● 05.14.17

● Links 14/5/2017: Linux 4.12 RC1 and KDE Frameworks 5.34.0

Posted in News Roundup at 1:11 pm by Dr. Roy SchestowitzContentsGNU/LinuxGNU/Linux

Desktop

• While that is happening prepare your install USB stick for Ubuntu 16.04 LTS. Just as a note, I tried using Ubuntu 17.04 but had issues with the desktop locking up. Unity8 briefly worked but then it too froze. So I reverted back to 16.04 as the default. I suspect you can get 17.04 running if you put on the server version, and then manually install the desktop and configure the graphics and so forth and want to spend the extra time in resolving things.

• Once the Windows 10 is complete (allow several hours for that) then you need to do 2 steps. First run the Windows disk defragment utility to compress down the file system. Then run the disk manager utility and shrink down the partition. I was able to shrink it to 250GB, leaving 760GB for installing Ubuntu.

• In this video I review the latest laptop from System76, the Galago Pro! Released in 2017, the Galago Pro aims to be a first-class Linux Ultrabook. Check it out in this review. This laptop was purchased with my own money, and was not sponsored in any way by System76.

• The Pop theme can be installed via our PPA for Ubuntu 16.04 and 17.04. It works with both Unity and GNOME though our focus will be on the GNOME experience.

Audiocasts/Shows

Kernel Space

• Linus Torvalds has went ahead and closed the Linux 4.12 kernel merge window one day early with the release of 4.12-rc1.

• Linus wrote of 4.12-rc1, “Despite it being fairly large, it has (so far) been pretty smooth. I don’t think I personally saw any breakage at all, which is always nice. Usually I end up having something break, or trigger some silly build failure that really should have been noticed before it even got to me, but so far things are looking good. Famous last words.”

• Greg Kroah-Hartman announced today the immediate availability of the first point release of the Linux 4.11 kernel series, marking the new branch as stable on the kerne.org website.

• Linux kernel 4.11 was unveiled by Linus Torvalds two weeks ago, on April 30, 2017, which stayed marked as a “mainline” kernel on kernel.org until today when the Linux 4.11.1 patch landed as the latest stable kernel available for Linux-based operating systems. This, of course, means that it can now be deployed on various stable GNU/Linux distros who want to have the newest Linux kernel.

• The 4.12 merge window opened on May 1; as of this writing, just over 4,300 non-merge changesets have been pulled into the mainline repository. Though things are just beginning, it has the look of yet another busy development cycle for the kernel community. Thus far, the bulk of the changes merged have been in the block I/O and networking areas.

• Yesterday I provided some numbers about over one million lines added to Linux 4.12, much more than any of the recent merge windows for the Linux kernel. Here are some additional numbers and stats with finishing up the gitstats analytics on the Linux Git code-base.

• The Linux kernel is highly scalable but, while it runs nicely on the world’s largest computers, it is not an entirely comfortable fit on the smallest. The difficulties involved in running Linux on machines with 1MB or less of memory have left an opening for other operating systems, such as Zephyr, with lower memory needs. Some developers have not given up on scaling Linux to the smallest computers, but the approaches they have to take have always been a bit of a hard sell with the rest of the development community. Nicolas Pitre’s minitty patch set is a case in point.

• With the Linux 4.12 merge window now over, here is a look at some of the most exciting features that were added to the Linux kernel for this next installment.

• Dmitry Torokhov has sent in some last-minute updates for the Linux 4.12 kernel around its input support.

• In particular, this final pull request is primarily an xpad input driver update. This xpad driver update adds in USB IDs for the Mad Catz Brawlstick and Razer Sabertooth.

• I’m announcing the release of the 4.11.1 kernel.

• All users of the 4.11 kernel series must upgrade.

• The updated 4.11.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.11.y and can be browsed at the normal kernel.org git web browser:

• http://git.kernel.org/?p=linux/kernel/git/stable/linux-st…

Graphics Stack

• The Freedreno Gallium3D driver for open-source, reverse-engineered 3D driver support for Qualcomm Adreno graphics has another important performance feature.

• Hardware binning is now supported by the latest-generation A5xx hardware on Freedreno. Hardware binning can boost performance, when it was added for older hardware on Freedreno developer Rob Clark mentioned performance boosts of 35~45% for vertex-heavy workloads.

