Language Selection

English French German Italian Portuguese Spanish

About Tux Machines

Monday, 29 Nov 21 - Tux Machines is a community-driven public service/news site which has been around for over a decade and a half and primarily focuses on GNU/LinuxSubscribe now Syndicate content

Search This Site

Quick Roundup

Bootlin contributions to Linux 5.14 and 5.15

Filed under
Linux

It’s been a while we haven’t posted about Bootlin contributions to the Linux kernel, and in fact missed both the Linux 5.14 and Linux 5.15 releases, which we will cover in this blog post.

Linux 5.14 was released on August 29, 2021. The usual KernelNewbies.org page and the LWN articles on the merge window (part 1 and part 2) provide the best summaries of the new features and hardware support offered by this release.

Read more

CaribouLite RPi HAT open-source SDR Raspberry Pi HAT tunes up to 6 GHz (Crowdfunding)

Filed under
Linux
Hardware

CaribouLite RPi HAT is an open-source dual-channel software-defined radio (SDR) Raspberry Pi HAT – or rather uHAT – that works in the sub-GHz ISM range and optionally the 30 MHz – 6 GHz range for the full version.

Developed by Israel-based CaribouLabs, the micro HAT is equipped with a Lattice Semi ICE40LP1K FPGA, a Microchip AT86RF215 RF transceiver, two SMA antenna connectors, a Pmod expansion connector, and designed for any Raspberry Pi board with a 40-pin GPIO header.

Read more

Best Free and Open Source Alternatives to Apple Photos

Filed under
Software

In 2020, Apple began the Apple silicon transition, using self-designed, 64-bit ARM-based Apple M1 processors on new Mac computers. Maybe it’s the perfect time to move away from the proprietary world of Apple, and embrace the open source Linux scene.

Apple Photos is a photo management and editing application. It lets you organize your collection into albums, or keep your photos organized automatically with smart albums.

What are the best free and open source alternatives?

Read more

Top 15 Window Managers for Linux

Filed under
Software

A window manager is a software responsible for the placement and appearance of windows of various applications. It allows you to use any number of displays and utilize the screen to its full potential. The advantage is that it increases your productivity and improves your multitasking experience. But what exactly can one do with a window manager?

The article describes some of the best floating and tiling window managers available for Linux.

Read more

Endless OS Review - Desktop Linux Done Right for the Masses

Filed under
Linux
Reviews

We review the popular Endless OS as Linux Desktop with the new features and updates of the latest version 4.0.
Read more

today's howtos

Filed under
HowTos
  • How to Install PostgreSQL 14 in Ubuntu 20.04

    There are specific database software attributes that make PostgreSQL stand out against other database platforms. The first and obvious attribute is its open-source nature.

    This PostgreSQL trait puts it on continuous developmental milestones. Both its community and developers seek to evolve PostgreSQL into an enterprise-class performing software.

    Existing PostgreSQL community platforms help users deal with emerging bugs, and also understand its various functionalities and use cases.

    Other PostgreSQL strengths are in its unique functions like Store Procedure, Diverse Indexing Techniques, Flexible Full-text search, Diversified Extension Functions, and Diverse kind of Replication.

  • How to upload an ISO image to the Proxmox Server - Unixcop the Unix / Linux the admins deams

    Hello, friends. We have already shown you how to install Proxmox and we noticed that the process is easier than you might think. Now I will show you how to upload an ISO image to the Proxmox server. To do this, I will use the graphical method or through the terminal.

    With Proxmox we will be able to virtualize systems professionally and to do many things more like cluster, backups, and others. However, to start with the virtualization we have to have an ISO image of the system.

    So, with a server that is far away from our location, how to do it? How to have the ISO image on the server so that Proxmox can manage it? Well, that’s what I will show you today.

    Let’s go for it.

  • How to install FreeOffice 2021 on Ubuntu 20.04 Linux - Linux Shout

    One of the best free alternatives to Microsoft Office is FreeOffice, developed by a German software company- SoftMaker. Recently, they have upgraded their Office suite to version 21. And here we learn the steps to install FreeOffice 2021 version on Ubuntu 20.04 Linux using the command terminal.

    This free office suite is a part of the commercial one from the same developers known as SoftMaker Office 21 (also available for Linux), of course, the premium will have more features but that doesn’t mean the free version- FreeOffice 2021 deprives to full fill all daily office documents (MS-Word alternative) related requirements. It offers a Microsoft office ribbon-like interface and three modules- TextMaker 21 to create documents; PlanMaker 21 to create sheets (Excel alternative) and Presentations 21 for making slides like MS-Powerpoint.

  • How to verify checksum on Linux | FOSS Linux

    A checksum is small-sized data obtained from a block of digital data used to detect errors. The checksum value uses a transmission message to represent bit numbers. Extensively, it has been used and still is in use by IT experts to detect high-level errors that might happen during data transmission. Before transmission, every bit of data is assigned a checksum value after running a cryptographic hash function.

