● 09.25.18

● Links 25/9/2018: Mesa 18.1.9, New Fedora Beta, and Oracle Solaris 11.4 SRU1

Posted in News Roundup at 2:33 pm by Dr. Roy SchestowitzContentsGNU/LinuxGNU/Linux

Desktop

Kernel Space

• The developers at Siemens AG working on the Jailhouse Linux hypervisor found it wise to issue their version 0.10 release prior to heading out to Oktoberfest.

• “O’zapft is, so better release before going to the Wiesn: We are happy to announce a new version of the partitioning hypervisor Jailhouse,” began their Jailhouse 0.10 release message — for those not familiar with the wonderful Bavarian culture, Oktoberfest kicked off on Saturday with the annual “O’zapft is!” (tapping of the first keg) and the wiesn is where this best event of the world takes place each year. Sadly, no Phoronix Oktoberfest event this year, but the Siemens engineers decided to celebrate with their Jailhouse 0.10 release.

• If you’re the type of person who uses the word “vuln” as a shorthand for code vulnerabilities, you should check out the presentation from the recent Linux Security Summit called “Security in Zephyr and Fuchsia.” In the talk, two researchers from the National Security Agency discuss their contributions to the nascent security stacks of two open source OS projects: Zephyr and Fuchsia.

• If you’re worried about the fact that Edward Snowden’s old employer is helping to write next generation OSes that could run our lives in 10 years, consider the upsides. First, since these are open source projects, any nefarious backdoors would be clearly visible. Second, the NSA knows a thing or two about security. Stephen Smalley and James Carter, who discussed security in Zephyr and Fuchsia, respectively, are computer security researchers at the NSA’s Information Assurance Research group, which developed and maintains the security-enhanced SELinux and SE Android distributions. Smalley leads the NSA’s Security Enhancements (SE) for the Internet of Things project and is a kernel and userspace maintainer for SELinux.

• The past few years open-source Intel developers have been creating a new Linux wireless daemon to potentially replace wpa_supplicant. This daemon, IWD, continues getting more feature-complete and is well on its way toward version 1.0.

• This afternoon AMD sent out their first Linux kernel patches for what might end up being a new feature for the “EPYC 2″ / Zen 2 processors.

Linux Foundation

• At the center of the intersection between globalization, world economic activity, and human and environmental health, are the world’s power systems. LF Energy, a new initiative of The Linux Foundation, provides a neutral, collaborative environment for open source innovation to enable the “electrification of everything to scale.” Our mission is to accelerate and transform the world’s relationship with energy.

• Education Ecosystem, a blockchain company building the Netflix for professional development has today announced that it is joining two nonprofit organizations. Enterprise Ethereum Alliance (EEA) the world’s largest open source blockchain initiative & the Linux Foundation, an organization dedicated to building sustainable ecosystems around open source projects to accelerate technology development and industry adoption.

• The world of blockchain witnessed a new event with Education Ecosystem partnering with Linux Foundation and Enterprise Ethereum Alliance. The notification released on 25th September suggests that the latter two are non-profitable firms. Linux Foundation is one of the prominent technology developers of the world, whereas, Enterprise Ethereum Alliance [EEA] is directed towards promoting applications based on Ethereum blockchain platform.

Graphics Stack

• The latest open-source project now officially adopting a Code of Conduct is Vulkan.

• Added today to the Vulkan documentation repository is a Code of Conduct file for Vulkan.

• That Code of Conduct is referencing the main Khronos Group Contributor Code of Conduct.

• Hi List,

• Due to me just forgetting to send out the release on Friday :/, it’s one work day late. Mesa 18.1.9 is now available for general consumption, it is the last release in the 18.1.x series, consider upgrading to 18.2.x for further updates.

• This has been another busy cycle, with roughly 35 real patches (excluding maintainer patches). We’ve seen long standing bugs in util code fixed, patches to anv and radv, as well as fixes to the android build system, and a few patches here and there across the rest of the code.

• Now that 18.1.x is all wrapped up, I’d like to say I’ve appreciated working with y’all as the maintainer for this cycle, thank you for your patience as I tried to get the process figured out.

• Dylan

• Mesa 18.1.9 is now available as the last planned point release of last quarter’s release stream.

• With Mesa 18.2.1 having been released, users are encouraged to upgrade to the stable Mesa 18.2 series. But if you’re holding off on upgrading for one reason or another, Mesa 18.1.9 is one last push for bug fixes.

• Earlier this month AMD finally got back on track with issuing new patches for FreeSync / Adaptive-Sync / HDMI Variable Refresh Rate support now that there seems to be a consensus among the Linux DRM (Direct Rendering Manager) driver developers over what this API should look like so it can support the multiple technologies and drivers at play.

• See the aforelinked article for more details, but this FreeSync/Adaptive-Sync/VRR support has been a long time coming for the open-source Radeon driver stack. The tech is intended to help reduce stuttering, tearing, and/or input lag while gaming.

• Wayland’s Weston compositor will no longer try to takeover your virtual reality (VR) head-mounted display.

• As was the case too with the X.Org Server up until some months back, Wayland’s Weston compositor currently would try to take over VR HMDs like the HTC Vive as just another monitor output… But thanks to the work led by Keith Packard under contract for Valve to improve the X.Org and DRM components for better SteamVR handling on Linux, there is now the non-desktop bit plumbed through the Linux kernel’s DRM infrastructure so VR HMDs will be treated as non-desktop display outputs. So user-space finally can know if a display output isn’t intended as just another desktop display but for a special use-case like virtual reality.

Benchmarks

• NVIDIA’s Tegra Xavier SoC is becoming more widely available now that the Jetson Xavier Development Kit has begun shipping. Besides this latest SoC being an exciting design with its Volta-based GPU and having a Tensor Processing Unit / Deep Learning Accelerator, it’s exciting on the CPU side as well with NVIDIA’s custom-designed ARMv8 “Carmel” CPU cores.

Applications

• When it comes to monitor running processes in Unix-like systems, the most commonly used applications are top and htop, which is an enhanced version of top. My personal favorite is htop. However, the developers are releasing few alternatives to these applications every now and then. One such alternative to top and htop utilities is Hegemon. It is a modular system monitor application written using Rust programming language.

Instructionals/Technical

Games

• Announced yesterday after a pretty short beta period, the magical arena fighting game Gift of Parthax is now officially available for Linux. Along with putting the Linux build out in public, their latest release also fixes a few bugs.

• The developer sent over a key and I’ve been testing it, the Linux version seems to be working really quite nicely. If you liked the idea of Wizard of Legend, but found it a little too fast for your tastes then Gift of Parthax might be a better fit although it’s single-player only.

• I have to admit, the game manager Lutris [Official Site] has come along quite a bit since I last used it. Today, version 0.4.20 was made available.

• For those not aware of it, Lutris is an application that aims to give you a single place to manage all your games on Linux. It supports native games, Wine, various emulators and so on. The application itself is available under the GPL and the helper scripts to install games can be viewed before using them so it’s quite nice.

• I’m aware that it has been a while since the last time we gave news to you. Be reassured, the project is moving on and here we are to give you some news.

• For those of you in the mood to start you week with some fun new games, Humble Store is doing an Aspyr Media sale.

• Geneshift (also known as Mutant Factions or Subvein) is a top-down shooter with some seriously good action that’s currently in Early Access and the developer has decided to add a Battle Royale mode.

• Initially, I thought this was a joke. However, it’s very much a real thing.

• For those who love Visual Novels, you might want to know that GOG have expanded their collection a little again recently.

• The two titles are Highway Blossoms and A Kiss For The Petals – Maidens of Michael. Neither game is particularly new, although it’s worth noting that A Kiss For The Petals – Maidens of Michael was removed from Steam so GOG is the easiest option to get it at the moment.

• DotLine from The Selenite Forge who also made Bionic Attack is a minimalist puzzle game that tries to challenge your brain, out now with native Linux support. Note: Key provided by the developer.

