● 10.20.22

Gemini version available ♊︎

● Links 20/10/2022: OpenBSD 7.2 and Claws Mail 3.19.1/4.1.1

Posted in News Roundup at 7:59 pm by Dr. Roy Schestowitz

GNU/Linux

• Build the ultimate retro emulation gaming experience, relive your Amiga Basic days and explore the huge open source emulation world! Discover all the software to enjoy the classic computer days of the ZX Spectrum, Commodore 64, Atari ST, Amiga and more. We’ll even run a mainframe for fun.

• PLUS: Search your PC faster, monitor your bandwidth, perfect your 3D prints, full-disk encryption, the best Lightweight distros tested, we dive into Kubernetes and loads more!

Desktop/Laptop

• Linux was complex to use on personal computers or laptops and used on servers or high-end cloud devices. But now the days have changed. There are various distros available for individuals wanting to use Linux on their laptops. Whether you have a high-end laptop or an old laptop, there are Linux distros that cover every device. Moreover, there are some distros available that might help the user switch from Windows or mac systems. In this article, we will take a look at five of the best Linux distros for laptops. We will also discuss some of the pros and cons of each distro.

• System76 has been selling desktop and laptop computers built with Linux in mind for years. The company just updated the design of its Thelio desktop, and now it’s available with the latest and greatest x86 CPUs.

• System76 sells three desktop computers: the cheapest Thelio workstation (starts at $949), the more powerful Thelio Mira (starts at $999), and the high-end Thelio Major (starts at $3,499). Starting today, you can now configure the Thelio and Thelio Mira with 13th Gen Intel Core or AMD Ryzen 7000 processors. Specifically, you can choose the Core i5-13600K at 5.1 GHz or the Core i7-13700K at 5.4 GHz on both computers, while the Mira is available with Ryzen 7 7600X, Ryzen 7 7900X, or Ryzen 7 7950X. The Thelio Major uses AMD Threadripper CPUs, just like before.

• You’ve heard of Android phones, tablets, TVs, cars, and smartwatches, but have you ever considered it for your laptop? The closest thing is Chromebooks, as they support Android apps. But what about actual Android? India-based Reliance will start selling a laptop powered by Google’s world-famous mobile OS.

• Reliance has launched the JioBook, a laptop that’s running an Android-based OS called JioOS that’s, according to the company, “optimized for superior performance.” It supports many local Indian languages, and it starts at 15,799 rupees, or $190. As it runs Android and it’s priced similarly to entry-level Android handsets, you can expect pretty modest specifications. Laptops running Android are nothing new, but they have fallen out of style as Windows and Chrome OS became more optimized for low-end hardware.

Server

• LINBIT® SDS 2.0 is a software-defined storage solution for Linux platforms. It is available in flavors for Kubernetes, Red Hat OpenShift, Apache CloudStack, OpenStack, OpenNebula, Hashicorp’s Nomad, Proxmox VE, XCP-ng, and as a virtual appliance for VMWare.

Audiocasts/Shows

• A Quick Overview of EndeavourOS 22.9

• What makes Google’s new OS so secure, a critical WiFi vulnerability in the Kernel, and why Linus is tapping the hype breaks for Linux 6.1.

• In this video, I am going to show how to install Ubuntu 22.10.

• It’s very likely you’ve never heard of a Unikernel or a Library operating system but this patchset aims to turn Linux into one of these, and it’s not useful for the general purpose user but it’s absolutely an interesting use case.

• In this video, we are looking at how to install Audacity on Linux Mint 21.

Applications

• This is a list of FOSS instant messenger applications. It’s aimed for people who want to quickly use and know more about Telegram, Signal and many others as free/libre open source software alternatives to Skype or WhatsApp proprietary messengers. We hope this helps you and your friends choose one. Happy communicating!

• For nearly twenty years, CPU-Z has been a staple for performance Windows users who want to see as much detailed information about their system as possible. Windows’ built-in device manager and resource monitor only provided so much information about the hardware in a computer, but finding certain settings or tweaks that may have been set in the system BIOS or UEFI may not be exposed. Applications such as CPU-Z have filled this gap for Windows users over the years, however Linux and BSD users have been without a single desktop GUI that gives the same information.

• CPU-X was first released in 2014, and can be easily downloaded from their Github repository. Written in C, CPU-X can be run on the desktop with a GTK interface similar to that of CPU-Z, or from the command line using ncurses. It provides to Linux users essentially what CPU-Z provides to Windows users.

• The MAAS 3.3 Beta 1 release is out. You should take a look.

• This is the 105th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news.

Instructionals/Technical

• LXC (aka Linux Containers) is a kernel-level virtualization tool. With it, users can create and run fully contained Linux operating systems. Here’s how to use LXC on your Linux system.

