● 03.09.22

Gemini version available ♊︎

● Links 10/3/2022: Blender 3.1 and Mesa 22.0.0

Posted in News Roundup at 9:34 pm by Dr. Roy SchestowitzContentsGNU/LinuxDistributionsDevices/EmbeddedFree Software/Open SourceLeftovers

GNU/Linux

Desktop/Laptop

• Logitech’s penny-sized USB dongles lets users connect up-to six compatible Logitech wireless devices to their computer via a single dongle.

• You can tell if a dongle uses this technology as it’ll have a little sunburst icon on it, as pictured in the product photo on the right.

• Being a slim, low-profile and discrete size, Logitech say there’s “no need to unplug it when you move around”. This is a far cry from the days when using a “wireless” device meant having to stay within (what felt like) a 20cm square box and in clear view of a huge blinking infrared receiver!

Audiocasts/Shows

• StormOS is a beginner friendly distribution based on Arch Linux, which offers an easy installation process, a full suite of software, and a few custom shell scripts to help new Arch users. StormOS offers two desktop editions: Xfce and KDE. Today, I’m taking a first look at their Xfce edition.

• Matt Mullenweg, founder, CEO and president of Automattic, talks to Doc Searls and Jonathan Bennett about how WordPress—their main product and open source project—is the “dark matter of the Web.” He also tells us what’s up with Tumblr, Openverse, WooCommerce, the Gutenberg block editor, and other projects among the many the company is up to.

• We revisit one of the core theses of the show and expand on it in a new way, leading us to ponder just what a wild ride the next eight years are going to be.

Kernel Space

• EasyOS has a script /usr/local/firmware/extract-fw-all, that I use to create a PET with latest firmware required for the current running kernel. Basically, you put all the firmware that can be found, into /lib/firmware, then run the script. The script will create a folder ‘fnd-firmware’, and file ‘missing-firmware’ listing all firmware that cannot be found.

Graphics Stack

• Featuring Vulkan 1.3 support the RADV (Radeon Vulkan) and ANV (Intel Vulkan) drivers, the Mesa 22.0 graphics stack is here to introduce KHR_dynamic_rendering for Lavapipe, RADV, and ANV drivers, the VK_KHR_synchronization2 and EXT_image_view_min_lod extensions for RADV, as well as the ARB_sparse_texture, ARB_sparse_texture2, and ARB_sparse_texture_clamp extension for the RadeonSI and Zink drivers.

Applications

• Blender 3.1 is performance-packed follow up to the incredibly well-received Blender 3.0 release that squeaked out at the end of last year.

• As I’m not someone who knows how to use Blender —boy do I wish I was that talented— I’m not the best person to walk you through what’s changed. But do you know who is? The Blender team themselves.

• Version 3.1 of the Blender artistic suite is out. The list of changes is long and can be seen in the video-heavy announcement page; it includes Apple Metal support, a new “point cloud” object, and much more.

• Running out of space on Ubuntu? Use one of these top cleaners to free up disk space on your Linux computer.

• Operating systems require adequate storage space to function correctly. We all think the same initially, but unnecessary files accumulate and slow down the system with time. No matter if you are a Windows or a Linux user, you should clean up the junk files taking up disk space.

• There are multiple tools by which a user can free up the space of the system. However, the variety of tools makes it difficult to select the best out of them. If you also have confusion regarding the same, don’t worry. This guide will help you go through the top GUI tools to free up disk space on Ubuntu.

• One popular and easy-to-use tool for detecting virus infections on Linux systems is ClamAV. It’s open source and free, and runs on many Linux systems, Ubuntu and Fedora included. In this post, we’ll take a look at how to install and use the tool on Ubuntu, Linux Mint, and related systems.

• Cantata has discontinued. If you’re looking for another app for Music Player Daemon, then Ymuse is a good choice for GNOME, Xfce or other GTK based desktops.

• Ymuse is a free open-source GTK front-end for Music Player Daemon, written in Go programming language. It can be used as either a player for local music playback or a client to control remote MPD, while using few resource.

• There are several online services and places where you can select colors either RGB or Hexadecimal, or even using GIMP or any other similar software. However, having this service in terminal is really notorious!

• rgb-tui is a color picker written in C++ that is easy to install and use.

Instructionals/Technical

• I’m planning to automate the loading (and unloading) of the module and starting the ffmpeg process in response to the real camera device being plugged or unplugged, using systemd events and services. (I don’t leave the camera plugged in all the time due to some bad USB behaviour I’ve experienced if I do so.) If I get that working, I will write a follow-up.

