- wlug - list.wlug.org.nz

Question please re: How to attach an Android (Samsung cellphone Galaxy A03S) photo to a Gmail email using Firefox and Ubuntu
by Michael James 20 Mar '23

20 Mar '23

G'day... Can anyone please suggest how to attach a photo - (from a Samsung Galaxy A03S cellphone via USB cable from the phone to a desktop) - onto a Gmail email using Firefox and running Ubuntu. Have tried connecting the phone via USB to the desktop and clicking the attach button on the email and double clicking the file in the Ubuntu Files folder under the Activities heading. This does not work. I tried both right and left mouse options and the 'OPEN' option; I also tried copying the file (photo) to downloads and attempted to attach via the same above pathway but this did not work either. I came across this post (below) on the internet from 2010 with the same question and the following answer: https://superuser.com/questions/132783/how-to-email-photo-from-ubuntu-f-spo… I'm not familiar with Python code and wonder if this answer is now outdated? Wondering if the problem is with Firefox? Gmail is running fine on Ubuntu with Firefox, it's just the attaching of photos from the Android that's giving trouble. Short of using the phone itself or Thunderbird or any other email service to send the photo, is there a way to attach photos to Gmail emails via Firefox running on Ubuntu please? Thanks, Michael James __________________________________________________________________________________________

2 2

Google tells users of some Android phones: Nuke voice calling to avoid infection
by Peter Reutemann 20 Mar '23

20 Mar '23

'Google is urging owners of certain Android phones to take urgent action to protect themselves from critical vulnerabilities that give skilled hackers the ability to surreptitiously compromise their devices by making a specially crafted call to their number. It’s not clear if all actions urged are even possible, however, and even if they are, the measures will neuter devices of most voice-calling capabilities. The vulnerability affects Android devices that use the Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos Auto T5123 chipsets made by Samsung’s semiconductor division. Vulnerable devices include the Pixel 6 and 7, international versions of the Samsung Galaxy S22, various mid-range Samsung phones, the Galaxy Watch 4 and 5, and cars with the Exynos Auto T5123 chip. These devices are ONLY vulnerable if they run the Exynos chipset, which includes the baseband that processes signals for voice calls. The US version of the Galaxy S22 runs a Qualcomm Snapdragon chip. A bug tracked as CVE-2023-24033 and three others that have yet to receive a CVE designation make it possible for hackers to execute malicious code, Google’s Project Zero vulnerability team reported on Thursday. Code-execution bugs in the baseband can be especially critical because the chips are endowed with root-level system privileges to ensure voice calls work reliably.' -- source: https://arstechnica.com/information-technology/2023/03/critical-vulnerabili… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unix Pioneer Ken Thompson Announces He's Switching From Mac To Linux
by Peter Reutemann 20 Mar '23

20 Mar '23

'The closing keynote at the SCaLE 20x conference was delivered by 80-year-old Ken Thompson (co-creator of Unix, Plan9, UTF8, and the Go programming language). Slashdot reader motang shared Thompson answer to a question at the end about what operating system he uses today: I have, for most of my life — because I was sort of born into it — run Apple. Now recently, meaning within the last five years, I've become more and more depressed, and what Apple is doing to something that should allow you to work is just atrocious. But they are taking a lot of space and time to do it, so it's okay. And I have come, within the last month or two, to say, even though I've invested, you know, a zillion years in Apple — I'm throwing it away. And I'm going to Linux. To Raspbian in particular. ' -- source: https://apple.slashdot.org/story/23/03/18/237211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.4 AMD Graphics Driver Picking Up New Power Features For The Steam Deck
by Peter Reutemann 20 Mar '23

