- wlug - University of Waikato Mail Lists

Who Writes Linux and Open Source Software?
by Peter Reutemann 28 Feb '23

28 Feb '23

'From an opinion piece in the Register: Aiven, an open source cloud data platform company, recently analyzed who's doing what with GitHub open source code projects. They found that the top open source contributors were all companies — Amazon Web Services, Intel, Red Hat, Google, and Microsoft.... Aiven looked at three metrics within the GitHub archives. These were the number of contributors, repositories (projects) contributed to, and the number of commits made by the contributors. These were calculated using Google Big Query analysis of PushEvents on public GitHub data. The company found that Microsoft and Google were neck-and-neck for the top spot. Red Hat is in third place, followed by Intel, then AWS, just ahead of IBM.... Red Hat is following closely behind and is currently contributing more commits than Google, with 125,012 in Q4 2022 compared to Google's 94,961. Microsoft is ahead of both, with 128,247 commits. However, regarding contributed staff working on projects, Google is leading the way with 5,757 compared to Microsoft's 5,513 and Red Hat's 3,656.... Heikki Nousiainen, Aiven CTO and co-founder, commented: "An unexpected result of our research was seeing Amazon overtake IBM to become the fifth biggest contributor." They "came late to the open source party, but they're now doubling down on its open source commitments and realizing the benefits that come with contributing to the open source projects its customers use." So, yes, open source certainly started with individual contributors, but today, and for many years before, it's company employees that are really making the code.... Aiven is far from the only one to have noticed that companies are now open source's economic engine. Jonathan Corbet, editor-in-chief of Linux Weekly News (LWN), found in his most recent analysis of Long Term Support Linux Kernel releases from 5.16 to 6.1 that a mere 7.5 percent of the kernel development, as measured by lines changed, came from individual developers. No, the real leaders were, in order: AMD; Intel; Google; Linaro, the main Arm Linux development organization; Meta; and Red Hat. The article also includes this thought-provoking quote from Aiven CTO's. "Innovation is at the heart of the open source community, but without a strong commitment from companies, the whole system will struggle. "We can see that companies are recognizing their role and supporting all who use open source."' -- source: https://news.slashdot.org/story/23/02/26/1950212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Emacs: Comparing Two Regions From Two Files
by Lawrence D'Oliveiro 28 Feb '23

28 Feb '23

So I was compiling some useful database-related routines that I have used in various places (with MySQL and SQLite so far) over the years into a set of common modules, so that I could easily find the latest and best-tested versions of them for future projects. Then I came to a routine with two versions of a few dozen lines each, and I was trying to figure out a way of doing a diff on them without writing them out to temporary files. I have an Emacs command called “make-command-buffer”, which I can use for example to create a buffer for entering and executing shell commands, and collecting their output. It was easy enough to copy and paste both routines into the buffer, but now how do I put them both into one diff command? There is a shell feature called “here-docs”, which lets you include the standard-input data for a command directly following the command: «cmd» <<«marker» ... data ... «marker» where the «marker» is some word that does not occur in the data. But I want to have two of these, like this: diff -u <<EOD1 <<EOD2 ... version 1 ... EOD1 ... version 2 ... EOD2 You can do something like that in Perl, but it doesn’t work in the shell. Hunting around on line reminded me why: because you can only have one standard input. But in the Bash man page, there is a syntax for redirecting arbitary file descriptors, letting you have any number of heredocs. So, combining this with the ability to give a command a file name that corresponds to an already-open file descriptor, I finally got this to work: diff -u /dev/fd/8 /dev/fd/9 8<<EOD1 9<<EOD2 ... version 1 ... EOD1 ... version 2 ... EOD2

1 1

LastPass says employee’s home computer was hacked and corporate vault taken
by Peter Reutemann 28 Feb '23

28 Feb '23

'Already smarting from a breach that put partially encrypted login data into a threat actor’s hands, LastPass on Monday said that the same attacker hacked an employee’s home computer and obtained an unencrypted vault available to only a handful of company developers. Although an initial intrusion into LastPass ended on August 12, officials with the leading password manager said the threat actor “was actively engaged in a new series of reconnaissance, enumeration, and exfiltration activity” from August 12 to August 26. In the process, the unknown threat actor was able to steal valid credentials from a senior DevOps engineer and access the contents of a LastPass data vault. Among other things, the vault gave access to a shared cloud-storage environment that contained the encryption keys for customer vault backups stored in Amazon S3 buckets.' -- source: https://arstechnica.com/information-technology/2023/02/lastpass-hackers-inf… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Asahi Linux Disputes Report That Linux 6.2 Will Run on Apple M1 Chips
by Peter Reutemann 28 Feb '23