• Ghost is free and open-source web server software that you can use to host a website. It’s a unique and elegant web publishing platform. Ghost provides a modern and sleek interface where you can publish articles, newsletters, and subscription-based content. It offers advanced features for monetizing your content. So, with Ghost, you can charge your subscribers a monthly fee similar to Patreon.

• MongoDB is a cross-platform document-oriented database that makes data storage and retrieval fast and easy. The database uses a JSON-like structure for the documents, primarily familiar to modern applications.

• MongoDB uses collections and manuscripts whereby documents consist of key-value pairs, the basic unit of data in MongoDB. In contrast, collections contain functions and documents equivalent to relational database tables.

• Sending an hour-long video to someone through your phone can take up to a few hours, depending on the file size. Not only will it cost you time, but it also eats up a chunk of your Internet plan. Luckily, you can easily compress these videos on your Android phone using a video compressor app. We show you two of these apps below.

• qBittorrent is an open-source peer-to-peer Bittorrent client which is available for all platforms: Windows, Linux, macOS, FreeBSD, and OS/2. You can use this as an alternative to µTorrent.

• In addition, it is based on the Qt toolkit and the libtorrent-rasterbar library.

• In this article, you will see multiple ways to install qBittorrent on your Linux machine. On the qBittorrent homepage, they say, “Go ahead and try qBittorrent, you won’t regret it!”

• OCI functions allows access to Oracle databases, but, at least in Ubuntu, aren’t included in the default PHP installation. This article will show you how to install php-oci8 on Ubuntu LTS. From the PHP manual:

• «They support SQL and PL/SQL statements. Basic features include transaction control, binding of PHP variables to Oracle placeholders, and support for large object (LOB) types and collections. Oracle’s scalability features such as Database Resident Connection Pooling (DRCP) and result caching are also supported.»

• Today we are looking at how to install Netbeans 13 on a Chromebook. Please follow the video/audio guide as a tutorial where we explain the process step by step and use the commands below.

• Gatsby is a fast modern site generator for React. It is an open-source framework that combines the functionality from React, GraphQL, and Webpack for building static websites and applications.

• Gatsby is more than just a static site generator, it allows the web developers to build websites using React and work with any data source (CMSs, Markdown, etc) of their choice. In this tutorial, we will show you how to install Gatsby on Ubuntu 20.04.

• In this video, I am going to show how to install Archman 2022.03.

• In this tutorial, we will show you how to install Atom Text Editor on AlmaLinux 8. For those of you who didn’t know, Atom is a free, cross-platform, and open-source graphical software that has been designed for programmer’s editor application that helps the developer to write code without too much hassle. The Atom text editor supports almost all operating distributions such as Linux, Windows, and macOS.

• In this tutorial, you will learn how to install MariaDB on Debian 11 “Bullseye” from the official Debian repository. The article also shows you how to secure MariaDB, add an admin user, and connect to the database management system from the command line.

• MariaDB is an open-source RDBMS (Relational Database Management System), backward compatible, binary drop-in replacement of MySQL. It is being developed by several of MySQL’s original developers as well as a large number of community members.

• Compared to MySQL, MariaDB provides improved performance with faster replication speeds, tighter security measures, and additional storage engines.

• This tutorial provides a step-by-step guide on how to install Erlang on Debian 11/Debian 10. According to erlang.org, Erlang is a programming language used to build massively scalable soft real-time systems with requirements on high availability. Some of its uses are in telecoms, banking, e-commerce, computer telephony and instant messaging. Erlang’s runtime system has built-in support for concurrency, distribution and fault tolerance.

• In this tutorial, we will show you the steps to take backup of Ext2, Ext3, or Ext4 file systems in Linux-based operating systems. You should be cautious while taking the backup of the Ext2, Ext3, or Ext4 file systems in Linux as the operating system that you are currently using is mounted on the file system on Linux which you won’t be able to copy in active mode. In this post, we will see how to backup Ext2, Ext3, or Ext4 file systems in Linux.

• Time zones can get complicated, especially if you and your Linux server are located in different zones.

• Intended to help people keep daytime and evening hours straight anywhere in the world, time zones don’t really matter to a computer. It’s usually best to set your Linux time zone to match yours or the one most of your users observe.

• Fortunately, it’s easy to configure the time zone on Linux even after installation. Here’s how.

• If you need to spin up a quick Linux desktop for development or testing purposes, one of the easiest is with a new tool called Distrobox. Jack Wallen shows you how.

