Bonum Certa Men Certa

Links 12/07/2022: KDE Plasma 5.25.3 and Xorg Server Security Patches



  • GNU/Linux

    • Desktop/Laptop

      • LWNGarrett: Responsible stewardship of the UEFI secure boot ecosystem [Ed: LWN spin assistance; LWN fails to note that he's the culprit, whom we should be egging over this; narrative shifting, but see the comments]

        Matthew Garrett grumbles about an apparent Microsoft policy change making it harder to boot Linux on some systems.

      • LiliputingSlimbook Executive is a lightweight Linux laptop with Intel Core i7-12700H - Liliputing

        Spanish PC maker Slimbook’s latest Linux-friendly laptop is a thin and light model that packs a lot of horsepower into a compact chassis. The new Slimbook Executive comes with a choice of 14 or 16 inch high-resolution, 90 Hz displays and both models are powered by a 45-watt Intel Core i7-12700H processor. The larger model also features NVIDIA GeForce RTX 3050 Ti discrete graphics.

        The Slimbook Executive is available now for 1299 (about $1310) and up.

      • ElectropagesJoint venture unveils world’s first RISC-V laptop

        As RISC-V continues to push the boundaries of open-source computing, a joint venture between DeepComputing and Xcalibyte has developed the world’s first RISC-V laptop set to be released in September. Why is RISC-V’s popularity growing, what are the specs of the new laptop, and could this help push the use of Linux onto everyday users?

    • Audiocasts/Shows

    • Applications

      • OSTechNixQuickgui - A GUI For Quickemu To Run Virtual Machines - OSTechNix

        The other day we discussed how to run Linux, macOS, Windows virtual machines with Quickemu. Quickemu is a command line program. Not everyone is fan of command line mode. For those who prefer GUI over CLI, I present you Quickgui, a graphical frontend for Quickemu to create, run and manage virtual machines.

        What Is Quickgui?

        Quickgui is a Flutter frontend for quickget and quickemu. Using Quickgui, you can quickly create and run virtual machines via a simple graphical interface. No need to remember commands!

        Quickgui is built with Flutter, an open source framework by Google for building beautiful, natively compiled, multi-platform applications from a single codebase.

    • Instructionals/Technical

      • LinuxiacRsync Command in Linux with Practical Example [Ed: it's not a comment but a program. It's also not exclusive to Linux.]

        This guide shows you how to use the rsync command in Linux to synchronize files and directories using simple examples.

      • ID RootHow To Install DeaDBeeF on Ubuntu 22.04 LTS - idroot

        In this tutorial, we will show you how to install DeaDBeeF on Ubuntu 22.04 LTS. For those of you who didn’t know, DeaDBeeF (as in 0xDEADBEEF) is a free and open-source audio player for Linux. It plays a variety of audio formats like Mp3, ogg, flac, ape, wv/iso.wv, wav, m4a/m4b/mp4 cd audio, and converts between them. DeadBeef is available for GNU/Linux, BSD, and other UNIX-like systems.

        This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the DeaDBeeF music player on Ubuntu 22.04 (Jammy Jellyfish). You can follow the same instructions for Ubuntu 22.04 and any other Debian-based distribution like Linux Mint, Elementary OS, Pop!_OS, and more as well.

      • LinuxBuzThe Ultimate Docker Cheat Sheet – Quick Reference - LinuxBuz

        A Docker cheat sheet is a set of notes used for quick reference while using Docker in the real world. I have prepared a Docker cheat sheet that includes an extensive list of Docker commands.

        Here, I am presenting my Docker Cheat Sheet (a one-page guide) with all common terms and useful one-liners commands. You can use it as a quick reference guide when working with Docker. If you want to learn more about Docker with detail information and examples, you can read the rest of the article.

      • H2S MediaHow to Install Azure Data Studio on Ubuntu 22.04 LTS Jammy [Ed: Why would any GNU/Linux users want that???]
      • HowTo GeekcURL vs. wget in Linux: What’s the Difference?

