- wlug - University of Waikato Mail Lists

Free Software Foundation Turns 35
by Lawrence D'Oliveiro 06 Oct '20

06 Oct '20

<https://www.theregister.com/2020/10/06/fsf_35/>: The FSF is keen that all should don their sandals and share in the celebration, perhaps by trying out an approved GNU/Linux distribution, or switching out a proprietary app like Microsoft Office for LibreOffice, or Adobe Photoshop for the GNU Image Manipulation Program. Heck, one could even have a crack at GNU Emacs and celebrate a keyboard shortcut or two.

1 0

Python 3.9 Is Out
by Lawrence D'Oliveiro 06 Oct '20

06 Oct '20

Worth noting from <https://devclass.com/2020/10/06/python-3_9/>: * Merging of dictionaries with “|” and “|=” operators * Generics in type hints * General expressions now allowed in decorators (I didn’t actually realize there were restrictions before) * New PEG parser, with option to revert to old parser for now (not that I expect to notice any difference between the two) * Deprecation of features for Python 2 backward compatibility (to be removed altogether in 3.10)

1 0

Oracle vs Google Goes To The US Supreme Court
by Lawrence D'Oliveiro 06 Oct '20

06 Oct '20

The US Supreme Court is due to hear Google’s appeal tomorrow <https://arstechnica.com/tech-policy/2020/10/google-asks-supreme-court-to-ov…> against the CAFC ruling that APIs are copyrightable and that Google infringed Oracle’s copyright on the Java APIs. A few companies (including GitHub) have filed “amicus curiae” briefs explaining why allowing the verdict against Google to stand will have unfortunate consequences for the entire software industry. The CAFC (Court of Appeals for the Federal Circuit) is a notoriously “intellectual-property-friendly” court, shall we say. They wouldn’t even have got the chance to rule on the original verdict by Judge Alsup, except that the suit initially included a patent claim (that was very quickly thrown out). Definite points to Oracle’s lawyers for doing this: like a chess strategy where you advance a seemingly unimportant pawn in the opening moves that is immediately sacrificed, but the long-term consequences for your opponent’s position only become apparent some time later in the game.

1 0

Developers Are Managing 100× More Code Than They Were 10 Years Ago
by Lawrence D'Oliveiro 05 Oct '20

05 Oct '20

This survey <https://arstechnica.com/gadgets/2020/10/sourcegraph-devs-are-managing-100x-…> reports on the explosion in typical source code bases that seems to have occurred over the past decade. I have a couple of concerns with this: * The obvious quantity-versus-quality issue. How much of this is due to things like node.js pulling in hundreds of dependencies for a comparatively small class library? Clearly, “managing” does not mean “writing” or even “maintaining”. * The use of “technology” as some kind of synonym for “information technology”. You mean it didn’t require “technology” to conduct insurance, retail, food and beverage businesses before? After all, pencil and paper are “technologies”, too. And if you think they are easy things to make, well ... try making them yourself. </rant>

1 0

What Operating Systems Keep Things Running In Space?
by Lawrence D'Oliveiro 04 Oct '20

04 Oct '20

Nice report <https://arstechnica.com/features/2020/10/the-space-operating-systems-bootin…> going into some details on the proprietary VxWorks (popular with NASA) and the open-source RTEMS (originating from the US military, now heavily used by ESA). Also mentions SpaceChain, which was developed in order to implement a BitCoin network in space. This is based on Sylix, which comes from the Chinese military, but is now open-source as well. And there is some use of Linux, but only in situations where hard-realtime constraints can be guaranteed by lower-level custom hardware. Summary: VxWorks and RTEMS are pretty much identical in basic features and maturity/reliability, but RTEMS does have an edge in configurability.