• The basic idea of the game is really simple. You have to guide a ball from start to end, the problem is the path it needs to take is all messed up and you’ve got the wonderful job of rotating everything into the correct position. What makes it challenging, is that as soon as you rotate the first piece, the ball will begin rolling and so it becomes a mad dash to get everything right. Even if you don’t do anything, you only get two seconds before it starts.

Desktop Environments/WMs

K Desktop Environment/KDE SC/Qt

• Mindmap diagrams are a productive way to visually organize information using hierarchies and relationship links among pieces of the whole. Today, we have a mind-mapping tool ideal for students, teachers, and creative users and it goes by the name of Semantik.

• Semantik (formerly kdissert) is a mind-mapping KDE software for efficiently creating documents including thesis, presentations, and reports.

• The created maps are converted into “flat” documents such as reports and presentations via document generators which can be used from both the GUI and Command line. You can edit the maps in linear view (as flat trees) or in 2-D and associate map nodes with text, pictures, tables, or diagrams.

• Semantik also features its own internal diagramming tool (semantik-d) and combines all of its features (search function, UML-like widgets, etc.) into a simple and organized GUI.

• First I directly admit on what I did teaser for 5.14 in my last update but what will not make it: generic gamma color correction per display. There are two reasons for it. The first one is that some preliminary patches, which needed to be merged first, endured long review phases. The second reason is, that when these patches finally were accepted I had shifted my focus on some other topics, which I decided to give an higher priority.

• Before delving into these other topics, a short analysis on why the reviews took so long: first there were of course some improvements possible to my patches, but after these got pointed out in the reviews I did fix them back then pretty quickly. The more striking reason is though that we are just short on people who can actually review KWin code changes, in particular with Martin being not maintainer anymore. That is not only a problem for my proposed code changes, but for anyone’s patches to KWin. And this hasn’t improved since back then. We must find a way to reduce the review pressure on the people being capable of doing reviews somehow, at best with only a minimal hit in code quality. I don’t have a full solution for this problem yet, we will see if we find a good one.

• After this is out of the way, let us talk about these other features, which I prioritized higher.

Distributions

Reviews

• Endless OS is a free Linux-based Operating System that makes computers fun to use. It features a beautiful UI, a somewhat locked-down app manager, and tons of educational software.

• Endless OS is mostly used to teach computing all over the world so the company has made it simulate a smartphone experience. In place of an app drawer, it uses shortcuts arranged in a grid view on the desktop. Sort of like an iPhone. You can add/delete apps from view as well as create folders for organizing them.

• For a completely different experience, take a look at the Ragazze Quartet’s performance of Terry Riley’s “Four Four Three.” I picked up ahigh-resolutionn version of this fascinating music from Channel Classics, which operates a Linux-friendly download store (no bloatware to install on your computer).

• And finally, I was saddened to hear of the recent passing of Rachid Taha, whose wonderful blend of North African and French musical traditions, along with his frank confrontation of the challenges of being North African and living in Europe, has made some powerful—and fun—music. Check out Taha’s version of “Rock the Casbah.” I have a few of his songs scattered around various compilation albums, and some time ago bought the CD version of Rachid Taha: The Definitive Collection, which I’ve been enjoying again recently.

OpenSUSE/SUSE

• The openSUSE Project is pleased to announce that it is accepting proposals for openSUSE Conference 2020. The Call for Hosts will be open until April 15, 2019.

• The openSUSE Conference Organizational Team will review the submissions with the hopes of having a decision announced about the location of oSC20 at the openSUSE Conference 2019 in Nuremberg, Germany. Community members and open-source enthusiasts are encouraged to follow the Conference How To guide on the wiki to submit a proposal on hosting the conference. The guide offers a How to Bid and How to Checklist to help with submitting a proposal.

• The proposals will need to be submitted to the openSUSE Marketing mailing list and the openSUSE Conference Organizational Team will discuss the proposals as it plans this year’s conference.

• While the openSUSE Project intends to move the conference to different worldwide locations in the future, the project has two locations (Nuremberg, Germany, and Prague, Czech Republic) to host the annual community conference if no proposals are submitted during the Call for Hosts.

Red Hat Family

• Despite being around for years, there’s still a learning curve for network functions virtualization (NFV) according to Red Hat’s Brian Gracely.

• Gracely, the director of product strategy for Red Hat, spoke about some of the difficulties of carriers deploying NFV as well as the maturity levels of containers and microservices in this Q&A, which was edited for clarity and length. In the first installment, he spoke about open source and Red Hat’s decision to double down on Kubernetes.

• If you were thinking that what Red Hat’s Openshift platform really needs is a service mesh, your prayers have been answered, courtesy of Istio. As long you don’t actually plan to use it in production anytime soon.

• Red Hatter Erik Jacobs said in a blog post yesterday that the firm had unleashed the first technology preview of the Red Hat OpenShift Service Mesh, and that it was based on the Google, IBM and Lyft-backed Istio.

• Istio is designed to take the complexity of managing microservices architectures away from the application developer or DevOps team. Istio’s backers pitch it as taking care of load balancing and monitoring, as well handling authentication and communications between services, access and traffic control.

• As enterprises increasingly adopt the advantages of deploying containerized applications, it is important to address the potential misconception that the JVM does not play nicely in the cloud. While it is true that most JVMs may not come out of the box perfectly configured to run in an elastic cloud environment, the wide variety of system properties available allows the JVM to be tuned to get the most out of a host environment. If a containerized application is deployed using Red Hat OpenShift, the application could take advantage of the Kubernetes Vertical Pod Autoscaler (VPA), which is an alpha feature. The VPA is a perfect example of where the JVM’s default memory management settings could diminish the increased resource utilization offered by such a feature. This blog post will walk through the steps of configuring and testing a containerized Java application for use with the VPA, which demonstrates the inherent adaptability of the JVM to cloud platforms.

Finance

Fedora

• So anyone reading my blog posts would probably have picked up on my excitement for the PipeWire project, the effort to unify the world of Linux audio, add an equivalent video bit and provide multimedia handling capabilities to containerized applications. The video part as I have mentioned before was the critical first step and that is starting to look really good with the screen sharing functionality in GNOME shell already using PipeWire and equivalent PipeWire support being added to KDE by Jan Grulich. We have internal patches for both Firefox and Chrome(ium) which we are polishing up to propose them upstream, but we will in the meantime offer them as downstream patches in Fedora as soon as they are ready for primetime. Once those patches are deployed you should have any browser based desktop sharing software, like Google Hangouts, working fully under Wayland (and X).

• We need Testers for new updated isos

• If yo can help test come see us in Freenode in the #fedora-respin channel

• Test Day will focus on OpenJDK 11 and OpenJDK 10. Currently, we have java-1.8.0-openjdk as main JDK in Fedora. It accompanied java-1.7.0-openjdk as JRE for a year, and replaced it in buildroot in F21. Similarly, as did java-1.7.0-openjdk to java-1.6.0-openjdk in F16 as parallel JRE and replaced it in F17 in build root and main JDK. However, today the situation is more complicated. Oracle changed release process, see OpenJDK 11 summary and OpenJDK 10 summary, so currently, in F27 and up, you have java-1.8.0-openjdk as main JDK, java-openjdk as rolling release of STS JDK 10, and java-11-openjdk as techpreview of future LTS JDK. Javaws is provided in another package – icedtea-web

• With Fedora 29 Beta set to ship today, here’s a reminder about some of the great changes on the way with this next installment of the Fedora Linux distribution that is on track to officially release around the end of October.

• - GNOME 3.30 makes up the default desktop environment and the many improvements to the GNOME Shell / Mutter and all the contained components.

Debian Family

• Back in February, I got curious to see if VLC now supported Bittorrent streaming. It did not, despite the fact that the idea and code to handle such streaming had been floating around for years. I did however find a standalone plugin for VLC to do it, and half a year later I decided to wrap up the plugin and get it into Debian. I uploaded it to NEW a few days ago, and am very happy to report that it entered Debian a few hours ago, and should be available in Debian/Unstable tomorrow, and Debian/Testing in a few days.

