● 11.21.17

● Links 21/11/2017: LibreELEC (Krypton) v8.2.1 MR, Mesa 17.3.0 RC5

Posted in News Roundup at 5:03 pm by Dr. Roy SchestowitzContentsGNU/LinuxGNU/Linux

Desktop

• Microsoft employee Tim Sneath, who spent no less than 17 years with the company, announced in a blog post that he’s leaving the software giant to work for Google on the new Flutter mobile framework.

• Sneath started his post by emphasizing how great Microsoft is, explaining that he company has “incredibly diverse interests” and is “filled with talented people.”

• Despite the good parts, however, the former Microsoft Program Manager who worked on a series of projects for developers, discussed what he described as the “missteps” that the Redmond-based software giant embraced beginning with the Windows Vista era.

• Sir, – It is encouraging to see a pro-Linux article in The Irish Times, with Derek Scally promoting the many advantages of the free and open-source operating system, without glossing over the difficulties a user may have when installing and using it for the first time on their personal computer (“‘Goodbye Apple, goodbye Microsoft – hello Linux”, Technology, November 18th).

• A major factor driving the decision to return to Windows appears to be changes in the political make-up of the council since the LiMux project began in 2003. Today the CSU political party, which has a long track record of opposition to LiMux, is also part of the ruling coalition in Munich. It was this coalition of CSU and SPD politicians that put forward the proposals to switch back to Windows 10 earlier this year.

Server

• Ever since containers on Linux became popular, determining the difference between Linux containers and virtual machines has become trickier. This article will provide you with the details to understand the differences between Linux containers and virtual machines.

• BuildKit is a new project under the Moby umbrella for building and packaging software using containers. It’s a new codebase meant to replace the internals of the current build features in the Moby Engine.

• If you want a basic idea of where containers are headed in the near future, follow the money. There’s a lot of it: 451 Research projects that the overall market for containers will hit roughly $2.7 billion in 2020, a 3.5-fold increase from the $762 million spent on container-related technology in 2016.

• There’s an obvious fundamental factor behind such big numbers: Rapidly increasing containerization. The parallel trend: As container adoption grows, so will container orchestration adoption.

Audiocasts/Shows

• This video shows how to upgrade Linux Mint from 17.3 to 18.3 while keeping all of your personal data intact.

• Please be sure to give EzeeLinux a ‘Like’ on Facebook! Thanks! Also check out http://www.ezeelinux.com for more about Linux.

• On this episode of This Week in Linux. The first 6 Year LTS Linux Kernel was released this week. Huge Update from Mozilla with Firefox Quantum. New distro releases from Fedora and Slax.

Kernel Space

• As some additional work past the KVM changes for Linux 4.15 submitted last week, a few more feature items have been queued.

• The second batch of Kernel-based Virtual Machine (KVM) updates sent in today for Linux 4.15 include ARM GICv4 support, x86 bug fixes, the AMD VFIO NFT performance fix, and x86 guest UMIP support. Landing already with Linux 4.15 is Intel UMIP capabilities for User-Mode Instruction Prevention to prevent certain instructions from being executed if the ring level is greater than zero. This latest KVM pull update adds this UMIP support to its space for both real and emulated guests.

• Of the many changes coming for Linux 4.15, as detailed this weekend Radeon GPU and AMD CPU customers have a lot to be thankful for with this new kernel update currently in development. Here are some initial benchmarks of the Linux 4.15 development kernel using an AMD EPYC 7601 32-core / 64-thread setup.

• When it comes to EPYC in Linux 4.15, the kernel side-bits have landed for Secure Encrypted Virtualization (SEV), CPU temperature monitoring support now working, and improved NUMA node balancing.

• A new technology has arrived in Linux that can provide sysadmins and developers with a large number of new tools and dashboards for performance analysis and troubleshooting. It’s called the enhanced Berkeley Packet Filter (eBPF, or just BPF), although these enhancements weren’t developed in Berkeley, they operate on much more than just packets, and they do much more than just filtering. I’ll discuss one way to use BPF on the Fedora and Red Hat family of Linux distributions, demonstrating on Fedora 26.

• BPF can run user-defined sandboxed programs in the kernel to add new custom capabilities instantly. It’s like adding superpowers to Linux, on demand. Examples of what you can use it for include:

Linux Foundation

• Fifteen people from 13 different countries have received Linux Foundation Training Scholarships (LiFT) in the category of Linux Newbies. This year, 27 people received scholarships across all categories — the most ever awarded by the Foundation.

• Now in its seventh year, the program awards training scholarships to current and aspiring IT professionals worldwide who may not otherwise have the means for specialized training. The Foundation has awarded 75 scholarships worth more than $168,000 since the program began.

Graphics Stack

• The fifth release candidate for Mesa 17.3.0 is now available. This is the last planned release candidate before the final release.

• We still have a couple of regressions in our tracker [1] although I’m anticipating for those to be resolved by EOW.

• The Mesa 17.3 release game is in overtime but it should be wrapping up in the days ahead.

• Emil Velikov of Collabora announced the Mesa 17.3-RC5 release candidate this morning. He anticipates it being the last release candidate, but there still are a few blocker bugs open. As of writing there still are 4 bugs open with one pertaining to Gallium3D Softpipe and the others being Intel driver issues.

• Just days after David Airlie landed R600g image shader support and other patches for this Radeon HD 2000 through HD 6000 series open-source driver, he’s enabled support for another GL4 extension.

• Marek Olšák’s latest project has been adding support for multi-context applications to the Gallium3D Heads-Up Display (HUD).

Benchmarks

• Here’s our latest Linux distribution comparison with this time looking at the out-of-the-box performance of six Linux distributions while running a range of enterprise/workstation-focused benchmarks while using two systems. One system is a high-end Core i9 7980XE desktop system and the other a Tyan 1U Xeon Scalable server with dual Xeon Gold 6138 processors.

