● 07.20.22

Gemini version available ♊︎

● Links 21/07/2022: EasyOS Plans and Arduino Projects

Posted in News Roundup at 10:46 pm by Dr. Roy Schestowitz

GNU/Linux

Audiocasts/Shows

• It’s time once again for The Weekender. This is our departure into the world of hedonism, random topic excursions, whimsy and (hopefully) knowledge. Thanks for listening and, if you happen to get a chance, feel free to call us or e-mail and send us some feedback. Tell us how we’re doing. We’d love to hear from you.

• There was a time where Google relied on a fork of Ubuntu LTS called Goobuntu but those days are long gone and now they rely on gLinux Rodete a rolling release fork of Debian based on Debian testing of all things.

• In this video, we are looking at how to install WPS Office 2019 on Pop!_OS 22.04.

• Stephano Cetola, Director of Technical Programs for RISC-V International, returns to bring Doc Searls and Jonathan Bennett up to speed on the many new developments in and around RISC-V’s radically open and promising CPU architecture.

• Hello, Twinimation Studios is back with a brand new course and a brand new website! If you love old timey, Fleischer’s style animations like Betty Boop and Koko the Clown, you can learn how to imitate these styles to create your own rubberhose work of art! Introducing Twinimation’s newest 22 lesson, 6 hour course! You will see the process of replicating rubberhose film through music, animation method, character design, and post production templates.

• Once again, we’re using Krita for our film lesson, but we’re going even more in depth in this course. We’ll be showing off more of Krita’s features, such as how to color using the paint bucket tool and the benefits of changing frame colors. Additionally, in this course, you’ll see Krita not only used for animation, but also illustration as we design and color background environments.

• Get started crafting your own brush presets! Join Ramon for the first of a set of comprehensive videos!

Kernel Space

• At the 2022 sambaXP conference, Jeremy Allison gave a talk titled “The UNIX Filesystem API is profoundly broken: What to do about it?”. LWN regulars may recall hints of these talks in a recent comment thread. He started his talk with the problems that symbolic links (“symlinks”) cause for application developers, then discussed how the solutions to the problems posed by symlinks led to substantial increases in the complexity of the APIs involved in working with pathnames.

• Allison explained that hard links were the first “interesting addition” to the original Unix filesystem API; unlike symlinks, though, they are not dangerous, and are, in fact, easy to use. A hard link is simply the connection between a directory entry and the inode for the file (or directory) to which that entry refers. Unix systems allow multiple links to any file, but require that the inode and directory entries all reside on the same filesystem.

• By contrast, symlinks contain another path as data, and the kernel transparently operates on the file at that path when system calls like open() or chown() are called on the symlink. This seemingly innocuous feature led to the addition of incredible amounts of complexity in the effort to fulfill the needs of programs that need to be aware of whether a pathname contains a symlink or not. Such programs include archival programs like tar, file synchronization and transfer programs such as rsync, network filesystem servers like Samba, and many more that suffer security problems as a result of not giving sufficient attention to symlinks in pathnames.

• The variety of security problems resulting from symlinks can be seen in a search of CVE entries, which gave Allison 1,361 results when he ran it. These include vulnerabilities that facilitate information disclosure, privilege escalation, and arbitrary file manipulation including deletion, among other attacks. Without discussing any specific CVE in detail, he gave an example of the kind of security problem that can result from symlink-related vulnerabilities.

• An application running as root may try to check that /data/mydir is a regular directory (not a symlink) before opening the file /data/mydir/passwd. In between the time the program does the directory check and the file open, an attacker could replace the mydir directory with a symlink to /etc, and now the file opened is, unexpectedly, /etc/passwd. This is a kind of race condition known as a time-of-check-to-time-of-use (TOCTOU) race.

• Once upon a time, a simple stack overflow was enough to mount a code-injection attack on a running system. In modern systems, though, stacks are not executable and, as a result, simple overflow-based attacks are no longer possible. In response, attackers have shifted to control-flow attacks that make use of the code already present in the target system. Hardware vendors have added a number of features intended to thwart control-flow attacks; some of these features have better support than others in the Linux kernel.

