Language Selection

English French German Italian Portuguese Spanish

August 2018

Limiting Free Licences and New FUD From Veracode/CA

Filed under
OSS
Security
Legal
  • ​Javascript Tool Maker Relents After Mixing Immigration Politics with Open Source Licensing

    In very short order, Lerna, a company that offers some Javascript tooling, has learned the hard way not to mess with the integrity of an open source license. In other words, don’t decide you’re going to take an existing OSI-certified open source license, modify it to suit your agenda, license your code under the newly derived license, and still continue to refer to your offering as "open source.”

    First, this analysis piece is really just a follow up to my previous post about why it’s time to reject the latest attack on open source software (OSS). The main point of that post was to point out that all of us who have experienced the benefits of open source (ok, that’s nearly all human beings) should play a role in defending it. Otherwise, it will whither and so too will the benefits most of us have come to enjoy, blind to the fact that open source is playing such an important role in our lives.

  • Does Redis' Commons Clause threaten open-source software?
  • Get a Jump on Reducing Your Open Source Software Security Risks [Ed: Anti-FOSS firm Veracode/CA pays IDG for spam which stigmatises FOSS as lacking security]

Software: gPodder, Puppet Bolt and Last howtos for the Week

Filed under
Software
HowTos
  • gPodder – podcast client written in Python

    gPodder is an open source tool that downloads and manages free audio and video content (“podcasts”) for you. The software is written in Python and sports a simple GTK interface. The software package also includes a command-line interface which is called gpo. It lets you listen to podcasts on your computer or on mobile devices. The software is very mature; it’s been in development since 2005.

  • FOSS Project Spotlight: Run Remote Tasks on Linux and Windows with Puppet Bolt

    Puppet, the company that makes automation software for managing systems and delivering software, has introduced Puppet Bolt, an open-source, agentless multiplatform tool for running commands, scripts, tasks and orchestrated workflows on remote Linux and Windows systems.

    The tool, which is freely available as a Linux package, Ruby gem and macOS or Windows installer, is ideal for sysadmins and others who want to perform a wide range of automation tasks on remote bare-metal servers, VMs or cloud instances without the need for any prerequisites. Puppet Bolt doesn't require any previous Puppet know-how. Nor does it require a Puppet agent or Puppet master. It uses only SSH and WinRM (or can piggyback Puppet transports) to communicate and execute tasks on remote nodes.

    Despite its simplicity, Puppet Bolt can execute all your existing scripts written in Bash, PowerShell, Python or any other language, stop and start Linux or Windows services, gather information about packages and system facts, or deploy procedural orchestrated workflows, otherwise known as plans. You can do all this right from your workstation or laptop.

  • How to install MediaWiki on Ubuntu 18.04 LTS
  • How to Install MyWebSQL 3.7 on CentOS 7
  • Fix GTK File Chooser Cannot Add/Remove Bookmarks
  • Docker Guide: Deploying Ghost Blog with MySQL and Traefik with Docker
  • Move the Ubuntu Launcher to Bottom or Right

Linux Kernel up to 4.15-rc3 Crypto Subsystem memory corruption

Filed under
Linux
Security
  • Linux Kernel up to 4.15-rc3 Crypto Subsystem memory corruption

    The weakness was shared 08/30/2018 as bug report (Bugzilla). The advisory is available at bugzilla.redhat.com. This vulnerability is traded as CVE-2018-14619 since 07/27/2018. Local access is required to approach this attack. A single authentication is needed for exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 08/31/2018).

  • CVE-2018-14619: New Critical Linux Kernel Vulnerability

    A new Linux kernel vulnerability identified as CVE-2018-14619 has been discovered by Red Hat Engineering researchers Florian Weimer and Ondrej Mosnacek. More particularly, the flaw was found in the crypto subsystem of the Linux kernel.

Security: Alexa Holes, Zemlin on CII, and Apache Struts Patches

Filed under
Security
  • Amazon Alexa Security Risk Allows Hackers to Take Over Voice Commands, Steal Private Information

    The world is changing and in the modern era, we are becoming reliant on our Internet of Things devices by the day. But this reliances could cost us everything, it could allow someone to steal our identity, bank information, medical history, and what not.

