● 08.02.23

Gemini version available ♊︎

● Links 02/08/2023: GNU C Library 2.38, Microsoft’s Collapse in Servers Continues

Posted in News Roundup at 3:02 am by Dr. Roy Schestowitz

GNU/Linux

• While Linux is not Unix, I often find that people wonder what the differences between Linux and Unix are. I’m guilty of that too, as I was unsure of the relationship between the two up until a couple of years ago when I finally sat down and read into it. The short story is that Linux is derived from Unix and is a continuation of Unix design, but in itself is not Unix.

• There’s a long and storied history between the two, and it’s extremely difficult to actually find a lot of information on the early days of both systems in context to each other, thanks to many sources being lost to the passage of time. We’ve done the best we can to dig up as much as possible, as nowadays, the differences are surprisingly slim.

• There’s a new 4MLinux in town and it’s ready to download now. Being version 43.0, it’s gone one step beyond being the answer to life, the universe, and everything else, as any good hitchhiker should know — but that’s something for a discussion later in day. For the time being, we’ll stick with the basics.

• Although 4M Linux is often referenced as “a lightweight Linux distro,” that doesn’t tell the whole story. In truth, it’s a lightweight Linux distro with a mission. You can use it for your everyday Linux distro for searching, surfing, email, and writing if you want — but that’s not really what it’s made for. It’s mainly a lightweight utility distro, ready to serve you if you need to fire up a server (let’s say to publish your blog), to use for system recovery (for like when your “real” distro fails you), or for a multimedia center (to hook up to a screen and speakers), and for gaming (which needs no explanation).

Server

• In the July 2023 survey we received responses from 1,101,218,364 sites across 255,719,341 domains and 12,125,956 web-facing computers. This reflects a loss of 5.5 million sites, but a gain of 231,918 domains and 19,453 web-facing computers.

• Google saw the largest gain of 1.6 million sites (+2.90%) this

• [...]

• Microsoft saw significant loss of 1.6 million sites (-4.66%), 117,600 domains (-1.63%), and 2,434 web-facing computers (-0.20%) this month. Microsoft now accounts for 2.99% of sites and 2.77% of domains seen by Netcraft, down by -0.13pp and -0.05pp respectively.

Audiocasts/Shows

• Mark Shuttleworth joins us on the Destination Linux podcast for an in-depth interview. Mark Shuttleworth is the Founder and CEO of Canonical, the company behind the development of the Linux-based Ubuntu operating system.

• FULL SHOW NOTES ►► https://tuxdigital.com/podcasts/destination-linux/mark-shuttleworth-interview

• We celebrate Slackware’s 30th birthday by trying it out and basking in its classic glory. Plus the BBC joins Mastodon, Google has dystopian plans for the web, the LXD drama rumbles on, and KDE takes a leaf out of GNOME’s book.

Kernel Space

• Ongoing issues with Linux and AMD’s fTPM – the chip designer’s firmware-based TPM – appear to be wearing on kernel overseer Linus Torvalds’ nerves, who has suggested switching off the module’s random number generator altogether.

• “Let’s just disable the stupid fTPM hwrnd thing,” Torvalds said on the open source kernel’s development mailing list. “Maybe use it for the boot-time ‘gather entropy from different sources,’ but clearly it should not be used at runtime.”

• TPMs, whether they’re firmware or hardware based, are used to securely create and store cryptographic keys, certificates, and passwords. The modules also, among things, generate random numbers for software to use.

• AMD’s fTPM issues are well-known in the industry, often causing system crashes and freezing. Linux’s creator Linus Torvalds has expressed his disappointment towards the feature, labeling it a “plague” for the kernel.

• The DENT project is a project from the Linux Foundation which aims at utilizing the Linux Kernel, Switchdev, and other Linux based projects as the basis for building a new standardized network operating system without abstractions or overhead.

• Qualcomm engineer Vikash Garodia has just pushed a commit to add “Qualcomm Iris V4L2 encoder/decoder driver” to mainline Linux enabling support for H.264, H.265, and VP9 decoding, H.264 and H.265 encoding, as well as M2M and STREAMING capabilities. The Adreno GPUs found in Qualcomm SoC have been supported by the open-source Freedreno driver for several years, but this was not the case with the IP block taking care of hardware video encoding and decoding. The latest patchset addresses this issue for “Qualcomm’s new video acceleration hardware architecture”, meaning it might not work for older Qualcomm processors.

Applications

• The team behind ONLYOFFICE DocSpace has recently launched a self-hosted version of their open-source collaborative platform for real-time document co-editing and management. ONLYOFFICE DocSpace is designed around the idea of rooms, where each space has specific permissions. This allows for enhanced collaboration on documents with customers, business partners, contractors, and other external users.