• Control-flow integrity (CFI) is a set of techniques intended to prevent control-flow attacks, or at least to reduce the ability of an attacker to hijack the program’s control flow. The general idea behind CFI is to label sources and destinations of indirect jumps (such as calls, branches, and return instructions) and verify at run time that the actual jump target matches the label. CFI can be implemented entirely in software, but there are also several hardware mechanisms from different vendors that assist in CFI implementation.

• The schedule for the upcoming Embedded Linux Conference Europe 2022 has been published recently.

• Bootlin CEO Thomas Petazzoni is again a member of the program committee for this edition of ELCE, and has helped with other members of this committee in reviewing and selecting the numerous talk submissions that have been received.

Instructionals/Technical

• Directories on Linux let you group files in distinct, separate collections. The downside is it becomes tedious moving from directory to directory to perform a repetitive task. Here’s how to automate that.

• How do you update your Ubuntu system in the command line? You use the apt update (to refresh the package cache) and apt upgrade commands.

• Back in 2020, I wrote this article about using DKIM to sign outgoing debian.org mail. This worked well for me for a while: outgoing mail was signed with DKIM and somehow was delivered. Maybe. Who knows.

• But now we have a relay server which makes this kind of moot. So I have changed my configuration to use that relay instead of sending email on my own. It seems more reliable that mail seems to be coming from a real debian.org machine, so I’m hoping this will have better reputation than my current setup.

• In this tutorial, we are going to explain in step-by-step detail how to install Laravel on the latest Ubuntu 22.04 distribution.

• Laravel is an open-source PHP framework developed for faster implementation and development of web applications along with many built-in features and many libraries. Laravel framework is based on Symfony and is following the MVC architectural pattern. The framework is created by Taylor Otwell and its source code is hosted on GitHub.

• Installing Laravel on Ubuntu 22.04 is a very easy and straightforward process with the Composer package manager that can take up to 10 minutes. Let’s get this working!

• This comprehensive guide explains what is Docker Desktop and how to install Docker Desktop in Linux and how to use Docker Desktop to create and manage Docker containers in Linux.

• Installing Apache requires the installation of a complete LAMP package (Linux, Apache, MySQL and, PHP). To do development, users require a complete set of these open-source software and a locally set up machine before they can host their websites to test it out. We will go through the complete installation of the LAMP stack on Linux Mint 20.

• “If you have installed CentOS Stream 9 on your computer and have an NVIDIA GPU installed on your computer, installing the NVIDIA GPU drivers on CentOS Stream 9 is the first thing you want to do. In this article, I will show you how to install NVIDIA GPU drivers on CentOS Stream 9. So, let’s get started.”

• The Escapists 2 is a strategy RPG developed by Toof Studios and published by Team17. Here’s how to play The Escapists 2 on Linux. Getting The Escapists 2 working on Linux The Escapists 2 works just fine on Linux out of the box, as it is a native game.

• If you already tried to package ROS 2 Foxy applications into snaps, you might have encountered the following error regarding shared memory:

• This log is stating that FastDDS (formerly known as FastRTPS) couldn’t create a file for the shared memory mechanism due to denied permission. Fortunately, FastDDS is smart enough to fallback to a non-shared memory-based option, allowing your program to run just fine.

• In this post, we will review the shared memory mechanism in ROS 2, explain why this error is happening in snaps and propose different solutions to tackle it in strictly confined snaps. We therefore assume that you are familiar with both ROS 2 and snaps. If not, have a look at either (or both) the ROS 2 documentation and the snap landing page.

• When working with git it is sometimes necessary to rename a git branch.

• Nextcloud is a powerful productivity platform that gives you access to some amazing features, such as collaborative editing, cloud file sync, private audio/video chat, email, calendar, and more! Best of all, Nextcloud is under your control and is completely customizable. In this article, we’re going to be setting up our very own Nextcloud server on Linode. Alternatively, you can also spin up a Nextcloud server by utilizing the Linode marketplace, which you can use to set up Nextcloud in a single click. However, this article will walk you through the manual installation method. While this method has more steps, by the end you’d have built your very own Nextcloud server from scratch, which will be not only a valuable learning experience – you’ll become intimately familiar with the process of setting up Nextcloud. Let’s get started!