• I’ve had a few instances in which relocating the HOME directory on either a Linux desktop or server was necessary. This could be because of space or security issues. Either way, it might seem like a rather daunting task to migrate the directory containing all user files and directories from one drive to another. Although it is a bit of a lengthy process, it’s not all that difficult.

Games

• Google appears to have built its own solution for running Windows games on Stadia. Google is planning to detail its Windows “emulator” for Linux next week at the company’s Google for Games Developer Summit on March 15th. Reddit users have spotted a session at the summit that will detail “how to write a Windows emulator for Linux from scratch.”

• The session will be led by Marcin Undak, on Google’s Stadia porting platform team, and promises a “detailed overview of the technology behind Google’s solution for running unmodified Windows games on Stadia.” It appears that Google has built its own Windows emulator for Linux to help developers port games to the service without having to modify titles for Linux.

• Google Stadia has had a rough life cycle so far. After debuting to middling reviews, it had to suffer through a slowly growing library, a limited user base and the shuttering of its first-party studios. But Stadia is still alive and kicking, and Google intends to prove it next week. The company plans to host five Stadia panels for developers and publishers, and one of them could have huge implications for PC gaming as a whole.

• While there are issues with the Deck Verified system, Valve continues on noting down more titles as being either Deck Verified or Playable.

• As of publishing time there’s now 1,214 going by Valve’s own list, which is a huge number for a gaming device that has only just recently released. With 660 Verified and 554 Playable. One of the biggest titles to appear recently of course was Apex Legends, the massively popular Battle Royale.

• Remember though: not being Verified or Playable doesn’t mean it won’t work, it just means it hasn’t been through Valve’s formal certification yet.

• If you’ve been worried about whether you’d be able to play Apex Legends on your Steam Deck, you no longer need to worry, as the game has officially been verified to work on Valve’s Linux-based handheld gaming PC.

• As a bystander in the evolution of Object-Oriented Programming in Perl, and someone who is really only just starting to get the hang of Perl modules and packages (still not any good at it), I get really quite overwhelmed by ideologies. There is considerable debate about the right way to program things, the right style, the right direction that Perl should go. It is Vim vs Emacs, Atari ST vs Amiga, Mods vs Punks. Really one needs a language to do what one needs it to do, simply, quickly and consistently. For an amateur, Perl has been able to do exactly that for me. I code rubbishly, but hey, who’s looking?

• But when you look at the clever people in the Perl community, you wonder. You wonder whether you are missing out by not being engaged in the evolutionary process. It is bewildering. I confess I understand a mere fraction of the terms, the rationale, the higher order coding discussions. I have read about Corinna, marvelled at Moose’s capabilities, gazed admiringly at Leonerd’s prowess, but do not dip my coding toes into the water. You see, I cant swim.

• [...]

• Pong was developed, a game with Sprites. The sprites contained position and motion data and the info required to draw the sprite, all contained in a hashRef, which could be passed to subroutines for processing. e.g my $sprite={x=>10….};. This was a deliberate precursor for later conversion into a blessed object e.g. my $sprite=Sprite->new(x=>10,…);, all in all a seemingly painless transformation. The sprite modules that were created from that were initially classic Packages, then eventually as classes using Object::Pad. If I can figure it out I will also use Moo. For the moment the code versions remain monolithic until we have tested it/extended it enough.

Desktop Environments/WMs

• Just a quick note, jwm window manager has been bumped from 2.4.0 to 2.4.1.

Distributions

• elementary OS, a Linux distribution that is currently ranked as one of the top 10 distros (according to DistroWatch.com), appears to be in the process of completely imploding on itself.

• The Short Version: The company behind elementary OS has been losing money for quite some time. Two co-founders are not pleased with each other and are attempting to part ways… and it is getting messy.

• Below is the full text, as posted to Twitter by elementary founder Daniel Foré. Some portions are bolded by me for emphasis.

• Users of the elementary OS distribution may want to be aware of the turmoil in its parent company, as reported by Brian Lunduke. “The Short Version: The company behind elementary OS has been losing money for quite some time. Two co-founders are not pleased with each other and are attempting to part ways… and it is getting messy”.

BSD

• The time has come to upgrade my SunBlade 2500s to something more power friendly and faster. I’d already removed one CPU and thus half the ram from two of these systems to reduce their power consumption, but it’s still much higher than it could be.