1 0

DigitalOcean’s “Hacktoberfest” Backfires
by Lawrence D'Oliveiro 02 Oct '20

02 Oct '20

Cloud company Digital Ocean has started its seventh annual “Hacktoberfest” <https://www.theregister.com/2020/10/01/digitalocean_hacktoberfest_pull_requ…>, promising free T-shirts to those who submit “quality” pull requests to online open-source repositories. Seems this year, the “quality” proviso is being roundly ignored. Many project maintainers are being deluged with trivial and pointless patches, many of whose submittors readily admit they are only doing it for the T-shirt. Choice quote: Imagine an arsonist declaring, "Only you can prevent forest fires," and you can get a sense of the frustration among open source maintainers. Actually, I’m surprised this hasn’t happened in previous years. But then again, maybe it has: "Hacktoberfest has never generated anything of value for open source ... It’s a marketing stunt which sends a deluge of low-effort contributions to maintainers, leaving them to clean up the spam." There’s also a link to a rather pungently-named Twitter account which is collecting examples of these useless patch submissions.

2 1

Developers Try Again To Upstream Motorola 68000 Series Support In LLVM
by Peter Reutemann 30 Sep '20

30 Sep '20

'Hobbyist developers are trying once again to get a Motorola 68000 back-end merged into the upstream LLVM compiler. Phoronix reports: The Motorola 68000 series processors have been around since the 80's thanks to the likes of the early Apple Macintosh computers. Fast forward to 2020, the Motorola 68000 is still a popular target for vintage computer enthusiasts and hobbyists. Community developers have worked on improving the Linux kernel support for M68k hardware like early Apple Powerbooks as recently as a few years ago and the compiler support is a continued target. GCC 11 due out next year was looking to drop the M68k target over its unmaintained status. Hobbyists though stepped up there so the M68k support will remain in GCC. Now developers are also looking at adding M68k support to the LLVM compiler. This isn't the first time that M68k support for LLVM has been brought up albeit never successfully landed to date. Building off the past failures to get the Motorola 68000 series support upstreamed, developers last week sent out new patches proposing this back-end -- this time they are showing more clarity about the developers involved and being committed to supporting the code, the sustainability of the code, and responding quickly to code review comments. This patch series is the latest attempt at upstreaming Motorola 68000 series support in LLVM. Besides all the back-end specific code there is also some common LLVM code changes that fall under greater scrutiny. ' -- source: https://hardware.slashdot.org/story/20/09/30/225226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Xen Project Officially Ports Its Hypervisor To Raspberry Pi 4
by Peter Reutemann 29 Sep '20

29 Sep '20

'The Xen Project has ported its hypervisor to the 64-bit Raspberry Pi 4. The Register reports: The idea to do an official port bubbled up from the Xen community and then reached the desk of George Dunlap, chairman of the Xen Project's Advisory Board. Dunlap mentioned the idea to an acquaintance who works at the Raspberry Pi Foundation, and was told that around 40 percent of Pis are sold to business users rather than hobbyists. With more than 30 million Arm-based Pis sold as of December 2019, and sales running at a brisk 600,000-plus a month in April 2020, according to Pi guy Eben Upton, Dunlap saw an opportunity to continue Xen's drive towards embedded and industrial applications. Stefano Stabellini, who by day works at FPGA outfit Xilinx, and past Apache Foundation director Roman Shaposhnik took on the task of the port. The pair clocked that the RPi 4's system-on-chip used a regular GIC-400 interrupt controller, which Xen supports out of the box, and thought this was a sign this would, overall, be an easy enough job. That, the duo admitted, was dangerous optimism. Forget the IRQs, there was a whole world of physical and virtual memory addresses to navigate. The pair were "utterly oblivious that we were about to embark on an adventure deep in the belly of the Xen memory allocator and Linux address translation layers," we're told. [The article goes on to explain the hurdles that were ahead of them.] "Once Linux 5.9 is out, we will have Xen working on RPi4 out of the box," the pair said. [...] Stefano Stabellini told The Register that an official Xen-on-RPi port will make a difference in the Internet-of-Things community, because other Arm development boards are more costly than the Pi, and programmers will gravitate towards a cheaper alternative for prototyping. He also outlined scenarios, such as a single edge device running both a real-time operating system alongside another OS, each dedicated to different tasks but inhabiting the same hardware and enjoying the splendid isolation of a virtual machine rather than sharing an OS as containers. George Dunlap also thinks that an official Xen-on-RPi port could also be of use to home lab builders, or perhaps just give developers a more suitable environment for their side projects than a virtual machine or container on their main machines. Stay tuned to Project EVE's Github page for more details about how to build your own Xen-for-RPi. Hacks to get it up and running should also appear on the Xen project blog.' -- source: https://hardware.slashdot.org/story/20/09/29/2025213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cloudflare's Privacy Crusade Continues With a Challenge To Google Analytics
by Peter Reutemann 29 Sep '20