    Amazon Alexa has been criticised for having a number of security flaws but Amazon has been quick to deal with them. However, this new security flaw may not have a fix at all. And this could be the most dangerous security threat yet.

    According to research conducted by the University of Illinois at Urbana-Champaign (UIUC), Amazon Alexa’s idiosyncrasies can be exploited through voice-commands to route users to malicious websites. Hackers are targeting the loopholes in machine learning algorithms to access private information.

  • Researchers show Alexa “skill squatting” could hijack voice commands

    The success of Internet of Things devices such as Amazon's Echo and Google Home have created an opportunity for developers to build voice-activated applications that connect ever deeper—into customers' homes and personal lives. And—according to research by a team from the University of Illinois at Urbana-Champaign (UIUC)—the potential to exploit some of the idiosyncrasies of voice-recognition machine-learning systems for malicious purposes has grown as well.

    Called "skill squatting," the attack method (described in a paper presented at USENIX Security Symposium in Baltimore this month) is currently limited to the Amazon Alexa platform—but it reveals a weakness that other voice platforms will have to resolve as they widen support for third-party applications. Ars met with the UIUC team (which is comprised of Deepak Kumar, Riccardo Paccagnella, Paul Murley, Eric Hennenfent, Joshua Mason, Assistant Professor Adam Bates, and Professor Michael Bailey) at USENIX Security. We talked about their research and the potential for other threats posed by voice-based input to information systems.

  • The Linux Foundation Set to Improve Open-Source Code Security

    CII is now working on further trying to identify which projects matter to the security of the internet as a whole, rather than taking a broader approach of looking at every single open-source project, he said. In his view, by prioritizing the projects that are the most critical to the operation of the internet and modern IT infrastructure, the CII can be more effective in improving security.

    "You'll see in the next three months or so, additional activity coming out of CII," Zemlin said.

    Among the new activities coming from the CII, will be additional human resources as well as new funding. The Linux Foundation had raised $5.8 million from contributors to help fund CII efforts, which Zemlin said has now all been spent. Zemlin that CII's money was used to fund development work for OpenSSL, NTP (Network Time Protocol) and conducting audits.

  • Apache Struts 2.3.25 and 2.5.17 resolve Cryptojacking Exploit Vulnerability

    Information regarding a severe vulnerability found in Apache Struts was revealed last week. A proof of concept of the vulnerability was also published publicly along with the vulnerability’s details. Since then, it seems that malicious attackers have set out to repeatedly exploit the vulnerability to remotely install a cryptocurrency mining software on users’ devices and steal cryptocurrency through the exploit. The vulnerability has been allotted the CVE identification label CVE-2018-11776.

    This behavior was first spotted by the security and data protection IT company, Volexity, and since its discovery, the rate of exploits has been increasing rapidly, drawing attention to the critical severity of the Apache Struts vulnerability. The company released the following statement on the issue: “Volexity has observed at least one threat actor attempting to exploit CVE-2018-11776 en masse in order to install the CNRig cryptocurrency miner. The initial observed scanning originated from the Russian and French IP addresses 95.161.225.94 and 167.114.171.27.”

Gnome 3 & best extensions

Filed under
GNOME

There you go. Writing this article got me thinking. Gnome 3 is like Firefox 57. It brought about a radical change, made a lot of what made the original version great redundant, and hid options from users, making customization difficult. Gnome 3 also fights hard against extensions. But these are the bread and butter of what makes it useful, practical and appealing to users. The same is also true of Cinnamon, which has also partially been afflicted the same way. Technically, one may claim that extensions are a poor excuse for bad design, but then, in general, history has shown that they do make products more engaging in the long run. Collective intelligence can be a good thing, especially when harvested for free.

I am still convinced that Gnome 3 is doing it wrong, and that Plasma, Unity or even MATE are much better solutions on all levels. But then, if you do want to use this desktop environment, there are several handy extensions that can truly transform the experience. The must-have set, and then a sweetening of five nice little extras, which help make the desktop more useful and fun. If you have any other suggestions, this is a good time to use your email sending skills. And we're done.