• After much searching, I’ve decided on Pine64′s RockPro64 4GiB ram model (technically, only 3.875GiB ram.) Pine64 make SBCs, laptops, phones, and various other mostly ARM gadgets, and the RockPro64 has the fastest CPU they ship (Rockchip RK3399), and can use a small “NAS Case”, that is sufficient to house 2 HDDs and, at a stretch, upto 6 SSDs (cooling would become quite an issue at this point.)

• In my SATA setup, I have 3 SSDs with a JMicron 585 card in the PCIe slot, two SSDs in the NAS case SSD region, and the third is in the HDD region with an adapter. I have used two SATA power splitters to convert the NAS case’s 2 SATA power ports into 4, with the 4th one also powering a Noctua case fan. The cabling is not great with this, with enough SATA power cabling for 6 devices to lay. Probably a bespoke power cable to connect to the RockPro64 would make this nicer and probably improve cooling slightly, but I’m just using off-the-shelf components for now.

IBM/Red Hat/Fedora

• Learn how to use the net namespace to configure point-to-point namespaces, isolate processes, and control which applications can access a VPN.

• We are pleased to announce that Red Hat Satellite 6.10.3 is generally available as of March 9, 2022.

• Red Hat Satellite is part of the Red Hat Smart Management subscription that makes it easier for enterprises to manage patching, provisioning, and subscription management of Red Hat Enterprise Linux infrastructure.

• As a developer, you need to be able to try and test new software and tools, but the process can be tedious. You often need to download the source code and reconfigure your entire local environment to deploy it. The process is a bit like being asked to assemble a car before giving it a test drive.

• The IBM Developer Technology Sandbox is a turnkey solution for you to test drive software. The browser-based, no-code/low-code sandbox enables developers to try new technologies, whether you are trying to extend your application stack or build new skills.

• Explore the pre-built applications and use the step-by-step instructions to run them with the click of a button. These applications are built on a combination of various IBM and IBM partner technologies, including APIs, cloud services, and more.

• I have said some things about secure boot and my involvement here. I will try to say the same things monthly from here on out. The current plan is for them to appear dated in this folder. That said, I am human and will probably forget sometimes. So while I encourage keeping an eye out for them, it’s probably best to reach out if I miss one and not worry too much unless several get missed.

Devices/Embedded

• OnLogic’s fanless “IGL130” and “IGL160” industrial thin clients run the Linux-based IGEL thin client stack on AMD’s Ryzen R1000 and V1000, respectively. The compact systems support up to 16GB DDR4 and offer HDMI, 2x DP, 2x GbE, 2x M.2, and 5x USB.

• Back in 2020, OnLogic launched its Apollo Lake based ISL200 and ISL300 thin clients equipped with IGEL Linux. These were its first two products verified for IGEL Technology’s IGEL Ready program. The company has now followed up with the AMD Ryzen Embedded R1000 based IGL130, which offers similar capabilities as IGEL’s IGEL UD3 (PDF), as well as the Ryzen Embedded R1000 powered IGL160, which is on par with the IGEL UD7 (PDF).

• We have great news: The coreboot project has been accepted for this year’s Google Summer of Code! Thanks to everyone who made this possible!

• You can find our GSoC organization page here [1] (unfortunately, newlines were removed from the description, but that’s true for all of the accepted orgs).

• Looking at the GSoC timeline [2], this means the next step is discussing our exciting projects. We have about a month for this, from now until April 3rd, when the application phase starts.

• We’re still looking for mentors! If you are interested, please have a look at the mail that Felix Singer, GSoC 2022 admin, sent earlier [3]. You also can help with code reviews or working out a project (writing description, defining project scope and tasks, …). Every bit of help counts.

• Tow-Boot is a relatively new project for bringing some consistency to the way we boot Linux on ARM. This is both aimed at the Linux single board computers but also the new wave of Linux phones.

• On these devices the most common platform firmware is U-Boot. In some cases the U-Boot provided with the device is a nice and clean mainline U-Boot, in other cases it’s the U-Boot build provided by the manufacturer of the SoC.

• One big difference between x86 computers and the ARM ecosystem is functionality that you’d expect from the bios/uefi in the hardware is actually in most cases part of the operating system that’s installed. This means there’s no consistency at all.

• Tales of Raspberry Pi SD card corruption are available online by the fistful, and are definitely a constant in Pi-adjacent communities. It’s apparent that some kind of problems tend to arise when a Raspberry Pi meets an SD card – which sounds quite ironic, since an SD card is the official and recommended way of booting a Pi. What is up with all of that?

