Linux for Beginners: Should You Make the Switch?

When it comes to operating systems, most people tend to go for the most popular options. If you’re buying a Mac computer, you probably won’t use Windows. PC owners typically choose it without giving this decision a second thought. Still, there is a low-key third option used to power many machines but is rarely used by your average PC owner.

We’re talking about Linux OS, of course. In its many variations, Linux is used as a software basis for many servers, IoT appliances, and many other devices but rarely do we see regular users opt for it. Why is that? Well, let’s take a closer look at this subject and see if this is a good OS choice for you.

Why it’s a good thing that the Linux desktop is boring again

Hopefully the title has piqued your interest, as that was the intent. With the upcoming release of GNOME 40, I’ve found myself in a rather contemplative and nostalgic mood lately. I remember, back in the early 2000s, I’d read about a new desktop in development called GNOME. Curiosity got the best of me and installed the beta version of the environment.

If I’m being honest, I wasn’t impressed. My formative years with the Linux desktop were spent using the likes of AfterStep and Enlightenment E16. If you know either of those desktops (or Window Managers) you get it. Both of them were exceptionally configurable and could be made to look absolutely gorgeous. At one point, I had AfterStep tricked out to the point where everything was varying degrees of transparency and the window decorations were as much sculpture as they were code. When people saw my desktop, they were astonished. It was a work of art.

Desktop/Laptop

• Italian judge punishes Lenovo for not reimbursing Windows license

  In 2014, the italian Court of Cassation sanctioned the right of italian consumers to the refund of Microsoft Windows licenses, that are indiscriminately charged even to consumers who purchase computers with Windows pre-installed, but will immediately uninstall, and thus never use it.

  Three years ago, Luca Bonissi, an italian advocate of “Free as in Freedom” software, who had already gone through similar experiences bought a Lenovo Ideapad tablet, and decided to get that refund, exactly because he would not run Windows on it anyway.

Server

• Changing Of The Guard For HPC And Big Iron At HPE

  Hewlett Packard Enterprise has been building a mainstream and grassroots server business aimed at large enterprises, HPC centers, and academic and government institutions for two decades. HPE took a run at the hyperscalers and cloud builders and large service providers with its Cloudline minimalist machinery, but has largely backed away from that business because margins are thin to non-existent.

  The systems business that is left represents the core of HPE after it has largely divested its software and services business, which it spent tens of billions of dollars to acquire to try to create a clone of IBM, and split off its PC and printer business into an entirely different company.

  While the original Hewlett Packard has a long history in proprietary and Unix systems, it was the acquisition of Compaq way back in September 2001 for $25 billion that gave what is now HPE a volume server business aimed at small, medium, and large enterprises as well as the emerging webscale companies. The rivalry with Dell (and to a lesser extent with Lenovo, Inspur, and Sugon) and the rise of the original design manufacturers who work directly with the hyperscalers and large public cloud builders (Foxconn, Quanta, Inventec, WiWynn, and such) have put the hurt on this ProLiant server business. But that ProLiant business is still formidable, and has many millions of loyal customers.

• SUSE: 7 Digital Transformation Questions IT Should Ask Their Business Managers

  During the journey of digital transformation, organizations have to master several things at the same time: adopting new innovations, increasing efficiency, and maintaining continuity. IT not only plays a crucial role in these improvements but in many cases also leads transformation projects that improve the business.

Audiocasts/Shows

• Font Preview Ueberzug: A Better Font Previewer

  A while back I looked at a font preview script but it was kind of annoying to use, but it turns out there’s a much better version of that script called font preview ueberzug which is what we’re checking out today.

• Ubuntu Voltage

  For a few years we’ve been performing a live version of an Ubuntu Podcast at FOSS Talk Live. This is a lively, nerdy, in-person Linux Podcast event at the Harrison Pub in London. A few shows are performed in front of a live slightly drunk studio pub audience. We are but one troup of performers though, over the course of the evening.

  The whole thing is organised by Joe Ressington and attended by our friends and/or/xor listeners. Joe has just announced over on episode 114 of Late Night Linux that we’re all doing it again! Go and listen to that show for a small amount of detail.

• FLOSS Weekly 619: Notetaking With Dendron – Kevin Lin and Dendron [Ed: FLOSS Weekly jumping the shark by pushing Microsoft proprietary software instead of actual FLOSS]

  Kevin Lin and Dendron.

  Kevin Lin joins Jonathan Bennett and Katherine Druckman to talk about Dendron, a note-taking application built on top of VSCode. After many years of taking notes, Kevin found himself with a massive, unmanageable personal knowledge store. None of the existing note-taking applications quite solved his problem, so Kevin did the only reasonable thing, and wrote his own. On this episode of FLOSS Weekly, Lin covers some of his design decisions, including building Dendron on VSCode and Javascript, and helps us understand how Dendron can help tame the jungle of personal knowledge.

Kernel Space

• Intel Sends Out KVM SGX Virtualization Patches For Linux – Phoronix

  Intel SGX support finally landed in Linux 5.11 after going through 40+ rounds of review that took years for bringing up Software Guard Extensions in the mainline kernel. But that trek isn’t yet over as Intel is now working on KVM SGX virtualization support to be upstreamed.

  Intel earlier sent out a “request for comments” on KVM SGX virtualization support while on Monday they sent out the first formal (non-RFC) patch series with this support for handling Software Guard Extensions in the context of KVM virtualization. Basically this allows for a portion of the system memory to be encrypted with an SGX enclave exclusively for a KVM guest virtual machine that can’t be accessed outside of the secure enclave. Separate from SGX enclaves, Intel also has coming out with future CPUs the Total Memory Encryption (TME) feature. AMD meanwhile has been working on Secure Encrypted Virtualization (SEV) with Secure Memory Encryption (SME) as their EPYC approach for securing guest VM memory from other VMs or the host.

• Linux 5.12 Lands Fix For File-System Corruption Caused By Swapfile Issue – Phoronix

  For those wanting to help in testing out the Linux 5.12 kernel, at least it should no longer eat your data now if you rely on a swapfile.

  The file-system corruption issue on Linux 5.12 Git noted last week and then followed up on yesterday when the corruption hit Intel’s graphics CI systems and narrowed down to a set of swap-related changes, has now been resolved with today’s latest Git code.

  [...]

  With that fix now in, we can get back to looking at Linux 5.12 performance changes and other more interesting testing than worrying about data loss.

• High severity Linux network security holes found, fixed | ZDNet

  Young and rising Linux security developer Alexander Popov of Russia’s Positive Technologies discovered and fixed a set of five security holes in the Linux kernel’s virtual socket implementation. An attacker could use these vulnerabilities (CVE-2021-26708) to gain root access and knock out servers in a Denial of Service (DoS) attack.

Benchmarks

• Blender 2.92 Linux & Windows Performance: Best CPUs & Graphics Cards

  Blender’s latest version, 2.92, has just released, and as usual, we’re going to dig into its performance and see which CPUs and GPUs reign supreme. For something a bit different this go-around, we’re adding Linux results to our rendering and viewport tests, and not surprisingly, the results are interesting!

  [...]

  When a new major version of Blender releases, we typically retest all of our hardware in Windows, and only Windows. After hearing your requests loud and clear, this article will also take care of Linux performance. Given the amount of time that it takes to test both OSes, we can’t promise that we’ll do this with every major release, but this certainly won’t be the last time.

  This article is going to tackle rendering to the CPU, the GPU, as well as mixed rendering with CPU and GPU combined. Our initial GPU render testing showed that Windows and Linux perform virtually the same, so we opted to show only Windows for the GPU results. There are, however, notable differences in performance with regards to CPU rendering when it comes to Windows vs. Linux, so CPUs were tested on both OSes.

  Our viewport tests will be found on the next page, where we will use two projects to see how our collection of graphics cards scale from one viewport mode to the next, again in both OSes.

Instructionals/Technical

• How to install Kali Linux 2021.1

  In this video, I am going to show how to install Kali Linux 2021.1.

• Arch Linux: Full Installation Guide – A complete tutorial/walkthrough in one video!

  “I run Arch!” You hear everyone else saying it, now you can say it too! In this video, we’ll go through the process of setting up Arch Linux from scratch. It’ll start at the command-line, and we’ll build the installation all the way up to a full desktop environment!

• How To Set Up Redis as a Cache for MySQL with PHP on Ubuntu 20.04

  Redis is an open-source and in-memory data structure store that can be used for caching, real-time analytics, searching, and machine learning. Integrate Redis with PHP and MySQL will improve your application performance because Redis stores data in RAM.

  You can use it with databases like MySQL or MariaDB. Redis provides a mechanism to cache your queries. For example, when a user requests your application page the first time, a MySQL query is performed on the server, and Redis caches this query to RAM. When another user requests the same page, you don’t need to query the database again.

• 7 Ways to Customize Cinnamon Desktop in Linux

  Linux Mint is one the best Linux distributions for beginners. Especially Windows users that want to switch to Linux, will find its flagship Cinnamon desktop environment very familiar.

  Cinnamon gives a traditional desktop experience and many users like it as it is. It doesn’t mean you have to content with what it provides. Cinnamon provides several ways for customizing the desktop.

• How to install Toontown Rewritten on a Chromebook

  Today we are looking at how to install Toontown Rewritten on a Chromebook. Please follow the video/audio guide as a tutorial where we explain the process step by step and use the commands below.

• How to install the Brave Beta Browser on Linux Mint 20.1 – YouTube

  In this video, we are looking at how to install the Brave Beta Browser on Linux Mint 20.1.

• Openstack RDO && KVM Hypervisor: Install intellij-idea on Fedora 33 via COPR Repository

  Procedure below works quite smoothly and eliminates any issues during similar manual setup which is available as well via `sudo dnf install openjfs`. First enable COPR Repository and perform install

  $ sudo dnf copr enable lkiesow/intellij-idea-community$ sudo dnf install intellij-idea-community

  During the very first run you will be given an option to install the most recent Oracle’s JDK ( second snapshot )

• How to Install a Specific Kernel Version in CentOS

  The Linux Kernel is the underlying core of all GNU/Linux distributions. The kernel, GNU standard programs, and additional programs and GUI on top of them make up a GNU/Linux operating system. CentOS is one such popular GNU/Linux operating system that comes under the RedHat family of Linux distributions.

  As the Linux kernel grows in size, more and more resources are spent in its development; mainly to incorporate support for newer hardware, amongst other things. However, there can be scenarios when an upgraded Kernel version is giving certain errors on a piece of hardware. There can be cases also when you want to test an older version of the kernel for compatibility purposes.

• Tips for using tmux | Enable Sysadmin

  Prior to Red Hat Enterprise Linux 8, the screen command was included. In version 8, the decision was made to deprecate screen and use tmux instead. tmux is a terminal multiplexer which means that you’re able to have a process running, disconnect from the system, and then reconnect at a later time and from a different computer so that you can continue working in that process. An easy way to demonstrate this is to SSH to a remote system, start tmux, and then from inside of that, start a ping command to a remote system, disconnect from tmux, resume tmux, and you’ll see that the ping is still going.

• Tips for using screen | Enable Sysadmin

  What happens when you’re connected to a remote system, using a long-running program, and then the connection drops? The odds are, at a minimum, you’re going to have to restart the program, and in a worst-case scenario, you’ll have data corruption. To help get around this, some programs run in a window shell on the system.

• How to Install the YouTube Add-on in Kodi – LinuxBabe

  In a previous tutorial, we explained how you can install LibreELEC on a Raspberry Pi to set up a home media server and replace your smart TV OS. This tutorial is going to show you how to install the YouTube add-on and set up YouTube API in Kodi.

• How to enable LUKS disk encryption with keyfile on Linux – nixCraft

  We can easily add a key file to LUKS disk encryption on Linux when running the cryptsetup command. A key file is used as the passphrase to unlock an encrypted volume. The passphrase allows Linux users to open encrypted disks utilizing a keyboard or over an ssh-based session.

• How to use Bootable USB drive in VMware Player to install OS

  If you want to boot your Virtual Machine running on VMware Workstation Player using a bootable USB drive for the installation of Windows 10/8/7 or Linux (Ubuntu, Linux Mint, CentOS, etc.) operating system. Then here are the simple steps to follow…

  Whether it is Vmware Workstation Player or VirtualBox when it comes to installing an operating system for VM, most of the time we use ISO files. However, imagine you already have a bootable USB drive of some OS but not the ISO file for the same and you want to install it for a Virtual machine created in VMware. What will you do? The answer is straightforward; we will use the option of VMware to boot from Physical Disk, and here i.e. a USB disk drive attached to PC.

• How to Dual Boot Ubuntu Linux and Windows 10 with BitLocker Encryption

  Laptops and desktops with Windows 10 Pro version come with BitLocker encryption enabled by default.

Games

• Drova – Forsaken Kin is an upcoming pixel-art RPG with ‘high player agency’

  Ready to try another demo of a promising upcoming game? The developer of Drova – Forsaken Kin emailed in about their pixel-art RPG and it sounds pretty promising.

  They mention that it’s a pixel art RPG that “focuses on investigative exploration and combat with high player agency”, with you choosing a side in a changing world “devoured by Ether, the essence of creation itself getting out of control when an ancient threat returns”. So what they’re saying is the world is dynamic, it changes and you have an effect on things – something like that.

  [...]

  The developer, Just2D, mentioned how they’ve put “a lot of effort into Linux compatibility” so hopefully that works out well for them.

• Top 6 New Games You Can Play With Proton Since Feb. 2021

  Valheim is a bit of a different beast in that list. It has a Linux client in the first place, but there’s apparently enough people who had trouble with it not working properly that they ended up falling back on Proton (and it looks like it works perfectly under Proton). So, do not take this as a recommendation to play the game on Proton, but simply as an alternative in case you have issues.

• Tower Defense with deck-building ‘Core Defense’ set to get an expansion

  Core Defense, a positively rated tower defense game by users (and one we enjoyed) from developer ehmprah that sprinkles in a little deck-building is getting an expansion with a Beta you can try.

  Quite different to most tower defense games, as the placement of almost everything is down to you. You’re building up a maze for enemy units to travel through, and then each round you pick from a set of cards that can give you new towers, abilities and more. It was a success too, earning the developer over $20K in the first week on Steam, clearly hit a mark.

• Another Proton Experimental update is out improving VR and controllers

  Proton Experimental is the extra special testing area where new fixes and features enter the Steam Play Proton compatibility layer before going out to everyone and there’s a new update out. If you’re not clear on what Proton and Steam Play are, be sure to check out our constantly updated dedicated page. It’s a special compatibility layer for running Windows games and apps from Steam on Linux.

• Steam Link Linux release reminds us how simple game streaming can be

  Valve released a Linux version of its Steam Link app, allowing the connectivity system to work on even MORE devices than before. This is just the latest in a line of operating systems made available to work with Steam Link, including Windows, Android, iOS, and Raspberry Pi. And it’s all free, provided you have a Steam account and own a game or two.

• Koi Farm is a simple relaxing chill-out experience about raising fish

  Koi Farm released recently and it’s quite a little gem. It’s a small game though, all about raising Koi with an “infinite number” of patterns you can create by cross-breeding all the different colours and you end up with lots of different mutations as you go along. You can pick them up, drop them between a big display pool and a smaller breeding pool and eventually let them go to swim on with their lives. On top of that, you can also turn them into special cards to stick in your book and progress through it.

• Survival game Vintage Story gets an official mod database, improved Wayland support

  Out for your next survival game that isn’t Valheim? Do give Vintage Story a go, which on the surface looks like Minecraft but it’s so much more interesting and far deeper mechanically.

  While this is mainly a stability update for the previous release, which was pretty huge, some fun bits have been put in. One of the big additions is an official Mod Database, for players to upload and download from. Eventually, they said, it will integrate with the game client to “blur the line on what is vanilla content and what is modded content” (if you want to use it, that is).

  The rest of the update is mostly small tweaks and fixes but their support of Linux continues shining. For Linux players, you should hopefully see improved support for running the game on Wayland. They upgraded the version of OpenTK used along with some extra Wayland fixes that should improve mouse support there. See the full changelog here.

  [...]

  A community member is also hosting a server for Linux fans…

• The tenth Norse world sure is busy as Valheim hits 5 million sold | GamingOnLinux

  Fully expected of course, Valheim continues pulling in masses of new users with the announcement that it’s now sold 5 million copies over the first month. What is it? For those living under a rock: a brutal exploration and survival game for 1-10 players, set in a procedurally-generated purgatory inspired by Viking culture.

  Across this time more than 15 thousand years have been spent playing Valheim based on a combined player time count, over 35 million hours of Valheim was watched on Twitch, it continues rising up as one of the best reviewed games on Steam (#39) and this is all still from a five-person team. The actual player-count seems to have now settled though from the 502,387 peak 10 days ago to it seeing a more regular player count of around 350,000.

• Valve makes further improvements to Steam Link and Remote Play Together

  Along with finally releasing the Linux client of the Steam Link app, Valve has also been making steady improvements to Steam Link and Remote Play Together.

  [...]