Derivatives

Canonical/Ubuntu

• This evening the “Cosmic Cuttlefish” embarked on its beta freeze ahead of the official Ubuntu 18.10 Beta due out later this week.

• Ubuntu Release Team member Adam Conrad has announced the beta freeze with hopes of delivering the beta images on Thursday, 27 September.

• If the beta preparations go as planned, the Ubuntu 18.10 kernel freeze based on the Linux 4.18 code-base is set to happen on 4 October. The final code freeze and release candidates are than due on 11 October. The official Ubuntu 18.10 release is penciled in for 18 October.

Devices/Embedded

• /e/, a Google-free fork of Android, reached a milestone this month with its initial ROM release. It’s available for download, so you can kick the tires, with nightly builds delivered via OTA (over the air) updates.

• El Reg interviewed the project’s leader, Gael Duval, in the summer. Duval launched and led the Linux Mandrake project. Back then it was called “eelo”, but has morphed into just /e/ – which autocorrect features won’t try to turn into “eels”.

• The project is significant in that the European Commission recently noted how few people switch platforms. If you’re on Apple or Android today, the chances are you will be on the same platform, plugged into the same “ecosystem” of peripherals and services, in 10 years. So it wants more variety and competition within the Android world.

• /e/ derives from LineageOS, itself a fork of CynaogenMod, so it can run on around 30 phone models including the Samsung Galaxy S7, and several recent-ish OnePlus devices.

Android

• It turned out that it’s possible to reset the blasted thing merely by holding it. If someone grabs it and pays no attention to what’s on the screen, then it’s easy to press and hold the edge power button inadvertently. That brings up a dialog that has 2 touch buttons for power off and reset. The same hand that’s holding the power touches the screen and causes the reset (a knuckle where the finger meets the palm does that perfectly).

Free Software/Open Source

• In continuance with the Public Education Rejuvenation Mission of Kerala Government, a two-day sub-district wise training camp on Free and Open Source Software (FOSS) applications for the Little KITE members would be conducted by KITE (Kerala Infrastructure and Technology for Education).

• As part of the PERM initiative,the Little KITE clubs currently include 58,380 student members from 1901 schools and it would be the 14,000 students out of these who excelled in school level trainings, who have been included for the 2-day camp. Training centers have been arranged in each of the 163 sub districts for the 2-day camp, which would only make use of Free and Open Source Software.

• Today’s business IT landscape has grown and exceeded beyond the highest estimates, and storage growth is no exception. People and machines are consuming unstructured data more than ever, and businesses have to continually reinforce their storage capabilities to keep up with the challenges of storing large volumes of business data.

• For CIOs, storage systems that can provide greater flexibility and choice, as well as the capability to identify unstructured data better to categorize, utilize and automate the management of it throughout its lifecycle are seen as the ideal solution.

• One answer to solving the storage issue is software-defined storage (SDS) which separates the physical storage hardware (data plane) from the data storage management logic or ‘intelligence’ (control plane). Needing no proprietary hardware components, SDS is the perfect cost-effective solution for enterprises as IT can use off-the-shelf, low-cost commodity hardware which is robust and flexible.

• After developing it internally for over 10 years, the National Cybersecurity Agency of France (ANSSI) has decided to open source CLIP OS, a Linux-based operating system developed “to meet the specific needs of the [French] administration,” and is asking outside coders to contribute to its development.

• We are extremely grateful to those who filled out the survey. We feel that our research can help create better environments at work, where team members can share knowledge and innovate.

• Purpose of the Study Our research is focused on knowledge sharing in ambiguous circumstances. Six Sigma is a method of quality control that should reduce ambiguity, given its structured approach. We ask whether the reduction in ambiguity is coupled with a reduction in knowledge sharing as well.

• Open source communities are no doubt playing a key role in moving the telecommunications industry forward, but not everyone is on board the bandwagon.

• Over the past five months or so, we’ve spent a fair amount of time writing about open source groups and standards development organizations (SDOs) such as the Linux Foundation, MEF, Open Networking Foundation, OpenDaylight, the TM Forum and ETSI, and there’s clearly more cooperation afoot for the good of the industry.

• But artificial intelligence startup B.Yond’s chief marketing officer, Rikard Kjellberg, said his company has to be careful when it comes to choosing which open source community to commit its resources to. Kjellberg spoke to FierceTelecom on the heels of the AT&T Spark conference earlier this month.

• The Collabora open-source consulting firm whose expertise spans from the Linux kernel to LibreOffice and X.Org had another successful year. The UK-based company last week reported their 2017 financial position last week providing a glimpse at the viability of open-source / free software consulting.

• Family and friends have gotten a rudimentary level of understanding of what curl is and what it does. I’m not suggesting they fully grasp it or know what an “internet protocol” is now, but at least a lot of people understand that it works with “internet transfers”. It’s not like people were totally uninterested before, but when I was given this prize – by a jury of engineers no less – that says this is a significant invention and accomplishment with a value that “can not be overestimated”, it made them more interested. The little video that was produced helped:

• Communications service providers (CSPs) are increasingly keen to adopt open source technologies to deliver their services, according to research.

• At this week’s Open Networking Summit Europe in Amsterdam, delegates heard that DevOps, automation, cloud, big data and analytics, software-defined networking (SDN), and management and orchestration (MANO) were increasingly being supported by open source solutions.

• Commissioned research questioned 150 CSP representatives across 98 companies worldwide. It found that 98% of CSPs are “confident” that open networking solutions can achieve the same level of performance as traditional networking solutions.

Events

• Tomorrow marks the start of the annual X.Org Developers’ Conference that is not only about the X11 server but also Mesa, Wayland, Linux input, and other areas of the desktop stack.

• It’s set to be another interesting XDC with talks about Vulkan in Mesa, multi-GPU device selection in OpenGL, Virtual KMS, DRM GPU scheduler, continuous integration, the new Intel Iris Gallium3D driver, the state of ARB_gl_spirv for Mesa, OpenCL support via NIR/SPIR-V. HMM, and more.

Web Browsers

Chrome

• When Google launched Chrome ten years ago, it seemed like one of those rare cases where everyone wins. In 2008, the browser market was dominated by Microsoft, a company with an ugly history of using browser dominance to crush their competitors. Worse, Microsoft was making noises about getting into the search business. This posed an existential threat to Google’s internet properties.

• In this setting, Chrome was a beautiful solution. Even if the browser never produced a scrap of revenue for Google, it served its purpose just by keeping the Internet open to Google’s other products. As a benefit, the Internet community would receive a terrific open source browser with the best development team money could buy. This might be kind of sad for Mozilla (who have paid a high price due to Chrome) but overall it would be a good thing for Internet standards.

• This system, Sync, allows users to log in with their Google accounts inside Chrome and optionally upload and synchronize local browser data (history, passwords, bookmarks, and other) to Google’s servers.

• Sync has been present in Chrome for years, but until now, the system worked independently from the logged-in state of Google accounts. This allowed users to surf the web while logged into a Google account but not upload any Chrome browsing data to Google’s servers, data that may be tied to their accounts.

• Google brought in a bunch of new features in the new Chrome 69 version. While many of them were much appreciated, some didn’t go well with the users. Apparently, there is another less advertised tweak that people are not happy about.

• A number of reports have highlighted that Chrome 69 – the one that made your tabs all curvy – is automatically logging people in as soon as they hit a Google-owned site. In other words, if you use Google, Gmail, YouTube, Google Docs, Google Maps and are logged in, then Chrome will also follow suit.

• Yet another privacy concern for Google Chrome users! Previously, we talked about Google’s auto-login mechanism which is hijacking our local Google Chrome data. Now, another Chrome 69 setting has come to light which is risking our freedom to remove data.

Mozilla

• A farewell and au revoir to a great gentleman in making the most of your old Mac, Charles W. Moore, who passed away at his home in rural Canada on September 16 after a long illness. Mr Moore was an early fan of TenFourFox, even back in the old bad Firefox 4 beta days, and he really made his famous Pismo PowerBook G3 systems work hard for it.

