today's leftovers

• OpenBSD KDE Status Report

  But today we can be happy about an up-to-date KDE stack in OpenBSD. Currently - at the end of January - our stack is very up-to-date: [...]

• Beneath the code: SUSE Enterprise Linux construction mechanics - Open Source Insider

  As every good developer knows, when you want to learn more about what a platform or tools provider is bringing through the release pipeline: ignore the news, delete the press releases, don’t look at the advertisements… read the coder blogs instead. Microsoft’s MSDN has adopted this approach for most of the last decade and it is – very arguably – where the real meat (or plant-based protein substitutes with soya-enrichment) is. Also well versed in this practice is German open source operating system softwarehaus SUSE. [...] Last but not least, Moutoussamy talks about the openSUSE community and how SUSE wants to share more than just code. “So next we will talk about some of the underlying processes glueing everything together but also about the great tool we are using: Open Build Service (build) and openQA (test),” he concludes. Can we imagine that one day, all technology vendors will talk about the way they actually build code and perform rollout cadence and express the need to balance open source community and commercial requirements in a product that still, ultimately, progresses forward year-on-year? We can dream, surely.

• Easy Version Control rollback device-tree files

  It is still a mystery to me how they work, but they are needed by the Raspberry Pi, and, as I discovered, getting the latest is important. However, with Easy Version Control, if we roll back to an older version of Easy, we should really roll back the device-tree also. Ditto when roll forward. The current device-tree files are in /boot/device-tree, which you can view in a running Easy. These are actually located inside easy.sfs. So, if roll back or forward to a different easy.sfs, then extract the device-tree files out of easy.sfs and copy them to the boot partition. That is what Easy Version Control now does. The modified scripts are /usr/local/easy_version/easy-update and easy-version-control.

• Iustin Pop: Raspbian/Raspberry PI OS with initrd

  While Raspbian, ahem, Raspberry PI OS is mostly Debian, the biggest difference is the kernel, both in terms of code and packaging. The packaging is weird since it needs to deal with the fact that there’s no bootloader per se, the firmware parses /boot/config.txt and depending on the setting of 64bit and/or kernel line, it loads a specific file. Normally, one of kernel7.img, kernel7l.img or kernel8.img. While this configuration file supports an initrd, it doesn’t have a clean way to associate an initrd with a kernel, but rather you have to (like for the actual kernel) settle on a hard-coded initrd name.

• Open-Source Apache CloudStack 4.15 Gets New Look

  The mature open-source cloud infrastructure platform project gets a major update, boasting a new user interface and improved storage subsystem features.

• Perceived Relations Between Gopher Gemini and HTTP

  This piece is written with the expectation that it will attract:

  * Those who are Gopher and Gemini enthusiasts,
  * Those who are the above and have the opinion I'm wrong,
  * Or those who have heard the two and want to know a bit more about them and their relation to the current web.

• 3 stress-free steps to tackling your task list

  In prior years, this annual series covered individual apps. This year, we are looking at all-in-one solutions in addition to strategies to help in 2021. Welcome to day 14 of 21 Days of Productivity in 2021. [...] Even then, I had to break these tasks down into smaller pieces—download the software, configure NGINX, validate the installs…you get the idea. And that's OK. A plan, or set of tasks, is not set in stone and can be changed as needed.

• Taking The Full Measure Of Power Servers - IT Jungle

  It is with that in mind that we turn to IBM’s server sales in the fourth quarter of 2020, which were reported on late last week. IBM’s overall revenues continue to slide as it shrinks and it divests itself of businesses, and even as it adds Red Hat to the mix. Sales across all product lines and geographies were off 6.5 percent to $20.37 billion, and after a $2.04 billion restructuring writeoff, net income was down by 63.1 percent to $1.36 billion. By the time IBM has spun off its NewCo managed infrastructure services business, which has about $19 billion in sales later this year, it will pare down to about $59 billion in sales for the remaining company. Overall sales of servers, storage, switching to IBM’s direct end user customers and its channel were $2.5 billion, down 17.8 percent, and internal sales of this stuff to other IBM divisions accounted for another $196 million. Total System group sales, therefore, were just under $2.7 billion, down 16.8 percent, with the hardware being $2.09 billion and operating systems being $408 million. The System group had a pre-tax income of $455 million, off 43.3 percent year on year. Not a great quarter, but there was a tough compare to the System z15 launch at the end of 2019 for one thing and a global pandemic for another. Neither Arvind Krishna, IBM’s chief executive officer, nor James Kavanaugh, the company’s chief financial officer, had much to say about the Power Systems line, although as usual they did chat a bit about the System z mainframe. Power Systems sales were off 16 percent at constant currency, and System z sales were down 24 percent, with storage down 17 percent.

