● 03.08.22

Gemini version available ♊︎

● Links 8/3/2022: Kdenlive 21.12.3 and Sparky 2022.03 Released

Posted in News Roundup at 10:08 am by Dr. Roy SchestowitzContentsGNU/LinuxDistributionsDevices/EmbeddedFree Software/Open SourceLeftovers

GNU/Linux

Desktop/Laptop

• Linux is the least popular desktop operating system (OS) when considering Windows, macOS, and Linux as our only choices.

• Linux powers most of the servers, but that is not the case for consumer desktops/laptops.

• To make things worse, many assume that Linux is tough from other experiences, even without giving it a try.

Audiocasts/Shows

• Hello and welcome to the 457th episode of Linux in the Ham Shack. In this episode, the hosts invite co-host Conor Murphy of the Linux Lads podcast to talk about their show and a bunch of other topics related to Linux and Open Source. Also discussed is the Linux community in Ireland, specifically Dublin, and its global outreach. It’s an entertaining and informative talk and we hope you enjoy it. Thank you for listening and have a great week.

• A varied selection of Discoveries including suspending apps, easy VMs, and controlling pretty lights. Plus your feedback about Linux gaming, whether bug fixes should be more important than new features, and more.

Benchmarks

• The Phoronix Test Suite (PTS)[1] is a comprehensive testing and benchmarking platform for assessing the performance of Linux systems. In this context, while comparing the performance of Oracle Linux 7 (OL7) and Oracle Linux 8 (OL8), where both are using the same kernel version, we noticed substantial performance deltas ranging up to 30% between the two. To investigate these deltas, we performed detailed analysis to identify the reasons. The resulting analysis has helped us to be cognizant of the importance of tool-chain versions and builds when making performance comparisions.

Applications

• An intrusion detection system is a device or software application that monitors a network or systems for malicious activity or policy violations.

• IDS types range in scope from single computers to large networks. The most common classifications are network intrusion detection systems (NIDS) and host-based intrusion detection systems (HIDS). A system that monitors important operating system files is an example of an HIDS, while a system that detects malicious traffic on a network is an example of an NIDS.

• Here’s our verdict on the finest HIDS. We only feature open source software here.

• There are 350 plus kali Linux tools that are used to automate our tasks during hacking and penetration testing. To increase time efficiency, Kali Linux tools are used that are already included in different versions of Kali Linux. They not only save time but also help us in getting the specific result by capturing accurate data. Here we describe the top 10 kali Linux tools that help us in hacking.

• If you are an active internet user, then you have dozens of accounts with different passwords on many web services. Therefore, you will need to a password manager to keep your passwords and authentication private information in a secure place.

• The password manager apps are intended for this goal. They come in different shapes, characteristics, platform support, and different audiences.

• We covered some password managers here, but today we will cover web-based open-source password managers.

• Version 3.36 of syslog-ng brings us many interesting new features. There is now basic support for system() source on MacOS, TLS 1.3 ciphers can now be restricted, TLS keylog support was added, symlink creation to the latest file, and there are many new possibilities in syslog parsing. From this blog, you can learn about some of the new 3.36 features, and we will test symlink creation, which is a community-contributed feature.

Instructionals/Technical

• Web servers can be generalized into two segments; the ones for running dynamic sites with configured complexities like databases software and the ones for running a simple static web front-end.

• Servy web server qualifies as an ideal candidate for running a simple/basic website with no backend/logic code attached to it.

• This article will walk us through understanding and configuring the Servy web server so that you can be able to comfortably run your simple websites before associating them with a backend code.

• In this tutorial, we will show you how to install Adoptium Temurin on AlmaLinux 8. For those of you who didn’t know, Eclipse Temurin is a project that focuses on building codes and processes that support the building of runtime binaries and the associated technologies used across the Java ecosystem.

• This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you through the step-by-step installation of Temurin on an AlmaLinux 8. You can follow the same instructions for Fedora, RHEL, CentOS, and Rocky Linux distributions.

• The top utility is a commonly used tool for displaying system-performance information. It dynamically shows administrators which processes are consuming processor and memory resources. Top is incredibly handy.

• By default, the root user is not able to log in to the GUI on Ubuntu 22.04 Jammy Jellyfish. This is a security feature and it is common convention to only start a desktop environment as an unprivileged user. However, on test systems and in edge scenarios, it can be useful to log in to the GUI as the root user.

• In this tutorial, you will learn how to log in to the GNOME desktop environment as the root user on Ubuntu 22.04 Jammy Jellyfish. Follow our step by step instructions below to implement this configuration.

• RStudio is a free integrated development environment for the R programming language. R is an open source programming language (software package) and environment used mainly for statistical data analysis. It is licensed under the GNU General Public License (GPL).

• As with most other programming languages, it is easier to work on your projects inside of an IDE such as RStudio. In this tutorial you will find the step by step instructions to install RStudio on Ubuntu 22.04 Jammy Jellyfish.

• If you plan to host a website on your Ubuntu 22.04 Jammy Jellyfish Linux system, it will be necessary to allow HTTP port 80 and HTTPS port 443 through the firewall, or else incoming connections will not make it to the web server.

• Ubuntu 22.04 uses the ufw firewall by default, which stands for “uncomplicated firewall.” When the firewall is enabled, it will block all incoming connections by default. It will be necessary to configure the ufw firewall to allow incoming connections on certain ports if you expect to host any services, such as a web server.

• In this tutorial, we will explain how to open HTTP port 80 and HTTPS port 443 on Ubuntu 22.04 Jammy Jellyfish with the ufw firewall. HTTP and HTTPS protocols are primarily used by web services such as, but not limited to, Apache or Nginx web servers.

• SSH stands for secure shell and is the primary method of remote access and administration on Linux systems. SSH is a client-server service providing secure, encrypted connections over a network connection. After downloading Ubuntu 22.04 Jammy Jellyfish or upgrading to Ubuntu 22.04, it will probably be one of the first things you want to configure.

• In this tutorial, we will go over the step by step instructions to install and configure SSH on Ubuntu 22.04 Jammy Jellyfish Server or Desktop Linux. This will help you whether you just want to connect to remote systems via SSH or you want your own system to accept incoming connections as well.

• Normally, a Bash script will execute each line of code the moment it reaches it, then immediately move on to the next. But it is also possible to add pauses to a Bash script in order to delay it or allow the user time to respond to a prompt, etc.

• In this tutorial, you will learn how to add pauses to a Bash script on a Linux system. Check out our examples below to see how pauses can be facilitated by the read or sleep command, and how this functionality has practical use in some scripts.

• What would you do if someone asked you to create a file size of 1 GB or more in Linux? Most likely, you will use compression utilities like tar or gzip to create a file size of around 1 GB or more, which is not optimal at all, because first, you will collect data and then compress, even though you will not be sure about the size of the file, right?

• Although you can use multiple utilities to achieve this task without any effort, just run a single command and your large file is automatically served to your system.

• In this tutorial, we’re going to show you how to move a file in Linux. Step-by-step, beginner-friendly instructions for the Linux terminal.

• If you’re using a GUI, you just need to drag and drop the file with your mouse. This tutorial will be for the command-line interface (CLI), or Terminal.

• These instructions also work for other Unix-based systems, like macOS and BSD.

• All of these examples are practical and useful for everyday tasks, with real-world use cases.

• The kernel is one of the fundamental parts of Linux distributions. It offers us, among other things, support for our hardware and many other things. Many define it as the heart of the system. Today, you will learn how to install Linux Kernel 5.16 on Rocky Linux 8 / Alma Linux 8.

• The Invisible Internet Project (I2P) is a fully encrypted private network layer that has been developed with privacy and security by design in order to provide protection for your activity, location and your identity. The software ships with a router that connects you to the network and applications for sharing, communicating and building.

