Language Selection

English French German Italian Portuguese Spanish

January 2018

today's leftovers

Filed under
Misc
  • Open Source Security Podcast: Episode 80 - GPS tracking and jamming
  • How to add a repository on your Linux machine
  • Modify SVG using GSVGtk: First Repor

    GSVGtk is a library to provide GTK+ widgets you can use to access SVG files. It is powered by GSVG, in a way it can access each shape and its properties using a GObject API based on W3C SVG 1.1 specification.

    Currently, GSVGtk uses Clutter to encapsulate SVG shapes, render them inside Clutter Actors, through librsvg, and maps events to source SVG in order to eventually modify original definitions, like its position.

    In the following video, you can see GSVGtk’s Container based on Clutter, loading an SVG file, take some shapes from it to show on the scene.

  • logo.png for default avatar for GitLab repos

    I added a logo.png to GNOME Tweaks at GNOME and it automatically showed up in Salsa when I imported the new version.

  • What’s New in Peppermint OS 8 Respin

    Peppermint OS 8 respin is the latest release of Peppermint OS Linux Distribution. This release based on Ubuntu 16.04 LTS (Xenial Xerus), powered by linux kernel 4.10 series, using LXDE desktop environment with new “Pepirus” xfwm4, GTK+ and icon themes. Also, brings 64 bit and 32 bit installation images. The 64 bit release provides complete support for UEFI systems and secure boot.

  • Imagine the world's biggest Kanban / Scrumboard

    Imagine a Kanban board that could aggregate issues from multiple backends, including your CalDAV task list, Bugzilla systems (Fedora, Mozilla, GNOME communities), Github issue lists and the Debian Bug Tracking System, visualize them together and coordinate your upstream fixes and packaging fixes in a single sprint.

    [...]

    If you'd like to see this or any of the other proposed projects go ahead, you don't need to be a Debian Developer to suggest ideas, refer a student or be a co-mentor. Many of our projects have relevance in multiple communities. Feel free to get in touch with us through the debian-outreach mailing list.

The Linux Foundation is Growing

Filed under
Linux
  • Linux Foundation fights fragmentation with network umbrella

    Open source platforms are becoming more and more fundamental to the new telecoms network architecture, raising exciting prospects for a more democratic ecosystem and rapid innovation. But open source also comes with the risk of fragmentation, which has already been seen in industry splits over different approaches to management and orchestration (MANO) in virtualized networks. A large number of open projects has emerged in the areas of virtualization, software-defined networking (SDN), MANO and even telecoms hardware initiatives like Facebook’s OpenCellular.

  • The Linux Foundation Announces 30 New Silver Members

    The Linux Foundation, the nonprofit organization enabling mass innovation through open source, announced the addition of 30 Silver members. Linux Foundation members help support development of the greatest shared technology resources in history, while accelerating their own innovation through open source leadership and participation.

Red Hat and Fedora Leftovers

Server: Microservices, Replika, STORK, OpenStack

OSS Leftovers

Filed under
OSS
  • India's RJio Plots Open Source Disruption

    Owned by Indian billionaire Mukesh Ambani, the telco believes that it is high time India developed products and services tailored specifically to the Indian market. "If you observe, a lot of effort has been put into the IT space [in India], but what has not happened is a focused effort [for innovation] in the telecom space," says Matthew Oommen, RJio's president of networks, global strategy and service development, on the sidelines of India's recent Digital Open Summit.

  • Open Source Initiative Turns 20

    The Open Source Initiative (OSI) will celebrate its 20th anniversary on Friday, Feb. 2, and the global non-profit organization dedicated to raising awareness and adoption of open source software is gonna par-tay. By which I mean, the OSI has scheduled activities around the world this year to commemorate the event. (I'm hoping there will be snacks.)

  • Swatantra17

    Last month Thiruvananthapuram witnessed one of the biggest Free and Open Source Software conference called Swatantra17. Swatantra is a flagship triennial ( actually used to be triennial, but from now on organizers decided to conduct in every 2 years.) FOSS conference from ICFOSS. This year there were more than 30 speakers from all around the world. The event held from 20-21 December at Mascot hotel, Thiruvananthapuram. I was one of the community volunteer for the event and was excited from the day it announced Smile .

