- wlug - list.wlug.org.nz

GitLab Plans To Delete Dormant Projects in Free Accounts
by Peter Reutemann 05 Aug '22

05 Aug '22

'GitLab plans to automatically delete projects if they've been inactive for a year and are owned by users of its free tier, The Register reported Thursday. From the report: The Register has learned that such projects account for up to a quarter of GitLab's hosting costs, and that the auto-deletion of projects could save the cloudy coding collaboration service up to $1 million a year. The policy has therefore been suggested to help GitLab's finances remain sustainable. People with knowledge of the situation, who requested anonymity as they are not authorized to discuss it with the media, told The Register the policy is scheduled to come into force in September 2022. GitLab is aware of the potential for angry opposition to the plan, and will therefore give users weeks or months of warning before deleting their work. A single comment, commit, or new issue posted to a project during a 12-month period will be sufficient to keep the project alive. The Register understands some in the wider GitLab community worry that the policy could see projects disappear before users have the chance to archive code on which they rely. As many open-source projects are widely used, it is feared that the decision could have considerable negative impact.' -- source: https://developers.slashdot.org/story/22/08/04/1919231 Ouch... I have a bunch of projects that haven't been touched for years, as they are plugins to stable APIs (and didn't require any fixes/updates). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Raspberry Pi 4 Expands 3D Potential With Vulkan Update
by Peter Reutemann 03 Aug '22

03 Aug '22

'The Raspberry Pi 4 has hit a major graphics milestone, adding support for a more modern Vulkan 3D APIa. Ars Technica reports: Raspberry Pi CEO Eben Upton announced the Pi 4's Vulkan 1.2 conformance on Monday. Support isn't available yet in downloadable Pi-friendly operating systems but should be coming soon. For most people using their Pi as a server, a DIY controller, or a light desktop, Vulkan 1.2 conformance won't be noticeable. Desktop graphics on the standard Raspberry Pi OS are powered by OpenGL, the older graphics API that Vulkan is meant to replace. There is one group that benefits, says Upton: games and other 3D Android applications. Android uses Vulkan as its low-overhead graphics API. As with most Raspberry Pi advancements, there could be unforeseen opportunities unleashed by this seemingly tiny change. Vulkan 1.2 support gives developers the same 3D-graphics interface (if not anywhere near the same power) as 2019 NVIDIA graphics cards, 2020 Intel chips with integrated graphics, and dozens of other devices. With a Vulkan 1.0 driver installed, developer Iago Toral was able in 2020 to get the original Quake trilogy mostly running on a Pi 4, with not-too-shabby frame rates. ' -- source: https://tech.slashdot.org/story/22/08/02/226200 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Gmail Attack Bypasses Passwords and 2FA To Read All Email
by Peter Reutemann 03 Aug '22

03 Aug '22

'Forbes: According to cyber security firm Volexity, the threat research team has found the North Korean 'SharpTongue' group, which appears to be part of, or related to, the Kimsuky advanced persistent threat group, deploying malware called SHARPEXT that doesn't need your Gmail login credentials at all. Instead, it "directly inspects and exfiltrates data" from a Gmail account as the victim browses it. This quickly evolving threat, Volexity says it is already on version 3.0 according to the malware's internal versioning, can steal email from both Gmail and AOL webmail accounts, and works across three browsers: Google Chrome, Microsoft Edge, and a South Korean client called Whale. The U.S. Cybersecurity & Infrastructure Security Agency, CISA, reports that Kimsuky has been operating since 2012, and is "most likely tasked by the North Korean regime with a global intelligence gathering mission." While CISA sees Kimsuky most often targeting individuals and organizations in South Korea, Japan, and the U. S., Volexity says that the SharpTongue group has frequently been seen targeting South Korea, the U. S. and Europe. The common denominator between them is that the victims often " work on topics involving North Korea, nuclear issues, weapons systems, and other matters of strategic interest to North Korea." The report says that SHARPEXT differs from previous browser extensions deployed by these hacking espionage groups in that it doesn't attempt to grab login credentials but bypasses the need for these and can grab email data as the user reads it. The good news is that your system needs to be compromised by some means before this malicious extension can be deployed. Unfortunately, we know all too well that system compromise is not as difficult as it should be. Once a system has been compromised by phishing, malware, unpatched vulnerabilities, whatever, the threat actors can install the extension using a malicious VB script that replaces the system preference files. Once that's done and the extension runs quietly in the background, it is tough to detect. The user logs in to their Gmail account from their normal browser on the expected system. The security researchers recommend "enabling and analyzing PowerShell ScriptBlock logging" to detect whether you've been targeted by this attack, reports Forbes. Additionally, they recommend reviewing installed extensions regularly, especially looking for ones you don't recognize or are not available from the Chrome Web Store.' -- source: https://it.slashdot.org/story/22/08/02/2041205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Dirty Carbon Secret Behind Solid State Memory Drives
by Peter Reutemann 03 Aug '22