        If you ask a bunch of Linux users what they download files with, some will say wget and others will say cURL. What’s the difference, and is one better than the other?

    • Desktop Environments/WMs

      • K Desktop Environment/KDE SC/Qt

  • Distributions and Operating Systems

  • Free, Libre, and Open Source Software

    • OSI BlogThe future of innovation has patent-free standards [Ed: Simon Phipps wrote this after he had brought Microsoft, the biggest patent bully, into OSI]

      As with any legal loophole, simply existing meant it was exploited and became the norm, even if it was initially temporary (like income tax in the UK.) Once exploitation of a legal loophole becomes competitive, it becomes its own justification for the existence of the regulations (“look at the economic value of this segment”) and they become near impossible to remove – even when the original justification has ceased to need preferential protection.

      So today we see a swathe of rich consumer electronics and telecom companies, addicted to the revenue they get from licensing the standard-essential patents (SEPs) they have embedded in what they call “open” standards (abusing the term to include standards that you have to pay to read and get patent licenses to implement), lobbying hard to ensure their value to the economy is recognized.

  • Leftovers

    • Linux Foundation

    • Security

      • Red Hat OfficialSocial Engineering vs Mistakes: Two sources of pain, one process

        There are a million ways for awful things to happen to your data and accounts. For example, someone could accidentally commit their AWS access keys publicly to GitHub, and attackers quickly run up $100,000 in charges mining cryptocurrency on expensive GPU-enabled instances. Or "account support" calls with a notice that your account has false charges, but they can remove them once they verify your credit card info. There are fake software updates that steal bank account information. And fictitious warnings about login failures to your corporate email with a link to "login and verify access." Not to mention account information leaked from one of your online services, including your banking site. Although there are many causes of account exposure, they fall broadly into two categories: malicious intent or accidental leaks.

      • Stop using phishing as a measure of your cyber awareness culture | Pen Test Partners

        If I had a penny for every time someone said to me “let’s measure our security culture by phishing our staff” I’d probably be able to fill my car up.

        It’s a really easy thing to do, you carry out some online training and typically they come with phishing simulations as a free or low cost add on. On the face of it that sounds great, train staff to spot phishing emails and they will be much better prepared to take up the mantle of defending your organisation. It sounds like the perfect solution, There’s a problem though, it’s Not.

      • FOSSLifeNew OrBit Malware Infects All Running Processes [Ed: "FOSSlife Team" helps the anti-Linux FUD lobby; so much for "FOSS'... maybe focus on back doors in proprietary software instead; no need to infect it, the doors are wide open...]

        Security researchers from Intezer have reported a new Linux malware variant called OrBit.

      • LWNSecurity updates for Tuesday [LWN.net]

        Security updates have been issued by Debian (chromium), Mageia (openssl and webkit2), Slackware (seamonkey), SUSE (crash, curl, freerdp, ignition, libnbd, and python3), and Ubuntu (dovecot and python-ldap).

      • Understanding Memory Leaks in Java | Developer.com

        When creating applications in Java, developers can create managed objects in their software using the new keyword. Programmers do not need to remove these managed objects explicitly in their code, since the garbage collector takes care of the removal of objects that are no longer required. So long as the objects are disposed of by the garbage collector, this is fine. However, if the garbage collector is unable to remove objects that are no longer referenced, there are chances of memory leaks in your applications.

        A memory leak in Java refers to a state when an object no longer needed by the application remains alive in the Java Virtual Machine (JVM). Memory leaks occur when an application accidentally hangs on to object references that are no longer necessary. Memory leaks lead to performance degradation over time because of your application’s increased (and unexpected) use of memory.

      • X.Org Security Advisory: July 12, 2022
        X.Org Security Advisory: July 12, 2022
        
        

        Multiple input validation failures in X server extensions =========================================================

        All theses issues can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.