Applications

• Most mail servers made of Mail delivery agent (MDA) and Mail Transfer Agents (MTA). MDA software used to routes e-mail to its destination. You use MDA such as Dovecot, Qpopper, Courier, and Cyrus IMAP/POP3 servers. MTA software used to transfers e-mail between servers or computers. You use MTA such as Exim, Qmail, Sendmail, OpenSMTPD, Postfix, and others. Apart from MTA and MDA, you need to install and use Antispam, Antivirus, Webmail and other software too. You need to make sure your IP address stay clean. Apart from mail server software configuration, you need to install some database to store user names, email IDs, password and other information. Setting up and maintaining a full-fledged email server is a complicated task. You need to be a technology expert and a good sysadmin to set it up.

• FreeType 2.8 has been released and this version brings some big features to this widely-used open-source font engine.

• FreeType 2.8 marks the completion of OpenType Variation Fonts support. The last missing pieces of OpenType Variation Fonts support was completed for v2.8.

Instructionals/Technical

• Pidgin is a wonderful application used for connecting to multiple chat protocols through a single application, making it much easier to chat to more people at once, and saving on system resources at the same time.

• I’m a multitasker, I always have multiple windows open and multiple things on the go simultaneously, but one thing I can’t stand is having to use multiple apps with similar purposes, separately, when I can find a way to link them all together.

• You just need a car license which is covered by this company to get all the travels made by that car, the full name of the person owning it and its position in real time.

• I reported this privacy flaw to the CERT Nazionale which wrote to the company.

• The company fixed the leak 3 weeks later by providing new Web services endpoints that use authenticated calls. The company mailed its users saying them to update their App as soon as possible. The old Web services have been shutdown after 1 month and half since my first contact with the CERT Nazionale.

Games

• Linux lovers spend most of their time in the distro is with a terminal. The terminal is just like one of our friends which we know can almost do anything. Delete files, copy files, tell the weather, send emails, kill the system processes and much more. Then why not play some games in terminal too? Today I am going to cover some of the best games I love to play in Linux terminal which you will definitely enjoy. ​The list is not exhaustive, which means It may happen that some games may be missed, but I will try my best to cover top games for terminal in Linux. The commands will be for Ubuntu based distro using “sudo”. Replace “sudo apt-get” with your respective command like “yum” or “dnf” as per requirements.

Desktop Environments/WMs

• Xfce 4.13 is the development version leading to Xfce 4.14. I have setup a COPR repository for Xfce 4.13 packages. This COPR provides packages for Rawhide, Fedora 26 and Fedora 25.

K Desktop Environment/KDE SC/Qt

• Earlier this week the decision was made to switch from Drupal to WordPress as the CMS used for the KDE.org main website. While Drupal is certainly a fine system, the decision to switch was borne when my quick work to update a WordPress asset turned into a serious venture much more successful than my work with Drupal. Prior to my contributing to KDE I used to develop on WP, and I was surprised to find out my experience largely held in this new version. In hindsight, WordPress was the obvious option considering this.

• May 13, 2017. KDE today announces the release of KDE Frameworks 5.34.0.

• KDE Frameworks are 70 addon libraries to Qt which provide a wide variety of commonly needed functionality in mature, peer reviewed and well tested libraries with friendly licensing terms. For an introduction see the Frameworks 5.0 release announcement.

• The latest monthly KDE Frameworks 5 update is now available for KDE/Qt developers.

• This month’s KDE Frameworks 5.34 release brings new/updated Breeze icons, the KAuth fix for the root exploit vulnerability reported a few days ago, KAuth integration in document saving for KTextEditor, KWayland does some additional surface validation, Plasma Framework updates, an Arduino extension in the syntax highlighting, and various other changes.

• Latte Dock v0.6.1 (bug fix release) is out and you can get its source from our release page at github. Those that dont want to build it by themselves should wait their distro’s repos/channels to provide it. Many distros are already providing packages for v0.6.0 and we update that list at our main page in github.

• Plasma Desktop 5.9.5 for Zesty 17.04, 5.8.6 for Xenial 16.04, KDE Frameworks 5.33 and some selected application updates are now available via the Kubuntu backports PPA.

• Documents, documents, documents. Didn’t Steve Ballmer shout that at some expo some time ago? No? Never mind. Let’s talk about Okular instead, then. This is a document viewer for Linux and THE document viewer available in the KDE/Plasma desktop environment. It’s been around for a long time, it’s survived quite a few seasons of ever-changing desktop versions and tool, and its name doesn’t even begin with the letter K, which tells you how robust it really is.

• Having embarked on a journey of leaving no stone unturned in the Linux desktop world, it is time for me to take a deeper look at Okular. We started with the rather comprehensive State of Plasma report, we talked about Amarok and whether it will ever see revival, and now we will do this. After me.

