Language Selection

English French German Italian Portuguese Spanish

August 2018

Limiting Free Licences and New FUD From Veracode/CA

Filed under
OSS
Security
Legal
  • ​Javascript Tool Maker Relents After Mixing Immigration Politics with Open Source Licensing

    In very short order, Lerna, a company that offers some Javascript tooling, has learned the hard way not to mess with the integrity of an open source license. In other words, don’t decide you’re going to take an existing OSI-certified open source license, modify it to suit your agenda, license your code under the newly derived license, and still continue to refer to your offering as "open source.”

    First, this analysis piece is really just a follow up to my previous post about why it’s time to reject the latest attack on open source software (OSS). The main point of that post was to point out that all of us who have experienced the benefits of open source (ok, that’s nearly all human beings) should play a role in defending it. Otherwise, it will whither and so too will the benefits most of us have come to enjoy, blind to the fact that open source is playing such an important role in our lives.

  • Does Redis' Commons Clause threaten open-source software?
  • Get a Jump on Reducing Your Open Source Software Security Risks [Ed: Anti-FOSS firm Veracode/CA pays IDG for spam which stigmatises FOSS as lacking security]

Software: gPodder, Puppet Bolt and Last howtos for the Week

Filed under
Software
HowTos
  • gPodder – podcast client written in Python

    gPodder is an open source tool that downloads and manages free audio and video content (“podcasts”) for you. The software is written in Python and sports a simple GTK interface. The software package also includes a command-line interface which is called gpo. It lets you listen to podcasts on your computer or on mobile devices. The software is very mature; it’s been in development since 2005.

  • FOSS Project Spotlight: Run Remote Tasks on Linux and Windows with Puppet Bolt

    Puppet, the company that makes automation software for managing systems and delivering software, has introduced Puppet Bolt, an open-source, agentless multiplatform tool for running commands, scripts, tasks and orchestrated workflows on remote Linux and Windows systems.

    The tool, which is freely available as a Linux package, Ruby gem and macOS or Windows installer, is ideal for sysadmins and others who want to perform a wide range of automation tasks on remote bare-metal servers, VMs or cloud instances without the need for any prerequisites. Puppet Bolt doesn't require any previous Puppet know-how. Nor does it require a Puppet agent or Puppet master. It uses only SSH and WinRM (or can piggyback Puppet transports) to communicate and execute tasks on remote nodes.

    Despite its simplicity, Puppet Bolt can execute all your existing scripts written in Bash, PowerShell, Python or any other language, stop and start Linux or Windows services, gather information about packages and system facts, or deploy procedural orchestrated workflows, otherwise known as plans. You can do all this right from your workstation or laptop.

  • How to install MediaWiki on Ubuntu 18.04 LTS
  • How to Install MyWebSQL 3.7 on CentOS 7
  • Fix GTK File Chooser Cannot Add/Remove Bookmarks
  • Docker Guide: Deploying Ghost Blog with MySQL and Traefik with Docker
  • Move the Ubuntu Launcher to Bottom or Right

Linux Kernel up to 4.15-rc3 Crypto Subsystem memory corruption

Filed under
Linux
Security
  • Linux Kernel up to 4.15-rc3 Crypto Subsystem memory corruption

    The weakness was shared 08/30/2018 as bug report (Bugzilla). The advisory is available at bugzilla.redhat.com. This vulnerability is traded as CVE-2018-14619 since 07/27/2018. Local access is required to approach this attack. A single authentication is needed for exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 08/31/2018).

  • CVE-2018-14619: New Critical Linux Kernel Vulnerability

    A new Linux kernel vulnerability identified as CVE-2018-14619 has been discovered by Red Hat Engineering researchers Florian Weimer and Ondrej Mosnacek. More particularly, the flaw was found in the crypto subsystem of the Linux kernel.

Security: Alexa Holes, Zemlin on CII, and Apache Struts Patches

Filed under
Security
  • Amazon Alexa Security Risk Allows Hackers to Take Over Voice Commands, Steal Private Information

    The world is changing and in the modern era, we are becoming reliant on our Internet of Things devices by the day. But this reliances could cost us everything, it could allow someone to steal our identity, bank information, medical history, and what not.

    Amazon Alexa has been criticised for having a number of security flaws but Amazon has been quick to deal with them. However, this new security flaw may not have a fix at all. And this could be the most dangerous security threat yet.

