Language Selection

English French German Italian Portuguese Spanish

Why We Can't Teach Cybersecurity

Filed under

By Dr. Andy Farnell

I teach cybersecurity. It's something I really believe in, but it's hard work for all the wrong reasons. First day homework for students is watching Brazil, No Country for Old Men, Chinatown, The Empire Strikes Back, or any other film where evil triumphs and the bad guys win. This establishes the right mindset - like the medics at the Omaha beach landing in Saving Private Ryan. Not to be pessimistic, but cybersecurity is a lost cause, at least as things stand today. If we define computer security to be the combination of confidentiality, integrity, and availability for data, and as resilience, reliability and safety for systems, then we are failing terribly on all points.

As a "proof" after a fashion, my students use a combination of Blotto analysis from military game theory, and Lubarsky's law ("there's always one more bug"). It is a dispiriting exercise to see how logic stacks up against the defenders, according to which "the terrorists always win". Fortunately, game theory frequently fails to explain a reality where we are not all psychopathically selfish Bayesian utility maximisers (unlike corporations which are programmed to be). Occasionally hope, compassion, gratitude, and neighbourly love win out.

Could things be worse than having mathematics against you? Actually yes. You could live in a duplicitous culture antithetical to security but favouring a profitable facsimile of it. Perhaps that's a means for obsolete power hierarchies to preserve themselves, or because we don't really understand what "security" is yet. Regardless, that's the culture we have, and it's a more serious problem than you might think, much more so than software complexity or the simple greed of criminals.

My optimism is that if we can face up to facts, we can start to change and progress. It is in the nature of teachers, doctors and drill instructors that we must believe people can change. So I'll try to explore here how this mess happened, how Linux, BSD and free open source software with transparent standards are a plausible even necessary way out of the present computer security crisis, and why the cybersecurity courses at most universities are not helping.

We have to keep faith that complexity, bad language design and reckless software engineering practices are surmountable by smart people. Maybe one day we'll build computers that are 99.9% secure. But that is unlikely to happen for reasons recently explained by Edward Snowden, who describes an Insecurity Industry. Indeed, I was a little disappointed by Snowden's essay which does not go nearly far enough in my opinion.

For me, the Insecurity Industry is not located in a few commercial black-hat operations like Israel's NSO Group, but within the attitudes and practices running through every vein of mainstream computing. As with its leaders, a society gets the technology it deserves. As we revel in cheap imported goods, surveillance capitalism, greed, convenience, manipulation, and disempowerment of users, we reap the security we deserve.

Blaming the cyber-arms trade, the NSO or NSA for answering the demands of cops and criminals alike, is distracting. Without doubt what they are doing is wrong and harmful to everyone, but we can't have secure computing while those who want it are an educated minority. That situation will not change so long as powerful and fundamentally untrustworthy corporations with business models founded on ignorance dominate our digital lives.

Projects of digital literacy started in the nineteen eighties. They kick-started Western tech economies, but faltered in the mid nineties. Programming and "computer studies" which attempted to explain technological tools were replaced by training in Microsoft Word and Excel spreadsheets. Innovation tailed-off. A generation taught to be dependent on tech, not masters of it, are fit only for what David Graeber described as Bullshit Jobs Graeber18.

Into this vacuum rushed "Silicon Valley values" of rent seeking, piggybacking upon established standards and protocols. With a bit of spit, polish, and aggressive marketing, old lamps could be foisted upon consumers. Twenty years later we have a culture of depressed, addicted, but disenfranchised technology users Lanier11.

We have moved from "It's more fun to compute" to "If you've nothing to fear you've nothing to hide". In other words, we've transformed digital technology from a personally empowering choice into systems of near-mandatory social command and control (see Neil Postman's Technopoly postman93). What advantage would any group have in securing their own chains and the weapons ranged against them? A sentiment only half-disguised in young people today is utter ambivalence toward tech.

As states move to reclaim control from social media platforms, public debate has been framed around whether Facebook and suchlike are threats to democracy and ought to be regulated. But this is merely a fragment of a larger problem and of a discussion that has never been properly widened to examine the general dangers of information technology in all its manifest forms, in the hands of governments, businesses, rogue groups and individuals alike.

For me, an elephant in the room is the colossal distance between what we teach and what we practice. Twice convicted monopolists Microsoft set back computing by decades, and in particular their impact on security has been devastating. Yet their substandard wares are still pushed into schools, hospitals and safety-critical transport roles. Even as embarrassing new holes in their products are exposed daily, lobbying and aggressive misinformation from Microsoft and other Big-Tech companies, all of which suffer from appalling privacy and security faults, continues unabated.