• The second premium Krita game art course, Make Cel Shaded Game Characters, is out! It contains 14 tutorials

• I’m here for the first time to talk about my first participation in a sprint event and try to keep coming out of my shell. To clarify this, I have to back in time…

• It took longer than expected (many pieces to fit together), but now it’s ready: KDE Plasma is going to get Google Drive integration! Just add your Google account once, in the System Settings “Online Accounts” module, and you will be able to browse your Google Drive files from Dolphin or Plasma Folder View applets.

GNOME Desktop/GTK

• To this end, the next release of Granite will include an almost entirely re-written Granite Demo with better navigation and comprehensive examples for every non-deprecated widget available in the library. A decent amount of work has already been done to this end with new views like a CSS demo.

• [...]

• With AppCenter, we’re entering a new major evolution in elementary’s role as a development platform. We’re happy to continue making improvements to that platform and in the future we’ll be taking a good hard look at projects like Granite to make sure we’re meeting developer’s needs and helping them to build the great apps that their users want to see. Granite began as a way to make it easier to ship consistent, feature full apps and we’re confident that we can continue to deliver on that promise.

• Of the ones I did create and maintained, my motivation was the same as for the rest of GNOME: because I agree with the FSF’s motivation for free software. I also agree with the “secondary” derivations of the four freedoms: I live in Mexico, where proprietary software is terribly expensive and always seems to come from other countries, so it doesn’t help ours. I like that free software can be made more secure and trustworthy than proprietary software. I also like “giving back” to the free software commons at large, since I have gotten so many things out of it.

• GNOME is not just a desktop environment, but a collection of apps too. Some are useful, while others… not so much. Case in point, GNOME has a new program called “Recipes.” It is quite literally a searchable database of cooking recipes. While there is nothing really wrong with creating such an app, it sort of duplicates the functionality of a search engine, like Google or Bing. If resources were unlimited, I’d say more power to the developers. The open source project largely relies on donations, however, and it could be argued that Recipes is a bit unnecessary.

• There are many themes available which are flat design and target people who prefer flat themes for their desktop. This theme Flat-Plat-Aurora is based on Flat-Plat which is material-design flat theme and it was released in 2015. It is compatible with GTK 3.22+ and Gnome Shell 3.22/3.24 and available for Ubuntu 16.10 Yakkety and 17.04 Zesty. It support almost every desktop such as Unity, Gnome Shell, Xfce, Cinnamon, Mate and so on but not compatible with KDE. If you encounter any issues with the latest version of the theme 3.20/3.22 then report it to developer and hopefully it will get fixed in the next update If you are using other distribution you can directly download theme from its page and install it manually. Pop Suite icons used in the following screenshots. You can use Unity Tweak Tool, Gnome-tweak-tool to change icons.

• There are plenty of icon themes available from our site, many creators put their free time to create these eyecandy stuff for Linux users and give us free of cost, we should at least appreciate them. You may have tried various icons and you may have your favorite one right now on your desktop but there is no harm to try something new. Perforated Edge icons are modified version of Vibrancy Color icons, which looks quite different and nice with some themes, its initial version was released back in 2015 and most recent update brought 1000 new icons to the theme. This icon theme is compatible with most of the desktop environments such as Unity, Gnome, Xfce, Cinnamon, Mate and so but it is not compatible with KDE, it contains more than 4000 icons. It is in active development which means if you find any missing icon or problem with this icon set then you can report it via linked page and hopefully it will be fixed in the next update. You can use Unity Tweak Tool, Gnome-tweak-tool to change icons.

Distributions

• Our old git infrastructure will continue to live, read-only, for a month. After such point it will be removed. This ensures any latent projects or packages definitely make the migration over to Diffusion.

• If you’re a package maintainer, maintain a clone of the repository, etc. you will need to either update your common’s git remote to, or re-clone, the HTTPS url from the new common repo. After that, run make pull -jN (N here would be how many repositories you want to be cloning at the same time and would depend on your connection) in your repository folder and you should have your existing cloned git repositories receive updated remote addresses.

Reviews

• Deepin 15.4 is the latest release of the Debian-based deepin Linux distribution. This release features Control Center that makes it easier for users to set up various general settings for the desktop and the rest of the system, and a brand-new installation UI that offers smart detection for existing installation, helpful tips, and a QR code if you want to give feedback.

New Releases

• For detailed information about the changes between 2014.11 and 2017.05(-rc1) have a look at the official release announcement.