• It’s been a while since last doing any Linux boot speed comparisons while this morning I have some numbers to share when looking at the boot performance from the Linux 4.6 kernel through Linux 4.15 Git to see how it’s changed over time,

• These tests were being done using a Lenovo ThinkPad X1 Carbon notebook using a mature Intel Broadwell CPU. Linux 4.6 through 4.15 Git was chosen since that’s as far back as the mainline kernel would work with this Ubuntu 17.10 user-space. Linux 4.5 and older would fail to boot.

• Last week we presented our initial benchmarks of the Intel Optane SSD 900P on Linux and it offers mighty performance potential for those using I/O heavy workloads thanks to the use of 3D XPoint memory. But is a solid-state drive like this really worth the price if you are just a Linux gamer? Here are some tests comparing load times and boot times between a HDD, SATA 3.0 SSD, NVMe SSD, and this 3D XPoint NVMe U.2 SSD.

Applications

• We have written on a couple of note-taking apps for developers before and one such app is Boostnote. Today, we have another note-taking app that is just as good and it goes by the name Medleytext.

• Medleytext is a free and open-source cross-platform note-taking application with functions aimed at developers. It features support for a handful of languages including Markdown, HTML, CSS, and JavaScript.

• As we already know: PulseAudio is a network sound server and works well with the Linux operating system.

• After switching your site to HTTPS, you probably want to test if resources such as images, slides, embedded videos and others, are correctly pointed to HTTPS protocol or displaying warnings about the insecure content on the pages. After some research I found a useful tool for this purpose, called insecuRes.

Instructionals/Technical

• In the September 2016 issue, I wrote an article called “Papa’s Got a Brand New NAS” where I described how I replaced my rackmounted gear with a small, low-powered ARM device—the Odroid XU4. Before I settled on that solution, I tried out a few others including a pair of Banana Pi computers—small single-board computers like Raspberry Pis only with gigabit networking and SATA2 controllers on board. In the end, I decided to go with a single higher-powered board and use a USB3 disk enclosure with RAID instead of building a cluster of Banana Pis that each had a single disk attached. Since I had two Banana Pis left over after this experiment, I decided to put them to use, so in this article, I describe how I turned one into a nice little backup server.

Games

• Another week, another load of Linux games currently on sale. Multiple game stores currently have big sales on! Each store link takes you directly to their Linux sales section.

• The Humble Store is giving away Brutal Legend for free right now, but you’ll need to act fast to grab it as the offer expires in just over one day’s time.

• A new release is available of the Lightweight Java Game Library 3 (LWJGL) that is popular among game developers using the Java programming language.

• Beamdog [Official Site] have officially announced their next revamp of a classic with Neverwinter Nights Enhanced Edition. I have it confirmed it will be on Linux too.

• Better late than never eh! I sometimes feel like that’s GOG’s motto for Linux. Anyway, the Linux version of Shadow Warrior Classic Redux is now available on GOG.

Desktop Environments/WMs

K Desktop Environment/KDE SC/Qt

• The talk by Jean-Baptiste Mardelle’s at Akademy 2017 is released along with many other interesting talks.

• Akademy is the annual world summit of KDE, one of the largest Free Software communities in the world. It is a free, non-commercial event organized by the KDE Community.

GNOME Desktop/GTK

• I took part in Codechef’s November Challenge (which stretched from 3rd till 13th of Nov.) intermittently solving some of the tough problems (not necessarily quickly) to keep a track of my progress and increase my comfort in solving problems in a long contest setting.

Distributions

New Releases

• LibreELEC 8.2.1 is a maintenance release that includes Kodi 17.6. It also resolves a minor time-zone issue after recent daylight saving changes, a resume from suspend issue with the Apple IR driver, and it provides two new SMB client configuration options in Kodi settings. You can now set a minimum SMB protocol version to prevent prevent SMB1 from ever being used, and a ‘legacy security’ option forces weak authentication to resolve issues seen with the USB sharing functions on some older router/NAS devices. If updating to LibreELEC 8.2 for the first time PLEASE READ THE RELEASE NOTES below here before posting issues in the forums as there are disruptive changes to Lirc, Samba, and Tvheadend.

• The LibreELEC 8.2.1 update is based on the latest Kodi 17.6 “Krypton” open-source and cross-platform media center software and it mostly patches some Samba (SMB) “file exists” share errors on Windows 10 Fall Creators Update by updating the protocol to Samba 4.6.10, implementing SMB client options for minimum SMB protocol and an SMB legacy security option with NTLMv1, and disabling SPNEGO.

• “LibreELEC 8.2.x includes changes that allow the Kodi SMB client and our embedded Samba server to support SMB2/3 connections; deprecating SMB1 to improve security and performance. This is necessary to cope with changes Microsoft introduced in the Windows 10 ‘Fall Creators Update’ to resolve SMB1 security issues,” explained the developers.

• LibreELEC is a fantastic open source Linux-based operating system designed to run Kodi. It is particularly well suited for devices like Raspberry Pi. If you want to build your own Kodi box, it’s ideal.

• Today, the LibreELEC team releases a new build that it expects will be the last from the current branch — going forward the focus will be firmly on LibreELEC (Leia) 9.0 development.

Slackware Family

• I have uploaded my November ’17 set of Plasma 5 packages for Slackware 14.2 and -current. KDE 5_17.11 contains: KDE Frameworks 5.40.0, Plasma 5.11.3 and Applications 17.08.3. All based on Qt 5.9.2 for Slackware-current and Qt 5.7.1 for Slackware 14.2. For Slackware -current there’s again a choice of ‘latest‘ and ‘testing‘ where the ‘testing’ repository contains 17 recompiled packages that provide a Wayland compositor stack. This means you have a working Plasma5 Wayland session if you use ‘testing‘ as opposed to ‘latest‘.

• The ‘testing‘ repository is for… testing. Do not use those packages on a production environment unless you are familiar with Slackware, debugging graphical sessions and know your way around slackpkg/slackpkg+.

Red Hat Family

• Group of Technology Companies (GTech), the industry body for IT companies in Kerala, has signed an MoU with Red Hat, a leading global open source software company.

