01.23.23

GNU/Linux

• Audiocasts/Shows

  • Video ☛ Nobara Project 37 overview | a modified version of Fedora Linux with user-friendly fixes added to it – Invidious

    In this video, I am going to show an overview of Nobara Project 37 and some of the applications pre-installed.

  • Jupiter Broadcasting ☛ Updating Our Fiddly Bits | LINUX Unplugged 494 | Jupiter Broadcasting

    Today we are finally taking on a project months in the making, and we’re switching to an entirely new generation of Linux tech in the process.

  • Video ☛ My New Desktop – Invidious

  • Video ☛ Amusing Linux Distros to Try if You’re a Distro Dynamic Person

  • Video ☛ A Brand New Cool Latest Linux Distributions For 2023 – Invidious

  • Video ☛ Steam Deck could upend the gaming industry… whether Valve has the guts is another story. – Invidious

    The Steam Deck is at a fork in the road and Valve needs to decide. Take the Bubsy path, you wake up in your bed and believe whatever it is you want to believe. Take the Mario 64 path, you stay in Wonderland and Valve shows you how deep the rabbit hole really goes.

  • Video ☛ New options have appeared in the Steam Deck’s beta settings menu! – Invidious

  • Video ☛ Init Freedom Campaign Saves Linux From Systemd? – Invidious

    Nowadays systemd is the defacto standard software suite for your init system with systemd-init, growing popularity with systemd-boot and much much more but in an alternate timeline that might not be the case

  • CubicleNate ☛ Linux Saloon | News Flight Night 9 – CubicleNate’s Techpad

    The second Linux Saloon Live was a News Flight Night with a flight of topics sourced from all around the internet from the Linux Saloon bunch. The main topic of the show revolved around a Strawpoll that Aris made asking, “Have you ever built a desktop.” A simple question that made for some incredibly interesting conversation about building a computer.

• Kernel Space

  • Barry Kauler ☛ xloadimage and xserver-fb added to Kirkstone build

  • LWN ☛ The return of the Linux Kernel Podcast [LWN.net] [Ed: See comment]

    After a brief break of … a dozen years or so … Jon Masters has announced the return of his kernel podcast…

• Applications

  • Linux Links ☛ 8 Meritorious Free and Open Source Modelers

    
    Linux offers a rich platform for anyone with an artistic inclination. With low cost hardware, quality open source software, and an ounce of talent, artists can produce professional-looking computer graphics.

    There is a relatively small range of open source software that offers the ability of rendering images with Linux. Rendering is the process of taking a 3D model and displaying it as a two-dimensional image. Unfortunately, some of the applications have not seen any development in recent years, abandoned by their developers with no one coming forward to step into their shoes. Nevertheless, there are still some high quality, open source Linux modelers which are worth investigating.

  • OMG! Linux ☛ Tangram for Linux is a Browser Built for Web Apps – OMG! Linux

    For an ordered way to use your favourite web apps on Linux check out Tangram, a GTK-based web browser.

    Oh, I know what you’re going to say: “Dude, I already have a web browser” — and for most people a regular web browser (like Firefox, Chrome, etc) is a solid way to use web apps on Linux desktops.

    But what if you want to keep your web apps separate apps from the rest of your browsing?

    Enter Tangram, an open-source GTK4/libadwaita app powered by the the same Webkit engine as GNOME Web (aka Epiphany). As such, pretty much all modern web content works in it.

  • 9to5Linux ☛ HandBrake 1.6.1 Fixes Intel QSV Hardware Detection on Linux, Adds Missing Translations

    HandBrake 1.6 was released about three weeks ago, but it looks like some bugs and crashes managed to squeeze into the final release. For Linux users, HandBrake 1.6.1 is here to address the detection of Intel QSV hardware, though the devs note the fact that this is only a partial fix, for now.

