● 02.28.18

● Links 28/2/2018: X.Org Server 1.20, Falkon 3.0

Posted in News Roundup at 4:25 am by Dr. Roy SchestowitzContentsGNU/LinuxGNU/Linux

• After the demise of the Ubuntu Phone, Linux users appear to be placing their hopes for a mobile device on the Librem 5, a smartphone that managed to raise much more than it asked for in a crowd-funding drive. The company behind it, Purism, has said that it hopes to have phones ready next year.

• But it seems unlikely that the phone will have any kind of mass appeal. What seems more likely is that it will cater to a fringe market, putting its log-term viability in doubt.

• At least, those who are waiting for the Librem 5 are not deceiving themselves by pretending that Android phones are actually Linux phones, as the head of the Linux Foundation Jim Zemlin does.

• If you really believe in having the most possible control over your computer and operating system, then Purism, maker of free software and Linux-powered laptops, is the company for you.

• In its latest news, Purism announced that it has successfully integrated Trammel Hudson’s Heads security firmware into its Trusted Platform Module (TPM)-equipped Librem laptops. Heads is an open-source computer firmware and configuration tool that aims to provide better physical security and data protection.

• A decade passes so quickly. And yet, ten years for open source is half its life. How have things changed in those ten years? So much has happened in this fast-moving and exciting world, it’s hard to remember. But we’re in luck. The continuing availability of Linux Journal’s past issues and website means we have a kind of time capsule that shows us how things were, and how we saw them.

• Ten years ago, I was writing a regular column for Linux Journal, much like this one. Looking through the 80 or so posts from that time reveals a world very different from the one we inhabit today. The biggest change from then to now can be summed up in a word: Microsoft. A decade back, Microsoft towered over the world of computing like no other company. More important, it (rightly) saw open source as a threat and took continuing, wide-ranging action to weaken it in every way it could.

• Its general strategy was to spread FUD (fear, uncertainty and doubt). At every turn, it sought to question the capability and viability of open source. It even tried to convince the world that we no longer needed to talk about free software and open source—anyone remember “mixed source”?

• Alongside general mud-flinging, Microsoft’s weapon of choice to undermine and thwart open source was a claim of massive patent infringement across the entire ecosystem. The company asserted that the Linux kernel violated 42 of its patents; free software graphical interfaces another 65; the OpenOffice.org suite of programs, 45; and assorted other free software 83 more. The strategy was two-fold: first to squeeze licensing fees from companies that were using open source, and second, perhaps even more important, to paint open source as little more than a pale imitation of Microsoft’s original and brilliant ideas.

• While the average Chromebook user tends to stick with Chrome OS, Chromebooks are really just lightweight Linux machines capable of a lot more. For years, crafty Chromebook owners have been using Crouton (Chromium OS Universal Chroot Environment) to run Ubuntu, Debian, and Kali Linux systems within Chrome OS. When set up properly with an extension called Xiwi, you can use a keyboard shortcut to switch between Chrome OS and a standard Linux desktop environment. It’s a hack, but it looks a future version of Chrome OS will add native support for Linux applications via containers.

Desktop

• According to System76, the team is ready to deploy one of the biggest updates to Pop!_OS Linux’s HiDPI (High Dots Per Inch) daemon, which should be soon available for all of their customers running Pop!_OS Linux on any of the laptop or desktop computers bought from the computer reseller. The update will add a new and improved layout engine, as well as support for saving resolutions and layouts.

• “We are getting ready to release major updates to the HiDPI daemon for all System76 customers. The new release will include a new and improved layout engine, the ability to use saved layouts and resolutions, and several bug fixes,” said System76 in a blog post. “We are also working toward making the HiDPI daemon available in Pop!_OS and elsewhere. If you are interested in seeing HiDPI in action, please come see our booth at Scale!”

• Purism sells security-oriented Librem 13 and Librem 15 laptops running PureOS, a Linux-based operating system designed with security in mind and based on Debian GNU/Linux. Earlier this month, the company announced that they’ve managed to boot PureOS with the coreboot (formerly known as LinuxBIOS) open-source extended firmware platform, and all new laptop shipments with come with coreboot.

• Coreboot enables Purism’s Librem laptops to boot fast and offer users a secure boot experience. Today, Purism raises the bar on security by integrating Trammel Hudson’s Heads security firmware with TPM (Trusted Platform Module) support into their coreboot-enabled laptops, giving users full control over the boot process. In addition, users will be able to freely inspect the code, and even build and install it themselves.

• It’s common for Linux users to hop between distributions and survey the field, and I recently reached a point where I had to seriously rethink the one I was using most of the time.

• Between hardware compatibility issues with my old standby and some discouraging missteps with other go-to choices, I felt the time had come to reassess my pool of preferred distributions and repopulate it from scratch.

• As my journey progressed, I realized that as often as I’ve discussed the field of Linux-based systems, I had not addressed how to pick one out. To give you an idea of how to approach distribution selection, I wanted to volunteer my recent search as one template. This is certainly not the only or best way to go about it — everyone has their own criteria and priorities — but my intention is to provide some reference points for mapping out your own way.

Kernel Space

Linux Foundation

• The Linux Foundation, the nonprofit organization enabling mass innovation through open source, announced the addition of 36 Silver members and six Associate members. Linux Foundation members help support development of the greatest shared technology resources in history, while accelerating their own innovation through open source leadership and participation.

• Cloud native computing is transforming cloud architectures and application delivery at organizations of all sizes. Via containers, microservices, and more, it introduces many new efficiencies. One of the world’s leading experts on it, Adrian Cockcroft, Vice President of Cloud Architecture at Amazon Web Services (AWS), focused on cloud native computing within the context of AWS in his keynote address at KubeCon + CloudNativeCon.

• Helm can make deploying and maintaining Kubernetes-based applications easier, said Amy Chen in her talk at KubeCon + CloudNativeCon. Chen, a Systems Software Engineer at Heptio, began by dissecting the structure of a typical Kubernetes setup, explaining how she often described the basic Docker containers as “baby computers,” in that containers are easy to move around, but they still need the “mommy” computer. However, containers do carry with them all the environmental dependencies for a given application.