  For Invite Anyone, you need to send a link from your friends list in the Steam Overlay to others which they use to join through the Steam Link app. Valve has already done a quick improvement on that to allow you to make as many invites as you want, providing the game supports multiple players and your network bandwidth can handle it.

  Valve also mentioned in an email that the Steam Link app itself has also recently been upgraded, to allow streaming at 90FPS and 120FPS across all platforms. You can find the setting in the advanced menu.

Distributions

• Reviews

  • Review: The New weLees Visual LVM, a new style of LVM management, has been released

    Maintenance of the storage system is a daily job for system administrators. Linux provides users with a wealth of storage capabilities, and powerful built-in maintenance tools. However, these tools are hardly friendly to system administrators while generally considerable effort is required for mastery.

    As a Linux built-in storage model, LVM provides users with plenty flexible management modes to fit various needs. For users who can fully utilize its functions, LVM could meet almost all needs. But the premise is thorough understanding of the LVM model, dozens of commands as well as accompanying parameters.

• BSD

  • OpenSSH 8.5 released

    OpenSSH 8.5 has been released. It includes fixes for a couple of potential security problems (one of which only applies to Solaris hosts); it also enables UpdateHostKeys by default, allowing hosts with insecure keys to upgrade them without creating scary warnings for users. There are a lot of other small changes; see the announcement for details.

  • NomadBSD 1.4 is now available!

    We are pleased to present the release of NomadBSD 1.4.

  • NomadBSD 1.4 Released With GUI For Easier Chrome / Brave / Vivaldi Browser Installation

    NomadBSD 1.4 is out today as the latest feature update to this operating system that is one of the BSD-based desktop initiatives.

    NomadBSD 1.4 re-bases its operating system against upstream FreeBSD 12.2-p4. Meanwhile on the NomadBSD side it fixes some UEFI boot problems, better automatic graphics driver detection, improved touchpad support if wanting to run this BSD on laptops, wifimgr has replaced NetworkManager, and removal of i386 support for accelerated Intel and AMD graphics since the drm-legacy-kmod driver is now obsolete.

• SUSE/OpenSUSE

  • openSUSE Leap 15.3 Reaches Beta Build Phase

    openSUSE Leap has entered into the beta release phase today for its 15.3 minor version.

    This openSUSE Leap 15.3 version is a solidified release that focuses more on the building of the distribution rather than refreshing the distribution’s packages, but there are some significant changes to the distribution.

    Many of the packages will remain the same as those in openSUSE Leap 15.2 with a bit of hardware enablement and security backports. An updated version of glibc brings some Power10 support and the Xfce desktop users will have the new 4.16 version. The distribution also gains adds s390x architecture.

    The biggest change for this release is how Leap is built and its relationship with SUSE Linux Enterprise. Leap transitioned to a new way of building openSUSE Leap releases in the fall of 2020 through a prototype project called Jump. The Jump prototype was used as a proof of concept, but no longer exists; it did prove to work at building a distribution and bringing the code streams of both openSUSE Leap and SLE closer together. The proof of concept was implemented for building the release of openSUSE Leap 15.3 as seen in the beta release today. Building Leap on top of binary packages from SLE, which was part of the rationale for the Jump prototype, allows for easy development on a community release to be put into production on an enterprise release should the need arise.

  • openSUSE Leap 15.3 Enters Beta Phase As an Exciting CentOS Alternative With Xfce 4.16, Power10 Support, and More

    openSUSE is unquestionably an interesting distribution. We also have a separate article listing some compelling reasons to use openSUSE.

    While it’s been almost a year since openSUSE 15.2 Leap released with a focus on containers, it is almost time for the next minor release.

    Now, openSUSE announced the 15.3 minor version reaching the beta phase, meaning – it is up for testing. Even though it is technically a minor release, there are some significant changes worth noting along with some updates and improvements.

    Let me briefly highlight those for you.

  • openSUSE Leap 15.3 Beta Begins – Phoronix

    OpenSUSE Leap 15.3 Alpha started rolling out in December while today the beta builds have begun for this next openSUSE Leap installment.

    The openSUSE Leap 15.3 release is exciting in that it’s based on their “jump” concept for greater alignment between openSUSE Leap and SUSE Linux Enterprise 15 SP3. The official openSUSE Leap 15.3 release is expected in July aligned with SLES 15 SP3 for which they are built from largely the same sources.

  • Closing the Leap Gap

    Today the openSUSE project announced the start of the public beta phase for openSUSE Leap 15.3. This release is an important milestone for openSUSE and SUSE, our users and customers: Leap 15.3 is the first release where openSUSE Leap and SUSE Linux Enterprise share the same source code and use the exact same binary packages. Let’s have a look at the following picture to examine what this means in detail.

    [...]

    We won’t go into details on how this works under the hood in this post. If that’s what you’re looking for, see our blog series on How SUSE Builds its Enterprise Linux Distribution. Today, we will focus on what this change means for you as an end user. In a nutshell, while portability (i.e. the ability to run software built for openSUSE Leap on SLE or vice versa) between SLE and Leap was previously very likely, it is now almost guaranteed. You can migrate from openSUSE Leap to SUSE Linux Enterprise without having to reinstall anything, and this is a big deal. Let’s take a look at a couple of examples.

  • SUSE Linux Enterprise 15 Service Pack 3 Public Beta is out!

    Starting with SP3, we are now offering packages pre-built binaries from SLE in addition to the sources we were previously providing to openSUSE. This means that openSUSE Leap and SUSE Linux Enterprise are closer together than before, thus easing the migration from openSUSE Leap to SLES.
    This article will tell you more about how openSUSE and SLE were made in the past years but also the important changes with openSUSE Leap 15.3 and SUSE Linux Enterprise 15 Service Pack 3.

• IBM/Red Hat/Fedora

  • Why it’s time to stop setting SELinux to Permissive or Disabled

    Given the kerfuffle that has been CentOS lately, and the number of inevitable forks that will rise out of the ashes, there will probably be a large percentage of admins migrating to, or finally deploying, a Linux distribution based on Red Hat Enterprise Linux in some form or fashion. It may be Rocky Linux or AlmaLinux. It may be that you stick with CentOS Stream, or even purchase a license for Red Hat Enterprise Linux. If you’re a non-profit or another eligible organization, you might qualify for RHEL for Open Source Infrastructure.

    No matter which route you take, you’ll be using a solid Linux distribution with serious security systems in place.

    However… It’s such a powerful word, “however.” It stops all natural flow of the narrative to make you wonder just what comes next.

    You wait, and you wait, and you wait.

    Until the inevitable: SELinux.

  • 13 challenges creating an open, scalable, and secure serverless platform

    Serverless is the natural evolution of cloud computing. In essence, serverless comes down to two main features: (1) you “pay by the drink” for all computing resources and (2) you get more fine-grained scaling than you would from larger workloads. However, taking full advantage of this extended computing model requires developers to restructure apps and services into components that can scale down to zero when not needed.

    Microservices architectures are a step in the correct direction. And Kubernetes (K8s) as a platform for running microservices is a promising and popular concrete implementation of a core infrastructure for managing containers, which are used to run microservices. However, Kubernetes by itself is not sufficient to meet the needs of serverless workloads, and the layers on top of the base platform do not need to be reinvented by all. Enter Knative in 2019 as a common serverless layer on top of K8s.

  • Why developers should centralize their security

    Current security challenges are forcing developers to implement increasing amounts of security measures to provide safe environments for customers on online sites. Adding security measures such as MFA, 2FA, and even reCAPTCHA to increase security can have a negative impact on customer loyalty. How do you ensure fraud is not committed while also making it easy for the customer to use the site or buy a product?

  • Red Hat Adds Common Criteria Certification for Red Hat Enterprise Linux 8

  • rpminspect-1.3.1 released

    rpminspect 1.3.1 is now available. I was actually preparing to release rpminspect 1.3, which I did, but a bug was found by Fedora QA in the 1.3 release after I already made it. So I just did a 1.3.1 followup to fix that issue. You will 1.3.1 in the Fedora and EPEL repos, but 1.3 is posted as a release on the GitHub project page.

    In addition to the usual collection of bug fixes and enhancements, this release also expands the GitHub Actions CI coverage. It builds and runs the test suite on the latest Fedora stable release, Debian testing, Ubuntu, OpenSUSE Leap, CentOS 8, CentOS 7, and Gentoo. Gentoo is the newest one. I have had to disable OpenSUSE Tumbleweed and Arch Linux. I also disabled Fedora rawhide for the moment because I could not get anything to pass there. I plan to check these out again and enable the ones that work. If there are other platforms you would like to see in the CI workflow, let me know.

  • Red Hat Introduces Latest Update to Red Hat Process Automation

    The goal of Red Hat Process Automation has always been to empower enterprise business and IT users to collaborate, successfully document, simulate, manage, automate, and monitor business processes and decisions. We are excited to announce the latest release of Red Hat Process Automation, which delivers new developer tooling, extended support for eventing and streaming for event-driven architectures (EDA) through integration with Apache Kafka, and new monitoring capabilities through heatmap dashboards.

    Red Hat Process Automation is an open source business automation platform that combines business process management (BPM), case management, business rules management, and resource planning. It enables IT organizations to better create, manage, validate, and deploy business processes, cases, and business rules. Red Hat Process Automation also uses a centralized repository where all resources are stored. This allows for consistency, transparency, and the ability to audit across the business. The latest release of the platform introduces and expands on a number of key capabilities.

  • SAP HANA 2.0 Certified on RHEL 8.2 and 7.9: Top 5 reasons why you should care

    The shift to using SAP S/4HANA drives standardization towards SAP’s in-memory database (SAP HANA) on Linux. With SAP HANA, both transactional and analytical data workloads are served from the same in-memory database, eliminating the need for separate data systems. However, to deliver the horsepower needed to serve these demanding data workloads, picking the right operating system that can best utilize the underlying hardware resources is essential.

    When deploying mission-critical enterprise workloads on SAP HANA, Red Hat Enterprise Linux (RHEL) is the de-facto standard for many customers. We are excited to announce that SAP HANA 2.0 is certified on RHEL 8.2 and 7.9. Customers may find further details at SAP Note 2235581.

  • IBM’s Arranged OpenShift-Power Marriage Eyes Hybrid Cloud Crown | Data Center Knowledge

    New Power-based hardware appliance for IBM cloud on-prem ships with Red Hat’s container orchestration platform. Power Systems, IaaS expand OpenShift support.

  • Red Hat’s survey results on the state of enterprise open-source software | ZDNet

    After all, as Red Hat president and CEO Paul Cormier, pointed out, “Open source has solidified itself as an innovation engine for the software industry. The technology trends that you see changing how we work and do business were born in open source — enterprise Linux, cloud computing, edge and Internet of Things (IoT), containers, artificial intelligence, and machine learning, and DevOps.” It’s all open source, all the time.

    It’s not just what we think of as IT. Thanks to the power of open source, which combines collaboration, transparency, and the belief that the best idea can come from anywhere, we’ve been able to come up with COVID-19 vaccines in mere months instead of years.

    But where exactly is open-source software being used? Infrastructure modernization, which is a fancy way of saying replacing the last proprietary operating systems in servers and data centers, remains at 64%, open-source software’s top use.

• Debian Family

  • Toolbox your Debian

    Last week I needed a Debian system to test things, I had heard others were using toolbox with Debian images without much trouble so decided to give it a go instead of creating a VM.

    Toolbox only requires a handful utilities to work with any given docker image. After a quick search I stumbled upon Philippe’s post which in turn linked into this PR about an Ubuntu based toolbox image. Looks like the last major issues where worked out recently in toolbox and there isn’t anything extra needed apart the image.

• Canonical/Ubuntu Family

  • Canonical to Pre-Certify ADLINK Devices with Ubuntu Linux Operating System

  • Canonical to Pre-Certify ADLINK Devices with Ubuntu Linux Operating System

  • Canonical to Pre-Certify ADLINK Devices with Ubuntu Linux Operating System

  • Canonical to Pre-Certify ADLINK Devices with Ubuntu Linux Operating System

    ADLINK Technology announced at Embedded World that it has entered into an agreement with Canonical to pre-certify ADLINK devices with the Ubuntu Linux operating system (OS) to create a complete hardware and software device offering with fully supported security and operational updates for the device lifecycle.

    [...]

    Ubuntu Linux is the leading Linux distribution for large embedded systems and is the most popular open source operating system for autonomous robotics and self-driving vehicles. Developed by Canonical, it provides security updates and support for each Ubuntu release.

  • Embedded World: Adlink pre-certifies hardware to run Ubuntu Linux

    Canonical and Adlink are both members of the Robot Operating System 2 (ROS 2) technical steering committee. “Adlink and Canonical are aligned on ROS development and other machine intelligence research,” said Canonical v-p of IoT Tom Canning. “Whether they’re using industrial gateways or pursuing initiatives in the robotics and AI space, Adlink and Canonical customers will benefit from pre-certified stacks to accelerate their development.”

  • Linux Mint emits fix for memory-gobbling Cinnamon – and future version may insist on some updates

    The Linux Mint team has introduced a fix for a memory leak it does not fully understand: restarting the Cinnamon desktop.

    Cinnamon is a desktop environment which began as a fork of GNOME 3 and is developed primarily for Linux Mint, though there are also non-Cinnamon flavours of Mint, using MATE (based on GNOME 2) or the lightweight XFCE.

    The memory usage for Linux Mint is meant to be “between 80MB to 1GB” according to founder Clem Lefebvre’s latest post; but there are cases where memory consumption continues to grow, even when the operating system is sitting idle, consuming “2GB, 4GB, 6GB of RAM. We don’t know what causes these leaks yet but we’ll have a workaround in Cinnamon 5.0,” he said.

Devices/Embedded

• It’s raining i.MX 8M Plus systems-on-module at Embedded World 2021

  NXP introduced i.MX 8M Plus AI SoC with a built-in 2.3 TOPS neural processing unit (NPU) last year, and we’ve already covered several early announcements about i.MX 8M Plus systems-on-module (SoM) with Variscite VAR-SOM-MX8M-PLUS and DART-MX8M-PLUS, TechNexion EDM-G-IMX8M-PLUS and AXON-E-IMX8M-PLUS respectively using SO-DIMM edge connectors and board-to-board connectors, as well as SolidRun i.MX 8M Plus SoM that was announced together with the HummindBoard Mate carrier board with dual Gigabit Ethernet.

  But as Embedded World 2021 Digital is taking place virtually until Friday, other companies have now made their own announcements of i.MX 8M Plus SoMs as the processor enters mass production this month, and since as far as I know, it’s pin-to-pin and software compatible with earlier i.MX 8M Nano/Mini SoCs, the update must have been easy. That means we’ve got a longish list of modules, and I have probably missed some. Supported operating systems are basically the same across companies with Linux using Builroot or the Yocto Project running on Cortex-A53 cores, and FreeRTOS on the real-time Cortex-M7 core. Some also offer Android support.

• Geniatech XPI-3288 Raspberry Pi lookalike features Rockchip RK3288 SoC

  Geniatech XPI is a family of single board computers following Raspberry Pi 3 form factor. We first covered XPI-S905X SBC in 2018, which was followed by XPI 3128 board last year.

  The company has now launched another model with Geniatech XPI-3288 SBC powered by Rockchip RK3288 32-bit quad-core Cortex-A17 processor coupled with 2G RAM and 16GB eMMC flash.

• Asymmetric Multi Processing with Linux & Zephyr on the STM32MP1

  In the embedded world, more and more vendors offer Arm-based System-on-Chips (SoC) including both powerful Cortex-A CPU cores, designed to run a full-featured OS such as Linux, and one or more low-power Cortex-M cores, usually found in microcontrollers, designed to execute bare-metal or RTOS-based applications.

  [...]

  While the Linux kernel can run on a wide range of devices, it requires a decent amount of memory (> 4MB), and therefore cannot be used on memory-constrained microcontrollers.

  Enters Zephyr, a project initiated by Wind River, now developed as a Linux Foundation project.

• Mapping

  • Freedom to map depends on WHO delivers it

    At the moment, I do not know enough about this reform and its general background, to have a definite opinion on who is wrong or right here. But that is not important. My only goal with this post is to remind everybody, in India and everywhere else, that “map or you will be mapped” is not just a fancy slogan.

    Whoever draws the maps, or controls the data needed to draw them, can concretely increase, or limit, your personal freedom and rights. This is the only thing that you surely want to learn from all the congratulations and concerns above. Take them as concrete examples of what could actually go wrong, or right, with mapping laws, whatever digital map you are already living in.

