• The Problems and Promise of WebAssembly

  WebAssembly is a format that allows code written in assembly-like instructions to be run from JavaScript. It has recently been implemented in all four major browsers. We reviewed each browser’s WebAssembly implementation and found three vulnerabilities. This blog post gives an overview of the features and attack surface of WebAssembly, as well as the vulnerabilities we found.

  [...]

  Overall, the majority of the bugs we found in WebAssembly were related to the parsing of WebAssembly binaries, and this has been mirrored in vulnerabilities reported by other parties. Also, compared to other recent browser features, surprisingly few vulnerabilities have been reported in it. This is likely due to the simplicity of the current design, especially with regards to memory management.

  There are two emerging features of WebAssembly that are likely to have a security impact. One is threading. Currently, WebAssembly only supports concurrency via JavaScript workers, but this is likely to change. Since JavaScript is designed assuming that this is the only concurrency model, WebAssembly threading has the potential to require a lot of code to be thread safe that did not previously need to be, and this could lead to security problems.

  WebAssembly GC is another potential feature of WebAssembly that could lead to security problems. Currently, some uses of WebAssembly have performance problems due to the lack of higher-level memory management in WebAssembly. For example, it is difficult to implement a performant Java Virtual Machine in WebAssembly. If WebAssembly GC is implemented, it will increase the number of applications that WebAssembly can be used for, but it will also make it more likely that vulnerabilities related to memory management will occur in both WebAssembly engines and applications written in WebAssembly.

• Detecting Bomb And Guns Using Normal WiFi: Researchers Find A New Way

  The test was able to give out accurate results on 15 different objects ranging in there different categories — Metal, liquid, and non-dangerous items.

  While it’s not clear whether the government will adopt and use the newly developed tracking method in public places, this certainly looks like the best way to stop guns and bombs get into school premises.

• What OpenShift Online customers should know about L1TF OpenShift SRE Security

  On Aug. 14, 2018, information was released about another set of “speculative execution” issues with Intel microprocessor hardware known as “L1 Terminal Fault”. As with earlier issues like Spectre and Meltdown, this information was coordinated with the release of updated software solutions to help mitigate the issue.

  At the time the embargo was lifted, the OpenShift SRE team worked to begin remediation (detailed below) on all OpenShift Online clusters. All Pro clusters finished remediation shortly before 18h00 EDT August 14, 2018. All Starter clusters were patched as of 23h30 EDT August 14, 2018.

• L1TF (AKA Foreshadow) Explained in 3 Minutes from Red Hat

• Google bod wants cookies to crumble and be remade into something more secure

  A key member of the Google Chrome security team has proposed the death of cookies to be replaced with secure HTTP tokens.

  This week Mike West posted his "not-fully-baked" idea on GitHub and asked for comments. "This isn't a proposal that's well thought out, and stamped solidly with the Google Seal of Approval," he warns. "It's a collection of interesting ideas for discussion, nothing more, nothing less."

  So far, people are largely receptive to the idea while pointing to the complexities that exist in trying to replace something that has become an everyday part of online interaction.

• Mozilla Recommend a Privacy Extension That Is Tracking Your Web History

  Web Security, a Firefox extension with over 200,000 current users, tracks every website users visit and stores that information on a German web server.

  The extension was recommended by Mozilla in a blog post last week about add-ons that improve users’ privacy. Mozilla has since edited the post, removing Web Security.

• Garbage collection in Perl 6

  In the first article in this series on migrating Perl 5 code to Perl 6, we looked into some of the issues you might encounter when porting your code. In this second article, we’ll get into how garbage collection differs in Perl 6.

  There is no timely destruction of objects in Perl 6. This revelation usually comes as quite a shock to people used to the semantics of object destruction in Perl 5. But worry not, there are other ways in Perl 6 to get the same behavior, albeit requiring a little more thought by the developer. Let’s first examine a little background on the situation in Perl 5.

• An introduction to the Django Python web app framework

  In the first three articles of this four-part series comparing different Python web frameworks, we covered the Pyramid, Flask, and Tornado web frameworks. We've built the same app three times and have finally made our way to Django. Django is, by and large, the major web framework for Python developers these days and it's not too hard to see why. It excels in hiding a lot of the configuration logic and letting you focus on being able to build big, quickly.

