|
|
Subscribe / Log in / New account

Brief items

Security

Security quotes of the week

There's a couple of morals here:
  • Don't default to running debug daemons on production firmware seriously how hard is this
  • If you're going to have a security disclosure form, read it
Matthew Garrett investigates the TP-Link SR20

Your phone's screen can be thought of as a drum – a membrane supported at the edges. It makes slightly different sounds depending on where you tap it. Modern phones and tablets typically have two microphones, so you can also measure the time difference of arrival of the sounds. The upshot is that can recover PIN codes and short words given a few measurements, and in some cases even long and complex words.
Ross Anderson previews a new paper

I created an Instagram page that showcased pictures of New York City's skylines, iconic spots, elegant skyscrapers — you name it. The page has amassed a following of over 25,000 users in the NYC area and it's still rapidly growing.

I reach out restaurants in the area either via Instagram's direct messaging or email and offer to post a positive review in return for a free entree or at least a discount. Almost every restaurant I've messaged came back at me with a compensated meal or a gift card. Most places have an allocated marketing budget for these types of things so they were happy to offer me a free dining experience in exchange for a promotion. I've ended up giving some of these meals away to my friends and family because at times I had too many queued up to use myself.

The beauty of this all is that I automated the whole thing. And I mean 100% of it. I wrote code that finds these pictures or videos, makes a caption, adds hashtags, credits where the picture or video comes from, weeds out bad or spammy posts, posts them, follows and unfollows users, likes pictures, monitors my inbox, and most importantly — both direct messages and emails restaurants about a potential promotion.

Chris Buetti figures out how to get free food from Instagram

Comments (2 posted)

Kernel development

Kernel release status

The current development kernel is 5.1-rc3, released on March 31. Linus said: "Nothing particularly unusual going on here".

Stable updates: 5.0.6, 4.19.33, 4.14.110, 4.9.167, 4.4.178, and 3.18.138 were released on April 3.

Comments (none posted)

Quotes of the week

Are your computer operators aggressively derpy? Do they have a habit of leaving disk cables on the floor so they can trip over them twenty times a day? Does this leave you with sad files full of zeroes?

If so, bootfs is for you! This new filesystem type uses journalling to ensure metadata integrity, but forces all writes and directory tree updates to be synchronous, fsyncs files on close, and checkpoints its journal whenever a synchronization event happens. Some allege this is very slow, but I've been able to max out the iops on both of my double height floppy drives! In a power-cycling stress test, I found that the switch broke off in my hand before I lost any data. This concept may sound terrible, but like any good crutch, it _is_ made of wood!

Darrick Wong

Just a few nitpicks on the patches themself. You want to change msleep() to mdelay() in order to avoid "Scheduling while atomic" noise and you want to have global serialization because interleaving "La Paloma" from CPU1 and "Once Upon a Time in the West" from CPU2 sounds really horrible.
Thomas Gleixner

Saying kernel development is all about the code is a pretty big lie. You will not be successful in kernel development without the ability to communicate.
Laura Abbott

Comments (none posted)

Distributions

The Debian Project mourns the loss of Innocent de Marchi

The Debian Project sadly announced the passing of Innocent de Marchi. "Innocent was a math teacher and a free software developer. One of his passions was tangram puzzles, which led him to write a tangram-like game that he later packaged and maintained in Debian. Soon his contributions expanded to other areas, and he also worked as a tireless translator into Catalan."

Full Story (comments: none)

Distribution quotes of the week

Personally I think the phrase "Debian Developer" and the abbreviation DD is a relic of an earlier era when the set of tasks available to Debian contributors were more technical and less varied. I try to use "Debian member" in mails since it is clearer what that means to a larger set of people and I'd like to see Debian culture (and perhaps the official documents) move towards that too.
Paul Wise

I am all for making it easier for [programming-]language-specific packaging teams to do their curation work.

But I don't think it is a problem *for Debian* that there are systems which look more convenient until you discover that are a tyre fire and now you are on fire too. I don't think we should emulate them.

Ian Jackson on programming-language-specific repositories and Debian

Comments (none posted)

Development

Chef becomes 100% free software

Chef, the purveyor of a popular configuration-management system, has announced a move away from the open-core business model and toward the open-sourcing of all of its software. "We aren’t making this change lightly. Over the years we have experimented with and learned from a variety of different open source, community and commercial models, in search of the right balance. We believe that this change, and the way we have made it, best aligns the objectives of our communities with our own business objectives. Now we can focus all of our investment and energy on building the best possible products in the best possible way for our community without having to choose between what is 'proprietary' and what is 'in the commons.'"