Big-tech corporations are insinuating themselves into our public education and health systems without any proper discussion around their place. It is left to well educated individuals to opt-out, reject their systems, and insist on secure, interoperable choices. Advisories like the European Interoperability Framework (EIF is part of Communication COM134 of the European Commission March 2017) recognise that tech is set to become a socially divisive equality issue. The technical poverty of the future will not separate into "haves and have-nots", but "will and the will-nots", those who will trade their privacy and freedom for access and those who eschew convenience for digital dignity.

As the word "infrastructure" (really vertical superstructure) has slyly replaced ICT (a horizontal service) battles have raged between tech monopolies and champions of open standards for control of government, education and health. The idea of public code (see the commentary of David A Wheeler and Richard Stallman) as the foundation of an interoperable technological society, has been vigorously attacked by tech giants. Germany fought Microsoft tooth and nail to replace Windows systems with 20,000 Linux PCs in 2015, only to have Microsoft lobby their way back in, replacing 30,000 desktops with Windows 10 in 2017. Now the Germans seem poised to switch again, this time taking back all public services by mandating support for LibreOffice.

In the UK, several institutions at which I teach are 'Microsoft customers'. I pause to use the term "Microsoft Universities", but they may as well be. Entirely in the pocket of a single corporation, all email, storage networks, and "Teams" communication are supplied by the giant. Due to de-skilling of the sector, the ICT staff, while nice enough people, lack advanced IT skills. They can use off-the-shelf corporate tools, but anything outside lockstep conformity allowed by check-box webmin interfaces is both terrifying and "not supported". I met a secondary school headmaster who seemed proud to tell me that they were not in the pockets of Microsoft, because they had "become a Google Academy". I responded that "as a Linux child", my daughter woudn't be using any of that rubbish either.

Here's a problem; I don't use Microsoft or Google products. At one level it's an ethical decision, not to enrich aggressive bullies who won't pay proper taxes in my country. It's also a well informed technical position based on my knowledge of computer security. For me to teach Microsoft to cybersecurity students would bring professional disgrace. I won't be the first or last person to lose work for putting professional integrity first. They say "Nobody ever got fired for choosing Microsoft". At some institutions that is not merely advice, it's a threat. Security in the shadow of Big-Tech now means job-security, as in the iron rice bowl from which the compliant may feed, but educated independent thinkers must abstain.

A more serious problem is not just that companies like Google and Microsoft are an expensive, controlling foreign corporations supplying buggy software, or that university administrators have given away control of our networks and systems, it's that commercial products are increasingly incompatible with teaching and research. They inject inbuilt censorship and ideological micromanagement into academies and schools.

Another is that "choice" is something of an illusion. Whatever the appearance of competition between, say, Apple and Facebook, Big-Tech companies collude to maintain interlocking systems of controls that enforce each others shared values including sabotage of interoperability, security and inviting regulation upon themselves to better keep down smaller competitors. Big-Tech comes with its own value system that it imposes on our culture. It restricts the learning opportunities of our kids, limits workplace innovation and diversity, and intrudes into our private activities of commerce and health.

In such a hostile environment for teaching cybersecurity (which is to teach empowering knowledge, and why we call it "Ethical Hacking" 1) one may employ two possible methods. First, we can buy in teaching packages reliant entirely on off-site resources. These are the "official" versions of what computer security is. Two commonly available versions come from Cisco and the EC Council. Though slickly presented these resources suffer the same problems as textbooks in fast-changing disciplines. They very quickly go out of date. They only cover elementary material of the "Cyber Essentials" flavour, which ultimately is more about assurance than reality. And they are partial, perhaps even parochial versions of the subject arrived at by committee.

Online courses also suffer link-rot and patchy VM service that breaks lessons. Unlike in-house setups, professors or students cannot debug or change the system, itself an important opportunity for learning. Besides, the track record of Cisco with respect to backdoors no longer inspires much confidence.

The other method is to create "suitcase data-centres". A box of Raspberry Pi single board computers saves the day! The Raspberry Pi Foundation, perhaps modelled after the early digital literacy drives of Acorn/BBC has done more for British education than any dozen edu-tech companies by promoting (as much as it can) openness of hardware and GNU/Linux/Unix software.

