- wlug - list.wlug.org.nz

Russian Developers Blocked From Contributing To FOSS Tools
by Peter Reutemann 22 Mar '23

22 Mar '23

'The Reg has seen two recent incidents of Russian developers being blocked from public development of FOSS code. One was a refusal on the Linux kernel mailing list, the other a more general block on Github. In the last week, these events have both caused active, and sometimes heated, discussions in FOSS developer communities. From the report: The GitHub account of developer Alexander Amelkin has been blocked, and his repositories marked as "archived" â" including ipmitool, whose README describes it as "a utility for managing and configuring devices that support the Intelligent Platform Management Interface." Unable to comment on Github itself, Amelkin described what happened on the project's older Soureforge page. Amelkin works for Russian chipbuilder Yadro, which we described as working on RISC-V chips back in 2021. Microsoft is just obeying US law in this: according to the War and Sanctions database of the Ukrainian National Agency on Corruption Prevention, the NACP, Yadro is a sanctioned company. However, on LinkedIn, Amelkin disputes his employer's involvement. Over on Hacker News, commentators seem to be generally in favor of the move, although the discussion on LWN is more measured, pointing out both that there is little threat from server-management tools like this, but that Microsoft probably has no choice. Amelkin is not alone. Over on the Linux Kernel Mailing List, a contribution from Sergey Semin has been refused with the terse notice: "We don't feel comfortable accepting patches from or relating to hardware produced by your organization. Please withhold networking contributions until further notice." Semin is a developer at chipmaker Baikal Electronics, a company whose website has been suspended for a year now, as we noted a year ago in a story that also mentions Yadro. We were reporting on Baikal's efforts to develop its own CPUs nearly a decade ago, mere months after the Russian annexation of Crimea. And once again, there is spirited debate over the move on the Orange Site. ' -- source: https://news.slashdot.org/story/23/03/21/2126227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ASUS Unveils the Tinker V As Their First RISC-V Board
by Peter Reutemann 21 Mar '23

21 Mar '23

'Phoronix: For over a half-decade ASUS has been selling the Tinker Board devices as their line of Raspberry Pi alternatives. To date the ASUS Tinker Board single board computers have all been Arm-based while now they have launched their first RISC-V board, the Tinker V. The ASUS Tinker V is their first RISC-V single board computer and intended for the industrial IoT (Internet of Things) developer community. The ASUS Tinker V is set to officially run Debian Linux and Yocto while surely with time more Linux distributions will be supported.... Being IoT focused, there isn't any display support. Those interested in learning more about the ASUS Tinker V can do so via tinker-board.asus.com. The Register notes that Asus "is offering at least five years of support for Tinker V... Dedicated on-site technical support is also available to shorten customer development cycles and accelerate application deployment." The move shows that the RISC-V open-source instruction set architecture continues to garner support. The last RISC-V Summit in San Jose saw the launch of a family of datacenter-class processors based on the architecture from Ventana Micro Systems, while XMOS unveiled new high-performance microcontrollers using RISC-V. According to Asus, Tinker V samples will be available in Q2 of this year, but it did not disclose a date for full availability or pricing.' -- source: https://hardware.slashdot.org/story/23/03/20/0034207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Question please re: How to attach an Android (Samsung cellphone Galaxy A03S) photo to a Gmail email using Firefox and Ubuntu
by Michael James 20 Mar '23

20 Mar '23

G'day... Can anyone please suggest how to attach a photo - (from a Samsung Galaxy A03S cellphone via USB cable from the phone to a desktop) - onto a Gmail email using Firefox and running Ubuntu. Have tried connecting the phone via USB to the desktop and clicking the attach button on the email and double clicking the file in the Ubuntu Files folder under the Activities heading. This does not work. I tried both right and left mouse options and the 'OPEN' option; I also tried copying the file (photo) to downloads and attempted to attach via the same above pathway but this did not work either. I came across this post (below) on the internet from 2010 with the same question and the following answer: https://superuser.com/questions/132783/how-to-email-photo-from-ubuntu-f-spo… I'm not familiar with Python code and wonder if this answer is now outdated? Wondering if the problem is with Firefox? Gmail is running fine on Ubuntu with Firefox, it's just the attaching of photos from the Android that's giving trouble. Short of using the phone itself or Thunderbird or any other email service to send the photo, is there a way to attach photos to Gmail emails via Firefox running on Ubuntu please? Thanks, Michael James __________________________________________________________________________________________

2 2

Google tells users of some Android phones: Nuke voice calling to avoid infection
by Peter Reutemann 20 Mar '23