Graphics Stack

• Independent developer Mario Kleiner has spent the past several months working on plumbing the Linux graphics stack for better “deep color” or 30-bit color depth support. His latest work on the X.Org Server has now been merged to mainline.

• One big piece of Keith Packard’s work on improving Steam VR for Linux or particularly VR HMD handling is now merged to Git master.

• Keith’s work on RandR leases is now rounded out with the work hitting the X.Org Server Git tree today. RandR leases allows for CRTCs/outputs to be made available to a client for direct access via Linux’s KMS/DRM kernel APIs. When leased to a client, the output(s) are not in the way of the X.Org Server. The focus here is on allowing a VR compositor to have direct access to the VR head-mounted display without any X.Org Server interference.

• I’d like to call the (xfree86) ABI frozen in RC1, and I think for the remaining changes I’d like to see landed for 1.20 we can mostly land them without ABI breaks.

• Indeed it turns out that the landing today of RandR leases and deep color / color depth 30 support for GLAMOR/modesetting is because Red Hat’s Adam Jackson is finally wrangling the xorg-server 1.20 release together.

• No major X.Org Server release materialized in 2017 and the plans for releasing xorg-server 1.20 around January didn’t pan out. But out of the blue, Adam Jackson announced today that he is planning on the 1.20 RC1 release tomorrow, 28 February.

• The AMD developers working on their official, cross-platform “AMDVLK” Vulkan driver code have just pushed out another batch of changes to their open-source code repository.

• For those of you with a Radeon GCN 1.0 “Southern Islands” GPU, the RADV Vulkan driver support for these first Graphics Core Next graphics processors continues to be improved.

Applications

• When it comes to data safety and security, not only large companies, but also personal computer owners also need to have good backup and recovery software that protects their data from losing their precious data. To overcome these issue, there are a lot of open source backup software tools that are available that can help protect your data. And nowadays, computer desktops come with huge storage capacity and in turn it means lots of data being stored. This also leads to a huge risk of losing all the data if the system gets crashed and it may take several days and weeks to recover and repair the damage cause. Hence it is increasingly important to have a proper recovery solution with you all the time.

• Did your screen just turn black or your laptop freeze without warning? Maybe your hard drive has started chirping. Worse yet, maybe you suddenly can’t save to your home partition.

• All these signs of a corrupted or failing drive can cause you to sweat, but there’s no reason to immediately throw away your computer. Keep reading to learn about five Linux tools that can help you retrieve your data and get your digital life back on track.

• This article I will show you, tools which enabled you to access remote Desktop on machines running Centos/RHEL. All these apps works in client-server mode. So you need to run server side app on your remote machine and after that, you will be able to connect to it from all over the world. Of Course in this reference manual I will tell you how to configure this securely, so only you can access to your server. Before beginning, you only need SSH access to your server and rights to install software. You need to know root password or permissions to use sudo.

• Yesterday we have released CafeOBJ 1.5.7 with lots of changes concerning the inductive theorem prover CITP, as well as fixes to make CafeOBJ work with current SBCL. The documentation has gained a few more documents (albeit in Japanese), please see Documentation pages for the full list. The reference manual has been updated and is available as PDF, Html, or Wiki.

Proprietary

• Cloud Sticky Notes is a free, simple, and customizable Java-based sticky note-taking application. It is recognized by many people using Mac, Windows, and Linux OS since it runs on all three platforms, among others. It has a User Interface reminiscent of the famous Windows Sticky Notes app so it should be easy for anyone to get up and running with.

• You can add, edit, and delete notes while offline without any setbacks. Cloud Sticky Notes will automatically synchronize your data whenever you’re online so you will have no need to manually sync your data to the cloud.

Instructionals/Technical

Games

• Tannenberg [Steam], the WWI FPS that follows the Eastern Front is going to get an update sometime soon that should give a decent performance boost.

• Vaporum, a steampunk dungeon crawler from Fatbot Games has been officially released for Linux, available from both GOG and Steam. I’ve spent some time with it now and here’s some thoughts.

• Much like the initial full launch of Albion Online, the servers for Tale of Toast have been completely overloaded. Naturally, there’s a lot of upset gamers out there, some of which have waited for hours to still not get in.

• If you enjoyed the camp tactical RPG Chroma Squad [Official Site], get ready for more action as it now has a free Episode Creator and Steam Workshop support.

Desktop Environments/WMs

• Xfce is one of the most common desktop environments on Linux and other Unix-like systems. it’s fast, lightweight and gets the job done. However, Xfce developers announced their roadmap to Xfce 4.14 around 3 years ago, but we are still not there yet.

• In this report, we post the ongoing development of Xfce, what’s missing and what’s being worked on, and we highlight some aspects regarding the adorable DE.

K Desktop Environment/KDE SC/Qt

• Calamares is a distribution-independent system installer featuring advanced partitioning with full-disk encryption support used in popular GNU/Linux distros like KaOS, KDE Neon, OpenMandriva, Netrunner, Sabayon, Siduction, Tanglu, Bluestar Linux, Chakra GNU/Linux, GeckoLinux, and others.

• Calamares 3.2 will be the next major update of the universal installer framework, promising a plethora of attractive new features and enhancements for OS developers who want to implement it as default graphical installer in their next releases, such as Lubuntu Next 18.04 (Bionic Beaver).

• The first release of Falkon, the KDE web browser formerly known as QupZilla, is available to download.

• Falkon 3.0.0 is the first formal release of the rebadged Qt-based web navigator, and follows a name change in summer of last year.

• As this is more of a rebranding than a brand new app you won’t notice too many visual differences between the latest stable release of QupZilla 2.2.5, and the first hatching of Falkon 3.0.

• Falkon 3.0 has been released today as the first version since its rebranding from QupZilla as an open-source, Qt-powered web-browser.

• Falkon is a new KDE web browser, previously known as QupZilla. Following this release, there will only be one last final QupZilla release.

• Years ago, for KDE 3, I had ported a console “asciiquarium” to operate as a KDE screensaver, called “KDE asciiquarium“. By KDE 4.2, it was included as part of the kdeartwork module by default.

• Since the KDE 3 times when I started this screensaver, our desktop concept has changed around a bit. We’ve developed the Plasma desktop, and have effectively deprecated the idea of screensavers (which are increasingly less popular), though lock screens are still important.