• I can start with a history lesson. Back when Raspberry Pi launched in 2012 – which is now 10 years ago – there were SD card controller driver problems, which makes sense given the wide variety of SD cards available out there. They were verifiably fixed one by one at some point in time, as debugging goes, their impact decreased and bugs with individual cards got smoothed over. This is how the “Pi SD card corruption” meme was originally born; however, if the problems were to end there, so would the meme. Yet, tales of broken SD cards plague us to this day – way less severe than they were in the beginning, but pronounced enough that you’ll see people encounter them every now and then.

Open Hardware/Modding

• We’ve previously written articles about boards featuring the mikroBUS interface supporting thousands of Click expansion boards from Mikroelectronika, and now the company has collaborated with Sparkfun who launched MicroMod and Raspberry Pi RP2040-based boards with a mikroBUS socket, plus Qwicc connectors.

• Raspberry Pi RP2040 is the well-known dual-core Arm Cortex-M0+ microcontroller found in Raspberry Pi Pico and a range of third-party boards, while Sparkfun MicroMod‘s are M.2 MCU modules with chips from Microchip, Nordic Semi, Ambiq, Espressif Systems, and NXP.

• Checking obstacle distance to your robot or, generally speking, to your prototype can give your project the awarenes on how a risk is near and warn the user accordingly to your code. HC-SR04 sensor with Arduino has a particular work principle really interesting and can be coded easily once acquired this knowledge

• In this tutorial, I’m going to show you how to interface the ultrasonic sensor (HC-SR04) with Arduino Uno. The sensor has the ability to measure distance.

• Arduino Nicla Vision is an ultra-compact (~2.3×2.3 cm) board powered by an STMicro STM32H7 dual-core Cortex-M7/M4 microcontroller, and equipped with a 2MP camera, a WiFi & Bluetooth LE module, and a few sensors.

• Those features make the board suitable for machine vision and edge computing applications such as asset tracking, image detection, object recognition, and predictive maintenance. For instance, image detection, facial recognition, automated optical inspection, vehicle plate reading, or gesture recognition can be added to projects, either using Nicla Vision as a standalone board or in combination with Portenta or MKR boards.

Mobile Systems/Mobile Applications

Free, Libre, and Open Source Software

Web Browsers

Mozilla

• Well, in Q4 2021, Mozilla’s PDF.js landed support for XFA PDF forms, so Firefox is now able to deal with them, which is huge deal, as we have been increasingly encountering such documents over the years, and still will be for a long time, especially given how slow-moving governments can be when it comes to their digital practices.

• It would be fantastic to see these code insights put to use in Poppler, the library that Evince, Okular and other applications use… so if someone feels like fixing one of the few biggest issues with reading/filling PDFs under Linux, please use this code (see also: all the XFA-related pull requests) as inspiration to contribute a fix to this and that issue in Poppler!

• The internet doesn’t just have a simple on/off switch — rather, there are endless ways connectivity can be ruptured or impaired, both intentionally (cyber attacks) and unintentionally (weather events). While a difficult task, knowing more about how connectivity is affected and where can help us better understand the outages of today, as well as who (or what) is behind them to prevent them in the future.

• [...]

• “Mozilla is excited to make our relevant telemetry data available to researchers around the world to aid efforts toward transparency and accountability. Internet outages can be hard to measure and it is very fortunate that there is a dedicated international community that is focused on this crucial task. We look forward to interesting ways in which the community will use this anonymous dataset to help keep the internet an open, global public resource,” says Daniel McKinley, VP, Data Science and Analytics at Mozilla.

• On March 11, 2020 the World Health Organization declared COVID-19 a global pandemic. Within days, practically the entire planet was on lockdown. We went indoors and online.

• So how did the sudden mass migration online impact browser extension usage? Pretty dramatically, it turns out. On this two-year mark of the start of the pandemic we looked back at Firefox extension installs and usage data to discover several compelling trends.

Programming/Development

Rust

• Two weeks ago, the lang team held its March planning meeting (minutes). We hold these meetings on the first Wednesday of every month and we use them to schedule design meetings for the remainder of the month.

Java

• The Apache Software Foundation has released version 13 of its NetBeans open-source IDE for Java, PHP, Javascript and other languages.

• The new version also upgrades support for two of the main build-automation tools out there: Apache’s own Maven, and the Gradle tool used for Android development.

• Additionally, the updated IDE builds in the nb-javac compiler, its fork of the standard Java Development Kit’s javac compiler. The release notes claim that this will make the “startup experience simpler and smoother”.

• It also defaults to the new FlatLaf theme’s Light mode by default. (Yes, there’s a Dark mode, too.) FlatLaf is a fashionably Flat Look and feel for Swing apps, inspired by the look of the rival IntelliJ IDEA IDE – and also able to import third-party IDEA themes. FlatLaf can also scale to support HiDPI displays.