  • DO or UNDO - there is no VACUUM

    To put this another way, it is in general true that PostgreSQL’s VACUUM implementation has gotten progressively better at reclaiming space occupied by dead tuples more quickly and with less expenditure of effort. And that’s really good, because the faster you reclaim space, the less new space you end up allocating, which keeps tables small and performance high. However, the examples above show that VACUUM isn’t the whole problem. In these examples, even if VACUUM ran at the earliest instant when it could reclaim the space occupied by dead tuples and ran infinitely fast, the table would still become bloated. In the case where the bloat is caused by many short queries run while one long-running transaction remains open, we could, with smarter snapshot management, limit the worst-case bloat to approximately a factor of two -- that is, we’d keep the version of the tuple visible to the old snapshot and the current version, and discard the intermediate versions, a trick PostgreSQL currently can’t manage. However, even a factor of two is a lot, and what if there are multiple distinct open snapshots?  Further, in the case where the bloat is created by a SQL statement that induces scattered updates throughout the table, no improvement to VACUUM can possibly help. By the time that SQL statement finishes, the damage is already done.

  • Scratch group projects – 2018

    Once again, it’s time for this year’s Scratch projects from my grade 10 students. Up next is python, but their final projects are available at https://scratch.lesbg.com. Feel free to play them and rate them. This is a first attempt for students, so do please be gentle on the ratings.

  • Why Create a New Unix Shell?

FSF and GNU Debugger (GDB) 8.1

Filed under
GNU
  • Free Software Foundation was gifted 91 bitcoin

    The Free Software Foundation, has announced that it received its largest donation ever, 91.45 bitcoin from an anonymous entity called Pineapple Fund. The 91.45 bitcoin, at the time of payment, was roughly equal to $1 million. The Free Software Foundation is an organisation that promotes the concept of free software, which is defined by the ‘four essential freedoms’.

  • GDB 8.1 released!

    Release 8.1 of GDB, the GNU Debugger, is now available via anonymous FTP.  GDB is a source-level debugger for Ada, C, C++, Objective-C, Pascal and many other languages.  GDB can target (i.e., debug programs running on) more than a dozen different processor architectures, and GDB itself can run on most popular GNU/Linux, Unix and Microsoft Windows variants.

  • GDB 8.1 Debugger Brings Better Rust Support, Improved Python Scripting

    Version 8.1 of the GNU Debugger (GDB) is now available for developers.

    The GDB 8.1 debugger update brings Python scripting enhancements, improved Rust language support, breakpoints on C++ functions are now set on all scopes by default, a number of new commands have been added, the GDBserver has received a few enhancements, there is better auto-completion support for this debugger, and a variety of other improvements to help developers debug their code in a variety of languages.

  • GDB 8.1 released

    Version 8.1 of the GDB debugger is out. Changes include better support for the Rust language and various other improvements to make debugging easier; see the announcement and the news file for the full list.

Security: Updates, Google, Hacking Team, Microsoft-NSA, Django

Filed under
Security
  • Security updates for Wednesday
  • How Did Google Wipe Out 700,000 Malicious Android Apps From Play Store? Using Artificial Intelligence
  • Hacking Team Is Still Alive Thanks to a Mysterious Investor From Saudi Arabia

    The 2015 breach of spyware vendor Hacking Team seemed like it should have ended the company. Hacking Team was thoroughly owned, with its once-secret list of customers, internal emails, and spyware source code leaked online for anyone to see. But nearly three years later, the company trudges on, in large part thanks to a cash influx in 2016 from a mysterious investor who had been publicly unknown until now.

    The hack hurt the company’s reputation and bottom line: Hacking Team lost customers, was struggling to make new ones, and several key employees left. Three years later—after the appearance of this new investor—the company appears to have stopped the bleeding. The company registered around $1 million in losses in 2015, but bounced back with around $600,000 in profits in 2016.

    Motherboard has learned that this apparent recovery is in part thanks to the new investor, who appears to be from Saudi Arabia—and whose lawyer’s name matches that of a prominent Saudi attorney who regularly works for the Saudi Arabian government and facilitates deals between the government and international companies.

  • NSA exploit EternalBlue is back and powering WannaMine cryptojacking malware

    SAY HELLO to WannaMine, the cryptojacking malware that's using leaked NSA hacking tools to infiltrate computers and syphon processor power to crunch calculations needed to 'mine; cryptocurrencies.

    But first a history lesson. You may remember the EternalBlue, a Windows exploit developed by the NSA that was leaked by hacking group Shadow Brokers.

    Pretty soon after the exploit was used to launch the massive WannaCry ransomware attack that locked down NHS systems and affected some 230,000 computers across 150 countries. EternalBlue was then used to spearhead the arguably more dangerous NotPetya attacks.

