- wlug - list.wlug.org.nz

Microsoft's GitHub Under Fire For DDoSing Crucial Open Source Project Website
by Peter Reutemann 29 Jun '23

29 Jun '23

'The servers used by the GMP project, an open source arithmetic library at the heart of GCC and other programs, slowed to a crawl earlier this month due to a large amount of network traffic originating from Microsoft servers. The Register reports: Torbjorn Granlund, principal author of GMP, raised the alarm in a note to the project's mailing list. "The GMP servers are under attack by several hundred IP addresses owned by Microsoft Corporation," he wrote. "We do not know if this is made with malice by Microsoft, if it is some sort of mistake, or if [it is one] of their cloud customers ... running the attack. The attack targets the GMP repo, with thousands of identical requests. The requests are cleverly chosen as to cause heavy system load. "We're firewalling off all of Microsoft's IP addresses as an emergency response." The following day, Mike Blacker, director of threat hunting, operations, and response at Microsoft's GitHub, had identified the culprit: a GitHub Actions Workflow that clones a Mercurial repo and has been forked more than 700 of times. "Microsoft and GitHub have investigated the issue and determined that a GitHub user updated a script within the FFmpeg-Builds project that pulled content from https://gmplib.org," explained Blacker. "This build was configured to run parallel simultaneous tests on 100 different types of computers/architectures. This activity does not appear to be nefarious. [GMP] appears to have limited infrastructure that could not sustain the limited, yet simultaneous requests." [...] As of last week, the excessive traffic was still an issue. "Our servers are fully available again, but that's the result of us adding all participating Microsoft network ranges to our firewall," the GMP project explains on its webpage. "We understand that we are far from the first project to take such measures against Github." The Register asked Granlund whether he was satisfied with Microsoft-GitHub's response, and he told us he had only heard once from Blacker. "I blocked about 40 IP ranges from accessing our web server," he explained. "A week after this started, there was still intensive traffic from the same IP addresses, perhaps 100 different Microsoft addresses all in all, belonging to about 40 ranges. The difference was that that traffic just caused minuscule load, and a log line in the firewall." "Problem solved. I cannot care less if they no longer can access gmplib.org. I find it interesting how little responsibility Github/Microsoft assume here. They seem to think that they are entitled to bash away at smaller sites." ' -- source: https://tech.slashdot.org/story/23/06/28/2045228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Let’s Encrypt Outage--Did Anybody Notice?
by Lawrence D'Oliveiro 29 Jun '23

29 Jun '23

Just noticed a mention in passing in this article <https://www.theregister.com/2023/06/28/microsofts_github_gmp_project/> that Let’s Encrypt was issuing bad certificates over a period of about an hour earlier this month <https://letsencrypt.status.io/pages/incident/55957a99e800baa4470002da/648b3…>. An explanation of what went wrong (from a third party who does monitoring of CA (mis)behaviour as part of his job) is here <https://www.agwa.name/blog/post/last_weeks_lets_encrypt_downtime>. Seems like many of the people affected were still using their bad certificates a week after the incident. Did you have one of the bad certificates? That article mentions a new addition to the ACME auto-renewal protocols that would allow clients to resolve a glitch like this in future without any manual intervention.

1 0

The Linux coders turning the ROG Ally and other handhelds into Steam Deck clones
by Peter Reutemann 28 Jun '23