  That said, when it comes to small projects, like our To-Do List app, Django can be a bit like bringing a firehose to a water gun fight. Let's see how it all comes together.

• Dirk Eddelbuettel: RcppArmadillo 0.9.100.5.0

  A new RcppArmadillo release 0.9.100.5.0, based on the new Armadillo release 9.100.5 from earlier today, is now on CRAN and in Debian.

  It once again follows our (and Conrad's) bi-monthly release schedule. Conrad started with a new 9.100.* series a few days ago. I ran reverse-depends checks and found an issue which he promptly addressed; CRAN found another which he also very promptly addressed. It remains a true pleasure to work with such experienced professionals as Conrad (with whom I finally had a beer around the recent useR! in his home town) and of course the CRAN team whose superb package repository truly is the bedrock of the R community.

• Install Nagios core 4.4.1 on Ubuntu 18.04 Server

• Resetting the Configuration of a SRX220

• How to Use Keyboard Numpad for Music on Linux

• How to Set Up Parental Controls on Chromebooks

• How to Install and Configure VNC on Ubuntu 18.04

• create /dev/null if accidentally deleted or for a chroot

• Copying and Pasting Text onto the Linux Terminal

• Add YouTube Player Controls To Your Linux Desktop With browser-mpris2 (Chrome Extension)

• .snap Vs .deb Package

• Talking UX at DevConf.us 2018

  DevConf.us 2018 is the first annual, free, Red Hat sponsored technology conference in North America for contributors to free and open source projects. It follows on the success of DevConf.cz and DevConf.in, and will highlight emerging technologies like machine learning and artificial intelligence, serverless, containers and orchestration, as well as important foundational practices like quality engineering and user experience.

  We sat down with a few of the Red Hat speakers presenting on user experience (UX) in open source technologies to talk about user experience and how it impacts them in all of their different roles.

• Visualizing a DevOps mindset

• These two stocks can make you build again: Red Hat, Inc. (RHT), Caesars Entertainment Corporation (CZR)

• Red Hat, Inc. (RHT) is at $139.13 per share and SendGrid, Inc. (SEND) is listed at $30.93

• The Bears Are Wrong Again: Red Hat, Inc. (RHT), Analog Devices, Inc. (ADI)

• Form 4 RED HAT INC For: Aug 15 Filed by: ABBASI SOHAIB

Cloudgizer is a free open source tool for building web applications. It combines the ease of scripting languages with the performance of C, helping manage the development effort and run-time resources for cloud applications.

Cloudgizer works on Red Hat/CentOS Linux with the Apache web server and MariaDB database. It is licensed under Apache License version 2.

It’s no secret that Linux is basically the operating system of containers, and containers are the future of the cloud, says James Bottomley, Distinguished Engineer at IBM Research and Linux kernel developer. Bottomley, who can often be seen at open source events in his signature bow tie, is focused these days on security systems like the Trusted Platform Module and the fundamentals of container technology.

• Salesforce plans to open-source the technology behind its Einstein machine-learning services

  Salesforce is open-sourcing the method it has developed for using machine-learning techniques at scale — without mixing valuable customer data — in hopes other companies struggling with data science problems can benefit from its work.

  The company plans to announce Thursday that TransmogrifAI, which is a key part of the Einstein machine-learning services that it believes are the future of its flagship Sales Cloud and related services, will be available for anyone to use in their software-as-a-service applications. Consisting of less than 10 lines of code written on top of the widely used Apache Spark open-source project, it is the result of years of work on training machine-learning models to predict customer behavior without dumping all of that data into a common training ground, said Shubha Nabar, senior director of data science for Salesforce Einstein.

• Salesforce open-sources TransmogrifAI, the machine learning library that powers Einstein

  Machine learning models — artificial intelligence (AI) that identifies relationships among hundreds, thousands, or even millions of data points — are rarely easy to architect. Data scientists spend weeks and months not only preprocessing the data on which the models are to be trained, but extracting useful features (i.e., the data types) from that data, narrowing down algorithms, and ultimately building (or attempting to build) a system that performs well not just within the confines of a lab, but in the real world.