    Checksum sometimes is termed as a hash sum or hash value. It is a long data string that contains various numbers and letters. They work by providing the receiving end information about the data transmission to deliver the full range of data. Checksum acts as a fingerprint for files since it contains a long string of numbers and letters. It aids in obtaining the number of bits included in a transmission.

    Suppose the checksum value calculated by the end-user is slightly different from the original checksum value of the file. In that case, it alerts all parties involved in the transmission that a third party corrupted the file. The receiver can then investigate what went wrong or try re-downloading the file. Standard protocols used to determine checksum numbers are the transmission control protocol (TCP) and the user diagram protocol (UDP). TCP is more reliable for tracking transmitted packets of data, but UDP may be beneficial to avoid slowing down transmission time.

  • How to create and extract cpio archives on Linux Examples

    Although the cpio archiving utility is nowadays used less than other archiving tools like tar, it is still good to know how it works, since it is still used, for example, to create initramfs images on Linux and for rpm packages, which are used mainly in the Red Hat family of distributions. In this tutorial we see how to create and extract cpio archives using the GNU cpio utility, and how to obtain a list of the files they contain.

  • How to hash passwords on Linux

    Passwords should never be stored as plain text. Whether we are talking about a web application or an operating system, they should always be in hash form (on Linux, for example, hashed passwords are stored in the /etc/shadow file). Hashing is the process through which, by the use of some complex algorithms, a password is turned into a different string. Such process is one-way: there is no way to revert an hashed password to its original, plain text form. Hashing often involves the use of random data as additional input for the hash algorithm, so that the same password, hashed two times, doesn’t produce the same result. This random data is called salt. In this tutorial we explore some methods we can use to hash passwords on Linux.

  • A Decade with Jekyll

    Today I’d like to look back on my experience with Jekyll, the static site generator (SSG) that I’m using to publish this site and my other blogs Meta Redux and Emacs Redux. Back in the day Jekyll was a trend-setter - it basically defined the SSG category and every subsequent tool in it was compared to Jekyll. A lot has happened since 2011: [...]

  • ZFS Storage pool layout: VDEVs

    The storage pool of ZFS constitutes one or more virtual devices that are, in general, called vdevs. A Vdev is either a single disk, or two or more disks which mirrors each other, or a group of disks that organizes together. The RAID layout sets on each vdev as opposed to the storage pool. Similarly, data that is present in the storage pool strips across all vdevs which also means that the loss of one vdev would result in pool failure.

  • [Old] The Basic Guide to Working with ZFS

    RAID-Z1 replaces RAID5 in a traditional setup. Performance is pretty equivalent, but the benefit is in some of the features. As mentioned before, you get healing or at least detection of bit rot or a bad sector, it’s a lot easier to set up with mixed drives, etc. RAID-Z2 (equivalent to RAID6) performs better from my experience than any traditional RAID6 setup I’ve used with equivalent drives on an equivalent machine.

9to5Linux Weekly Roundup: November 28th, 2021

Filed under
Linux
News

This week has been full of great releases, despite the fact that it was Thanksgiving week in the US. We managed to test drive the MX Linux 21 AHS edition, new Deepin Linux, Alpine Linux, Endless OS, IPFire, and Clonezilla Live versions, as well as to update our VirtualBox, LibreOffice, Tux Paint, and Proton installs.

On top of that, this week brought us a new Linux laptop from TUXEDO Computers targeted at business users. You can enjoy these and much more in 9to5Linux’s Linux weekly roundup for November 28th, 2021, below! Don’t forget to also check out our YouTube channel for the latest reviews.

Read more

Why We Can't Teach Cybersecurity

Filed under
Linux

By Dr. Andy Farnell

I teach cybersecurity. It's something I really believe in, but it's hard work for all the wrong reasons. First day homework for students is watching Brazil, No Country for Old Men, Chinatown, The Empire Strikes Back, or any other film where evil triumphs and the bad guys win. This establishes the right mindset - like the medics at the Omaha beach landing in Saving Private Ryan. Not to be pessimistic, but cybersecurity is a lost cause, at least as things stand today. If we define computer security to be the combination of confidentiality, integrity, and availability for data, and as resilience, reliability and safety for systems, then we are failing terribly on all points.

As a "proof" after a fashion, my students use a combination of Blotto analysis from military game theory, and Lubarsky's law ("there's always one more bug"). It is a dispiriting exercise to see how logic stacks up against the defenders, according to which "the terrorists always win". Fortunately, game theory frequently fails to explain a reality where we are not all psychopathically selfish Bayesian utility maximisers (unlike corporations which are programmed to be). Occasionally hope, compassion, gratitude, and neighbourly love win out.