28 Jun '23

'As soon as I was done with my review of the Asus ROG Ally, I grabbed my best USB stick and started looking for ISOs to download. Windows is, of course, the main highway to most PC gaming, but it's also (as detailed in the review) not yet built to work well on a 7-inch gaming handheld. The ROG Ally ships with Windows (Home) installed and a bunch of Asus software, but it is still, at heart, a PC. With effort, you can get into the BIOS, disable Secure Boot, plug in a USB stick, and boot a USB stick with a live Linux distribution on it. [...] With Ubuntu 23.04 installed, I could run the Phoronix Test Suite and run glxgears, which showed that at least some kind of 3D acceleration was happening. I installed Cyberpunk 2077 through Steam's Proton compatibility tool, benchmarked it, and got, well, very sad numbers. Cyberpunk saw that my GPU was the Ally's key feature—an AMD Ryzen Z1 Extreme. But it ran at 17 and 23 frames per second averages on "Medium" and "Steam Deck" settings, respectively (at 720p resolution and 60 Hz refresh rate). With nothing to lose, I installed the latest AMD Linux drivers, ran those benchmarks again, and lo and behold, improvement: 30.8 and 27.32 fps on "Medium" and "Steam Deck." That's notably shy of the 38 and 34 frames per second I clocked on the same benchmark in Windows. Then again, I'm guessing at drivers, and I can't do much to control thermals or power draw.' -- source: https://arstechnica.com/gadgets/2023/06/the-linux-coders-turning-the-rog-al… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Kart - git for geospatial data
by Peter Reutemann 27 Jun '23

27 Jun '23

Hi everyone Just came across this interesting project on my Mastodon feed (https://cloudisland.nz/@dznz/110613146633504731) Kart - Distributed version-control for geospatial and tabular data "stores geospatial and tabular data in Git, providing version control at the row and cell level." https://kartproject.org/ Is being developed by local company Koordinates and released under GPLv2 with linking exception. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Foundation Celebrates Zephyr Project's Small Real-Time Operating System
by Peter Reutemann 27 Jun '23

27 Jun '23

'This week the Linux Foundation shared an update on the Zephyr Project, a small real-time operating system for connected, resource-constrained and embedded devices: The project recently achieved several milestones including surpassing 80,000 commits since it was released in open source in 2015. This is an average of almost 2 commits per hour, which was made recently by 490 individuals, including 166 first-timers, who contributed to the 3.4 release. Zephyr RTOS supports over 450 boards running embedded microcontrollers from Arm and RISC-V to Tensilica, NIOS, ARC and x86 as single and multicore systems... Zephyr RTOS has a growing set of software libraries that can be used across various applications and industry sectors such as Industrial IoT, wearables, machine learning and more. It is built with an emphasis on broad chipset support, security, dependability, long-term support releases and a growing open source ecosystem... The Zephyr community will be at the Zephyr Developer Summit, which takes place on June 27-30 in Prague, Czech Republic, and virtually as part of the first-ever Embedded Open Source Summit. [Register here for virtual attendance.] Arduino will be joining Zephyr's Technical Steering Committee, along with Technology Innovation Institute and the American multinational semiconductor company Analog Devices (or ADI, who will also be joining its governing board). Arduino's CEO said "We believe that Zephyr OS is a truly special project that will play a significant role in the Arduino ecosystem and will be a big priority for us." As a "Platinum"-level sponsor, ADI joins Antmicro, Baumer, Google, Intel, Meta, Nordic Semiconductor, NXP, Oticon, Qualcomm Innovation Center and T-Mobile.' -- source: https://news.slashdot.org/story/23/06/26/0234245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GCC Steering Committee Announces a Code of Conduct
by Peter Reutemann 26 Jun '23

26 Jun '23

'GCC is the GNU project's free and open-source cross-platform compiler collection. Now an anonymous reader shared this announcement from the mailing list for GCC: The GCC Steering Committee has decided to adopt a Code of Conduct for interactions in GCC project spaces, including mailing lists, bugzilla, and IRC. The vast majority of the time, the GCC community is a very civil, cooperative space. On the rare occasions that it isn't, it's helpful to have something to point to to remind people of our expectations. It's also good for newcomers to have something to refer to, for both how they are expected to conduct themselves and how they can expect to be treated... At this time the CoC is preliminary: the code itself should be considered active, but the CoC committee (and so the reporting and response procedures) are not yet in place. There's also an official FAQ, and GCC's Code of Conduct begins with this introduction. "Like the free software community as a whole, the GCC community is made up of a mixture of professionals and volunteers from all over the world, working on every aspect of the project — including mentorship, teaching, and connecting people." Where this leads to issues and unhappiness, "we have a few ground rules that we ask people to adhere to... [T]ake it in the spirit in which it's intended — a guide to make it easier to enrich all of us, the project, and the broader communities in which we participate."' -- source: https://news.slashdot.org/story/23/06/25/2255253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PipeWire Versus PulseAudio+JACK
by Lawrence D'Oliveiro 25 Jun '23

