● 11.30.22

Gemini version available ♊︎

● Links 30/11/2022: Mesa 22.3, EuroLinux 9.1, and Texinfo 7.0.1

Posted in News Roundup at 9:40 pm by Dr. Roy Schestowitz

GNU/Linux

Desktop/Laptop

• After last week’s feast and many, many leftovers, we’re serving up a summary of all the juicy morsels we’ve encountered this month here at System76. Bon appétit!

Audiocasts/Shows

• There are so many Wayland issues being dealt with right now and the latest is fractional scaling, finally Wayland is finally supporting it properly and not doing it through a giant hack.

• Jason Griffey of NISO is the guest this week on FLOSS Weekly. Aaron Newcomb and Doc Searls talk with Griffey about all the lessons we should all be learning from the successes, failures and future implications of his LibraryBox project. A great discussion on standards, open hardware and privacy.

• What’s up, Linux Community!!! In this video, I cover a cyber security article on how Twitter user data has been leaked online. While most of the data consisted of public information, such as Twitter IDs, names, login names, locations, and verified status, it also included private information, such as phone numbers and email addresses.

Graphics Stack

• Coming a little over two months after Mesa 22.2, the Mesa 22.3 release is here to introduce new features like Mesa-DB, a new single file cache type, initial GFX11/RDNA3 support on the Radeon Vulkan (RADV) driver, OpenGL 4.5 support on the Freedreno/a6xx driver, Radeon Raytracing Analyzer integration using the RADV_RRA_* environment variables, as well as shader disk cache and Mali T620 support on Collabora’s Panfrost driver.

• Mesa 22.3 also adds support for R8G8B8, B8G8R8, R16G16B16, and 64-bit vertex buffer formats on the Radeon Vulkan (RADV) driver, along with various ray tracing optimizations and the VK_EXT_extended_dynamic_state2 feature.

Instructionals/Technical

• Several weeks ago, I wrote an article that provided a basic overview of the AppArmor hardening tool, explained how it works, and showed you a practical example on how to confine and harden the Firefox browser. But wait, not just any which Firefox, but specifically the tarball version that you can download from Mozilla. I’m talking about the tar archive. Grab, extract, run.

• So far so good. Using the AppArmor profile (template) from my Kubuntu installation, I was able, with small modifications, to create a custom ruleset for the Firefox tar version running from my home directory. Things are fine, but there be one problem. By default, it cannot update. We shall fix that now.

• Improve your terminal experience and save more time by reducing the length of your Linux commands with these methods.

• Linux commands are often known for being too long, and with excessive length comes increased complexity and comprehension issues. But there’s always a way to shorten your Linux commands and turn them into the neat, concise strings that everyone loves.

• Here are four ways to shorten the length of your commands so you can type less and do more within the Linux terminal.

• This tutorial will only work on Chromebooks with an Intel or AMD CPU (with Linux Apps Support) and not those with an ARM64 architecture CPU.

• Linux is an incredibly powerful operating system for both servers and desktops. For the most part, anyone using Linux on a desktop could go their entire life without touching the command line.

• However, there are a lot of very handy tools from within the terminal window. Take, for instance, identifying your IP address.

• Let’s say you’re using a desktop version of Linux, complete with a desktop environment and all the features that come with it. If you have that desktop configured for DHCP, your machine will be given an IP address from a server or router on your network.

• Compressed Linux files are helpful because they save disk space, but what should you do when you have a series of compressed files and want to determine if any are duplicates? The zdiff and zcmp commands can help.

• To begin, if a directory contains two files like those below, it’s easy to tell just from the listing that they are not identical. After all, the file sizes are a little different.

• Videomass is an excellent tool for anyone who needs to work with video files, and the user interface is intuitive and easy to use, making it perfect for beginners. Videomass also offers many features for more advanced users, including concatenating videos, creating presets, and managing conversions. Videomass is also open-source and cross-platform, meaning it can be used on Windows, Mac, and Linux distributions such as Ubuntu. Another great benefit, Videomass is officially supported with a PPA making the installation and updating straightforward.