• Adriaan de Groot continues working on improving the KDE stack for FreeBSD. The moment is finally near where KDE Plasma 5 along with the modern KDE Applications stack should soon be available via the FreeBSD Ports collection.

• In preparation for finally having the modern KDE desktop stack available via FreeBSD Ports, the older KDE4 ports have been moved aside (but are still accessible via x11/kde4). KDE4 will continue to work for those who have already installed it on FreeBSD, but they are reorganizing these packages in preparation for pushing out the modern KDE Plasma 5 + Apps stack.

• Clazy is a Clang plugin which extends the compiler with over 50 warnings related to Qt best practices ranging from unneeded memory allocations to API misuse. It’s an opensource project spawned by KDAB’s R&D efforts for better C++ tooling.

• Hotspot is a KDAB R&D project to create a standalone GUI for performance data. It is a replacement for perf report. Hotspot’s GUI takes a perf.data file, parses and evaluates its contents and then displays the result in a graphical way.

• Hotspot’s initial goal was to provide a UI like KCachegrind around Linux perf. In future versions we will be supporting various other performance data formats under this umbrella. You can find the source code on our GitHub page.

• After some heavy lifting in KStars January v2.9.2 release, we dedicated February to fix all those KStars issues that have been accumulating for a while. Today, KStars v2.9.3 is released with many several important fixes, mostly in Ekos scheduler and capture modules.

GNOME Desktop/GTK

• I know, I’m late, but after releasing 3.27.90 I took some days off GNOME Notes development to enjoy my holidays with my son – girls stayed at home, doing girls stuff, this time.

• When I get back, I was involved in trying new Linux distros to see how my workflow would work with them. That took some days too, so here we go with my thoughts on GNOME Notes 3.28.

Distributions

Red Hat Family

• Red Hat JBoss Fuse 7.0 technical preview three is out today! On the pathway to become one of the best cloud-native integration platforms, JBoss Fuse gives developers the freedom to choose how they want to develop an integration solution, where they want to deploy it. It also has capabilities to address new integration personas that do not have development experience.

• The overarching theme of Mobile World Congress 2018 is “creating a better future.” This is a theme that can speak to the core of technology companies; at Red Hat, we see this exemplified through our global telecommunications customers who are embracing open source and the community to help transform their telcos from the inside out.

• These days, innovation rules. Nearly every organization is seeking better and faster ways to generate new ideas to keep them on the cutting edge. But the era of digital transformation we live in is also one filled with disruption. Your entire business, or entire market, could change overnight—maybe by something you never even saw coming.

• Red Hat announced on Tuesday new innovations in its management portfolio, including the latest releases of Red Hat Satellite and Red Hat CloudForms, designed to accelerate deployments of Red Hat-powered cloud environments, and automate and greater simplify ongoing infrastructure management.

Finance

Debian Family

Derivatives

Canonical/Ubuntu

• Itching to see more of Samsung’s promising ‘Linux on Galaxy’ initiative? Then you have to watch the following video.

• The smartphone giant has uploaded a short clip to YouTube in which it demos ‘Linux on Galaxy’ to a group of Android developers.

• If you’ve been reading this site for a while you’ll know that I change my desktop and smartphone wallpaper regularly — too regularly, perhaps! It’s partly why this site has a ‘wallpaper category’; I can write about my favourite wallpapers primarily so I can go back and find my favourites at a later date!

• On the road to 18.04 we have a 4.15 based kernel in the Bionic repository.

• The purpose of this communication is to provide a status update and highlights for any interesting subjects from the Ubuntu Server Team. If you would like to reach the server team, you can find us at the #ubuntu-server channel on Freenode. Alternatively, you can sign up and use the Ubuntu Server Team mailing list.

Devices/Embedded

• The Mobile World Congress (MWC) 2018 is at full swing in Barcelona and we’ve already seen a number of new devices being introduced. One that has caught our attention is probably Android 8 Oreo running Samsung flagship, the Galaxy S9. However, Android isn’t the only mobile OS catching some media buzz at the mega event. Finnish company Jolla also announced the third version of its mobile platform, Sailfish OS.

• The Gumstix “Chatterbox for the Colibri iMX7” is a Geppetto-customizable, Linux-driven Alexa Voice Service development board that features Toradex’s i.MX7 based module, and offers a 2.5-Watt speaker driver, mic and audio jacks, plus WiFi, BT, Ethernet, USB, and more.

• Gumstix has partnered with Toradex to launch an Amazon Alexa Voice Service (AVS) development board with a SODIMM connector for Toradex’s Cortex-A7 based Colibri iMX7 module. The Gumstix Chatterbox for the Colibri iMX7 was built in the Gumstix Geppetto “Design-to-Order” Web development platform, and can be customized using the same service. In addition, the Colibri iMX7 SODIMM connector is available in Geppetto so developers can build their own iMX7 based boards independent of the Chatterbox.

• Emlid’s 41 x 29.5mm “Neutis N5” module runs OTA-updated mainline Linux on a quad-A53 Allwinner H5, and offers a crypto chip, 8GB eMMC, WiFi with BT 4.0/BLE, extended temp support, and an optional development board.

• Emlid, which is known for its ArduPilot compatible, Linux-driven drone controllers such as the Navio2 autopilot HAT for the Raspberry Pi and more recent, standalone Emlid Edge, is dipping its toes into the mainstream embedded market with a Neutis N5 computer-on-module.

• A year ago, F&S Elektronik Systeme announced an armStone A53SD Pico-ITX SBC with a Snapdragon 410E. Now it has returned to Embedded World to show off its latest Pico-ITX entry, this time based on the NXP i.MX8M. The layout of the new armStone MX8M is almost identical to the A53SD, and the feature set is very close, as well.

• Advantech-Innocore announced a Linux-supported “DPX-E140” casino gaming platform with AMD’s new Ryzen Embedded V1000 SoC, quad-4K display support, 9x USB ports, and passive cooling on up to 25W V1000 parts.

Tizen

Android

Free Software/Open Source

Web Browsers

Mozilla

• If you want to learn more about Neutrino, Eli Perelman (original author of the project) wrote about Neutrino at hacks.mozilla.org. You can find the official documentation at https://neutrino.js.org.

