Language Selection

English French German Italian Portuguese Spanish

February 2017

today's leftovers

Filed under
Misc

Linux Devices: Tizen and Pi Zero

Filed under
Linux
  • Samsung Z4 SM-Z400F could be the phone that runs Tizen 3.0 out of the box

    It has been over six months since the launch of the last Tizen Smartphone which was the Samsung Z2 and hence we should soon be seeing a successor to refresh the series. Earlier today, we reported on the leaked specifications and features of one such upcoming Tizen device which is the highly anticipated Samsung Z5. Now, we are getting hints on another Tizen device in the making bearing the Model name SM-Z400F which should logically be the Samsung Z4.

  • Smartphone Game: Dinosaur Simulator: Dino World platform Tizen

    Dino Simulator Dino World is a game where you are a dinosaur causing chaos all over the place. There is one objective and that is to kill, destroy, and to destroy more!!! By causing destuction to innocent people’s lives (and proberably killing those innocent people), you get points! (YAY!).

  • Pi Zero Wireless out now for $10

    Today, on the fifth anniversary of the release of the original Raspberry Pi, the Foundation has released Pi Zero W, a Pi Zero with built-in WiFi and Bluetooth, for $10.

    The original Pi Zero was great (and still is!)—but many people found its lack of wireless connectivity an inconvenience. Now with Zero W, you can connect to the Internet without using any adapters, and you can even use a Bluetooth mouse and keyboard rather than wired USB, or use a Bluetooth speaker for audio.

FOSS Licensing: ZFS in Debian and Creative Commons

Filed under
OSS
Legal
  • On ZFS in Debian

    I’m currently over at FOSDEM, and have been asked by a couple of people about the state of ZFS and Debian. So, I thought I’d give a quick post to explain what Debian’s current plan is (which has come together with a lot of discussion with the FTP Masters and others around what we should do).

    [...]

    Debian has always prided itself in providing the unequivocally correct solution to our users and downstream distributions. This also includes licenses – we make sure that Debian will contain 100% free software. This means that if you install Debian, you are guaranteed freedoms offered under the DFSG and our social contract.

  • Complying with Creative Commons license attribution requirements in slides and powerpoint

    When I was at Mozilla and WMF, I frequently got asked how to give proper credit when using Creative Commons-licensed images in slideshows. I got the question again last week, and am working on slides right now, so here’s a quick guide.

Leftovers: OSS and Sharing/Transparency

Filed under
OSS
  • ‘Use open source software for GIS mapping’

    Open sourcing of data for Geographical Information System (GIS) mapping will create a huge potential for employment and transparency in administration, secretary of OSGEO-India V. Ravi Kumar has said.

    Proprietary software for GIS costs up to Rs. .30 lakh. Instead, utilising tools developed using open software and training youth would help in creating employment locally, he said. Money will be spent on those working using GIS but not for the software, he said.

  • ESI Group: Acquisition of Scilab Enterprises, Publisher of Scilab Open Source Analytical Computational Software
  • Release notes for the Genode OS Framework 17.02

    After the revision of Genode's most fundamental protocols in the previous release it was time to move our attention upwards the software stack. The current release largely revisits the integration of the C runtime with the Genode component API as well as the virtual-file-system (VFS) infrastructure. The two biggest challenges were making Genode's VFS capable to perform I/O asynchronously, and to make the C runtime compatible with the state-machine-based execution model of modern Genode components. This line of work is described in detail in Sections Enhanced VFS infrastructure and New execution model of the C runtime. One particularly exciting result is the brand-new ability to plug the Linux TCP/IP stack as a VFS plugin into any libc-using component by the sole means of component configuration.

  • Genode OS 17.02 Released With Improved VFS, New Input Event Processing

    Genode OS 17.02 has been released today as the latest version of this open-source operating system framework.

    Accomplished for Genode OS 17.02 were ABI improvements, a much better virtual file-system (VFS) implementation, new input event processing capabilities, and a dynamic component-composition engine.

  • heads 0.0 is out!

    heads 0.0 is a preview live CD of what heads is going to be about. This release is not intended to be used from a security point of view, but as a showcase and testing point of view.

    I am not even completely sure everything is torified, but hey, that's what testing is for, no?