• In order to install Nextcloud, we’ll need a Linux instance to install it onto. That’s the easy part – there’s no shortage of Linux on Linode, so what we’ll do in order to get started, is create a brand-new Ubuntu 20.04 Linode instance to serve as our base. Many of the commands we’ll be using have changed since Ubuntu 20.04, so while you might be tempted to start with a newer instance, these commands were all tested on Ubuntu 20.04. And considering that Ubuntu 20.04 is supported until April of 2025, it’s not a bad choice at all.

• Today we are looking at how to install Sonic the Hedgehog Time Twisted on a Chromebook. Please follow the video/audio guide as a tutorial where we explain the process step by step and use the commands below.

• In this guide, we will show you how to install qView on Ubuntu systems.

• qview is an image viewer for viewing, No toolbars or distractions—pure space efficiency.

• qView is a free, open-source image viewer designed from the very start to be as visually minimal and space efficient as possible. No cluttered interface, just your image and a titlebar.

• In this guide, we will show you how to install Waterfox Browser on Ubuntu systems.

• Waterfox is an open-source web browser for x64, ARM64, and PPC64LE systems. It is intended to be ethical and (in Waterfox Classic) maintain support for legacy extensions dropped by Firefox, from which it is forked.

• There are official releases for Windows (including a portable version), macOS, Linux and Android in two versions: Classic (Year.Month) and Current (G.x.x.x).

• Waterfox is based on Firefox (and uses Firefox’s engine) and is compiled using various compilers and using Intel’s Math Kernel Library, Streaming SIMD Extensions 3 and Advanced Vector Extensions. Linux builds are built with Clang on all architectures other than PPC64LE. It is compatible with extensions written for Mozilla Firefox, Google Chrome and Opera.

• In this guide, we will show you how to install Krita on Ubuntu systems.

• Krita is a free and open-source raster graphics editor designed primarily for digital painting and 2D animation. The software runs on Windows, macOS, Linux, Android, and Chrome OS, and features an OpenGL-accelerated canvas, colour management support, an advanced brush engine, non-destructive layers and masks, group-based layer management, vector artwork support, and switchable customization profiles.

• Chromium is an open source web browser that you can use to browse the internet on your computer, a lot of modern browsers nowadays use Chromium’s source code on their browsers. For example: Google Chrome is based on Chromium, the difference between Chromium and Chrome is that Chromium is open source while Chrome it’s not.

• If you want to develop or understand how a web browser works then chromium is the right choice to use for your projects as it is open source.

• In this tutorial you will learn how to install Chromium web browser on Linux Mint.

• Portmaster isn’t just a cross-platform network monitor — it’s also a very powerful security tool that can help to lock down your desktops and block things like ads, trackers and malware. I’ve been using Portmaster on my primary Linux desktop and I can attest to its ability to block incoming traffic.

• I recently had an incident when, for whatever reason (probably because I was feeling lazy and didn’t want to make the trek to my office at the end of the house), I had to SSH into my desktop from another machine on the LAN. I’d forgotten Portmaster was running, and I hadn’t yet made a rule to allow that particular IP address through. No matter what I tried, I couldn’t get in. But after I added the allow rule, entrance through the required port was permitted and all was well.

• Network File System has been around for a very long time and makes for a simple-to-use directory sharing system within your LAN. With this in place, users gain access to remote data as though it was on their local system.

• One of the primary reasons why you might choose NFS over Samba is because NFS is much faster and more reliable when dealing with small- to mid-sized files. SMB offers better performance for larger files. In the end, a combination of the two would cover pretty much all of your basis for directory access across a LAN.

• If you are a programmer, chances are you might already be familiar with the nuances and capabilities of Visual Studio Code.

