Language Selection

English French German Italian Portuguese Spanish

About Tux Machines

Sunday, 13 Oct 19 - Tux Machines is a community-driven public service/news site which has been around for over a decade and a half and primarily focuses on GNU/LinuxSubscribe now Syndicate content

Search This Site

Quick Roundup

Typesort icon Title Author Replies Last Post
Blog entry Some site news srlinuxx 2 01/11/2010 - 5:24pm
Blog entry PCLinuxOS KDE Full and Mini ISOS updated to 2010.11 Texstar 25/11/2010 - 2:16am
Blog entry KDE 4.5.4 now available for PCLinuxOS Texstar 02/12/2010 - 8:24pm
Blog entry gave it up srlinuxx 1 06/02/2011 - 12:14pm
Blog entry Best Hard Drives? srlinuxx 10 13/04/2011 - 6:00pm
Blog entry Damn you Kubuntu srlinuxx 1 25/01/2011 - 6:40pm
Blog entry Pandora FMS 3.2 has been released. geniususer 05/01/2011 - 5:54pm
Blog entry Printer Woes gfranken 5 19/01/2011 - 2:19am
Blog entry Happy Holidays srlinuxx 1 30/12/2010 - 5:33pm
Blog entry Enlightenment packages updated post beta 3 Texstar 27/12/2010 - 2:10am

Server: Knative, Puppet, Kubectl and EdgeX Foundry

Filed under
Server
  • Google's Keeping Knative Development Under Its Thumb 'For the Foreseeable Future'

    In addition to Knative, which is for deploying serverless workloads, Google evidently plans to keep the Kubernetes service mesh, Istio, in-house.

  • Puppet’s New Cloud Native Continuous Delivery Tool Builds on the CDF’s Tekton [Ed: It says: "The Linux Foundation, Puppet, and Red Hat are sponsors of The New Stack." Read as: we're being paid to write this article by the subject of this article.]

    Puppet has released into public beta its Project Nebula, a cloud native tool that connects a DevOps team’s existing toolset into an end-to-end, continuous delivery platform. The company aims to simplify deployment of microservices and serverless-based applications by connecting popular tools for infrastructure provisioning, application deployment, and notifications into a single, automated workflow.

    “There are a few folks in the world who believe in one tool that solves all the problems. And then there are folks who believe in best-of-breed and pulling the right tools for the right job with the right people, and the right culture,” said Matthew Young, senior director of product management at Puppet. “And we’re really going after the latter… We are not trying to replace every other tool.”

  • Kubectl and friends as a snap

    At Canonical, we build solutions to simplify the lives of our users. We want to reduce complexity, costs, and barriers to entry. When we built the Canonical Distribution of Kubernetes (CDK) and MicroK8s, we made sure it aligned with our mission. We built snaps like kubectl for various Kubernetes clients and services to ensure a harmonious ecosystem.

    From user feedback, requests and going over the exciting use cases our users and partners are experimenting with, sometimes you just need to get up and running. Kubernetes on a Raspberry Pi anyone? This is why we provide Kubernetes components such as kubectl, kubefed, kubeadm, etc. as snaps and open to use for your use cases.

  • EdgeX Foundry Organizes Its First Hackathon

    The project organized its first hackathon in Chicago to see how the retail industry leverages EdgeX Foundry to solve some of its pressing problems.

Programming: Rust, RcppArmadillo and Python

Filed under
Development
  • This Week in Rust 307
  • Nicholas Nethercote: Visualizing Rust compilation

    Speeding up the Rust compiler isn’t the only way to make a Rust project build faster. Changing the crate structure of a project can also make a big difference. The good news here is that Eric Huss has implemented an amazing tool for visualizing Rust compilation, which can be used to identify inefficient crate structures in Rust projects.

  • RcppArmadillo 0.9.800.1.0

    Another month, another Armadillo upstream release! Hence a new RcppArmadillo release arrived on CRAN earlier today, and was just shipped to Debian as well. It brings a faster solve() method and other goodies. We also switched to the (awesome) tinytest unit test frameowrk, and Min Kim made the configure.ac script more portable for the benefit of NetBSD and other non-bash users; see below for more details. One again we ran two full sets of reverse-depends checks, no issues were found, and the packages was auto-admitted similarly at CRAN after less than two hours despite there being 665 reverse depends. Impressive stuff, so a big Thank You! as always to the CRAN team.

  • Anaconda Enters a New Chapter

    Today I am excited to announce that I am stepping into the role of CEO at Anaconda. Although I am a founder of the company and have previously served as president, this marks the first time I am serving in the role of chief executive.

    The entire world is undergoing a revolution in computation and data analytics — a revolution that we helped start almost 10 years ago, at the dawn of modern data science.