  • IKEA's Idealistic Open Source Garden Orb
  • Denmark’s draft IT architecture open for comment

    Denmark’s Agency for Digitisation (Digitaliseringsstyrelsen - DIGST) is inviting comments on its draft IT architecture for digitalisation of the public sector. The document sets out the IT principles for the country’s 33 digitisation initiatives.

  • Norway working on first IT procurement frameworks

    Norway’s government procurement centre (ANS) and the Agency for Public Management and e-Government (Difi) are preparing the country’s first procurement frameworks related to IT. The first call, on telephony services, will be published in the next few days. The second call, for telephony and PC workstations, is expected around 24 April. Calls will be published on both Norway’s and Europe’s procurement portals, Doffin and Ted.

  • France prepares next Open Government action plan

    The 2017-2019 Open Government Action Plan is being prepared by the government modernisation unit (Secretariat-General for Government Modernisation, SGMAP). This week, on Tuesday, SGMAP is hosting a public workshop, where it will present a draft of the plan. The final text is expected in September.

  • Make food production data open source, urges MIT Media Lab

    Agriculture production data should be public and the open source movement should be the model for analysing it, according to the Open Agriculture initiative at MIT Media Lab.

    This could involve making the data from every farming IoT sensor public - so you could use the climate data to understand how best to grow what and where, or use other IoT data points to trace where the food has come from across the whole supply chain.

Security News

Filed under
Security
  • Security updates for Tuesday
  • EU updates smartphone secure development guideline

    The European Union Agency for Network and Information Security (ENISA) has published an updated version of its Smartphone Secure Development Guidelines. This document details the risks faced by developers of smartphone application, and provides ways to mitigate these.

  • CloudLinux 7 Users Get New Beta Linux Kernel Update That Addresses CVE-2017-6074

    CloudLinux's Mykola Naugolnyi announced today the availability of a new Beta kernel for the CloudLinux 7 operating system series, which patches a recently discovered and critical security flaw.

  • Linus Torvalds shrugged off warnings about 'insecure' SHA-1 in 2005

    LINUX FOUNDER Linus Torvalds was warned in 2005 that the use of the SHA-1 hash to sign code in Linux and Git was insecure and urged to shift to something better protected, but rejected the advice outright.

    Free software evangelist John Gilmore warned Torvalds ten years ago that "SHA1 has been broken; it's possible to generate two different blobs that hash to the same SHA1 hash".

    Gilmore penned his warning to Torvalds in April 2005, when MD5 had already been cracked and SHA1 remained "hard to crack" - but still crackable.

  • Subversion SHA1 Collision Problem Statement — Prevention and Remediation Options

    You probably saw the news last week that researchers at Google had found a scenario where they were able to break the SHA1 algorithm by creating two PDF files with differing content that produced the same hash. If you are following this story then you may have also seen that the Webkit Subversion repository had problems after a user committed these example files to their repository so that they could be used in test cases for SHA1 collisions.

  • making git-annex secure in the face of SHA1 collisions

    git-annex has never used SHA1 by default. But, there are concerns about SHA1 collisions being used to exploit git repositories in various ways. Since git-annex builds on top of git, it inherits its foundational SHA1 weaknesses. Or does it?

  • SSH Fingerprint Verification via Tor

    OpenSSH (really, are there any other implementations?) requires Trust on First Use for fingerprint verification.

    Verification can be especially problematic when using remote services like VPS or colocation.

    How can you trust that the initial connection isn’t being Man In The Middle’d?

  • Almost all Windows vulnerabilities are enabled by liberal 'admin rights'

    NEARLY OF THE VULNERABILITIES THAT AFFECT Microsoft's Windows operating system could be mitigated through a little careful control.

    Avecto, a security company, is the source of the latest revelation in this direction, and it says that 94 per cent of security problems could have been killed off if admin rights had been removed from the affected computer.

    This makes a lot of sense, since a computer that cannot be molested by a user cannot be molested by a third party. 94 per cent is just one example of the differences that can be made and Avecto says that in the case of Internet Explorer 100 per cent of risks are mitigated when rights are removed.

  • More on Bluetooth Ingenico Overlay Skimmers

    This blog has featured several stories about “overlay” card and PIN skimmers made to be placed atop Ingenico-brand card readers at store self-checkout lanes. I’m revisiting the topic again because a security technician at a U.S.-based retailer recently shared a few photos of several of these devices pulled from compromised card terminals, and the images and his story offer a fair bit more detail than in previous articles.

