- wlug - list.wlug.org.nz

Another Apple “Innovation” Bites The Dust
by Lawrence D'Oliveiro 01 Nov '23

01 Nov '23

This commentary <https://www.theregister.com/2023/11/01/apple_kills_off_touchpad/> on Apple’s latest product introductions mentions, among other things, the company’s abandonment of its “touch bar” technology: Personally, my biggest gripe with the Touch Bar during the two years I used it was the overall lack of tactility. Because it replaced the top row of keys with an indistinct plate of glass, and its contents changed depending on what you were doing, using it required looking away from the screen and down at the keyboard. Am I really the only one to notice the great irony of touchscreens, that they cannot be operated by touch? That, being a featureless flat surface in tactile terms, you have to look at the image being displayed on them to figure out where the buttons are?

2 1

Russia Blocks 167 VPNs, Steps Up OpenVPN and WireGuard Disruption
by Peter Reutemann 01 Nov '23

01 Nov '23

'TorrentFreak reports: The head of the Russian department responsible for identifying threats to the "stability, security and integrity" of the internet, has revealed the extent of the Kremlin's VPN crackdown. Former FSO officer Sergei Khutortsev, a central figure in Russia's 'sovereign internet' project, confirmed that 167 VPN services are now blocked along with over 200 email services. Russia is also reported as stepping up measures against protocols such as OpenVPN, IKEv2 and WireGuard. [...] An in-depth report published by TheIns.ru has details of the monitoring/blocking system reportedly deployed in Russia, how much it costs (4.3 billion rubles/$43 million in 2020, 24.7 billion rubles/$247 million for 2022-2024), and the names of the companies supplying the components. The publication also obtained original documents that apparently show some of the protocols Russia initially intended to block. They include older VPN protocols IPSec, L2TP, and PPTP, plus the BitTorrent protocol still widely used today. The full report on the system, which reveals the use of Intel chips/chipsets in 965 servers manufactured by Huawei and already purchased by Russia, plus another 2400+ servers for 2023/24, is available here.' -- source: https://tech.slashdot.org/story/23/10/31/2124234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Plans RISC-V Android Tools In 2024, Wants Developers To 'Be Ready'
by Peter Reutemann 01 Nov '23

01 Nov '23

'Ars Technica reports: Android is slowly entering the RISC-V era. So far we've seen Google say it wants to give the up-and-coming CPU architecture "tier-1" support in Android, putting RISC-V on equal footing with Arm. Qualcomm has announced the first mass-market RISC-V Android chip, a still-untitled Snapdragon Wear chip for smartwatches. Now Google has announced a timeline for developer tools via the Google Open Source Blog. The last post is titled "Android and RISC-V: What you need to know to be ready." Getting the Android OS and app ecosystem to support a new architecture is going to take an incredible amount of work from Google and developers, and these tools are laying the foundation for that work. First up, Google already has the "Cuttlefish" virtual device emulator running, including a gif of it booting up. This isn't the official "Android Emulator" -- which is targeted at app developers doing app development -- Cuttlefish is a hardware emulator for Android OS development. It's the same idea as the Android Emulator but for the bottom half of the tech stack -- the kernel, framework, and hardware bits. Cuttlefish lets Google and other Android OS contributors work on a RISC-V Android build without messing with an individual RISC-V device. Google says it's working well enough now that you can download and emulate a RISC-V device today, though the company warns that nothing is optimized yet. The next step is getting the Android Emulator (for app developers) up and running, and Google says: "By 2024, the plan is to have emulators available publicly, with a full feature set to test applications for various device form factors!" The nice thing about Android is that most app code is written with no architecture in mind -- it's all just Java/Kotlin. So once the Android RunTime starts spitting out RISC-V code, a lot of app code should Just Work. That means most of the porting work will need to go into things written in the NDK, the native developer kit, like libraries and games. The emulator will still be great for testing, though.' -- source: https://developers.slashdot.org/story/23/10/31/2059206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bcachefs Merged Into the Linux 6.7 Kernel
by Peter Reutemann 01 Nov '23

01 Nov '23

'The new open-source, copy-on-write file system known as Bcachefs has been successfully merged into the Linux 6.7 kernel. "Given the past struggles to get Bcachefs mainlined, I certainly didn't expect to see Linus Torvalds act so soon on merging it," writes Phoronix's Michael Larabel. "But after it spent all of the 6.6 cycle within Linux-Next, overnight Linus Torvalds did in fact land this new file-system developed by Kent Overstreet." >From a Slashdot story published on Friday August 21, 2015: Bcachefs is a new open-source file-system derived from the bcache Linux kernel block layer cache. Bcachefs was announced by Kent Overstreet, the lead Bcache author. Bcachefs hopes to provide performance like XFS/EXT4 while having features similar to Btrfs and ZFS. The bachefs on-disk format hasn't yet been finalized and the code isn't yet ready for the Linux kernel. That said, initial performance results are okay and "It probably won't eat your data -- but no promises." Features so far for Bcachefs are support for multiple devices, built-in caching/tiering, CRC32C checksumming, and Zlib transparent compression. Support for snapshots is to be worked on.' -- source: https://linux.slashdot.org/story/23/10/31/215248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Promises a Rescue Patch For Android 14's 'Ransomware' Bug
by Peter Reutemann 01 Nov '23