• Mobile Systems/Mobile Applications

  • The 10 Best Golf Games and Apps For Android Device

  • Five reasons why Android is better than iPhone | ZDNet

  • The best smartwatches, fitness trackers, and wearables for Android (Spring 2021)

  • First Android 12 Developer Preview Update is Here

  • Trick to Blur Background in Zoom for Android & iOS – Gadgets To Use

  • You Can Now Turn the Punch-Hole Into an LED Light on Several Android Phones

  • Volvo C40 Recharge is the latest EV with Android Automotive – 9to5Google

  • Google is boosting AR performance on Android phones with dual cameras – The Verge

  • Android phones are getting a big AR upgrade to fight the iPhone 12 | Tom’s Guide

  • Itel 32-inch and 43-inch Android TVs will reportedly launch in India this month | Digit

  • Vivo Y20s review: a super-cheap Android phone with long battery life | T3

  • Lenovo Tab P11 Pro review: a new top Android tablet? | TechRadar

  • Android 11 Update For The OnePlus 7 & 7T Expected “In The Coming Days”

  • I put the Android 12 beta on my daily driver Pixel 5 and it’s nearly flawless | Android Central

  • Best Free Fire sensitivity settings for Android devices in 2021

  • How To Set Up Guest Mode on Android: The #1 Simplest Method

Free, Libre, and Open Source Software

• Zstd 1.4.9 Released With ~2x Faster Performance For Long Mode

  Zstd previously introduced the “–long” mode to analyze large quantities of data in a timely manner and suitable memory budget. The aim in this mode is to improve the compression ratio for files with long matches at a large distance. With Zstd 1.4.9 the long distance mode is much faster thanks to a number of optimizations that preserve the compression ratio while drastically speeding up the compression time. Test cases are showing this long distance mode being 114~154% faster than the prior point release of Zstd. These new algorithms for the long distance mode appear to be a big win based on all of the data published thus far.

• Conditions and Implied Licenses: Bitmanagement v. United States

  An interesting case was handed down by the Federal Circuit on February 25, 2021, discussing some software licensing issues seldom mentioned in case law. Bitmanagement Software GMBH v. United States was a dispute that involved the use of certain proprietary software, BS Contract Geo, a 3D visualization product.

  The facts surrounding the license of the software are complex, but laid out in detail in the opinion. The owner of the software, Bitmanagement, and the user of the software, the US Navy, never entered into a direct or express software license. The contracting process, which took place via a reseller called Planet 9, stalled, when it was determined that the Navy’s system needs were incompatible with Bitmanagement’s software management keys. In the end, the Navy paid for some copies, but engaged in “massive free copying” (see concurring opinion, p.27) of the software with no express license to do so.

  Central to the court’s finding, the parties had agreed that as a condition to the license, the Navy would use Flexera’s license-tracking software FlexWrap to monitor the number of simultaneous users of the software. It noted that the Claims Court found that Bitmanagement agreed to the licensing scheme “because Flexera would limit the number of simultaneous users of BS Contact Geo, regardless of how many copies were installed on Navy computers.” (p. 20) But the Navy did not use the FlexWrap tool as agreed. The court held that use of this management software was a condition of the license, even though the license was not in writing. The court said, “This is one of those rare circumstances where the record as a whole reflects that the only feasible explanation for Bitmanagement allowing mass copying of its software, free of charge, was the use of Flexera at the time of copying.” (p.21)

• Sustainability for Open Source Projects: 4 Big Questions [Ed: VM (Vicky) Brasseur, who promotes proprietary software in some contexts, wants to FUD Free software as having that mythical "sustainability" woe (as if it's all about money). GNU developed for 37 years (soon 38) in spite of that "sustainability" nonsense. People can get paid for things other than their per Free software project.]

  What does sustainability look like for open source projects? VM (Vicky) Brasseur considers four key questions to help determine the answer for your project.

  These days the word “sustainability” gets thrown around a lot with respect to free and open source software (FOSS). What is sustainability, and what does it mean for your project?

  The concept of sustainability didn’t originate in the 1980s, but it gained a lot of mindshare at that time thanks to the Brundtland Report, which was released by the United Nations in 1987 after three years of research by a cross-functional team of scientists, policy makers, and business people. The report defines sustainability as “…development that meets the needs of the present without compromising the ability of future generations to meet their own needs.”

• Samuel Iglesias: Igalia is hiring! [Ed: Case of point; you can get paid to do Free software]

  One of the best decisions I did in my life was when I joined Igalia in 2012. Inside Igalia, I have been working in different open-source projects, most of the time related to graphics technologies, interacting with different communities, giving talks, organizing conferences and, more importantly, contributing to free software as my daily job.

  [...]

  What we offer is to work in an open-source consultancy in which you can participate equally in the management and decision-making process of the company via our democratic, consensus-based assembly structure. As all of our positions are remote-friendly, we welcome submissions from any part of the world.

• CMS

  • The Month in WordPress: February 2021

    That was Josepha Haden Chomphosy on WordPress is Free(dom) episode of the WP Briefing Podcast, speaking about the four freedoms of open-source software. Those four freedoms are core to how WordPress is developed. A lot of the updates we bring you this month will resonate with those freedoms.

• FSF

  • GNU Projects

    • denemo @ Savannah: Release 2.5 out now.

      New Features 
      
          MusicXML export 
              Supports export of multi-movement scores 
          Support for Musical Sketches 
              Cut selection as sketch 
          Support for LilyPond 2.20.0 
          Menu Navigation from Keyboard enabled 
          Comments in Lyric verses 
          
      Bug Fixes 
      
          Various fixes in MusicXML import 
          Various fixes in LilyPond import 
          Wrong Keyboard Shortcuts on MacOS
      

    • GNU Denemo 2.5 Is Released

      GNU Denemo version 2.4.0. This is not the new version, this is the previous version. The graphical is basically identical to the new version.

      GNU Denemo is a very specialized program for music notation. It has most of the bases in that area covered, thought he user-interface is a bit clunky to work with.

      The latest 2.5.0 release brings support for cutting selections as sketches, support exporting multi-movement scores to the MusicXML format, support for comments in lyric verses and, after all these years, support for menu navigation using the keyboard.

      There’s also improvements to MusicXML import, LilyPond import and a fix for keyboard shortcuts on macOS.

    • February GNU Spotlight with Mike Gerwitz: 23 new releases

      23 new GNU releases in the last month (as of February 25, 2021):
      artanis-0.5
      autoconf-archive-2021.02.19
      binutils-2.36.1
      freeipmi-1.6.7
      freeipmi-1.6.8
      glibc-2.33
      gnuhealth-3.8.0
      gwl-0.3.0
      help2man-1.48.1
      inetutils-2.0
      intlfonts-1.4.1
      libgcrypt-1.9.2
      libredwg-0.12.1
      libredwg-0.12.2
      linux-libre-5.11
      mailutils-3.12
      nano-5.6
      nettle-3.7.1
      octave-6.2.0
      parallel-20210222
      tar-1.34
      unifont-13.0.06
      xorriso-1.5.4.pl02

• Programming/Development

  • Flutter 2.0 reaches stable and adds support for foldable and dual-screen devices

    For a while now, Flutter for Desktop has been in an alpha stage, which meant changing APIs, bugs, and performance issues. With Flutter 2.0, Google has moved its status to somewhere between beta and stable. What does that mean? Well, it’s available in Flutter 2.0 Stable, but Google doesn’t think it’s fully complete yet. It should be fine for production use, but there may be a bug here and there.

  • How I Built a Web Scraper with Beautiful Soup and Used it to Land My First Job

    Landing any job, let alone a first job, can be a difficult process. Employers often tell you that you don’t have enough experience for them to hire you. But that means you also won’t get an opportunity to gain that experience (like a job).

    Landing a job in tech can feel even more challenging. On the one hand you have to answer interview questions well, like any other job. On the other you have to prove that your technical skills can do the job you’re interviewing for.

    These hurdles can be difficult to overcome. In this article I’ll share how I built a web scraper to help me land my first job in tech. I’ll explain what exactly I built and the key lessons I learned. Most importantly, I’ll share how I leveraged those lessons to ace my interviews and land a job offer.

  • We Sent 304,654 Coding Tests to Developers from 156 Countries – Here’s What We Learned

    At DevSkiller, we are known for our detailed industry reports that assist IT recruitment professionals with their hiring decisions. And this past year has been the most diverse and data-heavy set of information ever compiled by our team.

    Despite the circumstances that 2020 brought us, the show must go on. We have compiled 304,654 coding tests sent to developers in 156 countries to create the 2021 DevSkiller IT skills report.

    Whilst it’s easy to point to the big tech multinationals that will indeed profit from a crisis like we’ve had, many other small businesses will have a hard time adapting to the market’s fluctuating demands.

  • Qt 6.0.2 Released

    We have released Qt 6.0.2 today. As a patch release, the Qt 6.0.2 does not add any new functionality but provides bug fixes and other improvements.

  • Shell/Bash/Zsh/Ksh

    • DIY primary/foreign key relationships, again

      In a blog post in 2020 I described a problem I was finding in linked tables. One table had a primary key field and the other had a foreign key field that should have referred back to the first table. That wasn’t always the case, because the tables didn’t always come from a database with referential integrity. The tables were sometimes built in spreadsheets and the primary and foreign keys were entered by hand.

      The defective tables usually have formatting differences or orphaned foreign keys. The formatting issue is that the primary key is something like “Abc_def_236-ghi” and the foreign key is “Abc-def-236-ghi”; close, but no cigar. Orphaned foreign keys are correctly formatted entries with no match at all in the primary key set.

  • Rust

    • Rust Lang team March update

      Did you know that you can see the lang team’s active projects on our project board? We’re still experimenting and evolving the setup, but the goal is that it should give you a quick overview of what kinds of things the lang team is focused on, and what stage they are in their development. Our minutes contain a writeup for each active project, but let me call out a few highlights here…

Playboi Carti, Rap Iconoclast

When rappers coronate themselves as rock stars, they’re usually either staking their claim to the zeitgeist (Rae Sremmurd’s “Black Beatles”), partying with abandon (Shop Boyz’ “Party Like a Rock Star”), or flirting with oblivion (Danny Brown’s “Die Like a Rockstar”). When Playboi Carti declares himself a rock star, as he does throughout his restless second album, Whole Lotta Red, the persona is shorthand for a liberating fugue state.

Education

• Educating Young People in Conflict Zones: an Interview With Nyla Ali Khan

  Nyla Ali Khan: As an academic, it is intellectually stimulating for me to observe my students think critically about significant issues. I encourage students to find a way to enter the conversation. What are you saying to their audience? How are they saying it? What others are saying motivates their writing, and, therefore, I require them to find a way to enter the conversation with others’ views. I emphasize that I, as a reader, am interested in their stances, and students learn to employ a perspective to better understand the position from which their write, which has been constructed by their political ideology, education, religious beliefs, history, nationality, ethnicity, class, and gender, which is a transformative experience for students.

  My personal history, education, and scholarship have made me sensitive to the diversity of cultural traditions and to the questions and conflicts within them, and I bring this sensitivity to my teaching as well. Working and living in Oklahoma has taught me that community is the ability to organize and mobilize for social change, which requires the creation of awareness not just at the individual level but at the collective level as well. Community is the courage to bridge divides and to pave the way for the education of the younger generation, which is the only viable response to ignorance and bigotry. Community is the openness to dissent, and differences of opinion, which is true courage. In my teaching, writings, and public lectures, I emphasize that we have a lack of understanding of each other and a paranoia that may lead to violence. It is or, at least, should be inconceivable, in the day and age of a global economy, to spurn the concepts of reason, rationality, and political and moral ethics.

Health/Nutrition

• New Year, Same Pandemic

  Support independent cartooning: join Sparky’s List—and don’t forget to visit TT’s Emporium of Fun, featuring the new book and plush Sparky!

• Chris Hedges: The Age of Social Murder

  The two million deaths that have resulted from the ruling elite’s mishandling of the global pandemic will be dwarfed by what is to follow. The global catastrophe that awaits us, already baked into the ecosystem from the failure to curb the use of fossil fuels and animal agriculture, presage new, deadlier pandemics, mass migrations of billions of desperate people, plummeting crop yields, mass starvation, and systems collapse.

• Yemen, Where Pitiless Geopolitics is Causing Famine

  The region is an epic governance fail that probably cannot be resolved in any ordinary, decent person’s favour until the oil, morally adulterated with mrillions of gallons of human blood over the decades, runs out. Unfortunately for the cohorts of children who could starve to death imminently in Yemen, the oil will keep flowing. And many of them will most likely die. That’s because the blockade of the country imposed by the Saudis, flush with petrodollar-purchased artillery and jets, has made humanitarian relief in the country near-impossible on a nationwide basis.

  It’s not like this is like for like, either. Yemen, by an accident of geology denied the oleaginous riches of its northern neighbours, has in modern times rarely made it out of the bottom five poorest states anywhere in the wider region.

Integrity/Availability

• Proprietary

  • ONLYOFFICE 6.2 Release Introduces Data Validation, Auto-Format, and Other Useful Changes [Ed: It's actually proprietary software]

    ONLYOFFICE is a free and open-source cross-platform office suite available for Windows, macOS, Linux, Android, and iOS platforms. It also provides cloud office solutions, collaboration tools, project management tools, and more.

    Recently, a new version ONLYOFFICE 6.2 was announced by the team. This release includes features such as Data validation, the ability to set up auto-format, and various improvements as well.

  • Pseudo-Open Source

    • Privatisation/Privateering

      • Linux Foundation

        • Linux Foundation and RISC-V International launch free courses on open source architecture for processors

          The Linux Foundation and RISC-V International hope that two new free courses will make it easier for IT professionals to learn about open instruction set architecture for processor chips. The courses are available starting Tuesday, March 2 on edX.org.

          An ongoing semiconductor chip shortage due to supply chain interruptions has limited the supply of smartphones and laptops, but the ripple effects extend beyond the tech market, as Dallon Adams reported on TechRepublic. Ford recently announced that it was decreasing F-150 production due to the semiconductor shortage.

          RISC-V (pronounced as “risk five”) is an open instruction set architecture that could power a new era of innovation for processor architectures. According to a press release, The Linux Foundation and RISC-V International designed these courses to reduce the barrier to entry for people interested in gaining RISC-V skills. RISC-V International is a non-profit based in Switzerland with more than 750 members.

        • Free Courses Now Available to Learn ‘RISC-V’ by The Linux Foundation & RISC-V International

          The Linux Foundation is the official organization behind Linux and is at the forefront for collaboration on open-source software, open hardware, open data and open standards.

          Recently, they’ve partnered with RISC-V International, an organization that pushes for adoption and implementation of the open-source RISC-V ISA (Instruction Set Architecture).

          Now, they have announced two new free online courses that are being made available on edX.org, a learning platform founded by Harvard University and Massachusetts Institute of Technology (MIT).

        • Linux Foundation, RISC-V International Launch Free RISC-V Training Courses

          Linux Foundation and RISC-V International have announced two new free online training courses to help individuals get started with the RISC-V ISA.

          The courses are available on edX.org, the online learning platform founded by Harvard and MIT.

          The first course, Introduction to RISC-V (LFD110x), guides participants through the various aspects of understanding the RISC-V ecosystem, RISC-V International, the RISC-V specifications, how to curate and develop RISC-V specifications, and the technical aspects of working with RISC-V both as a developer and end-user.

  • Security

    • Microsoft: Chinese Cyberspies Used 4 Exchange Server Flaws to Plunder Emails

      Microsoft Corp. today released software updates to plug four security holes that attackers have been using to plunder email communications at companies that use its Exchange Server products. The company says all four flaws are being actively exploited as part of a complex attack chain deployed by a previously unidentified Chinese cyber espionage group.

    • Microsoft Says Chinese Hackers Responsible for Exchange Attacks [Ed: Microsoft puts back doors in its products but is now blaming China for taking advantage of those. Microsoft: our back doors aren’t always exploited; when they are, we’ll resort to xenophobia and blame the Chinese (not those who put the back doors there).]

    • Payroll/HR Giant PrismHR Hit by Ransomware?

      PrismHR, a company that sells technology used by other firms to help more than 80,000 small businesses manage payroll, benefits, and human resources, has suffered what appears to be an ongoing ransomware attack that is disrupting many of its services.

    • Malicious NPM Packages Steal Linux and Unix Password Files of Amazon, Slack, and More [Ed: Microsoft is delivering spyware and malware, but media doesn't name the real culprit (as if Microsoft doesn't exist when that does not suit Microsoft)]

    • Security updates for Wednesday [LWN.net]

      Security updates have been issued by CentOS (bind), Debian (adminer, grub2, spip, and wpa), Mageia (openjpeg2, wpa_supplicant, and xterm), openSUSE (avahi, bind, firefox, ImageMagick, java-1_8_0-openjdk, nodejs10, and webkit2gtk3), Red Hat (container-tools:1.0, container-tools:2.0, grub2, and virt:rhel and virt-devel:rhel), SUSE (bind, gnome-autoar, grub2, and nodejs8), and Ubuntu (python2.7 and wpa).

    • Now-fixed Linux kernel vulnerabilities enabled local privilege escalation (CVE-2021-26708)

      The vulnerabilities could be exploited for local privilege escalation, as confirmed in experiments on Fedora 33 Server. The vulnerabilities, known together as CVE-2021-26708, have received a CVSS v3 base score of 7.0 (high severity).

