● 06.14.22

Gemini version available ♊︎

● Links 14/06/2022: EuroLinux 9.0 and Kdenlive 22.04.2

Posted in News Roundup at 1:49 pm by Dr. Roy Schestowitz

GNU/Linux

• California is a state in the Western United States. California borders Oregon to the north, Nevada and Arizona to the east, the Mexican state of Baja California to the south; and has a coastline along the Pacific Ocean to the west.

Audiocasts/Shows

• In this video, I am going to show an overview of openSUSE 15.4 overview and some of the applications pre-installed.

• When it comes to filesystems, btrfs is definitely a bird of another color! In this video, Jay from Learn Linux TV will break down some of the finer-points of this modern filesystem, which will include topics such as how it differs from other technologies, how to take snapshots, creating a btrfs volume of your own, and more!

Kernel Space

•  Linux kernel 5.17 was released on March 20th, 2022, and it appears to be the shortest-lived kernel series to date. After only fifteen maintenance releases, Linux kernel 5.17 has now reached its end of life, which means that no further security updates will be provided for this branch in the future.

• Therefore, all GNU/Linux distribution maintainers and users who like to compile their own kernels or install the newest from third-party repositories are now urged to upgrade their systems to the latest and greatest Linux 5.18 kernel series, which was also updated today to version 5.18.4.

Applications

• There are quite a few music player applications for Linux. Amberol and G4Music are two of them with really good looking UI design.

Instructionals/Technical

• E-mail is one of the most basic messaging methods used since the development of the internet. This has led to the development of many messaging tools and protocols. There are protocols for the compatible operation of systems with different architectures.

• E-mail servers perform tasks such as not losing user e-mails, and assisting users in accessing their e-mails when they’re online. The tools that provide e-mail transmission on local intranets and the internet are called Mail Transfer Agents (MTA).

• In this article we’ll learn about with a wide range of features to exclude directories, skipping files and selecting non-matching results while searching files with grep.

• When you want to transfer a file from one Linux computer to another, you have several options, some of which are GUI tools and some that are not. One of the most popular methods of transferring files also happens to be one of the more secure. That method is by way of the scp command.

• Scp stands for Secure Copy and is part of the SSH tool, which nearly every Linux distribution includes out of the box. That means you don’t have to install any extra software to get this done.

• SFTP is a protocol that allows for the secure transfer of files over a network. It is often used by businesses and individuals to transfer sensitive data. SFTP is similar to FTP but uses a different protocol for communication. SFTP is more secure than FTP and is often used in conjunction with SSH (Secure Shell) to provide an even higher level of security.

• In this tutorial, we will help you to set up an SFTP server and create an SFTP-only user on Ubuntu 22.04 systems. That account can connect over SFTP but is not able to connect over SSH. Also, this will restrict (chroot) the SFTP user to a specific directory only.

• In this tutorial, we will show you how to install Cockpit on Ubuntu 22.04 LTS. For those of you who didn’t know, The cockpit is a free and open-source web-based graphical interface for servers. It helps advance users in quickly updating, enabling services, restarting the system, accessing Docker containers, Network, storage management, and all above the web-based terminal to issue commands remotely on a server.

• This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the Cockpit web-based graphical interface for servers on Ubuntu 22.04 (Jammy Jellyfish). You can follow the same instructions for Ubuntu 22.04 and any other Debian-based distribution like Linux Mint, Elementary OS, Pop!_OS, and more as well.

• It’s easy to make backup of your iPhone’s photos, since Ubuntu now has out-of-the-box support for accessing iOS files.

• To make life easy, the gThumb image organizer can even pop-up the photo import dialog automatically once your iPhone is plugged in via USB port.

• Do you want to change Ubuntu’s GNU GRUB menu at startup time? Either it is disabling it completely or just editing the text to suit your needs, you can do it all. Here’s the tutorial for you made simple.

• Having a MySQL instance is quite normal in a server or workstation where you work with database connections with this program. The problem arises when we do not know the version of MySQL that the system has. And this can cause some compatibility issues with applications. The solution? Read this post, where you will learn how to check the MySQL version on Linux.

• I don’t know if it is the most popular, but MySQL is for sure one of the most important database managers that you can use, even if it has MariaDB as a competitor. For this very reason, many applications use it as their trusted data manager.

Desktop Environments/WMs

K Desktop Environment/KDE SC/Qt

• KDE Plasma 5.25 is the 27th version of KDE Plasma desktop, not an LTS release. This release is followed by the prior 5.24 LTS, released in February. KDE Plasma 5.25 brings several exciting updates on the desktop UI, polished applets, widgets, a good set of gesture updates for touch-based devices and a massive list of bug fixes. Plasma 5.25 is based on Qt 5.15.2 and KDE Frameworks 5.94.