• As the introduction explains, the tutorial will teach you how to install Videomass on Ubuntu 22.10/22.04/20.04 Linux using the command line terminal the LaunchPAD PPA by Gianluca Pernigotto. This is the best method for Ubuntu users to install Videomass and keep it up to date.

• In this tutorial, we will show you how to install Qoobar Tag Editor in Ubuntu systems.

• Qoobar is a simple tagger which is designed for editing tags in files of classical music.

• Qoobar uses Qt for GUI and Taglib for tags manipulation and runs under GNU/Linux, Mac OS X and Windows. It also uses parts of other libraries: loudgain library, some files from Qt Creator sources and KDE sources.

• In this guide, we will show you how to install Fotoxx on Ubuntu systems.

• Fotoxx is a free open source Linux program for photo/image editing and collection management. The goal is to meet the needs of serious photographers while remaining fast and easy to use.

• In this tutorial, we will show you how to install Videomass on Ubuntu systems.

• Videomass is a cross-platform GUI for FFmpeg and youtube-dl / yt-dlp.

• Videomass is a cross-platform GUI designed for FFmpeg enthusiasts who need to manage custom profiles to automate conversion and transcoding processes.

• It is based on an advanced use of presets and profiles in order to use most of the FFmpeg commands without limits of formats and codecs.

• It features graphical tools for viewing, analyzing and processing multimedia streams and downloading videos via youtube-dl or yt-dlp.

• In this guide, we will show you how to install and use UNRAR on Ubuntu systems.

• UnRAR is the name of two different command-line applications for extracting RAR file archives.

• RAR is a proprietary archive file format that supports data compression, error correction and file spanning. It was developed in 1993 by Russian software engineer Eugene Roshal and the software is licensed by win.rar GmbH. The name RAR stands for Roshal Archive.

Desktop Environments/WMs

• This month brought lots of goodies for fans of the lightweight desktop environment as the development team released the first preview version of the upcoming Xfce 4.18 release. It looks like they are sticking to the original schedule and, if everything goes according to plan, we might see the final release of Xfce 4.18 on our GNU/Linux computers as soon as this Christmas.

• Xfce 4.18 will bring many cool new features and improvements, including (hopefully) initial Wayland support in applications. Thunar received a lot of changes, so check out the previous editions of my “Xfce’s Apps Update” monthly roundup if you can’t wait until the final release hits the streets so I can take it for a test drive and present you with the best new features and enhancements.

• The Xfce team has announced the release date of the next iteration of the desktop, which includes a good number of features to polish the fan-favorite Linux UI.

• When the next version of Xfce is released, you might not be blown away by an array of new and game-changing features. Instead, what you’ll find are plenty of subtle new features and fixes that make the open source desktop better than ever… all the while remaining very familiar, stable, and easy to use.

• The new features include a number of improvements to the Thunar file manager – such as a new bookmark menu, Recent sidebar entry, customizable keyboard shortcuts, option to show full directory path, recursive search, UNDO/REDO options, a split view, support for drag & drop items in the view panels, and the ability to execute shell scripts from within a directory.

• As far as the desktop, you’ll find the panel length is now configured in pixels (as opposed to a percentage), a new Keep Panel Above Windows option, more font options for the Xfce clock applet, and header bards that can be disabled in dialogs.

• Also included are a new default multi-monitor behavior that can be configured before you attach a second display, fixes for move-to-monitor, and 1.25/1.75 scale ratios.

Distributions and Operating Systems

New Releases

• Proxmox Backup Server 2.3, based on Debian 11.5, adds namespace-aware prune jobs and offline mirroring capabilities.

• Proxmox Backup Server is a free, open-source enterprise backup solution to back up and restore virtual machines, containers, and physical hosts following the client-server model.

• The software stack is written in Rust as the software is published under the GNU AGPL, v3. Of course, it is also specifically optimized to function with the same company’s Proxmox Virtual Environment.

Fedora Family / IBM

• EuroLinux 9.1 introduces Keylime, a remote machine attestation tool using the trusted platform module (TPM) technology. With Keylime, you can verify and continuously monitor the integrity of remote machines.