20 Mar '23

'Phoronix: A pull request of early AMDGPU kernel graphics driver changes was submitted for DRM-Next on Friday as some of the early feature work accumulating for the Linux 6.4 kernel cycle. Among the AMDGPU kernel driver changes this round are a number of fixes affecting items such as the UMC RAS, DCN 3.2, FreeSync, SR-IOV, various IP blocks, USB4, and more. On the feature side, mentioned subtly in the change-log are a few power-related additions... These additions are largely focused on Van Gogh APUs, which is notably for the Valve Steam Deck and benefiting its graphics moving forward. First up, this kernel pull request introduces a new sysfs interface for adjusting/setting thermal throttling. This is wired up for Van Gogh and allows reading/updating the thermal limit temperature in millidegrees Celsius. This "APU thermal cap" interface is just wired up for Van Gogh and seems to be Steam Deck driven feature work so that SteamOS will be better able to manage the thermal handling of the APU graphics.... These power features will be exposed via sysfs while Steam OS will wrap around them intelligently and possibly some new UI settings knobs for those wanting more control over their Steam Deck's thermal/performance. ' -- source: https://linux.slashdot.org/story/23/03/19/2040247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Most Failed Drives Fail Before 3 Years Of Use
by Lawrence D'Oliveiro 19 Mar '23

19 Mar '23

In contrast to backup company Backblaze, here is a report <https://blocksandfiles.com/2023/03/16/failed-disk-drives-fail-after-just-un…> from one of the ambulances at the bottom of the cliff -- a company that tries to recover data from drives after they have failed. What they find is the average working life of a failed drive is just under three years of total power-on time. (So if a drive doesn’t fail by then, it looks like its chances of surviving longer are increased.) Also worth noting that, when a drive goes bad, it doesn’t go just a little bad (say, one or two bad sectors), it tends to go significantly bad (hundreds or thousands of bad sectors). This has been my experience with bad drives too (at least, those that could still spin up and do some I/O transfers successfully). Interesting quotes: “We found that the five most durable and resilient hard drives from [the two most popular manufacturers, Western Digital and Seagate] were made before 2015. On the other hand, most of the least durable and resilient hard drives from each manufacturer were made after 2015.” and “in general, old drives seem more durable and resilient than new drives,” and “disks with CMR (conventional magnetic recording) appear more durable and resilient than those with SMR.” I think SMR drives are only used for archive purposes, because the process for writing new data onto them is somewhat convoluted and slow. Ironic, though, that an archive drive might not be that reliable ...

1 0

All-Open Source 7-Inch MNT Reform Pocket Laptop Ships In October
by Peter Reutemann 16 Mar '23

16 Mar '23

'An anonymous reader quotes a report from Ars Technica: The creators of the all-open source MNT Reform laptop are getting nearer to launching its handheld counterpart: The crowdfunding campaign for the 7-inch MNT Pocket Reform has officially launched and is also serving as a de-facto preorder system for the device. The cheapest version of the Pocket Reform starts at $899, and it's also being offered in purple for $969 or in a bundle with a 1TB SSD, carrying case, handbook, and poster for $1,299. All versions are currently slated to ship in mid-October. Like the full-size Reform, the pocket version uses open source hardware and a mechanical keyboard (buyers can choose either white or red Kalih switches). But the pocket version uses a 7-inch 1920x1200 LCD screen instead of a 12.5-inch version and comes with fewer and smaller ports (two USB-C, one micro HDMI, a microSD port, and one ix industrial mini Ethernet port). Its keyboard also comes with an individually programmable RGB backlight, and its trackball-style pointing device has been downsized to fit into the smaller design. The Pocket Reform also includes built-in Wi-Fi and Bluetooth, 128GB of built-in eMMC storage, and an expansion slot for 4G cellular connectivity. The device will also boot from microSD cards or an NVMe SSD installed in the device's M.2 slot. Its 8000 mAh batteries will allow it to run for about four hours. MNT warns in its blog post that "risks and challenges" could delay the October shipping timeline: "Pocket Reform has hundreds of electronic components. We tried to pick them so that there will be enough stock when we get around to manufacturing the boards, but it's always possible that there could be a sudden component shortage or increase in price. If that should happen, we would have to re-engineer the affected PCB and exchange the part, causing a delay in continued production. We had to adapt our products several times during the global chip crisis, so we are confident that we'll be able to work around any difficulties. Should any situation arise that would delay the estimated shipping timeline, backers will be informed promptly via project updates."' -- source: https://news.slashdot.org/story/23/03/15/2043243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DreamWorks' OpenMoonRay Renderer Code Published
by Peter Reutemann 16 Mar '23