Read more

Games: Scarecrow Studio, RAZED, XCOM 2

Filed under
Gaming
  • Colourful comedy adventure '3 Minutes to Midnight' planned to release for Linux

    Scarecrow Studio [Official Site] have officially announced that their colourful comedy adventure 3 Minutes to Midnight with a trailer and it's coming to Linux.

  • RAZED will bring lightning-fast platformer racing to Linux on September 14th

    Soaked in some vibrant colours, lightning-fast platformer RAZED will requiring a good pair of running shoes when it releases with Linux support on September 14th.

    Developed by Warpfish Games with a sprinkle of publishing from PQube Limited, RAZED is promising an exciting speedrunning experience across the 60 levels being included at release. These levels are spreadout across six different worlds, each of them having their own unique flavour. Each world will also come with an ability to unlock, along with a boss battle.

  • XCOM 2 to possibly get another expansion with 'TLE'

    There's rumours circling around about XCOM 2 getting a new expansion and it seems whatever it turns out to be that Linux support should be there.

A Look At DragonFlyBSD's Kernel Tuning Performance On The AMD Threadripper 2990WX

Filed under
Graphics/Benchmarks
BSD

Last week I posted some initial tests and benchmarks of DragonFlyBSD/FreeBSD on the AMD Threadripper 2990WX. While that went well and the BSDs scale with this 32-core / 64-thread processor better than Windows, lead DragonFly developer Matthew Dillon had picked up a 2990WX system and has been tuning the kernel ever since. Here are some benchmarks looking at some of his recent optimizations.

Hours after that BSD Threadripper testing ended last week, Matthew Dillon landed some more performance tuning/optimizations to benefit the Threadripper 2990WX design. Here are some benchmarks of that original 2990WX support on DragonFlyBSD 5.3-DEVELOPMENT compared to the later daily snapshot.

Read more

SharkLinux Distro: Open Source in Action

Filed under
Linux
OSS

Every so often I run into a Linux distribution that reminds me of the power of open source software. SharkLinux is one such distribution. With a single developer creating this project, it attempts to change things up a bit. Some of those changes will be gladly welcomed by new users, while scoffed at by the Linux faithful. In the end, however, thanks to open source software, the developer of SharkLinux has created a distribution exactly how he would want it to be. And that my friends, is one amazing aspect of open source. We get to do it our way.

But what is SharkLinux and what makes it stand out? I could make one statement about SharkLinux and end this now. The developer of SharkLinux reportedly developed the entire distribution using only an Android phone. That, alone, should have you wanting to give SharkLinux a go.

Read more

Linux hacker board features new Allwinner SoC with analytics accelerator

Filed under
Linux

The open-spec, camera-oriented “Lindenis V5” SBC runs Linux on a new quad -A7 Allwinner V5 V100 with a visual analytics accelerator, and offers dual MIPI-CSI, GbE, and a 40-pin expansion header.

A Shenzhen, China startup called Lindenis Tech. Ltd., staffed by former Allwinner employees, has launched an open spec, 139 x 85mm single board computer that debuts a 1.5GHz Allwinner camera SoC called the V5 V100. Like the Allwinner A33, H2+, and H3 SoCs, the Allwinner V5 V100 (PDF) runs on 4x Cortex-A7 cores. However, instead of an Arm Mali GPU, there’s a custom VPU, a dual ISP, and an “AIE” acceleration engine for visual analytics, with support for motion detection, perimeter defense, video diagnosis, face detection, flow statistics, and binocular depth maps.

Read more

More in Tux Machines

Programming: Python, Rust, PHP, C++ and More

  • Python For Loop: Everything You Need to Know

    Loops are one of the essential elements in any programming language, and Python is not an exception to it. Loops are used to repeat a statement or a block of statements multiple times. If there were no concept of loops in programming languages, we have to write each statement again and again for the number of times we want to execute it. Python provides two types of loops to handle looping requirements, i.e., the while loop and the for loop. In this tutorial, we will learn everything about the for loop statement in Python. Before getting started with this tutorial, It is necessary to have Python installed and set up in your environment path. If you don’t have it installed already, refer to our step by step guide to install Python on Linux. The code presented in this tutorial can be run on the python shell, but it is recommended to run the code in a Python IDE. If you don’t have a python IDE installed in your system or want to know which IDE is a better choice to install, you can refer to our guide Top 10 best python IDE compared.