Linux and Linux Foundation

Filed under
Linux

GNOME News

Filed under
GNOME
  • Hands on with the new Night Light feature in GNOME 3.24

    We take a look at GNOME Night Light, a blue light filter that is included in the GNOME 3.24 desktop and adjusts the color temperature of the display.

  • New Printers Panel

    As I mentioned in my previous post about the New Users Panel, we are happy to be able to include a new Printers panel in GNOME 3.24.

    The Printers panel is also part of the GNOME Control Center redesign effort which intents to introduce the new shell in 3.26

  • Profiling Flatpak’d applications
  • Attended FOSDEM 2017

    Containerised applications solve these issues. Maybe. He mentioned Flatpak, snappy, and Appimage. The former is the oldest technology dating all the way back to 2003. The solutions have in common that they bundle the app and run it in some kind of container or sandbox. From his criteria, the compatibility issue is solved, because the libraries are in the bundles. Portability is solved, because all dependencies are shipped in the bundle. And the pace of change is up to the app developer.

  • Custom terminal titles are back in Fedora

    Almost four years ago, in GNOME 3.12, the ability to have custom terminal titles was removed from gnome-terminal. As is wont to happen, users who dealt with scores of similar looking terminal tabs and windows were quick to express their grief at this loss.

Red Hat News

Filed under
Red Hat

today's howtos

Filed under
HowTos

Gemini PDA is like a tiny Android/Linux laptop with premium specs (crowdfunding)

Filed under
Android
Linux

Are physical keyboards for mobile devices making a comeback? TCL and BlackBery just launched a new phone with a QWERTY keyboard. A keyboard module for the Moto Z smartphone is generating some buzz. And an Indiegogo campaign for a 7 inch, pocket-sized Windows notebook has raised over $1.7 million (so far).

Now the folks at UK-based Planet Computers want to bring back the idea of a small, clamshell computer. And they’ve partnered with the designer of the classic Psion Series 5 to do it.

Read more

More in Tux Machines

today's leftovers

  • Bring your ideas to the world with kubectl plugins

    kubectl is the most critical tool to interact with Kubernetes and has to address multiple user personas, each with their own needs and opinions. One way to make kubectl do what you need is to build new functionality into kubectl. Challenges with building commands into kubectl However, that’s easier said than done. Being such an important cornerstone of Kubernetes, any meaningful change to kubectl needs to undergo a Kubernetes Enhancement Proposal (KEP) where the intended change is discussed beforehand. When it comes to implementation, you’ll find that kubectl is an ingenious and complex piece of engineering. It might take a long time to get used to the processes and style of the codebase to get done what you want to achieve. Next comes the review process which may go through several rounds until it meets all the requirements of the Kubernetes maintainers – after all, they need to take over ownership of this feature and maintain it from the day it’s merged. When everything goes well, you can finally rejoice. Your code will be shipped with the next Kubernetes release. Well, that could mean you need to wait another 3 months to ship your idea in kubectl if you are unlucky. So this was the happy path where everything goes well. But there are good reasons why your new functionality may never make it into kubectl. For one, kubectl has a particular look and feel and violating that style will not be acceptable by the maintainers. For example, an interactive command that produces output with colors would be inconsistent with the rest of kubectl. Also, when it comes to tools or commands useful only to a minuscule proportion of users, the maintainers may simply reject your proposal as kubectl needs to address common needs. But this doesn’t mean you can’t ship your ideas to kubectl users.

  • Phoronix Test Suite 9.4 Released With More Features For Open-Source, Cross-Platform Automated Benchmarking

    Phoronix Test Suite 9.4-Vestby is now available as one of our largest updates in recent years for our open-source, cross-platform automated benchmarking framework. Almost wanting to rebrand it as Phoronix Test Suite 10, sticking to conventional versioning the Phoronix Test Suite 9.4 release brings numerous result viewer improvements, a lot of polishing to the PDF result exporting, various Microsoft Windows support improvements, new statistics capabilities, some useful new sub-commands, and much more as the latest quarterly feature release.