• The aim is to create enhanced awareness on various open source technologies amongst IT professionals in the state, a spokesman for GTech said.

• Red Hat wants to be your AWS hybrid cloud and container company as well your Linux provider.

• Red Hat Inc. is adding native integration with many of Amazon Web Services Inc.’s cloud services to its OpenShift Container Platform.

• The OpenShift Container Platform is Red Hat’s on-premises private platform-as-a-service product, built around a core of application containers powered by Docker, with orchestration and management provided by Kubernetes, on a foundation of Red Hat Enterprise Linux.

Finance

Debian Family

Derivatives

Canonical/Ubuntu

• The update is a major one patching a total of 13 security flaws, including race conditions in Linux kernel’s ALSA subsystem, the packet fanout implementation, and the key management subsystem, as well as use-after-free vulnerabilities in both the USB serial console driver and the ALSA subsystem.

• Various other issues were also patched for Linux kernel’s key management subsystem, the Ultra Wide Band driver, the ALSA subsystem, the USB unattached storage driver, and the USB subsystem, which received the most attention in this update as several security flaws were recently disclosed.

• As computing at the edge grows, so does the need to connect a flurry of IoT devices directly into a device that can do advanced analytics and processing. The whole journey from prototype to production is often bumpy, having to switch from a tangle of wires and development boards to production hardware: portability issues, lack of performance and so on. To help address this, Canonical is working with Intel, Arduino, AAEON and SEEED to deliver the UP² Grove IoT development kit. In short, it has the simplicity of development of Ubuntu Server, the connectivity options of Arduino, the community support of these 2 ecosystems and a clear path to production with support for the board and the software stack.

• The highlight of this week was the release of LXD 2.20 which introduces a number of exciting new features.

• LXD 2.20 should now be available everywhere through both native packages and snap. We also started the process of deprecating the various LXD PPAs, see below for details.

Devices/Embedded

• Pimloc’s “Pholio” runs Linux on an Nvidia Tegra, and provides offline storage and search of images and video using visual and face recognition.

• Digital imaging has lived up to its promise of making it easier to take more images more quickly, but the promise that it would make it easier to find those images has fallen short. Unless you spend time with an image management package and apply tags to each and every photo, it’s a pain to try to find specific images or groups of images. A new Kickstarter project called Pholio promises to skip the prep work and use visual recognition technology to quickly locate any image or video you seek.

Tizen

Android

Free Software/Open Source

• Diversity and inclusivity in the technology industry—and in open source communities more specifically—have received a lot of coverage, both on Opensource.com and elsewhere. One approach to the issue foregrounds arguments about concepts that are more abstract—like human decency, for example.

• But the “supply chain” metaphor works, too. And it can be an effective argument for championing greater inclusivity in our open organizations, especially when people dismiss arguments based on appeals to abstract concepts. Open organizations require inclusivity, which is a necessary input to get the diversity that reduces the risk in our supply chain.

• Getting involved in the open source projects that matter to a company, in other words, gives them more ability to influence their future today, even as dependence on a vendor results in putting one’s future in the hands of that vendor to resolve on their timetable. It’s simply not smart business, not if an open source alternative exists and your company already depends upon it.

• In sum, the GitHub contributor counts should be much higher, and not merely for those in the business of selling software (or tech, generally). Any company defined by software—and that’s your company, too—needs to get more involved in both using and contributing open source software.

• Just as a mainframe from decades ago might be ready for retirement, the IT staff who originally procured and installed that system might also be preparing for a new phase in their lives. It’s up to the current and next generation of government IT employees to prepare for that eventuality, but there are indications they may not be ready, despite evidence that older IT professionals are retiring or will soon be leaving their positions.

• Unfortunately, a skills gap exists even among younger generation IT workers. Agencies are scrambling to find personnel with expertise in cloud service management, cybersecurity, technical architecture and legacy technologies, such as common business-oriented language (COBOL) and mainframes, among other areas. At the same time that many workers are getting ready to retire, leaving behind a wealth of knowledge, many younger IT professionals are struggling to gain the knowledge they will need to take their agencies into the future.

• Fn, a new serverless open source project was announced at this year’s JavaOne. There’s no risk of cloud lock-in and you can write functions in your favorite programming language. “You can make anything, including existing libraries, into a function by packaging it in a Docker container.” We invited Bob Quillin, VP for the Oracle Container Group to talk about Fn, its best features, next milestones and more.

Events

• I had attended to Tokyo area debian seminar #157. The day’s special guest is Chris Lamb, the Debian Project Leader in 2017. He had attended to Open Compliance Summit, so we invited him as our guest.

SaaS/Back End

• Overclock Labs wants to make it easier for developers to deploy and manage their applications across clouds. To do so, the company is building tools to automate distributed cloud infrastructure and, unsurprisingly, it is betting on containers — and specifically the Kubernetes container orchestration tools — to do this.

• Today, Overclock Labs, which was founded two years ago, is coming out of stealth and announcing that it raised a $1.3 million seed round from a number of Silicon Valley angel investors and CrunchFund — the fund that shares a bit of its name and history with TechCrunch but is otherwise completely unaffiliated with the blog you are currently reading.

Databases

• MariaDB® Corporation, the company behind the fastest growing open source database, today announced new product enhancements to MariaDB AX, delivering a modern approach to data warehousing that enables customers to easily perform fast and scalable analytics with better price performance over proprietary solutions. MariaDB AX expands the highly successful MariaDB Server, creating a solution that enables high performance analytics with distributed storage and parallel processing, and that scales with existing commodity hardware on premises or across any cloud platform. With MariaDB AX, data across every facet of the business is transformed into meaningful and actionable results.

Pseudo-Open Source (Openwashing)

• AT&T says it’s not enough to deploy white box hardware and to orchestrate its networks with the Open Network Automation Platform (ONAP) software. “Each individual machine also needs its own operating system,” writes Chris Rice, senior vice president of AT&T Labs, Domain 2.0 Architecture, in a blog post. To that end, AT&T announced its newest effort — the Open Architecture for a Disaggregated Network Operating System (dNOS).

