- wlug - University of Waikato Mail Lists

Canonical Reveals More Details About Ubuntu Core Desktop
by Peter Reutemann 09 Nov '23

09 Nov '23

'Next April a new LTS Ubuntu arrives, and alongside it will be a whole new immutable desktop edition. At this year's Ubuntu conference in Riga, Latvia, Canonical revealed more details about its forthcoming immutable desktop distro. From a report: Core Desktop is not the next version of Ubuntu itself. Ordinary desktop and server Ubuntu aren't going anywhere, and the next release, numbered 24.04 and codenamed Noble Numbat as we mentioned last month, will be the default and come with all the usual editions and flavors. Nor is this a whole new product: it is a graphical desktop edition of the existing Ubuntu Core distro, as we examined on its release in June last year, a couple of months after 22.04. Ubuntu Core is Canonical's Internet of Things (IoT) distro, intended to be embedded on edge devices, such as digital signs and smart displays. It is an immutable distro, meaning that the root filesystem is read-only and there's no conventional package manager. Rather than being a basis for customization, like a conventional Linux, the idea is that immutable distros are rolled out and updated more like a phone or tablet OS: there's a single fixed and heavily tested OS image, and it's deployed onto the devices out in the field without modification. Updates are monolithic: a whole fresh image is pushed out, and all the OS components are upgraded in a single operation to the same combination. That isn't unique. Most of the major Linux vendors have immutable offerings, and The Reg has looked at several over the years, including MicroOS, the basis of SUSE's next-gen enterprise OS ALP. As well as the well-known ChromeOS, another immutable desktop is the educational distro Endless OS. [...] Canonical believes it has some unique new angles. Core Desktop is constructed as additional layers on top of the existing Ubuntu Core distro, and like Core, it's entirely built with a single packaging system: Ubuntu's Snap. While Snap remains controversial, it does have some compelling advantages over both SUSE and Red Hat's tooling. SUSE's transactional_update tool, while simpler than its rivals in implementation, requires a snapshot-capable filesystem, meaning that its immutable distros must use Btrfs. While it has many admirers, the number and the contents of the orange and red cells in the feature tables here in its own documentation reflect the FOSS desk's serious reservations about Btrfs.' -- source: https://news.slashdot.org/story/23/11/08/1957249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Abandons Mercurial
by Lawrence D'Oliveiro 08 Nov '23

08 Nov '23

Up to now, Mozilla has been supporting the use of both Git and Mercurial DVCSes by its contributors <https://devclass.com/2023/11/07/mozilla-will-move-firefox-development-from-…>. But no more: it is giving up on Mercurial, and making things exclusively Git-based. Furthermore, it is moving to use GitHub for hosting its repos. I can remember the discussion over which distributed VCS they should switch to about a decade ago, back when I was new to Git myself. Even then, the momentum was clearly on the side of Git. However, the Mozilla crew wanted something that would work well on Windows, not just on Linux, and back then the process-heavy execution model of Git gave poor performance on Windows. Hence they went for Mercurial. Presumably that objection no longer applies; suitable compromises have been made in the architecture of Git to cater for the platform that thinks 26 drive letters ought to be enough for anybody. (I can’t remember what Mozilla were using before that; probably Subversion.) Using GitHub, on the other hand, seems in some ways like a step backwards for distributed development. Linus Torvalds famously pilloried their lame pull-request system <https://github.com/torvalds/linux/pull/17#issuecomment-5654674>, which just happens to be the one feature of your GitHub repos that you cannot turn off.

2 2

Android 14’s storage disaster gets patched, but your data might be gone
by Peter Reutemann 08 Nov '23

08 Nov '23

'It's the start of November, and that means a new Android security patch. Google claims this one is fixing a high-profile Android 14 storage bug that was locking some people out of their devices. The November Security Bulletin contains the usual pile of security fixes, while consumer-oriented Pixel patch notes list a few user-facing changes. The important line is "Fix for issue occasionally causing devices with multiple users enabled to show out of space or be in a reboot loop." A footnote points out that this is for the "Pixel 6, Pixel 6a, 6 Pro, 7, 7 Pro, 7a, Tablet, Fold, Pixel 8, Pixel 8 Pro." We're on about day 33 of the Android 14 storage bug. For devices with multiple users set up, there is some kind of storage issue that is locking users out of their device. Some are completely unusable, with the phone bootlooping constantly and never reaching the home screen. Others are able to boot up the device but don't have access to lock storage, which causes a huge amount of issues. Some users likened the bug to "ransomware," a type of malware that encrypts your local storage and then demands money for your data. One fix is to completely erase your device with a factory reset, but a lot of users don't want to do that. The earliest reports of this started just days after the October 4 launch date. Google usually rolls updates out slowly so it can pull them if issues like this pop up to minimize damage. That didn't happen here, though. Google failed to respond quickly to initial reports and just let the bug roll out to everyone. Some people even report being freshly hit with the bug just four days ago because Google 1) let the update roll out without stopping it and 2) can't patch its software quickly enough. The biggest issue tracker thread on this bug is up to 1,000-plus likes and 850 comments of people locked out of their devices, and it took two separate rounds of news coverage for Google to acknowledge the bug after about 20 days. Google promised a rescue patch, which is now arriving, though the company said only "some" data would be recoverable and that "this update may not enable data to be recovered for devices that are repeatedly rebooting." That seems to line up with what people are experiencing now that the OTA is out. People who can boot up report fixed devices, while bootloopers aren't getting anywhere. Some users are still in the support thread hoping for some kind of data recovery for bootlooping devices, but it doesn't seem like that is going to happen.' -- source: https://arstechnica.com/gadgets/2023/11/android-14-patches-ransomware-stora… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When Linux Spooked Microsoft: Remembering 1998's Leaked 'Halloween Documents'
by Peter Reutemann 05 Nov '23