• MongoDB is an outstanding NoSQL database that offers plenty of features to satisfy the most demanding needs, but I’ve found installing MongoDB to be a bit inconsistent across Linux distributions. MongoDB might install just fine on, say, Ubuntu 20.04, but there’s no guarantee it will start properly. That’s an issue I’ve experienced on several occasions.

• Pop!_OS is my primary operating system. I use it every day for the vast majority of my productivity. The other day I was taking care of a few tasks and I thought: “I should really do something to make this a bit more efficient.”

• It’s not like I mind using the command line or working with different tools for different tasks. But some days I would much rather do everything under one roof. Even better, I have other machines to deal with that could benefit from a more efficient solution.

• Recently I had a first look into Vulkan development. So I started by reading a Vulkan Tutorial. It’s rather detailed and actually it takes a long time before you see your first shaded triangle (about 900 lines of code!). The Vulkan Tutorial has some software requirements on Linux, which are explained in detail in the Development environment for Linux. In order to make things easier for openSUSE users here is the package list you need to have installed. Just install them via zypper.

• It’s easy to access and read Wikipedia articles using the Linux terminal when you need to.

• Hardcore Linux fans spend their lives on the command line. From inside a terminal, you can do virtually everything—to the extent, that many don’t even bother installing a desktop environment.

• But did you know that you can easily read Wikipedia summaries from the terminal? Here’s how.

• Jack Wallen shows you how you can wrangle all of those SSH connections you use daily into a single, easy-to-use application.

• Hi-Res FLAC files are one of the pinnacles of the Hi-Fi audio experience. However, if you rip your CD into FLAC files, you might find that they are often hard to play outside the equipment they are made for. This can be an issue for users who own high-resolution audio tracks but do not have the tools to play them properly.

• One way to fix this is to use sox to resample your Hi-Res FLAC files. This tutorial teaches the basics of sox and how to use it to resample FLAC files in Linux.

• “For video editors, the OpenShot Video editor is a good choice. The open-source and free tool helps users create and edit classic videos and offers multiple audio, video, and image formats. With this tool, you can create content videos for social media platforms and platforms like YouTube.

• This tutorial covers different ways of installing OpenShot on Ubuntu 22.04.”

• Learn the commands to install free and open-source OpenSCAD 3D CAD software on Ubuntu 22.04 LTS Jammy JellyFish Linux using the terminal and GUI.

• The 3D tool OpenSCAD generates 3D models from descriptive scripts. This gives you very precise control over every single work step during modeling.

• From various two- and three-dimensional basic shapes, you assemble your model, move elements and assign colors.

• Various mathematical operators, modifiers, transformations, variables, loops, and other functions allow to realize of almost arbitrarily complex models.

• The interface of OpenSCAD is essentially divided into two areas. While you type the script on the left, the freeware renders the result on the right side at the push of a button.

• Install the 2048 mathematical game on Ubuntu 22.04 Jammy JellyFish or Ubuntu 20.04 Focal Fossa to take a break from your Terminal commands.

• 2048 is a simple but complicated puzzle board game in which a single player gets 4×4 tiles. Where the player has to combine or add the random but same digits to achieve the value of 2048 before the board is full. It was developed by Gabriele Cirulli, an Italian developer.

• At first glance, the game seems quite basic and easy to play but as you start sliding the tiles to get the number 2048 you will realize, it is not a piece of cake for everyone. Only the mathematical sound person could get the right number to win the game.

• Originally the game was written in Javascript and CSS. And being an open-source software it is available to install using the default system repository of Ubuntu Linux.

• The best part is that we can use our Terminal to play it, no need to launch some separate application launcher to play the game.

• In this guide we are going to Install and set up Apache virtual host to serve PHP content on a Ubuntu 22.04 system. The Apache HTTP Server(Apache), is one of the most popular free and open-source cross-platform web server software, released under the terms of Apache License 2.0.

• Zabbix is an open-source monitoring software tool for diverse IT components, including networks, servers, virtual machines and cloud services. Zabbix provides monitoring metrics, among others network utilization, CPU load and disk space consumption.

• In this tutorial, we will show you how to install Fork CMS on Ubuntu 22.04 LTS. For those of you who didn’t know, Fork CMS is a free open source content management system (CMS) written in PHP and uses Symphony components. Fork CMS comes with many themes and apps like Banners, Guestbook and support many third-party extensions available to use.

• This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the Fork content management systems on Ubuntu 22.04 (Jammy Jellyfish). You can follow the same instructions for Ubuntu 22.04 and any other Debian-based distribution like Linux Mint, Elementary OS, Pop!_OS, and more as well.

Games

• For the Steam Deck, we have just reached 6000 games (almost, 5974 at the last count an hour ago), classified in two categories:

• - Verified; 2370 verified - Playable: 3604 playable

• Here’s a graph of the progression over time – we are headed towards somewhere between 7000 and 8000 games by the end of the year.