• The whole is greater than the sum of its parts is a very famous quote from Aristotle, a Greek philosopher and scientist. This quote is particularly pertinent to Linux. In my view, one of Linux’s biggest strengths is its synergy. The usefulness of Linux doesn’t derive only from the huge raft of open source (command line) utilities. Instead, it’s the synergy generated by using them together, sometimes in conjunction with larger applications.

• The Unix philosophy spawned a “software tools” movement which focused on developing concise, basic, clear, modular and extensible code that can be used for other projects.

• This philosophy remains an important element for many Linux projects.

• Good open source developers writing utilities seek to make sure the utility does its job as well as possible, and work well with other utilities. The goal is that users have a handful of tools, each of which seeks to excel at one thing. Some utilities work well independently.

Instructionals/Technical

• I got a refurbished Lenovo ThinkPad X1 Carbon Gen 10 and I’m not really happy with how the fan is managed by OpenBSD. Plus, the ThinkPad A485 running Windows for $WORK has been freezing quite a few times recently. So I decided I could try using a single ThinkPad for both $WORK and $HOME using different Operating Systems. I recently loved Slackware Linux again and wished I could use it too on that machine.

• In the world of Linux, having comprehensive Linux commands cheat sheet by your side can be a game-changer. Whether you’re a beginner just starting out, or an experienced system administrator, these commands form the backbone of your Linux experience. This article provides an extensive cheat sheet of Linux commands, compiled from three reputable sources.

• Among all its services Oracle Cloud Infrastructure (OCI) provides the Object Storage service. This is an internet-scale, high-performance storage platform that offers reliable and cost-efficient data durability. The Object Storage service can store an unlimited amount of unstructured data of any content type, including analytic data and rich content, like images and videos.

• Currently, Object Storage data can be accessed with: – The OCI console, an easy-to-use, browser-based interface. – The OCI command line interface (CLI). – Or programmatically with OCI SDKs or the OCI Rest API.

• OCIFS provides an alternate way to access Object Storage data through a filesystem. With OCIFS, Object Storage data becomes accessible as regular files that you can read, write or modify with standard shell commands (ls, rm, cat …) or system calls (open(2), read(2), write(2) …)

• There are certain fonts you’ll find on Microsoft Windows that don’t ship with Linux by default. Fortunately, there’s an easy way to get them.

• Suppose you are working on a complex bash script to automate a series of tasks on your Linux system. You notice that as it grows, there are certain parts of the script where the same code blocks are repeated multiple times. For this, you can wrap the repeating piece inside a block known as a ‘function’ and reuse it, making the overall code more streamlined and organized. In this article, we will discuss what is a function in bash and how to use it for automating Linux tasks.

• If you’re a font geek, you’ll find Google has plenty of free, open-source fonts to choose from. Here’s how easy it is to install them on Linux.

• Admins need to follow six steps to configure SELinux properly to run applications and services. This tutorial walks you through how to configure the security system.

• In this tutorial, we will show you how to install DirectAdmin on Ubuntu 22.04 LTS. DirectAdmin stands as a powerful web hosting control panel, empowering users to effortlessly manage websites and applications.

• Introduction What is Git? Git is a widely used version control system that allows multiple people to work on a project without overwriting each other’s changes. It keeps track of every modification to the code in a special kind of database.

• Introduction In the evolving world of software development, Version Control Systems (VCS) have become a necessity. They enable developers to keep track of changes, compare and revert to older versions of code, and work collaboratively without fear of overwriting each other’s work.

• In this tutorial, we will show you how to install Apache Spark on Debian 12. For those of you who didn’t know, Apache Spark has revolutionized big data processing, becoming the go-to solution for data engineers and analysts worldwide.

• In this tutorial, we will show you how to install Deluge BitTorrent on Debian 12. For those of you who didn’t know, Deluge, an open-source BitTorrent client, offers a powerful and versatile platform for downloading and managing torrents efficiently.

• When working with files and directories in Linux, the chmod command is a vital tool in your arsenal. As an acronym for ‘Change Mode’, the chmod command is designed to help Linux users adjust file or directory permissions. This command, brimming with versatility, is crucial in secure and efficient file management.

• In the vast realm of Linux, an open-source operating system, the grep command holds a significant place. An acronym for ‘Global Regular Expression Print’, the grep command is a widely-used Linux tool that gives users the power to search through text or output based on specific patterns.

• Understanding and efficiently managing directory contents in Linux, an open-source operating system, relies heavily on a fundamental command: the ls command. Known as the ‘list’ command, it is a powerful tool in the Linux command-line utilities toolkit, and is central to navigating the Linux filesystem.

• Webmin is a web-based system configuration tool for any Linux system that can be used to manage your server through web interface. In this tutorial, we will learn how to install Webmin on Ubuntu 18.04 LTS server.

• Whether you are new or experienced user, XFCE is the desktop environment that you will love using.

• If you are worried that Gnome will be too buggy for your old computer, then you should give XFCE a try.