• Docker is an open source containerization platform. It enables developers to package applications into containers—standardized executable components combining application source code with the operating system (OS) libraries and dependencies required to run that code in any environment.

• Docker is a set of platform as a service products that use OS-level virtualization to deliver software in packages called containers. Containers are isolated from one another and bundle their own software, libraries and configuration files; they can communicate with each other through well-defined channels.

• In this guide we are going to explore various options to install docker in OpenSUSE Leap15.

• Strapi is an open-source content management system which is developed on NodeJS and MongoDB which helps in creating database-driven websites, APIs and applications etc. It provides many features like a great Admin Panel, Content Management, API Generator etc. The API Endpoints created through Strapi can be adapted to your own needs. It’s a self-hosted application.

• In this tutorial, we will show you how to install Showfoto on Ubuntu 20.04 LTS. For those of you who didn’t know, Showfoto is a fast and powerful image editing tool that comes with all the standard photo editing functionalists such as transformation, filtering, adding effects, metadata editing, and many more. It is a standalone photo editor of the DigiKam project. This application supports various image formats such as JPEG, PNG, TIFF, etc.

• This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the Showfoto image viewer on Ubuntu 20.04 (Focal Fossa). You can follow the same instructions for Ubuntu 18.04, 16.04, and any other Debian-based distribution like Linux Mint.

• Envoy is a high-performance C++ distributed proxy designed for single services and applications.

• Envoy Proxy is a modern, high performance, small footprint edge and service proxy.Envoy is most comparable to software load balancers such as Nginx and HAProxy. Originally written and deployed at Lyft, Envoy now has a vibrant contributor base and is an official Cloud Native Computing Foundation project.

Games

• Developer CPasJuste has released pEMU 5.1 for the PS4, Nintendo Switch, and Linux. These are pretty stable emulators that can provide a very good alternative to Retroarch.

• Heroic Games Launcher is a great multi-platform alternative client for Epic Games and GOG, which helps get your games working on Linux and Steam Deck and a new release is out with version 2.2.2.

• The new release brings some fixes to the newer GOG integration, and a number of settings and adjustments to help prepare for the upcoming Flatpak package to make it available on Flathub which they’ve been getting help from the Bottles app developer on.

• When it is about the best gaming genres, strategy games come in the very first place. In most strategy games, you have to use your tactical skill with the battling experience. So, it is the all-time favorite genre of most players. Today, we will talk about the best strategy games for Linux users. Generally, Linux is considered the best alternative PC gaming platform to Windows. So, there are tons of features-rich strategy games available for Linux users.

• After a few days delay, the Steam Hardware Survey has now been updated with the latest numbers and Linux is still just about holding above 1%.

• It has seen another small drop though of 0.04% so the Linux user share is now at 1.02%. As you can see on our dedicated Steam Tracker.

• Game store itch.io has put up another massive charity bundle, and it’s your chance to get a ton of games plus funds go on to support Ukraine.

• There’s close to 600 games included, with 991 total items in the bundle. It was arranged by Brandon Sheffield of Necrosoft Games and includes some really amazing titles. Funds go on directly to International Medical Corps and Voices of Children. No Steam keys are provided on this one, so you will need to use itch for all games included.

• Valve has release the latest client update for the Steam Deck and it brings a highly requested feature. Now, there’s another additional mode for the performance overlay that allows you to just see the FPS without overloading your screen with other information.

• If you want to play the classic Heroes of Might and Magic II on Steam Deck and Linux with a more up to date game engine, that includes plenty of enhancements you should look to fheroes2.

Desktop Environments/WMs

K Desktop Environment/KDE SC/Qt

• The last maintenance release of the 21.12 cycle is out with lots of usability polishing of keyframes, subtitles and proxy clips. Audio thumbnails on high zoom levels got a major performance optimization. This version also fixes 5 crashes including Wayland layout switching, time remapping module among others.

