It has been a long time since I followed the development of the android operating system made for desktop PCs / laptops. One of my favorite Android-based operating systems to install on laptops is Prime OS. In my personal opinion, this operating system runs stably when installed on my old laptop with a 32 bit processor architecture.
When I visited the official site of Prime OS, I was surprised because the official site was no longer accessible. Even though I intend to see if there is a software update or not. Is this the end of the Prime OS journey and decided to discontinue?
I will try to accelerate the "Switched to Linux books" production to help more and more windows/mac users in theirs "Linux journeys".
Today, I’m following along from an earlier article “The Allure of The Terminal” where I talked about how I love the terminal aesthetic. How much, well, one of my computers is a command-line only install. I thought I’d talk a bit about that setup. Firstly, it’s not command-line only because it can’t run a graphical environment, although it isn’t a super modern system. It is certainly capable of running Ubuntu MATE, for example, I just choose not to.
The machine I want to talk about today is one of my (many) ThinkPads, in this case, an X61s. It’s got an Intel C2D L7500 CPU running at 1.6GHz, 6GiB RAM and a 240GB OCZ-Vertex 3 SSD. I installed Ubuntu Server 18.04 on it in October 2019, and kept it up to date since. I have upgraded it to Ubuntu 20.04 in the meantime.
Shortlist of best Linux laptops of 2021. If you are looking to buy a new laptop for Linux based working environment then this list might be helpful for you.
A brand new version of the Building Cloud Native and Multicloud Applications course is now available. For this second version, we completely restructured and rewrote the course from the ground up to include the most current cloud-native and multicloud knowledge, technologies, and tools. It incorporates real-world demos and hands-on labs using IBM Cloud€® and its rich set of services and offerings.
Within just five years, Kubernetes and containers have redefined how software is deployed. Researchers expect the container market to grow by 30% year over year to become a 5 billion industry by 2022. But what is the reason behind this mass adoption of container technology in the enterprise?
Some sysadmins change jobs often, while some of us stay too long in one place. Where do you fall on the job change continuum?
Jonni’s been arguing with me this issue – he thinks Linux Format readers don’t need virtual machine orchestration. Of course, as always, he’s right, but I’ve never let being wrong stop me before… Just because you don’t actually “need” something doesn’t mean you don’t want to learn about it or try it out!
[...]
Finally, Les Pounder brings us another breaking Raspberry Pi Pico review. We managed to sneak the review into the issue just as we were going to press. The Pi Foundation does it again cramming so many features into a $4 device. This microcontroller in many ways is better for smaller projects that the main Pi was still being used for. We’re sure we’ll be seeing much more of it in the future, so I hope you enjoy!
First up, in our Wanderings, I find a new box, Joe’s light as a feather, Moss explodes a DDE, and Bo hosts his own email
Then, in the News, a Linux Mint update, Ubuntu loses the lead, Wayland changes, and some new releases
In Security, time to patch… again.
Which distro is best for friends and family? We have a unique take on this common question.
Plus new insights into the future of CentOS, and Chris falls in love with a 14-inch screamer.
One of the biggest character flaws that I see in many people is the compulsion that some have to change others. And these types of people are around us. They have even started infiltrating the free and open source software movements.
Daniel Jordan looks at ktest on the Oracle Linux blog.
Exfatprogs 1.1 have been released as the open-source, user-space utilities around the Linux/Android exFAT file-system support maintained by Samsung.
The Linux/open-source exFAT file-system support continues to mature on Linux. The Samsung-backed kernel driver is quite stable and reliable at this point in the kernel while Exfatprogs continues to mature for the user-space tooling around dealing with this file-system that is common to today's SD/SDHC cards and other consumer electronic devices.
If you don’t know what is traces based rendering regression testing, read the appendix before continuing.
The Mesa community has witnessed an explosion of the Continuous Integration interest in the last two years.
In addition to checking the proper building of the project, integrating the testing of its functional correctness has become a priority. The user space graphics drivers exhibit a wide variety of types of tests and test suites. One kind of those tests are the traces based rendering regression testing.
The public effort to add this kind of tests into Mesa’s CI started with this mail from Alexandros Frantzis.
At some point, we had support for replaying OpenGL, Vulkan and D3D11 traces using apitrace, RenderDoc and GFXReconstruct with the in-tree tool tracie. However, it was a very custom solution made to the needs of Mesa so I proposed to move this codebase and integrate it into the piglit test suite. It was a natural step forward.
This is how replayer was born into piglit.
Your zink built from git master now has GL 4.3.
Going back to last summer there have been patches for getting OpenGL 4.6 with the Zink GL on Vulkan implementation but were considered experimental and not for immediate upstreaming. In the months since and especially after Mike Blumenkrantz was hired by Valve, the upstreaming effort kicked into higher gear. Now with Mesa 21.1, we are up to OpenGL 4.3.
When it comes to open-source cloud storage software for Linux, there is a huge number of available options. ownCloud, Seafile, and Pydio are just a few of them. However, if you pay a lot of attention to security issues and want to take full control of your data, you should opt for Nextcloud and install it on your server.
Nextcloud is an open-source secure PHP-based collaboration platform designed for file sharing synchronization. It’s a safe and flexible solution that allows users to share and synchronize their files with a Nextcloud server.
Although Nextcloud is great on its own, its functionality can be significantly increased with third-party apps. Some apps are installed by default, while others should be installed and enabled manually.
Written in C, PostgreSQL which is also known as Postgres is one of the most popular relational database management systems. macOS server has it as default database and is also available for other operating systems such as Windows, FreeBCD, OpenBCD and Linux. As PostgreSQL is one of the most used database management systems in the world, it is used as the backbone of many small to large applications and software’s.
Even though I feel working in command-line is best way to learn anything in the world of application and software development, there are some limitations while working with databases in command-line. It requires great experience of working in command-line or it could get really messy for newbies as well as for professionals.
