Language Selection

English French German Italian Portuguese Spanish

About Tux Machines

Saturday, 20 Jan 18 - Tux Machines is a community-driven public service/news site which has been around for over a decade and primarily focuses on GNU/LinuxSubscribe now Syndicate content

Search This Site

Quick Roundup

Typesort icon Title Author Replies Last Post
Blog entry Some site news srlinuxx 2 01/11/2010 - 5:24pm
Blog entry Distribution Release - pclinuxos enlightenment 2010.11 Texstar 05/11/2010 - 11:22pm
Blog entry Maintenance Release - pclinuxos zen mini 2010.10 Texstar 05/11/2010 - 11:29pm
Blog entry KDE 4.5.4 now available for PCLinuxOS Texstar 02/12/2010 - 8:24pm
Blog entry PCLinuxOS KDE Full and Mini ISOS updated to 2010.11 Texstar 25/11/2010 - 2:16am
Blog entry working quake 1 srlinuxx 25/11/2010 - 1:50am
Blog entry unreal gold install srlinuxx 24/11/2010 - 3:10am
Blog entry new quake 2 install srlinuxx 23/11/2010 - 7:41am
Blog entry PCLinuxOS 64-bit Texstar 19/11/2010 - 4:01pm
Blog entry GNOME 2.32.1 desktop updated for PCLinuxOS Texstar 19/11/2010 - 3:22am

Toughened up SODIMM-style COM taps i.MX8M

Filed under
Android
Linux
Hardware

CompuLab’s rugged, 68 x 42mm “CL-SOM-iMX8” computer-on-module runs Yocto or Android on NXP’s dual- or quad-core Cortex-A53 i.MX8M, with up to 4GB LPDDR4, up to 64GB eMMC, onboard wireless, and PCIe and HDMI 2.0 support.

CompuLab’s CL-SOM-iMX8 COM, which ships with an optional SBC-iMX8 Evaluation Kit, shares many features with Variscite’s recently announced DART-MX8M module, which similarly features NXP’s new i.MX8M SoC. The CL-SOM-iMX8 is slightly larger, at 68 x 42mm, and adds shock (50G/20ms) and vibration (20G/0-600Hz) resistance.

Read more

Also: 5.25-inch SBCs offer Kaby Lake or Skylake in S- and H-series options

Browsers: Mozilla Firefox and Bromite

Filed under
Google
Moz/FF
Web
  • Firefox 60 Product Integrity Requests Report

    Late last year I was putting out weekly reports on the number of requests Mozilla’s Product Integrity group was receiving and how well we were tracking toward our self-imposed service-level agreement (respond to 90% within 48 hours).

    The initial system we set up was only ever intended to be minimally viable and has not scaled well, although that’s probably to be expected. There’s been quite a lot of growing pains so I’ve been tasked with taking it to the next level.

  • Tab Warming: How Firefox Will Improve Web Browsing Experience? How To Get It Now?

    Mozilla developer Mike Conley described the details about Tab Warming in a post on his personal blog. It will improve tab switching by pre-loading the contents of a tab before it gets displayed in front of the users.

  • Bromite Is the New NoChromo — Open Source Chrome Port with Ad Blocking

    A while back, we told you about NoChromo, a no-root ad-blocking browser based on Google Chrome's open source code base, Chromium. That browser was wildly successful, as it offered an identical interface to regular Chrome, but without any ads. Sadly, the developer abandoned NoChromo, but a new ad-blocking Chromium port called Bromite has been released to fill its void.

GNOME: GNOME Shell, Bug Tracking, GXml

Filed under
GNOME
  • How to Install GNOME Shell Extensions GUI / CLI

    GNOME Shell extensions are small and lightweight pieces of codes that enhance GNOME desktop’s functionality and improves the user experience. They are the equivalent of add-ons in your browser. For instance, you can have add-ons that download videos like IDM downloader or block annoying ads such as Adblocker.