Desktop Environments/WMs

K Desktop Environment/KDE SC/Qt

• In this video for our ‘Insights’ series, we talk to Bruno Coudoin, the creator and founder of GCompris software, about what inspired him and how GCompris became so successful.

• GCompris is a free and open source, high quality, educational software suite for kids aged 2 – 10, that’s built with Qt.

Distributions and Operating Systems

New Releases

• In preparation for the upcoming Makulu Max release, We have now added a “Max” section to the Main website where we have posted the “Release notes highlights” for the last 2 months, users can now follow development as we get ready for the Beta 1 release. The release date is expected to be in the coming weeks, however no exact date is yet determined. Feel free to check out the Release Notes Highlights by clicking here. We will also be making some videos in the Coming Days/Weeks to prepare users for what to expect. More news will follow…

BSD

• This is a partial list of new features and systems included in OpenBSD 7.2.

Fedora / Red Hat / IBM

• Once upon a time, and it wasn’t that long ago, “desktops” were terminals to mainframes or midrange computers running Unix. Then along came the PC, and everything changed. That is, until now. Today, Desktop-as-a-Service (DaaS) is making a comeback. And Red Hat is joining this trend with the general availability of Red Hat Enterprise Linux for Workstations (RHEL WS) on Amazon Web Services, announced Tuesday.

• Red Hat, Inc., the world’s leading provider of open source solutions, today announced that Ulta Beauty, the nation’s largest beauty retailer, has selected Red Hat Ansible Automation Platform as its internal standard for automation transformation. As part of a three-phased transformation project to free up IT teams by deploying technology with greater speed and efficiency, the retailer is using automation as a catalyst for innovation and cultural change. Through this effort, Ulta Beauty has already saved thousands of hours a year in manual work with Ansible Automation Platform.

• Firstly, there’s a fix.

• In most cases, update. Cockpit 277, released last month, has the fix.

• Updating Cockpit should work for Arch, CentOS Stream, Debian, Fedora, openSUSE, non-LTS versions of Ubuntu.

• If updating doesn’t work (in Ubuntu LTS, some versions of RHEL, Alma Linux, and Rocky Linux), then hopefully it will work very soon. For the time being, please look at the bottom of this post for some workarounds.

• EPEL 8 Modularity was set up shortly after the main EPEL 8 release. It attempted to use the Fedora module ecosystem with RHEL modules. The strange mixture of Fedora ecosystem and RHEL modularity never worked properly. There have been routine instances of modules that wouldn’t install, modules that overwrote RHEL modules, Fedora maintainers surprised their modules were in EPEL, and the constant issue that EPEL modules couldn’t depend on RHEL modules.

• Many people have attempted to fix EPEL modularity over the years but none of these attempts have worked. At this point the EPEL Steering Committee is saying that the experiment with modules in EPEL has not worked. We are decommissioning EPEL 8 modularity.

• In the beginning, there was… well, we don’t know, because we weren’t there to tweet about it. Without the internet, it was difficult to arrange things like hunting parties or afternoon tea. Most people woke up with the sun and slept when it was dark. The keeping of time was so sloppy that eventually winter stopped happening in winter, and something had to be done about it. In 1582 Pope Gregory XIII created our modern calendar, and centuries later most countries have adopted it. I’m not kidding about “centuries” either; Saudi Arabia only adopted it in 2016, and Britain waited until 1752 as can be seen by the weird calendar that year…

Canonical/Ubuntu Family

• Ubuntu 22.10, codenamed “Kinetic Kudu”, is finally released today. This release is a mark of continuous improvements to the new technology adoption by Ubuntu for its general and commercial users across desktops and servers.

• This is the final release of this year and a short-term one, supported until July 20, 2023. The team has worked hard through the development and testing cycle and finally introduced the final Ubuntu 22.10.

• Here’s what’s new.

• Always stay with long-term support release. That is the thumb rule. So, the prior Ubuntu 22.04 LTS Jammy Jellyfish is supported until April 2027. That’s a long time.

• In addition, LTS releases are super stable. They rarely break and become unstable. So, if you use your laptop/desktop or server installation with the LTS version, stay with it.

• However, if you want the latest Kernel, GNOME 43, and new technology like Pipewire – you might want to make the jump and want to upgrade to Ubuntu 22.10 Kinetic Kudu.

• Here’s how.

• Dubbed the “Kinetic Kudu,” Ubuntu 22.10 is here with the latest and greatest GNOME 43 desktop environment by default (yes, with support for GTK4 apps), which comes with numerous new features and enhancements for fans of the GNOME/Ubuntu desktop, yet the look and feel remain unchanged from previous releases.