• Good news. It looks like we’re having a consent management mini-conference as part of Mozfest next month. (I’m one of the organizers for the Global Consent Manager session, and plan to attend the others.)

• Data breaches, when information like your username and password are stolen from a website you use, are an unfortunate part of life on the internet today. It can be hard to keep track of when your information has been stolen, so we’re going to help by launching Firefox Monitor, a free service that notifies people when they’ve been part of a data breach. After testing this summer, the results and positive attention gave us the confidence we needed to know this was a feature we wanted to give to all of our users.

• That sinking feeling. You’re reading the news and you learn about a data breach. Hackers have stolen names, addresses, passwords, survey responses from a service that you use. It seems like we’re having that sinking feeling more and more. But we don’t have to despair. While technology will never be impervious to attacks, we can make sure that we’re able to respond when we learn that our personal data and passwords are part of a breach.

• A particular vulnerability in the present Firefox browser has been unraveled by the security researcher and basically the creater of this bug, Sabri Haddouche in his blog post. He pointed towards a bug which brings the browser and also the operating system possibly with a ‘Reap Firefox’ attack crash. This vulnerability affects Firefox versions working under Linux, macOS and Windows.

• After months of prototyping and judging, Mozilla and the National Science Foundation are fueling the best and brightest ideas for bringing more Americans online

• Today, Mozilla and the National Science Foundation (NSF) are announcing the grand prize winners in our Wireless Innovation for a Networked Society (NSF-WINS) Challenges — an audacious competition to connect millions of unconnected Americans.

• The grand prize winners are as novel as they are promising: An 80-foot tower in rural Appalachia that beams broadband connectivity to residents. And, an autonomous network that fits in two suitcases — and can be deployed after earthquakes and hurricanes.

• Mozilla, the organisation that produces the Firefox browser and makes a loud noise about its open source credentials, is quietly collecting telemetry data on its users by the use of hidden add-ons, even though publicly visible telemetry controls are not selected.

• In other Firefox news, the browser evidently is collecting telemetry data via hidden add-ons, ITWire reports. The ITWire post also quotes Mozilla’s Marshall Eriwn, director of Trust and Security: “…we will measure Telemetry Coverage, which is the percentage of all Firefox users who report telemetry. The Telemetry Coverage measurement will sample a portion of all Firefox clients and report whether telemetry is enabled. This measurement will not include a client identifier and will not be associated with our standard telemetry.”

Oracle/Java/LibreOffice

• My reminiscing led me to reach out to the Document Foundation, which governs LibreOffice, to learn more about the history of this open source productivity software.

• The Document Foundation’s team told me that “StarWriter, the ancestor of the LibreOffice suite, was developed as proprietary software by Marco Börries, a German student, to write his high school final thesis.” He formed a company called Star Division to develop the software.

• In 1999, Sun Microsystems bought Star Division for $73.5 million, changed the software’s name to OpenOffice.org, and released the code as open source. Anyone could download the office suite at no charge for personal use. The Document Foundation told me, “For almost 10 years, the software was developed under Sun stewardship, from version 1.0 to version 3.2. It started with a dual license—LGPL and the proprietary SISSL (Sun Industry Standard Software License)—but it evolved to pure LGPL from version 2.0.”

• Today we’re releasing the first SRU for Oracle Solaris 11.4! This is the next installment in our ongoing support train for Oracle Solaris 11 and there will be no further Oracle Solairs 11.3 SRUs delivered to the support repository. Due to the timing of our releases and some fixes being in Oracle Solaris 11.3 SRU35 but not in 11.4, not all customers on Oracle Solaris 11.3 SRU35 were able to update to Oracle Solaris 11.4 when it was released. SRU1 includes all these fixes and customers can now update to Oracle Solaris 11.4 SRU1 via ‘pkg update’ from the support repository or by downloading the SRU from My Oracle Support Doc ID 2433412.1.

• It’s been just under one month since Oracle’s long-awaited debut of Solaris 11.4 and now its first stable release update has been issued.

• Solaris 11.4 SRU1 is mainly intended to fix some early bugs and those that didn’t make the cut for getting in the initial 11.4 release. One new feature is support for “Memory Reservation Pools for Kernel Zones” to help systems with high levels of memory contention or fragmented memory by allowing memory to be reserved ahead of time.

Pseudo-Open Source (Openwashing)

Funding

• Henry Zhu makes software that’s crucial to websites you use every day, even if you’ve never heard of him or his software.

• Zhu manages a program called Babel, which translates code written in one version of the programming language JavaScript into code written for another version of the language. That might not sound like a big deal. But because not all browsers support the latest version of JavaScript, Babel lets programmers use JavaScript’s latest features without worrying about which browsers will run the code. It’s useful enough that it’s been adopted by companies like Facebook, Netflix, and Salesforce.

• Open source developers, especially those who work on lesser known projects, do not get much attention or money for the work they do. While some developers are paid to work on open source projects as a part of their day jobs, they can get overwhelmed by the amount of work these projects require.

FSF/FSFE/GNU/SFLC

• GIMP is a fantastic artist’s tool for editing digital images, especially with the bevy of impressive features in the recent release of version 2.10. Of course, like all creative applications, you can get working more quickly if you can make yourself familiar with the various keyboard shortcuts and hotkeys available. GIMP, of course, gives you the ability to customize these shortcuts to match what you’re personally comfortable with. However, the default shortcuts that GIMP ships with are impressive and generally easy to get used to.

• This cheat sheet is not an exhaustive list of all of the defaults GIMP has available. Instead, it covers the most frequently used shortcuts so you can get to work as fast as possible. Plus, there should be a few in here that make you aware of a few features that maybe you weren’t aware of.

Programming/Development

• Rust is a fairly young and modern programming language with a lot of features that make it incredibly flexible and very secure. It’s also becoming quite popular, having won first place for the “most loved programming language” in the Stack Overflow Developer Survey three years in a row — 2016, 2017, and 2018.

• Rust is also an open-source language with a suite of special features that allow it to be adapted to many different programming projects. It grew out of what was a personal project of a Mozilla employee back in 2006, was picked up as a special project by Mozilla a few years later (2009), and then announced for public use in 2010.

• Far gone are the days when you wrote Perl for the web in just CGI. Dancer, Catalyst and Mojolicious are the modern ways of going about it, with Mojo’s version 8.0, code-named “Supervillain”, being released just last week.

• Each framework has its own distinct advantages, with Dancer being considered the most lightweight and with the lowest entry barrier; and Catalyst being considered the most heavyweight and with a steep learning curve. Mojo floats somewhere in the middle, its own strongest point being its claim to be a “Real time Web framework” due to its Websockets and non-blocking/async capabilities provided out of the box. With that said, let’s discover what Mojo’s newest version has to offer.

• The Portable Computing Language (a.k.a. POCL or PortableCL) is the effort for getting OpenCL running on CPUs as well as other hardware for this open-source code-base that supports OpenCL 1.2 with some OpenCL 2.0+ functionality.

• The main “feature” of POCL 1.2 is support for LLVM Clang 7.0 as previously the support was limited to LLVM 6.0, but now this new version of LLVM is supported. The HWLOC 2.0 library is also now supported. There are also some minor feature additions like device-side printf being supported.

• Over two years ago I wrote about the C++ Lifetimes proposal and some of my concerns about it. Just recently, version 1.0 was released with a blog post by Herb Sutter.

• Comparing the two versions shows many important changes. The new version is much clearer and more worked-out, but there are also significant material changes. In particular the goal has changed dramatically.

Leftovers

Science

• In 1996 they began experimenting with the Stanford homepage and soon came up with the PageRank algorithm – a ranking system which would prove to be Page and Brin’s breakthrough idea.

• The algorithm was devised to give more weight to links that came from more authoritative pages – the more backlinks a site had, the more likely it was to be a good source, similar to an academic paper. That allowed Page and Brin to rank search results not only by keyword frequency but by authority. And because the system analysed links, the more the web grew the better Backrub got.