Leftovers

Science

• We don’t talk enough about vaporware over here, so let’s discuss two attempts to make optical discs fluorescent … both of which went absolutely nowhere.

• When it comes to technology, it’s easy to get hyped up about something that sounds cool, but turns out to be a bunch of hooey. Theranos, currently the subject of a Hulu miniseries, is the most famous recent example of this, but there are plenty of others out there where an idea seems to briefly draw in the attention of lots of people, only for the idea to look a lot less awesome close-up. That’s often when it becomes vaporware—and it happens even to established companies. The once-prominent Wang Laboratories, for example, once announced 14 products in a single day, but failed to release most of them, reflecting broader challenges facing the company. In this spirit, I’d like to consider a couple of unusual attempts to take the optical disc far beyond the limitations that we think of it having today. For at least one company, it looked like, at least for a brief moment, it had something as good as the tiny vial of blood Theranos was pitching—a disc that promised an insane amount of storage, despite the medium itself being transparent. (And it wasn’t the only one!) Today’s Tedium takes a look at two turn-of-the-century efforts to make optical discs fluorescent. Just like the discs themselves, you couldn’t see the finished products in the end.

Integrity/Availability

Proprietary

Security

• Security updates have been issued by Debian (kernel, linux-4.19, spip, and thunderbird), Fedora (cyrus-sasl and libxml2), Mageia (firefox and thunderbird), openSUSE (buildah and tcpdump), Red Hat (cyrus-sasl, kernel, kernel-rt, and kpatch-patch), Slackware (kernel), SUSE (buildah, kernel, libcaca, and tcpdump), and Ubuntu (linux, linux-aws, linux-aws-5.13, linux-azure, linux-azure-5.13, linux-gcp, linux-gcp-5.13, linux-hwe-5.13, linux-kvm, linux-oem-5.14, linux-oracle, linux-oracle-5.13, linux-raspi, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-azure-fde, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, and linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, ilinux-lts-xenial, linux-oracle, linux-raspi2, linux-snapdragon).

• CISA, the Federal Bureau of Investigation (FBI), the National Security Agency (NSA), and the United States Secret Service (USSS) have re-released an advisory on Conti ransomware. Conti cyber threat actors remain active and reported Conti ransomware attacks against U.S. and international organizations have risen to more than 1,000.

• CISA, the FBI, NSA, and the USSS encourage organizations to review AA21-265A: Conti Ransomware, which includes new indicators of compromise, for more information. See Shields Up and StopRansomware.gov for ways to respond against disruptive cyber activity.

• The Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message, to crash the control plane process. This can be exploited when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from an attacker.

• According to this report on The Hacker News, there are a couple of recent Firefox vulnerabilities that are currently being exploited.

• Mozilla has pushed out-of-band software updates to its Firefox web browser to contain two high-impact security vulnerabilities, both of which it says are being actively exploited in the wild.

• A few days prior to the expected 5.17 release, the mainline kernel has just received a series of Spectre mitigations for the x86 and ARM architectures. The vulnerability this time is called “branch history injection”; it has been deemed CVE-2022-0001 and CVE-2022-0002.

Fear, Uncertainty, Doubt/Fear-mongering/Dramatisation

• Security researchers detailed a Linux vulnerability allowing an attacker to overwrite data in arbitrary read-only files. The vulnerability, known as CVE-2022-0847 or “Dirty Pipe” leads to privilege escalation as unprivileged processes can inject code into root processes. According to security researcher Max Kellermann, it is similar to CVE-2016-5195 “Dirty Cow” but is easier to exploit. Dirty Pipe has been a vulnerability in Linux Kernel since 5.8 and has been fixed in Linux 5.16.11, 5.15.25 and 5.10.102.

• There are some crazy Linux exploits and this is certainly Dirty Pipe is certainly high up there, this exploit is similiar to an earlier exploit called Dirty Cow and allows you to almost complete bypass system permissions.

• Linux administrators and developers are urged to update to the latest version of the kernel or their Linux distribution after the discovery of a major vulnerability. The problem is in Linux kernels going back to version 5.8. It allows an attacker to overwrite supposedly read-only files. That could lead to an escalation of data access privileges because an attacker could inject malware into root processes. The vulnerability has been disclosed to the Linux kernel security team and the Android security team. The bug has to be patched in Android.

