Language Selection

English French German Italian Portuguese Spanish

August 2018

Limiting Free Licences and New FUD From Veracode/CA

Filed under
OSS
Security
Legal
  • ​Javascript Tool Maker Relents After Mixing Immigration Politics with Open Source Licensing

    In very short order, Lerna, a company that offers some Javascript tooling, has learned the hard way not to mess with the integrity of an open source license. In other words, don’t decide you’re going to take an existing OSI-certified open source license, modify it to suit your agenda, license your code under the newly derived license, and still continue to refer to your offering as "open source.”

    First, this analysis piece is really just a follow up to my previous post about why it’s time to reject the latest attack on open source software (OSS). The main point of that post was to point out that all of us who have experienced the benefits of open source (ok, that’s nearly all human beings) should play a role in defending it. Otherwise, it will whither and so too will the benefits most of us have come to enjoy, blind to the fact that open source is playing such an important role in our lives.

  • Does Redis' Commons Clause threaten open-source software?
  • Get a Jump on Reducing Your Open Source Software Security Risks [Ed: Anti-FOSS firm Veracode/CA pays IDG for spam which stigmatises FOSS as lacking security]

Software: gPodder, Puppet Bolt and Last howtos for the Week

Filed under
Software
HowTos
  • gPodder – podcast client written in Python

    gPodder is an open source tool that downloads and manages free audio and video content (“podcasts”) for you. The software is written in Python and sports a simple GTK interface. The software package also includes a command-line interface which is called gpo. It lets you listen to podcasts on your computer or on mobile devices. The software is very mature; it’s been in development since 2005.

  • FOSS Project Spotlight: Run Remote Tasks on Linux and Windows with Puppet Bolt

    Puppet, the company that makes automation software for managing systems and delivering software, has introduced Puppet Bolt, an open-source, agentless multiplatform tool for running commands, scripts, tasks and orchestrated workflows on remote Linux and Windows systems.

    The tool, which is freely available as a Linux package, Ruby gem and macOS or Windows installer, is ideal for sysadmins and others who want to perform a wide range of automation tasks on remote bare-metal servers, VMs or cloud instances without the need for any prerequisites. Puppet Bolt doesn't require any previous Puppet know-how. Nor does it require a Puppet agent or Puppet master. It uses only SSH and WinRM (or can piggyback Puppet transports) to communicate and execute tasks on remote nodes.

    Despite its simplicity, Puppet Bolt can execute all your existing scripts written in Bash, PowerShell, Python or any other language, stop and start Linux or Windows services, gather information about packages and system facts, or deploy procedural orchestrated workflows, otherwise known as plans. You can do all this right from your workstation or laptop.

  • How to install MediaWiki on Ubuntu 18.04 LTS
  • How to Install MyWebSQL 3.7 on CentOS 7
  • Fix GTK File Chooser Cannot Add/Remove Bookmarks
  • Docker Guide: Deploying Ghost Blog with MySQL and Traefik with Docker
  • Move the Ubuntu Launcher to Bottom or Right

Linux Kernel up to 4.15-rc3 Crypto Subsystem memory corruption

Filed under
Linux
Security
  • Linux Kernel up to 4.15-rc3 Crypto Subsystem memory corruption

    The weakness was shared 08/30/2018 as bug report (Bugzilla). The advisory is available at bugzilla.redhat.com. This vulnerability is traded as CVE-2018-14619 since 07/27/2018. Local access is required to approach this attack. A single authentication is needed for exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 08/31/2018).

  • CVE-2018-14619: New Critical Linux Kernel Vulnerability

    A new Linux kernel vulnerability identified as CVE-2018-14619 has been discovered by Red Hat Engineering researchers Florian Weimer and Ondrej Mosnacek. More particularly, the flaw was found in the crypto subsystem of the Linux kernel.