      These vulnerabilities result from race conditions that were implicitly added with virtual socket multi-transport support. They appeared in Linux kernel version 5.5 in November 2019. The vulnerable kernel drivers (CONFIG_VSOCKETS and CONFIG_VIRTIO_VSOCKETS) are shipped as kernel modules in all major GNU/Linux distributions. The vulnerable modules are automatically loaded when an AF_VSOCK socket is created. This ability is available to unprivileged users.

    • Researchers discover and patch Linux kernel vulnerabilities | 2021-03-03

    • Privilege Manager 11: New privilege management capabilities for Unix and Linux

      With the latest release of Privilege Manager, all endpoints and servers throughout your organization can now follow consistent least privilege and Zero Trust policies, whether they are Windows, Mac, or Unix/Linux.

    • Fear, Uncertainty, Doubt/Fear-mongering/Dramatisation

      • GRUB2 boot loader reveals multiple high severity vulnerabilities [Ed: Microsoft interjected fake (non) security into Linux and is now boasting and celebrating the dire consequences in its loyal propaganda sites]

        GRUB, a popular boot loader used by Unix-based operating systems has fixed multiple high severity vulnerabilities.

        In 2020, BleepingComputer had reported on the BootHole vulnerability in GRUB2 that could have let attackers compromise an operating system’s booting process even if the Secure Boot verification mechanism was active.

        Threat actors could further abuse the flaw to hide arbitrary code (“bootkit”) within the OS that would run on every boot.

Defence/Aggression

• Opinion | The Pentagon, First, Last, and Always

  Focusing on the wrong threats, including a new cold war with China, is the last thing we can afford now.

• War Mongering for Artificial Intelligence

  The application of AI in military systems has plagued the ethicist but excited certain leaders and inventors.  Russian President Vladimir Putin has grandiloquently asserted that “it would be impossible to secure the future of our civilization” without a mastery of artificial intelligence, genetics, unmanned weapons systems and hypersonic weapons.

  Campaigners against the use of autonomous weapons systems in war have been growing in number.  The UN Secretary-General António Guterres is one of them.  “Autonomous machines with the power and discretion to select targets and take lives without human involvement,” he wrote on Twitter in March 2019, “are politically unacceptable, morally repugnant and should be prohibited by international law.”  The International Committee for Robot Arms Control, the Campaign to Stop Killer Robots and Human Rights Watch are also dedicated to banning lethal autonomous weapons systems.  Weapons analysts such as Zachary Kallenborn see that absolute position as untenable, preferring a more modest ban on “the highest-risk weapons: drone swarms and autonomous chemical, biological, radiological, and nuclear weapons”.

Environment

• Zoonoses and Climate Change: Is One Health Enough?

  Coronaviruses are zoonotic. SARS-CoV was transmitted from civet cats to humans and MERS-CoV from dromedary camels to humans. A novel coronavirus (nCoV) like Covid 19 is a new strain not previously identified in humans. Other coronaviruses discovered circulating in animals have not yet infected humans. By now, everyone is familiar with symptoms and preventative measures, including fraught vaccination. However, as Rob Wallace said at a ZeroCovid event, “The causes of diseases extend out to our relationships between each other, and with animals and ecosystems.”

  On 18 February 2021, the UN released a a168-page report, Making Peace with Nature, which states, on page 15, ” The deteriorating state of the planet undermines efforts to achieve healthy lives and well-being for all. Around one quarter of the global burden of disease stems from environment-related risks, including those from animal-borne diseases (such as COVID-19), climate change, and exposure to pollution and toxic chemicals. Pollution causes some 9 million premature deaths annually and millions more die every year from other environment-related health risks.”

• Energy

  • A ‘Green New Dud’? Progressives Warn House Climate Bill ‘Fails to Grasp the Fundamental Truth’ of Planetary Crisis

    “Democrats should be making a big, bold push on climate—and the CLEAN Future Act is simply not strong enough.”

  • ‘A Disgrace’: First Nation Pipeline Opponent Gets 90 Days in Jail After Ceremony Along Trans Mountain Route

    “Gallagher is one of more than 200 people, many Indigenous, who have been arrested for mobilizing against the $12.6 billion pipeline.”

  • Opinion | This Obscure Energy Treaty Is the Greatest Threat to the Planet You’ve Never Heard Of

    The Energy Charter Treaty allows fossil fuel companies to sue governments for taking action on climate change. It must be stopped before it’s too late.

  • New IEA Data Shows World on Path to Resume ‘Carbon-Intensive Business-as-Usual’

    The agency’s chief said the new figures offer “a sharp reminder of the immense challenge we face in rapidly transforming the global energy system.”

  • Opinion | Operation Desert Storm: Blood for Oil

    Amid the ongoing horror, it’s important to find ways to atone for war crimes—including reparations.

• Wildlife/Nature

  • Conservation Groups Swing Back at Bernhardt’s Last Minute Favor to Oregon Ranchers

    It also reflects how doggedly the Trump Administration wanted to give a grazing permit to the Hammond Ranches, Inc. that both Ryan Zinke and his successor David Bernhardt – each on their very last day in public office*– seized control of the administrative process, stepped in and directed an outcome that had already been opposed by the Bureau and defended against by the regional solicitor.

    When the Bureau decision to not renew the Hammond Ranches permit in 2014, it did so for numerous reasons, but primarily because the agency couldn’t justify reissuing a permit to the Hammonds given the grazing regulations that require a permittee to be in good standing and in substantial compliance with the terms and conditions of the previous permit. (There’s more to this story, documented here.) It wasn’t just the arsons for which they had been convicted in 2012, but it was the underlying behavior of those actions, “(T)he malicious disregard for human life and public property [that] showed contempt for [Bureau] regulation of public land.”

Finance

• ‘Now Is the Time for Boldness’: Senators Urge Biden to Back Recurring Payments for Covid Relief Package

  “This crisis is far from over, and families deserve certainty that they can put food on the table and keep a roof over their heads,” the 10 members of the Democratic caucus wrote.

• Opinion | Biden Must Go Beyond Fiscal Stimulus

  Both supporters and critics of US President Joe Biden’s $1.9 trillion stimulus plan assume that there is a dollar amount that is just right. In fact, no such figure exists: every possible stimulus size is simultaneously too little and too big.

• Bartenders and Public Pension Fund Investment Advisers

  It is the same story for pension funds when it comes to their various pension advisers. The pension funds’ boards (the people who actually are in charge of running the fund) are often on good terms with the people who manage their money. In many cases, they have used the same group of advisers for years or even decades.

  Nonetheless, the fund’s investment advisers are in the same relationship to the pension fund as the bartender is to the person worried about their drinking problem. The advisers are making money off the fund.

• Happy Birthday, Open Bank Project!

  More than ten years ago, I met one of the founders of the Open Bank Project. Back then, I observed that if banks adopted Open Bank, we would need less Wikileaks.

  This month, Open Bank celebrates its eleventh birthday, and I invite everybody to join the celebrations. Here are just some of the reasons why you should:

AstroTurf/Lobbying/Politics

• Russian lawmaker seeks official probe following (debunked) reports that Yulia Navalnaya has dual citizenship

  Russian State Duma deputy Vitaly Milonov has sent a request to the Interior Ministry asking police officials to look into whether or not Yulia Navalnaya, the wife of jailed opposition politician Alexey Navalny, possesses dual citizenship or a foreign residency permit.

• ‘Reprehensible Power Grab’: Outrage as Georgia House Passes GOP Bill Restricting Voting Rights

  “Georgia Republicans didn’t like the results of the 2020 election so they decided they would try to dictate who they will let vote and who they won’t let vote.”

• The Claudius Presidency?

  During the nearly four years that he ruled over the Roman empire in the first century CE, Caligula was notorious for sexual predation and extravagant spending. Never one to sell himself short, he proclaimed early on that he was a god. He held the Senate in such contempt that he forced its high-ranking members to run alongside his chariot for miles dressed in their togas. He dismissed Virgil as a hack writer and Livy as a dispenser of fake history, and he dreamed of making his favorite horse a consul.

  He was also inordinately fond of killing people, sometimes only to seize their assets. Or because he was bored, like the time at a gladiatorial contest when there were no criminals to execute during the intermission. Thinking fast, the despot ordered his guards to throw an entire section of the audience into the arena to be devoured by wild animals.

Freedom of Information/Freedom of the Press

• EU sanctions Russian officials linked to Navalny’s imprisonment

  The European Union has imposed personal sanctions on four Russian officials for their involvement in the persecution of opposition politician Alexey Navalny, the German Press Agency reported on Tuesday, March 2. 

Civil Rights/Policing

• Lev Ponomarev announces dissolution of his human rights group due to Russia’s strengthened ‘foreign agents’ laws

  Russian human rights activist Lev Ponomarev, who was himself labeled a “foreign agent” in December 2020, has announced the dissolution of his movement “Za Prava Cheloveka” (For Human Rights) due to the recent tightening of Russia’s foreign agent legislation.

• Belarusian journalist and doctor sentenced to time in prison for disclosing information about opposition activist’s death

  A district court in Minsk has sentenced Tut.by journalist Katerina Borsevich (Katsiaryna Barysevich) and doctor Artem Sorokin (Artsiom Sorokin) to time in prison for divulging confidential medical information concerning the death of opposition activist Raman Bandarenka.

Monopolies

• Counsel fear loopholes for counterfeiters as DSA gathers pace [Ed: Let's kill the whole Internet because some barons and oligarchs don't like that potential of competition online?]

  A narrow focus on e-commerce sites and a potential for convincing counterfeits to slip through the net are among the latest concerns

• Trade secrets in the wild (Part 1): some economics of cybersecurity investment [Ed: Monopolies by imposed secrecy is very dodgy stuff]

  Courts also play a key role in determining shaping the public policy environment for IP and cybersecurity. Civil litigation involves both private and public expenditures, whereas the criminal system is largely publicly funded. Determining the level of reasonable protection is ultimately down to the courts, and adds another layer to the interaction between policy and a firm’s cybersecurity spending decisions.

  Public expenditure is relatively higher in criminal than in civil cases, as the government leads the investigation and prosecution. This can be useful when the victim is resource-poor or the defendant has limited financial resources, which often render a civil, financial penalty a moot point [aka, judgement proof]. Criminal prosecution can also be useful when pursuing a civil action is not good strategy, for example, when a company risks upsetting a foreign state where it does business.

  Criminal approaches also send strong signals to would-be criminals, but it is well established that the deterrence factor is most successful when the probability of discovery of the criminal act and its prosecution is higher. More prosecutions mean more public expenditures, whereas higher penalties are relatively cheap to implement, but less effective at increasing the costs to criminals.

  [...]

  Unlike other IPR [sic], trade secrets rely on a reasonable protection within the control of the rightsholder. Years ago, aerial photography was a risk, here, these days the threat is largely cyber. As trade secret use and cybersecurity both become more sophisticated, expect to see more interest in their connections.

  Part II of this post looks at problems with reporting crime (longer version of this series with bonus squiggly lines, here.)

• Speed, fluidity, nuance: what pharma in-house need from firms [Ed: Denying access to medicines (i.e. killing people) to keep costs artificially high and suing people who dare try to prioritise life-saving

  Four in-house counsel from multinational pharma companies set out their prosecution challenges and external counsel requirements for the year

• FOSS Patents: Arizona House of Representatives adopts law untying in-app payment method from mobile app store monopolies: now on to the State Senate

  The result of the third reading vote was 31-29. There are 31 Republicans and 29 Democrats in the Arizona State House, and one member per party crossed the aisle, thereby canceling each other out.

  A couple of proposed amendments failed, while a proposal by Dr. Cobb (enabling app developers to complain to Arizona’s Attorney General about any failure by Apple or Google to comply) was adopted. (Technically, the App Store part of HB2005 was an amendment to a multi-purpose bill, which amendment then in turn got amended in the way just described.)

  [...]

  In order for this measure to be passed into law, the Arizona Senate would have to adopt it as well, and the Governor would have to sign it (as opposed to vetoing it). The (counter)lobbying onslaught by Apple and Google has been massive already, and may further intensify. There are 16 Republican and 14 Democratic senators. It is counterintuitive that Arizona Democrats have such strong reservations concerning this measure, considering that the Democratic majority in the United States House of Representatives took a clear position on tech monopolies and walled gardens in October.

  This remains interesting, and meanwhile there are initiatives in various other states. Today, the Minnesota Reformer website published an opinion piece by Justin Stofferahn and Pat Garofalo, calling on the Minnesota state legislature to “curb anti-competitive tactics” in order to become, once again, “an innovation center.”

• Patents

  • MIP International Patent Forum: Anti-anti-suit injunctions ‘scary’ FRAND trend [Ed: Aggressors dominate and sponsor another think tank 'forum' hosted by their propaganda front, Managing IP]

    Counsel from Philips, Ericsson and other panellists discussed the evolution of SEP litigation at Managing IP’s virtual forum

  • Is it Hyperbole if it Accurately Describes an Absurd Reality [Ed: USPTO may have legitimacy crisis when former heads are lobbying for patent maximalists while taking bribes from IBM and Microsoft]

    Wow, lots of new amicus in the patent eligibility case of American Axle v. Neapco, including a joint filing from Sen. Thom Tillis, Hon. Paul Michel, and Hon. David Kappos. The trio argue that the current state of patent eligibility doctrine is “an unintelligible hash” causing significant systemic problems. [Tillis Brief] Kappos addition to the brief is symbolically important. His name is memorialized in Bilski v. Kappos, the case that seemingly re-started us down this pathway. The brief offers an interesting approach — it is filled with quotes from policymakers about the problems created by the shift in patent eligibility laws. Many of the quotes appear hyperbolic, but it is hard to tell in this situation whether they are simply reflecting reality.

    Professors Lefstin (Hastings) and Menell (Berkeley) add their own hyperbole noting that in this case, the Federal Circuit has stretched “Section 101 to absurd lengths.” A common law professor trope is to talk through the absurdity that ensues when a given rule is taken to an extreme. Here, the professors are noting instead that absurdity has arrived.

  • U.S. v. Arthrex: Is Historical Practice of the USPTO Relevant? [Ed: Patent profiteers do all they can to scuttle those panels which get rid of fake patents that should never have been granted in the first place. They've leveraged some spin to paint that as a constitutional issue.]

    As discussed here, the Justices asked many questions in the oral argument in Arthrex this week on both questions: (1) whether there was an Appointments Clause defect and (2) if so, whether the Federal Circuit properly cured it. With respect to the first question, several of the Justices appeared skeptical that administrative patent judges are “inferior officers” as argued by the government and Smith & Nephew. Instead, the Court may well affirm the Federal Circuit’s holding that the appointment of administrative patent judges to the Patent Trial and Appeal Board violated the Appointments Clause.

    What was much less clear from the argument, however, was the Justice’s views on the second question. While the Federal Circuit’s cure (prospectively severing a portion of the AIA restricting the way APJs can be removed) did not get much attention during the argument, no other approach appeared to have a consensus either.

    Interestingly, the issue of historical practice of the USPTO came up during oral argument. Justice Kagan asked Smith & Nephew’s attorney, Mr. Perry, the story behind the scope of administrative patent judge’s authority. Mr. Perry noted interference examiners going back to 1836, which decided interference proceedings and were appointed by the Secretary of Commerce, as part of “the long and proud history of the Patent Office.” Mr. Perry continued: “[w]e have a patent-specific tradition [that] comes out of the examination process” and “modern APJs are very much in line with a long, long history that, in fact, stretches all the way back to the founding.”

  • The Hidden Ideological Stakes of SCOTUS Patent Case [Ed: It's not ideology. Fake patents that should not have been granted ought to be revoked. The sooner, the better.]

    On Monday the Supreme Court heard oral argument in United States v. Arthrex, Inc., which presents two seemingly technical questions: (1) do administrative patent judges (APJs) hold their office unconstitutionally because they were not appointed by the President and confirmed by the Senate? And if so, (2) what is the appropriate remedy? The details of these issues are, well, technical. Here I shall set aside the remedy question. After explaining so much of the case as minimally necessary for a layperson to grasp what it involves, I shall connect the issues that seemed to trouble the justices to much less arcane and thus much more ideologically divisive matters.

    [...]

    Arthrex concerns the appointment of APJs—government officials who sit in panels to conduct hearings within the Patent and Trademark Office (PTO) to determine the validity of challenged patents. Because they are appointed by the Secretary of Commerce—the head of a department of the federal government—they exercise their power validly if they are inferior officers but not if they are principal officers.

    During Monday’s oral argument, the lawyers for the federal government and for the private-party petitioners each separately argued that of course APJs are inferior officers, because unlike cabinet secretaries and other agency heads, they do not sit (as one lawyer put it) “at the right hand of the President,” but several levels down.

    Arthrex’s lawyer and the Federal Circuit whose judgment he was defending (on substance though not on remedy), disagreed. They relied on the 1997 decision in Edmond v. United States for a rule to the effect that in order to be an inferior officer, an administrative adjudicator’s decisions must be subject to review by a Senate-confirmed (i.e., principal) officer. Because APJ panels’ decisions are not subject to such intra-executive review, the Federal Circuit concluded and Arthrex argued, the APJs are not inferior officers but principal ones whose appointment was therefore unconstitutional.