BSD

FSF/FSFE/GNU/SFLC

• Feature development on the GCC 8 compiler is over with it now entering stage three of its development process.

• SUSE’s Richard Biener announced minutes ago that GCC 8 entered stage three development, meaning only general bug fixing and documentation updates are permitted.

Public Services/Government

Licensing/Legal

• Mastodon was always known to be tough on Nazis; it was known that they were strict on free speech only to a degree. After the treatment that I received yesterday, however, I can no longer recommend Mastodon. It may be Free software, but it’s very weak on free speech.

• Two organizations founded to help and support developers of free and open-source software have locked horns in public, betraying a long-running quarrel rumbling mostly behind the scenes.

• On one side, the Software Freedom Law Center, which today seeks to resolve licensing disputes amicably. On the other, the Software Freedom Conservancy, which takes a relatively harder line against the noncompliance of licensing terms.

• The battleground: the, er, US Patent and Trademark Office. The law center has demanded the cancellation of a trademark held by the conservancy.

Openness/Sharing/Collaboration

Open Hardware/Modding

• Alex Williams pulled off an incredible engineering project. He developed an Autonomous Underwater Vehicle (AUV) which uses a buoyancy engine rather than propellers as its propulsion mechanism and made the entire project Open Source and Open Hardware.

Programming/Development

• A few days ago, there was a flash-in-the-pan controversy over Google “forking” Apple’s open-source programming language Swift. After a few minutes of speculation over whether Google was going to make its own special flavor of the language for its own purposes, Swift’s creator Chris Lattner (who now works at Google) helpfully clarified the situation:

• This are numerous articles and opinions on the topic, including Brilliant Jerks Cost More Than They Are Worth, and It’s Better to Avoid a Toxic Employee than Hire a Superstar. My colleague Justin Becker is also giving a talk at QConSF 2017 on the topic: Am I a Brilliant Jerk?.

• It may help to clarify that “brilliant jerk” can mean different things to different people. To illustrate, I’ll describe two types of brilliant jerks: the selfless and the selfish, and their behavior in detail. I’ll then describe the damage caused by these jerks, and ways to deal with them.

• The following are fictional characters. These are not two actual engineers, but are collections of related traits to help examine this behavior beyond the simple “no asshole rule.” These are engineers who by default act like jerks, not engineers who sometimes act that way.

• You started hacking on technology thrilled with every stroke of the key, making discoveries with every commit. You went about solving problems, finding new challenges. You were happy for a while, until you hit a plateau. There was a choice to be made. Continue solving the same problems or start managing others. You tried it out, and hated it. Longing to focus on technology, not people, you turned to your open source project. When it became successful, you became an open source maintainer but ended up overwhelmed and burned out. Hoping to get back to doing work that fascinates you, you went work for yourself. Lacking experience running a business, you’re crushed with all the decisions you need to make. You’re nearing burnout — again. It feels like you’re on a hamster wheel.

• Regular expressions inspire fear in new and experienced programmers alike. When I first saw a regular expression — often abbreviated as “regex” — I remember feeling dizzy from looking at the litany of parentheses, asterisks, letters, and numbers. Regular expressions seemed nonsensical, impenetrable.

• Online transportation company Uber has released its open sourced Pyro – a homegrown probabilistic programming language that has been developed internally.

• A maintenance release 0.3.3.3.1 of RcppEigen is now on CRAN (and will get to Debian soon). It brings Eigen 3.3.* to R.

Leftovers

Science

Hardware

• In another consolidation move in the semiconductor industry, chipmaker Marvell Technology announced it will acquire competitor Cavium Inc. for approximately $6 billion. It’s estimated that the combined company will generate about $3.4 billion in annual revenue.

Health/Nutrition

• The tasty Japanese seaweed nori is ubiquitous today, but that wasn’t always true. Nori was once called “lucky grass” because every year’s harvest was entirely dependent on luck. Then, during World War II, luck ran out. No nori would grow off the coast of Japan, and farmers were distraught. But a major scientific discovery on the other side of the planet revealed something unexpected about the humble plant and turned an unpredictable crop into a steady and plentiful food source.

• Nori is most familiar to us when it’s wrapped around sushi. It looks less familiar when floating in the sea, but for centuries, farmers in Japan, China, and Korea knew it by sight. Every year, they would plant bamboo poles strung with nets in the coastal seabed and wait for nori to build up on them.

• The tens of thousands of American deaths from drug overdoses are a measure of the hopeless desperation left behind by the soul-starving socio-economic system of late-stage capitalism, writes poet Phil Rockstroh.

• The NHS has lost the equivalent of 1,000 full-time GPs in the past year as workload pressures and funding squeezes drive out senior doctors who are increasingly looking for flexible freelance work.

• Official figures for GP numbers in England show that numbers collapsed by 3.5 per cent since September 2016, from 34,495 full-time equivalent GPs to 33,302 in September this year.

• While there are around 41,324 doctors working in general practice, 500 fewer than two years ago, the pressures of the job mean they are increasingly working less than the NHS definition of “full-time”.

Security

• An unknown hacker group has been targeting Middle Eastern countries as well as others such as India, Pakistan, US and Georgia as part of what appears to be a massive cyber-espionage campaign. On Monday (20 November), the Saudi Arabian government’s national cyber security center reportedly confirmed that the kingdom had been targeted by hackers since February.

• The hacker group, dubbed MuddyWater, used fake documents, purporting to be from the NSA, Russian cybersecurity firm Kasperksy and the Iraqi government, among others, to trick victims into clicking on malicious documents. Security experts at Palo Alto Networks, who uncovered the campaign, said that the hackers are making use of a PowerShell-based first-stage backdoor called “POWERSTATS”.

• Far too many companies and industries out there seem to think that the best way to handle a security researcher finding security holes in their tech and websites is to immediately begin issuing threats. This is almost always monumentally dumb for any number of reasons, ranging from the work these researchers do actually being a benefit to these companies issuing the threats, to the resulting coverage of the threats making the vulnerabilities more widely known than they would have been otherwise.