Slackware Family

• Last week, a new LTS kernel (4.9.26), new glibc (2.25) and a new gcc compiler suite (7.1.0) landed in Slackware-current. Note that gcc no longer contains the Java compiler (gcj): subsequently Slackware’s gcc-java package has been removed from slackware-current. We are at the head of the herd again folks. There is not yet any other distro that ships with the gcc-7 compiler by default. This will certainly pose some challenges for people who compile their stuff themselves – the SBo team warned their community about scripts that require patches to compile against gcc-7.

• Not much news of late about my ‘liveslak‘ scripts. I occasionally tweak them but the modifications these days are fairly minor. I stamped a new version on the repository this week: liveslak 1.1.8 on the occasion that I wanted to generate and upload a fresh series of Slackware-current based Live ISO images. After all, liveslak is meant to be a showcase of what Slackware-current is all about, and with the recent updates to kernel, gcc, glibc and more, a refresh was more than welcome.

• The Pale Moon browser was forked off the Mozilla Firefox codebase a couple of years ago, before Firefox switched to the Australis User Interface. Since then, the project has steadily been diverging from the Firefox codebase, optimizing its Gecko layout engine and rebranding that to ‘Goanna’ (which is the name of just another lizard). The community has a large vote in the direction the Pale Moon browser’s features are taking.

• I really like my new job. It is exciting, rewarding, but also demanding, and I find that I have a lot less free time at hand these days than I used to when I was with IBM. Hacking Slackware is becoming a luxury. Simply, because I realized how easily I can lose my job when an administrator puts my name in a spreadsheet… so I work my ass off and try to convince everyone that I am indispensable. Works so far.

Red Hat Family

Finance

Debian Family

Derivatives

Canonical/Ubuntu

• Ubuntu MATE 17.04 has been released at April 13th 2017. Here is a review for this user-friendly, desktop-oriented operating system with highly customizable interface and complete set of software. It keeps the same user-experience from the old Ubuntu GNOME2 era while also providing 4 other desktop layout choices (that resemble OS X, Windows, and Unity plus a Netbook-friendly look) and user can transform between them anytime. With only around 550MB of RAM idle use and the latest MATE 1.18, Ubuntu MATE 17.04 becomes an ultimate desktop choice for everyone. I hope you’ll enjoy this review and be comfortable with 17.04.

Flavours and Variants

• ​Bodhi Linux is essentially one of those distributions which try to bring your old PC back to life but at the same time, tries to make it look like it is still keeping up with the latest trends in Design and Interface. And with every new release, its community is growing larger and larger. We will look at the latest release which comes with a new theme and more bug fixes (more on this later).

Devices/Embedded

• Helios 4 is a network attached storage Or NAS. It is basically a single board computer with 4 hard drives attached to it to store and share data. This way, you can create a personal cloud, where you can store your Photos, Songs , and Movies by connecting it to your Home network.

• The Google Assistant SDK for Raspberry Pi was recently released. With so many options for an AI assistant on your RPi, how do you choose which one to try first?

Phones

Android

Free Software/Open Source

• Today, I’m happy to announce that the Insomnia desktop app is now open source software under the GPLv3 license! The source code is hosted on GitHub for your viewing pleasure.

• I am happy to announce the availability of Bookmarks for Nextcloud 0.10.0! Bookmarks is a simple way to manage the remarkable websites and pages you come across on the Internet. Bookmarks 0.10.0 provides API methods to create, read, update and delete your bookmarks as well as compatibility with upcoming Nextcloud 12, next to smaller improvements and fixes.

• If you happen to have an ASRock G41C-GS still in use or tucked away in your closet, this older motherboard for Intel Core 2 CPUs now has support for Coreboot to free the proprietary BIOS of the motherboard. Or if you don’t but still have other parts available, this motherboard is still available from a few online shops.

Events

• The OpenStack Summit wrapped up today in Boston and it was a great week! There were plenty of informative breakouts and some interesting keynotes.

• On the morning of April 26 I arrived at our venue, preparing for around 120 people to fill the rooms at foss-north 2017.

• The first Operating-System-Directed Power-Management (OSPM) Summit took place at the ReTiS Lab of the Scuola Superiore Sant’Anna in Pisa on April 3 and 4, 2017. This summit was organized as a collection of collaborative sessions focused on trying to improve how operating-system-directed power management and the kernel’s task scheduler can work together to achieve the goal of reducing energy consumption while still meeting performance and latency requirements. This subject is receiving great interest, not least since the advent of energy-aware scheduling (EAS) and heterogeneous CPU designs.