28 Feb '23

'Last week ZDNet reported Linux had added upstream support for the Apple M1 Pro, M1 Max, and M1 Ultra chips and then concluded that "newer Mac owners can look forward to running Linux on their M1-powered machines." Saturday Asahi Linux called ZDNet's story "misleading and borderline false," posting on Twitter that "You will not be able to run Ubuntu nor any other standard distro with 6.2 on any M1 Mac. Please don't get your hopes up." We are continuously upstreaming kernel features, and 6.2 notably adds device trees and basic boot support for M1 Pro/Max/Ultra machines. However, there is still a long road before upstream kernels are usable on laptops. There is no trackpad/keyboard support upstream yet. While you can boot an upstream 6.2 kernel on desktops (M1 Mac Mini, M1 Max/Ultra Mac Studio) and do useful things with it, that is only the case for 16K page size kernel builds. No generic ARM64 distro ships 16K kernels today, to our knowledge. Our goal is to upstream everything, but that doesn't mean distros instantly get Apple Silicon support. As with many other platforms, there is some integration work required. Distros need to package our userspace tooling and, at this time, offer 16K kernels. In the future, once 4K kernel builds are somewhat usable, you can expect zero-integration distros to somewhat work on these machines (i.e. some hardware will work, but not all, or only partially). This should be sufficient to add a third-party repo with the integration packages. But for out-of-the-box hardware support, distros will need to work with us to get everything right. We are already working with some, and we expect to announce official Apple Silicon support for a mainstream distro in the near future. Just not quite yet!' -- source: https://linux.slashdot.org/story/23/02/27/0457206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Nokia Launches DIY Repairable Budget Android Phone
by Peter Reutemann 28 Feb '23

28 Feb '23

'Guardian reports: Nokia has announced one of the first budget Android smartphones designed to be repaired at home allowing users to swap out the battery in under five minutes in partnership with iFixit. Launched before Mobile World Congress in Barcelona on Saturday, the Nokia G22 has a removable back and internal design that allows components to be easily unscrewed and swapped out including the battery, screen and charging port. Nokia phones manufacturer HMD Global will make "quick fix" repair guides and genuine parts available for five years via specialists iFixit, in addition to affordable professional repair options. "People value long-lasting, quality devices and they shouldn't have to compromise on price to get them. The new Nokia G22 is purposefully built with a repairable design so you can keep it even longer," said Adam Ferguson, head of product marketing for HMD Global. The G22 is partially made of recycled plastic and has a 6.53in screen, large-capacity battery, 50-megapixel camera and a fingerprint scanner. It runs Android 12 and will be supported for three years of monthly security updates and two major Android version upgrades.' -- source: https://mobile.slashdot.org/story/23/02/25/2046209 -- specs: https://www.nokia.com/phones/en_int/nokia-g-22/specs Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Google Chrome's Improved Page Zoom Should Help Make the Mobile Web More Accessible
by Peter Reutemann 28 Feb '23

28 Feb '23

'Google Chrome's giving its page zoom feature a boost, which should make it more helpful for people who have difficulty reading the smaller screen on a phone. From a report: With the improved feature, you can increase the size of text, images, videos, and interactive controls on mobile web pages by up to 300 percent while preserving their original formatting. While the feature hasn't yet become available for all Chrome users, you can access it now if you download the Chrome beta on your phone or tablet. To enable the feature, tap the three dots icon in the top right corner of the browser, hit Settings > Accessibility, and then adjust the zoom level to your liking. Google will save this preference for all the sites you browse so you won't have to keep tweaking it, and will even bypass the ones that try to block zoom features. Previously, Google only allowed users to adjust text scaling options up to 200 percent.' -- source: https://it.slashdot.org/story/23/02/27/1234200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GCC Gets a New Frontend for Rust
by Peter Reutemann 27 Feb '23

27 Feb '23

'Slashdot reader sleeping cat shares a recent FOSDEM talk by a compiler engineer on the team building Rust-GCC, "an alternative compiler implementation for the Rust programming language." "If gccrs interprets a program differently from rustc, this is considered a bug," explains the project's FAQ on GitHub. The FAQ also notes that LLVM's set of compiler technologies — which Rust uses — "is missing some backends that GCC supports, so a gccrs implementation can fill in the gaps for use in embedded development." But the FAQ also highlights another potential benefit: With the recent announcement of Rust being allowed into the Linux Kernel codebase, an interesting security implication has been highlighted by Open Source Security, inc. When code is compiled and uses Link Time Optimization (LTO), GCC emits GIMPLE [an intermediate representation] directly into a section of each object file, and LLVM does something similar with its own bytecode. If mixing rustc-compiled code and GCC-built code in the Linux kernel, the compilers will be unable to perform a full link-time optimization pass over all of the compiled code, leading to absent CFI (control flow integrity). If Rust is available in the GNU toolchain, releases can be built on the Linux kernel (for example) with CFI using LLVM or GCC. Started in 2014 (and revived in 2019), "The effort has been ongoing since 2020...and we've done a lot of effort and a lot of progress," compiler engineer Arthur Cohen says in the talk. "We have upstreamed the first version of gccrs within GCC. So next time when you install GCC 13 — you'll have gccrs in it. You can use it, you can start hacking on it, you can please report issues when it inevitably crashes and dies horribly." "One big thing we're doing is some work towards running the rustc test suite. Because we want gccrs to be an actual Rust compiler and not a toy project or something that compiles a language that looks like Rust but isn't Rust, we're trying really hard to get that test suite working."' -- source: https://developers.slashdot.org/story/23/02/26/0543203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft .NET 8 Will Bolster Linux Support
by Peter Reutemann 27 Feb '23