Security: Alexa Holes, Zemlin on CII, and Apache Struts Patches

Filed under
Security
  • Amazon Alexa Security Risk Allows Hackers to Take Over Voice Commands, Steal Private Information

    The world is changing and in the modern era, we are becoming reliant on our Internet of Things devices by the day. But this reliances could cost us everything, it could allow someone to steal our identity, bank information, medical history, and what not.

    Amazon Alexa has been criticised for having a number of security flaws but Amazon has been quick to deal with them. However, this new security flaw may not have a fix at all. And this could be the most dangerous security threat yet.

    According to research conducted by the University of Illinois at Urbana-Champaign (UIUC), Amazon Alexa’s idiosyncrasies can be exploited through voice-commands to route users to malicious websites. Hackers are targeting the loopholes in machine learning algorithms to access private information.

  • Researchers show Alexa “skill squatting” could hijack voice commands

    The success of Internet of Things devices such as Amazon's Echo and Google Home have created an opportunity for developers to build voice-activated applications that connect ever deeper—into customers' homes and personal lives. And—according to research by a team from the University of Illinois at Urbana-Champaign (UIUC)—the potential to exploit some of the idiosyncrasies of voice-recognition machine-learning systems for malicious purposes has grown as well.

    Called "skill squatting," the attack method (described in a paper presented at USENIX Security Symposium in Baltimore this month) is currently limited to the Amazon Alexa platform—but it reveals a weakness that other voice platforms will have to resolve as they widen support for third-party applications. Ars met with the UIUC team (which is comprised of Deepak Kumar, Riccardo Paccagnella, Paul Murley, Eric Hennenfent, Joshua Mason, Assistant Professor Adam Bates, and Professor Michael Bailey) at USENIX Security. We talked about their research and the potential for other threats posed by voice-based input to information systems.

  • The Linux Foundation Set to Improve Open-Source Code Security

    CII is now working on further trying to identify which projects matter to the security of the internet as a whole, rather than taking a broader approach of looking at every single open-source project, he said. In his view, by prioritizing the projects that are the most critical to the operation of the internet and modern IT infrastructure, the CII can be more effective in improving security.

    "You'll see in the next three months or so, additional activity coming out of CII," Zemlin said.

    Among the new activities coming from the CII, will be additional human resources as well as new funding. The Linux Foundation had raised $5.8 million from contributors to help fund CII efforts, which Zemlin said has now all been spent. Zemlin that CII's money was used to fund development work for OpenSSL, NTP (Network Time Protocol) and conducting audits.

  • Apache Struts 2.3.25 and 2.5.17 resolve Cryptojacking Exploit Vulnerability

    Information regarding a severe vulnerability found in Apache Struts was revealed last week. A proof of concept of the vulnerability was also published publicly along with the vulnerability’s details. Since then, it seems that malicious attackers have set out to repeatedly exploit the vulnerability to remotely install a cryptocurrency mining software on users’ devices and steal cryptocurrency through the exploit. The vulnerability has been allotted the CVE identification label CVE-2018-11776.

    This behavior was first spotted by the security and data protection IT company, Volexity, and since its discovery, the rate of exploits has been increasing rapidly, drawing attention to the critical severity of the Apache Struts vulnerability. The company released the following statement on the issue: “Volexity has observed at least one threat actor attempting to exploit CVE-2018-11776 en masse in order to install the CNRig cryptocurrency miner. The initial observed scanning originated from the Russian and French IP addresses 95.161.225.94 and 167.114.171.27.”

Gnome 3 & best extensions

Filed under
GNOME

There you go. Writing this article got me thinking. Gnome 3 is like Firefox 57. It brought about a radical change, made a lot of what made the original version great redundant, and hid options from users, making customization difficult. Gnome 3 also fights hard against extensions. But these are the bread and butter of what makes it useful, practical and appealing to users. The same is also true of Cinnamon, which has also partially been afflicted the same way. Technically, one may claim that extensions are a poor excuse for bad design, but then, in general, history has shown that they do make products more engaging in the long run. Collective intelligence can be a good thing, especially when harvested for free.