Could things be worse than having mathematics against you? Actually yes. You could live in a duplicitous culture antithetical to security but favouring a profitable facsimile of it. Perhaps that's a means for obsolete power hierarchies to preserve themselves, or because we don't really understand what "security" is yet. Regardless, that's the culture we have, and it's a more serious problem than you might think, much more so than software complexity or the simple greed of criminals.

My optimism is that if we can face up to facts, we can start to change and progress. It is in the nature of teachers, doctors and drill instructors that we must believe people can change. So I'll try to explore here how this mess happened, how Linux, BSD and free open source software with transparent standards are a plausible even necessary way out of the present computer security crisis, and why the cybersecurity courses at most universities are not helping.

We have to keep faith that complexity, bad language design and reckless software engineering practices are surmountable by smart people. Maybe one day we'll build computers that are 99.9% secure. But that is unlikely to happen for reasons recently explained by Edward Snowden, who describes an Insecurity Industry. Indeed, I was a little disappointed by Snowden's essay which does not go nearly far enough in my opinion.

For me, the Insecurity Industry is not located in a few commercial black-hat operations like Israel's NSO Group, but within the attitudes and practices running through every vein of mainstream computing. As with its leaders, a society gets the technology it deserves. As we revel in cheap imported goods, surveillance capitalism, greed, convenience, manipulation, and disempowerment of users, we reap the security we deserve.

Blaming the cyber-arms trade, the NSO or NSA for answering the demands of cops and criminals alike, is distracting. Without doubt what they are doing is wrong and harmful to everyone, but we can't have secure computing while those who want it are an educated minority. That situation will not change so long as powerful and fundamentally untrustworthy corporations with business models founded on ignorance dominate our digital lives.

Projects of digital literacy started in the nineteen eighties. They kick-started Western tech economies, but faltered in the mid nineties. Programming and "computer studies" which attempted to explain technological tools were replaced by training in Microsoft Word and Excel spreadsheets. Innovation tailed-off. A generation taught to be dependent on tech, not masters of it, are fit only for what David Graeber described as Bullshit Jobs Graeber18.

Into this vacuum rushed "Silicon Valley values" of rent seeking, piggybacking upon established standards and protocols. With a bit of spit, polish, and aggressive marketing, old lamps could be foisted upon consumers. Twenty years later we have a culture of depressed, addicted, but disenfranchised technology users Lanier11.

We have moved from "It's more fun to compute" to "If you've nothing to fear you've nothing to hide". In other words, we've transformed digital technology from a personally empowering choice into systems of near-mandatory social command and control (see Neil Postman's Technopoly postman93). What advantage would any group have in securing their own chains and the weapons ranged against them? A sentiment only half-disguised in young people today is utter ambivalence toward tech.

As states move to reclaim control from social media platforms, public debate has been framed around whether Facebook and suchlike are threats to democracy and ought to be regulated. But this is merely a fragment of a larger problem and of a discussion that has never been properly widened to examine the general dangers of information technology in all its manifest forms, in the hands of governments, businesses, rogue groups and individuals alike.

For me, an elephant in the room is the colossal distance between what we teach and what we practice. Twice convicted monopolists Microsoft set back computing by decades, and in particular their impact on security has been devastating. Yet their substandard wares are still pushed into schools, hospitals and safety-critical transport roles. Even as embarrassing new holes in their products are exposed daily, lobbying and aggressive misinformation from Microsoft and other Big-Tech companies, all of which suffer from appalling privacy and security faults, continues unabated.

Big-tech corporations are insinuating themselves into our public education and health systems without any proper discussion around their place. It is left to well educated individuals to opt-out, reject their systems, and insist on secure, interoperable choices. Advisories like the European Interoperability Framework (EIF is part of Communication COM134 of the European Commission March 2017) recognise that tech is set to become a socially divisive equality issue. The technical poverty of the future will not separate into "haves and have-nots", but "will and the will-nots", those who will trade their privacy and freedom for access and those who eschew convenience for digital dignity.

As the word "infrastructure" (really vertical superstructure) has slyly replaced ICT (a horizontal service) battles have raged between tech monopolies and champions of open standards for control of government, education and health. The idea of public code (see the commentary of David A Wheeler and Richard Stallman) as the foundation of an interoperable technological society, has been vigorously attacked by tech giants. Germany fought Microsoft tooth and nail to replace Windows systems with 20,000 Linux PCs in 2015, only to have Microsoft lobby their way back in, replacing 30,000 desktops with Windows 10 in 2017. Now the Germans seem poised to switch again, this time taking back all public services by mandating support for LibreOffice.