Web Browsers

Mozilla

• The following article gives you a glimpse of the upcoming Photon design of the Firefox web browser which will come out later this year.

• Mozilla plans to make Firefox 57 a milestone release. It is the version of Firefox in which the cut is made that leaves legacy add-ons behind, and also the Firefox version that will feature a design update.

• This design update is called Photon, and we talked about this previously already here on Ghacks Technology News.

• Not too many years ago, Firefox was king of the jungle. Sadly, this is no longer the case. Is Chrome the browser to beat in 2017 on the Linux desktop? Can Firefox or other alternatives possibly make a dent in Chrome’s reign? I examine this matter closely.

Databases

• There are packages for Ubuntu 17.04 (Zesty ), 16.10 (Yakkety) , 16.04 LTS (Xenial) and 14.04 LTS (Trusty).

OnlyOffice/LibreOffice

• When someone mentions a “free office suite”, probably the first name would be the famous LibreOffice. Which is – indeed – one of the best free office suites out there. However, there are a lot of other alternatives which you can try.

• OnlyOffice is another cross-platform office suite which offers solutions to create, edit and view many different documents formats. It’s free and licensed under the AGPL 3.0 license. Check the code on GitHub.

BSD

• We’re starting the process toward pfSense software release 2.3.4. pfSense software release 2.4 is close as well, and will bring a number of improvements: UEFI, translations to at least five lanuguages, ZFS, FreeBSD 11 base, new login page, OpenVPN 2.4 and more. pfSense version 2.4 requires a 64-bit Intel or AMD CPU, and nanobsd images are no longer a part of pfSense as of version 2.4.

FSF/FSFE/GNU/SFLC

• A discussion (plus Q&A) with the Executive Director of the Free Software Foundation (FSF), John Sullivan – Recorded live at LinuxFest NorthWest. May 6th, 2017.

Licensing/Legal

• Machine learning is a technique that has taken the computing world by storm over the last few years. As Luis Villa discussed in his 2017 Free Software Legal and Licensing Workshop (LLW) talk, there are legal implications that need to be considered, especially with regard to the data sets that are used by machine-learning systems. The talk, which was not under the Chatham House Rule default for the workshop, also provided a simplified introduction to machine learning geared toward a legal audience.

Openness/Sharing/Collaboration

Open Hardware/Modding

• Electrospinning is the process of dispensing a polymer solution from a nozzle, then applying a very high voltage potential between the nozzle and a collector screen. The result is a very, very fine fiber that is stretched and elongated down to nanometers. Why would anyone want this? These fibers make great filters because of their large surface area. Electrospinning has been cited as an enabling technology for the future of textiles. The reality, though, is that no one really knows how electrospinning is going to become a standard industrial process because it’s so rare. Not many labs are researching electrospinning, to say nothing of industry.

Programming/Development

• The database goliath has lost a Java Community public-review ballot by 13 to 10 that was to have approved its Java Platform Module System (JPMS) specification as a final draft. Executive Committee members ignored dire warnings from Oracle spec lead Mark Reinhold in an open letter where he claimed that a “no” vote would not only delay Java 9 but also be a “vote against the Java Community Process itself”.

• The JSR, number 376, needed a two-thirds majority to pass.

• In that bluntly worded letter, Oracle’s Java platform chief also chastised IBM and Red Hat for suggesting that they might vote against JPMS.

Leftovers

Science

• It turns out that about 1 in 5 of the toddlers used handheld screens, and those kids had an average daily usage of about a half hour. Handheld screen time was associated with potential delays in expressive language, the team found. For every half hour of mobile media use, a child’s risk of language delay increased by about 50 percent.

Health/Nutrition

• In addition to legal fees for city employees, the city has requested settlement authority of up to $16 million for unresolved water rate lawsuits brought by Flint residents and settlement authority of up to $6.9 million for an unresolved lawsuit brought by city retirees.

• CNN’s calls to mosques attended by the girls’ parents and the defendants were not returned.

• The politics surrounding FGM has resulted in deafening silence on this issue, especially from the left and feminists who should be outraged.

Security

• Private security firms identified the ransomware as a new variant of “WannaCry” that had the ability to automatically spread across large networks by exploiting a known bug in Microsoft’s Windows operating system.