    Also for Linux, the HandBrake release addresses a potential crash that occurred when canceling an Intel QSV encode operation, adds missing format strings to allow you to build the software from sources with the -Werror=format-security option, and adds missing translations (Bulgarian, Corsican, Dutch, German, and Spanish).

  • IceWM 3.3.1 Released

    The latest released version is 3.3.1 (2023-01-23).

• Instructionals/Technical

  • HowTo Forge ☛ How to Set Up a Kubernetes Cluster Using Minicube on Debian 11

    Minikube is a free and open-source tool that comes with a set of built-in add-ons that helps you to set up a Kubernetes cluster in your local system.

  • HowTo Forge ☛ How to Install Drupal with Docker on Ubuntu 22.04

    Drupal is an open-source content management system (CMS) written in PHP.

  • ID Root ☛ How To Install 7-Zip on Debian 11 – idroot

    In this tutorial, we will show you how to install 7-Zip on Debian 11. For those of you who didn’t know, 7-Zip is a popular open-source file-archiving software that can be used to compress and decompress files on a variety of platforms, including Windows, Linux, and macOS. It supports a wide range of file formats, including .7z, .zip, .rar, and .tar, and offers both command-line and graphical user interface (GUI) options for interacting with compressed files.

    This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the 7-Zip archiving software on a Debian 11 (Bullseye).

  • TecAdmin ☛ Getting Started with Linux Screen Command: A Beginner’s Guide – TecAdmin

    Have you ever heard of the Linux Screen Command? It’s an incredibly powerful tool that allows you to take control of multiple programs in a single terminal window. With the Linux Screen Command, you can easily manage multiple programs, even if they’re running in different directories. You can even switch between programs without having to close or restart them. It’s an incredibly efficient way to work in Linux.

  • ID Root ☛ How To Install Magento on Rocky Linux 9 – idroot

    In this tutorial, we will show you how to install Magento on Rocky Linux 9. For those of you who didn’t know, Magento is a popular open-source e-commerce platform that offers a wide range of features and functionalities. One of the key features of Magento is its flexibility and scalability. It is designed to be highly customizable, allowing developers to create unique and customized online stores. It also supports multiple languages, currencies, and tax rates, making it suitable for businesses operating in different regions.

    This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of Magento open-source e-commerce platforms on Rocky Linux. 9.

  • Kifarunix ☛ How to Install Docker Resource Usage Extension – kifarunix.com

    How can you install Resource usage extension on Docker desktop? In this guide, you will learn how to install Docker Resource Usage extension.

  • Make Use Of ☛ How to Install and Use HACS in Home Assistant

    Home Assistant Community Store, or HACS, is a powerful integration for Home Assistant that allows users to download and install custom add-ons, integrations, themes, elements, etc. Discover how to install HACS on both the Supervised Home Assistant server running on a Raspberry Pi HASS OS and a non-supervised Home Assistant Server running in a Docker container on a Linux OS.

  • Linux Hint ☛ How to Remove Docker Images

    Docker images contain instructions to manage and run Docker containers. Users can create as many docker images as they want. But these Docker images can take up most of the storage in the Docker engine. Therefore, developers are occasionally required to remove the unused Docker image to keep the Docker engine clean.

  • Network World ☛ Working with image files on the Linux command line | Network World

    There’s a lot to learn about image files on the command line, from verifying file format to finding out where and when photos were taken and maybe even getting an unusual view of what they look like.

• Desktop Environments/WMs

  • K Desktop Environment/KDE SC/Qt

    • KDE Official ☛ Season of KDE 2023: Mentees and Projects | KDE.news

      This year Season of KDE has several projects focusing on the accessibility and sustainability goals. There are three projects focused on accessibility, three on sustainability and three additional projects in other areas.

      The sustainability projects had fifteen excellent applicants for just three projects, so selecting mentees was challenging. The time mentee applicants invested in applying is much appreciated, and any applicants who have not been selected are encouraged to continue contributing to KDE and open source. It is possible to make smaller contributions to KDE projects that allow possible mentors to see your work and then mentor you informally.