    Similarly, GNOME extensions perform certain tasks e.g. Display weather and geolocation. One of the tools used to install and customize GNOME Shell extensions is the GNOME tweak tool. It comes pre-installed in the latest Linux distributions. This article we cover how to install GNOME Shell extensions from GUI and from the command line on various Linux distros.

  • Musings on bug trackers

    I love bugzilla, I really do. I’ve used it nearly my entire career in free software. I know it well, I like the command line tool integration. But I’ve never had a day in bugzilla where I managed to resolve/triage/close nearly 100 issues. I managed to do that today with our gitlab instance and I didn’t even mean to.

  • ABI stability for GXml

    I’m taking a deep travel across Vala code; trying to figure out how things work. With my resent work on abstract methods for compact classes, may I have an idea on how to provide ABI stability to GXml.

    GXml have lot of interfaces for DOM4, implemented in classes, like Gom* series. But they are a lot, so go for each and add annotations, like Gee did, to improve ABI, is a hard work.

More on Barcelona Moving to Free Software

Filed under
GNU
Linux
  • Barcelona Aims To Oust Microsoft In Open Source Drive

    The city of Barcelona has embarked on an ambitious open source effort aimed at reducing its dependence on large proprietary software vendors such as Microsoft, including the replacement of both applications and operating systems.

  • Barcelona to ditch Microsoft software for open source software

    Barcelona, one of the most popular cities in the Europe is now switching to open-source software by replacing Microsoft Windows, Office and Exchange with Linux, Libre Office and Open Xchange respectively. The city council is already piloting the use of Ubuntu Linux desktops along with Mozilla Firefox as the default browser. With this move, Barcelona city is planning to save money over the years by reducing software/service licensing fees. They are also planning to hire new developers to write open-source software. The open-source product will also be made available to other Spanish municipalities and public bodies further afield allowing them the opportunity to save money on software licences.

  • Barcelona to ditch Microsoft in favour of open source Linux software

    Catalan capital Barcelona is planning to ditch proprietary software products from Microsoft in favour of free, open source alternatives such as Open-Xchange email.

    That’s according to a report by Spain's national paper El Pais, which reports that Barcelona plans to invest 70% of its annual software budget in open source this year.

OSS Leftovers

Filed under
OSS
  • Open Source turns 20

    While open source software is ubiquitous, recognized across industries as a fundamental infrastructure component as well as a critical factor for driving innovation, the "open source" label was coined only 20 years ago.

    The concept of open source software - as opposed to free software or freeware - is credited to Netscape which, in January 1998, announced plans to release the source code of its proprietary browser, Navigator, under a license that would freely permit modification and redistribution. This code is today the basis for Mozilla Firefox and Thunderbird.

    The Open Source Initiative (OSI) regards that event as the point at which "software freedom extended its reach beyond the enthusiast community and began its ascent into the mainstream".

  • Coreboot 4.7 Released With 47 More Motherboards Supported, AMD Stoney Ridge

    Coreboot 4.7 is now available as the latest release of this free and open-source BIOS/UEFI replacement.

    Coreboot 4.7 is the latest tagged release for this project developed via Git. This release has initial support for AMD Stoney Ridge platforms, Intel ICH10 Southbridge support, Intel Denverton/Denverton-NS platform support, and initial work on supporting next-gen Intel Cannonlake platforms.

  • Thank you CUSEC!

    Last week, I spoke at CUSEC (Canadian Undergraduate Software Engineering Conference) in Montreal.   I really enjoy speaking with students and learning what they are working on.  They are the future of our industry!  I was so impressed by the level of organization and the kindness and thoughtfulness of the CUSEC organizing committee who were all students from various universities across Canada. I hope that you all are enjoying some much needed rest after your tremendous work in the months approaching the conference and last week.

  • Percona Announces Sneak Peek of Conference Breakout Sessions for Seventh Annual Percona Live Open Source Database Conference
  • The Universal Donor

    A few people reacted negatively to my article on why Public Domain software is broadly unsuitable for inclusion in a community open source project. Most argued that because public domain gave them the rights they need where they live (mostly the USA), I should not say it was wrong to use it.