Junk laptops running Debian (Parrot Linux) and SBCs make a great teaching setup because a tangle of real network cables, wifi antennas and flashing lights helps visualise real hacking scenarios. Professors often have to supply this equipment using our own money. I rescued a pile of 1.2GHz Intel Atom netbooks from the garbage. Because we are not allowed to connect to university networks, 3/4G hotspots are necessary, again using bandwidth paid for out of my own pocket in order to run classes. Teaching cybersecurity feels like a "forbidden" activity that we sneakily have to do despite, not because of, university support.

Teaching cybersecurity reflects a cultural battle going on right inside our classrooms. It is a battle between two version of a technological society, two different futures. One an empowering vision of technology, the other a dystopian trap of managed dependency. Dan Geer, speaking in 2014 described cybersecurity as a manifestation of Realpolitik. Nowhere does the issue come so clearly to a head as in the schism between camps of Snowden or Assange supporters and the US State, each of which can legitimately claim the other a "traitor" to some ideal of "security".

At the everyday level there is a tension between what we might call real versus fake security. The latter is a festival of form over function, a circus of phones, apps and gizmos where appearance triumphs over reality. It's a racket of productised solutionism, assurance, certification and compliance that's fast supplanting actual security efforts. By contrast, the former is a quiet anathema to "security industry" razzle. It urges thoughtful, modest simplicity, slow and cautious change. It's about what you don't do.

So, in our second lesson we analyse the word "security" itself. Security is both a reality and a feeling. There are perhaps masculine and feminine flavours of security, one following a military metaphor of perimeters, penetration and targets, the other, as Eve Ensler Ensler06 and Brene Brown Brown12 allude, an inner security that includes the right to be insecure and be free from patrician security impositions "for your own good". Finally, there is the uncomfortable truth that security is often a zero-sum affair - your security means my insecurity. While "good" security is a tide that raises all ships, some people misuse security as a euphemism for wielding power.

None of these social and psychological realities fit well into the lacklustre, two dimensional models of textbook computer security. Fortunately a mature discipline of Security Engineering which does not dodge social and political factors has emerged in the UK. Ross Anderson Anderson08 is part of a team leading such work at the Cambridge Cybercrime Centre. One take-away from lesson two is that the word "security" may not be used as a bare, abstract noun. One must ask; security for who? Security from who or what? Security to what end?

Once we begin to examine the deeper issues around device ownership, implied (but infirm) trust models, forced updates, security theatre, and conflicting cyber-laws, we see that in every important respect tech is anarchy. It's a de facto "might is right" free-for-all where much of what passes for "security" for our smartphones, online banking and personal information is "ignorant bullshit" (in the strict academic sense of bullshit according to Harry Frankfurt; that vendors and politicians don't know that they do not know what they are talking about - and care even less Frankfurt05).

Consequently, much of what we teach; the canonical script of "recon, fingerprinting, vulnerability analysis, vector and payload, clean-up, pivoting, escalation, keeping root…", and the corresponding canon of blue team defence (backup, intrusion detection, defence in depth, etc…) - has no context or connection to a bigger picture. It is ephemeral pop that will evaporate as technology changes leaving students with no deeper understanding of what we are trying to do by testing, protecting and repairing systems and data, or why that even matters.

We create more guards for the castles of tech-feudalism - obedient, unthinking security guards employed to carry out the whims of the management class. Leveraged by the unspoken carrot of preferential technical privilege and enforced by the stick of threatened removal of their "security status", they become administrators of new forms of political force. Challenges to grey-area behaviours beyond the legal remit of managers, are proclaimed "security breaches" unless pursued through intractable administrative routes or through appeals that can be deflected with allusions to "policy" or the abstract "security" of unseen authorities. Some of our smartest people are ultimately paid well to shut up and never to think for themselves.

There is a very serious concern that our "Ethical Hacking" courses (which contain no study of ethics whatsoever) are just creating fresh cyber-criminals. Despite the narrative that "we are desperately short of cybersecurity graduates and there are great jobs for everyone", the reality is that students graduate into an extremely competitive environment where recruitment is often hostile and arbitrary. It doesn't take them long to figure that their newfound skills are valuable elsewhere.

Years ago, it became clear to me that we must switch to a model of "Civic Cyber Security". I became interested in the work of Bruce Schneier not as a cryptographer but as an advocate of Technology In The Public Interest. National security is nothing more than the sum-total of individual earned and learned security. That means teaching children as young as five foundational attitudes that would horrify industry.