Privacy/Surveillance

• A new guide launched today on effective due diligence will help shareholders with investments in the surveillance technology ecosystem identify, assess, prevent, and mitigate increasing human rights and other material risks. The intrusive and pervasive nature of these emerging technologies has led to invasions of privacy, violence, and discrimination, frequently against marginalised communities. However, for those investing in this rapidly developing industry there is still a long way to go to fully recognise the significant threats involved – and their critical role in preventing and mitigating them.

• Investors have a responsibility to ensure their portfolio companies are respecting human rights and are not unnecessarily exposed to legal, reputational, and financial risks. Navigating the Surveillance Technology Ecosystem: A human rights due diligence guide for investors provides shareholders with a deeper understanding of the potential human rights issues going unnoticed in their portfolio companies’ value chains and a framework for making rights-respecting investment decisions. Based on consultations with digital rights advocates, due diligence modeling experts and investors, the Guide is ultimately designed to help investors advance corporate accountability throughout the surveillance technology ecosystem.

• The General Data Protection Regulation (GDPR) came into force in May 2018. It gave European Union (EU) and European Economic Area (EEA) citizens many new rights, including Article 17: [the] Right to erasure. Article 17 gives citizens the right to have companies delete their personal data.

• In late May 2021, I decided to clean my password manager vault of unused accounts and services. I had 421 entries in my password manager and managed to get it down to 297. It took 5 hours and 10 minutes to go through the 124 unwanted entries and figure out how to request their deletion. I also spent at least as much time over the following weeks just following up on deletion requests.

• The experience was a mixed bag. I gathered some statistics along the way, and I’ll share some highlights in this article. I won’t name and shame any companies, sorry.

• Many services have self-service account deletion tools, but often hide them so well that I failed to locate them without deferring to their customer support. On average, it took 24 interactions (menu clicks, password entries, etc.) after an initial login to request and confirm a deletion request.

Finance

• Walmart closes the stores at night because the prices go up so fast and they don’t want you to see them do it.

• Inflation in the United States is now so bad that in the last month, groceries have gone up in price more than they have in the last 8 years before that.

• [...]

• Since 2020, Walmart has raised the price of Coca Cola by 35%.

• My spouse, who is from the Philippines and is not used to living in a “normal” country with “real money” says “this just happens, even in the Philippines”. It’s not normal for prices to go up this fast in America. In fact, it hasn’t happened in my lifetime. You read about it happening in the 1970s, but things were different then. Wages kept up with it. Everyone was furious, but wages kept up.

Civil Rights/Policing

• This is the second in a series of blog posts from Public Knowledge examining the public policy implications of algorithmic decision-making. We are responding in part to a series of legislative proposals over the past year or so targeted at the advertising-based business model that motivates platforms to use algorithms to distribute content based primarily on a profit motive rather than the public interest (e.g., Algorithmic Justice and Online Platform Transparency Act, the Ban Surveillance Ads Act, the Algorithmic Accountability Act, and the Social Media Nudge Act). In order to create appropriate policy solutions, we have to understand the nature of the harms that can arise from algorithmic decision-making about content, including ​​ad targeting and delivery, content moderation, and content ranking and recommendation systems. This blog post catalogs what we have learned about algorithmic harms from these systems in three broad categories: (1) harms to safety and well-being; (2) harms to economic justice; and (3) harms to democratic participation. One important theme that unites all the harms across these categories is that their impact is too often concentrated on historically disadvantaged communities.

• We acknowledge at the outset that there are other, and in some cases more virulent, harms associated with algorithmic decision-making that are not focused on content distribution, including harms that arise from facial recognition, deepfake technologies, law enforcement access to social media, technologies used in criminal justice laws, employment, rental housing and real estate buying, credit and lending, and health care, to name a few. We also don’t mean to suggest that the harms we will catalog arise exclusively from algorithmic decision-making. In fact, we hope algorithmic decision-making could one day mitigate cultural biases and disparate outcomes that arise from human decision-making (predicated on adequate reform of systemic inequities).

• Additionally, our catalog of harms associated with platforms’ content distribution is by no means exhaustive, or mutually exclusive. There are complicated intersections and relationships among them and policy solutions, which we will discuss in later posts, need to reflect those intertwined complications and relationships. And lastly, any proposal we support will be consistent with the First Amendment, which gives full protection to a wide range of “harmful” speech. At Public Knowledge, we are not proposing to ban any kind of legally-protected speech. However, we encourage platforms to create policies and digital tools to minimize harms. We also recognize that social media companies, advocates, and government stakeholders disagree about what constitutes “harmful” speech, based on different personal and community values, and perspectives.