03 Aug '22

'Solid state drives use far less power than hard disc drives. But a new study unexpectedly reveals that their lifetime carbon footprint is much higher than their hard disc cousins, raising difficult questions for the computer industry. From a report: The benefits of SSDs over HDDs are legion. They are smaller, mechanically simpler, faster to read and write data than their hard disc cousins. They are also more energy efficient. So with many computer manufacturers and datacenter operators looking to reduce their carbon footprints, it's easy to imagine that all this makes the choice of memory easy. But all is not as it seems, say Swamit Tannu at University of Wisconsin in Madison and Prashant Nair at the University of British Columbia in Vancouver. SSDs have a dirty secret. Tannu and Nair have measured the carbon footprint per gigabyte of these devices across their entire lifetimes and, unexpectedly, it turns out that SSDs are significantly dirtier. "Compared to SSDs, the embodied [carbon] cost of HDDs is at least an order of magnitude lower," say the researchers. Tannu and Nair come to their conclusion by adding up the amount of carbon emitted throughout the estimated 10-year lifespans of these devices. This includes the carbon emitted during manufacture, during operation, for transportation and for disposal. The carbon emitted during operation is straightforward to calculate. To read and write data, HDDs consume 4.2 Watts versus 1.3W for SSDs. The researchers calculate that a 1 terabyte HDD emits the equivalent of 159 kilograms of carbon dioxide during a 10-year operating lifespan. By comparison, a 1 terabyte SSD emits just 49.2 kg over 10 years. But SSDs are significantly more carbon intensive to manufacture. That's because the chip fabrication facilities for SSDs operate at extreme temperatures and pressures that are energy intensive to maintain. And bigger memories require more chips, which increases the footprint accordingly. All this adds up to a significant carbon footprint for SSD manufacture. Tannu and Nair calculate that manufacturing a 1 terabyte SSD emits the equivalent of 320 kg of carbon dioxide. By comparison, a similar HDD emits just 40 kg. So the lifetime footprint for a 1 terabyte SSD is 369.2 kg of carbon dioxide equivalent versus 199 kg for an HDD. So HDDs are much cleaner. That's a counterintuitive result with important implications. At the very least, it suggests that computer manufacturers and cloud data storage operators should reconsider the way they use SSDs and HDDs. For example, almost 40 per cent of the carbon footprint of a desktop computer comes from its SSD, compared to just 4 per cent from the CPU and 11 per cent from the GPU.' -- source: https://hardware.slashdot.org/story/22/08/02/1837229 I wish my drives would last 10 years, neither HDD or SSD seem to last that long... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Releases Linux 5.19 - From an Apple Silicon MacBook
by Peter Reutemann 01 Aug '22

01 Aug '22

'"Linus Torvalds just released Linux 5.19 as stable for the newest version of the Linux kernel..." reports Phoronix. But they also note that on the Linux kernel mailing list, "Torvalds went on to write about his Arm-based MacBook [running an AArch64 Apple M1 SoC]... now under Linux thanks to the work of the Asahi Linux project." Torvalds wrote: [T]he most interesting part here is that I did the release (and am writing this) on an arm64 laptop. It's something I've been waiting for for a _loong_ time, and it's finally reality, thanks to the Asahi team. We've had arm64 hardware around running Linux for a long time, but none of it has really been usable as a development platform until now. It's the third time I'm using Apple hardware for Linux development — I did it many years ago for powerpc development on a ppc970 machine. And then a decade+ ago when the Macbook Air was the only real thin-and-lite around. And now as an arm64 platform. Not that I've used it for any real work, I literally have only been doing test builds and boots and now the actual release tagging. But I'm trying to make sure that the next time I travel, I can travel with this as a laptop and finally dogfooding the arm64 side too. ' -- source: https://apple.slashdot.org/story/22/07/31/2326216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What's New in Linux Mint 21 Cinnamon
by Peter Reutemann 01 Aug '22

01 Aug '22

'Today saw the release of Linux Mint 21 "Vanessa" Cinnamon Edition, a long term support release (supported until 2027). Release notes at LinuxMint.com promise that it comes with "refinements and many new features to make your desktop experience more comfortable." Among the highlights: its Bluetooth manager is now Blueman (instead of Blueberry). Blueberry depended on gnome-bluetooth, which was developed exclusively for GNOME. In contrast, Blueman relies on the standard Bluez stack which works everywhere and can even be used or queried from the command line. The Blueman manager and tray icon provide many features that weren't available in Blueberry and a lot more information which can be used to monitor your connection or troubleshoot Bluetooth issues. Out of the box Blueman features better connectivity, especially when it comes to headsets and audio profiles. In preparation for Linux Mint 21 the Blueman user interface was improved and received support for symbolic icons. Upstream, Blueman and Bluez are actively developed and used in many environments. The lack of thumbnails for some common file types was identified as a usability issue. To address it a new Xapp project called xapp-thumbnailers was started and is now featured in Linux Mint 21. The project brings support for the following mimetypes: - AppImage - ePub - MP3 (album cover) - RAW pictures (most formats) - Webp Automated tasks are great to keep your computer safe but they can sometimes affect the system's performance while you're working on it. A little process monitor was added to Linux Mint to detect automated updates and automated system snapshots running in the background. Whenever an automated task is running the monitor places an icon in your system tray. Your computer might still become slow momentarily during an update or a snapshot, but with a quick look on the tray you'll immediately know what's going on.... Linux Mint 21 uses IPP, also known as Driverless Printing and Scanning (i.e. a standard protocol which communicates with printers/scanners without using drivers). For most printers and scanners no drivers are needed, and the device is detected automatically. And there's also a fabulous collection of new backgrounds.' -- source: https://linux.slashdot.org/story/22/07/31/1922217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next month
by Peter Reutemann 29 Jul '22