There is no room to lie back and hope Apple or Google can protect us. Organisations like the UK's National Cyber Security Centre, or US National Security Agency, which have conflicted remits, might wish to be seen as benevolent guardians. Their output has been likened by comedian Stuart Lee to "Mr Fox's guide to hen-house security". Cybersecurity can never be magically granted by those who have a deep and lasting interest in withholding it.

The business of "personal computing" has become ugly. Cybersecurity, in as much as it exists, is a conflicted and unreliable story we tell ourselves about power and tribal allegiances. We can't put on a "good guys" hat and beat "cyber-criminals" so long as we are competing with them for the same thing, exploitable clueless users.

The only questions are whether they are to be sucked dry by ransomware, "legitimate" advertising, or manipulated for political ends. If we are to engage in sincere, truthful education, then we have to call-out Big-Tech for what it is; more a part of the problem than a solution. Those of us who want to explore and teach must still circumvent, improvise and overcome within institutions that pay only lip service to authentic cybersecurity because they are captured by giant corporations



  • [Graeber18] David Graeber, Bullshit Jobs: A Theory, Simon and Schuster (2018).
  • [Lanier11] Jaron Lanier, You Are Not a Gadget, Vintage (2011).
  • [postman93] Neil Postman, Technopoly: The Surrender of Culture to Technology, Vintage Books. N.Y. (1993).
  • [Ensler06] Ensler, Insecure at last, Villard (2006).
  • [Brown12] Brené Brown, The Power of Vulnerability: Teachings on Authenticity, Connection and Courage, Sounds True (2012).
  • [Anderson08] Ross Anderson, Security Engineering: A Guide to Building Dependable Distributed Systems, Wiley (2008).
  • [Frankfurt05] Harry Frankfurt, On Bullshit, Princeton University Press (2005).


1 A term made up to attract young students to cybersecurity while assuring parents and politicians.

About the author

Dr. Andy Farnell is a computer scientist, author and visiting professor in signals, systems and cybersecurity at a range of European universities.

His recent book "Digital Vegan" uses a dietary metaphor to examine technology dependency and over-consumption.

More in Tux Machines

Git 2.35.0

Git 2.35 Release Notes

Updates since Git 2.34

Backward compatibility warts

 * "_" is now treated as any other URL-valid characters in an URL when
   matching the per-URL configuration variable names.

 * The color palette used by "git grep" has been updated to match that
   of GNU grep.

Note to those who build from the source

 * You may need to define NO_UNCOMPRESS2 Makefile macro if you build
   with zlib older than 1.2.9.

 * If your compiler cannot grok C99, the build will fail.  See the
   instruction at the beginning of git-compat-util.h if this happens
   to you.

UI, Workflows & Features

 * "git status --porcelain=v2" now show the number of stash entries
   with --show-stash like the normal output does.

 * "git stash" learned the "--staged" option to stash away what has
   been added to the index (and nothing else).

 * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for
   the newly created branch if "git init" is run.

 * Various operating modes of "git reset" have been made to work
   better with the sparse index.

 * "git submodule deinit" for a submodule whose .git metadata
   directory is embedded in its working tree refused to work, until
   the submodule gets converted to use the "absorbed" form where the
   metadata directory is stored in superproject, and a gitfile at the
   top-level of the working tree of the submodule points at it.  The
   command is taught to convert such submodules to the absorbed form
   as needed.

 * The completion script (in contrib/) learns that the "--date"
   option of commands from the "git log" family takes "human" and
   "auto" as valid values.

 * "Zealous diff3" style of merge conflict presentation has been added.

 * The "git log --format=%(describe)" placeholder has been extended to
   allow passing selected command-line options to the underlying "git
   describe" command.

 * "default" and "reset" have been added to our color palette.

 * The cryptographic signing using ssh keys can specify literal keys
   for keytypes whose name do not begin with the "ssh-" prefix by
   using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256").

 * "git fetch" without the "--update-head-ok" option ought to protect
   a checked out branch from getting updated, to prevent the working
   tree that checks it out to go out of sync.  The code was written
   before the use of "git worktree" got widespread, and only checked
   the branch that was checked out in the current worktree, which has
   been updated.

 * "git name-rev" has been tweaked to give output that is shorter and
   easier to understand.

 * "git apply" has been taught to ignore a message without a patch
   with the "--allow-empty" option.  It also learned to honor the
   "--quiet" option given from the command line.