I am still convinced that Gnome 3 is doing it wrong, and that Plasma, Unity or even MATE are much better solutions on all levels. But then, if you do want to use this desktop environment, there are several handy extensions that can truly transform the experience. The must-have set, and then a sweetening of five nice little extras, which help make the desktop more useful and fun. If you have any other suggestions, this is a good time to use your email sending skills. And we're done.

Read more

Games: Scarecrow Studio, RAZED, XCOM 2

Filed under
Gaming
  • Colourful comedy adventure '3 Minutes to Midnight' planned to release for Linux

    Scarecrow Studio [Official Site] have officially announced that their colourful comedy adventure 3 Minutes to Midnight with a trailer and it's coming to Linux.

  • RAZED will bring lightning-fast platformer racing to Linux on September 14th

    Soaked in some vibrant colours, lightning-fast platformer RAZED will requiring a good pair of running shoes when it releases with Linux support on September 14th.

    Developed by Warpfish Games with a sprinkle of publishing from PQube Limited, RAZED is promising an exciting speedrunning experience across the 60 levels being included at release. These levels are spreadout across six different worlds, each of them having their own unique flavour. Each world will also come with an ability to unlock, along with a boss battle.

  • XCOM 2 to possibly get another expansion with 'TLE'

    There's rumours circling around about XCOM 2 getting a new expansion and it seems whatever it turns out to be that Linux support should be there.

A Look At DragonFlyBSD's Kernel Tuning Performance On The AMD Threadripper 2990WX

Filed under
Graphics/Benchmarks
BSD

Last week I posted some initial tests and benchmarks of DragonFlyBSD/FreeBSD on the AMD Threadripper 2990WX. While that went well and the BSDs scale with this 32-core / 64-thread processor better than Windows, lead DragonFly developer Matthew Dillon had picked up a 2990WX system and has been tuning the kernel ever since. Here are some benchmarks looking at some of his recent optimizations.

Hours after that BSD Threadripper testing ended last week, Matthew Dillon landed some more performance tuning/optimizations to benefit the Threadripper 2990WX design. Here are some benchmarks of that original 2990WX support on DragonFlyBSD 5.3-DEVELOPMENT compared to the later daily snapshot.

Read more

SharkLinux Distro: Open Source in Action

Filed under
Linux
OSS

Every so often I run into a Linux distribution that reminds me of the power of open source software. SharkLinux is one such distribution. With a single developer creating this project, it attempts to change things up a bit. Some of those changes will be gladly welcomed by new users, while scoffed at by the Linux faithful. In the end, however, thanks to open source software, the developer of SharkLinux has created a distribution exactly how he would want it to be. And that my friends, is one amazing aspect of open source. We get to do it our way.

But what is SharkLinux and what makes it stand out? I could make one statement about SharkLinux and end this now. The developer of SharkLinux reportedly developed the entire distribution using only an Android phone. That, alone, should have you wanting to give SharkLinux a go.

Read more

Linux hacker board features new Allwinner SoC with analytics accelerator

Filed under
Linux

The open-spec, camera-oriented “Lindenis V5” SBC runs Linux on a new quad -A7 Allwinner V5 V100 with a visual analytics accelerator, and offers dual MIPI-CSI, GbE, and a 40-pin expansion header.

A Shenzhen, China startup called Lindenis Tech. Ltd., staffed by former Allwinner employees, has launched an open spec, 139 x 85mm single board computer that debuts a 1.5GHz Allwinner camera SoC called the V5 V100. Like the Allwinner A33, H2+, and H3 SoCs, the Allwinner V5 V100 (PDF) runs on 4x Cortex-A7 cores. However, instead of an Arm Mali GPU, there’s a custom VPU, a dual ISP, and an “AIE” acceleration engine for visual analytics, with support for motion detection, perimeter defense, video diagnosis, face detection, flow statistics, and binocular depth maps.