• Still running an older version of Linux Mint? If yes, then it’s a good time for you to upgrade to the latest version of Linux Mint Victoria and enjoy all the new features and improvements it has to offer.

• Remote desktop control is a crucial functionality for many users, whether for managing a home server, accessing a work computer, or assisting a friend with troubleshooting. If you’re using Linux Mint, one of the best tools for this job is VNC (Virtual Network Computing) Server. VNC allows you to view and interact with a graphical desktop environment on another computer over a network connection.

• Glassfish is a free, open-source Java application server that simplifies the process of deploying Java applications to a scalable platform.

• Introduction Brief Overview of Version Control System (VCS) In software development, tracking and controlling changes to the source code is a critical process.

• Introduction Version Control System (VCS) A Version Control System (VCS) is an essential tool for software development, enabling teams to track changes, resolve conflicts, and manage code history.

• Introduction Version control systems are a cornerstone of modern software development, facilitating team collaboration, tracking changes, and supporting rollback capabilities in case of errors.

• Understanding the Need for Version Control Systems The Challenges of Code Management Managing and organizing code effectively can be quite challenging, especially when working on large projects or collaborating with others. Some common issues include losing code due to overwritten files, difficulties in tracking changes, and problems while integrating code from different team members.

Games

• Nobara Linux is a game-changer in the Linux world, targeting both beginners and gamers with its impressive features. Built on the Arch Linux framework, which is known for its solid foundation, Nobara Linux aims to make this minimalistic distribution more accessible for less technically advanced users.

• Unlike Arch Linux, which requires technical skills to use and maintain, Nobara Linux offers a user-friendly experience right out of the box. Its streamlined and straightforward interface makes installation and getting started a breeze. The distro focuses on gaming, coming pre-installed with packages like Steam, Lutris, and Wine Staging, catering to the needs of gamers.

• A little while has passed since the release of 2.7.0, and we are now excited to present you with the bugfix release 2.7.1.

• We have included a significant amount of fixes and small improvements, in particular: [...]

Desktop Environments/WMs

K Desktop Environment/KDE SC/Qt

• Every once in a while I hear developers having trouble staying up to date with KDE Discuss(ions). No great surprise when I then find out they aren’t tracking things (in other words: not subscribed to categories)!

• Discourse, the software that powers KDE Discuss, has a number of handy notifications settings that we can use to have the software bring posts to us instead of having to go to the website every once in a while. We can use these options to tailor a good experience for ourselves.

• Three setting types are relevant for the notification experience…

• KDE Plasma 5.27.7 is here six weeks after KDE Plasma 5.27.6 to improve support for multi-channel audio setups by allowing users to adjust the volume of each channel in a proportional way when adjusting the global volume level, if your system is set up to have different volume levels for each channel.

• This release also fixes a visual glitch for auto-hiding panels when using a dark color scheme when sliding in and out, and addresses a major performance issue in the Plasma Wayland session that affected Intel GPU users when animating widgets are enabled with the “Background Contrast” effect.

• The month of July is already wrapped up, I can’t believe it! I went to Akademy this year, and it was really great! Between Akademy and the imminent gear release, I didn’t get much work done this month – but oh well.

• I also closed the majority of my old MRs, which either aren’t needed anymore or not applicable. Whats left is features that are still on the backburner (like tablet dial support, Kirigami context menus, etc) that I want to finish.

GNOME Desktop/GTK

• Tobias Bernard, a designer who works with Purism, the company that sells the Librem 5 free software phone among other products, outlined in a blog post the way in which windows could be organised by the system, rather than have the user organised things they way she/he liked.

• The post appeared on the American news aggregation site Slashdot a few days back, and the first few comments were not exactly complimentary.

• “The reason window management is left to users is that we know where we want them,” wrote one commenter. “I don’t want ‘smart’ systems guessing where I want them and I don’t want them moving around.

• Looking to reduce screen time before bed? Introducing GNOME Bedtime Mode – an innovative extension that turns your GNOME workspace greyscale for a more relaxing experience. Are you often find it challenging to put your device down before bedtime?

• I’m on my way back from GUADEC in Rīga, Latvia and one recurring discussion (of many) was centered around how ratings and reviews are presented in GNOME software and other app stores.

• I’ve been building open app ecosystems for over a decade now. Ratings (quantitative feedback) and reviews (qualitative feedback) of apps can serve useful purposes: a powerful signal for ranking, a way to provide feedback to a developer, a way to demonstrate “social proof” (like testimonials or positive social media posts on a website), and a heads-up to other users for positive or negative experiences. But the widely-used five-star and review system has its problems.

• Since I’m sitting in an airport killing time while waiting to my flight back to Denver (where GUADEC 2024 is happening, if you haven’t heard!), let’s dig into this.

Distributions and Operating Systems

New Releases

• On Thursday, the Ireland-based Zorin Group announced the availability of its new Zorin OS 16.3 release across all of the Linux distribution’s six editions. Yes, you read correctly. I did write six editions, which is a lot.