• With the upcoming release of Firefox 59, we are pleased to welcome the 53 developers who contributed their first code change to Firefox in this release, 49 of whom were brand new volunteers!

• If you’re a veteran of using old-style screenshot tactics, you know it used to involve a lot of saving to the desktop or cloud, re-finding the image files in a mass of similar file names, then having to crop or otherwise “fix up” the images before re-saving them and getting them into a google doc, presentation, or other platform.

• Hello and welcome to another issue of This Week in Rust! Rust is a systems language pursuing the trifecta: safety, concurrency, and speed.

• As you may have seen in several of our SRE status reports, we’re moving all of our webapp hosting from Deis to Kubernetes (k8s). As part of that we’ve also been doing some additional thinking about the security of our deployments. One thing we’ve not done as good a job as we should is with Django’s ALLOWED_HOSTS setting. We should have been adding all possible hosts to that list, but it seems we used to occasionally leave it set to ['*']. This isn’t great, but also isn’t the end-of-the-world since we don’t knowingly construct URLs using the info sent via the Host header. In an effort to cover all bases we’ve decided to improve this. Unfortunately our particular combination of technologies doesn’t make this as easy as we thought it would (story of our lives).

• [...]

• Conclusion

• That was a long way to go to get to some simple health checking, but we believe it was the right move for the reliability and security of our Django apps hosted in our k8s infrastructure on AWS. Please check out the repo for django-allow-cidr on Github if you’re interested in the code. Our hope is that releasing this as a general use package will help others that find themselves in our situation, as well as helping ourselves to do less copypasta coding around our various web projects.

Blockchain

• There is a large number of different open source licenses with significantly different terms (some prominent licenses used for blockchain projects are GNU General Public License, GNU Lesser General Public License [LGPL], Apache License 2.0, MIT license). These licenses impact the way of how the software proliferated under the license may be used, modified and redistributed. Particular attention needs to be paid to the redistribution rights and obligations because several open source licenses require that software or at least the derivative part of the software incorporating the open source software is redistributed again under the same open source terms (“copy-left”, GNU and LGPL).

• MARK.SPACE is delighted to announce the mega launch of CRYPTO.VALLEY, a new virtual infrastructure project that promises to be a cynosure of the global crypto community as an interactive and informational pool. In its fully functional form, CRYPTO.VALLEY will be a virtual city completely compatible with the 3D and VR technologies.

• The most important question to ask any decentralized blockchain protocol is: “How do you protect your protocol from ‘incumbent’ companies?” While many emerging protocols promise disintermediated commercial interactions between people, it is critical that these protocols are weary of corporate giants with FOMO . After all, most decentralized protocols are open-source – copying their code is free and 100 percent legal.

Pseudo-Open Source (Openwashing)

Funding

• FundRequest, a blockchain based platform for incentivizing open source development, has recently completed their crowd sale where they raised $12.5 million from investors and the public. The token sale also drew some big-name investors such as 1kx, an angel fund who pursues companies committed to creating distributed ledger technology-based solutions; Connect Capital, a blockchain and digital asset investment fund; Tetras Capital, a New York City-based hedge fund focusing on blockchain and crypto asset classes; and ZestAds, a digital advertising firm with offices in Southeast Asia.

BSD

• MidnightBSD founder Lucas Holt shares the story of his project and discusses the recent Pale Moon controversy.

Public Services/Government

• The U.S. Department of Defense (DoD) recently announced the launch of Code.mil, an open source initiative that allows software developers around the world to collaborate on unclassified code written by federal employees in support of DoD projects.

• DoD is working with GitHub, an open source platform, in an experiment aimed at fostering collaboration between federal employees and private-sector software developers on software projects built within the DoD. The Code.mil URL directs users to an online repository that will store code written for a range of projects across the DoD for individuals to review and make suggested changes.

Openness/Sharing/Collaboration

Open Hardware/Modding

• Hardware and software are certainly different beasts. Software is really just information, and the storing, modification, duplication, and transmission of information is essentially free. Hardware is expensive, or so we think, because it’s made out of physical stuff which is costly to ship or copy. So when we talk about open-source software (OSS) or open-source hardware (OSHW), we’re talking about different things — OSS is itself the end product, while OSHW is just the information to fabricate the end product, or have it fabricated.

• The fabrication step makes OSHW essentially different from OSS, at least for now, but I think there’s something even more fundamentally different between the current state of OSHW and OSS: the pull request and the community. The success or failure of an OSS project depends on the community of people developing it, and for smaller projects that can hinge on the ease of a motivated individual digging in and contributing. This is the main virtue of OSS in my opinion: open-source software is most interesting when people are reading and writing that source.

• The company’s new processor is based on the RISC-V open-source processor architecture, with the focus being on handling low-power AI processing in sensory devices that other mainstream chips would not typically be designed to handle specifically. In fact, GreenWaves has designed the processor with image, sound and vibration analysis at its heart, with a number of new algorithms being included in order to execute a wide variety of tasks. These tasks will also consume minimal amounts of energy due to the integrated 8-core cluster that is coupled with a separate core designed to handle any pre-analysis communication, control, and information. It is because of this low power consumption that GreenWaves has designed the processor with battery-powered devices in mind, although it hopes the chip will result in a number of new connected products with support for artificial intelligence such as smart toys, certain wearables, or even the implementation of always-on facial recognition in mobile devices. However, the new processor isn’t just energy-efficient, but also relatively affordable, with the handling of machine vision potentially costing less than $15 to implement. The product should also help relieve pressure on networks due to the fact that all processes will happen wherever the sensors are placed, removing the need for a secondary product while also reducing the costs of data management and speeding up the processing, according to the company.

• “The RISC-V movement has tremendous potential but it is absolutely reliant on a robust ecosystem, including early software development solutions,” noted Simon Davidmann, President and Chief Executive Officer, Imperas Software, Ltd. “Imperas has uniquely solved this problem, providing RISC-V developers with commercial-grade processor simulation to accelerate software verification as well as hardware validation.”