Every so often (or really, too often), people with good intentions build a program that looks at some things or does some things, and they decide to have that program emit warnings or set status results if things are not quite perfect and as expected. This is a mistake, and it makes system administrators who have to deal with the program unhappy. An ordinary system configuration should not cause a program to raise warnings or error markers, even if it doesn't allow all of the things that a program is capable of doing (or that the program wants to do by default). In addition, every warning should be rate-limited in any situation that can plausibly emit them regularly.
Lenovo makes it possible to change the boot logo of my refurbished ThinkPad T460s. So let’s turn the big red rectangle into something BSD.
for years nano has been nothing but a mockery for those who use emacs or vim. a friendly and pragmatic editor? what a laughable prospect.
well this is where it ends. nano is a friendly and pragmatic editor, but it's no notepad. nano has depth. let's take a look.
Many people are unhappy with the current state of the Web: pervasive user tracking, a lot of distractions from the actual content, so complicated that it is very hard to develop from scratch a new browser. Why not going back to the future, with a protocol and format focused on lightweight distribution of content? This is Gemini, both a new ultra-simple protocol and a simple format. Not to develop an alternative to YouTube but useful to access content with a minimal client. Gemini is not "retro" but it "looks retro".
This page explains use cases and examples of SSH tunnels while visually presenting the traffic flows. For example, here's a reverse tunnel that allows only users from IP address 1.2.3.4 access to port 80 on the SSH client through an SSH server.
SSH tunnels are encrypted TCP connections between SSH clients and servers that allows traffic entering one side of the tunnel to transparently exit through the other. While the term originally referred to tunnels using TUN/TAP virtual network interfaces, it's commonly used to refer to SSH port forwarding nowadays. Use cases include: [...]
Access to the smart card reader on the Librem 5 is something we at Purism have been looking forward to for a long time. That day is finally here; those who have their Librem 5 can follow this guide to set up access to the smart card. Orders shipping soon will come with the card reader already setup.
VMware Workstation 16 Pro is an industry-standard software for running multiple different virtual machines (operating systems) on a single Linux or Windows PC.
This tutorial is the 2nd of the Inkscape for Students series. Below you will learn about graphics formats, the graphic format SVG, and how to open & save graphics, including how to insert ones in a document. Let's learn!
In this tutorial, we will show you how to install Supervisor on CentOS 8. For those of you who didn’t know, Supervisor is a client/server system that allows its users to monitor and control a number of processes on UNIX-like operating systems. It is used to control processes related to a project or a customer and is meant to start like any other program at boot time. Features of Supervisor include simple, centralized, efficient, extensible, compatible, and proven. The supervisor will manage your process to live all time.
This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you through the step by step install of the Supervisor monitoring on CentOS 8.
In my mail server tutorials, I recommend running mail server on ScalaHosting VPS, because their IP addresses are not on any blacklist. And I also recommend purchasing a domain name from NameCheap because the price is low and they give whois privacy protection free for life. It’s a good practice to buy web hosting and domain name from different vendors. This can minimize damages to your business if your account is compromised. You can transfer your domain name to NameCheap and learn how to create DNS records at NameCheap.
The DNS zone editor at ScalaHosting for self-managed VPS users is not very useful. If you accidentally bought a domain name from ScalaHosting, I recommend migrating your name server to Cloudflare, which features an easy-to-use DNS zone editor. Cloudflare can propagate your DNS records to the Internet in an instant, so you don’t have to wait several hours. Cloudflare also provides CDN (content delivery network) service and DDoS protection for free, so I highly recommend it.
In previous tutorials, we explained how to set up authoritative DNS servers and edit DNS records from the command line. However, some folks prefer to use a web GUI to edit DNS records. This tutorial is going to show you how to set up authoritative DNS servers with Webmin, which is a free open-source web-based control panel, so you can edit DNS records with a web interface.
When you are working on a shell script in bash, there are cases where you want to check if a particular file exists (or does not exist) in a directory, and then perform an action based on the condition. In bash, there are several ways to check whether or a file exists in bash. In the following I demonstrate bash shell script examples for this use case.
Vim text editor, short for Vi IMproved, is one of the most powerful and popular Linux text editors that enjoys immense patronage from the open-source community. It is an improvement of the vi editor and uses a combination of regular keyboard keys to provide vast functionality.
Vim provides colored syntax among other basic functionalities such as inserting and deleting text, copying and pasting text, and saving changes made to a file. The list of what you can do is quite long and the learning curve is steep.
In this guide, we endeavor to show you various ways that you can split the Vim editor into different workspaces in the Linux command-line.
In this guide, you will learn how to Dual boot Arch Linux with Windows 10 on UEFI system. This guide assumes that you already have Windows 10 installed on your system.
Debian is a rock solid GNU/Linux distribution with more than 30,000 packages available in its official repositories. Debian is suitable for servers, workstations, mobile devices and embedded systems.
Debian has a simple and clean installation system which allows installing Debian with little effort as long as the number of installations to be executed is minimal, but as this number grows the installation procedure becomes cumbersome and tedious (Please note that during the installation process it is necessary to answer configuration questions and package selection), for example if we want to install Debian in a lab that has 15 workstations, we need to repeat this process 15 times, which is possible , but if we want to deploy Debian in mass, for example 100, 200, 500 or 1000 installations, it is no longer feasible, this is the reason why the Debian developers have created a system that allows automatic or unattended installations starting from a configuration file (preseed).
The days when you used a horse and buggy to travel to town along a dusty, wheel-rutted path are gone. Today’s roadways are complex, offering you many routes to the office, with High Occupancy Vehicle (HOV) lanes to help make your commute quicker. The evolution of networking is a bit like the explosive growth of our roadway systems. In the "olden" days of networking, connectivity was achieved using Transmission Control Protocol (TCP), a single path protocol much like that old bridleway that had grass poking up in the center. While today’s networks have multipath, super-highway, requirements—with mobile devices using multiple radio interfaces and datacenters and cloud deployments using redundant paths—these networks still primarily use single-path TCP as a transmission mechanism.