• OpenSSH now supports setting minimum RSA key length. The option to be set is named RequiredRSASize. crypto-policies enforce minimum 2048-bit RSA key length for OpenSSH by default.

• NSS no longer support RSA keys shorter than 1023bit.

• SELinux user-space packages have been upgraded to version 3.4. Changes: – Improved relabeling performance through parallel relabeling – Support for SHA-256 in the semodule tool – New policy utilities in the libsepol-utils package

• CIQ today unveiled an advisory board comprising veteran leaders with deep expertise in IT infrastructure, high performance computing (HPC), open-source software and business strategy. The advisory board will help guide CIQ as it builds the next generation of software infrastructure for enterprises running data-intensive workloads atop the Rocky Linux enterprise Linux distribution.

• Rocky Linux version 9.1 is now available. Major changes include the availability of Keylime, a remote boot attestation and runtime integrity management solution using Trusted Platform Modules (TPMs). Additionally, 9.1 introduces the first module streams including: node.js 18, php:8.1, maven:3.8 and ruby:3.1. New compiler toolset versions include GCC 12, LLVM 14.0.6, Rust 1.62, and Go 1.18.

Debian Family

• In recent years, Debian leaders have abused their positions to leak rumors and gossip about some developers while hiding far more serious scandals.

• One of those is the shadow expulsion of Shaya Potter (blog, CV) in 1998.

• Potter was a child prodigy who began a US Navy internship when he was fifteen or sixteen. At the same time, Novare, Inc was hosting some Debian infrastructure on their company servers.

• Potter claims his software was being deployed to the USS Theodore Roosevelt (Secure Tactical Access Terminal) while at the same time, Debian records show that he was stashing WaReZ on master.debian.org, a server operated by Novare.

• The case of a navy intern committing piracy is interesting for a wide range of reasons that have a lot more to do with Debian than the navy.

• Potter began co-authoring Debian as a minor. It appears that he was 19 when he was caught with WaReZ but it is not clear what age he was when he actually downloaded these illegal copies of software. The age of majority varies between different countries and different states of the US. Therefore, there was some confusion about whether it should be handled as a juvenile offence. I recently wrote about the concerns with FSFE encouraging minors to do unpaid work on open source projects.

• Earlier this year I wrote about the fact that only 86 of the original Debian co-authors agreed to form an association with a constitution. If we look at the names of the people who consented to form an association, Shaya Potter is not in the list. If Potter did not consent to the constitution then he wasn’t a member at all. Morever, the association only came into existence at the end of the vote in December 1998. Potter was supposedly expelled in November 1998, one month before the vote. Therefore, as the organization didn’t really exist yet and as he hadn’t consented to be a member, we can’t really say he was expelled at all.

• Nonetheless, it looks like his position with the US Navy also ended the year after the Debian drama. Barely five years later, Potter went on to win the LISA’05 award for the best student paper.

• The great irony in this case is that people were angry with Potter for violating copyright law. Yet this was the first time the developers forcefully removed the name of a Debian co-author from the software. Therefore, by removing his name and failing to give him equal credit as a joint author of the Debian software, they were violating his copyright interests. They set a precedent for violating the copyright interests of other authors, for example, the violent suppression of Ted Walther in DebConf6.

Open Hardware/Modding

• Heart disease is the most common cause of death — not just in industrialized countries, but for the world as a whole. Many deaths caused by heart failure could be prevented if the patient received medical care sooner, but people are often unaware of impending heart failure until it actually occurs. However, there are physiological indicators that become detectable in advance of heart failure. This wearable “health belt” contains sensors that monitor for those indicators to give warning of imminent heart failure so patients can seek lifesaving medical attention.

• This health belt has a variety of sensors to monitor key physiological indicators, including thoracic impedance, heart rate, electrocardiogram activity, and motion activity. None of those alone would reliably correspond to upcoming heart failure without many false positives and negatives, but together they provide a clear picture. The sensor array, which is wearable and resembles a cumberbund, communicates via Bluetooth with the user’s phone. When the signs of heart failure appear, their phone can either notify them to seek medical attention or notify a third party, like a family member or doctor.