Read more

More in Tux Machines

today's leftovers

  • Snapcraft Clinic Successes

    On Thursday I mentioned we were restarting the Snapcraft Clinic. Basically we stand up a regular video call with engineers from the snap and snapcraft team & us from Snap Advocacy. Developers of applications and publishers of snaps are invited to join to troubleshoot. There was nothing especially secret or private discussed, but as we don’t record or stream the calls, and I don’t have direct permission to mention the applications or people involved, so I’ll keep this a little vague. In future I think we should ask permission and record the outcomes of the calls. We had a few productive discussions. One developer brought an application which they’d requested classic confinement for, and wished to discuss the options for confinement. We had a rather lengthy open discussion about the appropriateness of the available options. The developer was offered some choices, including making changes to their application to accomodate confinement, and another was (as always) not to snap the application. They appreciated our openness in terms of accepting that there are limitations with all software, and not everything always makes sense to be packaged as a snap, at the moment. We also had a productive discusison with a representative of a group responsible for publishing multiple snaps. They had difficulties with a graphical snapped application once it had been updated to use core20. The application would launch and almost immediately segfault. As the application was already published in the Snap Store, in a non-stable channel, we were all able to install it to test on our own systems.

  • Kraft Version 0.96

    Ich freue mich, heute das Release Version 0.96 von Kraft herauszugeben. Die neue Version kann über die Homepage heruntergeladen werden.

  • A new data format has landed in the upcoming GTG 0.5

    Diego’s changes are major, invasive technological changes, and they would benefit from extensive testing by everybody with “real data” before 0.5 happens (very soon). I’ve done some pretty extensive testing & bug reporting in the last few months; Diego fixed all the issues I’ve reported so far, so I’ve pretty much run out of serious bugs now, as only a few remain targetted to the 0.5 milestone… But I’m only human, and it is possible that issues might remain, even after my troll-testing. Grab GTG’s git version ASAP, with a copy of your real data (for extra caution, and also because we want you to test with real data); see the instructions in the README, including the “Where is my user data and config stored?” section. Please torture-test it to make sure everything is working properly, and report issues you may find (if any). Look for anything that might seem broken “compared to 0.4”, incorrect task parenting/associations, incorrect tagging, broken content, etc.

  • MAS ‘Ocean strainer’ technology to be open source

    Inspired by the success of its ‘Ocean Strainer’ floating trash trap, a pilot project launched in the Dehiwala Canal last year, MAS Holdings will make the ‘Ocean Strainer’ technology available to interested parties, to replicate and scale up the solution.

  • Notes on Addressing Supply Chain Vulnerabilities

    One of the unsung achievements of modern software development is the degree to which it has become componentized: not that long ago, when you wanted to write a piece of software you had to write pretty much the whole thing using whatever tools were provided by the language you were writing in, maybe with a few specialized libraries like OpenSSL. No longer. The combination of newer languages, Open Source development and easy-to-use package management systems like JavaScript’s npm or Rust’s Cargo/crates.io has revolutionized how people write software, making it standard practice to pull in third party libraries even for the simplest tasks; it’s not at all uncommon for programs to depend on hundreds or thousands of third party packages. [...] Even packages which are well maintained and have good development practices routinely have vulnerabilities. For example, Firefox recently released a new version that fixed a vulnerability in the popular ANGLE graphics engine, which is maintained by Google. Both Mozilla and Google follow the practices that this blog post recommends, but it’s just the case that people make mistakes. To (possibly mis)quote Steve Bellovin, “Software has bugs. Security-relevant software has security-relevant bugs”. So, while these practices are important to reduce the risk of vulnerabilities, we know they can’t eliminate them. Of course this applies to inadvertant vulnerabilities, but what about malicious actors (though note that Brewer et al. observe that “Taking a step back, although supply-chain attacks are a risk, the vast majority of vulnerabilities are mundane and unintentional—honest errors made by well-intentioned developers.”)? It’s possible that some of their proposed changes (in particular forbidding anonymous authors) might have an impact here, but it’s really hard to see how this is actionable. What’s the standard for not being anonymous? That you have an e-mail address? A Web page? A DUNS number?[3] None of these seem particularly difficult for a dedicated attacker to fake and of course the more strict you make the requirements the more it’s a burden for the (vast majority) of legitimate developers. I do want to acknowledge at this point that Brewer et al. clearly state that multiple layers of protection needed and that it’s necessary to have robust mechanisms for handling vulnerability defenses. I agree with all that, I’m just less certain about this particular piece.