    [...]

    I am very appreciative of our previous CEO Scott Collison. Under his leadership, we grew from an open-source consultancy into a true product company, put a world-class leadership team in place, and launched our enterprise machine learning platform. He made a lasting impact on our company’s evolution.

  • Emacs: The Best Python Editor?

    Finding the right code editor for Python development can be tricky. Many developers explore numerous editors as they grow and learn. To choose the right code editor, you have to start by knowing which features are important to you. Then, you can try to find editors that have those features. One of the most feature-rich editors available is Emacs.

    Emacs started in the mid-1970s as a set of macro extensions for a different code editor. It was adopted into the GNU project by Richard Stallman in the early 1980s, and GNU Emacs has been continuously maintained and developed ever since. To this day, GNU Emacs and the XEmacs variant are available on every major platform, and GNU Emacs continues to be a combatant in the Editor Wars.

Graphics Stack: FFmpeg+GPUs, Mesa 19.3

Filed under
Graphics/Benchmarks
  • Intel Adds GPU-Accelerated Memory Copy Support To FFmpeg

    Intel engineers have contributed GPU-accelerated memory copy support to FFmpeg when making use of their preferred video decode implementation.

    For those making use of Intel Quick Sync Video decode with FFmpeg, the latest development code has added GPU-accelerated memory copy support between the video and system memory.

  • Intel ANV & Radeon RADV Vulkan Drivers Tacking On More Extensions With Mesa 19.3

    There still is another month until the feature freeze for Mesa 19.3 to end out 2019 and it will be a big one.

    In addition to the continued flurry of OpenGL driver activity and bits like Zink potentially being merged, the Intel and AMD Radeon Vulkan drivers have been seeing more extension work for 19.3-devel. Here's the latest.

RK3328-based industrial SBC eases Raspbian porting

Filed under
GNU
Linux
Hardware

Novasom’s new M7+ version of its Pi-like, RK3328 based SBC-M7 board adds RS485, power over USB, an FPC connector for HDMI, and a library that lets Pi users recompile Raspbian apps for use with its industrial RASPMOOD stack.

In February, Novasom Industries launched its Linux-powered, Rockchip RK3328 based SBC-M7 single board computer, which Novasom now calls the Novasom M7, along with an SBC-M8 board based on a Snapdragon 410E. Now, Novasom has followed customer feedback to upgrade the somewhat Raspberry Pi-like Novasom M7 with a Novasom M7+ (or M7Plus) model that provides a variety of hardware and software improvements.

Read more

Programming: PyCon, Programming Exercises, Outreachy and Eclipse Foundation on IDEs

Filed under
Development
  • Financial Aid Launches for PyCon US 2020!

    The financial aid program aims to bring many folks to PyCon by limiting the maximum grant amount per person; in that way, we can offer support to more people based on individual need. The financial aid program reimburses direct travel costs including transportation, hotel, and childcare, as well as offering discounted or waived registration tickets. For complete details, see our FAQ, and contact pycon-aid@python.org with further questions.

  • 7 Reasons to Get Professional Programming Assignment Help

    Programming is one of the most popular disciplines in schools and universities, and many students learn programming languages at this point. If you are one of them, you know how complicated it can be to study programming, especially if you get a lot of other assignments from other classes.

  • Adding stateless support to vicodec

    Prior to joining Collabora, I took part in Round 17 of the Outreachy internships, which ran from December 2018 to March 2019. Outreachy is a paid, remote internship program. Its goal is to support people from groups underrepresented in tech, and help newcomers to free software and open source make their first contributions. Open to applicants around the world, Outreachy internships run twice a year.

    Once your application is approved, you must pick an open source project to make a contribution to, in hopes of being selected as an intern, and teamed with experienced mentors. You can read more about the program here.

    In my case, I was selected as an intern to work on the media subsystem of the Linux kernel, and my mentors were Helen Koike, (who is now my colleague at Collabora!) and Hans Verkuil (who works for Cisco and has been working on the media subsystem for around 15 years).

  • Eclipse Foundation Looks to Create Cloud-Based IDE Standards

    The Eclipse Foundation today announced the formation of a working group to create standards for cloud-based integrated development environments (IDEs) led by Broadcom, EclipseSource, Ericsson, IBM, Intel, Red Hat, SAP, Software AG and Typefox.

Red Hat: EPEL8, vDPA and Apache Kafka on OpenShift

Filed under
Red Hat
  • EPEL8 packages

    With the opening up of EPEL8, there’s a lot of folks looking and seeing packages they formerly used in EPEL6/7 not being available and wondering why. The reason is simple: EPEL is not a fixed exact list of packages, it’s a framework that allows interested parties to build and provide the packages they are interested in providing to the community.

