Bonum Certa Men Certa

Links 12/07/2022: KDE Plasma 5.25.3 and Xorg Server Security Patches



  • GNU/Linux

    • Desktop/Laptop

      • LWNGarrett: Responsible stewardship of the UEFI secure boot ecosystem [Ed: LWN spin assistance; LWN fails to note that he's the culprit, whom we should be egging over this; narrative shifting, but see the comments]

        Matthew Garrett grumbles about an apparent Microsoft policy change making it harder to boot Linux on some systems.

      • LiliputingSlimbook Executive is a lightweight Linux laptop with Intel Core i7-12700H - Liliputing

        Spanish PC maker Slimbook’s latest Linux-friendly laptop is a thin and light model that packs a lot of horsepower into a compact chassis. The new Slimbook Executive comes with a choice of 14 or 16 inch high-resolution, 90 Hz displays and both models are powered by a 45-watt Intel Core i7-12700H processor. The larger model also features NVIDIA GeForce RTX 3050 Ti discrete graphics.

        The Slimbook Executive is available now for 1299 (about $1310) and up.

      • ElectropagesJoint venture unveils world’s first RISC-V laptop

        As RISC-V continues to push the boundaries of open-source computing, a joint venture between DeepComputing and Xcalibyte has developed the world’s first RISC-V laptop set to be released in September. Why is RISC-V’s popularity growing, what are the specs of the new laptop, and could this help push the use of Linux onto everyday users?

    • Audiocasts/Shows

    • Applications

      • OSTechNixQuickgui - A GUI For Quickemu To Run Virtual Machines - OSTechNix

        The other day we discussed how to run Linux, macOS, Windows virtual machines with Quickemu. Quickemu is a command line program. Not everyone is fan of command line mode. For those who prefer GUI over CLI, I present you Quickgui, a graphical frontend for Quickemu to create, run and manage virtual machines.

        What Is Quickgui?

        Quickgui is a Flutter frontend for quickget and quickemu. Using Quickgui, you can quickly create and run virtual machines via a simple graphical interface. No need to remember commands!

        Quickgui is built with Flutter, an open source framework by Google for building beautiful, natively compiled, multi-platform applications from a single codebase.

    • Instructionals/Technical

      • LinuxiacRsync Command in Linux with Practical Example [Ed: it's not a comment but a program. It's also not exclusive to Linux.]

        This guide shows you how to use the rsync command in Linux to synchronize files and directories using simple examples.

      • ID RootHow To Install DeaDBeeF on Ubuntu 22.04 LTS - idroot

        In this tutorial, we will show you how to install DeaDBeeF on Ubuntu 22.04 LTS. For those of you who didn’t know, DeaDBeeF (as in 0xDEADBEEF) is a free and open-source audio player for Linux. It plays a variety of audio formats like Mp3, ogg, flac, ape, wv/iso.wv, wav, m4a/m4b/mp4 cd audio, and converts between them. DeadBeef is available for GNU/Linux, BSD, and other UNIX-like systems.

        This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the DeaDBeeF music player on Ubuntu 22.04 (Jammy Jellyfish). You can follow the same instructions for Ubuntu 22.04 and any other Debian-based distribution like Linux Mint, Elementary OS, Pop!_OS, and more as well.

      • LinuxBuzThe Ultimate Docker Cheat Sheet – Quick Reference - LinuxBuz

        A Docker cheat sheet is a set of notes used for quick reference while using Docker in the real world. I have prepared a Docker cheat sheet that includes an extensive list of Docker commands.

        Here, I am presenting my Docker Cheat Sheet (a one-page guide) with all common terms and useful one-liners commands. You can use it as a quick reference guide when working with Docker. If you want to learn more about Docker with detail information and examples, you can read the rest of the article.

      • H2S MediaHow to Install Azure Data Studio on Ubuntu 22.04 LTS Jammy [Ed: Why would any GNU/Linux users want that???]
      • HowTo GeekcURL vs. wget in Linux: What’s the Difference?

        If you ask a bunch of Linux users what they download files with, some will say wget and others will say cURL. What’s the difference, and is one better than the other?

