- wlug - University of Waikato Mail Lists

SerenityOS: Homage To The 1990s
by Lawrence D'Oliveiro 19 Aug '21

19 Aug '21

Here <https://arstechnica.com/gadgets/2021/08/not-a-linux-distro-review-serenityo…> is a review of SerenityOS, a complete open-source POSIXy OS that does not use any GNU, Linux or BSD code. The review spends a lot of time on the GUI, which is consciously designed around a 1990s aesthetic. As usual, this sort of thing leaves me wondering “you could implement that whole look and feel on top of a Linux kernel, so why make your own?”. Then, further down, we get to this: Some of the paradigm shifts Kling and fellow contributors have introduced are neither weird nor trivial, though. SerenityOS's kernel, for example, exposes its internals as JSON rather than unstructured text. System utilities consuming kernel information therefore have a much simpler time of formatting it for display and/or internal decisions. Aha! Now there is something which could very well have a point. Though the Linux approach is to have the information exposed in these kernel pseudo-files in a simple (not unstructured!) text format that is both easy to parse and also somewhat comprehensible to a human viewer (which is harder to say of JSON). If you want to pass around object streams in a Linux command line, jq <https://github.com/stedolan/jq> is available as a standard Debian package, for doing precisely this sort of manipulation of JSON-formatted data. (Is that someone in Microsoft’s PowerShell group saying “I told you so!” ... ?)

1 0

Google's Fuchsia OS Is Rolling Out Widely To 1st-Gen Nest Hubs
by Peter Reutemann 19 Aug '21

19 Aug '21

'More owners of the first-generation Nest Hub are receiving the update to Google's Fuchsia operating system as it expands beyond the Preview program. 9to5Google reports: Back in May, Google formally released Fuchsia, its effort to develop a "not Linux" operating system from scratch, which has been years in the making. The first device to receive the new OS was Google's 2018 smart display, the Nest Hub -- not to be confused with the second generation Nest Hub with sleep tracking released earlier this year -- taking it permanently off of the existing Linux based "Cast OS" without negatively affecting the UI or experience. At the time, the rollout of Fuchsia was limited to a select few devices that were enrolled in the "Preview program" available to all devices via the Google Home app. Over time, the number of Nest Hubs running Fuchsia was expanded, with Google no doubt watching carefully for any issues with the upgrade. Late last week, Google updated a support page to reflect that the Nest Hub has received a new firmware update for both the Preview program and all other devices. Specifically, the first-gen Nest Hub is now receiving firmware version 1.52.260996. Google confirmed to us that this update does indeed include the upgrade to Fuchsia. All goes well, this means in a matter of days, all first-gen Nest Hub devices in households around the world should be running Fuchsia. ' -- source: https://tech.slashdot.org/story/21/08/18/2056255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firewalls and Middleboxes Can Be Weaponized For Gigantic DDoS Attacks
by Peter Reutemann 18 Aug '21

18 Aug '21

'In an award-winning paper last week, academics said they discovered a way to abuse the TCP protocol, firewalls, and other network middleboxes to launch giant distributed denial of service (DDoS) attacks against any target on the internet. Authored by computer scientists from the University of Maryland and the University of Colorado Boulder, the research is the first of its kind to describe a method to carry out DDoS reflective amplification attacks via the TCP protocol, previously thought to be unusable for such operations. Making matters worse, researchers said the amplification factor for these TCP-based attacks is also far larger than UDP protocols, making TCP protocol abuse one of the most dangerous forms of carrying out a DDoS attack known to date and very likely to be abused in the future.' -- source: https://it.slashdot.org/story/21/08/17/1941202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Glibc Security Fix Created a Nastier Linux Bug
by Peter Reutemann 17 Aug '21

17 Aug '21

'A fix that was made in early June to the GNU C Library (glibc) introduced a new and nastier problem. Steven J. Vaughan-Nichols writes via ZDNet: The first problem wasn't that bad. As Siddhesh Poyarekar, a Red Hat principal software engineer wrote, "In order to mount a minimal attack using this flaw, an attacker needs many pre-requisites to be able to even crash a program using this mq_notify bug." Still, it needed patching and so it was fixed. Alas, the fix contained an even nastier bug. While checking the patch, Nikita Popov, a member of the CloudLinux TuxCare Team, found the problem. It turns out that it is possible to cause a situation where a segmentation fault could be triggered within the library. This can lead to any application using the library crashing. This, of course, would cause a Denial-of-Service (DoS) issue. This problem, unlike the earlier one, would be much easier to trigger. Whoops. Red Hat gives the problem in its Common Vulnerability Scoring System (CVSS) a score of 7.5, which is "high." An attack using it would be easy to build and requires no privileges to be made. In short, it's bad news. Popov himself thinks "every Linux application including interpreters of other languages (python, PHP) is linked with glibc. It's the second important thing after the kernel itself, so the impact is quite high." [...] The good news is both the vulnerability and code fix have been submitted to the glibc development team. It has already been incorporated into upstream glibc. In addition, a new test has been submitted to glibc's automated test suite to pick up this situation and prevent it from happening in the future. The bottom line is sometimes changed in unrelated code paths can lead to behaviors changing elsewhere without the programmer realizing what's going on. This test will catch this situation. The Linux distributors are still working out the best way to deploy the fix. In the meantime, if you want to be extra careful -- and I think you should be -- you should upgrade to the newest stable version of glibc 2.34 or higher. ' -- source: https://it.slashdot.org/story/21/08/16/2131221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian 11 'Bullseye' Released As Stable
by Peter Reutemann 16 Aug '21

16 Aug '21

'"One of the oldest and most renowned distributions of Linux has been released!" âwrites Slashdot reader Washuu2. Phoronix reports it took "just over two years in development." Debian 11 brings many new features as outlined this morning with the big upgrade to Linux 5.10 LTS, exFAT file-system support, control groups v2, yescrypt for password hashing, and a plethora of updated packages. GNOME 3.38, KDE Plasma 5.20, and Xfce 4.16 are among the desktop options for Debian 11. Debian.org adds: Do you want to celebrate the release? We provide some bullseye artwork that you can share or use as base for your own creations. Follow the conversation about bullseye in social media via the #ReleasingDebianBullseye and #Debian11Bullseye hashtags... Around the world, there were even several in-person and online release parties — with a few more upcoming!' -- source: https://linux.slashdot.org/story/21/08/15/171228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting this month
by Peter Reutemann 16 Aug '21

16 Aug '21

Hi everyone At this stage, we don't have any talk(s) lined up for our meeting this month. Anybody feeling like a quick show and tell about some software or project that they've been working on lately? Or another topic that they'd like to discuss? Thanks! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

“Androids”: A History Of The Development Of The Android Operating System
by Lawrence D'Oliveiro 15 Aug '21

15 Aug '21

Chet Haase, one of the Android engineers, has published a book called “Androids”, giving an account of the early development of the mobile OS. A review is here <https://arstechnica.com/gadgets/2021/08/review-androids-is-a-developer-comm…>, and an excerpt is here <https://arstechnica.com/information-technology/2021/08/excerpt-the-history-…>. Before Android the company got acquired by Google, they were shopping themselves around to various groups of venture capitalists. From the beginning, the platform was going to be built on Open Source components like the Linux kernel. So how were they going to make money, if the main part of the platform was being given away for free? The initial answer was to offer paid-for services that would be resold by the carriers. This whole idea went away after the Google acquisition. Interesting to review the state of play at the time Android Inc were pitching their new OS: Symbian had some support from different vendors, but surprisingly (to me, at least), it left the whole UI layer up to the device maker, with no attempt at standardization between vendors. How were you to write portable apps in that situation? No wonder it had limited uptake. Sun were offering Java ME for mobile devices, but again, this was subject to differing, not-quite-compatible “profiles” for different devices, further complicating the headache of writing code to run across those devices. As I understand it, it also ran just a single Java VM on the device which had to be shared across all applications, which made it totally unsuited to a modern multitasking OS. The Hiptop device from Danger, Inc also gets a mention. Not a few people considered it probably the best mobile device to come out up to that point. Not mentioned in the above is that Microsoft acquired Danger. But because its platform was built on Java, which Microsoft had an allergy to, they wasted 18 months of product development time excising the Java dependency, totally losing the window of opportunity for releasing a new device. When the Kin finally came out, it probably held the world record for some product category for the shortest time on the market before being heavily discounted in clearance sales (about a month). One key point is that, when Google acquired Android, they continued to let it run like an independent company, at least for the first few years. This allowed the innovation to continue to flourish ... at least for a while.