    This means for a package to be in EPEL8, it requires a maintainer to step forward and explicitly ask “I’d like to maintain this in EPEL8” and then build, test and do all the other things needed to provide that package.

    The reason for this is simple: We want a high quality, maintained collection of packages. Simply building things once and never again doesn’t allow for someone fixing bugs, updating the package or adjusting it for other changes. We need a active maintainer there willing and able to do the work.

  • vDPA hands on: The proof is in the pudding

    In this post, we will set up vDPA using its DPDK framework. Since vDPA compatible HW cards are in the process of being commonly available on the market, we will work around the HW constraint by using a paravirtualized Virtio-net device in a guest as if it was a full Virtio HW offload NIC.

  • Open Banking with Microservices Architectures and Apache Kafka on OpenShift

    Last month, at OpenShift Commons Gathering Milan, Paolo Gigante and Pierluigi Sforza of Poste Italiane, showed the audience how they built a microservices based banking architecture using Apache Kafka and OpenShift. Their slides are available here. For more great in-person events like this, register for the next Commons Gathering near you! San Francisco is coming up before the end of the month, and will focus on AI/ML.

Ubuntu Core: Raspberry Pi 4 and Beyond

Filed under
Hardware
Ubuntu
  • Attaching a CPU fan to a RPi running Ubuntu Core

    When I purchased my Raspberry Pi4 I kind of expected it to operate under similar conditions as all the former Pi’s I owned …

    So I created an Ubuntu Core image for it (you can find info about this at Support for Raspberry Pi 4 on the snapcraft forum)

    Runnig lxd on this image off a USB3.1 SSD to build snap packages (it is faster than the Ubuntu Launchpad builders that are used for build.snapcraft.io, so a pretty good device for local development), I quickly noticed the device throttles a lot once it gets a little warmer, so I decided I need a fan.

  • A reference architecture for secure IoT device Management

    One of the key benefits of IoT is the ability to monitor and control connected devices remotely. This allows operators to interact with connected devices in a feedback loop, resulting in accelerated decisions. These interactions are mediated by a device management interface, which presents data in a user-friendly UI. The interface also serves as a client to remotely control devices in the field. Device management is, therefore, a key component of IoT solution stacks, with a significant impact on the ROI of such deployments.

    However, there is no one size fits all when it comes to device management solutions. IoT solutions are deployed in various contexts. The purpose, the devices, and the users involved vary from one deployment to another, even within the same industry. It is, therefore, challenging to find a ready-made device management solution perfectly suitable to any given deployment.

    Security is the critical requirement that these deployments invariably share, for it must be implemented in line with the best practices. Secure authentication and communication encryption are indispensable for the management of mission-critical device fleets.

Security: Updates, Ken Thompson's Unix Password, Microsoft Spying on Everything for 'Security', Cross Site Scripting Fix

Filed under
Security
  • Security updates for Wednesday

    Security updates have been issued by Fedora (chromium), openSUSE (rust and sqlite3), SUSE (dnsmasq, firefox, and kubernetes, patchinfo), and Ubuntu (python2.7, python3.5, python3.6, python3.7).

  • Ken Thompson's Unix password

    Somewhere around 2014 I found an /etc/passwd file in some dumps of the BSD 3 source tree, containing passwords of all the old timers such as Dennis Ritchie, Ken Thompson, Brian W. Kernighan, Steve Bourne and Bill Joy.

    Since the DES-based crypt(3) algorithm used for these hashes is well known to be weak (and limited to at most 8 characters), I thought it would be an easy target to just crack these passwords for fun.

    Well known tools for this are john and hashcat.

    Quickly, I had cracked a fair deal of these passwords, many of which were very weak. (Curiously, bwk used /.,/.,, which is easy to type on a QWERTY keyboard.)

    However, kens password eluded my cracking endeavor. Even an exhaustive search over all lower-case letters and digits took several days (back in 2014) and yielded no result. Since the algorithm was developed by Ken Thompson and Robert Morris, I wondered what’s up there. I also realized, that, compared to other password hashing schemes (such as NTLM), crypt(3) turns out to be quite a bit slower to crack (and perhaps was also less optimized).

    Did he really use uppercase letters or even special chars? (A 7-bit exhaustive search would still take over 2 years on a modern GPU.)

    The topic came up again earlier this month on The Unix Heritage Society mailing list, and I shared my results and frustration of not being able to break kens password.

  • How my application ran away and called home from Redmond

    I recently found a surprising leak vector in Windows 10 installations. We were porting our Beacon Application to Windows and for easy deployment. The plan was to create just one .exe including everything. However we found out that End Point Protection (EPP) solutions didn’t like that at all and we had to go with the MSI installer option. This is a story what happened during the .exe testing.