    According to research conducted by the University of Illinois at Urbana-Champaign (UIUC), Amazon Alexa’s idiosyncrasies can be exploited through voice-commands to route users to malicious websites. Hackers are targeting the loopholes in machine learning algorithms to access private information.

  • Researchers show Alexa “skill squatting” could hijack voice commands

    The success of Internet of Things devices such as Amazon's Echo and Google Home have created an opportunity for developers to build voice-activated applications that connect ever deeper—into customers' homes and personal lives. And—according to research by a team from the University of Illinois at Urbana-Champaign (UIUC)—the potential to exploit some of the idiosyncrasies of voice-recognition machine-learning systems for malicious purposes has grown as well.

    Called "skill squatting," the attack method (described in a paper presented at USENIX Security Symposium in Baltimore this month) is currently limited to the Amazon Alexa platform—but it reveals a weakness that other voice platforms will have to resolve as they widen support for third-party applications. Ars met with the UIUC team (which is comprised of Deepak Kumar, Riccardo Paccagnella, Paul Murley, Eric Hennenfent, Joshua Mason, Assistant Professor Adam Bates, and Professor Michael Bailey) at USENIX Security. We talked about their research and the potential for other threats posed by voice-based input to information systems.

  • The Linux Foundation Set to Improve Open-Source Code Security

    CII is now working on further trying to identify which projects matter to the security of the internet as a whole, rather than taking a broader approach of looking at every single open-source project, he said. In his view, by prioritizing the projects that are the most critical to the operation of the internet and modern IT infrastructure, the CII can be more effective in improving security.

    "You'll see in the next three months or so, additional activity coming out of CII," Zemlin said.

    Among the new activities coming from the CII, will be additional human resources as well as new funding. The Linux Foundation had raised $5.8 million from contributors to help fund CII efforts, which Zemlin said has now all been spent. Zemlin that CII's money was used to fund development work for OpenSSL, NTP (Network Time Protocol) and conducting audits.

  • Apache Struts 2.3.25 and 2.5.17 resolve Cryptojacking Exploit Vulnerability

    Information regarding a severe vulnerability found in Apache Struts was revealed last week. A proof of concept of the vulnerability was also published publicly along with the vulnerability’s details. Since then, it seems that malicious attackers have set out to repeatedly exploit the vulnerability to remotely install a cryptocurrency mining software on users’ devices and steal cryptocurrency through the exploit. The vulnerability has been allotted the CVE identification label CVE-2018-11776.

    This behavior was first spotted by the security and data protection IT company, Volexity, and since its discovery, the rate of exploits has been increasing rapidly, drawing attention to the critical severity of the Apache Struts vulnerability. The company released the following statement on the issue: “Volexity has observed at least one threat actor attempting to exploit CVE-2018-11776 en masse in order to install the CNRig cryptocurrency miner. The initial observed scanning originated from the Russian and French IP addresses 95.161.225.94 and 167.114.171.27.”

Gnome 3 & best extensions

Filed under
GNOME

There you go. Writing this article got me thinking. Gnome 3 is like Firefox 57. It brought about a radical change, made a lot of what made the original version great redundant, and hid options from users, making customization difficult. Gnome 3 also fights hard against extensions. But these are the bread and butter of what makes it useful, practical and appealing to users. The same is also true of Cinnamon, which has also partially been afflicted the same way. Technically, one may claim that extensions are a poor excuse for bad design, but then, in general, history has shown that they do make products more engaging in the long run. Collective intelligence can be a good thing, especially when harvested for free.

I am still convinced that Gnome 3 is doing it wrong, and that Plasma, Unity or even MATE are much better solutions on all levels. But then, if you do want to use this desktop environment, there are several handy extensions that can truly transform the experience. The must-have set, and then a sweetening of five nice little extras, which help make the desktop more useful and fun. If you have any other suggestions, this is a good time to use your email sending skills. And we're done.

Read more

Games: Scarecrow Studio, RAZED, XCOM 2

Filed under
Gaming
  • Colourful comedy adventure '3 Minutes to Midnight' planned to release for Linux

    Scarecrow Studio [Official Site] have officially announced that their colourful comedy adventure 3 Minutes to Midnight with a trailer and it's coming to Linux.

  • RAZED will bring lightning-fast platformer racing to Linux on September 14th

    Soaked in some vibrant colours, lightning-fast platformer RAZED will requiring a good pair of running shoes when it releases with Linux support on September 14th.