• Linux overlord Linus Torvalds has offered some very choice words about different approaches security, during a discussion about whitelisting features proposed for version 4.15 of the Linux kernel.

• Torvalds’ ire was directed at open software aficionado and member of Google’s Pixel security team Kees Cook, who he has previously accused of idiocy.

• Cook earned this round of shoutiness after he posted a request to “Please pull these hardened usercopy changes for v4.15-rc1.”

• Ten thousand dollars is more than $3,000, so the motives don’t add up for me. Hutchins may or may not have written some code, and that code may or may not have been used to commit a crime. Tech-literate people, such as the readers of Linux Magazine, understand the difference between creating a work and using it to commit a crime, but most of the media coverage – in the UK, at least – has been desperate to follow the paradigm of building a man up only to gleefully knock him down. Even his achievement of stopping WannaCry is decried as “accidental,” a word full of self-deprecating charm when used by Hutchins, but which simply sounds malicious in the hands of the Daily Mail and The Telegraph.

• Researchers working at Russian cyber security firm Dr Web claim to have found a new vulnerability that enables remote attackers to crack Linux installations virtually unnoticed.

• According to the anti-malware company, cyber criminals are getting into the popular open-source operating system via a new backdoor.

• This, they say, is “indirect evidence” that cyber criminals are showing an increasing interest in targeting Linux and the applications it powers.

• The trojan, which it’s calling Linux.BackDoor.Hook.1, targets the library libz primarily. It offers compression and extraction capabilities for a plethora of Linux-based programmes.

• The guidelines are intended to reduce risks in low-budget local races as well as the high-stakes Congressional midterm contests next year. Though most of the suggestions cost little or nothing to implement and will strike security professionals as common sense, notorious attacks including the leak of the emails of Hillary Clinton’s campaign chair, John Podesta, have succeeded because basic security practices were not followed.

• On Monday, the chipmaker released a security advisory that lists new vulnerabilities in ME, as well as bugs in the remote server management tool Server Platform Services, and Intel’s hardware authentication tool Trusted Execution Engine. Intel found the vulnerabilities after conducting a security audit spurred by recent research. It has also published a Detection Tool so Windows and Linux administrators can check their systems to see if they’re exposed.

Defence/Aggression

• In one of the most glaring, power-serving omissions in some time, CBS News’ 60 Minutes (11/19/17) took a deep dive into the humanitarian crisis in Yemen, and did not once mention the direct role the United States played in creating, perpetuating and prolonging a crisis that’s left over 10,000 civilians dead, 2 million displaced, and an estimated 1 million with cholera.

• Correspondent Scott Pelley’s segment, “When Food Is Used as a Weapon,” employed excellent on-the-ground reporting to highlight the famine and bombing victims of Saudi Arabia’s brutal two-and-a-half year siege of Yemen. But its editors betrayed this reporting—and their viewers—by stripping the conflict of any geopolitical context, and letting one of its largest backers, the United States government, entirely off the hook.

• [...]

• To compound the obfuscation, 60 Minutes doesn’t just omit the US role in the war, it paints the US as a savior rescuing its victims. The hero of the piece is American David Beasley, the director of the UN’s World Food Programme, the organization coordinating humanitarian aid. “The US is [the World Food Programme]’s biggest donor, so the director is most often an American. Beasley was once governor of South Carolina,” Pelly narrates over B-roll hero shots of Beasley overseeing food distribution.

Environment/Energy/Wildlife/Nature

• On Monday, the Nebraska Public Service Commission issued its final order (PDF) on the fate of energy company TransCanada’s controversial Keystone XL pipeline. The commission conditionally approved the pipeline, but it ordered the pipeline to be moved east of Nebraska’s ecologically sensitive Sandhills region.

• The condition sets up a hurdle for TransCanada—now the company needs to seek the approval of different local landowners, according to The Washington Post. Still, the approval likely means Keystone XL will be able to deliver tar sands crude oil from Alberta, Canada to refineries in Texas in the near future. Reuters called the Nebraska approval “the last big regulatory obstacle” to the completion of the pipeline.

• Despite extremely dangerous levels of air pollution smothering Delhi and creating “gas chamber” conditions, thousands took to the streets to run a half marathon Sunday. Most ran without masks that would filter out harmful pollution.

• Over half a billion years ago, during the Cambrian geological period, life on Earth started to get a lot more interesting. Thanks to the rise in free oxygen generated mostly by photosynthesizing algae, lifeforms could draw much more energy out of the environment. That meant the rise of multicellularity and the beginnings of a world full of the macro-sized plants and animals we know and love. That moment, full of weird-ass animals like Anomalocaris, is called the Cambrian Explosion.

• The Cambrian Explosion gets a lot of play because it was the first time multicellular creatures ruled the planet. What few people (other than geologists and paleontologists) realize is that there was an even crazier time for early life. It came during the Ordovician period, right after the Cambrian came to a close 485 million years ago. The Ordovician Radiation, also called the Great Ordovician Diversification Event (GOBE), saw a quadrupling of diversity at the genus level (that’s the category one step above species). Life also started occupying new ecological niches, clinging to plants floating in the ocean’s water column and burrowing deep into the seabed.

Finance

• Nearly 60 percent of U.S. bank customers are willing to try a financial product from tech firms they already use, according to a survey conducted by consultant Bain & Co. For younger respondents, the interest was especially high. About 73 percent of people age 18 to 34 said they would try a tech firm’s credit card, deposit account, investment or mortgage.

• A lot has happened on Brexit in recent weeks and this post sets out what some general views as to where we are now in this adventure (or misadventure, depending on taste).

• There is one thing which is more likely than not: the United Kingdom will, by automatic operation of law, cease to be a member of the European Union on 29 March 2019.

• This is regardless of there being a deal or not.

• Mining requires huge amounts of electricity, and Golix says that energy prices in the region are simply too high to make the process cost effective.