• After a few releases that were not synced with the latest GNOME desktop release, Ubuntu’s engineers finally managed to ship an Ubuntu system that features the most recent GNOME Stack, and GNOME 43 introduces a new GNOME Text Editor app that replaces Gedit in Ubuntu 22.10 as the default text editor.

• Included as part of the Ubuntu 22.10 release, there are the Kubuntu 22.10, Xubuntu 22.10, Lubuntu 22.10, Ubuntu Unity 22.10, Ubuntu Studio 22.10, Ubuntu MATE 22.10, Ubuntu Budgie 22.10, and Ubuntu Kylin 22.10 official flavors, which are packed with all the internal changes of Ubuntu 22.10.

• The highlight of the Kinetic Kudu flavors release is Ubuntu Unity 22.10, which sees first ever release as an official Ubuntu flavor recognized by Canonical. Ubuntu Unity features the good old Unity7 desktop environment that Canonical used to maintain many years ago, and this should please many old Ubuntu users out there.

• Ubuntu 22.10 brings exciting new features such as GNOME 43, the latest Kernel, a newly re-designed tray menu, Files features, Pipewire and many more.

• I am sure you are excited to try them.

• Before you head over to enjoy a new installation of Ubuntu, here’s an assorted list of customization tips which you can’t miss.

• In this post I show you how (relatively) easy it is to upgrade to Ubuntu 22.10 from Ubuntu 22.04 LTS.

• Just keep in mind that Ubuntu 22.04 LTS is a long-term support release and Ubuntu 22.10 is not! As an interim release, Ubuntu 22.10 gets just 9 months of guaranteed support compared to the (at least) 5 years of support Ubuntu 22.04 LTS receives.

• Which do you covet more: rock-solid stability and a UI you can depend on not changing for five years, or the latest features, refreshed software, and a big upgrade every six months?

• If you’re happy to ride the interim wave, here’s the actual “how to” bit.

• It’s live — Ubuntu 22.10 “Kinetic Kudu” is available to download.

• Ubuntu 22.10 comes with a number of improvements to the user experience, a new sound server, new text editor app, and Linux kernel 5.19. It also boasts better-than-ever support for the Raspberry Pi single board computer.

• Ubuntu 22.10 has been released. “Codenamed ‘Kinetic Kudu’, this interim release improves the experience of enterprise developers and IT administrators. It also includes the latest toolchains and applications with a particular focus on the IoT ecosystem.” See the release notes for details.

• Canonical has announced the release of Ubuntu 22.10, codenamed “Kinetic Kudu.” The new release comes with some desktop and performance tweaks, as well as a focus on Internet of Things development.

• Canonical released a new version of its Linux distribution Ubuntu today. Ubuntu 22.10, codename Kinetic Kudu, is a short term support release that will be supported until July 2023. Ubuntu users who need long term support should use the Ubuntu 20.04 LTS, Long Term Support release, instead, as it is supported until April 2027.

• Downloads are not yet provided on the official Ubuntu website, but several mirrors host the new interim release already. Soon, downloads will also be offered on the official website and you may check out the main download page to find the Ubuntu 22.10 download.

• GNOME 43 Desktop Environment, PipeWire as default, and Linux kernel 5.19 are the key new features in the just-released Ubuntu 22.10.

• The wait is finally over. Ubuntu 22.10, codenamed ‘Kinetic Kudu’, has finally arrived and is available to download.

• Following a tradition, Ubuntu 22.10, like all prior versions of the x.10 series, was released on the penultimate Thursday in October, as planned. For those interested, this is the 37th release of Ubuntu since 2004, when the initial version, Ubuntu 4.10, debuted.

• The Xubuntu team is happy to announce the immediate release of Xubuntu 22.10.

• Xubuntu 22.10, codenamed Kinetic Kudu, is a regular release and will be supported for 9 months, until July 2023.

• Xubuntu is an XFCE-powered official Ubuntu flavour.

• It is also one of the best lightweight Linux distributions available.

• The Kubuntu Team is happy to announce that Kubuntu 22.10 has been released, featuring the ‘beautiful’ KDE Plasma 5.25 simple by default, powerful when needed.

• Codenamed “Kinetic Kudu”, Kubuntu 22.10 continues our tradition of giving you Friendly Computing by integrating the latest and greatest open source technologies into a high-quality, easy-to-use Linux distribution.

• Under the hood, there have been updates to many core packages, including a new 5.19-based kernel, KDE Frameworks 5.98, KDE Plasma 5.25 and KDE Gear 22.08.

• Kubuntu is an official Ubuntu flavor that offers a lot of functionality in a refined KDE-powered package.

• The release of Kubuntu 22.10 promises various improvements and a newer version of KDE Plasma.

• Let us go through the highlights of this release.