 * The "init" and "set" subcommands in "git sparse-checkout" have been
   unified for a better user experience and performance.

 * Many git commands that deal with working tree files try to remove a
   directory that becomes empty (i.e. "git switch" from a branch that
   has the directory to another branch that does not would attempt
   remove all files in the directory and the directory itself).  This
   drops users into an unfamiliar situation if the command was run in
   a subdirectory that becomes subject to removal due to the command.
   The commands have been taught to keep an empty directory if it is
   the directory they were started in to avoid surprising users.

 * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is
   done to a piece of e-mail without a patch in it.

 * The default merge message prepared by "git merge" records the name
   of the current branch; the name can be overridden with a new option
   to allow users to pretend a merge is made on a different branch.

 * The way "git p4" shows file sizes in its output has been updated to
   use human-readable units.

 * "git -c branch.autosetupmerge=inherit branch new old" makes "new"
   to have the same upstream as the "old" branch, instead of marking
   "old" itself as its upstream.

Performance, Internal Implementation, Development Support etc.

 * The use of errno as a means to carry the nature of error in the ref
   API implementation has been reworked and reduced.

 * Teach and encourage first-time contributors to this project to
   state the base commit when they submit their topic.

 * The command line completion for "git send-email" options have been
   tweaked to make it easier to keep it in sync with the command itself.

 * Ensure that the sparseness of the in-core index matches the
   index.sparse configuration specified by the repository immediately
   after the on-disk index file is read.

 * Code clean-up to eventually allow information on remotes defined
   for an arbitrary repository to be read.

 * Build optimization.

 * Tighten code for testing pack-bitmap.

 * Weather balloon to break people with compilers that do not support

 * The "reftable" backend for the refs API, without integrating into
   the refs subsystem, has been added.

 * More tests are marked as leak-free.

 * The test framework learns to list unsatisfied test prerequisites,
   and optionally error out when prerequisites that are expected to be
   satisfied are not.

 * The default setting for trace2 event nesting was too low to cause
   test failures, which is worked around by bumping it up in the test

 * Drop support for TravisCI and update test workflows at GitHub.

 * Many tests that used to need GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME
   mechanism to force "git" to use 'master' as the default name for
   the initial branch no longer need it; the use of the mechanism from
   them have been removed.

 * Allow running our tests while disabling fsync.

 * Document the parameters given to the reflog entry iterator callback
   (merge e6e94f34b2 jc/reflog-iterator-callback-doc later to maint).

 * The test helper for refs subsystem learned to write bogus and/or
   nonexistent object name to refs to simulate error situations we
   want to test Git in.

 * "diff --histogram" optimization.

 * Weather balloon to find compilers that do not grok variable
   declaration in the for() loop.

 * diff and blame commands have been taught to work better with sparse

 * The chainlint test script linter in the test suite has been updated.

 * The DEVELOPER=yes build uses -std=gnu99 now.

 * "git format-patch" uses a single rev_info instance and then exits.
   Mark the structure with UNLEAK() macro to squelch leak sanitizer.

 * New interface into the tmp-objdir API to help in-core use of the
   quarantine feature.

 * Broken &&-chains in the test scripts have been corrected.

 * The RCS keyword substitution in "git p4" used to be done assuming
   that the contents are UTF-8 text, which can trigger decoding
   errors.  We now treat the contents as a bytestring for robustness
   and correctness.

 * The conditions to choose different definitions of the FLEX_ARRAY
   macro for vendor compilers has been simplified to make it easier to

 * Correctness and performance update to "diff --color-moved" feature.

 * "git upload-pack" (the other side of "git fetch") used a 8kB buffer
   but most of its payload came on 64kB "packets".  The buffer size
   has been enlarged so that such a packet fits.

 * "git fetch" and "git pull" are now declared sparse-index clean.
   Also "git ls-files" learns the "--sparse" option to help debugging.

 * Similar message templates have been consolidated so that
   translators need to work on fewer number of messages.

Fixes since v2.34

 * "git grep" looking in a blob that has non-UTF8 payload was
   completely broken when linked with certain versions of PCREv2
   library in the latest release.

 * Other code cleanup, docfix, build fix, etc.

 * "git pull" with any strategy when the other side is behind us
   should succeed as it is a no-op, but doesn't.