But Multipath TCP (MPTCP) is zooming up the right lane and merging onto the scene. MPTCP is the highway of the future, offering you a way to supercharge your wireless, internet, and datacenter networks. However, the same features that make MPTCP so powerful also create some security challenges.
If you need to generate a list of names and addresses to test an application or a script that you're working on, Linux can make that surprisingly easy. There's a command called "rig" that will create name, address and phone number listings. As far as I can tell, out of the box, it only works with U.S. addresses and area codes. However, if this is indeed the case, you might be able to work around this problem.
The co-creator of Terraria has called off development of the game for Google Stadia following a three-week stretch where he has been inexplicably locked out of all of his Google accounts.
Andrew Spinks gave the ultimatum early Monday, after getting no response from Google since YouTube locked him out of his account in mid-January. The lockout has also cost Spinks access to apps he’s purchased on Google Stadia, wiped data he stored in Google drive, and terminated a Gmail account he’s used for more than 15 years.
Spinks concludes that his problems stem from Google trying to “burn a bridge,” and if that’s the way it’s going to be, he says, he’s cancelling the Stadia release of Terraria, as he “will not be involved with a corporation that values their customers and partners so little. Doing business with you is a liability.”
The cancellation of a Stadia port for Terraria comes at a challenging time for Google Stadia: last week, the company announced it was closing its in-house development studio and said it would rely instead solely on third-party developers. The cloud gaming service is also losing one of its biggest exclusives, Crayta, as its timed exclusivity deal is slated to end soon.
The developers of Terraria, Re-Logic, have shared more details about what their severed ties with Google mean. Including how the boycott will include future versions of Terraria and future games from the studio. But existing versions of Terraria on Android and Google Play will not be impacted by the co-creator's decisions today.
In a statement to IGN, Re-Logic says “Punishing existing customers who paid for our game on these platforms is not what we are about. To be clear: there should be no impact whatsoever to Terraria on Google platforms, both existing/purchased games as well as ongoing store availability.”
The studio also provided a more in-depth timeline on how its issues with Google came about.
"After using every resource I have to get this resolved, you have done nothing but given me the runaround." He cites his frustration as being linked to thousands of dollars in-app purchases, movie purchases, and Google Drive data now being beyond his reach. Additionally, "I can't access my YouTube channel. The worst of all is losing access to my Gmail address of over 15 years."
If you’re one of the few whose PC contains an Intel Pentium 4 or an AMD Athlon 64, bad news: You’re about to lose access to Google’s Chrome browser.
In other news, I have completely re-written the back-end for installation reporting in system-installer. It’s now based off rsync, and uses other technologies in order to keep the transfer of data to our server secure. I won’t go into the details of how it works here, beyond there being a randomly generated key that must be used in order to upload to the server, along with other forms of server-side validation. I haven’t managed to get this new system working both securely and reliably yet (currently it’s one or the other), but I am doing testing in order to improve this situation.
In the future, I plan to add support for things such as creating RAID arrays in system-installer using btrfs. This will be the next feature added once installation reporting, and the auto partitioner have both been fixed.
Speaking of the auto partitioner, it has been rewritten to Python! This rewrite allowed me to fix some bugs, while also making it more intelligent.
Drauger OS is an ambitious project that focuses on providing a good gaming experience on the Linux platform without compromising the security.
Even though I haven’t tried it yet, it is definitely something that would appeal to Linux gaming enthusiasts.
In a recent blog post, they addressed that the development for the upcoming release Drauger OS 7.6 is underway while also revealing some exciting details for their plans to launch a Game console and develop a Game Console Desktop Environment (GCDE) tailored for that.
The work-in-progress FUTEX2 system call for improving Windows games on Linux via Wine / Steam Play remains one of the items left to be addressed in 2021 with the work on that being funded by Valve and tackled by Collabora engineers.
André Almeida of Collabora presented at last month's Linux.Conf.Au 2021 virtual summit on the FUTEX2 system call designed to succeed the current FUTEX implementation for better resource utilization and other functionality that will yield a more performant Windows-on-Linux gaming experience as well as being relevant to other workloads too.
After our review of the Serval WS from System76, here’s a brief look at the Polaris laptop from Tuxedo Computers, based in Germany (unboxing and benchmarks included!)...
The FLA is a mechanism for assigning copyright – generally copyright over a piece of software – to a fiduciary. Someone you trust. The fiduciary is expected to Do The Right Thing with the copyright that is assigned to it. Unlike a Copyright License Agreement (or Assignment) which some software projects use, the FLA is carefully constructed to keep everything Free Software and to circumscribe what the fiducary may do. In addition, the FLA ensures that you, the original copyright holder, can continue to do all the Free Software things that you could originally do with your software.
So what’s the point?
Well, unlike a CLA, the FLA was written with preserving-your-Software-Freedom in mind (the FSFE spearheaded this approach) so that you can continue to use your code and release it under whatever license you like, while the fiduciary can also do that, but in a restricted (preserving Freedom) fashion. This allows centralizing – to the fiduciary – some decisions about the software that may be needed in the longer term.
Linspire 10 is out this week as the newest version of this Linux distribution formerly known as Lindows nearly two decades ago. While Linspire went dark for several years, under its current ownership by PC/OpenSystems they have been trying to reinvigorate the desktop distribution the past few years. Linspire 10 represents the latest work for the Ubuntu-based platform.
Linspire 10 Beta released late last year with claims of Linspire being the number one distribution for new, intermediate and power users. Now with the formal Linspire 10 release they write that their developers "have worked diligently to develop the best, most meticulously designed and engineered FOSS desktop on the market today, intuitive, efficient, ready for your workflow."
KeePassXC is an application for people with extremely high demands on secure personal data management. KeePassXC saves many different information e.g. user names, passwords, urls, attachemts and comments in one single database.
Min browser is a smarter, faster web browser
Darktable is a photography workflow application: a virtual lighttable and darkroom for photographers: it manages your digital negatives in a database and lets you view them through a zoomable lighttable. it also enables you to develop raw images and enhance them.