• Ubuntu MATE 22.10 is a modest update by recent standards and focused on “quality of life improvements”. And there is good reason why this release of Ubuntu MATE doesn’t feature the usual bucket list of changes you’d typically expect, and that’s because I’ve been helping bring the full Ubuntu MATE experience to Debian MATE

• Ubuntu MATE is one of the official Ubuntu flavours that add interesting improvements with every upgrade.

• It is aimed at users who cherish the look and feel of a traditional desktop but also desire the functionality of a modern operating system.

• Ubuntu MATE 22.10 release adds a number of betterments and features, let us take a look at those.

• The Ubuntu Studio team is pleased to announce the release of Ubuntu Studio 22.10, code-named “Kinetic Kudu”. This marks Ubuntu Studio’s 32nd release. This release is a regular release and as such, it is supported for 9 months (until July 2023).

• Since it’s just out, you may experience some issues, so you might want to wait a bit before upgrading. Please see the release notes for a complete list of changes and known issues.

• Ubuntu Budgie is an official flavor of Ubuntu, which is popular for its traditional desktop interface and minimal software bloat.

• The release of Ubuntu Budgie 22.10 brings in a few crucial tweaks and additions.

• Canonical has announced the availability of Ubuntu 22.10 “Kinetic Kudu”. This is described by the company as an interim release that is aimed at improving the experience for enterprise developers and IT administrators. It comes with the newest toolchains and applications for the IoT ecosystem. Unlike LTS versions of Ubuntu, such as Ubuntu 22.04 LTS, this interim release will only receive support for nine months.

• Ubuntu 22.10, codenamed “Kinetic Kudu”, is here. This release continues Ubuntu’s proud tradition of integrating the latest and greatest open source technologies into a high-quality, easy-to-use Linux distribution. The team has been hard at work through this cycle, partnering with the community and our partners, to introduce new features and fix bugs.

• Ubuntu Desktop 22.10 users will benefit from the refinements in GNOME 43, including GTK4 theming for improved performance and consistency. Quick Settings now provide faster access to commonly used options such as wifi, bluetooth, dark mode and power settings.

• The Pipewire audio platform broadens support for audio devices and provides a step up in bluetooth connectivity, delivering improved performance for video conferencing. Linux 5.19 improves the power performance of Intel devices and now includes multithreaded decompression on Ubuntu to improve multi-core desktop snap performance.

• Thanks to all the hard work from our contributors, Lubuntu 22.10 has been released. With the codename Kinetic Kudu, Lubuntu 22.10 is the 23rd release of Lubuntu, the ninth release of Lubuntu with LXQt as the default desktop environment.

• Xubuntu 22.10, “Kinetic Kudu,” has been released! The antelope-inspired release packs the latest and greatest GNOME 43, MATE 1.26, and Xfce 4.17 packages. Some long-running issues have finally been addressed, making for a better overall experience over recent releases. I hope this new release makes using your computer more enjoyable.

Open Hardware/Modding

• The quality of the air we breathe has a direct impact on our health. Poor air quality can cause a variety of health problems, including respiratory infections, headaches, and fatigue. It can also aggravate existing conditions such as asthma and allergies. That’s why it’s so important to monitor the air quality in your office and take steps to improve it if necessary.

• Furthermore, the number of people in an office can have a significant impact on air quality. The more people there are, the greater the chance of contaminants being emitted into the air. This is why environmental monitoring is so important in corporate offices; it helps to ensure that the air quality is safe for all workers.

• The last few years added to this challenge yet another layer: The COVID-19 pandemic has forced many businesses to re-evaluate their workplace safety protocols. One of the most important considerations is air quality. Poor air quality can lead to a variety of health problems, including respiratory infections.

• In the first season of Stranger Things, a character uses a string of Christmas lights to communicate with a missing loved one. The missing person in question can flash particular lights next to letters painted on a bedsheet to spell out messages. The Christmas lights and bedsheets have become a part of pop culture and because the show is creepy, Redditor BishSaidWut’s recreation is the perfect Halloween decoration.

• Unlike most of the similar decorations that you can buy online that either blink randomly or spell out pre-programmed messages, BishSaidWut’s Christmas lights can spell out any message that they text to a specific phone number. That phone number connects to the Twilio service, which parses SMS messages and makes the text available through an API. An ESP8266 board connects to that API and processes incoming messages. If the message is within an acceptable length and doesn’t contain profanity, the ESP8266 passes on the text to an Arduino Uno development board.

Mobile Systems/Mobile Applications

• With Ubuntu Touch, the UBports Foundation offers a truly unique mobile experience – a viable alternative to Android and iOS. The UBports community provides a free and open-source GNU/Linux-based mobile operating system. One that can be installed and used today.

• Currently, there is an intensive effort going on lifting Ubuntu Touch from its current Ubuntu 16.04 base up to an Ubuntu 20.04 base. (And very soon after that to an Ubuntu 22.04 base…).