  • Software Patents

    • Federal Circuit affirms Unified’s win against Barkan

      On March 2, 2021, the Federal Circuit affirmed the Patent Office’s final decision, in a summary Rule 36 affirmance, confirmed that Barkan Wireless IP Holding’s U.S. Patent 8,014,284 was mostly unpatentable. The Court also upheld the Board’s decision that Unified’s members should not have been named as RPIs as unreviewable after the Supreme Court’s ruling in Click-to-Call. In every challenge at both the PTAB and the Federal Circuit, Unified has always been confirmed as the sole real party-in-interest in its filings.

• Copyrights

  • Microsoft Attacks The Open Web Because It’s Jealous Of Google’s Success

Open source drone makes it to Mars, System76 unveils its new keyboard, and more

In this edition of our open source news roundup, learn about open source on Mars, System76′s new keyboard, a 5G open source stack, and more.

When NASA’s latest Mars rover hit the Red Planet in February, it was partially powered by open source software.

A small drone helicopter named Ingenuity is inside the rover. Given its distance from Earth, no one will fly Ingenuity manually. Instead, it was built to fly itself using Linux and NASA’s open source F´ framework.

Audiocasts/Shows

• mintCast 355.5 – McKnight in Shining Armor

  1:49 Linux Innards
  27:06 Vibrations from the Ether
  51:29 Check This Out
  58:45 Announcements & Outro

  In our Innards section, we talk to community member Mike!

  And finally, the feedback and a couple suggestions

Kernel Space

• LVFS Serves Up 25 Million Firmware/BIOS Updates To Linux Users – Phoronix

  It was just this past September that LVFS served its 20 millionth firmware file to Linux users updating their system BIOS or device firmware using Fwupd while this week the Linux Vendor Firmware Service crossed the 25 million milestone!

  LVFS/Fwupd lead developer Richard Hughes of Red Hat relayed the news that LVFS has now served more than 25 million firmware files to Linux users. Considering just a few years ago it was difficult updating your system BIOS under Linux and most hardware vendors wouldn’t even consider offering firmware updates for Linux, this is an incredible accomplishment.

• Btrfs: Resolving the logical-resolve · Marcos’ Blog

  Tools like fsck and smartctl are usually used when something bad happens on your disk. But, what if such tools have a problem and also need to be fixed? Well, that’s what we are going to see today.

  [...]

  An astute reader would think that we can get wrong mount points too, like a bind mount that points to a directory within our desired mount point. This was fixed by the commit mentioned in a previous post.

  [...]

  The package btrfs-progs v5.10 already contains the fixes pointed in this post, so make sure to upgrade your package in order to have a working logical-resolve.

• Graphics Stack

  • Gallium Nine Still Seeing Improvements In 2021 For Direct3D 9 Within Mesa – Phoronix

    While VKD3D has been receiving much attention these days for implementing Direct3D 9/10/11 atop the Vulkan API that can be consumed in a driver agnostic manner, Gallium Nine as a D3D9 state tracker going back years for Mesa continues to receive new work too.

Applications

• Best Free and Open Source Alternatives to Google Maps

  Google has a firm grip on the desktop. Their products and services are ubiquitous. Don’t get us wrong, we’re long-standing admirers of many of Google’s products and services. They are often high quality, easy to use, and ‘free’, but there can be downsides of over-reliance on a specific company. For example, there are concerns about their privacy policies, business practices, and an almost insatiable desire to control all of our data, all of the time.

  What if you are looking to move away from Google and embark on a new world of online freedom, where you are not constantly tracked, monetised and attached to Google’s ecosystem.

  In this series, we explore how you can migrate from Google without missing out on anything. We’ll recommend open source solutions.

Instructionals/Technical

• Kushal Das: Get a TLS certificate for your onion service

  For a long time, I wanted to have a certificate for the onion address of my blog. Digicert was the only CA who was providing those certificates with an Extended Validation. Those are costly and suitable for an organization to get, but not for me personally, especially due to the cost.

• How To Install Nano Text Editor on CentOS 8 – idroot

  In this tutorial, we will show you how to install Nano Text Editor on CentOS 8. For those of you who didn’t know, Nano comes with many powerful features and allows you to edit and create various files on your computer or server. It includes all the basic functionality same as other text editors such as UTF-8 encoding, syntax highlighting, search and replace with regular expression support, multiple buffers, spellchecking, and more.

  This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you through the step-by-step installation of the Nano Text Editor on CentOS 8.

• How to Install Terraform in Linux Distributions

  Terraform is a popular cloud orchestration tool in the world of automation, which is used to deploy your infrastructure through the IAC (Infrastructure as code) approach. Terraform is built by Hashicorp and released under Mozilla Public License. It supports public, private as well as hybrid cloud, as of now Terraform supports 145 providers, which includes popular providers like AWS, Azure cloud, GCP, Oracle cloud, and many others.

  Terraform architecture is very simple. All you need is to download the terraform binary to your local/server machine which is going to act as your base machine. We have to mention the provider to work within our syntax file. Terraform will download the plugin for that particular provider automatically and will authenticate with provider API to execute the plan.

Games

• PS2 Emulation Gets Even Nicer With Custom Textures

  PCSX2 has long been a fantastic PS2 emulator, but a recent advance has made it all the more appealing for anyone playing on a PC: the ability to swap textures in games.

  While the famous Dolphin emulator for the GameCube has long supported this feature, PCSX2 has only just brought it in, and it’ll allow modders to improve any kind of texture they want in an old PS2 game. In the example video below by someother1ne, we can see everything from the road in Gran Turismo to the helmets and jerseys in NFL2K5 get swapped out.

• Valve Finally Makes Steam Link Available for Linux Gamers To Stream Games

  In case you didn’t know, Steam Link was initially a hardware-based solution to let you stream the games that you own in your Steam library from your PC.

  The tech was completely sold out and discontinued in November 2018. Right after that, it was pitched in as a software solution that supported mobile devices and Raspberry Pi to let you stream the game on them from your PC via your home network.

  The list of supported devices includes iPhone, Android TVs, Android phones, Samsung Smart TVs, and Raspberry Pi 3.

Distributions

• BSD

  • OpenSSH 8.5

    OpenSSH 8.5 was released on 2021-03-03. It is available from the
    mirrors listed at https://www.openssh.com/.
    
    OpenSSH is a 100% complete SSH protocol 2.0 implementation and
    includes sftp client and server support.
    
    Once again, we would like to thank the OpenSSH community for their
    continued support of the project, especially those who contributed
    code or patches, reported bugs, tested snapshots or donated to the
    project. More information on donations may be found at:
    
    https://www.openssh.com/donations.html
    
    Future deprecation notice
    =========================
    
    It is now possible[1] to perform chosen-prefix attacks against the
    SHA-1 algorithm for less than USD$50K.
    
    In the SSH protocol, the "ssh-rsa" signature scheme uses the SHA-1
    hash algorithm in conjunction with the RSA public key algorithm.
    OpenSSH will disable this signature scheme by default in the near
    future.
    
    Note that the deactivation of "ssh-rsa" signatures does not necessarily
    require cessation of use for RSA keys. In the SSH protocol, keys may be
    capable of signing using multiple algorithms. In particular, "ssh-rsa"
    keys are capable of signing using "rsa-sha2-256" (RSA/SHA256),
    "rsa-sha2-512" (RSA/SHA512) and "ssh-rsa" (RSA/SHA1). Only the last of
    these is being turned off by default.
    
    This algorithm is unfortunately still used widely despite the
    existence of better alternatives, being the only remaining public key
    signature algorithm specified by the original SSH RFCs that is still
    enabled by default.
    
    The better alternatives include:
    
     * The RFC8332 RSA SHA-2 signature algorithms rsa-sha2-256/512. These
       algorithms have the advantage of using the same key type as
       "ssh-rsa" but use the safe SHA-2 hash algorithms. These have been
       supported since OpenSSH 7.2 and are already used by default if the
       client and server support them.
    
     * The RFC8709 ssh-ed25519 signature algorithm. It has been supported
       in OpenSSH since release 6.5.
    
     * The RFC5656 ECDSA algorithms: ecdsa-sha2-nistp256/384/521. These
       have been supported by OpenSSH since release 5.7.
    
    To check whether a server is using the weak ssh-rsa public key
    algorithm, for host authentication, try to connect to it after
    removing the ssh-rsa algorithm from ssh(1)'s allowed list:
    
        ssh -oHostKeyAlgorithms=-ssh-rsa user@host
    
    If the host key verification fails and no other supported host key
    types are available, the server software on that host should be
    upgraded.
    
    This release enables the UpdateHostKeys option by default to assist
    the client by automatically migrating to better algorithms.
    
    [1] "SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and
        Application to the PGP Web of Trust" Leurent, G and Peyrin, T
        (2020) https://eprint.iacr.org/2020/014.pdf
    
    Security
    ========
    
     * ssh-agent(1): fixed a double-free memory corruption that was
       introduced in OpenSSH 8.2 . We treat all such memory faults as
       potentially exploitable. This bug could be reached by an attacker
       with access to the agent socket.
    
       On modern operating systems where the OS can provide information
       about the user identity connected to a socket, OpenSSH ssh-agent
       and sshd limit agent socket access only to the originating user
       and root. Additional mitigation may be afforded by the system's
       malloc(3)/free(3) implementation, if it detects double-free
       conditions.
    
       The most likely scenario for exploitation is a user forwarding an
       agent either to an account shared with a malicious user or to a
       host with an attacker holding root access.
    
     * Portable sshd(8): Prevent excessively long username going to PAM.
       This is a mitigation for a buffer overflow in Solaris' PAM username
       handling (CVE-2020-14871), and is only enabled for Sun-derived PAM
       implementations.  This is not a problem in sshd itself, it only
       prevents sshd from being used as a vector to attack Solaris' PAM.
       It does not prevent the bug in PAM from being exploited via some
       other PAM application. GHPR#212
    
    
    Potentially-incompatible changes
    ================================
    
    This release includes a number of changes that may affect existing
    configurations:
    
     * ssh(1), sshd(8): this release changes the first-preference signature
       algorithm from ECDSA to ED25519.
    
     * ssh(1), sshd(8): set the TOS/DSCP specified in the configuration
       for interactive use prior to TCP connect. The connection phase of
       the SSH session is time-sensitive and often explicitly interactive.
       The ultimate interactive/bulk TOS/DSCP will be set after
       authentication completes.
    
     * ssh(1), sshd(8): remove the pre-standardization cipher
       rijndael-cbc@lysator.liu.se. It is an alias for aes256-cbc before
       it was standardized in RFC4253 (2006), has been deprecated and
       disabled by default since OpenSSH 7.2 (2016) and was only briefly
       documented in ssh.1 in 2001.
    
     * ssh(1), sshd(8): update/replace the experimental post-quantum
       hybrid key exchange method based on Streamlined NTRU Prime coupled
       with X25519.
    
       The previous sntrup4591761x25519-sha512@tinyssh.org method is
       replaced with sntrup761x25519-sha512@openssh.com. Per its
       designers, the sntrup4591761 algorithm was superseded almost two
       years ago by sntrup761.
    
       (note this both the updated method and the one that it replaced are
       disabled by default)
    
     * ssh(1): disable CheckHostIP by default. It provides insignificant
       benefits while making key rotation significantly more difficult,
       especially for hosts behind IP-based load-balancers.
    
    Changes since OpenSSH 8.4
    =========================
    
    New features
    ------------
    
     * ssh(1): this release enables UpdateHostkeys by default subject to
       some conservative preconditions:
        - The key was matched in the UserKnownHostsFile (and not in the
          GlobalKnownHostsFile).
        - The same key does not exist under another name.
        - A certificate host key is not in use.
        - known_hosts contains no matching wildcard hostname pattern.
        - VerifyHostKeyDNS is not enabled.
        - The default UserKnownHostsFile is in use.
    
       We expect some of these conditions will be modified or relaxed in
       future.
    
     * ssh(1), sshd(8): add a new LogVerbose configuration directive for
       that allows forcing maximum debug logging by file/function/line
       pattern-lists.
    
     * ssh(1): when prompting the user to accept a new hostkey, display
       any other host names/addresses already associated with the key.
    
     * ssh(1): allow UserKnownHostsFile=none to indicate that no
       known_hosts file should be used to identify host keys.
    
     * ssh(1): add a ssh_config KnownHostsCommand option that allows the
       client to obtain known_hosts data from a command in addition to
       the usual files.
    
     * ssh(1): add a ssh_config PermitRemoteOpen option that allows the
       client to restrict the destination when RemoteForward is used
       with SOCKS.
    
     * ssh(1): for FIDO keys, if a signature operation fails with a
       "incorrect PIN" reason and no PIN was initially requested from the
       user, then request a PIN and retry the operation. This supports
       some biometric devices that fall back to requiring PIN when reading
       of the biometric failed, and devices that require PINs for all
       hosted credentials.
    
     * sshd(8): implement client address-based rate-limiting via new
       sshd_config(5) PerSourceMaxStartups and PerSourceNetBlockSize
       directives that provide more fine-grained control on a per-origin
       address basis than the global MaxStartups limit.
    
    Bugfixes
    --------
    
     * ssh(1): Prefix keyboard interactive prompts with "(user@host)" to
       make it easier to determine which connection they are associated
       with in cases like scp -3, ProxyJump, etc. bz#3224
    
     * sshd(8): fix sshd_config SetEnv directives located inside Match
       blocks. GHPR#201
    
     * ssh(1): when requesting a FIDO token touch on stderr, inform the
       user once the touch has been recorded.
    
     * ssh(1): prevent integer overflow when ridiculously large
       ConnectTimeout values are specified, capping the effective value
       (for most platforms) at 24 days. bz#3229
    
     * ssh(1): consider the ECDSA key subtype when ordering host key
       algorithms in the client.
    
     * ssh(1), sshd(8): rename the PubkeyAcceptedKeyTypes keyword to
       PubkeyAcceptedAlgorithms. The previous name incorrectly suggested
       that it control allowed key algorithms, when this option actually
       specifies the signature algorithms that are accepted. The previous
       name remains available as an alias. bz#3253
    
     * ssh(1), sshd(8): similarly, rename HostbasedKeyTypes (ssh) and
       HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms.
    
     * sftp-server(8): add missing lsetstat@openssh.com documentation
       and advertisement in the server's SSH2_FXP_VERSION hello packet.
    
     * ssh(1), sshd(8): more strictly enforce KEX state-machine by
       banning packet types once they are received. Fixes memleak caused
       by duplicate SSH2_MSG_KEX_DH_GEX_REQUEST (oss-fuzz #30078).
    
     * sftp(1): allow the full range of UIDs/GIDs for chown/chgrp on 32bit
       platforms instead of being limited by LONG_MAX. bz#3206
    
     * Minor man page fixes (capitalization, commas, etc.) bz#3223
    
     * sftp(1): when doing an sftp recursive upload or download of a
       read-only directory, ensure that the directory is created with
       write and execute permissions in the interim so that the transfer
       can actually complete, then set the directory permission as the
       final step. bz#3222
    
     * ssh-keygen(1): document the -Z, check the validity of its argument
       earlier and provide a better error message if it's not correct.
       bz#2879
    
     * ssh(1): ignore comments at the end of config lines in ssh_config,
       similar to what we already do for sshd_config. bz#2320
    
     * sshd_config(5): mention that DisableForwarding is valid in a
       sshd_config Match block. bz3239
    
     * sftp(1): fix incorrect sorting of "ls -ltr" under some
       circumstances. bz3248.
    
     * ssh(1), sshd(8): fix potential integer truncation of (unlikely)
       timeout values. bz#3250
    
     * ssh(1): make hostbased authentication send the signature algorithm
       in its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type.
       This make HostbasedAcceptedAlgorithms do what it is supposed to -
       filter on signature algorithm and not key type.
    
    Portability
    -----------
    
     * sshd(8): add a number of platform-specific syscalls to the Linux
       seccomp-bpf sandbox. bz#3232 bz#3260
    
     * sshd(8): remove debug message from sigchld handler that could cause
       deadlock on some platforms. bz#3259
    
     * Sync contrib/ssh-copy-id with upstream.
    
     * unittests: add a hostname function for systems that don't have it.
       Some systems don't have a hostname command (it's not required by
       POSIX). The do have uname -n (which is), but not all of those have
       it report the FQDN.
    
    Checksums:
    ==========
    
     - SHA1 (openssh-8.5.tar.gz) = 04cae43c389fb411227c01219e4eb46e3113f34e
     - SHA256 (openssh-8.5.tar.gz) = 5qB2CgzNG4io4DmChTjHgCWqRWvEOvCKJskLdJCz+SU=
    
     - SHA1 (openssh-8.5p1.tar.gz) = 72eadcbe313b07b1dd3b693e41d3cd56d354e24e
     - SHA256 (openssh-8.5p1.tar.gz) = 9S8/QdQpqpkY44zyAK8iXM3Y5m8FLaVyhwyJc3ZG7CU=
    
    Please note that the SHA256 signatures are base64 encoded and not
    hexadecimal (which is the default for most checksum tools). The PGP
    key used to sign the releases is available from the mirror sites:
    
    https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc
    
    Please note that the OpenPGP key used to sign releases has been
    rotated for this release. The new key has been signed by the previous
    key to provide continuity.
    