  • Linux 5.6 Tests On AMD EPYC 7742 vs. Intel Xeon 8280 2P With 100+ Benchmarks

    The latest benchmarks for your viewing pleasure are looking at the dual Intel Xeon Platinum 8280 performance up against the dual AMD EPYC 7742 CPUs while using the in-development Linux 5.6 kernel as the first time trying out these highest-end server processors on this new kernel debuting as stable in about one month's time.

  • PyIDM – An Open Source Alternative to IDM (Internet Download Manager)

    pyIDM is a free, open-source alternative to IDM (Internet Download Manager), used to download general files and videos from youtube as well as other streaming websites. It is developed using Python (requires Python 3.6+) and relies only on open source tools and libraries such as pycurl, youtube_dl, FFmpeg, and pysimplegui. It features multiple-connections, a speed engine (and it offers high download speeds based on libcurl); resume uncompleted downloads, support for fragmented video streams, support for encrypted/non-encrypted HLS (HTTP Live Streaming) media streams. Besides, it also supports scheduling downloads, re-using an existing connection to a remote server, and HTTP proxy support. And it allows users to control options such as selecting a theme (there are 140 themes available), set proxy, selecting segment size, speed limit, maximum concurrent downloads and maximum connections per download.

  • DRM Plugin crashes after openSUSE Tumbleweed update

    A few days ago openSUSE users started complaining about DRM Plugin crashes in Firefox after running a Tumbleweed update. Netflix requires the DRM plugin in Firefox to be able to play encrypted videos. The plugin would crash due to a bug in Firefox 73. While this bug affected not just openSUSE users, but everyone using Firefox 73, it became apparent to TW users as v73 landed in the Tumbleweed repo.

  • How Melissa Di Donato Is Going To Reinvent SUSE

    SUSE is one of the oldest open source companies and the first to market Linux for the enterprise. Even though it has undergone several acquisitions and a merger, it remains a strong player in the business. It has maintained its integrity and core values around open source. It continues to rely on its tried-and-tested Linux business and European markets, and generally shies away from making big moves taking big risks. Until now. SUSE appointed Melissa Di Donato as its first female CEO. She is making some serious changes to the company, from building a diverse and inclusive culture to betting on emerging technologies and taking risks. Soon after taking the helm last year, Di Donato spent the first few months traveling around the globe to meet SUSE teams and customers and get a better sense of the perception of the market about the company. Just like Red Hat CEO Jim Whitehurst, Di Donato didn’t come to the company from an open source background. She had spent the last 25 years of her career as a SUSE customer, so she did have an outsider’s perspective of the company. “I am not interested in what SUSE was when I joined. I am more interested in what we want to become,” she said.

  • Experimental feature: snap refresh awareness and update inhibition

    We’d like to follow up on last week’s article about parallel installs for classic snaps with another bleeding-edge topic. Today, we will discuss snap refreshes. By design, snaps come with automatic updates, and by default, the update (refresh) frequency check is four times a day. Whenever new application versions are published, they soon become available and propagate to all end-user systems. Normally, the process is transparent and seamless, but there could be exceptions. For instance, if you have an app open and running, an update could be disruptive in the middle of your work. Some developers have asked for an option to inhibit refreshes of snaps while they are running, and this is now a new, experimental feature that you can enable and test on your system. [...] The app refresh capability offers snaps users another level of control in the overall user experience. Automatic updates are geared toward security, but users can defer updates for up to 60 days, and now, they also have the ability to gracefully update applications with minimal disruption to their normal usage patterns and workflows. We very much welcome your feedback and suggestions, especially with new and upcoming features. The refresh awareness option is a good example of where the developer feedback has been valuable and useful in making the snap ecosystem even friendlier and more robust. If you have any ideas on this topic – or any other, please join our forum for a discussion.

  • How Domotz streamlined provisioning of IoT devices

    Learn how Ubuntu Core and snaps gives Domotz a competitive advantage As the number of IoT devices scale, the challenges of provisioning and keeping them up to date in the field increases. Domotz, who manufacture an all-in-one, network monitoring and management device for enterprise IoT networks, found themselves with this challenge that was further compounded by their rapid software release cadence. One of the most crucial and difficult aspects for Domotz to solve was the delivery of automatic updates to the tens of thousands of devices deployed. Domotz turned to snaps and Ubuntu Core to meet their exacting requirements. I absolutely believe that Ubuntu Core and snaps give us a competitive advantage. We are the only company in the IoT network management space that can guarantee a secure, always-up-to-date device for our customers’ on-premises deployments.