16 Mar '23

'Today, DreamWorks published the open-source code for MoonRay, their production renderer used for films like The Bad Guys, Puss in Boots: The Last Wish, and other animation films. "OpenMoonRay is available via DreamWorks Animation's GitHub," reports Phoronix. "This professional-grade renderer is available under an Apache 2.0 license." >From the README: "MoonRay was developed at DreamWorks and is in continuous active development and includes an extensive library of production-tested, physically based materials, a USD Hydra render delegate, multi-machine and cloud rendering via the Arras distributed computation framework." More details can be found via OpenMoonRay.org.' -- source: https://news.slashdot.org/story/23/03/15/225218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft’s File-Tainting System ’Tain’t Working
by Lawrence D'Oliveiro 15 Mar '23

15 Mar '23

Microsoft has a clever-sounding system for trying to protect Windows users from downloading malicious files: it’s called “Mark-Of-The-Web”. What it means is that any file downloaded from an untrusted source is supposed to have a special flag set in its NTFS metadata indicating that the file is not to be trusted. So any attempt by the user to perform sensitive operations on that file (e.g. execute macros from it, run it as an executable) is supposed to trigger appropriate system warnings. If the file is a .zip archive, then this mark is supposed to be propagated to all files extracted from that archive. However, it turns out this mechanism can be bypassed (surprise, surprise) <https://www.theregister.com/2022/11/01/microsoft_motw_malware_flaw/>. How can this happen? The flaw lies in the mechanism used to tell Windows to trust downloaded files, by attaching an “Authenticode” signature to them. Files without such signatures are of course untrusted and will trigger the appropriate warnings. However, by attaching an invalid signature of a particular form, you can trigger an error response from the signature-checking process that is actually interpreted as “this file is OK” <https://blog.0patch.com/2022/10/free-micropatches-for-bypassing-motw.html>. What do you call it when an attempt to add mechanisms to make a system more secure actually increases the attack surface on that system? By the way, the referenced Twitter thread discussing this vulnerability <https://twitter.com/GossiTheDog/status/1579895038523609088> seems to be saying that no Mark-Of-The-Web propagation is done for files extracted from .iso disc images. And that Microsoft uses this form for distributing its own software (Visio was mentioned) precisely to avoid the hassle of going through vetting by third-party antimalware tools.

1 1

cURL, the omnipresent data tool, is getting a 25th birthday party this month
by Peter Reutemann 13 Mar '23

13 Mar '23

'When you first start messing with the command line, it can feel like there's an impermeable wall between the local space you're messing around in and the greater Internet. On your side, you've got your commands and files, and beyond the wall, there are servers, images, APIs, webpages, and more bits of useful, ever-changing data. One of the most popular ways through that wall has been cURL, or "client URL," which turns 25 this month. The cURL tool started as a way for programmer Daniel Stenberg to let Internet Chat Relay users quickly fetch currency exchange rates while still inside their chat window. As detailed in an archived history of the project, it was originally built off an existing command-line tool, httpget, built by Rafael Sagula. A 1.0 version was released in 1997, then changed names to urlget by 2.0, as it had added in GOPHER, FTP, and other protocols. By 1998, the tool could upload as well as download, and so version 4.0 was named cURL. Over the next few years, cURL grew to encompass nearly every Internet protocol, work with certificates and encryption, offer bindings for more than 50 languages, and be included in most Linux distributions and other systems. The cURL project now encompasses both the command-line command itself and the libcurl library. In 2020, the project's history estimated the command and library had been installed in more than 10 billion instances worldwide.' -- source: https://arstechnica.com/information-technology/2023/03/curl-the-omnipresent… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Backblaze: SSDs Only Slightly More Reliable Than Hard Drives
by Lawrence D'Oliveiro 11 Mar '23

11 Mar '23

The latest storage reliability report from backup company Backblaze is out <https://blocksandfiles.com/2023/03/10/backblaze-ssd-vs-hdd/>, and they are starting to include data from their increasing use of SSDs. One result: SSDs are not much more reliable than hard drives. They find an annualized failure rate of 1.64% for HDDs, 0.98% for the solid-state ones. You could say that’s over 50% greater reliability, but it’s not enough to make any material difference to the need for a proper backup regime. Another interesting result is that SMART diagnostics from SSD controllers seem to be very inconsistent. That is to say, they are even less useful than the ones from hard drives. Not that I would bother with either.

1 0