Games

• Between 2022-07-14 and 2022-07-20 there were 23 New Steam games released with Native Linux clients. For reference, during the same time, there were 251 games released for Windows on Steam, so the Linux versions represent about 9.2 % of total released titles. Here’s a quick pick of the most interesting ones…

• In eight testimonials, Cartesi delivers the first proof that it can empower millions of new startups and their developers to use The Blockchain OS, bringing Linux applications to the forefront of the Web3 revolution.

Distributions and Operating Systems

EasyOS

• The last couple of days, have been working on a 32-bit Dunfell-series. Did a complete recompile in OE, for a i686 CPU target, compiled a 5.15.55 kernel, got it to boot on my old circa-2005 Acer laptop — or rather, it started to boot.

• At the switch_root, got a kernel panic — the famous “tried to kill init” message. Should be fixable, but I can see this soaking up another week, and it is fragmenting my time too much. There are already lots of issues with the 64-bit version 4.2.7, so decided to get back on track, just do the one thing.

• Although publicity is good, there is also a downside. It means more people will be trying Easy, and quite likely finding faults. Many of those people might not be aware that Easy is an experimental distribution, and almost every part of it is a work-in-progress.

• Then there’s the small package repository, and some packages don’t work. Probably, when Easy Bookworm comes out, with access to the large Debian package repository, users who want lots of packages will be satisfied. But, that is probably a couple of months away.

SUSE/OpenSUSE

• Members of openSUSE had a visitor for a recent Work Group (WG) session that provided the community an update from one of the leaders focusing on the development of the next generation distribution.

• SUSE and the openSUSE community have a steering committee and several Work Groups (WG) collectively innovating what is being referred to as the Adaptable Linux Platform (ALP).

• SUSE’s Frederic Crozat, who is one of ALP Architects and part of the ALP steering committee, joined in the exchange of ideas and opinions as well as provided some insight to the group about moving technical decisions forward.

• The vision is to take step beyond of what SUSE does with modules like in SUSE LInux Enterprise (SLE) 15. This is not really seen on the openSUSE side. On the SLE side, it’s a bit different, but the point is to be more flexible and agile with development. The way to get there is not yet fully decided, but one thing that is certain is containerization is one of the easiest ways to ensure adaptability.

• Kasm Technologies is collaborating with SUSE to release SUSE Linux Enterprise Server (SLES) and openSUSE images within the Kasm Workspaces Containerized Desktop Infrastructure® platform for streaming remote workspaces directly to your web browser. The technical collaboration between Kasm Technologies and SUSE includes research and development on cloud orchestration and open-source technology for streaming desktops and applications to the browser.

Fedora Family / IBM

• Rocky Linux 9.0, the latest version of the open source enterprise OS designed to be fully bug-for-bug compatible with Red Hat Enterprise Linux (RHEL), is now generally available. The update includes new security and networking features, and a new open source build system called Peridot.

• Released July 14, Rocky Linux 9.0 has all of the build chain infrastructure tools for developers to pick up Rocky Linux or extend or reproduce the OS, should a developer want to do something independently of the community or any upstream supporting organisation.

• A primary goal behind developing the new, cloud-native build system was assuring that new versions of Rocky can be released within one week of new RHEL version releases, project representatives said.

• Linux distributions have changed quite a bit over the last 30 years, but the way that they package software has been relatively static. While the .deb and RPM formats (and others) have evolved with time, their current form would not be unrecognizable to their creators. Distributors are pushing for change, though. Both the Fedora and openSUSE projects are moving to reduce the role of the venerable RPM format and switch to Flatpak for much of their software distribution; some users are proving hard to convince that this is a good idea, though.

• A traditional binary package from a distribution contains the program of interest, of course, along with any supplementary files that it needs. The package also carries metadata describing, among other things, which other packages must be installed for the program to work. The distribution’s package manager uses that dependency information to ensure that every package is properly installed.

• The Flatpak format has been described as “just another distribution format” and, to an extent, it is true. A Flatpak package (or, simply, “a flatpak”) has everything that a .deb or RPM package would have, but there are some significant differences. Perhaps at the top of the list is the way that dependencies are handled. A traditional package will have a (possibly long) list indicating every other package that is needed; a Flatpak package, instead, will list a single “runtime” containing the base set of libraries against which the package is built. If there are libraries or other dependencies that do not appear in the runtime of choice, they are simply bundled with the application in its flatpak.