In the UK, several institutions at which I teach are 'Microsoft customers'. I pause to use the term "Microsoft Universities", but they may as well be. Entirely in the pocket of a single corporation, all email, storage networks, and "Teams" communication are supplied by the giant. Due to de-skilling of the sector, the ICT staff, while nice enough people, lack advanced IT skills. They can use off-the-shelf corporate tools, but anything outside lockstep conformity allowed by check-box webmin interfaces is both terrifying and "not supported". I met a secondary school headmaster who seemed proud to tell me that they were not in the pockets of Microsoft, because they had "become a Google Academy". I responded that "as a Linux child", my daughter woudn't be using any of that rubbish either.

Here's a problem; I don't use Microsoft or Google products. At one level it's an ethical decision, not to enrich aggressive bullies who won't pay proper taxes in my country. It's also a well informed technical position based on my knowledge of computer security. For me to teach Microsoft to cybersecurity students would bring professional disgrace. I won't be the first or last person to lose work for putting professional integrity first. They say "Nobody ever got fired for choosing Microsoft". At some institutions that is not merely advice, it's a threat. Security in the shadow of Big-Tech now means job-security, as in the iron rice bowl from which the compliant may feed, but educated independent thinkers must abstain.

A more serious problem is not just that companies like Google and Microsoft are an expensive, controlling foreign corporations supplying buggy software, or that university administrators have given away control of our networks and systems, it's that commercial products are increasingly incompatible with teaching and research. They inject inbuilt censorship and ideological micromanagement into academies and schools.

Another is that "choice" is something of an illusion. Whatever the appearance of competition between, say, Apple and Facebook, Big-Tech companies collude to maintain interlocking systems of controls that enforce each others shared values including sabotage of interoperability, security and inviting regulation upon themselves to better keep down smaller competitors. Big-Tech comes with its own value system that it imposes on our culture. It restricts the learning opportunities of our kids, limits workplace innovation and diversity, and intrudes into our private activities of commerce and health.

In such a hostile environment for teaching cybersecurity (which is to teach empowering knowledge, and why we call it "Ethical Hacking" 1) one may employ two possible methods. First, we can buy in teaching packages reliant entirely on off-site resources. These are the "official" versions of what computer security is. Two commonly available versions come from Cisco and the EC Council. Though slickly presented these resources suffer the same problems as textbooks in fast-changing disciplines. They very quickly go out of date. They only cover elementary material of the "Cyber Essentials" flavour, which ultimately is more about assurance than reality. And they are partial, perhaps even parochial versions of the subject arrived at by committee.

Online courses also suffer link-rot and patchy VM service that breaks lessons. Unlike in-house setups, professors or students cannot debug or change the system, itself an important opportunity for learning. Besides, the track record of Cisco with respect to backdoors no longer inspires much confidence.

The other method is to create "suitcase data-centres". A box of Raspberry Pi single board computers saves the day! The Raspberry Pi Foundation, perhaps modelled after the early digital literacy drives of Acorn/BBC has done more for British education than any dozen edu-tech companies by promoting (as much as it can) openness of hardware and GNU/Linux/Unix software.

Junk laptops running Debian (Parrot Linux) and SBCs make a great teaching setup because a tangle of real network cables, wifi antennas and flashing lights helps visualise real hacking scenarios. Professors often have to supply this equipment using our own money. I rescued a pile of 1.2GHz Intel Atom netbooks from the garbage. Because we are not allowed to connect to university networks, 3/4G hotspots are necessary, again using bandwidth paid for out of my own pocket in order to run classes. Teaching cybersecurity feels like a "forbidden" activity that we sneakily have to do despite, not because of, university support.

Teaching cybersecurity reflects a cultural battle going on right inside our classrooms. It is a battle between two version of a technological society, two different futures. One an empowering vision of technology, the other a dystopian trap of managed dependency. Dan Geer, speaking in 2014 described cybersecurity as a manifestation of Realpolitik. Nowhere does the issue come so clearly to a head as in the schism between camps of Snowden or Assange supporters and the US State, each of which can legitimately claim the other a "traitor" to some ideal of "security".

At the everyday level there is a tension between what we might call real versus fake security. The latter is a festival of form over function, a circus of phones, apps and gizmos where appearance triumphs over reality. It's a racket of productised solutionism, assurance, certification and compliance that's fast supplanting actual security efforts. By contrast, the former is a quiet anathema to "security industry" razzle. It urges thoughtful, modest simplicity, slow and cautious change. It's about what you don't do.

So, in our second lesson we analyse the word "security" itself. Security is both a reality and a feeling. There are perhaps masculine and feminine flavours of security, one following a military metaphor of perimeters, penetration and targets, the other, as Eve Ensler Ensler06 and Brene Brown Brown12 allude, an inner security that includes the right to be insecure and be free from patrician security impositions "for your own good". Finally, there is the uncomfortable truth that security is often a zero-sum affair - your security means my insecurity. While "good" security is a tide that raises all ships, some people misuse security as a euphemism for wielding power.