    Reporting Bugs:
    ===============
    
    - Please read https://www.openssh.com/report.html
      Security bugs should be reported directly to openssh@openssh.com
    

• Slackware Family

  • Absolute64-20210302 released

    Based on Slackware64-current.
    Slack recompiled everything due to gcc update…
    Stuff that I did NOT recompile still works, go figure.
    SpaceFM and ROX-Filer (arox) get me occassional complaints
    due to their age/ lack of updating…
    but they work for me and I still don’t even use gvfs or udisks,
    like a default Slackware install.
    [But Slackware still resists systemd, YEAH!]

    Pulled Kodi and GMT from the installer –
    Kodi I never use, so timely updating becomes an issue.
    GMT (generic mapping tools), no one besides me ever uses.
    These ommissions trimmed the ISO filesize a bit.
    Still a lot of development libraries included
    so the download is not small.
    But remember, although the distro has lots of files — it runs lite

• Canonical/Ubuntu Family

  • Friendly Reminder From The Linux Mint Team: Update Your Computer (And Teach Others How)

    Clem from the Linux Mint team issued a reminder that we should all update our computers last month. It is good advice because “Security updates are very important”. We can add that you should teach friends and family how to update their system if you install GNU/Linux on their machines, and the Linux community needs to make upgrades between major versions of GNU/Linux distributions a whole lot easier.

    [...]

    The Linux-focused TV channel Linux Lounge recently brought up a good point in a recent video: The assumption that GNU/Linux users know how to maintain and update their computer systems may be wrong. Quite a few of us have installed a user-friendly GNU/Linux distribution on a family-members computer and said “Good luck” with the assumption the machine will remain safe and secure and free from computer-viruses forever.

    The recent blog post from the Linux Mint team titled “Update your computer!” reminds us that there are a lot of Linux users out there who stick with outdated GNU/Linux distributions for years after they are reach their End-Of-Life and security updates, and other updates, stop coming. Those people are probably running even older software, they are probably not the types of people who kept their distribution up-to-date when it did get regular updates. Some are probably running the exact same base system they got when they originally installed their GNU/Linux distribution.

Devices/Embedded

• Host your website with dynamic content and a database on a Raspberry Pi | Opensource.com

  Raspberry Pi’s single-board machines have set the mark for cheap, real-world computing. With its model 4, the Raspberry Pi can host web applications with a production-grade web server, a transactional database system, and dynamic content through scripting. This article explains the installation and configuration details with a full code example. Welcome to web applications hosted on a very lightweight computer.

  [...]

  The client could be a browser, a utility such as curl, or a hand-crafted program fluent in HTTP. Communications between the client and Nginx occur through HTTP, but then uwsgi takes over as a binary-transport protocol between Nginx and the application server, which interacts with request-handling code such as requestHandler.py (described below). This architecture delivers a clean division of labor. Nginx alone manages the client, and only the request-handling code interacts with the database. In turn, the application server separates the web server from the programmer-written code, which has a high-level API to read and write HTTP messages delivered over uwsgi.

  I’ll examine these architectural pieces and cover the steps for installing, configuring, and using uwsgi and Nginx in the next sections.

• François Marier: Creating a Kodi media PC using a Raspberry Pi 4

  Here’s how I set up a media PC using Kodi (formerly XMBC) and a Raspberry Pi 4.

• Make an animated sign with Raspberry Pi Pico

• Open Hardware/Modding

  • Arduino IDE 2.0 beta released with live debugger, revamped user interface

    Arduino programming language and the Arduino IDE are the most popular software development tools for the makers market, but it lacks some of the features found in professional tools like autocompletion and the ability to add breakpoints via a debugger, and that’s why the company announced its work on the Arduino Pro IDE in 2019. Work is now nearing completion with the release of the beta version of the Arduino IDE 2.0 based on the Eclipse Theia framework.

• Mobile Systems/Mobile Applications

  • 4 main Android 12 features you can look forward to trying – CNET

  • Android 12 Developer Preview: Requirements, How to install and more

  • TCL 10 Pro Android 11 update released – Ausdroid

  • Samsung Galaxy Tab S6 gets Android 11 update with One UI 3.1 – GSMArena.com news

  • Xiaomi Mi 11 Review: A Powerful Rival To Top Android Flagships – Tech

  • Realme GT confirmed to ship with Android 11-based Realme UI 2.0 custom skin | 91mobiles.com

  • realme RMX3203 certified by FCC as a 4G smartphone running Android 11 – Gizmochina

  • Top 9 Best File Manager Android Apps – 2021

  • 10 Best Xbox Games With Android And Cloud Touch Control Support

  • Best Android apps that help you fall asleep

  • Play Console adds comparative benchmarks for Android devs – 9to5Google

  • Google Duo on Android using ‘Lyra’ to run on 2G connections – 9to5Google

  • Who needs Android? Huawei reveals impressive news that’ll have Google worried | Express.co.uk

  • How to use the Android Messages Schedule Send feature – TechRepublic

Free, Libre, and Open Source Software

• Web Browsers

  • The small web is beautiful

    About fifteen years ago, I read E. F. Schumacher’s Small is Beautiful and, despite not being interested in economics, I was moved by its message. Perhaps even more, I loved the terse poetry of the book’s title – it resonated with my frugal upbringing and my own aesthetic.

    I think it’s time for a version of that book about technology, with a chapter on web development: The Small Web is Beautiful: A Study of Web Development as if People Mattered. Until someone writes that, this essay will have to do.

    There are two aspects of this: first, small teams and companies. I’m not going to talk much about that here, but Basecamp and many others have. What I’m going to focus on in this essay is small websites and architectures.

• Programming/Development

  • How to Deploy a Node.js App – From Server Setup to Production

    In this tutorial, we are going to learn everything we need to know before deploying a Node app to a production server.

    We will start by renting a server on Digital Ocean. Then we’ll configure this server, connect to it, install Nginx and configure it, pull or create our Node app, and run it as a process.

    As you can see, there is a lot to do and it will be an action-packed tutorial. So let’s get started without wasting any time.

  • React Tutorial – Learn React and JavaScript Programming Basics with Example Code

    React is an open-source JavaScript library that helps you build user interfaces. It’s a component-based, declarative, “learn once and write anywhere” tool.

  • How to Build a Solid To-Do App with React

    In this tutorial you will learn how to create a basic Solid to-do app. But what is Solid – not to be confused with SOLID? Well, it’s a set of conventions and tools used to build decentralized apps.

    So what do I mean by decentralized? Currently, all our data is centralized in a few web platforms: Facebook, Google, and others. This has various consequences for privacy that we’re all aware of, but it also endangers the principle of universality of the web: the web must be accessible to everyone.

  • Working with RESTful Web Services in JavaScript – Creating your First Web Service

    Some developers consider themselves to be server-side specialists, while others focus most of their efforts on client-side coding. The departments of IT shops often reflect those tendencies. However, that need not be the case. Thanks to the emergence of technologies like Node.js, you can write both the server and client components using essentially the same language. In this series on RESTful Web services we’ll cover how to to do it all using JavaScript. Today’s installment will focus on setting up a basic Web service using Node.js and the Express framework.

  • How to Install R Programming Language Tools on Linux Mint 20

    By following today’s tutorial, you will be able to install the “R” programming language on your Linux Mint 20 system instantly. However, as soon as you feel like you do not want to work with this language anymore, you can conveniently uninstall it from your system to free up your resources.

  • Golang

    • Using Delve to debug Go programs on Red Hat Enterprise Linux – Red Hat Developer

      Delve is now available on Red Hat Enterprise Linux (RHEL). Starting in the RHEL 8.2 and devtools-2020.2 releases, the Go language debugger Delve will be installed with the Go toolchain itself via the go-toolset package.

      Being tailored specifically for Go, Delve has intricate knowledge of the Go runtime and provides features and an environment not available in other debuggers. The tool aims for simplicity of use, staying out of your way as you figure out what’s going wrong with your program. Delve also offers powerful features that let you debug your Go programs as quickly as possible.

  • Python

    • Python’s datetime Module – How to Handle Dates in Python

      In this quick guide to Python’s datetime module, you’ll learn how to parse dates, extract meaningful information from dates, handle timedelta objects and much more.

      So without further ado let’s start counting time with Python!

      Most programming languages provide libraries for easy handling of dates. Python offers the powerful datetime module with its many functions and lucid documentation which makes parsing dates easy.

  • Shell/Bash/Zsh/Ksh

    • Elegant bash conditionals

      The if-statement is a very basic thing, not just in bash, but in all of programming. I see them used quite a lot in shell scripts, even though in many cases they can be replaced with something much more elegant.

      In this rather short article, I’ll show how control operators can be used instead. Many probably know about this, but don’t realize how to use them nicely. This will help you write cleaner shell scripts in the future.

    • How to write a function in bash

      When you are writing a complex bash script (or any complex program for that matter), subdividing the functional logic of the script in smaller modules and writing/testing each module is often an effective coding strategy. A modularized bash script not only makes the script easier to understand, but also makes individual modules re-usable. In bash, such modular programming is achieved with bash functions.

      Even if you have little coding experience, you are probably familiar with the notion of a function in programming. A function is basically a self-contained block of code that performs a specific task via well-defined input/output interfaces. Let’s find out how a bash function is written and how to use a function in bash. This bash tutorial will specifically cover how to create a bash function, how to pass arguments to a bash function, how to call a bash function, how to return a bash function, etc.

  • Rust

    • 5 signs you might be a Rust programmer

      I’m a fairly recent convert to Rust, which I started to learn around the end of April 2020. But, like many converts, I’m an enthusiastic evangelist. I’m also not a very good Rustacean, truth be told, in that my coding style isn’t great, and I don’t write particularly idiomatic Rust. I suspect this is partly because I never really finished learning Rust before diving in and writing quite a lot of code (some of which is coming back to haunt me) and partly because I’m just not that good a programmer.

      But I love Rust, and so should you. It’s friendly—well, more friendly than C or C++; it’s ready for low-level systems tasks—more so than Python, it’s well-structured—more than Perl; and, best of all, it’s completely open source from the design level up—much more than Java, for instance.

      Despite my lack of expertise, I noticed a few things that I suspect are common to many Rust enthusiasts and programmers. If you say “yes” to the following five signs (the first of which was sparked by some exciting recent news), you, too, might be a Rust programmer.

Standards/Consortia

• What Every Developer Must Know About Encoding and Unicode

  If you are coding an international app that uses multiple languages, you’ll need to know about encoding. Or even if you’re just curious how words end up on your screen – yep, that’s encoding, too.

  I’ll explain a brief history of encoding in this article (and I’ll discuss how little standardisation there was) and then I’ll talk about what we use now. I’ll also cover some Computer Science theory you need to understand.

Science

• A materials science approach to combating coronavirus

  Researchers at Tokyo Institute of Technology working in collaboration with colleagues at the Kanagawa Institute of Industrial Science and Technology and Nara Medical University in Japan have succeeded in preparing a material called cerium molybdate (γ-Ce2Mo3O13 or CMO), which exhibits high antiviral activity against coronavirus.

  The ongoing coronavirus pandemic has highlighted the urgency not only of vaccine development and rollout but also of developing innovative materials and technologies with antiviral properties that could play a vital role in helping to contain the spread of the virus.

  Conventional inorganic antimicrobial materials are often prepared with metals such as copper or photocatalysts such as titanium dioxide. However, metal-based materials can be prone to corrosion, and the effects of photocatalysts are usually limited under dark conditions.

  Now, a research team led by Akira Nakajima of Tokyo Institute of Technology’s Department of Materials Science and Engineering proposes a new type of an antiviral material that can overcome these drawbacks. The team successfully combined a relatively low-cost rare earth element cerium (Ce) with molybdenum (Mo), which is well known for its antibacterial effects, to prepare two types of cerium molybdate (Ce2Mo3O12 and γ-Ce2Mo3O13) in powder form.

  Both powders exhibited antiviral activity against bacteriophage Φ6. Notably, γ-Ce2Mo3O13 also exhibited high antiviral activity against SARS-CoV-2, the virus that causes COVID-19.

Health/Nutrition

• The US Reaches 500,000 Deaths From the Coronavirus

• ‘It’s Like Nobody Cares’: After Two Weeks Without Running Water, Jackson, Miss. Pleads for Help

  “Water is a basic necessity and it just brought a lot of frustration, anger, and disappointment,” said one of the city’s residents. “If you don’t know when it’s coming back, what is being done to help us?”

• Black People Face Higher COVID Infections & Deaths. Should They Have Lower Age Cutoffs for Vaccines?

  As the U.S. vaccine rollout continues to expand, health justice advocates worry about a racial gap in vaccinations. Black communities have been hard hit by the pandemic, but rates of vaccination in communities of color lag behind largely white communities across the country. Dr. Oni Blackstock, a primary care and HIV physician, argues that age cutoffs should be lowered or removed for Black people in order to speed up inoculations, noting that Black Americans are twice as likely to die from COVID-19 as white Americans and also dying at rates similar to those of white Americans who are 10 years older. “These fixed-age cutoffs that most states implemented did not take into account structural racism’s toll on Black life expectancy in addition to the impact of the pandemic on the life expectancy of Black people in this country,” says Dr. Blackstock.

Integrity/Availability

• Proprietary

  • Epic Games is buying Fall Guys creator Mediatonic

    According to the blog posts and FAQs detailing the announcement, Fall Guys will remain available on Steam for the time being, and the developer is still bringing the game to both the Xbox and Nintendo Switch platforms. Epic and Mediatonic say there are no plans right now to make the game (which currently costs $19.99) free-to-play, as Epic did with Rocket League. Epic later confirmed it plans to make the PC version of Fall Guys available on the Epic Game Store.

  • You Can Now Install Official Evernote Client on Ubuntu and Debian-based Linux Distributions

    Evernote is a popular note-taking application. It was a revolutionary product at the time of its launch. Since then, there have been several such application that allow you to save web clippings, notes etc into notebook formats.

    For years, the desktop client of Evernote was not available for Linux. Evernote promised a Linux application some time ago and its beta version is finally available for Ubuntu-based distributions.

  • Four zero-day exploits used to attack Microsoft Exchange Server

    It said the four vulnerabilities being exploited — CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 — had all been patched on Tuesday US time. The announcement and fixes came a week ahead of the company’s regular monthly updates.

  • Last Week on My Mac: Users are losing out against Big Sur’s sealed System

    Big Sur’s sealed System volume seemed like a good idea. Although the read-only version in Catalina may look impregnable, guaranteeing integrity using a Merkle Tree of hashes, then locking the whole lot in a snapshot, looks even more robust. Like other good engineering ideas, though, it also needs thinking through thoroughly.

  • How long before grid attacks become the new normal?

    In the news roundup, David Kris digs into rumors that Chinese malware attacks may have caused a blackout in India at a time when military conflict was flaring on the two nation’s Himalayan border. This leads us to Russia’s targeting of the U.S. grid and to uneasy speculation on how well our regulatory regime is adapted to preventing successful grid attacks.

  • Security

    • Biggest Data Breaches of 2020 – and What Developers Should Learn From Them

      2020 was not a good year for hacks, data breaches, and other cyber-attacks. As far as those things go, it was among the worst years on record.

      Businesses far and wide experienced some of the most damaging and embarrassing hacks imaginable last year. And some of the incidents led to serious security failures that could end up having grave international implications.

      But despite all of the problems, some of 2020′s hacks can yield valuable lessons for programmers and software engineers to help them to harden their products against future attacks.

    • SQL Injection Tutorial – What is SQL Injection and How to Prevent it

      SQL injection is when you insert or inject a SQL query via input data from the client to the application.

      Successful attacks allow an attacker to access sensitive data from the database, modify database data, potentially shut the database down or issue other admin commands, recover the contents of files, and occasionally issue commands to the operating system.

      This type of attack is relatively easy to detect and exploit, so it’s particularly important that any vulnerable systems are quickly remediated.

    • Privacy/Surveillance

      • Privacy Talks | Interview with Robin Wilton from Internet Society

        This interview originally aired on August 28th, 2020.

      • Officials in Baltimore and St. Louis Put the Brakes on Persistent Surveillance Systems Spy Planes

        From April to October of 2020, Baltimore residents were subjected to a panopticon-like system of surveillance facilitated by a partnership between the Baltimore Police Department and a privately-funded Ohio company called Persistent Surveillance Systems (PSS). During that period, for at least 40 hours a week, PSS flew surveillance aircraft over 32 square miles of the city, enabling police to identify specific individuals from the images captured by the planes. Although no planes had flown as part of the collaboration since late October—and the program was scheduled to end later this year—the program had become troubling enough that on February 3, the City’s spending board voted unanimously to terminate Baltimore’s contract with Ohio-based Persistent Surveillance Systems.