• This arrangement has a certain appeal to packagers. The “runtime plus bundling” approach simplifies dependency management, and the ability to bundle patched versions of system or runtime libraries is called out as a Flatpak feature. A package built against a given runtime can be installed on any system that has that runtime installed, making it possible to build a single package that can be installed on multiple distributions. Distributors can thus use this format to make their lives easier; purveyors of proprietary packages also see some obvious charm in this idea.

• In a sense, Flatpak has set out to solve many of the same problems that the ill-fated Linux Standard Base effort addressed many years ago.

Open Hardware/Modding

• CNC machines (both CNC mills and CNC routers) are very useful to makers. With them, you can fabricate custom wood, plastic, or metal parts to the exact dimensions that you define in a CAD (computer-aided design) model. But CNC routers are expensive and CNC mills capable of cutting metal are even pricier—to the point where they are out of the reach of most makers. However, if you have a 3D printer, time, and a modest budget, you can build Ivan Miranda’s CNC mill from scratch.

• Miranda designed several CNC routers and mills over the years. Like those, this is possible to build using common materials and doesn’t require any special tools except a 3D printer. Its frame is a combination of sturdy, yet affordable, aluminum extrusion and 3D-printed joints. The various hardware, like linear rails, belts, and bearings, is similar to what you would find on a 3D printer. That keeps costs down and makes the parts easy to find.

• Measurement tools, like calipers and micrometers, are just as important as your soldering iron and side cutters. But if you’re still using a measuring tape for long parts, you are subjecting yourself to unnecessary frustration. Digital measuring wheels let you easily measure almost infinite lengths by rolling the device along. There are wheels like these on the consumer market, but you can also follow along with AGBarber’s Instructables tutorial to build your own multi-function digital measuring wheel.

• In addition to distance measurements, this wheel has two other functions. You can roll it around the circumference of a round object, like a pipe, and the device will automatically calculate the diameter. You can also spin the wheel and it will tell you the RPM. We’re not quite sure what the RPM function’s application would be, but we’re sure that someone has a use for it. The unit is about the size of a typical measuring tape and has a big battery for portable use.

• In 2020, for the first time since the ’80s, vinyl records outsold CDs. Digital music — particularly streaming — outpaced both by a wide margin, but the popularity of vinyl records increased while the popularity of CDs decreased. That’s because the analog sound of vinyl adds a dimension that many find pleasing and because there is something appealing about the tangible act of putting on a record. In a fun twist, students at LDLC School in France came up with a new way to put a record on: by inserting the record cover instead of the vinyl.

• Students Ibrahima, Scott, Antoine and Arthur came across an old Arduino project that their teacher, Jean Noël, created years ago. He converted a “slot-in” record player to accept record sleeves instead of vinyl. But it would still play the correct music, thanks to RFID. An RFID tag on the record sleeve would trigger an Arduino inside the record player to queue up the correct playlist on an SD card. The Arduino would then play the music through an Adafruit Music Maker MP3 shield connected to a 7W mono amplifier.

• One of the most unique security features we offer at Purism is our anti-interdiction service. This is a premium add-on service that aims to help you detect attempts to tamper with your hardware in shipment, so you can have peace of mind that the hardware you receive is the same as when it left our custody. While we mostly have discussed anti-interdiction in the context of laptops (and you can read more about anti-interdiction options for the Librem 14 here) many people don’t realize that we also offer anti-interdiction for our Librem 5 and Librem 5 USA phones.

Free, Libre, and Open Source Software

• Over the last five decades or so, free and open-source software (FOSS) has gone from an almost unknown quantity available to only the most technically savvy to underpinning much of the infrastructure we rely on today. Much like software itself, FOSS is “eating the world”. But that has changed—is changing—the role of the maintainers of all of that code; when “critical” infrastructure uses code from a FOSS project, suddenly, and perhaps without warning, that code itself becomes critical. But many maintainers of that software are volunteers who did not set out to become beholden to the needs of large companies and organizations when they released their code, they were just scratching their itch—now lots of others are clamoring for theirs to be scratched as well.