• With the Ubuntu Touch 20.04 base the progress bar is already at (I’d say) 89%, but we recently got hit by a drawback.

• I am currently involved in the Ubuntu Touch core development team at UBports and on medium short notice our current ARM64 server sponsor has announced to decommission our ARM64 build server that currently powers all the ARM64 and armhf CI builds.

Free, Libre, and Open Source Software

Web Browsers/Web Servers

Mozilla

• I’ve been a bit busy with site design changes and Ubuntu 22.10 release content writing so I missed Firefox 106 being release released.

• And, y’know what? Firefox 106 is actually a pretty meaty update, even if I’m not a fan of all of its changes. The browser’s rapid release cadence means big new features are few and far between, or introduced slowly over several releases.

• Not so here — let’s take a look.

• Mozilla has released security updates to address vulnerabilities in Firefox ESR and Firefox. An attacker could exploit these vulnerabilities to cause denial-of-service conditions.

• The essence of software engineering is making trade-offs, and sometimes engineers even trade away security for other priorities. When it comes to running untrusted code from unknown sources, however, exceptionally strong security is simply the bar to clear for serious participation: consider the extraordinary efforts that Web browser and hypervisor maintainers take to preserve their systems’ integrity. WebAssembly runtimes also run untrusted code from untrusted sources, and therefore such efforts are also a hard requirement for WebAssembly runtimes.

• WebAssembly programs are sandboxed and isolated from one another and from the host, so they can’t read or write external regions of memory, transfer control to arbitrary code in the process, or freely access the network and filesystem. This makes it safe to run untrusted WebAssembly programs: they cannot escape the sandbox to steal private data from elsewhere on your laptop or run a botnet on your servers. But these security properties only hold true if the WebAssembly runtime’s implementation is correct. This article will highlight the ways we are ensuring correctness in the Wasmtime WebAssembly runtime and in its compiler, Cranelift.

• This is our second blog post leading up to Wasmtime’s upcoming 1.0 release on September 20th, 2022. The first blog post focused on Wasmtime’s performance. We’re ready to release Wasmtime 1.0 because we believe not only that it solidly clears the bar for security and correctness, but also that we have the momentum, processes, and multi-stakeholder investment in place to keep it that way in the future.

• To bring it back, something else very big has to go. Easy has both Firefox and SeaMonkey, which is too much of a luxury, one will have to go.

Content Management Systems (CMS)

• A web content management system (WCMS) is software designed to simplify the publication of Web content. In particular, it enables content creators to submit content without requiring technical knowledge of HTML or the uploading of files. A CMS is most commonly used in creating an intranet or in establishing a presence on the Web.

Programming/Development

Rust

Standards/Consortia

• The USB Implementers Forum, USB-IF, rolled out the spec of USB 4 version 2 just last month, as you’ve probably read in The Register. We noted at the time that the nitty-gritty stuff would debut in time for developer events scheduled for November.

• Well, it’s nearly November, and a more detailed announcement [PDF] is here. (We especially like the _FINAL_v2 on the end of the filename. We’ve all done it.)

• Apparently, if you have a passive USB-C cable capable of 40Gbps, with USB-4 v2 it will now be able to do 80Gbps. Good for you if you know the speed rating of your USB-C cables, because here at the Reg FOSS desk, we freely admit that we don’t. We don’t even know if ours are active or passive. We can only apologize for this wretched lack of professionalism, and once we learn how to tell, we’ll put a new cartridge in our label-maker and rectify this.

Leftovers

Security

• Security updates have been issued by Debian (firefox-esr), Red Hat (java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, OpenShift Container Platform 4.9.50 bug fix and, and rh-nodejs14-nodejs), SUSE (buildah, clone-master-clean-up, go1.18, go1.19, helm, jasper, libostree, nodejs16, php8, qemu, and xen), and Ubuntu (libxdmcp, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oem-5.14, linux-oracle, linux-raspi, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gke, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-oem-5.17, and perl).

• In this video, I cover an FBI warning issued about how scammers may be targeting individuals seeking to enroll in the Federal Student Aid program to steal their personal information, payment details, and money.

• CISA has added two vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added vulnerabilities in the catalog, click on the arrow in the “Date Added to Catalog” column, which will sort by descending dates.

• CISA has issued requests for comment (RFCs) on eight Microsoft 365 security configuration baselines as part of the Secure Cloud Business Application (SCuBA) project to secure federal civilian executive branch agencies’ (FCEB) cloud environments.

• CISA has released three (3) Industrial Control Systems (ICS) advisories on October 20, 2022. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

• Confidential Computing is a hardware-based technology that shields computer workloads from their environments and keeps data encrypted during processing.

• In this Help Net Security video, Felix Schuster, CEO at Edgeless Systems, talks about the open-source release of Constellation.