    • Desktop Environments/WMs

      • K Desktop Environment/KDE SC/Qt

  • Distributions and Operating Systems

  • Free, Libre, and Open Source Software

    • OSI BlogThe future of innovation has patent-free standards [Ed: Simon Phipps wrote this after he had brought Microsoft, the biggest patent bully, into OSI]

      As with any legal loophole, simply existing meant it was exploited and became the norm, even if it was initially temporary (like income tax in the UK.) Once exploitation of a legal loophole becomes competitive, it becomes its own justification for the existence of the regulations (“look at the economic value of this segment”) and they become near impossible to remove – even when the original justification has ceased to need preferential protection.

      So today we see a swathe of rich consumer electronics and telecom companies, addicted to the revenue they get from licensing the standard-essential patents (SEPs) they have embedded in what they call “open” standards (abusing the term to include standards that you have to pay to read and get patent licenses to implement), lobbying hard to ensure their value to the economy is recognized.

  • Leftovers

    • Linux Foundation

    • Security

      • Red Hat OfficialSocial Engineering vs Mistakes: Two sources of pain, one process

        There are a million ways for awful things to happen to your data and accounts. For example, someone could accidentally commit their AWS access keys publicly to GitHub, and attackers quickly run up $100,000 in charges mining cryptocurrency on expensive GPU-enabled instances. Or "account support" calls with a notice that your account has false charges, but they can remove them once they verify your credit card info. There are fake software updates that steal bank account information. And fictitious warnings about login failures to your corporate email with a link to "login and verify access." Not to mention account information leaked from one of your online services, including your banking site. Although there are many causes of account exposure, they fall broadly into two categories: malicious intent or accidental leaks.

      • Stop using phishing as a measure of your cyber awareness culture | Pen Test Partners

        If I had a penny for every time someone said to me “let’s measure our security culture by phishing our staff” I’d probably be able to fill my car up.

        It’s a really easy thing to do, you carry out some online training and typically they come with phishing simulations as a free or low cost add on. On the face of it that sounds great, train staff to spot phishing emails and they will be much better prepared to take up the mantle of defending your organisation. It sounds like the perfect solution, There’s a problem though, it’s Not.

      • FOSSLifeNew OrBit Malware Infects All Running Processes [Ed: "FOSSlife Team" helps the anti-Linux FUD lobby; so much for "FOSS'... maybe focus on back doors in proprietary software instead; no need to infect it, the doors are wide open...]

        Security researchers from Intezer have reported a new Linux malware variant called OrBit.

      • LWNSecurity updates for Tuesday [LWN.net]

        Security updates have been issued by Debian (chromium), Mageia (openssl and webkit2), Slackware (seamonkey), SUSE (crash, curl, freerdp, ignition, libnbd, and python3), and Ubuntu (dovecot and python-ldap).

      • Understanding Memory Leaks in Java | Developer.com

        When creating applications in Java, developers can create managed objects in their software using the new keyword. Programmers do not need to remove these managed objects explicitly in their code, since the garbage collector takes care of the removal of objects that are no longer required. So long as the objects are disposed of by the garbage collector, this is fine. However, if the garbage collector is unable to remove objects that are no longer referenced, there are chances of memory leaks in your applications.

        A memory leak in Java refers to a state when an object no longer needed by the application remains alive in the Java Virtual Machine (JVM). Memory leaks occur when an application accidentally hangs on to object references that are no longer necessary. Memory leaks lead to performance degradation over time because of your application’s increased (and unexpected) use of memory.

      • X.Org Security Advisory: July 12, 2022
        X.Org Security Advisory: July 12, 2022
        
        

        Multiple input validation failures in X server extensions =========================================================

        All theses issues can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.

        * CVE-2022-2319/ZDI-CAN-16062: X.Org Server ProcXkbSetGeometry Out-Of-Bounds Access

        The handler for the ProcXkbSetGeometry request of the Xkb extension does not properly validate the request length leading to out of bounds memory write.

        * CVE-2022-2320/ZDI-CAN-16070: X.Org Server ProcXkbSetDeviceInfo Out-Of-Bounds Access

        The handler for the ProcXkbSetDeviceInfo request of the Xkb extension does not properly validate the request length leading to out of bounds memory write.
      • xorg-server 21.1.4
        This release fixes 2 recently reported security vulnerabilities in xkb, several
        regressions since 1.20.x and a number of miscellaneous bugs.
        
      • ViceHackers Say They Can Unlock and Start Honda Cars Remotely

        On Thursday, a security researcher who goes by Kevin2600 published a technical report and videos on a vulnerability that he claims allows anyone armed with a simple hardware device to steal the code to unlock Honda vehicles. Kevin2600, who works for cybersecurity firm Star-V Lab, dubbed the attack RollingPWN.