        Given the program’s problematic history and unimpressive efficacy, it may come as some surprise that on December 11, 2020, City of St. Louis Alderman Tom Oldenburg introduced legislation that would have forced the mayor, and comptroller, to enter into a contract with PSS closely replicating Baltimore’s spy plane program.

        With lobbyists for the privately-funded Persistent Surveillance Systems program padding campaign coffers, Alderman Oldenburg’s proposal was initially well received by the City’s Board of Alders. However, as EFF and local advocates—including the ACLU of Missouri and Electronic Frontier Alliance member Privacy Watch STL—worked to educate lawmakers and their constituents about the bill’s unconstitutionality, that support began to waver. While the bill narrowly cleared a preliminary vote in late January, by Feb. 4 the Rules Committee voted unanimously to issue a “Do Not Pass” recommendation.

      • Is this the future of Covid-19 vaccine passports: open source and based on the Ethereum blockchain?

        But as the article rightly points out: “The key moral and legal issues are not so much about reliability, as about the reliance decision makers will place upon the certificates.” Vaccine certificates might be perfectly implemented, but if politicians shy away from taking meaningful action based on them, they become simply an exercise in window-dressing. As technical implementations of vaccine passports start to arrive, it is vital that the ethical and legal issues are addressed too.

      • Judge approves $650M Facebook privacy lawsuit settlement

        A federal judge on Friday approved a $650 million settlement of a privacy lawsuit against Facebook for allegedly using photo face-tagging and other biometric data without the permission of its users.

        U.S. District Judge James Donato approved the deal in a class-action lawsuit that was filed in Illlinois in 2015. Nearly 1.6 million Facebook users in Illinois who submitted claims will be affected.

        Donato called it one of the largest settlements ever for a privacy violation.

      • Facebook privacy settlement approved: Nearly 1.6 million Illinois users will ‘expeditiously’ get at least $345

        The settlement class included about 6.9 million Facebook users in Illinois for whom the social network created and stored a face template after June 7, 2011. To qualify, Facebook users had to live in the state for at least six months over the last nine years.

        Nearly 1.6 million claim forms were filed by the Nov. 23 deadline, representing about 22% of eligible Illinois Facebook users.

        Out of the $650 million Facebook agreed to pay, Donato awarded $97.5 million in attorneys’ fees and about $915,000 in expenses. The court also awarded $5,000 to each of the three named plaintiffs in the lawsuit. The rest is to be distributed to all class members equally.

Defence/Aggression

• Biden Ran on Ending Forever Wars. He’s Already Undermining That Promise.

  According to President Biden, the air strikes he launched against Iran-backed militias in Syria on Feb. 25 were designed to send Iran a message: “You can’t act with impunity. Be careful.” But the strikes also sent a disturbing message to Americans: Barely a month into Biden’s presidency, the Middle East quagmire is already undermining his much-advertised commitment to a “foreign policy for the middle class” that will end “forever wars” and focus on “existential” threats such as climate change and on rebuilding America’s strength at home.

• The George Floyd Murder Was First Degree

  George Floyd’s family and attorney are pushing for a first-degree murder charge for Derek Chauvin. The difference between first and second-degree murder in the United States is premeditation. Brumley Law Firm wonders if 9 minutes of kneeling on someone’s neck could count as premeditated: “The argument could be made in this case that the defendant did premeditate the murder. Nearly nine minutes elapsed while the defendant knelt on the victim’s neck who repeatedly stated he couldn’t breathe and then became unresponsive. During this length of time the defendant had the opportunity to form the requisite intent to kill Mr. Floyd and then took time to consider his actions and then completed the act.”

  Crucially the first-degree murder charge does not necessarily need proof of a plan, only the passage of time. Ben Crump, the family’s lead attorney contends: “For Chauvin to leave his knee on George’s neck despite warnings and evidence that his life was in danger — and to continue that course for many minutes — demands a first-degree murder charge.” For attorney Antonio Romanucci the degree of proof lies in the fact that they knew their actions might cause death: “They are criminally liable because they knew what they were doing could lead to death.”

• Congressional hearing investigates role of cryptocurrencies in domestic terrorism financing

  The memo for the hearing described the topic at hand:

• The Turkish Drone War over Nagorno-Karabakh: Gamechanger for more unmanned armament?

• The Israeli Military Shot My Cousin—and the US Bears Part of the Blame

  January 1, 2021. My aunt Rasmiya Mohammad, 75, began her year with the news that her grandson, my cousin Harun Abu Aram, had been seriously wounded during an Israeli army raid in the Tiwani village in the South Hebron Hills. It was his birthday, and he was turning 24.

• Nigeria’s Boarding Schools Have Become a Hunting Ground for Kidnappers

  Each kidnapping seems to inspire another. The media coverage that erupts after every incident puts pressure on the government to win the release of the hostages.

  Governors in the north have come under heavy criticism for being unable to protect their citizens. But when hostages are liberated, the government sometimes capitalizes on the publicity. And corrupt government officials have also been accused of skimming portions of the ransom money, according to Nigerian analysts and media reports.

• Hundreds of Nigerian schoolgirls rescued days after kidnapping

  Hundreds of schoolgirls that were kidnapped at gunpoint in Nigeria have been rescued, authorities said.

  The 279 girls were abducted on Friday by armed men who raided their state-run school in Nigeria’s northwest Zamfara State, a high-ranking government official with knowledge of the incident told CNN.

  Yusuf Idris, a spokesman for the regional governor, said Tuesday the girls had been safely returned and were all accounted for. He did not comment when asked whether a ransom was paid for their release.

Transparency/Investigative Reporting

• Mayday: How the White Helmets and James Le Mesurier got pulled into a deadly battle for truth

  The British man behind the Syrian civil defence group, the White Helmets, found himself at the centre of a battle to control the narrative of the Syrian war. Russian and Syrian propagandists accused his teams of faking evidence of atrocities – and convinced some in the West. The battle for truth formed a backdrop to James Le Mesurier’s sudden death in Istanbul in November 2019.

Environment

• Weakening Gulf Stream may disrupt world weather

  The Gulf Stream is growing feebler, the Arctic seas are gaining fresh water. Together they could affect the world’s weather.

• Energy

  • New IEA Data Shows World on Path to Resume ‘Carbon-Intensive Business-as-Usual’

    Following warnings that the coronavirus-triggered drop in planet-warming emissions would be short-lived without structural changes, the International Energy Agency released data Tuesday showing that global CO2 emissions from the energy sector were 2 percent higher in December 2020 compared to the same month the previous year.

  • ‘The System Worked as Designed in Texas; That’s the Really Scary Thing’

    Janine Jackson: The winter energy crisis in Texas has led to a number of strange scenes, from frozen fish tanks and basements turned into skating rinks to officials claiming that the crisis—in which more than 4 million people were left without electricity or heat, some without water, during a frigid week, and those whose lights stayed on faced eye-popping bills—was caused by the state’s reliance on renewable energy sources. Or, in the words of Gov. Greg Abbott, that it “just shows that fossil fuel is necessary.” Even a critical article on the “disaster foretold” takes the time to spell out:

• Wildlife/Nature

  • Yellowstone Wasn’t Saved by Chance

    In the 1870s and ’80s, opportunists in and out of Congress wanted to open Yellowstone to commercial development, settlement and private ownership. Picture Lamar Valley with a railroad running through it, mansions on Specimen Ridge, and a ski resort on Mount Washburn. Imagine a golf resort in Hayden Valley.

    This is not so far-fetched. In the early 1880s The Yellowstone Park Improvement Company was granted the rights to develop 4,000 acres in the newly minted park, including Old Faithful, Mammoth Hot Springs and the Grand Canyon of the Yellowstone. They planned on building railroads and logging, mining, and cattle ranching in the Park.

  • Oregon’s Logging Industry Says It Can’t Afford New Taxes. But Prices Have Never Been Higher and Profits Are Soaring.

    Thirty years after Oregon lawmakers began giving the state’s timber industry tax cuts that cost rural counties an estimated $3 billion, industry lobbyists warned them not to follow through on efforts to reinstate the tax this year.

    Legislators are considering whether to add to taxes paid by the logging industry after an investigation published last year by Oregon Public Broadcasting, The Oregonian/OregonLive and ProPublica found that timber companies, increasingly dominated by Wall Street real estate trusts and investment funds, benefited from the tax cuts at the expense of rural counties struggling to provide basic government services.

Finance

• ‘We Should Be Taxing the Rich, Not the Unemployed’: Millions Set to Receive Surprise Bills for Pandemic Jobless Benefits

  Democrats are facing pressure to act fast to stave off an “easily avoidable political disaster.”

• Opinion | The Age of Social Murder

  The ruling elites, despite the accelerating and tangible ecological collapse, mollify us, either by meaningless gestures or denial.

• $15 an Hour Is the Compromise

  Economist Dean Baker reminds us that for the first 40 years after President Franklin Roosevelt signed the Fair Labor Standards Act in 1938, the national minimum wage “not only kept pace with inflation, it rose in step with productivity growth.”

• The Average American Pay Tax on Half of Their Wealth, Shouldn’t Rich Americans?

  We call this already existing levy the “property tax,” and almost all Americans feel its pinch — with one exception. The rich. America’s current “wealth tax” only taxes the category of wealth that makes up the bulk of the net worth of average Americans. The financial assets that make up the bulk of wealthy people’s net worth — stocks and bonds, for instance — face no wealth tax.

  Wealthy people, of course, like things this way. The rest of us should be aghast. How aghast? Let’s compare how our existing “wealth tax” treats the exceedingly rich and everybody else.

• Urging Senate to ‘Ignore the Parliamentarian,’ Sanders to Force Vote on $15 Minimum Wage Amendment

  “I regard it as absurd that the parliamentarian, a Senate staffer elected by no one, can prevent a wage increase for 32 million workers.”

• ‘Bad Policy and Bad Politics’: Manchin Is Trying to Cut Unemployment Benefits, Limit Survival Checks in Covid Relief Bill

  “Cutting UI from $400 to $300 or reducing checks will cause a full blown revolt from progressives.”

• Elizabeth Warren Unveils 2 Percent Wealth Tax on “Ultra-Millionaires”

• Congolese Whistleblowers, Who Allegedly Exposed Israeli Oligarch’s Efforts To Evade US Sanctions, Identify Themselves

  Israeli businessman Dan Gertler allegedly established a “money laundering network” designed to evade United States sanctions against him. He also was accused of using the network to “acquire new mining assets” in the Democratic Republic of the Congo.On February 26, two Congolese whistleblowers identified themselves as the source of these and other disclosures involving Afriland First Bank.“

  [...]

  Treasury officials asserted Gertler was granted a “special license” until 2022 because the U.S. had a “national security interest” in his Africa dealings, and Israeli Prime Minister Benjamin Netanyahu and other prominent Israelis backed the pressure campaign to remove sanctions.

AstroTurf/Lobbying/Politics

• Even Blue States Suppress Student Voters

  At the top of a small hill at the end of a dark, winding, and unlit path in Red Hook, N.Y., sits the only voting location for all of Bard College. For decades, the 750-square-foot building, called St. John’s Episcopal Church, has been the only place for those living on and around Bard’s campus to cast their vote in local, state, and national elections.

• Happy 90th Birthday, Mr. Gorbachev

  No individual made a more profound impact on world history in the second half of the 20th century than did Mikhail Gorbachev, the last leader of the Soviet Union. The celebration of his 90th birthday on March 2 is a time to reflect on the difference he made and to dispel misconceptions.

• VP Harris, Maybe You Were Elected for Such a Time as This

  In the biblical story of Queen Esther, a daughter of the exiled Hebrew people rose to power in the society of her day. When the survival of her people became a political issue before the King, Queen Esther’s Uncle Mordecai wrote on behalf of their marginalized community to suggest that God may have placed her in the position she was in for such a time as this. Queen Esther rose to the challenge and risked her position to save her people.

• The Afghanization of American Democracy?

  What could possibly go wrong with sweeping the 2020 election controversies under the rug? Clues can be found in a recent report, “Elections: Lessons from the U.S. Experience in Afghanistan,” produced by the Special Inspector General for Afghanistan Reconstruction (SIGAR). That report contains more wisdom than will be found in President Trump’s idiotic tweet in December: “A young military man working in Afghanistan told me that elections in Afghanistan are far more secure and much better run than the USA’s 2020 Election.”

  I have been thumping U.S. policy in Afghanistan for a dozen years in CounterPunch, including “Eight Years of Big Lies on Afghanistan” in 2009, “Dying to Corrupt Afghanistan” in 2011, “Obama’s Biggest Corruption Charade” in 2016, and “Your Tax Dollars Bankroll Afghan Child-Molesters” in 2018. Sad to say, this new report has shattered my final illusions on this U.S. rescue mission.

• As Manchin Yells He Will ‘Never…Jesus Christ!’ Vote to Kill Filibuster, Warren and Sanders Demand End to Archaic Rule

  “Moderate Democrats in the Senate have a choice to make: They can either defend democracy and the Constitution by passing H.R. 1 or they can save the McConnell filibuster. They can’t do both.”

• ‘You Do Love to See it’: Progressives Cheer Withdrawal of Neera Tanden’s OMB Nomination

  “The reason to celebrate the end of Neera Tanden’s nomination has nothing to do with her late-night out-of-control rage-tweeting and everything to do with her record.”

• Twitter hashtags trends should be treated as political ads, says EC panel; here’s why

  ‘Hashtag’ trends on Twitter may be treated as political advertisements during the election process and subjected to media certification and monitoring committee (MCMC) regulations of the Election Commission, an expert committee set up by Election Commission last year has recommended.

  The committee, in its interim report submitted to the poll panel in January, also called for the creation of a separate social media monitoring cell in the district election officer’s (DEO) office so that political ads on social media can be tracked during the elections, Times of India reported.

• Trump and Gab CEO accounts compromised during large-scale [crack] of alternative social media platform

  Distributed Denial of Secrets, a group similar to WikiLeaks, collected more than 70 gigabytes of data from the platform incorporating more than 40 million posts, according to Wired. The [cracker] who allegedly recouped Gab’s information goes by the identifier “JaXpArO and My Little Anonymous Revival Project.” DDOSecrets co-founder Emma Best said the [cracker] got into the backend database via a SQL injection vulnerability, allowing for a [cracker] to meddle with it.

• Twitter ups efforts to stop misinformation, labeling falsehoods related to COVID-19 vaccine

  At first, labels will be applied to tweets by Twitter’s team when they determine that the content violates the company’s policy. After a while, those assessments will be used to inform Twitter’s automated tools to label similar content across the social media platform.

• As Beijing’s power grows, can it shift meaning of ‘human rights’?

  Many observers think few participants will bow out. But that expectation points, in part, to China’s growing leverage on the international stage to push its own vision of human rights and block criticism of its record. Ultimately, experts say, Beijing is promoting a doctrine of non-interference that weakens global norms of human rights transparency and accountability.

  “China is attempting to reinterpret or at least change the balance of our thinking about what we mean by human rights,” says Rosemary Foot, a senior research fellow at the University of Oxford.

Censorship/Free Speech

• Techdirt Podcast Episode 272: Section 230 Matters, With Ron Wyden & Chris Cox

  Last week, we hosted Section 230 Matters, a virtual Techdirt fundraiser featuring a panel discussion with the two lawmakers who wrote the all-important text and got it passed 25 years ago: Chris Cox and Senator Ron Wyden. It was informative and entertaining, and for this week’s episode of the podcast, we’ve got the full audio of the panel discussion about the history, evolution, and present state of Section 230.

• State Court Says Tennessee’s Anti-SLAPP Law Is Constitutional, Shuts Down Litigant Involved In Baseless Libel Litigation

  Tennessee is filled with awful legislators. Fortunately, despite itself, the legislature passed an anti-SLAPP law that appears to finally be putting an end to ridiculous libel lawsuits in the state. Prior to this, residents and libel tourists were abusing the law to do things like silence legitimate criticism and — believe it or not — sue a journalist for things said by someone he interviewed.

• The Most Important Part Of The Facebook / Oversight Board Interaction Happened Last Week And Almost No One Cared

  The whole dynamic between Facebook and the Oversight Board has received lots of attention — with many people insisting that the Board’s lack of official power makes it effectively useless. The specifics, again, for most of you not deep in the weeds on this: Facebook has only agreed to be bound by the Oversight Board’s decisions on a very narrow set of issues: if a specific piece of content was taken down and the Oversight Board says it should have been left up. Beyond that, the Oversight Board can make recommendations on policy issues, but the companies doesn’t need to follow them. I think this is a legitimate criticism and concern, but it’s also a case where if Facebook itself actually does follow through on the policy recommendations, and everybody involved acts as if the Board has real power… then the norms around it might mean that it does have that power (at least until there’s a conflict, and you end up in the equivalent of a Constitutional crisis).

• Blasphemy suspect gets bail over four years after arrest

  The suspect’s counsel argued before the high court that his client had been languishing behind bars for the last four and a half years with no progress in the trial.