• With this release we switched our AppImage building to KDE Craft that is already in use for our Windows and macOS builds. With this step our packages become more consistent in regard of bundled dependency versions across all platforms. Also the maintenance becomes less time consuming giving developers more time to focus on coding rather than packaging. We encourage users to reset their configurations to avoid any possible issues by going to menu Help -> Reset Configuration.

• KDE Plasma 5.24.3 is here two weeks after the Plasma 5.24.2 update and brings more improvements for the Plasma Wayland session, especially for multi-monitor and multi-GPU systems. For example, it fixes a major regression in Plasma 5.24.2 that broke multi-monitor and multi-GPU configurations when using Wayland.

• Also for the Plasma Wayland session, this update improves screen sharing, recording, or casting in full-screen applications, improves the virtual keyboard to no longer overlap half of the vertical panel setup, and improves colors to no longer appear dithered on some hardware.

• Today KDE releases a bugfix update to KDE Plasma 5, versioned 5.24.3.

• Plasma 5.24 was released in February 2022 with many feature refinements and new modules to complete the desktop experience.

Distributions

• Escluelas Linux is an education-focused distribution with all essential tools for a classroom and teachers.

• The latest update is a fix to prevent LibreOffice Calc from crashing. You need to make sure that you use Escuelas Linux 7.4 (64-bit) or 6.18 (32-bit) if you want to get rid of any issues.

SUSE/OpenSUSE

• Being selected as one of the 203 open-source projects for GSoC gives openSUSE mentors an opportunity to guide aspiring student developers looking to gain experience with open-source projects.

• openSUSE’s dedicated website 101.opensuse.org offers several projects for GSoC students. Projects available this year include quality assurance testing project openQA, input framework ibus, user-space implementation PRoot and configuration management project Uyuni.

IBM/Red Hat/Fedora

• I’m confident that I speak for all of us when I say that the still unfolding war in Ukraine is heartbreaking. As a company, we stand in unity with everyone affected by the violence and condemn the Russian military’s invasion of Ukraine. We add our voices to those calling for peace and will continue to work to enable the safety of our impacted associates and their families in any way we can.

• The safety, security, and well-being of our associates remain our top priority. The cross-functional team we established several weeks ago has connected directly with every Red Hatter in Ukraine and Russia and will continue to ensure they have the support and resources they need. We have helped Red Hatters in Ukraine and their families (including spouses, children and family members) move safely to nearby countries and continue to help those who remain in the country in any way possible. In the last few days alone, Red Hat-organized buses have safely transported several dozen of our Ukrainian associates’ family members across the border to Poland. We are also supporting our associates in Russia. And for any Red Hatter that needs them, no matter where you are located, we have additional well-being resources available.

• According to the U.S. Bureau of Labor and Statistics, approximately 4.5 million employees resigned in November of 2021. Predictably, that has spurred plenty of talk about retention along with more investment in employee experience programs. But there has not been enough discussion about how to specifically retain IT staff given their essential role in today’s evolving organizations.

• I recently spoke to an audience of students and graduates in the Women in IT Management WITM community of Ryerson University’s IT Management degree program about my experience as a woman in the business world.

• The students’ questions stayed in my mind after the event: “I’m a young mother of three – what do I put on my resume to show that I’m capable of doing a role [even if I] lack the formal work experience?” “How do I overcome the stigma of being a mother and entering the IT workforce for the first time?”

• These same questions could come from a broader audience – from women not enrolled in degree programs, for example, or women re-entering the workforce after a period of leave.

• The JDK Mission Control (JMC) agent is a powerful tool that allows users to inject custom JDK Flight Recorder (JFR) events at runtime without needing to restart the Java virtual machine. Just as the JMC agent plugin simplifies the process of using the agent in a non-containerized environment, the Cryostat agent plugin does the same for containerized environments.