    That demonstrates either parochialism or a misunderstanding of what public domain really means. It should not be used for the same reason code known to be subject to software patents should not be used — namely that only code that, to the best efforts possible, can be used by anyone, anywhere without the need to ask permission (e.g. by buying a patent license) or check it it’s needed (e.g. is that PD code PD here?) can be used in an open source project. Public domain fails the test for multiple reasons: global differences in copyright term, copyright as an unalienable moral rather than as a property right, and more.

    Yes, public domain may give you the rights you need. But in an open source project, it’s not enough for you to determine you personally have the rights you need. In order to function, every user and contributor of the project needs prior confidence they can use, improve and share the code, regardless of their location or the use to which they put it. That confidence also has to extend to their colleagues, customers and community as well.

Ubuntu: Ubuntu Core, Ubuntu Free Culture Showcase for 18.04, Lubuntu 17.04 EoL

Filed under
Ubuntu
  • Ubuntu Core: A secure open source OS for IoT

    Canonical's Ubuntu Core, a tiny, transactional version of the Ubuntu Linux OS for IoT devices, runs highly secure Linux application packages, known as "snaps," that can be upgraded remotely.

  • Introducing the Ubuntu Free Culture Showcase for 18.04

    Ubuntu’s changed a lot in the last year, and everything is leading up to a really exciting event: the release of 18.04 LTS! This next version of Ubuntu will once again offer a stable foundation for countless humans who use computers for work, play, art, relaxation, and creation. Among the various visual refreshes of Ubuntu, it’s also time to go to the community and ask for the best wallpapers. And it’s also time to look for a new video and music file that will be waiting for Ubuntu users on the install media’s Examples folder, to reassure them that their video and sound drivers are quite operational.

    Long-term support releases like Ubuntu 18.04 LTS are very important, because they are downloaded and installed ten times more often than every single interim release combined. That means that the wallpapers, video, and music that are shipped will be seen ten times more than in other releases. So artists, select your best works. Ubuntu enthusiasts, spread the word about the contest as far and wide as you can. Everyone can help make this next LTS version of Ubuntu an amazing success.

  • Lubuntu 17.04 has reached End of Life

    The Lubuntu Team announces that as a non-LTS release, 17.04 has a 9-month support cycle and, as such, reached end of life on Saturday, January 13, 2018. Lubuntu will no longer provide bug fixes or security updates for 17.04, and we strongly recommend that you update to 17.10, which continues to be actively supported with security updates and select high-impact bug fixes.

KDE: Compositor Switcher, digiKam, Season Of KDE

Filed under
KDE
  • This App Automatically Disables Compositing in KDE When Opening Steam

    Compositor Switcher for KDE is a small utility that can disable compositing on the KDE Plasma desktop when running a specific gaming client.

  • digiKam 5.8 Open-Source Image Manipulator Adds UPnP/DLNA Export, Improvements

    The digiKam 5.8.0 open-source cross-platform image editor, viewer, and organizer tool has been released over the weekend with numerous improvements and some new features.

    Coming four months after the previous release, digiKam 5.8.0 is here with another set of enhancements for fans of the applications. For starters, the new version introduces a new tool that allows users to export their image collections to UPnP/DLNA-compatible devices. It can be accessed in all of digiKam's views through the Tools menu.

    "In September 2017, the digiKam team has been invited to take part in the Randa Meetings," reads the release announcement. "We have focused the reunion on including the new media server dedicated to sharing collection contents on local networks with compatible DLNA devices or applications, such as tablets, cellulars, TV, etc."

  • Season Of KDE

    After contributing for several months at GCompris, I applied for SoK 2018 and finally my proposal got selected among top 10 participants. I am very happy with the results I have got.

  • SoK Project – Week 1 & 2

    With all the happiness after being selected for SoK 2018, I was looking forward to start working on my project with whole dedication. My project aims to complete port of a brain-boosting memory activity called “Railroad” (in which kids have to observe the given train and memorize it within given time and then try to rebuild it) from Gtk+ to Qt version. It is a part of project GCompris(a high-quality educational software suite, including a large number of activities for children aged 2 to 10). My mentors are Timothée Giet and Rudra Nil Basu, along with them I’d like to thank a lot to Johnny Jazeix and Divyam Madaan for helping me with my project. My SoK proposal can be found here –> SoK Proposal. And my progress can be tracked at –> Railroad branch.