• If you’re wondering why there’re so many, it’s mainly because Zorin monetizes its Linux distro by selling licenses (much like Microsoft and Apple, just cheaper), so it markets a variety of free and paid versions. There’s a free and a paid “core” version with the Gnome desktop for folks installing on machines with modern specs, and a free and a paid “lite” version, with Xfce’s desktop, for installing on older hardware with limited resources.

SUSE/OpenSUSE

• SUSE CEO Dirk-Peter van Leeuwen outlines strategy to capture the Kubernetes opportunity and offer enterprises an alternative to RHEL following Red Hat’s decision to limit access to RHEL source code

Fedora Family / IBM

• Several people have opined on the recent announcement of Red Hat to change their terms of sales for their software. Here are some thoughts from someone who has been around a long time and been in the midst of a lot of what occurred, and has been on many sides of the fence.

• This is a fairly long article. It goes back a long way. People who know me will realize that I am going to tell a lot of details that will fit sooner or later. Have patience. Or you can jump close to the bottom and read the section “Tying it all together” without knowing all the reasoning.

• Here is a long reminiscence from Jon “maddog” Hall leading up to some thoughts on Red Hat’s source-release policy changes.

• CIQ — the company building the next generation of software infrastructure for enterprises running data-intensive workloads atop the Rocky Linux enterprise Linux distribution — has expanded its leadership team, announcing today the addition of five seasoned veterans who bring not only deep experience and passion for the technology industry but also a wealth of expertise in their respective professional domains.

Debian Family

• Step into the world of MX Linux 23, codenamed “Libretto,” offering modern Xfce, KDE, Fluxbox desktops, and an array of improvements.

• Debian enjoys many derivatives, with Ubuntu being the most popular in the desktop niche. In the same field, however, aimed at more advanced users, MX Linux is one of the best things to happen to your desktop.

• Rating by us as one of the best desktop-oriented distros, including Xfce as its flagship desktop environment, the (almost) systemd-free Linux distro MX Linux is a long-established name among open-source enthusiasts.

• Today, after two betas, three RCs, refreshed identity, and over six months after the previous 21.3 release, MX Linux’s devs released the highly anticipated MX Linux 23 “Libretto.” So, let’s see what’s changed.

• MX Linux is a Debian-based distro that focuses on providing an elegant and efficient desktop experience. Not to forget, MX Linux is also a systemd-free distro.

• The last major release was MX Linux 21, which was a long time ago.

• Luckily, a new release has been introduced that promises quite a few improvements.

Canonical/Ubuntu Family

• Ubuntu 23.10, code-named “Mantic Minotaur”, is generating significant buzz among the Linux community as it is scheduled for release on October 12, 2023. A few discussions in the Ubuntu desktop Discourse forum suggest that certain applications, including LibreOffice, could be dropped from the ISO.

• Welcome to the Ubuntu Weekly Newsletter, Issue 798 for the week of July 23 – 29, 2023. The full version of this issue is available here.

• Welcome to the Ubuntu Weekly Newsletter, Issue 798 for the week of July 23 – 29, 2023. The full version of this issue is available here.

Devices/Embedded

• Amazon sells cheap tablets with decent screens and reasonably adequate specs because the company wants you to spend money on Amazon products and services.

• [...]

• But folks have been hacking Amazon tablets for as long as the company’s been offering them. These days if you buy a brand new Amazon tablet you can probably install the Google Play Store, maybe load an alternate home screen and launcher app, and make some other changes. But Amazon doesn’t make it easy to completely replace the operating system. If you have some older Amazon tablets though, it is possible to unlock the bootloader and load a custom Android ROM, or even a completely different operating system like postmarketOS.

• Just a couple of years ago, we would have laughed at the idea of getting an E-ink monitor, because most displays were still in black and white only,  larger displays were prohibitively expensive, and nobody wants to wait for several seconds to get a full display refresh.

Open Hardware/Modding

• Bulgarian open hardware specialist Olimex has announced a low-cost development board built around the Espressif ESP32-S3 microcontroller — and offering the ability to run either MicroPython or a full Linux 6.3 environment, depending on your needs.

• “ESP32-S3-DevKit-LiPo is small €12 [around $13.30] open source hardware board which is [able] to run Linux Kernel 6.x and MicroPython,” Olimex founder Tsvetan Usunov writes of his latest board design, which as the name implies is a follow-up to the ESP32-S2-DevKit-LiPo launched back in February 2021 — replacing the Espressif ESP32-S2 with an ESP32-S3 while adding a few new features besides.

• Now that my Amiga 3000 has been fully restored, I decided to make it the best Amiga I could. Here is the journey I took. Acceleration One of the first upgrades, I decided on, was to make my Amiga one of the fastest possible for the era.