  • GNOME Desktop/GTK

    • GNOME ☛ Crosswords 0.3.7: Adaptive Layout, Animations, and Arrows – Jonathan Blandford

      It’s GNOME Crosswords release time again! This is a big release with a lot of changes. Most importantly, I was able to find some time over the holidays to do some long-overdue refactoring of the core game code.

      [...]

      Adaptive Layout and Animations

      In the previous release, I tried to make Crosswords adapt to different screen sizes. It wasn’t all that usable, so I worked more on it this cycle.

      First, the good news: I cleaned up a lot of the layout bugs, and (thanks to Carlos) got some form of touch screen keyboard input working. The end result is that I changed the appinfo file to indicate we supported all screen sizes and inputs, which means it should be available on all platforms.

Distributions and Operating Systems

• New Releases

  • It’s FOSS ☛ Netrunner 23 “Vaporwave” Release Combines the Stability of Debian 11 and Linux Kernel 5.10 LTS

    Netrunner is a Debian-based Linux distro for PCs/ARM-based computers that has been around since 2010 and has been getting a steady flow of updates.

    In a recent announcement, they released Netrunner 23 “Vaporwave” with a few improvements.

  • Linux Magazine ☛ Netrunner OS 23 is Now Available

    The latest version of this Linux distribution is now based on Debian Bullseye and is ready for installation and finally hits the KDE 5.20 branch of the desktop.

    Netrunner “Vaporware” version 23 has been made available by Blue Systems, arriving some two years after the previous milestone release. Unlike Netrunner 21, version 23 migrates to Debian Bullseye, which means it also includes the 5.10.19 Linux kernel.

    As well, Netrunner 23 includes KDE Plasma 5.20, Qt 5.15.2, Firefox 102 ESR, LibreOffice 7.0.4, VLC 3.0.18, Audacious 4.0.5, Thunderbird 102.6.0, GIMP 2.10, and much more. But don’t think you’ll be getting a stock KDE desktop.

    The developers have added a number of customizations to the desktop, such as an overview-like main menu, a unique theme that helps to make it stand out, simplified System Settings with Plasma Tweaks, a unified look for both KDE and non-KDE applications, GTK apps with standard Kwin borders, Task Manager with expanding icons, Show Desktop hot-spot in the lower right corner, and more.

  • ZDNet ☛ Netrunner 23 ‘Vaporware’ is a Linux distribution ready for productivity and gaming | ZDNET

    I cannot even count the number of Debian-based Linux distributions there are on the market. But when you whittle that list down to those that are both productive and game-ready, the options are much fewer. One of those options is Netrunner.

    According to the official website, “Netrunner is a complete Linux Operating System for PCs, laptops/netbooks and ARM microcomputers, that makes exclusive use of the KDE Plasma desktop environment.” I find that description quite lacking because the distribution isn’t just a complete Linux operating system, but a platform for fun and work.

    With plenty of applications pre-loaded, you can immediately start playing and working without having to install much in the way of third-party software.

    The only tools you might have to add would be the likes of Spotify and Slack. The caveat to that is you would need to first install either Snap or Flatpak.

  • Happy New Year! OSMC’s January update is here – OSMC

    We hope that you had a good Christmas and New Year.

    Our first update of the year brings Kodi v19.5, which is the final version of Kodi 19.x (Matrix). We are now working on preparing Kodi v20 (Nexus) for OSMC users. This update brings the last stable version of Kodi v19 with a few improvements to improve the upgrade process.

  • 9to5Linux ☛ Freespire 9.0 Released with Xfce 4.18, Based on Xubuntu 22.04 LTS

    Based on Canonical’s Xubuntu 22.04.1 LTS (Jammy Jellyfish) operating system, the Freespire 9.0 release is here to offer users a rock-solid Ubuntu experience with the addition of the latest and greatest Xfce 4.18 desktop environment.