• With Australia in a fairly messy situation as far as network security is concerned, it is somewhat curious to note that the Australia Strategic Policy Institute is trying to lobby for the complete adoption of digital identity.

• This is the equivalent of saying that one should digitise a confusing analog setup, in the hope that it would suddenly morph into something efficient.

• What always happens when a confused set-up is digitised is that the mess is magnified. Computerisation is very good at that – no fault of the discipline, but that’s just the way it is.

• It is even more puzzling that the lobbying for digital identity comes from Fergus Hanson, director of the International Cyber Policy Centre at ASPI, who is touted as a cyber security expert by that august media organ, the Australian Financial Review.

• A freshly fixed vulnerability (CVE-2022-42889) in the Apache Commons Text library has been getting attention from security researchers these last few days, worrying it could lead to a repeat of the Log4Shell dumpster fire.

Monopolies

Copyrights

• Great revolutions were stirring in Paris during January 1789: Abbé Sieyès published his incendiary pamphlet Qu’est-ce que le tiers-état? (What is the Third Estate?), and from the study of “M. Etteilla, Professeur d’Algebre” at 48 Rue de l’Oseille, a letter was sent applying for a patent to print a French edition of Livre de Thot, which promised to reveal the theory and practice of ancient Egyptian magic through Tarot. By July, when the French Revolution began with the storming of the Bastille fortress, scores of Parisians were already turning to Etteilla’s cards to divine the fate of France.

Gemini* and Gopher

Personal

• The other day, Malobee wrote a very thought-provoking post about temporarily leaving behind social media[1] based on a different post on Medium by Devon Price[2].

• Reading through these and looking at the rules being laid out, I started thinking on the way I personally make use of social media. I’m not what I would describe as a power user. While I have various social media accounts, I rarely ever make posts on them or check my personal feeds. Part of the reason I laid this gemlog out for myself as “not a place to talk about my projects or journal my daily life” is I personally dislike the idea of using the internet for social validation. That isn’t to say I never post things I’ve made to the internet or toss thoughts on my day out to others, but when I do I prefer to do so within specific Discord servers filled with people I know and enjoy speaking with in the same way you might call up a friend or a family member IRL for a chat.

• The problem I’ve always seen with social media is that it expands the relevant social circle to an unknowable amount of strangers, the majority of whom you’ll never interact with in any meaningful way. Clout-chasing is the act of trying to gain praise and validation from vast numbers of people you don’t know and whose opinions should usually hold very little value to you. And even if you’re merely reading social media there’s an endless amount of content out there, which means endless ways to burn your time on something actively unimportant or even destructive, and an even more endless amount of negativity and public opinion you can be sucked into. If you don’t know who these hundreds of people are, why do you need to care what they think about a movie that just came out or something a celebrity said?

• I just couldn’t. In any way. Physically I *can* have a kid (or kids), but the lifestyle and responsibility would crush me. I was barely raised by MY parents, and was left to be on my own accord from a very young age, like many a 1980s/90s reckless youth, who usually end up “ending” before their life expectancy due to wild environments, weird “life” situations, etc

• Some years ago I wasted a few weeks of a scammer’s time, enjoying it greatly. Here is how it went down.

• About two years ago, I lost my father.

• A few weeks ago, I came to know I am going to be one.

• My emotions underwent a rapid change when I first found out. From fear, to anxiety then exhilaration and finally happiness. It took me a while to take the decision. Lots of discussion and thinking between me and my wife, and finally we found the answer from god. We went to a temple and I told her to ask Mahadev what she should do. When she came back the confusion was absent from her face. It was a little bit early in our marriage, but I guess that’s how my life is. Everything is a tad bit early.

• [...]

• My dad, whatever he did in his professional life, never let me feel the lack of things. He would always bring me things that I wanted, not needed. He sent me to a school far away just so I could get a good education when the family could barely afford it. My spending habits in the early days were not something I would call sustainable, and yet he helped me sustain them. I guess he was not a good father in techincal terms (not spoiling the kids, teaching discipline, et cetera) , but he was always good to me. Always smiling.

• Christian lately has been talking about the subject of what he calls *memory drift* (as good a term as any) and it being one of the reasons for keeping a journal. It was certainly one of the reasons that I originally began writing and especially continued to write. Well, I also started to write to make myself appear to be more of an elitist scum than my peers. I’d peer at them from my plinth made of strung together phrases joined by tenuous punctuation. I’d guffaw at their lowliness. Peering down from the plinth of *journaling*, one observes that all others are earthbound morsels consumed by insects.

Politics

• Recently I saw a video clip from 2007, in which a statistic was cited claiming that one in five Americans are unable to locate the United States on a map. The statistic might be apocryphal, but for purposes of this log, I’m going to treat it as a result actually claimed by a real study.