Mobile Systems/Mobile Applications

Free, Libre, and Open Source Software

Web Browsers/Web Servers

Mozilla

• Acool new feature in Firefox 117 is the built-in (and automatic) translation of web content. This feature is implemented as a “Translate page” option in the application menu. When clicked, it will open a pop-up dialog to let you choose the languages you want to translate from and to.

• Mozilla says that to protect the privacy of users, the new feature will translate web pages locally in Firefox. This means that the text being translated will never leave your computer, according to Mozilla. The new translation feature is currently in beta stage.

• Firefox 115.1 and 116 Released With Two Windows-Only Security Issues Fixed As usual, a Firefox release is out with serious security vulnerabilities inherited from Windows in addition to actual bugs in Firefox.

• This is a common occurrence because Windows is badly designed and adds vulnerabilities to everything that runs on top of it.

• CVE-2023-4052 creates a hazard using the NTFS version of symbolic links and a hole in Windows UAC (discretionary access controls).

• CVE-2023-4054 is yet another Windows MetaFile-like bug that can be used to run malicious code without any warning.

• The roadmap item we’re currently working on is Improve Account Setup. Most of our time went into working on this. However, for June there’s no exciting news to share. We mostly worked on the internal plumbing; that is important to get right, but not necessarily great material for a blog post. Hopefully there will be new screenshots to share in July’s progress report.

• Having an app with a large user base means we can’t spend all of our time working on new features. Fixing bugs is a large and important part of the job. Here’s a writeup of just three of the bugs we fixed in June.

• A user reported that some of their folders appear to be empty in K-9 Mail. Using the provided debug log we were able to track this down to a message containing an invalid email address, specifically one whose local part (the text before the @ symbol) exceeds the limit of 64 characters.

• The error was thrown by a newly added email address parser that is stricter than what we used before. At first it was a bit surprising that this would lead to messages in a folder not being shown. We deliberately kept this new implementation out of the code responsible for parsing emails after download and the code for displaying messages.

• However, it turned out the new email address parser was used when getting the contact name belonging to an email address. This lookup is performed when loading the message list of a folder from the local database. When an error occurs during this step, an empty message list is shown to the user.

• Thunderbird 115.1 looks like a modest release that only includes a few changes. For example, it hides the Quick Filter bar by default and adjusts the heights of the Mail tab toolbar and Unified toolbar to be more consistent.

• Did you know you can install Thunderbird as a Flatpak app from Flathub? Well, the new release is here to improve support for the Flatpak version of the popular email client by allowing you to also run it from a terminal window using the thunderbird command.

• With the ever-increasing reliance on multiple devices for work and personal tasks, seamless data synchronization has become paramount. Thunderbird, known for its robust features and user-friendly interface, has acknowledged this growing demand and has taken a step towards addressing it.

• To revolutionize the user experience and enhance productivity, the development team behind Thunderbird, the popular open-source email and communication app, has made an exciting announcement.

Content Management Systems (CMS)

• People of WordPress features Ihtisham Zahoor, an administrator turned web developer from Pakistan.

FSF

• Please help us welcome our new associate members to the community and thank all the generous donors who contributed to the cause.

Programming/Development

• Version 2.38 of the GNU C Library has been released. This release consists mostly of relatively small changes, including improved support for working with binary integer constants, some new printf() formatting options, libmvec support for 64-bit Arm systems, the strlcpy() and strlcat() string functions, and more. See the release notes for the details.

Python

• A few weeks ago, my friend and neighbor Jérôme (aka lavamind) installed a weather station on his balcony and started collecting data from it.

• Microservices architecture has revolutionized the software development landscape, providing a more flexible and scalable approach than the traditional monolithic architecture. In the realm of microservices, Python’s Flask has established itself as a popular and capable choice. This article will walk you through the process of building microservices with Flask for DevOps, including practical examples.

• Flask, a micro web framework written in Python, is beloved by many developers for its simplicity, flexibility, and fine-grained control. However, when it comes to deploying your Flask application, you might encounter the need to adjust its default host and port settings to meet specific deployment environments or application requirements.

Leftovers

Hardware

• UBPorts has just released Ubuntu Touch 20.04 OTA-2 based on Ubuntu 20.04 with three new phones supported namely the Fairphone 3, the Volla Phone X23, and F(x)tec Pro1 X with the latter being introduced in 2020 in a crowdfunding campaign claiming Ubuntu Touch support. Ubuntu Touch was initially an initiative by Canonical for desktop/mobile convergence, but when the company decided to refocus its efforts on cloud and IoT, the UBPorts community took over and eventually outed the first stable Ubuntu Touch release in June 2017.

• China uses more Arm-based servers than any other country, according to Bernstein.

Proprietary/Artificial Intelligence (AI)

Linux Foundation

• Pixar, Adobe, Apple, Autodesk, and NVIDIA, together with the Joint Development Foundation (JDF), an affiliate of the Linux Foundation, today announced the Alliance for OpenUSD (AOUSD) to promote the standardization, development, evolution, and growth of Pixar’s Universal Scene Description technology.