  • 26 Firefox Quantum About:Config Tricks You Need to Learn - Make Tech Easier

    “Here be dragons,” reads the ominous disclaimer when you type about:config into Firefox’s URL bar, warning you that tweaking things in this area is largely experimental and can cause instability to your browser. Sounds exciting, right? And even though it sounds a little scary, the fact is you will almost certainly be okay when you start playing around in this area and can actually use the features here to improve and speed up your browser. These are Make Tech Easier’s favorite Firefox about:config tricks, freshly updated for Firefox Quantum.

  • Attackers collaborate to exploit CVE-2021-21972 and CVE-2021-21973 - Blueliv

Programming Leftovers

  • The HTTP Referer header is fading away (at least as a useful thing)

    The HTTP Referer header on requests is famously misspelled (it should be Referrer), and also famously not liked because of privacy and security concerns. The privacy and security concerns are especially strong with external ('cross-origin') Referers, which is also the ones that many people find most useful because they tell you where visitors to your pages are coming from and let you find places where people have linked to you or are mentioning you.

  • Top 10 Natural Language Processing (NLP) Trends To Look Forward

    AI and Machine Learning have gifted us marvelous things. NLP or Natural Language Processing is one of them. It is one of the most prominent applications of AI. We are using this technology in our day-to-day life without even knowing. Translators, speech recognition apps, chatbots are actually NLP-powered products. Tech giants like Google and Microsoft are making new developments in NLP every year. If you are an AI enthusiast, you should go deep inside NLP. Chill! We got you covered. Just go through the article, and know about the top NLP trends that most data scientists are talking about.

  • Russ Allbery: DocKnot 4.01

    DocKnot is my software documentation and release management tool. This release adds support for a global user configuration file separate from the metadata for any given project and adds support for signing generated distribution tarballs with GnuPG. Currently, the only configuration options for the global configuration file are to set the destination location of generated distributions and the PGP key to use when signing them.

  • horizonator: terrain renderer based on SRTM DEMs

    I just resurrected and cleaned up an old tool I had lying around. It's now nice and usable by others. This tool loads terrain data, and renders it from the ground, simulating what a human or a camera would see. This is useful for armchair exploring or for identifying peaks. This was relatively novel when I wrote it >10 years ago, but there are a number of similar tools in existence now. This implementation is still useful in that it's freely licensed and contains APIs, so fancier processing can be performed on its output.

  • Happy birthday, Python, you're 30 years old this week: Easy to learn, and the right tool at the right time

    The 30th anniversary of Python this week finds the programming language at the top of its game, but not without challenges. "I do believe that Python just doesn’t have the right priorities these days," said Armin Ronacher, director of engineering at software monitoring biz Sentry and creator of Flask, the popular Python web app framework, in an email interview with The Register. Ronacher, a prolific Python contributor, remains a fan of the language. He credits Python's success to being both easy to learn and having an implementation that was easy to hack. And in its early years, Python didn't have a lot of competitors with those same characteristics, he said.

  • Google fires 150 game developers hired for Stadia: Report

    In about two years, Google has announced to shut down the in-house Stadia game development division, as it sees a great adoption of its technology by third-party developers and publishers to create world-class games.

    Google has said that it will not be investing further in bringing exclusive content from its internal development team SG&E, beyond any near-term planned games.

Benchmarks at Phoronix and Phoronix Test Suite

  • Vulkan Ray-Tracing Along With Other New/Updated Benchmarks For February - Phoronix

    Below is a look at all of the updates now available via OpenBenchmarking.org for Phoronix Test Suite users or if simply wanting to go to the test profile pages to gauge the CPU/GPU performance in the different real-world workloads. All these updates are available to Phoronix Test Suite users automatically if on an Internet connection when the metadata automatically updates or by running phoronix-test-suite openbenchmarking-refresh to force refresh.