29 Jul '22

Hi everyone For next month's meeting (I know, I'm early this time round!), I was thinking of the following topic: Essential command-line tools like find, grep, cat, less/more, bc, head/tail, etc. Rather than just one person demoing tools, I'm thinking more of a joint effort, where everyone can demo one or more tools. Doesn't matter if the same tool comes up more than once. There will be always useful options to hear about! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Costs Of Mobile Data By Country
by Lawrence D'Oliveiro 27 Jul '22

27 Jul '22

Report on a table compiled in the UK <https://www.theregister.com/2022/07/26/mobile_data_survey/>, on comparative mobile data costs in different countries, puts NZ at 210th place out of 233 countries surveyed. We are paying USD6.72 per gigabyte (NZD11.00), with entries lower down going to over USD40, while ones at the top go down to mere cents. Australia is paying about a tenth of what we are.

1 0

Discovery of new UEFI rootkit exposes an ugly truth: The attacks are invisible to us
by Peter Reutemann 27 Jul '22

27 Jul '22

'Researchers have unpacked a major cybersecurity find—a malicious UEFI-based rootkit used in the wild since 2016 to ensure computers remained infected even if an operating system is reinstalled or a hard drive is completely replaced. The firmware compromises the UEFI, the low-level and highly opaque chain of firmware required to boot up nearly every modern computer. As the software that bridges a PC’s device firmware with its operating system, the UEFI—short for Unified Extensible Firmware Interface—is an OS in its own right. It’s located in an SPI-connected flash storage chip soldered onto the computer motherboard, making it difficult to inspect or patch the code. Because it’s the first thing to run when a computer is turned on, it influences the OS, security apps, and all other software that follows. On Monday, researchers from Kaspersky profiled CosmicStrand, the security firm’s name for a sophisticated UEFI rootkit that the company detected and obtained through its antivirus software. The find is among only a handful of such UEFI threats known to have been used in the wild. Until recently, researchers assumed that the technical demands required to develop UEFI malware of this caliber put it out of reach of most threat actors. Now, with Kaspersky attributing CosmicStrand to an unknown Chinese-speaking hacking group with possible ties to cryptominer malware, this type of malware may not be so rare after all. “The most striking aspect of this report is that this UEFI implant seems to have been used in the wild since the end of 2016—long before UEFI attacks started being publicly described,” Kaspersky researchers wrote. “This discovery begs a final question: If this is what the attackers were using back then, what are they using today?” While researchers from fellow security firm Qihoo360 reported on an earlier variant of the rootkit in 2017, Kaspersky and most other Western-based security firms didn’t take notice. Kaspersky’s newer research describes in detail how the rootkit—found in firmware images of some Gigabyte or Asus motherboards—is able to hijack the boot process of infected machines. The technical underpinnings attest to the sophistication of the malware.' -- source: https://arstechnica.com/information-technology/2022/07/researchers-unpack-u… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora Sours On Creative Commons 'No Rights Reserved' License
by Peter Reutemann 27 Jul '22

27 Jul '22

'Fedora, the popular Linux distribution, will no longer incorporate software licensed under CC0, the Creative Commons "No Rights Reserved" license. In order to support the wide re-use of copyrighted content in new works, CC0 provides authors "a way to waive all their copyright and related rights in their works to the fullest extent allowed by law." The license arose in response to the 1998 Sonny Bono Copyright Term Extension Act (CTEA), which extended the duration of copyright by 20 years at the expense of the public domain. But CC0 explicitly says the licensor does not waive patent rights, which for free and open source software (FOSS) is a potential problem. That means, for instance as described here, if you use CC0-licensed code in your project, and the author of that code later claims your project is infringing a patent they own regarding that code, your defense will be limited. Avoiding the use of CC0-licensed code is one way to steer clear of these so-called submarine patents that could years later torpedo you. In a message to The Fedora Project's mailing list for legal issues, Richard Fontana, a technology lawyer for Red Hat (which sponsors Fedora), explained that while CC0 is cited as a "good license," it won't be for much longer. "We plan to classify CC0 as allowed-content only, so that CC0 would no longer be allowed for code," said Fontana. "This is a fairly unusual change and may have an impact on a nontrivial number of Fedora packages (that is not clear to me right now), and we may grant a carveout for existing packages that include CC0-covered code." Fontana said there's a growing consensus in the FOSS community that licenses without any form of patent licensing or forbearance aren't suitable. CC0, he said, like other Creative Commons licenses, includes a clause that explicitly states no patent rights are waived by the licensor.' -- source: https://linux.slashdot.org/story/22/07/26/2028205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1