Programming/Development

• Green Hills Software introduces its Compiler 2018.1 for creating highly optimized 32-bit and 64-bit embedded C and C++ software applications for all common embedded processor architectures, including Arm, Intel and Power Architecture. As a result, users see 3x faster vector processing speeds, and scores beating the LLVM Compiler even on LLVM’s own benchmark suite. Other highlights of Compiler 2018.1 include full C++14 support, Spectre mitigations and support for the highest functional safety levels. As per Green Hills, compiler 2018.1 enables designers to bring their products to market more quickly, meet safety and security requirements and extract maximum processor performance in all embedded markets including automotive, industrial control, high performance computing (HPC), digital storage and consumer products.

Leftovers

Health/Nutrition

• The EU and UK should agree on how to maintain the free flow of personal data for research. This would ideally be achieved through a comprehensive ‘adequacy’ agreement (where it is agreed that there are adequate levels of data protection to allow personal data to be transferred without more safeguards). A practical alternative is agreeing sector-specific safeguards to allow the free flow of personal data for research as part of a research and innovation agreement.

Security

• Letters sent to the United States Congress by Intel and the other six companies in the Meltdown/Spectre disclosure cabal have revealed how and why they didn’t inform the wider world about the dangerous chip design flaws.

• Republican members of the House Energy and Commerce Committee sent letters to the seven in January, to seek answers about the reasons they chose not to disclose the flaws and whether they felt their actions were responsible and safe.

• All the letters go over old ground: Google Project Zero spotted the design errors, told Intel, which formed a cabal comprising itself, Google, AMD, Arm, Apple, Amazon and Microsoft. The gang of seven decided that Project Zero’s 90-day disclosure deadline had to be extended to January, then spoke to others to help them prepare fixes. But stray posts and sharp-eyed Reg hacks foiled that plan as we broke the news on January 3rd.

• Serverless is an exciting development in the modern infrastructure world. It brings with it the promise of dramatically reduced system costs, simpler and cheaper total cost of ownership, and highly elastic systems that can seamlessly scale to what old-timers (like me) call a “Slashdot moment” – a large and immediate spike in traffic.

• The cost savings Serverless offers greatly accelerated its rate of adoption, and many companies are starting to use it in production, coping with less mature dev and monitoring practices to get the monthly bill down. Such a trade off makes sense when you balance effort vs reward, but one aspect of it is especially scary – security.

• This article aims to provide a broad understanding of security in the Serverless world. We’ll consider the ways in which Serverless improves security, the areas where it changes security, and the security concerns it hurts.

Defence/Aggression

• This all comes as, in Florida, Broward County Sheriff Scott Israel is facing increasing calls to resign over his department’s inability to stop the mass school shooting, which included his department’s failure to take seriously dozens of previous calls about the gunman, Nikolas Cruz, about whom residents had expressed fears for years. One of his deputies, Scot Peterson, has resigned after details emerged that he took cover outside the school during the shooting. He is now claiming that he didn’t enter the school because he thought the shooting was happening outside.

Transparency/Investigative Reporting

AstroTurf/Lobbying/Politics

• US Cyber Command chief Adm. Mike Rogers told lawmakers on Tuesday that he has not been granted the authority by President Donald Trump to disrupt Russian election hacking operations where they originate. Asked by Democratic Sen. Jack Reed if he has been directed by the President, through the defense secretary, to confront Russian cyber operators at the source, Rogers said “no I have not” but noted that he has tried to work within the authority he maintains as a commander.

• Less than two weeks after special counsel Robert Mueller indicted 13 individuals and a trio of Russian companies for “interference operations targeting the United States,” NSA Director Mike Rogers told members of Congress that the Trump administration hasn’t even authorized him to take measures to prevent election meddling going forward.

• A top national security official told lawmakers on Tuesday he had not been directed by Donald Trump to disrupt Russian efforts to meddle in US elections, and that Vladimir Putin had come to the conclusion there was “little price to pay” for such actions.

• A top U.S. intelligence official said Tuesday that President Donald Trump has given him no specific instructions to combat Russian meddling in the 2018 congressional elections that mirrors Moscow’s interference in the 2016 presidential contest aimed at helping Trump win.

• “I’ve never been given any specific direction to take additional steps outside my authority,” Admiral Mike Rogers, director of both the U.S. Cyber Command and the National Security Agency, told lawmakers.

• NSA boss Mike Rogers told a US congressional panel today that Russia’s online mischief-making in America’s elections is not going to stop – because Uncle Sam isn’t hitting back.

• “I believe that President Putin has clearly come to the conclusion there’s little price to pay here, and that therefore I can continue this activity,” Admiral Rogers told the Senate Armed Services Committee.

• The admiral in charge of both the nation’s top electronic spying agency and the Pentagon’s cybersecurity operations would seem a logical point man for countering Russia’s digital intrusions in U.S. election campaigns.

• First, let’s stop giving politicians bad ideas. Whoever prompted this response from Klobuchar has bits on their hands if this ever becomes law. Klobuchar can come up with her own bad ideas. There’s absolutely no reason journalists should be floating ideas containing First Amendment collateral damage. Let Klobuchar come up with her own terrible legislation. It’s not like she hasn’t done it before.

• Second, what the hell does this even mean? Weeding out all bots is impossible. Weeding out those the government has noticed might be doable, but they’ll likely be replaced with new ones as soon as they’re deleted. On top of that, forcing large platforms to cull anything that resembles automation is going to do damage to legitimate accounts that schedule posts in advance and it might result in the removal of truly useful bots, like Brad Heath’s Big Cases bot — one that trawls federal court RSS feeds for cases of interest and posts publicly-available copies of filings locked behind the government’s PACER paywall.

• Such a task is unfeasible. Legislation like this would only serve as a platform for political grandstanding. Fining tech companies for violations of terms of service by users is ridiculous. It’s not as though we don’t have enough ongoing threats to service provider immunity. Twitter and Facebook are already trying to wrestle with bot problems, but criminalizing the mere existence of bots doesn’t solve the problem. It just makes it easier for the government to monetize the very behavior reps are claiming they want to stamp out. It’s an incentive with a government perversion attached.