01 Nov '23

'Google says it'll issue a system update to fix a major storage bug in Android 14 that has caused some users to be locked out of their devices. Ars Technica reports: Apparently one more round of news reports was enough to get the gears moving at Google. Over the weekend the Issue tracker bug has been kicked up from a mid-level "P2" priority to "P0," the highest priority on the issue tracker. The bug has been assigned to someone now, and Googlers have jumped into the thread to make official statements that Google is looking into the matter. Here's the big post from Google on the bug tracker [...]. The highlights here are that Google says the bug affects devices with multiple Android users, not multiple Google accounts or (something we thought originally) users with work profiles. Setting up multiple users means going to the system settings, then "Multiple users," then "Allow multiple users," and you can add a user other than the default one. If you do this, you'll have a user switcher at the bottom of the quick settings. Multiple users all have separate data, separate apps, and separate Google accounts. Child users are probably the most popular reason to use this feature since you can lock kids out of things, like purchasing apps. Shipping a Google Play system update as a quick Band-Aid is an interesting solution, but as Google's post suggests, this doesn't mean the problem is fixed. Play system updates (these are alternatively called Project Mainline or APEX modules) allow Google to update core system components via the Play Store, but they are really not meant for critical fixes. The big problem is that the Play system updates don't aggressively apply themselves or even let you know they have been downloaded. They just passively, silently wait for a reboot to happen so they can apply. For Pixel users, it feels like the horse has already left the barn anyway -- like most Pixel phones have automatically applied the nearly 13-day-old update by now. Users can force Play system updates to happen themselves by going to the system settings, then "Security & Privacy," then "System & updates," then "Google Play system update." If you have an update, you'll be prompted to reboot the phone. Also note that this differs from the usual OS update checker location, which is in system settings, then "System," then "System update." The system update screen will happily tell you "Your system is up to date" even if you have a pending Google Play system update. It would be great to have a single location for OS updates, Google Play System/Mainline updates, and app updates, but they are scattered everywhere and give conflicting "up to date" messages.' -- source: https://hardware.slashdot.org/story/23/10/30/2310212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“This vulnerability is now under mass exploitation.” Citrix Bleed bug bites hard
by Peter Reutemann 31 Oct '23

31 Oct '23

'A vulnerability that allows attackers to bypass multifactor authentication and access enterprise networks using hardware sold by Citrix is under mass exploitation by ransomware hackers despite a patch being available for three weeks. Citrix Bleed, the common name for the vulnerability, carries a severity rating of 9.4 out of a possible 10, a relatively high designation for a mere information-disclosure bug. The reason: the information disclosed can include session tokens, which the hardware assigns to devices that have already successfully provided credentials, including those providing MFA. The vulnerability, tracked as CVE-2023-4966 and residing in Citrix’s NetScaler Application Delivery Controller and NetScaler Gateway, has been under active exploitation since August. Citrix issued a patch on October 10. ' -- source: https://arstechnica.com/security/2023/10/critical-citrix-bleed-vulnerabilit… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint Gets 'Experimental' Wayland Support in December
by Peter Reutemann 30 Oct '23

30 Oct '23

'"The work started on Wayland," the Linux Mint project announced in their monthly newsletter. An anonymous reader shared this report from 9to5Linux about an upcoming new option in the Ubuntu-based distro: Linux Mint 21.3 [planned for Christmas of 2023] will be the first Linux Mint release to offer a Wayland session, but in an experimental state. The default session will still be the X11 one, but users who want to try Wayland can do so by selecting the "Cinnamon on Wayland" session from the login screen. "The Wayland session won't be as stable as the default one. It will lack features and it will come with its own limitations. We won't recommend it but you'll be able to give it a shot if you want to and it'll be there for interested people if they want to give us feedback," said Linux Mint project leader Clement Lefebvre. I said that "2024 is the year of the Wayland desktop", but Clement Lefebvre doesn't think Linux Mint needs Wayland support before 2026... By that time, I believe Xfce will also be fully Wayland compatible so that Linux Mint can fully switch to Wayland by default. The newsletter says the 2026 target "leaves us two years to identify and to fix all the issues. It's something we'll continue to work on. "Whenever it happens, assuming it does, we'll consider switching defaults. We'll use the best tools to do the job and provide the best experience. Today that means Xorg. Tomorrow it might mean Wayland. We'll be ready and compatible with both."' -- source: https://linux.slashdot.org/story/23/10/29/2017257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Experimental Project Attempts a Python Virtual Shell for Linux
by Peter Reutemann 30 Oct '23