• JMC agent support is now merged into Cryostat, and Cryostat supports various API handlers for using the JMC agent in a containerized environment. This article introduces the Cryostat agent and its API handlers.

Debian Family

• Sparky 2022.03 of the (semi-)rolling line is out, which is based on Debian testing “Bookworm”.

• The new iso images provide: – all packages upgraded as of March 6, 2022 – Linux kernel 5.16.11 (5.16.12 & 5.17-rc7 in sparky unstable repos) – Calamares 3.2.53 – Firefox 96.0.3 (firefox-sparky 98.0 & firefox-esr-sparky 91.7.0esr (Mozilla builds) available in Sparky repos) – Thunderbird 91.6.1 – LibreOffice 7.3.1 RC1 – added a dock-like vala-panel with custom config which provides favorite apps launcher on the left side of your desktop (via ‘sparky-launcher’ package) – small improvements

Canonical/Ubuntu Family

• It’s been some time since I wrote something on It’s FOSS. The truth is that I’ve been writing for a Spanish version of It’s FOSS. If you’ve not visited it and/or you’re a Spanish speaker, please visit It’s FOSS en Español and check all the Linux content in Spanish.

• You may be wondering why I’m sharing this fact with you. It’s because this post includes this new page as an example.

• At the time of doing a clean installation of your favorite Linux distro, the system asks you to choose a main language. Even though it’s not frequent, some people consider changing that language to a new one later on, like me for example.

• Welcome to the Ubuntu Weekly Newsletter, Issue 725 for the week of February 27 – March 5, 2022. The full version of this issue is available here.

Devices/Embedded

• The Commodore 64 is “famous” for being the most prolific computer of the past. For many people it in the 80s, it was their first computer and as it does hold that position for me. It has been and remains today the computer I get incredible joy out of using. When My Retro Computer made this available in recent time, I purchased it and conducted an analysis of the case design, and built it out into the computer of my childhood dreams.

• Nexcom’s rugged, Linux-ready “NISE 109” embedded PC combines Intel’s Elkhart Lake with up to 16GB DDR4, 2x GbE, 6x USB, 4x COM, 2.5-inch SATA, DP, HDMI, M.2, and mini-PCIe.

• In December, Nexcom announced a compact NISE 53 embedded system powered by Intel’s Elkhart Lake. The company has now followed up with a larger, slightly more feature-rich NISE 109 system based on the same SoC. Although it lacks the third GbE port, additional M.2 B-key slot, and triple HDMI ports of the NISE 53, the NISE 109 doubles the serial ports, adds two more USB ports, and adds dual audio jacks and a 2.5-inch SATA bay.

Open Hardware/Modding

• Released over 10 years ago, Arduino UNO is still the best-selling Arduino board, but lacking WiFi in the IoT era is not ideal, so Gianluca Martino, Arduino co-founder and working with the company until 2015, decided to design the Jolly DIP module based on ESP8285 WiFi chip that can replace the ATmega328P 8-bit AVR DIP-40 microcontroller.

• Since ESP8285 cannot provide all I/Os, notably analog inputs offered by ATmega328P, Gianluca combined it with the ATMega328PB microcontroller in a compact SMD package to offer firmware compatibility plus WiFi connectivity in the same DIP form factor.

Mobile Systems/Mobile Applications

Free, Libre, and Open Source Software

Web Browsers

Mozilla

• Last month we created new Firefox desktop colorways celebrating Disney and Pixar’s “Turning Red” streaming only on Disney+ March 11 (subscription required. 18+ to subscribe). It’s a fun way to show your personality by changing the way your Firefox browser looks, with colors and moods inspired by some of the main characters in the film. Today, we’ve got mobile wallpapers inspired by the all-new movie, based on the coming-of-age story of Mei Lee, a teen who when she gets too excited, transforms into a giant red panda (fun fact: a red panda is also known as a fire fox!). We’ve also created a destination for all things 2002 nostalgia and will be having conversations with people about their journeys to embrace their true colors online.