Firefox browser has been updated to 85.0.2 and now available in the software repository. This is a minor bug fix update.
Audacious is a media player based on the BMP music playing application.
How do I patch or upgrade my SUSE instances in the public cloud? How do I keep all my instances at the same patch level in the public cloud? What options are available in the public cloud? Part 1 of this post will try to address some of these questions. Additional options available will be discussed in Part 2.
First, let’s discuss what is available for PAYG instances but not BYOS instances. Included with PAYG instances is access to a highly available and low latency managed software update infrastructure, which allows for high data transfer rates to patch your instance. This comes enabled and ready at instance launch, so you can be assured that the latest packages can be updated or installed. The only part you have to play in this is to ensure the proper security rules, firewalls, or proxies allow the proper communication from your instance to the public cloud update infrastructure. There’s a blog post that can get you up to speed [1].
It’s time for more development news from the YaST Team. In this occasion, most of the work has gone into improving features already implemented in previous sprints and, thus, presented in former blog posts.
Going back about two years there has been work on properly supporting Wine on POWER 64-bit (PPC64). Now past the Wine 6.0 stable release, it looks like that work that work is finally beginning to land. In conjunction with Hangover to handle the cross-architecture aspect, the hope is to eventually allow Windows x86 programs to work on libre POWER systems or at the very least with native Winelib support to help in porting open-source Windows software to IBM POWER / OpenPOWER.
This week, the Fedora Packager Dashboard left the testing period and is available for wide use. Why should you care about it? And what is it about?
Fedora Packager Dashboard is a web application designed to make the lives of Fedora Packagers easier. It aggregates and shows all the relevant data for package maintainers on one page, structured, searchable and filterable. You’ll see things like current bug reports, updates, issues regarding all your packages at one place, without needing to spend time reading your emails and/or monitoring dozens of different services one by one. Caring about your packages will be easier and less time-consuming with Fedora Packager Dashboard.
Last week we held our traditional annual CentOS Dojo at FOSDEM. We had 216 people registered, of whom 164 (75.9%) actually showed up to attend some part of it. A big thank you to those that turned up and made it a successful event.
In case you missed it, or some part of it, all of the content is now on YouTube.
The CentOS Hyperscale effort is sounding quite promising for those riding CentOS Stream and wanting fresher packages in some instances and alternative defaults as a blend of CentOS Stream, Fedora / EPEL, and its own forthcoming package repositories.
The CentOS Hyperscale special interest group was formed by engineers from the likes of Facebook and Twitter with an interesting set of objectives. The Hyperscale SIG was approved last month and in the past few weeks progress is being made on getting it established. In some cases it's taking what has already been carried out internally at large enterprises like Facebook and making it suitable for upstream CentOS / widespread public consumption.
In case you want to run our latest release (still cooking, of course) in your Raspberries — I have enabled builds for both Debian 10 (Stable, Buster) and Debian 11 (Testing, Bullseye). Go grab it!
Nasty story or technical necessary? In the Raspberry Pi community, there is a shit storm, after an update of the Raspbian operating system secretly installed a Microsoft repo. This repo triggers a ping on a Microsoft server with every update.
With this repository present in your system, every time you perform an update a ping to a Microsoft server is automatically performed. The Redmond house, therefore, will know that you are using the Raspberry Pi operating system, that maybe you have one and your IP address. Profiling that will become more and more accurate by browsing GitHub, Bing, and so on.
One concern from users is that Microsoft might gather information on the device in use, such as an IP address, then link this to other information to create a targeted advertising profile. For those users who actively attempt to operate below the radar, this could serve as a method of identification.
But for many users, there are bigger issues in play.
First, many users expressed disappointment that an open-source project would update its source repositories without informing the users. Second, that the update adds the Microsoft repository to existing installations is also causing anger.
Most of the Vecow systems we have seen are beefy Intel Core based computers such as the 11th Gen Tiger Lake based SPC-7000. Yet, the Taipei based manufacturer recently branched out to launch its first AMD Ryzen Embedded system with its V1000 based MIG-1000 edge AI computer and has now launched its first Arm-based system. The VIG-120 IoT gateway runs Debian Stretch R01-4.9.11 on NXP’s power-sipping i.MX6 UltraLite (UL).
Geniatech says the boards support Android 11.0 and Linux (Buildroot/Debian/Yocto), but since they only work with other businesses, there’s typically no public documentation/software for their development board, nor the pricing is made public.
The definition of online privacy has been expanded to include many more elements beyond the basic definition. With today’s advanced Internet technology, having “privacy” is no longer simple. In fact, it is about being able to have much more control over the information that others can access about you and your activities. Many people are concerned about the security of their phones. While it may seem like common sense, many individuals do not realize how easy it can be for a person to take advantage of technology when they have the ability to secure their online privacy by using Linux secure phones.
Early Android 12 screenshots leaked yesterday on XDA have revealed what looks like a major design refresh and new privacy features, though they are unofficial and we cannot guarantee their authenticity.
Major Android releases typically come annually, in August or September, the last being Android 11 in September 2020. Rollout to actual devices comes later (or not at all) since it depends on vendor support. Many vendors also like to customise Android with their own skins and custom applications. Inconsistency and delays in releases are the disadvantages of Android when you compare it to Apple's iOS.
The leaked screenshots – featuring Jenifer Aniston's character "Rachel" and Courtney Cox's "Monica" from '90s sitcom Friends – suggest a user interface design refresh may be on the way with more rounded corners, less transparency, and simplified privacy settings.
Google Open Source is delighted to announce Season of Docs 2021!
The 2019 Season of Docs brought together open source organizations and technical writers to create 44 successful documentation projects. In 2020, we had 64 successful standard-length technical writing projects and are still awaiting long-running project results.
In 2021, the Season of Docs program will continue to support better documentation in open source and provide opportunities for skilled technical writers to gain open source experience. In addition, building on what we’ve learned from the successful 2019 and 2020 projects, we’re expanding our focus to include learning about effective metrics for evaluating open source documentation.