• Windows Games On Linux? Valve May Be Working On New “Steam Play” Tool

  Even though there are quite a few Linux-based distro options for gamers, hardcore gamers often go back to Windows to play the games they love. SteamOS from Valve, the most popular gaming Linux distro, seems to be making headlines from time-to-time, but things have been quiet for some time.

• A Look At Linux Gaming Performance Scaling On The Threadripper 2950X

  On Monday when the launch embargo expired on the Threadripper 2950X and Threadripper 2990WX I hadn't run any gaming benchmarks since, well, most games even on Windows can't scale out to 32 threads let alone 64 threads... Especially on Linux. It's far more practical getting these Threadripper 2 processors if you want to compile with 32 or 64 make jobs -- among many other common multi-threaded Linux workloads -- versus using this $899 or $1799 processor for a Linux gaming system. But if you are curious how Linux games scale with the Threadripper 2950X, here are some benchmark results when testing both AMD Radeon and NVIDIA GeForce graphics.

• Some Of The Smaller Features Hitting The Linux 4.19 Kernel This Week

  Here is a look at some of the smaller features landing in the Linux 4.19 kernel this week in a variety of different subsystems.

• Linux Kernel Diverts Question To Distros: Trust CPU Hardware Random Number Generators?

  In a controversial move, the Linux kernel will be pushing the question off to distribution vendors on whether to put trust in CPU hardware random number generators.

  Google's Ted Ts'o sent out the random subsystem updates this week for the Linux 4.19 kernel merge window. In addition to the recent change of better protecting entropy sent in from user-space, the decision on whether to trust the CPU hardware random number generators like Intel's RdRand will now be left up to the Linux distribution vendors or end-users having the final say in overriding that decision.

• L1TF / Foreshadow Mitigations Land In Linux 4.18 / 4.17 / 4.14 / 4.9 / 4.4 Kernel Update

  Linux stable maintainer Greg Kroah-Hartman has released new updates across the Linux 4.18, 4.17, 4.14, 4.9, and 4.4 kernel channels to address the recently exposed L1 Terminal Fault "L1TF" / Foreshadow Meltdown-like CPU vulnerability affecting Intel processors.

  Linux 4.4.148, 4.9.120, 4.14.63, 4.17.15, and 4.18.1 are all out this morning with their principal changes in these patch releases being the inclusion of L1TF/Foreshadow mitigation. As covered already, the default behavior is to carry out conditional L1D flushes on VMENTER, but there are kernel knobs available for always forcing L1 cache flushes on VMENTER and the full protection of disabling SMP/HT support.

• Linux 4.19 Goes Ahead And Makes Lazy TLB Mode Lazier For Small Performance Benefit

  Last month I wrote about lazy TLB mode improvements on the way to the mainline kernel and this week the changes were indeed merged for the in-development Linux 4.19 kernel.

It has been a while since ASUS last offered any Linux options for laptops, but they appear to have a new effort underway with Endless OS.

For those that remember Eee PC from a decade ago, ASUS used to offer some Linux laptops/netbook options that back was using Xandros Linux during the netbook fad...

• Turn-based tactical RPG 'Fell Seal: Arbiter's Mark' is out in Early Access

  Fell Seal: Arbiter's Mark [Official Site] from 6 Eyes Studio and publisher 1C Company is a turn-based tactical RPG with a focus on storytelling and strategic battles.

  From the press release:

  “Fell Seal: Arbiter’s Mark invites players to experience the classic era of tactical RPGs, but with new twists that update the gameplay for the modern age,” said Nikolay Baryshnikov, VP of 1C Company. “The team at 6 Eyes Studio has a strong vision fueled by a love of the genre, and the game unveils an epic story with challenging tactical combat and lovely visuals for RPG fans to enjoy.”

• You can get the original Orwell free from Humble Store for a limited time

• Aquarium tycoon game 'Megaquarium' releasing September 13th with Linux support

  Megaquarium from Twice Circled will have you dazzle your visitors with all sorts of aquatic attractions and it's releasing with Linux support on September 13th.