• KDE team announced today the general availability of the KDE Plasma 5.25 desktop environment for download.

• The 27th release of KDE Plasma desktop – KDE Plasma 5.25 is here, followed by the prior 5.24 LTS release. Coming after almost five months, this release is significant because for the first time, you get the dynamic accent colour which changes based on the wallpaper. In addition, you can also take advantage of the floating panel, more gesture support for touch-based devices, a massive list of bug fixes and many under-the-hood changes.

• Version 5.25.0 of the KDE-based Plasma desktop has been released. New features include support for touchpad and touchscreen gestures, an “overview” mode for navigating between windows, additional color configuration options, and more.

• Plasma 5.25 brings new features and concepts to the desktop environment. Check out how you can now handle your desktop through gestures on your touchpad or touchscreen, the advanced and easy to use customization features, an improved and very useful Overview, and much, much more.

• The polishing and stability effort of this release cycle continues with the release Kdenlive 22.04.2 which comes with bug fixes to the AppImage and Mac packages, render widget, same track transitions, subtitles and project loading issues.

Distributions and Operating Systems

New Releases

• On June 13, 2022, we released version 9.0 of the EuroLinux operating system. It is compatible with the latest upstream release. This release focuses on providing improved default cryptographic policies, a 5.14 kernel, a graphical management interface via a web panel, and improvements related to cloud, virtualization and containerization. “Nine” also introduces a major update in the form of the GNOME 40 desktop environment (with modern GTK 4). An important change for those who want to use EuroLinux on x86_64 architecture, is the need to have a processor supporting x86_64-v2 microarchitecture (also on virtual machines)

Fedora Family / IBM

• CentOS is hosting an online Dojo this Friday, June 17, from 14:00 to 20:00 UTC. CentOS Dojos are free miniconferences with talks on a variety of topics from CentOS and the wider Enterprise Linux ecosystem. This Dojo features seven talks, along with an informal chat with the CentOS Board of Directors.

• Organizations across the globe continue to focus on managing security and risk compliance as the threat landscape evolves. Funding for IT security remains the top priority for many enterprises, as reported in the 2022 Global Tech Outlook report, published by Red Hat earlier this year.

• When it comes to managing security and regulatory compliance risks, enterprises face an increasing number of challenges. One of these is managing the regulatory compliance of IT infrastructure to various cybersecurity policies (e.g. PCI, HIPAA, CIS, etc.). This is an ongoing, constantly-evolving need. As an enterprise, managing the regulatory compliance of your infrastructure without any disruption to the business has become a critical exercise.

Debian Family

• Thanks to the WIPO legal dossier, we now have more evidence of the source of harassment in Debian.

• We previously reported on a Google Summer of Code (GSoC) intern from Bhopal, India, who was not paid the full stipend.

• It raises numerous questions: the intern who failed, Deepanshu Gajbhiye, had done more technical work than the Albanian woman who received $6,000 for Outreachy in 2019.

• Today we release another fact: Deepanshu’s mentor was an Albanian, Dashamir Hoxha. Deepanshu had sent a written complaint about the mentor. The complaint was escalated to the Debian anti-harassment team and they did nothing. We feel the Debian anti-harassment team has protected the Albanians because the Albanians bring pretty young female interns to conferences.

Free, Libre, and Open Source Software

Web Browsers

Mozilla

• Starting today, Firefox is rolling out Total Cookie Protection by default to all Firefox users worldwide, making Firefox the most private and secure major browser available across Windows and Mac. Total Cookie Protection is Firefox’s strongest privacy protection to date, confining cookies to the site where they were created, thus preventing tracking companies from using these cookies to track your browsing from site to site.

• Whether it’s applying for a student loan, seeking treatment or advice through a health site, or browsing an online dating app, massive amounts of your personal information is online — and this data is leaking all over the web. The hyper-specific-to-you ads you so often see online are made possible by cookies that are used to track your behavior across sites and build an extremely sophisticated profile of who you are.

• Recent stories (including an excellent Last Week Tonight episode) have shown how robust, yet under-the-radar, the data selling economy is and how easy it is for anyone to buy your data, combine it with more data about you and use it for a variety of purposes, even beyond advertising.

• Mozilla has announced the enabling of its “total cookie protection” feature in all versions of the Firefox browser.

• Open source, cross-platform email client Thunderbird has announced plans to provide Thunderbird on Android and iOS devices.