Censorship/Free Speech

• Lately I’ve been enjoying watching re-runs of Rowan & Martin’s Laugh-In. It’s somewhat reassuring to watch a previous generation get through a period of political angst as we go through this current one, especially as there are quite a few parallels that can be drawn. I mention this because as people call for Amazon, Apple, Roku, and YouTube to drop NRA-TV, I realize that we’ve seen calls for censorship like this before.

• A motion was backed by Dundee University Students’ Association’s ruling body to remove the Daily Mail, Daily Express and The Sun from its shops.

• Sean O’Connor, the DUSA president, said the newspapers “do not match our values” and run “inflammatory and sensationalised articles that demean and insult members of our community”.

• But the move has been condemned by critics as an erosion of freedom of speech.

• Ross Starke, a politics student who works as a Dundee United kit man, leads a group of students opposed to the ban.

• I hope you’ve heard — even better — read, Amy Cherry’s story about the Caesar Rodney school district’s censorship of dissenting views on the district’s official Facebook page.

• An Elgin-area U46 official is blasting proposed changes to guidelines for school board members as an attempt to censor her social media statements about school district policies.

• Jeanette Ward is taking issue with direction that elected officials “carefully consider what they post on social media before they post it, avoiding statements that might be volatile,” which is part of proposed changes to a series of board agreements.

• Last week, the European Parliament’s MEP in charge of overhauling the EU’s copyright laws did a U-turn on his predecessor’s position. Axel Voss is charged with making the EU’s copyright laws fit for the Internet Age, yet in a staggering disregard for advice from all quarters, he decided to include a obligation on websites to automatically filter content.

• In 2016 the European Commission proposed a new Directive on Copyright in the Digital Single Market. While there are other serious concerns about the proposals, Article 13, which sets out how online platforms should manage user-uploaded content appears to have the most dangerous implications for fundamental rights. Since then, European Parliament committees have done some good work improving the draft law — which makes Voss’ 180° spin all the more alarming.

• Cases of art censorship on Facebook continue to surface. The latest work deemed “pornographic” is the 30,000 year-old nude statue famously known as the Venus of Willendorf, part of the Naturhistorisches Museum (NHM) collection in Vienna.

• Millennials, we keep hearing, are too easily offended. The slightest whiff of troubling female sexualisation, for instance, and they’ll default straight to indignant outrage.

• Earlier this month Manchester Art Gallery took down a pre-Raphaelite painting showing young nude “femmes fatales”. The gallery put a sign up in place of Hylas and the Nymphs by John Williams Waterhouse encouraging visitors to comment.

• “While people are always quick to take up the cudgels against censorship of the press, or radio, any crackpot can advocate new forms of censorship for the movies,” the screen star wrote, “and not a voice is lifted in protest.”

• Pacific Rim, Guillermo del Toro’s 2013 futuristic sci-fi film starring Idris Elba, was a resounding flop, recouping just $106 million in United States cinema ticket sales from a budget of $190 million. The critical reception wasn’t much better: “You might as well watch the birth of an elephant,” lamented one reviewer.

• As we’ve been discussing, this afternoon, the House voted both on Rep. Mimi Walters’ bad amendment to attach SESTA to FOSTA, and then on the combined bill — and both sailed through Congress. Somewhat incredibly, this happened even though the Justice Department weighed in with a last minute letter saying that the language in the combined SESTA/FOSTA is so poorly drafted that it would actually make it more difficult to prosecute sex traffickers, and also calling into question whether or not the bill was even Constitutional.

• You would think that with the DOJ pointing out these fairly fatal flaws with the bill, that perhaps (just perhaps), the House would delay voting on this. As noted last week, bringing the amendment to the floor without having it go through the House Judiciary Committee (as is supposed to happen), seemed to be the House’s way of washing its hands of the bill, and tossing the issue back to the Senate. But rushing through a bill with huge implications is no way to make law.

• The bill passed today 388-25 by the U.S. House of Representatives marks an unprecedented push towards Internet censorship, and does nothing to fight sex traffickers.

• H.R. 1865, the Allow States and Victims to Fight Online Sex Trafficking Act (FOSTA), allows for private lawsuits and criminal prosecutions against Internet platforms and websites, based on the actions of their users. Facing huge new liabilities, the law will undoubtedly lead to platforms policing more user speech.

• The Internet we know today is possible only because of Section 230 of the Communications Decency Act, which prevents online platforms from being held liable for their users’ speech, except in certain circumstances. FOSTA would punch a major hole in Section 230, enabling lawsuits and prosecutions against online platforms—including ones that aren’t even aware that sex trafficking is taking place.

• It’s an art form that’s used to push back against censorship, and it’s happening at the Hamilton Public Library right now.

• It’s called “blackout poetry” — a form of visual and intellectual art that uses contentious books that have been banned in the past to create a piece that celebrates free expression.

• These pieces are being created at the library’s central branch as part of Freedom to Read Week, which is a national celebration of free expression, born of a protest against censorship that stretches back decades.

• Back in November, we wrote about a pure SLAPP lawsuit filed by Stanford professor Mark Jacobson against another scientist, Christopher Clack, and the National Academy of Sciences. Jacobson claimed that Clack and others defamed him by publishing a rebuttal of a paper that he and some others had published earlier. In other words, this was a standard kind of academic dispute, with different scientists taking different positions. Rather than continue to debate it in academic settings, Jacobson sued the critics. We went through all of the details of the case, and why it was so ridiculous in the original article, so we won’t rehash that here.

• The interim order issued by Chief Justice Gopal Parajuli to the Press Council instructing pre-censorship of news concerning the discrepancies in his birth-date mentioned in his official documents has drawn widespread criticism from different sides.

• The order that came from the bench presided by Parajuli himself on Sunday, following a series of news story about his birth-date controversy published in Kantipur daily, has been seen as an attack on free press by the advocates of democracy. Many of them took to social media to voice their concern on Tuesday. They were strident in their reactions against Parajuli’s attempt to muzzle the media.

Privacy/Surveillance

• The U.S. Court of Appeals for the Ninth Circuit has a new opportunity to strengthen personal privacy at the border. When courts recognize and strengthen our Fourth Amendment rights against warrantless, suspicionless searches of our electronic devices at the border, it’s an important check on the government’s power to search anyone, for any or no reason, at airports and border checkpoints.

