- wlug - list.wlug.org.nz

KaOS Linux Celebrates 10 Years with New ISO Release Featuring Pre-Release KDE Plasma 6
by Peter Reutemann 24 Apr '23

24 Apr '23

'9to5Linux reports: KDE-focused and Arch Linux-inspired independent distribution KaOS Linux celebrates today 10 years of existence with a new stable ISO release that brings some of the latest GNU/Linux technologies and a preview of the upcoming KDE Plasma 6 desktop environment. Yes, you're reading it right, KaOS is one of the very first GNU/Linux distributions to offer you a live ISO image with a pre-release version of the KDE Plasma 6 desktop, which, of course, is compiled against the latest Qt 6 open-source application framework... Since this is a special ISO release, the devs also added an option to play music during the installation process. "KaOS uses the Systemd-provided Systemd-boot for UEFI installs," according to the release notes.' -- source: https://linux.slashdot.org/story/23/04/23/0555224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Proton Launches an End-to-End Encrypted Password Manager
by Peter Reutemann 21 Apr '23

21 Apr '23

'Proton, the company behind Proton Mail, has announced the launch of a new password manager: Proton Pass. While the service will eventually become free for everyone to use, it's currently only available as a beta to Proton's Lifetime and Visionary users for now. From a report: As is the case with Proton's other products, Proton Pass uses end-to-end encryption (E2EE) that's supposed to keep your personal information away from prying eyes, including third parties and Proton itself. In addition to letting you store your usernames, passwords, and notes, you can also add any randomly generated email aliases that you can use as a replacement for your real address. Proton's new password manager not only applies E2EE to your passwords but also the usernames, web addresses, and all the other fields associated with your login information. In a blog post explaining the service's security model, Proton notes that "all cryptographic operations, including key generation and data encryption," happen locally on your device, which Protons says it can't decrypt, even if a third party requests it.' -- source: https://yro.slashdot.org/story/23/04/20/1840225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MariaDB Hits Financial Headwinds
by Lawrence D'Oliveiro 20 Apr '23

20 Apr '23

This report <https://www.theregister.com/2023/04/18/mariadb_job_losses/> says that the company set up to commercialize MariaDB (the fork of MySQL created by Michael “Monty” Widenius after the latter’s acquisition by Oracle) is cutting jobs and adopting other cost-saving measures to get around revenue shortfalls. What interested me was, in response to a reader asking what Widenius was doing after personally getting $15 million out of that acquisition, the founder himself responded <https://forums.theregister.com/forum/all/2023/04/18/mariadb_job_losses/#c_4…> about the contributions that he had put into the company, the project and employees’s salaries.

1 0

FSF Says Google's Decision to Deprecate JPEG-XL Emphasizes Need for Browser Choice
by Peter Reutemann 17 Apr '23

17 Apr '23

'"The fact remains that Google Chrome is the arbiter of web standards," argues FSF campaigns manager Greg Farough (while adding that Firefox, "through ethical distributions like GNU IceCat and Abrowser, can weaken that stranglehold.") "Google's deprecation of the JPEG-XL image format in February in favor of its own patented AVIF format might not end the web in the grand scheme of things, but it does highlight, once again, the disturbing amount of control it has over the platform generally." Part of Google's official rationale for the deprecation is the following line: "There is not enough interest from the entire ecosystem to continue experimenting with JPEG-XL." Putting aside the problematic aspects of the term "ecosystem," let us remark that it's easy to gauge the response of the "entire ecosystem" when you yourself are by far the largest and most dangerous predator in said "ecosystem." In relation to Google's overwhelming power, the average web user might as well be a microbe. In supposedly gauging what the "ecosystem" wants, all Google is really doing is asking itself what Google wants... While we can't link to Google's issue tracker directly because of another freedom issue — its use of nonfree JavaScript — we're told that the issue regarding JPEG-XL's removal is the second-most "starred" issue in the history of the Chromium project, the nominally free basis for the Google Chrome browser. Chromium users came out of the woodwork to plead with Google not to make this decision. It made it anyway, not bothering to respond to users' concerns. We're not sure what metric it's using to gauge the interest of the "entire ecosystem," but it seems users have given JPEG-XL a strong show of support. In turn, what users will be given is yet another facet of the web that Google itself controls: the AVIF format. As the response to JPEG-XL's deprecation has shown, our rallying together and telling Google we want something isn't liable to get it to change its mind. It will keep on wanting what it wants: control; we'll keep on wanting what we want: freedom. Only, the situation isn't hopeless. At the present moment, not even Google can stop us from creating the web communities that we want to see: pages that don't run huge chunks of malicious, nonfree code on our computers. We have the power to choose what we run or do not run in our browsers. Browsers like GNU IceCat (and extensions like LibreJS and JShelter> ) help with that. Google also can't prevent us from exploring networks beyond the web like Gemini. What our community can do is rally support behind those free browsers that choose to support JPEG-XL and similar formats, letting the big G know that even if we're smaller than it, we won't be bossed around.' -- source: https://news.slashdot.org/story/23/04/16/002204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Spectre-Related 'Medium Severity' Flaw Patched in Linux Kernel
by Peter Reutemann 17 Apr '23