None of these social and psychological realities fit well into the lacklustre, two dimensional models of textbook computer security. Fortunately a mature discipline of Security Engineering which does not dodge social and political factors has emerged in the UK. Ross Anderson Anderson08 is part of a team leading such work at the Cambridge Cybercrime Centre. One take-away from lesson two is that the word "security" may not be used as a bare, abstract noun. One must ask; security for who? Security from who or what? Security to what end?

Once we begin to examine the deeper issues around device ownership, implied (but infirm) trust models, forced updates, security theatre, and conflicting cyber-laws, we see that in every important respect tech is anarchy. It's a de facto "might is right" free-for-all where much of what passes for "security" for our smartphones, online banking and personal information is "ignorant bullshit" (in the strict academic sense of bullshit according to Harry Frankfurt; that vendors and politicians don't know that they do not know what they are talking about - and care even less Frankfurt05).

Consequently, much of what we teach; the canonical script of "recon, fingerprinting, vulnerability analysis, vector and payload, clean-up, pivoting, escalation, keeping root…", and the corresponding canon of blue team defence (backup, intrusion detection, defence in depth, etc…) - has no context or connection to a bigger picture. It is ephemeral pop that will evaporate as technology changes leaving students with no deeper understanding of what we are trying to do by testing, protecting and repairing systems and data, or why that even matters.

We create more guards for the castles of tech-feudalism - obedient, unthinking security guards employed to carry out the whims of the management class. Leveraged by the unspoken carrot of preferential technical privilege and enforced by the stick of threatened removal of their "security status", they become administrators of new forms of political force. Challenges to grey-area behaviours beyond the legal remit of managers, are proclaimed "security breaches" unless pursued through intractable administrative routes or through appeals that can be deflected with allusions to "policy" or the abstract "security" of unseen authorities. Some of our smartest people are ultimately paid well to shut up and never to think for themselves.

There is a very serious concern that our "Ethical Hacking" courses (which contain no study of ethics whatsoever) are just creating fresh cyber-criminals. Despite the narrative that "we are desperately short of cybersecurity graduates and there are great jobs for everyone", the reality is that students graduate into an extremely competitive environment where recruitment is often hostile and arbitrary. It doesn't take them long to figure that their newfound skills are valuable elsewhere.

Years ago, it became clear to me that we must switch to a model of "Civic Cyber Security". I became interested in the work of Bruce Schneier not as a cryptographer but as an advocate of Technology In The Public Interest. National security is nothing more than the sum-total of individual earned and learned security. That means teaching children as young as five foundational attitudes that would horrify industry.

There is no room to lie back and hope Apple or Google can protect us. Organisations like the UK's National Cyber Security Centre, or US National Security Agency, which have conflicted remits, might wish to be seen as benevolent guardians. Their output has been likened by comedian Stuart Lee to "Mr Fox's guide to hen-house security". Cybersecurity can never be magically granted by those who have a deep and lasting interest in withholding it.

The business of "personal computing" has become ugly. Cybersecurity, in as much as it exists, is a conflicted and unreliable story we tell ourselves about power and tribal allegiances. We can't put on a "good guys" hat and beat "cyber-criminals" so long as we are competing with them for the same thing, exploitable clueless users.

The only questions are whether they are to be sucked dry by ransomware, "legitimate" advertising, or manipulated for political ends. If we are to engage in sincere, truthful education, then we have to call-out Big-Tech for what it is; more a part of the problem than a solution. Those of us who want to explore and teach must still circumvent, improvise and overcome within institutions that pay only lip service to authentic cybersecurity because they are captured by giant corporations

Bibliography

Bibliography

  • [Graeber18] David Graeber, Bullshit Jobs: A Theory, Simon and Schuster (2018).
  • [Lanier11] Jaron Lanier, You Are Not a Gadget, Vintage (2011).
  • [postman93] Neil Postman, Technopoly: The Surrender of Culture to Technology, Vintage Books. N.Y. (1993).
  • [Ensler06] Ensler, Insecure at last, Villard (2006).
  • [Brown12] Brené Brown, The Power of Vulnerability: Teachings on Authenticity, Connection and Courage, Sounds True (2012).
  • [Anderson08] Ross Anderson, Security Engineering: A Guide to Building Dependable Distributed Systems, Wiley (2008).
  • [Frankfurt05] Harry Frankfurt, On Bullshit, Princeton University Press (2005).

Footnotes:

1 A term made up to attract young students to cybersecurity while assuring parents and politicians.


About the author

Dr. Andy Farnell is a computer scientist, author and visiting professor in signals, systems and cybersecurity at a range of European universities.

His recent book "Digital Vegan" uses a dietary metaphor to examine technology dependency and over-consumption.

toiday's leftovers

Filed under
Misc
  • Linux Weekly Roundup #158

    Welcome to this week's Linux Roundup. It was a full week of Linux releases with Endless OS 4.0.0 and Deepin 20.3.