  • NihAV Is An Experimental Multimedia Framework Written In Rust

    NihAV is an experimental multimedia framework written in the Rust programming language. At the moment it's focused on diving into supporting decoders for different formats that lack open-source support right now / not yet reverse engineered, exploring new approaches for conventional multimedia concepts, and other experiments for advancing audio-video frameworks.

  • rra-c-util 8.3

    n this release of my utility library for my other packages, I finally decided to drop support for platforms without a working snprintf. This dates back to the early 2000s and a very early iteration of this package. At the time, there were still some older versions of UNIX without snprintf at all. More commonly, it was buggy. The most common problem was that it would return -1 if the buffer wasn't large enough rather than returning the necessary size of the buffer. Or, in some cases, it wouldn't support a buffer size of 0 and a NULL buffer to get the necessary size.

  • Embedded Programming and Beyond: An Interview with Warren Gay

    Interested in embedded programming? Warren Gay, an Ontario, Canada-based senior programmer, is an excellent resource for professional programmers, students, and makers alike. Here he talks about his new book, FreeRTOS for ESP32-Arduino (Elektor, 2020), and shares insights about FreeRTOS, ESP32, Arduino, embedded technologies, and more. You are sure to find his input informative and inspiring, especially if you plan to work with ESP32 or Arduino in the near future.

  • PHP 7.1 - 8 new features

    In the PHP 7.0 version function declaration accepts a return type, with the release of 7.1 version functions and parameters can return/accept null by prefixing the data type with a question mark(?). if the data type passed as parameter or returned by a function is different from the type specified a TypeError exception will be thrown.

  • Senior Developers don’t know Everything

    For about 20 years, I’ve been doing C++ and Qt and KDE development. I suppose that makes me a “senior software engineer”, also in the sense that I’ve hacked, programmed, futzed, designed, architected, tested, proved-correct, and cursed at a lot of software. But don’t let the label fool you: I look up just as much in the documentation as I ever did; senior developers don’t know everything.

Software and Games: Cloud Hypervisor, Joplin, Kodi, MuseScore, Bashtop, Grounded

  • Intel Cloud-Hypervisor 0.9 Brings io_uring Block Device Support For Faster Performance

    Intel's Cloud Hypervisor focused on being a Rustlang-based hypervisor focused for cloud workloads is closing in on the 1.0 milestone. With this week's release of Cloud-Hypervisor 0.9 there is one very exciting feature in particular but also a lot of other interesting changes. 

  • Joplin

    Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. The notes are searchable, can be copied, tagged and modified either from the applications directly or from your own text editor. The notes are in Markdown format. Notes exported from Evernote via .enex files can be imported into Joplin, including the formatted content (which is converted to Markdown), resources (images, attachments, etc.) and complete metadata (geolocation, updated time, created time, etc.). Plain Markdown files can also be imported. The notes can be synchronized with various cloud services including Nextcloud, Dropbox, OneDrive, WebDAV or the file system (for example with a network directory). When synchronizing the notes, notebooks, tags and other metadata are saved to plain text files which can be easily inspected, backed up and moved around.

  •          
  • Kodi 19 Alpha 1 Released With AV1 Decoding, Many Other HTPC Improvements

    Kodi 19 "Matrix" Alpha 1 has been released for this very popular, cross-platform open-source HTPC software.  Kodi 19 is bringing many exciting improvements as a major update to this open-source home theater software. 

  •        
  • Scorewriter MuseScore 3.5 Released with Chord Symbol Playback

    MuseScore, free music composition and notation software, released version 3.5 with long list of new features, bug fixes, and other improvements. MuseScore 3.5 contains one of the most requested features: Chord Symbol Playback. The feature is disabled by default so far. You can enable it by going to Edit > Preferences > Note Input.