Comments (19 posted)

Courtès: Connecting reproducible deployment to a long-term source code archive

On the Guix blog, Ludovic Courtès writes about connecting reproducible builds for the Guix package manager with the Software Heritage archive. "It quickly became clear that reproducible builds had 'reproducible source code downloads', so to speak, as a prerequisite. The Software Heritage archive is the missing piece that would finally allow us to reproduce software environments years later in spite of the volatility of code hosting sites. Software Heritage’s mission is to archive essentially 'all' the source code ever published, including version control history. Its archive already periodically ingests release tarballs from the GNU servers, repositories from GitHub, packages from PyPI, and much more. We quickly settled on a scheme where Guix would fall back to the Software Heritage archive whenever it fails to download source code from its original location. That way, package definitions don’t need to be modified: they still refer to the original source code URL, but the downloading machinery transparently goes to Software Heritage when needed."

Comments (8 posted)

Linux Foundation Welcomes LVFS Project (Linux.com)

Linux.com interviews Richard Hughes about the Linux Vendor Firmware Service (LVFS), which has recently joined the Linux Foundation as a new project. Hughes is the founder and maintainer of the project. "The short-term goal was to get 95% of updatable consumer hardware supported. With the recent addition of HP that's now a realistic target, although you have to qualify the 95% with 'new consumer non-enterprise hardware sold this year' as quite a few vendors will only support hardware no older than a few years at most, and most still charge for firmware updates for enterprise hardware. My long-term goal is for the LVFS to be seen like a boring, critical part of infrastructure in Linux, much like you’d consider an NTP server for accurate time, or a PGP keyserver for trust. With the recent Spectre and Meltdown issues hitting the industry, firmware updates are no longer seen as something that just adds support for new hardware or fixes the occasional hardware issue. Now the EFI BIOS is a fully fledged operating system with networking capabilities, companies and government agencies are realizing that firmware updates are as important as kernel updates, and many are now writing in 'must support LVFS' as part of any purchasing policy."

Comments (33 posted)

Development quote of the week

If you are open to review other people’s contributions, there is a high [chance] you will find challengers disguised as contributors. And your code review will be treated as an intellectual battle between good and evil. And you will need to explain and clarify over and over, and deal with circular logic, and pretty much any tool people might use to win battles instead of improving their code. And that is incredibly tiresome.
Georges Stavracas (Thanks to Paul Wise)

Comments (1 posted)

Miscellaneous

Bottomley: A Roadmap for Eliminating Patents in Open Source

James Bottomley has posted a detailed description of how patent exhaustion might be used to mostly eliminate the software patent threat to free software. "The intriguing possibility this offers us is that we may be close to an enforceable court decision (at least in the US) that would render all patents in open source owned by community members exhausted and thus unenforceable. The purpose of this blog post is to explain the current landscape and how we might be able to get the necessary missing court decisions to make this hope a reality." LWN covered the FOSDEM talk by Van Lindberg that underlies Bottomley's post.

Comments (10 posted)

VMware Suit Concludes in Germany

Software Freedom Conservancy reports that the Hamburg Higher Regional Court affirmed the lower court's decision, which dismissed Christoph Hellwig's case against VMWare in Germany. Hellwig will not pursue the case further in German courts.

Conservancy's staff also spent a significant amount of time and resources at each stage of the proceedings — most recently, analyzing what this ruling could mean for future enforcement actions. The German court made a final decision in this case on procedure and standing, not on substance. While we are disappointed that the courts did not take the opportunity to deliver a clear pro-software-freedom ruling, this ruling does not set precedent and the implications of the decision are limited. This matter certainly would proceed differently with different presentation of plaintiffs or in another jurisdiction.

In addition to VMware committing to removing vmklinux from their kernel, this case also succeeded in sparking significant discussion about the community-wide implications for free software when some companies playing by the rules while others continually break them. Our collective insistence, that licensing terms are not optional, has now spurred other companies to take copyleft compliance more seriously. The increased focus on respecting licenses post-lawsuit and providing source code for derivative works — when coupled with VMware's reluctant but eventual compliance — is a victory, even if we must now look to other jurisdictions and other last-resort legal actions to adjudicate the question of the GPL and derivative works of Linux.

Comments (28 posted)

Linux Journal at 25

Linux Journal celebrates 25 years since it began publishing. "Most magazines have the life expectancy of a house plant. Such was the betting line for Linux Journal when it started in April 1994. Our budget was a shoestring. The closest our owner, SSC (Specialized System Consultants) came to the magazine business was with the reference cards it published for UNIX, C, VI, Java, Bash and so on."

Comments (1 posted)

Page editor: Jake Edge
Next page: Announcements>>


Copyright © 2019, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds