- wlug - University of Waikato Mail Lists

TinyPilot KVM Over IP
by Lawrence D'Oliveiro 31 Jan '21

31 Jan '21

Just been watching this review <https://www.youtube.com/watch?v=CyEpshm16HY> of the TinyPilot KVM-over-IP box. It’s purchasable from the maker’s website for US$300-plus, which is a fraction of the price of most other KVM-over-IP products. It’s built around a Raspberry π 4, using the camera adapter for HDMI in (no use made of the GPIO connector at all). Of course this means it can only support a connection to a single server machine. The source code is on GitHub if you want to build that yourself. The base product offers insecure HTTP-only access; if you want HTTPS, you have to pay extra for the TinyPilot Pro software licence. For comparison, some reader comments mention an alternative “PiKVM” product -- has anyone heard of this?

2 2

CERN Gets Its Open Hardware Licence Approved By OSI
by Lawrence D'Oliveiro 31 Jan '21

31 Jan '21

CERN wanted to come up with the hardware equivalent of open-source software licences. Such licences don’t really work well with hardware, because they use terms (like “linking” and “system libraries”) that aren’t applicable to hardware. So they worked with the Open Source Initiative (the custodians of the Open Source Definition) to come up with a selection of three licences, allowing for a choice of strong copyleft (GPL-equivalent), weak copyleft (LGPL-equivalent, I guess) and no copyleft at all. It seems these licences could actually be used for a combination of both hardware and software. <https://www.theregister.com/2021/01/29/cern_ohl_approved/>

1 0

Cloning SSD's
by Ian Stewart 31 Jan '21

31 Jan '21

FWIW: My recent experiences with copying SSD's... I recently installed Ubuntu Mate from USB stick to a 120GB SSD. I then updated with all the latest patches. This took about 30 minutes. I then tailored my preferences of Firefox, Terminal, Pluma, etc. Created a Guest account. Installed the NZ dictionary, and added some applications. This took me another 30 minutes. I then needed to do this to 5 more computers. So, to prepare six computers would have taken me a total of about 6 hours. I considered using the utility "dd" to copy a clone of my master disk. Looking through stackoverflow<https://unix.stackexchange.com/questions/144172/full-dd-copy-from-hdd-to-hdd> I found the suggestion to use "cat". I.e. Boot Ubuntu from a USB stick and assuming sda is my master disk and sdb is the clone, then issue the command... $ sudo sh -c 'cat /dev/sda >/dev/sdb' I found this copying took about 15 minutes. However, it didn't give me any progress report during the copying sequence. I then... $ sudo apt install pv ...pv stands for "Pipe Viewer". For the next SSD drive to be cloned I issued the command... $ sudo sh -c 'pv /dev/sda >/dev/sdb' ...which then provided a progress bar that updated every second. With Samsung SSD 120GB drives I found the operation took 13 minutes 13 seconds with a transfer rate of 153MB/s. I later had built another master SSD on a Kingston 120GB SSD and cloned this to another Kingston 120GB SSD which took 10 minutes and had a transfer rate of 200MB/s. I found with the system still powered on, I could unplug the cloned SSD and plug in another blank SSD and start another cloning. Probably not a recommended practice. After booting the clone, I edited /etc/hostname to make each clone unique. Maybe there's something else I should change??? In summary, allowing for a bit of time to physically move the SSD's between machines, I was effectively completing the installation/updating/tailoring at a rate of three PC's an hour. I dunno if this was the right way or the best way, but, so far, the masters and all the clones seem to be working OK. cheers, Ian.

2 1

Intel Iris Xe Video Cards Now Shipping To OEMs: DG1 Lands In Desktops
by Peter Reutemann 28 Jan '21

28 Jan '21

'Ryan Smith, writing at AnandTech: Following plans first unveiled last year during the launch of their DG1 GPU, Intel sends word this morning that the first Iris Xe video cards have finally begun shipping to OEMs. Based on the DG1 discrete GPU that's already being used in Intel's Iris Xe MAX laptop accelerators, the Iris Xe family of video cards are their desktop counterpart, implementing the GPU on a traditional video card. Overall, with specifications almost identical to Xe MAX, Intel is similarly positioning these cards for the entry-level market, where they are being released as an OEM-only part. As a quick refresher, the DG1 GPU is based on the same Xe-LP graphics architecture as Tiger Lake's integrated GPU. In fact, in broad terms the DG1 can be thought of as a nearly 1-to-1 discrete version of that iGPU, containing the same 96 EUs and 128-bit LPDDR4X memory interface as Tiger Lake itself. Consequently, while DG1 is a big first step for Intel -- marking the launch of their first discrete GPU of the modern era -- the company is planning very modestly for this generation of parts. The first DG1 GPUs were shipped in the fall as part of Intel's Iris Xe MAX graphics solution for laptops. At the time, Intel also indicated that a desktop card for OEMs would also be coming in 2021, and now, right on schedule, those desktop cards have begun shipping out.' -- source: https://hardware.slashdot.org/story/21/01/28/1649204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ProtonMail, Threema, Tresorit and Tutanota Warn EU Lawmakers Over 'Anti-Encryption' Push
by Peter Reutemann 28 Jan '21