Free, Libre, and Open Source Software

Web Browsers/Web Servers

Chromium

• LTS-102 is being updated in the LTS channel to 102.0.5005.189 (Platform Version: 14695.155.0) for most ChromeOS devices. Want to know more about Long Term Support? Click here.

Mozilla

• The W3C recently elected a Board of Directors (BoD) for the new W3C Legal Entity. Several new board members are currently on the W3C Advisory Board (AB) and they decided to step down from the AB to focus on the BoD. The W3C is holding a special election for the remaining 6-18 months of the terms of those four AB seats. This blog post is an extended version of my personal nomination statement for that election.

• Hi, I’m Tantek Çelik and I’m running for the W3C Advisory Board (AB) to help it reboot W3C as a community-led, values-driven, and more effective organization. I have been participating in and contributing to W3C groups and specifications for over 24 years.

• I am Mozilla’s Advisory Committee (AC) representative and have previously served on the AB for several terms, starting in 2013. In the early years I helped lead the movement to offer open licensing of W3C standards, and make it more responsive to the needs of independent websites and open source implementers. In my most recent term I led the AB’s Priority Project for an updated W3C Vision. I set the example of a consensus-based work-mode of summarizing & providing granular proposed resolutions to issues, presenting these to the AB at the August 2022 Berlin meeting, and making edits to the W3C Vision according to consensus.

Content Management Systems (CMS)

• This month we feature Huanyi (Eric) Chuang, a front end developer from Taiwan, who helps connect local groups to WordPress and the worldwide open source community. He is part of the team helping to make the first WordCamp Asia a success in 2023.

• The People of WordPress series shares some of the inspiring stories of how people’s lives can change for the better through WordPress and its global network of contributors.

• [...]

• In 2018, he took the step to help as an organizer, having joined the Taoyuan Meetup in Taiwan. He played several parts across the organizing team, and the welcoming feeling he got in every situation encouraged him to get more involved.

• He recalls meeting new friends from different fields and other countries, which gave him a great sense of achievement and strengthened his passion for participating in the community.

• When the team started this meetup, numbers were much lower than in the group in the city of Taipei, but they were not disheartened and gradually grew the local WordPress community.

FSF

• Check out the great work our volunteers accomplished at today’s Free Software Directory (FSD) IRC meeting. Every week, free software activists from around the world come together in #fsf on Libera.Chat to help improve the FSD, which is a catalog of useful free software that runs under free GNU-like systems (not limited to the GNU operating system and its GNU/Linux variants) and a project of the Free Software Foundation (FSF). This recaps the work we accomplished at the Friday, November 25, 2022 meeting, where we saw a one new program added and two entries updated. We also discussed and learned what it could mean for a free program to depend on a platform like Docker. If a program requires Docker in order to be available, it runs the danger of introducing difficult to detect nonfree dependencies, so we must be cautious when we discover a Docker configuration file or the prerequisite of Docker to run an otherwise free program.

• The fifteenth edition of the Free Software Foundation’s (FSF) annual conference is only a couple of months away. Registration is open now.

• For fifteen years, free software enthusiasts from around the world have joined us for the annual LibrePlanet conference. You can watch videos from the last conference (and do so using only free software!) on our MediaGoblin instance or on PeerTube. Also, you can now pre-order the colorful and ethically manufactured LibrePlanet 2023 T-shirt in the FSF shop. And if you order yours before the March 1, 2023, cutoff date, you’ll be able to wear it to the event.

GNU Projects

• We have released version 7.0.1 of Texinfo, the GNU documentation format. This is a minor bug-fix release.

Programming/Development

• This tutorial will help ypu installing software required to develop desktop Ubuntu applications with C++ language and GTKmm library version 4. You might want to do so following examples of the excellent programs created with GTKmm like Ardour, Inkscape, GParted, Rawtherapee and even VisualBoyAdvance. This is an alternative to programming with C/GTK as we published back in 2018. We will show you how to prepare the tools, write your first program, compile it and repeat it.