    Under the hood, Freespire 9.0 is powered by Xubuntu 22.04’s long-term supported Linux 5.15 kernel series, and, according to its developers, it does not include any proprietary codecs or software code that is not open source.

• Canonical/Ubuntu Family

  • Ubuntu ☛ Ubuntu Blog: What is MLOps going to look like in 2023?

    While AI seems to be the topic of the moment, especially in the tech industry, the need to make it happen in a reliable way is becoming more obvious. MLOps, as a practice, finds itself in a place where it needs to keep growing and remain relevant in view of the latest trends. Solutions like ChatGPT or MidJourney dominated internet chatter last year, but the main question is…What do we foresee in the MLOps space this year and where is the community of MLOps practitioners focusing their energy? Let’s first look back at 2022 and then explore expectations for 2023.

• Open Hardware/Modding

  • Adafruit ☛ Composite PAL Video on an RPi Pico

    The RaspberryPi Pico can deliver gorgeous composite video!

  • Adafruit ☛ Circuit Playground Express Lo-fi Cap Touch Nintendo Controller Tutorial

    This excellent Physical Computing lesson series from the University of Washington includes a section on learning to use capacitive touch on Circuit Playground Express using MakeCode.

    The Making a Lo-fi Capacitive Touch Nintendo Controller project looks great, and includes instructions on building a large paper, cardboard, and conductive tape/foil NES controller.

• Mobile Systems/Mobile Applications

  • The Wire ☛ ‘BharOS’ vs Android: India Needs Not Just a Self-Reliant but Reliable Operating System

    Although there is no publicly available documentation about BharOS and its features, it looks like a ‘fork‘ of the Android Open Source Project (AOSP) led by Google.

    It is also unclear which phones BharOS can run on, as the operating system has been announced independent of any specific phone that will run it. While being promoted as an indigenous operating system, BharOS, however, is not entirely a product of Indian origin as the operating system is based on AOSP, which is a global effort by people of multiple nationalities.

    In a highly globalised world, it is really hard to produce a truly domestic product from scratch. At present, there are several other operating systems like LineageOS, CalyxOS, GrapheneOS based on AOSP that are supported by independent free and open-source software groups to help people take control of their personal data and mobile phones.

    But why is there a need for using operating systems other than the default one supplied with the phone? This is for people who want privacy and don’t want to continuously feed Google with information.

    Google has abused its position as a promoter of the Android project by locking several features and apps to the Play Store and Google Play services. The default installation of Google apps and the Google search engine in the Android OS has always been a contentious issue with regulators. In the European Union and India, regulators are pushing back against Google’s dominance in the market.

  • Linux On Mobile ☛ LINMOB.net – Weekly GNU-like Mobile Linux Update (3/2023): Pinhole photography

    An unofficial PINE64 community update, a library to help Phosh deal with notches, bleak future for Cawbird and experiments with video recording on PinePhone.

  • The Hindu ☛ Apple iPhone download speeds are no longer faster than Android: report� – The Hindu

  • Giz China ☛ iPhone 14 Pro Max Loses Top Spot: These Two Android Phones Took Over as Speediest Devices! – Gizchina.com

  • Express ☛ Urgent warning issued to Samsung Galaxy users – check your phone now | Express.co.uk

  • India Times ☛ OnePlus Buds Pro 2 to come with Google Android’s Spatial Audio support – Times of India

  • GSM Arena ☛ OnePlus Buds Pro 2 are among the first to support Android 13′s Spatial Audio feature – GSMArena.com news

  • SamMobile ☛ Carrier-locked Galaxy A13 LTE is now getting Android 13 in the USA – SamMobile

  • Android Central ☛ Wear OS 3 finally fixes the problems Android watches have had for years | Android Central

  • 9to5Google ☛ Android Auto 8.7 rolling out without ‘Coolwalk’

Free, Libre, and Open Source Software

• Make Use Of ☛ You Don’t Trust Open-Source Software? 6 Reasons Why You Should

  Open-source software is usually free. But is free software better than proprietary? Here are some reasons why you should trust open-source software.