Kernel: Retpoline, VirtualBox, Linux 4.15 Next Weekend, and Linux Storage, Filesystem, and Memory-Management Summit

Filed under
Linux
  • Retpoline Is Still Being Improved Upon For Intel Skylake/Kabylake

    While initial support for Retpoline was merged into the Linux 4.15 Git kernel last week and is now being backported to some supported Linux kernel series, there is still additional work ongoing for properly mitigating Spectre v2 on Intel Skylake CPUs and newer.

    It turns out Skylake CPUs and newer require additional patches to fully mitigate against the Spectre Variant Two vulnerability. These newer CPUs can fallback to a potentially poisoned indirect branch predictor when a return buffer underflows. Andi Kleen of Intel has sent out a new patch series dubbed "RETPOLINE_UNDERFLOW" that gets enabled by default for Skylake CPUs and newer.

  • VirtualBox Guest Driver Being Mainlined With Linux 4.16

    The upcoming Linux 4.16 kernel cycle will be mainlining the VirtualBox Guest "vboxguest" kernel driver.

    As part of an effort led by Red Hat, the VirtualBox guest drivers are finally working towards mainline in the Linux kernel and with 4.16 there is the vboxguest driver as a notable step following the VirtualBox DRM/KMS driver in Linux 4.13.

  • Linus Torvalds Is Hopeful for a January 21 Release of the Linux 4.15 Kernel

    The eighth and probably the last RC (Release Candidate) of the upcoming Linux 4.15 kernel series has been announced by Linus Torvalds over the weekend and it's now ready for public testing.

    Coming a week after the seventh RC, Linux kernel 4.15 Release Candidate 8 is here with more patches against the Meltdown and Spectre security vulnerabilities publicly disclosed earlier this month. Most specifically, it brings x86 "retpoline" support, a solution developed by Google and other security researchers to not allow speculation on the CPU.

  • LSFMM 2018 call for proposals

    The 2018 Linux Storage, Filesystem, and Memory-Management Summit will be held April 23-25 in Park City, Utah. The call for proposals has just gone out with a tight deadline: they need to be received by January 31.

Red Hat and Fedora

Filed under
Red Hat

Security: Updates, Secure Contexts, RubyMiner, ZAP, Transmission, AMD

Filed under
Security
  • Security updates for Monday
  • Secure Contexts Everywhere

    Since Let’s Encrypt launched, the Secure Contexts specification has become much more mature. We have witnessed the successful restriction of existing, as well as new features to secure contexts. The W3C TAG is about to drastically raise the bar to ship features on insecure contexts. All the building blocks are now in place to quicken the adoption of HTTPS and secure contexts, and follow through on our intent to deprecate non-secure HTTP.

  • Linux and Windows Servers Targeted with RubyMiner Malware

    Security researchers have spotted a new strain of malware being deployed online. Named RubyMiner, this malware is a cryptocurrency miner spotted going after outdated web servers.

    According to research published by Check Point and Certego, and information received by Bleeping Computer from Ixia, attacks started on January 9-10, last week.

  • Virtual currency miners target web servers with malware
  • ZAP provides automated security tests in continuous integration pipelines

    Commonly, a mixture of open source and expensive proprietary tools are shoehorned into a pipeline to perform tests on nightly as well as ad hoc builds. However, anyone who has used such tests soon realizes that the maturity of a smaller number of time-honored tests is sometimes much more valuable than the extra detail you get by shoehorning too many tests into the pipe then waiting three hours for a nightly build to complete. The maturity of your battle-hardened tests is key.

  • BitTorrent users beware: Flaw lets hackers control your computer

    There's a critical weakness in the widely used Transmission BitTorrent app that allows websites to execute malicious code on some users' computers. That's according to a researcher with Google's Project Zero vulnerability reporting team, who also warns that other BitTorrent clients are likely similarly susceptible.

    [...]

    Among the things an attacker can do is change the Torrent download directory to the user's home directory. The attacker could then command Transmission to download a Torrent called ".bashrc" which would automatically be executed the next time the user opened a bash shell. Attackers could also remotely reconfigure Transmission to run any command of their choosing after a download has completed. Ormandy said the exploit is of "relatively low complexity, which is why I'm eager to make sure everyone is patched."

  • AMD Releases Linux and Windows Patches for Two Variants of Spectre Vulnerability

    AMD has published a press announcement on Thursday to inform its customers that it released patches for two variants of the Spectre security vulnerability disclosed to the public earlier this month.

  • 'Shift Left': Codifying Intuition into Secure DevOps

    Continuous delivery (CD) is becoming the cornerstone of modern software development, enabling organizations to ship — in small increments — new features and functionality to customers faster to meet market demands. CD is achieved by applying DevOps practices and principles (continuous integration and continuous deployment) from development to operations. There is no continuous delivery without implementing DevOps practices and principles. By that, I mean strong communication and collaboration across teams, and automation across testing, build, and deployment pipelines. But often achieving continuous delivery to meet market demands presents numerous challenges for security.

Applications: GIMP, Partclone, Samba, Tidal

Filed under
Software
  • 6 Cheap Alternatives to Adobe Photoshop

    Adobe Photoshop is easily the industry standard when it comes to graphic and photo editing. We don’t just edit a photo these days, but we ‘photoshop’ it—but ‘shopping things with the real deal isn’t cheap.

    Working on a subscription plan basis, it’ll cost you from $9.99 a month, depending on the package you select. Crucially, you’re renting the product—you’ll never actually own a Photoshop license.

    [...]

    For many years, GIMP has been touted as the ideal free alternative to Photoshop. There’s a good reason for that—it offers very similar functionality to Adobe’s behemoth.

    Providing many professional level features, it includes layers, customizable brushes, filters, and automatic image enhancement tools for those short on time. It further expands its potential through a huge number of plugins, thanks to its very active community. Effectively, it’s in constant development. New features are commonplace, while bugs are few and far between.

    The downside? There’s no native support for RAW files—a key component in photo editing—you have to install an additional plugin straight away for such functionality. Also, GIMP’s highly customizable interface can be intimidating for novice users. While Photoshop is instantly accessible, GIMP requires a little tweaking and manipulation to get things how you like them to look, although recent updates have made it look more like its main competition.

    It’s worth sticking with, of course, given it’s entirely free to use, but for the novice user, it might take a little time to gel.

  • Partclone – A Versatile Free Software for Partition Imaging and Cloning

    Partclone is a free and open-source tool for creating and cloning partition images brought to you by the developers of Clonezilla. In fact, Partclone is one of the tools that Clonezilla is based on.

    It provides users with the tools required to backup and restores used partition blocks along with high compatibility with several file systems thanks to its ability to use existing libraries like e2fslibs to read and write partitions e.g. ext2.

  • Samba 4.8 RC1 Released, Samba 4.9 In Development On Git

    The first release candidate of Samba 4.8 is now available for this popular open-source project implementing the SMB/CIFS protocols.

  • Listen to Tidal Music from the Command Line

    Tidal subscribers have a new way to listen to the high-fidelity music streaming service while using the Linux desktop. The Spotify rival touts better sound quality and bigger royalty cheques for artists, but it doesn’t provide a desktop Tidal music app for Linux.

Security: Patching of GNU/Linux Distros

Filed under
GNU
Linux
Security

16-Way GPU Comparison With NVIDIA GPUs Going Back To Kepler

Filed under
Graphics/Benchmarks

Last week I provided a fresh look at the NVIDIA GeForce vs. AMD Radeon Linux gaming performance using the latest drivers at the start of 2018. That testing included the latest NVIDIA and AMD GPUs, but for those curious how these numbers compare for older NVIDIA GPUs, here's a look with the Kepler and Maxwell graphics cards added to the comparison.