• In August 1996, Backrub became Google, a play on the term googol, meaning the large number 10 to the power of 100. The first version appeared on the Stanford site, run from cobbled-together bits of computers scavenged by Page and Brin. The system demanded so much bandwidth it would regularly take down the whole of Stanford’s internet connection, but it succeeded in letting users search all 24m pages it had stored in its database.

Health/Nutrition

• Brazil yesterday signed an agreement with the Medicines Patent Pool (MPP), through which the country will share patent information with the MPP. The Brazilian IP office joins several others in an effort to regular update of the MPP’s database on patent information. Separately, high-level representatives of Latin American and Iberian countries met on the side of the annual World Intellectual Property Organization General Assemblies taking place this week.

• A few weeks ago I left the house and while driving realised I had forgotten my smartphone. It was not a good feeling – I felt disadvantaged and disconnected. Yet as a younger man I happily travelled around the world with just my wristwatch and a backpack. What has happened to us since those days?

• Seven of Canada’s top 10 cannabis patent holders are major multi-national pharmaceutical companies, according to a joint research project between Washington D.C. based New Frontier Data, the global authority in data, analytics, and business intelligence for the cannabis industry, and London based cannabis bio-technology firm, Grow Biotech .

• “Big Pharma’s inevitable entrance into the Cannabis space has arrived. The top nine medical conditions for which Cannabis can be used as an alternative treatment could cannibalize as much as $20 billion in U.S. pharmaceutical sales in the next two years. As more medicinal applications for the plant are discovered, and more physicians and patients integrate cannabis into treatment regimes, the potential impact of cannabis on healthcare will continue to grow for years to come,” said New Frontier Data Founder & CEO Giadha Aguirre de Carcer.

• What began as a trade skirmish over Donald Trump’s imposition of a 10-per-cent tariff on Canadian steel and aluminum is now clearly a trade war. The miasma is only just lifting from the G7 summit in Charlevoix, Que., in which a Justin Trudeau press conference over a spiked communiqué sparked a Trump tantrum.

• But the war’s final battle will not be the tariff that our government has already imposed in retaliation on American pizza, whisky, mattresses, coffee, et cetera—in fact, our tit-for-tat tariffs have only caused the White House to double down and promise even more tariffs against Canada soon. That means that Canada’s symmetrical retaliation is not working—and if we do not rethink our strategy now, we could soon be inside a tornado-like spiral of escalating tariffs, causing rising prices, sinking economies, and growing joblessness on both sides of the border.

Security

• Zero Day Initiative or ZDI, a division of the Japanese multinational cyber security and defense company recently found a serious security flaw in Microsoft’s JET Database Engine which is inculcated and used in various different Microsoft products.

• ZDI reported that this vulnerability will allow potential attackers to execute an arbitrary code in Microsoft’s JET Database Engine, which is an underlying component of a database, a collection of information stored on a computer in a systematic way, this acts as the groundwork for many of Microsoft’s product, including the most widely used Microsoft Office. ZDI stated this to be an “out-of-bounds (OOB)” write in the JET, “An attacker could leverage this vulnerability to execute code under the context of the current process, however it does require user interaction since the target would need to open a malicious file,” ZDI further added in their report.

• From the beginning we have had big plans for the Librem Key. When we first announced our partnership with Nitrokey to produce the Librem Key all we could talk about publicly was the standard USB security token features it would have and some of the integration possibilities between the Librem laptop and Librem Key that would make security easier for the average person. What we couldn’t say at the time was that we were also working toward making the Librem Key do something that doesn’t exist anywhere else–integrate it with the tamper-evident Heads BIOS to make it incredibly easy to tell whether your BIOS has been tampered with. In this post I’m going to talk about why we wanted to add this feature, some of the work that went into it, and dive into some of the technologies that are working behind the scenes to help you understand how it works.

• While last week Purism entered into the hardware security space with the Librem Key as a USB-based smart card, industry veteran Yubico today announced their YubiKey 5 Series.

• The YubiKey 5 Series is the industry’s first multi-protocol security keys with support for FIDO2, the new open authentication standard for passwordless logins. Among the other supported protocols are OpenPGP, FIDO U2F, OATH-HOTP, and others. In addition to USB-C and USB-A interfaces, YubiKey 5 also has near-field communication (NFC) support.

• Yubico announced the launch of the YubiKey 5 series this morning, which are the first multi-protocol security keys to support FIDO2/WebAuthn and allow you to replace “weak password-based authentication with strong hardware-based authentication”. You can purchase them here for $45.

• Yubico, the leading provider of hardware authentication security keys, today announced the launch of the YubiKey 5 Series, the industry’s first multi-protocol security keys supporting FIDO2/WebAuthn. With this new addition, the YubiKey 5 Series has the capability to replace weak password-based authentication with strong hardware-based authentication.

• Since people’s location is a very sensitive piece of information, security of this information had been the core part of Geoclue2 design. The idea was (and still is) to only allow apps access to user’s location with their explicit permission (that they could easily revoke later). When Geoclue2 was designed and then developed, we didn’t have Flatpak. Surely, people were talking about the need for something like Flatpak but even with those ideas, it wasn’t clear how location access will be handled.

• Hence we decided for geoclue to handle this itself, through an external app authorizing agent and implemented such an agent in GNOME Shell. Since there is no reliable way to identify an app on Linux, there were mixed reactions to this approach. While some thought it’s good to have something rather than nothing, others thought it’s better to wait for the time when we’ve the infrastructure that allows us to reliably identify apps.

• A security flaw has been unearthed in macOS Mojave, Apple’s latest desktop OS update, by a well-known security researcher Patrick Wardle.

• As reported by Bleeping Computer, Wardle has discovered a bypass flaw in macOS Mojave using which hackers can gain access to contacts data from the address book with the help of an app that does not have the required permissions.

Defence/Aggression

• The ‘force’ would have around 2,000 operatives drawn from GCHQ and the armed forces. However, the establishment of the organisation has been held up by internal political wrangling over funding, and which part of government will have ultimate command of the unit.

• If Osama Bin Laden was not sufficient warning that decades of money, arms and other support from the Western security services does not render a jihadi a friend of the West, then the Manchester bomber, Salman Abedi, should have opened British eyes forever to the danger. In collaboration with MI5, Abedi had been fighting in the ongoing proxy war for Western oil interests in Libya, before being rescued by the Royal Navy. Back home in Manchester, he carried out an attack of appalling violence against a primarily young and female target group.

• So it would be very foolish indeed to rely on the fact that the jihadi logistic support and propaganda group the White Helmets is largely British government funded, to expect its members who are now, like Abedi, being brought into the UK, to behave as quiet citizens. The links of the White Helmets to Al-Nusra and Al-Shams and other jihadi groups are deep – they chose to be evacuated to Idlib together from numerous sites. The reason there is no substantial corpus of independently filmed evidence of the White Helmets’ work is that they co-operate with people who would chop off western journalists’ heads on sight. In many well-attested cases, they are the same people.

• In ending all funding to the White Helmets, the Dutch government did not wish to be confrontational towards the other neo-conservative governments who are funding and exploiting the propaganda from the White Helmets. Their report was therefore diplomatically phrased. Funding for the White Helmets may have “inadvertently” fallen into the hands of armed extremists, while unacceptable contact between the White Helmets and extreme jihadists was “inevitable” in the ares they operated.

• Taking its title from a 1950s CIA manual on killing, the young LCC MA graduate’s project reveals the surreal clash of leaked CIA documents, government propaganda, and bananas

• In 1997, a document titled A Study of Assassination was released by the CIA as part of the Freedom of Information Act. It is believed to have been created in 1953 with the purpose of instructing agents on how to kill, and was released with a collection of files relating to the 1954 CIA-backed overthrow of the-then newly-elected leader of Guatemala, Colonel Jacobo Arbenz Guzman. The operation in Guatemala was lobbied for by United Fruit Company, an American corporation that traded in tropical fruit, mainly bananas, and which wielded huge power in Central America at the time.

• When he found out about these documents, George Selley was instantly captivated, and his new project, A Study of Assassination, combines pages from the manual with archival press images, banana advertisements, and Cold War propaganda. BJP caught up with the recent London College of Communication MA graduate to find out more about this project and his approach to images.