• EFF recently filed amicus briefs in two cases, U.S. v. Cano and U.S. v. Caballero, before the Ninth Circuit arguing that the Constitution requires border agents to have a probable cause warrant to search travelers’ electronic devices.

• Border agents, whether from U.S. Customs and Border Protection (CBP) or U.S. Immigration and Customs Enforcement (ICE), regularly search cell phones, laptops, and other electronic devices that travelers carry across the U.S. border. The number of device searches at the border has increased six-fold in the past five years, with the increase accelerating during the Trump administration. These searches are authorized by agency policies that generally permit suspicionless searches without any court oversight.

• The last significant ruling on device privacy at the border in the Ninth Circuit, whose rulings apply to nine western states, was in U.S. v. Cotterman (2013). In that case, the court of appeals held that the Fourth Amendment required border agents to have had reasonable suspicion—a standard between no suspicion and probable cause—before they conducted a “forensic” search, aided by sophisticated software, of the defendant’s laptop. Unfortunately, the Ninth Circuit also held that a manual search of an electronic device is “routine” and so the traditional border search exception to the warrant requirement applies—that is, no warrant or any suspicion of wrongdoing is needed.

• The Supreme Court of India has commenced final hearings in the long-standing challenge to India’s massive biometric identity apparatus, Aadhaar. Following last August’s ruling in the Puttaswamy case rejecting the Attorney General’s contention that privacy was not a fundamental right, a five-judge bench is now weighing in on the privacy concerns raised by the unsanctioned use of Aadhaar.

• The stakes in the Aadhaar case are huge, given the central government’s ambitions to export the underlying technology to other countries. Russia, Morocco, Algeria, Tunisia, Malaysia, Philippines, and Thailand have expressed interest in implementing biometric identification system inspired by Aadhaar. The Sri Lankan government has already made plans to introduce a biometric digital identity for citizens to access services, despite stiff opposition to the proposal, and similar plans are under consideration in Pakistan, Nepal and Singapore. The outcome of this hearing will impact the acceptance and adoption of biometric identity across the world.

• At home in India, the need for biometric identity is staked on claims that it will improve government savings through efficient, targeted delivery of welfare. But in the years since its implementation, there is little evidence to back the government’s savings claims. A widely-quoted World Bank’s estimate of $11 billion annual savings (or potential savings) due to Aadhaar has been challenged by economists.

• The architects of Aadhaar also invoke inclusion to justify the need for creating a centralized identity scheme. Yet, contrary to government claims, there is growing evidence of denial of services for lack of Aadhaar card, authentication failures that have led to death, starvation, denial of medical services and hospitalization, and denial of public utilities such as pensions, rations, and cooking gas. During last week’s hearings , Aadhaar’s governing institution, the Unique Identity Authority of India (UIDAI), was forced to clarify that access to entitlements would be maintained until an adequate mechanism for authentication of identity was in place, issuing a statement that “no essential service or benefit should be denied to a genuine beneficiary for the want of Aadhaar.”

• This will allow the Chinese government to quell dissent and hunt down wrong-thinkers much more efficiently. It also shows the company is willing to drastically change the way it does business in order to maintain a large foreign customer base. This move will prompt questions from Congressional reps and FBI officials about Apple’s refusal to work with the US government to provide access to locked devices and encrypted communications. Thanks to its acquiescence to the Chinese government, these questions won’t be so easy to answer.

• This change in policy won’t budge the needle much in terms of US lawful access. US authorities will now have to route requests for Chinese data through the Chinese government, but it’s unlikely there’s much of that going on now. Requests for domestic data and communications stored in Apple’s iCloud will be handled the way they always have been. Apple’s always held keys domestically for iCloud accounts, which makes the cries of “going dark” a bit melodramatic.

• But it does indicate Apple is willing to change policies for governments far less freedom-friendly than ours. And if it’s willing to do that, why won’t it stash encryption keys for locked devices where US law enforcement can access them?

• A federal judge has thrown a wrench in the government’s case against National Security Agency Contractor Harold T. Martin III by questioning how much foreknowledge a federal contractor needs to have for their possession of NSA documents to constitute theft of government information.

• On Feb 16, 2018, U.S. District Judge Marvin Garbis ordered a legal hearing to take place before March 6, 2018, at which both the defense and prosecution must define what they think the government must legally prove to convict Martin of theft, as originally reported by Politico.

Civil Rights/Policing

• New York Times editorial page deputy editor Bari Weiss—a boilerplate neocon warmonger, anti-Arab racist, and sexual abuse soft-peddler—got into hot water when she sent a tweet last week praising Asian-American Mirai Nagasu (born in California) for being “an immigrant” who “got things done.” When several people noted not only that Nagasu was born in the US–and thus not an immigrant–but that the assumption that Asian-Americans are inherently foreign is a pervasive, deeply toxic trope that should be apologized for, Weiss had a classic Twitter meltdown, ending in claims that animosity leveled at her was “another sign of civilization’s end.”

• Right on cue, fellow blue-checkmark Serious People rushed to her defense, most prominently—and uniformly—from the ultimate arbiter of seriousness, Atlantic Magazine. The centrist outlet published not one but two articles on the topic of Twitter being mean to Weiss: “The Excesses of Call-Out Culture“ by Conor Friedersdorf (2/19/18) and “Bari Weiss and the Left-Wing Infatuation With Taking Offense” by Shadi Hamid (2/17/19).

• A federal court orders the government to reinstate DACA status that it unlawfully revoked without due process.

• As part of its anti-immigrant agenda, the Trump administration has been revoking Deferred Action for Childhood Arrivals grants based on unproven allegations or minor offenses that should have no effect on whether a person can protected from deportation under DACA. This policy has caused many young immigrants to lose their permission to live and work in the United States with no notice, explanation or opportunity to respond.

• But on Monday night, a federal court in Los Angeles put a stop to the practice, ruling that the government violates its own rules and the Administrative Procedure Act when it terminates DACA status without notice or a chance to contest the government’s actions. The APA is a 1946 law that regulates federal agencies and provides judicial oversight over their behavior.