Read more

Ubuntu 18.04 LTS Wallpaper Contest Welcomes Talented Photographers and Artists

Filed under
Ubuntu

Announced today by Ubuntu member Nathan Haines, Ubuntu Free Culture Showcase for Ubuntu 18.04 LTS is now officially open for submissions, and since Ubuntu 18.04 it's an LTS (Long-Term Support) version, which Canonical will support for the next five years with software and security updates, it's more than a wallpaper contest.

Well, of course, it's not a contest, because you won't win any prize besides the fact that your work will be showcased to millions of Ubuntu users worldwide. This time, besides wallpapers, Ubuntu Free Culture Showcase also looks for new video and music files that will be available in the Examples folder of Ubuntu 18.04 LTS' live installation medium.

Read more

KDE Plasma 5.12 LTS Enters Beta, Brings Unified Look and Phone Integration

Filed under
KDE

Designed as the next long-term support (LTS) version of the popular desktop environment, replacing the KDE Plasma 5.8 LTS on users' computers when it will be out early next month, KDE Plasma 5.12 is an important milestone that introduces numerous stability and reliability improvements, along with a bunch of new and long-anticipated features.

One of the most important changes in KDE Plasma 5.12 LTS is the greatly improved support for the next-generation Wayland display server, with a long-term support promise as the KDE Project will continue to patch bugs and other issues until the end of life of the desktop environment next year.

Read more

Also: KDE Plasma 5.12 Reaches Beta With Faster Start-Up Time, Better Wayland Support

How To Create Or Increase Swap Space In Linux

Filed under
Linux

The operating system makes use of swap space when its available physical memory (RAM) is running out due to ever demanding applications. In this situation, the operating system moves the inactive pages in physical memory to swap space.

Read<br />
more

Flatpak Support Getting More Mature in KDE Plasma's Discover Package Manager

Filed under
KDE

Those interesting in installing Flatpak universal Linux apps on their KDE Plasma-based GNU/Linux distros, should know that Flatpak support in the Plasma Discover package manager is now more mature and ready for production. It can handle multiple Flatpak repos, as well as installing of packages from the Flathub repository.

With the upcoming KDE Plasma 5.12 LTS desktop environment, Plasma Discover will support different backends, including Flatpak and Snappy, allowing users to search, download and install Flatpak and Snap apps. However, such a backend doesn't come installed by default, so you'll have to add it manually.

Read more

KDE Frameworks 5.42 Open-Source Software Suite Released for KDE Plasma 5.12 LTS

Filed under
KDE
OSS

KDE Frameworks 5.42.0 is out now just in time for the soon-to-be-released KDE Plasma 5.12 LTS Beta desktop environment, and includes numerous improvements and bug fixes for various components like Baloo, Breeze icons, KActivities, KCoreAddons, KDeclarative, KDED, KDBusAddons, KConfig, KDocTools, KHTML, KEmoticons, KFileMetaData, KI18n, KIO, KInit, Kirigami, and KJobWidgets.

It also improves things like KNewStuff, KNotification, KRunner, KWayland, KTextEditor, KWallet Framework, KWidgetsAddons, KXMLGUI, NetworkManagerQt, Plasma Framework, Prison, QQC2StyleBridge, Sonnet, syntax highlighting, KPackage Framework, as well as KDELibs 4 support and extra CMake modules. The complete changelog is available below for more details on the new fixes.

Read more

Syndicate content

More in Tux Machines

Security: OpenSSL, IoT, and LWN Coverage of 'Intelpocalypse'

  • Another Face to Face: Email Changes and Crypto Policy
    The OpenSSL OMC met last month for a two-day face-to-face meeting in London, and like previous F2F meetings, most of the team was present and we addressed a great many issues. This blog posts talks about some of them, and most of the others will get their own blog posts, or notices, later. Red Hat graciously hosted us for the two days, and both Red Hat and Cryptsoft covered the costs of their employees who attended. One of the overall threads of the meeting was about increasing the transparency of the project. By default, everything should be done in public. We decided to try some major changes to email and such.
  • Some Basic Rules for Securing Your IoT Stuff

    Throughout 2016 and 2017, attacks from massive botnets made up entirely of hacked [sic] IoT devices had many experts warning of a dire outlook for Internet security. But the future of IoT doesn’t have to be so bleak. Here’s a primer on minimizing the chances that your IoT things become a security liability for you or for the Internet at large.