    I used my personal malware analysis lab for testing the application. My lab is an isolated network environment which has a whitelist based firewall rules. Whitelist firewall is needed to carefully allow specific updates and downloads. The lab already has Beacon Virtual Machine running and it has found issues in the past. All of them are fixed. So this leak was something new!

    [...]

    I researched a bit more and made educated guesses about why this happened. I managed to narrow it down to Microsoft Defender and the “Automatic sample submission” feature.

    [...]

    Microsoft Windows 10 sends all new unique binaries for further analysis to Microsoft by default. They run the executable in an environment where network connectivity is available. This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel.

  • Enrico Zini: Fixed XSS issue on debtags.debian.org

    Thanks to Moritz Naumann who found the issues and wrote a very useful report, I fixed a number of Cross Site Scripting vulnerabilities on https://debtags.debian.org.

Games: Nobodies and Steam Play Proton 4.11-7

Filed under
Gaming

NixOS 19.09 Released

Filed under
GNU
Linux
  • NixOS 19.09 released

    NixOS 19.09 “Loris” has been released, the twelfth stable release branch. See the release notes for details. You can get NixOS 19.09 ISOs and VirtualBox appliances from the download page. For information on how to upgrade from older release branches to 19.09, check out the manual section on upgrading.

  • NixOS 19.09 Released With Xfce 4.14 Packages, GNOME 3 Updates

    NixOS 19.09 ships with installer improvements so it can run with less privileges, updating to Xfce 4.14 packages for those using that desktop, better handling of different GNOME 3 services and modules, better printer handling, their VLC package now supports Google Chromecast, systemd updates, and an array of other enhancements.

BleachBit 2.3 Beta

Filed under
OSS

When your computer is getting full, BleachBit quickly frees disk space. When your information is only your business, BleachBit guards your privacy. With BleachBit you can free cache, delete cookies, clear Internet history, shred temporary files, delete logs, and discard junk you didn't know was there.

Designed for Linux and Windows systems, it wipes clean thousands of applications including Firefox, Internet Explorer, Adobe Flash, Google Chrome, Opera, Safari, and more. Beyond simply deleting files, BleachBit includes advanced features such as shredding files to prevent recovery, wiping free disk space to hide traces of files deleted by other applications, and vacuuming Firefox to make it faster. Better than free, BleachBit is open source.

Read more

Ubuntu Touch OTA-11 Now Available for Testing with Improved, Smarter Keyboard

Filed under
Ubuntu

Originally planned as a small update that was supposed to contain only some bug fixes and improvements, the Ubuntu Touch OTA-11 release appears to bring quite some enhancements for Ubuntu Phones, such as a much-improved and smarter keyboard that introduces a Dvorak keyboard layout option, improvements to the Japanese and Polish layouts, as well as a new way to edit text.

"Using this feature, you can move around your typed text, undo and redo actions, move around a text selection rectangle, and use the cut/copy/paste commands, all from the same overlay. To get started, press and hold the space bar," explained UBports. "We are still unsure about the discoverability of this feature, so stay tuned for changes that will make it even easier to find and use."

Read more

Celluloid is a really good mpv frontend for Linux

Filed under
Linux

If you are a Linux user who wants a front-end for the popular MPV video player, Celluloid may be your best bet.

I installed the application via flatpak but you can find quite a few packages linked at the official GitHub; installation instructions for flatpak are available on the same page.

Celluloid mpv frontend for Linux

The GUI of Celluloid is quite similar to most Linux apps, and quite minimal. Click on the + button in the top left corner to open a video, or drag and drop one on to the interface. You can also load a web URL to stream content directly using the player from the Open Location menu.

Read more

Beware open source vendor lock-in

Filed under
OSS

With open source having become not only mainstream but also so ubiquitous it is all but invisible, there is a real danger that open source users could find themselves in a whole new world of “open source” vendor lock-in.

That was the warning sounded by Obsidian’s Karl Fisher at the start of LinuxConf [ZA] 2019, a Linux and open source conference which marked the start of Open Source Week in South Africa this week.

Fisher took the delegates, mainly open source aficionados and developers, though a potted evolutionary history of open source – from the days when it was disparaged by Microsoft founder Bill Gates, and later his successor as CEO Steve Ballmer who infamously dubbed Linux a 'cancer'; to Microsoft’s recent, multi-billion dollar acquisition of GitHub, the world’s largest open source code hosting platform.