• The supply-chain security problem is clearly a serious one that needs to be addressed. The Log4j incident provides a recent example of how a security vulnerability in a fairly small component can ripple out across the internet by way of dependency chains. Some projects depended directly on Log4j, but many others became vulnerable because they were using some other library or package that depended on Log4j—directly or indirectly.

• Some of the places where dependency chains are often lengthy, and thus more vulnerable to the intentional injection of malware, are various language-specific repositories of packages. Sites like the Python Package Index (PyPI) provide a huge palette of components that can be used by applications or other libraries. The pip tool that comes with Python will happily install PyPI packages along with all of their dependencies, recursively. Many other languages have similar repositories and tooling.

Programming/Development

• Good evening, gentle hackfolk. Last time we talked about heuristics for when you might want to compact a heap. Compacting garbage collection is nice and tidy and appeals to our orderly instincts, and it enables heap shrinking and reallocation of pages to large object spaces and it can reduce fragmentation: all very good things. But evacuation is more expensive than just marking objects in place, and so a production garbage collector will usually just mark objects in place, and only compact or evacuate when needed.

• When I (in spite of knowing better) talk to ordinary people about what I do for a living and the project I work on, one of the details about it that people have the hardest time to comprehend, is the fact that I really and truly don’t know a lot about who uses my code. (Or where. Or what particular features they use.)

• I work on curl full-time and we ship releases frequently. Users download the curl source code from us, build curl and put it to use. Most of “my” users never tell me or anyone else in the curl project that they use curl or libcurl. This is of course perfectly fine and I probably could not even handle the flood if every user would tell me.

• This not-knowing is a most common situation for Open Source authors and projects. It is not unique for me.

• The not knowing your users is otherwise unusual in a world of products and software, and quite frankly, sometimes it is an obstacle for us as well since we lack a good way to communicate with users about plans, changes or ideas. It also makes it really hard to estimate our own success and the always-recurring question: how many users do you have?

• Weaveworks today says container images of its open source Flux version control software have now been downloaded more than one billion times. Flux is at the core of Weaveworks’ GitOps platform.

• In addition, the company claims that its enterprise customer base doubled in the first half of 2022, which led to a corresponding increase in revenue for the same period.

• Weaveworks CEO Alexis Richardson says as more organizations deploy fleets of Kubernetes clusters, it’s clear GitOps is emerging as the preferred method for deploying cloud-native applications based on microservices.

Perl / Raku

• The Perl sort built-in is mostly (at least by me) called as sort LIST or sort BLOCK LIST. But there is a third way to call it: sort SUBROUTINE LIST, which actually appears first in the documentation.

• This is not a blog entry about using the sort SUBROUTINE LIST form of sort. It is more about the need to be aware of this form when writing (or trying to write) the sort LIST form.

• Consider the following situation: you have a subroutine foo() which returns an un-ordered list. You need that list sorted. Perl has a sort built-in, so your (or at least my) first reaction is to write my @sorted = sort foo();, run it, and then wonder why @sorted is empty.

Python

• Back in April, there was an interesting discussion on the python-ideas mailing list that started as a query about adding support for custom literals, a la C++, but branched off from there. Custom literals are frequently used for handling units and unit conversion in C++, so the Python discussion fairly quickly focused on that use case. While ideas about a possible feature were batted about, it does not seem like anything that is being pursued in earnest, at least at this point. But some of the facets of the problem are, perhaps surprisingly, more complex than might be guessed.

• With every Python release, there are new modules being added and new and better ways of doing things get introduced.

• Martin Heinz encourages Python developers to move on to a number of newer modules.

• Analytical web applications were a task for seasoned developers that required knowledge of multiple programming languages and frameworks. Unfortunately, that’s no longer the case. Nowadays, you can make data visualization interfaces using pure Python.