  You might feel hesitant to use free and open-source software, especially since so much of the code comes from volunteers. In most areas of our lives, having a product come from a reputable company is a plus. It’s how you trust that something is well-made.

  Why trust code from some volunteers over the high-quality software from the experts at Microsoft, Apple, and Google?

  As the tech giants have shown us, their software may be reliable, but it often comes with all sorts of tracking and other forms of exploitation. Open-source software is actually much safer to use, and here’s why.

• Events

  • FSFE ☛ Ready for FOSDEM 2023?

    FOSDEM 2023 is taking place in Brussels the first weekend of February. The FSFE team will be participating at the main Free Software convention in Europe with a booth and giving some keynotes. Are you going to be there? Come to our booth and do not miss our talks!

    After two years without the chance to meet in person and spend time talking with other Free Software friends — and newcomers — around our booth, we are almost there: FOSDEM is back as an “in situ” event.

    FOSDEM brings together thousands of Free Software enthusiasts for one weekend in Brussels to discuss current topics and developments in the Free Software world. This year we are back at the Université Libre de Bruxelles with our booth and several talks to encourage and raise awareness on wider issues that impact our movement. Networking is equally important. We have prepared social gatherings to get to know each other a bit better during the evenings in some informal venues.

• Web Browsers/Web Servers

  • Mozilla

    • Jamie Zawinski ☛ mozilla.org’s 25th anniversary

      Big Tech layoffs are in the news, you say?

      On January 20th, 1998, Netscape laid off a lot of people. One of them would have been me, as my “department”, such as it was, had been eliminated, but I ended up mometarily moving from “clienteng” over to the “website” division. For about 48 hours I thought that I might end up writing a webmail product or something.

      That, uh, didn’t happen.

      At 8am on January 22, 1998, Netscape put out a press release announcing that the source code to the web browser would be released to the public at the end of March. This was the first that I had heard that this was even being considered.

    • LWN ☛ Zawinski: mozilla.org’s 25th anniversary [LWN.net]

      Jamie Zawinski reminds us that the 25th anniversary of the Netscape open-source announcement — a crucial moment in free-software history — has just passed.

    • Bleach 6.0.0 release and deprecation | Will’s Blog

      Bleach is a Python library for sanitizing and linkifying text from untrusted sources for safe usage in HTML.

    • Mozilla ☛ Start this year fresh with Mozilla’s tech challenge

      If you’ve already ditched your new year’s goals, we’re here to help. How about a refreshening of your online life with new habits and routines?

      Are there newsletters you don’t read anymore? Mobile apps you no longer use? Or social media platforms you’ve left (ahem, Twitter)? We want to help.

      We’ve put together a month-long challenge to refresh your online life. Each week, we’ll update this blog post with three easy tasks, all of which will take less than 10 minutes to complete. We want to help you build healthy online habits, so you can spend 2023 with fewer worries and more time to enjoy the best of what the internet has to offer.

• Productivity Software/LibreOffice/Calligra

  • Community Member Monday: Afshin Falatooni – The Document Foundation Blog

    Today we’re talking to Afshin Falatooni, from the Persian-speaking LibreOffice community!

    [...]

    I write regularly on the Persian LibreOffice blog. My goal is to provide educational contents around LibreOffice there. Additionally, if I find a bug that is either directly or indirectly related to Persian language, in addition to reporting it to Bugzilla with the necessary screenshots and documents, I post it to the blog to make others aware of the important bugs.

    We also have a Persian-speaking group in Telegram, where I answer questions as far as I can, alongside the other admin of the group.