28 Jan '21

'Four European apps which secure user data via end-to-end encryption, ProtonMail, Threema, Tresorit and Tutanota, have issued a joint-statement warning over recent moves by EU institutions that they say are setting lawmakers on a dangerous path to backdooring encryption. From a report: Last month the EU Council passed a resolution on encryption that's riven with contradiction -- calling for "security through encryption and security despite encryption" -- which the four e2e app makers believe is a thinly veiled call to backdoor encryption. The European Commission has also talked about seeking "improved access" to encrypted information, writing in a wide-ranging counter-terrorism agenda also published in December that it will "work with Member States to identify possible legal, operational, and technical solutions for lawful access." Simultaneously, the Commission has said it will "promote an approach which both maintains the effectiveness of encryption in protecting privacy and security of communications, while providing an effective response to crime and terrorism." And it has made it clear there will be no 'one silver bullet' as regards the e2e encryption security 'challenge.' But such caveats are doing nothing to alleviate the concerns of e2e encrypted app makers -- who are convinced proposals from the Council of the EU, which is involved in adopting the bloc's laws (though the Commission usually drafts legislation), sums to an push toward backdoors. "While it's not explicitly stated in the resolution, it's widely understood that the proposal seeks to allow law enforcement access to encrypted platforms via backdoors," the four app makers write, going on to warn that such a move would fatally underline the security EU institutions also claim to want to maintain. "The resolution makes a fundamental misunderstanding: Encryption is an absolute, data is either encrypted or it isn't, users have privacy or they don't," they go on. "The desire to give law enforcement more tools to fight crime is obviously understandable. But the proposals are the digital equivalent of giving law enforcement a key to every citizen's home and might begin a slippery slope towards greater violations of personal privacy."' -- source: https://yro.slashdot.org/story/21/01/28/1724250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rocky Linux gets a parent company, with $4m Series A funding
by Peter Reutemann 28 Jan '21

28 Jan '21

'Gregory Kurtzer, co-founder of the now-defunct CentOS Linux distribution, has founded a new startup company called Ctrl IQ, which will serve in part as a sponsoring company for the upcoming Rocky Linux distribution. Rocky Linux is to be a beneficiary of Ctrl IQ's revenue, not its source—the company describes itself in its announcement as the suppliers of a "full technology stack integrating key capabilities of enterprise, hyper-scale, cloud and high-performance computing."' -- source: https://arstechnica.com/gadgets/2021/01/rocky-linux-gets-a-parent-company-w… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitLab Reshuffles Its Paid Subscription Plans, Drops Its Bronze/Starter Tier
by Peter Reutemann 27 Jan '21

27 Jan '21

'GitLab, the increasingly popular DevOps platform, today announced a major update to its subscription model. The company is doing away with its $4/month Bronze/Starter package. Current users will be able to renew one more time at the existing price or move to a higher tier (and receive a significant discount for the first three years after they do so). The company's free tier, it is worth noting, is not going away and GitLab argues that it includes "89% of the features in Bronze/Starter." To ease the pain, Bronze users will be able to renew their existing subscription before January 26, 2022 for an additional year at the existing price. They can also opt to move to the Premium tier at a discounted price for the next three years, starting at $6/user/month in Year 1, but that price then goes up to $9/user/month and $15/user/month in Year 2 and 3 respectively. For new users, the Bronze package is no longer available, starting now. With this change, GitLab now offers three tiers: Free, Premium and Ultimate (it's also doing away with the "Silver/Premium" and "Gold/Ultimate" naming). "The Bronze tier, we were selling at a loss," GitLab founder and CEO Sid Sijbrandij told TechCrunch. "We were just losing money every time we sold it -- just on hosting and support. To be a sustainable business, this was a move we had to make. It's a big transition for our customers but we want to make sure we're a sustainable company and we can keep investing."' -- source: https://tech.slashdot.org/story/21/01/27/215226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Reddit 1: Wall Street 0
by Lawrence D'Oliveiro 27 Jan '21

27 Jan '21

Something very peculiar happened last week: a group of small-time stock traders who hang out on Reddit took on a well-funded Wall Street money manager, and won. What happened was, a company called Melvin Capital took out a “short position” on shares in GameStop--that is, they put money on a bet that the stock value would go down. The Redditors (part of a subreddit called “wallstreetbets”) figured out that this position was vulnerable, and bet against it by buying up GameStop shares. This drove up the price, forcing Melvin to either put up or shut up--put up a bunch of money to back up their position, or give up and lose an even bigger bunch of money. In other words, Melvin was caught in a “short squeeze”, which drove it to the verge of bankruptcy. A good, clear intro to the whole story is here <https://arstechnica.com/gaming/2021/01/the-complete-morons-guide-to-gamesto…>. A less-easy-to-understand analysis, with links to further articles, is here <https://www.aljazeera.com/economy/2021/1/27/bbgamestop-how-day-trader-reddi…>.

1 0

10-year-old Sudo Bug Lets Linux Users Gain Root-Level Access
by Peter Reutemann 27 Jan '21

27 Jan '21

'A major vulnerability impacting a large chunk of the Linux ecosystem has been patched today in Sudo, an app that allows admins to delegate limited root access to other users. From a report: The vulnerability, which received a CVE identifier of CVE-2021-3156, but is more commonly known as "Baron Samedit," was discovered by security auditing firm Qualys two weeks ago and was patched earlier today with the release of Sudo v1.9.5p2. In a simple explanation provided by the Sudo team today, the Baron Samedit bug can be exploited by an attacker who has gained access to a low-privileged account to gain root access, even if the account isn't listed in /etc/sudoers -- a config file that controls which users are allowed access to su or sudo commands in the first place.' -- source: https://linux.slashdot.org/story/21/01/27/1820205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Play Bans Video App For Standard “.ass” Subtitle Support
by Lawrence D'Oliveiro 26 Jan '21

26 Jan '21

libass <https://github.com/libass/libass> is an open-source library for decoding the .ass/.ssa subtitle formats for video files. However, the automated censor-bot in the Google Play Store decided that an app supporting this format was violating the “Sexual Content and Profanity Policy”, and suspended it. The app was only reinstated after an appeal. <https://arstechnica.com/gadgets/2021/01/googles-bots-decide-ass-subtitle-su…>

1 0