    We hope that you had a good week and may the be a great one ahead!

  • Putting the Open back into Open Source

    Agility has never been more important than it is in today’s disrupted digital world. Leaders in every industry are trying to find a balance between the stability that allows them to plan for the future, while creating highly agile organisations that can quickly respond to new challenges and opportunities.

    This agility only comes from the ability to innovate at speed, which is why open source communities are as vital as ever. According to SUSE’s recently commissioned Insight Avenue report, Why Today’s IT Leaders are Choosing Open, 84% now see open source as a way to cost-effectively drive this innovation.

  • How To Install Snap on Ubuntu 20.04 LTS - idroot

    In this tutorial, we will show you how to install Snap on Ubuntu 20.04 LTS. For those of you who didn’t know, Snap also known as Snappy is an alternative package management tool and program package format developed by Canonical, the company behind Ubuntu Linux. All the snaps are usually stored in a central repository called Snap Store from where snaps can be downloaded and installed using the snap command. Snaps work across a range of Linux distributions, which makes them a distro-agnostic upstream software deployment solution.

    This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the Snap Package Manager on Ubuntu 20.04 (Focal Fossa). You can follow the same instructions for Ubuntu 18.04, 16.04, and any other Debian-based distribution like Linux Mint.

  • The European Commission To Force Apple To Allow App Sideloading (NASDAQ:AAPL) | Seeking Alpha [Ed: It is NOT called SIDELOADING… it’s called INSTALLING!]

    Investors are ignoring significant regulatory developments for Apple while distracted by Apple Car speculation.

  • Unboxing Busybox: Claroty and JFrog uncovers 14 vulnerabilities

    Embedded devices with limited memory and storage resources are likely to leverage a tool such as BusyBox, which is marketed as the Swiss Army Knife of embedded Linux. BusyBox is a software suite of Unix utilities, known as applets, that are packaged as a single executable file.

    Within BusyBox you can find a full-fledged shell, a DHCP client/server, and small utilities such as cp, ls, grep, and others. You’re also likely to find many OT and IoT devices running BusyBox, including popular programmable logic controllers (PLCs), human-machine interfaces (HMIs), and remote terminal units (RTUs)—many of which now run on Linux.

    As part of our commitment to improving open-source software security, Claroty’s Team82 and JFrog collaborated on a vulnerability research project examining BusyBox. Using static and dynamic techniques, Claroty’s Team82 and JFrog discovered 14 vulnerabilities affecting the latest version of BusyBox.

    In most cases, the expected impact of these issues is denial of service (DoS). However, in rarer cases, these issues can also lead to information leaks and possibly remote code execution.

  • Perl Weekly Challenge 140: Multiplication Tables
  • Leaky Rakudo

    Yesterday the discord-bridge-bot refused to perform its 2nd job: EVAL All The Things! The EVALing is done via shell-out and requires a fair bit of RAM (Rakudo is equally slim then Santa). After about 3 weeks the fairly simple bot had grown from about halve a GB to one and a halve – while mostly waiting for the intertubes to deliver small pieces of text. I complained on IRC and was advised to take heap snapshots. Since I didn’t know how to make heaps of snapshots, I had to take timo’s directions towards use Telemetry. As snap(:heap) wasn’t willing to surrender the filename of the snapshot (I want to compress the file, it is going to get big over time) I had a look at the source. I also requested a change to Rakudo so I don’t have to hunt down the filename, which was fulfilled by lizmat 22 minutes later. Since you may not have a very recent Rakudo, the following snipped might be useful.

  • Nemiver debugger now in devx SFS

    Mike (mikewalsh) responded with a great link that lists lots of Linux debugger/trace tools. The EasyOS devx SFS already has the 'gdb' CLI utility, and I saw on that link, there are 'ddd' and 'nemiver' GUI frontends for gdb.
    I went for nemiver and compiled it. The project seems to be almost dead, but then, if it works, perhaps no need for more commits to the git repository. I chose version 0.8.2, not the latest, but it suited me to stay with a gtk+2 based app rather than gtk+3.
    Two dependencies, 'gtkmm' and 'libgtop', are compiled in OpenEmbedded. I compiled 'libgtksourceviewmm' and 'nemiver' in a running EasyOS and made them into PETs.

Kernel and Graphics: Linux Stuff and GPUs

Filed under
Graphics/Benchmarks
Linux
  • Facebook/Meta Tackling Transparent Page Placement For Tiered-Memory Linux Systems - Phoronix

    Back during the Linux 5.15 cycle Intel contributed an improvement for tiered memory systems where less used memory pages could be demoted to slower tiers of memory storage. But once demoted that kernel infrastructure didn't have a means of promoting those demoted pages back to the faster memory tiers should they become hot again, though now Facebook/Meta engineers have been working on such functionality. 

