- wlug - list.wlug.org.nz

ARM’s Morello Runs CheriBSD
by Lawrence D'Oliveiro 29 Aug '22

29 Aug '22

“CHERI” is a project at Cambridge University based on a very old concept for implementing memory/process protection on computer hardware: that of “capabilities”. Instead of having specially-trusted kernel code run in a privileged mode that is allowed to do pretty much anything, capabilities allow for a more decentralized model, with distribution and separation of different areas of trust. The capability concept fell out of favour, because its implementation overhead was greater than the processor-privilege-level (also often described as “privilege rings”) concept that is so commonplace today. But with the increase in security vulnerabilities like Meltdown and Spectre, there is increasing interest in alternative approaches that might reduce complexity, hopefully with less of a performance cost than the fixes that were needed to mitigate those vulnerabilities. ARM Ltd’s experimental “Morello” chip is an implementation of the CHERI concept. And it has got as far as running CheriBSD, which is a specially-adapted variant of FreeBSD. This now includes Wayland as the GUI server, and it provides a KDE Plasma desktop on top of that, according to <https://www.theregister.com/2022/07/26/cheri_computer_runs_kde/>. All this code has been tweaked, where appropriate, to remove the assumptions of arbitrary access to process memory allowed by conventional C pointers, in favour of the more restricted access controlled by capabilities. The CHERI project started with MIPS-based hardware, and besides being on ARM now, it looks to be coming to RISC-V as well. By the way, the Linux kernel has already (mis)used the term ”capability” to refer to an entirely different concept <https://manpages.debian.org/bullseye/manpages/capabilities.7.en.html>. Those familiar with the process-privilege system on old VMS from DEC may notice some resemblance ...

1 1

Will Google's 'Cross-Device' Development Kit Bring Android Apps to Non-Android Devices?
by Peter Reutemann 29 Aug '22

29 Aug '22

'Google is trying "to make it easier for developers to create Android apps that connect in some way across a range of devices," reports the Verge. Documentation for the software development kit says it will simplify development for "multi-device experiences." "The Cross device SDK is open-source and will be available for different Android surfaces and non-Android ecosystem devices (Chrome OS, Windows, iOS)," explains the documentation, though the current developer preview only works with Android phones and tablets, according to the Verge. But they report that Google's new SDK "contains the tools developers need to make their apps play nice across Android devices, and, eventually non-Android phones, tablets, TVs, cars, and more." The SDK is supposed to let developers do three key things with their apps: discover nearby devices, establish secure connections between devices, and host an app's experience across multiple devices. According to Google, its cross-device SDK uses Wi-Fi, Bluetooth, and ultra-wideband to deliver multi-device connectivity.... [I]t could let multiple users on separate devices choose items from a menu when creating a group food order, saving you from passing your phone around the room. It could also let you pick up where you left off in an article when swapping from your phone to a tablet, or even allow the passengers in a car to share a specific map location with the vehicle's navigation system. It almost sounds like an expansion of Nearby Share, which enables users on Android to transfer files to devices that use Chrome OS and other Androids. In April, Esper's Mishaal Rahman spotted an upcoming Nearby Share update that could let you quickly share files across the devices that you're signed into Google with. Google also said during a CES 2022 keynote that it will bring Nearby Share to Windows devices later this year. "This SDK abstracts away the intricacies involved with working with device discovery, authentication, and connection protocols," argues Google's blog post, "allowing you to focus on what matters most — building delightful user experiences and connecting these experiences across a variety of form factors and platforms."' -- source: https://developers.slashdot.org/story/22/08/27/219224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Debian Considers Changing How It Handles Non-Free Firmware
by Peter Reutemann 29 Aug '22

29 Aug '22

'"Debian currently doesn't load non-free firmware by default on its systems," reports Phoronix, "even when it means no working hardware support/acceleration without those binary elements. Not loading the non-free firmware can also mean missing out on security updates or for addressing usability issues." Now the Debian community is discussing three proposals on how non-free firmware should be handled going forward (before a vote in September). Proposal A and B both start with the same two paragraphs: We will include non-free firmware packages from the "non-free-firmware" section of the Debian archive on our official media (installer images and live images). The included firmware binaries will normally be enabled by default where the system determines that they are required, but where possible we will include ways for users to disable this at boot (boot menu option, kernel command line etc.). When the installer/live system is running we will provide information to the user about what firmware has been loaded (both free and non-free), and we will also store that information on the target system such that users will be able to find it later. The target system will also be configured to use the non-free-firmware component by default in the apt sources.list file. Our users should receive security updates and important fixes to firmware binaries just like any other installed software. But Proposal A adds that "We will publish these images as official Debian media, replacing the current media sets that do not include non-free firmware packages," while Proposal B says those images "will not replace the current media sets," but will instead be offered alongside them. And Proposal C? "The Debian project is permitted to make distribution media (installer images and live images) containing packages from the non-free section of the Debian archive available for download alongside with the free media in a way that the user is informed before downloading which media are the free ones.' -- source: https://linux.slashdot.org/story/22/08/28/0242228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pine64 Touts Its RISC-V-Based Single-Board Computer and Soldering Irons
by Peter Reutemann 29 Aug '22