• The surge has been fueled by Zimbabwean investors seeking a safe haven from domestic banks amid the country’s ongoing political, financial and monetary woes. While Zimbabwe once had its own currency, it began using a mix of currencies from stable economies including the U.S. dollar in 2009 after hyperinflation made its own note nearly worthless.

• According to Golix, it has processed over $1 million worth of transactions in the past 30 days, a sharp increase from its turnover of $100,000 for the entire year of 2016.

• According to Golix co-owner Taurai Chinyamakobvu, the prices for Bitcoin are determined by supply and demand. The sellers of the digital currency are paid in US dollars that are deposited electronically. The money, however, can only be converted into hard cash at a sizeable discount on the black market.

• The agency sent in criminal investigation agents with search warrants for computer files and any paperwork related to sales of foreign drugs. The agents also took files on customers and the stores’ financial records. They left behind a letter for store owners to sign, acknowledging that the practice of importing foreign medicines is illegal.

• Although none of the stores has closed due to the activity, the owners are spooked by the turn of events—and puzzled by the timing.

• Bill Hepscher, co-owner of Canadian MedStore, which owns six of the nine raided storefronts, said that the FDA’s actions “worr[y]” him. For years, his stores have helped patients with valid prescriptions order the medicines they need at steeply discounted prices compared with those in the States. The stores don’t dispense the drugs, rather they simply arrange for the medicines to be delivered directly to the customers’ homes. Hepscher estimates that he has about 10,000 customers a year.

• A few weeks ago, we wrote how many — even the US Trade Representative, Robert Lighthizer — seem to think it’s time for corporate sovereignty, also called “investor-state dispute settlement” (ISDS), to go. For some reason the European Commission disagrees. As Techdirt readers may recall, after receiving a bloody nose in a public consultation about corporate sovereignty, the Commission announced to great fanfare that it was “replacing” ISDS with something called the Investment Court System (ICS). In fact, this amounted to little more than putting lipstick on the ISDS pig, since ICS suffered from the same fundamental flaw: it gave companies unique rights to sue countries in a supra-national court. T

• Lawyers representing Molly and Jolyon Maugham of the Good Law Project have written again to David Davis and Philip Hammond giving them 14 days to release in full government studies into the economic impacts of Brexit. If they refuse to make the documents publicly available, they will start judicial review proceedings in the High Court.

• The letter points to the fact that, following a Labour motion which pressed the government into agreeing to release the documents to a government committee, recent government statements ‘leaves it wholly uncertain what information will be made public, and when’.

• Molly and Jolyon Maugham QC are demanding that 58 sectoral impact studies be released as well as a Treasury report comparing the predicted economic impacts of Brexit with potential benefits of alternative free trade agreements. They say the information must be made publicly available in its entirety without redaction.

• One of the world’s biggest logistics companies, whose clients include Rolls-Royce, Airbus and Primark, has said it is “bordering on insanity” to think new Brexit customs systems will be in place for 2019.

• Leigh Pomlett, the executive director of CEVA Group, which specialises in road, air and ocean-going freight, said Downing Street and the Treasury did not understand how difficult it would be to have a system in place in 15 months’ time, when the UK leaves the EU.

• “It is just the urgency of this that worries me. It takes me longer to negotiate a supply chain contract than we have here. Arguably, it is already too late,” he said.

• CEVA employs 6,000 people in the UK and counts supermarkets, car manufacturers, food producers and pharmaceutical companies including GlaxoSmithKline among its clients.

Censorship/Free Speech

• Earlier this year we wrote about the EFF going to court in California to protect it against an Australian patent troll, GEMSA, who objected to EFF naming a GEMSA patent one of EFF’s “Stupid Patents of the Month.” Apparently GEMSA sued in Australia, didn’t properly serve EFF, and then got an injunction in Australia, which it threatened to enforce in California. EFF went to court using the all important SPEECH Act, which bars foreign judgments from being enforced in the US if they are in conflict with the First Amendment.

• GEMSA, perhaps not surprisingly, declined to show up in the California court, leading EFF to move for default. A magistrate judge initially recommended against this, arguing that the court did not have personal jurisdiction over GEMSA. EFF asked the court to try again, and in a extraordinarily detailed and careful ruling, Judge Jon Tigar rejects the magistrate’s recommendation and gives EFF the default judgment it sought. We’ve complained in the past that often the problem with default judgments is that courts are only too willing to just grant them if one party declines to show up for the case. This is not one of those situations. Tigar goes out of his way to explore pretty much every possible argument that GEMSA might have for why the court shouldn’t have jurisdiction, for why the SPEECH Act should not apply and for why EFF’s post may have been defamatory. And one by one by one, he points out why GEMSA is wrong and EFF is right. I won’t repeat all the reasoning here, in part because there are so many different elements, though it’s a fun and quick read in the filing.

• Victoria’s Secret staff are said to believe their emails are being watched. To which seasoned business travellers to China might respond: why do you think we’ve been carrying burner phones and disposable laptops there for years?

• Earlier this year, we mentioned the Texas lawyer Jason Lee Van Dyke in relation to a story in which Twitter, ridiculously, banned Ken “Popehat” White after he wrote about threats from Van Dyke. We had written about Van Dyke years earlier when he sued the Tor Project because a revenge porn site was using Tor. We also noted that that case involved a guy who had been declared the leader of a hate group, Kyle Bristow — and appeared to involve Van Dyke deliberately and knowingly “serving” the wrong party. The revenge porn site that Van Dyke claimed he was targeting had sarcastically provided Bristow’s address as its address to mock Van Dyke, and Van Dyke then claimed he had properly “served” the revenge porn site by serving it on Bristow.

• Orchid Labs, a company headquartered in San Francisco, has launched the private alpha version of its blockchain-based Orchid network, which is said to allow users to access the Internet free of censorship, restrictions and surveillance.

• A cloud of concern seems to hang around the International Film Festival in Goa — regarding increasing film censorship and no reason for banning films this year (so far three films have been dropped from IFFI: S Durga, Nude, Saawan).