Read more

Android Leftovers

Filed under
Android

The Mitigation Impact Difference On AMD Ryzen 9 3900X vs. Intel Core i9 9900K Performance

Filed under
Graphics/Benchmarks

Last week I shared benchmark results of the AMD Ryzen 9 3900X vs. Intel Core i9 9900K in 400+ benchmarks in the largest comparison ever for these two competing ~$500 USD processors. If that wasn't enough, I repeated the hundreds of CPU/system benchmarks again but without any of the recent CPU security mitigations in place to see how the situation would have played out pre-2018.

Immediately following those tests last week, I restarted the large benchmark queue with the 300+ system/CPU tests (foregoing the gaming benchmarks with the various CPU speculative execution vulnerabilities having little impact on gaming/graphics performance). As a reminder, both the Intel and AMD systems were tested on Ubuntu 19.10 with the Linux 5.3 kernel and all of the other latest software components for this H2'2019 update to Ubuntu Linux.

The Core i9 9900K was running with the ASUS PRIME Z390-A motherboard and the Ryzen 9 3900X with the ROG CROSHAIR VIII HERO WiFi motherboard, both boards using their very latest public BIOS releases as of testing. Both systems were tested with the same GSKILL 2 x 8GB DDR4-3600 memory, 280GB Intel Optane 900p NVMe SSD, and Radeon RX Vega 64 graphics card.

Read more

Syndicate content

More in Tux Machines

OSS Leftovers

  • New Vector to scale open-source alternative to WhatsApp and Slack, where users own their data

    New Vector has announced $8.5 million in funding to scale its open-source, secure communication network, a bid to revolutionise data privacy and ownership in the messaging app space. The investments come from European VCs who specialize in enterprise tech: Notion Capital, Dawn and firstminute capital. Necessary for understanding New Vector’s business is to first understand Matrix. Matrix is an open-source project, building a global network for decentralised communication. Users can collaborate securely via end-to-end encryption, and notably, they retain all ownership and control over their data.

  • New Vector raises $8.5 million to develop an open source Slack and WhatsApp

    Tech giants like Facebook, Google, Apple, and Microsoft needn’t be gatekeepers to communication. That’s the idea upon which Matrix, an open standard and decentralized protocol for real-time communication, was formulated. It’s designed to allow users of one service provider to communicate with users of different providers via online chat, voice over IP, and videotelephony, ideally as seamlessly as SMTP (Simple Mail Transfer Protocol) facilitates email exchanges across clients and services. Implementing the Matrix protocol at scale requires infrastructure and technical expertise, however — and that’s where startups like New Vector have carved out a niche for themselves. In a little over two years, the startup has helped to grow the Matrix network 400% to 11 million users across 40,000 deployments, including French and U.S. government agencies, Wikipedia parent Wikimedia, KDE, RedHat, and more.

  • Paris uses open source to get closer to the citizen

    Around 35 per cent of Paris’ 1,000 IT applications are Lutece-driven and 15 per cent are based on other open-source software, with the remaining 50 per cent using proprietary systems. As applications are upgraded or new ones added, Lutece and open-source tools will be deployed as much as possible, Lanouar said, noting that this approach enables greater autonomy and agility for the City, as well as the ability to be more transparent and create a better user experience for the citizen.

  • After Dallas County's TechShare software failure, the future must be open source

    There has been plenty of coverage of the very expensive failures of TechShare, Dallas County's attempt to create case-tracking software that could be used in any Texas criminal court. Like many battles over operations-level issues, it is easy to miss the forest for the trees. One basic principle of good governing was flagrantly violated in this instance: Government shouldn't be involved in a for-profit operation. TechShare's leadership sought profit, rather than to merely recoup costs. I hope members of both parties can agree this is a principle we should consciously adopt. A public discussion will help avoid future misadventures that cost the county $30 million for a hot plate of nothing. The term "crony capitalism" gets tossed around a lot, and it sometimes unfairly tarnishes good models of public-private partnerships. Crony capitalism usually means the government gives preference to certain favored private firms without seeking the best price (or quality) for a service or good. That preference is odious because it denies taxpayers the best price. Crony capitalism props up firms that would otherwise fail, using taxpayer money as insurance.

  • AI Researchers' Open-Source Model Explanation Toolkit AllenNLP Interpret

    Although the techniques are generic, AllenNLP Interpret is intended for use in NLP. Inputs to NLP systems are strings of text, usually sentences or whole documents, and the text is parsed into its constituent words or tokens. AllenNLP Interpret includes saliency maps that show each token's contribution to the model prediction; a use case for this might be explaining which words in a sentence caused its sentiment to be classified as positive or negative. The toolkit also includes two adversarial methods that show how changing the tokens in the input could affect the output. The first, HotFlip, replaces the input word that has the highest gradient with other words until the model output changes. The other attack, input reduction, iteratively removes the word with the smallest gradient without changing the output; this results in input texts that are "usually nonsensical but cause high confidence predictions."