  • A look at the handling of Meltdown and Spectre
    The Meltdown/Spectre debacle has, deservedly, reached the mainstream press and, likely, most of the public that has even a remote interest in computers and security. It only took a day or so from the accelerated disclosure date of January 3—it was originally scheduled for January 9—before the bugs were making big headlines. But Spectre has been known for at least six months and Meltdown for nearly as long—at least to some in the industry. Others that were affected were completely blindsided by the announcements and have joined the scramble to mitigate these hardware bugs before they bite users. Whatever else can be said about Meltdown and Spectre, the handling (or, in truth, mishandling) of this whole incident has been a horrific failure. For those just tuning in, Meltdown and Spectre are two types of hardware bugs that affect most modern CPUs. They allow attackers to cause the CPU to do speculative execution of code, while timing memory accesses to deduce what has or has not been cached, to disclose the contents of memory. These disclosures can span various security boundaries such as between user space and the kernel or between guest operating systems running in virtual machines. For more information, see the LWN article on the flaws and the blog post by Raspberry Pi founder Eben Upton that well describes modern CPU architectures and speculative execution to explain why the Raspberry Pi is not affected.
  • Addressing Meltdown and Spectre in the kernel
    When the Meltdown and Spectre vulnerabilities were disclosed on January 3, attention quickly turned to mitigations. There was already a clear defense against Meltdown in the form of kernel page-table isolation (KPTI), but the defenses against the two Spectre variants had not been developed in public and still do not exist in the mainline kernel. Initial versions of proposed defenses have now been disclosed. The resulting picture shows what has been done to fend off Spectre-based attacks in the near future, but the situation remains chaotic, to put it lightly. First, a couple of notes with regard to Meltdown. KPTI has been merged for the 4.15 release, followed by a steady trickle of fixes that is undoubtedly not yet finished. The X86_BUG_CPU_INSECURE processor bit is being renamed to X86_BUG_CPU_MELTDOWN now that the details are public; there will be bug flags for the other two variants added in the near future. 4.9.75 and 4.4.110 have been released with their own KPTI variants. The older kernels do not have mainline KPTI, though; instead, they have a backport of the older KAISER patches that more closely matches what distributors shipped. Those backports have not fully stabilized yet either. KPTI patches for ARM are circulating, but have not yet been merged.
  • Is it time for open processors?
    The disclosure of the Meltdown and Spectre vulnerabilities has brought a new level of attention to the security bugs that can lurk at the hardware level. Massive amounts of work have gone into improving the (still poor) security of our software, but all of that is in vain if the hardware gives away the game. The CPUs that we run in our systems are highly proprietary and have been shown to contain unpleasant surprises (the Intel management engine, for example). It is thus natural to wonder whether it is time to make a move to open-source hardware, much like we have done with our software. Such a move may well be possible, and it would certainly offer some benefits, but it would be no panacea. Given the complexity of modern CPUs and the fierceness of the market in which they are sold, it might be surprising to think that they could be developed in an open manner. But there are serious initiatives working in this area; the idea of an open CPU design is not pure fantasy. A quick look around turns up several efforts; the following list is necessarily incomplete.
  • Notes from the Intelpocalypse
    Rumors of an undisclosed CPU security issue have been circulating since before LWN first covered the kernel page-table isolation patch set in November 2017. Now, finally, the information is out — and the problem is even worse than had been expected. Read on for a summary of these issues and what has to be done to respond to them in the kernel. All three disclosed vulnerabilities take advantage of the CPU's speculative execution mechanism. In a simple view, a CPU is a deterministic machine executing a set of instructions in sequence in a predictable manner. Real-world CPUs are more complex, and that complexity has opened the door to some unpleasant attacks. A CPU is typically working on the execution of multiple instructions at once, for performance reasons. Executing instructions in parallel allows the processor to keep more of its subunits busy at once, which speeds things up. But parallel execution is also driven by the slowness of access to main memory. A cache miss requiring a fetch from RAM can stall the execution of an instruction for hundreds of processor cycles, with a clear impact on performance. To minimize the amount of time it spends waiting for data, the CPU will, to the extent it can, execute instructions after the stalled one, essentially reordering the code in the program. That reordering is often invisible, but it occasionally leads to the sort of fun that caused Documentation/memory-barriers.txt to be written.