  • Johnny Hacker hauls out NSA-crafted Server Message Block exploits, revamps 'em

    EternalBlue, EternalSynergy, EternalRomance and EternalChampion formed part of the arsenal of NSA-developed hacking tools that were leaked by the Shadow Brokers group before they were used (in part) to mount the devastating NotPetya cyber attack.

    [...]

    "After that, the exploit module will drop to disk (or use a PowerShell command), explains zerosum0x0, and then copy directly to the hard drive."

  • 10 tips for making the Django Admin more secure

    Offloading the responsibility for making your app secure onto QA testers or an information security office is tempting, but security is everyone's responsibility. The Django Admin is one of our favorite features of Django, but unless it's locked down correctly, it presents opportunities for exploitation. To save your users from compromised data, here are 10 tips to make the Django Admin more secure.

11 Myths About the RISC-V ISA

Filed under
Hardware
OSS

Despite its rich ecosystem and growing number of real-world implementations, misconceptions about RISC-V are keeping companies around the world from fully realizing its benefits.

Read more

Mozilla: Rust, Privacy and More

Filed under
Moz/FF
  • Where’s Rust headed in 2018? Ask the community.

    2017 was a big year for the Rust systems programming language. Now, members of the open source project are looking to consolidate last year’s progress – making Rust easier to learn and use – and publish the first major update to the stable 2015 Rust release.

    “We’re making Rust a much nicer place to be,” said Aaron Turon, a Rust core team member and engineering manager at Mozilla. “We’re working to create a more productive environment for programmers – especially those new to the language.”

  • The 2018 Rust Event Lineup

    Every year there are multiple Rust events around the world, bringing together the community. Despite being early in the year, we’re excited to be able to highlight several events that are already being organized!

  • This Week in Rust 219

    Hello and welcome to another issue of This Week in Rust! Rust is a systems language pursuing the trifecta: safety, concurrency, and speed. This is a weekly summary of its progress and community. Want something mentioned? Tweet us at @ThisWeekInRust or send us a pull request. Want to get involved? We love contributions.

  • Retrospective: Looking Glass

    In December, we launched a tv show tie-in with Mr. Robot, Looking Glass, that alarmed some people because we didn’t think hard enough about the implications of shipping an add on that had the potential to be both confusing and upsetting. We’re deeply sorry for this and we understand why it’s important for us to learn and grow from this experience. As mentioned last month, we conducted a post-mortem to better understand how and why this happened and how we can do better.

  • Mozilla Reps Community: Rep of the Month – December 2017
  • Mozilla Security Blog: Preventing data leaks by stripping path information in HTTP Referrers

    To help prevent third party data leakage while browsing privately, Firefox Private Browsing Mode will remove path information from referrers sent to third parties starting in Firefox 59.

More in Tux Machines

FOSS in SaaS/Back End/Databases

  • What to expect from Scylla Summit 2019

    Scylla (the company) takes its name directly from Scylla [pronounced: sill-la], a Greek god sea monster whose mission was to haunt and torment the rocks of a narrow strait of water opposite the Charybdis whirlpool. Outside of Greek history, Scylla is an open source essentially distributed NoSQL data store that uses a sharded design on each node, meaning each CPU core handles a different subset of data.

  • Licence to grill: A year on, MongoDB's Eliot Horowitz talks to The Reg about SSPL

    A year after its controversial switch to the Server Side Public License (SSPL), and with new products livening up the summer, MongoDB remains unrepentant. The change was aimed at making vendors selling a service using the company's code share the source of applications used to run the service as well as any tweaks. The move appeared to be aimed squarely at cloud vendors, content to "capture all the value and give nothing back to the community," as Dev Ittycheria, CEO of MongoDB, told us at the time. Elements of the open source community were less than impressed. The Open Source Initiative (OSI) rejected the company's attempts to get the licence approved and eventually MongoDB withdrew the thing from the process, although the company continued to use it for its own products. Indeed, at MongoDB's London .Local event, where we met co-founder and CTO Eliot Horowitz, the company was trumpeting the opening up of its Compass GUI for MongoDB under the SSPL.

  • From Russia with OLAP: Percona uses ClickHouse analytics

    At Percona Live Europe last week, one such example came up around the open source scene that is developing in Russia and how one of the projects that is now starting to open up to international use.