• The alliance seeks to standardize the 3D ecosystem by advancing the capabilities of Open Universal Scene Description (OpenUSD). By promoting greater interoperability of 3D tools and data, the alliance will enable developers and content creators to describe, compose, and simulate large-scale 3D projects and build an ever-widening range of 3D-enabled products and services.

• Linux Foundation Training and Certification has teamed up with the Republic of Trinidad and Tobago’s Ministry of Digital Transformation to provide eLearning courses and IT certification opportunities as part of the Ministry’s Developers’ Hub Initiative, branded as D’Hub.

• [...]

• “I believe that education changes lives and, as a fellow TT national, I’m confident that this initiative, along with the Foundation’s support, will have a direct, positive impact on the citizens of T&T,” said Clyde Seepersad, SVP and General Manager, Linux Foundation Training & Certification. “It is an honor for me and the Foundation to be able to assist the Ministry, the country and its citizens through open source tech education with these scholarships.”

• At present, D’Hub enables, supports and hosts the collaborative efforts of local developers – individual developers, small development teams and micro-enterprises. Eventually, the services will be offered to secondary school students. At the moment, it is open to anyone aged 18 and older. Quarterly release plans are in place to continually expand the platform and increase accessibility for all nationals.

Security

• Security updates have been issued by Debian (tiff), Fedora (curl), Red Hat (bind, ghostscript, iperf3, java-1.8.0-ibm, nodejs, nodejs:18, openssh, postgresql:15, and samba), Scientific Linux (iperf3), Slackware (mozilla and seamonkey), SUSE (compat-openssl098, gnuplot, guava, openssl-1_0_0, pipewire, python-requests, qemu, samba, and xmltooling), and Ubuntu (librsvg, openjdk-8, openjdk-lts, openjdk-17, openssh, rabbitmq-server, and webkit2gtk).

• The Hidden Virtual Network Computing (hVNC) malware infests Macs and silently executes complete takeovers, with no user permission needed. It also sports persistence through reboots.

• Fall of August 1991: Linus Torvalds, a student at the University of Helsinki, creates an operating system as a hobby. The motive? Creating a free, open-source alternative to MINIX.

• US officials have discovered what they suspect is Chinese malware that has infiltrated US military systems with the intent to ‘disrupt’.

• It found the average total cost of a breach this year was about US$4.45 million, an increase from the previous year when the estimated cost was US$4.35 million.

• Looking at the increase from 2020, IBM said that the figure in that year was US$3.86 million, indicating a rise of about 15.3% over three years.

• The IBM figures were based on data supplied by the Ponemon Institute; a total of 553 organisations affected by breaches between March 2022 and March this year were studied.

• Callow added: “The US$16 billion figure is based only on breach reports that have stated the number of individuals impacted, and only 93 of the 550 known victims have filed such a report.

• “Additionally, there are undoubtedly more victims than the 550 which are known. We’ll likely not know how many more victims are out there for weeks or even months.”

• An unknown group of hackers is using a novel strain of malware to attack publicly accessible deployments of Redis ” a popular data storage tool used by major companies like Amazon, Hulu and Tinder.

• Sophisticated Rust-based malware infecting Redis data stores to self-replicate and inject payloads into servers. Researchers at Cado Security decompiled the activities to get identifiable indicators.

• Researchers at cloud forensics and incident response platform startup Cado Security Ltd. today detailed a recently discovered malware campaign aimed at Redis data store deployments. Redis is an open-source in-memory data structure store used as a database, cache and message broker that supports various data structures such as strings, hashes, lists and sets.

• CISA has shared analysis reports on three malware families obtained from an organization hacked via a recent Barracuda ESG vulnerability.

• Researchers have just published a paper showing how to automate the discovery of prompt injection attacks. They look something like this:

• That one works on the ChatGPT-3.5-Turbo model, and causes it to bypass its safety rules about not telling people how to build bombs.

• Look at the prompt. It’s the stuff at the end that causes the LLM to break out of its constraints. The paper shows how those can be automatically generated. And we have no idea how to patch those vulnerabilities in general. (The GPT people can patch against the specific one in the example, but there are infinitely more where that came from.)…

• BleepingComputer reports that VMware ESXi servers have been subjected to attacks involving a Linux version of the Abyss Locker ransomware, making the ransomware operation, which only emerged in March, to be the latest to target VMware ESXi with a Linux encryptor, following the Akira, Black Basta, LockBit, Royal, REvil, and Hive ransomware groups, among others.

• Discovery at Home provides senior home healthcare services to seniors in Florida and Texas. On July 31, they issued a website notice about a phishing incident they discovered on June 1. As they describe it, the scheme resulted in the transmittal of personal health information to an unauthorized third-party sender.