    Prior to the Linux 5.15 kernel, during the memory reclaim process when the system RAM was under memory pressure was to simply toss out cold pages. However, with Linux 5.15 came the ability to shift those cold pages to any slower memory tiers. In particular, modern and forthcoming servers with Optane DC persistent memory or CXL-enabled memory, etc. Therefore the pages are still accessible if needed but not occupying precious system DRAM if they aren't being used and to avoid just flushing them out or swapping to disk. 

  • Linux 5.17 To Boast Latency Optimization For AF_UNIX Sockets - Phoronix

    Net-next has been queuing a number of enticing performance optimizations ahead of the Linux 5.17 merge window kicking off around the start of the new year. Covered already was a big TCP optimization and a big improvement for csum_partial() that is used in the network code for checksum computation. The latest optimization is improving the AF_UNIX code path for those using AF_UNIX sockets for local inter-process communication. 

    A new patch series was queued up on Friday in net-next for improving the AF_UNIX code. That patch series by Kuniyuki Iwashima of Amazon Japan is ultimately about replacing AF_UNIX sockets' single big lock with per-hash locks. The series replaces the AF_UNIX big lock and also as part of the series has a speed-up to the autobind behavior. 

  • Nvidia Pascal GPU, DX12 and VKD3D: Slideshow time! - Boiling Steam

    So Horizon Zero Dawn had a sale recently on Fanatical, and I thought… OK I’ll grab it! It’s time. I first installed it on my workstation that only has a GTX1060 3GB GPU – not a workhorse but a decent card nonetheless for low-to-medium end gaming. I knew very well that Horizon Zero Dawn is a DX12 game and that Pascal architecture (Nvidia 10xx basically) and earlier versions do not play very well with DX12 games running through vkd3d-proton, the DX12 to Vulkan translation layer.

    Still, I could imagine getting somewhere around 30 FPS on low-to-medium settings, and use FSR if necessary to get to better framerates. Nothing prepared me for the performance I was about to experience.

Linux 5.16-rc3

Filed under
Linux
So rc3 is usually a bit larger than rc2 just because people had some
time to start finding things.

So too this time, although it's not like this is a particularly big
rc3. Possibly partly due to the past week having been Thanksgiving
week here in the US. But the size is well within the normal range, so
if that's a factor, it's not been a big one.

The diff for rc3 is mostly drivers, although part of that is just
because of the removal of a left-over MIPS Netlogic driver which makes
the stats look a bit wonky, and is over a third of the whole diff just
in itself.

If you ignore that part, the statistics look a bit more normal, but
drivers still dominate (network drivers, sound and gpu are the big
ones, but there is noise all over). Other than that there's once again
a fair amount of selftest (mostly networking), along with core
networking, some arch updates - the bulk of it from a single arm64
uaccess patch, although that's mostly because it's all pretty small -
and random other changes.

Full shortlog below.

Please test,

             Linus

Read more

Also: Linux 5.16-rc3 Released With Alder Lake ITMT Fix, Other Driver Fixes - Phoronix

Audiocasts/Shows: Endless OS 4.0.0, GIMP, BSD, KDE, and Elementary

Filed under
GNU
Linux

today's howtos

Filed under
HowTos
  1. How to install FreeOffice 2021 on Ubuntu 20.04 Linux

    One of the best free alternatives to Microsoft Office is FreeOffice, developed by a German software company- SoftMaker. Recently, they have upgraded their Office suite to version 21. And here we learn the steps to install FreeOffice 2021 version on Ubuntu 20.04 Linux using the command terminal.

    This free office suite is a part of the commercial one from the same developers known as SoftMaker Office 21 (also available for Linux), of course, the premium will have more features but that doesn’t mean the free version- FreeOffice 2021 deprives to full fill all daily office documents (MS-Word alternative) related requirements. It offers a Microsoft office ribbon-like interface and three modules- TextMaker 21 to create documents; PlanMaker 21 to create sheets (Excel alternative) and Presentations 21 for making slides like MS-Powerpoint.

  2. Pin Custom Folders to Left Panel ‘Files’ Icon Context Menu in Ubuntu 20.04 | UbuntuHandbook

    In Windows 10, user may right-click on the ‘File Explorer’ icon on panel to access pinned folders (e.g., Desktop, Downloads and Documents) quickly.

    Ubuntu has first implemented this feature in Ubuntu 21.10, though it seems to be not working properly due to bug. Ubuntu 20.04 may manually add the context (right-click) menu options so user can right-click on the ‘Files’ icon to choose open favorite folders quickly.

  3. How To Install Perl on AlmaLinux 8 - idroot

    In this tutorial, we will show you how to install Perl on AlmaLinux 8. For those of you who didn’t know, Perl (Practical Extraction and Reporting Language) is a general-purpose programming language originally developed for text manipulation and now used for a wide range of tasks including system administration, web development, network programming, GUI development, and more. The major features of Perl are easy to use, supports object-oriented and procedural programming languages, and has built-in support for processing text. The most impressive feature of Perl is that it supports a large collection of third-party modules.