        […]

        In a phone call, Kevin2600 explained that the attack relies on a weakness that allows someone using a software defined radio—such as HackRF—to capture the code that the car owner uses to open the car, and then replay it so that the hacker can open the car as well. In some cases, he said, the attack can be performed from 30 meters (approximately 98 feet) away.

        In the videos, Kevin2600 and his colleagues show how the attack works by unlocking different models of Honda cars with a device connected to a laptop.

        The Honda models that Kevin2600 and his colleagues tested the attack on use a so-called rolling code mechanism, which means that€­—in theory€­—every time the car owner uses the keyfob, it sends a different code to open it. This should make it impossible to capture the code and use it again. But the researchers found that there is a flaw that allows them to roll back the codes and reuse old codes to open the car, Kevin2600 said.

      • Privacy/Surveillance

        • AccessNowTikTok forced to pause plans for privacy-intrusive ads

          When TikTok announced its plan to impose personalised ads on everyone over 18 who uses the platform in EEA, UK, and Switzerland, Access Now told the company in no uncertain terms that it must scrap this action that would risk privacy, and deny agency. Reports now indicate that TikTok has hit the brakes.

          On 5 July, 2022, Access Now sent open letters to TikTok to immediately halt these invasive changes, and to the European Data Protection Board and its members to intervene.

    • Civil Rights/Policing

      • AccessNowThe EU AI Act proposal: a timeline - Access Now

        The use of artificial intelligence (AI) technology opens new risks for human rights, including for people and communities targeted for discrimination and marginalisation. Access Now advocates for AI regulations based on internationally recognised human rights principles. Below is a summary of our proposed amendments to the draft EU AI Act and a timeline of our related commentary and recommendations.

      • AccessNowCivil society calls on Indian government to withdraw amendments to IT Rules - Access Now

        We, the undersigned organizations operating in more than 10 countries and internationally in the promotion and protection of digital rights and freedoms, submit the following comments and urge you to withdraw the amendments recently proposed to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (IT Rules 2021). [1] We commend the Ministry of Electronics and Information Technology (MeitY) on the initiative to amend the IT Rules 2021, and commence a process of consultation on the proposed amendments.

        Amendments to the Rules are necessary in order to meaningfully protect fundamental rights. In our view, however, these new revisions add concerns to already restrictive provisions in the Rules that pose a direct threat to the rights to freedom of expression and privacy, as well as other related human rights protected under the Indian Constitution and international law.

    • Digital Restrictions (DRM)

      • The Register UKHive to pull the plug on smart home gadgets by 2025 [Ed: "Smart" things are for dumb, gullible people]

        Home automation platform Hive plans to terminate key products in its line, including the Hive View cameras, HomeShield, and Leak products.

        A Hive spokesperson told The Register: "At Hive, we've got big plans to make... homes greener, so we've made the tough decision to discontinue our smart security and leak detection products. As a smart tech brand in the middle of a climate crisis, we know the focus needs to change and will instead be developing smart home tech that'll help get us closer to achieving Net Zero."

        Users, some of whom have invested four figure sums in Hive products are less than impressed.

    • Monopolies

      • U.S. Antitrust Reform Is Necessary to Defend Global Human Rights [Ed: Why is Microsoft absent from this? Have the bribes paid off? Paid politicians? Paid press? Microsoft: get busy, regulators, with "GAFA"... while we too spy even more than "GAFA" and also commit a ton of crimes... including against GNU/Linux (which we claim to "love" to keep you asleep)... Public Access is already infiltrated by Microsoft (the Board), but is Access Now also infiltrated to distract and deflect?]

        In today’s interconnected world, it is nearly impossible to function in society without relying on a tech tool made in the USA. Trying to sell something? Use Facebook marketplace. Want to start a business? Google has a platform for your micro-targeted ads. This excessive concentration of power has helped solidify Big Tech’s reign over the world, making it much harder to hold these companies accountable for facilitating human rights violations, such as attacks against human rights defenders in the Philippines and ethnic violence in Ethiopia.


* Gemini (Primer) links can be opened using Gemini software. It's like the World Wide Web but a lot lighter.