• Python provides various libraries that come with different features for data visualization. In addition, all these libraries come with additional features and can support multiple graphs.

• We will discuss these libraries individually and plot some most commonly used graphs.

Leftovers

Hardware

• How much is a pinch of sand worth? Well, that all depends on what you do with it.

• If you get someone to pull the silicon from the oxygen and make quasi-glassy plates from it, then you can etch transistors into circuits on that wafer, cut it up into discrete chips, and sell those chips for a whole lotta money. In the case of Taiwan Semiconductor Manufacturing Co, the world’s biggest and most successful foundry, in the second quarter of 2022, we are talking about $18.16 billion in revenues (up 36.3 percent) across nearly 3.8 million 12-inch silicon wafer equivalents (up only 10.1 percent). But most amazingly, TSMC brought $8.06 billion of that – a staggering 44.4 percent of revenue and an increase of 67.6 percent from the year ago period – to the bottom line.

• At the end of the quarter, TSMC was therefore sitting on nearly $48 billion in cash, even after shelling out $7.4 billion in capital expenses to keep advancing and expanding its foundries. That is probably enough money to build around two and a half fabs, and despite a slowdown in PC and smartphone sales, where is will take a few quarters to burn down inventories, the top brass at TSMC can be cool because there is so much pent-up demand for what it calls high performance components – a different kind of HPC that underlies the other kind of HPC simulation and modeling that we know so well at – that it will be able to meet more demand here and keep its revenue and profit engine chugging along into 2023.

Security

• The Russian hacking group Turla released an Android app that seems to aid Ukrainian hackers in their attacks against Russian networks.

• Google’s Threat Analysis Group (TAG) continues to closely monitor the cybersecurity environment in Eastern Europe with regard to the war in Ukraine. Many Russian government cyber assets have remained focused on Ukraine and related issues since the invasion began, while Russian APT activity outside of Ukraine largely remains the same. TAG continues to disrupt campaigns from multiple sets of Russian government-backed attackers, some of which are detailed in our previous updates.

• Similarly, Russian observed disinformation efforts are also focused on the war in Ukraine and TAG has disrupted coordinated influence operations from several actors including the Internet Research Agency and a Russian consulting firm as detailed in the TAG Bulletin. Most of these coordinated influence operations are Russian language efforts aimed at ensuring domestic support in Russia for the war. Here is a deeper look at some campaign activity TAG has observed since our last update:

• The popularity of web applications is constantly growing as businesses and corporations host several services through them. However, companies and businesses that do have web applications still face the threat of vulnerabilities. A vulnerability is a flaw in your system that hackers may exploit to obtain unauthorized access, run malicious code, install malware, and perhaps steal sensitive information. Remediating these attacks could be near impossible, especially since most small businesses, corporations, and even daily users lack the resources to fix several vulnerabilities at a time.

• We have always made all our build-scripts public. These are the same set of tools which we use to generate Kali Linux (for each release, or our weekly images). You may have noticed that previously there wasn’t anything about Virtual Machines (VMs). This is because until recently it was a manually done process, which followed our guides (VMware & VirtualBox). We have now upped our DevOps game, and automated the build process! Enter build-scripts/Kali-VM.

• Another positive outcome of this is that it allows us to generate weekly VMs now! These images are more up-to-date, meaning less packages need updates out of the box, but the only set of tests run are the automated ones. Our release images have an additional set of Quality Assurance (QA) smoke-tests run against them, with the knowledge of last-snapshot, meaning the packages are in a known state. You have a choice: Stable vs updates!

• Let’s start with a quick introduction to the weekly VMs, then we’ll have a glimpse at the Kali-VM build script.

• The microservice deployment and management stack is proving very effective for companies taking advantage of the cloud’s capabilities to scale and adapt. Containers (often alongside Kubernetes) sit on top of this elastic fabric with agile DevOps and CI/CD workflows that transition code from development to production in short timescales.

• A significant problem with the speed of transition from home lab environments to production in just a few years is that container technology is generally DevOps, and not SecOps-focused. The collegiate atmosphere of trust in the broader development community has not so much turned a blind eye to bad actors, but simply not considered the implications of malevolent players’ potential activities.