20 Mar '23

'Google is urging owners of certain Android phones to take urgent action to protect themselves from critical vulnerabilities that give skilled hackers the ability to surreptitiously compromise their devices by making a specially crafted call to their number. It’s not clear if all actions urged are even possible, however, and even if they are, the measures will neuter devices of most voice-calling capabilities. The vulnerability affects Android devices that use the Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos Auto T5123 chipsets made by Samsung’s semiconductor division. Vulnerable devices include the Pixel 6 and 7, international versions of the Samsung Galaxy S22, various mid-range Samsung phones, the Galaxy Watch 4 and 5, and cars with the Exynos Auto T5123 chip. These devices are ONLY vulnerable if they run the Exynos chipset, which includes the baseband that processes signals for voice calls. The US version of the Galaxy S22 runs a Qualcomm Snapdragon chip. A bug tracked as CVE-2023-24033 and three others that have yet to receive a CVE designation make it possible for hackers to execute malicious code, Google’s Project Zero vulnerability team reported on Thursday. Code-execution bugs in the baseband can be especially critical because the chips are endowed with root-level system privileges to ensure voice calls work reliably.' -- source: https://arstechnica.com/information-technology/2023/03/critical-vulnerabili… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unix Pioneer Ken Thompson Announces He's Switching From Mac To Linux
by Peter Reutemann 20 Mar '23

20 Mar '23

'The closing keynote at the SCaLE 20x conference was delivered by 80-year-old Ken Thompson (co-creator of Unix, Plan9, UTF8, and the Go programming language). Slashdot reader motang shared Thompson answer to a question at the end about what operating system he uses today: I have, for most of my life — because I was sort of born into it — run Apple. Now recently, meaning within the last five years, I've become more and more depressed, and what Apple is doing to something that should allow you to work is just atrocious. But they are taking a lot of space and time to do it, so it's okay. And I have come, within the last month or two, to say, even though I've invested, you know, a zillion years in Apple — I'm throwing it away. And I'm going to Linux. To Raspbian in particular. ' -- source: https://apple.slashdot.org/story/23/03/18/237211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.4 AMD Graphics Driver Picking Up New Power Features For The Steam Deck
by Peter Reutemann 20 Mar '23

20 Mar '23

'Phoronix: A pull request of early AMDGPU kernel graphics driver changes was submitted for DRM-Next on Friday as some of the early feature work accumulating for the Linux 6.4 kernel cycle. Among the AMDGPU kernel driver changes this round are a number of fixes affecting items such as the UMC RAS, DCN 3.2, FreeSync, SR-IOV, various IP blocks, USB4, and more. On the feature side, mentioned subtly in the change-log are a few power-related additions... These additions are largely focused on Van Gogh APUs, which is notably for the Valve Steam Deck and benefiting its graphics moving forward. First up, this kernel pull request introduces a new sysfs interface for adjusting/setting thermal throttling. This is wired up for Van Gogh and allows reading/updating the thermal limit temperature in millidegrees Celsius. This "APU thermal cap" interface is just wired up for Van Gogh and seems to be Steam Deck driven feature work so that SteamOS will be better able to manage the thermal handling of the APU graphics.... These power features will be exposed via sysfs while Steam OS will wrap around them intelligently and possibly some new UI settings knobs for those wanting more control over their Steam Deck's thermal/performance. ' -- source: https://linux.slashdot.org/story/23/03/19/2040247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Most Failed Drives Fail Before 3 Years Of Use
by Lawrence D'Oliveiro 19 Mar '23

19 Mar '23

In contrast to backup company Backblaze, here is a report <https://blocksandfiles.com/2023/03/16/failed-disk-drives-fail-after-just-un…> from one of the ambulances at the bottom of the cliff -- a company that tries to recover data from drives after they have failed. What they find is the average working life of a failed drive is just under three years of total power-on time. (So if a drive doesn’t fail by then, it looks like its chances of surviving longer are increased.) Also worth noting that, when a drive goes bad, it doesn’t go just a little bad (say, one or two bad sectors), it tends to go significantly bad (hundreds or thousands of bad sectors). This has been my experience with bad drives too (at least, those that could still spin up and do some I/O transfers successfully). Interesting quotes: “We found that the five most durable and resilient hard drives from [the two most popular manufacturers, Western Digital and Seagate] were made before 2015. On the other hand, most of the least durable and resilient hard drives from each manufacturer were made after 2015.” and “in general, old drives seem more durable and resilient than new drives,” and “disks with CMR (conventional magnetic recording) appear more durable and resilient than those with SMR.” I think SMR drives are only used for archive purposes, because the process for writing new data onto them is somewhat convoluted and slow. Ironic, though, that an archive drive might not be that reliable ...