  • The best open source software of 2019
  • InfoWorld Identifies the Most Innovative Products Available to Developers, Data Analysts, and IT Organizations

    InfoWorld — the technology media brand committed to keeping IT decision-makers ahead of the technology curve — announces the winners of its 2019 Best of Open Source Software Awards, better known as the Bossies. The annual Bossie awards recognize the most important and innovative open source projects for businesses and the IT professionals who serve them. The 26 winners in this year’s Bossie Awards are the next-generation tools and technologies that are enabling digital transformation, allowing businesses to succeed and IT organizations to excel at a time when the technology is more complex than ever.

  • Open Source Rules the World

    Not too long ago I attended Linux Foundation’s Open Source Summit in San Diego, and this declaration of world dominance (tongue in cheek) was a fairly prominent refrain throughout. From best practices in OS development to emerging technologies to getting started—how to create an open source strategy, sustain it, and the right path to developing an Open Source Program Office (OSPO). All open source all the time. What became abundantly clear to me through the cacophony of voices representing developers, technologists and enthusiasts is that at the center of all that is open source are three key components critical to ultimate success (however you define it): people, processes, and technology. [...] The entire tech space is being redesigned by a digital transformation and the emergence of new open source technology platforms. It’s a revolution of sorts, led by groundbreaking innovations in machine learning, open source IoT, cyber security, virtual reality, big data analytics, blockchain and open source development tools. Additionally, there’s technology to help you know what’s in your code and automate the detection and remediation of license compliance and security issues in your DevOps life cycle.

  • Extreme Networks Transitions StackStorm to the Linux Foundation

    Extreme Networks, Inc. (EXTR) today announced it has turned governance of StackStorm™ platform, its popular open-source workflow automation platform, over to The Linux Foundation. In making this transition, Extreme expects the Foundation's open source community to accelerate development and adoption of the platform so enterprises everywhere can reap the benefits of new applications and use cases.

  • ExpressionEngine Under New Ownership, Will Remain Open Source for Now

    EllisLab founder Rick Ellis announced yesterday that ExpressionEngine has been acquired by Packet Tide, the parent company of EEHarbor, one of the most successful EE add-on providers and development agencies in the community. A year ago EllisLab, the developers of EE core, was acquired by Digital Locations but Ellis said the company ended up not being a good fit for the future of the CMS...

  • Open Source Seed, a Hoax or a Wake-Up Call?

    “Open source” is a trend in various industries. It started to take root in the software industry (Mozilla), followed by biotechnology (CAMBIA) and publishing, where the creative commons concepts have taken root. Several of these trends are based in an opposition against corporate power generated by exclusive rights provided by patents and copyright. Others have a positive goal, i.e. to enhance participation by a much wider population to generate, validate and share information (e.g. Wikipedia). The seed sector has a very good story to tell with regard to its contributions to societal goals, but in parts of society, the corporate image and the use of patents create questions, so we could expect that also our sector would be challenged. It is there now. The University of Wisconsin developed an Open Source Seed Initiative several years ago, which was followed in Germany more recently. Access to “freed” plant genetic resources is made conditional to users making them available under the same “open source” conditions – that no IP is vested. The system should thus go “viral” and “force” breeders to join and thus stop protecting their products through IP.

  • Satellite images and open-source programs for mapping during disasters

    A few weeks ago, the states of Assam and Bihar were reeling under floods. Over 200 people were reported dead, with at least 10 million (one crore) of the states’ residents estimated to have been displaced. To save more lives and prevent further infrastructural damage, search and rescue missions during such disasters need to be effective, and more importantly, need to be rapid. The answer to this may lie in space. Open-source access to satellite images and new technologies to process these images have been a significant breakthrough to help document the true extent of flooding. Getting this information in time is key to plan and conduct evacuation missions, response operations and damage assessments. The European Space Agency (ESA)’s Sentinel-1 mission and the web-based Google Earth Engine (GEE) platform are two recent developments that have helped timely capture and analysis of satellite information. A research team from the Indian Institute for Human Settlements (IIHS) used this combination (Sentinel and GEE) to come up with an illustrative example of how such mapping can be used in the future to help in rescue missions, through accurate mapping of flood extents.

Events: Fibre Optic Conference, All Things Open and HacktoberFest

  • Andile Ngcaba urges embracing open source

    Given the growth of data and the Internet of things, insofar as data is concerned, the fibre industry must adopt open source architecture in terms of designing and building networks. This is the sentiment shared by Andile Ngcaba, president of the FTTx Council Africa, at the annual Fibre Optic Conference that kicked-off at the Sandton Convention Centre yesterday. Ngcaba was speaking about the future of the industry and how to be part of it, pointing out that modern businesses are being built on open source, while modern telcos are going to be built on open source.