Transparency/Investigative Reporting

• On September 21, The Guardian ran an absolutely sensational exclusive, based on disclosures made by “multiple” anonymous sources to Luke Harding, one of the paper’s leading journalists – in 2017, Russian diplomats allegedly held secret talks in London with associates of Assange, in an attempt to assist in the Wikileaks founder’s escape from the UK.

• The dastardly conspiracy would’ve entailed Assange being smuggled out of the Ecuadorian embassy in Knightsbridge under cover of Christmas Eve in a diplomatic vehicle and transported to Russia, where he’d be safe from extradition to the US, ending his eight-years of effective arbitrary detention in the process.

• In any event, the audacious plot was eventually aborted after being deemed “too risky” — even for the reckless daredevils of Moscow — mere days before its planned execution date. Rommy Vallejo, head of Ecuador’s intelligence agency, is said to have travelled to the UK around December 15 to supervise the operation, and left when it was called off.

• According to Murray, Narvaez told the Guardian that there was “no truth” in the story. The publication ran the story, which was written by, among others, former Guardian Moscow correspondent Luke Harding, regardless. The piece relied on four separate sources for their claims, though they give no more details than that.

• Of the Guardian’s sources, Murray states: “I strongly suspect that, as usual, MI6 tool Luke Harding’s “anonymous sources” are in fact the UK security services, and this piece is entirely black propaganda produced by MI6.”

• READ MORE: British Media is not waving, it’s drowning…in a sea of its own mendacity

• Harding worked for the Guardian in Russia for four years before his visa expired. After being subsequently refused entry to Russia, Harding claimed he had been expelled from the country for being critical of the Kremlin, a claim denied by the Russian government. He has since wrote extensively on Russia while based in the UK.

• Last year, as investigators examined claims by longtime Donald Trump adviser Roger Stone that he was in contact during the 2016 election with WikiLeaks, Stone asserted that he had only learned about the group’s plans through an intermediary: Randy Credico, a comedian and political activist. Credico has denied being Stone’s go-between. And now he tells Mother Jones that Stone offered to help him pay his legal fees in what Credico believed was an effort to stop him from contradicting Stone’s account of their interactions during the 2016 campaign.

• “He knew that I was upset,” Credico says. “He wanted me to be quiet. He wanted me to go along with his narrative. He didn’t want me talking to the press and saying what I was saying.”

• Stone, a Republican operative who cut his teeth working for Richard Nixon’s presidential campaign, and Credico, a standup comic long involved in left-wing causes, met in 2002 through their mutual work on drug legalization efforts and formed an unlikely friendship. They are now embroiled in a bitter conflict ignited by the Russia investigations undertaken by Congress and by special counsel Robert Mueller.

• Assange has been staying at the Embassy of Ecuador in London since 2012, unable to leave for fear of being detained by the UK authorities.

• Since 2006, WikiLeaks, founded by Assange, has revealed a vast number of classified documents, including sensitive information allegedly related to US diplomats and the American intelligence community. This has led to a criminal investigation into its activities, initiated by US authorities.

Finance

• Asked about the cash advance service, Stripe acknowledged that it was testing something out and pointed us to this tweet without elaborating more. So we don’t know if Stripe has been offering other users different premiums or payback percentages, nor if $25,000 is the cap or if it’s loaning more, nor if it’s working with a third-party to provide the financing, or whether it is offering it off its own balance sheet.

• Exciting news for capitalism is the recent achievement of trillion-dollar value for both Amazon and Apple, making them the first corporations to obtain such a lofty status. Amazon’s skyrocketing growth makes its CEO, Jeff Bezos, the world’s richest person with an $160 billion net worth.

• Driving the engine of global wealth concentration are giant transnational investment management firms. In 2017, seventeen trillion-dollar investment companies collectively controlled $41.1 trillion of capital. These firms are all directly invested in each other, making them a huge cluster of centralized capital managed by just 199 people, who decide how and where that wealth will be invested.

• In the case of Amazon, the top investment management corporations are: Vanguard $56.7 billion, BlackRock $49.5 billion, FMR $33 billion, Capital $33 billion, State Street $29 billion, and most of the other trillion-dollar Giants and many others who hold 58.6% of Amazon shares.

• So, while Bezos is a large tree in the forest, the forest itself is groomed by a few hundred global power elites making investment decisions that drive the concentration of wealth into coffers of the 1%. These elites interact through non-governmental policy-making organizations—privately funded by large corporations—that include the Council of Thirty, Trilateral Commission, and the Atlantic Council. Their role is to facilitate, manage, and protect the free flow of global capital. They do this by providing policy recommendations and instructions to governments, intelligence services, security forces, NATO, the Pentagon, and transnational governmental groups including the G-7 G-20, World Bank, IMF, and International Bank of Settlements.

AstroTurf/Lobbying/Politics

• On September 14th, we wrote about a draft executive order basically tasking the executive branch with “investigating” the major internet companies for evidence of “bias” that might lead to antitrust activity. As we wrote at the time, the draft executive order was poorly drafted, didn’t make much sense, and was almost certainly unconstitutional. It took a week, but the rest of the tech policy world finally discovered the same draft executive order this past Friday (amusingly with some insisting that they had the “scoop” a week after we wrote about it).

• Now, the White House has admitted that the document is “real”, though they’re not entirely sure who crafted it, it hasn’t gone through any of the normal processes, and there’s no intention of moving forward with it. In other words, it sounds like a pet project of someone in the White House to have in a drawer in case it was needed at some future date.

Censorship/Free Speech

• Nobody who knows anything about YouTube will be surprised. Time and again, researchers have discovered that when videos with political or ideological content are uploaded to the platform, YouTube’s “recommender” algorithm will direct viewers to more extremist content after they have watched the first one. Given that most people probably have the autoplay feature left on by default, that means that watching YouTube videos often leads people to extremist sites.

• Strangely, this doesn’t just hold for political or other types of controversial content. Zeynep Tufekci, a well-known technology commentator, found that videos about vegetarianism led to videos about veganism, videos about jogging led to videos about running ultramarathons, and so on. “It seems,” she wrote, “as if you are never ‘hardcore’ enough for YouTube’s recommendation algorithm. It promotes, recommends and disseminates videos in a manner that appears to constantly up the stakes.”

• Given its billion or so users, she concluded that “YouTube may be one of the most powerful radicalising instruments of the 21st century.”

• In observance of Banned Books Week 2018, Mickey speaks with three guests, all involved in different facets of defending Americans’ right to read. Betsy Gomez is coordinator of Banned Books Week, Charles Brownstein is executive director of the Comic Book Legal Defense Fund, and Abena Hutchful leads the Youth Free Expression Program at the National Coalition Against Censorship.

• So, the braintrust behind this assertion includes three missionaries and their children and 6-12 complaints over the past decade. Obviously, the only conclusion to draw is that indoctrination is out of hand and only the powerful velvet fist of government regulation can stop it. If the First Amendment must be destroyed to save the children, it’s a sacrifice Tallman is willing to make on behalf of the few that agree with him and the large majority of non-idiots who don’t.

• Everyone who isn’t Tallman has already greeted his proposed legislation with Constitution-based ridicule. The law will never pass. If something goes horribly wrong and the bill does pass, the courts will strike it down immediately.

• Whatsapp has been trying to curb fake news on its platform for a long time now. After multiple cases of lynching caused due to fake news, the Indian government asked the company to solve this issue or risk a ban in the country.

• Now the instant messaging service has appointed a ‘grievance officer’ to address complaints regarding false news and misinformation spreading on the platform in India.

Privacy/Surveillance

• The smartphones we use today are sophisticated little machines that have gone through an incredible evolution over the last decade. They are now capable of working as a personal assistant that can monitor our heartbeat, track our movements, and anticipate our needs.

• But have you ever wondered how does your smartphone achieve such remarkable feats? A lot of those coolest feats are accomplished through different sensors in your phone. But do you know how many smartphone sensors are there in your device or what their purpose is?