  •        
  • Bashtop: An Htop Like System Monitor But Much More Useful

    As cool as Htop there is one thing that it's seriously lacking in and that is system monitoring tools, this may not be a problem for you but if you want a system monitor than bashtop is a much better option to choose, it let's you do most of the process management stuff that you want from htop but it comes with things like hard drive usage, network usage and cpu usage statistics. 

  • An Early Look at Grounded

    You’re in control of a child, who looks like he/she hasn’t entered the teenager years just yet. Among four different children — two boys and two girls — they’ve got a big problem: they’ve been shrunk to the size of an insect. Join them in their adventure — either by yourself or with a group of online friends — as they fight to survive in someone’s backyard, trying to build shelters whilst defending against bugs, and figure out why they’ve shrunk in the first place. Enter Grounded, developed by Obsidian Entertainment — the studio that brought us such titles as Pillars of Eternity, The Outer Worlds, and Star Wars: KOTOR2.

Fedora: LTO, Nest and More

  • Fedora 33 Moving Closer To LTO-Optimizing Packages

    Going back to last year Fedora has been working to enable link-time optimizations by default for their packages. That goal wasn't achieved for Fedora 32 but for Fedora 33 this autumn they still have chances of marking that feature off their TODO list.  LTO'ing the Fedora package set can offer not only performance advantages but in some cases smaller binaries as well. This is all about applying the compiler optimizations at link-time on the binary as a whole for yielding often sizable performance benefits and other optimizations not otherwise possible. LTO is great as we often show in benchmarks, especially in the latest GCC and LLVM Clang compilers. 

  • Zamir SUN: Report for session 1 of FZUG @ Nest with Fedora

    Last month, Alick suggested the Fedora Zhongwen User Group (FZUG) can do a online meetup during Nest with Fedora. And based on the survey, people registered for two time slots, the first one is 9:00 PM Saturday evening UTC+8 which is not a good time for Alick, so I take up the coordinating role for this session. As for the tool, we decided to use Jitsi, as it should work fine for most of us and do not have any limitations. What’s more, it’s totally open source. During the meeting, I firstly introduced Nest with Fedora and it’s previous offline version, Flock to Fedora, to the attendees. It’s interesting to see that during the past years, we not only have new users in China, but also new contributors. One attendee shares that his motivation of being a packager is that deploying packages for their research in the lab is cumbersome before. So he decided to package all into Fedora and then he can just simply install them on every machine. It is good to know that people contribute back because they want to solve their own problems. Maybe this can be a talking point to attract more contributors in the future. After the self introduction, we continue by sharing our interesting stores with Linux. That is a lot of fun.

  • Jon Chiappetta: Last piece of relay software needed for my home bridged network

    If you are running a bridged/relayd network with macs on it you may need to also forward the multicast broadcasts (mDNS related) that allow the devices to automatically discover each other. On the WRT wifi client side, there is a pkg called avahi-daemon and you can configure to operate in “reflector” mode to forward these broadcasts across the specified interfaces. Running this service along with the dhcprb C program which takes care of layer 2 arp requests & dhcp gateway forwarding has been pretty smooth so far!

Perl Programming: Exercises and DocKnot Release

  • The [Perl] Weekly Challenge #072

    I am glad, this week focus was more Array/List related. Technical speaking Array and List aren’t the same in Perl. I must admit until I read the article by brian d foy, I thought they were the same. As the famous saying, you learn something new every day.

  • Perl Weekly Challenge 72: One-Liners for Trailing Zeros and Line Ranges

    These are some answers to the Week 72 of the Perl Weekly Challenge organized by Mohammad S. Anwar. Spoiler Alert: This weekly challenge deadline is due in a few hours. This blog post offers some solutions to this challenge, please don’t read on if you intend to complete the challenge on your own.

  • Russ Allbery: DocKnot 3.05

    I keep telling myself that the next release of DocKnot will be the one where I convert everything to YAML and then feel confident about uploading it to Debian, and then I keep finding one more thing to fix to release another package I'm working on. Anyway, this is the package I use to generate software documentation and, in the long run, will subsume my static web site generator and software release workflow. This release tweaks a heuristic for wrapping paragraphs in text documents, fixes the status badge for software with Debian packages to do what I had intended, and updates dependencies based on the advice of Perl::Critic::Freenode.