today's leftovers

• Kernel Electric-Fence: Linux 5.12 Merges KFence For Low-Overhead Memory Safety Feature

  Linus Torvalds just merged a set of patches that includes KFence. Short for the Kernel Electric Fence, KFence is a low-overhead memory safety error detector/validator that is suitable for use in production kernel builds. While there has long been KASAN as the Kernel Address Sanitizer for a dynamic memory error detector for discovering use-after-free and out-of-bounds bugs within the Linux kernel, KFence aims to provide a lower-overhead solution.

• FOSS, Mentorship, and Doing Great Work

  Katherine Druckman and Doc Searls talk to Travis Carden and Petros Koutoupis about maintaining open source projects, mentoring contributors, Drupal, and automated testing.

• Tailwind does not support pseudo-elements

  This week I came across another tricky part of Tailwind, pseudo-elements. But what if you want to use them? What are pseudo-elements anyway? Pseudo-elements are HTML elements that do not exist in the HTML markup at all. Such elements won’t be visible to the browser assistive technology, they can only be styled visually with CSS. It’s quite common to define the :before and :after pseudo-elements that style a non-existing element in position relative to the element at hand. People use it for typography or drawing to keep markup clean and tidy. A lot of times, they are used in code pens to showcase some advanced CSS.

• Spidermonkey Development Blog: SpiderMonkey Newsletter 9 (Firefox 86-87)

  SpiderMonkey is the JavaScript engine used in Mozilla Firefox. This newsletter gives an overview of the JavaScript and WebAssembly work we’ve done as part of the Firefox 86 and 87 Nightly release cycles.

• Patterns

  The biggest value in design patterns is that it gives us a common language for talking about software and how it’s organized. That’s why Alexander named one of his books A Pattern Language. We’ve all spent hours making diagrams on black- or white-boards to show how some software we’re writing is organized. Design patterns give a common vocabulary so that we can discuss software with some certainty that we all mean the same thing. I eventually realized that UML had the same aim: UML diagrams are like architectural blueprints, in which one kind of line represents a brick wall, another wood, another plasterboard. Unfortunately, UML was never quite standard enough, and like design patterns, was perceived as a good in itself. In the end, a common vocabulary (whether a pattern catalog or UML) is a tool, and any tool can be abused.

• QtQuick3D instanced rendering

  Using this new instancing feature on my development machine, QtQuick3D can render one million cubes at 60 frames per second (FPS), using only 2% CPU time. The same scene recreated with the API in Qt 6.0, using Repeater3D to generate cubes, starts to struggle at ten thousand cubes: only managing 42 FPS and using 100% of the CPU.

• Using the Display Posts plugin with WordPress and custom CSS

  My goal when I refactored the site (once again) using WordPress was to focus more on writing than fiddling. I mean, yes, this was a tiny bit fiddly, but I could have spent quite a bit of time trying to code this up myself. Especially since coding isn’t my thing. Instead, a few “off-the-shelf” open source bits and I’m in business.

• EDB tries to crowbar graph, JSON, and time-series data models into PostgreSQL – but can they pull it off?

  EDB, a prominant backer of the PostgreSQL open-source database, expects to focus on graph, JSON, and time-series data in the upcoming autumn release. Analysts, however, are sceptical about its ability to optimise for different data models ahead of built for purpose databases. Last week, EDB announced a 59 per cent increase in annual recurring revenue, although being privately held it can pick and choose which financial metrics to release. Its team has grown by nearly half, to 300, however that is dwarfed by comparable open-source-supporting firms like Red Hat, with 13,000 employees.

• 30 Years of Browsers: A Quick History [Ed: Mostly glosses over Microsoft crimes in that area, as might be expected from IDG]

  It didn’t take long for Internet Explorer (IE) to win over most internet users, but that did attract the attention of the US government, which brought antitrust charges against Microsoft for its practice of preventing computer manufacturers from uninstalling IE and installing other browsers. The case was finally settled in 2001, but IE had three more years of being the preeminent browser ahead of it, peaking at 95% of the market in 2003.