Gemini* and Gopher

Personal

• I hit the ground running and I haven’t stopped since. Got a deadline for a new computer lab rollout that I need to finish — I think it’s going fine, actually, it’s just a lot — and with training in between April and now, everything has been A Lot. Also, Gemini’s port being blocked at work hasn’t helped at all.

• 4000 beagles rescued from the Envigo breeding factory in Cumberland, Virginia are up for adoption. These beagles survived Envigo’s numerous violations of the Animal Welfare Act. If you live in the Virginia, Maryland, or Washington D.C. areas and are in a position to adopt a beagle, please contact Homeward Trails or the Humane Society of the United States (HSUS).

• Had their life at Envigo continued, the dogs could have reasonably expected dental disease, parasitic infections, food covered in mold, severe skin problems, and ambient temperatures consistently upwards of 90°F (32°C). All of these things were observed in the USDA’s July 2021¹ inspection. They could have then gone on to be one of the 196 dogs euthanized via intracardiac injection performed without an anesthetic, as USDA investigators observed in their November 2021² inspection.

• Lucky and charitable readers of Max Stirner will remember that first moment in which they grasped (or felt as though they had grasped) Stirner’s process of inquiry, that feeling of complete exhilaration that comes from one’s first sustained encounter with Der Einzige und sein Eigentum.

• This despite the fact that it’s a small miracle for a reader to there in the first place. There are few authors who have been so willfully misunderstood by their enemies and misinterpreted by their most vocal, would-be supporters. The former despise him because of his ferocious assault on their religious, philosophical, political, or moral “fixed ideas;” the latter would have Stirner be a kind of cantankerous old uncle who held to their political platform while being none the wiser, no matter that platform’s vintage.

• Since the Italian peninsula has a mediterranean climate, summer is not just the hottest, but also the driest time of the year. Mediterranean climates experience extended droughts durring the warm season, and it’s possible that the effects of the drought were too obvious to ignore by July. It also may be that in ancient times, people feared that the drought would not end unless they prayed to Neptunus. In regions such as southern California, which has an extreme mediterranean climate, summer rain is extremely rare; San Diego rarely gets any rain from June to September. The Mediterranean itself, is actually less “mediterranean” in climate, but this pattern of warm or hot dry seasons existed in ancient Rome, much as it does today (erenow.net)

Technical

Internet/Gemini

• AuraGem Search has been updated to use Full-Text Searching (FTS) with indexed page metadata. This does not do Full-Text Searching on page contents, because AuraGem Search does not store page contents.

• Previously a query with just one search term could take over 1 second. With this change, a one-term query will take up to 80ms.

• Further improvements will be made in the future, including pagination for large result sets, and providing FTS optimized for languages other than English.

• Documents have many positive aspects and forcing people to use an app (anything with Javascript) means that almost always the experience degrades: less accessibility, less freedom in layout, theming, archiving, printing, navigation, and so on.

• This is my first Post in my new Gemlog. Four months ago I decided to enter Geminispace, three months ago I rented a VServer, After a slow and careful setup my site is finally ready for takeoff.

• You see, I start things slowly and cozy. Nevertheless I have many plans here. But for now I enjoy the good feeling of having a step accomplished and learned new things. Afterwarts I might write a new text, which I will hopefully publish tomorrow. But this will be an exception since I probably won’t be able to publish on a daily basis.

• Well over a year ago, one of the first things I did on AuraGem (previously Ponix) was write code that converted a Gemsub Feed to an Atom Feed. Everytime someone clicks on AuraGem’s Atom feed, it is automatically generated on-demand with the code below. It is extremely simple, and certainly can be improved, but it works for my uses. One thing that can be added is the subtitle line (marked by the second-level heading just under the feed title), as described in the Gemsub Feed companion spec.

• Gemini (Primer) links can be opened using Gemini software. It’s like the World Wide Web but a lot lighter. Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages. Permalink  Send this to a friend

----------

➮ Sharing is caring. Content is available under CC-BY-SA.