• We start with a shadowy US government agency, the NSA, systematically analyzing the software of the biggest American computer companies in search of vulnerabilities. So far, so plausible: this is one of the jobs of an intelligence and counter-espionage agency focussed on information technology. However, instead of helping Microsoft fix them, we are supposed to believe that the NSA hoard their knowledge of weaknesses in Microsoft Windows, a vitally important piece of their own nation’s infrastructure, in case they’ll come in handy againt some hypothetical future enemy. (I’m sorry, but this just won’t wash; surely the good guys would prioritize protecting their own corporate infrastructure? But this is just the first of the many logical inconsistencies which riddle the back story and plot of “Zero Day”.)

• The next talk was given by Jeremy Allison on the recent symlink CVE. Jeremy explained how it was discovered and the measures that were taken to fix it.

• Let’s reword this to drive the point home. How likely is it that the United States NSA, through its persistent interest in keeping us unsafe, has managed to hand control of Britain’s nuclear weapons platforms to unknown ransomware authors, perhaps in Russia or Uzbekistan?

• The lesson here is that the NSA’s mission, keeping a country safe, is in direct conflict with its methods of collecting a catalog of vulnerabilities in critical systems and constructing weapons to use against those systems, weapons that will always leak, instead of fixing the discovered weaknesses and vulnerabilities that make us unsafe.

• A security researcher that goes online by the nickname of MalwareTech is the hero of the day, albeit an accidental one, after having saved countless of computers worldwide from a virulent form of ransomware called Wana Decrypt0r (also referenced as WCry, WannaCry, WannaCrypt, and WanaCrypt0r).

• In Q1 2017, the geography of DDoS attacks narrowed to 72 countries, with China accounting for 55.11% (21.9 p.p. less than the previous quarter). South Korea (22.41% vs. 7.04% in Q4 2016) and the US (11.37% vs. 7.30%) were second and third respectively.

• The Top 10 most targeted countries accounted for 95.5% of all attacks. The UK (0.8%) appeared in the ranking, replacing Japan. Vietnam (0.8%, + 0.2 p.p.) moved up from seventh to sixth, while Canada (0.7%) dropped to eighth.

• This week, I had the opportunity to take Joe Fitzpatrick’s class “Applied Physical Attacks and Hardware Pentesting”. This was a preview of the course he’s offering at Black Hat this summer, and so it was in a bit of an unpolished state, but I actually enjoyed the fact that it was that way. I’ve taken a class with Joe before, back when he and Stephen Ridley of Xipiter taught “Software Exploitation via Hardware Exploitation”, and I’ve watched a number of his talks at various conferences, so I had high expectations of the course, and he didn’t disappoint.

• Last month, while I was waiting for hardware to arrive and undergo troubleshooting, I had some spare time to begin some Intel ME reverse engineering work.

• First, I need to give some shout out to Igor Skochinsky, a Hex-Rays developer, who had been working on reverse engineering the Intel ME for a while, and who has been very generous in sharing his notes and research on the ME with us, which is going to be a huge help and cut down months of reverse engineering and guesswork. Igor was very helpful in getting me to understand the bits that didn’t make sense to me.

• More details about Intel’s AMT vulnerablity have been released – it’s about the worst case scenario, in that it’s a total authentication bypass that appears to exist independent of whether the AMT is being used in Small Business or Enterprise modes (more background in my previous post here). One thing I claimed was that even though this was pretty bad it probably wasn’t super bad, since Shodan indicated that there were only a small number of thousand machines on the public internet and accessible via AMT. Most deployments were probably behind corporate firewalls, which meant that it was plausibly a vector for spreading within a company but probably wasn’t a likely initial vector.

• [...]

• Case 2 is the scary one. If you have a laptop that supports AMT, and if AMT has been provisioned, and if AMT has had wireless support turned on, and if you’re running Windows, then connecting your laptop to a public wireless network means that AMT is accessible to anyone else on that network[1]. If it hasn’t received a firmware update, they’ll be able to do so without needing any valid credentials.

• It’s been a year since we warned that Intel’s Management Engine — a separate computer within your own computer, intended to verify and supervise the main system — presented a terrifying, unauditable security risk that could lead to devastating, unstoppable attacks. Guess what happened next?

• For the past week, the IT press has been full of news about the AMT module in the Management Engine making millions of systems vulnerable to local and remote attacks, with a firmware update to disable the module as the only really comprehensive solution. But AMT is only one of the many components of ME, and every one of them could have a vulnerability as grave as this one — and Intel is not offering any way to turn off ME altogether, meaning that there’s a lot of this in our future.

• ME is a brilliant example of why declaring war on general-purpose computing is a terrible idea. There are lots of reasons to want a computer that can only run some programs (instead of every program): preventing poisoned operating systems and other malware, preventing game cheating, enforcing copyright restrictions (DRM), etc… Every one of them is presented as a use-case for ME.