  • The love and the lament: Percona CEO details state of open source data

    Open source has changed, obviously it has. Starting from its origins among the hobbyist programmers and hackers who dared to defy the proprietary Silicon Valley behemoths, the open community-centric model for software development has now been widely adopted by the commercial software sector. In many cases, open source has become the norm for modern platforms, tools and applications. But how has this affected the nature of open development and what impact has this shift left in its wake on the data landscape that we view today?

  • GraphDB 9.0 Open Sources Its Front End and Engine Plugins to Support Knowledge Graph Solutions

    Ontotext has announced GraphDB 9.0, which is aimed at lowering the effort required for development and continuous operation of knowledge graphs by opening multiple integration extension points for its users and developers. GraphDB is a database for managing semantic information with more than 30 large production installations in big enterprises. With the growing complexity of enterprise data integration, many organizations are starting the journey of building knowledge graphs.

  • Ververica Announces Open Source Framework to Enable Lightweight, Stateful Applications at Scale

    Ververica, the original creators of Apache Flink, today announced at Flink Forward Europe the launch of Stateful Functions (statefun.io), an open source framework that reduces the complexity of building and orchestrating stateful applications at scale. Stateful Functions enables users to define loosely coupled, independent functions with a low footprint that can interact consistently and reliably in a shared pool of resources. Ververica will propose the project, licensed under Apache 2.0, to the Apache Flink community as an open source contribution.

  • DataStax offers bidirectional data dexterity for Apache Kafka

    DataStax has opened up ‘early access’ to its DataStax Change Data Capture (CDC) Connector for Apache Kafka, the open source stream-processing (where applications can use multiple computational units, similar to parallel processing) software platform. As a company, DataStax offers a commercially supported ‘enterprise-robust’ database built on open source Apache Cassandra. Stream processing is all about speed and cadence, so, the DataStax CDC Connector for Apache Kafka gives developers ‘bidirectional data movement’ between DataStax, Cassandra and Kafka clusters.

Security: WireGuard, SafeBreach and More

  • WireGuard Snapshot `0.0.20191012` Available
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256
    
    Hello,
    
    A new snapshot, `0.0.20191012`, has been tagged in the git repository.
    
    Please note that this snapshot is a snapshot rather than a final
    release that is considered secure and bug-free. WireGuard is generally
    thought to be fairly stable, and most likely will not crash your
    computer (though it may).  However, as this is a snapshot, it comes
    with no guarantees; it is not applicable for CVEs.
    
    With all that said, if you'd like to test this snapshot out, there are a
    few relevant changes.
    
    == Changes ==
    
      * qemu: bump default version
      * netns: add test for failing 5.3 FIB changes
      
      Kernels 5.3.0 - 5.3.3 crash (and are probably exploitable) via this one liner:
      
      unshare -rUn sh -c 'ip link add dummy1 type dummy && ip link set dummy1 up && ip -6 route add default dev dummy1 && ip -6 rule add table main suppress_prefixlength 0 && ping -f 1234::1'
      
      We fixed this upstream here:
      
      https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=ca7a03c4175366a92cee0ccc4fec0038c3266e26
      
      This is relevant to WireGuard because a very similar sequence of commands is
      used by wg-quick(8).
      
      So, we've now added some tests to catch this code path in the future. While
      the bug here was a random old use-after-free, the test checks the general
      policy routing setup used by wg-quick(8), so that we make sure this continues
      to work with future kernels.
      
      * noise: recompare stamps after taking write lock
      
      We now recompare counters while holding a write lock.
      
      * netlink: allow preventing creation of new peers when updating
      
      This is a small enhancement for wg-dynamic, so that we can update peers
      without readding them if they've already been removed.
      
      * wg-quick: android: use Binder for setting DNS on Android 10
      
      wg-quick(8) for Android now supports Android 10 (Q). We'll be releasing a new
      version of the app for this later today.
    
    This snapshot contains commits from: Jason A. Donenfeld and Nicolas Douma.
    
    As always, the source is available at https://git.zx2c4.com/WireGuard/ and
    information about the project is available at https://www.wireguard.com/ .
    
    This snapshot is available in compressed tarball form here:
      https://git.zx2c4.com/WireGuard/snapshot/WireGuard-0.0.20191012.tar.xz
      SHA2-256: 93573193c9c1c22fde31eb1729ad428ca39da77a603a3d81561a9816ccecfa8e
      BLAKE2b-256: d7979c453201b9fb6b1ad12092515b27ea6899397637a34f46e74b52b36ddf56
    
    A PGP signature of that file decompressed is available here:
      https://git.zx2c4.com/WireGuard/snapshot/WireGuard-0.0.20191012.tar.asc
      Signing key: AB9942E6D4A4CFC3412620A749FC7012A5DE03AE
    
    If you're a snapshot package maintainer, please bump your package version. If
    you're a user, the WireGuard team welcomes any and all feedback on this latest
    snapshot.
    