Recent Techrights' Posts

A farewell to Finland, an occupied territory
Finland, Finland, Finland
 
GNU/Linux in Monaco: From 0.3% to Almost 6%
Monaco is a small country
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, May 22, 2024
IRC logs for Wednesday, May 22, 2024
Microsoft Has Lost Cote D'ivoire (Ivory Coast), Where Android Now Exceeds 60% of the Operating Systems' 'Market Share'
According to statCounter anyway
The Rumour Said Later Today Red Hat (IBM) Might Announce Layoffs
Let's see what happens later today (or next week)
Governments That Fail Journalism
Australia is known for giving us pure garbage like Rupert Murdoch
Windows Has Fallen From 'Grace'
When you tell people that Microsoft watches their every move in Windows many of them will freak out and ask for alternatives
Serbia: GNU/Linux at Almost 4% (or Beyond if ChromeOS is Counted)
considerable growth for GNU/Linux
Links 22/05/2024: China in Other Countries' Islands, Growing Threat of Piracy
Links for the day
Gemini Links 22/05/2024: Freedom Through Limitation, Cloud Photos
Links for the day
Canonical Supports Monopoly
more of the same
Links 22/05/2024: "Copilot+" as Mass Surveillance and Microsoft Defying Consent in Scarlett Johansson's Case
Links for the day
[Meme] Escalating After Failures
4 stages of cancel culture
Red Hat Had 2+ Days to Deny Reports of Impending Layoffs. But Red Hat Chose to Keep Silent.
Red Hat DOES NOT deny layoffs on the way
Microsoft-Connected Person Was Threatening to Sue Me and to Sue My Wife (Because His Feelings Were Hurt After Had He Spent More Than a Decade Defaming Me and Violating My Family's Dignity, Privacy)
litigation was chosen and we shall defend everything we wrote
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, May 21, 2024
IRC logs for Tuesday, May 21, 2024
Attempts to Sink the Free Software Movement (Under the Guise of Saving It)
We can see who's being drowned
Czech Republic: Windows Down From 98% to 43%, GNU/Linux Rises to Over 3%
modest gains for GNU/Linux
Links 22/05/2024: Pixar Layoffs and More Speculation About Microsoft Shutdowns/Layoffs (Ninja Theory)
Links for the day
Microsoft-Connected Sites Trying to Shift Attention Away From Microsoft's Megabreach Only Days Before Important If Not Unprecedented Grilling by the US Government?
Why does the mainstream media not entertain the possibility a lot of these talking points are directed out of Redmond?
Gemini Links 21/05/2024: Caesar II for MS-DOS and Reinventing the Assertion Wheel
Links for the day
Internal Memos/Communications Hinting at "a New, But Masked, Round of Layoffs" at Red Hat
A negative outlook heads of a long weekend
Nigeria: Windows Down to 6%, Android at All-Time High of 77%
Google is becoming the "new monopoly" in some places
[Video] Microsoft's Attack on Education
Microsoft's cult-like activities and overt entryism
[Meme] Money In, No Money Out (Granting Loads of Invalid European Patents)
EPO production?
Staff Representation at the EPO Has Just Explained to Heads of Delegations (National Delegates) Why the EPO's Financial Study is Another Hoax
Here we are again 5 years later
Canonical and Red Hat Are Not Competing With Microsoft Anymore
What a shame they hired so many people from Microsoft...
Links 21/05/2024: "Hating Apple Goes Mainstream", Lots of Coverage About Julian Assange Ruling
Links for the day
Gemini Links 21/05/2024: Losing Fats and Modern XMPP
Links for the day
Microsoft Windows Used to Have Nearly 100% in China and Now Google Has 50% (With Android)
Will China bring about a faster "fall" for Microsoft?
Pursuing a Case With No Prospects (Because It's "Funny")
the perpetrators are taking a firm that's considered notorious
GNU/Linux Growing Worldwide (the Story So Far!)
Microsoft is unable to stop GNU/Linux
GNU/Linux in Honduras: From 0.28% to 6%
Honduras remains somewhat of a hotspot
Good News From Manchester and London, Plus High Productivity in Techrights
what has happened and what's coming
[Video] The 'Linux' Foundation Cannot be Repaired Anymore (It Sold Out)
We might need to accept that the Linux Foundation lost its way
Links 21/05/2024: Tesla Layoffs and Further Free Speech Perils Online
Links for the day
Gemini Links 21/05/2024: New Gemini Reader and Gemini Games
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, May 20, 2024
IRC logs for Monday, May 20, 2024