• All across Europe, from Finland to Portugal, Ireland to Greece, governments rely on Microsoft software. As their digital systems grow in size and importance, countries are becoming increasingly dependent on this single American corporation. But what consequences does this “lock-in” have? What risks does it pose for the security of European data? And what can governments do to counter it?

• It’s estimated that Microsoft makes around two billion euros in Europe every year, just from its business with the public sector. In 2012 the European Commission released a report that stated that 1.1 billion euros were unnecessarily lost by the European public sector due to being locked-in in business with IT system providers.

Defence/Aggression

Finance

• CGI was at the centre of the massive IT catastrophe which left around 20,000 farmers without their farm subsidy payments, driving many to the edge of ruin. Audit Scotland, which produced a report into the shambles, warned that the incomplete £178m system, designed to process common agricultural policy payments of £688m a year, was at risk of running out of money before it had met the European Commission deadline.

• Oh, and there are some big benefits for Microsoft if it can pull this off, too, given that the company gets a nice 30 percent cut of app purchases.

AstroTurf/Lobbying/Politics

• “Either way, as with the first article of impeachment against Richard Nixon, this is a series of high crimes and misdemeanors,” Mr Tribe said.

Censorship/Free Speech

• This Article examines the tension between freedom of speech and laws restricting the defamation of religion, using the case study of Singapore and the Amos Yee case. In 2015, four days after the death of revered former Prime Minister Lee Kuan Yew, Amos Yee, a sixteen-year-old blogger, posted a video called “Lee Kuan Yew is finally dead!” and, one day later, an image on his blog entitled “Lee Kuan Yew buttfucking Margaret Thatcher.” As part of Yee’s eight-minute-long video, Yee spent forty seconds criticizing Lee by drawing an unfavorable analogy between Lee and Jesus. As a result, Yee was charged under section 298 of the Penal Code, the law prohibiting the “uttering of words with the deliberate intent to wound the religious or racial feelings.” While international news highlighted Yee’s prosecution as a blatant attempt to silence criticism of the former Prime Minister, the courts held steadfast in their belief that Yee’s words were hurtful towards Christians, and that offending the religious sentiments of any community would not be tolerated in Singapore. This Article will review the facts of the case, the history of the law, and its application. It will also attempt to situate the law in the larger Defamation of Religions resolution debate in the United Nations from 1999–2010 and review legal restrictions on free speech in the United States and Europe.

• The six-month-long fight against censorship of the Militant at the 2,000-inmate Illinois River Correctional Center in Canton is winning new support. Prison authorities there denied a long-term subscriber three issues of the socialist newsweekly last fall.

• Prison authorities claimed that each of the issues — which contain articles reporting on the Militant’s fight against censorship at the Attica Correctional Facility in New York — is “detrimental to security, good order, rehabilitation, or discipline or it might facilitate criminal activity or be detrimental to mental health.”

• [...]

• Michelle Howard, former staff member of the Campaign to End the Death Penalty and wife of Burge torture survivor Stanley Howard — who is still fighting for his release from prison — also wrote to support the Militant’s effort to end censorship at the prison.

• The documentary film Azziara (The Visit, 2015), by Marouan Omara and Nadia Mounier in collaboration with Islam Kamal, was prevented from screening at the first edition of Zawya Cinema’s Arabic film festival Cairo Cinema Days on May 10. According to a statement made by the festival organizers, the film, which explores perceptions of the Egyptian countryside, was not granted approval from the Censorship Board. No reason was given for this move.

• “I am not sure how much effect censorship currently has in our country in the wake of the explosion of Internet,” Basu told PTI at the screening of short film “The Sixth Element”, which deals with the intimate relation between a widow and a foreigner.

• Bipartisan Tennessee lawmakers passed a free speech law Tuesday that protects students’ First Amendment rights on college campuses.

• Facebook has censored the page of an organization that helps women obtain abortion pills, citing its policy against the “promotion or encouragement of drug use”.

Privacy/Surveillance

• A newly released court opinion from the secretive Foreign Intelligence Surveillance Court (FISC) shows that for years the NSA improperly and perhaps illegally surveilled Americans. The court order triggered the surprise announcement two weeks ago that the agency would be severely scaling back its domestic surveillance and destroying previously collected data on Americans.

• The National Security Agency has decided to halt a controversial surveillance program, but this was just the tip of an iceberg of government abuses of privacy and due process.

• When searching intelligence data, analysts from the National Security Agency failed to follow the rules “with much greater frequency” than was previously disclosed, documents published by the Office of the Director of National Intelligence show.