    Finally, WireGuard development thrives on donations. By popular demand, we
    have a webpage for this: https://www.wireguard.com/donations/
    
    Thank you,
    Jason Donenfeld
    
  • WireGuard 0.0.20191012 Released With Latest Fixes

    WireGuard is still working on transitioning to the Linux kernel's existing crypto API as a faster approach to finally make it into the mainline kernel, but for those using the out-of-tree WireGuard secure VPN tunnel support, a new development release is available.

  • SafeBreach catches vulnerability in controversial HP Touchpoint Analytics software

    Now the feature is embroiled in another minor controversy after security researchers at SafeBreach said they uncovered a new vulnerability. HP Touchpoint Analytics comes preinstalled on many HP devices that run Windows. Every version below 4.1.4.2827 is affected by what SafeBreach found. In a blog post, SafeBreach Labs security researcher Peleg Hadar said that because the service is executed as "NT AUTHORITY\SYSTEM," it is afforded extremely powerful permissions that give it wide access. "The CVE-2019-6333 vulnerability gives attackers the ability to load and execute malicious payloads using a signed service. This ability might be abused by an attacker for different purposes such as execution and evasion, for example: Application Whitelisting Bypass Signature Validation Bypassing," Hadar wrote. [...] The company has long had to defend HP Touchpoint Analytics against critics who say it gives HP unnecessary access to users' systems. When it first became widely noticed in 2017, dozens of users complained that they had not consented to adding the system.

  • Security Tool Sprawl Reaches Tipping Point
  • How trusted digital certificates complement open source security

    Application developers incorporating open source software into their designs may only discover later that elements of this software have left them (and their customers) exposed to cyber-attacks.

  • Securing the Container Supply Chain

FOSS in Finance/Currency Leftovers

Programming Leftovers

  • Xilinx unveils open source FPGA platform

    The Vitis unified software platform from FPGA vendor Xilinx is the result of five-year project to create software development tools using familiar languages like C++ and Python to develop a wide range of applications for its reprogrammable chip.

  • Listen: How ActiveState is tackling “dependency hell” by providing enterprise-level support for open source programming languages [Podcast]

    “Open source back in the late nineties – and even throughout the 2000s – was really hard to use,” ActiveState CEO Bart Copeland says. “Our job,” he continues, “was to make it much easier for developers to use open source and much easier for enterprises to use open source.”

  • 10 open source projects proving the power of Google Go

    Now 10 years in the wild, Google’s Go programming language has certainly made a name for itself. Lightweight and quick to compile, Go has stirred significant interest due to its generous libraries and abstractions that ease the development of concurrent and distributed (read: cloud) applications. But the true measure of success of any programming language is the projects that developers create with it. Go has proven itself as a first choice for fast development of network services, software infrastructure projects, and compact and powerful tools of all kinds.

  • The Eclipse Foundation Launches The Eclipse Cloud Development Tools Working Group for Cloud Native Software

    The Eclipse Foundation today announced the launch of the Eclipse Cloud Development Tools Working Group (ECD WG), a vendor-neutral open source collaboration that will focus on development tools for and in the cloud. The ECD WG will drive the evolution and broad adoption of emerging standards for cloud-based developer tools, including language support, extensions, marketplaces, and developer workspace definition. Founding members of the ECD WG include Broadcom, EclipseSource, Ericsson, IBM, Intel, Red Hat, SAP, Software AG, and Typefox among many others.

  • You cannot cURL under pressure

    With cURL having this many features (with the general mass of them being totally unknown to me, let alone how you use them) got me thinking… What if you could do a game show style challenge for them?

  • Follow-up on ‘ASCII Transliteration without ICU or iconv’

    By an anonymous commenter, I got pointed to that Unicode (in Qt) is slightly more complicated than I had considered when writing the code: I missed to handle planes beyond the Basic Multilingual Plane (BMP) and the ‘surrogates’ between code points 0xD800 and 0xDFFF. In a series of recently pushed Git commits I addressed problem of surrogates and fixed some more issues. Some preparatory work has been done to support more planes in the future, but as of now, only the BMP is supported. For details, please have a look at the five commits posted on 2019-10-12.