• Elements of personal information that may have been compromised included: name, address, date of birth, medical information, including dates of service, certain treatment-related information, health insurance information, insurance beneficiary number, claim number, and policy number.

• SolarWinds Corp. will pay $26 million to settle an investor suit alleging it failed to disclose security vulnerabilities before a massive cyberattack, under an agreement given final approval by a federal court.

• CloudSEK’s contextual AI digital risk platform XVigil has discovered a post on an English speaking cybercrime forum, sharing a database of PHI-IIIT Delhi for Forum credits. A total of 82 Databases were compromised and leaked data.

• A consistent pattern emerges in data breach and cyber-attack cases when companies turn to their insurers for coverage after such incidents. Whether they possess specialized cyber insurance or not, insurers often decline claims, citing various reasons such as failure to provide timely notice, failure to mitigate costs, employee misconduct or criminal activity leading to the breach, or attributing the losses to a party not covered by the policy. This holds true for both General Casualty or Liability policies (GCL) and specialized cyber liability insurance policies, covering damage to electronic assets.

• The Privacy Commissioner is “frustrated” to have learnt about a “serious” privacy breach through the media, relating to the email addresses of 147 firearms owners being spilled.

• In July, it was reported that the email addresses of licence holders were to sent to each other after a list of addresses was pasted in the carbon copy (cc) address field, rather than as in the blind carbon copy (bcc) field.

• An NHS trust has been reprimanded by the UK’s data protection regulator after it was discovered that staff had been sharing patient details on an unapproved app for two years.

• Some 26 staff at NHS Lanarkshire accessed the WhatsApp group between April 2020 and April 2022, entering sensitive patient data including names, phone numbers, addresses, images, videos, screenshots and clinical information, according to the Information Commissioner’s Office (ICO).

• The Township of Montclair’s insurer negotiated a settlement of $450,000 with the people behind a recent “cyber incident” in order to end the attack, a report says. […]

• “To guard against future incidents, the township has installed the most sophisticated dual authentication system available to its own system and it is currently up and running,” Hartnett said.

• Here’s yet one more case to note about standing and how cases may get dismissed before they even really get started. This case involved Syracuse ASC, LLC. In 2021, they experienced a cyberattack and notified 24,891 patients. A copy of their notification was posted to the Vermont Attorney General’s website at the time.

• In due course, a patient sued, seeking potential class-action status (Greco v. Syracuse ASC LLC).

• As Jeffrey Haber of Freiberger Haber LLP reminds us, in order to have Article III standing to sue, a plaintiff must allege the existence of an injury-in-fact that ensures that s/he has some concrete interest prosecuting the action.

• Thousands of health-care workers’ personal information has been compromised in a data breach that’s targeted servers at the Health Employers Association of BC.

• Hackers had access to the HEABC system from May 9 to June 10, and the breach wasn’t detected until July 13, according to the association.

Integrity/Availability/Authenticity

• Learn about the tactics scammers use to trick victims out of their money

Privacy/Surveillance

• The UK intelligence agencies are lobbying the government to weaken surveillance laws they argue place a “burdensome” limit on their ability…

Environment

Energy/Transportation

• Major banks are close to working out the details of how they want to account for carbon emissions linked to their capital markets business. The decision they are reaching is to simply exclude part of the business from the calculation.

Wildlife/Nature

• The largest dam removal project in the history of the U.S., which includes four dams from the Klamath River, has begun along the California-Oregon border and will be finished in 2024. Restoring its natural flow and habitat, however, will take decades.

Finance

• CVS Health is cutting approximately 5,000 jobs to save on costs amid its ongoing push into healthcare delivery.

• The layoffs, first reported by The Wall Street Journal, will primarily affect corporate positions, and those affected will receive severance pay and benefits including outplacement services, the company confirmed to Fierce Healthcare. It does not expect customer-oriented roles in stores, pharmacies and clinics to be affected in the layoff plan.

• “Our industry is evolving to adapt to new consumer health needs and expectations,” a company spokesperson told Fierce Healthcare in a statement. “As part of an enterprise initiative to reprioritize our investments around care delivery and technology, we must take difficult steps to reduce expenses. This unfortunately includes the need to eliminate a number of non-customer facing positions across the company.

• Pharmacy giant CVS Health will cut roughly 5,000 jobs nationwide, the company announced this week, making it the latest U.S. company to conduct layoffs as recession fears push employers to make cuts (see Forbes’ layoff tracker from the first quarter here).

• The 1,290 job cuts planned this year represent nearly 20% of the company’s Irish workforce.

• A church bought, and forgave, more than four million dollars in medical debt using small donations collected from the congregation. The staff writer Sheelah Kolhatkar explains how.

• Google’s virtual assistant reportedly will get a makeover by integrating artificial intelligence (AI) technologies into the platform similar to its Bard chatbot.