 * An earlier change in 2.34.0 caused JGit application (that abused
   GIT_EDITOR mechanism when invoking "git config") to get stuck with
   a SIGTTOU signal; it has been reverted.

 * An earlier change that broke .gitignore matching has been reverted.

 * Things like "git -c branch.sort=bogus branch new HEAD", i.e. the
   operation modes of the "git branch" command that do not need the
   sort key information, no longer errors out by seeing a bogus sort
   (merge 98e7ab6d42 jc/fix-ref-sorting-parse later to maint).

 * The compatibility implementation for unsetenv(3) were written to
   mimic ancient, non-POSIX, variant seen in an old glibc; it has been
   changed to return an integer to match the more modern era.
   (merge a38989bd5b jc/unsetenv-returns-an-int later to maint).

 * The clean/smudge conversion code path has been prepared to better
   work on platforms where ulong is narrower than size_t.
   (merge 596b5e77c9 mc/clean-smudge-with-llp64 later to maint).

 * Redact the path part of packfile URI that appears in the trace output.
   (merge 0ba558ffb1 if/redact-packfile-uri later to maint).

 * CI has been taught to catch some Unicode directional formatting
   sequence that can be used in certain mischief.
   (merge 0e7696c64d js/ci-no-directional-formatting later to maint).

 * The "--date=format:" gained a workaround for the lack of
   system support for a non-local timezone to handle "%s" placeholder.
   (merge 9b591b9403 jk/strbuf-addftime-seconds-since-epoch later to maint).

 * The "merge" subcommand of "git jump" (in contrib/) silently ignored
   pathspec and other parameters.
   (merge 67ba13e5a4 jk/jump-merge-with-pathspec later to maint).

 * The code to decode the length of packed object size has been
   (merge 34de5b8eac jt/pack-header-lshift-overflow later to maint).

 * The advice message given by "git pull" when the user hasn't made a
   choice between merge and rebase still said that the merge is the
   default, which no longer is the case.  This has been corrected.
   (merge 71076d0edd ah/advice-pull-has-no-preference-between-rebase-and-merge later to maint).

 * "git fetch", when received a bad packfile, can fail with SIGPIPE.
   This wasn't wrong per-se, but we now detect the situation and fail
   in a more predictable way.
   (merge 2a4aed42ec jk/fetch-pack-avoid-sigpipe-to-index-pack later to maint).

 * The function to cull a child process and determine the exit status
   had two separate code paths for normal callers and callers in a
   signal handler, and the latter did not yield correct value when the
   child has caught a signal.  The handling of the exit status has
   been unified for these two code paths.  An existing test with
   flakiness has also been corrected.
   (merge 5263e22cba jk/t7006-sigpipe-tests-fix later to maint).

 * When a non-existent program is given as the pager, we tried to
   reuse an uninitialized child_process structure and crashed, which
   has been fixed.
   (merge f917f57f40 em/missing-pager later to maint).

 * The single-key-input mode in "git add -p" had some code to handle
   keys that generate a sequence of input via ReadKey(), which did not
   handle end-of-file correctly, which has been fixed.
   (merge fc8a8126df cb/add-p-single-key-fix later to maint).

 * "git rebase -x" added an unnecessary 'exec' instructions before
   'noop', which has been corrected.
   (merge cc9dcdee61 en/rebase-x-fix later to maint).

 * When the "git push" command is killed while the receiving end is
   trying to report what happened to the ref update proposals, the
   latter used to die, due to SIGPIPE.  The code now ignores SIGPIPE
   to increase our chances to run the post-receive hook after it
   (merge d34182b9e3 rj/receive-pack-avoid-sigpipe-during-status-reporting later to maint).

 * "git worktree add" showed "Preparing worktree" message to the
   standard output stream, but when it failed, the message from die()
   went to the standard error stream.  Depending on the order the
   stdio streams are flushed at the program end, this resulted in
   confusing output.  It has been corrected by sending all the chatty
   messages to the standard error stream.
   (merge b50252484f es/worktree-chatty-to-stderr later to maint).

 * Coding guideline document has been updated to clarify what goes to
   standard error in our system.
   (merge e258eb4800 es/doc-stdout-vs-stderr later to maint).

 * The sparse-index/sparse-checkout feature had a bug in its use of
   the matching code to determine which path is in or outside the
   sparse checkout patterns.
   (merge 8c5de0d265 ds/sparse-deep-pattern-checkout-fix later to maint).