    Developed by Warpfish Games with a sprinkle of publishing from PQube Limited, RAZED is promising an exciting speedrunning experience across the 60 levels being included at release. These levels are spreadout across six different worlds, each of them having their own unique flavour. Each world will also come with an ability to unlock, along with a boss battle.

  • XCOM 2 to possibly get another expansion with 'TLE'

    There's rumours circling around about XCOM 2 getting a new expansion and it seems whatever it turns out to be that Linux support should be there.

A Look At DragonFlyBSD's Kernel Tuning Performance On The AMD Threadripper 2990WX

Filed under
Graphics/Benchmarks
BSD

Last week I posted some initial tests and benchmarks of DragonFlyBSD/FreeBSD on the AMD Threadripper 2990WX. While that went well and the BSDs scale with this 32-core / 64-thread processor better than Windows, lead DragonFly developer Matthew Dillon had picked up a 2990WX system and has been tuning the kernel ever since. Here are some benchmarks looking at some of his recent optimizations.

Hours after that BSD Threadripper testing ended last week, Matthew Dillon landed some more performance tuning/optimizations to benefit the Threadripper 2990WX design. Here are some benchmarks of that original 2990WX support on DragonFlyBSD 5.3-DEVELOPMENT compared to the later daily snapshot.

Read more

SharkLinux Distro: Open Source in Action

Filed under
Linux
OSS

Every so often I run into a Linux distribution that reminds me of the power of open source software. SharkLinux is one such distribution. With a single developer creating this project, it attempts to change things up a bit. Some of those changes will be gladly welcomed by new users, while scoffed at by the Linux faithful. In the end, however, thanks to open source software, the developer of SharkLinux has created a distribution exactly how he would want it to be. And that my friends, is one amazing aspect of open source. We get to do it our way.

But what is SharkLinux and what makes it stand out? I could make one statement about SharkLinux and end this now. The developer of SharkLinux reportedly developed the entire distribution using only an Android phone. That, alone, should have you wanting to give SharkLinux a go.

Read more

Linux hacker board features new Allwinner SoC with analytics accelerator

Filed under
Linux

The open-spec, camera-oriented “Lindenis V5” SBC runs Linux on a new quad -A7 Allwinner V5 V100 with a visual analytics accelerator, and offers dual MIPI-CSI, GbE, and a 40-pin expansion header.

A Shenzhen, China startup called Lindenis Tech. Ltd., staffed by former Allwinner employees, has launched an open spec, 139 x 85mm single board computer that debuts a 1.5GHz Allwinner camera SoC called the V5 V100. Like the Allwinner A33, H2+, and H3 SoCs, the Allwinner V5 V100 (PDF) runs on 4x Cortex-A7 cores. However, instead of an Arm Mali GPU, there’s a custom VPU, a dual ISP, and an “AIE” acceleration engine for visual analytics, with support for motion detection, perimeter defense, video diagnosis, face detection, flow statistics, and binocular depth maps.

Read more

More in Tux Machines

Fedora, Red Hat and IBM Leftovers

  • Feora: How to setup an anonymous FTP download server

    Sometimes you may not need to set up a full FTP server with authenticated users with upload and download privileges. If you are simply looking for a quick way to allow users to grab a few files, an anonymous FTP server can fit the bill. This article shows you show to set it up.

  • Kubernetes networking, OpenStack Train, and more industry trends

    As part of my role as a senior product marketing manager at an enterprise software company with an open source development model, I publish a regular update about open source community, market, and industry trends for product marketers, managers, and other influencers. Here are five of my and their favorite articles from that update.

  • How collaboration fueled a development breakthrough at Greenpeace

    We'd managed to launch a prototype of Planet 4, Greenpeace's new, open engagement platform for activists and communities. It's live in more than 38 countries (with many more sites). More than 1.75 million people are using it. We've topped more than 3.1 million pageviews. To get here, we spent more than 650 hours in meetings, drank 1,478 litres of coffee, and fixed more than 300 bugs. But it fell short of our vision; it still wasn't the minimum lovable product we wanted and we didn't know how to move it forward. We were stuck. Planet 4's complexity was daunting. We didn't always have the right people to address the numerous challenges the project raised. We didn't know if we'd ever realize our vision. Yet a commitment to openness had gotten us here, and I knew a commitment to openness would get us through this, too.