Productivity Software/LibreOffice/Calligra

• Writer now has a set of improvements to better render Word-style borders around pages, tables and paragaphs. This required adjusting how we perform automatic mirroring and also to make sure that clipping is done the Word way.

• Last couple of weeks I have been working on the 16k columns support in Calc. There’s been a lot of work on this already by Noel and others, but so far this has been hidden behind the experimental option, and normally documents open only with the “normal” 1024 columns support. The goal of this work is to finish the 16k support stable enough for it to be the default, so that people who need this many columns can finally get them without any complications.

• As of now all Calc tests pass with the default switched to 16k, and I’ve also dealt with all the known problems from tdf#133764 (minus few rare corner cases that I can deal with later). But I’m pretty sure there are more hidden problems lurking, either crashes because of incorrect bounds checking, or performance problems when some code suddenly deals with 16x more columns. So the next step is to enable this by default in master and collect compl… feedback from guin… testers :).

• Because for loops are a powerful tool in C/C++, they are one of the desirable tools when you want to do something repeatedly, or process elements of a data structures. But there many ways to write a for loop. Some forms of it are easier to use, read, write and understand, and some are not. Range based for loops are discussed in this article. They can be good if you know where to use them.

FSF

GNU Projects

• This is a fresh installation with Debian GNU/Linux 11. The host name is the same (federation.gnuhealth.org). The box provides the demo GNU Health Hospital Management System, Thalamus (GH Federation message and authentication server) and the demo for the GH Federation Health and demographics Database.

• We are happy to announce that GNOME has been accepted as a mentor organization for Google Summer of Code 2022!

• New contributors will be reaching out in our communication channels for information about the program and to discuss project ideas, please point them to gsoc.gnome.org.

• Up till 2013, GIMP was a regular at the Summer of Code. Ever since then we haven’t applied. Nine years have passed, so we decided to give it a new try and 2 days ago, we received an email: GNU Image Manipulation program is officially a Google Summer of Code 2022 mentor organization!

• If anyone is interested, it could be a good opportunity to jump into the development of a huge desktop program used by millions of people. Here are some ideas of what you could possibly work on: wiki with list of possible project ideas.

• On our side, we are interested in realistic projects which can really be finished or at least broken down in usable parts. Our list of ideas is mostly informative and we very much welcome people coming with their own ideas. If you want to participate, come discuss with us on IRC.

Programming/Development

• I have sync’ed my “quirky” layer of OpenEmbedded with the latest release of the Dunfell series, 3.1.14 released in February 2022, and backported some packages (xorg, mesa, llvm, libdrm) from “master-next” branch of OE (which I think is going to be the Kirkstone release due out in April 2022).

Shell/Bash/Zsh/Ksh

Standards/Consortia

• Today, The Khronos® Group, an open consortium of industry-leading companies creating advanced acceleration interoperability standards, announced the public release of the royalty-free Vulkan® Safety-Critical (SC) 1.0 API Specification to enable safety-critical industries to deploy state-of-the-art GPU graphics and compute acceleration while meeting the highest levels of functional safety requirements. The Vulkan SC Conformance Test Suite is also freely available in open source, and multiple vendors have officially-conformant Vulkan SC 1.0 implementations. Industry feedback on the specification is welcome at the Vulkan SC specification GitHub repository.

Leftovers

Hardware

• This may read like January or February 2020 headlines with disruption to shipping and manufacturing in China due to a “new coronavirus”, but it’s happening again, particularly in Hong Kong and Shenzhen where COVID-19 case numbers have jumped and the governments have implemented strict measures to attempt to contain it.

Integrity/Availability

Proprietary

• Today, the FAANG and S&P 500 companies rely on more than just selling their products to satisfy their growth goals. They also establish themselves as media owners and rent out their digital contact points to media buyers who wish to advertise to end-users. Can this be applied to your business too? In this blog post, we dive into the actors and mechanics behind digital advertising. If you are curious about the different use cases of digital advertising in embedded devices, please visit the previous blog post in the series.

• So something involving T-Mobile’s network is preventing Google Play from working. Apps either won’t download at all “Pending” or they’ll partially download and then stop, but connecting to a VPN allows it to work.

Security

• Security updates have been issued by Debian (gif2apng and twisted), Mageia (golang, kernel, and webmin), openSUSE (chromium, cyrus-sasl, and opera), Red Hat (virt:rhel and virt-devel:rhel), Slackware (mozilla), SUSE (cyrus-sasl), and Ubuntu (glibc and redis).

• CISA has released a draft version of Applying Zero Trust Principles to Enterprise Mobility for public comment. The paper guides federal agencies as they evolve and operationalize cybersecurity programs and capabilities, including cybersecurity for mobility. The public comment period will close April 18, 2022.

• Executive Order 14028: Improving the Nation’s Cybersecurity, issued May 12, 2021, requires Federal Civilian Executive Branch departments and agencies to adopt Zero Trust (ZT) architectures to protect the government’s information resources, of which federal mobility is an integral part. The guidance highlights the need for special consideration for mobile devices and associated enterprise security management capabilities due to their technological evolution and ubiquitous use.

• In my last post I mentioned about Solid Project, and while digging more into it I got more questions on privacy issues. Let us break it down from beginning:

• [...]

• In my mind this is a privacy nightmare. The WebID spec has section about security considerations, but nothing about privacy implications.

Fear, Uncertainty, Doubt/Fear-mongering/Dramatisation

• On Monday, March 7th, security researcher Max Kellermann published a new software vulnerability that affect users of the Linux Kernel. The vulnerability, called Dirty Pipe (CVE-2022-0847) , impacts Linux Kernels 5.8 and later, and allows local attackers to overwrite files even if they had only read permissions, allowing for easy privilege escalation.

• The issue is triggered by a combination of two bugs, one bug in Linux Kernels 4.9 and newer and made exploitable by the second bug introduced in Linux Kernel 5.8.

• A newly revealed vulnerability in the Linux kernel allows an attacker to overwrite data in arbitrary read-only files.

• Detailed today by security researchers Max Kellermann and dubbed “Dirty Pipe,” the vulnerability leads to privilege escalation, since unprivileged processes can inject code into root processes. The vulnerability, officially named CVE-2022-0847, affects Linux Kernel 5.8 and later versions, even on Android devices, but has been fixed in Linux versions 5.16.11, 5.15.25 and 5.10.102.

• Kellermann explains that he found the vulnerability after receiving a support ticket about corrupt files a year ago. The customer complained that the access logs downloaded could not be decompressed. Kellermann confirmed the issue, fixed the issue manually and then closed the ticket, but the issue then occurred again and again.

• A newly disclosed vulnerability in the Linux kernel could allow an attacker to write any data into an arbitrary file and gain elevated privileges. The bug affects the major Linux distributions going back to version 5.8 and Android, but a fix was included in the latest Linux kernel and Android releases in late February. Many vulnerabilities are discovered by researchers who are digging into a particular app or code base, looking for potential issues. But this flaw (CVE-2022-0847) has an unusual origin story. It began in February 2021 when Max Kellermann received a support ticket from a customer of IONOS, the hosting provider where he works. The customer was having an issue decompressing nightly log files, and Kellermann discovered a corrupt file on the log server. He found a cyclic redundancy check (CRC) error in the file, which he fixed and then moved on. The same issue happened several more times in the next couple of months, and Kellermann found each time that the contents of the file looked correct, save for the CRC error.

• Linux has yet another high-severity vulnerability that makes it easy for untrusted users to execute code capable of carrying out a host of malicious actions including installing backdoors, creating unauthorized user accounts, and modifying scripts or binaries used by privileged services or apps.