  I spoke to the developer today after the announcement was sent out, they confirmed to me the date does include the Linux version—just to be clear on that.

• The action RPG that has you adventure as well as run a shop 'Moonlighter' is now on Linux

  Good things come to those who wait, as today the Linux version of the action RPG Moonlighter is now officially available.

• libinput's "new" trackpoint acceleration method

  This is mostly a request for testing, because I've received zero feedback on the patches that I merged a month ago and libinput 1.12 is due to be out. No comments so far on the RC1 and RC2 either, so... well, maybe this gets a bit broader attention so we can address some things before the release. One can hope.

  [...]

  Because basically every trackpoint has different random data ranges not linked to anything easily measurable, libinput's device quirks now support a magic multiplier to scale the trackpoint range into something resembling a sane range. This is basically what we did before with the systemd POINTINGSTICK_CONST_ACCEL property except that we're handling this in libinput now (which is where acceleration is handled, so it kinda makes sense to move it here). There is no good conversion from the previous trackpoint range property to the new multiplier because the range didn't really have any relation to the physical input users expected.

• 15 Tips On How to Use ‘Curl’ Command in Linux

• Disassembling JITed code in GDB

• PSA: Workaround for a working MTP

  KDE Connect is awesome, we all know that. But sometimes you still want (or need) to acces the files on your Android phone via a good old USB cable. And to do so, you need a working implementation of the MTP protocol.

  Many people on bugzilla complain that the MTP support in Plasma is just broken. And indeed the MTP implementation we have has always been ignoring a fundamental limitation of MTP: the protocol doesn’t allow parallel operations, unlike the old Android USB mass storage did. In practice, if more than one process spawns an mtp ioslave, everything breaks.

• Museum Day, or, the Benefit of Skiving Off

  Tomorrow, there’s the fund raiser training session. Given that we’ve been raising funds for Krita since time immemorial (our first fund raiser was for two Wacom tablets and art pens so we could implement support for them, the second to let Lukas Tvrdy work on Krita for a couple of months and after that, we’ve had the kickstarters), that might seem superfluous. But I’m still hoping to learn lots. After all, it’s not like we’re exactly awash in money.

• Michael Kors announces new Wear OS smartwatches

  Popular fashion brand, Michael Kors, has announced an update to its long-serving Runway series of watches. It’s reviving the Runway watch as a Wear OS smartwatch, adding new silicone band option while retaining the familiar design, case and steel bracelet options.

• Android August Security Update Released for Nokia 8

• Android 9 Pie (Go Edition) Will Release This Fall With New Features

• How To Stop Google From Tracking Your Location? [This Time For Real]

• Audio & Video Tags Exploited For Collecting Sensitive Data in Google Chrome: Update Now

• A Bug in Chrome Gives Bad Actors License to Play ‘20 Questions’ with Your Private Data

• What the CoreOS Acquisition Means for Red Hat and the Container Space

  Red Hat, the 800-pound gorilla of the open source software world, bought CoreOS at the end of January. That was important for anyone interested in containers, and here's why: by combining the two companies Red Hat hoped to consolidate its position as one of the leading players providing useful software based around Kubernetes, the open source container management system.

  You'll recall that CoreOS developed Tectonic, an entire container management platform built around Kubernetes, and has been a champion of the software for some time. Since then, the CoreOS team at Red Hat has been hard at work, and at the beginning of May it introduced what it is calling an "Operator Framework" for building Kubernetes applications.

• Instant alterations:: Red Hat, Inc. (NYSE: RHT)

• Fluctuating Stocks: Extended Stay America, Inc., (NASDAQ: STAY), Red Hat, Inc., (NYSE: RHT)

• Notable Traders Alert: Twenty-First Century Fox, Inc., (NASDAQ: FOXA), Red Hat, Inc., (NYSE: RHT)

• Jonathan Dieter: Flock 2018

• How to Get Customizable Quick Settings and Notifications Without Updating to Android Pie

• Android 9 Pie's Go version has a tiny footprint and faster boot times

• Android 9 Pie release - These smartphones are now getting Google's latest features

• Dark mode comes to the latest version of Android Messages

• Google is developing native hearing aid support for Android

• 8 hurdles IT must overcome if they want open source success

  Open source software has the potential to drive innovation and collaboration across an enterprise, and can transform the way developers work together.