  • After Seven Quarters Of Growth, Power Systems Declines

    The tough compares have hit home on IBM’s Power Systems business, but the good news is that this has happened after seven consecutive quarters of growth for the Power-based server business that Big Blue owns lock, stock, and barrel. Even with this decline, which was quite steep because of the triple whammy of tough compares (more on that in a moment), there is still a healthy underlying Power Systems business that is much better off than the last time it was hit by similar declines. Let’s take a look at the numbers for IBM’s Power Systems division and then work our way up through its Systems group and to the company at large. According to the presentation put together by IBM’s chief financial officer, Jim Cavanaugh, to go over the numbers for the third quarter of 2019, the Power Systems division had a decline of 27 percent in constant currency (meaning growth in local currencies aggregated across those economies), with as-reported sales also being down 27 percent. In other words, currency had no effect on the overall Power Systems business even if it did impact IBM’s sales, as reported in U.S. dollars, by 1.3 percent in the period ended in September.

  • Red Hat Government Symposium: Transforming culture and creating open innovation powerhouses

    For state, local and federal government agencies, digital transformation means much more than just migrating away from legacy technology systems. It involves inspiring ideas, encouraging communication and collaboration, and empowering government employees to forge their organizations’ innovation pathways.  That’s why we are focusing on cultural transformation at our upcoming Red Hat Government Symposium. This year’s one-day event—Open transforms: A future built on open source—will be on Nov. 12, 2019, in Washington, D.C., and will feature a stellar lineup of keynotes and panels, as well as fantastic networking opportunities with industry peers.  

  • Journey to the Future of Money with Red Hat at Money 20/20

    Event season is in full swing for the Red Hat Financial services team, and this time, we are headed to the bright lights of Las Vegas to attend Money 20/20 USA, being held from October 27 - 30th. Red Hat will be attending to sponsor a number of activities and discuss the important role open source technologies play in the future of payments, money and banking activities. 

SUSE Leftovers

  • Digital Transformation – it’s dead, Jim?

    However, digital transformation is like life – it’s an ongoing process, not something you just do once and then it’s done and dusted. A large part of digital transformation is your cloud strategy, which I wrote about fairly recently. That is also something that isn’t a one-off task, but is instead an evolving, transformational process. It was interesting to see, after speaking to attendees at the Gartner event in Frankfurt, that a number of them still hadn’t defined their cloud strategy outside of “we need to move everything to the cloud for cost savings and agility”, while some hadn’t even begun writing a cloud strategy. Looking at a chart showing the trends in Google searches for digital transformation in the US (the global trend is the same) over the past 5 years, you can see that while it trends up and then down fairly regularly, it still continues to grow on the whole. So if it’s been around for a while, why does it continue to grow, and is it still relevant?

  • New Security Tools for Application Delivery

    What if you could shut down cybercriminals’ most frequently used method of attack? At SUSE we’ve recently made a move to help you get closer to that goal. As you may know, SUSE recently released new versions of our application delivery solutions, SUSE CaaS Platform 4 and SUSE Cloud Application Platform 1.5. The releases contain a number of important updates and features, but the one most exciting in terms of protecting your organization is the addition of Cilium to SUSE CaaS Platform.

Security: Patches, Nostromo, PureBoot and Microsoft's Latest DRM Lock-down (Locking GNU/Linux Out for 'Security')

  • Security updates for Monday

    Security updates have been issued by Debian (aspell, graphite-web, imagemagick, mediawiki, milkytracker, nfs-utils, and openjdk-11), Fedora (kernel, kernel-headers, kernel-tools, mediawiki, and radare2), openSUSE (dhcp, libpcap, lighttpd, and tcpdump), Scientific Linux (java-1.8.0-openjdk), Slackware (python), SUSE (bluez, kernel, and python-xdg), and Ubuntu (aspell).

  • Nostromo web servers exposed by resurrected RCE vulnerability

    A security researcher has disclosed the existence of a remote code execution (RCE) vulnerability in the open source Nostromo web server software. On Monday, a threat analyst and bounty hunter with the online handle Sudoka published a technical analysis of the bug, tracked as CVE-2019-16278. The vulnerability impacts Nostromo, also known as nhttpd, a niche web server used by some in the Unix and open source community but altogether dwarfed in popularity by Apache. In a blog post, Sudoka said the vulnerability stems from shortcomings in how the path of URLs are verified. Inadequate URL checks mean that an unauthenticated attackers is able to force a server to point to a shell file, resulting in the potential execution of arbitrary code.