30 Oct '23

'Long-time Slashdot reader CJSHayward shares "an attempt at Python virtual shell." The home-brewed project "mixes your native shell with Python with the goal of letting you use your regular shell but also use Python as effectively a shell scripting language, as an alternative to your shell's built-in scripting language... I invite you to explore and improve it!" >From the web site: The Python Virtual Shell (pvsh or 'p' on the command line) lets you mix zsh / bash / etc. built-in shell scripting with slightly modified Python scripting. It's kind of like Brython [a Python implementation for client-side web programming], but for the Linux / Unix / Mac command line... The core concept is that all Python code is indented with tabs, with an extra tab at the beginning to mark Python code, and all shell commands (including some shell builtins) have zero tabs of indentation. They can be mixed line-by-line, offering an opportunity to use built-in zsh, bash, etc. scripting or Python scripting as desired. The Python is an incomplete implementation; it doesn't support breaking a line into multiple lines. Nonetheless, this offers a tool to fuse shell- and Python-based interactions from the Linux / Unix / Mac command line.' -- source: https://developers.slashdot.org/story/23/10/29/1610218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Pro-Russia hackers target inboxes with 0-day in webmail app used by millions
by Peter Reutemann 26 Oct '23

26 Oct '23

'A relentless team of pro-Russia hackers has been exploiting a zero-day vulnerability in widely used webmail software in attacks targeting governmental entities and a think tank, all in Europe, researchers from security firm ESET said on Wednesday. The previously unknown vulnerability resulted from a critical cross-site scripting error in Roundcube, a server application used by more than 1,000 webmail services and millions of their end users. Members of a pro-Russia and Belarus hacking group tracked as Winter Vivern used the XSS bug to inject JavaScript into the Roundcube server application. The injection was triggered simply by viewing a malicious email, which caused the server to send emails from selected targets to a server controlled by the threat actor.' -- source: https://arstechnica.com/security/2023/10/pro-russia-hackers-target-inboxes-… CVE-2023-5631: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5631 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Excel As A Cancer
by Lawrence D'Oliveiro 24 Oct '23

24 Oct '23

This only slightly tongue-in-cheek opinion piece <https://www.theregister.com/2023/10/16/excel_hell_comment/> on the seeming inevitability of data-processing errors due to overuse/misuse/abuse of Microsoft Excel suggests the creation of a whole new industry to mitigate those errors, rather than try to avoid them by switching to another tool. One of the user comments linked to this article <https://journals.plos.org/ploscompbiol/article?id=10.1371/journal.pcbi.1008…>, which is an analysis of what has happened in genetics research in the years since measures were taken to rename genes with names that were prone to being misinterpreted by Excel, and otherwise raise awareness of the issue of Excel import/processing errors. The conclusion? Things haven’t improved at all. I absolutely love the recommendations that they make. The first one is a biggie: Scripted analyses are preferred over spreadsheets. Gene name to date conversion is a bug specific to spreadsheets and doesn’t occur in scripted computer languages like Python or R. In addition, analyses conducted with Python and R notebooks (eg: Jupyter or Rmarkdown) capture computational methods and results in a stepwise fashion meaning these workflows can be more readily audited. These notebooks can therefore achieve a higher level of computational reproducibility than spreadsheets. Although this requires a big investment in learning a computer language, this investment pays off in the longer term. Note that bit: “capture computational methods and results in a stepwise fashion meaning these workflows can be more readily audited”. Here I thought reproducibility was an absolutely non-negotiable foundation stone of scientific research, yet it seems people have been publishing results with nothing to back up their analyses other than an Excel spreadsheet. Also: If a spreadsheet must be used, then LibreOffice is recommended because it will avoid such errors from occurring. This will not remedy other error types. Better than sticking with Excel! But still not as good as proper analysis tools. If you must use Excel, then ... then take great care importing the data. If opening a TSV or CSV file, use the data import wizard to ensure that each column of data is formatted appropriately. Though I suspect most of the users are clueless about this, else they would be doing it already. A good recommendation on data formats in general: Instead of spreadsheets, share genomic data as “flat text” files. These typically have the suffixes “csv”, “tsv” or “txt”. These are native formats for computer languages and suitable for long term data archiving. Excel formats such as “xls” or “xlsx” are proprietary and future development is decided by Microsoft. The problems are not just in genetics, of course: Although changes to gene names and software will help, they won’t solve the overarching problem with spreadsheets; that (i) errors occur silently, (ii) errors can be hidden amongst thousands of rows of data, and (iii) they are difficult to audit. Research shows that errors are surprisingly common in the business setting, which raises the question as to how common such errors are in science. The difficulty in auditing spreadsheets makes them generally incompatible with the principles of computational reproducibility.

3 3