25 Jun '23

Came across this PipeWire FAQ <https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/FAQ>, which among other things explains why there is a need to replace both PulseAudio and JACK. Briefly, it started from a wish to manage video inputs and outputs in a similar way to audio inputs and outputs, and also fix some performance/configuration limitations in the older specs. And if you are wondering why all your sound devices have suddenly acquired a “Pro Audio” option in their settings, this explains that as well. Also, for those complaining that Wayland’s stricter security model breaks basic functionality like screen recording and sharing, it appears PipeWire is the basis for the solution to that problem.

1 0

DuckDuckGo browser beta for Windows bakes in a lot of privacy tools
by Peter Reutemann 23 Jun '23

23 Jun '23

'Privacy-focused firm DuckDuckGo has released a public beta of its browser for Windows, offering more default privacy protections and an assortment of Duck-made browsing tools. More than a year after debuting its browser for Mac in private beta, the search engine and tracking antagonist offers many of those same features to a much wider audience. Like its Mac browser, DuckDuckGo (DDG) uses "the underlying operating system rendering API" rather than its own forked browser code. That's "a Windows WebView2 call that utilizes the Blink rendering engine underneath," according to DuckDuckGo's blog post. Fittingly, the browser reports itself as Microsoft Edge at most header-scanning sites.' -- source: https://arstechnica.com/gadgets/2023/06/duckduckgo-offers-its-privacy-cente… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Art Of Refurbishing Old Computers
by Lawrence D'Oliveiro 22 Jun '23

22 Jun '23

Interesting report <https://www.theregister.com/2023/06/21/pc_officina_positive_trashware/> on an Italian organization, which mentions some points which could be useful to those doing the same thing here: how to salvage and refurbish old PCs for donation to those who can’t afford something new. Note that they won’t take any old rubbish: they will no longer accept 32-bit machines or those needing DDR2 RAM, for example. Their current recommended OS is Linux Mint 21 with XFCE, but they will source Microsoft Windows for those who really want it (at what cost?).

1 0

Latest SUSE Linux Enterprise Goes All in With Confidential Computing
by Peter Reutemann 21 Jun '23

21 Jun '23

'SUSE's latest release of SUSE Linux Enterprise 15 Service Pack 5 (SLE 15 SP5) has a focus on security, claiming it as the first distro to offer full support for confidential computing to protect data. From a report: According to SUSE, the latest version of its enterprise platform is designed to deliver high-performance computing capabilities, with an inevitable mention of AI/ML workloads, plus it claims to have extended its live-patching capabilities. The release also comes just weeks after the community release openSUSE Leap 15.5 was made available, with the two sharing a common core. The Reg's resident open source guru noted that Leap 15.6 has now been confirmed as under development, which implies that a future SLE 15 SP6 should also be in the pipeline. SUSE announced the latest version at its SUSECON event in Munich, along with a new report on cloud security issues claiming that more than 88 percent of IT teams have reported at least one cloud security incident over the the past year. This appears to be the justification for the claim that SLE 15 SP5 is the first Linux distro to support "the entire spectrum" of confidential computing, allowing customers to run fully encrypted virtual machines on their infrastructure to protect applications and their associated data. Confidential computing relies on hardware-based security mechanisms in the processor to provide this protection, so enterprises hoping to take advantage of this will need to ensure their servers have the necessary support, such as AMD's Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) and Intel's Trust Domain Extensions (TDX).' -- source: https://linux.slashdot.org/story/23/06/20/1846203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0