05 Nov '23

't happened a quarter of a century ago. The New York Times wrote that "An internal memorandum reflecting the views of some of Microsoft's top executives and software development managers reveals deep concern about the threat of free software and proposes a number of strategies for competing against free programs that have recently been gaining in popularity." The memo warns that the quality of free software can meet or exceed that of commercial programs and describes it as a potentially serious threat to Microsoft. The document was sent anonymously last week to Eric Raymond, a key figure in a loosely knit group of software developers who collaboratively create and distribute free programs ranging from operating systems to Web browsers. Microsoft executives acknowledged that the document was authentic... In addition to acknowledging that free programs can compete with commercial software in terms of quality, the memorandum calls the free software movement a "long-term credible" threat and warns that employing a traditional Microsoft marketing strategy known as "FUD," an acronym for "fear, uncertainty and doubt," will not succeed against the developers of free software. The memorandum also voices concern that Linux is rapidly becoming the dominant version of Unix for computers powered by Intel microprocessors. The competitive issues, the note warns, go beyond the fact that the software is free. It is also part of the open-source software, or O.S.S., movement, which encourages widespread, rapid development efforts by making the source code — that is, the original lines of code written by programmers — readily available to anyone. This enables programmers the world over to continually write or suggest improvements or to warn of bugs that need to be fixed. The memorandum notes that open software presents a threat because of its ability to mobilize thousands of programmers. "The ability of the O.S.S. process to collect and harness the collective I.Q. of thousands of individuals across the Internet is simply amazing," the memo states. "More importantly, O.S.S. evangelization scales with the size of the Internet much faster than our own evangelization efforts appear to scale." Back in 1998, Slashdot's CmdrTaco covered the whole brouhaha — including this CNN article: A second internal Microsoft memo on the threat Linux poses to Windows NT calls the operating system "a best-of-breed Unix" and wonders aloud if the open-source operating system's momentum could be slowed in the courts. As with the first "Halloween Document," the memo — written by product manager Vinod Valloppillil and another Microsoft employee, Josh Cohen — was obtained by Linux developer Eric Raymond and posted on the Internet. In it, Cohen and Valloppillil, who also authored the first "Halloween Document," appear to suggest that Microsoft could slow the open-source development of Linux with legal battles. "The effect of patents and copyright in combating Linux remains to be investigated," the duo wrote. Microsoft's slogain in 1998 was "Where do you want to go today?" So Eric Raymond published the documents on his web site under the headline "Where will Microsoft try to drag you today? Do you really want to go there?" 25 years later, and it's all still up there and preserved for posterity on Raymond's web page — a collection of leaked Microsoft documents and related materials known collectively as "the Halloween documents." And Raymond made a point of thanking the writers of the documents, "for authoring such remarkable and effective testimonials to the excellence of Linux and open-source software in general."' -- source: https://linux.slashdot.org/story/23/11/05/046247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Update/upgrade
by john 03 Nov '23

03 Nov '23

For some time I have been receiving a message regarding missing firmware. I do have an onboard AMD GPU do I need to go hunting or am I suffering from fomo? W: Possible missing firmware /lib/firmware/amdgpu/ip_discovery.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/vega10_cap.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/sienna_cichlid_cap.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/navi12_cap.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/psp_13_0_10_ta.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/psp_13_0_10_sos.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/aldebaran_cap.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/aldebaran_sjt_mec2.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/aldebaran_sjt_mec.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_imu.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_rlc.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_mec.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_me.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_pfp.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_0_toc.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/sdma_6_0_3.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/sienna_cichlid_mes1.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/sienna_cichlid_mes.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/navi10_mes.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_mes1.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_mes_2.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/gc_11_0_3_mes.bin for module amdgpu W: Possible missing firmware /lib/firmware/amdgpu/smu_13_0_10.bin for module amdgpu Cheers John..