    Many years ago, I added a large collection of Persian words to OpenOffice.org project, which were likely to be written incorrectly. Using that word list, the Persian language was added as part of the OpenOffice.org auto-correction feature. The word bank continues to exist in LibreOffice, and is useful for the Persian speaking users.

• GNU Projects

  • GNU ☛ texinfo – GNU documentation system – News: Texinfo 7.0.2 released [Savannah]

    We have released version 7.0.2 of Texinfo, the GNU documentation format. This is a minor bug-fix release.
    It’s available via a mirror (xz is much smaller than gz, but gz is available too just in case):

    http://ftpmirror.gnu.org/texinfo/texinfo-7.0.2.tar.xz

    http://ftpmirror.gnu.org/texinfo/texinfo-7.0.2.tar.gz

  • GNU ☛ Meet Guix at FOSDEM

    GNU Guix will be present at FOSDEM next week, February 4th and 5th. This is the first time since the pandemic that FOSDEM takes place again “in the flesh” in Brussels, which is exciting to those of us lucky enough to get there! Everything will be live-streamed and recorded thanks to the amazing FOSDEM crew, so everyone can enjoy wherever they are; some of the talks this year will be “remote” too: pre-recorded videos followed by live Q&A sessions with the speaker.

• Programming/Development

  • Razor Agile – a GIT Integrated Software Development Solution for Windows or Linux

    Razor uses GIT to store revisions of issues, files, and baseline history. MariaDB is used to store (settings, configuration, user information, encryption profile, license, etc.). Open-Source and Spawned from MySQL. Runs in a VMware Virtual Machine.

  • Qt ☛ Product Analytics With Qt Insight – Make Business Decisions Based on Real Usage Data [Ed: Qt went proprietary; now it promotes telemetry (surveillance)]

    How are critical product-related decisions made at your company? Whilst other areas of business may rely on years of experience, generic data gathered on the way, or even competitor analysis, digging deeper into how your products or digital solutions perform is required in order to optimize the product development lifecycle. Without an understanding of user flows, customer pain points, or the elements going unused, the product development lifecycle can’t be fully optimised, leading to wasted time and resources. Sure, you can always conduct endless feedback loops and research surveys, or even interview your customers to understand how they feel about your products, but the results may not be providing you with an unbiased view – not to mention the time it takes to commit to overseeing qualitative research.

  • Perl / Raku

    • Rakulang ☛ 2023.04 Thank you, JJ – Rakudo Weekly News

      JJ Merelo has been very active for the Perl and Raku communities for many years. Organizer of the YAPC::Europe in Granada, giving many Raku presentations, working on the Raku documentation, and a regular helper at FOSDEM. The past years, also as a Raku Steering Council member and the Raku Community Affairs Team. Earlier last year, JJ indicated that the Raku activities became too much, with all the other tasks JJ was performing.

  • Python

    • Adafruit ☛ The Python on Hardware Newsletter: join for free

    • Adafruit ☛ 400 CircuitPython Libraries!

      The CircuitPython community reached a big milestone together! There are 400 CircuitPython Libraries!

      The CircuitPython Library Bundle and Community Library Bundle contain all the current libraries available for CircuitPython. CircuitPython libraries are separate files designed to work with CircuitPython code. CircuitPython programs require a lot of information to run.

Leftovers

• Andrea Corbellini: What time is it? A simple question with a complex answer. How computers synchronize time

  ver wondered how your computer or your phone displays the current date and time accurately? What keeps all the devices in the world (and in space) in agreement on what time it is? What makes applications that require precise timing possible?

  In this article, I will explain some of the challenges with time synchronization and explore two of the most popular protocols that devices use to keep their time in sync: the Network Time Protocol (NTP) and the Precision Time Protocol (PTP).

• Hardware

  • CNX Software ☛ Fanless Alder Lake network appliance comes with six 2.5GbE interfaces – CNX Software [Ed: “Windows 11 Pro apparently preinstalled on the system”, so why does CNX cover this?]