  • All Things Open: The ‘hidden tech gem in the Triangle’ that draws thousands

    In its seventh year, All Things Open is preparing for more than 5,000 attendees. The conference will feature more than 250 talks from some of the top technologists and decision-makers discussing open source technology during three days of programming at the Raleigh Convention Center.

  • Six reasons why you should attend All Things Open in Raleigh

    Haven’t decided whether to attend the All Things Open conference in Raleigh? Well, Open Source is growing more important in technology so you might want to keep an open mind about attending. And more than 4,500 people are already scheduled to attend. Action begins Sunday.

  • Tech Village Hosting HacktoberFest Open-Source Meetup This Weekend

    The event will be hosted in Bulawayo in the 1st floor of the NetOne Building, Corner Fife Street and L.Takawira. Opposite Central Police Station. Maintainers -the guys/girls who build source code into a binary package for distribution, commit patches, or organize code in a source repository– will be present to help out would-be contributors to help move open-source projects forward.

FOSS in SaaS/Back End/Databases

  • What to expect from Scylla Summit 2019

    Scylla (the company) takes its name directly from Scylla [pronounced: sill-la], a Greek god sea monster whose mission was to haunt and torment the rocks of a narrow strait of water opposite the Charybdis whirlpool. Outside of Greek history, Scylla is an open source essentially distributed NoSQL data store that uses a sharded design on each node, meaning each CPU core handles a different subset of data.

  • Licence to grill: A year on, MongoDB's Eliot Horowitz talks to The Reg about SSPL

    A year after its controversial switch to the Server Side Public License (SSPL), and with new products livening up the summer, MongoDB remains unrepentant. The change was aimed at making vendors selling a service using the company's code share the source of applications used to run the service as well as any tweaks. The move appeared to be aimed squarely at cloud vendors, content to "capture all the value and give nothing back to the community," as Dev Ittycheria, CEO of MongoDB, told us at the time. Elements of the open source community were less than impressed. The Open Source Initiative (OSI) rejected the company's attempts to get the licence approved and eventually MongoDB withdrew the thing from the process, although the company continued to use it for its own products. Indeed, at MongoDB's London .Local event, where we met co-founder and CTO Eliot Horowitz, the company was trumpeting the opening up of its Compass GUI for MongoDB under the SSPL.

  • From Russia with OLAP: Percona uses ClickHouse analytics

    At Percona Live Europe last week, one such example came up around the open source scene that is developing in Russia and how one of the projects that is now starting to open up to international use.

  • The love and the lament: Percona CEO details state of open source data

    Open source has changed, obviously it has. Starting from its origins among the hobbyist programmers and hackers who dared to defy the proprietary Silicon Valley behemoths, the open community-centric model for software development has now been widely adopted by the commercial software sector. In many cases, open source has become the norm for modern platforms, tools and applications. But how has this affected the nature of open development and what impact has this shift left in its wake on the data landscape that we view today?

  • GraphDB 9.0 Open Sources Its Front End and Engine Plugins to Support Knowledge Graph Solutions

    Ontotext has announced GraphDB 9.0, which is aimed at lowering the effort required for development and continuous operation of knowledge graphs by opening multiple integration extension points for its users and developers. GraphDB is a database for managing semantic information with more than 30 large production installations in big enterprises. With the growing complexity of enterprise data integration, many organizations are starting the journey of building knowledge graphs.

  • Ververica Announces Open Source Framework to Enable Lightweight, Stateful Applications at Scale

    Ververica, the original creators of Apache Flink, today announced at Flink Forward Europe the launch of Stateful Functions (statefun.io), an open source framework that reduces the complexity of building and orchestrating stateful applications at scale. Stateful Functions enables users to define loosely coupled, independent functions with a low footprint that can interact consistently and reliably in a shared pool of resources. Ververica will propose the project, licensed under Apache 2.0, to the Apache Flink community as an open source contribution.

  • DataStax offers bidirectional data dexterity for Apache Kafka

    DataStax has opened up ‘early access’ to its DataStax Change Data Capture (CDC) Connector for Apache Kafka, the open source stream-processing (where applications can use multiple computational units, similar to parallel processing) software platform. As a company, DataStax offers a commercially supported ‘enterprise-robust’ database built on open source Apache Cassandra. Stream processing is all about speed and cadence, so, the DataStax CDC Connector for Apache Kafka gives developers ‘bidirectional data movement’ between DataStax, Cassandra and Kafka clusters.