  "Open source is now part of the evaluation criteria when deciding on a software platform, so much so that it is expected," said Matt Ingenthron, senior director of engineering at Couchbase. "In this way, open source has somewhat faded into the background in a positive way. Just like no consumer would inquire if a mobile phone had internet access or text messaging, choosing an open source solution is almost always an option."

• Sprint calls on open source analytics to prevent cyberfraud

  Mobile phone-related fraud is big business. Fraudsters, hackers, and other bad actors employ creative techniques to compromise networks, hijack user information, and piece together customer identities that are then sold for big bucks on the dark web. To protect its customers, Sprint needed to transform the way it detected and blocked fraudulent activity.

  “In the mobile phone business, there’s no markup on selling devices — our bread and butter is the network and the services that are delivered on that network, through the devices,” says Scott Rice, CIO of Sprint. “Identity theft is a huge problem and the ability for nefarious actors to use that theft of information to impersonate our customers means we were eating the costs of the devices and the costs of services delivery.”

• Open Source Platform Delivers LDAP Integration

  The latest release of InfluxData, an open source platform for metrics, events, and other time series data, adds LDAP integration, new advanced analytics, and self-healing capabilities in the time series database platform. According to the company, time series data, collected and stored with InfluxData’s Time Series database platform is integral to observability and is becoming mission critical for organizations. Enhancements to InfluxEnterprise make it easier for administrators to keep this mission critical data available and secure by checking and verifying every requested action. This includes creating databases, storing data and running queries – against a user’s stored authorizations and role.

• YOYOW-WeCenter Special Edition Release: Free and Open Source

  The YOYOW-WeCenter Special Edition, customized and developed by YOYOW and based on WeCenter Q&A community framework, has been released on GitHub. Compared to regular WeCenter frameworks, YOYOW is providing free open source services and will be continually iterating products and will be introducing an incentive mechanism. Each Q&A community can directly integrate into YOYOW's bottom layer network and enjoy the network services provided by YOYOW.

• Add-on Recommended By Mozilla Caught Logging Users’ Browsing History

  According to the reports by Mike Kuketz, an independent security blogger from Germany and uBlock Origin, an add-on named “Web Security” has been caught collecting users’ browsing history.

  [...]

  Soon after this discovery by Hill, Kuketz added a post on his blog about the same extension pointing to the same strange behavior of the add-on. A user on Kuketz’s blog decoded the garbled data and found that the add-on was collecting users’ browsing history and sending it to a German server.

• Zombies: Top 5 Open Source Vulnerabilities That Refuse To Die [Ed: Microsoft partner WhiteSource continues to stigmatise FOSS as a security nightmare, using bugs branded by other Microsoft partner for extra panic]

• How a civic hacker used open data to halve tickets at Chicago's most confusing parking spot

  Matt Chapman used the Freedom of Information Act to get the City of Chicago's very mess parking ticket data; after enormous and heroic data normalization, Chapman was able to pinpoint one of the city's most confusing parking spots, between 1100-1166 N State St, which cycled between duty as a taxi-stand and a parking spot with a confusingly placed and semi-busted parking meter.

  After surveying the site and deducing the problem, Chapman contacted the alderman responsible for that stretch of North State Street, and, eight months later, the signage was cleaned up and made more intuitive.

  Followup data analysis showed that Chapman's work had halved the number of parking tickets issued on the spot, with 600-odd fewer tickets in the past 20 months, for a savings of $60,000 to Chicago motorists.

• Bluespec, Inc. Releases a New Family of Open-Source RISC-V Processors

  Bluespec Inc. has released Piccolo, its first in a family of RISC-V open-source processors provided as a vehicle for open innovation in embedded systems.

  Piccolo is a 3-stage RV32IM processor whose small “footprint” is ideal for many IoT applications. The repository (https://github.com/bluespec/Piccolo) contains a royalty-free synthesizable Verilog core that can be easily integrated and deployed into an ASIC or FPGA. Bluespec, Inc. will actively maintain Piccolo. It also offers commercial-grade tools for the customization and verification of RISC-V cores. Configurations will be continually added to provide the full spectrum of embedded controller features. Companies or universities interested in contributing to the Piccolo project should contact Bluespec, Inc. (add contact – RISC-V open source support).