Google Open Source has announced the 2021 edition of Season of Docs.
In January there were 106 alerts generated, resulting in 15 regression bugs being filed on average 4.3 days after the regressing change landed.
Welcome to the January 2021 edition of the performance sheriffing newsletter. Here you’ll find the usual summary of our sheriffing efficiency metrics, followed by some analysis of the bug products and components that were identified as the cause of regressions in 2020. If you’re interested (and if you have access) you can view the full dashboard.
Fenix’s architecture is unique. Many of the browser features are not implemented in Fenix itself – they come from independent and reusable libraries such as GeckoView and Mozilla Android Components (known as Mozac). Fenix as a browser application combines these libraries as building parts for the internals, and the fenix project itself is primarily a User Interface. Mozac is noteworthy because it connects web contents rendered in GeckoView into the native Android world.
There are common pitfalls that lead to security bugs in the connection between web content and native apps. In this post, we’ll take a look at one of the pitfalls: private browsing mode bypasses. While looking for this class of bug, I discovered three separate but similar issues (Bugs 1657251, 1658231, and 1663261.)
[...]
As you can see, Mozac’s URL fetch is one of the places that creates inconsistencies with web content. Other than private browsing mode, there are various other security protection mechanisms in the web world, such as port blocks, HSTS, CSP, Mixed-Content Block, etc. These protections are sometimes overlooked when issuing HTTP requests from another component. By focusing on these common pitfalls, you’ll likely be able to find new security bugs continuously into the future.
Firefox 86 will be released on February 23, 2021. We’d like to call out two highlights and several bug fixes for the WebExtensions API that will ship with this release.
Mozilla has been fuzzing Firefox and its underlying components for a while. It has proven to be one of the most efficient ways to identify quality and security issues. In general, we apply fuzzing on different levels: there is fuzzing the browser as a whole, but a significant amount of time is also spent on fuzzing isolated code (e.g. with libFuzzer) or whole components such as the JS engine using separate shells. In this blog post, we will talk specifically about browser fuzzing only, and go into detail on the pipeline we’ve developed. This single pipeline is the result of years of work that the fuzzing team has put into aggregating our browser fuzzing efforts to provide consistently actionable issues to developers and to ease integration of internal and external fuzzing tools as they become available.
Data ingestion is a process that involves decompressing, validating, and transforming millions of documents every hour. The schemas of data coming into our systems are ever-evolving, sometimes causing partial outages of data availability when the conditions are ripe. Once the outage has been resolved, we run a backfill to fill in the gaps for all the missing data. In this post, I’ll discuss the error discovery and recovery processes through a recent bug.
Jaybird 4.0.2 and 3.0.10 have been released.
Firebird Project announces the first Release Candidate of Firebird 4.0, the next major version of the Firebird relational database, which is now available for testing on Windows and Linux platforms.
This Release Candidate demonstrates the complete set of features and improvements developed for the new release. Release Candidates are generally considered stable enough and may be recommended for testing in "almost-production" environments. Our users are appreciated giving it a try and providing feedback to the development mailing list. Apparent bugs can be reported directly to the bugtracker.
This 330-page book explores the basics of Impress, before moving on to master slides, styles, templates, graphic objects, effects, exporting in various formats, and much more.
Thank you very much for the hard work in the past years. Wish you all a good, happy and healthy Chinese New Year!
Armadillo is a powerful and expressive C++ template library for linear algebra aiming towards a good balance between speed and ease of use with a syntax deliberately close to a Matlab. RcppArmadillo integrates this library with the R environment and language–and is widely used by (currently) 823 other packages on CRAN.
This release brings us Armadillo 10.2 with a few updates as detailed below in the list of changes. Upstream release 10.2 was made a couple of days ago, but we need to balance new upstream updates with a responsible release cadence at CRAN. As we needed a maintenance release in early January, I opted to wait four weeks with this one which hence gets us 10.2.0 and 10.2.1 at once. As tweeted (with a follow-up) it had yet another very smooth passage at CRAN so we again appreciate the excellent work of the CRAN maintainers and say Thank You!.
The widely lauded signatures feature is currently still experimental to facilitate experimentation with several more important features that are needed for it to be considered feature-complete. However, at this point the basic design is well tested and stabilized, and has been unchanged for the requisite two stable releases. I propose that in Perl 7, the signatures feature be declared stable as-is, added to the :7.0 feature bundle, and these further additions to be developed as a separate initiative. The new additions could trigger distinct experimental warnings until stabilized, or be added under one or more new experimental features as appropriate. (Stabilization of the signatures feature has now been proposed by Paul Evans.)
I've written a new blog post on Perl 7 (prev: Perl 7: A Risk-Benefit Analysis and Perl 7 By Default). You can find it, and likely my future posts, on dev.to#perl, for similar reasons as mentioned here.
Which means: that the module (Cwd in this case) is not compatible (Because it’s an XS module) with your current version of perl, installed on your system: Likely it was compiled for a previous version, leadin to those binaries mismatching
Structured and tidy data is great to work with, because on the command line you can reliably convert one structure into another.
[...]
The file was created by an (imaginary) ecologist who visited 8 forest plots (p1 - p8) and on each plot recorded tree species. The recording was done with a simple note-taking app on the ecologist's phone. For each plot there's a plot-code line followed by a line with comma-separated, 4-letter species codes. Notice that in "p5" the code "phas" is unnecessarily repeated.
Back in her office, the ecologist puts "plots" on her laptop before doing an analysis of the tree data based on presence/absence. Her analytical software, though, wants a tab-separated species-vs-plots table where a "1" in the table will indicate presence and "0" an absence.
In this short tutorial, we will outline 4 methods that help remove duplicate elements from an array in Javascript.
Deno is a secure runtime for JavaScript and TypeScript.