1 0

Fwd: [NZLUG] Call for Proposals - Sysadmin Miniconf at Linux.conf.au 2022
by Peter Reutemann 13 Aug '21

13 Aug '21

Apologies for cross-posting, but you might be interested in the call for papers outlined below. Cheers, Peter ---------- Forwarded message --------- From: Simon Lyall <simon(a)darkmere.gen.nz> Date: Thu, Aug 12, 2021 at 11:29 PM Subject: [NZLUG] Call for Proposals - Sysadmin Miniconf at Linux.conf.au 2022 To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> The Call for Proposals is now up for the Sysadmin Miniconf at Linux.conf.au 2022. The Miniconf is on January 14th and the rest of the conference is the 2 days afterwards. All events are online. We are looking for 30 minute long Operations-related talks. We'd particularly love your War Stories about responding to the global pandemic and general work for home, or how you avoided earning war stories. The good news is that all talks accepted to the Miniconf get a free ticket for the whole of the conference! The bad news is that the CFP closes in just over 3 weeks from now on September 5th. So don't delay getting your proposal in. See our long CFP for more details: https://sysadmin.miniconf.org/cfp22.html Then Register and Login the the Conference dashboard to submit a proposal: https://linux.conf.au/dashboard -- Simon Lyall | Very Busy | Web: http://www.simonlyall.com/ "To stay awake all night adds a day to your life" - Stilgar _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Centralization Versus Decentralization On The Internet
by Lawrence D'Oliveiro 12 Aug '21

12 Aug '21

A thoughtful, at times somewhat technical article <https://www.theregister.com/2021/08/11/decentralized_internet/> on the original philosophy of the designers of the Internet that nothing should be centralized, and how that was modified somewhat with the concept of “Software-Defined Networking”, without compromising the robustness of a decentralized underlying framework. The World-Wide Web, on the other hand, is a very different matter: rampant centralization, not just at the level of social-media networks and cloud services, but also at the lower layer of “Content-Delivery Networks” (CDNs) has led to the creation of way too many of what the engineers call SPOFs (“Single Points Of Failure”), where a breakdown in any of these can lead to a complete failure of any number of services that have become crucially dependent on them. Is the pendulum swinging away from centralization now? The author seems to think so; but I suspect the fat profit margins are still driving things in the wrong direction.

1 0

Firefox 91 Pushes Privacy With Stronger New Cookie-clearing Option
by Peter Reutemann 11 Aug '21

11 Aug '21

'WIth the release of Firefox 91 on Tuesday, Mozilla has introduced a bigger hammer for smashing the cookies that websites, advertisers and tracking companies can use to record your online behavior. From a report: The new feature, called enhanced cookie clearing, is designed to block tracking not just from a website, but also from third parties whose code appears on the site. The technology is designed to let you clear cookies for a particular website but also the more aggressive "supercookies" designed to evade lesser privacy protections. The feature is an option if you enable Firefox's strict mode for cookie handling, which partitions website data into separate storage containers. "You can easily recognize and remove all data a website has stored on your computer, without having to worry about leftover data from third parties embedded in that website," Mozilla said in a blog post. ' -- source: https://news.slashdot.org/story/21/08/10/1637219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0