  • A birthday gift: 2GB Raspberry Pi 4 now only $35

    TL;DR: it’s our eighth birthday, and falling RAM prices have allowed us to cut the price of the 2GB Raspberry Pi 4 to $35. You can buy one here.

  • The RedMonk Programming Language Rankings: January 2020 [Ed: Redmonk uses to assess programming languages use only projects that Microsoft (a Redmonk client) controls. Some 'research', eh?]
  • Announcing Rust 1.41.1

    The Rust team has published a new point release of Rust, 1.41.1. Rust is a programming language that is empowering everyone to build reliable and efficient software. If you have a previous version of Rust installed via rustup, getting Rust 1.41.1 is as easy as: rustup update stable If you don't have it already, you can get rustup from the appropriate page on our website.

  • This Week in Rust 327
  • Zip Files: History, Explanation and Implementation

    I have been curious about data compression and the Zip file format in particular for a long time. At some point I decided to address that by learning how it works and writing my own Zip program. The implementation turned into an exciting programming exercise; there is great pleasure to be had from creating a well oiled machine that takes data apart, jumbles its bits into a more efficient representation, and puts it all back together again. Hopefully it is interesting to read about too.

    This article explains how the Zip file format and its compression scheme work in great detail: LZ77 compression, Huffman coding, Deflate and all. It tells some of the history, and provides a reasonably efficient example implementation written from scratch in C. The source code is available in hwzip-1.0.zip.

    I am very grateful to Ange Albertini, Gynvael Coldwind, Fabian Giesen, Jonas Skeppstedt (web), Primiano Tucci, and Nico Weber who provided valuable feedback on draft versions of this material.

Netrunner Linux Still Goes Its Own Way at 'Twenty'

The Netrunner distro used to be a bleeding-edge choice among KDE options. With little that's new and must-have, this release takes the edge off the bleeding. I wasn't nudged away from my preferred competing KDE distro -- the new Feren OS Plasma edition. While Netrunner 20.01 provides a fairly solid integration of classic KDE desktop performance, this release is a departure, in that it is not a step or two ahead of most other KDE-integrated Linux OSes. I Netrunner attracts two types of typical users. One fancies a more friendly desktop environment. The second wants the freedom to tweak more extensively than other desktop environments allow. Hardware requirements include a minimum CPU of 1.6 GHz Intel Atom N270 or greater and at least 1 GB of RAM with at least 10 GB hard drive space. Also, the computer should have Intel GMA 945 graphics card support with 128+ MB of video memory. Netrunner is a unique distro with its own spin on the K Plasma desktop environment. Seasoned Linux users who like to fiddle and tweak an OS into their own platform will love how this distro integrates the KDE Plasma desktop. Newcomers can be quite content using the out-of-the-box settings. Read more

Wind River launches dev site with TensorFlow for Linux and a free VxWorks download

A new “Wind River Labs” developer site hosts projects including TensorFlow for Wind River Linux, the first free VxWorks SDK, and VxWorks BSPs for the Raspberry Pi and UP Squared. One would think that when Wind River decided to launch a public-facing developer site, it would showcase the Yocto Project based Wind River Linux, which is available in a GPL-licensed release on GitHub in addition to the standard commercial version and new continuous integration version. Yet when Wind River announced its new Wind River Labs site this week, its proprietary VxWorks was the star of the show — but with a twist. There’s a new free VxWorks SDK for evaluating the RTOS for non-commercial purposes, as well as open source VxWorks BSPs for the Raspberry Pi and UP Squared boards. Read more

Security, Proprietary Software and Openwashing

  • Linux 4.4.215 / 4.9.215 / 4.14.172 / 5.5.7 Kernels Bringing Intel KVM Security Fix

    A few days back we reported on a security vulnerability within Intel's KVM virtualization code for the Linux kernel. That vulnerability stems from unfinished kernel code and was fixed for Linux 5.6 Git and is now being back-ported to the 4.4 / 4.9 / 4.14 / 5.5 supported kernels. Back on Monday when the CVE-2020-2732 patches first came to light, little was publicly known about the issue but that it stemmed from incomplete code in the vmx_check_intercept functionality in not checking all possible intercepts and in turn could end up emulating instructions that should be disabled by the hypervisor.