• We don’t hear much from anyone other than FBI officials about the “going dark” theory. The DOJ pitches in from time to time, but it’s the FBI’s baby. And it’s an ugly baby. Earlier this year, the FBI admitted it couldn’t count physical devices. The software it used to track uncrackable devices spat out inflated numbers, possibly tripling the number of phones the FBI claimed stood between it and justice. FBI officials like James Comey and Chris Wray said “7,800.” The real number — should it ever be delivered — is expected to be less than 2,000.

• The FBI also hasn’t been honest about its efforts to crack these supposedly-uncrackable phones. Internal communications showed the agency slow-walked its search for a solution to the San Bernardino shooter’s locked iPhone, hoping instead for a precedential federal court decision forcing device manufacturers to break encryption whenever presented with a warrant.

• The FBI appears to have ignored multiple vendors offering solutions for its overstated “going dark” problem. At this point, it’s public knowledge that at least two vendors have the ability to crack any iPhone. Israel’s Cellebrite — the company presumed to have broken into the San Bernardino phone for the FBI — is one of them. The other is GrayShift, which sells a device called GrayKey, which allows law enforcement to bypass built-in protections to engage in brute force password cracking.

• We don’t know how often the FBI avails itself of these services. A pile of locked phones numbering in the thousands (but which thousands?!) suggests it is allowing the serviceable (vendor services) to be the enemy of the perfect (favorable court rulings and/or legislation).

• On September 13, after a five-year legal battle, the European Court of Human Rights said that the UK government’s surveillance regime—which includes the country’s mass surveillance programs, methods, laws, and judges—violated the human rights to privacy and to freedom of expression. The court’s opinion is the culmination of lawsuits filed by multiple privacy rights organizations, journalists, and activists who argued that the UK’s surveillance programs violated the privacy of millions.

• The court’s decision is a step in the right direction, but it shouldn’t be the last. While the court rejected the UK’s spying programs, it left open the risk that a mass surveillance regime could comply with human rights law, and it did not say that mass surveillance itself was unlawful under the European Convention on Human Rights (a treaty that we discuss below).

• But the court found that the real-world implementation of the UK’s surveillance—with secret hearings, vague legal safeguards, and broadening reach—did not meet international human rights standards. The court described a surveillance regime “incapable” of limiting its “interference” into individuals’ private lives when only “necessary in a democratic society.”

• In particular, the court’s decision attempts to rein in the expanding use of mass surveillance. Originally reserved for allegedly protecting national security or preventing serious threats, use of these programs has trickled into routine criminal investigations with no national security element—a lowered threshold that the court zeroed in on to justify its rejection of the UK’s surveillance programs. The court also said the UK’s mass surveillance pipeline—from the moment data is automatically swept up and filtered to the moment when that data is viewed by government agents—lacked meaningful safeguards.

• There is little to celebrate for digital rights in China. A seemingly constant stream of developments is putting human rights defenders on high alert, as the Chinese state grows ever more powerful and cultivates its surveillance capabilities, integrates social media monitoring with everyday policing, and appears to be persuading international companies like Apple and Google to comply with Chinese law and practices that harm human rights in order to enter the market. China also runs the largest biometric policing system known to date.

• Somewhat hidden under the din of this overtly dystopian discourse are the small yet powerful moves that China is making that are likely to have a long-term negative impact on global cybersecurity, even beyond the Great Wall. These include the government’s strategic withholding of technology vulnerabilities from the international community.

• It all seems so far away now, but in 2013, during the early days of the Snowden revelations, a story about the NSA’s activities emerged that apparently came from a different source. Bloomberg reported (behind a paywall, summarized by Ars Technica) that Microsoft was providing the NSA with information about newly-discovered bugs in the company’s software before it patched them. It gave the NSA a window of opportunity during which it could take advantage of those flaws in order to gain access to computer systems of interest. Later that year, the Washington Post reported that the NSA was spending millions of dollars per year to acquire other zero-days from malware vendors.

• A stockpile of vulnerabilities and hacking tools is great — until they leak out, which is precisely what seems to have happened several times with the NSA’s collection. The harm that lapse can cause was vividly demonstrated by the WannaCry ransomware. It was built on a Microsoft zero-day that was part of the NSA’s toolkit, and caused very serious problems to companies — and hospitals — around the world.

• The other big problem with the NSA — or the UK’s GCHQ, or Germany’s BND — taking advantage of zero-days in this way is that it makes it inevitable that other actors will do the same.

• The Senate Commerce Committee is holding a hearing on consumer privacy this week, but consumer privacy groups like EFF were not invited. Instead, only voices from big tech and Internet access corporations will have a seat at the table. In the lead-up to this hearing, two industry groups (the Chamber of Commerce and the Internet Association) have suggested that Congress wipe the slate clean of state privacy laws in exchange for weaker federal protections. EFF opposes such preemption, and has submitted a letter to the Senate Commerce Committee to detail the dangers it poses to user privacy.

• Current state laws across the country have already created strong protections for user privacy. Our letter identifies three particularly strong examples from California’s Consumer Privacy Act, Illinois’ Biometric Privacy Act, and Vermont’s Data Broker Act. If Congress enacts weaker federal data privacy legislation that preempts such stronger state laws, the result will be a massive step backward for user privacy.

• Krieger and Systrom built Instagram and sold it to Facebook for $715 million six years ago. When the deal was announced, the company had only 13 employees and 30 million registered users. Now more than 1 billion people use the app monthly, and it is the main source of advertising revenue for Facebook outside the social network’s main news feed.

• [...]

• Kevin Systrom and Mike Krieger, who have been at the company since Instagram’s acquisition by Facebook in 2012, had been able to keep the brand and product independent while relying on Facebook’s infrastructure and resources to grow. Lately, they were frustrated with an uptick in day-to-day involvement by Zuckerberg, who has become more reliant on Instagram in planning for Facebook’s future, said the people, who asked not to be identified sharing internal details.

• Without the founders around, Instagram is likely to become more tightly integrated with Facebook, making it more of a product division within the larger company than an independent operation, the people said.

• Mr. Systrom and Mr. Krieger did not give a reason for stepping down, according to the people, but said they planned to take time off after leaving Instagram. Mr. Systrom, 34, and Mr. Krieger, 32, have known each other since 2010, when they met and transformed a software project built by Mr. Systrom into what eventually became Instagram, which now has more than one billion users.

• Twitter has revealed that a bug in the Account Activity API could allow private messages sent to businesses between May 2017 and 10 September 2018 to have been accidentally cc’d to the developer of the business’ chosen platform.

• Twitter’s apologetic noises initially sound quite reassuring, until you read between the lines. Yes, the bug was fixed “within hours” of discovery, but when the exploit wasn’t found for 16 months that’s not a great deal of consolation. And sure, the bug affected less than 1 per cent of people on Twitter, but with a user base of 68 million, that could still mean anywhere between one and 680,000 people.

Civil Rights/Policing

• Members of Congress have a duty to protect their staffers from harassment by reforming the Congressional Accountability Act of 1995.

• It’s been nearly one year since the #MeToo movement came into public consciousness and months since the Senate and House of Representatives each passed legislation to reform the way Congress handles claims of harassment in its own workplace. But further action on the bills has stalled, and even after sitting members had to resign over their own misconduct, our elected officials have still not moved to effectively protect the safety of their employees.

• On Thursday, seven former congressional staffers sent a letter to congressional leaders in both the House and Senate, calling for meaningful reform of the Congressional Accountability Act of 1995, a law that applies civil rights and workplace safety laws to Congress. Each of the letter’s signatories experienced harassment or abuse while working for members of Congress. They describe in the letter the trauma and pain exacerbated by the current system that has failed to ensure their safety and hold wrongdoers to account.

• The stories these brave survivors share in their letter are harrowing. Anna Kain, Rebecca Weir, Ally Coll Steele, Katherine Cichy, Winsome Packer, Melanie Sloan, and Lauren Greene — all of whom worked for members of Congress — write of being sexually harassed, verbally berated, and publicly humiliated. They were grabbed and threatened — and they were not protected by the powerful people they served.