• Michael Meeks: 2021-02-26 Friday

  Finally got around to posting my FOSDEM slides, first an update for the Collaboration dev-room on integrating

• FOSDEM 2021: Building massive virtual communities in Matrix

  Matthew, the open source lead for the Matrix project, held a 48 minutes long lecture on Matrix, a open protocol communications system with encrypted chat, chatrooms and more, at FOSDEM 2021. The video is worth watching if you are curious to learn how Matrix works, what their future plans are for shared spaces and other features, and the practical use-cases it can solve for you and your organization.

• New Affiliate Member Joins OSI: The TeX Users Group

  The TeX Users Group (TUG) is new to the OSI Affiliate program, but not new to the world. It's a membership-based not-for-profit that was founded in 1980 to encourage and expand the use of TeX, LaTeX, Metafont and related systems. TUG fosters innovation while maintaining the usability of these systems. TUG also supports users by hosting an annual event, maintaining a list of active local TeX user groups and publishing a regular journal called TUGboat three times a year. The OSI loves to let folks know about open source tools that they could be using like the TeX, LaTeX and Metafont systems for preparing documents. TUG is for anyone who uses the TeX typesetting system created by Donald Knuth and/or is interested in typography and font design. If you want to install TeX on your computer, please consult the resources mentioned on the TUG home page.

• Release notes for the Genode OS Framework 21.02

  Genode 21.02 stays close to the plan laid out on our road map, featuring a healthy dose of optimizations, extends the framework's ARM SoC options, and introduces three longed-for new features. First, we extended our concept of pluggable device drivers to all network drivers, including Ethernet and Wifi. As reported in Section Pluggable network device drivers, such drivers can now gracefully be started, restarted, removed, and updated at runtime without disrupting network-application stacks. Second, the release features the infrastructure needed for mobile-data communication over LTE, which is a prerequisite for our ambition to use Genode on the Pinephone. Section LTE modem stack gives insights into the involved components and the architecture. Third, we are happy to feature the initial version of VirtualBox 6 for Genode. Section VirtualBox 6.1.14 gives an overview of the already supported feature set and the outlook to reach feature-parity to our version of VirtualBox 5 soon. Speaking of VirtualBox in general (both versions), we were able to significantly improve the USB-device pass-through abilities, specifically covering audio headsets. Further noteworthy improvements of the current release range from added VirtIO-block device support for virtual machines on ARM (Section VirtIO block devices for virtual machines on ARM), revived developments on RISC-V (Section RISC-V), over VFS support for named pipes (Section VFS support for named pipes), to streamlined tooling (Section Build system and tools).

• Genode OS Framework 21.02 Adds LTE Data Support, More RISC-V Work

  Genode OS 21.02 is out as the latest feature release to this open-source operating system framework.

• The Apache News Round-up: week ending 26 February 2021

  Farewell, February --we're wrapping up the month with another great week. Here are the latest updates on the Apache community's activities...

• West: Post-Spectre web development

  Mike West has posted a detailed exploration of what is really required to protect sensitive information in web applications from speculative-execution exploits. "Spectre-like side-channel attacks inexorably lead to a model in which active web content (JavaScript, WASM, probably CSS if we tried hard enough, and so on) can read any and all data which has entered the address space of the process which hosts it. While this has deep implications for user agent implementations' internal hardening strategies (stack canaries, ASLR, etc), here we’ll remain focused on the core implication at the web platform level, which is both simple and profound: any data which flows into a process hosting a given origin is legible to that origin. We must design accordingly."

• What Is the Shellshock Bug and Is It Still a Risk? [Ed: Borrowing old FUD to keep the scare. 2014 called. It wants is news back.]

  Like most security bugs, Shellshock took the internet by a storm in 2014 and compromised millions of accounts. This deadly bug originates from the Bash (Bourne Again Shell) which is the default command-line interface on all Linux, Unix, and Mac-based operating systems. The Shellshock vulnerability was first detected some 30 years ago but was not classified as an official and public threat until September of 2014. Even with the passage of time and numerous patches, this bug still remains a threat to enterprise security.