29 Aug '22

'PINE64's August update included photos of their first prototype for its upcoming Star64 single-board computer, "the first true RISC-V single-board computer from us...but as I wrote last month it certainly isn't the last RISC-V piece of hardware you'll be seeing from us." Just as a short recap: Star64 comes with a StarFive JH7110 64bit CPU sporting quad SiFive FU740 cores clocked at 1.5GHz. The SOC is equipped with BXE-2-32 from Imagination Technologies, which is said to be a solid mid-range GPU. Star64 will be available in two configurations — with 4Gb and 8GB of RAM, similarly to the Quartz64. Both hardware versions include USB 3.0 and a PCIe slot as well as two native Gigabit Ethernet NICs.... Along the long leading edges you'll find PCIe on one end and GPIO on the other. At one end of the board you'll find a digital video output, a double-stacked Gigabit Ethernet port and a 12V barrel plug for power. On the opposite side, you'll find 3x USB 2.0, 1x USB 3.0, an audio jack as well as a power button. There are also two U.FL ports for antennas — one for bluetooth and the other for WiFi.... The Star64 also has an MiPi display output complete with a touch panel (TP) input, a 12V power port, a CSI camera port and an eMMC slot. A micro SD card slot can be found at the bottom of the PCB. Similarly to the RockPro64 and Quartz64, the 12V port on the Star64 can be used for powering other hardware directly from the board — a popular example is powering one or multiple SSDs connected to a PCIe SATA adapter. I'll add that, at least in theory, the Star64 would make a great network-attached storage device because of its SoCs low thermals and idle power. I am looking forward to seeing NAS-focused Linux or BSD* OSes available for the board. Speaking of software, efforts to support the SoC in Linux have already begun. I've been told that both Debian and Fedora are already being ported to the StarFive JH7110, which is great news. We are certain that many other OSes will follow swiftly — especially once we start delivering the Star64 to interested developers. On the subject of availability: the Star64 will be available in a few weeks time, and will initially be available to developers. Given the interest in the Star64's and the SoC powering I hope to see functional distributions available for the board soon after launch. The announcement also included an update on their PinecilV2 smart mini portable soldering iron (built with a 32-bit RISC-V SoC). "The Pinecil V2 landed earlier this month and sold out almost instantly. The next production run of the ought to be available soon however..."' -- source: https://hardware.slashdot.org/story/22/08/28/1759238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Heroku Announces Plans To Eliminate Free Plans, Blaming 'Fraud and Abuse'
by Peter Reutemann 29 Aug '22

29 Aug '22

'After offering them for over a decade, Heroku announced this week that it will eliminate all of its free services -- pushing users to paid plans. From a report: Starting November 28, the Salesforce-owned cloud platform as a service will stop providing free product plans and shut down free data services and soon (on October 26) will begin deleting inactive accounts and associated storage for accounts that have been inactive for over a year. In a blog post, Bob Wise, Heroku general manager and Salesforce EVP, blamed "abuse" on the demise of the free services, which span the free plans for Heroku Dynos and Heroku Postgres as well as the free plan for Heroku Data for Redis. [...] Wise went on to note that Heroku will be announcing a student program at Salesforce's upcoming Dreamforce conference in September, but the details remain a mystery at this point. For the uninitiated, Heroku allows programmers to build, run and scale apps across programming languages including Java, PHP, Scala and Go. Salesforce acquired the company for $212 million in 2010 and subsequently introduced support for Node.js and Clojure and Heroku for Facebook, a package to simplify the process of deploying Facebook apps on Heroku infrastructure. Heroku claims on its website that it's been used to develop 13 million apps to date.' -- source: https://developers.slashdot.org/story/22/08/26/188231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google's Fuchsia OS is Taking Over Smart Displays, Now on Its Second Device
by Peter Reutemann 26 Aug '22