• In 2016, Oregon officials freed Anthony Montwheeler from the Oregon State Hospital, accepting his argument that he had faked mental illness for nearly 20 years to avoid prison.

• Last week, an Oregon judge ruled that Montwheeler, 50, was not competent to stand trial for an assault and two murders that prosecutors say he committed just weeks after his release. The judge ordered him returned to the hospital for treatment of depression brought on by the charges against him.

• The Montwheeler case has raised broader questions about Oregon’s handling of people charged with crimes and judged not guilty by reason of insanity, questions ProPublica and the Malheur Enterprise are examining in a yearlong project.

• State attorneys prosecuting Jason Van Dyke, the former Chicago police officer accused of murdering 17-year-old Laquan McDonald, finished presenting their case on September 20. The defense called its first witness September 24.

• The key moment so far in the trial known for the 16 shots Van Dyke fired—his entire magazine—came near the end of testimony in support of the prosecution’s case.

• A ballistics expert from the FBI testified that a quick movement on video by Van Dyke’s partner, Joseph Walsh, was “consistent with a flinch” commonly seen in people who are near a surprise shot being fired. The expert then used plumes of debris evident in the video to establish a timeline of shots that lasts “at least” 14.2 seconds.

• The expert, Scott Patterson, then showed the jury a video of another agent, one of the FBI’s top marksmen, firing 16 rounds into a target.

• This is an astounding reaction to incidents that are far too commonplace in this country. This is also an indictment of policing in America. There is no reason this reaction should be as stunning as it is. This should be standard operating procedure when cops screw up. Instead, we’re most often greeted with defense of indefensible actions combined with a multitude of efforts designed to make the SWAT raid victim appear as unsympathetic as possible.

• Wrong address raids, killings of unarmed citizens, excessive force deployment… all of these events are normally handled by police departments with maximum defensiveness and minimal acceptance of culpability. A law enforcement agency immediately stepping up to take responsibility for its errors — especially ones with potentially deadly outcomes — is a breath of fresh air in the fetid, stagnant swamp of US policing.

• But this shouldn’t be the ultra-rare exception. It should be the rule. The public law enforcement serves deserves far better than the condescending, self-serving crap it’s so often handed in the wake of incidents like these.

Internet Policy/Net Neutrality

• The problem is much bigger than Cleveland, but the FCC isn’t ready to do much about it. US customers pay some of the highest prices for broadband in the developed world, and broadband availability is sketchy at best for millions of Americans. But instead of tackling that problem head on, the FCC is increasingly looking the other way, relying on ISP data that paints an inaccurately rosy picture of Americans’ internet access. And as long as regulators are relying on a false picture of US broadband access, actually solving the problem may be impossible.

• Comcast’s latest effort to grow even larger is spooking even the company’s investors. “Growth for growth’s sake” has been the mantra of the telecom and TV sectors for years. Once growth in any particular market (like broadband) saturates, companies begin nosing about for efforts to grow larger in other sectors, even if it it’s well outside of their core competencies (see Verizon Sugarstring, Go90). Unfortunately for the end user, such growth isn’t accompanied by any meaningful parallel investment in quality product or customer service, a major reason so many users “enjoy” Comcast services today.

• At the same time, this growing power results in increased efforts to thwart any effort to rein in this power, leaving oversight of the natural monopolies more precarious than ever (see: net neutrality). That’s exceptionally true for Comcast, where the one-two punch of fading state and federal oversight, expiring NBC Universal merger conditions from its last 2011 megadeal, and a growing monopoly over broadband is forging a perfect storm of trouble.

Intellectual Monopolies

• The TriZetto Group has secured a victory in a trade secrets dispute after Syntel allegedly stole information from them.

• Syntel was previously sanctioned for refusing to comply with discovery orders and in the latest ruling from the US District Court for the Southern District of New York again found that Syntel had failed to comply with court orders.

• TriZettom, who develops and licenses software products in the healthcare industry, provides consulting services and hires contractors to perform some of this work with a previous contractor being Syntel.

• The two most important motions for summary judgment that Qualcomm is facing at present (and one might even say has ever faced in its history) are the Federal Trade Commission’s motion to hold that Qualcomm itself committed to extending standard-essential patent licenses to rival chipset makers such as Intel (a motion that has drawn broadbased support from industry) and a motion by Apple and four contract manufacturers to end Qualcomm’s double-dipping practice (selling chipsets and additionally collecting patent license fees). This post is about Qualcomm’s opposition in the Northern District of California to the former, but I’d also like to mention that Qualcomm is trying to duck the latter by means of a motion to dismiss all declaratory judgment claims relating to Qualcomm patents from the Apple (and contract manufacturers) v. Qualcomm case in the Southern District of California. When it turned out that its adversaries were going to insist on an adjudication of their patent exhaustion defense, Qualcomm requested expedited briefing, which Judge Gonzalo Curiel denied. The opposition brief to Qualcomm’s attempt to chicken out is due by the end of next week.

• [...]

• There’s no question that you need an antenna and electricity for mobile telephony. But that doesn’t mean the mobile baseband chip–or “modem chip” in accordance with Qualcomm’s brief–doesn’t implement the standard simply because it’s the central and decisive component. It’s the mastermind (a term that is key to the analysis of an alleged “divided infringement” of a method claim and fits here, too). Once the importance of the mastermind component is downplayed, the ultimate consequence may be that not even a device infringes since electricity must be provided by a utility, which in turn needs some energy source somewhere.

• In a 2014 case, GPNE Corp. v. Apple, Judge Koh herself held “as a matter of law that in [that] case, the baseband processor [was] the proper smallest salable patent-practicing unit.” And in Judge Koh’s court, a 2012 jury sided with Apple against Samsung on patent exhaustion, based on Samsung’s license to Qualcomm and Apple’s use of Qualcomm chips in certain products at issue back then. The same happened to Samsung in the Netherlands and France (where I attended a preliminary injunction hearing in 2011).

• This month we’ll revisit two issues covered previously: attempts to promote compulsory licensing as a way for lowering the cost of Medicare drugs and increasing the return on investment from federally-supported R&D.

Trademarks

• Indiana brewery owns “IT’S NOT NORMAL” trademark

• [...]

• This afternoon, Abnormal posted the following on Instagram; additional comment by company president and CEO Matt DeLoach follows. 3 Floyds did not immediately return a request for comment.

• It’s no secret that sometimes a company’s lawyers get way out ahead of how their client would want them to behave in protecting their intellectual property. We’ve seen many a story in which threat letters go out, only to have ownership on both sides of a dispute get together and settle things amicably. And if there’s any industry in which this should absolutely happen, it should be the craft brewing industry, where there has long been a tradition of fraternity and peaceful coexistence.

Copyrights

• The EU legislation, bad as it is in its own right, must be seen as part of a wider attempt to clamp down on free expression and the free exchange of ideas in the West at a time when fewer people than ever before believe establishment narratives. This month a British MP by the name of Lucy Powell, launched a bill in Parliament entitled the ‘Online Forums Bill’ to ban private Facebook groups which promote “hate”, “racism” and “fake news”. But who defines what these terms actually mean?

• If you would like to discuss the present and future of copyright, our friends at KNect365 would like to let you know that the annual International Copyright Law conference is returning to London on 27 and 28 November 2018.

• A few months ago, this blog reported that the EU Commission had issued a Notice to stakeholders on the impact that a no-deal Brexit would have on UK copyright.

• At that time, UK’s withdrawal from the EU without any agreement in place must have seen impossible: if one looks at the comments to the relevant post, a reader who called themselves a ‘Broptimist’ stated that the EU Commission’s document

• Google, Yandex and other prominent Internet companies in Russia are discussing the creation of a database of infringing content including movies, TV shows, games, and software. The idea is that the companies will automatically query this database every five minutes with a view to removing such content from search results within six hours, no court order required.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages. Permalink  Send this to a friend

----------

➮ Sharing is caring. Content is available under CC-BY-SA.