 * "git rebase -x" by mistake started exporting the GIT_DIR and
   GIT_WORK_TREE environment variables when the command was rewritten
   in C, which has been corrected.
   (merge 434e0636db en/rebase-x-wo-git-dir-env later to maint).

 * When "git log" implicitly enabled the "decoration" processing
   without being explicitly asked with "--decorate" option, it failed
   to read and honor the settings given by the "--decorate-refs"

 * "git fetch --set-upstream" did not check if there is a current
   branch, leading to a segfault when it is run on a detached HEAD,
   which has been corrected.
   (merge 17baeaf82d ab/fetch-set-upstream-while-detached later to maint).

 * Among some code paths that ask an yes/no question, only one place
   gave a prompt that looked different from the others, which has been
   updated to match what the others create.
   (merge 0fc8ed154c km/help-prompt-fix later to maint).

 * "git log --invert-grep --author=" used to exclude commits
   written by the given author, but now "--invert-grep" only affects
   the matches made by the "--grep=" option.
   (merge 794c000267 rs/log-invert-grep-with-headers later to maint).

 * "git grep --perl-regexp" failed to match UTF-8 characters with
   wildcard when the pattern consists only of ASCII letters, which has
   been corrected.
   (merge 32e3e8bc55 rs/pcre2-utf later to maint).

 * Certain sparse-checkout patterns that are valid in non-cone mode
   led to segfault in cone mode, which has been corrected.

 * Use of certain "git rev-list" options with "git fast-export"
   created nonsense results (the worst two of which being "--reverse"
   and "--invert-grep --grep=").  The use of "--first-parent" is
   made to behave a bit more sensible than before.
   (merge 726a228dfb ws/fast-export-with-revision-options later to maint).

 * Perf tests were run with end-user's shell, but it has been
   corrected to use the shell specified by $TEST_SHELL_PATH.
   (merge 9ccab75608 ja/perf-use-specified-shell later to maint).

 * Fix dependency rules to generate hook-list.h header file.
   (merge d3fd1a6667 ab/makefile-hook-list-dependency-fix later to maint).

 * "git stash" by default triggers its "push" action, but its
   implementation also made "git stash -h" to show short help only for
   "git stash push", which has been corrected.
   (merge ca7990cea5 ab/do-not-limit-stash-help-to-push later to maint).

 * "git apply --3way" bypasses the attempt to do a three-way
   application in more cases to address the regression caused by the
   recent change to use direct application as a fallback.
   (merge 34d607032c jz/apply-3-corner-cases later to maint).

 * Fix performance-releated bug in "git subtree" (in contrib/).
   (merge 3ce8888fb4 jl/subtree-check-parents-argument-passing-fix later to maint).

 * Extend the guidance to choose the base commit to build your work
   on, and hint/nudge contributors to read others' changes.
   (merge fdfae830f8 jc/doc-submitting-patches-choice-of-base later to maint).

 * A corner case bug in the ort merge strategy has been corrected.
   (merge d30126c20d en/merge-ort-renorm-with-rename-delete-conflict-fix later to maint).

 * "git stash apply" forgot to attempt restoring untracked files when
   it failed to restore changes to tracked ones.
   (merge 71cade5a0b en/stash-df-fix later to maint).

 * Calling dynamically loaded functions on Windows has been corrected.
   (merge 4a9b204920 ma/windows-dynload-fix later to maint).

 * Some lockfile code called free() in signal-death code path, which
   has been corrected.
   (merge 58d4d7f1c5 ps/lockfile-cleanup-fix later to maint).