• There’s little more chilling to First Amendment freedoms than the possibility of spending decades in jail for documenting a protest that turned into a riot. But that’s exactly what independent journalist Alexi Wood is facing. Traveling from Texas to Washington DC to document anti-Trump protests on Inauguration Day, Wood was “kettled” and arrested along with the protestors he was covering. He wasn’t the only journalist to be detained for hours and hit with charges, but most of the others have seen their charges dismissed.

• Ulysses is a book that has inspired books. Indeed, there is something of a Ulysses industry, with books dedicated to the controversies around the publication and the numerous court cases instigated by it. Yet despite the fuss over the printed word, it was the 1967 film version of the tale which shocked Irish sensibilities most. Denounced by the authorities as being ‘subversive to public morality’, it remained banned in Ireland for more than three decades, having the dubious honour of the longest film ban in the history of the Irish state. The film proved controversial globally, even inspiring a walkout protest at the Cannes Film Festival, with the audience of critics who booed the film denounced as ‘illiterates’ by a festival official. The use of the word ‘fuck’, coupled with a nude man shown from behind, was too much for some.

• Alphabet Inc. chairman says DPRK would be less dangerous opponent if “better connected to the world”

• “Good to have Google on record as defying all logic and reason: facts aren’t allowed if they come from RT,” said Editor-In-Chief Margarita Simonyan.

• In the face of an ongoing outcry regarding alleged Kremlin meddling in U.S. electoral processes, Alphabet’s Executive Chairman Eric Schmidt said that the parent company to Google News would begin to reduce the presence of Russian state-owned media sites that had previously been given normal placement on the search company’s news and advertising sites.

Privacy/Surveillance

• The Delhi High Court at the end of October allowed Ericsson’s request to create a confidentiality club to limit access to documents in a patent dispute with Xiaomi.

• Before the year’s end Congress needs to decide what it’s going to do about Section 702 of the Foreign Intelligence Surveillance Act (FISA), which permits the federal government to engage in surveillance of foreign targets that are not on U.S. soil, secretly and without warrants.

• Section 702 amendments sunset at the end of the year if Congress does not act to renew it. These amendments were originally passed in 2008 and renewed in 2012.

• The US Congress still hasn’t passed any legislation to reign in what critics call “warrantless surveillance” of US citizens by the nation’s multiple spy agencies. But there are now five proposals on the table aimed in that direction.

• The latest, introduced last week, is the Senate version of the USA (United and Strengthening American) Liberty Act of 2017, which at least some privacy advocates say is a marked improvement over a House bill of the same name that was introduced in early October 2017.

• Several bills that would extend the US government’s ability to grab and search vast numbers of communications without a warrant – including users’ data from companies such as Google and Facebook – are marching toward passage in Congress with little public attention or debate.

• US law currently allows these activities under Section 702 of the Foreign Intelligence Surveillance Act, which was adopted in 2008. As former National Security Agency contractor Edward Snowden revealed, Section 702 is the basis for two enormous warrantless snooping programs: one in which the government demands communications from US-based internet companies, and one in which it allegedly scans massive amounts of the internet traffic that flows between the US and other countries. Although the government cannot legally target people in the US for this monitoring, it scoops up untold quantities of their correspondence “incidentally.”

• Have you ever typed something into a search box on a website and then thought better of it? New research shows that 482 sites may be passing on that information anyway.

• We have long known that information we provide online can be tracked. A website you visit might have hundreds of scripts running in the background; some deposit cookies, others track you to other websites. The variety of tracking tools mean it is almost impossible to know what happens to your data when you visit a site.

• But all of these seem tame compared with what Steven Englehardt and his colleagues at Princeton University found after combing through hundreds of websites to examine the scripts they were running: the widespread use of a type of script, called a session replay, that logs everything you do on a website, including what you type…

• If you have the uncomfortable sense someone is looking over your shoulder as you surf the Web, you’re not being paranoid. A new study finds hundreds of sites—including microsoft.com, adobe.com, and godaddy.com—employ scripts that record visitors’ keystrokes, mouse movements, and scrolling behavior in real time, even before the input is submitted or is later deleted.

• Session replay scripts are provided by third-party analytics services that are designed to help site operators better understand how visitors interact with their Web properties and identify specific pages that are confusing or broken. As their name implies, the scripts allow the operators to re-enact individual browsing sessions. Each click, input, and scroll can be recorded and later played back.

• Consider this: Deputy Attorney General Rod Rosenstein has been going around talking about “responsible encryption” for some time now— proselytizing for encryption that’s somehow only accessible by the government—something we all know to be unworkable. If the Department of Justice (DOJ) is taking this aggressive public position about what kind of access it should have to user data, it begs the question—what kind of technical assistance from companies and orders for user data is the DOJ demanding in sealed court documents? EFF’s client The Stranger, a Seattle-based newspaper, has filed a petition with one court to find out.

• A Brooklyn judge has ruled that the police need an eavesdropping warrant to covertly track the cellphones of criminal suspects, raising the bar in New York for the use of a surveillance device that is facing challenges across the United States.

• The company’s introduction of its white spaces on the island comes as it makes moves to expand the technology to rural parts of the U.S., where [I]nternet service have not kept pace with urban and suburban areas.

• The more data it has on offer, the more value it creates for advertisers. That means it has no incentive to police the collection or use of that data — except when negative press or regulators are involved. Facebook is free to do almost whatever it wants with your personal information, and has no reason to put safeguards in place.

Civil Rights/Policing

• It’s been barely a month since news came to us of the Worth County (GA) Sheriff’s Department’s search of an entire school’s worth of high school students. Over 800 students were searched without a warrant, subjected to invasive pat downs that included breasts and genitals by Sheriff Jeff Hobby and his deputies.

• Sheriff Hobby thought there might be drugs in the school, but despite the search of hundreds of students and the use of drug dogs, no drugs were found. A class action lawsuit [PDF] alleging multiple rights violations brought by some of the students was filed in June. In October, Sheriff Hobby and two of his deputies were indicted for sexual battery and false imprisonment.

• More than 70 British MPs have pledged support for Lauri Love, an alleged computer hacker currently battling extradition to the US – where he faces up to 99 years in prison.