• A Linux local privilege escalation flaw dubbed Dirty Pipe has been discovered and disclosed along with proof-of-concept exploit code.

• The flaw, CVE-2022-0847, was introduced in kernel version 5.8 and fixed in versions 5.16.11, 5.15.25 and 5.10.102.

• It can be exploited by a normal logged-in user or a rogue running program to gain root-level privileges; it can also be used by malicious apps to take over vulnerable Android devices. Max Kellermann said he found the programming blunder and reported it to the kernel security team in February, which issued patches within a few days. By now these should be filtering through to affected Linux distros.

• The bug can be abused to add or overwrite data in sensitive read-only files, such as removing the root password from /etc/passwd allowing anyone on the system to get superuser access, or temporarily altering a setuid binary to grant root privileges.

• If you’re running a Linux distro on your computer or use an Android smartphone, you should install the latest updates immediately as a severe security vulnerability has been found and patched in the Linux kernel.

• The vulnerability, tracked as CVE-2022-0847 and dubbed “Dirty Pipe”, was discovered by a software developer named Max Kellerman at the web hosting company IONOS earlier this year.

• Linux distributions are in the process of issuing patches to address a newly disclosed security vulnerability in the kernel that could allow an attacker to overwrite arbitrary data into any read-only files and allow for a complete takeover of affected systems.

• Dubbed “Dirty Pipe” (CVE-2022-0847, CVSS score: 7.8) by IONOS software developer Max Kellermann, the flaw “leads to privilege escalation because unprivileged processes can inject code into root processes.”

• Kellerman said the bug was discovered after digging into a support issue raised by one of the customers of the cloud and hosting provider that concerned a case of a “surprising kind of corruption” affecting web server access logs.

Privacy/Surveillance

• WHAT IF YOUR computer decided not to blare out a notification jingle because it noticed you weren’t sitting at your desk? What if your TV saw you leave the couch to answer the front door and paused Netflix automatically, then resumed playback when you sat back down? What if our computers took more social cues from our movements and learned to be more considerate companions?

• It sounds futuristic and perhaps more than a little invasive—a computer watching your every move? But it feels less creepy once you learn that these technologies don’t have to rely on a camera to see where you are and what you’re doing. Instead, they use radar. Google’s Advanced Technology and Products division—better known as ATAP, the department behind oddball projects such as a touch-sensitive denim jacket—has spent the past year exploring how computers can use radar to understand our needs or intentions and then react to us appropriately.

• This is not the first time we’ve seen Google use radar to provide its gadgets with spatial awareness. In 2015, Google unveiled Soli, a sensor that can use radar’s electromagnetic waves to pick up precise gestures and movements. It was first seen in the Google Pixel 4′s ability to detect simple hand gestures so the user could snooze alarms or pause music without having to physically touch the smartphone. More recently, radar sensors were embedded inside the second-generation Nest Hub smart display to detect the movement and breathing patterns of the person sleeping next to it. The device was then able to track the person’s sleep without requiring them to strap on a smartwatch.

• “Privacy-friendly” is a relative term.

• These technologies are coming. They’re going to be an essential part of the Internet of Things.

Monopolies

Patents

Software Patents

• Patent trolls, aka Patent Assertion Entities (PAE)s, have plagued open-source software for ages. Over the years though, other groups have risen up to keep them from stealing from the companies and organizations that actually use patents’ intellectual property (IP). One such group, Unified Patents, an international organization of over 200 businesses, has been winning for the last two years. This is their story to date.

• Unified Patents brings the fight to the trolls. It deters patent trolls from attacking its members by making it too expensive for the troll to win. The group does this by examining troll patents and their activities in various technology sectors (Zones). The United Patents Open Source Software Zone (OSS Zone) is the newest of these Zones.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages. Permalink  Send this to a friend

----------

➮ Sharing is caring. Content is available under CC-BY-SA.