  • The Phoronix Test Suite Gains Vulkan Ray-Tracing Benchmarks

    The versatile Phoronix Test Suite, developed and used by the Linux news website Phoronix, has gained profiles for benchmarking Vulkan ray-tracing performance using two different benchmarks as well as the JPEG XL benchmarks. There's also updates to many of the existing tests as well as a new 10.2.2 release of the Phoronix Test Suite software. [...] Michael Larabel has also updated many existing benchmarks, including the ones for the commercial closed-source games Portal 2, Insurgency and Civilization VI, blender, the libavif AVIF image encoder, the dav1d AV1 video encoder, GROMACS (GROningen MAchine for Chemical Simulations), ParaView, V-RAY (commercial), Pennant (OpenMP benchmark), NWChem and the free software platform game DDraceNetwork.

today's howtos

  • How To Use chmod and chown Command in Linux

    How do I use chmod and chown command under Linux / Unix operating systems? Use the chown command to change file owner and group information. we run the chmod command command to change file access permissions such as read, write, and access. This page explains how to use chmod and chown command on Linux or Unix-like systems.

  • How To Add Route on Linux – devconnected

    As a network engineer, you probably spend a lot of time thinking and planning your network infrastructure. You plan how computers will be linked, physically using specific cables but also logically using routing tables. When your network plan is built, you will have to implement every single link that you theorized on paper. In some cases, if you are using Linux computers, you may have to add some routes in order to link it to other networks in your company. Adding routes on Linux is extremely simple and costless : you can use the Network Manager daemon (if you are running a recent distribution) or the ifconfig one. In this tutorial, you will learn how you can easily add new routes on a Linux machine in order to link it to your physical network.

  • syncing subtitles in freedom

    The topic of creating subtitles with Free Software has often come up in my circles of Emacs-oriented users, and I haven't had a good recommendation to share, until this idea hit me the other day. Subtitle files are largely blocks of start/end time associated with blocks of text. I figured, once you got a transcript, existing Emacs Org Mode features could be used, perhaps along with keyboard macros, to turn the transcript into a synced subtitle file.

  • How To Install Minecraft on Ubuntu 20.04 LTS [Ed: Proprietary and Microsoft; not an attractive option as Free/libre alternatives exist]

    In this tutorial, we will show you how to install Minecraft on Ubuntu 20.04 LTS. For those of you who didn’t know, Minecraft is the most popular sandbox video game developed by Mojang studios but later purchased by Microsoft. It can be used with all major platforms like Linux, macOS, and Windows. Most Minecraft players would agree that the secrete to the game’s success lies in its creativity-inspiring design. Players are free to explore a large, procedurally generated world made of blocks, each of which can be interacted with, moved, or transformed into resources for crafting. This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you through the step-by-step installation of Minecraft on Ubuntu 20.04 (Focal Fossa). You can follow the same instructions for Ubuntu 18.04, 16.04, and any other Debian-based distribution like Linux Mint.

  • Ubuntu: format SD card [Guide]

    Are you new to Ubuntu? Do you need to format your SD card but can’t figure out how to do it? If so, this guide is for you! Follow along as we go over a few ways you can format SD cards on Linux.

  • How to remove a remove apt repository from Debian

    Do you have an Apt repository on your Debian Linux PC that you want to delete? Can’t figure out how to do it? We can help! Follow along as we go over two ways you can remove Apt repositories from Debian!

  • The Raspberry PI Cheat Sheet – Raspberry PI User

    The Raspberry PI cheat sheet gives a quick overview of common commands, installation tips and links to guides to help you set up your Raspberry PI as a desktop computer.

  • Do a Kernel Upgrade the Easy Way in Linux Mint

    Upgrading the Linux kernel can be difficult, especially for new Linux users. In Linux Mint, however, it's possible to upgrade to a newer kernel with zero hassle. Today we'll find out how to do it, and what to do if you experience problems.