• According to Jason Evangelho in the announcement, K-9 Mail has officially joined the Thunderbird family and will ultimately transform into Thunderbird on Android. Additionally, K-9 Mail’s project maintainer, Christian Ketterer, has joined the Thunderbird staff.

• “This move allows Thunderbird users to have a powerful, privacy-respecting email experience today on Android. Plus, it lets the community help shape the transition of K-9 Mail into a fully featured mobile Thunderbird experience,” Evangelho says.

• I’ve been using a custom Firefox web extension for my homepage for nearly a year now. It’s just a tree-list of my browser’s bookmarks. It’s built for speed; no extra features already provided by the browser (like bookmark organization).

Content Management Systems (CMS)

• WackoWiki is a free, open-source light and easy to install multilingual Wiki-engine. Supports WYTIWYG-editing, page rights (ACLs), design themes (skins), file upload, email notification and much more. Compatible with PHP 7.3 – 8.1 and MariaDB / MySQL.

Programming/Development

• As you can easily tell, line breaks made at the beginning of the chapter affect the potential line breaks you can do later. Sometimes it is worth it to make a locally non-optimal choice at the beginning to get a better line break possibility much later. Evaluating a global metric like this can be potentially slow, which is why interactive programs like LibreOffice do not use this method.

• The classical way of solving this problem is to use dynamic programming. It has the requirement that the problem must conform to a requirement called the Bellman optimality condition (or, if you are into rocketry, the Pontryagin maximum principle). This is perhaps best illustrated with an example: suppose you are in Paris and want to drive to Venice. This requires picking some path to drive that is “optimal” for your requirements. Now suppose we know that Zürich is along the path of this optimal route. The requirement basically says, then, that the optimal route you take from Paris to Zürich does not in any way affect the optimal route from Zürich to Venice. That is, the two paths can be routed independently of each other. This is true for the basic form of Knuth-Plass line breaking.

• It is not true for line breaking in practice.

Rust

• For the last year I’ve been leading the development of rust-minidump, a pure-Rust replacement for the minidump-processing half of google-breakpad.

• Well actually in some sense I finished that work, because Mozilla already deployed it as the crash processing backend for Firefox 6 months ago, it runs in half the time, and seems to be more reliable. (And you know, isn’t a terrifying ball of C++ that parses and evaluates arbitrary input from the internet. We did our best to isolate Breakpad, but still… yikes.)

• This is a pretty fantastic result, but there’s always more work to do because Minidumps are an inky abyss that grows deeper the further you delve… wait no I’m getting ahead of myself. First the light, then the abyss. Yes. Light first.

• What I can say is that we have a very solid implementation of the core functionality of minidump parsing+analysis for the biggest platforms (x86, x64, ARM, ARM64; Windows, MacOS, Linux, Android). But if you want to read minidumps generated on a PlayStation 3 or process a Full Memory dump, you won’t be served quite as well.

Leftovers

• There are a lot of beloved-by-me stories in that first category, like Snow Crash on the heels of the Sprawl Trilogy, or From A Buick 8 in the tradition of Chambers or Bierce, but I can still see why people sometimes wanna make this division as some sort of litmus test or indicator when they look for Great Literature—not a perfect test by any means because there are both false positives and false negatives, but still somewhat useful as one kind of data point.

• Where they lose me, though, and what I can’t get behind, is when they take the presence of anything supernatural, fantastic, otherworldly, technological, speculative—in short, anything fantastic—as a reason to dismiss a book as “genre”.

• Then they lose their collective proverbials and awe at the sight of Marquez and his “magical realism”.

• First, what kind of escape am I talking about. A strategic retreat? An escape to save higher goals? Nope. On the other side of the spectrum, is it about simple procrastination, creative procrastination that I have control over and can stop when I want to

Proprietary

• During a software update, your settings can sometimes change or revert back to their original state. For example, if your computer has multiple browsers installed, you may end up with a different default browser than Firefox. That’s easy to fix so that Firefox is there for you when you expect it, like when you click on web links in email and other apps.

• With Firefox set as your default Windows browser, you’ll be automatically guarded from invasive tracking methods like fingerprinting and cryptomining, thanks to Firefox’s technology that blocks more than 10,000,000,000 trackers every day including Total Cookie Protection. (See what Firefox has blocked for you.) Your bookmarks, history, open tabs, form information and passwords are accessible wherever you’re logged into Firefox, from your PC to your phone to your tablet.

Security

• Hertzbleed is a new family of side-channel attacks: frequency side channels. In the worst case, these attacks can allow an attacker to extract cryptographic keys from remote servers that were previously believed to be secure.