        * CVE-2022-2319/ZDI-CAN-16062: X.Org Server ProcXkbSetGeometry Out-Of-Bounds Access

        The handler for the ProcXkbSetGeometry request of the Xkb extension does not properly validate the request length leading to out of bounds memory write.

        * CVE-2022-2320/ZDI-CAN-16070: X.Org Server ProcXkbSetDeviceInfo Out-Of-Bounds Access

        The handler for the ProcXkbSetDeviceInfo request of the Xkb extension does not properly validate the request length leading to out of bounds memory write.
      • xorg-server 21.1.4
        This release fixes 2 recently reported security vulnerabilities in xkb, several
        regressions since 1.20.x and a number of miscellaneous bugs.
        
      • ViceHackers Say They Can Unlock and Start Honda Cars Remotely

        On Thursday, a security researcher who goes by Kevin2600 published a technical report and videos on a vulnerability that he claims allows anyone armed with a simple hardware device to steal the code to unlock Honda vehicles. Kevin2600, who works for cybersecurity firm Star-V Lab, dubbed the attack RollingPWN.

        […]

        In a phone call, Kevin2600 explained that the attack relies on a weakness that allows someone using a software defined radio—such as HackRF—to capture the code that the car owner uses to open the car, and then replay it so that the hacker can open the car as well. In some cases, he said, the attack can be performed from 30 meters (approximately 98 feet) away.

        In the videos, Kevin2600 and his colleagues show how the attack works by unlocking different models of Honda cars with a device connected to a laptop.

        The Honda models that Kevin2600 and his colleagues tested the attack on use a so-called rolling code mechanism, which means that€­—in theory€­—every time the car owner uses the keyfob, it sends a different code to open it. This should make it impossible to capture the code and use it again. But the researchers found that there is a flaw that allows them to roll back the codes and reuse old codes to open the car, Kevin2600 said.

      • Privacy/Surveillance

        • AccessNowTikTok forced to pause plans for privacy-intrusive ads

          When TikTok announced its plan to impose personalised ads on everyone over 18 who uses the platform in EEA, UK, and Switzerland, Access Now told the company in no uncertain terms that it must scrap this action that would risk privacy, and deny agency. Reports now indicate that TikTok has hit the brakes.

          On 5 July, 2022, Access Now sent open letters to TikTok to immediately halt these invasive changes, and to the European Data Protection Board and its members to intervene.

    • Civil Rights/Policing

      • AccessNowThe EU AI Act proposal: a timeline - Access Now

        The use of artificial intelligence (AI) technology opens new risks for human rights, including for people and communities targeted for discrimination and marginalisation. Access Now advocates for AI regulations based on internationally recognised human rights principles. Below is a summary of our proposed amendments to the draft EU AI Act and a timeline of our related commentary and recommendations.

      • AccessNowCivil society calls on Indian government to withdraw amendments to IT Rules - Access Now

        We, the undersigned organizations operating in more than 10 countries and internationally in the promotion and protection of digital rights and freedoms, submit the following comments and urge you to withdraw the amendments recently proposed to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (IT Rules 2021). [1] We commend the Ministry of Electronics and Information Technology (MeitY) on the initiative to amend the IT Rules 2021, and commence a process of consultation on the proposed amendments.

        Amendments to the Rules are necessary in order to meaningfully protect fundamental rights. In our view, however, these new revisions add concerns to already restrictive provisions in the Rules that pose a direct threat to the rights to freedom of expression and privacy, as well as other related human rights protected under the Indian Constitution and international law.

    • Digital Restrictions (DRM)

      • The Register UKHive to pull the plug on smart home gadgets by 2025 [Ed: "Smart" things are for dumb, gullible people]

        Home automation platform Hive plans to terminate key products in its line, including the Hive View cameras, HomeShield, and Leak products.

        A Hive spokesperson told The Register: "At Hive, we've got big plans to make... homes greener, so we've made the tough decision to discontinue our smart security and leak detection products. As a smart tech brand in the middle of a climate crisis, we know the focus needs to change and will instead be developing smart home tech that'll help get us closer to achieving Net Zero."