• The updates will change the way Assistant works. For now, the company will support both old and new approaches, according to Axios, based on an internal email sent to employees Monday.

• The idea is to fulfill a “huge opportunity to explore what a supercharged Assistant, powered by the latest [large language model] technology, would look like,” per the letter.

• The update, which has already begun, began with the mobile app.

• As part of the change, Google will reorganize the teams working on Assistant, which means a small number of layoffs and eliminating dozens of jobs out of the thousands who work on Assistant.

• The Swedish telecommunications company with a North American headquarters in Plano cited costs and a downturn in market demands for the job cuts.

• Sinn Féin TD Louise O’Reilly says the layoffs at tech company Accenture demonstrate “continuing volatility” in the technology sector.

• O’Reilly, who serves as the party spokesperson on Enterprise, Trade, Employment, and Workers’ Rights, says the news that Accenture is due to cut 890 jobs from its Irish workforce, having already cut 400 jobs earlier this year, is “another crushing blow for workers, their families and communities.”

• “This announcement comes despite Accenture stating that their Irish business continues to ‘show strong performance,” she noted.

• “This is yet another concerning blow for tech workers in Ireland, and a worrying sign of continuing volatility in the sector.”

AstroTurf/Lobbying/Politics

• X accused the Center for Countering Digital Hate in a lawsuit Monday of making “false” claims after the nonprofit found bigoted speech had surged since October’s Elon Musk-led takeover of the platform formerly known as Twitter.

• President Biden‘s team recently split with the Democratic Party’s longtime lawyer, Marc Elias, because of disagreements with Elias’ legal strategies and strained personal relationships, according to several people familiar with the dispute.

• Why it matters: The divorce has created a divide in the party’s legal apparatus going into the 2024 election — with Elias representing Democrats’ committees for House, Senate and state legislative races, while Biden’s campaign and the Democratic National Committee mostly get legal help elsewhere.

• Former President Trump’s new legal defense fund for aides and employees may double as both an act of benevolence and a potential insurance policy against a practice he has long loathed: flipping.

• Why it matters: New federal charges against Trump — who once said cooperating with prosecutors in exchange for leniency “ought to be illegal” — rely in large part on the testimony of a Mar-a-Lago employee who allegedly was asked to delete surveillance footage subpoenaed by investigators.

Censorship/Free Speech

• Lawyers for Elon Musk claim the group is deliberately attempting to make the social media giant look bad by using cherry-picked data.

• Simon Elmer This is Part II of this essay, you can read Part I here. The Misogyny of ‘Trans’ Let’s begin with a question few have the courage to pose and fewer still dare to answer honestly. Why is it always male transvestites who demand access to women’s toilets…

• Senegal suspended mobile internet access on Monday after the arrest of opposition leader Ousmane Sonko and a period of civil unrest. NetBlocks, an independent monitor of global internet freedom, mapped the restriction using data from Google. The data showed a sharp decrease in Senegalese internet traffic on Monday morning.

Internet Policy/Net Neutrality

• Eight of the top 10 fastest countries for broadband were based in Western Europe, while Ireland came 44th out of 220 countries.

Digital Restrictions (DRM)

• Earlier last month, four engineers from Google LLC posted a new open-source project on GitHub and called it “Web Environment Integrity.” The WEI project ignited all sorts of criticism about privacy implications and concerns that Google wasn’t specifically addressing its real purpose. Remember the problems with web cookies? WEI takes this to a new level.

Monopolies

Patents

• Nokia commenced litigation against Oppo in 2021, after the two companies could not adequately renew the terms of a licensing agreement which expired that same year. Both companies have since launched offensive and defensive attacks against each other in Germany and across Europe.

• Unified is pleased to announce PATROLL crowdsourcing contest winners, Ekta Aswal and Vibhor Dimri, who split a cash prize of $2,000 for their prior art submissions on U.S. Patent 7,035,461, owned by Monument Peak Ventures, an NPE and Dominion Harbor entity. The ‘461 relates generally to the field of digital image processing and, more particularly, to a method for detecting an object in a digital image.

• Recent Patent Progress posts have focused on the harmful and overlapping policy proposals contained in the USPTO’s Advance Notice of Proposed Rulemaking (ANPRM) and the PREVAIL Act. As it turns out, many others share our concerns.  Last week, Unified Patents released an analysis of the more than 14,500 public comments…

• The Federal Circuit recently sided with the accused infringers Teva and Apotex, affirming the invalidation claims from four Vanda patents covering methods of using tasimelteon to treat circadian rhythm disorders. However, the patent owner has petitioned the court for en banc rehearing, arguing the panel improperly disregarded evidence of nonobviousness.  Responsive briefing from the generics are due on August 1.

Copyrights

• As classical listeners shift to streaming, Apple’s bespoke app falls short of its smaller-scale competitors.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages. Permalink  Send this to a friend

----------

➮ Sharing is caring. Content is available under CC-BY-SA.