recently took place had discussions about running Ubuntu on ARM and RISC-V processors <https://www.theregister.com/2023/11/13/ubuntu_for_arm64_laptops/>. One interesting thing in that article is that the Asahi project, which was getting Linux running on Apple’s ARM-based machines, is no longer confined to Arch Linux. It is now also working with Ubuntu, with the help of a developer from, of all things, the OpenBSD project. And there are other alternatives, including Fedora and Debian. Also interesting to read how Apple makes the little speakers in its laptops sound better than they should, by carefully driving them beyond what would normally be considered their “safe” power limits, based on the frequency characteristics of the signal at any moment. This technique has been recreated in an open-source program called “speakersafetyd”.

1 0

I Wonder If This Is A WordPress Thing ...
by Lawrence D'Oliveiro 14 Nov '23

14 Nov '23

You may not notice it, but a remarkable number of sites are built on WordPress. Seems the ability to customize the layout of such sites is limitless. But I think one of the clues that WordPress lies underneath is sometimes you see image URLs that look like MHMA5269-copy-1698399489.jpg?resize=770,513&quality=80 I think this is characteristic of some image-manipulation plugin that resizes the image for embedding in the page. In this case, I tried the part from the “?” onwards, and ended up with a much larger and higher-quality image file.

1 0

Why Chrome Enabled WebAssembly Garbage Collection (WasmGC) By Default
by Peter Reutemann 13 Nov '23

13 Nov '23

'In Chrome, JavaScript (and WebAssembly) code are both executed by Google's open source V8 engine — which already has garbage-collecting capabilities. "This means developers making use of, for example, PHP compiled to Wasm, end up shipping a garbage collector implementation of the ported language (PHP) to the browser that already has a garbage collector," writes Google developer advocate Thomas Steiner, "which is as wasteful as it sounds." "This is where WasmGC comes in." WebAssembly Garbage Collection (or WasmGC) is a proposal of the WebAssembly Community Group [which] adds struct and array heap types, which means support for non-linear memory allocation... In simplified terms, this means that with WasmGC, porting a programming language to WebAssembly means the programming language's garbage collector no longer needs to be part of the port, but instead the existing garbage collector can be used. Sometime on Halloween, Steiner wrote that in Chrome, WebAssembly garbage collection is now enabled by default. But then he explored what this means for high-level programming languages (with their own built-in garbage collection) being compiled into WebAssembly: To verify the real-world impact of this improvement, Chrome's Wasm team has compiled versions of the Fannkuch benchmark (which allocates data structures as it works) from C, Rust, and Java. The C and Rust binaries could be anywhere from 6.1 K to 9.6 K depending on the various compiler flags, while the Java version is much smaller at only 2.3 K! C and Rust do not include a garbage collector, but they do still bundle malloc/free to manage memory, and the reason Java is smaller here is because it doesn't need to bundle any memory management code at all. This is just one specific example, but it shows that WasmGC binaries have the potential of being very small, and this is even before any significant work on optimizing for size. The blog post includes two examples of WasmGC-ported programming languages in action: - "One of the first programming languages that has been ported to Wasm thanks to WasmGC is Kotlin in the form of Kotlin/Wasm." - "The Dart and Flutter teams at Google are also preparing support for WasmGC. The Dart-to-Wasm compilation work is almost complete, and the team is working on tooling support for delivering Flutter web applications compiled to WebAssembly."' -- source: https://developers.slashdot.org/story/23/11/12/0456220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

Remote desktop without using x protocols
by David Nicholls 10 Nov '23

10 Nov '23

I have noticed a number of distros are starting to drop support for x11. This becomes annoying if you are wanting to remote into a Linux box (itth a GUI) RDP style prior to logging in as all the documented solutions that don't require a cloud, docker or server seem to need xrdp, xvnc or similar x based solution installed. Can anyone point me to a cross platform project that does not require x11? -- Cheers... David Nicholls

2 2