US Sanctions Against Chinese Android Phones, LWN Report on Eelo

  • A new bill would ban the US government from using Huawei and ZTE phones
    US lawmakers have long worried about the security risks posed the alleged ties between Chinese companies Huawei and ZTE and the country’s government. To that end, Texas Representative Mike Conaway introduced a bill last week called Defending U.S. Government Communications Act, which aims to ban US government agencies from using phones and equipment from the companies. Conaway’s bill would prohibit the US government from purchasing and using “telecommunications equipment and/or services,” from Huawei and ZTE. In a statement on his site, he says that technology coming from the country poses a threat to national security, and that use of this equipment “would be inviting Chinese surveillance into all aspects of our lives,” and cites US Intelligence and counterintelligence officials who say that Huawei has shared information with state leaders, and that the its business in the US is growing, representing a further security risk.
  • U.S. lawmakers urge AT&T to cut commercial ties with Huawei - sources
    U.S. lawmakers are urging AT&T Inc, the No. 2 wireless carrier, to cut commercial ties to Chinese phone maker Huawei Technologies Co Ltd and oppose plans by telecom operator China Mobile Ltd to enter the U.S. market because of national security concerns, two congressional aides said. The warning comes after the administration of U.S. President Donald Trump took a harder line on policies initiated by his predecessor Barack Obama on issues ranging from Beijing’s role in restraining North Korea to Chinese efforts to acquire U.S. strategic industries. Earlier this month, AT&T was forced to scrap a plan to offer its customers Huawei [HWT.UL] handsets after some members of Congress lobbied against the idea with federal regulators, sources told Reuters.
  • Eelo seeks to make a privacy-focused phone
    A focus on privacy is a key feature being touted by a number of different projects these days—from KDE to Tails to Nextcloud. One of the biggest privacy leaks for most people is their phone, so it is no surprise that there are projects looking to address that as well. A new entrant in that category is eelo, which is a non-profit project aimed at producing not only a phone, but also a suite of web services. All of that could potentially replace the Google or Apple mothership, which tend to collect as much personal data as possible.

today's howtos

Mozilla: Resource Hogs, Privacy Month, Firefox Census, These Weeks in Firefox

  • Firefox Quantum Eats RAM Like Chrome
    For a long time, Mozilla’s Firefox has been my web browser of choice. I have always preferred it to using Google’s Chrome, because of its simplicity and reasonable system resource (especially RAM) usage. On many Linux distributions such as Ubuntu, Linux Mint and many others, Firefox even comes installed by default. Recently, Mozilla released a new, powerful and faster version of Firefox called Quantum. And according to the developers, it’s new with a “powerful engine that’s built for rapid-fire performance, better, faster page loading that uses less computer memory.”
  • Mozilla Communities Speaker Series #PrivacyMonth
    As a part of the Privacy Month initiative, Mozilla volunteers are hosting a couple of speaker series webinars on Privacy, Security and related topics. The webinars will see renowned speakers talking to us about their work around privacy, how to take control of your digital self, some privacy-security tips and much more.
  • “Ewoks or Porgs?” and Other Important Questions
    You ever go to a party where you decide to ask people REAL questions about themselves, rather than just boring chit chat? Us, too! That’s why we’ve included questions that really hone in on the important stuff in our 2nd Annual Firefox Census.
  • These Weeks in Firefox: Issue 30