• Whenever there’s a new in-the-wild 0-day disclosed, I’m very interested in understanding the root cause of the bug. This allows us to then understand if it was fully fixed, look for variants, and brainstorm new mitigations. This blog is the story of a “zombie” Safari 0-day and how it came back from the dead to be disclosed as exploited in-the-wild in 2022. CVE-2022-22620 was initially fixed in 2013, reintroduced in 2016, and then disclosed as exploited in-the-wild in 2022. If you’re interested in the full root cause analysis for CVE-2022-22620, we’ve published it here.

• In the 2020 Year in Review of 0-days exploited in the wild, I wrote how 25% of all 0-days detected and disclosed as exploited in-the-wild in 2020 were variants of previously disclosed vulnerabilities. Almost halfway through 2022 and it seems like we’re seeing a similar trend. Attackers don’t need novel bugs to effectively exploit users with 0-days, but instead can use vulnerabilities closely related to previously disclosed ones. This blog focuses on just one example from this year because it’s a little bit different from other variants that we’ve discussed before. Most variants we’ve discussed previously exist due to incomplete patching. But in this case, the variant was completely patched when the vulnerability was initially reported in 2013. However, the variant was reintroduced 3 years later during large refactoring efforts. The vulnerability then continued to exist for 5 years until it was fixed as an in-the-wild 0-day in January 2022.

• Security updates have been issued by Fedora (golang-github-docker-libnetwork and moby-engine), Mageia (apache, docker-containerd, kernel, kernel-linus, nats-server, and php-smarty), Slackware (php), SUSE (gimp, grub2, thunderbird, u-boot, and xen), and Ubuntu (firefox, liblouis, ncurses, and rsync).

• Open source Tracee uses Linux eBPF technology to trace system and applications at runtime, and analyzes collected events to detect suspicious behavioral patterns.

• While Linux Servers are already extremely secure by default, there are extra steps you can and should take if you do have a Linux Server instance running. As with any system, vulnerabilities still exist and can wreak havoc if proper prevention and security best practices are not implemented. Of course, the most well known and most basic security tip people will tell you is to keep up to date with updates and security patches. (As we all should!) However, this will only do so much. Linux being amongst one of the most widely implemented and deployed operating systems makes it an attractive target for cybercriminals trying to steal your information, install malicious files on your system, and even try to run malicious scripts to take control of your system.

Fear, Uncertainty, Doubt/Fear-mongering/Dramatisation

Privacy/Surveillance

• According to reports, U.S. defense contractor L3Harris Tech plans to acquire sanctioned spyware maker NSO Group.

• NSO Group has been in the international spotlight for their facilitation of human rights abuses around the world, from Palestine to El Salvador to Poland. The spyware was also used to target U.S. diplomats’ phones. These ongoing revelations have led to the U.S. government and other stakeholders taking a number of actions against the company.

• Notably, the Biden administration added NSO to its blocked Entity List for violating U.S. national security. This move was so consequential that it reportedly pushed NSO to the brink of financial collapse, leading the firm to consider shutting down Pegasus and selling the company in its entirety. Earlier this year, U.S. venture capital firm Integrity Partners was in its final stage of negotiations to purchase NSO.

Environment

Energy

• Let’s imagine that you’re concerned about climate change. You’ve decided to leave the city and move to a place where you can grow your own food (or at least some of it). You settle on a part of the country where continued access to fresh water is fairly likely and summer heatwaves won’t become too bad — in the US and Canada this might be near the Great Lakes. This feels like a wise thing to do.

• You go to landwatch.com and find an old farm for sale. Compared to property in your city, it’s pretty cheap. You reason that the profitability of the land has been steadily declining for conventional farmers — they need to pour more money into fertilizers, pesticides, and the patented seed that can withstand those, and their margins have become unbearably tight. “Okay,” you reason, “I’m going to spend the next few years building the soil back up and not producing much food — but that’s fine — I will be a responsible steward for this land so it will be healthy and able to feed people when things get dire.” That’s what you’re worried about anyway.

Censorship/Free Speech

• I ended up really liking both seasons of Anita’s feminist video game show that she did with McIntosh. I was watching the episodes as they were released and they helped me get back into gaming with her encouragement to both enjoy and criticize media, which helped me to enjoy the good parts of these these disturbing games.

• I was surprised that I liked them as much since I had thought (I wasn’t a crowdfunding backer); her first show (about tropes generally, not just games) was basic and overly 101 and “doesn’t everyone know this?” (Gamergate showed how very, very wrong I was about that, and now I think that show was good since those “101” basic points was not was universally agreed-upon and known as I believed.)

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages. Permalink  Send this to a friend

----------

➮ Sharing is caring. Content is available under CC-BY-SA.