  The counsel said the forensic report proved that the alleged blasphemous post in a WhatsApp group had not been generated by the petitioner, who is now 20-years old.

• Nabeel Masih convicted of Blasphemy at 16 years is to be set free on bail thanks to BACA

  After close to three years in prison Nabeel Masih now 20 years old asked BACA to take over his case. He was devastated over his ongoing incarceration and was desperate to restart his life which he felt was slipping away every day that he remained in a cell. We begun to pursue his freedom via Lahore High Court and hired a Christian solicitor Naseeb Anjum to challenge for his freedom initial seeking bail before we began the longer proceeding for full acquittal. We reasoned that the quicker process of a bail application would enable Nabeel to be freed from his incarceration sooner, enabling him to tackle his suicidal depression and face the challenge of a long battle for exoneration in a position of strength.

  Though initially charges under lower blasphemy offences had been laid against Nabeel Masih, Pattoki Police were building a case for charges under 295/C that would enact a death sentence. Moreover, they were also establishing a list of cyber crimes against Nabeel Masih, an action which was perceived to be a safety net prosecution, should public and international pressure result in the dropping of blasphemy charges against Nabeel. Fortunately for Nabel Masih the additional charges were thrown out of court due to a lack of evidence and a stringent fight by our BACA appointed lawyer.

Freedom of Information/Freedom of the Press

• Reporters Without Borders Files Unprecedented Suit Against Saudis for Khashoggi Murder, Other ‘Crimes Against Humanity’

  “No one should be above international law, especially when crimes against humanity are at stake. The urgent need for justice is long overdue.”

• Lawyer reports secret witness in treason case against jailed journalist Ivan Safronov

  The treason case against former journalist and advisor to the head of Roscomos Ivan Safronov now includes a secret witness, his lawyer Ivan Pavlov reported on Tuesday, March 2. 

• Alexey Navalny’s lawyers challenge ruling in war veteran defamation trial

  Lawyers representing jailed opposition politician Alexey Navalny have filed an appeal against his sentence in the “war veteran defamation” case, reports the Russian state news agency TASS, citing spokespeople for Moscow’s Babushkinsky District Court. 

Civil Rights/Policing

• Planned Parenthood Returns to Rural Texas

  It was a frigid October morning in the West Texas city of Lubbock as Shelley Woodbridge drove carefully over the thick black ice that covered roads; the coldest day in months, by far. Woodbridge, a single mother, crisscrossed town to drop her three young kids off at different schools. Just before 11 am, she turned onto 22nd Place in the city’s Medical District, and thought about the periwinkle dress she had on—her favorite. “I shouldn’t have worn this today,” she thought. “What if someone throws blood on me?”

• ICE Is Also Using Utility Databases Run By Private Companies To Hunt Down Undocumented Immigrants

  ICE has always had a casual relationship with the Fourth Amendment. Since it’s in the business of tracking foreigners, it has apparently decided the rights traditionally extended to them haven’t actually been extended to them.

• Opinion | In Honduras and Across the World, Human Rights Defenders Continue To Be Killed With Impunity

  Five years after Berta Cáceres was murdered, governments are still failing to protect human rights defenders.

• ISIS and the UK: the Case of Shamima Begum

• Anti-Choice Forces Use Pandemic to Slash Abortion Access in Preview of Post-Roe v. Wade World

  We look at how people across the U.S. have struggled to access abortions during the pandemic with reporter Amy Littlefield, who says that even before the COVID-19 outbreak, many states had restrictions, including three-day waiting periods and counseling sessions filled with misinformation. Then, many tried to use the pandemic as a pretext for banning abortion as a nonessential service. “Texas, in the early weeks of the pandemic, sort of gave us a dress rehearsal for what it could look like when states try to ban abortion entirely,” says Littlefield. “We saw how half a century worth of attempts to whittle away at abortion access really collided with a deadly pandemic in a way that was just devastating.”

• Federal Court Affirms Travelers Have A First Amendment Right To Record TSA Screeners

  It’s pretty clearly established you have the right to record public servants as they perform their public duties. There are a few exceptions, but for the most part, if you’re not interfering with their work, record away. Public servants hate this, of course, but there’s not much they can do about it. Sure, they can try to use local laws to shut down recordings, but those efforts have routinely been rejected by federal courts.

• A Las Vegas Judge Approves $1.4 Million Payment to Wrongfully Convicted Man Who Served More Than Two Decades

  For the first time, Fred Steese walked into a Las Vegas courtroom on Monday without reason for trepidation. He was there to be awarded nearly $1.4 million by the state of Nevada for wrongfully convicting him of murder.

  “It’s a gigantic day,” Steese said in an interview afterward, noting how odd it felt after decades in which bad things happened to him in courtrooms.

• Hours After an Employee Accused Him of Sexual Misconduct, Prominent Alaska Executive Resigns

  A week ago, one of Alaska’s most powerful executives abruptly resigned from his job leading the largest tribal health organization in the state. Neither the outgoing president nor the group said why.

  Earlier in the day, his former assistant had delivered a scathing three-page letter to the Alaska Native Tribal Health Consortium that described a pattern of abusive behavior, harassment and coerced sexual encounters by President Andy Teuber, according to the document, obtained by the Anchorage Daily News and ProPublica.

• A New Form of Jim Crow: Ari Berman on the GOP’s Anti-Democratic Assault on Voting Rights

  The Republican-led House in Georgia has passed a sweeping bill to make it harder to vote, in a move aimed to prevent Democrats from winning future elections. The bill limits access to absentee ballots, limits weekend early voting hours and curbs ballot drop boxes, among other provisions. Across the U.S., Republican lawmakers have introduced more than 250 bills in 43 states aimed at restricting voting access. Ari Berman, author and reporter for Mother Jones, says Republicans are “breaking democracy” with their push to restrict voting. “The Republican Party has no interest in appealing to a majority of Americans. Instead, they are doubling down on anti-democratic tactics so they can get a minority of votes but wield a majority of power,” says Berman.

• Christian Mother in Uganda Hit with Acid for Her Faith, Sources Say

  “My husband began questioning me whether I had embraced Christianity,” Kyoleka told Morning Star News. “I kept quiet. He started beating me with sticks, and my 5-month-old began crying, and before the arrival of the neighbors, my husband had already poured acid on me, and I lost all consciousness.”

  Kyoleka regained consciousness in a hospital bed in Mbale. She had acid burns on the right side of her body from breast to thigh, including private parts, she said.

Internet Policy/Net Neutrality

• The New York Times (Falsely) Informs Its 7 Million Readers Net Neutrality Is ‘Pointless’

  Let’s be clear about something: the net neutrality fight has always really been about monopolization and a lack of broadband competition. Net neutrality violations, whether it’s wireless carriers blocking competing mobile payment services or an ISP blocking competing voice services, are just symptoms of a lack of competition. If we had meaningful competition in broadband, we wouldn’t need net neutrality rules because consumers would vote with their wallets and leave an ISP that behaved like an asshole.

Monopolies

• The Unasked Question In Tech Policy: Where Do We Get The Lawyers?

  When we criticize Internet regulations like the CCPA and GDPR, or lament the attempts to roll back Section 230, one of the points we almost always raise is how unduly expensive these policy decisions can be for innovators. Any law that increases the risk of legal trouble increases the need for lawyers, whose services rarely come cheap.

• FOSS Patents: Epic Games v. Apple App Store antitrust case: written order confirms May 3 trial date, further details of trial format

  Just like on Monday, it’s still unclear how many trial days will be required. Over the next 16 days, the parties will provide different versions of their witness lists to the court. The deadlines for those filings are March 12 (Epic’s tentative list), March 16 (Apple’s tentative list), March 18 (Epic’s supplemental list), and March 19 (either party’s consolidated list). There will be another pretrial conference on March 26, and I guess at that one the judge presiding over this landmark case–to me, the most important smartphone litigation ever, eclipsing even Apple v. Samsung and FTC v. Qualcomm–will indicate how many trial days are needed. On Monday, different numbers of weeks were tossed out as hypothetical possibilities. It’s hardly going to be shorter than three weeks, I guess.

  Trials in that district often have a rhythym that leaves one, two or even three days per week to the court for other matters. That is particularly the case when there are urgent criminal trials that must be held. In this case, however, Judge Gonzalez Rogers expects to be able to hear Epic Games v. Apple every day Monday through Friday.

  They’ll start early (at 8 AM and finish at 3:15 PM, giving her enough time in the afternoon for orders (related to this case and to others she’s presiding over). Considering the time zone from which I’ll be following the proceedings, this schedule makes it easy for me to listen to the entirety of the public proceedings.

• MIP International Patent Forum: How to overcome COVID career challenges[Ed: As if these patent zealots aren't already exploiting COVID to make a killing with patent monopolies...]

  This time last year it was hard to imagine that the 2021 Managing IP International Patent Forum would not take place in a London hotel complete with pastry and many opportunities for in-person networking.

  But with the pandemic forcing many events to move online, a virtual conference is the next best thing.

• Patents

  • Early Disclosures of Patent Filing Activities Related to COVID-19 [Ed: Building monopolies around COVID to rip off the public, deny the poor access to medicine (vaccines), and slow down research (it's all about money, not solving problems, at least to them)]

    As of February 2021, it is still too early to have a clear and complete view of how the COVID-19 health, economic, and social crisis has affected patent filing trends and how innovation specifically dedicated to cope with the present “new normal” situation is the object of patent protection. This pandemic has prompted patent offices to provide companies and investigators with a large number of new web-based services and dedicated policies to cope with logistical and financial problems related to IP operations, as reported in WIPO COVID-19 IP Policy Tracker. Moreover, many websites giving access to patent databases have established dedicated portals to foster research and access to information relevant for developing new technical solutions, such as the PatentScope COVID-19 Index or the patent datasets EPO patent examiners and data analysts have compiled and which can be accessed at the Fighting Coronavirus webpage. These and other patent information search tools may also be used to evaluate to what extent the examination and publication of COVID-19 related patent applications have been accelerated after their filing. This search allows identifying in which countries applicants have shown more interest in getting a patent granted (or at least disclosing own patent-related activities), due to their own perception of the potential financial and strategic importance.

    I have co-authored a study (Falciola L. and Barbieri M., ”Searching and Analysing Patent-Relevant Information for Evaluating COVID-19 Innovation”; posted on the SSRN website on 26 January 2021) on the major trends in scientific and patent publications during the first months as of COVID-19’s appearance. The analysis has been performed in patent databases and official registers of the major patent offices worldwide, using a standardized set of keywords, under three main dimensions: the claimed technologies, the type of patent proceedings, and the countries. The data extracted for the period January-August 2020 show that more than 1,000 patent documents explicitly mentioning the infectious agent (SARS-CoV-2) and/or the disease (COVID-19) were already filed and published. These documents concern products or technologies applicable in a range of domains, mainly in diagnostics and therapeutics but also body protection, disinfection, informatics and mechanical devices. It is interesting to compare the dates of some early 2020 events with the filing dates of the earliest published patent applications, which predate even the official WHO declaration of the COVID-19 pandemic. This is illustrated below.

  • Samsung asks federal court in Texas to throw out Ericsson’s FRAND claims: no subject-matter jurisdiction over foreign patents

    After a post on a Texas-size patent damages verdict in the Western District, we’re now hopping over to the traditional patent (troll) litigation hotspot, the Eastern District of Texas.

    In Judge Rodney Gilstrap’s court, Ericsson brought a FRAND action against Samsung in mid-December, not even knowing that the Korean electronics giant had pre-empted it by filing suit in China, and the Swedish former handset maker amended its Texas case in early January, right after the expiration of the previous cross-license agreement, by throwing in eight standard-essential patent (SEP) infringement claims. Yesterday (Tuesday, March 2) Samsung had to respond to Ericsson’s complaint.

    [...]

    That competitive situation between Samsung and Ericsson presumably complicates the patent licensing dispute. Ericsson would like to tax its competition. It asserts patents against everyone, but in the base station market, there’s a strategic aspect to it. It’s also possible that Samsung’s increasing success in the base station market makes some decision makers on Ericsson’s side even more determined to maximize the license fees it can siphon off.

    Let’s now look at Samsung’s above-mentioned motion to dismiss Ericsson’s FRAND claims, as this is related to the wider issue of extraterritoriality in patent litigation, a high-priority topic for this blog. Last week, Samsung filed the opening brief in its Federal Circuit appeal of Ericsson’s anti-antisuit injunction from Texas, and earlier this week, six law professors explained that the Chinese approach to antisuit injunctions is actually pretty consistent and–as far as I can see–perfectly compatible with U.S. antisuit injunction case law (Gallo and Unterweser). Samsung’s motion to dismiss is not based on the fact that Ericsson brought those claims in contravention of the Wuhan antisuit injunction, but on the lack of subject-matter jurisdiction even under Judge Gilstrap’s own case law…

  • U.S. v. Arthrex: Supreme Court Oral Argument [Ed: Patent zealots want to stop the quality assessment of USPTO fake patents; because they're patent profiteers who distort patent law and don't want accountability]

    The Supreme Court heard argument on Monday in U.S. v. Arthrex, involving the question of whether appointment of Administrative Patent Judges (APJs) and their authority under the Leahy-Smith America Invents Act violates the Appointments Clause of the Constitution. Both the Government and Smith & Nephew, who lost this argument below, opposed Arthrex in this regard. At argument, the U.S. Government was represented by Malcolm l. Stewart, Deputy Solicitor General, Department of Justice; Smith & Nephew was represented by Mark A. Perry; and Arthrex was represented by Jeffrey A. Lamken.

    The Government argued first; in what is clearly a procedural pattern, the Court permitted each advocate to make their argument in brief before the Chief Justice started the questioning. Deputy Solicitor General Steward began with reference to Edmond v. United States, where the Court held that Coast Guard Court of Criminal Appeals judges were inferior officers. Here, he argued, the USPTO Director’s supervisory powers exceed those in the Edmonds case. For example, the Director can “promulgate binding guidance concerning substantive patent law,” “designate particular board opinions as precedential,” “decide whether any particular review will be instituted and which judges will sit on the panel,” and “de-institute a review even after it has been commenced.” When included with the Director’s power to convene a new panel and overturn any decision against PTO policy, the DSG argued that “[t]aken together, the Director’s supervisory powers are fully sufficient to render administrative patent judges inferior officers.”

  • Wac(k)o record verdict: jury in Western District of Texas says Intel owes Softbank-owned patent troll $2.175 billion over two patents

    Texas has a reputation for being big and going big. With respect to patents, it’s unfortunately also notorious for going off the deep end at times–not all parts of the Lone Star State, but two of its federal districts. For a long time, the Eastern District was synonymous with patent troll-friendly pretrial rulings and juries. More recently, the Western District’s Waco division has put into evidence that nothing is ever so bad it couldn’t get worse.

    What happened in Waco yesterday is shocking for most of us while it’s precisely what patent trolls’ political friends like Senators Thom Tillis (R-N.C.) and Chris Coons (D-Del.) would like to see on a monthly if not weekly basis: the potential of money being sucked out of companies that make innovative products by those in the business of patent assertion.

    [...]

    The ’373 patent was found to be literally infringed; for the ’759 patent, the jury found an infringement under the doctrine of equivalents, and rejected Intel’s invalidity contentions.

    The judge was so eager to hold this trial that he conducted an in-person patent trial despite the COVID-19 pandemic.

    The verdict is the highest one ever in an information technology patent case. Only one patent damages verdict in U.S. history was larger; it was about a pharmaceutical patent and, as Professor Mark Lemley (Stanford) notes on Twitter, was “erased on appeal.”

    The verdict comes just a week before Intel and Apple will file their second amended complaint (i.e., “version 3.0″ in total) in their antitrust action against Fortress in the Northern District of California. Last year they already amended the complaint once, but the case has to be narrowed further.

• Copyrights

  • U.S. Navy is Liable for Mass Software Piracy, Appeals Court Rules

    The United States Navy is liable for a mass copyright infringement. The Court of Appeals for the Federal Circuit sided with the German software company Bitmanagement, which accused the Navy of copying software without permission. Bitmanagement claimed more than $500 million in damages, but the final amount has yet to be determined.

  • Games Publisher “Cracked & Pirated” ‘The Sinking City’, Developer Alleges

    Last week, Ukranian games developer Frogwares warned players not to buy the Steam version of its game The Sinking City, stating that it had not created it. In an announcement yesterday, Frogwares said that its own publisher, France-based Nacon, had “cracked and pirated” the game, uploaded it to Steam for profit, then tried to “cover up” the reporting trail.

  • Is Bill C-10 Unconstitutional? A Former Justice Senior General Counsel Makes the Case It Is

    Noting the lengthy CRTC hearing periods, I told the committee that the bill won’t provide new revenues for film and television production until the second half of the decade at the earliest. If a constitutional challenge is added to the mix, the timeline grows even longer. The bill has faced a rough ride at committee and the Palmer submission should give the committee further pause about the wisdom of moving forward without a significant overhaul.