Internet Policy/Net Neutrality

• This evening I called T-Mobile support and eventually got fielded around to someone who knows what’s going on.

• He confirmed that the Google Play problems are related to their tower upgrades and shutting down the last of the Sprint network.

• Internally, T-Mobile uses a VPN to route certain traffic, including the Play Store, even if you’re not using one of their devices, and something in that setup got messed up. They said they are aware of it and it should eventually go away, but to “keep using the VPN app” to get Google Play to work until it’s fixed.

• By using NordVPN, it forces it to tunnel over the internet instead of internally at T-Mobile, through NordVPN’s server, and reach the Google Play store over the Internet, through NordVPN.

Monopolies

Patents

• Patents core to the breakthrough gene-editing technology CRISPR belong to the University of Harvard and the Massachusetts Institute of Technology’s Broad Institute, the US Patent and Trademark Office (USPTO) has ruled.

• Loosing novelty regarding patents is a vital issue globally. It should be well understood in order to avoid the potential business and value loss than it can entail.

• In Japan, when an invention is disclosed to the public before a patent filing, such as if the product is posted on the web, published in a newspaper or magazine, and / or an explanation is given so that the invention can be understood, the novelty is lost “by the inventor’s own actions”. However, if an application is filed within one year from the date of said loss of novelty, the Japan patent Office (JPO) examination will be concluded as “not losing novelty” (Article 30 of the Japanese Patent Law). This is called an “exception for loss of novelty.” This treatment is similar in the United States, although with even broader exceptions there than in Japan (US Patent Law, Article 102).

• On the other hand, the European EPO (European Patent Office) is very strict in this regard: there are very few allowable reasons for relief from loss of novelty, and such relief will be typically be denied at the EPO. China is equally strict as it uses the EPC (European Patent Law) as a model to create Chinese Patent Law. Therefore, when Japanese applicants apply for the exception of loss of novelty outside of Japan, it is a very critical situation and you need to be careful.

• The European Patent Office on Tuesday said it will end its cooperation with Russia and Belarus’ patent offices following Russian President Vladimir Putin’s invasion of Ukraine.

• The EPO said it stands “in solidarity with all those suffering from the appalling violence in Ukraine and all refugees seeking safety in other countries,” and that it had decided to pause its cooperation with the Russian and Belarusian patent agencies, as well as the Eurasian Patent Organization.

• The Munich-based agency said it will consider further actions and “consequences” ahead of its next administrative council meeting on March 22.

• “Our office was founded in the spirit of European and international cooperation,” the EPO said. “We stand for peace, progress and prosperity, with staff drawn from across the 38 contracting states of the European Patent Convention.”

• The U.S. Patent and Trademark Office announced Friday that it has severed ties with its Russian equivalent over the invasion of Ukraine, mirroring a similar move by the European Patent Office earlier this week.

• The USPTO said in a statement on its website that it suspended communication with Russia’s federal patent and trademark agency, known as Rospatent, as well as the Eurasian Patent Organization, a Russia-based international patent agency.

• According to the USPTO, the move is a reflection of guidance handed down by the U.S. Department of State regarding the Russian invasion.

• The U.S. Patent and Trademark Office has stopped engagement with officials from Rospatent, Russia’s agency in charge of intellectual property, following the military invasion of Ukraine, the USPTO said.

• The EPO has issued a statement on its website entitled “Standing together for peace in Europe”, announcing that it has frozen co-operation activities with the Federation of Russia and of Belarus. The EPO will assess and debate other possible measures and consequences with the 38 Member States, extension states and observers in preparation of the next Administrative Council meeting on 22 March. Ukraine itself is not one of the 38 Member States of the European Patent Organisation, nor an extension state. However, Ukraine has been a PCT contracting state since 1991.

Trademarks

• In a loss for The EU Intellectual Property Office, an EU general court has overturned a decision cancelling a word sign for ‘Mood Media’, first registered by a Dutch company more than a decade ago.

Copyrights

• Combing across 19th-century shores, seaweed collectors would wander for hours, tucking specimens into pouches and jars, before pasting their finds into artful albums. Sasha Archibald explores the eros contained in the pressed and illustrated pages of notable algologists, including “the most ambitious album of all” by Charles F. Durant.

• Inventor Robert Pittis Scott’s *Cycling Art* offers a whimsical and illustrated tour through the previous century of “man-motor locomotion”.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages. Permalink  Send this to a friend

----------

➮ Sharing is caring. Content is available under CC-BY-SA.