    This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the Perl programming language on AlmaLinux 8. You can follow the same instructions for Rocky Linux.

  4. How to play Total War: WARHAMMER on Linux

    Total War: Warhammer is a turn-based real-time tactics video game developed by Creative Assembly and published by Sega. It takes place in the War Hammer 40K universe. Here’s how you can play it on your Linux PC.

  5. How to install Funkin' Vs. Camellia on a Chromebook

    Today we are looking at how to install Funkin' Vs. Camellia on a Chromebook. Please follow the video/audio guide as a tutorial where we explain the process step by step and use the commands below.

Debian GR procedures and timelines

Filed under
Debian

A vote has been proposed in Debian to change the formal procedure in Debian by which General Resolutions (our name for "votes") are proposed. The original proposal is based on a text by Russ Allberry, which changes a number of rules to be less ambiguous and, frankly, less weird.

One thing Russ' proposal does, however, which I am absolutely not in agreement with, is to add a absolutly hard time limit after three weeks. That is, in the proposed procedure, the discussion time will be two weeks initially (unless the Debian Project Leader chooses to reduce it, which they can do by up to one week), and it will be extended if more options are added to the ballot; but after three weeks, no matter where the discussion stands, the discussion period ends and Russ' proposed procedure forces us to go to a vote, unless all proposers of ballot options agree to withdraw their option.

I believe this is a big mistake. I think any procedure we come up with should allow for the possibility that we may end up with a situation where everyone agrees that extending the discussion time a short time is a good idea, without necessarily resetting the whole discussion time to another two weeks (modulo a decision by the DPL).

Read more

PHP 8.1 Benchmarks - Continuing The Nice Performance Trajectory

Filed under
Graphics/Benchmarks

PHP 8.1 released on Thursday as the latest major feature release for this programming language. In this article are some benchmarks of PHP 8.1.0 on an AMD EPYC powered Linux server compared to prior releases going as far back as PHP 5.6.

As previously covered, PHP 8.1 introduces many new language features like PHP "Fibers", enums, read-only class properties, new fsync functions, and much more. PHP 8.1 is another great annual update to this server-side language. But as we've seen over the past number of years since the late PHP 5.x era, the performance has continued improving.

Read more

5 Best Free and Open Source Linux MAC/RBAC Tools

Filed under
Software
OSS

One of the most difficult problems in managing a large network is the complexity of security administration. The deployment of individual security products such as firewalls, intrusion detection systems, network traffic analysis, log file analysis, or antivirus software is never going to provide adequate protection for computers that are connected to the internet. For example, a good network intrusion prevention and detection system (such as Snort) does an exemplary job at detecting attacks within traffic. However, this type of detection does not offer any sort of damage containment. Equally, a firewall offers an outstanding method at defining what type of traffic is allowed in a network, but does not offer any deep protocol analysis.

Read more

Kalendar v0.3.0 out soon, with improved stability, efficiency, accessibility… and a Windows version?? – Kalendar devlog 23

Filed under
KDE

Over the past two weeks, we have been hard at work under the hood of Kalendar. What you can expect from these two weeks’ refactors, additions, and changes is a version of Kalendar that is more stable, faster to use, and easier to use than ever before.

We are excited to have you try Kalendar, and we want your feedback — especially bug reports! These will help us improve Kalendar as much as possible before releasing 1.0.

Read more

Best Free and Open Source Alternatives to Corel Painter

Filed under
Software
OSS

Corel Corporation is a Canadian software company specializing in graphics processing. They are best known for developing CorelDRAW, a vector graphics editor. They are also notable for purchasing and developing AfterShot Pro, PaintShop Pro, Painter, Video Studio, MindManager, and WordPerfect.

Corel has dabbled with Linux over the years. For example they produced Corel Linux, a Debian-based distribution which bundled Corel WordPerfect Office for Linux. While Corel effectively abandoned its Linux business in 2001 they are not completely Linux-phobic. For example, AfterShot Pro has an up to date Linux version albeit its proprietary software.

Read more

SQLite 3.37 Lightweight Database Comes Packed with New Features

Filed under
Software

SQLite 3.37 has just got better with added new features such as CLI enhancements and additional interfaces.

SQLite is is an open source self-contained, lightweight serverless relational database management system. The lite in SQLite means lightweight in terms of setup, database administration, and required resources.

Normally, an RDBMS such as MySQL, PostgreSQL, etc., requires a separate server process to operate, but SQLite does not work this way. It accesses its storage files directly.

SQLite stores its data in a single cross-platform file. As there’s no dedicated server or specialized filesystem, deploying SQLite is as simple as creating a new regular file.

Read more

Syndicate content