    The design looks very similar to another white brand fanless network appliance with six 2.5GbE ports and an Intel Gemini Lake processor that we covered last year. Besides the faster processor, the new system replaces i225-V controllers with i226-V controllers, some of the USB ports have been upgraded to “USB 3.2”, and DisplayPort output was added for dual display setups.

  • CNX Software ☛ Storaxa is a 3-in-1 5-bay NAS, WiFi 6 router, and 4K media center (Crowdfunding) – CNX Software

    It’s unclear to me what are the advantages of having SSD drives in the Storaxa, as one of the advantages of SSD-based NAS like the QNAP TBS-464 and upcoming TBS-574X is their thin design, but it’s obviously not the case here. QNAP says the TBS-574X will also be suitable for real-time 4K video production and business IT applications, so maybe the SSDs may help here too although the Intel Celeron N6005 used in the Storaxa will not be quite as powerful as the Intel Core i3-1220P 10-core Alder Lake-P processor found in the QNAP NAS.

• Pseudo-Open Source

  • Openwashing

    • The Linux Foundation May Soon Build Its Own Open Source Metaverse Equivalent [Ed: Facebook is failing, so it’s openwashing time at Linux Foundation]

• Security

  • Wladimir Palant ☛ Bitwarden design flaw: Server side iterations | Almost Secure

    In the aftermath of the LastPass breach it became increasingly clear that LastPass didn’t protect their users as well as they should have. When people started looking for alternatives, two favorites emerged: 1Password and Bitwarden. But do these do a better job at protecting sensitive data?

    For 1Password, this question could be answered fairly easily. The secret key functionality decreases usability, requiring the secret key to be moved to each new device used with the account. But the fact that this random value is required to decrypt the data means that the encrypted data on 1Password servers is almost useless to potential attackers. It cannot be decrypted even for weak master passwords.

    As to Bitwarden, the media mostly repeated their claim that the data is protected with 200,001 PBKDF2 iterations: 100,001 iterations on the client side and another 100,000 on the server. This being twice the default protection offered by LastPass, it doesn’t sound too bad. Except: as it turns out, the server-side iterations are designed in such a way that they don’t offer any security benefit. What remains are 100,000 iterations performed on the client side, essentially the same protection level as for LastPass.

  • Bruce Schneier ☛ No-Fly List Exposed – Schneier on Security

    I can’t remember the last time I thought about the US no-fly list: the list of people so dangerous they should never be allowed to fly on an airplane, yet so innocent that we can’t arrest them. Back when I thought about it a lot, I realized that the TSA’s practice of giving it to every airline meant that it was not well protected, and it certainly ended up in the hands of every major government that wanted it.

    The list is back in the news today, having been left exposed on an insecure airline computer. (The airline is CommuteAir, a company so obscure that I’ve never heard of it before.)

    This is, of course, the problem with having to give a copy of your secret list to lots of people.

  • LWN ☛ Security updates for Monday [LWN.net]

  • USCERT ☛ CISA Adds One Known Exploited Vulnerability to Catalog | CISA [Ed: "Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario."]

    CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. This type of vulnerability is a frequent attack vector for malicious cyber actors and poses a significant risk to the federal enterprise. Note: To view the newly added vulnerabilities in the catalog, click on the arrow in the “Date Added to Catalog” column, which will sort by descending dates.

  • LinuxSecurity ☛ How to Check if Your Linux System is Infected with a Virus | LinuxS…

    Linux is undoubtedly the best open-source operating system, and is arguably the most secure OS by design. Most computers these days are Linux-based. Android OS, which is the most commonly used mobile operating system, is also Linux-based. The same goes for Chromebooks and a variety of tablets.

  • Bleeping Computer ☛ Hackers now use Microsoft OneNote attachments to spread malware

  • Fear, Uncertainty,
    Doubt/Fear-mongering/Dramatisation

    • Matthew Garrett ☛ Build security with the assumption it will be used against your friends [Ed: UEFI ‘secure’ boot is already used against us and we know who built this thing into Linux: the author of this post]

      But most importantly: build security features as if they’ll be used against you.