29 Sep '20

'Fortune: Cloudflare is launching a privacy-friendly rival to Google Analytics. Google Analytics is a free toolkit that's used by website administrators across the globe to help them track the behavior of the people visiting those sites -- how they find them, what they do there, the devices they're using, and so on. However, the service -- the most popular of its kind -- also helps Google track websites' visitors, so it can better profile them for advertising purposes. This privacy-invasive aspect makes many people squeamish. And that's where Cloudflare would now like to step in. Around its birthday every year, the decade-old company -- which went public last year -- announces a move intended to "give back" to the wider Internet community. These moves are often related to privacy. On Tuesday, it unveiled Cloudflare Web Analytics, a free-to-use toolkit that largely replicates what Google Analytics offers -- minus the invasive tracking, and thus the ability to assess the performance of targeted ads carried on websites. Cloudflare Web Analytics is immediately available to the company's paid customers, but any website owner will be able to use it from some point in the coming months. Cloudflare's scale is crucial here [...] because it takes substantial resources to run a free analytics platform, and Cloudflare already has a giant network that can support the load. Cloudflare Web Analytics isn't the company's only big announcement this week. "On Monday, Cloudflare launched a beta testing program for a cloud technology called Durable Objects," the report adds. "You can read the technical explanation here, but in essence this is a tool that allows developers of online services to make those services comply with the increasing number of data-localization and data-protection laws that limit where users' data is supposed to go." "With Durable Objects, Cloudflare says, it is possible to specify where particular data will reside on Cloudflare's network, so -- for example -- a German user's data does not have to leave Germany. Or, with an eye to other current news, a service such as TikTok could ensure that U.S. users' data never leaves the U.S., without having to create a separate version of its service for that country." ' -- source: https://tech.slashdot.org/story/20/09/29/2011226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Removes 17 Android Apps Caught Engaging In WAP Billing Fraud
by Peter Reutemann 29 Sep '20

29 Sep '20

'Google has recently removed 17 Android applications from the official Play Store because they were infected with the Joker (aka Bread) malware. ZDNet reports: "This spyware is designed to steal SMS messages, contact lists, and device information, along with silently signing up the victim for premium wireless application protocol (WAP) services," Zscaler security researcher Viral Gandhi said this week. The 17 malicious apps were uploaded on the Play Store this month and didn't get a chance to gain a following, having been downloaded more than 120,000 times before being detected. Following its internal procedures, Google removed the apps from the Play Store, used the Play Protect service to disable the apps on infected devices, but users still need to manually intervene and remove the apps from their devices. But this recent takedown also marks the third such action from Google's security team against a batch of Joker-infected apps over the past few months. [...] The way these infected apps usually manage to sneak their way past Google's defenses and reach the Play Store is through a technique called "droppers," where the victim's device is infected in a multi-stage process. Malware authors begin by cloning the functionality of a legitimate app and uploading it on the Play Store. This app is fully functional, requests access to dangerous permissions, but also doesn't perform any malicious actions when it's first run. Because the malicious actions are usually delayed by hours or days, Google's security scans don't pick up the malicious code, and Google usually allows the app to be listed on the Play Store. But once on a user's device, the app eventually downloads and "drops" (hence the name droppers, or loaders) other components or apps on the device that contain the Joker malware or other malware strains. ' -- source: https://tech.slashdot.org/story/20/09/28/236245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0