• A letter sent on 17 November, addressed to UK prime minster Theresa May and attorney general Jeremy Wright QC, argued Love should be tried for any alleged crimes in the UK.

• In a speech on Friday, the attorney general signaled that he will rescind more civil rights guidance from the Obama era.

• On Friday, Attorney General Jeff Sessions strongly hinted that he isn’t done trying to roll back the civil rights gains made during the Obama administration.

• In a speech before the conservative Federalist Society’s National Lawyers Convention, Sessions described an internal Justice Department memo he signed prohibiting his department from issuing “improper” guidance documents. According to the document, “Effective immediately, Department components may not issue guidance documents that purport to create rights or obligations binding on persons or entities outside the Executive Branch (including state, local, and tribal governments). The document also stated the Justice Department will no longer issue guidance that “effectively bind private parties without undergoing the rulemaking process.”

• Behind this bureaucratic language is an attack on the civil rights legacy of the Obama-era Justice Department. Throughout the Obama administration, the Department of Justice worked with state and local governments to protect civil rights and liberties by suggesting practical ways, for example, to eliminate gender bias in policing, legally enforce fines and fees, and dismantle the school to prison pipeline. Sessions has indicated that he may “repeal and replace” these policies, which will roll back important efforts to ensure equal protection for all under the law.

Internet Policy/Net Neutrality

• As the Federal Communications Commission (FCC) gets ready to abandon a decade of progress on net neutrality, some in Congress are considering how new legislation could fill the gap and protect users from unfair ISP practices. Unfortunately, too many lawmakers seem to be embracing the idea that they should allow ISPs to create Internet “fast lanes” — also known as “paid prioritization,” one of the harmful practices that violates net neutrality. They are also looking to re-assign the job of protecting customers from ISP abuses to the Federal Trade Commission.

• These are both bad ideas. Let’s start with paid prioritization. In response to widespread public demand from across the political spectrum, the 2015 Open Internet Order expressly prohibited paid prioritization, along with other unfair practices like blocking and throttling. ISPs have operated under the threat or the reality of these prohibitions for at least a decade, and continue to be immensely profitable. But they’d like to make even more money by double-dipping: charging customers for access to the Internet, and then charging services for (better) access to customers. And some lawmakers seem keen to allow it.

• The Trump administration’s Department of Justice (DOJ) today filed a lawsuit to block AT&T’s proposed acquisition of Time Warner Inc.

• AT&T has been the nation’s largest pay-TV company since it acquired DirecTV in 2015. Acquiring Time Warner and its stable of popular TV programming would give the company too much control over programming and distribution, the DOJ said.

• Together, AT&T and Time Warner would attempt to impede competition from online video distributors and raise prices on rivals that want access to Time Warner programming, the DOJ alleged.

• When Charter Spectrum acquired Time Warner Cable and Bright House Networks in a blockbuster $69 billion merger last year, the company promised the deal would result in all manner of “synergies” and consumer benefits. But as is the case with most telecom megamergers, most of these acquired users say the deal only resulted in significantly higher prices — and somehow even worse customer service than the historically awful service the company was already known for. In many areas, users say they’ve been socked with price hikes up to 40% for the exact same service.

• The news of the proposal — expected to be unveiled on Tuesday — drew immediate criticism from public interest groups. They warn that the removal of the regulations will invite telecom companies to block or throttle traffic, or to sell “fast lanes” to internet providers willing to pay for speedier access to the consumer. Fight for the Future, which has been waging a campaign to preserve the rules, has been warning that Pai will seek to eliminate most of the rules altogether.

• The FCC’s next meeting, where it votes on proposals, is December 14th. That’s when it’s expected to vote on its plan to reverse net neutrality. There’s no firm date on when the proposal will be announced, but the commission usually details its plans for each meeting several weeks ahead of time, and, as of this year, publicly reveals the text of what it’ll be voting on, too. Scheduling the net neutrality announcement for Thanksgiving week may be a coincidence, but it certainly seems like the FCC is trying to release this plan at a time when it’ll be harder for net neutrality advocates to give it their full attention.

• The important point, as we’ve said before, is that once the genie is out of the bottle, getting it back in is almost impossible and for our readers outside the US, don’t think this doesn’t affect you – everything that passes through US servers will be affected in some way and will knock on to you.

Intellectual Monopolies

Copyrights

• We’ve repeated this over and over again, but the Constitutional rationale for copyright is “to promote the progress of science” (in case you’re wondering about the “useful arts” part that comes after it, that was for patents, as “useful arts” was a term that meant “inventions” at the time). “Science” in the language of the day was synonymous with “learning.” Indeed, the very first US copyright law, the Copyright Act of 1790 is literally subtitled “An Act for the Encouragement of Learning.” Now, it’s also true that the method provided by the Constitution for the promotion of this progress was a monopoly right — locking up the content for a limited time. But the intent and purpose was always to promote further learning. This is why, for years, we’ve questioned two things: First, if the monopoly rights granted by copyright are hindering the promotion of learning, should they still be Constitutional? Second, if the goal is the promotion of learning, shouldn’t we be exploring if there are better methods to do that, which don’t involve monopoly rights and limiting access. And this, of course, leaves aside all the big questions about how much copyright has changed in the past 227 years.

• The UK’s Intellectual Property Office has today published advice on so-called ‘Illicit Streaming Devices’. Noting the importance of ensuring that copyright holders get paid, the IPO warns that ‘Kodi boxes’ and ‘Android TV boxes’ present a threat to child welfare while presenting an electrical safety hazard to the public. If you have one, you should wipe it clean now, the government says.

• Shani, the developer of the popular Kodi-addon ZemTV, is asking the public for help so he can defend a lawsuit filed by American satellite and broadcast provider Dish Network. A proper defense is needed to avoid a bad precedent, he stresses. “The fight is rigged against the little guy, they are trying to make something illegal that shouldn’t be illegal.”

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages. Permalink  Send this to a friend

----------

➮ Sharing is caring. Content is available under CC-BY-SA.