    • LinuxInsider ☛ Linux Malware Rates Rise to Record Levels Amid Hacker Inconsistency [Ed: Jack M. Germain at LinuxInsider relays anti-Linux talking points from a firm looking to sell itself using FUD tactics. Germain used to do vastly better work before he became LF parrot.]

      … based on an analysis by researchers at Atlas VPN…

  • Privacy/Surveillance

    • Adafruit ☛ Home security drone [Ed: Surveillance gadgets for Bezos and the cops. And YOU PAY FOR IT.]

      A couple weeks back at CES 2023 Ring showed off a prototype drone that would surveil your home. While the idea is super neat it doesn’t sound the most practical for security, maybe if you tie a sheet to it you could scare the burglars away

• AstroTurf/Lobbying/Politics

  • Michael West Media ☛ Murdoch’s wailing old white man scribes get Jacinda Ardern dead wrong, again – Michael West

    As the world is thanking Jacinda Ardern profoundly for her 14 years in New Zealand’s Parliament and more than five as prime minister, a large number of white male scribes have joined in a frenzy of extraordinarily bitter attacks. Alan Austin reports on her economic performance.

    Jacinda Ardern announced on Thursday her intention to retire from the prime ministership in February and from the parliament at the October election. Condemnations from the conservative media are remarkably fact-free.

• Censorship/Free Speech

  • Notice in Lumen reveals Indian Government’s attempt to remove references to BBC’s documentary titled ‘India: The Modi Question’

    A notice contributed to Lumen by Twitter as a part of Twitter’s transparency efforts revealed that on January 21, 2023, India’s Ministry of Information and Broadcasting sent Twitter an online content blocking order requiring the removal of fifty tweets that discuss ‘India: The Modi Question’, BBC’s recent documentary critical of PM Modi’s role in the 2002 Gujarat communal riots, where more than 1000 people were killed. Twitter has withheld the tweets in India in response to this request. The order includes tweets made by multiple members of the Indian Parliament, journalists and news channels.

    The legal justification for the blocking order is Rule 16 of the recently enacted Information Technology Rule, 2021. Under Rule 16, in situations where “no delay is acceptable”, an Authorised Officer can examine content and submit a written recommendation to the Secretary of the Ministry of Information and Broadcasting, who enjoys the unilateral power of providing mandates to online platforms to remove content. The Mumbai and Madras High Courts in India have in the past noted that parts of the IT Rules ‘threaten independence of media’ and violate freedom of speech.

Gemini* and Gopher

• Politics

  • The Limit of Compound Interest

    A common point of focus for analysis and finance students is the question of continual compound interest: how will a principal amount grow if an arbitrarily-small amount of compound interest in applied arbitrarily frequently? At the core of this question is the limit…

• Technical

  • Hey, hey, 2FA

    In which I talk about the problems with suddenly not being able to do 2FA in the modern world.

    I woke up this morning and as usual, checked the time on my phone by the bedside. Blank – ah – didn’t take a charge overnight, perhaps. Unfortunately not so, the phone is dead. Either it won’t take a charge through a cable and the wireless charger, or the on/off button is broken, or the battery is kaput, or … let’s face it, it’s dead.

  • Home Automation and Zigbee

    So I’ve been dabbling a little in home automation this week.

    Ever had to signal your SO by flashing on and off the sofa light because you’re stuck outside in the cold since you forgot your keys, and she’s not answering the phone?

    Until yesterday, this was not something I’d have had to do, but I’ve crossed this threshold now in the relationship and I expect full retribution sometime later when I’m seemingly home alone.

  • Programming

    • redo (part 5) version.h, autogenerated

      How about updating something like BUILDDATE or GITVERSION automatically in some generated version.h file? Wouldn’t that be nice?