2 2

Chrome Not Proceeding With Web Integrity API Deemed By Many To Be DRM
by Peter Reutemann 03 Nov '23

03 Nov '23

'Back in July, Google's work on a Web Integrity API emerged and many equated it to DRM. While prototyped, it was only at the proposal stage and the company announced today it's not going ahead with it. With this proposal, Google wanted to give websites a way to confirm the authenticity of the user and their device/browser. The Web Integrity API would let websites "request a token that attests key facts about the environment their client code is running in." It's not all too different from the Play Integrity API (SafetyNet) on Android that Google Wallet and other banking apps use to make sure a device hasn't been tampered with (rooted). ' -- source: https://it.slashdot.org/story/23/11/02/2040234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bye-Bye Theora
by Lawrence D'Oliveiro 02 Nov '23

02 Nov '23

Seems the old Theora video codec, an early attempt at a freely-licensable algorithm unencumbered by patent restrictions, has largely fallen into disuse <https://www.theregister.com/2023/11/02/theora_video_codec_deprecation/>. In other words, it has served its purpose, and the patent minefields that used to plague video encoding have (to mix metaphors) been effectively defanged. I remember when the Xiph.org foundation came out with the Vorbis audio codec as a free alternative to MP3, back when Fraunhofer was still vigorously enforcing its patents on the latter. Xiph also came up with a multimedia container format called “Ogg”, which could handle both audio and video. But given it was, at least in the early years, only used for audio, quite a lot of people assumed that a “.ogg” file was audio-only. So the video files had to have the “.ogv” file extension (I think there were some “.oga” files to indicate that they were audio-only). The name “Theora” comes from Theora Jones, one of the principal characters in the old “Max Headroom” TV series. “Vorbis” is from a character in Terry Pratchett’s “Discworld” novels. I thought “Ogg” also came from those novels, but Wikipedia says no.

2 1

Arm Acquires Minority Stake in Raspberry Pi
by Peter Reutemann 02 Nov '23

02 Nov '23

'Arm today announced that it has made a strategic investment, a minority stake in Raspberry Pi -- the arm of Raspberry Pi responsible for the new Raspberry Pi 5 and past Raspberry Pi products. From a report: Arm's minority stake extends the long-term partnership between Arm and Raspberry Pi, which has seen Arm CPUs feature in all of the Raspberry Pi and Raspberry Pi Pico SoC. The partnership began way before the Raspberry Pi was available for sale, in 2008 -- when the original board was still just a dream. Fast-forward to 2023 and we have a generation of learners who have taken their first steps with coding, science and electronics thanks to the Raspberry Pi.' -- source: https://hardware.slashdot.org/story/23/11/02/1638205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Jupyter Server Behind Reverse Proxy
by Lawrence D'Oliveiro 02 Nov '23

02 Nov '23

I’ve been experimenting with running a Jupyter server inside an LXC container, and making it publicly accessible in a controlled way, via a reverse-proxy setup in Apache. This way, the web server handles all the authentication access, the Jupyter server doesn’t need to impose any restrictions. And being isolated inside a container should help to minimize the impact of a security breach. I found some related documentation here <https://jupyterhub.readthedocs.io/en/stable/howto/configuration/config-prox…>, though it talks about JupyterHub, not Jupyter. This part matched what I initially tried (but didn’t fully work on its own): ProxyPreserveHost on ProxyPass http://«container-host»:«port»/ ProxyPassReverse http://«container-host»:«port»/ This line was not something I did, so I’m not sure it’s really needed: RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME} However, this whole rewrite business I found to be quite unnecessary: RewriteEngine On RewriteCond %{HTTP:Connection} Upgrade [NC] RewriteCond %{HTTP:Upgrade} websocket [NC] RewriteRule /(.*) ws://«container-host»:«port»/$1 [P,L] Because the same effect can be achieved much more simply, by one small change to those initial three lines: ProxyPreserveHost on ProxyPass http://«container-host»:«port»/ upgrade=websocket ProxyPassReverse http://«container-host»:«port»/ Notice that “upgrade=websocket” bit? That’s all it took to get the proxying to work.

1 0

Raspberry Pi Smart Vertical Farming Takes Veggies To New Heights
by Peter Reutemann 01 Nov '23

01 Nov '23

'Tanay Tanay has developed a smart vertical farming system using a Raspberry Pi 4 as the central controller, with features such as Bluetooth and Wi-Fi support for remote plant monitoring, precise automated watering based on moisture levels, and environmental factor tracking. Tom's Hardware reports: The end result is a Pi-powered system with tons of cool goodies to take your plant care to the next level. Tanay is able to monitor all sorts of environmental factors like how much light is available, how moist the air is, how much water is in the soil, what the temperature is and much more. The icing on the cake is a user-friendly interface that can be used to manually water the plants. The main board for this project is a Raspberry Pi 4 B. It's connected to an Arduino Nano R3 which is assigned to a specific plant. Some of the sensors confirmed in the design are a soil moisture sensor, an ambient light sensor as well as a water level depth detection sensor. You could always add more or take away modules depending on what you want to do with your vertical farm. For example, a camera could be used to log plant growth progress over time. Tanay explains that ThingSpeak, an IoT platform, was used in the project design. ' -- source: https://hardware.slashdot.org/story/23/11/01/0043259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0