Quarkus is a Java stack tailored for OpenJDK HotSpot (or OpenJ9 on zSeries) and GraalVM, crafted from optimized Java libraries and standards. It is a good choice for building highly-scalable applications while using lower amounts of CPU and memory resources than other Java frameworks. These applications can be traditional web applications, serverless applications, or even functions as a service.
There are many documented instances of organizations migrating their applications to Quarkus. In this article, let’s see one such migration path from Spring Boot to Quarkus that is part magic and part madness! The magic will be some hand waving and performing the migration without changing a single line of code. The madness will be trying to figure out how it was done.
[...]
It was mentioned at the beginning of this post that we wanted to perform the migration without changing a single line of code. Every Spring Boot application needs to have an “application” class that contains a main method and is annotated with @SpringBootApplication. In our project, src/main/java/io/quarkus/todospringquarkus/TodoApplication.java is that class.
Quarkus does not require such a class, nor do any of the Quarkus Spring compatibility extensions provide resolution for the @SpringBootApplication annotation nor the SpringApplication class referenced in this class.
So, what gives? We didn’t make any code changes whatsoever, yet those classes seem to resolve just fine in Quarkus.
You’ll notice a peculiar comment in both pom.xml (for Maven)/build-quarkus.gradle (for Gradle), right above the dependency declaration for the dependency org.springframework.boot:spring-boot-autoconfigure:
This dependency is a hack for TodoApplication.java, which isn't required for Quarkus. Point of demo is to NOT have any code changes. This is the key to this part of the trick. This dependency allows both Spring Boot and Quarkus to resolve these classes at build time. The dependency is declared optional in Maven/compileOnly in Gradle, meaning it will never be included in the application binary the Quarkus build produces. It will be included in the binary the Spring Boot build produces because all of the other spring-boot-starter-* dependencies also depend on it, so it’s included transitively.
In early 2009, the historian and social critic Mike Davis sat down for an interview with Bill Moyers to discuss what was then the worst economic collapse since the Great Depression. When asked whether, as a socialist, he had anticipated the crisis, Davis said he couldn’t have predicted its scale or devastation.
Davis’s modesty won out over the truth. Four years earlier, he had, in fact, done just that. Writing in the Los Angeles Times, he laid out the fundamental problems of the housing bubble then underway. Noting its particular precarity in Southern California, he also went on to discuss how it might affect the country and the world: The “national economy may be equally vulnerable to property deflation, with a mild jolt sufficient to end the current American boom, and perhaps throw all the dollar-pegged economies into recession.” Davis wasn’t the only one who saw that crash coming, of course. But in the Moyers interview, he downplayed his clairvoyance with a joke: “People of the left like myself are famous,” he said, for “predicting 11 of the last three depressions.”
Students began protesting on Jan. 4. Local news reported that police carried out home raids in response, detaining students in the early hours of Jan. 5. A few hours later, academics on campus silently protested the appointment at Bulu’s handover ceremony by turning their backs on him. Protests continued through Jan. On Feb. 1, police detained 159 students, all of whom were released by Feb. 4. Peaceful protests followed quickly.. In another midnight move that day, Erdogan announced the opening of two new faculties at the university. Protesters believed this was an attempt to further cement his efforts to appoint pro-AKP faculty members.
I decided back in October that I was going to either fix the cultural problem directly in front of me in middle management or I was going to walk. I figured it'd go like this: either I succeed epically and we start a new future where people feel confident to speak the truth about what's going on in technical matters... OR I fail epically and walk. Either way, it wouldn't be my problem. Granted, in the second case, it would still be everyone else's problem, but I'd get my damn life back at least.
But then, things went stupid, like, really stupid. I cancelled all of the 1:1s with my manager since I did not want to deal with him any more. I went up the org chart. "Things would change", I was told. Time passed. I spent it working on dumb things like saving the company stupid amounts of money by finding where they were pissing it away with terrible infra implementations. I waited to hear back on this proposal I was promised: how things would be different.
Then one day, I was shown the proposal for what would change. It was a list of things for me to do... and nothing from anyone else.
I handed over my badge on the spot, and walked (as I said I would if nothing was going to change). That was November 13, 2019, a little after noon. I had been there just under 10 months.
In the past, Facebook had said it would only “downrank,” or push lower down in people’s news feeds, misleading or false claims about vaccines, making it more difficult to find such groups or posts. Now posts, pages and groups containing such falsehoods will be removed from the platform entirely.
Working with the World Health Organization, Facebook has updated its policies on what someone can say about COVID-19 on its platforms. The change includes “content calling to action, advocating, or promoting that others not get the COVID-19 vaccine.” It also includes any denial of the virus’ severity or statements that it doesn’t exist.
The discussion continued until Tony Arcieri dropped one of the most brutal takedowns of a cryptographic design in CFRG history.
"I think the biggest problem though is all of this has already been pointed out to you repeatedly in other forums and you completely refuse to acknowledge that your cipher fails to meet the absolute most minimum criteria for a secure cipher."
-- Tony Arcieri, landing a cryptographic 360 no-scope on Crystalline.
In spite of this mic drop moment, the author of Crystalline continued to double down and insist that a symmetric cipher doesn’t need to be indistinguishable from randomness to be secure (which, to severely understate the affairs, is simply not true).
It's the kind of breach that has been warned about for years but is rarely seen. Experts say the hack, which was addressed quickly, is a prime example of why the cybersecurity of the U.S. water supply remains one of the greatest risks to the country's infrastructure.
And like the U.S. election system, it tends to be a sprawling and varied challenge.
Linux Foundation on Monday announced that it will launch an open source industry collaboration focused on enabling a converged cellular core network stack, starting with the Magma open source software platform.
Previously open sourced by Facebook in 2019, Magma will now be managed under a neutral governance framework at the Linux Foundation. Arm, Deutsche Telekom, Facebook, FreedomFi, Qualcomm, the Institute of Wireless Internet of Things at Northeastern University, the OpenAirInterface Software Alliance, and the Open Infrastructure Foundation, will join the collaboration as founding members to accelerate the path to production use cases at scale.