Security: WireGuard, SafeBreach and More

  • WireGuard Snapshot `0.0.20191012` Available
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256
    
    Hello,
    
    A new snapshot, `0.0.20191012`, has been tagged in the git repository.
    
    Please note that this snapshot is a snapshot rather than a final
    release that is considered secure and bug-free. WireGuard is generally
    thought to be fairly stable, and most likely will not crash your
    computer (though it may).  However, as this is a snapshot, it comes
    with no guarantees; it is not applicable for CVEs.
    
    With all that said, if you'd like to test this snapshot out, there are a
    few relevant changes.
    
    == Changes ==
    
      * qemu: bump default version
      * netns: add test for failing 5.3 FIB changes
      
      Kernels 5.3.0 - 5.3.3 crash (and are probably exploitable) via this one liner:
      
      unshare -rUn sh -c 'ip link add dummy1 type dummy && ip link set dummy1 up && ip -6 route add default dev dummy1 && ip -6 rule add table main suppress_prefixlength 0 && ping -f 1234::1'
      
      We fixed this upstream here:
      
      https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=ca7a03c4175366a92cee0ccc4fec0038c3266e26
      
      This is relevant to WireGuard because a very similar sequence of commands is
      used by wg-quick(8).
      
      So, we've now added some tests to catch this code path in the future. While
      the bug here was a random old use-after-free, the test checks the general
      policy routing setup used by wg-quick(8), so that we make sure this continues
      to work with future kernels.
      
      * noise: recompare stamps after taking write lock
      
      We now recompare counters while holding a write lock.
      
      * netlink: allow preventing creation of new peers when updating
      
      This is a small enhancement for wg-dynamic, so that we can update peers
      without readding them if they've already been removed.
      
      * wg-quick: android: use Binder for setting DNS on Android 10
      
      wg-quick(8) for Android now supports Android 10 (Q). We'll be releasing a new
      version of the app for this later today.
    
    This snapshot contains commits from: Jason A. Donenfeld and Nicolas Douma.
    
    As always, the source is available at https://git.zx2c4.com/WireGuard/ and
    information about the project is available at https://www.wireguard.com/ .
    
    This snapshot is available in compressed tarball form here:
      https://git.zx2c4.com/WireGuard/snapshot/WireGuard-0.0.20191012.tar.xz
      SHA2-256: 93573193c9c1c22fde31eb1729ad428ca39da77a603a3d81561a9816ccecfa8e
      BLAKE2b-256: d7979c453201b9fb6b1ad12092515b27ea6899397637a34f46e74b52b36ddf56
    
    A PGP signature of that file decompressed is available here:
      https://git.zx2c4.com/WireGuard/snapshot/WireGuard-0.0.20191012.tar.asc
      Signing key: AB9942E6D4A4CFC3412620A749FC7012A5DE03AE
    
    If you're a snapshot package maintainer, please bump your package version. If
    you're a user, the WireGuard team welcomes any and all feedback on this latest
    snapshot.
    
    Finally, WireGuard development thrives on donations. By popular demand, we
    have a webpage for this: https://www.wireguard.com/donations/
    
    Thank you,
    Jason Donenfeld
    
  • WireGuard 0.0.20191012 Released With Latest Fixes

    WireGuard is still working on transitioning to the Linux kernel's existing crypto API as a faster approach to finally make it into the mainline kernel, but for those using the out-of-tree WireGuard secure VPN tunnel support, a new development release is available.

  • SafeBreach catches vulnerability in controversial HP Touchpoint Analytics software

    Now the feature is embroiled in another minor controversy after security researchers at SafeBreach said they uncovered a new vulnerability. HP Touchpoint Analytics comes preinstalled on many HP devices that run Windows. Every version below 4.1.4.2827 is affected by what SafeBreach found. In a blog post, SafeBreach Labs security researcher Peleg Hadar said that because the service is executed as "NT AUTHORITY\SYSTEM," it is afforded extremely powerful permissions that give it wide access. "The CVE-2019-6333 vulnerability gives attackers the ability to load and execute malicious payloads using a signed service. This ability might be abused by an attacker for different purposes such as execution and evasion, for example: Application Whitelisting Bypass Signature Validation Bypassing," Hadar wrote. [...] The company has long had to defend HP Touchpoint Analytics against critics who say it gives HP unnecessary access to users' systems. When it first became widely noticed in 2017, dozens of users complained that they had not consented to adding the system.

  • Security Tool Sprawl Reaches Tipping Point
  • How trusted digital certificates complement open source security

    Application developers incorporating open source software into their designs may only discover later that elements of this software have left them (and their customers) exposed to cyber-attacks.

  • Securing the Container Supply Chain