17 Apr '23

'"The Spectre vulnerability that has haunted hardware and software makers since 2018 continues to defy efforts to bury it," reports the Register: On Thursday, Eduardo (sirdarckcat) Vela Nava, from Google's product security response team, disclosed a Spectre-related flaw in version 6.2 of the Linux kernel. The bug, designated medium severity, was initially reported to cloud service providers — those most likely to be affected — on December 31, 2022, and was patched in Linux on February 27, 2023. "The kernel failed to protect applications that attempted to protect against Spectre v2, leaving them open to attack from other processes running on the same physical core in another hyperthread," the vulnerability disclosure explains. The consequence of that attack is potential information exposure (e.g., leaked private keys) through this pernicous problem.... Spectre v2 — the variant implicated in this particular vulnerability — relies on timing side-channels to measure the misprediction rates of indirect branch prediction in order to infer the contents of protected memory. That's far from optimal in a cloud environment with shared hardware... The bug hunters who identified the issue found that Linux userspace processes to defend against Spectre v2 didn't work on VMs of "at least one major cloud provider."' -- source: https://linux.slashdot.org/story/23/04/16/0143259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Releases Emergency Chrome Security Update
by Peter Reutemann 17 Apr '23

17 Apr '23

'"Earlier this week, Google released an emergency security update for the Chrome browser due to a vulnerability that is being actively exploited in the wild," reports Hot Hardware: On Friday, Google highlighted CVE-2023-2033, reported by Clément Lecigne of Google's own Threat Analysis Group (TAG). This vulnerability is a 'type confusion' bug in the JavaScript engine for Chromium browsers useing the V8 Javascript engine. In short, type confusion is a bug that allows memory to be accessed with the wrong type, allowing for the reading or writing of memory out of bounds. The CVE page says that an attacker could create an HTML page that allows the exploitation of heap corruption. While there is no Common Vulnerability Scoring System (CVSS) score attached to the vulnerability yet, Google is tracking this as a "high" severity issue. This is likely due in part to the fact that "Google is aware that an exploit for CVE-2023-2033 exists in the wild." The article notes that Chrome updates are generally done automatically, but you can also check for updates by clicking Chrome's three-dots menu in the top-right corner, then "Help" and "About Chrome."' -- source: https://it.slashdot.org/story/23/04/16/2057239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Feeling Competition From Linux In ... Gaming?!?
by Lawrence D'Oliveiro 14 Apr '23

14 Apr '23

Here’s another interesting development in the Windows-Linux rivalry: in gaming, of all places. The Steam Deck is a Linux-based handheld gaming PC which could, in principle, run Windows. Trouble is, Windows doesn’t offer any good UI options for working with this form factor <https://arstechnica.com/gadgets/2023/04/handheld-mode-for-windows-could-mak…>. So there is talk of developing a new “handheld mode” for Windows. Of course, for Linux, there is no “mode” in the OS for this, it’s just a different configuration of the GUI layer. Which is modular and completely replaceable.

1 0

Watch Out For Those USB Charging Ports!
by Lawrence D'Oliveiro 12 Apr '23

12 Apr '23

Something else to worry about: the US FBI, and NZ CERT, are advising travellers not to use public USB charging ports, because they can be a way to hack into your device <https://www.nzherald.co.nz/travel/fbi-warns-travellers-not-to-use-public-ch…>. When I was in Hong Kong Airport a few years ago, it was very hard for me to find a mains outlet to charge my laptop. Just about all the ports built into the public seating areas were USB ones, for phones/tablets.

2 1

New Attack On Car Security: “CAN Injection”
by Lawrence D'Oliveiro 07 Apr '23

07 Apr '23

CANbus is a mini-LAN built into every car manufactured this century. It is increasingly being used for all kinds of functions, like controlling “smart headlamps”, and of course unlocking the doors and letting you get into the car and drive off. Now it turns out that there are ways to connect to the bus through weak points from outside the vehicle, for example by breaking into the connections for those “smart headlamps”. From here, you can do things like spoof signals from the smart key receiver, fooling the security system into thinking it has received a signal from a valid owner’s key when it hasn’t. And once you’ve done that, you can steal the car. Because, of course, components on the bus are trusting the signals they get from other components, aren’t they? <https://www.theregister.com/2023/04/06/can_injection_attack_car_theft/>

1 0

'One In Two New Npm Packages Is SEO Spam Right Now'
by Peter Reutemann 31 Mar '23

31 Mar '23

'Gabi Dobocan, writing at auditing firm Sandworm: More than half of all new packages that are currently (29 Mar 2023) being submitted to npm are SEO spam. That is - empty packages, with just a single README file that contains links to various malicious websites. Out of the ~320k new npm packages or versions that Sandworm has scanned over the past week, at least ~185k were labeled as SEO spam. Just in the last hour as of writing this article, 1583 new e-book spam packages have been published. All the identified spam packages are currently live on npmjs.com.' -- source: https://developers.slashdot.org/story/23/03/30/184239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0