The DumpsSchool is delivering comprehensive Linux Foundation CKA Exam Dumps to thousands of candidates for years. It has marked a unique image in providing its clients the Linux Foundation CKA exam questions answers & preparation material by strictly following the Linux Foundation standards. The DumpsSchool has served several Certified Kubernetes Administrator aspirants to become successful Administrator, engineers, instructors, and content developers. The DumpsSchool Linux Foundation CKA dumps PDF file is composed by the highly qualified and top IT professionals to pass the Kubernetes Administrator successfully in the first attempt.
If you’ve ever met Ian Jarman, you’d know that the IBM Power Systems business unit executive for IBM Lab Services is not a man who gets easily excited. So when the longtime IBM Rochester executive said he was “alarmed” by the decided lack of basic security precautions in IBM i shops during the recent webinar to discuss the HelpSystems IBM i Marketplace Report, you might get the sense that something is quite wrong.
Once again, security was at the top of the list of top concerns of IBM i shops in HelpSystems’ annual survey and report, which is now in its seventh year. Seventy-five percent of the nearly 500 folks who participated in this year’s survey and report listed security as a top concern. That was down 2 percent from 2020, but it was up from 2019 (69%) and 2018 (72%).
“The goal of OSV is to provide precise data on where a vulnerability was introduced and where it got fixed, thereby helping consumers of open source software accurately identify if they are impacted and then make security fixes as quickly as possible,” the announcement states.
When you use the term zero-trust in your organization, it means you do not want to trust anything but want to verify everything. The said concept is relatively newin the corporate world as it was introduced by John Kindervag, a Forrester Research-based analyst, in 2010.
As per this principle, organizations or companies, whether large or small, should take all the necessary steps to safeguard all of their resources, including apps, corporate networks, official devices, etc. Besides, they should assume every network connection as suspicious by default.
Continue reading this post to discover what a zero-trust model is all about and why it is considered as a useful cybersecurity policy by organizations in 2021.
The vulnerability (CVE-2021-26708) was discovered by Alexander Popov as multiple race conditions in Linux kernel’s AF_VSOCK implementation, which could allow a local attacker to crash the system by causing a denial of service or run programs as an administrator (root).
This security issue affects all Ubuntu 20.10 and Ubuntu 20.04 LTS systems running the Linux 5.8 kernel on all supported architectures, including 64-bit, Raspberry Pi (V8) systems, OEM systems, cloud environments (KVM), as well as Amazon Web Services (AWS), Google Cloud Platform (GCP), Oracle Cloud, and Microsoft Azure Cloud systems.
I’m particularly interested in knowing bugs, grammar issues, unanswered and other questions that might be raised by the report. Highlighting stuff that is excessively verbose or might benefit from more clarity, is also welcome. This has been written in a 3-day haze of caffeine and I need fresh eyeballs.
The parliamentary experts conclude that automated and indiscriminate scanning of all communications content was disproportionate and violates fundamental rights. Using “artificial intelligence” to search for the solicitation of contact with minors (grooming) or child pornography is only permissible if the screening is limited to suspects (page 47 of the report). The same applies to the search for unknown child pornography with the help of “machine learning”, as practised by the organisation “Safer”, founded by US actor Ashton Kutcher, according to a supplementary statement by the author of the study. Limiting the content screening to suspects has so far been rejected by the EU Commission, the European Parliament and the EU Council in the ongoing trilogue negotiations, so that the planned ePrivacy derogation would likely be annulled in court.
Huge Ma, a 31-year-old software engineer for Airbnb, was stunned when he tried to make a coronavirus vaccine appointment for his mother in early January and saw that there were dozens of websites to check, each with its own sign-up protocol. The city and state appointment systems were completely distinct.
“There has to be a better way,” he said he remembered thinking.
So, he developed one. In less than two weeks, he launched TurboVax, a free website that compiles availability from the three main city and state New York vaccine systems and sends the information in real time to Twitter. It cost Mr. Ma less than $50 to build, yet it offers an easier way to spot appointments than the city and state’s official systems do.
Prosecutors charged them with lese majeste, the first time in three years anyone has been charged with the offense. The crime had been shelved at the behest of King Maha Vajiralongkorn. However, police began invoking the offense following recent widespread criticism of the monarchy and the government.
Lese majeste makes it a crime to insult or defame the monarchy. Offenders could be imprisoned for up to 15 years. Some have also been charged with sedition and violating the Act on Ancient Monuments, among other crimes.
Twitter Inc. has permanently suspended more than 500 accounts and blocked access to hundreds of others within India, the company said on Wednesday, acceding to the government’s order to restrain the spread of misinformation and inflammatory content related to the farmers’ protest.
The social media giant had earlier been in a standoff with the India government, disagreeing with some blocking orders from regulators and citing “open and free exchange of information,” but backed down after receiving a non-compliance notice. Flouting the government’s orders attracts stringent penalties including potential jail terms.
The United States incarcerates more of its residents than any other nation with 5% of the world’s population and nearly 20% of the world’s prison population. This build-up of America as a prison nation happened over decades as politicians passed legislation that imprisoned more and more people for increasing numbers of years, cut funding for social safety nets, and increased funding for police and prisons. For many years, this build-up failed to garner widespread public attention, let alone outrage. Organizers, including currently and formerly incarcerated people and their family members, often found their concerns and efforts pushed to the political sidelines. That started to change over the past decade as the country’s prison population climbed to 2.3 million and mass incarceration became a more frequent topic of political debates, news headlines and even pop culture.
The maker of the software, Cybergenetics, has insisted in lower court proceedings that the program's source code is a trade secret. The co-founder of the company, Mark Perlin, is said to have argued against source code analysis by claiming that the program, consisting of 170,000 lines of MATLAB code, is so dense it would take eight and a half years to review at a rate of ten lines an hour.
The company offered the defense access under tightly controlled conditions outlined in a non-disclosure agreement, which included accepting a $1m liability fine in the event code details leaked. But the defense team objected to the conditions, which they argued would hinder their evaluation and would deter any expert witness from participating.