26 Aug '22

'The kingdom of Google's third major operating system, Fuchsia, is growing a little wider today. ArsTechnica: 9to5Google reports Google completed the rollout of Fuchsia to the Google Nest Hub Max. Along with the original Nest Hub/Google Home Hub, that puts two of Google's three smart displays on the new OS, with the one holdout being the 2nd Gen Nest Hub. The Nest Hub Max is the first device running Fuchsia that Google is currently selling -- the Home Hub only got Fuchsia after it had been discontinued. The Google smart display user interface is written in Flutter, a Google programming language designed for portability, which runs on Android, iOS, Fuchsia, and the weird cast platform Nest Hubs typically use. So it's not right to describe the user interface as "similar" after the OS swap -- it's the exact same code because Flutter runs on nearly everything. You are getting a slightly newer code version, though, and it comes with a Bluetooth menu. If you dive into the settings and hit "about device," you'll see a "Fuchsia Version" field that will say something like "6.20211109.1.3166243." It's a bit weird to do an entire OS switch to the futuristic, secretive Fuchsia project and then have basically nothing to show (or say) for it in terms of obvious improvements in performance or security. You can dive into the minutia of the Fuchsia source code, but it continues to be a mystery in terms of what practical benefits it offers consumers. Google never talks about Fuchsia, so not much is known about what, exactly, Google is accomplishing here.' -- source: https://tech.slashdot.org/story/22/08/25/1856206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux 6.1 Will Make It A Bit Easier To Help Spot Faulty CPUs
by Peter Reutemann 26 Aug '22

26 Aug '22

'While mostly of benefit to server administrators with large fleets of hardware, Linux 6.1 aims to make it easier to help spot problematic CPUs/cores by reporting the likely socket and core when a segmentation fault occurs, which can help in spotting any trends if routinely finding the same CPU/core is causing problems. Queued up now in TIP's x86/cpu branch for the Linux 6.1 merge window in October is a patch to print the likely CPU at segmentation fault time. Printing the likely CPU core and socket when a seg fault occurs can be beneficial if routinely finding seg faults happening on the same CPU package or particular core.' -- source: https://linux.slashdot.org/story/22/08/25/1841209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo now offers anti-tracking email service to everyone
by Peter Reutemann 26 Aug '22

26 Aug '22

'DuckDuckGo's tracker-removing email service, which has been available in private beta for a year, is now open to anyone who uses a DuckDuckGo mobile app, browser extension, or Mac browser. It has also added a few more privacy tools. The service provides you a duck.com email address, one intended to be given out for the kind of "Subscribe to our newsletter for 20 percent off" emails you know exist only to harvest data and target you for ads. Email sent to your duck.com address forwards to your chosen primary email—but with trackers removed. Email Protection now also fixes up links, strips them of tracking modifiers, upgrades unencrypted HTTP URLs to HTTPS where possible, and, for the rare necessary reply, allows you to send directly from your duck address instead of exposing your primary email. During their closed beta, DuckDuckGo claims that 85 percent of the emails it processed contained hidden trackers.' -- source: https://arstechnica.com/gadgets/2022/08/duckduckgo-now-offers-anti-tracking… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Experts Warn of Widespread Exploitation Involving Hikvision Cameras
by Peter Reutemann 25 Aug '22

25 Aug '22

'Both government and criminal hacking groups are still targeting Hikvision cameras with a vulnerability from 2021, according to reports from several security researchers. From a report: Cybersecurity firm CYFIRMA released a report this week saying Russian cybercriminal forums are awash with hackers looking to collaborate on exploiting Hikvision cameras using the command injection vulnerability CVE-2021-36260. "Specifically in the Russian forums, we have observed leaked credentials of Hikvision camera products available for sale," the company's researchers said. "These can be leveraged by hackers to gain access to the devices and exploit further the path of attack to target an organization's environment." CYFIRMA reported they found that more than 80,000 Hikvision cameras are still vulnerable to the critical command injection flaw, which carries a CVSS score of 9.8 out of 10. Of the more than 80,000 vulnerable cameras, more than 100 nations and 2,300 organizations are impacted.' -- source: https://tech.slashdot.org/story/22/08/24/1856244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSearch 0.2 File Search Utility Removes Snap Support
by Peter Reutemann 24 Aug '22

24 Aug '22

Since we were discussing find during this week's meeting, I thought some of you might be interested in this post: 'FSearch, the GTK-based lightning-fast file search tool, now has a new version, 0.2, that significantly improves its functionality. Many Linux users believe the only options for searching for files are those built into the operating system. Of course, the ‘find’ command or the file search capability provided by the file manager does an excellent job. But what if you could go to the next level using a handy graphical tool that searches for files at the speed of light? Meet FSearch. FSearch is an open-source standalone file search utility based on GTK3 inspired by Everything Search Engine. Because it is written in C, FSearch offers incredibly fast search speed, which is the application’s main advantage.' -- source: https://linuxiac.com/fsearch-0-2-file-search-utility/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0