  • PureBoot Best Practices

    Recently we started offering the PureBoot Bundle–PureBoot installed and configured on your laptop at the factory and bundled with a pre-configured Librem Key so you can detect tampering from the moment you unbox your laptop. It’s been great to see so many customers select the PureBoot Bundle and now that PureBoot is on so many more customer laptops, we felt it was a good time to write up a post to describe some best practices when using PureBoot. If you are just getting started with PureBoot and want to know the basics, check out our Getting Started Guide for pointers on what to do when you start up your PureBoot Bundle for the first time. In this post I’ll assume you have already gone through the first boot and first reboot of your laptop and have settled into daily use.

  •                
  • Secured-core PCs offer new defense against firmware attacks
                     
                       

    Microsoft, chipmakers, and several PC makers on Monday announced Secured-core PCs, which use hardware-based defense mechanisms to combat firmware-level security attacks.

  •                
  • Microsoft's New Plan to Defend the Code Deep Within PCs
                     
                       

    The idea of secured-core PC is to take firmware out of that equation, eliminating it as a link in the chain that determines what's trustworthy on a system. Instead of relying on firmware, Microsoft has worked with AMD, Intel, and Qualcomm to make new central processing unit chips that can run integrity checks during boot in a controlled, cryptographically verified way. Only the chip manufacturers will hold the encryption keys to broker these checks, and they're burned onto the CPUs during manufacturing rather than interacting with the firmware's amorphous, often unreliable code layer.

  •                            

Games: Remote Play Together, OpenRA, The Coma 2, Humble Store and Shiver

  • Steam 'Remote Play Together' is now in Beta, allowing local multiplayer games over the net

    Today, Valve have released an exciting update to the Steam Beta Client which adds in Remote Play Together, allowing you to play local co-op, local multiplayer and shared/split screen games over the net with your friends. From what Valve said, it will allow up to four players "or even more in ideal conditions", meaning if you all have reasonable internet connections you might be able to play with quite a few people. Something that has of course been done elsewhere, although the advantage here is no extra payments or software needed as it runs right from the Steam client. It's very simply done too. Just like you would invite friends to join your online game, you invite them to Remote Play Together from the Steam Friends list and if they accept…away you go. Only the host needs to own the game too, making it easy to get going.

  • Another OpenRA preview build is up needing testing, Tiberian Sun support is coming along

    Work continues on the open source game engine OpenRA which allows you to play Command & Conquer, Red Alert and Dune 2000 on Linux and other modern platforms with support for Tiberian Sun progressing well. [...] One issue they've been dealing with is deployable units in Tiberian Sun, while OpenRA had basic support for the feature due to the Construction Yards in classic C&C it wasn't suitable for Tiberian Sun. Now though? They've overhauled it and expanded it. You can now queue up deploy commands between other orders, deployable units can be ordered to pack up and then move somewhere else as a single action too. Additionally, the code for aircraft and helicopter movement has also been given an overhaul to add in many of the extra features and dynamics needed for Banshees, Orcas, and Carryalls. The transport behaviour for the Carryall was also updated, with unit pick-up behaviour closer to the original game and allowing you to queue up multiple transport runs.

  • Devespresso Games join with Headup for Western release of The Coma 2: Vicious Sisters

    The Korean survival horror-adventure The Coma 2: Vicious Sisters from Devespresso Games is now getting a helping hand from publisher Headup for Western audiences. Also confirmed through the press emails is that The Coma 2 will be entering Steam Early Access on November 5th, with a full release expected in "Q1 2020".

  • Humble Store is doing a Female Protagonist Sale, plus the upcoming Steam sale dates leaked

    The week has only just begun and there's plenty of sales going on, with even more coming up. Let's have a little look. First up, Humble Store is doing a Female Protagonist Sale celebrating various heroines across multiple genres.

  • Kowai Sugoi Studios close up so they've made their point & click horror 'Shiver' free

    Times are tough for indies, with Kowai Sugoi Studios announcing they're closing up shop and so they've set their point and click horror title Shiver free for everyone. Kowai Sugoi Studios said in a blog post on the official site that this month they're shutting down, no reason for it was given but they gave their "sincere appreciation to our friends, family, and fans" for supporting them along the way. Shiver seems to be their only game, released originally back in 2017.