At an evidence hearing in 2019, Pickett’s attorneys filed a motion to see the program's source code and related documentation but were eventually denied by the judge. At the hearing, Cybergenetics cofounder Dr. Mark Perlin testified the source code is considered a trade secret and that it could take a person hours to decipher just a few dozen of the roughly 170,000 lines contained in the program.
In Wednesday's ruling, the appeals court called access to the source code imperative.
“Without scrutinizing its software's source code — a human-made set of instructions that may contain bugs, glitches and defects — in the context of an adversarial system, no finding that it properly implements the underlying science could be realistically made,” they wrote.
The brief discusses the troubling histories of both forensic science and software tools, arguing that issues with TrueAllele’s reliability may arise from multiple sources – from mistaken design assumptions to implementation errors. The brief also discusses how TrueAllele’s source code has never been independently reviewed and how independent review by third-party experts have uncovered outcome-determinative errors in the source code or use of at least two of TrueAllele’s competitors. Finally, the brief emphasizes that admitting evidence generated by a technology that has not undergone independent and adversarial testing violates defendants’ due process rights and may also warp the criminal legal system by incentivizing secrecy and giving undue influence to private, corporate actors.
Law enforcement uses TrueAllele to test mixtures of DNA usually found at crime scenes. Conventional crime labs often refuse to calculate the probability that a suspect contributed DNA in weak and contaminated crime scene samples, rejecting test results below a certain threshold of reliability. TrueAllele uses all test results, regardless of how weak they are. This means there are large differences between the conclusions reached by TrueAllele compared to conventional DNA testing.
The real pressing question, though, is what Bezos is going to do with all that money. Forbes pegs his net worth around $193.2 billion as of the close of trading on February 8th, though it’s possible it’s gone up since this writing. That’s more money than most people’s brains can process! For instance, last year, Bezos’ ex-wife, Mackenzie Scott, gave away $4 billion in four months — and her net worth is only a paltry $60 billion by comparison.
This Instrument repeals and revokes domestic legislation concerning the Unified Patent Court (UPC) and the European Patent with Unitary Effect (Unitary Patent or UP). This legislation would have implemented the UPC and UP system but is no longer necessary following the withdrawal of the United Kingdom (UK) and Isle of Man (IoM) from the Agreement on a Unified Patent Court on 20 July 2020. The implementing legislation was due to take effect upon commencement of the UPC and UP system in the UK. However, this will now not occur. This instrument provides clarity by removing pending legislation relating to a system that the UK and IoM will not participate in. The UK and IoM patent system will continue to operate unchanged after the instrument passes.
The European Patent Office (EPO) and the European Union Intellectual Property Office (EUIPO) have released a new study today which shows that companies which own at least one patent, registered design or trade mark generate on average 20% higher revenues per employee than companies which do not own any of those intellectual property rights (IPRs).
Patent owners have no right€ to keep their patents rights secret. The whole point of the patent system is to encourage people to disclose information about their inventions to the public by giving certain exclusive rights to those who do. But that doesn’t stop private companies from trying to keep€ information about their€ patents secret—even when their disputes to go court, where the public has a right to know what happens.
A recent decision by a federal court in a long-running transparency push by EFF affirmed the public’s right to access important information about a patent dispute. For more than two years, we have been working to vindicate the public’s right of access to important sealed court documents in Uniloc v. Apple. The sealed documents supported Apple’s argument that the case should be dismissed because Uniloc lost ownership of the patents when it sued Apple, and thus lost the right to bring the suit. But as filed, the documents were so heavily redacted that it was impossible to understand them. So EFF intervened to oppose the sealing requests on the public’s behalf—and we won. When Uniloc asked for reconsideration, the court refused—and we won again. When Uniloc appealed, the Federal Circuit overwhelmingly upheld the district court’s decision—and for the third time, we won.
EFF hoped that the string of victories would mark the end of our intervention and that the parties would promptly file properly-redacted documents as required at last. But they did not do so.
On February 5, 2021, Unified Patents filed an ex parte reexamination proceeding against U.S. Patent 6,275,166, owned by Karamelion LLC, an NPE and affiliate of IP Edge. This patent relates to relaying communications to appliances from a central computer and has been asserted in over 40 district court litigations.
On January 27, 2021, the Board terminated IPR2020-00948, Unified Patents, LLC v. Arsus, LLC, in response to Arsus disclaiming all challenged claims. Arsus's counsel filed a Motion to Vacate Judgment arguing that the Board was deprived of subject matter jurisdiction after Arsus's disclaimer. The Board issued an order denying Arsus's motion to vacate and affirming termination of the proceeding.
On February 9, 2021, the Patent Trial and Appeal Board (PTAB) instituted trial on all challenged claims in an IPR filed by Unified against U.S. Patent 8,645,562, owned by Ideahub, Inc., and licensed to and asserted by Helios Streaming, LLC, an NPE. The '562 patent is directed to an adaptive streaming service using metadata and is being asserted Showtime, Vudu, Crackle, and Starz. Helios is asserting the ‘562 patent against streaming media content in accordance with the MPEG-DASH standard and video-on-demand (VOD) systems.
Google Play offers separate terms for traditional publishers than individual authors. I own my own publishing company, but I don’t produce books quickly enough to get access to the publisher terms. Fine.
Since its inception, Google Play has let individual authors put a suggested retail price on their books. Until recently, they reserved the right to cut the price for their customers. If they cut the price, they would pay the author their cut based on the suggested retail price. Google used this to boost their platform. They could take, say, SSH Mastery, and make it free for the next thousand downloads. I would make my $6 or so on each download. I get paid, so what could I possibly object to?
I object to it destroying my business, that’s what.
"I recall being 13 or 16 years old," she said, "and signing our first contract, recording contract. Well, I didn't know what the heck was on that contract. That's why I went back to college, because I realized that there was so much that we, The Supremes, had given away because we didn't know how to read those contracts. I mean, we could read. We graduated from high school and all that. But the understanding was not there."