  • Let's Encrypt Has Issued a Billion Certificates

    We issued our billionth certificate on February 27, 2020. We’re going to use this big round number as an opportunity to reflect on what has changed for us, and for the Internet, leading up to this event. In particular, we want to talk about what has happened since the last time we talked about a big round number of certificates - one hundred million. One thing that’s different now is that the Web is much more encrypted than it was. In June of 2017 approximately 58% of page loads used HTTPS globally, 64% in the United States. Today 81% of page loads use HTTPS globally, and we’re at 91% in the United States! This is an incredible achievement. That’s a lot more privacy and security for everybody. Another thing that’s different is that our organization has grown a bit, but not by much! In June of 2017 we were serving approximately 46M websites, and we did so with 11 full time staff and an annual budget of $2.61M. Today we serve nearly 192M websites with 13 full time staff and an annual budget of approximately $3.35M. This means we’re serving more than 4x the websites with only two additional staff and a 28% increase in budget. The additional staff and budget did more than just improve our ability to scale though - we’ve made improvements across the board to provide even more secure and reliable service. Nothing drives adoption like ease of use, and the foundation for ease of use in the certificate space is our ACME protocol. ACME allows for extensive automation, which means computers can do most of the work. It was also standardized as RFC 8555 in 2019, which allows the Web community to confidently build an even richer ecosystem of software around it. Today, thanks to our incredible community, there is an ACME client for just about every deployment environment. Certbot is one of our favorites, and they’ve been working hard to make it even easier for people to use.

  • The “Cloud Snooper” malware that sneaks into your Linux servers [Ed: Sophos citing itself, hyping up the threat is installing malicious software on one's own server]

    SophosLabs has just published a detailed report about a malware attack dubbed Cloud Snooper. The reason for the name is not so much that the attack is cloud-specific (the technique could be used against pretty much any server, wherever it’s hosted), but that it’s a sneaky way for cybercrooks to open up your server to the cloud, in ways you very definitely don’t want, “from the inside out”. The Cloud Snooper report covers a whole raft of related malware samples that our researchers found deployed in combination.

  • OpenSMTPD Email Server Vulnerability Threatens Many Linux and BSD Systems [Ed: It is this package, not the operating systems (GNU/Linux rarely uses this)]

    A critical vulnerability has been discovered in the OpenBSD email server OpenSMTPD. Exploiting the flaw could allow remote code execution attacks. The seriousness of the vulnerability poses a threat to the integrity of OpenBSD and Linux systems.

  • A billion Wi-Fi devices suffer from a newly discovered security fla

    More than a billion internet-connected devices—including Apple's iPhone and Amazon's Echo—are affected by a security vulnerability that could allow [attackers] to spy on traffic sent over Wi-Fi.

  • New ‘Haken’ Malware Found On Eight Apps In Google Play Store

    Eight apps – mostly camera utilities and children’s games – were discovered spreading a new malware strain that steals data and signs victims up for expensive premium services.

  •                            
  • What does it take to commit to 100% open source?
                                 
                                   

    While experts in the database market in particular agree that open source is becoming the norm, the question remains, just how open is this sector’s open-source software? Can software providers realistically succeed with a company that’s 100% open source? Furthermore, would a proprietary infrastructure software provider with a freemium tier be able to achieve the same benefits as those committing to open source?

                                   

    The short answer is, yes — a proprietary infrastructure software company with a freemium tier could theoretically achieve the same benefits as companies going fully open source. However, it’s important to recognize that it would take a freemium model company a significantly longer period of time for its software to mature to the same level as that of an open-source company. Also, the loss of collaborative development and slower feedback loops would likely lead to a higher probability of the software never achieving market traction and ultimately fading away into oblivion.

  • Mirantis: Balancing Open Source With Guardrails

    Mirantis, an open infrastructure company that rose to popularity with its OpenStack offering, is now moving into the Kubernetes space very aggressively. Last year, the company acquired the Docker Enterprise business from Docker. This week, it announced that they were hiring the Kubernetes experts from the Finnish company Kontena and established a Mirantis office in Finland, expanding the company’s footprint in Europe. Mirantis already has a significant presence in Europe due to large customers such as Bosch and Volkswagen.