• [...]

• At default configuration, Geany cannot compile, build and run C++/GTKmm source codes correctly. For that purpose, one should configure Geany build commands manually. You can do this following the example above.

Perl / Raku

• New year is a fun time when the whole family gets together by a table and eat holiday dinner.

• Let me introduce some fun and young member of a Raku family – a guy named SparrowCI – super flexible and fun to use CI service.

Leftovers

• Saying yes is easy—at first.

• It makes you feel better. And it makes you feel like you can do anything! And the person you’re saying yes to also gets a happy feeling because you’re going to do something for them.

• Saying no is hard. It’s an admission you can’t do something. And worse still, you’re disappointing someone else who wants you to say yes.

• But here’s the thing: none of us is a god. We’re people. We have a certain amount of mental resources.

• Some people are kind of crazy and can do a lot more than you or I can, but nobody can do it all. And sometimes you can burn the midnight candle for a little while, but you’re just building up debt. Every ‘Yes’ is a loan you have to pay off.

• [...]

• The first time I seriously reflected on burnout as a maintainer was around 2016. I had a young and growing family, and had just had my third kid—with three under 5—and life was understandably getting stressful.

Security

• One of the huge benefits of WebAuthn is that it makes traditional phishing attacks impossible. An attacker sends you a link to a site that looks legitimate but isn’t, and you type in your credentials. With SMS or TOTP-based 2FA, you type in your second factor as well, and the attacker now has both your credentials and a legitimate (if time-limited) second factor token to log in with. WebAuthn prevents this by verifying that the site it’s sending the secret to is the one that issued it in the first place – visit an attacker-controlled site and said attacker may get your username and password, but they won’t be able to obtain a valid WebAuthn response.

• But what if there was a mechanism for an attacker to direct a user to a legitimate login page, resulting in a happy WebAuthn flow, and obtain valid credentials for that user anyway? This seems like the lead-in to someone saying “The Aristocrats”, but unfortunately it’s (a) real, (b) RFC-defined, and (c) implemented in a whole bunch of places that handle sensitive credentials. The villain of this piece is RFC 8628, and while it exists for good reasons it can be used in a whole bunch of ways that have unfortunate security consequences.

Privacy/Surveillance

• MEP Patrick Breyer is looking for a campaigner on defending the digital secrecy of correspondence against the proposal to indiscriminately scan personal messages and data for suspicious content (so-called chat control proposal, see chatcontrol.eu).

Defence/Aggression

• Yashwant Shinde, an RSS worker for 25 years, also claimed that he was told by a senior VHP leader about a terror training camp that was underway to “carry out blasts across the country”.

Finance

• Want to pay your $7 to hike the prized Coyote Buttes North at Arizona’s Vermilion Cliffs National Monument? Sure, just pay a $9 “lottery application fee.” Even by junk fee standards, this is a very junky fee – it’s not a fee for paying a fee, it’s a fee for the chance to pay a fee.

• Only 4-10% of lottery entrants get a permit (Coyote Buttes is a very fragile ecosystem and entrance is severely limited), which means that Recreation.gov’s rake from this junk fee is about 1,000% of what it actually makes on hiking permits.

• Well, at least that money is going to Coyote Buttes, right? Preserving the petroglyphs and the dinosaur tracks and whatnot?

• Nope. The Bureau of Land Management gets the $7 entry fee from the 64 daily hikers who are lucky enough to visit Coyote Buttes. The $14,400 in lottery fees that the day’s hopeful hikers pay to Recreation.gov for a shot at a permit all go to a giant military contractor: Booz Allen.

• I know. What. The. Actual. Fuck. On his BIG newsletter, Matt Stoller explains how a beltway bandit like Booz Allen became the Ticketmaster of America’s public lands. The deal started in 2017, when Booz got the contract to build Recreation.gov “at no cost to the federal government.”