Being in development for the past several months, KDE Applications 18.08 goes stable today and will hit the software repositories of various popular GNU/Linux distributions during the next few days. This is a major release and brings numerous new features and improvements across multiple apps, including Dolphin, Konsole, Gwenview, KMail, Akonadi, Cantor, Spectacle, and others.

"We continuously work on improving the software included in our KDE Application series, and we hope you will find all the new enhancements and bug fixes useful," reads today's announcement. "More than 120 bugs have been resolved in applications including the Kontact Suite, Ark, Cantor, Dolphin, Gwenview, Kate, Konsole, Okular, Spectacle, Umbrello and more!"

• How to Protect Your PC From the Intel Foreshadow Flaws

• AT&T Sued After SIM Hijacker Steals $24 Million in Customer's Cryptocurrency

  It has only taken a few years, but the press, public and law enforcement appear to finally be waking up to the problem of SIM hijacking. SIM hijacking (aka SIM swapping or a "port out scam") involves a hacker hijacking your phone number, porting it over to their own device (often with a wireless carrier employee's help), then taking control of your personal accounts. As we've been noting, the practice has heated up over the last few years, with countless wireless customers saying their entire identities were stolen after thieves ported their phone number to another carrier, then took over their private data.

  Sometimes this involves selling valuable Instagram account names for bitcoin; other times it involves clearing out the target's banking or cryptocurrency accounts. Case in point: California authorities recently brought the hammer down on one 20-year-old hacker, who had covertly ported more than 40 wireless user accounts, in the process stealing nearly $5 million in bitcoin.

  One of the problems at the core of this phenomenon is that hackers have either tricked or paid wireless carrier employees to aid in the hijacking, or in some instances appear to have direct access to (apparently) poorly-secured internal carrier systems. That has resulted in lawsuits against carriers like T-Mobile for not doing enough to police their own employees, the unauthorized access of their systems, or the protocols utilized to protect consumer accounts from this happening in the first place.

• Voting Machine Vendors, Election Officials Continue To Look Ridiculous, As Kids Hack Voting Machines In Minutes

• Security updates for Thursday

Q4OS emphasizes the Trinity Desktop Environment (TDE), which continues the legacy of the old KDE 3.5 desktop. The latest release, Q4OS 2.5, was available only for 64-bit (x86_64) and 32-bit (i686 PAE) hardware architectures, but now it can also be installed on ARM hardware like the Raspberry Pi, Pine64, and Pinebook.

"Q4OS on Raspberry Pi performs at lightning speed due to its exceptionally low hardware requirements," say the devs in the announcement. "All the native Q4OS features, for example "Desktop profiler" and "Setup tool," are available and fully functional within the Raspberry Pi Q4OS edition."

• Tropico 6 to launch in January 2019, Linux support still happening

  Tropico 6 is having a little extra time in the oven, with it being announced today for a January 2019 release.

  One thing that concerned me, was that their announcements and PR emails only mentioned Windows for the PC release. They cleared that it up on the Steam forum post after I asked about it, to confirm Linux support is still happening. When speaking to them over email, they clarified further that they are aiming to launch the Linux version at the same time as Windows, but they can't give a 100% guarantee on that right now. Either way it's happening—great!

• 7 Billion Humans from Tomorrow Corporation to arrive with Linux support on August 23rd

  Tomorrow Corporation have officially announced that their programming puzzle game 7 Billion Humans will launch on August 23rd with Linux support.

  Always love their style, I have fond memories of World of Goo which was one of the indie games that came to Linux back in the "early days" of 2009. Tomorrow Corporation also previously put out Human Resource Machine and Little Inferno, so it's really great to see yet another developer continue supporting Linux for so long.

• CrossCode, the 2D action RPG set in the distant future to officially launch on September 20th

• The absolutely gorgeous puzzle game Evergarden is now out

  Puzzle game Evergarden from Flippfly is out today with Linux support and not only is it gorgeous, it's also a very interesting puzzle experience.