1 0

All-Open Source 7-Inch MNT Reform Pocket Laptop Ships In October
by Peter Reutemann 16 Mar '23

16 Mar '23

'An anonymous reader quotes a report from Ars Technica: The creators of the all-open source MNT Reform laptop are getting nearer to launching its handheld counterpart: The crowdfunding campaign for the 7-inch MNT Pocket Reform has officially launched and is also serving as a de-facto preorder system for the device. The cheapest version of the Pocket Reform starts at $899, and it's also being offered in purple for $969 or in a bundle with a 1TB SSD, carrying case, handbook, and poster for $1,299. All versions are currently slated to ship in mid-October. Like the full-size Reform, the pocket version uses open source hardware and a mechanical keyboard (buyers can choose either white or red Kalih switches). But the pocket version uses a 7-inch 1920x1200 LCD screen instead of a 12.5-inch version and comes with fewer and smaller ports (two USB-C, one micro HDMI, a microSD port, and one ix industrial mini Ethernet port). Its keyboard also comes with an individually programmable RGB backlight, and its trackball-style pointing device has been downsized to fit into the smaller design. The Pocket Reform also includes built-in Wi-Fi and Bluetooth, 128GB of built-in eMMC storage, and an expansion slot for 4G cellular connectivity. The device will also boot from microSD cards or an NVMe SSD installed in the device's M.2 slot. Its 8000 mAh batteries will allow it to run for about four hours. MNT warns in its blog post that "risks and challenges" could delay the October shipping timeline: "Pocket Reform has hundreds of electronic components. We tried to pick them so that there will be enough stock when we get around to manufacturing the boards, but it's always possible that there could be a sudden component shortage or increase in price. If that should happen, we would have to re-engineer the affected PCB and exchange the part, causing a delay in continued production. We had to adapt our products several times during the global chip crisis, so we are confident that we'll be able to work around any difficulties. Should any situation arise that would delay the estimated shipping timeline, backers will be informed promptly via project updates."' -- source: https://news.slashdot.org/story/23/03/15/2043243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DreamWorks' OpenMoonRay Renderer Code Published
by Peter Reutemann 16 Mar '23

16 Mar '23

'Today, DreamWorks published the open-source code for MoonRay, their production renderer used for films like The Bad Guys, Puss in Boots: The Last Wish, and other animation films. "OpenMoonRay is available via DreamWorks Animation's GitHub," reports Phoronix. "This professional-grade renderer is available under an Apache 2.0 license." >From the README: "MoonRay was developed at DreamWorks and is in continuous active development and includes an extensive library of production-tested, physically based materials, a USD Hydra render delegate, multi-machine and cloud rendering via the Arras distributed computation framework." More details can be found via OpenMoonRay.org.' -- source: https://news.slashdot.org/story/23/03/15/225218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft’s File-Tainting System ’Tain’t Working
by Lawrence D'Oliveiro 15 Mar '23

15 Mar '23

Microsoft has a clever-sounding system for trying to protect Windows users from downloading malicious files: it’s called “Mark-Of-The-Web”. What it means is that any file downloaded from an untrusted source is supposed to have a special flag set in its NTFS metadata indicating that the file is not to be trusted. So any attempt by the user to perform sensitive operations on that file (e.g. execute macros from it, run it as an executable) is supposed to trigger appropriate system warnings. If the file is a .zip archive, then this mark is supposed to be propagated to all files extracted from that archive. However, it turns out this mechanism can be bypassed (surprise, surprise) <https://www.theregister.com/2022/11/01/microsoft_motw_malware_flaw/>. How can this happen? The flaw lies in the mechanism used to tell Windows to trust downloaded files, by attaching an “Authenticode” signature to them. Files without such signatures are of course untrusted and will trigger the appropriate warnings. However, by attaching an invalid signature of a particular form, you can trigger an error response from the signature-checking process that is actually interpreted as “this file is OK” <https://blog.0patch.com/2022/10/free-micropatches-for-bypassing-motw.html>. What do you call it when an attempt to add mechanisms to make a system more secure actually increases the attack surface on that system? By the way, the referenced Twitter thread discussing this vulnerability <https://twitter.com/GossiTheDog/status/1579895038523609088> seems to be saying that no Mark-Of-The-Web propagation is done for files extracted from .iso disc images. And that Microsoft uses this form for distributing its own software (Visio was mentioned) precisely to avoid the hassle of going through vetting by third-party antimalware tools.

1 1