• The secretive Foreign Intelligence Surveillance Court accused the NSA of a “lack of candor” when reporting those failures, which are a serious concern for the Fourth Amendment.

• During a preliminary review of just a few months in 2015, analysts running searches on emails and other digital communications vacuumed up from undersea internet cables frequently violated Americans’ privacy—albeit unintentionally.

• Undercover counter-extremism officers used hackers in India to access the emails of journalists and environmental activists, it has been claimed.

• And that’s just the start of it. Experts warn that, in the future, your online activity could be taken into consideration when you apply for a loan – or for a job.

• In contrast, the children did not express such negativity, overall. The youngest children (4-7 years) were positive about someone tracking others’ possessions. In fact, children were more negative about someone merely placing a mobile GPS device on an object and not tracking it than about someone placing the device in order to track the object, Gelman said.

• Edward Snowden has blamed the National Security Council for not preventing a cyber attack which infiltrated the computer systems of organisations in 74 countries around the world.

• In a tweet, the National Security Council (NSA) whistleblower said: “Despite warnings, @NSAGov built dangerous attack tools that could target Western software. Today we see the cost.”

Civil Rights/Policing

• First detained on apostasy charges in 2008, Mr. Badawi was released after a day of questioning. He was arrested on June 17, 2012, on a charge of insulting Islam through electronic channels and brought to court on several charges including apostasy, a conviction which carries an automatic death sentence. Human Rights Watch stated that Badawi’s website had hosted material criticizing “senior religious figures.” Mr. Badawi had also suggested that Imam Muhammad ibn Saud Islamic University had become “a den for terrorists.”

• In its rush to claim former Dutch colonies in the Asia-Pacific region following West Papua’s self-declared independence from the Netherlands in late 1961, Indonesia has subjected West Papua to continued human rights violations.

• [...]

• With foreign media all but denied access to West Papua – despite apparent lifting of restrictions by President Joko Widodo in 2015 – much of Indonesia’s atrocities remain secret, hidden.

• In August, the U.S. Court of Appeals for the 9th Circuit dealt the Federal Trade Commission a major blow by calling into question one of the consumer protection agency’s most important powers. The court said the FTC should be banned from regulating a company if even a small part of that firm’s business is regulated by the Federal Communications Commission as a telecom service, otherwise known as a “common carrier.”

DRM

• Today, activists will gather in Cambridge, Mass to march to the offices of W3C Director Tim Berners-Lee to urge him to keep DRM out of the standards for the open web.

• The controversial project to standardize DRM for streaming video on the web started in 2013 and culminated last month with a poll by W3C members whose results are confidential (though the W3C has chosen to publish the outcomes of previous polls and may yet do so for this one).

• Many of the members who voted in that poll endorsed a compromise advanced by the EFF: to go ahead with DRM, but only if members sign an amendment to the current membership agreement, promising not to use DRM laws to attack people engaged in legitimate activity like adapting the standard for people with disabilities, investigating security and privacy defects, and adding lawful features to video tools.

Intellectual Monopolies

Copyrights

• At the 2017 Free Software Legal and Licensing Workshop (LLW), which was held April 26-28 in Barcelona, Spain, more information about the GPL enforcement efforts by Patrick McHardy emerged. The workshop is organized by the Free Software Foundation Europe (FSFE) and its legal network. A panel discussion on the final day of the workshop discussed McHardy’s methodology and outlined why those efforts are actually far from the worst-case scenario of a copyright troll. While the Q&A portion of the discussion was under Chatham House Rule (which was the default for the workshop), the discussion between the three participants was not—it provided much more detail about McHardy’s efforts, and copyright trolling in general, than has been previously available publicly.

• Scandinavian telecoms operator Telia has revealed how rightsholders are bombarding the company with demands to identify alleged pirates. During the past year alone, Telia has been ordered to hand over personal details relating to more than 82,000 IP addresses, a large proportion of which will go to known copyright trolls.

• “I’ve had to continually re-educate myself that this isn’t about selling music. It’s about making music.”

• BBC collects IP address, location, e-mail address in fight against online cheats.

• A Federal Court in Texas has issued a broad preliminary injunction ordering several Internet services to disconnect a list of pirate sports streaming domains. While domain name seizures are not an entirely new phenomenon in the US, this order targets “anticipated” infringements and only applies temporarily. It ends after the Indian Premier League cricket tournament.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages. Permalink  Send this to a friend

----------

➮ Sharing is caring. Content is available under CC-BY-SA.