• Sessions’ gay panic is just one example of his efforts to diminish rights and protections for certain groups, while intensifying the nation’s mass incarceration culture. He recently announced that he would end Obama-era protections for marijuana users in states that have legalized possession. While marijuana possession is still a federal crime — one based on retrograde, anti-scientific laws — he is using his authority to counter the will of voters in states where the public supports decriminalization of marijuana. He is doing this based on a comically outdated view of marijuana — that “good people” don’t smoke it — and a tragic resuscitation of the failed war on drugs more broadly.

• By last summer, Laqueanda Reneau felt like she had finally gotten her life on track.

• A single mother who had gotten pregnant in high school, she supported her family with a series of jobs at coffee shops, restaurants and clothing stores until she landed a position she loved as a community organizer on Chicago’s West Side. At the same time, she was working her way toward a degree in public health at DePaul University.

• But one large barrier stood in her way: $6,700 in unpaid tickets, late fines and impound fees.

• She had begun racking up the ticket debt five years earlier, in 2012, after a neighbor who saw her riding the bus late at night with her infant son sold her her first car, a used Toyota Camry, for a few hundred dollars. She was grateful for the shorter commute to work but unprepared for the extra costs of owning a car in Chicago.

• We’ve been reporting on how unpaid parking and automated traffic camera tickets can quickly spiral out of control for Chicago’s working poor, and particularly for African Americans.

• Thousands of drivers file for Chapter 13 bankruptcy each year to cope with ticket debt, getting a chance to lift license suspensions or to protect their vehicles from the city’s boot list.

• But bankruptcy often leaves drivers in worse financial shape.

• Powerful Democrats in both the House and Senate called Tuesday for an investigation into Drug Enforcement Administration-led operations in Mexico that played a role in triggering violent drug cartel attacks. These attacks left dozens, possibly hundreds, of people dead or missing, including many who had nothing to do with the drug trade.

• The call was issued in a letter signed by ranking members of the committees that oversee America’s foreign law enforcement operations and draws heavily on two stories last year by ProPublica and National Geographic that documented the attacks and the DEA’s role. One story reconstructed a 2011 massacre by the Zetas cartel in the Mexican state of Coahuila. It revealed that the wave of killings was unleashed after sensitive information obtained during a DEA operation wound up in the hands of cartel leaders, who ordered a wave of retaliation against suspected traitors.

Internet Policy/Net Neutrality

• The NRA last week thought it would be a good idea to give FCC boss Ajit Pai an award for killing net neutrality. More specifically, the NRA gave Pai the Charleton Heston Award for Courage at the CPAC conference for killing the popular consumer protections. The entire affair was a tone deafness supernova from beginning to end, with American Conservative Union (ACU) Executive Director Dan Schneider making it abundantly clear that he and other attendees have absolutely no coherent idea what net neutrality even is.

• Today, EFF is participating in a national Day of Action to push Congress to preserve the net neutrality rules the FCC repealed in December. With a simple majority, Congress can use the Congressional Review Act (CRA) to overturn the FCC’s new rule. We’re asking for members of the House and Senate to commit to doing so publicly.

• On Thursday, February 22, the FCC’s so-called “Restoring Internet Freedom Order” was published in the Federal Register. Under the CRA, Congress has 60 working days to vote to overturn that Order. We’re asking representatives to publicly commit to doing just that. In the House of Representatives, that means supporting Representative Mike Doyle’s bill, which has 150 co-sponsors. In the Senate, Senator Ed Markey’s bill is just one vote away from passing.

Intellectual Monopolies

Copyrights

• In a decision that threatens legitimate fair uses, the Second Circuit ruled against part of the service offered by TVEyes, which creates a text-searchable database of broadcast content from thousands of television and radio stations in the United States and worldwide. The service is invaluable to people looking to investigate and analyze the claims made on broadcast television and radio. Sadly, this ruling is likely to interfere with that valuable service.

• TVEyes allows subscribers to search through transcripts of broadcast content and gives a time code for what the search returns. It also allows its subscribers to search for, view, download, and share ten-minute clips. It’s used by exactly who you’d think would need a service like this: journalists, scholars, politicians, and so on in order to monitor what’s being said in the media. If you’ve ever read a story where a public figure’s words now are contrasted with contradictory things they said in the past, then you’ve seen the effects of TVEyes.

• An appealing user interface is a de facto requirement in modern software that has become better and better over the years. The world of BitTorrent clients is no different. While we still have those somewhat ugly but feature-packed torrent downloaders, there are many good looking options available for everyday torrent downloaders.

• A pending case against recycler Eric Lundgren has now moved to the 11th Circuit Court of Appeals. Lundgren pled guilty to criminal copyright infringement and was sentenced to 15 months incarceration. The basics are that he manufactured over 28,000 discs containing Dell/Microsoft Restore Discs and shipped them from China to the U.S. Lundgren argued that the discs should be seen as publicly available since they don’t work without an access code and his actual plan involved using legitimate access codes that he had obtained from purchasers. Microsoft apparently pushed the Miami FBI to pursue Lundgren for counterfeiting and last year he pled guilty to both Criminal Copyright Infringement and Conspiracy to Traffic in Counterfeit Goods.

• [...]

• The conspiracy to traffic in counterfeit goods is, I imagine, what really drove the charges — the problem with the discs was not only that they were Microsoft Restore discs, but that he had printed on them the Dell and Microsoft logos. Of course, one trick with Conspiracy is that it is a future-crime – an agreement to commit a crime at some time in the future.

• Recycling advocate Eric Lundgren, who was sentenced to 15 months in prison for making free Windows recovery discs, told RT that he will use his appeal to continue fighting against planned obsolescence by Microsoft and others. “I was very, very shocked when I was given a prison sentence for extending the lifecycle of electronics, practicing recycling and trying to empower people,” Lundgren said of the one year and three months conviction handed to him by a Florida court earlier in February.

• Lundgren was found guilty of “conspiracy and copyright infringement” after burning 28,000 copies of recovery discs for Windows back in 2016, despite the fact that the CDs, which had absolutely no retail value, were seized by the authorities. He was also slapped with a $50,000 fine but luckily avoided repaying $420,000 that Microsoft sought in restitution for lost sales.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages. Permalink  Send this to a friend

----------

➮ Sharing is caring. Content is available under CC-BY-SA.