27 Feb '23

'InfoWorld: .NET 8, the next planned version of the Microsoft's open source software development platform, is set to emphasize Linux accommodations as well as cloud development and containers. A first preview of .NET 8 is available for download at dot.microsoft.com for Windows, Linux, and macOS, Microsoft said on February 21. A long-term support (LTS) release that will be supported for three years, .NET 8 is due for production availability in November, a year after the release of predecessor .NET 7. The new .NET release will be buildable on Linux directly from the dotnet/dotnet repository, using dotnet/source-build to build .NET runtimes, tools, and SDKs. This is the same build used by Red Hat and Canonical to build .NET. Over time, this capability will be extended to support Windows and macOS. Previously, .NET could be built from the source, but a "source tarball" was required from the dotnet/installer. "We are publishing Ubuntu Chiseled images with .NET 8," adds Microsoft's announcement. And when it comes to the .NET Monitor tool, "We plan to ship to dotnet/monitor images exclusively as Ubuntu Chiseled, starting with .NET 8. That's notable because the monitor images are the one production app image we publish."' -- source: https://developers.slashdot.org/story/23/02/25/1955259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

At Least One Open Source Vulnerability Found In 84% of Code Bases, Report Finds
by Peter Reutemann 26 Feb '23

26 Feb '23

'L.Kynes shares a report from CSO Online: At a time when almost all software contains open source code, at least one known open source vulnerability was detected in 84% of all commercial and proprietary code bases examined by researchers at application security company Synopsys. In addition, 48% of all code bases analyzed by Synopsys researchers contained high-risk vulnerabilities, which are those that have been actively exploited, already have documented proof-of-concept exploits, or are classified as remote code execution vulnerabilities. The vulnerability data -- along with information on open source license compliance -- was included in Synopsys' 2023 Open Source Security and Risk Analysis (OSSRA) report (PDF), put together by the company's Cybersecurity Research Center (CyRC). "Of the 1,703 codebases that Synopsys audited in 2022, 96% of them contained open source," adds L.Kynes, citing the report. "Aerospace, aviation, automotive, transportation, logistics; EdTech; and Internet of Things are three of the 17 industry sectors included in the report that had open source in 100% of their audited codebases. In the remaining verticals, over 92% of the codebases contained open source."' -- source: https://news.slashdot.org/story/23/02/24/2035247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NASA Launches 'Open-Source Science Initiative', Urges Adoption of Open Science
by Peter Reutemann 26 Feb '23

26 Feb '23

'In a keynote at FOSDEM 2023, NASA's science data officer Steve Crawford explored NASA's use of open-source software. But LWN.net notes that the talk went far beyond just the calibration software for the James Webb Space Telescope and the Mars Ingenuity copter's flight-control framework. In his talk, Crawford presented NASA's Open-Source Science Initiative. Its goal is to support scientists to help them integrate open-science principles into the entire research workflow. Just a few weeks before Crawford's talk, NASA's Science Mission Directorate published its new policy on scientific information. Crawford summarized this policy with "as open as possible, as restricted as necessary, always secure", and he made this more concrete: "Publications should be made openly available with no embargo period, including research data and software. Data should be released with a Creative Commons Zero license, and software with a commonly used permissive license, such as Apache, BSD, or MIT. The new policy also encourages using and contributing to open-source software." Crawford added that NASA's policies will be updated to make it clear that employees can contribute to open-source projects in their official capacity.... As part of its Open-Source Science Initiative, NASA has started its five-year Transform to Open Science (TOPS) mission. This is a $40-million mission to speed up adoption of open-science practices; it starts with the White House and all major US federal agencies, including NASA, declaring 2023 as the "Year of Open Science". One of NASA's strategic goals with TOPS is to enable five major scientific discoveries through open-science principles, Crawford said. Interesting tidbit from the article: "In 2003 NASA created a license to enable the release of software by civil servants, the NASA Open Source Agreement. This license has been approved by the Open Source Initiative (OSI), but the Free Software Foundation doesn't consider it a free-software license because it does not allow changes to the code that come from third-party free-software projects."' -- source: https://science.slashdot.org/story/23/02/25/0337222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0