• Five Tips For Life Sciences Companies To Protect Their AI Technologies [Ed: Some habitual copyleft FUD]

  Though they come in all shapes and flavors, open source licenses can generally be characterized into two groups: (1) permissive open source licenses, and (2) copyleft open source licenses. A permissive open source license (e.g., the MIT license) makes software code available for free to a user, but does not place significant restrictions on how the code must be used. Importantly, this means the user of code under a permissive open source license can combine the code with its own proprietary code and be under no obligation to disclose or license the combined code. Conversely, copyleft licenses (e.g., the General Public License (GPL)) also make software code available for free, but require that any modified code be licensed under the same terms. Therefore, if the copyleft licensed code is combined with proprietary code, the user may be required to make its proprietary code publicly available for free as well. Obviously, this is not a good outcome for a company desiring to keep its AI software secret. To avoid this negative outcome, companies should incorporate good hygiene around their use of open source software and implement policies and procedures to ensure that no source code is used that could jeopardize the secrecy of the company’s proprietary code.

Devices: Spectrogram and Boards With (Optional) Linux

• Spectrogram Drawing For Fun And Coding | Hackaday

  The code is a bit slow so writes its values to a file which is output by a HackRF, but it could just as easily be used by any other capable output device such as GNU Radio and a soundcard if you too want an Aphex Twin moment.

• Fanless Coffee Lake computer targets testing and analysis

  No OS support was listed for the Neu-X302, but the Neu-X300 runs Linux or Win 10. The new Coffee Lake Refresh options range up to the octa-core, 1.8GHz/2.2GHz Core i7-9100TE with 35W TDP. Once again, there is a choice of Intel Q370 or Intel H310 I/O chipsets, creating two SKUs. However, there are fewer feature differences.

• Arm-based IoT gateway reaches out with WiFi, Bluetooth, LTE, and NB-IoT

  Aaeon’s compact “SRG-3352C” IoT gateway is equipped with a TI AM3352, 3x USB, 2x RS-485, 2x GbE, WiFi/BT, mini-PCIe with micro-SIM, and an NB-IoT connector. It’s always a bit troubling when vendors omit the name of an embedded system’s processor. However, Aaeon’s fanless SRG-3352C Compact Edge IoT Gateway System, which is said to be based on an 800MHz, Cortex-A8 SoC, gives away the mystery in its name: the IoT gateway no doubt features the aging TI Sitara AM3352. No OS support was listed but given the AM3352 — the lowest end model in the AM335x line, with no 3D GPU or PRU-ICSS cores — Linux is almost certainly supported.

• Embedded Artists launches 1GHz NXP i.MX RT1176 Crossover MCU module and devkit

  Anders Rosvall, CTO at Embedded Artists AB, explains the i.MX RT1176 uCOM board “enables customers to move up to application-level performance without having to move to the Linux world”, and provides an update from the company’s iMX RT1064 uCOM with double the SDRAM, MIPI-DSI interface, and a 2D graphics engine. In case you wonder why a company would not want to move their application to a Linux platform, reasons include code reuse, faster real-time responsiveness, and lower power consumption.

• Cortex-A7 module debuts with optional Pico-ITX carrier

  DH unveiled a “DHCOM STM32MP1” module that runs Linux on ST’s Cortex-A7/M4 SoC with up to 1GB RAM, 16GB eMMC, and WiFi/BT. “DH PicoITX2” and “DH PDK” carriers are also available.

Good News! De-Googled /e/OS Smartphones is Now Shipping to the US and Canada

The de-googled Android fork /e/OS is a passionate step towards removing Google from your daily driver (i.e. your smartphone). Considering they’re also working on a privacy-friendly Siri alternative, /e/OS is particularly an exciting pitch for the future smartphones without relying on Google. While /e/ smartphones have been around for a while, it still is not tailored for everyone depending on various requirements for daily activities that you do on a smartphone. I’d suggest doing your research before making a purchase. However, there’s good news that /e/ smartphones will now also be shipping to the USA and Canada.