 * Other code cleanup, docfix, build fix, etc.
   (merge 74db416c9c cw/protocol-v2-doc-fix later to maint).
   (merge f9b2b6684d ja/doc-cleanup later to maint).
   (merge 7d1b866778 jc/fix-first-object-walk later to maint).
   (merge 538ac74604 js/trace2-avoid-recursive-errors later to maint).
   (merge 152923b132 jk/t5319-midx-corruption-test-deflake later to maint).
   (merge 9081a421a6 ab/checkout-branch-info-leakfix later to maint).
   (merge 42c456ff81 rs/mergesort later to maint).
   (merge ad506e6780 tl/midx-docfix later to maint).
   (merge bf5b83fd8a hk/ci-checkwhitespace-commentfix later to maint).
   (merge 49f1eb3b34 jk/refs-g11-workaround later to maint).
   (merge 7d3fc7df70 jt/midx-doc-fix later to maint).
   (merge 7b089120d9 hn/create-reflog-simplify later to maint).
   (merge 9e12400da8 cb/mingw-gmtime-r later to maint).
   (merge 0bf0de6cc7 tb/pack-revindex-on-disk-cleanup later to maint).
   (merge 2c68f577fc ew/cbtree-remove-unused-and-broken-cb-unlink later to maint).
   (merge eafd6e7e55 ab/die-with-bug later to maint).
   (merge 91028f7659 jc/grep-patterntype-default-doc later to maint).
   (merge 47ca93d071 ds/repack-fixlets later to maint).
   (merge e6a9bc0c60 rs/t4202-invert-grep-test-fix later to maint).
   (merge deb5407a42 gh/gpg-doc-markup-fix later to maint).
   (merge 999bba3e0b rs/daemon-plug-leak later to maint).
   (merge 786eb1ba39 js/l10n-mention-ngettext-early-in-readme later to maint).
   (merge 2f12b31b74 ab/makefile-msgfmt-wo-stats later to maint).
   (merge 0517f591ca fs/gpg-unknown-key-test-fix later to maint).
   (merge 97d6fb5a1f ma/header-dup-cleanup later to maint).
Read more Also: Git 2.35 Released With "git stash --staged" mode, Other Developer Additions - Phoronix

FUD and Security Leftovers

  • Linux Servers at Risk of RCE Due to Critical CWP Bugs [Ed: It's not a Linux issue but a program that can run on top of it; FUD pattern?]
  • CWP bugs allow code execution as root on Linux servers, patch now [Ed: Microsoft boosters make a bug in CentOS Web Panel sound like it's an issue with Linux]

    Two security vulnerabilities that impact the Control Web Panel (CWP) software can be chained by unauthenticated attackers to gain remote code execution (RCE) as root on vulnerable Linux servers. CWP, previously known as CentOS Web Panel, is a free Linux control panel for managing dedicated web hosting servers and virtual private servers.

  • CISA Publishes Infographic on Layering Network Security Through Segmentation

    CISA has published an infographic to emphasize the importance of implementing network segmentation—a physical or virtual architectural approach that divides a network into multiple segments, each acting as its own subnetwork, to provide additional security and control that can help prevent or minimize the impact of a cyberattack.

  • LHS Episode #449: Insecurities Everywhere

    Hello and welcome to the 449th installment of Linux in the Ham Shack. In this short-topics episode, the hosts discuss results from the 2021 QSO parties, the FCC tech advisory council, the proliferation of Linux malware, SDR++, programming in Python and much more. Thank you for listening and have a fantastic week.

Today in Techrights

today's leftovers

  • The Apache Weekly News Round-up: week ending 21 January 2022

    We're wrapping up another great week with the following activities from the Apache community...

  • How the debuginfod project evolved in 2021

    Debuginfod is a web service for distributing debugging resources over HTTP. The project began in 2019 and has seen a lot of growth in 2021.

  • Am getting the hang of it…. [Ed: archbang-winter-2201-x86_64.iso has been released]

    With a bit of spare time on my hands between decorating and cooking, been slowly setting up dk tiling window manager. Did try lemonbar as a panel but I soon lost interest and went back to tint2, more the fact I am used to it more. One thing I have added is super + a which fires up rofi showing open windows, not only that it tells you which workspace window is on. Was trying out floating windows and just moved them to workspace 10 to test them out only they would not return to full screen. Found it very odd so tried them on 9 and they worked fine. So thought I would take a look at dkrc file and sure enough there is a line that sets windows, gaps and borders on workspace 10.

  • Brazilian telecoms giant accelerates innovation with SUSE | SUSE Communities

    “SUSE Rancher makes it easier for our IT staff to manage and scale a large container environment. As a result, we can spend less time on repetitive manual tasks and more time on value-added development.” Marcos Borges, Telco/DC Application Manager, Algar Telecom.

  • Linux Foundation launches Open Source Software Development, Linux, and Git certification [Ed: Paid-for LF spam by SJVN at ZDNet. 'Obligatory' articles for sponsors.]

    Want a good-paying programming job? By ZipRecruiter's count, the average annual pay for an open-source developer in the United States is $123,411. That's not bad. There's also a lot of demand for Linux and open-source pros. The Linux Foundation and edX, the leading massive open online course (MOOC) provider, reported in their 2021 Open Source Jobs Report that the pair found more demand for top open-source workers than ever.