• Dissecting the Apple M1 GPU, part II

  Less than a month ago, I began investigating the Apple M1 GPU in hopes of developing a free and open-source driver. This week, I’ve reached a second milestone: drawing a triangle with my own open-source code. The vertex and fragment shaders are handwritten in machine code, and I interface with the hardware via the IOKit kernel driver in an identical fashion to the system’s Metal userspace driver.

Programming Leftovers

• Period, Duration and Instant in Java

  Period, Duration and Instant are three different classes introduced since Java 8 to help us deal better with time.

• Pyston 2.1 Is Blowing Past Python 3.8/3.9 Performance

  With this past week's release of Pyston 2.1 as an alternative Python interpreter I was curious to see how the performance compared to that of upstream Python... So here are some weekend benchmarks with a Ryzen 9 5900X system. On a Ryzen 9 5900X system running Ubuntu 20.10, I ran a few Python benchmarks using its stock Python 3.8.6 installation, Python 3.9.1 as the latest upstream and built from source in an optimized mode, and then the Pyston 2.1 x86_64 Linux binary. Pyston 2.x still is (sadly) binary-only for now.

• gfldex: Chain calling

  When working with IO::Path we have to take platform dependent directory separator into account. To alleviate the problem .add was added. Surprisingly there is no candidate that takes a list. So we have to chain method calls as if we would use an inferior language.

• A Beginner’s Guide to R Programming | EC-Council Blog

  R is a free software environment for statistical computing and graphics. It is used for complex analysis such as correlation, clustering, and data reduction. Learn everything about the fundamental programming concepts in R and more.

Proprietary Software, Insecurity and DRM

• Microsoft and SAP Extend Partnership

  Microsoft and SAP have announced an extension of their existing partnership, one that will see Microsoft Teams integrated into SAP’s suite of products.

• PoC exploit available for SAP Solution Manager flaw

  A serious vulnerability in SAP Solution Manager would allow an attacker can authenticate to vulnerable systems by simply trying to connect, a local researcher has warned, adding that a proof-of-concept exploit is circulating.

• Ransomware Attackers Publish 4K Private Scottish Gov Agency Files

  On the heels of a ransomware attack against the Scottish Environmental Protection Agency (SEPA), attackers have now reportedly published more than 4,000 files stolen from the agency – including contracts and strategy documents.

  After hitting SEPA on Christmas Eve with the attack, cybercriminals encrypted 1.2GB of information. The attack has affected SEPA’s email systems, which remain offline as of Thursday, according to the agency. However, SEPA, which Scotland’s environmental regulator, stressed on Thursday that it will not “engage” with the cybercriminals.

• Discord-Stealing Malware Invades npm Packages

  The CursedGrabber Discord malware family, discovered in November, targets Windows hosts. It contains two .exe files which are invoked and executed via ‘postinstall’ scripts from the manifest file, ‘package.json’. One of the .exe files scans user profiles from multiple web browsers along with Discord leveldb files, steals Discord tokens, steals credit-card information, and sends user data via a webhook to the attacker. The second unpacks additional code with multiple capabilities, including privilege escalation, keylogging, taking screenshots, planting backdoors, accessing webcams and so on.

  In the case of the three npm packages, these “contain variations of Discord token-stealing code from the Discord malware discovered by Sonatype on numerous occasions,” said Sonatype security researcher Ax Sharma, in a Friday blog posting.

• DreamBus botnet targets enterprise apps running on Linux servers [Ed: Fear, Uncertainty, Doubt (FUD) site ZDNet continues to blame on "Linux" unpatched software that has nothing to do with Linux (and is being neglected, not patched by the system's maintainers)]

• ESPN Plus apologizes for ‘technical issue’ during UFC pay-per-view event [Ed: Digital Restrictions (DRM) at work]

  A spokesperson for Disney, which owns ESPN, said in an email to The Verge on Sunday that the company was “aware that a technical issue prevented a portion of users from accessing the early part of the ESPN+ pay-per-view event, and we apologize for that experience. We worked as quickly as possible to identify and resolve the issue.”