AstroTurf/Lobbying/Politics

Internet Policy/Net Neutrality

• DDNet is running an Advent of DDNet event starting tomorrow until the last door opens on December 24…

• Today, the Departments of the Interior and Commerce and the Federal Communications Commission (FCC) announced a new Memorandum of Understanding (MOU) that will enhance spectrum access and broadband deployment on Tribal lands. In addition, the Department of the Interior will establish an Office of Indigenous Communications and Technology which will assist in the development and implementation of new wireless services on Tribal lands. Public Knowledge applauds this announcement as a major step in closing the digital divide while supporting Tribal self-determination in the digital era.

• I was originally leaning towards Gopher, but exploring Gemini in the Lagrange browser reminded me just how much I love it. Rather than boiling the ocean, I might try running my own server with some basic stuff on it first.

Monopolies

Patents

• Postmortems from the November 8th elections are in full swing with pundits and operatives making bold claims about what the results mean for Democrats, Republicans, and the country. The dust still hasn’t totally settled, but one thing is crystal clear: both chambers of Congress will be controlled by the slimmest of margins.

Copyrights

• The longstanding debate over whether Bill C-18, the Online News Act, requires payment for linking came to an end yesterday. Government officials admitted that even basic quotes from news articles that include a hyperlink to the original source would scope user posts into the law and require platforms such as Google and Facebook to negotiate payment for the links. As noted below, even that position may understate the impact of the bill, which appears to also cover a user post of a news quote without a link. In other words, merely quoting a few sentences from a news article on an Internet platform is treated as making news content available, which triggers a requirement for the platforms to negotiate payment. This position runs counter to Canada’s copyright obligations under the Berne Convention and has no place in a country committed to freedom of expression.

• [...]

• The government’s aim is to remove the ability for platforms to argue that the use of news content on their platforms through quotation is permitted under the Copyright Act and therefore does not require payment or permission. The government now admits that the platforms are correct – this is a permissible activity – but wants to suspend the fair dealing rights of the platforms for the purposes of negotiating an agreement. Bill C-18 therefore sets aside user rights by forcing bargaining as if they did not exist. Article 10(1) of the Berne Convention creates a positive obligation to include a right of quotation within national copyright law, specifically citing the right to quote news articles…

Gemini* and Gopher

Personal

• The “pink” bamboo sheets [1] finally arrived at Chez Boca. These are the ones I paid $325 for because we “stained” them acidentally with some bed clothes. Bunny and I are both puzzled over these, because they certainly don’t appear pink in any meaningful, or unmeaningful, way. We looked at them in both dim light and exceedingly bright light, (thanks to some old-school 8mm movie lights I still have) and they look white to us.

• DMs who like linear campaigns are always super eager to discuss semantics and be like “that is actually not the definition of railroading, this is not railroading in that sense of the word, this is only a linear campaign”.

• And I, who really dislike linear campaigns of all kinds, am like “uh what a distraction. I wish I hadn’t called it ‘railroading’ because some people get really hung up on how it’s much more important that the stuff they’re doing is not called a particular taboo word that everyone knows is bad, than addressing what they’re actually doing and changing their campaign structures.”

Technical

Internet/Gemini

• This post is meant to be a brief overview of the NWS weather tools for Alaska and Fairbanks. I use these tools because they give a lot of detailed current and forecasted weather data for Alaska, without requiring the use of any JavaScript. Regarding my concerns about JavaScript:

• The Player and I (Lantashi) are continuing to use the Terminal as much as possible, and that includes using Mastodon. We use Toot (link below) to interact with Mastodon. Use “toot timeline” to read your timeline, or “toot tui” to bring up an ncurses interface.

• If you see an image in your timeline, you can wget the image – “wget myurl/mypic.jpeg”, and thus if you want to grab the images from your timeline, or from a tag search, you can grab them individually that way.

• As a Sylvan adventurer, defending the Wood Sea from the evil about, I don’t have time to individually wget images when I want them! I’d rather grab them all at once, and them “fim *” (link below) through them all, quickly!

• Gemini (Primer) links can be opened using Gemini software. It’s like the World Wide Web but a lot lighter. Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages. Permalink  Send this to a friend

----------

➮ Sharing is caring. Content is available under CC-BY-SA.