        Users, some of whom have invested four figure sums in Hive products are less than impressed.

    • Monopolies

      • U.S. Antitrust Reform Is Necessary to Defend Global Human Rights [Ed: Why is Microsoft absent from this? Have the bribes paid off? Paid politicians? Paid press? Microsoft: get busy, regulators, with "GAFA"... while we too spy even more than "GAFA" and also commit a ton of crimes... including against GNU/Linux (which we claim to "love" to keep you asleep)... Public Access is already infiltrated by Microsoft (the Board), but is Access Now also infiltrated to distract and deflect?]

        In today’s interconnected world, it is nearly impossible to function in society without relying on a tech tool made in the USA. Trying to sell something? Use Facebook marketplace. Want to start a business? Google has a platform for your micro-targeted ads. This excessive concentration of power has helped solidify Big Tech’s reign over the world, making it much harder to hold these companies accountable for facilitating human rights violations, such as attacks against human rights defenders in the Philippines and ethnic violence in Ethiopia.


* Gemini (Primer) links can be opened using Gemini software. It's like the World Wide Web but a lot lighter.



Recent Techrights' Posts

Disputing the Achievements of IBM's CEO, Who Already Terminated Many Jobs at Red Hat (Which He Had Allegedly Suggested Buying)
Buying a company to gut it within about a year?
Microsoft's GitHub is Losing Traffic, Based on an Extensive Web Survey, and Its Future is Uncertain
Remember that Microsoft keeps close to its chest the operations and finances of GitHub (because it's embarrassing!)
 
IBM Bribery Scandal in China
IBM has a long history of bribery and other crimes
XBox Turmoil Continues, Head of XBox Game Studios Resigns After Less Than One Year
There are many signs that XBox is dying - something that many sites have predicted for a while
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, October 14, 2024
IRC logs for Monday, October 14, 2024
Links 14/10/2024: One Year Since Activision Blizzard Demolition 'Officially' Began and Amazon Corporate Layoffs Accelerate
Links for the day
Gemini Links 14/10/2024: Dabbling in GemText, Unit Testing
Links for the day
Links 14/10/2024: Keeping Multiple Blogs, Wrestling With Misinformation
Links for the day
[Meme] Class of Microsoft
"Everything started with Microsoft DOS!"
History Education and Rejecting Creation Myths
The creator of Linux isn't the creator of GNU/Linux
How to Follow Our Updates About EPO (or Everything Else for That Matter)
follow us via RSS feeds
EPO Administration: Wait Several Months or Until Next Year for Clarifications
"After the intranet announcements of 18 September and 27 September and recent emails from CIGNA concerning opting into the VECOZO network, colleagues have been contacting us with queries and requests for guidance."
[Meme] Shoestring Budget With Record Profits (Because Hundreds of Thousands of Fake European Patents Get Granted)
Record profits? EPO staff does not benefit!
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, October 13, 2024
IRC logs for Sunday, October 13, 2024
Unrest at the European Patent Office as School Costs Eat Away the Income
"Letter to the administration on the Education Allowance - DISDH - German School"
Gemini Links 13/10/2024: ArcMenu, Emacs decide-mode, Midnight Pub Mass-Deletion Option
Links for the day
Links 13/10/2024: Science, Politics, and Some Gemini
Links for the day
Links 13/10/2024: Writing, Remembering John Wheeler, Voice Cloning
Links for the day
Certificate Authority Let's Encrypt Falls to 0.7% in Geminispace (It Was Around 12% Just 2 Years Ago and 7.5% This Past February)
Let's Encrypt is down again
Gemini Links 13/10/2024: Self-hosting Snac2 and Invasion of e-ink
Links for the day
SDxCentral, which the Linux Foundation Paid to Produce Marketing SPAM, Has Now Become Slop (LLM Spew) Disguised as 'Articles'
Google should delist it
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, October 12, 2024
IRC logs for Saturday, October 12, 2024