• A number like that is absolutely shocking. How could so many Americans not know the location of their own home country when looking right at it on a map? People tend to believe it, however, because of a prevailing opinion–even among US citizens–that the average American is appallingly ignorant.

• I received my ballot for the November 8 election in the mail yesterday, and it will soon be time to complete it and return it. Among the items included on the ballot is the selection of a new county sheriff.

• On what basis should I decide between the candidates? There are two local law enforcement-related issues that come to mind.

• The first issue is how does law enforcement interact with the population of homeless persons? This is primarily an issue for local city police departments since homeless persons tend to congregate in cities rather than the rural areas that the sheriff’s office is responsible for. However, the voters are also in the cities so candidates must base their appeals to voters on issues that city-dwelling voters care about. In the local discussions regarding homelessness drug use and addiction is a prominent topic. Both candidates claim they will be tough on crime, especially mentioning drug dealers.

Technical

• I really love using docker compose for local development. Whenever I start writing a service with any kind of external dependencies (databases, containerized APIs etc), I quickly setup a `docker-compose.yaml’ for the project to allow me to try it out locally. I’ve heard murmurings that this is not what you should do anymore, instead you should use Kubernetes to do this. While I do like Kubernetes, I definitely prefer the simplicity of the docker-compose.yaml format. Writing a simple `docker-compose.yaml’ file takes a few minutes, writing the correct Kubernetes manifests to achieve the same thing takes considerably longer.

• Like many others I’m trying to implement a GameBoy emulator. The development is sporadic to say the least and mostly occurs when I happen to have both some time and inspiration to spare. I’m still implementing the CPU instructions, and this week I came to the one called DAA (Decimal Adjust Accumulator according to the GameBoy Programming manual). I mostly wanted to summarize my findings to have something to refer back to later, but maybe this someone out there will find it useful as well.

• The purpose of the DAA instruction is to correct a value which resulted from addition or subtraction of numbers in Binary Coded Decimal (BCD) representation. Since I had no idea what BCD was, I had to do some digging. Below are some notes to help me remember this for later.

• I saw the above link posted in IRC today and after reading the entire page at the link, I really agree with the statement.

• Frequently in a techical environment whether at work or elsewhere, someone will try to be friendly by timidly introducing themselves and posting other introductions before getting to the point. For someone whose job it is to respond and help people, not asking the question right away feels like their time is itentionally being stolen. After a while, it gets harder and harder to remind yourself that they don’t mean to waste your time by stealing your attention away from what they are trying to focus on.

Internet/Gemini

• It has been quite some time, and many miles moved, since I wrote here last. In April I was in the Dallas suburbs, messing around with converting gemtext to HTML in awk. The family is now all in the UK, having arrived in August and September. Car, job, bank account, and various other vital things are sorted out now. We’ve also made an offer on a house. Now there’s a little bit of time to play around with computers and music again.

Programming

• Over the past 40 years I’ve used (and disliked) many languages. To provide some context, I’ve written a bunch of compilers and code-generating thingamajigs, and have not seen anything better than Common Lisp as high-level languages go.

• And so I take an exception to including Common Lisp into the broad category of badly-engineered dynamic-typing languages, because I don’t think that any part of that description fits.

• Common Lisp has a pretty good type system, which you may choose to completely ignore. Modern CL compilers _infer_ type all by themselves, and if you care about types, you can provide declarations at a _per-scope level_, specifying with any degree of precision, the types you expect certain things to be, including combinations of types with a variety of logic operators.

• The upshot is that most of the studies have limitations that limit their general applicability, but if you wanted to take home a message from them, in aggregate, it’s that if static typing provides stability/reliability/maintainability benefits to programs, the effect is very, very small. But also likewise, if dynamic typing provides a benefit to developer productivity, it is also very, very small.

• There are a couple of studies that both come to about the same estimate of what percentage of errors in dynamically-typed languages are from type errors — about two (2) percent. It ought to follow that this is about the reliability benefit that you should expect to see from using static typing.

• For reasons behind the scope of this entry, I had to decode some data encoded in base32. After an embarrassing moment where i used EVP_DecodeBlock from libcrypto because apparently I can’t read (it’s a base64, not 32, decoder), I discovered that libcrypto doesn’t provide a base32 decoder. Probably some other popular library provides it, but since I was hacking in a project that only uses libc and libcrypto as dependencies, I wrote one.

• Decoding base32-encoded data is not difficult, the encoding scheme is very, very simple, so why bother writing a post about it? Well, before writing my own decoder I searched on the web if there was something I could stole and, hum, I didn’t like what I found, too over engineered. I haven’t looked too much, so apologize if I’ve missed your sexy decoder.

• Gemini (Primer) links can be opened using Gemini software. It’s like the World Wide Web but a lot lighter. Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages. Permalink  Send this to a friend

----------

➮ Sharing is caring. Content is available under CC-BY-SA.